418 files changed, 17055 insertions, 8204 deletions

diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index 5704ed9c3a23..9d010a09ab98 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -38,9 +38,9 @@ struct vlan_info {
 static inline unsigned int vlan_proto_idx(__be16 proto)
 {
         switch (proto) {
-        case __constant_htons(ETH_P_8021Q):
+        case htons(ETH_P_8021Q):
                 return VLAN_PROTO_8021Q;
-        case __constant_htons(ETH_P_8021AD):
+        case htons(ETH_P_8021AD):
                 return VLAN_PROTO_8021AD;
         default:
                 BUG();
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 6ee48aac776f..3c32bd257b73 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -22,11 +22,11 @@ bool vlan_do_receive(struct sk_buff **skbp)
                 return false;
 
         skb->dev = vlan_dev;
-        if (skb->pkt_type == PACKET_OTHERHOST) {
+        if (unlikely(skb->pkt_type == PACKET_OTHERHOST)) {
                 /* Our lower layer thinks this is not local, let's make sure.
                  * This allows the VLAN to have a different MAC than the
                  * underlying device, and still route correctly. */
-                if (ether_addr_equal(eth_hdr(skb)->h_dest, vlan_dev->dev_addr))
+                if (ether_addr_equal_64bits(eth_hdr(skb)->h_dest, vlan_dev->dev_addr))
                         skb->pkt_type = PACKET_HOST;
         }
 
@@ -106,6 +106,12 @@ u16 vlan_dev_vlan_id(const struct net_device *dev)
 }
 EXPORT_SYMBOL(vlan_dev_vlan_id);
 
+__be16 vlan_dev_vlan_proto(const struct net_device *dev)
+{
+        return vlan_dev_priv(dev)->vlan_proto;
+}
+EXPORT_SYMBOL(vlan_dev_vlan_proto);
+
 static struct sk_buff *vlan_reorder_header(struct sk_buff *skb)
 {
         if (skb_cow(skb, skb_headroom(skb)) < 0)
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 27bfe2f8e2de..6f142f03716d 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -559,7 +559,7 @@ static const struct net_device_ops vlan_netdev_ops;
 static int vlan_dev_init(struct net_device *dev)
 {
         struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
-        int subclass = 0, i;
+        int subclass = 0;
 
         netif_carrier_off(dev);
 
@@ -613,17 +613,10 @@ static int vlan_dev_init(struct net_device *dev)
 
         vlan_dev_set_lockdep_class(dev, subclass);
 
-        vlan_dev_priv(dev)->vlan_pcpu_stats = alloc_percpu(struct vlan_pcpu_stats);
+        vlan_dev_priv(dev)->vlan_pcpu_stats = netdev_alloc_pcpu_stats(struct vlan_pcpu_stats);
         if (!vlan_dev_priv(dev)->vlan_pcpu_stats)
                 return -ENOMEM;
 
-        for_each_possible_cpu(i) {
-                struct vlan_pcpu_stats *vlan_stat;
-                vlan_stat = per_cpu_ptr(vlan_dev_priv(dev)->vlan_pcpu_stats, i);
-                u64_stats_init(&vlan_stat->syncp);
-        }
-
-
         return 0;
 }
 
@@ -689,13 +682,13 @@ static struct rtnl_link_stats64 *vlan_dev_get_stats64(struct net_device *dev, st
 
                         p = per_cpu_ptr(vlan_dev_priv(dev)->vlan_pcpu_stats, i);
                         do {
-                                start = u64_stats_fetch_begin_bh(&p->syncp);
+                                start = u64_stats_fetch_begin_irq(&p->syncp);
                                 rxpackets       = p->rx_packets;
                                 rxbytes         = p->rx_bytes;
                                 rxmulticast     = p->rx_multicast;
                                 txpackets       = p->tx_packets;
                                 txbytes         = p->tx_bytes;
-                        } while (u64_stats_fetch_retry_bh(&p->syncp, start));
+                        } while (u64_stats_fetch_retry_irq(&p->syncp, start));
 
                         stats->rx_packets       += rxpackets;
                         stats->rx_bytes         += rxbytes;
@@ -718,20 +711,19 @@ static void vlan_dev_poll_controller(struct net_device *dev)
         return;
 }
 
-static int vlan_dev_netpoll_setup(struct net_device *dev, struct netpoll_info *npinfo,
-                                  gfp_t gfp)
+static int vlan_dev_netpoll_setup(struct net_device *dev, struct netpoll_info *npinfo)
 {
         struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
         struct net_device *real_dev = vlan->real_dev;
         struct netpoll *netpoll;
         int err = 0;
 
-        netpoll = kzalloc(sizeof(*netpoll), gfp);
+        netpoll = kzalloc(sizeof(*netpoll), GFP_KERNEL);
         err = -ENOMEM;
         if (!netpoll)
                 goto out;
 
-        err = __netpoll_setup(netpoll, real_dev, gfp);
+        err = __netpoll_setup(netpoll, real_dev);
         if (err) {
                 kfree(netpoll);
                 goto out;
diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
index c7e634af8516..8ac8a5cc2143 100644
--- a/net/8021q/vlan_netlink.c
+++ b/net/8021q/vlan_netlink.c
@@ -56,8 +56,8 @@ static int vlan_validate(struct nlattr *tb[], struct nlattr *data[])
 
         if (data[IFLA_VLAN_PROTOCOL]) {
                 switch (nla_get_be16(data[IFLA_VLAN_PROTOCOL])) {
-                case __constant_htons(ETH_P_8021Q):
-                case __constant_htons(ETH_P_8021AD):
+                case htons(ETH_P_8021Q):
+                case htons(ETH_P_8021AD):
                         break;
                 default:
                         return -EPROTONOSUPPORT;
diff --git a/net/9p/client.c b/net/9p/client.c
index 9186550d77a6..0004cbaac4a4 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -415,9 +415,17 @@ static void p9_free_req(struct p9_client *c, struct p9_req_t *r)
  * req: request received
  *
  */
-void p9_client_cb(struct p9_client *c, struct p9_req_t *req)
+void p9_client_cb(struct p9_client *c, struct p9_req_t *req, int status)
 {
         p9_debug(P9_DEBUG_MUX, " tag %d\n", req->tc->tag);
+
+        /*
+         * This barrier is needed to make sure any change made to req before
+         * the other thread wakes up will indeed be seen by the waiting side.
+         */
+        smp_wmb();
+        req->status = status;
+
         wake_up(req->wq);
         p9_debug(P9_DEBUG_MUX, "wakeup: %d\n", req->tc->tag);
 }
@@ -655,16 +663,13 @@ static int p9_client_flush(struct p9_client *c, struct p9_req_t *oldreq)
         if (IS_ERR(req))
                 return PTR_ERR(req);
 
-
         /*
          * if we haven't received a response for oldreq,
          * remove it from the list
          */
-        if (oldreq->status == REQ_STATUS_FLSH) {
-                spin_lock(&c->lock);
-                list_del(&oldreq->req_list);
-                spin_unlock(&c->lock);
-        }
+        if (oldreq->status == REQ_STATUS_SENT)
+                if (c->trans_mod->cancelled)
+                        c->trans_mod->cancelled(c, oldreq);
 
         p9_free_req(c, req);
         return 0;
@@ -751,6 +756,12 @@ again:
         err = wait_event_interruptible(*req->wq,
                                        req->status >= REQ_STATUS_RCVD);
 
+        /*
+         * Make sure our req is coherent with regard to updates in other
+         * threads - echoes to wmb() in the callback
+         */
+        smp_rmb();
+
         if ((err == -ERESTARTSYS) && (c->status == Connected)
                                   && (type == P9_TFLUSH)) {
                 sigpending = 1;
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index b7bd7f2961bf..80d08f6664cb 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -66,20 +66,6 @@ struct p9_fd_opts {
         int privport;
 };
 
-/**
- * struct p9_trans_fd - transport state
- * @rd: reference to file to read from
- * @wr: reference of file to write to
- * @conn: connection state reference
- *
- */
-
-struct p9_trans_fd {
-        struct file *rd;
-        struct file *wr;
-        struct p9_conn *conn;
-};
-
 /*
   * Option Parsing (code inspired by NFS code)
   *  - a little lazy - parse all fd-transport options
@@ -159,6 +145,20 @@ struct p9_conn {
         unsigned long wsched;
 };
 
+/**
+ * struct p9_trans_fd - transport state
+ * @rd: reference to file to read from
+ * @wr: reference of file to write to
+ * @conn: connection state reference
+ *
+ */
+
+struct p9_trans_fd {
+        struct file *rd;
+        struct file *wr;
+        struct p9_conn conn;
+};
+
 static void p9_poll_workfn(struct work_struct *work);
 
 static DEFINE_SPINLOCK(p9_poll_lock);
@@ -212,15 +212,9 @@ static void p9_conn_cancel(struct p9_conn *m, int err)
         m->err = err;
 
         list_for_each_entry_safe(req, rtmp, &m->req_list, req_list) {
-                req->status = REQ_STATUS_ERROR;
-                if (!req->t_err)
-                        req->t_err = err;
                 list_move(&req->req_list, &cancel_list);
         }
         list_for_each_entry_safe(req, rtmp, &m->unsent_req_list, req_list) {
-                req->status = REQ_STATUS_ERROR;
-                if (!req->t_err)
-                        req->t_err = err;
                 list_move(&req->req_list, &cancel_list);
         }
         spin_unlock_irqrestore(&m->client->lock, flags);
@@ -228,7 +222,9 @@ static void p9_conn_cancel(struct p9_conn *m, int err)
         list_for_each_entry_safe(req, rtmp, &cancel_list, req_list) {
                 p9_debug(P9_DEBUG_ERROR, "call back req %p\n", req);
                 list_del(&req->req_list);
-                p9_client_cb(m->client, req);
+                if (!req->t_err)
+                        req->t_err = err;
+                p9_client_cb(m->client, req, REQ_STATUS_ERROR);
         }
 }
 
@@ -302,6 +298,7 @@ static void p9_read_work(struct work_struct *work)
 {
         int n, err;
         struct p9_conn *m;
+        int status = REQ_STATUS_ERROR;
 
         m = container_of(work, struct p9_conn, rq);
 
@@ -348,8 +345,7 @@ static void p9_read_work(struct work_struct *work)
                          "mux %p pkt: size: %d bytes tag: %d\n", m, n, tag);
 
                 m->req = p9_tag_lookup(m->client, tag);
-                if (!m->req || (m->req->status != REQ_STATUS_SENT &&
-                                        m->req->status != REQ_STATUS_FLSH)) {
+                if (!m->req || (m->req->status != REQ_STATUS_SENT)) {
                         p9_debug(P9_DEBUG_ERROR, "Unexpected packet tag %d\n",
                                  tag);
                         err = -EIO;
@@ -375,10 +371,10 @@ static void p9_read_work(struct work_struct *work)
                 p9_debug(P9_DEBUG_TRANS, "got new packet\n");
                 spin_lock(&m->client->lock);
                 if (m->req->status != REQ_STATUS_ERROR)
-                        m->req->status = REQ_STATUS_RCVD;
+                        status = REQ_STATUS_RCVD;
                 list_del(&m->req->req_list);
                 spin_unlock(&m->client->lock);
-                p9_client_cb(m->client, m->req);
+                p9_client_cb(m->client, m->req, status);
                 m->rbuf = NULL;
                 m->rpos = 0;
                 m->rsize = 0;
@@ -573,21 +569,19 @@ p9_pollwait(struct file *filp, wait_queue_head_t *wait_address, poll_table *p)
 }
 
 /**
- * p9_conn_create - allocate and initialize the per-session mux data
+ * p9_conn_create - initialize the per-session mux data
  * @client: client instance
  *
  * Note: Creates the polling task if this is the first session.
  */
 
-static struct p9_conn *p9_conn_create(struct p9_client *client)
+static void p9_conn_create(struct p9_client *client)
 {
         int n;
-        struct p9_conn *m;
+        struct p9_trans_fd *ts = client->trans;
+        struct p9_conn *m = &ts->conn;
 
         p9_debug(P9_DEBUG_TRANS, "client %p msize %d\n", client, client->msize);
-        m = kzalloc(sizeof(struct p9_conn), GFP_KERNEL);
-        if (!m)
-                return ERR_PTR(-ENOMEM);
 
         INIT_LIST_HEAD(&m->mux_list);
         m->client = client;
@@ -609,8 +603,6 @@ static struct p9_conn *p9_conn_create(struct p9_client *client)
                 p9_debug(P9_DEBUG_TRANS, "mux %p can write\n", m);
                 set_bit(Wpending, &m->wsched);
         }
-
-        return m;
 }
 
 /**
@@ -669,7 +661,7 @@ static int p9_fd_request(struct p9_client *client, struct p9_req_t *req)
 {
         int n;
         struct p9_trans_fd *ts = client->trans;
-        struct p9_conn *m = ts->conn;
+        struct p9_conn *m = &ts->conn;
 
         p9_debug(P9_DEBUG_TRANS, "mux %p task %p tcall %p id %d\n",
                  m, current, req->tc, req->tc->id);
@@ -704,14 +696,26 @@ static int p9_fd_cancel(struct p9_client *client, struct p9_req_t *req)
                 list_del(&req->req_list);
                 req->status = REQ_STATUS_FLSHD;
                 ret = 0;
-        } else if (req->status == REQ_STATUS_SENT)
-                req->status = REQ_STATUS_FLSH;
-
+        }
         spin_unlock(&client->lock);
 
         return ret;
 }
 
+static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req)
+{
+        p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req);
+
+        /* we haven't received a response for oldreq,
+         * remove it from the list.
+         */
+        spin_lock(&client->lock);
+        list_del(&req->req_list);
+        spin_unlock(&client->lock);
+
+        return 0;
+}
+
 /**
  * parse_opts - parse mount options into p9_fd_opts structure
  * @params: options string passed from mount
@@ -780,7 +784,7 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
 
 static int p9_fd_open(struct p9_client *client, int rfd, int wfd)
 {
-        struct p9_trans_fd *ts = kmalloc(sizeof(struct p9_trans_fd),
+        struct p9_trans_fd *ts = kzalloc(sizeof(struct p9_trans_fd),
                                            GFP_KERNEL);
         if (!ts)
                 return -ENOMEM;
@@ -806,9 +810,8 @@ static int p9_socket_open(struct p9_client *client, struct socket *csocket)
 {
         struct p9_trans_fd *p;
         struct file *file;
-        int ret;
 
-        p = kmalloc(sizeof(struct p9_trans_fd), GFP_KERNEL);
+        p = kzalloc(sizeof(struct p9_trans_fd), GFP_KERNEL);
         if (!p)
                 return -ENOMEM;
 
@@ -829,20 +832,12 @@ static int p9_socket_open(struct p9_client *client, struct socket *csocket)
 
         p->rd->f_flags |= O_NONBLOCK;
 
-        p->conn = p9_conn_create(client);
-        if (IS_ERR(p->conn)) {
-                ret = PTR_ERR(p->conn);
-                p->conn = NULL;
-                kfree(p);
-                sockfd_put(csocket);
-                sockfd_put(csocket);
-                return ret;
-        }
+        p9_conn_create(client);
         return 0;
 }
 
 /**
- * p9_mux_destroy - cancels all pending requests and frees mux resources
+ * p9_mux_destroy - cancels all pending requests of mux
  * @m: mux to destroy
  *
  */
@@ -859,7 +854,6 @@ static void p9_conn_destroy(struct p9_conn *m)
         p9_conn_cancel(m, -ECONNRESET);
 
         m->client = NULL;
-        kfree(m);
 }
 
 /**
@@ -881,7 +875,7 @@ static void p9_fd_close(struct p9_client *client)
 
         client->status = Disconnected;
 
-        p9_conn_destroy(ts->conn);
+        p9_conn_destroy(&ts->conn);
 
         if (ts->rd)
                 fput(ts->rd);
@@ -1033,14 +1027,7 @@ p9_fd_create(struct p9_client *client, const char *addr, char *args)
                 return err;
 
         p = (struct p9_trans_fd *) client->trans;
-        p->conn = p9_conn_create(client);
-        if (IS_ERR(p->conn)) {
-                err = PTR_ERR(p->conn);
-                p->conn = NULL;
-                fput(p->rd);
-                fput(p->wr);
-                return err;
-        }
+        p9_conn_create(client);
 
         return 0;
 }
@@ -1053,6 +1040,7 @@ static struct p9_trans_module p9_tcp_trans = {
         .close = p9_fd_close,
         .request = p9_fd_request,
         .cancel = p9_fd_cancel,
+        .cancelled = p9_fd_cancelled,
         .owner = THIS_MODULE,
 };
 
@@ -1064,6 +1052,7 @@ static struct p9_trans_module p9_unix_trans = {
         .close = p9_fd_close,
         .request = p9_fd_request,
         .cancel = p9_fd_cancel,
+        .cancelled = p9_fd_cancelled,
         .owner = THIS_MODULE,
 };
 
@@ -1075,6 +1064,7 @@ static struct p9_trans_module p9_fd_trans = {
         .close = p9_fd_close,
         .request = p9_fd_request,
         .cancel = p9_fd_cancel,
+        .cancelled = p9_fd_cancelled,
         .owner = THIS_MODULE,
 };
 
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index 8f68df5d2973..14ad43b5cf89 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -193,6 +193,8 @@ static int parse_opts(char *params, struct p9_rdma_opts *opts)
                 if (!*p)
                         continue;
                 token = match_token(p, tokens, args);
+                if (token == Opt_err)
+                        continue;
                 r = match_int(&args[0], &option);
                 if (r < 0) {
                         p9_debug(P9_DEBUG_ERROR,
@@ -305,8 +307,7 @@ handle_recv(struct p9_client *client, struct p9_trans_rdma *rdma,
         }
 
         req->rc = c->rc;
-        req->status = REQ_STATUS_RCVD;
-        p9_client_cb(client, req);
+        p9_client_cb(client, req, REQ_STATUS_RCVD);
 
         return;
 
@@ -511,6 +512,11 @@ dont_need_post_recv:
                 goto send_error;
         }
 
+        /* Mark request as `sent' *before* we actually send it,
+         * because doing if after could erase the REQ_STATUS_RCVD
+         * status in case of a very fast reply.
+         */
+        req->status = REQ_STATUS_SENT;
         err = ib_post_send(rdma->qp, &wr, &bad_wr);
         if (err)
                 goto send_error;
@@ -520,6 +526,7 @@ dont_need_post_recv:
 
  /* Handle errors that happened during or while preparing the send: */
  send_error:
+        req->status = REQ_STATUS_ERROR;
         kfree(c);
         p9_debug(P9_DEBUG_ERROR, "Error %d in rdma_request()\n", err);
 
@@ -582,12 +589,24 @@ static struct p9_trans_rdma *alloc_rdma(struct p9_rdma_opts *opts)
         return rdma;
 }
 
-/* its not clear to me we can do anything after send has been posted */
 static int rdma_cancel(struct p9_client *client, struct p9_req_t *req)
 {
+        /* Nothing to do here.
+         * We will take care of it (if we have to) in rdma_cancelled()
+         */
         return 1;
 }
 
+/* A request has been fully flushed without a reply.
+ * That means we have posted one buffer in excess.
+ */
+static int rdma_cancelled(struct p9_client *client, struct p9_req_t *req)
+{
+        struct p9_trans_rdma *rdma = client->trans;
+        atomic_inc(&rdma->excess_rc);
+        return 0;
+}
+
 /**
  * trans_create_rdma - Transport method for creating atransport instance
  * @client: client instance
@@ -721,6 +740,7 @@ static struct p9_trans_module p9_rdma_trans = {
         .close = rdma_close,
         .request = rdma_request,
         .cancel = rdma_cancel,
+        .cancelled = rdma_cancelled,
 };
 
 /**
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index ac2666c1d011..6940d8fe8971 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -164,8 +164,7 @@ static void req_done(struct virtqueue *vq)
                 p9_debug(P9_DEBUG_TRANS, ": rc %p\n", rc);
                 p9_debug(P9_DEBUG_TRANS, ": lookup tag %d\n", rc->tag);
                 req = p9_tag_lookup(chan->client, rc->tag);
-                req->status = REQ_STATUS_RCVD;
-                p9_client_cb(chan->client, req);
+                p9_client_cb(chan->client, req, REQ_STATUS_RCVD);
         }
 }
 
diff --git a/net/Kconfig b/net/Kconfig
index e411046a62e3..d92afe4204d9 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -89,8 +89,12 @@ config NETWORK_SECMARK
           to nfmark, but designated for security purposes.
           If you are unsure how to answer this question, answer N.
 
+config NET_PTP_CLASSIFY
+        def_bool n
+
 config NETWORK_PHY_TIMESTAMPING
         bool "Timestamping in PHY devices"
+        select NET_PTP_CLASSIFY
         help
           This allows timestamping of network packets by PHYs with
           hardware timestamping capabilities. This option adds some
@@ -239,7 +243,7 @@ config XPS
         default y
 
 config CGROUP_NET_PRIO
-        tristate "Network priority cgroup"
+        bool "Network priority cgroup"
         depends on CGROUPS
         ---help---
           Cgroup subsystem for use in assigning processes to network priorities on
diff --git a/net/appletalk/aarp.c b/net/appletalk/aarp.c
index d27b86dfb0e9..d1c55d8dd0a2 100644
--- a/net/appletalk/aarp.c
+++ b/net/appletalk/aarp.c
@@ -926,7 +926,7 @@ static struct aarp_entry *iter_next(struct aarp_iter_state *iter, loff_t *pos)
         struct aarp_entry *entry;
 
  rescan:
-        while(ct < AARP_HASH_SIZE) {
+        while (ct < AARP_HASH_SIZE) {
                 for (entry = table[ct]; entry; entry = entry->next) {
                         if (!pos || ++off == *pos) {
                                 iter->table = table;
@@ -995,7 +995,7 @@ static const char *dt2str(unsigned long ticks)
 {
         static char buf[32];
 
-        sprintf(buf, "%ld.%02ld", ticks / HZ, ((ticks % HZ) * 100 ) / HZ);
+        sprintf(buf, "%ld.%02ld", ticks / HZ, ((ticks % HZ) * 100) / HZ);
 
         return buf;
 }
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 02806c6b2ff3..786ee2f83d5f 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -293,7 +293,7 @@ static int atif_probe_device(struct atalk_iface *atif)
 
 /* Perform AARP probing for a proxy address */
 static int atif_proxy_probe_device(struct atalk_iface *atif,
-                                   struct atalk_addr* proxy_addr)
+                                   struct atalk_addr *proxy_addr)
 {
         int netrange = ntohs(atif->nets.nr_lastnet) -
                         ntohs(atif->nets.nr_firstnet) + 1;
@@ -581,7 +581,7 @@ out:
 }
 
 /* Delete a route. Find it and discard it */
-static int atrtr_delete(struct atalk_addr * addr)
+static int atrtr_delete(struct atalk_addr *addr)
 {
         struct atalk_route **r = &atalk_routes;
         int retval = 0;
@@ -936,11 +936,11 @@ static unsigned long atalk_sum_skb(const struct sk_buff *skb, int offset,
         int i, copy;
 
         /* checksum stuff in header space */
-        if ( (copy = start - offset) > 0) {
+        if ((copy = start - offset) > 0) {
                 if (copy > len)
                         copy = len;
                 sum = atalk_sum_partial(skb->data + offset, copy, sum);
-                if ( (len -= copy) == 0)
+                if ((len -= copy) == 0)
                         return sum;
 
                 offset += copy;
@@ -1151,7 +1151,7 @@ static int atalk_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                         goto out;
 
                 at->src_net  = addr->sat_addr.s_net = ap->s_net;
-                at->src_node = addr->sat_addr.s_node= ap->s_node;
+                at->src_node = addr->sat_addr.s_node = ap->s_node;
         } else {
                 err = -EADDRNOTAVAIL;
                 if (!atalk_find_interface(addr->sat_addr.s_net,
@@ -1790,53 +1790,53 @@ static int atalk_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         void __user *argp = (void __user *)arg;
 
         switch (cmd) {
-                /* Protocol layer */
-                case TIOCOUTQ: {
-                        long amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
+        /* Protocol layer */
+        case TIOCOUTQ: {
+                long amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
 
-                        if (amount < 0)
-                                amount = 0;
-                        rc = put_user(amount, (int __user *)argp);
-                        break;
-                }
-                case TIOCINQ: {
-                        /*
-                         * These two are safe on a single CPU system as only
-                         * user tasks fiddle here
-                         */
-                        struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
-                        long amount = 0;
+                if (amount < 0)
+                        amount = 0;
+                rc = put_user(amount, (int __user *)argp);
+                break;
+        }
+        case TIOCINQ: {
+                /*
+                 * These two are safe on a single CPU system as only
+                 * user tasks fiddle here
+                 */
+                struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
+                long amount = 0;
 
-                        if (skb)
-                                amount = skb->len - sizeof(struct ddpehdr);
-                        rc = put_user(amount, (int __user *)argp);
-                        break;
-                }
-                case SIOCGSTAMP:
-                        rc = sock_get_timestamp(sk, argp);
-                        break;
-                case SIOCGSTAMPNS:
-                        rc = sock_get_timestampns(sk, argp);
-                        break;
-                /* Routing */
-                case SIOCADDRT:
-                case SIOCDELRT:
-                        rc = -EPERM;
-                        if (capable(CAP_NET_ADMIN))
-                                rc = atrtr_ioctl(cmd, argp);
-                        break;
-                /* Interface */
-                case SIOCGIFADDR:
-                case SIOCSIFADDR:
-                case SIOCGIFBRDADDR:
-                case SIOCATALKDIFADDR:
-                case SIOCDIFADDR:
-                case SIOCSARP:          /* proxy AARP */
-                case SIOCDARP:          /* proxy AARP */
-                        rtnl_lock();
-                        rc = atif_ioctl(cmd, argp);
-                        rtnl_unlock();
-                        break;
+                if (skb)
+                amount = skb->len - sizeof(struct ddpehdr);
+                rc = put_user(amount, (int __user *)argp);
+                break;
+        }
+        case SIOCGSTAMP:
+                rc = sock_get_timestamp(sk, argp);
+                break;
+        case SIOCGSTAMPNS:
+                rc = sock_get_timestampns(sk, argp);
+                break;
+        /* Routing */
+        case SIOCADDRT:
+        case SIOCDELRT:
+                rc = -EPERM;
+                if (capable(CAP_NET_ADMIN))
+                        rc = atrtr_ioctl(cmd, argp);
+                break;
+        /* Interface */
+        case SIOCGIFADDR:
+        case SIOCSIFADDR:
+        case SIOCGIFBRDADDR:
+        case SIOCATALKDIFADDR:
+        case SIOCDIFADDR:
+        case SIOCSARP:          /* proxy AARP */
+        case SIOCDARP:          /* proxy AARP */
+                rtnl_lock();
+                rc = atif_ioctl(cmd, argp);
+                rtnl_unlock();
+                break;
         }
 
         return rc;
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 8215f7cb170b..ba291ce4bdff 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -68,7 +68,7 @@ static int to_atmarpd(enum atmarp_ctrl_type type, int itf, __be32 ip)
 
         sk = sk_atm(atmarpd);
         skb_queue_tail(&sk->sk_receive_queue, skb);
-        sk->sk_data_ready(sk, skb->len);
+        sk->sk_data_ready(sk);
         return 0;
 }
 
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 5a2f602d07e1..4c5b8ba0f84f 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -152,7 +152,7 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
                 atm_force_charge(priv->lecd, skb2->truesize);
                 sk = sk_atm(priv->lecd);
                 skb_queue_tail(&sk->sk_receive_queue, skb2);
-                sk->sk_data_ready(sk, skb2->len);
+                sk->sk_data_ready(sk);
         }
 }
 #endif /* defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE) */
@@ -447,7 +447,7 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
                         atm_force_charge(priv->lecd, skb2->truesize);
                         sk = sk_atm(priv->lecd);
                         skb_queue_tail(&sk->sk_receive_queue, skb2);
-                        sk->sk_data_ready(sk, skb2->len);
+                        sk->sk_data_ready(sk);
                 }
         }
 #endif /* defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE) */
@@ -530,13 +530,13 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
         atm_force_charge(priv->lecd, skb->truesize);
         sk = sk_atm(priv->lecd);
         skb_queue_tail(&sk->sk_receive_queue, skb);
-        sk->sk_data_ready(sk, skb->len);
+        sk->sk_data_ready(sk);
 
         if (data != NULL) {
                 pr_debug("about to send %d bytes of data\n", data->len);
                 atm_force_charge(priv->lecd, data->truesize);
                 skb_queue_tail(&sk->sk_receive_queue, data);
-                sk->sk_data_ready(sk, skb->len);
+                sk->sk_data_ready(sk);
         }
 
         return 0;
@@ -616,7 +616,7 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
 
                 pr_debug("%s: To daemon\n", dev->name);
                 skb_queue_tail(&sk->sk_receive_queue, skb);
-                sk->sk_data_ready(sk, skb->len);
+                sk->sk_data_ready(sk);
         } else {                /* Data frame, queue to protocol handlers */
                 struct lec_arp_table *entry;
                 unsigned char *src, *dst;
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index b71ff6b234f2..e8e0e7a8a23d 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -706,7 +706,7 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
                 dprintk("(%s) control packet arrived\n", dev->name);
                 /* Pass control packets to daemon */
                 skb_queue_tail(&sk->sk_receive_queue, skb);
-                sk->sk_data_ready(sk, skb->len);
+                sk->sk_data_ready(sk);
                 return;
         }
 
@@ -992,7 +992,7 @@ int msg_to_mpoad(struct k_message *mesg, struct mpoa_client *mpc)
 
         sk = sk_atm(mpc->mpoad_vcc);
         skb_queue_tail(&sk->sk_receive_queue, skb);
-        sk->sk_data_ready(sk, skb->len);
+        sk->sk_data_ready(sk);
 
         return 0;
 }
@@ -1273,7 +1273,7 @@ static void purge_egress_shortcut(struct atm_vcc *vcc, eg_cache_entry *entry)
 
         sk = sk_atm(vcc);
         skb_queue_tail(&sk->sk_receive_queue, skb);
-        sk->sk_data_ready(sk, skb->len);
+        sk->sk_data_ready(sk);
         dprintk("exiting\n");
 }
 
@@ -1492,7 +1492,7 @@ static void __exit atm_mpoa_cleanup(void)
 
         mpc_proc_clean();
 
-        del_timer(&mpc_timer);
+        del_timer_sync(&mpc_timer);
         unregister_netdevice_notifier(&mpoa_notifier);
         deregister_atm_ioctl(&atm_ioctl_ops);
 
diff --git a/net/atm/raw.c b/net/atm/raw.c
index b4f7b9ff3c74..2e17e97a7a8b 100644
--- a/net/atm/raw.c
+++ b/net/atm/raw.c
@@ -25,7 +25,7 @@ static void atm_push_raw(struct atm_vcc *vcc, struct sk_buff *skb)
                 struct sock *sk = sk_atm(vcc);
 
                 skb_queue_tail(&sk->sk_receive_queue, skb);
-                sk->sk_data_ready(sk, skb->len);
+                sk->sk_data_ready(sk);
         }
 }
 
diff --git a/net/atm/signaling.c b/net/atm/signaling.c
index 4176887e72eb..523bce72f698 100644
--- a/net/atm/signaling.c
+++ b/net/atm/signaling.c
@@ -51,7 +51,7 @@ static void sigd_put_skb(struct sk_buff *skb)
 #endif
         atm_force_charge(sigd, skb->truesize);
         skb_queue_tail(&sk_atm(sigd)->sk_receive_queue, skb);
-        sk_atm(sigd)->sk_data_ready(sk_atm(sigd), skb->len);
+        sk_atm(sigd)->sk_data_ready(sk_atm(sigd));
 }
 
 static void modify_qos(struct atm_vcc *vcc, struct atmsvc_msg *msg)
diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c
index 96f4cab3a2f9..7ed8ab724819 100644
--- a/net/ax25/ax25_in.c
+++ b/net/ax25/ax25_in.c
@@ -422,7 +422,7 @@ static int ax25_rcv(struct sk_buff *skb, struct net_device *dev,
 
         if (sk) {
                 if (!sock_flag(sk, SOCK_DEAD))
-                        sk->sk_data_ready(sk, skb->len);
+                        sk->sk_data_ready(sk);
                 sock_put(sk);
         } else {
 free:
diff --git a/net/batman-adv/Kconfig b/net/batman-adv/Kconfig
index fa780b76630e..11660a3aab5a 100644
--- a/net/batman-adv/Kconfig
+++ b/net/batman-adv/Kconfig
@@ -50,6 +50,15 @@ config BATMAN_ADV_NC
           If you think that your network does not need this feature you
           can safely disable it and save some space.
 
+config BATMAN_ADV_MCAST
+        bool "Multicast optimisation"
+        depends on BATMAN_ADV
+        default n
+        help
+          This option enables the multicast optimisation which aims to
+          reduce the air overhead while improving the reliability of
+          multicast messages.
+
 config BATMAN_ADV_DEBUG
         bool "B.A.T.M.A.N. debugging"
         depends on BATMAN_ADV
diff --git a/net/batman-adv/Makefile b/net/batman-adv/Makefile
index 42df18f877e9..eb7d8c0388e4 100644
--- a/net/batman-adv/Makefile
+++ b/net/batman-adv/Makefile
@@ -36,3 +36,4 @@ batman-adv-y += send.o
 batman-adv-y += soft-interface.o
 batman-adv-y += sysfs.o
 batman-adv-y += translation-table.o
+batman-adv-$(CONFIG_BATMAN_ADV_MCAST) += multicast.o
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 8323bced8e5b..b3bd4ec3fd94 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -347,10 +347,10 @@ static void batadv_iv_ogm_iface_update_mac(struct batadv_hard_iface *hard_iface)
         unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff;
 
         batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff;
-        memcpy(batadv_ogm_packet->orig,
-               hard_iface->net_dev->dev_addr, ETH_ALEN);
-        memcpy(batadv_ogm_packet->prev_sender,
-               hard_iface->net_dev->dev_addr, ETH_ALEN);
+        ether_addr_copy(batadv_ogm_packet->orig,
+                        hard_iface->net_dev->dev_addr);
+        ether_addr_copy(batadv_ogm_packet->prev_sender,
+                        hard_iface->net_dev->dev_addr);
 }
 
 static void
@@ -830,7 +830,7 @@ static void batadv_iv_ogm_forward(struct batadv_orig_node *orig_node,
         tvlv_len = ntohs(batadv_ogm_packet->tvlv_len);
 
         batadv_ogm_packet->ttl--;
-        memcpy(batadv_ogm_packet->prev_sender, ethhdr->h_source, ETH_ALEN);
+        ether_addr_copy(batadv_ogm_packet->prev_sender, ethhdr->h_source);
 
         /* apply hop penalty */
         batadv_ogm_packet->tq = batadv_hop_penalty(batadv_ogm_packet->tq,
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index 05f0712be5e7..6f0d9ec37950 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -191,7 +191,7 @@ batadv_backbone_hash_find(struct batadv_priv *bat_priv,
         if (!hash)
                 return NULL;
 
-        memcpy(search_entry.orig, addr, ETH_ALEN);
+        ether_addr_copy(search_entry.orig, addr);
         search_entry.vid = vid;
 
         index = batadv_choose_backbone_gw(&search_entry, hash->size);
@@ -305,7 +305,7 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, uint8_t *mac,
                 /* normal claim frame
                  * set Ethernet SRC to the clients mac
                  */
-                memcpy(ethhdr->h_source, mac, ETH_ALEN);
+                ether_addr_copy(ethhdr->h_source, mac);
                 batadv_dbg(BATADV_DBG_BLA, bat_priv,
                            "bla_send_claim(): CLAIM %pM on vid %d\n", mac,
                            BATADV_PRINT_VID(vid));
@@ -314,7 +314,7 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, uint8_t *mac,
                 /* unclaim frame
                  * set HW SRC to the clients mac
                  */
-                memcpy(hw_src, mac, ETH_ALEN);
+                ether_addr_copy(hw_src, mac);
                 batadv_dbg(BATADV_DBG_BLA, bat_priv,
                            "bla_send_claim(): UNCLAIM %pM on vid %d\n", mac,
                            BATADV_PRINT_VID(vid));
@@ -323,7 +323,7 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, uint8_t *mac,
                 /* announcement frame
                  * set HW SRC to the special mac containg the crc
                  */
-                memcpy(hw_src, mac, ETH_ALEN);
+                ether_addr_copy(hw_src, mac);
                 batadv_dbg(BATADV_DBG_BLA, bat_priv,
                            "bla_send_claim(): ANNOUNCE of %pM on vid %d\n",
                            ethhdr->h_source, BATADV_PRINT_VID(vid));
@@ -333,8 +333,8 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, uint8_t *mac,
                  * set HW SRC and header destination to the receiving backbone
                  * gws mac
                  */
-                memcpy(hw_src, mac, ETH_ALEN);
-                memcpy(ethhdr->h_dest, mac, ETH_ALEN);
+                ether_addr_copy(hw_src, mac);
+                ether_addr_copy(ethhdr->h_dest, mac);
                 batadv_dbg(BATADV_DBG_BLA, bat_priv,
                            "bla_send_claim(): REQUEST of %pM to %pM on vid %d\n",
                            ethhdr->h_source, ethhdr->h_dest,
@@ -395,7 +395,7 @@ batadv_bla_get_backbone_gw(struct batadv_priv *bat_priv, uint8_t *orig,
         entry->bat_priv = bat_priv;
         atomic_set(&entry->request_sent, 0);
         atomic_set(&entry->wait_periods, 0);
-        memcpy(entry->orig, orig, ETH_ALEN);
+        ether_addr_copy(entry->orig, orig);
 
         /* one for the hash, one for returning */
         atomic_set(&entry->refcount, 2);
@@ -563,7 +563,7 @@ static void batadv_bla_add_claim(struct batadv_priv *bat_priv,
         struct batadv_bla_claim search_claim;
         int hash_added;
 
-        memcpy(search_claim.addr, mac, ETH_ALEN);
+        ether_addr_copy(search_claim.addr, mac);
         search_claim.vid = vid;
         claim = batadv_claim_hash_find(bat_priv, &search_claim);
 
@@ -573,7 +573,7 @@ static void batadv_bla_add_claim(struct batadv_priv *bat_priv,
                 if (!claim)
                         return;
 
-                memcpy(claim->addr, mac, ETH_ALEN);
+                ether_addr_copy(claim->addr, mac);
                 claim->vid = vid;
                 claim->lasttime = jiffies;
                 claim->backbone_gw = backbone_gw;
@@ -624,7 +624,7 @@ static void batadv_bla_del_claim(struct batadv_priv *bat_priv,
 {
         struct batadv_bla_claim search_claim, *claim;
 
-        memcpy(search_claim.addr, mac, ETH_ALEN);
+        ether_addr_copy(search_claim.addr, mac);
         search_claim.vid = vid;
         claim = batadv_claim_hash_find(bat_priv, &search_claim);
         if (!claim)
@@ -882,7 +882,7 @@ static int batadv_bla_process_claim(struct batadv_priv *bat_priv,
         proto = ethhdr->h_proto;
         headlen = ETH_HLEN;
         if (vid & BATADV_VLAN_HAS_TAG) {
-                vhdr = (struct vlan_ethhdr *)ethhdr;
+                vhdr = vlan_eth_hdr(skb);
                 proto = vhdr->h_vlan_encapsulated_proto;
                 headlen += VLAN_HLEN;
         }
@@ -1103,8 +1103,8 @@ void batadv_bla_update_orig_address(struct batadv_priv *bat_priv,
                                                 oldif->net_dev->dev_addr))
                                 continue;
 
-                        memcpy(backbone_gw->orig,
-                               primary_if->net_dev->dev_addr, ETH_ALEN);
+                        ether_addr_copy(backbone_gw->orig,
+                                        primary_if->net_dev->dev_addr);
                         /* send an announce frame so others will ask for our
                          * claims and update their tables.
                          */
@@ -1310,7 +1310,7 @@ int batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
         entry = &bat_priv->bla.bcast_duplist[curr];
         entry->crc = crc;
         entry->entrytime = jiffies;
-        memcpy(entry->orig, bcast_packet->orig, ETH_ALEN);
+        ether_addr_copy(entry->orig, bcast_packet->orig);
         bat_priv->bla.bcast_duplist_curr = curr;
 
 out:
@@ -1458,7 +1458,7 @@ int batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb,
                 if (is_multicast_ether_addr(ethhdr->h_dest) && is_bcast)
                         goto handled;
 
-        memcpy(search_claim.addr, ethhdr->h_source, ETH_ALEN);
+        ether_addr_copy(search_claim.addr, ethhdr->h_source);
         search_claim.vid = vid;
         claim = batadv_claim_hash_find(bat_priv, &search_claim);
 
@@ -1547,9 +1547,6 @@ int batadv_bla_tx(struct batadv_priv *bat_priv, struct sk_buff *skb,
         if (!atomic_read(&bat_priv->bridge_loop_avoidance))
                 goto allow;
 
-        /* in VLAN case, the mac header might not be set. */
-        skb_reset_mac_header(skb);
-
         if (batadv_bla_process_claim(bat_priv, primary_if, skb))
                 goto handled;
 
@@ -1560,7 +1557,7 @@ int batadv_bla_tx(struct batadv_priv *bat_priv, struct sk_buff *skb,
                 if (is_multicast_ether_addr(ethhdr->h_dest))
                         goto handled;
 
-        memcpy(search_claim.addr, ethhdr->h_source, ETH_ALEN);
+        ether_addr_copy(search_claim.addr, ethhdr->h_source);
         search_claim.vid = vid;
 
         claim = batadv_claim_hash_find(bat_priv, &search_claim);
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index edee50411892..b25fd64d727b 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -277,7 +277,7 @@ static void batadv_dat_entry_add(struct batadv_priv *bat_priv, __be32 ip,
         /* if this entry is already known, just update it */
         if (dat_entry) {
                 if (!batadv_compare_eth(dat_entry->mac_addr, mac_addr))
-                        memcpy(dat_entry->mac_addr, mac_addr, ETH_ALEN);
+                        ether_addr_copy(dat_entry->mac_addr, mac_addr);
                 dat_entry->last_update = jiffies;
                 batadv_dbg(BATADV_DBG_DAT, bat_priv,
                            "Entry updated: %pI4 %pM (vid: %d)\n",
@@ -292,7 +292,7 @@ static void batadv_dat_entry_add(struct batadv_priv *bat_priv, __be32 ip,
 
         dat_entry->ip = ip;
         dat_entry->vid = vid;
-        memcpy(dat_entry->mac_addr, mac_addr, ETH_ALEN);
+        ether_addr_copy(dat_entry->mac_addr, mac_addr);
         dat_entry->last_update = jiffies;
         atomic_set(&dat_entry->refcount, 2);
 
@@ -1027,6 +1027,11 @@ bool batadv_dat_snoop_incoming_arp_request(struct batadv_priv *bat_priv,
         if (!skb_new)
                 goto out;
 
+        /* the rest of the TX path assumes that the mac_header offset pointing
+         * to the inner Ethernet header has been set, therefore reset it now.
+         */
+        skb_reset_mac_header(skb_new);
+
         if (vid & BATADV_VLAN_HAS_TAG)
                 skb_new = vlan_insert_tag(skb_new, htons(ETH_P_8021Q),
                                           vid & VLAN_VID_MASK);
diff --git a/net/batman-adv/distributed-arp-table.h b/net/batman-adv/distributed-arp-table.h
index ac9be9b67a25..d76e1d06c5b5 100644
--- a/net/batman-adv/distributed-arp-table.h
+++ b/net/batman-adv/distributed-arp-table.h
@@ -25,6 +25,9 @@
 
 #include <linux/if_arp.h>
 
+/**
+ * BATADV_DAT_ADDR_MAX - maximum address value in the DHT space
+ */
 #define BATADV_DAT_ADDR_MAX ((batadv_dat_addr_t)~(batadv_dat_addr_t)0)
 
 void batadv_dat_status_update(struct net_device *net_dev);
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 88df9b1d552d..bcc4bea632fa 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -449,8 +449,8 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
         frag_header.reserved = 0;
         frag_header.no = 0;
         frag_header.total_size = htons(skb->len);
-        memcpy(frag_header.orig, primary_if->net_dev->dev_addr, ETH_ALEN);
-        memcpy(frag_header.dest, orig_node->orig, ETH_ALEN);
+        ether_addr_copy(frag_header.orig, primary_if->net_dev->dev_addr);
+        ether_addr_copy(frag_header.dest, orig_node->orig);
 
         /* Eat and send fragments from the tail of skb */
         while (skb->len > max_fragment_size) {
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index 55cf2260d295..c835e137423b 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -389,8 +389,6 @@ out:
                 batadv_neigh_ifinfo_free_ref(router_gw_tq);
         if (router_orig_tq)
                 batadv_neigh_ifinfo_free_ref(router_orig_tq);
-
-        return;
 }
 
 /**
@@ -680,7 +678,7 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len,
         if (!pskb_may_pull(skb, *header_len + ETH_HLEN))
                 return BATADV_DHCP_NO;
 
-        ethhdr = (struct ethhdr *)skb->data;
+        ethhdr = eth_hdr(skb);
         proto = ethhdr->h_proto;
         *header_len += ETH_HLEN;
 
@@ -689,7 +687,7 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len,
                 if (!pskb_may_pull(skb, *header_len + VLAN_HLEN))
                         return BATADV_DHCP_NO;
 
-                vhdr = (struct vlan_ethhdr *)skb->data;
+                vhdr = vlan_eth_hdr(skb);
                 proto = vhdr->h_vlan_encapsulated_proto;
                 *header_len += VLAN_HLEN;
         }
@@ -728,7 +726,7 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len,
                 return BATADV_DHCP_NO;
 
         /* skb->data might have been reallocated by pskb_may_pull() */
-        ethhdr = (struct ethhdr *)skb->data;
+        ethhdr = eth_hdr(skb);
         if (ntohs(ethhdr->h_proto) == ETH_P_8021Q)
                 ethhdr = (struct ethhdr *)(skb->data + VLAN_HLEN);
 
@@ -765,7 +763,7 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len,
                 if (*p != ETH_ALEN)
                         return BATADV_DHCP_NO;
 
-                memcpy(chaddr, skb->data + chaddr_offset, ETH_ALEN);
+                ether_addr_copy(chaddr, skb->data + chaddr_offset);
         }
 
         return ret;
diff --git a/net/batman-adv/icmp_socket.c b/net/batman-adv/icmp_socket.c
index abb9d6e0388b..161ef8f17d2e 100644
--- a/net/batman-adv/icmp_socket.c
+++ b/net/batman-adv/icmp_socket.c
@@ -158,6 +158,7 @@ static ssize_t batadv_socket_write(struct file *file, const char __user *buff,
         struct batadv_orig_node *orig_node = NULL;
         struct batadv_neigh_node *neigh_node = NULL;
         size_t packet_len = sizeof(struct batadv_icmp_packet);
+        uint8_t *addr;
 
         if (len < sizeof(struct batadv_icmp_header)) {
                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
@@ -227,10 +228,10 @@ static ssize_t batadv_socket_write(struct file *file, const char __user *buff,
                         goto dst_unreach;
 
                 icmp_packet_rr = (struct batadv_icmp_packet_rr *)icmp_header;
-                if (packet_len == sizeof(*icmp_packet_rr))
-                        memcpy(icmp_packet_rr->rr,
-                               neigh_node->if_incoming->net_dev->dev_addr,
-                               ETH_ALEN);
+                if (packet_len == sizeof(*icmp_packet_rr)) {
+                        addr = neigh_node->if_incoming->net_dev->dev_addr;
+                        ether_addr_copy(icmp_packet_rr->rr[0], addr);
+                }
 
                 break;
         default:
@@ -250,7 +251,7 @@ static ssize_t batadv_socket_write(struct file *file, const char __user *buff,
                 goto free_skb;
         }
 
-        memcpy(icmp_header->orig, primary_if->net_dev->dev_addr, ETH_ALEN);
+        ether_addr_copy(icmp_header->orig, primary_if->net_dev->dev_addr);
 
         batadv_send_skb_packet(skb, neigh_node->if_incoming, neigh_node->addr);
         goto out;
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 66ae135b9f27..d1183e882167 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -34,6 +34,7 @@
 #include "gateway_client.h"
 #include "bridge_loop_avoidance.h"
 #include "distributed-arp-table.h"
+#include "multicast.h"
 #include "gateway_common.h"
 #include "hash.h"
 #include "bat_algo.h"
@@ -110,6 +111,9 @@ int batadv_mesh_init(struct net_device *soft_iface)
         spin_lock_init(&bat_priv->tt.last_changeset_lock);
         spin_lock_init(&bat_priv->tt.commit_lock);
         spin_lock_init(&bat_priv->gw.list_lock);
+#ifdef CONFIG_BATMAN_ADV_MCAST
+        spin_lock_init(&bat_priv->mcast.want_lists_lock);
+#endif
         spin_lock_init(&bat_priv->tvlv.container_list_lock);
         spin_lock_init(&bat_priv->tvlv.handler_list_lock);
         spin_lock_init(&bat_priv->softif_vlan_list_lock);
@@ -117,9 +121,17 @@ int batadv_mesh_init(struct net_device *soft_iface)
         INIT_HLIST_HEAD(&bat_priv->forw_bat_list);
         INIT_HLIST_HEAD(&bat_priv->forw_bcast_list);
         INIT_HLIST_HEAD(&bat_priv->gw.list);
+#ifdef CONFIG_BATMAN_ADV_MCAST
+        INIT_HLIST_HEAD(&bat_priv->mcast.want_all_unsnoopables_list);
+        INIT_HLIST_HEAD(&bat_priv->mcast.want_all_ipv4_list);
+        INIT_HLIST_HEAD(&bat_priv->mcast.want_all_ipv6_list);
+#endif
         INIT_LIST_HEAD(&bat_priv->tt.changes_list);
         INIT_LIST_HEAD(&bat_priv->tt.req_list);
         INIT_LIST_HEAD(&bat_priv->tt.roam_list);
+#ifdef CONFIG_BATMAN_ADV_MCAST
+        INIT_HLIST_HEAD(&bat_priv->mcast.mla_list);
+#endif
         INIT_HLIST_HEAD(&bat_priv->tvlv.container_list);
         INIT_HLIST_HEAD(&bat_priv->tvlv.handler_list);
         INIT_HLIST_HEAD(&bat_priv->softif_vlan_list);
@@ -145,6 +157,7 @@ int batadv_mesh_init(struct net_device *soft_iface)
                 goto err;
 
         batadv_gw_init(bat_priv);
+        batadv_mcast_init(bat_priv);
 
         atomic_set(&bat_priv->gw.reselect, 0);
         atomic_set(&bat_priv->mesh_state, BATADV_MESH_ACTIVE);
@@ -169,6 +182,8 @@ void batadv_mesh_free(struct net_device *soft_iface)
         batadv_dat_free(bat_priv);
         batadv_bla_free(bat_priv);
 
+        batadv_mcast_free(bat_priv);
+
         /* Free the TT and the originator tables only after having terminated
          * all the other depending components which may use these structures for
          * their purposes.
@@ -1133,8 +1148,8 @@ void batadv_tvlv_unicast_send(struct batadv_priv *bat_priv, uint8_t *src,
         unicast_tvlv_packet->reserved = 0;
         unicast_tvlv_packet->tvlv_len = htons(tvlv_len);
         unicast_tvlv_packet->align = 0;
-        memcpy(unicast_tvlv_packet->src, src, ETH_ALEN);
-        memcpy(unicast_tvlv_packet->dst, dst, ETH_ALEN);
+        ether_addr_copy(unicast_tvlv_packet->src, src);
+        ether_addr_copy(unicast_tvlv_packet->dst, dst);
 
         tvlv_buff = (unsigned char *)(unicast_tvlv_packet + 1);
         tvlv_hdr = (struct batadv_tvlv_hdr *)tvlv_buff;
diff --git a/net/batman-adv/main.h b/net/batman-adv/main.h
index 9374f1a51348..770dc890ceef 100644
--- a/net/batman-adv/main.h
+++ b/net/batman-adv/main.h
@@ -24,7 +24,7 @@
 #define BATADV_DRIVER_DEVICE "batman-adv"
 
 #ifndef BATADV_SOURCE_VERSION
-#define BATADV_SOURCE_VERSION "2014.1.0"
+#define BATADV_SOURCE_VERSION "2014.2.0"
 #endif
 
 /* B.A.T.M.A.N. parameters */
@@ -176,6 +176,8 @@ enum batadv_uev_type {
 #include <linux/percpu.h>
 #include <linux/slab.h>
 #include <net/sock.h>           /* struct sock */
+#include <net/addrconf.h>       /* ipv6 address stuff */
+#include <linux/ip.h>
 #include <net/rtnetlink.h>
 #include <linux/jiffies.h>
 #include <linux/seq_file.h>
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
new file mode 100644
index 000000000000..8c7ca811de6e
--- /dev/null
+++ b/net/batman-adv/multicast.c
@@ -0,0 +1,748 @@
+/* Copyright (C) 2014 B.A.T.M.A.N. contributors:
+ *
+ * Linus Lüssing
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "main.h"
+#include "multicast.h"
+#include "originator.h"
+#include "hard-interface.h"
+#include "translation-table.h"
+#include "multicast.h"
+
+/**
+ * batadv_mcast_mla_softif_get - get softif multicast listeners
+ * @dev: the device to collect multicast addresses from
+ * @mcast_list: a list to put found addresses into
+ *
+ * Collect multicast addresses of the local multicast listeners
+ * on the given soft interface, dev, in the given mcast_list.
+ *
+ * Returns -ENOMEM on memory allocation error or the number of
+ * items added to the mcast_list otherwise.
+ */
+static int batadv_mcast_mla_softif_get(struct net_device *dev,
+                                       struct hlist_head *mcast_list)
+{
+        struct netdev_hw_addr *mc_list_entry;
+        struct batadv_hw_addr *new;
+        int ret = 0;
+
+        netif_addr_lock_bh(dev);
+        netdev_for_each_mc_addr(mc_list_entry, dev) {
+                new = kmalloc(sizeof(*new), GFP_ATOMIC);
+                if (!new) {
+                        ret = -ENOMEM;
+                        break;
+                }
+
+                ether_addr_copy(new->addr, mc_list_entry->addr);
+                hlist_add_head(&new->list, mcast_list);
+                ret++;
+        }
+        netif_addr_unlock_bh(dev);
+
+        return ret;
+}
+
+/**
+ * batadv_mcast_mla_is_duplicate - check whether an address is in a list
+ * @mcast_addr: the multicast address to check
+ * @mcast_list: the list with multicast addresses to search in
+ *
+ * Returns true if the given address is already in the given list.
+ * Otherwise returns false.
+ */
+static bool batadv_mcast_mla_is_duplicate(uint8_t *mcast_addr,
+                                          struct hlist_head *mcast_list)
+{
+        struct batadv_hw_addr *mcast_entry;
+
+        hlist_for_each_entry(mcast_entry, mcast_list, list)
+                if (batadv_compare_eth(mcast_entry->addr, mcast_addr))
+                        return true;
+
+        return false;
+}
+
+/**
+ * batadv_mcast_mla_list_free - free a list of multicast addresses
+ * @mcast_list: the list to free
+ *
+ * Removes and frees all items in the given mcast_list.
+ */
+static void batadv_mcast_mla_list_free(struct hlist_head *mcast_list)
+{
+        struct batadv_hw_addr *mcast_entry;
+        struct hlist_node *tmp;
+
+        hlist_for_each_entry_safe(mcast_entry, tmp, mcast_list, list) {
+                hlist_del(&mcast_entry->list);
+                kfree(mcast_entry);
+        }
+}
+
+/**
+ * batadv_mcast_mla_tt_retract - clean up multicast listener announcements
+ * @bat_priv: the bat priv with all the soft interface information
+ * @mcast_list: a list of addresses which should _not_ be removed
+ *
+ * Retracts the announcement of any multicast listener from the
+ * translation table except the ones listed in the given mcast_list.
+ *
+ * If mcast_list is NULL then all are retracted.
+ */
+static void batadv_mcast_mla_tt_retract(struct batadv_priv *bat_priv,
+                                        struct hlist_head *mcast_list)
+{
+        struct batadv_hw_addr *mcast_entry;
+        struct hlist_node *tmp;
+
+        hlist_for_each_entry_safe(mcast_entry, tmp, &bat_priv->mcast.mla_list,
+                                  list) {
+                if (mcast_list &&
+                    batadv_mcast_mla_is_duplicate(mcast_entry->addr,
+                                                  mcast_list))
+                        continue;
+
+                batadv_tt_local_remove(bat_priv, mcast_entry->addr,
+                                       BATADV_NO_FLAGS,
+                                       "mcast TT outdated", false);
+
+                hlist_del(&mcast_entry->list);
+                kfree(mcast_entry);
+        }
+}
+
+/**
+ * batadv_mcast_mla_tt_add - add multicast listener announcements
+ * @bat_priv: the bat priv with all the soft interface information
+ * @mcast_list: a list of addresses which are going to get added
+ *
+ * Adds multicast listener announcements from the given mcast_list to the
+ * translation table if they have not been added yet.
+ */
+static void batadv_mcast_mla_tt_add(struct batadv_priv *bat_priv,
+                                    struct hlist_head *mcast_list)
+{
+        struct batadv_hw_addr *mcast_entry;
+        struct hlist_node *tmp;
+
+        if (!mcast_list)
+                return;
+
+        hlist_for_each_entry_safe(mcast_entry, tmp, mcast_list, list) {
+                if (batadv_mcast_mla_is_duplicate(mcast_entry->addr,
+                                                  &bat_priv->mcast.mla_list))
+                        continue;
+
+                if (!batadv_tt_local_add(bat_priv->soft_iface,
+                                         mcast_entry->addr, BATADV_NO_FLAGS,
+                                         BATADV_NULL_IFINDEX, BATADV_NO_MARK))
+                        continue;
+
+                hlist_del(&mcast_entry->list);
+                hlist_add_head(&mcast_entry->list, &bat_priv->mcast.mla_list);
+        }
+}
+
+/**
+ * batadv_mcast_has_bridge - check whether the soft-iface is bridged
+ * @bat_priv: the bat priv with all the soft interface information
+ *
+ * Checks whether there is a bridge on top of our soft interface. Returns
+ * true if so, false otherwise.
+ */
+static bool batadv_mcast_has_bridge(struct batadv_priv *bat_priv)
+{
+        struct net_device *upper = bat_priv->soft_iface;
+
+        rcu_read_lock();
+        do {
+                upper = netdev_master_upper_dev_get_rcu(upper);
+        } while (upper && !(upper->priv_flags & IFF_EBRIDGE));
+        rcu_read_unlock();
+
+        return upper;
+}
+
+/**
+ * batadv_mcast_mla_tvlv_update - update multicast tvlv
+ * @bat_priv: the bat priv with all the soft interface information
+ *
+ * Updates the own multicast tvlv with our current multicast related settings,
+ * capabilities and inabilities.
+ *
+ * Returns true if the tvlv container is registered afterwards. Otherwise
+ * returns false.
+ */
+static bool batadv_mcast_mla_tvlv_update(struct batadv_priv *bat_priv)
+{
+        struct batadv_tvlv_mcast_data mcast_data;
+
+        mcast_data.flags = BATADV_NO_FLAGS;
+        memset(mcast_data.reserved, 0, sizeof(mcast_data.reserved));
+
+        /* Avoid attaching MLAs, if there is a bridge on top of our soft
+         * interface, we don't support that yet (TODO)
+         */
+        if (batadv_mcast_has_bridge(bat_priv)) {
+                if (bat_priv->mcast.enabled) {
+                        batadv_tvlv_container_unregister(bat_priv,
+                                                         BATADV_TVLV_MCAST, 1);
+                        bat_priv->mcast.enabled = false;
+                }
+
+                return false;
+        }
+
+        if (!bat_priv->mcast.enabled ||
+            mcast_data.flags != bat_priv->mcast.flags) {
+                batadv_tvlv_container_register(bat_priv, BATADV_TVLV_MCAST, 1,
+                                               &mcast_data, sizeof(mcast_data));
+                bat_priv->mcast.flags = mcast_data.flags;
+                bat_priv->mcast.enabled = true;
+        }
+
+        return true;
+}
+
+/**
+ * batadv_mcast_mla_update - update the own MLAs
+ * @bat_priv: the bat priv with all the soft interface information
+ *
+ * Updates the own multicast listener announcements in the translation
+ * table as well as the own, announced multicast tvlv container.
+ */
+void batadv_mcast_mla_update(struct batadv_priv *bat_priv)
+{
+        struct net_device *soft_iface = bat_priv->soft_iface;
+        struct hlist_head mcast_list = HLIST_HEAD_INIT;
+        int ret;
+
+        if (!batadv_mcast_mla_tvlv_update(bat_priv))
+                goto update;
+
+        ret = batadv_mcast_mla_softif_get(soft_iface, &mcast_list);
+        if (ret < 0)
+                goto out;
+
+update:
+        batadv_mcast_mla_tt_retract(bat_priv, &mcast_list);
+        batadv_mcast_mla_tt_add(bat_priv, &mcast_list);
+
+out:
+        batadv_mcast_mla_list_free(&mcast_list);
+}
+
+/**
+ * batadv_mcast_forw_mode_check_ipv4 - check for optimized forwarding potential
+ * @bat_priv: the bat priv with all the soft interface information
+ * @skb: the IPv4 packet to check
+ * @is_unsnoopable: stores whether the destination is snoopable
+ *
+ * Checks whether the given IPv4 packet has the potential to be forwarded with a
+ * mode more optimal than classic flooding.
+ *
+ * If so then returns 0. Otherwise -EINVAL is returned or -ENOMEM in case of
+ * memory allocation failure.
+ */
+static int batadv_mcast_forw_mode_check_ipv4(struct batadv_priv *bat_priv,
+                                             struct sk_buff *skb,
+                                             bool *is_unsnoopable)
+{
+        struct iphdr *iphdr;
+
+        /* We might fail due to out-of-memory -> drop it */
+        if (!pskb_may_pull(skb, sizeof(struct ethhdr) + sizeof(*iphdr)))
+                return -ENOMEM;
+
+        iphdr = ip_hdr(skb);
+
+        /* TODO: Implement Multicast Router Discovery (RFC4286),
+         * then allow scope > link local, too
+         */
+        if (!ipv4_is_local_multicast(iphdr->daddr))
+                return -EINVAL;
+
+        /* link-local multicast listeners behind a bridge are
+         * not snoopable (see RFC4541, section 2.1.2.2)
+         */
+        *is_unsnoopable = true;
+
+        return 0;
+}
+
+/**
+ * batadv_mcast_forw_mode_check_ipv6 - check for optimized forwarding potential
+ * @bat_priv: the bat priv with all the soft interface information
+ * @skb: the IPv6 packet to check
+ * @is_unsnoopable: stores whether the destination is snoopable
+ *
+ * Checks whether the given IPv6 packet has the potential to be forwarded with a
+ * mode more optimal than classic flooding.
+ *
+ * If so then returns 0. Otherwise -EINVAL is returned or -ENOMEM if we are out
+ * of memory.
+ */
+static int batadv_mcast_forw_mode_check_ipv6(struct batadv_priv *bat_priv,
+                                             struct sk_buff *skb,
+                                             bool *is_unsnoopable)
+{
+        struct ipv6hdr *ip6hdr;
+
+        /* We might fail due to out-of-memory -> drop it */
+        if (!pskb_may_pull(skb, sizeof(struct ethhdr) + sizeof(*ip6hdr)))
+                return -ENOMEM;
+
+        ip6hdr = ipv6_hdr(skb);
+
+        /* TODO: Implement Multicast Router Discovery (RFC4286),
+         * then allow scope > link local, too
+         */
+        if (IPV6_ADDR_MC_SCOPE(&ip6hdr->daddr) != IPV6_ADDR_SCOPE_LINKLOCAL)
+                return -EINVAL;
+
+        /* link-local-all-nodes multicast listeners behind a bridge are
+         * not snoopable (see RFC4541, section 3, paragraph 3)
+         */
+        if (ipv6_addr_is_ll_all_nodes(&ip6hdr->daddr))
+                *is_unsnoopable = true;
+
+        return 0;
+}
+
+/**
+ * batadv_mcast_forw_mode_check - check for optimized forwarding potential
+ * @bat_priv: the bat priv with all the soft interface information
+ * @skb: the multicast frame to check
+ * @is_unsnoopable: stores whether the destination is snoopable
+ *
+ * Checks whether the given multicast ethernet frame has the potential to be
+ * forwarded with a mode more optimal than classic flooding.
+ *
+ * If so then returns 0. Otherwise -EINVAL is returned or -ENOMEM if we are out
+ * of memory.
+ */
+static int batadv_mcast_forw_mode_check(struct batadv_priv *bat_priv,
+                                        struct sk_buff *skb,
+                                        bool *is_unsnoopable)
+{
+        struct ethhdr *ethhdr = eth_hdr(skb);
+
+        if (!atomic_read(&bat_priv->multicast_mode))
+                return -EINVAL;
+
+        if (atomic_read(&bat_priv->mcast.num_disabled))
+                return -EINVAL;
+
+        switch (ntohs(ethhdr->h_proto)) {
+        case ETH_P_IP:
+                return batadv_mcast_forw_mode_check_ipv4(bat_priv, skb,
+                                                         is_unsnoopable);
+        case ETH_P_IPV6:
+                return batadv_mcast_forw_mode_check_ipv6(bat_priv, skb,
+                                                         is_unsnoopable);
+        default:
+                return -EINVAL;
+        }
+}
+
+/**
+ * batadv_mcast_want_all_ip_count - count nodes with unspecific mcast interest
+ * @bat_priv: the bat priv with all the soft interface information
+ * @ethhdr: ethernet header of a packet
+ *
+ * Returns the number of nodes which want all IPv4 multicast traffic if the
+ * given ethhdr is from an IPv4 packet or the number of nodes which want all
+ * IPv6 traffic if it matches an IPv6 packet.
+ */
+static int batadv_mcast_forw_want_all_ip_count(struct batadv_priv *bat_priv,
+                                               struct ethhdr *ethhdr)
+{
+        switch (ntohs(ethhdr->h_proto)) {
+        case ETH_P_IP:
+                return atomic_read(&bat_priv->mcast.num_want_all_ipv4);
+        case ETH_P_IPV6:
+                return atomic_read(&bat_priv->mcast.num_want_all_ipv6);
+        default:
+                /* we shouldn't be here... */
+                return 0;
+        }
+}
+
+/**
+ * batadv_mcast_forw_tt_node_get - get a multicast tt node
+ * @bat_priv: the bat priv with all the soft interface information
+ * @ethhdr: the ether header containing the multicast destination
+ *
+ * Returns an orig_node matching the multicast address provided by ethhdr
+ * via a translation table lookup. This increases the returned nodes refcount.
+ */
+static struct batadv_orig_node *
+batadv_mcast_forw_tt_node_get(struct batadv_priv *bat_priv,
+                              struct ethhdr *ethhdr)
+{
+        return batadv_transtable_search(bat_priv, ethhdr->h_source,
+                                        ethhdr->h_dest, BATADV_NO_FLAGS);
+}
+
+/**
+ * batadv_mcast_want_forw_ipv4_node_get - get a node with an ipv4 flag
+ * @bat_priv: the bat priv with all the soft interface information
+ *
+ * Returns an orig_node which has the BATADV_MCAST_WANT_ALL_IPV4 flag set and
+ * increases its refcount.
+ */
+static struct batadv_orig_node *
+batadv_mcast_forw_ipv4_node_get(struct batadv_priv *bat_priv)
+{
+        struct batadv_orig_node *tmp_orig_node, *orig_node = NULL;
+
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(tmp_orig_node,
+                                 &bat_priv->mcast.want_all_ipv4_list,
+                                 mcast_want_all_ipv4_node) {
+                if (!atomic_inc_not_zero(&orig_node->refcount))
+                        continue;
+
+                orig_node = tmp_orig_node;
+                break;
+        }
+        rcu_read_unlock();
+
+        return orig_node;
+}
+
+/**
+ * batadv_mcast_want_forw_ipv6_node_get - get a node with an ipv6 flag
+ * @bat_priv: the bat priv with all the soft interface information
+ *
+ * Returns an orig_node which has the BATADV_MCAST_WANT_ALL_IPV6 flag set
+ * and increases its refcount.
+ */
+static struct batadv_orig_node *
+batadv_mcast_forw_ipv6_node_get(struct batadv_priv *bat_priv)
+{
+        struct batadv_orig_node *tmp_orig_node, *orig_node = NULL;
+
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(tmp_orig_node,
+                                 &bat_priv->mcast.want_all_ipv6_list,
+                                 mcast_want_all_ipv6_node) {
+                if (!atomic_inc_not_zero(&orig_node->refcount))
+                        continue;
+
+                orig_node = tmp_orig_node;
+                break;
+        }
+        rcu_read_unlock();
+
+        return orig_node;
+}
+
+/**
+ * batadv_mcast_want_forw_ip_node_get - get a node with an ipv4/ipv6 flag
+ * @bat_priv: the bat priv with all the soft interface information
+ * @ethhdr: an ethernet header to determine the protocol family from
+ *
+ * Returns an orig_node which has the BATADV_MCAST_WANT_ALL_IPV4 or
+ * BATADV_MCAST_WANT_ALL_IPV6 flag, depending on the provided ethhdr, set and
+ * increases its refcount.
+ */
+static struct batadv_orig_node *
+batadv_mcast_forw_ip_node_get(struct batadv_priv *bat_priv,
+                              struct ethhdr *ethhdr)
+{
+        switch (ntohs(ethhdr->h_proto)) {
+        case ETH_P_IP:
+                return batadv_mcast_forw_ipv4_node_get(bat_priv);
+        case ETH_P_IPV6:
+                return batadv_mcast_forw_ipv6_node_get(bat_priv);
+        default:
+                /* we shouldn't be here... */
+                return NULL;
+        }
+}
+
+/**
+ * batadv_mcast_want_forw_unsnoop_node_get - get a node with an unsnoopable flag
+ * @bat_priv: the bat priv with all the soft interface information
+ *
+ * Returns an orig_node which has the BATADV_MCAST_WANT_ALL_UNSNOOPABLES flag
+ * set and increases its refcount.
+ */
+static struct batadv_orig_node *
+batadv_mcast_forw_unsnoop_node_get(struct batadv_priv *bat_priv)
+{
+        struct batadv_orig_node *tmp_orig_node, *orig_node = NULL;
+
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(tmp_orig_node,
+                                 &bat_priv->mcast.want_all_unsnoopables_list,
+                                 mcast_want_all_unsnoopables_node) {
+                if (!atomic_inc_not_zero(&orig_node->refcount))
+                        continue;
+
+                orig_node = tmp_orig_node;
+                break;
+        }
+        rcu_read_unlock();
+
+        return orig_node;
+}
+
+/**
+ * batadv_mcast_forw_mode - check on how to forward a multicast packet
+ * @bat_priv: the bat priv with all the soft interface information
+ * @skb: The multicast packet to check
+ * @orig: an originator to be set to forward the skb to
+ *
+ * Returns the forwarding mode as enum batadv_forw_mode and in case of
+ * BATADV_FORW_SINGLE set the orig to the single originator the skb
+ * should be forwarded to.
+ */
+enum batadv_forw_mode
+batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb,
+                       struct batadv_orig_node **orig)
+{
+        int ret, tt_count, ip_count, unsnoop_count, total_count;
+        bool is_unsnoopable = false;
+        struct ethhdr *ethhdr;
+
+        ret = batadv_mcast_forw_mode_check(bat_priv, skb, &is_unsnoopable);
+        if (ret == -ENOMEM)
+                return BATADV_FORW_NONE;
+        else if (ret < 0)
+                return BATADV_FORW_ALL;
+
+        ethhdr = eth_hdr(skb);
+
+        tt_count = batadv_tt_global_hash_count(bat_priv, ethhdr->h_dest,
+                                               BATADV_NO_FLAGS);
+        ip_count = batadv_mcast_forw_want_all_ip_count(bat_priv, ethhdr);
+        unsnoop_count = !is_unsnoopable ? 0 :
+                        atomic_read(&bat_priv->mcast.num_want_all_unsnoopables);
+
+        total_count = tt_count + ip_count + unsnoop_count;
+
+        switch (total_count) {
+        case 1:
+                if (tt_count)
+                        *orig = batadv_mcast_forw_tt_node_get(bat_priv, ethhdr);
+                else if (ip_count)
+                        *orig = batadv_mcast_forw_ip_node_get(bat_priv, ethhdr);
+                else if (unsnoop_count)
+                        *orig = batadv_mcast_forw_unsnoop_node_get(bat_priv);
+
+                if (*orig)
+                        return BATADV_FORW_SINGLE;
+
+                /* fall through */
+        case 0:
+                return BATADV_FORW_NONE;
+        default:
+                return BATADV_FORW_ALL;
+        }
+}
+
+/**
+ * batadv_mcast_want_unsnoop_update - update unsnoop counter and list
+ * @bat_priv: the bat priv with all the soft interface information
+ * @orig: the orig_node which multicast state might have changed of
+ * @mcast_flags: flags indicating the new multicast state
+ *
+ * If the BATADV_MCAST_WANT_ALL_UNSNOOPABLES flag of this originator,
+ * orig, has toggled then this method updates counter and list accordingly.
+ */
+static void batadv_mcast_want_unsnoop_update(struct batadv_priv *bat_priv,
+                                             struct batadv_orig_node *orig,
+                                             uint8_t mcast_flags)
+{
+        /* switched from flag unset to set */
+        if (mcast_flags & BATADV_MCAST_WANT_ALL_UNSNOOPABLES &&
+            !(orig->mcast_flags & BATADV_MCAST_WANT_ALL_UNSNOOPABLES)) {
+                atomic_inc(&bat_priv->mcast.num_want_all_unsnoopables);
+
+                spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+                hlist_add_head_rcu(&orig->mcast_want_all_unsnoopables_node,
+                                   &bat_priv->mcast.want_all_unsnoopables_list);
+                spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+        /* switched from flag set to unset */
+        } else if (!(mcast_flags & BATADV_MCAST_WANT_ALL_UNSNOOPABLES) &&
+                   orig->mcast_flags & BATADV_MCAST_WANT_ALL_UNSNOOPABLES) {
+                atomic_dec(&bat_priv->mcast.num_want_all_unsnoopables);
+
+                spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+                hlist_del_rcu(&orig->mcast_want_all_unsnoopables_node);
+                spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+        }
+}
+
+/**
+ * batadv_mcast_want_ipv4_update - update want-all-ipv4 counter and list
+ * @bat_priv: the bat priv with all the soft interface information
+ * @orig: the orig_node which multicast state might have changed of
+ * @mcast_flags: flags indicating the new multicast state
+ *
+ * If the BATADV_MCAST_WANT_ALL_IPV4 flag of this originator, orig, has
+ * toggled then this method updates counter and list accordingly.
+ */
+static void batadv_mcast_want_ipv4_update(struct batadv_priv *bat_priv,
+                                          struct batadv_orig_node *orig,
+                                          uint8_t mcast_flags)
+{
+        /* switched from flag unset to set */
+        if (mcast_flags & BATADV_MCAST_WANT_ALL_IPV4 &&
+            !(orig->mcast_flags & BATADV_MCAST_WANT_ALL_IPV4)) {
+                atomic_inc(&bat_priv->mcast.num_want_all_ipv4);
+
+                spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+                hlist_add_head_rcu(&orig->mcast_want_all_ipv4_node,
+                                   &bat_priv->mcast.want_all_ipv4_list);
+                spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+        /* switched from flag set to unset */
+        } else if (!(mcast_flags & BATADV_MCAST_WANT_ALL_IPV4) &&
+                   orig->mcast_flags & BATADV_MCAST_WANT_ALL_IPV4) {
+                atomic_dec(&bat_priv->mcast.num_want_all_ipv4);
+
+                spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+                hlist_del_rcu(&orig->mcast_want_all_ipv4_node);
+                spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+        }
+}
+
+/**
+ * batadv_mcast_want_ipv6_update - update want-all-ipv6 counter and list
+ * @bat_priv: the bat priv with all the soft interface information
+ * @orig: the orig_node which multicast state might have changed of
+ * @mcast_flags: flags indicating the new multicast state
+ *
+ * If the BATADV_MCAST_WANT_ALL_IPV6 flag of this originator, orig, has
+ * toggled then this method updates counter and list accordingly.
+ */
+static void batadv_mcast_want_ipv6_update(struct batadv_priv *bat_priv,
+                                          struct batadv_orig_node *orig,
+                                          uint8_t mcast_flags)
+{
+        /* switched from flag unset to set */
+        if (mcast_flags & BATADV_MCAST_WANT_ALL_IPV6 &&
+            !(orig->mcast_flags & BATADV_MCAST_WANT_ALL_IPV6)) {
+                atomic_inc(&bat_priv->mcast.num_want_all_ipv6);
+
+                spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+                hlist_add_head_rcu(&orig->mcast_want_all_ipv6_node,
+                                   &bat_priv->mcast.want_all_ipv6_list);
+                spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+        /* switched from flag set to unset */
+        } else if (!(mcast_flags & BATADV_MCAST_WANT_ALL_IPV6) &&
+                   orig->mcast_flags & BATADV_MCAST_WANT_ALL_IPV6) {
+                atomic_dec(&bat_priv->mcast.num_want_all_ipv6);
+
+                spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+                hlist_del_rcu(&orig->mcast_want_all_ipv6_node);
+                spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+        }
+}
+
+/**
+ * batadv_mcast_tvlv_ogm_handler_v1 - process incoming multicast tvlv container
+ * @bat_priv: the bat priv with all the soft interface information
+ * @orig: the orig_node of the ogm
+ * @flags: flags indicating the tvlv state (see batadv_tvlv_handler_flags)
+ * @tvlv_value: tvlv buffer containing the multicast data
+ * @tvlv_value_len: tvlv buffer length
+ */
+static void batadv_mcast_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
+                                             struct batadv_orig_node *orig,
+                                             uint8_t flags,
+                                             void *tvlv_value,
+                                             uint16_t tvlv_value_len)
+{
+        bool orig_mcast_enabled = !(flags & BATADV_TVLV_HANDLER_OGM_CIFNOTFND);
+        uint8_t mcast_flags = BATADV_NO_FLAGS;
+        bool orig_initialized;
+
+        orig_initialized = orig->capa_initialized & BATADV_ORIG_CAPA_HAS_MCAST;
+
+        /* If mcast support is turned on decrease the disabled mcast node
+         * counter only if we had increased it for this node before. If this
+         * is a completely new orig_node no need to decrease the counter.
+         */
+        if (orig_mcast_enabled &&
+            !(orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST)) {
+                if (orig_initialized)
+                        atomic_dec(&bat_priv->mcast.num_disabled);
+                orig->capabilities |= BATADV_ORIG_CAPA_HAS_MCAST;
+        /* If mcast support is being switched off increase the disabled
+         * mcast node counter.
+         */
+        } else if (!orig_mcast_enabled &&
+                   orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST) {
+                atomic_inc(&bat_priv->mcast.num_disabled);
+                orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_MCAST;
+        }
+
+        orig->capa_initialized |= BATADV_ORIG_CAPA_HAS_MCAST;
+
+        if (orig_mcast_enabled && tvlv_value &&
+            (tvlv_value_len >= sizeof(mcast_flags)))
+                mcast_flags = *(uint8_t *)tvlv_value;
+
+        batadv_mcast_want_unsnoop_update(bat_priv, orig, mcast_flags);
+        batadv_mcast_want_ipv4_update(bat_priv, orig, mcast_flags);
+        batadv_mcast_want_ipv6_update(bat_priv, orig, mcast_flags);
+
+        orig->mcast_flags = mcast_flags;
+}
+
+/**
+ * batadv_mcast_init - initialize the multicast optimizations structures
+ * @bat_priv: the bat priv with all the soft interface information
+ */
+void batadv_mcast_init(struct batadv_priv *bat_priv)
+{
+        batadv_tvlv_handler_register(bat_priv, batadv_mcast_tvlv_ogm_handler_v1,
+                                     NULL, BATADV_TVLV_MCAST, 1,
+                                     BATADV_TVLV_HANDLER_OGM_CIFNOTFND);
+}
+
+/**
+ * batadv_mcast_free - free the multicast optimizations structures
+ * @bat_priv: the bat priv with all the soft interface information
+ */
+void batadv_mcast_free(struct batadv_priv *bat_priv)
+{
+        batadv_tvlv_container_unregister(bat_priv, BATADV_TVLV_MCAST, 1);
+        batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_MCAST, 1);
+
+        batadv_mcast_mla_tt_retract(bat_priv, NULL);
+}
+
+/**
+ * batadv_mcast_purge_orig - reset originator global mcast state modifications
+ * @orig: the originator which is going to get purged
+ */
+void batadv_mcast_purge_orig(struct batadv_orig_node *orig)
+{
+        struct batadv_priv *bat_priv = orig->bat_priv;
+
+        if (!(orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST))
+                atomic_dec(&bat_priv->mcast.num_disabled);
+
+        batadv_mcast_want_unsnoop_update(bat_priv, orig, BATADV_NO_FLAGS);
+        batadv_mcast_want_ipv4_update(bat_priv, orig, BATADV_NO_FLAGS);
+        batadv_mcast_want_ipv6_update(bat_priv, orig, BATADV_NO_FLAGS);
+}
diff --git a/net/batman-adv/multicast.h b/net/batman-adv/multicast.h
new file mode 100644
index 000000000000..73b5d45819c1
--- /dev/null
+++ b/net/batman-adv/multicast.h
@@ -0,0 +1,80 @@
+/* Copyright (C) 2014 B.A.T.M.A.N. contributors:
+ *
+ * Linus Lüssing
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _NET_BATMAN_ADV_MULTICAST_H_
+#define _NET_BATMAN_ADV_MULTICAST_H_
+
+/**
+ * batadv_forw_mode - the way a packet should be forwarded as
+ * @BATADV_FORW_ALL: forward the packet to all nodes (currently via classic
+ *  flooding)
+ * @BATADV_FORW_SINGLE: forward the packet to a single node (currently via the
+ *  BATMAN unicast routing protocol)
+ * @BATADV_FORW_NONE: don't forward, drop it
+ */
+enum batadv_forw_mode {
+        BATADV_FORW_ALL,
+        BATADV_FORW_SINGLE,
+        BATADV_FORW_NONE,
+};
+
+#ifdef CONFIG_BATMAN_ADV_MCAST
+
+void batadv_mcast_mla_update(struct batadv_priv *bat_priv);
+
+enum batadv_forw_mode
+batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb,
+                       struct batadv_orig_node **mcast_single_orig);
+
+void batadv_mcast_init(struct batadv_priv *bat_priv);
+
+void batadv_mcast_free(struct batadv_priv *bat_priv);
+
+void batadv_mcast_purge_orig(struct batadv_orig_node *orig_node);
+
+#else
+
+static inline void batadv_mcast_mla_update(struct batadv_priv *bat_priv)
+{
+        return;
+}
+
+static inline enum batadv_forw_mode
+batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb,
+                       struct batadv_orig_node **mcast_single_orig)
+{
+        return BATADV_FORW_ALL;
+}
+
+static inline int batadv_mcast_init(struct batadv_priv *bat_priv)
+{
+        return 0;
+}
+
+static inline void batadv_mcast_free(struct batadv_priv *bat_priv)
+{
+        return;
+}
+
+static inline void batadv_mcast_purge_orig(struct batadv_orig_node *orig_node)
+{
+        return;
+}
+
+#endif /* CONFIG_BATMAN_ADV_MCAST */
+
+#endif /* _NET_BATMAN_ADV_MULTICAST_H_ */
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index f1b604d88dc3..a9546fe541eb 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -819,7 +819,7 @@ static struct batadv_nc_node
 
         /* Initialize nc_node */
         INIT_LIST_HEAD(&nc_node->list);
-        memcpy(nc_node->addr, orig_node->orig, ETH_ALEN);
+        ether_addr_copy(nc_node->addr, orig_node->orig);
         nc_node->orig_node = orig_neigh_node;
         atomic_set(&nc_node->refcount, 2);
 
@@ -941,8 +941,8 @@ static struct batadv_nc_path *batadv_nc_get_path(struct batadv_priv *bat_priv,
         spin_lock_init(&nc_path->packet_list_lock);
         atomic_set(&nc_path->refcount, 2);
         nc_path->last_valid = jiffies;
-        memcpy(nc_path->next_hop, dst, ETH_ALEN);
-        memcpy(nc_path->prev_hop, src, ETH_ALEN);
+        ether_addr_copy(nc_path->next_hop, dst);
+        ether_addr_copy(nc_path->prev_hop, src);
 
         batadv_dbg(BATADV_DBG_NC, bat_priv, "Adding nc_path %pM -> %pM\n",
                    nc_path->prev_hop,
@@ -1114,15 +1114,15 @@ static bool batadv_nc_code_packets(struct batadv_priv *bat_priv,
         coded_packet->ttl = packet1->ttl;
 
         /* Info about first unicast packet */
-        memcpy(coded_packet->first_source, first_source, ETH_ALEN);
-        memcpy(coded_packet->first_orig_dest, packet1->dest, ETH_ALEN);
+        ether_addr_copy(coded_packet->first_source, first_source);
+        ether_addr_copy(coded_packet->first_orig_dest, packet1->dest);
         coded_packet->first_crc = packet_id1;
         coded_packet->first_ttvn = packet1->ttvn;
 
         /* Info about second unicast packet */
-        memcpy(coded_packet->second_dest, second_dest, ETH_ALEN);
-        memcpy(coded_packet->second_source, second_source, ETH_ALEN);
-        memcpy(coded_packet->second_orig_dest, packet2->dest, ETH_ALEN);
+        ether_addr_copy(coded_packet->second_dest, second_dest);
+        ether_addr_copy(coded_packet->second_source, second_source);
+        ether_addr_copy(coded_packet->second_orig_dest, packet2->dest);
         coded_packet->second_crc = packet_id2;
         coded_packet->second_ttl = packet2->ttl;
         coded_packet->second_ttvn = packet2->ttvn;
@@ -1349,8 +1349,8 @@ static void batadv_nc_skb_store_before_coding(struct batadv_priv *bat_priv,
 
         /* Set the mac header as if we actually sent the packet uncoded */
         ethhdr = eth_hdr(skb);
-        memcpy(ethhdr->h_source, ethhdr->h_dest, ETH_ALEN);
-        memcpy(ethhdr->h_dest, eth_dst_new, ETH_ALEN);
+        ether_addr_copy(ethhdr->h_source, ethhdr->h_dest);
+        ether_addr_copy(ethhdr->h_dest, eth_dst_new);
 
         /* Set data pointer to MAC header to mimic packets from our tx path */
         skb_push(skb, ETH_HLEN);
@@ -1636,7 +1636,7 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
 
         /* Reconstruct original mac header */
         ethhdr = eth_hdr(skb);
-        memcpy(ethhdr, &ethhdr_tmp, sizeof(*ethhdr));
+        *ethhdr = ethhdr_tmp;
 
         /* Select the correct unicast header information based on the location
          * of our mac address in the coded_packet header
@@ -1646,7 +1646,7 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
                  * so the Ethernet address must be copied to h_dest and
                  * pkt_type changed from PACKET_OTHERHOST to PACKET_HOST
                  */
-                memcpy(ethhdr->h_dest, coded_packet_tmp.second_dest, ETH_ALEN);
+                ether_addr_copy(ethhdr->h_dest, coded_packet_tmp.second_dest);
                 skb->pkt_type = PACKET_HOST;
 
                 orig_dest = coded_packet_tmp.second_orig_dest;
@@ -1682,7 +1682,7 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
         unicast_packet->packet_type = BATADV_UNICAST;
         unicast_packet->version = BATADV_COMPAT_VERSION;
         unicast_packet->ttl = ttl;
-        memcpy(unicast_packet->dest, orig_dest, ETH_ALEN);
+        ether_addr_copy(unicast_packet->dest, orig_dest);
         unicast_packet->ttvn = ttvn;
 
         batadv_nc_packet_free(nc_packet);
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 853941629dc1..ffd9dfbd9b0e 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -27,6 +27,7 @@
 #include "bridge_loop_avoidance.h"
 #include "network-coding.h"
 #include "fragmentation.h"
+#include "multicast.h"
 
 /* hash class keys */
 static struct lock_class_key batadv_orig_hash_lock_class_key;
@@ -446,7 +447,7 @@ batadv_neigh_node_new(struct batadv_hard_iface *hard_iface,
         INIT_HLIST_HEAD(&neigh_node->ifinfo_list);
         spin_lock_init(&neigh_node->ifinfo_lock);
 
-        memcpy(neigh_node->addr, neigh_addr, ETH_ALEN);
+        ether_addr_copy(neigh_node->addr, neigh_addr);
         neigh_node->if_incoming = hard_iface;
         neigh_node->orig_node = orig_node;
 
@@ -557,6 +558,8 @@ static void batadv_orig_node_free_rcu(struct rcu_head *rcu)
         }
         spin_unlock_bh(&orig_node->neigh_list_lock);
 
+        batadv_mcast_purge_orig(orig_node);
+
         /* Free nc_nodes */
         batadv_nc_purge_orig(orig_node->bat_priv, orig_node, NULL);
 
@@ -664,15 +667,17 @@ struct batadv_orig_node *batadv_orig_node_new(struct batadv_priv *bat_priv,
         /* extra reference for return */
         atomic_set(&orig_node->refcount, 2);
 
-        orig_node->tt_initialised = false;
         orig_node->bat_priv = bat_priv;
-        memcpy(orig_node->orig, addr, ETH_ALEN);
+        ether_addr_copy(orig_node->orig, addr);
         batadv_dat_init_orig_node_addr(orig_node);
         atomic_set(&orig_node->last_ttvn, 0);
         orig_node->tt_buff = NULL;
         orig_node->tt_buff_len = 0;
         reset_time = jiffies - 1 - msecs_to_jiffies(BATADV_RESET_PROTECTION_MS);
         orig_node->bcast_seqno_reset = reset_time;
+#ifdef CONFIG_BATMAN_ADV_MCAST
+        orig_node->mcast_flags = BATADV_NO_FLAGS;
+#endif
 
         /* create a vlan object for the "untagged" LAN */
         vlan = batadv_orig_node_vlan_new(orig_node, BATADV_NO_FLAGS);
diff --git a/net/batman-adv/packet.h b/net/batman-adv/packet.h
index 0a381d1174c1..34e096d2dce1 100644
--- a/net/batman-adv/packet.h
+++ b/net/batman-adv/packet.h
@@ -89,6 +89,19 @@ enum batadv_icmp_packettype {
         BATADV_PARAMETER_PROBLEM       = 12,
 };
 
+/**
+ * enum batadv_mcast_flags - flags for multicast capabilities and settings
+ * @BATADV_MCAST_WANT_ALL_UNSNOOPABLES: we want all packets destined for
+ *  224.0.0.0/24 or ff02::1
+ * @BATADV_MCAST_WANT_ALL_IPV4: we want all IPv4 multicast packets
+ * @BATADV_MCAST_WANT_ALL_IPV6: we want all IPv6 multicast packets
+ */
+enum batadv_mcast_flags {
+        BATADV_MCAST_WANT_ALL_UNSNOOPABLES      = BIT(0),
+        BATADV_MCAST_WANT_ALL_IPV4              = BIT(1),
+        BATADV_MCAST_WANT_ALL_IPV6              = BIT(2),
+};
+
 /* tt data subtypes */
 #define BATADV_TT_DATA_TYPE_MASK 0x0F
 
@@ -106,10 +119,30 @@ enum batadv_tt_data_flags {
         BATADV_TT_FULL_TABLE = BIT(4),
 };
 
-/* BATADV_TT_CLIENT flags.
- * Flags from BIT(0) to BIT(7) are sent on the wire, while flags from BIT(8) to
- * BIT(15) are used for local computation only.
- * Flags from BIT(4) to BIT(7) are kept in sync with the rest of the network.
+/**
+ * enum batadv_tt_client_flags - TT client specific flags
+ * @BATADV_TT_CLIENT_DEL: the client has to be deleted from the table
+ * @BATADV_TT_CLIENT_ROAM: the client roamed to/from another node and the new
+ *  update telling its new real location has not been received/sent yet
+ * @BATADV_TT_CLIENT_WIFI: this client is connected through a wifi interface.
+ *  This information is used by the "AP Isolation" feature
+ * @BATADV_TT_CLIENT_ISOLA: this client is considered "isolated". This
+ *  information is used by the Extended Isolation feature
+ * @BATADV_TT_CLIENT_NOPURGE: this client should never be removed from the table
+ * @BATADV_TT_CLIENT_NEW: this client has been added to the local table but has
+ *  not been announced yet
+ * @BATADV_TT_CLIENT_PENDING: this client is marked for removal but it is kept
+ *  in the table for one more originator interval for consistency purposes
+ * @BATADV_TT_CLIENT_TEMP: this global client has been detected to be part of
+ *  the network but no nnode has already announced it
+ *
+ * Bits from 0 to 7 are called _remote flags_ because they are sent on the wire.
+ * Bits from 8 to 15 are called _local flags_ because they are used for local
+ * computations only.
+ *
+ * Bits from 4 to 7 - a subset of remote flags - are ensured to be in sync with
+ * the other nodes in the network. To achieve this goal these flags are included
+ * in the TT CRC computation.
  */
 enum batadv_tt_client_flags {
         BATADV_TT_CLIENT_DEL     = BIT(0),
@@ -145,6 +178,7 @@ enum batadv_bla_claimframe {
  * @BATADV_TVLV_NC: network coding tvlv
  * @BATADV_TVLV_TT: translation table tvlv
  * @BATADV_TVLV_ROAM: roaming advertisement tvlv
+ * @BATADV_TVLV_MCAST: multicast capability tvlv
  */
 enum batadv_tvlv_type {
         BATADV_TVLV_GW          = 0x01,
@@ -152,6 +186,7 @@ enum batadv_tvlv_type {
         BATADV_TVLV_NC          = 0x03,
         BATADV_TVLV_TT          = 0x04,
         BATADV_TVLV_ROAM        = 0x05,
+        BATADV_TVLV_MCAST       = 0x06,
 };
 
 #pragma pack(2)
@@ -504,4 +539,14 @@ struct batadv_tvlv_roam_adv {
         __be16 vid;
 };
 
+/**
+ * struct batadv_tvlv_mcast_data - payload of a multicast tvlv
+ * @flags: multicast flags announced by the orig node
+ * @reserved: reserved field
+ */
+struct batadv_tvlv_mcast_data {
+        uint8_t flags;
+        uint8_t reserved[3];
+};
+
 #endif /* _NET_BATMAN_ADV_PACKET_H_ */
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index a953d5b196a3..35141534938e 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -222,8 +222,8 @@ static int batadv_recv_my_icmp_packet(struct batadv_priv *bat_priv,
 
                 icmph = (struct batadv_icmp_header *)skb->data;
 
-                memcpy(icmph->dst, icmph->orig, ETH_ALEN);
-                memcpy(icmph->orig, primary_if->net_dev->dev_addr, ETH_ALEN);
+                ether_addr_copy(icmph->dst, icmph->orig);
+                ether_addr_copy(icmph->orig, primary_if->net_dev->dev_addr);
                 icmph->msg_type = BATADV_ECHO_REPLY;
                 icmph->ttl = BATADV_TTL;
 
@@ -276,9 +276,8 @@ static int batadv_recv_icmp_ttl_exceeded(struct batadv_priv *bat_priv,
 
         icmp_packet = (struct batadv_icmp_packet *)skb->data;
 
-        memcpy(icmp_packet->dst, icmp_packet->orig, ETH_ALEN);
-        memcpy(icmp_packet->orig, primary_if->net_dev->dev_addr,
-               ETH_ALEN);
+        ether_addr_copy(icmp_packet->dst, icmp_packet->orig);
+        ether_addr_copy(icmp_packet->orig, primary_if->net_dev->dev_addr);
         icmp_packet->msg_type = BATADV_TTL_EXCEEDED;
         icmp_packet->ttl = BATADV_TTL;
 
@@ -341,8 +340,8 @@ int batadv_recv_icmp_packet(struct sk_buff *skb,
                 if (icmp_packet_rr->rr_cur >= BATADV_RR_LEN)
                         goto out;
 
-                memcpy(&(icmp_packet_rr->rr[icmp_packet_rr->rr_cur]),
-                       ethhdr->h_dest, ETH_ALEN);
+                ether_addr_copy(icmp_packet_rr->rr[icmp_packet_rr->rr_cur],
+                                ethhdr->h_dest);
                 icmp_packet_rr->rr_cur++;
         }
 
@@ -664,7 +663,7 @@ batadv_reroute_unicast_packet(struct batadv_priv *bat_priv,
         }
 
         /* update the packet header */
-        memcpy(unicast_packet->dest, orig_addr, ETH_ALEN);
+        ether_addr_copy(unicast_packet->dest, orig_addr);
         unicast_packet->ttvn = orig_ttvn;
 
         ret = true;
@@ -774,7 +773,7 @@ static int batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
         if (!primary_if)
                 return 0;
 
-        memcpy(unicast_packet->dest, primary_if->net_dev->dev_addr, ETH_ALEN);
+        ether_addr_copy(unicast_packet->dest, primary_if->net_dev->dev_addr);
 
         batadv_hardif_free_ref(primary_if);
 
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 843febd1e519..3d64ed20c393 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -27,6 +27,7 @@
 #include "originator.h"
 #include "network-coding.h"
 #include "fragmentation.h"
+#include "multicast.h"
 
 static void batadv_send_outstanding_bcast_packet(struct work_struct *work);
 
@@ -59,8 +60,8 @@ int batadv_send_skb_packet(struct sk_buff *skb,
         skb_reset_mac_header(skb);
 
         ethhdr = eth_hdr(skb);
-        memcpy(ethhdr->h_source, hard_iface->net_dev->dev_addr, ETH_ALEN);
-        memcpy(ethhdr->h_dest, dst_addr, ETH_ALEN);
+        ether_addr_copy(ethhdr->h_source, hard_iface->net_dev->dev_addr);
+        ether_addr_copy(ethhdr->h_dest, dst_addr);
         ethhdr->h_proto = htons(ETH_P_BATMAN);
 
         skb_set_network_header(skb, ETH_HLEN);
@@ -165,7 +166,7 @@ batadv_send_skb_push_fill_unicast(struct sk_buff *skb, int hdr_size,
         /* set unicast ttl */
         unicast_packet->ttl = BATADV_TTL;
         /* copy the destination for faster routing */
-        memcpy(unicast_packet->dest, orig_node->orig, ETH_ALEN);
+        ether_addr_copy(unicast_packet->dest, orig_node->orig);
         /* set the destination tt version number */
         unicast_packet->ttvn = ttvn;
 
@@ -220,7 +221,7 @@ bool batadv_send_skb_prepare_unicast_4addr(struct batadv_priv *bat_priv,
 
         uc_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;
         uc_4addr_packet->u.packet_type = BATADV_UNICAST_4ADDR;
-        memcpy(uc_4addr_packet->src, primary_if->net_dev->dev_addr, ETH_ALEN);
+        ether_addr_copy(uc_4addr_packet->src, primary_if->net_dev->dev_addr);
         uc_4addr_packet->subtype = packet_subtype;
         uc_4addr_packet->reserved = 0;
 
@@ -248,15 +249,15 @@ out:
  *
  * Returns NET_XMIT_DROP in case of error or NET_XMIT_SUCCESS otherwise.
  */
-static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
-                                   struct sk_buff *skb, int packet_type,
-                                   int packet_subtype,
-                                   struct batadv_orig_node *orig_node,
-                                   unsigned short vid)
+int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
+                            struct sk_buff *skb, int packet_type,
+                            int packet_subtype,
+                            struct batadv_orig_node *orig_node,
+                            unsigned short vid)
 {
         struct ethhdr *ethhdr;
         struct batadv_unicast_packet *unicast_packet;
-        int ret = NET_XMIT_DROP, hdr_size;
+        int ret = NET_XMIT_DROP;
 
         if (!orig_node)
                 goto out;
@@ -265,16 +266,12 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
         case BATADV_UNICAST:
                 if (!batadv_send_skb_prepare_unicast(skb, orig_node))
                         goto out;
-
-                hdr_size = sizeof(*unicast_packet);
                 break;
         case BATADV_UNICAST_4ADDR:
                 if (!batadv_send_skb_prepare_unicast_4addr(bat_priv, skb,
                                                            orig_node,
                                                            packet_subtype))
                         goto out;
-
-                hdr_size = sizeof(struct batadv_unicast_4addr_packet);
                 break;
         default:
                 /* this function supports UNICAST and UNICAST_4ADDR only. It
@@ -283,7 +280,10 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
                 goto out;
         }
 
-        ethhdr = (struct ethhdr *)(skb->data + hdr_size);
+        /* skb->data might have been reallocated by
+         * batadv_send_skb_prepare_unicast{,_4addr}()
+         */
+        ethhdr = eth_hdr(skb);
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
 
         /* inform the destination node that we are still missing a correct route
@@ -312,6 +312,7 @@ out:
  * @packet_type: the batman unicast packet type to use
  * @packet_subtype: the unicast 4addr packet subtype (only relevant for unicast
  *  4addr packets)
+ * @dst_hint: can be used to override the destination contained in the skb
  * @vid: the vid to be used to search the translation table
  *
  * Look up the recipient node for the destination address in the ethernet
diff --git a/net/batman-adv/send.h b/net/batman-adv/send.h
index aaddaa9661ce..38d0ec1833ae 100644
--- a/net/batman-adv/send.h
+++ b/net/batman-adv/send.h
@@ -36,6 +36,11 @@ bool batadv_send_skb_prepare_unicast_4addr(struct batadv_priv *bat_priv,
                                            struct sk_buff *skb,
                                            struct batadv_orig_node *orig_node,
                                            int packet_subtype);
+int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
+                            struct sk_buff *skb, int packet_type,
+                            int packet_subtype,
+                            struct batadv_orig_node *orig_node,
+                            unsigned short vid);
 int batadv_send_skb_via_tt_generic(struct batadv_priv *bat_priv,
                                    struct sk_buff *skb, int packet_type,
                                    int packet_subtype, uint8_t *dst_hint,
@@ -47,6 +52,7 @@ int batadv_send_skb_via_gw(struct batadv_priv *bat_priv, struct sk_buff *skb,
  * batadv_send_skb_via_tt - send an skb via TT lookup
  * @bat_priv: the bat priv with all the soft interface information
  * @skb: the payload to send
+ * @dst_hint: can be used to override the destination contained in the skb
  * @vid: the vid to be used to search the translation table
  *
  * Look up the recipient node for the destination address in the ethernet
@@ -68,6 +74,7 @@ static inline int batadv_send_skb_via_tt(struct batadv_priv *bat_priv,
  * @bat_priv: the bat priv with all the soft interface information
  * @skb: the payload to send
  * @packet_subtype: the unicast 4addr packet subtype to use
+ * @dst_hint: can be used to override the destination contained in the skb
  * @vid: the vid to be used to search the translation table
  *
  * Look up the recipient node for the destination address in the ethernet
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index f82c267e1886..744a59b85e15 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -32,6 +32,7 @@
 #include <linux/ethtool.h>
 #include <linux/etherdevice.h>
 #include <linux/if_vlan.h>
+#include "multicast.h"
 #include "bridge_loop_avoidance.h"
 #include "network-coding.h"
 
@@ -111,8 +112,8 @@ static int batadv_interface_set_mac_addr(struct net_device *dev, void *p)
         if (!is_valid_ether_addr(addr->sa_data))
                 return -EADDRNOTAVAIL;
 
-        memcpy(old_addr, dev->dev_addr, ETH_ALEN);
-        memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
+        ether_addr_copy(old_addr, dev->dev_addr);
+        ether_addr_copy(dev->dev_addr, addr->sa_data);
 
         /* only modify transtable if it has been initialized before */
         if (atomic_read(&bat_priv->mesh_state) == BATADV_MESH_ACTIVE) {
@@ -170,17 +171,19 @@ static int batadv_interface_tx(struct sk_buff *skb,
         unsigned short vid;
         uint32_t seqno;
         int gw_mode;
+        enum batadv_forw_mode forw_mode;
+        struct batadv_orig_node *mcast_single_orig = NULL;
 
         if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE)
                 goto dropped;
 
         soft_iface->trans_start = jiffies;
         vid = batadv_get_vid(skb, 0);
-        ethhdr = (struct ethhdr *)skb->data;
+        ethhdr = eth_hdr(skb);
 
         switch (ntohs(ethhdr->h_proto)) {
         case ETH_P_8021Q:
-                vhdr = (struct vlan_ethhdr *)skb->data;
+                vhdr = vlan_eth_hdr(skb);
 
                 if (vhdr->h_vlan_encapsulated_proto != ethertype)
                         break;
@@ -194,7 +197,7 @@ static int batadv_interface_tx(struct sk_buff *skb,
                 goto dropped;
 
         /* skb->data might have been reallocated by batadv_bla_tx() */
-        ethhdr = (struct ethhdr *)skb->data;
+        ethhdr = eth_hdr(skb);
 
         /* Register the client MAC in the transtable */
         if (!is_multicast_ether_addr(ethhdr->h_source)) {
@@ -230,7 +233,7 @@ static int batadv_interface_tx(struct sk_buff *skb,
                 /* skb->data may have been modified by
                  * batadv_gw_dhcp_recipient_get()
                  */
-                ethhdr = (struct ethhdr *)skb->data;
+                ethhdr = eth_hdr(skb);
                 /* if gw_mode is on, broadcast any non-DHCP message.
                  * All the DHCP packets are going to be sent as unicast
                  */
@@ -247,9 +250,19 @@ static int batadv_interface_tx(struct sk_buff *skb,
                          * directed to a DHCP server
                          */
                         goto dropped;
-        }
 
 send:
+                if (do_bcast && !is_broadcast_ether_addr(ethhdr->h_dest)) {
+                        forw_mode = batadv_mcast_forw_mode(bat_priv, skb,
+                                                           &mcast_single_orig);
+                        if (forw_mode == BATADV_FORW_NONE)
+                                goto dropped;
+
+                        if (forw_mode == BATADV_FORW_SINGLE)
+                                do_bcast = false;
+                }
+        }
+
         batadv_skb_set_priority(skb, 0);
 
         /* ethernet packet should be broadcasted */
@@ -279,8 +292,8 @@ send:
                 /* hw address of first interface is the orig mac because only
                  * this mac is known throughout the mesh
                  */
-                memcpy(bcast_packet->orig,
-                       primary_if->net_dev->dev_addr, ETH_ALEN);
+                ether_addr_copy(bcast_packet->orig,
+                                primary_if->net_dev->dev_addr);
 
                 /* set broadcast sequence number */
                 seqno = atomic_inc_return(&bat_priv->bcast_seqno);
@@ -301,6 +314,10 @@ send:
                         if (ret)
                                 goto dropped;
                         ret = batadv_send_skb_via_gw(bat_priv, skb, vid);
+                } else if (mcast_single_orig) {
+                        ret = batadv_send_skb_unicast(bat_priv, skb,
+                                                      BATADV_UNICAST, 0,
+                                                      mcast_single_orig, vid);
                 } else {
                         if (batadv_dat_snoop_outgoing_arp_request(bat_priv,
                                                                   skb))
@@ -652,10 +669,7 @@ static void batadv_softif_destroy_finish(struct work_struct *work)
         }
 
         batadv_sysfs_del_meshif(soft_iface);
-
-        rtnl_lock();
-        unregister_netdevice(soft_iface);
-        rtnl_unlock();
+        unregister_netdev(soft_iface);
 }
 
 /**
@@ -692,6 +706,14 @@ static int batadv_softif_init_late(struct net_device *dev)
 #ifdef CONFIG_BATMAN_ADV_DAT
         atomic_set(&bat_priv->distributed_arp_table, 1);
 #endif
+#ifdef CONFIG_BATMAN_ADV_MCAST
+        bat_priv->mcast.flags = BATADV_NO_FLAGS;
+        atomic_set(&bat_priv->multicast_mode, 1);
+        atomic_set(&bat_priv->mcast.num_disabled, 0);
+        atomic_set(&bat_priv->mcast.num_want_all_unsnoopables, 0);
+        atomic_set(&bat_priv->mcast.num_want_all_ipv4, 0);
+        atomic_set(&bat_priv->mcast.num_want_all_ipv6, 0);
+#endif
         atomic_set(&bat_priv->gw_mode, BATADV_GW_MODE_OFF);
         atomic_set(&bat_priv->gw_sel_class, 20);
         atomic_set(&bat_priv->gw.bandwidth_down, 100);
diff --git a/net/batman-adv/sysfs.c b/net/batman-adv/sysfs.c
index e456bf6bb284..1ebb0d9e2ea5 100644
--- a/net/batman-adv/sysfs.c
+++ b/net/batman-adv/sysfs.c
@@ -539,6 +539,9 @@ BATADV_ATTR_SIF_UINT(gw_sel_class, S_IRUGO | S_IWUSR, 1, BATADV_TQ_MAX_VALUE,
                      batadv_post_gw_reselect);
 static BATADV_ATTR(gw_bandwidth, S_IRUGO | S_IWUSR, batadv_show_gw_bwidth,
                    batadv_store_gw_bwidth);
+#ifdef CONFIG_BATMAN_ADV_MCAST
+BATADV_ATTR_SIF_BOOL(multicast_mode, S_IRUGO | S_IWUSR, NULL);
+#endif
 #ifdef CONFIG_BATMAN_ADV_DEBUG
 BATADV_ATTR_SIF_UINT(log_level, S_IRUGO | S_IWUSR, 0, BATADV_DBG_ALL, NULL);
 #endif
@@ -558,6 +561,9 @@ static struct batadv_attribute *batadv_mesh_attrs[] = {
 #ifdef CONFIG_BATMAN_ADV_DAT
         &batadv_attr_distributed_arp_table,
 #endif
+#ifdef CONFIG_BATMAN_ADV_MCAST
+        &batadv_attr_multicast_mode,
+#endif
         &batadv_attr_fragmentation,
         &batadv_attr_routing_algo,
         &batadv_attr_gw_mode,
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 959dde721c46..d636bde72c9a 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -24,6 +24,7 @@
 #include "originator.h"
 #include "routing.h"
 #include "bridge_loop_avoidance.h"
+#include "multicast.h"
 
 #include <linux/crc32c.h>
 
@@ -96,7 +97,7 @@ batadv_tt_hash_find(struct batadv_hashtable *hash, const uint8_t *addr,
         if (!hash)
                 return NULL;
 
-        memcpy(to_search.addr, addr, ETH_ALEN);
+        ether_addr_copy(to_search.addr, addr);
         to_search.vid = vid;
 
         index = batadv_choose_tt(&to_search, hash->size);
@@ -192,6 +193,31 @@ batadv_tt_global_entry_free_ref(struct batadv_tt_global_entry *tt_global_entry)
         }
 }
 
+/**
+ * batadv_tt_global_hash_count - count the number of orig entries
+ * @hash: hash table containing the tt entries
+ * @addr: the mac address of the client to count entries for
+ * @vid: VLAN identifier
+ *
+ * Return the number of originators advertising the given address/data
+ * (excluding ourself).
+ */
+int batadv_tt_global_hash_count(struct batadv_priv *bat_priv,
+                                const uint8_t *addr, unsigned short vid)
+{
+        struct batadv_tt_global_entry *tt_global_entry;
+        int count;
+
+        tt_global_entry = batadv_tt_global_hash_find(bat_priv, addr, vid);
+        if (!tt_global_entry)
+                return 0;
+
+        count = atomic_read(&tt_global_entry->orig_list_count);
+        batadv_tt_global_entry_free_ref(tt_global_entry);
+
+        return count;
+}
+
 static void batadv_tt_orig_list_entry_free_rcu(struct rcu_head *rcu)
 {
         struct batadv_tt_orig_list_entry *orig_entry;
@@ -333,7 +359,7 @@ static void batadv_tt_local_event(struct batadv_priv *bat_priv,
         tt_change_node->change.flags = flags;
         memset(tt_change_node->change.reserved, 0,
                sizeof(tt_change_node->change.reserved));
-        memcpy(tt_change_node->change.addr, common->addr, ETH_ALEN);
+        ether_addr_copy(tt_change_node->change.addr, common->addr);
         tt_change_node->change.vid = htons(common->vid);
 
         del_op_requested = flags & BATADV_TT_CLIENT_DEL;
@@ -484,7 +510,7 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
 {
         struct batadv_priv *bat_priv = netdev_priv(soft_iface);
         struct batadv_tt_local_entry *tt_local;
-        struct batadv_tt_global_entry *tt_global;
+        struct batadv_tt_global_entry *tt_global = NULL;
         struct net_device *in_dev = NULL;
         struct hlist_head *head;
         struct batadv_tt_orig_list_entry *orig_entry;
@@ -497,7 +523,9 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
                 in_dev = dev_get_by_index(&init_net, ifindex);
 
         tt_local = batadv_tt_local_hash_find(bat_priv, addr, vid);
-        tt_global = batadv_tt_global_hash_find(bat_priv, addr, vid);
+
+        if (!is_multicast_ether_addr(addr))
+                tt_global = batadv_tt_global_hash_find(bat_priv, addr, vid);
 
         if (tt_local) {
                 tt_local->last_seen = jiffies;
@@ -549,7 +577,7 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
                    addr, BATADV_PRINT_VID(vid),
                    (uint8_t)atomic_read(&bat_priv->tt.vn));
 
-        memcpy(tt_local->common.addr, addr, ETH_ALEN);
+        ether_addr_copy(tt_local->common.addr, addr);
         /* The local entry has to be marked as NEW to avoid to send it in
          * a full table response going out before the next ttvn increment
          * (consistency check)
@@ -562,8 +590,11 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
         tt_local->last_seen = jiffies;
         tt_local->common.added_at = tt_local->last_seen;
 
-        /* the batman interface mac address should never be purged */
-        if (batadv_compare_eth(addr, soft_iface->dev_addr))
+        /* the batman interface mac and multicast addresses should never be
+         * purged
+         */
+        if (batadv_compare_eth(addr, soft_iface->dev_addr) ||
+            is_multicast_ether_addr(addr))
                 tt_local->common.flags |= BATADV_TT_CLIENT_NOPURGE;
 
         hash_added = batadv_hash_add(bat_priv->tt.local_hash, batadv_compare_tt,
@@ -1219,6 +1250,8 @@ batadv_tt_global_orig_entry_add(struct batadv_tt_global_entry *tt_global,
         hlist_add_head_rcu(&orig_entry->list,
                            &tt_global->orig_list);
         spin_unlock_bh(&tt_global->list_lock);
+        atomic_inc(&tt_global->orig_list_count);
+
 out:
         if (orig_entry)
                 batadv_tt_orig_list_entry_free_ref(orig_entry);
@@ -1277,7 +1310,7 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv,
                         goto out;
 
                 common = &tt_global_entry->common;
-                memcpy(common->addr, tt_addr, ETH_ALEN);
+                ether_addr_copy(common->addr, tt_addr);
                 common->vid = vid;
 
                 common->flags = flags;
@@ -1292,6 +1325,7 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv,
                 common->added_at = jiffies;
 
                 INIT_HLIST_HEAD(&tt_global_entry->orig_list);
+                atomic_set(&tt_global_entry->orig_list_count, 0);
                 spin_lock_init(&tt_global_entry->list_lock);
 
                 hash_added = batadv_hash_add(bat_priv->tt.global_hash,
@@ -1361,6 +1395,11 @@ add_orig_entry:
         ret = true;
 
 out_remove:
+        /* Do not remove multicast addresses from the local hash on
+         * global additions
+         */
+        if (is_multicast_ether_addr(tt_addr))
+                goto out;
 
         /* remove address from local hash if present */
         local_flags = batadv_tt_local_remove(bat_priv, tt_addr, vid,
@@ -1552,6 +1591,25 @@ out:
         return 0;
 }
 
+/**
+ * batadv_tt_global_del_orig_entry - remove and free an orig_entry
+ * @tt_global_entry: the global entry to remove the orig_entry from
+ * @orig_entry: the orig entry to remove and free
+ *
+ * Remove an orig_entry from its list in the given tt_global_entry and
+ * free this orig_entry afterwards.
+ */
+static void
+batadv_tt_global_del_orig_entry(struct batadv_tt_global_entry *tt_global_entry,
+                                struct batadv_tt_orig_list_entry *orig_entry)
+{
+        batadv_tt_global_size_dec(orig_entry->orig_node,
+                                  tt_global_entry->common.vid);
+        atomic_dec(&tt_global_entry->orig_list_count);
+        hlist_del_rcu(&orig_entry->list);
+        batadv_tt_orig_list_entry_free_ref(orig_entry);
+}
+
 /* deletes the orig list of a tt_global_entry */
 static void
 batadv_tt_global_del_orig_list(struct batadv_tt_global_entry *tt_global_entry)
@@ -1562,20 +1620,26 @@ batadv_tt_global_del_orig_list(struct batadv_tt_global_entry *tt_global_entry)
 
         spin_lock_bh(&tt_global_entry->list_lock);
         head = &tt_global_entry->orig_list;
-        hlist_for_each_entry_safe(orig_entry, safe, head, list) {
-                hlist_del_rcu(&orig_entry->list);
-                batadv_tt_global_size_dec(orig_entry->orig_node,
-                                          tt_global_entry->common.vid);
-                batadv_tt_orig_list_entry_free_ref(orig_entry);
-        }
+        hlist_for_each_entry_safe(orig_entry, safe, head, list)
+                batadv_tt_global_del_orig_entry(tt_global_entry, orig_entry);
         spin_unlock_bh(&tt_global_entry->list_lock);
 }
 
+/**
+ * batadv_tt_global_del_orig_node - remove orig_node from a global tt entry
+ * @bat_priv: the bat priv with all the soft interface information
+ * @tt_global_entry: the global entry to remove the orig_node from
+ * @orig_node: the originator announcing the client
+ * @message: message to append to the log on deletion
+ *
+ * Remove the given orig_node and its according orig_entry from the given
+ * global tt entry.
+ */
 static void
-batadv_tt_global_del_orig_entry(struct batadv_priv *bat_priv,
-                                struct batadv_tt_global_entry *tt_global_entry,
-                                struct batadv_orig_node *orig_node,
-                                const char *message)
+batadv_tt_global_del_orig_node(struct batadv_priv *bat_priv,
+                               struct batadv_tt_global_entry *tt_global_entry,
+                               struct batadv_orig_node *orig_node,
+                               const char *message)
 {
         struct hlist_head *head;
         struct hlist_node *safe;
@@ -1592,10 +1656,8 @@ batadv_tt_global_del_orig_entry(struct batadv_priv *bat_priv,
                                    orig_node->orig,
                                    tt_global_entry->common.addr,
                                    BATADV_PRINT_VID(vid), message);
-                        hlist_del_rcu(&orig_entry->list);
-                        batadv_tt_global_size_dec(orig_node,
-                                                  tt_global_entry->common.vid);
-                        batadv_tt_orig_list_entry_free_ref(orig_entry);
+                        batadv_tt_global_del_orig_entry(tt_global_entry,
+                                                        orig_entry);
                 }
         }
         spin_unlock_bh(&tt_global_entry->list_lock);
@@ -1637,8 +1699,8 @@ batadv_tt_global_del_roaming(struct batadv_priv *bat_priv,
                 /* there is another entry, we can simply delete this
                  * one and can still use the other one.
                  */
-                batadv_tt_global_del_orig_entry(bat_priv, tt_global_entry,
-                                                orig_node, message);
+                batadv_tt_global_del_orig_node(bat_priv, tt_global_entry,
+                                               orig_node, message);
 }
 
 /**
@@ -1664,8 +1726,8 @@ static void batadv_tt_global_del(struct batadv_priv *bat_priv,
                 goto out;
 
         if (!roaming) {
-                batadv_tt_global_del_orig_entry(bat_priv, tt_global_entry,
-                                                orig_node, message);
+                batadv_tt_global_del_orig_node(bat_priv, tt_global_entry,
+                                               orig_node, message);
 
                 if (hlist_empty(&tt_global_entry->orig_list))
                         batadv_tt_global_free(bat_priv, tt_global_entry,
@@ -1748,8 +1810,8 @@ void batadv_tt_global_del_orig(struct batadv_priv *bat_priv,
                                                  struct batadv_tt_global_entry,
                                                  common);
 
-                        batadv_tt_global_del_orig_entry(bat_priv, tt_global,
-                                                        orig_node, message);
+                        batadv_tt_global_del_orig_node(bat_priv, tt_global,
+                                                       orig_node, message);
 
                         if (hlist_empty(&tt_global->orig_list)) {
                                 vid = tt_global->common.vid;
@@ -1763,7 +1825,7 @@ void batadv_tt_global_del_orig(struct batadv_priv *bat_priv,
                 }
                 spin_unlock_bh(list_lock);
         }
-        orig_node->tt_initialised = false;
+        orig_node->capa_initialized &= ~BATADV_ORIG_CAPA_HAS_TT;
 }
 
 static bool batadv_tt_global_to_purge(struct batadv_tt_global_entry *tt_global,
@@ -2160,7 +2222,7 @@ batadv_new_tt_req_node(struct batadv_priv *bat_priv,
         if (!tt_req_node)
                 goto unlock;
 
-        memcpy(tt_req_node->addr, orig_node->orig, ETH_ALEN);
+        ether_addr_copy(tt_req_node->addr, orig_node->orig);
         tt_req_node->issued_at = jiffies;
 
         list_add(&tt_req_node->list, &bat_priv->tt.req_list);
@@ -2240,8 +2302,7 @@ static void batadv_tt_tvlv_generate(struct batadv_priv *bat_priv,
                         if ((valid_cb) && (!valid_cb(tt_common_entry, cb_data)))
                                 continue;
 
-                        memcpy(tt_change->addr, tt_common_entry->addr,
-                               ETH_ALEN);
+                        ether_addr_copy(tt_change->addr, tt_common_entry->addr);
                         tt_change->flags = tt_common_entry->flags;
                         tt_change->vid = htons(tt_common_entry->vid);
                         memset(tt_change->reserved, 0,
@@ -2724,7 +2785,7 @@ static void _batadv_tt_update_changes(struct batadv_priv *bat_priv,
                                 return;
                 }
         }
-        orig_node->tt_initialised = true;
+        orig_node->capa_initialized |= BATADV_ORIG_CAPA_HAS_TT;
 }
 
 static void batadv_tt_fill_gtable(struct batadv_priv *bat_priv,
@@ -2932,7 +2993,7 @@ static bool batadv_tt_check_roam_count(struct batadv_priv *bat_priv,
                 tt_roam_node->first_time = jiffies;
                 atomic_set(&tt_roam_node->counter,
                            BATADV_ROAMING_MAX_COUNT - 1);
-                memcpy(tt_roam_node->addr, client, ETH_ALEN);
+                ether_addr_copy(tt_roam_node->addr, client);
 
                 list_add(&tt_roam_node->list, &bat_priv->tt.roam_list);
                 ret = true;
@@ -3121,6 +3182,9 @@ static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
  */
 static void batadv_tt_local_commit_changes_nolock(struct batadv_priv *bat_priv)
 {
+        /* Update multicast addresses in local translation table */
+        batadv_mcast_mla_update(bat_priv);
+
         if (atomic_read(&bat_priv->tt.local_changes) < 1) {
                 if (!batadv_atomic_dec_not_zero(&bat_priv->tt.ogm_append_cnt))
                         batadv_tt_tvlv_container_update(bat_priv);
@@ -3211,13 +3275,15 @@ static void batadv_tt_update_orig(struct batadv_priv *bat_priv,
         uint8_t orig_ttvn = (uint8_t)atomic_read(&orig_node->last_ttvn);
         struct batadv_tvlv_tt_vlan_data *tt_vlan;
         bool full_table = true;
+        bool has_tt_init;
 
         tt_vlan = (struct batadv_tvlv_tt_vlan_data *)tt_buff;
+        has_tt_init = orig_node->capa_initialized & BATADV_ORIG_CAPA_HAS_TT;
+
         /* orig table not initialised AND first diff is in the OGM OR the ttvn
          * increased by one -> we can apply the attached changes
          */
-        if ((!orig_node->tt_initialised && ttvn == 1) ||
-            ttvn - orig_ttvn == 1) {
+        if ((!has_tt_init && ttvn == 1) || ttvn - orig_ttvn == 1) {
                 /* the OGM could not contain the changes due to their size or
                  * because they have already been sent BATADV_TT_OGM_APPEND_MAX
                  * times.
@@ -3257,7 +3323,7 @@ static void batadv_tt_update_orig(struct batadv_priv *bat_priv,
                 /* if we missed more than one change or our tables are not
                  * in sync anymore -> request fresh tt data
                  */
-                if (!orig_node->tt_initialised || ttvn != orig_ttvn ||
+                if (!has_tt_init || ttvn != orig_ttvn ||
                     !batadv_tt_global_check_crc(orig_node, tt_vlan,
                                                 tt_num_vlan)) {
 request_table:
diff --git a/net/batman-adv/translation-table.h b/net/batman-adv/translation-table.h
index 20a1d7861ded..ad84d7b89e39 100644
--- a/net/batman-adv/translation-table.h
+++ b/net/batman-adv/translation-table.h
@@ -29,6 +29,8 @@ int batadv_tt_global_seq_print_text(struct seq_file *seq, void *offset);
 void batadv_tt_global_del_orig(struct batadv_priv *bat_priv,
                                struct batadv_orig_node *orig_node,
                                int32_t match_vid, const char *message);
+int batadv_tt_global_hash_count(struct batadv_priv *bat_priv,
+                                const uint8_t *addr, unsigned short vid);
 struct batadv_orig_node *batadv_transtable_search(struct batadv_priv *bat_priv,
                                                   const uint8_t *src,
                                                   const uint8_t *addr,
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 78370ab31f9c..34891a56773f 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -24,8 +24,9 @@
 
 #ifdef CONFIG_BATMAN_ADV_DAT
 
-/* batadv_dat_addr_t is the type used for all DHT addresses. If it is changed,
- * BATADV_DAT_ADDR_MAX is changed as well.
+/**
+ * batadv_dat_addr_t - it is the type used for all DHT addresses. If it is
+ *  changed, BATADV_DAT_ADDR_MAX is changed as well.
  *
  * *Please be careful: batadv_dat_addr_t must be UNSIGNED*
  */
@@ -163,7 +164,7 @@ struct batadv_vlan_tt {
 };
 
 /**
- * batadv_orig_node_vlan - VLAN specific data per orig_node
+ * struct batadv_orig_node_vlan - VLAN specific data per orig_node
  * @vid: the VLAN identifier
  * @tt: VLAN specific TT attributes
  * @list: list node for orig_node::vlan_list
@@ -204,14 +205,18 @@ struct batadv_orig_bat_iv {
  * @batadv_dat_addr_t:  address of the orig node in the distributed hash
  * @last_seen: time when last packet from this node was received
  * @bcast_seqno_reset: time when the broadcast seqno window was reset
+ * @mcast_flags: multicast flags announced by the orig node
+ * @mcast_want_all_unsnoop_node: a list node for the
+ *  mcast.want_all_unsnoopables list
+ * @mcast_want_all_ipv4_node: a list node for the mcast.want_all_ipv4 list
+ * @mcast_want_all_ipv6_node: a list node for the mcast.want_all_ipv6 list
  * @capabilities: announced capabilities of this originator
+ * @capa_initialized: bitfield to remember whether a capability was initialized
  * @last_ttvn: last seen translation table version number
  * @tt_buff: last tt changeset this node received from the orig node
  * @tt_buff_len: length of the last tt changeset this node received from the
  *  orig node
  * @tt_buff_lock: lock that protects tt_buff and tt_buff_len
- * @tt_initialised: bool keeping track of whether or not this node have received
- *  any translation table information from the orig node yet
  * @tt_lock: prevents from updating the table while reading it. Table update is
  *  made up by two operations (data structure update and metdata -CRC/TTVN-
  *  recalculation) and they have to be executed atomically in order to avoid
@@ -247,12 +252,18 @@ struct batadv_orig_node {
 #endif
         unsigned long last_seen;
         unsigned long bcast_seqno_reset;
+#ifdef CONFIG_BATMAN_ADV_MCAST
+        uint8_t mcast_flags;
+        struct hlist_node mcast_want_all_unsnoopables_node;
+        struct hlist_node mcast_want_all_ipv4_node;
+        struct hlist_node mcast_want_all_ipv6_node;
+#endif
         uint8_t capabilities;
+        uint8_t capa_initialized;
         atomic_t last_ttvn;
         unsigned char *tt_buff;
         int16_t tt_buff_len;
         spinlock_t tt_buff_lock; /* protects tt_buff & tt_buff_len */
-        bool tt_initialised;
         /* prevents from changing the table while reading it */
         spinlock_t tt_lock;
         DECLARE_BITMAP(bcast_bits, BATADV_TQ_LOCAL_WINDOW_SIZE);
@@ -282,10 +293,15 @@ struct batadv_orig_node {
  * enum batadv_orig_capabilities - orig node capabilities
  * @BATADV_ORIG_CAPA_HAS_DAT: orig node has distributed arp table enabled
  * @BATADV_ORIG_CAPA_HAS_NC: orig node has network coding enabled
+ * @BATADV_ORIG_CAPA_HAS_TT: orig node has tt capability
+ * @BATADV_ORIG_CAPA_HAS_MCAST: orig node has some multicast capability
+ *  (= orig node announces a tvlv of type BATADV_TVLV_MCAST)
  */
 enum batadv_orig_capabilities {
         BATADV_ORIG_CAPA_HAS_DAT = BIT(0),
         BATADV_ORIG_CAPA_HAS_NC = BIT(1),
+        BATADV_ORIG_CAPA_HAS_TT = BIT(2),
+        BATADV_ORIG_CAPA_HAS_MCAST = BIT(3),
 };
 
 /**
@@ -334,7 +350,7 @@ struct batadv_neigh_node {
 };
 
 /**
- * struct batadv_neigh_node_bat_iv - neighbor information per outgoing
+ * struct batadv_neigh_ifinfo_bat_iv - neighbor information per outgoing
  *  interface for BATMAN IV
  * @tq_recv: ring buffer of received TQ values from this neigh node
  * @tq_index: ring buffer index
@@ -544,7 +560,7 @@ struct batadv_priv_bla {
 #endif
 
 /**
- * struct batadv_debug_log - debug logging data
+ * struct batadv_priv_debug_log - debug logging data
  * @log_buff: buffer holding the logs (ring bufer)
  * @log_start: index of next character to read
  * @log_end: index of next character to write
@@ -607,6 +623,39 @@ struct batadv_priv_dat {
 };
 #endif
 
+#ifdef CONFIG_BATMAN_ADV_MCAST
+/**
+ * struct batadv_priv_mcast - per mesh interface mcast data
+ * @mla_list: list of multicast addresses we are currently announcing via TT
+ * @want_all_unsnoopables_list: a list of orig_nodes wanting all unsnoopable
+ *  multicast traffic
+ * @want_all_ipv4_list: a list of orig_nodes wanting all IPv4 multicast traffic
+ * @want_all_ipv6_list: a list of orig_nodes wanting all IPv6 multicast traffic
+ * @flags: the flags we have last sent in our mcast tvlv
+ * @enabled: whether the multicast tvlv is currently enabled
+ * @num_disabled: number of nodes that have no mcast tvlv
+ * @num_want_all_unsnoopables: number of nodes wanting unsnoopable IP traffic
+ * @num_want_all_ipv4: counter for items in want_all_ipv4_list
+ * @num_want_all_ipv6: counter for items in want_all_ipv6_list
+ * @want_lists_lock: lock for protecting modifications to mcast want lists
+ *  (traversals are rcu-locked)
+ */
+struct batadv_priv_mcast {
+        struct hlist_head mla_list;
+        struct hlist_head want_all_unsnoopables_list;
+        struct hlist_head want_all_ipv4_list;
+        struct hlist_head want_all_ipv6_list;
+        uint8_t flags;
+        bool enabled;
+        atomic_t num_disabled;
+        atomic_t num_want_all_unsnoopables;
+        atomic_t num_want_all_ipv4;
+        atomic_t num_want_all_ipv6;
+        /* protects want_all_{unsnoopables,ipv4,ipv6}_list */
+        spinlock_t want_lists_lock;
+};
+#endif
+
 /**
  * struct batadv_priv_nc - per mesh interface network coding private data
  * @work: work queue callback item for cleanup
@@ -672,6 +721,8 @@ struct batadv_softif_vlan {
  *  enabled
  * @distributed_arp_table: bool indicating whether distributed ARP table is
  *  enabled
+ * @multicast_mode: Enable or disable multicast optimizations on this node's
+ *  sender/originating side
  * @gw_mode: gateway operation: off, client or server (see batadv_gw_modes)
  * @gw_sel_class: gateway selection class (applies if gw_mode client)
  * @orig_interval: OGM broadcast interval in milliseconds
@@ -702,6 +753,7 @@ struct batadv_softif_vlan {
  * @tt: translation table data
  * @tvlv: type-version-length-value data
  * @dat: distributed arp table data
+ * @mcast: multicast data
  * @network_coding: bool indicating whether network coding is enabled
  * @batadv_priv_nc: network coding data
  */
@@ -721,6 +773,9 @@ struct batadv_priv {
 #ifdef CONFIG_BATMAN_ADV_DAT
         atomic_t distributed_arp_table;
 #endif
+#ifdef CONFIG_BATMAN_ADV_MCAST
+        atomic_t multicast_mode;
+#endif
         atomic_t gw_mode;
         atomic_t gw_sel_class;
         atomic_t orig_interval;
@@ -759,6 +814,9 @@ struct batadv_priv {
 #ifdef CONFIG_BATMAN_ADV_DAT
         struct batadv_priv_dat dat;
 #endif
+#ifdef CONFIG_BATMAN_ADV_MCAST
+        struct batadv_priv_mcast mcast;
+#endif
 #ifdef CONFIG_BATMAN_ADV_NC
         atomic_t network_coding;
         struct batadv_priv_nc nc;
@@ -881,12 +939,14 @@ struct batadv_tt_local_entry {
  * struct batadv_tt_global_entry - translation table global entry data
  * @common: general translation table data
  * @orig_list: list of orig nodes announcing this non-mesh client
+ * @orig_list_count: number of items in the orig_list
  * @list_lock: lock protecting orig_list
  * @roam_at: time at which TT_GLOBAL_ROAM was set
  */
 struct batadv_tt_global_entry {
         struct batadv_tt_common_entry common;
         struct hlist_head orig_list;
+        atomic_t orig_list_count;
         spinlock_t list_lock;   /* protects orig_list */
         unsigned long roam_at;
 };
@@ -1004,8 +1064,8 @@ struct batadv_nc_packet {
 };
 
 /**
- * batadv_skb_cb - control buffer structure used to store private data relevant
- *  to batman-adv in the skb->cb buffer in skbs.
+ * struct batadv_skb_cb - control buffer structure used to store private data
+ *  relevant to batman-adv in the skb->cb buffer in skbs.
  * @decoded: Marks a skb as decoded, which is checked when searching for coding
  *  opportunities in network-coding.c
  */
@@ -1116,6 +1176,16 @@ struct batadv_dat_entry {
 };
 
 /**
+ * struct batadv_hw_addr - a list entry for a MAC address
+ * @list: list node for the linking of entries
+ * @addr: the MAC address of this list entry
+ */
+struct batadv_hw_addr {
+        struct hlist_node list;
+        unsigned char addr[ETH_ALEN];
+};
+
+/**
  * struct batadv_dat_candidate - candidate destination for DAT operations
  * @type: the type of the selected candidate. It can one of the following:
  *        - BATADV_DAT_CANDIDATE_NOT_FOUND
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index adb3ea04adaa..73492b91105a 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -27,7 +27,7 @@
 
 #include "6lowpan.h"
 
-#include "../ieee802154/6lowpan.h" /* for the compression support */
+#include <net/6lowpan.h> /* for the compression support */
 
 #define IFACE_NAME_TEMPLATE "bt%d"
 #define EUI64_ADDR_LEN 8
diff --git a/net/bluetooth/6lowpan.h b/net/bluetooth/6lowpan.h
index 680eac808d74..5d281f1eaf55 100644
--- a/net/bluetooth/6lowpan.h
+++ b/net/bluetooth/6lowpan.h
@@ -14,13 +14,34 @@
 #ifndef __6LOWPAN_H
 #define __6LOWPAN_H
 
+#include <linux/errno.h>
 #include <linux/skbuff.h>
 #include <net/bluetooth/l2cap.h>
 
+#if IS_ENABLED(CONFIG_BT_6LOWPAN)
 int bt_6lowpan_recv(struct l2cap_conn *conn, struct sk_buff *skb);
 int bt_6lowpan_add_conn(struct l2cap_conn *conn);
 int bt_6lowpan_del_conn(struct l2cap_conn *conn);
 int bt_6lowpan_init(void);
 void bt_6lowpan_cleanup(void);
+#else
+static int bt_6lowpan_recv(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        return -EOPNOTSUPP;
+}
+static int bt_6lowpan_add_conn(struct l2cap_conn *conn)
+{
+        return -EOPNOTSUPP;
+}
+int bt_6lowpan_del_conn(struct l2cap_conn *conn)
+{
+        return -EOPNOTSUPP;
+}
+static int bt_6lowpan_init(void)
+{
+        return -EOPNOTSUPP;
+}
+static void bt_6lowpan_cleanup(void) { }
+#endif
 
 #endif /* __6LOWPAN_H */
diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig
index 985b56070d26..06ec14499ca1 100644
--- a/net/bluetooth/Kconfig
+++ b/net/bluetooth/Kconfig
@@ -6,13 +6,13 @@ menuconfig BT
         tristate "Bluetooth subsystem support"
         depends on NET && !S390
         depends on RFKILL || !RFKILL
+        select 6LOWPAN_IPHC if BT_6LOWPAN
         select CRC16
         select CRYPTO
         select CRYPTO_BLKCIPHER
         select CRYPTO_AES
         select CRYPTO_ECB
         select CRYPTO_SHA256
-        select 6LOWPAN_IPHC
         help
           Bluetooth is low-cost, low-power, short-range wireless technology.
           It was designed as a replacement for cables and other short-range
@@ -40,6 +40,12 @@ menuconfig BT
           to Bluetooth kernel modules are provided in the BlueZ packages.  For
           more information, see <http://www.bluez.org/>.
 
+config BT_6LOWPAN
+        bool "Bluetooth 6LoWPAN support"
+        depends on BT && IPV6
+        help
+          IPv6 compression over Bluetooth.
+
 source "net/bluetooth/rfcomm/Kconfig"
 
 source "net/bluetooth/bnep/Kconfig"
diff --git a/net/bluetooth/Makefile b/net/bluetooth/Makefile
index 80cb215826e8..ca51246b1016 100644
--- a/net/bluetooth/Makefile
+++ b/net/bluetooth/Makefile
@@ -10,6 +10,7 @@ obj-$(CONFIG_BT_HIDP)	+= hidp/
 
 bluetooth-y := af_bluetooth.o hci_core.o hci_conn.o hci_event.o mgmt.o \
         hci_sock.o hci_sysfs.o l2cap_core.o l2cap_sock.o smp.o sco.o lib.o \
-        a2mp.o amp.o 6lowpan.o
+        a2mp.o amp.o
+bluetooth-$(CONFIG_BT_6LOWPAN) += 6lowpan.o
 
 subdir-ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index efcd108822c4..9514cc9e850c 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -162,7 +162,7 @@ static int a2mp_discover_req(struct amp_mgr *mgr, struct sk_buff *skb,
                 return -ENOMEM;
         }
 
-        rsp->mtu = __constant_cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU);
+        rsp->mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU);
         rsp->ext_feat = 0;
 
         __a2mp_add_cl(mgr, rsp->cl);
@@ -235,7 +235,7 @@ static int a2mp_discover_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
                         BT_DBG("chan %p state %s", chan,
                                state_to_string(chan->state));
 
-                        if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP)
+                        if (chan->scid == L2CAP_CID_A2MP)
                                 continue;
 
                         l2cap_chan_lock(chan);
@@ -649,7 +649,7 @@ static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
         if (err) {
                 struct a2mp_cmd_rej rej;
 
-                rej.reason = __constant_cpu_to_le16(0);
+                rej.reason = cpu_to_le16(0);
                 hdr = (void *) skb->data;
 
                 BT_DBG("Send A2MP Rej: cmd 0x%2.2x err %d", hdr->code, err);
@@ -695,7 +695,13 @@ static void a2mp_chan_state_change_cb(struct l2cap_chan *chan, int state,
 static struct sk_buff *a2mp_chan_alloc_skb_cb(struct l2cap_chan *chan,
                                               unsigned long len, int nb)
 {
-        return bt_skb_alloc(len, GFP_KERNEL);
+        struct sk_buff *skb;
+
+        skb = bt_skb_alloc(len, GFP_KERNEL);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        return skb;
 }
 
 static struct l2cap_ops a2mp_chan_ops = {
@@ -726,7 +732,11 @@ static struct l2cap_chan *a2mp_chan_open(struct l2cap_conn *conn, bool locked)
 
         BT_DBG("chan %p", chan);
 
-        chan->chan_type = L2CAP_CHAN_CONN_FIX_A2MP;
+        chan->chan_type = L2CAP_CHAN_FIXED;
+        chan->scid = L2CAP_CID_A2MP;
+        chan->dcid = L2CAP_CID_A2MP;
+        chan->omtu = L2CAP_A2MP_DEFAULT_MTU;
+        chan->imtu = L2CAP_A2MP_DEFAULT_MTU;
         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
 
         chan->ops = &a2mp_chan_ops;
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 0c5866bb49b6..2021c481cdb6 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -31,7 +31,7 @@
 #include <net/bluetooth/bluetooth.h>
 #include <linux/proc_fs.h>
 
-#define VERSION "2.18"
+#define VERSION "2.19"
 
 /* Bluetooth sockets */
 #define BT_MAX_PROTO    8
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index ba5366c320da..d958e2dca52f 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -82,7 +82,7 @@ static void hci_acl_create_connection(struct hci_conn *conn)
                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
                         cp.pscan_mode     = ie->data.pscan_mode;
                         cp.clock_offset   = ie->data.clock_offset |
-                                            __constant_cpu_to_le16(0x8000);
+                                            cpu_to_le16(0x8000);
                 }
 
                 memcpy(conn->dev_class, ie->data.dev_class, 3);
@@ -182,8 +182,8 @@ bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 
         cp.handle   = cpu_to_le16(handle);
 
-        cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
-        cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
+        cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
+        cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
         cp.voice_setting  = cpu_to_le16(conn->setting);
 
         switch (conn->setting & SCO_AIRMODE_MASK) {
@@ -225,13 +225,13 @@ void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
         cp.conn_interval_max    = cpu_to_le16(max);
         cp.conn_latency         = cpu_to_le16(latency);
         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
-        cp.min_ce_len           = __constant_cpu_to_le16(0x0001);
-        cp.max_ce_len           = __constant_cpu_to_le16(0x0001);
+        cp.min_ce_len           = cpu_to_le16(0x0000);
+        cp.max_ce_len           = cpu_to_le16(0x0000);
 
         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 }
 
-void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
+void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
                       __u8 ltk[16])
 {
         struct hci_dev *hdev = conn->hdev;
@@ -242,9 +242,9 @@ void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
         memset(&cp, 0, sizeof(cp));
 
         cp.handle = cpu_to_le16(conn->handle);
-        memcpy(cp.ltk, ltk, sizeof(cp.ltk));
+        cp.rand = rand;
         cp.ediv = ediv;
-        memcpy(cp.rand, rand, sizeof(cp.rand));
+        memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 
         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 }
@@ -337,9 +337,9 @@ static void hci_conn_idle(struct work_struct *work)
         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
                 struct hci_cp_sniff_subrate cp;
                 cp.handle             = cpu_to_le16(conn->handle);
-                cp.max_latency        = __constant_cpu_to_le16(0);
-                cp.min_remote_timeout = __constant_cpu_to_le16(0);
-                cp.min_local_timeout  = __constant_cpu_to_le16(0);
+                cp.max_latency        = cpu_to_le16(0);
+                cp.min_remote_timeout = cpu_to_le16(0);
+                cp.min_local_timeout  = cpu_to_le16(0);
                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
         }
 
@@ -348,8 +348,8 @@ static void hci_conn_idle(struct work_struct *work)
                 cp.handle       = cpu_to_le16(conn->handle);
                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
-                cp.attempt      = __constant_cpu_to_le16(4);
-                cp.timeout      = __constant_cpu_to_le16(1);
+                cp.attempt      = cpu_to_le16(4);
+                cp.timeout      = cpu_to_le16(1);
                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
         }
 }
@@ -363,6 +363,16 @@ static void hci_conn_auto_accept(struct work_struct *work)
                      &conn->dst);
 }
 
+static void le_conn_timeout(struct work_struct *work)
+{
+        struct hci_conn *conn = container_of(work, struct hci_conn,
+                                             le_conn_timeout.work);
+
+        BT_DBG("");
+
+        hci_le_create_connection_cancel(conn);
+}
+
 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 {
         struct hci_conn *conn;
@@ -410,6 +420,7 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
+        INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
 
         atomic_set(&conn->refcnt, 0);
 
@@ -442,6 +453,8 @@ int hci_conn_del(struct hci_conn *conn)
                 /* Unacked frames */
                 hdev->acl_cnt += conn->sent;
         } else if (conn->type == LE_LINK) {
+                cancel_delayed_work_sync(&conn->le_conn_timeout);
+
                 if (hdev->le_pkts)
                         hdev->le_cnt += conn->sent;
                 else
@@ -514,6 +527,26 @@ struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 }
 EXPORT_SYMBOL(hci_get_route);
 
+/* This function requires the caller holds hdev->lock */
+void hci_le_conn_failed(struct hci_conn *conn, u8 status)
+{
+        struct hci_dev *hdev = conn->hdev;
+
+        conn->state = BT_CLOSED;
+
+        mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
+                            status);
+
+        hci_proto_connect_cfm(conn, status);
+
+        hci_conn_del(conn);
+
+        /* Since we may have temporarily stopped the background scanning in
+         * favor of connection establishment, we should restart it.
+         */
+        hci_update_background_scan(hdev);
+}
+
 static void create_le_conn_complete(struct hci_dev *hdev, u8 status)
 {
         struct hci_conn *conn;
@@ -530,55 +563,55 @@ static void create_le_conn_complete(struct hci_dev *hdev, u8 status)
         if (!conn)
                 goto done;
 
-        conn->state = BT_CLOSED;
-
-        mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
-                            status);
-
-        hci_proto_connect_cfm(conn, status);
-
-        hci_conn_del(conn);
+        hci_le_conn_failed(conn, status);
 
 done:
         hci_dev_unlock(hdev);
 }
 
-static int hci_create_le_conn(struct hci_conn *conn)
+static void hci_req_add_le_create_conn(struct hci_request *req,
+                                       struct hci_conn *conn)
 {
-        struct hci_dev *hdev = conn->hdev;
         struct hci_cp_le_create_conn cp;
-        struct hci_request req;
-        int err;
-
-        hci_req_init(&req, hdev);
+        struct hci_dev *hdev = conn->hdev;
+        u8 own_addr_type;
 
         memset(&cp, 0, sizeof(cp));
+
+        /* Update random address, but set require_privacy to false so
+         * that we never connect with an unresolvable address.
+         */
+        if (hci_update_random_address(req, false, &own_addr_type))
+                return;
+
+        /* Save the address type used for this connnection attempt so we able
+         * to retrieve this information if we need it.
+         */
+        conn->src_type = own_addr_type;
+
         cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
         cp.scan_window = cpu_to_le16(hdev->le_scan_window);
         bacpy(&cp.peer_addr, &conn->dst);
         cp.peer_addr_type = conn->dst_type;
-        cp.own_address_type = conn->src_type;
-        cp.conn_interval_min = cpu_to_le16(hdev->le_conn_min_interval);
-        cp.conn_interval_max = cpu_to_le16(hdev->le_conn_max_interval);
-        cp.supervision_timeout = __constant_cpu_to_le16(0x002a);
-        cp.min_ce_len = __constant_cpu_to_le16(0x0000);
-        cp.max_ce_len = __constant_cpu_to_le16(0x0000);
+        cp.own_address_type = own_addr_type;
+        cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
+        cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
+        cp.supervision_timeout = cpu_to_le16(0x002a);
+        cp.min_ce_len = cpu_to_le16(0x0000);
+        cp.max_ce_len = cpu_to_le16(0x0000);
 
-        hci_req_add(&req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
+        hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 
-        err = hci_req_run(&req, create_le_conn_complete);
-        if (err) {
-                hci_conn_del(conn);
-                return err;
-        }
-
-        return 0;
+        conn->state = BT_CONNECT;
 }
 
-static struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
-                                    u8 dst_type, u8 sec_level, u8 auth_type)
+struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
+                                u8 dst_type, u8 sec_level, u8 auth_type)
 {
+        struct hci_conn_params *params;
         struct hci_conn *conn;
+        struct smp_irk *irk;
+        struct hci_request req;
         int err;
 
         if (test_bit(HCI_ADVERTISING, &hdev->flags))
@@ -607,35 +640,74 @@ static struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
         if (conn)
                 return ERR_PTR(-EBUSY);
 
+        /* When given an identity address with existing identity
+         * resolving key, the connection needs to be established
+         * to a resolvable random address.
+         *
+         * This uses the cached random resolvable address from
+         * a previous scan. When no cached address is available,
+         * try connecting to the identity address instead.
+         *
+         * Storing the resolvable random address is required here
+         * to handle connection failures. The address will later
+         * be resolved back into the original identity address
+         * from the connect request.
+         */
+        irk = hci_find_irk_by_addr(hdev, dst, dst_type);
+        if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
+                dst = &irk->rpa;
+                dst_type = ADDR_LE_DEV_RANDOM;
+        }
+
         conn = hci_conn_add(hdev, LE_LINK, dst);
         if (!conn)
                 return ERR_PTR(-ENOMEM);
 
-        if (dst_type == BDADDR_LE_PUBLIC)
-                conn->dst_type = ADDR_LE_DEV_PUBLIC;
-        else
-                conn->dst_type = ADDR_LE_DEV_RANDOM;
-
-        conn->src_type = hdev->own_addr_type;
+        conn->dst_type = dst_type;
 
-        conn->state = BT_CONNECT;
         conn->out = true;
         conn->link_mode |= HCI_LM_MASTER;
         conn->sec_level = BT_SECURITY_LOW;
         conn->pending_sec_level = sec_level;
         conn->auth_type = auth_type;
 
-        err = hci_create_le_conn(conn);
-        if (err)
+        params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
+        if (params) {
+                conn->le_conn_min_interval = params->conn_min_interval;
+                conn->le_conn_max_interval = params->conn_max_interval;
+        } else {
+                conn->le_conn_min_interval = hdev->le_conn_min_interval;
+                conn->le_conn_max_interval = hdev->le_conn_max_interval;
+        }
+
+        hci_req_init(&req, hdev);
+
+        /* If controller is scanning, we stop it since some controllers are
+         * not able to scan and connect at the same time. Also set the
+         * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
+         * handler for scan disabling knows to set the correct discovery
+         * state.
+         */
+        if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
+                hci_req_add_le_scan_disable(&req);
+                set_bit(HCI_LE_SCAN_INTERRUPTED, &hdev->dev_flags);
+        }
+
+        hci_req_add_le_create_conn(&req, conn);
+
+        err = hci_req_run(&req, create_le_conn_complete);
+        if (err) {
+                hci_conn_del(conn);
                 return ERR_PTR(err);
+        }
 
 done:
         hci_conn_hold(conn);
         return conn;
 }
 
-static struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
-                                                u8 sec_level, u8 auth_type)
+struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
+                                 u8 sec_level, u8 auth_type)
 {
         struct hci_conn *acl;
 
@@ -704,27 +776,22 @@ struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
         return sco;
 }
 
-/* Create SCO, ACL or LE connection. */
-struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
-                             __u8 dst_type, __u8 sec_level, __u8 auth_type)
-{
-        BT_DBG("%s dst %pMR type 0x%x", hdev->name, dst, type);
-
-        switch (type) {
-        case LE_LINK:
-                return hci_connect_le(hdev, dst, dst_type, sec_level, auth_type);
-        case ACL_LINK:
-                return hci_connect_acl(hdev, dst, sec_level, auth_type);
-        }
-
-        return ERR_PTR(-EINVAL);
-}
-
 /* Check link security requirement */
 int hci_conn_check_link_mode(struct hci_conn *conn)
 {
         BT_DBG("hcon %p", conn);
 
+        /* In Secure Connections Only mode, it is required that Secure
+         * Connections is used and the link is encrypted with AES-CCM
+         * using a P-256 authenticated combination key.
+         */
+        if (test_bit(HCI_SC_ONLY, &conn->hdev->flags)) {
+                if (!hci_conn_sc_enabled(conn) ||
+                    !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
+                    conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
+                        return 0;
+        }
+
         if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
                 return 0;
 
@@ -800,14 +867,23 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
         if (!(conn->link_mode & HCI_LM_AUTH))
                 goto auth;
 
-        /* An authenticated combination key has sufficient security for any
-           security level. */
-        if (conn->key_type == HCI_LK_AUTH_COMBINATION)
+        /* An authenticated FIPS approved combination key has sufficient
+         * security for security level 4. */
+        if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
+            sec_level == BT_SECURITY_FIPS)
+                goto encrypt;
+
+        /* An authenticated combination key has sufficient security for
+           security level 3. */
+        if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
+             conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
+            sec_level == BT_SECURITY_HIGH)
                 goto encrypt;
 
         /* An unauthenticated combination key has sufficient security for
            security level 1 and 2. */
-        if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
+        if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
+             conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
                 goto encrypt;
 
@@ -816,7 +892,8 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
            is generated using maximum PIN code length (16).
            For pre 2.1 units. */
         if (conn->key_type == HCI_LK_COMBINATION &&
-            (sec_level != BT_SECURITY_HIGH || conn->pin_length == 16))
+            (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
+             conn->pin_length == 16))
                 goto encrypt;
 
 auth:
@@ -840,13 +917,17 @@ int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 {
         BT_DBG("hcon %p", conn);
 
-        if (sec_level != BT_SECURITY_HIGH)
-                return 1; /* Accept if non-secure is required */
+        /* Accept if non-secure or higher security level is required */
+        if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
+                return 1;
 
-        if (conn->sec_level == BT_SECURITY_HIGH)
+        /* Accept if secure or higher security level is already present */
+        if (conn->sec_level == BT_SECURITY_HIGH ||
+            conn->sec_level == BT_SECURITY_FIPS)
                 return 1;
 
-        return 0; /* Reject not secure link */
+        /* Reject not secure link */
+        return 0;
 }
 EXPORT_SYMBOL(hci_conn_check_secure);
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 5e8663c194c1..1c6ffaa8902f 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -29,11 +29,14 @@
 #include <linux/idr.h>
 #include <linux/rfkill.h>
 #include <linux/debugfs.h>
+#include <linux/crypto.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 
+#include "smp.h"
+
 static void hci_rx_work(struct work_struct *work);
 static void hci_cmd_work(struct work_struct *work);
 static void hci_tx_work(struct work_struct *work);
@@ -285,24 +288,6 @@ static const struct file_operations link_keys_fops = {
         .release        = single_release,
 };
 
-static ssize_t use_debug_keys_read(struct file *file, char __user *user_buf,
-                                   size_t count, loff_t *ppos)
-{
-        struct hci_dev *hdev = file->private_data;
-        char buf[3];
-
-        buf[0] = test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) ? 'Y': 'N';
-        buf[1] = '\n';
-        buf[2] = '\0';
-        return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
-}
-
-static const struct file_operations use_debug_keys_fops = {
-        .open           = simple_open,
-        .read           = use_debug_keys_read,
-        .llseek         = default_llseek,
-};
-
 static int dev_class_show(struct seq_file *f, void *ptr)
 {
         struct hci_dev *hdev = f->private;
@@ -415,6 +400,70 @@ static int ssp_debug_mode_get(void *data, u64 *val)
 DEFINE_SIMPLE_ATTRIBUTE(ssp_debug_mode_fops, ssp_debug_mode_get,
                         ssp_debug_mode_set, "%llu\n");
 
+static ssize_t force_sc_support_read(struct file *file, char __user *user_buf,
+                                     size_t count, loff_t *ppos)
+{
+        struct hci_dev *hdev = file->private_data;
+        char buf[3];
+
+        buf[0] = test_bit(HCI_FORCE_SC, &hdev->dev_flags) ? 'Y': 'N';
+        buf[1] = '\n';
+        buf[2] = '\0';
+        return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
+}
+
+static ssize_t force_sc_support_write(struct file *file,
+                                      const char __user *user_buf,
+                                      size_t count, loff_t *ppos)
+{
+        struct hci_dev *hdev = file->private_data;
+        char buf[32];
+        size_t buf_size = min(count, (sizeof(buf)-1));
+        bool enable;
+
+        if (test_bit(HCI_UP, &hdev->flags))
+                return -EBUSY;
+
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+
+        buf[buf_size] = '\0';
+        if (strtobool(buf, &enable))
+                return -EINVAL;
+
+        if (enable == test_bit(HCI_FORCE_SC, &hdev->dev_flags))
+                return -EALREADY;
+
+        change_bit(HCI_FORCE_SC, &hdev->dev_flags);
+
+        return count;
+}
+
+static const struct file_operations force_sc_support_fops = {
+        .open           = simple_open,
+        .read           = force_sc_support_read,
+        .write          = force_sc_support_write,
+        .llseek         = default_llseek,
+};
+
+static ssize_t sc_only_mode_read(struct file *file, char __user *user_buf,
+                                 size_t count, loff_t *ppos)
+{
+        struct hci_dev *hdev = file->private_data;
+        char buf[3];
+
+        buf[0] = test_bit(HCI_SC_ONLY, &hdev->dev_flags) ? 'Y': 'N';
+        buf[1] = '\n';
+        buf[2] = '\0';
+        return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
+}
+
+static const struct file_operations sc_only_mode_fops = {
+        .open           = simple_open,
+        .read           = sc_only_mode_read,
+        .llseek         = default_llseek,
+};
+
 static int idle_timeout_set(void *data, u64 val)
 {
         struct hci_dev *hdev = data;
@@ -443,6 +492,37 @@ static int idle_timeout_get(void *data, u64 *val)
 DEFINE_SIMPLE_ATTRIBUTE(idle_timeout_fops, idle_timeout_get,
                         idle_timeout_set, "%llu\n");
 
+static int rpa_timeout_set(void *data, u64 val)
+{
+        struct hci_dev *hdev = data;
+
+        /* Require the RPA timeout to be at least 30 seconds and at most
+         * 24 hours.
+         */
+        if (val < 30 || val > (60 * 60 * 24))
+                return -EINVAL;
+
+        hci_dev_lock(hdev);
+        hdev->rpa_timeout = val;
+        hci_dev_unlock(hdev);
+
+        return 0;
+}
+
+static int rpa_timeout_get(void *data, u64 *val)
+{
+        struct hci_dev *hdev = data;
+
+        hci_dev_lock(hdev);
+        *val = hdev->rpa_timeout;
+        hci_dev_unlock(hdev);
+
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(rpa_timeout_fops, rpa_timeout_get,
+                        rpa_timeout_set, "%llu\n");
+
 static int sniff_min_interval_set(void *data, u64 val)
 {
         struct hci_dev *hdev = data;
@@ -499,6 +579,59 @@ static int sniff_max_interval_get(void *data, u64 *val)
 DEFINE_SIMPLE_ATTRIBUTE(sniff_max_interval_fops, sniff_max_interval_get,
                         sniff_max_interval_set, "%llu\n");
 
+static int identity_show(struct seq_file *f, void *p)
+{
+        struct hci_dev *hdev = f->private;
+        bdaddr_t addr;
+        u8 addr_type;
+
+        hci_dev_lock(hdev);
+
+        hci_copy_identity_address(hdev, &addr, &addr_type);
+
+        seq_printf(f, "%pMR (type %u) %*phN %pMR\n", &addr, addr_type,
+                   16, hdev->irk, &hdev->rpa);
+
+        hci_dev_unlock(hdev);
+
+        return 0;
+}
+
+static int identity_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, identity_show, inode->i_private);
+}
+
+static const struct file_operations identity_fops = {
+        .open           = identity_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static int random_address_show(struct seq_file *f, void *p)
+{
+        struct hci_dev *hdev = f->private;
+
+        hci_dev_lock(hdev);
+        seq_printf(f, "%pMR\n", &hdev->random_addr);
+        hci_dev_unlock(hdev);
+
+        return 0;
+}
+
+static int random_address_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, random_address_show, inode->i_private);
+}
+
+static const struct file_operations random_address_fops = {
+        .open           = random_address_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
 static int static_address_show(struct seq_file *f, void *p)
 {
         struct hci_dev *hdev = f->private;
@@ -522,33 +655,107 @@ static const struct file_operations static_address_fops = {
         .release        = single_release,
 };
 
-static int own_address_type_set(void *data, u64 val)
+static ssize_t force_static_address_read(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
 {
-        struct hci_dev *hdev = data;
+        struct hci_dev *hdev = file->private_data;
+        char buf[3];
 
-        if (val != 0 && val != 1)
+        buf[0] = test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dev_flags) ? 'Y': 'N';
+        buf[1] = '\n';
+        buf[2] = '\0';
+        return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
+}
+
+static ssize_t force_static_address_write(struct file *file,
+                                          const char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        struct hci_dev *hdev = file->private_data;
+        char buf[32];
+        size_t buf_size = min(count, (sizeof(buf)-1));
+        bool enable;
+
+        if (test_bit(HCI_UP, &hdev->flags))
+                return -EBUSY;
+
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+
+        buf[buf_size] = '\0';
+        if (strtobool(buf, &enable))
                 return -EINVAL;
 
+        if (enable == test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dev_flags))
+                return -EALREADY;
+
+        change_bit(HCI_FORCE_STATIC_ADDR, &hdev->dev_flags);
+
+        return count;
+}
+
+static const struct file_operations force_static_address_fops = {
+        .open           = simple_open,
+        .read           = force_static_address_read,
+        .write          = force_static_address_write,
+        .llseek         = default_llseek,
+};
+
+static int white_list_show(struct seq_file *f, void *ptr)
+{
+        struct hci_dev *hdev = f->private;
+        struct bdaddr_list *b;
+
         hci_dev_lock(hdev);
-        hdev->own_addr_type = val;
+        list_for_each_entry(b, &hdev->le_white_list, list)
+                seq_printf(f, "%pMR (type %u)\n", &b->bdaddr, b->bdaddr_type);
         hci_dev_unlock(hdev);
 
         return 0;
 }
 
-static int own_address_type_get(void *data, u64 *val)
+static int white_list_open(struct inode *inode, struct file *file)
 {
-        struct hci_dev *hdev = data;
+        return single_open(file, white_list_show, inode->i_private);
+}
+
+static const struct file_operations white_list_fops = {
+        .open           = white_list_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static int identity_resolving_keys_show(struct seq_file *f, void *ptr)
+{
+        struct hci_dev *hdev = f->private;
+        struct list_head *p, *n;
 
         hci_dev_lock(hdev);
-        *val = hdev->own_addr_type;
+        list_for_each_safe(p, n, &hdev->identity_resolving_keys) {
+                struct smp_irk *irk = list_entry(p, struct smp_irk, list);
+                seq_printf(f, "%pMR (type %u) %*phN %pMR\n",
+                           &irk->bdaddr, irk->addr_type,
+                           16, irk->val, &irk->rpa);
+        }
         hci_dev_unlock(hdev);
 
         return 0;
 }
 
-DEFINE_SIMPLE_ATTRIBUTE(own_address_type_fops, own_address_type_get,
-                        own_address_type_set, "%llu\n");
+static int identity_resolving_keys_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, identity_resolving_keys_show,
+                           inode->i_private);
+}
+
+static const struct file_operations identity_resolving_keys_fops = {
+        .open           = identity_resolving_keys_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
 
 static int long_term_keys_show(struct seq_file *f, void *ptr)
 {
@@ -556,12 +763,12 @@ static int long_term_keys_show(struct seq_file *f, void *ptr)
         struct list_head *p, *n;
 
         hci_dev_lock(hdev);
-        list_for_each_safe(p, n, &hdev->link_keys) {
+        list_for_each_safe(p, n, &hdev->long_term_keys) {
                 struct smp_ltk *ltk = list_entry(p, struct smp_ltk, list);
-                seq_printf(f, "%pMR (type %u) %u %u %u %.4x %*phN %*phN\\n",
+                seq_printf(f, "%pMR (type %u) %u 0x%02x %u %.4x %.16llx %*phN\n",
                            &ltk->bdaddr, ltk->bdaddr_type, ltk->authenticated,
                            ltk->type, ltk->enc_size, __le16_to_cpu(ltk->ediv),
-                           8, ltk->rand, 16, ltk->val);
+                           __le64_to_cpu(ltk->rand), 16, ltk->val);
         }
         hci_dev_unlock(hdev);
 
@@ -636,6 +843,34 @@ static int conn_max_interval_get(void *data, u64 *val)
 DEFINE_SIMPLE_ATTRIBUTE(conn_max_interval_fops, conn_max_interval_get,
                         conn_max_interval_set, "%llu\n");
 
+static int adv_channel_map_set(void *data, u64 val)
+{
+        struct hci_dev *hdev = data;
+
+        if (val < 0x01 || val > 0x07)
+                return -EINVAL;
+
+        hci_dev_lock(hdev);
+        hdev->le_adv_channel_map = val;
+        hci_dev_unlock(hdev);
+
+        return 0;
+}
+
+static int adv_channel_map_get(void *data, u64 *val)
+{
+        struct hci_dev *hdev = data;
+
+        hci_dev_lock(hdev);
+        *val = hdev->le_adv_channel_map;
+        hci_dev_unlock(hdev);
+
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(adv_channel_map_fops, adv_channel_map_get,
+                        adv_channel_map_set, "%llu\n");
+
 static ssize_t lowpan_read(struct file *file, char __user *user_buf,
                            size_t count, loff_t *ppos)
 {
@@ -679,6 +914,115 @@ static const struct file_operations lowpan_debugfs_fops = {
         .llseek         = default_llseek,
 };
 
+static int le_auto_conn_show(struct seq_file *sf, void *ptr)
+{
+        struct hci_dev *hdev = sf->private;
+        struct hci_conn_params *p;
+
+        hci_dev_lock(hdev);
+
+        list_for_each_entry(p, &hdev->le_conn_params, list) {
+                seq_printf(sf, "%pMR %u %u\n", &p->addr, p->addr_type,
+                           p->auto_connect);
+        }
+
+        hci_dev_unlock(hdev);
+
+        return 0;
+}
+
+static int le_auto_conn_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, le_auto_conn_show, inode->i_private);
+}
+
+static ssize_t le_auto_conn_write(struct file *file, const char __user *data,
+                                  size_t count, loff_t *offset)
+{
+        struct seq_file *sf = file->private_data;
+        struct hci_dev *hdev = sf->private;
+        u8 auto_connect = 0;
+        bdaddr_t addr;
+        u8 addr_type;
+        char *buf;
+        int err = 0;
+        int n;
+
+        /* Don't allow partial write */
+        if (*offset != 0)
+                return -EINVAL;
+
+        if (count < 3)
+                return -EINVAL;
+
+        buf = kzalloc(count, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        if (copy_from_user(buf, data, count)) {
+                err = -EFAULT;
+                goto done;
+        }
+
+        if (memcmp(buf, "add", 3) == 0) {
+                n = sscanf(&buf[4], "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx %hhu %hhu",
+                           &addr.b[5], &addr.b[4], &addr.b[3], &addr.b[2],
+                           &addr.b[1], &addr.b[0], &addr_type,
+                           &auto_connect);
+
+                if (n < 7) {
+                        err = -EINVAL;
+                        goto done;
+                }
+
+                hci_dev_lock(hdev);
+                err = hci_conn_params_add(hdev, &addr, addr_type, auto_connect,
+                                          hdev->le_conn_min_interval,
+                                          hdev->le_conn_max_interval);
+                hci_dev_unlock(hdev);
+
+                if (err)
+                        goto done;
+        } else if (memcmp(buf, "del", 3) == 0) {
+                n = sscanf(&buf[4], "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx %hhu",
+                           &addr.b[5], &addr.b[4], &addr.b[3], &addr.b[2],
+                           &addr.b[1], &addr.b[0], &addr_type);
+
+                if (n < 7) {
+                        err = -EINVAL;
+                        goto done;
+                }
+
+                hci_dev_lock(hdev);
+                hci_conn_params_del(hdev, &addr, addr_type);
+                hci_dev_unlock(hdev);
+        } else if (memcmp(buf, "clr", 3) == 0) {
+                hci_dev_lock(hdev);
+                hci_conn_params_clear(hdev);
+                hci_pend_le_conns_clear(hdev);
+                hci_update_background_scan(hdev);
+                hci_dev_unlock(hdev);
+        } else {
+                err = -EINVAL;
+        }
+
+done:
+        kfree(buf);
+
+        if (err)
+                return err;
+        else
+                return count;
+}
+
+static const struct file_operations le_auto_conn_fops = {
+        .open           = le_auto_conn_open,
+        .read           = seq_read,
+        .write          = le_auto_conn_write,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
 /* ---- HCI requests ---- */
 
 static void hci_req_sync_complete(struct hci_dev *hdev, u8 result)
@@ -1005,7 +1349,7 @@ static void bredr_setup(struct hci_request *req)
         hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 
         /* Connection accept timeout ~20 secs */
-        param = __constant_cpu_to_le16(0x7d00);
+        param = cpu_to_le16(0x7d00);
         hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 
         /* AVM Berlin (31), aka "BlueFRITZ!", reports version 1.2,
@@ -1027,14 +1371,17 @@ static void le_setup(struct hci_request *req)
         /* Read LE Local Supported Features */
         hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
 
+        /* Read LE Supported States */
+        hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
+
         /* Read LE Advertising Channel TX Power */
         hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
 
         /* Read LE White List Size */
         hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
 
-        /* Read LE Supported States */
-        hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
+        /* Clear LE White List */
+        hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
 
         /* LE-only controllers have LE implicitly enabled */
         if (!lmp_bredr_capable(hdev))
@@ -1288,6 +1635,10 @@ static void hci_set_event_mask_page_2(struct hci_request *req)
                 events[2] |= 0x08;      /* Truncated Page Complete */
         }
 
+        /* Enable Authenticated Payload Timeout Expired event if supported */
+        if (lmp_ping_capable(hdev))
+                events[2] |= 0x80;
+
         hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
 }
 
@@ -1322,21 +1673,8 @@ static void hci_init3_req(struct hci_request *req, unsigned long opt)
         if (hdev->commands[5] & 0x10)
                 hci_setup_link_policy(req);
 
-        if (lmp_le_capable(hdev)) {
-                if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
-                        /* If the controller has a public BD_ADDR, then
-                         * by default use that one. If this is a LE only
-                         * controller without a public address, default
-                         * to the random address.
-                         */
-                        if (bacmp(&hdev->bdaddr, BDADDR_ANY))
-                                hdev->own_addr_type = ADDR_LE_DEV_PUBLIC;
-                        else
-                                hdev->own_addr_type = ADDR_LE_DEV_RANDOM;
-                }
-
+        if (lmp_le_capable(hdev))
                 hci_set_le_support(req);
-        }
 
         /* Read features beyond page 1 if available */
         for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
@@ -1359,6 +1697,15 @@ static void hci_init4_req(struct hci_request *req, unsigned long opt)
         /* Check for Synchronization Train support */
         if (lmp_sync_train_capable(hdev))
                 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
+
+        /* Enable Secure Connections if supported and configured */
+        if ((lmp_sc_capable(hdev) ||
+             test_bit(HCI_FORCE_SC, &hdev->dev_flags)) &&
+            test_bit(HCI_SC_ENABLED, &hdev->dev_flags)) {
+                u8 support = 0x01;
+                hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
+                            sizeof(support), &support);
+        }
 }
 
 static int __hci_init(struct hci_dev *hdev)
@@ -1417,8 +1764,6 @@ static int __hci_init(struct hci_dev *hdev)
                                     hdev, &inquiry_cache_fops);
                 debugfs_create_file("link_keys", 0400, hdev->debugfs,
                                     hdev, &link_keys_fops);
-                debugfs_create_file("use_debug_keys", 0444, hdev->debugfs,
-                                    hdev, &use_debug_keys_fops);
                 debugfs_create_file("dev_class", 0444, hdev->debugfs,
                                     hdev, &dev_class_fops);
                 debugfs_create_file("voice_setting", 0444, hdev->debugfs,
@@ -1430,6 +1775,10 @@ static int __hci_init(struct hci_dev *hdev)
                                     hdev, &auto_accept_delay_fops);
                 debugfs_create_file("ssp_debug_mode", 0644, hdev->debugfs,
                                     hdev, &ssp_debug_mode_fops);
+                debugfs_create_file("force_sc_support", 0644, hdev->debugfs,
+                                    hdev, &force_sc_support_fops);
+                debugfs_create_file("sc_only_mode", 0444, hdev->debugfs,
+                                    hdev, &sc_only_mode_fops);
         }
 
         if (lmp_sniff_capable(hdev)) {
@@ -1442,20 +1791,43 @@ static int __hci_init(struct hci_dev *hdev)
         }
 
         if (lmp_le_capable(hdev)) {
+                debugfs_create_file("identity", 0400, hdev->debugfs,
+                                    hdev, &identity_fops);
+                debugfs_create_file("rpa_timeout", 0644, hdev->debugfs,
+                                    hdev, &rpa_timeout_fops);
+                debugfs_create_file("random_address", 0444, hdev->debugfs,
+                                    hdev, &random_address_fops);
+                debugfs_create_file("static_address", 0444, hdev->debugfs,
+                                    hdev, &static_address_fops);
+
+                /* For controllers with a public address, provide a debug
+                 * option to force the usage of the configured static
+                 * address. By default the public address is used.
+                 */
+                if (bacmp(&hdev->bdaddr, BDADDR_ANY))
+                        debugfs_create_file("force_static_address", 0644,
+                                            hdev->debugfs, hdev,
+                                            &force_static_address_fops);
+
                 debugfs_create_u8("white_list_size", 0444, hdev->debugfs,
                                   &hdev->le_white_list_size);
-                debugfs_create_file("static_address", 0444, hdev->debugfs,
-                                   hdev, &static_address_fops);
-                debugfs_create_file("own_address_type", 0644, hdev->debugfs,
-                                    hdev, &own_address_type_fops);
+                debugfs_create_file("white_list", 0444, hdev->debugfs, hdev,
+                                    &white_list_fops);
+                debugfs_create_file("identity_resolving_keys", 0400,
+                                    hdev->debugfs, hdev,
+                                    &identity_resolving_keys_fops);
                 debugfs_create_file("long_term_keys", 0400, hdev->debugfs,
                                     hdev, &long_term_keys_fops);
                 debugfs_create_file("conn_min_interval", 0644, hdev->debugfs,
                                     hdev, &conn_min_interval_fops);
                 debugfs_create_file("conn_max_interval", 0644, hdev->debugfs,
                                     hdev, &conn_max_interval_fops);
+                debugfs_create_file("adv_channel_map", 0644, hdev->debugfs,
+                                    hdev, &adv_channel_map_fops);
                 debugfs_create_file("6lowpan", 0644, hdev->debugfs, hdev,
                                     &lowpan_debugfs_fops);
+                debugfs_create_file("le_auto_conn", 0644, hdev->debugfs, hdev,
+                                    &le_auto_conn_fops);
         }
 
         return 0;
@@ -1548,6 +1920,8 @@ void hci_discovery_set_state(struct hci_dev *hdev, int state)
 
         switch (state) {
         case DISCOVERY_STOPPED:
+                hci_update_background_scan(hdev);
+
                 if (hdev->discovery.state != DISCOVERY_STARTING)
                         mgmt_discovering(hdev, 0);
                 break;
@@ -1876,10 +2250,15 @@ static int hci_dev_do_open(struct hci_dev *hdev)
                  * be able to determine if there is a public address
                  * or not.
                  *
+                 * In case of user channel usage, it is not important
+                 * if a public address or static random address is
+                 * available.
+                 *
                  * This check is only valid for BR/EDR controllers
                  * since AMP controllers do not have an address.
                  */
-                if (hdev->dev_type == HCI_BREDR &&
+                if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
+                    hdev->dev_type == HCI_BREDR &&
                     !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
                     !bacmp(&hdev->static_addr, BDADDR_ANY)) {
                         ret = -EADDRNOTAVAIL;
@@ -1916,6 +2295,7 @@ static int hci_dev_do_open(struct hci_dev *hdev)
 
         if (!ret) {
                 hci_dev_hold(hdev);
+                set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
                 set_bit(HCI_UP, &hdev->flags);
                 hci_notify(hdev, HCI_DEV_UP);
                 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
@@ -2014,9 +2394,13 @@ static int hci_dev_do_close(struct hci_dev *hdev)
 
         cancel_delayed_work_sync(&hdev->le_scan_disable);
 
+        if (test_bit(HCI_MGMT, &hdev->dev_flags))
+                cancel_delayed_work_sync(&hdev->rpa_expired);
+
         hci_dev_lock(hdev);
         hci_inquiry_cache_flush(hdev);
         hci_conn_hash_flush(hdev);
+        hci_pend_le_conns_clear(hdev);
         hci_dev_unlock(hdev);
 
         hci_notify(hdev, HCI_DEV_DOWN);
@@ -2074,6 +2458,7 @@ static int hci_dev_do_close(struct hci_dev *hdev)
 
         memset(hdev->eir, 0, sizeof(hdev->eir));
         memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
+        bacpy(&hdev->random_addr, BDADDR_ANY);
 
         hci_req_unlock(hdev);
 
@@ -2437,7 +2822,7 @@ static void hci_discov_off(struct work_struct *work)
         mgmt_discoverable_timeout(hdev);
 }
 
-int hci_uuids_clear(struct hci_dev *hdev)
+void hci_uuids_clear(struct hci_dev *hdev)
 {
         struct bt_uuid *uuid, *tmp;
 
@@ -2445,11 +2830,9 @@ int hci_uuids_clear(struct hci_dev *hdev)
                 list_del(&uuid->list);
                 kfree(uuid);
         }
-
-        return 0;
 }
 
-int hci_link_keys_clear(struct hci_dev *hdev)
+void hci_link_keys_clear(struct hci_dev *hdev)
 {
         struct list_head *p, *n;
 
@@ -2461,11 +2844,9 @@ int hci_link_keys_clear(struct hci_dev *hdev)
                 list_del(p);
                 kfree(key);
         }
-
-        return 0;
 }
 
-int hci_smp_ltks_clear(struct hci_dev *hdev)
+void hci_smp_ltks_clear(struct hci_dev *hdev)
 {
         struct smp_ltk *k, *tmp;
 
@@ -2473,8 +2854,16 @@ int hci_smp_ltks_clear(struct hci_dev *hdev)
                 list_del(&k->list);
                 kfree(k);
         }
+}
 
-        return 0;
+void hci_smp_irks_clear(struct hci_dev *hdev)
+{
+        struct smp_irk *k, *tmp;
+
+        list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
+                list_del(&k->list);
+                kfree(k);
+        }
 }
 
 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
@@ -2524,13 +2913,24 @@ static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
         return false;
 }
 
-struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
+static bool ltk_type_master(u8 type)
+{
+        if (type == HCI_SMP_STK || type == HCI_SMP_LTK)
+                return true;
+
+        return false;
+}
+
+struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, __le64 rand,
+                             bool master)
 {
         struct smp_ltk *k;
 
         list_for_each_entry(k, &hdev->long_term_keys, list) {
-                if (k->ediv != ediv ||
-                    memcmp(rand, k->rand, sizeof(k->rand)))
+                if (k->ediv != ediv || k->rand != rand)
+                        continue;
+
+                if (ltk_type_master(k->type) != master)
                         continue;
 
                 return k;
@@ -2540,18 +2940,56 @@ struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
 }
 
 struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                     u8 addr_type)
+                                     u8 addr_type, bool master)
 {
         struct smp_ltk *k;
 
         list_for_each_entry(k, &hdev->long_term_keys, list)
                 if (addr_type == k->bdaddr_type &&
-                    bacmp(bdaddr, &k->bdaddr) == 0)
+                    bacmp(bdaddr, &k->bdaddr) == 0 &&
+                    ltk_type_master(k->type) == master)
                         return k;
 
         return NULL;
 }
 
+struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
+{
+        struct smp_irk *irk;
+
+        list_for_each_entry(irk, &hdev->identity_resolving_keys, list) {
+                if (!bacmp(&irk->rpa, rpa))
+                        return irk;
+        }
+
+        list_for_each_entry(irk, &hdev->identity_resolving_keys, list) {
+                if (smp_irk_matches(hdev->tfm_aes, irk->val, rpa)) {
+                        bacpy(&irk->rpa, rpa);
+                        return irk;
+                }
+        }
+
+        return NULL;
+}
+
+struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                     u8 addr_type)
+{
+        struct smp_irk *irk;
+
+        /* Identity Address must be public or static random */
+        if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
+                return NULL;
+
+        list_for_each_entry(irk, &hdev->identity_resolving_keys, list) {
+                if (addr_type == irk->addr_type &&
+                    bacmp(bdaddr, &irk->bdaddr) == 0)
+                        return irk;
+        }
+
+        return NULL;
+}
+
 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
                      bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
 {
@@ -2565,7 +3003,7 @@ int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
                 key = old_key;
         } else {
                 old_key_type = conn ? conn->key_type : 0xff;
-                key = kzalloc(sizeof(*key), GFP_ATOMIC);
+                key = kzalloc(sizeof(*key), GFP_KERNEL);
                 if (!key)
                         return -ENOMEM;
                 list_add(&key->list, &hdev->link_keys);
@@ -2605,22 +3043,20 @@ int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
         return 0;
 }
 
-int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
-                int new_key, u8 authenticated, u8 tk[16], u8 enc_size, __le16
-                ediv, u8 rand[8])
+struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                            u8 addr_type, u8 type, u8 authenticated,
+                            u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
 {
         struct smp_ltk *key, *old_key;
+        bool master = ltk_type_master(type);
 
-        if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
-                return 0;
-
-        old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
+        old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type, master);
         if (old_key)
                 key = old_key;
         else {
-                key = kzalloc(sizeof(*key), GFP_ATOMIC);
+                key = kzalloc(sizeof(*key), GFP_KERNEL);
                 if (!key)
-                        return -ENOMEM;
+                        return NULL;
                 list_add(&key->list, &hdev->long_term_keys);
         }
 
@@ -2629,17 +3065,34 @@ int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
         memcpy(key->val, tk, sizeof(key->val));
         key->authenticated = authenticated;
         key->ediv = ediv;
+        key->rand = rand;
         key->enc_size = enc_size;
         key->type = type;
-        memcpy(key->rand, rand, sizeof(key->rand));
 
-        if (!new_key)
-                return 0;
+        return key;
+}
+
+struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                            u8 addr_type, u8 val[16], bdaddr_t *rpa)
+{
+        struct smp_irk *irk;
 
-        if (type & HCI_SMP_LTK)
-                mgmt_new_ltk(hdev, key, 1);
+        irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
+        if (!irk) {
+                irk = kzalloc(sizeof(*irk), GFP_KERNEL);
+                if (!irk)
+                        return NULL;
 
-        return 0;
+                bacpy(&irk->bdaddr, bdaddr);
+                irk->addr_type = addr_type;
+
+                list_add(&irk->list, &hdev->identity_resolving_keys);
+        }
+
+        memcpy(irk->val, val, 16);
+        bacpy(&irk->rpa, rpa);
+
+        return irk;
 }
 
 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
@@ -2658,21 +3111,38 @@ int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
         return 0;
 }
 
-int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
+int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
 {
         struct smp_ltk *k, *tmp;
+        int removed = 0;
 
         list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
-                if (bacmp(bdaddr, &k->bdaddr))
+                if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
                         continue;
 
                 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
 
                 list_del(&k->list);
                 kfree(k);
+                removed++;
         }
 
-        return 0;
+        return removed ? 0 : -ENOENT;
+}
+
+void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
+{
+        struct smp_irk *k, *tmp;
+
+        list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
+                if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
+                        continue;
+
+                BT_DBG("%s removing %pMR", hdev->name, bdaddr);
+
+                list_del(&k->list);
+                kfree(k);
+        }
 }
 
 /* HCI command timer function */
@@ -2721,7 +3191,7 @@ int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
         return 0;
 }
 
-int hci_remote_oob_data_clear(struct hci_dev *hdev)
+void hci_remote_oob_data_clear(struct hci_dev *hdev)
 {
         struct oob_data *data, *n;
 
@@ -2729,19 +3199,43 @@ int hci_remote_oob_data_clear(struct hci_dev *hdev)
                 list_del(&data->list);
                 kfree(data);
         }
+}
+
+int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                            u8 *hash, u8 *randomizer)
+{
+        struct oob_data *data;
+
+        data = hci_find_remote_oob_data(hdev, bdaddr);
+        if (!data) {
+                data = kmalloc(sizeof(*data), GFP_KERNEL);
+                if (!data)
+                        return -ENOMEM;
+
+                bacpy(&data->bdaddr, bdaddr);
+                list_add(&data->list, &hdev->remote_oob_data);
+        }
+
+        memcpy(data->hash192, hash, sizeof(data->hash192));
+        memcpy(data->randomizer192, randomizer, sizeof(data->randomizer192));
+
+        memset(data->hash256, 0, sizeof(data->hash256));
+        memset(data->randomizer256, 0, sizeof(data->randomizer256));
+
+        BT_DBG("%s for %pMR", hdev->name, bdaddr);
 
         return 0;
 }
 
-int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
-                            u8 *randomizer)
+int hci_add_remote_oob_ext_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                u8 *hash192, u8 *randomizer192,
+                                u8 *hash256, u8 *randomizer256)
 {
         struct oob_data *data;
 
         data = hci_find_remote_oob_data(hdev, bdaddr);
-
         if (!data) {
-                data = kmalloc(sizeof(*data), GFP_ATOMIC);
+                data = kmalloc(sizeof(*data), GFP_KERNEL);
                 if (!data)
                         return -ENOMEM;
 
@@ -2749,8 +3243,11 @@ int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
                 list_add(&data->list, &hdev->remote_oob_data);
         }
 
-        memcpy(data->hash, hash, sizeof(data->hash));
-        memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
+        memcpy(data->hash192, hash192, sizeof(data->hash192));
+        memcpy(data->randomizer192, randomizer192, sizeof(data->randomizer192));
+
+        memcpy(data->hash256, hash256, sizeof(data->hash256));
+        memcpy(data->randomizer256, randomizer256, sizeof(data->randomizer256));
 
         BT_DBG("%s for %pMR", hdev->name, bdaddr);
 
@@ -2770,7 +3267,7 @@ struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
         return NULL;
 }
 
-int hci_blacklist_clear(struct hci_dev *hdev)
+static void hci_blacklist_clear(struct hci_dev *hdev)
 {
         struct list_head *p, *n;
 
@@ -2780,8 +3277,6 @@ int hci_blacklist_clear(struct hci_dev *hdev)
                 list_del(p);
                 kfree(b);
         }
-
-        return 0;
 }
 
 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
@@ -2810,8 +3305,10 @@ int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
 {
         struct bdaddr_list *entry;
 
-        if (!bacmp(bdaddr, BDADDR_ANY))
-                return hci_blacklist_clear(hdev);
+        if (!bacmp(bdaddr, BDADDR_ANY)) {
+                hci_blacklist_clear(hdev);
+                return 0;
+        }
 
         entry = hci_blacklist_lookup(hdev, bdaddr, type);
         if (!entry)
@@ -2823,6 +3320,262 @@ int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
         return mgmt_device_unblocked(hdev, bdaddr, type);
 }
 
+struct bdaddr_list *hci_white_list_lookup(struct hci_dev *hdev,
+                                          bdaddr_t *bdaddr, u8 type)
+{
+        struct bdaddr_list *b;
+
+        list_for_each_entry(b, &hdev->le_white_list, list) {
+                if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
+                        return b;
+        }
+
+        return NULL;
+}
+
+void hci_white_list_clear(struct hci_dev *hdev)
+{
+        struct list_head *p, *n;
+
+        list_for_each_safe(p, n, &hdev->le_white_list) {
+                struct bdaddr_list *b = list_entry(p, struct bdaddr_list, list);
+
+                list_del(p);
+                kfree(b);
+        }
+}
+
+int hci_white_list_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
+{
+        struct bdaddr_list *entry;
+
+        if (!bacmp(bdaddr, BDADDR_ANY))
+                return -EBADF;
+
+        entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
+        if (!entry)
+                return -ENOMEM;
+
+        bacpy(&entry->bdaddr, bdaddr);
+        entry->bdaddr_type = type;
+
+        list_add(&entry->list, &hdev->le_white_list);
+
+        return 0;
+}
+
+int hci_white_list_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
+{
+        struct bdaddr_list *entry;
+
+        if (!bacmp(bdaddr, BDADDR_ANY))
+                return -EBADF;
+
+        entry = hci_white_list_lookup(hdev, bdaddr, type);
+        if (!entry)
+                return -ENOENT;
+
+        list_del(&entry->list);
+        kfree(entry);
+
+        return 0;
+}
+
+/* This function requires the caller holds hdev->lock */
+struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
+                                               bdaddr_t *addr, u8 addr_type)
+{
+        struct hci_conn_params *params;
+
+        list_for_each_entry(params, &hdev->le_conn_params, list) {
+                if (bacmp(&params->addr, addr) == 0 &&
+                    params->addr_type == addr_type) {
+                        return params;
+                }
+        }
+
+        return NULL;
+}
+
+static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
+{
+        struct hci_conn *conn;
+
+        conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
+        if (!conn)
+                return false;
+
+        if (conn->dst_type != type)
+                return false;
+
+        if (conn->state != BT_CONNECTED)
+                return false;
+
+        return true;
+}
+
+static bool is_identity_address(bdaddr_t *addr, u8 addr_type)
+{
+        if (addr_type == ADDR_LE_DEV_PUBLIC)
+                return true;
+
+        /* Check for Random Static address type */
+        if ((addr->b[5] & 0xc0) == 0xc0)
+                return true;
+
+        return false;
+}
+
+/* This function requires the caller holds hdev->lock */
+int hci_conn_params_add(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type,
+                        u8 auto_connect, u16 conn_min_interval,
+                        u16 conn_max_interval)
+{
+        struct hci_conn_params *params;
+
+        if (!is_identity_address(addr, addr_type))
+                return -EINVAL;
+
+        params = hci_conn_params_lookup(hdev, addr, addr_type);
+        if (params)
+                goto update;
+
+        params = kzalloc(sizeof(*params), GFP_KERNEL);
+        if (!params) {
+                BT_ERR("Out of memory");
+                return -ENOMEM;
+        }
+
+        bacpy(&params->addr, addr);
+        params->addr_type = addr_type;
+
+        list_add(&params->list, &hdev->le_conn_params);
+
+update:
+        params->conn_min_interval = conn_min_interval;
+        params->conn_max_interval = conn_max_interval;
+        params->auto_connect = auto_connect;
+
+        switch (auto_connect) {
+        case HCI_AUTO_CONN_DISABLED:
+        case HCI_AUTO_CONN_LINK_LOSS:
+                hci_pend_le_conn_del(hdev, addr, addr_type);
+                break;
+        case HCI_AUTO_CONN_ALWAYS:
+                if (!is_connected(hdev, addr, addr_type))
+                        hci_pend_le_conn_add(hdev, addr, addr_type);
+                break;
+        }
+
+        BT_DBG("addr %pMR (type %u) auto_connect %u conn_min_interval 0x%.4x "
+               "conn_max_interval 0x%.4x", addr, addr_type, auto_connect,
+               conn_min_interval, conn_max_interval);
+
+        return 0;
+}
+
+/* This function requires the caller holds hdev->lock */
+void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
+{
+        struct hci_conn_params *params;
+
+        params = hci_conn_params_lookup(hdev, addr, addr_type);
+        if (!params)
+                return;
+
+        hci_pend_le_conn_del(hdev, addr, addr_type);
+
+        list_del(&params->list);
+        kfree(params);
+
+        BT_DBG("addr %pMR (type %u)", addr, addr_type);
+}
+
+/* This function requires the caller holds hdev->lock */
+void hci_conn_params_clear(struct hci_dev *hdev)
+{
+        struct hci_conn_params *params, *tmp;
+
+        list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
+                list_del(&params->list);
+                kfree(params);
+        }
+
+        BT_DBG("All LE connection parameters were removed");
+}
+
+/* This function requires the caller holds hdev->lock */
+struct bdaddr_list *hci_pend_le_conn_lookup(struct hci_dev *hdev,
+                                            bdaddr_t *addr, u8 addr_type)
+{
+        struct bdaddr_list *entry;
+
+        list_for_each_entry(entry, &hdev->pend_le_conns, list) {
+                if (bacmp(&entry->bdaddr, addr) == 0 &&
+                    entry->bdaddr_type == addr_type)
+                        return entry;
+        }
+
+        return NULL;
+}
+
+/* This function requires the caller holds hdev->lock */
+void hci_pend_le_conn_add(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
+{
+        struct bdaddr_list *entry;
+
+        entry = hci_pend_le_conn_lookup(hdev, addr, addr_type);
+        if (entry)
+                goto done;
+
+        entry = kzalloc(sizeof(*entry), GFP_KERNEL);
+        if (!entry) {
+                BT_ERR("Out of memory");
+                return;
+        }
+
+        bacpy(&entry->bdaddr, addr);
+        entry->bdaddr_type = addr_type;
+
+        list_add(&entry->list, &hdev->pend_le_conns);
+
+        BT_DBG("addr %pMR (type %u)", addr, addr_type);
+
+done:
+        hci_update_background_scan(hdev);
+}
+
+/* This function requires the caller holds hdev->lock */
+void hci_pend_le_conn_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
+{
+        struct bdaddr_list *entry;
+
+        entry = hci_pend_le_conn_lookup(hdev, addr, addr_type);
+        if (!entry)
+                goto done;
+
+        list_del(&entry->list);
+        kfree(entry);
+
+        BT_DBG("addr %pMR (type %u)", addr, addr_type);
+
+done:
+        hci_update_background_scan(hdev);
+}
+
+/* This function requires the caller holds hdev->lock */
+void hci_pend_le_conns_clear(struct hci_dev *hdev)
+{
+        struct bdaddr_list *entry, *tmp;
+
+        list_for_each_entry_safe(entry, tmp, &hdev->pend_le_conns, list) {
+                list_del(&entry->list);
+                kfree(entry);
+        }
+
+        BT_DBG("All LE pending connections cleared");
+}
+
 static void inquiry_complete(struct hci_dev *hdev, u8 status)
 {
         if (status) {
@@ -2882,7 +3635,6 @@ static void le_scan_disable_work(struct work_struct *work)
 {
         struct hci_dev *hdev = container_of(work, struct hci_dev,
                                             le_scan_disable.work);
-        struct hci_cp_le_set_scan_enable cp;
         struct hci_request req;
         int err;
 
@@ -2890,15 +3642,128 @@ static void le_scan_disable_work(struct work_struct *work)
 
         hci_req_init(&req, hdev);
 
-        memset(&cp, 0, sizeof(cp));
-        cp.enable = LE_SCAN_DISABLE;
-        hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
+        hci_req_add_le_scan_disable(&req);
 
         err = hci_req_run(&req, le_scan_disable_work_complete);
         if (err)
                 BT_ERR("Disable LE scanning request failed: err %d", err);
 }
 
+static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
+{
+        struct hci_dev *hdev = req->hdev;
+
+        /* If we're advertising or initiating an LE connection we can't
+         * go ahead and change the random address at this time. This is
+         * because the eventual initiator address used for the
+         * subsequently created connection will be undefined (some
+         * controllers use the new address and others the one we had
+         * when the operation started).
+         *
+         * In this kind of scenario skip the update and let the random
+         * address be updated at the next cycle.
+         */
+        if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) ||
+            hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
+                BT_DBG("Deferring random address update");
+                return;
+        }
+
+        hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa);
+}
+
+int hci_update_random_address(struct hci_request *req, bool require_privacy,
+                              u8 *own_addr_type)
+{
+        struct hci_dev *hdev = req->hdev;
+        int err;
+
+        /* If privacy is enabled use a resolvable private address. If
+         * current RPA has expired or there is something else than
+         * the current RPA in use, then generate a new one.
+         */
+        if (test_bit(HCI_PRIVACY, &hdev->dev_flags)) {
+                int to;
+
+                *own_addr_type = ADDR_LE_DEV_RANDOM;
+
+                if (!test_and_clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags) &&
+                    !bacmp(&hdev->random_addr, &hdev->rpa))
+                        return 0;
+
+                err = smp_generate_rpa(hdev->tfm_aes, hdev->irk, &hdev->rpa);
+                if (err < 0) {
+                        BT_ERR("%s failed to generate new RPA", hdev->name);
+                        return err;
+                }
+
+                set_random_addr(req, &hdev->rpa);
+
+                to = msecs_to_jiffies(hdev->rpa_timeout * 1000);
+                queue_delayed_work(hdev->workqueue, &hdev->rpa_expired, to);
+
+                return 0;
+        }
+
+        /* In case of required privacy without resolvable private address,
+         * use an unresolvable private address. This is useful for active
+         * scanning and non-connectable advertising.
+         */
+        if (require_privacy) {
+                bdaddr_t urpa;
+
+                get_random_bytes(&urpa, 6);
+                urpa.b[5] &= 0x3f;      /* Clear two most significant bits */
+
+                *own_addr_type = ADDR_LE_DEV_RANDOM;
+                set_random_addr(req, &urpa);
+                return 0;
+        }
+
+        /* If forcing static address is in use or there is no public
+         * address use the static address as random address (but skip
+         * the HCI command if the current random address is already the
+         * static one.
+         */
+        if (test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dev_flags) ||
+            !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
+                *own_addr_type = ADDR_LE_DEV_RANDOM;
+                if (bacmp(&hdev->static_addr, &hdev->random_addr))
+                        hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
+                                    &hdev->static_addr);
+                return 0;
+        }
+
+        /* Neither privacy nor static address is being used so use a
+         * public address.
+         */
+        *own_addr_type = ADDR_LE_DEV_PUBLIC;
+
+        return 0;
+}
+
+/* Copy the Identity Address of the controller.
+ *
+ * If the controller has a public BD_ADDR, then by default use that one.
+ * If this is a LE only controller without a public address, default to
+ * the static random address.
+ *
+ * For debugging purposes it is possible to force controllers with a
+ * public address to use the static random address instead.
+ */
+void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                               u8 *bdaddr_type)
+{
+        if (test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dev_flags) ||
+            !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
+                bacpy(bdaddr, &hdev->static_addr);
+                *bdaddr_type = ADDR_LE_DEV_RANDOM;
+        } else {
+                bacpy(bdaddr, &hdev->bdaddr);
+                *bdaddr_type = ADDR_LE_DEV_PUBLIC;
+        }
+}
+
 /* Alloc HCI device */
 struct hci_dev *hci_alloc_dev(void)
 {
@@ -2919,11 +3784,14 @@ struct hci_dev *hci_alloc_dev(void)
         hdev->sniff_max_interval = 800;
         hdev->sniff_min_interval = 80;
 
+        hdev->le_adv_channel_map = 0x07;
         hdev->le_scan_interval = 0x0060;
         hdev->le_scan_window = 0x0030;
         hdev->le_conn_min_interval = 0x0028;
         hdev->le_conn_max_interval = 0x0038;
 
+        hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
+
         mutex_init(&hdev->lock);
         mutex_init(&hdev->req_lock);
 
@@ -2932,7 +3800,11 @@ struct hci_dev *hci_alloc_dev(void)
         INIT_LIST_HEAD(&hdev->uuids);
         INIT_LIST_HEAD(&hdev->link_keys);
         INIT_LIST_HEAD(&hdev->long_term_keys);
+        INIT_LIST_HEAD(&hdev->identity_resolving_keys);
         INIT_LIST_HEAD(&hdev->remote_oob_data);
+        INIT_LIST_HEAD(&hdev->le_white_list);
+        INIT_LIST_HEAD(&hdev->le_conn_params);
+        INIT_LIST_HEAD(&hdev->pend_le_conns);
         INIT_LIST_HEAD(&hdev->conn_hash.list);
 
         INIT_WORK(&hdev->rx_work, hci_rx_work);
@@ -3017,9 +3889,18 @@ int hci_register_dev(struct hci_dev *hdev)
 
         dev_set_name(&hdev->dev, "%s", hdev->name);
 
+        hdev->tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0,
+                                               CRYPTO_ALG_ASYNC);
+        if (IS_ERR(hdev->tfm_aes)) {
+                BT_ERR("Unable to create crypto context");
+                error = PTR_ERR(hdev->tfm_aes);
+                hdev->tfm_aes = NULL;
+                goto err_wqueue;
+        }
+
         error = device_add(&hdev->dev);
         if (error < 0)
-                goto err_wqueue;
+                goto err_tfm;
 
         hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
                                     RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
@@ -3055,6 +3936,8 @@ int hci_register_dev(struct hci_dev *hdev)
 
         return id;
 
+err_tfm:
+        crypto_free_blkcipher(hdev->tfm_aes);
 err_wqueue:
         destroy_workqueue(hdev->workqueue);
         destroy_workqueue(hdev->req_workqueue);
@@ -3105,6 +3988,9 @@ void hci_unregister_dev(struct hci_dev *hdev)
                 rfkill_destroy(hdev->rfkill);
         }
 
+        if (hdev->tfm_aes)
+                crypto_free_blkcipher(hdev->tfm_aes);
+
         device_del(&hdev->dev);
 
         debugfs_remove_recursive(hdev->debugfs);
@@ -3117,7 +4003,11 @@ void hci_unregister_dev(struct hci_dev *hdev)
         hci_uuids_clear(hdev);
         hci_link_keys_clear(hdev);
         hci_smp_ltks_clear(hdev);
+        hci_smp_irks_clear(hdev);
         hci_remote_oob_data_clear(hdev);
+        hci_white_list_clear(hdev);
+        hci_conn_params_clear(hdev);
+        hci_pend_le_conns_clear(hdev);
         hci_dev_unlock(hdev);
 
         hci_dev_put(hdev);
@@ -4345,3 +5235,104 @@ static void hci_cmd_work(struct work_struct *work)
                 }
         }
 }
+
+void hci_req_add_le_scan_disable(struct hci_request *req)
+{
+        struct hci_cp_le_set_scan_enable cp;
+
+        memset(&cp, 0, sizeof(cp));
+        cp.enable = LE_SCAN_DISABLE;
+        hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
+}
+
+void hci_req_add_le_passive_scan(struct hci_request *req)
+{
+        struct hci_cp_le_set_scan_param param_cp;
+        struct hci_cp_le_set_scan_enable enable_cp;
+        struct hci_dev *hdev = req->hdev;
+        u8 own_addr_type;
+
+        /* Set require_privacy to true to avoid identification from
+         * unknown peer devices. Since this is passive scanning, no
+         * SCAN_REQ using the local identity should be sent. Mandating
+         * privacy is just an extra precaution.
+         */
+        if (hci_update_random_address(req, true, &own_addr_type))
+                return;
+
+        memset(&param_cp, 0, sizeof(param_cp));
+        param_cp.type = LE_SCAN_PASSIVE;
+        param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
+        param_cp.window = cpu_to_le16(hdev->le_scan_window);
+        param_cp.own_address_type = own_addr_type;
+        hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
+                    &param_cp);
+
+        memset(&enable_cp, 0, sizeof(enable_cp));
+        enable_cp.enable = LE_SCAN_ENABLE;
+        enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
+        hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
+                    &enable_cp);
+}
+
+static void update_background_scan_complete(struct hci_dev *hdev, u8 status)
+{
+        if (status)
+                BT_DBG("HCI request failed to update background scanning: "
+                       "status 0x%2.2x", status);
+}
+
+/* This function controls the background scanning based on hdev->pend_le_conns
+ * list. If there are pending LE connection we start the background scanning,
+ * otherwise we stop it.
+ *
+ * This function requires the caller holds hdev->lock.
+ */
+void hci_update_background_scan(struct hci_dev *hdev)
+{
+        struct hci_request req;
+        struct hci_conn *conn;
+        int err;
+
+        hci_req_init(&req, hdev);
+
+        if (list_empty(&hdev->pend_le_conns)) {
+                /* If there is no pending LE connections, we should stop
+                 * the background scanning.
+                 */
+
+                /* If controller is not scanning we are done. */
+                if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
+                        return;
+
+                hci_req_add_le_scan_disable(&req);
+
+                BT_DBG("%s stopping background scanning", hdev->name);
+        } else {
+                /* If there is at least one pending LE connection, we should
+                 * keep the background scan running.
+                 */
+
+                /* If controller is connecting, we should not start scanning
+                 * since some controllers are not able to scan and connect at
+                 * the same time.
+                 */
+                conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
+                if (conn)
+                        return;
+
+                /* If controller is currently scanning, we stop it to ensure we
+                 * don't miss any advertising (due to duplicates filter).
+                 */
+                if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
+                        hci_req_add_le_scan_disable(&req);
+
+                hci_req_add_le_passive_scan(&req);
+
+                BT_DBG("%s starting background scanning", hdev->name);
+        }
+
+        err = hci_req_run(&req, update_background_scan_complete);
+        if (err)
+                BT_ERR("Failed to run HCI request: err %d", err);
+}
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 5f812455a450..49774912cb01 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -199,6 +199,8 @@ static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
         hdev->scan_rsp_data_len = 0;
 
+        hdev->le_scan_type = LE_SCAN_PASSIVE;
+
         hdev->ssp_debug_mode = 0;
 }
 
@@ -461,6 +463,34 @@ static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
         }
 }
 
+static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        u8 status = *((u8 *) skb->data);
+        struct hci_cp_write_sc_support *sent;
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, status);
+
+        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
+        if (!sent)
+                return;
+
+        if (!status) {
+                if (sent->support)
+                        hdev->features[1][0] |= LMP_HOST_SC;
+                else
+                        hdev->features[1][0] &= ~LMP_HOST_SC;
+        }
+
+        if (test_bit(HCI_MGMT, &hdev->dev_flags))
+                mgmt_sc_enable_complete(hdev, sent->support, status);
+        else if (!status) {
+                if (sent->support)
+                        set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
+                else
+                        clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
+        }
+}
+
 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_rp_read_local_version *rp = (void *) skb->data;
@@ -904,16 +934,50 @@ static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
         hci_dev_unlock(hdev);
 }
 
-static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
-                                             struct sk_buff *skb)
+static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
+                                       struct sk_buff *skb)
 {
         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
 
         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 
         hci_dev_lock(hdev);
-        mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
-                                                rp->randomizer, rp->status);
+        mgmt_read_local_oob_data_complete(hdev, rp->hash, rp->randomizer,
+                                          NULL, NULL, rp->status);
+        hci_dev_unlock(hdev);
+}
+
+static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
+                                           struct sk_buff *skb)
+{
+        struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
+
+        hci_dev_lock(hdev);
+        mgmt_read_local_oob_data_complete(hdev, rp->hash192, rp->randomizer192,
+                                          rp->hash256, rp->randomizer256,
+                                          rp->status);
+        hci_dev_unlock(hdev);
+}
+
+
+static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
+        bdaddr_t *sent;
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, status);
+
+        sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
+        if (!sent)
+                return;
+
+        hci_dev_lock(hdev);
+
+        if (!status)
+                bacpy(&hdev->random_addr, sent);
+
         hci_dev_unlock(hdev);
 }
 
@@ -929,12 +993,27 @@ static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
 
         hci_dev_lock(hdev);
 
-        if (!status) {
-                if (*sent)
-                        set_bit(HCI_ADVERTISING, &hdev->dev_flags);
-                else
-                        clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
-        }
+        if (!status)
+                mgmt_advertising(hdev, *sent);
+
+        hci_dev_unlock(hdev);
+}
+
+static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_cp_le_set_scan_param *cp;
+        __u8 status = *((__u8 *) skb->data);
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, status);
+
+        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
+        if (!cp)
+                return;
+
+        hci_dev_lock(hdev);
+
+        if (!status)
+                hdev->le_scan_type = cp->type;
 
         hci_dev_unlock(hdev);
 }
@@ -960,7 +1039,19 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
                 break;
 
         case LE_SCAN_DISABLE:
+                /* Cancel this timer so that we don't try to disable scanning
+                 * when it's already disabled.
+                 */
+                cancel_delayed_work(&hdev->le_scan_disable);
+
                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
+                /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
+                 * interrupted scanning due to a connect request. Mark
+                 * therefore discovery as stopped.
+                 */
+                if (test_and_clear_bit(HCI_LE_SCAN_INTERRUPTED,
+                                       &hdev->dev_flags))
+                        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
                 break;
 
         default:
@@ -980,6 +1071,49 @@ static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
                 hdev->le_white_list_size = rp->size;
 }
 
+static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
+                                       struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, status);
+
+        if (!status)
+                hci_white_list_clear(hdev);
+}
+
+static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
+                                        struct sk_buff *skb)
+{
+        struct hci_cp_le_add_to_white_list *sent;
+        __u8 status = *((__u8 *) skb->data);
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, status);
+
+        sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
+        if (!sent)
+                return;
+
+        if (!status)
+                hci_white_list_add(hdev, &sent->bdaddr, sent->bdaddr_type);
+}
+
+static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
+                                          struct sk_buff *skb)
+{
+        struct hci_cp_le_del_from_white_list *sent;
+        __u8 status = *((__u8 *) skb->data);
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, status);
+
+        sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
+        if (!sent)
+                return;
+
+        if (!status)
+                hci_white_list_del(hdev, &sent->bdaddr, sent->bdaddr_type);
+}
+
 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
                                             struct sk_buff *skb)
 {
@@ -1020,6 +1154,25 @@ static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
         }
 }
 
+static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_cp_le_set_adv_param *cp;
+        u8 status = *((u8 *) skb->data);
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, status);
+
+        if (status)
+                return;
+
+        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
+        if (!cp)
+                return;
+
+        hci_dev_lock(hdev);
+        hdev->adv_addr_type = cp->own_address_type;
+        hci_dev_unlock(hdev);
+}
+
 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
                                           struct sk_buff *skb)
 {
@@ -1185,9 +1338,12 @@ static int hci_outgoing_auth_needed(struct hci_dev *hdev,
                 return 0;
 
         /* Only request authentication for SSP connections or non-SSP
-         * devices with sec_level HIGH or if MITM protection is requested */
+         * devices with sec_level MEDIUM or HIGH or if MITM protection
+         * is requested.
+         */
         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
-            conn->pending_sec_level != BT_SECURITY_HIGH)
+            conn->pending_sec_level != BT_SECURITY_HIGH &&
+            conn->pending_sec_level != BT_SECURITY_MEDIUM)
                 return 0;
 
         return 1;
@@ -1518,6 +1674,87 @@ static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
         amp_write_remote_assoc(hdev, cp->phy_handle);
 }
 
+static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
+{
+        struct hci_cp_le_create_conn *cp;
+        struct hci_conn *conn;
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, status);
+
+        /* All connection failure handling is taken care of by the
+         * hci_le_conn_failed function which is triggered by the HCI
+         * request completion callbacks used for connecting.
+         */
+        if (status)
+                return;
+
+        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
+        if (!cp)
+                return;
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
+        if (!conn)
+                goto unlock;
+
+        /* Store the initiator and responder address information which
+         * is needed for SMP. These values will not change during the
+         * lifetime of the connection.
+         */
+        conn->init_addr_type = cp->own_address_type;
+        if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
+                bacpy(&conn->init_addr, &hdev->random_addr);
+        else
+                bacpy(&conn->init_addr, &hdev->bdaddr);
+
+        conn->resp_addr_type = cp->peer_addr_type;
+        bacpy(&conn->resp_addr, &cp->peer_addr);
+
+        /* We don't want the connection attempt to stick around
+         * indefinitely since LE doesn't have a page timeout concept
+         * like BR/EDR. Set a timer for any connection that doesn't use
+         * the white list for connecting.
+         */
+        if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
+                queue_delayed_work(conn->hdev->workqueue,
+                                   &conn->le_conn_timeout,
+                                   HCI_LE_CONN_TIMEOUT);
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
+static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
+{
+        struct hci_cp_le_start_enc *cp;
+        struct hci_conn *conn;
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, status);
+
+        if (!status)
+                return;
+
+        hci_dev_lock(hdev);
+
+        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
+        if (!cp)
+                goto unlock;
+
+        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
+        if (!conn)
+                goto unlock;
+
+        if (conn->state != BT_CONNECTED)
+                goto unlock;
+
+        hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
+        hci_conn_drop(conn);
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
@@ -1659,7 +1896,7 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
         } else {
                 conn->state = BT_CLOSED;
                 if (conn->type == ACL_LINK)
-                        mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
+                        mgmt_connect_failed(hdev, &conn->dst, conn->type,
                                             conn->dst_type, ev->status);
         }
 
@@ -1738,9 +1975,9 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                         bacpy(&cp.bdaddr, &ev->bdaddr);
                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 
-                        cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
-                        cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
-                        cp.max_latency    = __constant_cpu_to_le16(0xffff);
+                        cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
+                        cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
+                        cp.max_latency    = cpu_to_le16(0xffff);
                         cp.content_format = cpu_to_le16(hdev->voice_setting);
                         cp.retrans_effort = 0xff;
 
@@ -1780,7 +2017,9 @@ static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_disconn_complete *ev = (void *) skb->data;
         u8 reason = hci_to_mgmt_reason(ev->reason);
+        struct hci_conn_params *params;
         struct hci_conn *conn;
+        bool mgmt_connected;
         u8 type;
 
         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
@@ -1799,13 +2038,30 @@ static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
         conn->state = BT_CLOSED;
 
-        if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
-                mgmt_device_disconnected(hdev, &conn->dst, conn->type,
-                                         conn->dst_type, reason);
+        mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
+        mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
+                                reason, mgmt_connected);
 
         if (conn->type == ACL_LINK && conn->flush_key)
                 hci_remove_link_key(hdev, &conn->dst);
 
+        params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
+        if (params) {
+                switch (params->auto_connect) {
+                case HCI_AUTO_CONN_LINK_LOSS:
+                        if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
+                                break;
+                        /* Fall through */
+
+                case HCI_AUTO_CONN_ALWAYS:
+                        hci_pend_le_conn_add(hdev, &conn->dst, conn->dst_type);
+                        break;
+
+                default:
+                        break;
+                }
+        }
+
         type = conn->type;
 
         hci_proto_disconn_cfm(conn, ev->reason);
@@ -1943,34 +2199,57 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
-        if (conn) {
-                if (!ev->status) {
-                        if (ev->encrypt) {
-                                /* Encryption implies authentication */
-                                conn->link_mode |= HCI_LM_AUTH;
-                                conn->link_mode |= HCI_LM_ENCRYPT;
-                                conn->sec_level = conn->pending_sec_level;
-                        } else
-                                conn->link_mode &= ~HCI_LM_ENCRYPT;
+        if (!conn)
+                goto unlock;
+
+        if (!ev->status) {
+                if (ev->encrypt) {
+                        /* Encryption implies authentication */
+                        conn->link_mode |= HCI_LM_AUTH;
+                        conn->link_mode |= HCI_LM_ENCRYPT;
+                        conn->sec_level = conn->pending_sec_level;
+
+                        /* P-256 authentication key implies FIPS */
+                        if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
+                                conn->link_mode |= HCI_LM_FIPS;
+
+                        if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
+                            conn->type == LE_LINK)
+                                set_bit(HCI_CONN_AES_CCM, &conn->flags);
+                } else {
+                        conn->link_mode &= ~HCI_LM_ENCRYPT;
+                        clear_bit(HCI_CONN_AES_CCM, &conn->flags);
                 }
+        }
 
-                clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
+        clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 
-                if (ev->status && conn->state == BT_CONNECTED) {
-                        hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
+        if (ev->status && conn->state == BT_CONNECTED) {
+                hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
+                hci_conn_drop(conn);
+                goto unlock;
+        }
+
+        if (conn->state == BT_CONFIG) {
+                if (!ev->status)
+                        conn->state = BT_CONNECTED;
+
+                /* In Secure Connections Only mode, do not allow any
+                 * connections that are not encrypted with AES-CCM
+                 * using a P-256 authenticated combination key.
+                 */
+                if (test_bit(HCI_SC_ONLY, &hdev->dev_flags) &&
+                    (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
+                     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
+                        hci_proto_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
                         hci_conn_drop(conn);
                         goto unlock;
                 }
 
-                if (conn->state == BT_CONFIG) {
-                        if (!ev->status)
-                                conn->state = BT_CONNECTED;
-
-                        hci_proto_connect_cfm(conn, ev->status);
-                        hci_conn_drop(conn);
-                } else
-                        hci_encrypt_cfm(conn, ev->status, ev->encrypt);
-        }
+                hci_proto_connect_cfm(conn, ev->status);
+                hci_conn_drop(conn);
+        } else
+                hci_encrypt_cfm(conn, ev->status, ev->encrypt);
 
 unlock:
         hci_dev_unlock(hdev);
@@ -2144,6 +2423,10 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_write_ssp_mode(hdev, skb);
                 break;
 
+        case HCI_OP_WRITE_SC_SUPPORT:
+                hci_cc_write_sc_support(hdev, skb);
+                break;
+
         case HCI_OP_READ_LOCAL_VERSION:
                 hci_cc_read_local_version(hdev, skb);
                 break;
@@ -2213,7 +2496,11 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 break;
 
         case HCI_OP_READ_LOCAL_OOB_DATA:
-                hci_cc_read_local_oob_data_reply(hdev, skb);
+                hci_cc_read_local_oob_data(hdev, skb);
+                break;
+
+        case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
+                hci_cc_read_local_oob_ext_data(hdev, skb);
                 break;
 
         case HCI_OP_LE_READ_BUFFER_SIZE:
@@ -2244,10 +2531,18 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_user_passkey_neg_reply(hdev, skb);
                 break;
 
+        case HCI_OP_LE_SET_RANDOM_ADDR:
+                hci_cc_le_set_random_addr(hdev, skb);
+                break;
+
         case HCI_OP_LE_SET_ADV_ENABLE:
                 hci_cc_le_set_adv_enable(hdev, skb);
                 break;
 
+        case HCI_OP_LE_SET_SCAN_PARAM:
+                hci_cc_le_set_scan_param(hdev, skb);
+                break;
+
         case HCI_OP_LE_SET_SCAN_ENABLE:
                 hci_cc_le_set_scan_enable(hdev, skb);
                 break;
@@ -2256,6 +2551,18 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_le_read_white_list_size(hdev, skb);
                 break;
 
+        case HCI_OP_LE_CLEAR_WHITE_LIST:
+                hci_cc_le_clear_white_list(hdev, skb);
+                break;
+
+        case HCI_OP_LE_ADD_TO_WHITE_LIST:
+                hci_cc_le_add_to_white_list(hdev, skb);
+                break;
+
+        case HCI_OP_LE_DEL_FROM_WHITE_LIST:
+                hci_cc_le_del_from_white_list(hdev, skb);
+                break;
+
         case HCI_OP_LE_READ_SUPPORTED_STATES:
                 hci_cc_le_read_supported_states(hdev, skb);
                 break;
@@ -2264,6 +2571,10 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_write_le_host_supported(hdev, skb);
                 break;
 
+        case HCI_OP_LE_SET_ADV_PARAM:
+                hci_cc_set_adv_param(hdev, skb);
+                break;
+
         case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
                 hci_cc_write_remote_amp_assoc(hdev, skb);
                 break;
@@ -2351,6 +2662,14 @@ static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cs_accept_phylink(hdev, ev->status);
                 break;
 
+        case HCI_OP_LE_CREATE_CONN:
+                hci_cs_le_create_conn(hdev, ev->status);
+                break;
+
+        case HCI_OP_LE_START_ENC:
+                hci_cs_le_start_enc(hdev, ev->status);
+                break;
+
         default:
                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
                 break;
@@ -2630,7 +2949,8 @@ static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
         if (conn) {
-                if (key->type == HCI_LK_UNAUTH_COMBINATION &&
+                if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
+                     key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
                         goto not_found;
@@ -2844,6 +3164,9 @@ static void hci_remote_ext_features_evt(struct hci_dev *hdev,
                          * features do not indicate SSP support */
                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
                 }
+
+                if (ev->features[0] & LMP_HOST_SC)
+                        set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
         }
 
         if (conn->state != BT_CONFIG)
@@ -2905,6 +3228,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
         case 0x1c:      /* SCO interval rejected */
         case 0x1a:      /* Unsupported Remote Feature */
         case 0x1f:      /* Unspecified error */
+        case 0x20:      /* Unsupported LMP Parameter value */
                 if (conn->out) {
                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
                                         (hdev->esco_type & EDR_ESCO_MASK);
@@ -3194,8 +3518,8 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev,
         }
 
 confirm:
-        mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0, ev->passkey,
-                                  confirm_hint);
+        mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
+                                  le32_to_cpu(ev->passkey), confirm_hint);
 
 unlock:
         hci_dev_unlock(hdev);
@@ -3337,20 +3661,36 @@ static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
 
         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
         if (data) {
-                struct hci_cp_remote_oob_data_reply cp;
+                if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags)) {
+                        struct hci_cp_remote_oob_ext_data_reply cp;
 
-                bacpy(&cp.bdaddr, &ev->bdaddr);
-                memcpy(cp.hash, data->hash, sizeof(cp.hash));
-                memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
+                        bacpy(&cp.bdaddr, &ev->bdaddr);
+                        memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
+                        memcpy(cp.randomizer192, data->randomizer192,
+                               sizeof(cp.randomizer192));
+                        memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
+                        memcpy(cp.randomizer256, data->randomizer256,
+                               sizeof(cp.randomizer256));
+
+                        hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
+                                     sizeof(cp), &cp);
+                } else {
+                        struct hci_cp_remote_oob_data_reply cp;
+
+                        bacpy(&cp.bdaddr, &ev->bdaddr);
+                        memcpy(cp.hash, data->hash192, sizeof(cp.hash));
+                        memcpy(cp.randomizer, data->randomizer192,
+                               sizeof(cp.randomizer));
 
-                hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
-                             &cp);
+                        hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
+                                     sizeof(cp), &cp);
+                }
         } else {
                 struct hci_cp_remote_oob_data_neg_reply cp;
 
                 bacpy(&cp.bdaddr, &ev->bdaddr);
-                hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
-                             &cp);
+                hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
+                             sizeof(cp), &cp);
         }
 
 unlock:
@@ -3484,6 +3824,7 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
         struct hci_conn *conn;
+        struct smp_irk *irk;
 
         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
 
@@ -3514,19 +3855,70 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                         conn->out = true;
                         conn->link_mode |= HCI_LM_MASTER;
                 }
+
+                /* If we didn't have a hci_conn object previously
+                 * but we're in master role this must be something
+                 * initiated using a white list. Since white list based
+                 * connections are not "first class citizens" we don't
+                 * have full tracking of them. Therefore, we go ahead
+                 * with a "best effort" approach of determining the
+                 * initiator address based on the HCI_PRIVACY flag.
+                 */
+                if (conn->out) {
+                        conn->resp_addr_type = ev->bdaddr_type;
+                        bacpy(&conn->resp_addr, &ev->bdaddr);
+                        if (test_bit(HCI_PRIVACY, &hdev->dev_flags)) {
+                                conn->init_addr_type = ADDR_LE_DEV_RANDOM;
+                                bacpy(&conn->init_addr, &hdev->rpa);
+                        } else {
+                                hci_copy_identity_address(hdev,
+                                                          &conn->init_addr,
+                                                          &conn->init_addr_type);
+                        }
+                } else {
+                        /* Set the responder (our side) address type based on
+                         * the advertising address type.
+                         */
+                        conn->resp_addr_type = hdev->adv_addr_type;
+                        if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
+                                bacpy(&conn->resp_addr, &hdev->random_addr);
+                        else
+                                bacpy(&conn->resp_addr, &hdev->bdaddr);
+
+                        conn->init_addr_type = ev->bdaddr_type;
+                        bacpy(&conn->init_addr, &ev->bdaddr);
+                }
+        } else {
+                cancel_delayed_work(&conn->le_conn_timeout);
+        }
+
+        /* Ensure that the hci_conn contains the identity address type
+         * regardless of which address the connection was made with.
+         */
+        hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
+
+        /* Lookup the identity address from the stored connection
+         * address and address type.
+         *
+         * When establishing connections to an identity address, the
+         * connection procedure will store the resolvable random
+         * address first. Now if it can be converted back into the
+         * identity address, start using the identity address from
+         * now on.
+         */
+        irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
+        if (irk) {
+                bacpy(&conn->dst, &irk->bdaddr);
+                conn->dst_type = irk->addr_type;
         }
 
         if (ev->status) {
-                mgmt_connect_failed(hdev, &conn->dst, conn->type,
-                                    conn->dst_type, ev->status);
-                hci_proto_connect_cfm(conn, ev->status);
-                conn->state = BT_CLOSED;
-                hci_conn_del(conn);
+                hci_le_conn_failed(conn, ev->status);
                 goto unlock;
         }
 
         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
-                mgmt_device_connected(hdev, &ev->bdaddr, conn->type,
+                mgmt_device_connected(hdev, &conn->dst, conn->type,
                                       conn->dst_type, 0, NULL, 0, NULL);
 
         conn->sec_level = BT_SECURITY_LOW;
@@ -3540,25 +3932,73 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
         hci_proto_connect_cfm(conn, ev->status);
 
+        hci_pend_le_conn_del(hdev, &conn->dst, conn->dst_type);
+
 unlock:
         hci_dev_unlock(hdev);
 }
 
+/* This function requires the caller holds hdev->lock */
+static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
+                                  u8 addr_type)
+{
+        struct hci_conn *conn;
+        struct smp_irk *irk;
+
+        /* If this is a resolvable address, we should resolve it and then
+         * update address and address type variables.
+         */
+        irk = hci_get_irk(hdev, addr, addr_type);
+        if (irk) {
+                addr = &irk->bdaddr;
+                addr_type = irk->addr_type;
+        }
+
+        if (!hci_pend_le_conn_lookup(hdev, addr, addr_type))
+                return;
+
+        conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
+                              HCI_AT_NO_BONDING);
+        if (!IS_ERR(conn))
+                return;
+
+        switch (PTR_ERR(conn)) {
+        case -EBUSY:
+                /* If hci_connect() returns -EBUSY it means there is already
+                 * an LE connection attempt going on. Since controllers don't
+                 * support more than one connection attempt at the time, we
+                 * don't consider this an error case.
+                 */
+                break;
+        default:
+                BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
+        }
+}
+
 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         u8 num_reports = skb->data[0];
         void *ptr = &skb->data[1];
         s8 rssi;
 
+        hci_dev_lock(hdev);
+
         while (num_reports--) {
                 struct hci_ev_le_advertising_info *ev = ptr;
 
+                if (ev->evt_type == LE_ADV_IND ||
+                    ev->evt_type == LE_ADV_DIRECT_IND)
+                        check_pending_le_conn(hdev, &ev->bdaddr,
+                                              ev->bdaddr_type);
+
                 rssi = ev->data[ev->length];
                 mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
                                   NULL, rssi, 0, 1, ev->data, ev->length);
 
                 ptr += sizeof(*ev) + ev->length + 1;
         }
+
+        hci_dev_unlock(hdev);
 }
 
 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
@@ -3577,7 +4017,7 @@ static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
         if (conn == NULL)
                 goto not_found;
 
-        ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
+        ltk = hci_find_ltk(hdev, ev->ediv, ev->rand, conn->out);
         if (ltk == NULL)
                 goto not_found;
 
@@ -3593,7 +4033,13 @@ static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
 
-        if (ltk->type & HCI_SMP_STK) {
+        /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
+         * temporary key used to encrypt a connection following
+         * pairing. It is used during the Encrypted Session Setup to
+         * distribute the keys. Later, security can be re-established
+         * using a distributed LTK.
+         */
+        if (ltk->type == HCI_SMP_STK_SLAVE) {
                 list_del(&ltk->list);
                 kfree(ltk);
         }
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 7552f9e3089c..b9a418e578e0 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -211,22 +211,22 @@ void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
 
         switch (bt_cb(skb)->pkt_type) {
         case HCI_COMMAND_PKT:
-                opcode = __constant_cpu_to_le16(HCI_MON_COMMAND_PKT);
+                opcode = cpu_to_le16(HCI_MON_COMMAND_PKT);
                 break;
         case HCI_EVENT_PKT:
-                opcode = __constant_cpu_to_le16(HCI_MON_EVENT_PKT);
+                opcode = cpu_to_le16(HCI_MON_EVENT_PKT);
                 break;
         case HCI_ACLDATA_PKT:
                 if (bt_cb(skb)->incoming)
-                        opcode = __constant_cpu_to_le16(HCI_MON_ACL_RX_PKT);
+                        opcode = cpu_to_le16(HCI_MON_ACL_RX_PKT);
                 else
-                        opcode = __constant_cpu_to_le16(HCI_MON_ACL_TX_PKT);
+                        opcode = cpu_to_le16(HCI_MON_ACL_TX_PKT);
                 break;
         case HCI_SCODATA_PKT:
                 if (bt_cb(skb)->incoming)
-                        opcode = __constant_cpu_to_le16(HCI_MON_SCO_RX_PKT);
+                        opcode = cpu_to_le16(HCI_MON_SCO_RX_PKT);
                 else
-                        opcode = __constant_cpu_to_le16(HCI_MON_SCO_TX_PKT);
+                        opcode = cpu_to_le16(HCI_MON_SCO_TX_PKT);
                 break;
         default:
                 return;
@@ -319,7 +319,7 @@ static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
                 bacpy(&ni->bdaddr, &hdev->bdaddr);
                 memcpy(ni->name, hdev->name, 8);
 
-                opcode = __constant_cpu_to_le16(HCI_MON_NEW_INDEX);
+                opcode = cpu_to_le16(HCI_MON_NEW_INDEX);
                 break;
 
         case HCI_DEV_UNREG:
@@ -327,7 +327,7 @@ static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
                 if (!skb)
                         return NULL;
 
-                opcode = __constant_cpu_to_le16(HCI_MON_DEL_INDEX);
+                opcode = cpu_to_le16(HCI_MON_DEL_INDEX);
                 break;
 
         default:
@@ -716,6 +716,7 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
                 err = hci_dev_open(hdev->id);
                 if (err) {
                         clear_bit(HCI_USER_CHANNEL, &hdev->dev_flags);
+                        mgmt_index_added(hdev);
                         hci_dev_put(hdev);
                         goto done;
                 }
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 0b61250cfdf9..555982a78a58 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -49,14 +49,7 @@ static struct attribute *bt_link_attrs[] = {
         NULL
 };
 
-static struct attribute_group bt_link_group = {
-        .attrs = bt_link_attrs,
-};
-
-static const struct attribute_group *bt_link_groups[] = {
-        &bt_link_group,
-        NULL
-};
+ATTRIBUTE_GROUPS(bt_link);
 
 static void bt_link_release(struct device *dev)
 {
@@ -182,14 +175,7 @@ static struct attribute *bt_host_attrs[] = {
         NULL
 };
 
-static struct attribute_group bt_host_group = {
-        .attrs = bt_host_attrs,
-};
-
-static const struct attribute_group *bt_host_groups[] = {
-        &bt_host_group,
-        NULL
-};
+ATTRIBUTE_GROUPS(bt_host);
 
 static void bt_host_release(struct device *dev)
 {
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index b0ad2c752d73..a1e5bb7d06e8 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -42,6 +42,8 @@
 #include "amp.h"
 #include "6lowpan.h"
 
+#define LE_FLOWCTL_MAX_CREDITS 65535
+
 bool disable_ertm;
 
 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD;
@@ -330,44 +332,20 @@ static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
         return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
 }
 
-static u16 l2cap_seq_list_remove(struct l2cap_seq_list *seq_list, u16 seq)
+static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
 {
+        u16 seq = seq_list->head;
         u16 mask = seq_list->mask;
 
-        if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) {
-                /* In case someone tries to pop the head of an empty list */
-                return L2CAP_SEQ_LIST_CLEAR;
-        } else if (seq_list->head == seq) {
-                /* Head can be removed in constant time */
-                seq_list->head = seq_list->list[seq & mask];
-                seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
-
-                if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
-                        seq_list->head = L2CAP_SEQ_LIST_CLEAR;
-                        seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
-                }
-        } else {
-                /* Walk the list to find the sequence number */
-                u16 prev = seq_list->head;
-                while (seq_list->list[prev & mask] != seq) {
-                        prev = seq_list->list[prev & mask];
-                        if (prev == L2CAP_SEQ_LIST_TAIL)
-                                return L2CAP_SEQ_LIST_CLEAR;
-                }
+        seq_list->head = seq_list->list[seq & mask];
+        seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
 
-                /* Unlink the number from the list and clear it */
-                seq_list->list[prev & mask] = seq_list->list[seq & mask];
-                seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
-                if (seq_list->tail == seq)
-                        seq_list->tail = prev;
+        if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
+                seq_list->head = L2CAP_SEQ_LIST_CLEAR;
+                seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
         }
-        return seq;
-}
 
-static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
-{
-        /* Remove the head in constant time */
-        return l2cap_seq_list_remove(seq_list, seq_list->head);
+        return seq;
 }
 
 static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
@@ -506,7 +484,7 @@ static void l2cap_le_flowctl_init(struct l2cap_chan *chan)
         chan->sdu_len = 0;
         chan->tx_credits = 0;
         chan->rx_credits = le_max_credits;
-        chan->mps = min_t(u16, chan->imtu, L2CAP_LE_DEFAULT_MPS);
+        chan->mps = min_t(u16, chan->imtu, le_default_mps);
 
         skb_queue_head_init(&chan->tx_q);
 }
@@ -522,18 +500,10 @@ void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 
         switch (chan->chan_type) {
         case L2CAP_CHAN_CONN_ORIENTED:
-                if (conn->hcon->type == LE_LINK) {
-                        if (chan->dcid == L2CAP_CID_ATT) {
-                                chan->omtu = L2CAP_DEFAULT_MTU;
-                                chan->scid = L2CAP_CID_ATT;
-                        } else {
-                                chan->scid = l2cap_alloc_cid(conn);
-                        }
-                } else {
-                        /* Alloc CID for connection-oriented socket */
-                        chan->scid = l2cap_alloc_cid(conn);
+                /* Alloc CID for connection-oriented socket */
+                chan->scid = l2cap_alloc_cid(conn);
+                if (conn->hcon->type == ACL_LINK)
                         chan->omtu = L2CAP_DEFAULT_MTU;
-                }
                 break;
 
         case L2CAP_CHAN_CONN_LESS:
@@ -543,11 +513,8 @@ void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
                 chan->omtu = L2CAP_DEFAULT_MTU;
                 break;
 
-        case L2CAP_CHAN_CONN_FIX_A2MP:
-                chan->scid = L2CAP_CID_A2MP;
-                chan->dcid = L2CAP_CID_A2MP;
-                chan->omtu = L2CAP_A2MP_DEFAULT_MTU;
-                chan->imtu = L2CAP_A2MP_DEFAULT_MTU;
+        case L2CAP_CHAN_FIXED:
+                /* Caller will set CID and CID specific MTU values */
                 break;
 
         default:
@@ -595,7 +562,7 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
 
                 chan->conn = NULL;
 
-                if (chan->chan_type != L2CAP_CHAN_CONN_FIX_A2MP)
+                if (chan->scid != L2CAP_CID_A2MP)
                         hci_conn_drop(conn->hcon);
 
                 if (mgr && mgr->bredr_chan == chan)
@@ -642,6 +609,23 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
         return;
 }
 
+void l2cap_conn_update_id_addr(struct hci_conn *hcon)
+{
+        struct l2cap_conn *conn = hcon->l2cap_data;
+        struct l2cap_chan *chan;
+
+        mutex_lock(&conn->chan_lock);
+
+        list_for_each_entry(chan, &conn->chan_l, list) {
+                l2cap_chan_lock(chan);
+                bacpy(&chan->dst, &hcon->dst);
+                chan->dst_type = bdaddr_type(hcon, hcon->dst_type);
+                l2cap_chan_unlock(chan);
+        }
+
+        mutex_unlock(&conn->chan_lock);
+}
+
 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
 {
         struct l2cap_conn *conn = chan->conn;
@@ -681,7 +665,7 @@ static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
         rsp.scid   = cpu_to_le16(chan->dcid);
         rsp.dcid   = cpu_to_le16(chan->scid);
         rsp.result = cpu_to_le16(result);
-        rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
+        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 
         l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 }
@@ -699,10 +683,7 @@ void l2cap_chan_close(struct l2cap_chan *chan, int reason)
 
         case BT_CONNECTED:
         case BT_CONFIG:
-                /* ATT uses L2CAP_CHAN_CONN_ORIENTED so we must also
-                 * check for chan->psm.
-                 */
-                if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && chan->psm) {
+                if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
                         __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
                         l2cap_send_disconn_req(chan, reason);
                 } else
@@ -737,6 +718,7 @@ static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
         case L2CAP_CHAN_RAW:
                 switch (chan->sec_level) {
                 case BT_SECURITY_HIGH:
+                case BT_SECURITY_FIPS:
                         return HCI_AT_DEDICATED_BONDING_MITM;
                 case BT_SECURITY_MEDIUM:
                         return HCI_AT_DEDICATED_BONDING;
@@ -745,21 +727,23 @@ static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
                 }
                 break;
         case L2CAP_CHAN_CONN_LESS:
-                if (chan->psm == __constant_cpu_to_le16(L2CAP_PSM_3DSP)) {
+                if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
                         if (chan->sec_level == BT_SECURITY_LOW)
                                 chan->sec_level = BT_SECURITY_SDP;
                 }
-                if (chan->sec_level == BT_SECURITY_HIGH)
+                if (chan->sec_level == BT_SECURITY_HIGH ||
+                    chan->sec_level == BT_SECURITY_FIPS)
                         return HCI_AT_NO_BONDING_MITM;
                 else
                         return HCI_AT_NO_BONDING;
                 break;
         case L2CAP_CHAN_CONN_ORIENTED:
-                if (chan->psm == __constant_cpu_to_le16(L2CAP_PSM_SDP)) {
+                if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
                         if (chan->sec_level == BT_SECURITY_LOW)
                                 chan->sec_level = BT_SECURITY_SDP;
 
-                        if (chan->sec_level == BT_SECURITY_HIGH)
+                        if (chan->sec_level == BT_SECURITY_HIGH ||
+                            chan->sec_level == BT_SECURITY_FIPS)
                                 return HCI_AT_NO_BONDING_MITM;
                         else
                                 return HCI_AT_NO_BONDING;
@@ -768,6 +752,7 @@ static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
         default:
                 switch (chan->sec_level) {
                 case BT_SECURITY_HIGH:
+                case BT_SECURITY_FIPS:
                         return HCI_AT_GENERAL_BONDING_MITM;
                 case BT_SECURITY_MEDIUM:
                         return HCI_AT_GENERAL_BONDING;
@@ -1288,7 +1273,7 @@ static void l2cap_do_start(struct l2cap_chan *chan)
                 }
         } else {
                 struct l2cap_info_req req;
-                req.type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
+                req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
 
                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
                 conn->info_ident = l2cap_get_ident(conn);
@@ -1330,7 +1315,7 @@ static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
                 __clear_ack_timer(chan);
         }
 
-        if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
+        if (chan->scid == L2CAP_CID_A2MP) {
                 l2cap_state_change(chan, BT_DISCONN);
                 return;
         }
@@ -1385,18 +1370,18 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
 
                         if (l2cap_chan_check_security(chan)) {
                                 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
-                                        rsp.result = __constant_cpu_to_le16(L2CAP_CR_PEND);
-                                        rsp.status = __constant_cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
+                                        rsp.result = cpu_to_le16(L2CAP_CR_PEND);
+                                        rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
                                         chan->ops->defer(chan);
 
                                 } else {
                                         l2cap_state_change(chan, BT_CONFIG);
-                                        rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
-                                        rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
+                                        rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
+                                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
                                 }
                         } else {
-                                rsp.result = __constant_cpu_to_le16(L2CAP_CR_PEND);
-                                rsp.status = __constant_cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
+                                rsp.result = cpu_to_le16(L2CAP_CR_PEND);
+                                rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
                         }
 
                         l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
@@ -1493,8 +1478,6 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)
         if (!chan)
                 goto clean;
 
-        chan->dcid = L2CAP_CID_ATT;
-
         bacpy(&chan->src, &hcon->src);
         bacpy(&chan->dst, &hcon->dst);
         chan->src_type = bdaddr_type(hcon, hcon->src_type);
@@ -1528,7 +1511,7 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
 
                 l2cap_chan_lock(chan);
 
-                if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
+                if (chan->scid == L2CAP_CID_A2MP) {
                         l2cap_chan_unlock(chan);
                         continue;
                 }
@@ -1546,6 +1529,8 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
         }
 
         mutex_unlock(&conn->chan_lock);
+
+        queue_work(hcon->hdev->workqueue, &conn->pending_rx_work);
 }
 
 /* Notify sockets that we cannot guaranty reliability anymore */
@@ -1671,6 +1656,9 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 
         kfree_skb(conn->rx_skb);
 
+        skb_queue_purge(&conn->pending_rx);
+        flush_work(&conn->pending_rx_work);
+
         l2cap_unregister_all_users(conn);
 
         mutex_lock(&conn->chan_lock);
@@ -1718,66 +1706,6 @@ static void security_timeout(struct work_struct *work)
         }
 }
 
-static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
-{
-        struct l2cap_conn *conn = hcon->l2cap_data;
-        struct hci_chan *hchan;
-
-        if (conn)
-                return conn;
-
-        hchan = hci_chan_create(hcon);
-        if (!hchan)
-                return NULL;
-
-        conn = kzalloc(sizeof(struct l2cap_conn), GFP_KERNEL);
-        if (!conn) {
-                hci_chan_del(hchan);
-                return NULL;
-        }
-
-        kref_init(&conn->ref);
-        hcon->l2cap_data = conn;
-        conn->hcon = hcon;
-        hci_conn_get(conn->hcon);
-        conn->hchan = hchan;
-
-        BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
-
-        switch (hcon->type) {
-        case LE_LINK:
-                if (hcon->hdev->le_mtu) {
-                        conn->mtu = hcon->hdev->le_mtu;
-                        break;
-                }
-                /* fall through */
-        default:
-                conn->mtu = hcon->hdev->acl_mtu;
-                break;
-        }
-
-        conn->feat_mask = 0;
-
-        if (hcon->type == ACL_LINK)
-                conn->hs_enabled = test_bit(HCI_HS_ENABLED,
-                                            &hcon->hdev->dev_flags);
-
-        spin_lock_init(&conn->lock);
-        mutex_init(&conn->chan_lock);
-
-        INIT_LIST_HEAD(&conn->chan_l);
-        INIT_LIST_HEAD(&conn->users);
-
-        if (hcon->type == LE_LINK)
-                INIT_DELAYED_WORK(&conn->security_timer, security_timeout);
-        else
-                INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
-
-        conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
-
-        return conn;
-}
-
 static void l2cap_conn_free(struct kref *ref)
 {
         struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
@@ -1848,154 +1776,6 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
         return c1;
 }
 
-static bool is_valid_psm(u16 psm, u8 dst_type)
-{
-        if (!psm)
-                return false;
-
-        if (bdaddr_type_is_le(dst_type))
-                return (psm <= 0x00ff);
-
-        /* PSM must be odd and lsb of upper byte must be 0 */
-        return ((psm & 0x0101) == 0x0001);
-}
-
-int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
-                       bdaddr_t *dst, u8 dst_type)
-{
-        struct l2cap_conn *conn;
-        struct hci_conn *hcon;
-        struct hci_dev *hdev;
-        __u8 auth_type;
-        int err;
-
-        BT_DBG("%pMR -> %pMR (type %u) psm 0x%2.2x", &chan->src, dst,
-               dst_type, __le16_to_cpu(psm));
-
-        hdev = hci_get_route(dst, &chan->src);
-        if (!hdev)
-                return -EHOSTUNREACH;
-
-        hci_dev_lock(hdev);
-
-        l2cap_chan_lock(chan);
-
-        if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid &&
-            chan->chan_type != L2CAP_CHAN_RAW) {
-                err = -EINVAL;
-                goto done;
-        }
-
-        if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !(psm || cid)) {
-                err = -EINVAL;
-                goto done;
-        }
-
-        switch (chan->mode) {
-        case L2CAP_MODE_BASIC:
-                break;
-        case L2CAP_MODE_LE_FLOWCTL:
-                l2cap_le_flowctl_init(chan);
-                break;
-        case L2CAP_MODE_ERTM:
-        case L2CAP_MODE_STREAMING:
-                if (!disable_ertm)
-                        break;
-                /* fall through */
-        default:
-                err = -ENOTSUPP;
-                goto done;
-        }
-
-        switch (chan->state) {
-        case BT_CONNECT:
-        case BT_CONNECT2:
-        case BT_CONFIG:
-                /* Already connecting */
-                err = 0;
-                goto done;
-
-        case BT_CONNECTED:
-                /* Already connected */
-                err = -EISCONN;
-                goto done;
-
-        case BT_OPEN:
-        case BT_BOUND:
-                /* Can connect */
-                break;
-
-        default:
-                err = -EBADFD;
-                goto done;
-        }
-
-        /* Set destination address and psm */
-        bacpy(&chan->dst, dst);
-        chan->dst_type = dst_type;
-
-        chan->psm = psm;
-        chan->dcid = cid;
-
-        auth_type = l2cap_get_auth_type(chan);
-
-        if (bdaddr_type_is_le(dst_type))
-                hcon = hci_connect(hdev, LE_LINK, dst, dst_type,
-                                   chan->sec_level, auth_type);
-        else
-                hcon = hci_connect(hdev, ACL_LINK, dst, dst_type,
-                                   chan->sec_level, auth_type);
-
-        if (IS_ERR(hcon)) {
-                err = PTR_ERR(hcon);
-                goto done;
-        }
-
-        conn = l2cap_conn_add(hcon);
-        if (!conn) {
-                hci_conn_drop(hcon);
-                err = -ENOMEM;
-                goto done;
-        }
-
-        if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
-                hci_conn_drop(hcon);
-                err = -EBUSY;
-                goto done;
-        }
-
-        /* Update source addr of the socket */
-        bacpy(&chan->src, &hcon->src);
-        chan->src_type = bdaddr_type(hcon, hcon->src_type);
-
-        l2cap_chan_unlock(chan);
-        l2cap_chan_add(conn, chan);
-        l2cap_chan_lock(chan);
-
-        /* l2cap_chan_add takes its own ref so we can drop this one */
-        hci_conn_drop(hcon);
-
-        l2cap_state_change(chan, BT_CONNECT);
-        __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
-
-        if (hcon->state == BT_CONNECTED) {
-                if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
-                        __clear_chan_timer(chan);
-                        if (l2cap_chan_check_security(chan))
-                                l2cap_state_change(chan, BT_CONNECTED);
-                } else
-                        l2cap_do_start(chan);
-        }
-
-        err = 0;
-
-done:
-        l2cap_chan_unlock(chan);
-        hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
-        return err;
-}
-
 static void l2cap_monitor_timeout(struct work_struct *work)
 {
         struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
@@ -2654,6 +2434,14 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
                 if (IS_ERR(skb))
                         return PTR_ERR(skb);
 
+                /* Channel lock is released before requesting new skb and then
+                 * reacquired thus we need to recheck channel state.
+                 */
+                if (chan->state != BT_CONNECTED) {
+                        kfree_skb(skb);
+                        return -ENOTCONN;
+                }
+
                 l2cap_do_send(chan, skb);
                 return len;
         }
@@ -2703,6 +2491,14 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
                 if (IS_ERR(skb))
                         return PTR_ERR(skb);
 
+                /* Channel lock is released before requesting new skb and then
+                 * reacquired thus we need to recheck channel state.
+                 */
+                if (chan->state != BT_CONNECTED) {
+                        kfree_skb(skb);
+                        return -ENOTCONN;
+                }
+
                 l2cap_do_send(chan, skb);
                 err = len;
                 break;
@@ -3099,9 +2895,9 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
         lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
 
         if (conn->hcon->type == LE_LINK)
-                lh->cid = __constant_cpu_to_le16(L2CAP_CID_LE_SIGNALING);
+                lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
         else
-                lh->cid = __constant_cpu_to_le16(L2CAP_CID_SIGNALING);
+                lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
 
         cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
         cmd->code  = code;
@@ -3214,8 +3010,8 @@ static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
                 efs.stype       = chan->local_stype;
                 efs.msdu        = cpu_to_le16(chan->local_msdu);
                 efs.sdu_itime   = cpu_to_le32(chan->local_sdu_itime);
-                efs.acc_lat     = __constant_cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
-                efs.flush_to    = __constant_cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
+                efs.acc_lat     = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
+                efs.flush_to    = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
                 break;
 
         case L2CAP_MODE_STREAMING:
@@ -3356,8 +3152,8 @@ static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
                 rfc->retrans_timeout = cpu_to_le16((u16) ertm_to);
                 rfc->monitor_timeout = rfc->retrans_timeout;
         } else {
-                rfc->retrans_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
-                rfc->monitor_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
+                rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
+                rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
         }
 }
 
@@ -3489,7 +3285,7 @@ done:
         }
 
         req->dcid  = cpu_to_le16(chan->dcid);
-        req->flags = __constant_cpu_to_le16(0);
+        req->flags = cpu_to_le16(0);
 
         return ptr - data;
 }
@@ -3703,7 +3499,7 @@ done:
         }
         rsp->scid   = cpu_to_le16(chan->dcid);
         rsp->result = cpu_to_le16(result);
-        rsp->flags  = __constant_cpu_to_le16(0);
+        rsp->flags  = cpu_to_le16(0);
 
         return ptr - data;
 }
@@ -3812,7 +3608,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
         }
 
         req->dcid   = cpu_to_le16(chan->dcid);
-        req->flags  = __constant_cpu_to_le16(0);
+        req->flags  = cpu_to_le16(0);
 
         return ptr - data;
 }
@@ -3843,7 +3639,7 @@ void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
         rsp.mtu     = cpu_to_le16(chan->imtu);
         rsp.mps     = cpu_to_le16(chan->mps);
         rsp.credits = cpu_to_le16(chan->rx_credits);
-        rsp.result  = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
+        rsp.result  = cpu_to_le16(L2CAP_CR_SUCCESS);
 
         l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
                        &rsp);
@@ -3858,8 +3654,8 @@ void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
 
         rsp.scid   = cpu_to_le16(chan->dcid);
         rsp.dcid   = cpu_to_le16(chan->scid);
-        rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
-        rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
+        rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
+        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 
         if (chan->hs_hcon)
                 rsp_code = L2CAP_CREATE_CHAN_RSP;
@@ -3888,8 +3684,8 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
         u16 txwin_ext = chan->ack_win;
         struct l2cap_conf_rfc rfc = {
                 .mode = chan->mode,
-                .retrans_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
-                .monitor_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
+                .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
+                .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
                 .max_pdu_size = cpu_to_le16(chan->imtu),
                 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
         };
@@ -3980,7 +3776,7 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
         l2cap_chan_lock(pchan);
 
         /* Check if the ACL is secure enough (if not SDP) */
-        if (psm != __constant_cpu_to_le16(L2CAP_PSM_SDP) &&
+        if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
             !hci_conn_check_link_mode(conn->hcon)) {
                 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
                 result = L2CAP_CR_SEC_BLOCK;
@@ -4065,7 +3861,7 @@ sendresp:
 
         if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
                 struct l2cap_info_req info;
-                info.type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
+                info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
 
                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
                 conn->info_ident = l2cap_get_ident(conn);
@@ -4214,7 +4010,7 @@ static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
 {
         struct l2cap_cmd_rej_cid rej;
 
-        rej.reason = __constant_cpu_to_le16(L2CAP_REJ_INVALID_CID);
+        rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
         rej.scid = __cpu_to_le16(scid);
         rej.dcid = __cpu_to_le16(dcid);
 
@@ -4546,8 +4342,8 @@ static inline int l2cap_information_req(struct l2cap_conn *conn,
                 u8 buf[8];
                 u32 feat_mask = l2cap_feat_mask;
                 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
-                rsp->type   = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
-                rsp->result = __constant_cpu_to_le16(L2CAP_IR_SUCCESS);
+                rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
+                rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
                 if (!disable_ertm)
                         feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
                                 | L2CAP_FEAT_FCS;
@@ -4567,15 +4363,15 @@ static inline int l2cap_information_req(struct l2cap_conn *conn,
                 else
                         l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
 
-                rsp->type   = __constant_cpu_to_le16(L2CAP_IT_FIXED_CHAN);
-                rsp->result = __constant_cpu_to_le16(L2CAP_IR_SUCCESS);
+                rsp->type   = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
+                rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
                 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
                 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
                                buf);
         } else {
                 struct l2cap_info_rsp rsp;
                 rsp.type   = cpu_to_le16(type);
-                rsp.result = __constant_cpu_to_le16(L2CAP_IR_NOTSUPP);
+                rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
                 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
                                &rsp);
         }
@@ -4620,7 +4416,7 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn,
 
                 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
                         struct l2cap_info_req req;
-                        req.type = __constant_cpu_to_le16(L2CAP_IT_FIXED_CHAN);
+                        req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
 
                         conn->info_ident = l2cap_get_ident(conn);
 
@@ -4714,8 +4510,8 @@ static int l2cap_create_channel_req(struct l2cap_conn *conn,
 error:
         rsp.dcid = 0;
         rsp.scid = cpu_to_le16(scid);
-        rsp.result = __constant_cpu_to_le16(L2CAP_CR_BAD_AMP);
-        rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
+        rsp.result = cpu_to_le16(L2CAP_CR_BAD_AMP);
+        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 
         l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
                        sizeof(rsp), &rsp);
@@ -4779,7 +4575,7 @@ static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid)
         BT_DBG("conn %p, icid 0x%4.4x", conn, icid);
 
         cfm.icid = cpu_to_le16(icid);
-        cfm.result = __constant_cpu_to_le16(L2CAP_MC_UNCONFIRMED);
+        cfm.result = cpu_to_le16(L2CAP_MC_UNCONFIRMED);
 
         l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM,
                        sizeof(cfm), &cfm);
@@ -4962,12 +4758,12 @@ static void l2cap_do_create(struct l2cap_chan *chan, int result,
 
                 if (result == L2CAP_CR_SUCCESS) {
                         /* Send successful response */
-                        rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
-                        rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
+                        rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
+                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
                 } else {
                         /* Send negative response */
-                        rsp.result = __constant_cpu_to_le16(L2CAP_CR_NO_MEM);
-                        rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
+                        rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM);
+                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
                 }
 
                 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,
@@ -5095,7 +4891,7 @@ static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
         chan = l2cap_get_chan_by_dcid(conn, icid);
         if (!chan) {
                 rsp.icid = cpu_to_le16(icid);
-                rsp.result = __constant_cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
+                rsp.result = cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
                 l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP,
                                sizeof(rsp), &rsp);
                 return 0;
@@ -5439,9 +5235,9 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
 
         err = l2cap_check_conn_param(min, max, latency, to_multiplier);
         if (err)
-                rsp.result = __constant_cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
+                rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
         else
-                rsp.result = __constant_cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
+                rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
 
         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
                        sizeof(rsp), &rsp);
@@ -5709,7 +5505,7 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
 {
         struct l2cap_le_credits *pkt;
         struct l2cap_chan *chan;
-        u16 cid, credits;
+        u16 cid, credits, max_credits;
 
         if (cmd_len != sizeof(*pkt))
                 return -EPROTO;
@@ -5724,6 +5520,17 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
         if (!chan)
                 return -EBADSLT;
 
+        max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
+        if (credits > max_credits) {
+                BT_ERR("LE credits overflow");
+                l2cap_send_disconn_req(chan, ECONNRESET);
+
+                /* Return 0 so that we don't trigger an unnecessary
+                 * command reject packet.
+                 */
+                return 0;
+        }
+
         chan->tx_credits += credits;
 
         while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
@@ -5770,17 +5577,6 @@ static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
 {
         int err = 0;
 
-        if (!enable_lecoc) {
-                switch (cmd->code) {
-                case L2CAP_LE_CONN_REQ:
-                case L2CAP_LE_CONN_RSP:
-                case L2CAP_LE_CREDITS:
-                case L2CAP_DISCONN_REQ:
-                case L2CAP_DISCONN_RSP:
-                        return -EINVAL;
-                }
-        }
-
         switch (cmd->code) {
         case L2CAP_COMMAND_REJ:
                 l2cap_le_command_rej(conn, cmd, cmd_len, data);
@@ -5854,7 +5650,7 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
 
                 BT_ERR("Wrong link type (%d)", err);
 
-                rej.reason = __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
+                rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
                 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
                                sizeof(rej), &rej);
         }
@@ -5899,7 +5695,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
 
                         BT_ERR("Wrong link type (%d)", err);
 
-                        rej.reason = __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
+                        rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
                         l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ,
                                        sizeof(rej), &rej);
                 }
@@ -6871,6 +6667,7 @@ static int l2cap_le_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
 
         if (!chan->rx_credits) {
                 BT_ERR("No credits to receive LE L2CAP data");
+                l2cap_send_disconn_req(chan, ECONNRESET);
                 return -ENOBUFS;
         }
 
@@ -6995,8 +6792,10 @@ static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
                  * But we don't have any other choice. L2CAP doesn't
                  * provide flow control mechanism. */
 
-                if (chan->imtu < skb->len)
+                if (chan->imtu < skb->len) {
+                        BT_ERR("Dropping L2CAP data: receive buffer overflow");
                         goto drop;
+                }
 
                 if (!chan->ops->recv(chan, skb))
                         goto done;
@@ -7084,9 +6883,16 @@ drop:
 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
 {
         struct l2cap_hdr *lh = (void *) skb->data;
+        struct hci_conn *hcon = conn->hcon;
         u16 cid, len;
         __le16 psm;
 
+        if (hcon->state != BT_CONNECTED) {
+                BT_DBG("queueing pending rx skb");
+                skb_queue_tail(&conn->pending_rx, skb);
+                return;
+        }
+
         skb_pull(skb, L2CAP_HDR_SIZE);
         cid = __le16_to_cpu(lh->cid);
         len = __le16_to_cpu(lh->len);
@@ -7132,6 +6938,247 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
         }
 }
 
+static void process_pending_rx(struct work_struct *work)
+{
+        struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
+                                               pending_rx_work);
+        struct sk_buff *skb;
+
+        BT_DBG("");
+
+        while ((skb = skb_dequeue(&conn->pending_rx)))
+                l2cap_recv_frame(conn, skb);
+}
+
+static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
+{
+        struct l2cap_conn *conn = hcon->l2cap_data;
+        struct hci_chan *hchan;
+
+        if (conn)
+                return conn;
+
+        hchan = hci_chan_create(hcon);
+        if (!hchan)
+                return NULL;
+
+        conn = kzalloc(sizeof(struct l2cap_conn), GFP_KERNEL);
+        if (!conn) {
+                hci_chan_del(hchan);
+                return NULL;
+        }
+
+        kref_init(&conn->ref);
+        hcon->l2cap_data = conn;
+        conn->hcon = hcon;
+        hci_conn_get(conn->hcon);
+        conn->hchan = hchan;
+
+        BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
+
+        switch (hcon->type) {
+        case LE_LINK:
+                if (hcon->hdev->le_mtu) {
+                        conn->mtu = hcon->hdev->le_mtu;
+                        break;
+                }
+                /* fall through */
+        default:
+                conn->mtu = hcon->hdev->acl_mtu;
+                break;
+        }
+
+        conn->feat_mask = 0;
+
+        if (hcon->type == ACL_LINK)
+                conn->hs_enabled = test_bit(HCI_HS_ENABLED,
+                                            &hcon->hdev->dev_flags);
+
+        spin_lock_init(&conn->lock);
+        mutex_init(&conn->chan_lock);
+
+        INIT_LIST_HEAD(&conn->chan_l);
+        INIT_LIST_HEAD(&conn->users);
+
+        if (hcon->type == LE_LINK)
+                INIT_DELAYED_WORK(&conn->security_timer, security_timeout);
+        else
+                INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
+
+        skb_queue_head_init(&conn->pending_rx);
+        INIT_WORK(&conn->pending_rx_work, process_pending_rx);
+
+        conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
+
+        return conn;
+}
+
+static bool is_valid_psm(u16 psm, u8 dst_type) {
+        if (!psm)
+                return false;
+
+        if (bdaddr_type_is_le(dst_type))
+                return (psm <= 0x00ff);
+
+        /* PSM must be odd and lsb of upper byte must be 0 */
+        return ((psm & 0x0101) == 0x0001);
+}
+
+int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
+                       bdaddr_t *dst, u8 dst_type)
+{
+        struct l2cap_conn *conn;
+        struct hci_conn *hcon;
+        struct hci_dev *hdev;
+        __u8 auth_type;
+        int err;
+
+        BT_DBG("%pMR -> %pMR (type %u) psm 0x%2.2x", &chan->src, dst,
+               dst_type, __le16_to_cpu(psm));
+
+        hdev = hci_get_route(dst, &chan->src);
+        if (!hdev)
+                return -EHOSTUNREACH;
+
+        hci_dev_lock(hdev);
+
+        l2cap_chan_lock(chan);
+
+        if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid &&
+            chan->chan_type != L2CAP_CHAN_RAW) {
+                err = -EINVAL;
+                goto done;
+        }
+
+        if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {
+                err = -EINVAL;
+                goto done;
+        }
+
+        if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {
+                err = -EINVAL;
+                goto done;
+        }
+
+        switch (chan->mode) {
+        case L2CAP_MODE_BASIC:
+                break;
+        case L2CAP_MODE_LE_FLOWCTL:
+                l2cap_le_flowctl_init(chan);
+                break;
+        case L2CAP_MODE_ERTM:
+        case L2CAP_MODE_STREAMING:
+                if (!disable_ertm)
+                        break;
+                /* fall through */
+        default:
+                err = -ENOTSUPP;
+                goto done;
+        }
+
+        switch (chan->state) {
+        case BT_CONNECT:
+        case BT_CONNECT2:
+        case BT_CONFIG:
+                /* Already connecting */
+                err = 0;
+                goto done;
+
+        case BT_CONNECTED:
+                /* Already connected */
+                err = -EISCONN;
+                goto done;
+
+        case BT_OPEN:
+        case BT_BOUND:
+                /* Can connect */
+                break;
+
+        default:
+                err = -EBADFD;
+                goto done;
+        }
+
+        /* Set destination address and psm */
+        bacpy(&chan->dst, dst);
+        chan->dst_type = dst_type;
+
+        chan->psm = psm;
+        chan->dcid = cid;
+
+        auth_type = l2cap_get_auth_type(chan);
+
+        if (bdaddr_type_is_le(dst_type)) {
+                /* Convert from L2CAP channel address type to HCI address type
+                 */
+                if (dst_type == BDADDR_LE_PUBLIC)
+                        dst_type = ADDR_LE_DEV_PUBLIC;
+                else
+                        dst_type = ADDR_LE_DEV_RANDOM;
+
+                hcon = hci_connect_le(hdev, dst, dst_type, chan->sec_level,
+                                      auth_type);
+        } else {
+                hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type);
+        }
+
+        if (IS_ERR(hcon)) {
+                err = PTR_ERR(hcon);
+                goto done;
+        }
+
+        conn = l2cap_conn_add(hcon);
+        if (!conn) {
+                hci_conn_drop(hcon);
+                err = -ENOMEM;
+                goto done;
+        }
+
+        if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
+                hci_conn_drop(hcon);
+                err = -EBUSY;
+                goto done;
+        }
+
+        /* Update source addr of the socket */
+        bacpy(&chan->src, &hcon->src);
+        chan->src_type = bdaddr_type(hcon, hcon->src_type);
+
+        l2cap_chan_unlock(chan);
+        l2cap_chan_add(conn, chan);
+        l2cap_chan_lock(chan);
+
+        /* l2cap_chan_add takes its own ref so we can drop this one */
+        hci_conn_drop(hcon);
+
+        l2cap_state_change(chan, BT_CONNECT);
+        __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
+
+        /* Release chan->sport so that it can be reused by other
+         * sockets (as it's only used for listening sockets).
+         */
+        write_lock(&chan_list_lock);
+        chan->sport = 0;
+        write_unlock(&chan_list_lock);
+
+        if (hcon->state == BT_CONNECTED) {
+                if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
+                        __clear_chan_timer(chan);
+                        if (l2cap_chan_check_security(chan))
+                                l2cap_state_change(chan, BT_CONNECTED);
+                } else
+                        l2cap_do_start(chan);
+        }
+
+        err = 0;
+
+done:
+        l2cap_chan_unlock(chan);
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+        return err;
+}
+
 /* ---- L2CAP interface with lower layer (HCI) ---- */
 
 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
@@ -7206,7 +7253,8 @@ static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
         if (encrypt == 0x00) {
                 if (chan->sec_level == BT_SECURITY_MEDIUM) {
                         __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
-                } else if (chan->sec_level == BT_SECURITY_HIGH)
+                } else if (chan->sec_level == BT_SECURITY_HIGH ||
+                           chan->sec_level == BT_SECURITY_FIPS)
                         l2cap_chan_close(chan, ECONNREFUSED);
         } else {
                 if (chan->sec_level == BT_SECURITY_MEDIUM)
@@ -7226,7 +7274,7 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
 
         if (hcon->type == LE_LINK) {
                 if (!status && encrypt)
-                        smp_distribute_keys(conn, 0);
+                        smp_distribute_keys(conn);
                 cancel_delayed_work(&conn->security_timer);
         }
 
@@ -7238,7 +7286,7 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
                        state_to_string(chan->state));
 
-                if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
+                if (chan->scid == L2CAP_CID_A2MP) {
                         l2cap_chan_unlock(chan);
                         continue;
                 }
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index d58f76bcebd1..ef5e5b04f34f 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -36,8 +36,6 @@
 
 #include "smp.h"
 
-bool enable_lecoc;
-
 static struct bt_sock_list l2cap_sk_list = {
         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
 };
@@ -101,12 +99,19 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
                 return -EINVAL;
 
+        if (la.l2_cid) {
+                /* When the socket gets created it defaults to
+                 * CHAN_CONN_ORIENTED, so we need to overwrite the
+                 * default here.
+                 */
+                chan->chan_type = L2CAP_CHAN_FIXED;
+                chan->omtu = L2CAP_DEFAULT_MTU;
+        }
+
         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
-                if (!enable_lecoc && la.l2_psm)
-                        return -EINVAL;
                 /* We only allow ATT user space socket */
                 if (la.l2_cid &&
-                    la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
+                    la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
                         return -EINVAL;
         }
 
@@ -204,7 +209,7 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
                  * ATT. Anything else is an invalid combination.
                  */
                 if (chan->scid != L2CAP_CID_ATT ||
-                    la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
+                    la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
                         return -EINVAL;
 
                 /* We don't have the hdev available here to make a
@@ -220,11 +225,9 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
                 return -EINVAL;
 
         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
-                if (!enable_lecoc && la.l2_psm)
-                        return -EINVAL;
                 /* We only allow ATT user space socket */
                 if (la.l2_cid &&
-                    la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
+                    la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
                         return -EINVAL;
         }
 
@@ -357,17 +360,21 @@ static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 
         BT_DBG("sock %p, sk %p", sock, sk);
 
+        if (peer && sk->sk_state != BT_CONNECTED &&
+            sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2)
+                return -ENOTCONN;
+
         memset(la, 0, sizeof(struct sockaddr_l2));
         addr->sa_family = AF_BLUETOOTH;
         *len = sizeof(struct sockaddr_l2);
 
+        la->l2_psm = chan->psm;
+
         if (peer) {
-                la->l2_psm = chan->psm;
                 bacpy(&la->l2_bdaddr, &chan->dst);
                 la->l2_cid = cpu_to_le16(chan->dcid);
                 la->l2_bdaddr_type = chan->dst_type;
         } else {
-                la->l2_psm = chan->sport;
                 bacpy(&la->l2_bdaddr, &chan->src);
                 la->l2_cid = cpu_to_le16(chan->scid);
                 la->l2_bdaddr_type = chan->src_type;
@@ -432,6 +439,10 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
                               L2CAP_LM_SECURE;
                         break;
+                case BT_SECURITY_FIPS:
+                        opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
+                              L2CAP_LM_SECURE | L2CAP_LM_FIPS;
+                        break;
                 default:
                         opt = 0;
                         break;
@@ -445,6 +456,7 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 
                 if (put_user(opt, (u32 __user *) optval))
                         err = -EFAULT;
+
                 break;
 
         case L2CAP_CONNINFO:
@@ -499,6 +511,7 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
         switch (optname) {
         case BT_SECURITY:
                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
+                    chan->chan_type != L2CAP_CHAN_FIXED &&
                     chan->chan_type != L2CAP_CHAN_RAW) {
                         err = -EINVAL;
                         break;
@@ -560,11 +573,6 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case BT_SNDMTU:
-                if (!enable_lecoc) {
-                        err = -EPROTONOSUPPORT;
-                        break;
-                }
-
                 if (!bdaddr_type_is_le(chan->src_type)) {
                         err = -EINVAL;
                         break;
@@ -580,11 +588,6 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case BT_RCVMTU:
-                if (!enable_lecoc) {
-                        err = -EPROTONOSUPPORT;
-                        break;
-                }
-
                 if (!bdaddr_type_is_le(chan->src_type)) {
                         err = -EINVAL;
                         break;
@@ -699,6 +702,11 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
                         break;
                 }
 
+                if (opt & L2CAP_LM_FIPS) {
+                        err = -EINVAL;
+                        break;
+                }
+
                 if (opt & L2CAP_LM_AUTH)
                         chan->sec_level = BT_SECURITY_LOW;
                 if (opt & L2CAP_LM_ENCRYPT)
@@ -750,6 +758,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
         switch (optname) {
         case BT_SECURITY:
                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
+                    chan->chan_type != L2CAP_CHAN_FIXED &&
                     chan->chan_type != L2CAP_CHAN_RAW) {
                         err = -EINVAL;
                         break;
@@ -895,11 +904,6 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case BT_SNDMTU:
-                if (!enable_lecoc) {
-                        err = -EPROTONOSUPPORT;
-                        break;
-                }
-
                 if (!bdaddr_type_is_le(chan->src_type)) {
                         err = -EINVAL;
                         break;
@@ -912,11 +916,6 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case BT_RCVMTU:
-                if (!enable_lecoc) {
-                        err = -EPROTONOSUPPORT;
-                        break;
-                }
-
                 if (!bdaddr_type_is_le(chan->src_type)) {
                         err = -EINVAL;
                         break;
@@ -1272,7 +1271,7 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
 
                 if (parent) {
                         bt_accept_unlink(sk);
-                        parent->sk_data_ready(parent, 0);
+                        parent->sk_data_ready(parent);
                 } else {
                         sk->sk_state_change(sk);
                 }
@@ -1328,7 +1327,7 @@ static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
         sk->sk_state_change(sk);
 
         if (parent)
-                parent->sk_data_ready(parent, 0);
+                parent->sk_data_ready(parent);
 
         release_sock(sk);
 }
@@ -1341,7 +1340,7 @@ static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
 
         parent = bt_sk(sk)->parent;
         if (parent)
-                parent->sk_data_ready(parent, 0);
+                parent->sk_data_ready(parent);
 
         release_sock(sk);
 }
@@ -1449,6 +1448,11 @@ static void l2cap_sock_init(struct sock *sk, struct sock *parent)
                 chan->tx_credits = pchan->tx_credits;
                 chan->rx_credits = pchan->rx_credits;
 
+                if (chan->chan_type == L2CAP_CHAN_FIXED) {
+                        chan->scid = pchan->scid;
+                        chan->dcid = pchan->scid;
+                }
+
                 security_sk_clone(parent, sk);
         } else {
                 switch (sk->sk_type) {
@@ -1614,6 +1618,3 @@ void l2cap_cleanup_sockets(void)
         bt_sock_unregister(BTPROTO_L2CAP);
         proto_unregister(&l2cap_proto);
 }
-
-module_param(enable_lecoc, bool, 0644);
-MODULE_PARM_DESC(enable_lecoc, "Enable support for LE CoC");
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index a03ca3ca91bf..d2d4e0d5aed0 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -34,7 +34,7 @@
 #include "smp.h"
 
 #define MGMT_VERSION    1
-#define MGMT_REVISION   4
+#define MGMT_REVISION   5
 
 static const u16 mgmt_commands[] = {
         MGMT_OP_READ_INDEX_LIST,
@@ -79,6 +79,10 @@ static const u16 mgmt_commands[] = {
         MGMT_OP_SET_BREDR,
         MGMT_OP_SET_STATIC_ADDRESS,
         MGMT_OP_SET_SCAN_PARAMS,
+        MGMT_OP_SET_SECURE_CONN,
+        MGMT_OP_SET_DEBUG_KEYS,
+        MGMT_OP_SET_PRIVACY,
+        MGMT_OP_LOAD_IRKS,
 };
 
 static const u16 mgmt_events[] = {
@@ -103,6 +107,8 @@ static const u16 mgmt_events[] = {
         MGMT_EV_DEVICE_UNBLOCKED,
         MGMT_EV_DEVICE_UNPAIRED,
         MGMT_EV_PASSKEY_NOTIFY,
+        MGMT_EV_NEW_IRK,
+        MGMT_EV_NEW_CSRK,
 };
 
 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
@@ -127,7 +133,7 @@ static u8 mgmt_status_table[] = {
         MGMT_STATUS_FAILED,             /* Hardware Failure */
         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
-        MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
+        MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
@@ -207,7 +213,7 @@ static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 
         hdr = (void *) skb_put(skb, sizeof(*hdr));
 
-        hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
+        hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
         hdr->index = cpu_to_le16(index);
         hdr->len = cpu_to_le16(sizeof(*ev));
 
@@ -238,7 +244,7 @@ static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 
         hdr = (void *) skb_put(skb, sizeof(*hdr));
 
-        hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
+        hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
         hdr->index = cpu_to_le16(index);
         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 
@@ -264,7 +270,7 @@ static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
         BT_DBG("sock %p", sk);
 
         rp.version = MGMT_VERSION;
-        rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
+        rp.revision = cpu_to_le16(MGMT_REVISION);
 
         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
                             sizeof(rp));
@@ -288,8 +294,8 @@ static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
         if (!rp)
                 return -ENOMEM;
 
-        rp->num_commands = __constant_cpu_to_le16(num_commands);
-        rp->num_events = __constant_cpu_to_le16(num_events);
+        rp->num_commands = cpu_to_le16(num_commands);
+        rp->num_events = cpu_to_le16(num_events);
 
         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
                 put_unaligned_le16(mgmt_commands[i], opcode);
@@ -363,6 +369,7 @@ static u32 get_supported_settings(struct hci_dev *hdev)
 
         settings |= MGMT_SETTING_POWERED;
         settings |= MGMT_SETTING_PAIRABLE;
+        settings |= MGMT_SETTING_DEBUG_KEYS;
 
         if (lmp_bredr_capable(hdev)) {
                 settings |= MGMT_SETTING_CONNECTABLE;
@@ -376,11 +383,16 @@ static u32 get_supported_settings(struct hci_dev *hdev)
                         settings |= MGMT_SETTING_SSP;
                         settings |= MGMT_SETTING_HS;
                 }
+
+                if (lmp_sc_capable(hdev) ||
+                    test_bit(HCI_FORCE_SC, &hdev->dev_flags))
+                        settings |= MGMT_SETTING_SECURE_CONN;
         }
 
         if (lmp_le_capable(hdev)) {
                 settings |= MGMT_SETTING_LE;
                 settings |= MGMT_SETTING_ADVERTISING;
+                settings |= MGMT_SETTING_PRIVACY;
         }
 
         return settings;
@@ -423,6 +435,15 @@ static u32 get_current_settings(struct hci_dev *hdev)
         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
                 settings |= MGMT_SETTING_ADVERTISING;
 
+        if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
+                settings |= MGMT_SETTING_SECURE_CONN;
+
+        if (test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags))
+                settings |= MGMT_SETTING_DEBUG_KEYS;
+
+        if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
+                settings |= MGMT_SETTING_PRIVACY;
+
         return settings;
 }
 
@@ -629,14 +650,8 @@ static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 
         flags |= get_adv_discov_flags(hdev);
 
-        if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
-                if (lmp_le_br_capable(hdev))
-                        flags |= LE_AD_SIM_LE_BREDR_CTRL;
-                if (lmp_host_le_br_capable(hdev))
-                        flags |= LE_AD_SIM_LE_BREDR_HOST;
-        } else {
+        if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
                 flags |= LE_AD_NO_BREDR;
-        }
 
         if (flags) {
                 BT_DBG("adv flags 0x%02x", flags);
@@ -803,6 +818,64 @@ static void update_class(struct hci_request *req)
         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 }
 
+static bool get_connectable(struct hci_dev *hdev)
+{
+        struct pending_cmd *cmd;
+
+        /* If there's a pending mgmt command the flag will not yet have
+         * it's final value, so check for this first.
+         */
+        cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
+        if (cmd) {
+                struct mgmt_mode *cp = cmd->param;
+                return cp->val;
+        }
+
+        return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
+}
+
+static void enable_advertising(struct hci_request *req)
+{
+        struct hci_dev *hdev = req->hdev;
+        struct hci_cp_le_set_adv_param cp;
+        u8 own_addr_type, enable = 0x01;
+        bool connectable;
+
+        /* Clear the HCI_ADVERTISING bit temporarily so that the
+         * hci_update_random_address knows that it's safe to go ahead
+         * and write a new random address. The flag will be set back on
+         * as soon as the SET_ADV_ENABLE HCI command completes.
+         */
+        clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
+
+        connectable = get_connectable(hdev);
+
+        /* Set require_privacy to true only when non-connectable
+         * advertising is used. In that case it is fine to use a
+         * non-resolvable private address.
+         */
+        if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
+                return;
+
+        memset(&cp, 0, sizeof(cp));
+        cp.min_interval = cpu_to_le16(0x0800);
+        cp.max_interval = cpu_to_le16(0x0800);
+        cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
+        cp.own_address_type = own_addr_type;
+        cp.channel_map = hdev->le_adv_channel_map;
+
+        hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
+
+        hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
+}
+
+static void disable_advertising(struct hci_request *req)
+{
+        u8 enable = 0x00;
+
+        hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
+}
+
 static void service_cache_off(struct work_struct *work)
 {
         struct hci_dev *hdev = container_of(work, struct hci_dev,
@@ -824,12 +897,39 @@ static void service_cache_off(struct work_struct *work)
         hci_req_run(&req, NULL);
 }
 
+static void rpa_expired(struct work_struct *work)
+{
+        struct hci_dev *hdev = container_of(work, struct hci_dev,
+                                            rpa_expired.work);
+        struct hci_request req;
+
+        BT_DBG("");
+
+        set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
+
+        if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags) ||
+            hci_conn_num(hdev, LE_LINK) > 0)
+                return;
+
+        /* The generation of a new RPA and programming it into the
+         * controller happens in the enable_advertising() function.
+         */
+
+        hci_req_init(&req, hdev);
+
+        disable_advertising(&req);
+        enable_advertising(&req);
+
+        hci_req_run(&req, NULL);
+}
+
 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 {
         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
                 return;
 
         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
+        INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
 
         /* Non-mgmt controlled devices get this bit set
          * implicitly so that pairing works for them, however
@@ -935,6 +1035,71 @@ static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
                             sizeof(settings));
 }
 
+static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
+{
+        BT_DBG("%s status 0x%02x", hdev->name, status);
+
+        if (hci_conn_count(hdev) == 0) {
+                cancel_delayed_work(&hdev->power_off);
+                queue_work(hdev->req_workqueue, &hdev->power_off.work);
+        }
+}
+
+static int clean_up_hci_state(struct hci_dev *hdev)
+{
+        struct hci_request req;
+        struct hci_conn *conn;
+
+        hci_req_init(&req, hdev);
+
+        if (test_bit(HCI_ISCAN, &hdev->flags) ||
+            test_bit(HCI_PSCAN, &hdev->flags)) {
+                u8 scan = 0x00;
+                hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
+        }
+
+        if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
+                disable_advertising(&req);
+
+        if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
+                hci_req_add_le_scan_disable(&req);
+        }
+
+        list_for_each_entry(conn, &hdev->conn_hash.list, list) {
+                struct hci_cp_disconnect dc;
+                struct hci_cp_reject_conn_req rej;
+
+                switch (conn->state) {
+                case BT_CONNECTED:
+                case BT_CONFIG:
+                        dc.handle = cpu_to_le16(conn->handle);
+                        dc.reason = 0x15; /* Terminated due to Power Off */
+                        hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
+                        break;
+                case BT_CONNECT:
+                        if (conn->type == LE_LINK)
+                                hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
+                                            0, NULL);
+                        else if (conn->type == ACL_LINK)
+                                hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
+                                            6, &conn->dst);
+                        break;
+                case BT_CONNECT2:
+                        bacpy(&rej.bdaddr, &conn->dst);
+                        rej.reason = 0x15; /* Terminated due to Power Off */
+                        if (conn->type == ACL_LINK)
+                                hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
+                                            sizeof(rej), &rej);
+                        else if (conn->type == SCO_LINK)
+                                hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
+                                            sizeof(rej), &rej);
+                        break;
+                }
+        }
+
+        return hci_req_run(&req, clean_up_hci_complete);
+}
+
 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
                        u16 len)
 {
@@ -978,12 +1143,23 @@ static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
                 goto failed;
         }
 
-        if (cp->val)
+        if (cp->val) {
                 queue_work(hdev->req_workqueue, &hdev->power_on);
-        else
-                queue_work(hdev->req_workqueue, &hdev->power_off.work);
-
-        err = 0;
+                err = 0;
+        } else {
+                /* Disconnect connections, stop scans, etc */
+                err = clean_up_hci_state(hdev);
+                if (!err)
+                        queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
+                                           HCI_POWER_OFF_TIMEOUT);
+
+                /* ENODATA means there were no HCI commands queued */
+                if (err == -ENODATA) {
+                        cancel_delayed_work(&hdev->power_off);
+                        queue_work(hdev->req_workqueue, &hdev->power_off.work);
+                        err = 0;
+                }
+        }
 
 failed:
         hci_dev_unlock(hdev);
@@ -1005,7 +1181,7 @@ static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
         if (hdev)
                 hdr->index = cpu_to_le16(hdev->id);
         else
-                hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
+                hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
         hdr->len = cpu_to_le16(data_len);
 
         if (data)
@@ -1317,15 +1493,15 @@ static void write_fast_connectable(struct hci_request *req, bool enable)
                 type = PAGE_SCAN_TYPE_INTERLACED;
 
                 /* 160 msec page scan interval */
-                acp.interval = __constant_cpu_to_le16(0x0100);
+                acp.interval = cpu_to_le16(0x0100);
         } else {
                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
 
                 /* default 1.28 sec page scan */
-                acp.interval = __constant_cpu_to_le16(0x0800);
+                acp.interval = cpu_to_le16(0x0800);
         }
 
-        acp.window = __constant_cpu_to_le16(0x0012);
+        acp.window = cpu_to_le16(0x0012);
 
         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
             __cpu_to_le16(hdev->page_scan_window) != acp.window)
@@ -1336,50 +1512,6 @@ static void write_fast_connectable(struct hci_request *req, bool enable)
                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
 }
 
-static u8 get_adv_type(struct hci_dev *hdev)
-{
-        struct pending_cmd *cmd;
-        bool connectable;
-
-        /* If there's a pending mgmt command the flag will not yet have
-         * it's final value, so check for this first.
-         */
-        cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
-        if (cmd) {
-                struct mgmt_mode *cp = cmd->param;
-                connectable = !!cp->val;
-        } else {
-                connectable = test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
-        }
-
-        return connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
-}
-
-static void enable_advertising(struct hci_request *req)
-{
-        struct hci_dev *hdev = req->hdev;
-        struct hci_cp_le_set_adv_param cp;
-        u8 enable = 0x01;
-
-        memset(&cp, 0, sizeof(cp));
-        cp.min_interval = __constant_cpu_to_le16(0x0800);
-        cp.max_interval = __constant_cpu_to_le16(0x0800);
-        cp.type = get_adv_type(hdev);
-        cp.own_address_type = hdev->own_addr_type;
-        cp.channel_map = 0x07;
-
-        hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
-
-        hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
-}
-
-static void disable_advertising(struct hci_request *req)
-{
-        u8 enable = 0x00;
-
-        hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
-}
-
 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
 {
         struct pending_cmd *cmd;
@@ -2065,7 +2197,7 @@ static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
         }
 
         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
-                err = hci_uuids_clear(hdev);
+                hci_uuids_clear(hdev);
 
                 if (enable_service_cache(hdev)) {
                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
@@ -2205,6 +2337,7 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
 {
         struct mgmt_cp_load_link_keys *cp = data;
         u16 key_count, expected_len;
+        bool changed;
         int i;
 
         BT_DBG("request for %s", hdev->name);
@@ -2219,7 +2352,7 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
                                         sizeof(struct mgmt_link_key_info);
         if (expected_len != len) {
                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
-                       len, expected_len);
+                       expected_len, len);
                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
                                   MGMT_STATUS_INVALID_PARAMS);
         }
@@ -2234,7 +2367,7 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
         for (i = 0; i < key_count; i++) {
                 struct mgmt_link_key_info *key = &cp->keys[i];
 
-                if (key->addr.type != BDADDR_BREDR)
+                if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
                                           MGMT_STATUS_INVALID_PARAMS);
         }
@@ -2244,9 +2377,12 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
         hci_link_keys_clear(hdev);
 
         if (cp->debug_keys)
-                set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
+                changed = !test_and_set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
         else
-                clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
+                changed = test_and_clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
+
+        if (changed)
+                new_settings(hdev, NULL);
 
         for (i = 0; i < key_count; i++) {
                 struct mgmt_link_key_info *key = &cp->keys[i];
@@ -2306,10 +2442,22 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                 goto unlock;
         }
 
-        if (cp->addr.type == BDADDR_BREDR)
+        if (cp->addr.type == BDADDR_BREDR) {
                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
-        else
-                err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
+        } else {
+                u8 addr_type;
+
+                if (cp->addr.type == BDADDR_LE_PUBLIC)
+                        addr_type = ADDR_LE_DEV_PUBLIC;
+                else
+                        addr_type = ADDR_LE_DEV_RANDOM;
+
+                hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
+
+                hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
+
+                err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
+        }
 
         if (err < 0) {
                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
@@ -2633,6 +2781,16 @@ static void pairing_complete(struct pending_cmd *cmd, u8 status)
         mgmt_pending_remove(cmd);
 }
 
+void mgmt_smp_complete(struct hci_conn *conn, bool complete)
+{
+        u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
+        struct pending_cmd *cmd;
+
+        cmd = find_pairing(conn);
+        if (cmd)
+                pairing_complete(cmd, status);
+}
+
 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
 {
         struct pending_cmd *cmd;
@@ -2646,7 +2804,7 @@ static void pairing_complete_cb(struct hci_conn *conn, u8 status)
                 pairing_complete(cmd, mgmt_status(status));
 }
 
-static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
+static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
 {
         struct pending_cmd *cmd;
 
@@ -2697,12 +2855,22 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
         else
                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
 
-        if (cp->addr.type == BDADDR_BREDR)
-                conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
-                                   cp->addr.type, sec_level, auth_type);
-        else
-                conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
-                                   cp->addr.type, sec_level, auth_type);
+        if (cp->addr.type == BDADDR_BREDR) {
+                conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
+                                       auth_type);
+        } else {
+                u8 addr_type;
+
+                /* Convert from L2CAP channel address type to HCI address type
+                 */
+                if (cp->addr.type == BDADDR_LE_PUBLIC)
+                        addr_type = ADDR_LE_DEV_PUBLIC;
+                else
+                        addr_type = ADDR_LE_DEV_RANDOM;
+
+                conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
+                                      sec_level, auth_type);
+        }
 
         if (IS_ERR(conn)) {
                 int status;
@@ -2733,13 +2901,16 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
         }
 
         /* For LE, just connecting isn't a proof that the pairing finished */
-        if (cp->addr.type == BDADDR_BREDR)
+        if (cp->addr.type == BDADDR_BREDR) {
                 conn->connect_cfm_cb = pairing_complete_cb;
-        else
-                conn->connect_cfm_cb = le_connect_complete_cb;
+                conn->security_cfm_cb = pairing_complete_cb;
+                conn->disconn_cfm_cb = pairing_complete_cb;
+        } else {
+                conn->connect_cfm_cb = le_pairing_complete_cb;
+                conn->security_cfm_cb = le_pairing_complete_cb;
+                conn->disconn_cfm_cb = le_pairing_complete_cb;
+        }
 
-        conn->security_cfm_cb = pairing_complete_cb;
-        conn->disconn_cfm_cb = pairing_complete_cb;
         conn->io_capability = cp->io_cap;
         cmd->user_data = conn;
 
@@ -3071,7 +3242,12 @@ static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
                 goto unlock;
         }
 
-        err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
+        if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
+                err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
+                                   0, NULL);
+        else
+                err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
+
         if (err < 0)
                 mgmt_pending_remove(cmd);
 
@@ -3083,23 +3259,46 @@ unlock:
 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
                                void *data, u16 len)
 {
-        struct mgmt_cp_add_remote_oob_data *cp = data;
-        u8 status;
         int err;
 
         BT_DBG("%s ", hdev->name);
 
         hci_dev_lock(hdev);
 
-        err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
-                                      cp->randomizer);
-        if (err < 0)
-                status = MGMT_STATUS_FAILED;
-        else
-                status = MGMT_STATUS_SUCCESS;
+        if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
+                struct mgmt_cp_add_remote_oob_data *cp = data;
+                u8 status;
 
-        err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
-                           &cp->addr, sizeof(cp->addr));
+                err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
+                                              cp->hash, cp->randomizer);
+                if (err < 0)
+                        status = MGMT_STATUS_FAILED;
+                else
+                        status = MGMT_STATUS_SUCCESS;
+
+                err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
+                                   status, &cp->addr, sizeof(cp->addr));
+        } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
+                struct mgmt_cp_add_remote_oob_ext_data *cp = data;
+                u8 status;
+
+                err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
+                                                  cp->hash192,
+                                                  cp->randomizer192,
+                                                  cp->hash256,
+                                                  cp->randomizer256);
+                if (err < 0)
+                        status = MGMT_STATUS_FAILED;
+                else
+                        status = MGMT_STATUS_SUCCESS;
+
+                err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
+                                   status, &cp->addr, sizeof(cp->addr));
+        } else {
+                BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
+                err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
+                                 MGMT_STATUS_INVALID_PARAMS);
+        }
 
         hci_dev_unlock(hdev);
         return err;
@@ -3195,7 +3394,7 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
         struct hci_request req;
         /* General inquiry access code (GIAC) */
         u8 lap[3] = { 0x33, 0x8b, 0x9e };
-        u8 status;
+        u8 status, own_addr_type;
         int err;
 
         BT_DBG("%s", hdev->name);
@@ -3280,18 +3479,31 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
                         goto failed;
                 }
 
-                if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
+                /* If controller is scanning, it means the background scanning
+                 * is running. Thus, we should temporarily stop it in order to
+                 * set the discovery scanning parameters.
+                 */
+                if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
+                        hci_req_add_le_scan_disable(&req);
+
+                memset(&param_cp, 0, sizeof(param_cp));
+
+                /* All active scans will be done with either a resolvable
+                 * private address (when privacy feature has been enabled)
+                 * or unresolvable private address.
+                 */
+                err = hci_update_random_address(&req, true, &own_addr_type);
+                if (err < 0) {
                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
-                                         MGMT_STATUS_BUSY);
+                                         MGMT_STATUS_FAILED);
                         mgmt_pending_remove(cmd);
                         goto failed;
                 }
 
-                memset(&param_cp, 0, sizeof(param_cp));
                 param_cp.type = LE_SCAN_ACTIVE;
                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
-                param_cp.own_address_type = hdev->own_addr_type;
+                param_cp.own_address_type = own_addr_type;
                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
                             &param_cp);
 
@@ -3361,7 +3573,6 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
         struct hci_cp_remote_name_req_cancel cp;
         struct inquiry_entry *e;
         struct hci_request req;
-        struct hci_cp_le_set_scan_enable enable_cp;
         int err;
 
         BT_DBG("%s", hdev->name);
@@ -3397,10 +3608,7 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
                 } else {
                         cancel_delayed_work(&hdev->le_scan_disable);
 
-                        memset(&enable_cp, 0, sizeof(enable_cp));
-                        enable_cp.enable = LE_SCAN_DISABLE;
-                        hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
-                                    sizeof(enable_cp), &enable_cp);
+                        hci_req_add_le_scan_disable(&req);
                 }
 
                 break;
@@ -3457,15 +3665,17 @@ static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
         hci_dev_lock(hdev);
 
         if (!hci_discovery_active(hdev)) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
-                                 MGMT_STATUS_FAILED);
+                err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
+                                   MGMT_STATUS_FAILED, &cp->addr,
+                                   sizeof(cp->addr));
                 goto failed;
         }
 
         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
         if (!e) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
-                                 MGMT_STATUS_INVALID_PARAMS);
+                err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
+                                   MGMT_STATUS_INVALID_PARAMS, &cp->addr,
+                                   sizeof(cp->addr));
                 goto failed;
         }
 
@@ -3754,6 +3964,21 @@ static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
 
         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
 
+        /* If background scan is running, restart it so new parameters are
+         * loaded.
+         */
+        if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
+            hdev->discovery.state == DISCOVERY_STOPPED) {
+                struct hci_request req;
+
+                hci_req_init(&req, hdev);
+
+                hci_req_add_le_scan_disable(&req);
+                hci_req_add_le_passive_scan(&req);
+
+                hci_req_run(&req, NULL);
+        }
+
         hci_dev_unlock(hdev);
 
         return err;
@@ -3999,15 +4224,269 @@ unlock:
         return err;
 }
 
+static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
+                           void *data, u16 len)
+{
+        struct mgmt_mode *cp = data;
+        struct pending_cmd *cmd;
+        u8 val, status;
+        int err;
+
+        BT_DBG("request for %s", hdev->name);
+
+        status = mgmt_bredr_support(hdev);
+        if (status)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
+                                  status);
+
+        if (!lmp_sc_capable(hdev) &&
+            !test_bit(HCI_FORCE_SC, &hdev->dev_flags))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
+                                  MGMT_STATUS_NOT_SUPPORTED);
+
+        if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
+        hci_dev_lock(hdev);
+
+        if (!hdev_is_powered(hdev)) {
+                bool changed;
+
+                if (cp->val) {
+                        changed = !test_and_set_bit(HCI_SC_ENABLED,
+                                                    &hdev->dev_flags);
+                        if (cp->val == 0x02)
+                                set_bit(HCI_SC_ONLY, &hdev->dev_flags);
+                        else
+                                clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
+                } else {
+                        changed = test_and_clear_bit(HCI_SC_ENABLED,
+                                                     &hdev->dev_flags);
+                        clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
+                }
+
+                err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
+                if (err < 0)
+                        goto failed;
+
+                if (changed)
+                        err = new_settings(hdev, sk);
+
+                goto failed;
+        }
+
+        if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
+                                 MGMT_STATUS_BUSY);
+                goto failed;
+        }
+
+        val = !!cp->val;
+
+        if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
+            (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
+                err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
+                goto failed;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto failed;
+        }
+
+        err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
+        if (err < 0) {
+                mgmt_pending_remove(cmd);
+                goto failed;
+        }
+
+        if (cp->val == 0x02)
+                set_bit(HCI_SC_ONLY, &hdev->dev_flags);
+        else
+                clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
+
+failed:
+        hci_dev_unlock(hdev);
+        return err;
+}
+
+static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
+                          void *data, u16 len)
+{
+        struct mgmt_mode *cp = data;
+        bool changed;
+        int err;
+
+        BT_DBG("request for %s", hdev->name);
+
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
+        hci_dev_lock(hdev);
+
+        if (cp->val)
+                changed = !test_and_set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
+        else
+                changed = test_and_clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
+
+        err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
+        if (err < 0)
+                goto unlock;
+
+        if (changed)
+                err = new_settings(hdev, sk);
+
+unlock:
+        hci_dev_unlock(hdev);
+        return err;
+}
+
+static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
+                       u16 len)
+{
+        struct mgmt_cp_set_privacy *cp = cp_data;
+        bool changed;
+        int err;
+
+        BT_DBG("request for %s", hdev->name);
+
+        if (!lmp_le_capable(hdev))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
+                                  MGMT_STATUS_NOT_SUPPORTED);
+
+        if (cp->privacy != 0x00 && cp->privacy != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
+        if (hdev_is_powered(hdev))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
+                                  MGMT_STATUS_REJECTED);
+
+        hci_dev_lock(hdev);
+
+        /* If user space supports this command it is also expected to
+         * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
+         */
+        set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
+
+        if (cp->privacy) {
+                changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
+                memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
+                set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
+        } else {
+                changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
+                memset(hdev->irk, 0, sizeof(hdev->irk));
+                clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
+        }
+
+        err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
+        if (err < 0)
+                goto unlock;
+
+        if (changed)
+                err = new_settings(hdev, sk);
+
+unlock:
+        hci_dev_unlock(hdev);
+        return err;
+}
+
+static bool irk_is_valid(struct mgmt_irk_info *irk)
+{
+        switch (irk->addr.type) {
+        case BDADDR_LE_PUBLIC:
+                return true;
+
+        case BDADDR_LE_RANDOM:
+                /* Two most significant bits shall be set */
+                if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
+                        return false;
+                return true;
+        }
+
+        return false;
+}
+
+static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
+                     u16 len)
+{
+        struct mgmt_cp_load_irks *cp = cp_data;
+        u16 irk_count, expected_len;
+        int i, err;
+
+        BT_DBG("request for %s", hdev->name);
+
+        if (!lmp_le_capable(hdev))
+                return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
+                                  MGMT_STATUS_NOT_SUPPORTED);
+
+        irk_count = __le16_to_cpu(cp->irk_count);
+
+        expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
+        if (expected_len != len) {
+                BT_ERR("load_irks: expected %u bytes, got %u bytes",
+                       expected_len, len);
+                return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
+                                  MGMT_STATUS_INVALID_PARAMS);
+        }
+
+        BT_DBG("%s irk_count %u", hdev->name, irk_count);
+
+        for (i = 0; i < irk_count; i++) {
+                struct mgmt_irk_info *key = &cp->irks[i];
+
+                if (!irk_is_valid(key))
+                        return cmd_status(sk, hdev->id,
+                                          MGMT_OP_LOAD_IRKS,
+                                          MGMT_STATUS_INVALID_PARAMS);
+        }
+
+        hci_dev_lock(hdev);
+
+        hci_smp_irks_clear(hdev);
+
+        for (i = 0; i < irk_count; i++) {
+                struct mgmt_irk_info *irk = &cp->irks[i];
+                u8 addr_type;
+
+                if (irk->addr.type == BDADDR_LE_PUBLIC)
+                        addr_type = ADDR_LE_DEV_PUBLIC;
+                else
+                        addr_type = ADDR_LE_DEV_RANDOM;
+
+                hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
+                            BDADDR_ANY);
+        }
+
+        set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
+
+        err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
+
+        hci_dev_unlock(hdev);
+
+        return err;
+}
+
 static bool ltk_is_valid(struct mgmt_ltk_info *key)
 {
-        if (key->authenticated != 0x00 && key->authenticated != 0x01)
-                return false;
         if (key->master != 0x00 && key->master != 0x01)
                 return false;
-        if (!bdaddr_type_is_le(key->addr.type))
-                return false;
-        return true;
+
+        switch (key->addr.type) {
+        case BDADDR_LE_PUBLIC:
+                return true;
+
+        case BDADDR_LE_RANDOM:
+                /* Two most significant bits shall be set */
+                if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
+                        return false;
+                return true;
+        }
+
+        return false;
 }
 
 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
@@ -4029,7 +4508,7 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
                                         sizeof(struct mgmt_ltk_info);
         if (expected_len != len) {
                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
-                       len, expected_len);
+                       expected_len, len);
                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
                                   MGMT_STATUS_INVALID_PARAMS);
         }
@@ -4063,9 +4542,9 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
                 else
                         type = HCI_SMP_LTK_SLAVE;
 
-                hci_add_ltk(hdev, &key->addr.bdaddr, addr_type,
-                            type, 0, key->authenticated, key->val,
-                            key->enc_size, key->ediv, key->rand);
+                hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
+                            key->type, key->val, key->enc_size, key->ediv,
+                            key->rand);
         }
 
         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
@@ -4115,7 +4594,7 @@ static const struct mgmt_handler {
         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
-        { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
+        { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
@@ -4127,6 +4606,10 @@ static const struct mgmt_handler {
         { set_bredr,              false, MGMT_SETTING_SIZE },
         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
+        { set_secure_conn,        false, MGMT_SETTING_SIZE },
+        { set_debug_keys,         false, MGMT_SETTING_SIZE },
+        { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
+        { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
 };
 
 
@@ -4243,6 +4726,17 @@ void mgmt_index_removed(struct hci_dev *hdev)
         mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
 }
 
+/* This function requires the caller holds hdev->lock */
+static void restart_le_auto_conns(struct hci_dev *hdev)
+{
+        struct hci_conn_params *p;
+
+        list_for_each_entry(p, &hdev->le_conn_params, list) {
+                if (p->auto_connect == HCI_AUTO_CONN_ALWAYS)
+                        hci_pend_le_conn_add(hdev, &p->addr, p->addr_type);
+        }
+}
+
 static void powered_complete(struct hci_dev *hdev, u8 status)
 {
         struct cmd_lookup match = { NULL, hdev };
@@ -4251,6 +4745,8 @@ static void powered_complete(struct hci_dev *hdev, u8 status)
 
         hci_dev_lock(hdev);
 
+        restart_le_auto_conns(hdev);
+
         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
 
         new_settings(hdev, match.sk);
@@ -4292,11 +4788,6 @@ static int powered_update_hci(struct hci_dev *hdev)
         }
 
         if (lmp_le_capable(hdev)) {
-                /* Set random address to static address if configured */
-                if (bacmp(&hdev->static_addr, BDADDR_ANY))
-                        hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
-                                    &hdev->static_addr);
-
                 /* Make sure the controller has a good default for
                  * advertising data. This also applies to the case
                  * where BR/EDR was toggled during the AUTO_OFF phase.
@@ -4422,6 +4913,10 @@ void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
                 return;
 
+        /* Powering off may clear the scan mode - don't let that interfere */
+        if (!discoverable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
+                return;
+
         if (discoverable) {
                 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
         } else {
@@ -4455,6 +4950,10 @@ void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
                 return;
 
+        /* Powering off may clear the scan mode - don't let that interfere */
+        if (!connectable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
+                return;
+
         if (connectable)
                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
         else
@@ -4464,6 +4963,18 @@ void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
                 new_settings(hdev, NULL);
 }
 
+void mgmt_advertising(struct hci_dev *hdev, u8 advertising)
+{
+        /* Powering off may stop advertising - don't let that interfere */
+        if (!advertising && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
+                return;
+
+        if (advertising)
+                set_bit(HCI_ADVERTISING, &hdev->dev_flags);
+        else
+                clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
+}
+
 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
 {
         u8 mgmt_err = mgmt_status(status);
@@ -4494,28 +5005,104 @@ void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
 }
 
-void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
+void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
 {
         struct mgmt_ev_new_long_term_key ev;
 
         memset(&ev, 0, sizeof(ev));
 
-        ev.store_hint = persistent;
+        /* Devices using resolvable or non-resolvable random addresses
+         * without providing an indentity resolving key don't require
+         * to store long term keys. Their addresses will change the
+         * next time around.
+         *
+         * Only when a remote device provides an identity address
+         * make sure the long term key is stored. If the remote
+         * identity is known, the long term keys are internally
+         * mapped to the identity address. So allow static random
+         * and public addresses here.
+         */
+        if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
+            (key->bdaddr.b[5] & 0xc0) != 0xc0)
+                ev.store_hint = 0x00;
+        else
+                ev.store_hint = persistent;
+
         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
-        ev.key.authenticated = key->authenticated;
+        ev.key.type = key->authenticated;
         ev.key.enc_size = key->enc_size;
         ev.key.ediv = key->ediv;
+        ev.key.rand = key->rand;
 
         if (key->type == HCI_SMP_LTK)
                 ev.key.master = 1;
 
-        memcpy(ev.key.rand, key->rand, sizeof(key->rand));
         memcpy(ev.key.val, key->val, sizeof(key->val));
 
         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
 }
 
+void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
+{
+        struct mgmt_ev_new_irk ev;
+
+        memset(&ev, 0, sizeof(ev));
+
+        /* For identity resolving keys from devices that are already
+         * using a public address or static random address, do not
+         * ask for storing this key. The identity resolving key really
+         * is only mandatory for devices using resovlable random
+         * addresses.
+         *
+         * Storing all identity resolving keys has the downside that
+         * they will be also loaded on next boot of they system. More
+         * identity resolving keys, means more time during scanning is
+         * needed to actually resolve these addresses.
+         */
+        if (bacmp(&irk->rpa, BDADDR_ANY))
+                ev.store_hint = 0x01;
+        else
+                ev.store_hint = 0x00;
+
+        bacpy(&ev.rpa, &irk->rpa);
+        bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
+        ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
+        memcpy(ev.irk.val, irk->val, sizeof(irk->val));
+
+        mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
+}
+
+void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
+                   bool persistent)
+{
+        struct mgmt_ev_new_csrk ev;
+
+        memset(&ev, 0, sizeof(ev));
+
+        /* Devices using resolvable or non-resolvable random addresses
+         * without providing an indentity resolving key don't require
+         * to store signature resolving keys. Their addresses will change
+         * the next time around.
+         *
+         * Only when a remote device provides an identity address
+         * make sure the signature resolving key is stored. So allow
+         * static random and public addresses here.
+         */
+        if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
+            (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
+                ev.store_hint = 0x00;
+        else
+                ev.store_hint = persistent;
+
+        bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
+        ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
+        ev.key.master = csrk->master;
+        memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
+
+        mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
+}
+
 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
                                   u8 data_len)
 {
@@ -4590,11 +5177,29 @@ static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
 }
 
 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                              u8 link_type, u8 addr_type, u8 reason)
+                              u8 link_type, u8 addr_type, u8 reason,
+                              bool mgmt_connected)
 {
         struct mgmt_ev_device_disconnected ev;
+        struct pending_cmd *power_off;
         struct sock *sk = NULL;
 
+        power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
+        if (power_off) {
+                struct mgmt_mode *cp = power_off->param;
+
+                /* The connection is still in hci_conn_hash so test for 1
+                 * instead of 0 to know if this is the last one.
+                 */
+                if (!cp->val && hci_conn_count(hdev) == 1) {
+                        cancel_delayed_work(&hdev->power_off);
+                        queue_work(hdev->req_workqueue, &hdev->power_off.work);
+                }
+        }
+
+        if (!mgmt_connected)
+                return;
+
         if (link_type != ACL_LINK && link_type != LE_LINK)
                 return;
 
@@ -4649,6 +5254,20 @@ void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                          u8 addr_type, u8 status)
 {
         struct mgmt_ev_connect_failed ev;
+        struct pending_cmd *power_off;
+
+        power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
+        if (power_off) {
+                struct mgmt_mode *cp = power_off->param;
+
+                /* The connection is still in hci_conn_hash so test for 1
+                 * instead of 0 to know if this is the last one.
+                 */
+                if (!cp->val && hci_conn_count(hdev) == 1) {
+                        cancel_delayed_work(&hdev->power_off);
+                        queue_work(hdev->req_workqueue, &hdev->power_off.work);
+                }
+        }
 
         bacpy(&ev.addr.bdaddr, bdaddr);
         ev.addr.type = link_to_bdaddr(link_type, addr_type);
@@ -4707,7 +5326,7 @@ void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
 }
 
 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                              u8 link_type, u8 addr_type, __le32 value,
+                              u8 link_type, u8 addr_type, u32 value,
                               u8 confirm_hint)
 {
         struct mgmt_ev_user_confirm_request ev;
@@ -4717,7 +5336,7 @@ int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
         bacpy(&ev.addr.bdaddr, bdaddr);
         ev.addr.type = link_to_bdaddr(link_type, addr_type);
         ev.confirm_hint = confirm_hint;
-        ev.value = value;
+        ev.value = cpu_to_le32(value);
 
         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
                           NULL);
@@ -4910,6 +5529,43 @@ void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
         hci_req_run(&req, NULL);
 }
 
+void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
+{
+        struct cmd_lookup match = { NULL, hdev };
+        bool changed = false;
+
+        if (status) {
+                u8 mgmt_err = mgmt_status(status);
+
+                if (enable) {
+                        if (test_and_clear_bit(HCI_SC_ENABLED,
+                                               &hdev->dev_flags))
+                                new_settings(hdev, NULL);
+                        clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
+                }
+
+                mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
+                                     cmd_status_rsp, &mgmt_err);
+                return;
+        }
+
+        if (enable) {
+                changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
+        } else {
+                changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
+                clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
+        }
+
+        mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
+                             settings_rsp, &match);
+
+        if (changed)
+                new_settings(hdev, match.sk);
+
+        if (match.sk)
+                sock_put(match.sk);
+}
+
 static void sk_lookup(struct pending_cmd *cmd, void *data)
 {
         struct cmd_lookup *match = data;
@@ -4964,8 +5620,9 @@ void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
                    cmd ? cmd->sk : NULL);
 }
 
-void mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
-                                             u8 *randomizer, u8 status)
+void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
+                                       u8 *randomizer192, u8 *hash256,
+                                       u8 *randomizer256, u8 status)
 {
         struct pending_cmd *cmd;
 
@@ -4979,13 +5636,32 @@ void mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
                            mgmt_status(status));
         } else {
-                struct mgmt_rp_read_local_oob_data rp;
+                if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
+                    hash256 && randomizer256) {
+                        struct mgmt_rp_read_local_oob_ext_data rp;
+
+                        memcpy(rp.hash192, hash192, sizeof(rp.hash192));
+                        memcpy(rp.randomizer192, randomizer192,
+                               sizeof(rp.randomizer192));
 
-                memcpy(rp.hash, hash, sizeof(rp.hash));
-                memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
+                        memcpy(rp.hash256, hash256, sizeof(rp.hash256));
+                        memcpy(rp.randomizer256, randomizer256,
+                               sizeof(rp.randomizer256));
+
+                        cmd_complete(cmd->sk, hdev->id,
+                                     MGMT_OP_READ_LOCAL_OOB_DATA, 0,
+                                     &rp, sizeof(rp));
+                } else {
+                        struct mgmt_rp_read_local_oob_data rp;
 
-                cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
-                             0, &rp, sizeof(rp));
+                        memcpy(rp.hash, hash192, sizeof(rp.hash));
+                        memcpy(rp.randomizer, randomizer192,
+                               sizeof(rp.randomizer));
+
+                        cmd_complete(cmd->sk, hdev->id,
+                                     MGMT_OP_READ_LOCAL_OOB_DATA, 0,
+                                     &rp, sizeof(rp));
+                }
         }
 
         mgmt_pending_remove(cmd);
@@ -4997,6 +5673,7 @@ void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
 {
         char buf[512];
         struct mgmt_ev_device_found *ev = (void *) buf;
+        struct smp_irk *irk;
         size_t ev_size;
 
         if (!hci_discovery_active(hdev))
@@ -5008,13 +5685,20 @@ void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
 
         memset(buf, 0, sizeof(buf));
 
-        bacpy(&ev->addr.bdaddr, bdaddr);
-        ev->addr.type = link_to_bdaddr(link_type, addr_type);
+        irk = hci_get_irk(hdev, bdaddr, addr_type);
+        if (irk) {
+                bacpy(&ev->addr.bdaddr, &irk->bdaddr);
+                ev->addr.type = link_to_bdaddr(link_type, irk->addr_type);
+        } else {
+                bacpy(&ev->addr.bdaddr, bdaddr);
+                ev->addr.type = link_to_bdaddr(link_type, addr_type);
+        }
+
         ev->rssi = rssi;
         if (cfm_name)
-                ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
+                ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
         if (!ssp)
-                ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
+                ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
 
         if (eir_len > 0)
                 memcpy(ev->eir, eir, eir_len);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index facd8a79c038..cf620260affa 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -186,9 +186,9 @@ static void rfcomm_l2state_change(struct sock *sk)
         rfcomm_schedule();
 }
 
-static void rfcomm_l2data_ready(struct sock *sk, int bytes)
+static void rfcomm_l2data_ready(struct sock *sk)
 {
-        BT_DBG("%p bytes %d", sk, bytes);
+        BT_DBG("%p", sk);
         rfcomm_schedule();
 }
 
@@ -216,6 +216,7 @@ static int rfcomm_check_security(struct rfcomm_dlc *d)
 
         switch (d->sec_level) {
         case BT_SECURITY_HIGH:
+        case BT_SECURITY_FIPS:
                 auth_type = HCI_AT_GENERAL_BONDING_MITM;
                 break;
         case BT_SECURITY_MEDIUM:
@@ -359,6 +360,11 @@ static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
         return NULL;
 }
 
+static int rfcomm_check_channel(u8 channel)
+{
+        return channel < 1 || channel > 30;
+}
+
 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 {
         struct rfcomm_session *s;
@@ -368,7 +374,7 @@ static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst,
         BT_DBG("dlc %p state %ld %pMR -> %pMR channel %d",
                d, d->state, src, dst, channel);
 
-        if (channel < 1 || channel > 30)
+        if (rfcomm_check_channel(channel))
                 return -EINVAL;
 
         if (d->state != BT_OPEN && d->state != BT_CLOSED)
@@ -425,6 +431,20 @@ int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 chann
         return r;
 }
 
+static void __rfcomm_dlc_disconn(struct rfcomm_dlc *d)
+{
+        struct rfcomm_session *s = d->session;
+
+        d->state = BT_DISCONN;
+        if (skb_queue_empty(&d->tx_queue)) {
+                rfcomm_send_disc(s, d->dlci);
+                rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
+        } else {
+                rfcomm_queue_disc(d);
+                rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
+        }
+}
+
 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 {
         struct rfcomm_session *s = d->session;
@@ -437,32 +457,29 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
         switch (d->state) {
         case BT_CONNECT:
         case BT_CONFIG:
+        case BT_OPEN:
+        case BT_CONNECT2:
                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
                         rfcomm_schedule();
-                        break;
+                        return 0;
                 }
-                /* Fall through */
+        }
 
+        switch (d->state) {
+        case BT_CONNECT:
         case BT_CONNECTED:
-                d->state = BT_DISCONN;
-                if (skb_queue_empty(&d->tx_queue)) {
-                        rfcomm_send_disc(s, d->dlci);
-                        rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
-                } else {
-                        rfcomm_queue_disc(d);
-                        rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
-                }
+                __rfcomm_dlc_disconn(d);
                 break;
 
-        case BT_OPEN:
-        case BT_CONNECT2:
-                if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
-                        set_bit(RFCOMM_AUTH_REJECT, &d->flags);
-                        rfcomm_schedule();
+        case BT_CONFIG:
+                if (s->state != BT_BOUND) {
+                        __rfcomm_dlc_disconn(d);
                         break;
                 }
-                /* Fall through */
+                /* if closing a dlc in a session that hasn't been started,
+                 * just close and unlink the dlc
+                 */
 
         default:
                 rfcomm_dlc_clear_timer(d);
@@ -513,6 +530,25 @@ no_session:
         return r;
 }
 
+struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel)
+{
+        struct rfcomm_session *s;
+        struct rfcomm_dlc *dlc = NULL;
+        u8 dlci;
+
+        if (rfcomm_check_channel(channel))
+                return ERR_PTR(-EINVAL);
+
+        rfcomm_lock();
+        s = rfcomm_session_get(src, dst);
+        if (s) {
+                dlci = __dlci(!s->initiator, channel);
+                dlc = rfcomm_dlc_get(s, dlci);
+        }
+        rfcomm_unlock();
+        return dlc;
+}
+
 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
 {
         int len = skb->len;
@@ -533,6 +569,20 @@ int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
         return len;
 }
 
+void rfcomm_dlc_send_noerror(struct rfcomm_dlc *d, struct sk_buff *skb)
+{
+        int len = skb->len;
+
+        BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
+
+        rfcomm_make_uih(skb, d->addr);
+        skb_queue_tail(&d->tx_queue, skb);
+
+        if (d->state == BT_CONNECTED &&
+            !test_bit(RFCOMM_TX_THROTTLED, &d->flags))
+                rfcomm_schedule();
+}
+
 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
 {
         BT_DBG("dlc %p state %ld", d, d->state);
@@ -718,7 +768,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
 
         bacpy(&addr.l2_bdaddr, dst);
         addr.l2_family = AF_BLUETOOTH;
-        addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
+        addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
         addr.l2_cid    = 0;
         addr.l2_bdaddr_type = BDADDR_BREDR;
         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
@@ -1943,12 +1993,11 @@ static void rfcomm_process_sessions(void)
                         continue;
                 }
 
-                if (s->state == BT_LISTEN) {
+                switch (s->state) {
+                case BT_LISTEN:
                         rfcomm_accept_connection(s);
                         continue;
-                }
 
-                switch (s->state) {
                 case BT_BOUND:
                         s = rfcomm_check_connection(s);
                         break;
@@ -1983,7 +2032,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
         /* Bind socket */
         bacpy(&addr.l2_bdaddr, ba);
         addr.l2_family = AF_BLUETOOTH;
-        addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
+        addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
         addr.l2_cid    = 0;
         addr.l2_bdaddr_type = BDADDR_BREDR;
         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
@@ -2085,7 +2134,8 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
                                 set_bit(RFCOMM_SEC_PENDING, &d->flags);
                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
                                 continue;
-                        } else if (d->sec_level == BT_SECURITY_HIGH) {
+                        } else if (d->sec_level == BT_SECURITY_HIGH ||
+                                   d->sec_level == BT_SECURITY_FIPS) {
                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
                                 continue;
                         }
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 3c2d3e4aa2f5..c603a5eb4720 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -54,7 +54,7 @@ static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
 
         atomic_add(skb->len, &sk->sk_rmem_alloc);
         skb_queue_tail(&sk->sk_receive_queue, skb);
-        sk->sk_data_ready(sk, skb->len);
+        sk->sk_data_ready(sk);
 
         if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
                 rfcomm_dlc_throttle(d);
@@ -84,7 +84,7 @@ static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
                         sock_set_flag(sk, SOCK_ZAPPED);
                         bt_accept_unlink(sk);
                 }
-                parent->sk_data_ready(parent, 0);
+                parent->sk_data_ready(parent);
         } else {
                 if (d->state == BT_CONNECTED)
                         rfcomm_session_getaddr(d->session,
@@ -105,13 +105,18 @@ static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
 }
 
 /* ---- Socket functions ---- */
-static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
+static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src)
 {
         struct sock *sk = NULL;
 
         sk_for_each(sk, &rfcomm_sk_list.head) {
-                if (rfcomm_pi(sk)->channel == channel &&
-                                !bacmp(&rfcomm_pi(sk)->src, src))
+                if (rfcomm_pi(sk)->channel != channel)
+                        continue;
+
+                if (bacmp(&rfcomm_pi(sk)->src, src))
+                        continue;
+
+                if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN)
                         break;
         }
 
@@ -331,6 +336,7 @@ static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr
 {
         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
         struct sock *sk = sock->sk;
+        int chan = sa->rc_channel;
         int err = 0;
 
         BT_DBG("sk %p %pMR", sk, &sa->rc_bdaddr);
@@ -352,12 +358,12 @@ static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr
 
         write_lock(&rfcomm_sk_list.lock);
 
-        if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
+        if (chan && __rfcomm_get_listen_sock_by_addr(chan, &sa->rc_bdaddr)) {
                 err = -EADDRINUSE;
         } else {
                 /* Save source address */
                 bacpy(&rfcomm_pi(sk)->src, &sa->rc_bdaddr);
-                rfcomm_pi(sk)->channel = sa->rc_channel;
+                rfcomm_pi(sk)->channel = chan;
                 sk->sk_state = BT_BOUND;
         }
 
@@ -439,7 +445,7 @@ static int rfcomm_sock_listen(struct socket *sock, int backlog)
                 write_lock(&rfcomm_sk_list.lock);
 
                 for (channel = 1; channel < 31; channel++)
-                        if (!__rfcomm_get_sock_by_addr(channel, src)) {
+                        if (!__rfcomm_get_listen_sock_by_addr(channel, src)) {
                                 rfcomm_pi(sk)->channel = channel;
                                 err = 0;
                                 break;
@@ -528,6 +534,10 @@ static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *
 
         BT_DBG("sock %p, sk %p", sock, sk);
 
+        if (peer && sk->sk_state != BT_CONNECTED &&
+            sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2)
+                return -ENOTCONN;
+
         memset(sa, 0, sizeof(*sa));
         sa->rc_family  = AF_BLUETOOTH;
         sa->rc_channel = rfcomm_pi(sk)->channel;
@@ -648,6 +658,11 @@ static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __u
                         break;
                 }
 
+                if (opt & RFCOMM_LM_FIPS) {
+                        err = -EINVAL;
+                        break;
+                }
+
                 if (opt & RFCOMM_LM_AUTH)
                         rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
                 if (opt & RFCOMM_LM_ENCRYPT)
@@ -762,7 +777,11 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
                         break;
                 case BT_SECURITY_HIGH:
                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
-                                                        RFCOMM_LM_SECURE;
+                              RFCOMM_LM_SECURE;
+                        break;
+                case BT_SECURITY_FIPS:
+                        opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
+                              RFCOMM_LM_SECURE | RFCOMM_LM_FIPS;
                         break;
                 default:
                         opt = 0;
@@ -774,6 +793,7 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
 
                 if (put_user(opt, (u32 __user *) optval))
                         err = -EFAULT;
+
                 break;
 
         case RFCOMM_CONNINFO:
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index f9c0980abeea..403ec09f480a 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -40,6 +40,7 @@
 #define RFCOMM_TTY_MAJOR 216            /* device node major id of the usb/bluetooth.c driver */
 #define RFCOMM_TTY_MINOR 0
 
+static DEFINE_MUTEX(rfcomm_ioctl_mutex);
 static struct tty_driver *rfcomm_tty_driver;
 
 struct rfcomm_dev {
@@ -51,6 +52,8 @@ struct rfcomm_dev {
         unsigned long           flags;
         int                     err;
 
+        unsigned long           status;         /* don't export to userspace */
+
         bdaddr_t                src;
         bdaddr_t                dst;
         u8                      channel;
@@ -58,7 +61,6 @@ struct rfcomm_dev {
         uint                    modem_status;
 
         struct rfcomm_dlc       *dlc;
-        wait_queue_head_t       conn_wait;
 
         struct device           *tty_dev;
 
@@ -83,10 +85,6 @@ static void rfcomm_dev_destruct(struct tty_port *port)
 
         BT_DBG("dev %p dlc %p", dev, dlc);
 
-        spin_lock(&rfcomm_dev_lock);
-        list_del(&dev->list);
-        spin_unlock(&rfcomm_dev_lock);
-
         rfcomm_dlc_lock(dlc);
         /* Detach DLC if it's owned by this dev */
         if (dlc->owner == dev)
@@ -95,7 +93,12 @@ static void rfcomm_dev_destruct(struct tty_port *port)
 
         rfcomm_dlc_put(dlc);
 
-        tty_unregister_device(rfcomm_tty_driver, dev->id);
+        if (dev->tty_dev)
+                tty_unregister_device(rfcomm_tty_driver, dev->id);
+
+        spin_lock(&rfcomm_dev_lock);
+        list_del(&dev->list);
+        spin_unlock(&rfcomm_dev_lock);
 
         kfree(dev);
 
@@ -104,60 +107,24 @@ static void rfcomm_dev_destruct(struct tty_port *port)
         module_put(THIS_MODULE);
 }
 
-static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
-{
-        struct hci_dev *hdev;
-        struct hci_conn *conn;
-
-        hdev = hci_get_route(&dev->dst, &dev->src);
-        if (!hdev)
-                return NULL;
-
-        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
-
-        hci_dev_put(hdev);
-
-        return conn ? &conn->dev : NULL;
-}
-
 /* device-specific initialization: open the dlc */
 static int rfcomm_dev_activate(struct tty_port *port, struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
-        DEFINE_WAIT(wait);
         int err;
 
         err = rfcomm_dlc_open(dev->dlc, &dev->src, &dev->dst, dev->channel);
         if (err)
-                return err;
-
-        while (1) {
-                prepare_to_wait(&dev->conn_wait, &wait, TASK_INTERRUPTIBLE);
-
-                if (dev->dlc->state == BT_CLOSED) {
-                        err = -dev->err;
-                        break;
-                }
-
-                if (dev->dlc->state == BT_CONNECTED)
-                        break;
-
-                if (signal_pending(current)) {
-                        err = -ERESTARTSYS;
-                        break;
-                }
-
-                tty_unlock(tty);
-                schedule();
-                tty_lock(tty);
-        }
-        finish_wait(&dev->conn_wait, &wait);
+                set_bit(TTY_IO_ERROR, &tty->flags);
+        return err;
+}
 
-        if (!err)
-                device_move(dev->tty_dev, rfcomm_get_device(dev),
-                            DPM_ORDER_DEV_AFTER_PARENT);
+/* we block the open until the dlc->state becomes BT_CONNECTED */
+static int rfcomm_dev_carrier_raised(struct tty_port *port)
+{
+        struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 
-        return err;
+        return (dev->dlc->state == BT_CONNECTED);
 }
 
 /* device-specific cleanup: close the dlc */
@@ -176,9 +143,10 @@ static const struct tty_port_operations rfcomm_port_ops = {
         .destruct = rfcomm_dev_destruct,
         .activate = rfcomm_dev_activate,
         .shutdown = rfcomm_dev_shutdown,
+        .carrier_raised = rfcomm_dev_carrier_raised,
 };
 
-static struct rfcomm_dev *__rfcomm_dev_get(int id)
+static struct rfcomm_dev *__rfcomm_dev_lookup(int id)
 {
         struct rfcomm_dev *dev;
 
@@ -195,20 +163,41 @@ static struct rfcomm_dev *rfcomm_dev_get(int id)
 
         spin_lock(&rfcomm_dev_lock);
 
-        dev = __rfcomm_dev_get(id);
+        dev = __rfcomm_dev_lookup(id);
 
-        if (dev) {
-                if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
-                        dev = NULL;
-                else
-                        tty_port_get(&dev->port);
-        }
+        if (dev && !tty_port_get(&dev->port))
+                dev = NULL;
 
         spin_unlock(&rfcomm_dev_lock);
 
         return dev;
 }
 
+static void rfcomm_reparent_device(struct rfcomm_dev *dev)
+{
+        struct hci_dev *hdev;
+        struct hci_conn *conn;
+
+        hdev = hci_get_route(&dev->dst, &dev->src);
+        if (!hdev)
+                return;
+
+        /* The lookup results are unsafe to access without the
+         * hci device lock (FIXME: why is this not documented?)
+         */
+        hci_dev_lock(hdev);
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
+
+        /* Just because the acl link is in the hash table is no
+         * guarantee the sysfs device has been added ...
+         */
+        if (conn && device_is_registered(&conn->dev))
+                device_move(dev->tty_dev, &conn->dev, DPM_ORDER_DEV_AFTER_PARENT);
+
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+}
+
 static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
 {
         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
@@ -224,17 +213,16 @@ static ssize_t show_channel(struct device *tty_dev, struct device_attribute *att
 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
 static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
 
-static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
+static struct rfcomm_dev *__rfcomm_dev_add(struct rfcomm_dev_req *req,
+                                           struct rfcomm_dlc *dlc)
 {
         struct rfcomm_dev *dev, *entry;
         struct list_head *head = &rfcomm_dev_list;
         int err = 0;
 
-        BT_DBG("id %d channel %d", req->dev_id, req->channel);
-
         dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
         if (!dev)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         spin_lock(&rfcomm_dev_lock);
 
@@ -282,7 +270,6 @@ static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 
         tty_port_init(&dev->port);
         dev->port.ops = &rfcomm_port_ops;
-        init_waitqueue_head(&dev->conn_wait);
 
         skb_queue_head_init(&dev->pending);
 
@@ -318,22 +305,37 @@ static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
            holds reference to this module. */
         __module_get(THIS_MODULE);
 
+        spin_unlock(&rfcomm_dev_lock);
+        return dev;
+
 out:
         spin_unlock(&rfcomm_dev_lock);
+        kfree(dev);
+        return ERR_PTR(err);
+}
+
+static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
+{
+        struct rfcomm_dev *dev;
+        struct device *tty;
+
+        BT_DBG("id %d channel %d", req->dev_id, req->channel);
 
-        if (err < 0)
-                goto free;
+        dev = __rfcomm_dev_add(req, dlc);
+        if (IS_ERR(dev)) {
+                rfcomm_dlc_put(dlc);
+                return PTR_ERR(dev);
+        }
 
-        dev->tty_dev = tty_port_register_device(&dev->port, rfcomm_tty_driver,
+        tty = tty_port_register_device(&dev->port, rfcomm_tty_driver,
                         dev->id, NULL);
-        if (IS_ERR(dev->tty_dev)) {
-                err = PTR_ERR(dev->tty_dev);
-                spin_lock(&rfcomm_dev_lock);
-                list_del(&dev->list);
-                spin_unlock(&rfcomm_dev_lock);
-                goto free;
+        if (IS_ERR(tty)) {
+                tty_port_put(&dev->port);
+                return PTR_ERR(tty);
         }
 
+        dev->tty_dev = tty;
+        rfcomm_reparent_device(dev);
         dev_set_drvdata(dev->tty_dev, dev);
 
         if (device_create_file(dev->tty_dev, &dev_attr_address) < 0)
@@ -343,24 +345,23 @@ out:
                 BT_ERR("Failed to create channel attribute");
 
         return dev->id;
-
-free:
-        kfree(dev);
-        return err;
 }
 
 /* ---- Send buffer ---- */
-static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
+static inline unsigned int rfcomm_room(struct rfcomm_dev *dev)
 {
-        /* We can't let it be zero, because we don't get a callback
-           when tx_credits becomes nonzero, hence we'd never wake up */
-        return dlc->mtu * (dlc->tx_credits?:1);
+        struct rfcomm_dlc *dlc = dev->dlc;
+
+        /* Limit the outstanding number of packets not yet sent to 40 */
+        int pending = 40 - atomic_read(&dev->wmem_alloc);
+
+        return max(0, pending) * dlc->mtu;
 }
 
 static void rfcomm_wfree(struct sk_buff *skb)
 {
         struct rfcomm_dev *dev = (void *) skb->sk;
-        atomic_sub(skb->truesize, &dev->wmem_alloc);
+        atomic_dec(&dev->wmem_alloc);
         if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
                 tty_port_tty_wakeup(&dev->port);
         tty_port_put(&dev->port);
@@ -369,28 +370,24 @@ static void rfcomm_wfree(struct sk_buff *skb)
 static void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
 {
         tty_port_get(&dev->port);
-        atomic_add(skb->truesize, &dev->wmem_alloc);
+        atomic_inc(&dev->wmem_alloc);
         skb->sk = (void *) dev;
         skb->destructor = rfcomm_wfree;
 }
 
 static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority)
 {
-        if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
-                struct sk_buff *skb = alloc_skb(size, priority);
-                if (skb) {
-                        rfcomm_set_owner_w(skb, dev);
-                        return skb;
-                }
-        }
-        return NULL;
+        struct sk_buff *skb = alloc_skb(size, priority);
+        if (skb)
+                rfcomm_set_owner_w(skb, dev);
+        return skb;
 }
 
 /* ---- Device IOCTLs ---- */
 
 #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
 
-static int rfcomm_create_dev(struct sock *sk, void __user *arg)
+static int __rfcomm_create_dev(struct sock *sk, void __user *arg)
 {
         struct rfcomm_dev_req req;
         struct rfcomm_dlc *dlc;
@@ -412,16 +409,22 @@ static int rfcomm_create_dev(struct sock *sk, void __user *arg)
                 dlc = rfcomm_pi(sk)->dlc;
                 rfcomm_dlc_hold(dlc);
         } else {
+                /* Validate the channel is unused */
+                dlc = rfcomm_dlc_exists(&req.src, &req.dst, req.channel);
+                if (IS_ERR(dlc))
+                        return PTR_ERR(dlc);
+                else if (dlc) {
+                        rfcomm_dlc_put(dlc);
+                        return -EBUSY;
+                }
                 dlc = rfcomm_dlc_alloc(GFP_KERNEL);
                 if (!dlc)
                         return -ENOMEM;
         }
 
         id = rfcomm_dev_add(&req, dlc);
-        if (id < 0) {
-                rfcomm_dlc_put(dlc);
+        if (id < 0)
                 return id;
-        }
 
         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
                 /* DLC is now used by device.
@@ -432,7 +435,7 @@ static int rfcomm_create_dev(struct sock *sk, void __user *arg)
         return id;
 }
 
-static int rfcomm_release_dev(void __user *arg)
+static int __rfcomm_release_dev(void __user *arg)
 {
         struct rfcomm_dev_req req;
         struct rfcomm_dev *dev;
@@ -452,6 +455,12 @@ static int rfcomm_release_dev(void __user *arg)
                 return -EPERM;
         }
 
+        /* only release once */
+        if (test_and_set_bit(RFCOMM_DEV_RELEASED, &dev->status)) {
+                tty_port_put(&dev->port);
+                return -EALREADY;
+        }
+
         if (req.flags & (1 << RFCOMM_HANGUP_NOW))
                 rfcomm_dlc_close(dev->dlc, 0);
 
@@ -462,14 +471,35 @@ static int rfcomm_release_dev(void __user *arg)
                 tty_kref_put(tty);
         }
 
-        if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags) &&
-            !test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags))
+        if (!test_bit(RFCOMM_TTY_OWNED, &dev->status))
                 tty_port_put(&dev->port);
 
         tty_port_put(&dev->port);
         return 0;
 }
 
+static int rfcomm_create_dev(struct sock *sk, void __user *arg)
+{
+        int ret;
+
+        mutex_lock(&rfcomm_ioctl_mutex);
+        ret = __rfcomm_create_dev(sk, arg);
+        mutex_unlock(&rfcomm_ioctl_mutex);
+
+        return ret;
+}
+
+static int rfcomm_release_dev(void __user *arg)
+{
+        int ret;
+
+        mutex_lock(&rfcomm_ioctl_mutex);
+        ret = __rfcomm_release_dev(arg);
+        mutex_unlock(&rfcomm_ioctl_mutex);
+
+        return ret;
+}
+
 static int rfcomm_get_dev_list(void __user *arg)
 {
         struct rfcomm_dev *dev;
@@ -497,7 +527,7 @@ static int rfcomm_get_dev_list(void __user *arg)
         spin_lock(&rfcomm_dev_lock);
 
         list_for_each_entry(dev, &rfcomm_dev_list, list) {
-                if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
+                if (!tty_port_get(&dev->port))
                         continue;
                 (di + n)->id      = dev->id;
                 (di + n)->flags   = dev->flags;
@@ -505,6 +535,7 @@ static int rfcomm_get_dev_list(void __user *arg)
                 (di + n)->channel = dev->channel;
                 bacpy(&(di + n)->src, &dev->src);
                 bacpy(&(di + n)->dst, &dev->dst);
+                tty_port_put(&dev->port);
                 if (++n >= dev_num)
                         break;
         }
@@ -601,9 +632,11 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
         BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
 
         dev->err = err;
-        wake_up_interruptible(&dev->conn_wait);
+        if (dlc->state == BT_CONNECTED) {
+                rfcomm_reparent_device(dev);
 
-        if (dlc->state == BT_CLOSED)
+                wake_up_interruptible(&dev->port.open_wait);
+        } else if (dlc->state == BT_CLOSED)
                 tty_port_tty_hangup(&dev->port, false);
 }
 
@@ -703,8 +736,10 @@ static int rfcomm_tty_install(struct tty_driver *driver, struct tty_struct *tty)
          * when the last process closes the tty. The behaviour is expected by
          * userspace.
          */
-        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
+        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
+                set_bit(RFCOMM_TTY_OWNED, &dev->status);
                 tty_port_put(&dev->port);
+        }
 
         return 0;
 }
@@ -750,7 +785,7 @@ static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, in
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
         struct rfcomm_dlc *dlc = dev->dlc;
         struct sk_buff *skb;
-        int err = 0, sent = 0, size;
+        int sent = 0, size;
 
         BT_DBG("tty %p count %d", tty, count);
 
@@ -758,7 +793,6 @@ static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, in
                 size = min_t(uint, count, dlc->mtu);
 
                 skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC);
-
                 if (!skb)
                         break;
 
@@ -766,32 +800,24 @@ static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, in
 
                 memcpy(skb_put(skb, size), buf + sent, size);
 
-                err = rfcomm_dlc_send(dlc, skb);
-                if (err < 0) {
-                        kfree_skb(skb);
-                        break;
-                }
+                rfcomm_dlc_send_noerror(dlc, skb);
 
                 sent  += size;
                 count -= size;
         }
 
-        return sent ? sent : err;
+        return sent;
 }
 
 static int rfcomm_tty_write_room(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        int room;
+        int room = 0;
 
-        BT_DBG("tty %p", tty);
-
-        if (!dev || !dev->dlc)
-                return 0;
+        if (dev && dev->dlc)
+                room = rfcomm_room(dev);
 
-        room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
-        if (room < 0)
-                room = 0;
+        BT_DBG("tty %p room %d", tty, room);
 
         return room;
 }
@@ -1125,7 +1151,7 @@ int __init rfcomm_init_ttys(void)
         rfcomm_tty_driver->subtype      = SERIAL_TYPE_NORMAL;
         rfcomm_tty_driver->flags        = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
         rfcomm_tty_driver->init_termios = tty_std_termios;
-        rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL | CLOCAL;
+        rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL;
         rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON;
         tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 24fa3964b3c8..c06dbd3938e8 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -676,20 +676,20 @@ static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
                 bacpy(&cp.bdaddr, &conn->dst);
                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
 
-                cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
-                cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
+                cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
+                cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
                 cp.content_format = cpu_to_le16(setting);
 
                 switch (setting & SCO_AIRMODE_MASK) {
                 case SCO_AIRMODE_TRANSP:
                         if (conn->pkt_type & ESCO_2EV3)
-                                cp.max_latency = __constant_cpu_to_le16(0x0008);
+                                cp.max_latency = cpu_to_le16(0x0008);
                         else
-                                cp.max_latency = __constant_cpu_to_le16(0x000D);
+                                cp.max_latency = cpu_to_le16(0x000D);
                         cp.retrans_effort = 0x02;
                         break;
                 case SCO_AIRMODE_CVSD:
-                        cp.max_latency = __constant_cpu_to_le16(0xffff);
+                        cp.max_latency = cpu_to_le16(0xffff);
                         cp.retrans_effort = 0xff;
                         break;
                 }
@@ -1024,7 +1024,7 @@ static void sco_conn_ready(struct sco_conn *conn)
                         sk->sk_state = BT_CONNECTED;
 
                 /* Wake up parent */
-                parent->sk_data_ready(parent, 1);
+                parent->sk_data_ready(parent);
 
                 bh_unlock_sock(parent);
 
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 45007362683b..dfb4e1161c10 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -35,14 +35,14 @@
 
 #define AUTH_REQ_MASK   0x07
 
-static inline void swap128(u8 src[16], u8 dst[16])
+static inline void swap128(const u8 src[16], u8 dst[16])
 {
         int i;
         for (i = 0; i < 16; i++)
                 dst[15 - i] = src[i];
 }
 
-static inline void swap56(u8 src[7], u8 dst[7])
+static inline void swap56(const u8 src[7], u8 dst[7])
 {
         int i;
         for (i = 0; i < 7; i++)
@@ -53,6 +53,7 @@ static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
 {
         struct blkcipher_desc desc;
         struct scatterlist sg;
+        uint8_t tmp[16], data[16];
         int err;
 
         if (tfm == NULL) {
@@ -63,21 +64,89 @@ static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
         desc.tfm = tfm;
         desc.flags = 0;
 
-        err = crypto_blkcipher_setkey(tfm, k, 16);
+        /* The most significant octet of key corresponds to k[0] */
+        swap128(k, tmp);
+
+        err = crypto_blkcipher_setkey(tfm, tmp, 16);
         if (err) {
                 BT_ERR("cipher setkey failed: %d", err);
                 return err;
         }
 
-        sg_init_one(&sg, r, 16);
+        /* Most significant octet of plaintextData corresponds to data[0] */
+        swap128(r, data);
+
+        sg_init_one(&sg, data, 16);
 
         err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
         if (err)
                 BT_ERR("Encrypt data error %d", err);
 
+        /* Most significant octet of encryptedData corresponds to data[0] */
+        swap128(data, r);
+
         return err;
 }
 
+static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
+{
+        u8 _res[16];
+        int err;
+
+        /* r' = padding || r */
+        memcpy(_res, r, 3);
+        memset(_res + 3, 0, 13);
+
+        err = smp_e(tfm, irk, _res);
+        if (err) {
+                BT_ERR("Encrypt error");
+                return err;
+        }
+
+        /* The output of the random address function ah is:
+         *      ah(h, r) = e(k, r') mod 2^24
+         * The output of the security function e is then truncated to 24 bits
+         * by taking the least significant 24 bits of the output of e as the
+         * result of ah.
+         */
+        memcpy(res, _res, 3);
+
+        return 0;
+}
+
+bool smp_irk_matches(struct crypto_blkcipher *tfm, u8 irk[16],
+                     bdaddr_t *bdaddr)
+{
+        u8 hash[3];
+        int err;
+
+        BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
+
+        err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
+        if (err)
+                return false;
+
+        return !memcmp(bdaddr->b, hash, 3);
+}
+
+int smp_generate_rpa(struct crypto_blkcipher *tfm, u8 irk[16], bdaddr_t *rpa)
+{
+        int err;
+
+        get_random_bytes(&rpa->b[3], 3);
+
+        rpa->b[5] &= 0x3f;      /* Clear two most significant bits */
+        rpa->b[5] |= 0x40;      /* Set second most significant bit */
+
+        err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
+        if (err < 0)
+                return err;
+
+        BT_DBG("RPA %pMR", rpa);
+
+        return 0;
+}
+
 static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
                   u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
                   u8 _rat, bdaddr_t *ra, u8 res[16])
@@ -88,16 +157,15 @@ static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
         memset(p1, 0, 16);
 
         /* p1 = pres || preq || _rat || _iat */
-        swap56(pres, p1);
-        swap56(preq, p1 + 7);
-        p1[14] = _rat;
-        p1[15] = _iat;
-
-        memset(p2, 0, 16);
+        p1[0] = _iat;
+        p1[1] = _rat;
+        memcpy(p1 + 2, preq, 7);
+        memcpy(p1 + 9, pres, 7);
 
         /* p2 = padding || ia || ra */
-        baswap((bdaddr_t *) (p2 + 4), ia);
-        baswap((bdaddr_t *) (p2 + 10), ra);
+        memcpy(p2, ra, 6);
+        memcpy(p2 + 6, ia, 6);
+        memset(p2 + 12, 0, 4);
 
         /* res = r XOR p1 */
         u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
@@ -126,8 +194,8 @@ static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
         int err;
 
         /* Just least significant octets from r1 and r2 are considered */
-        memcpy(_r, r1 + 8, 8);
-        memcpy(_r + 8, r2 + 8, 8);
+        memcpy(_r, r2, 8);
+        memcpy(_r + 8, r1, 8);
 
         err = smp_e(tfm, k, _r);
         if (err)
@@ -154,7 +222,7 @@ static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
 
         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
         lh->len = cpu_to_le16(sizeof(code) + dlen);
-        lh->cid = __constant_cpu_to_le16(L2CAP_CID_SMP);
+        lh->cid = cpu_to_le16(L2CAP_CID_SMP);
 
         memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
 
@@ -203,31 +271,45 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
                               struct smp_cmd_pairing *req,
                               struct smp_cmd_pairing *rsp, __u8 authreq)
 {
-        u8 dist_keys = 0;
+        struct smp_chan *smp = conn->smp_chan;
+        struct hci_conn *hcon = conn->hcon;
+        struct hci_dev *hdev = hcon->hdev;
+        u8 local_dist = 0, remote_dist = 0;
 
         if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
-                dist_keys = SMP_DIST_ENC_KEY;
+                local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
+                remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
                 authreq |= SMP_AUTH_BONDING;
         } else {
                 authreq &= ~SMP_AUTH_BONDING;
         }
 
+        if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
+                remote_dist |= SMP_DIST_ID_KEY;
+
+        if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
+                local_dist |= SMP_DIST_ID_KEY;
+
         if (rsp == NULL) {
                 req->io_capability = conn->hcon->io_capability;
                 req->oob_flag = SMP_OOB_NOT_PRESENT;
                 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
-                req->init_key_dist = 0;
-                req->resp_key_dist = dist_keys;
+                req->init_key_dist = local_dist;
+                req->resp_key_dist = remote_dist;
                 req->auth_req = (authreq & AUTH_REQ_MASK);
+
+                smp->remote_key_dist = remote_dist;
                 return;
         }
 
         rsp->io_capability = conn->hcon->io_capability;
         rsp->oob_flag = SMP_OOB_NOT_PRESENT;
         rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
-        rsp->init_key_dist = 0;
-        rsp->resp_key_dist = req->resp_key_dist & dist_keys;
+        rsp->init_key_dist = req->init_key_dist & remote_dist;
+        rsp->resp_key_dist = req->resp_key_dist & local_dist;
         rsp->auth_req = (authreq & AUTH_REQ_MASK);
+
+        smp->remote_key_dist = rsp->init_key_dist;
 }
 
 static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
@@ -305,6 +387,11 @@ static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
         if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
                 method = JUST_WORKS;
 
+        /* Don't confirm locally initiated pairing attempts */
+        if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR,
+                                           &smp->smp_flags))
+                method = JUST_WORKS;
+
         /* If Just Works, Continue with Zero TK */
         if (method == JUST_WORKS) {
                 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
@@ -325,16 +412,14 @@ static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
                         method = REQ_PASSKEY;
         }
 
-        /* Generate random passkey. Not valid until confirmed. */
+        /* Generate random passkey. */
         if (method == CFM_PASSKEY) {
-                u8 key[16];
-
-                memset(key, 0, sizeof(key));
+                memset(smp->tk, 0, sizeof(smp->tk));
                 get_random_bytes(&passkey, sizeof(passkey));
                 passkey %= 1000000;
-                put_unaligned_le32(passkey, key);
-                swap128(key, smp->tk);
+                put_unaligned_le32(passkey, smp->tk);
                 BT_DBG("PassKey: %d", passkey);
+                set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
         }
 
         hci_dev_lock(hcon->hdev);
@@ -342,10 +427,14 @@ static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
         if (method == REQ_PASSKEY)
                 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
                                                 hcon->type, hcon->dst_type);
-        else
+        else if (method == JUST_CFM)
                 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
                                                 hcon->type, hcon->dst_type,
-                                                cpu_to_le32(passkey), 0);
+                                                passkey, 1);
+        else
+                ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
+                                                hcon->type, hcon->dst_type,
+                                                passkey, 0);
 
         hci_dev_unlock(hcon->hdev);
 
@@ -356,29 +445,24 @@ static void confirm_work(struct work_struct *work)
 {
         struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
         struct l2cap_conn *conn = smp->conn;
-        struct crypto_blkcipher *tfm;
+        struct hci_dev *hdev = conn->hcon->hdev;
+        struct crypto_blkcipher *tfm = hdev->tfm_aes;
         struct smp_cmd_pairing_confirm cp;
         int ret;
-        u8 res[16], reason;
+        u8 reason;
 
         BT_DBG("conn %p", conn);
 
-        tfm = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(tfm)) {
-                reason = SMP_UNSPECIFIED;
-                goto error;
-        }
+        /* Prevent mutual access to hdev->tfm_aes */
+        hci_dev_lock(hdev);
 
-        smp->tfm = tfm;
+        ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
+                     conn->hcon->init_addr_type, &conn->hcon->init_addr,
+                     conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
+                     cp.confirm_val);
+
+        hci_dev_unlock(hdev);
 
-        if (conn->hcon->out)
-                ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
-                             conn->hcon->src_type, &conn->hcon->src,
-                             conn->hcon->dst_type, &conn->hcon->dst, res);
-        else
-                ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
-                             conn->hcon->dst_type, &conn->hcon->dst,
-                             conn->hcon->src_type, &conn->hcon->src, res);
         if (ret) {
                 reason = SMP_UNSPECIFIED;
                 goto error;
@@ -386,7 +470,6 @@ static void confirm_work(struct work_struct *work)
 
         clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
 
-        swap128(res, cp.confirm_val);
         smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
 
         return;
@@ -400,8 +483,9 @@ static void random_work(struct work_struct *work)
         struct smp_chan *smp = container_of(work, struct smp_chan, random);
         struct l2cap_conn *conn = smp->conn;
         struct hci_conn *hcon = conn->hcon;
-        struct crypto_blkcipher *tfm = smp->tfm;
-        u8 reason, confirm[16], res[16], key[16];
+        struct hci_dev *hdev = hcon->hdev;
+        struct crypto_blkcipher *tfm = hdev->tfm_aes;
+        u8 reason, confirm[16];
         int ret;
 
         if (IS_ERR_OR_NULL(tfm)) {
@@ -411,21 +495,20 @@ static void random_work(struct work_struct *work)
 
         BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
 
-        if (hcon->out)
-                ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
-                             hcon->src_type, &hcon->src,
-                             hcon->dst_type, &hcon->dst, res);
-        else
-                ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
-                             hcon->dst_type, &hcon->dst,
-                             hcon->src_type, &hcon->src, res);
+        /* Prevent mutual access to hdev->tfm_aes */
+        hci_dev_lock(hdev);
+
+        ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
+                     hcon->init_addr_type, &hcon->init_addr,
+                     hcon->resp_addr_type, &hcon->resp_addr, confirm);
+
+        hci_dev_unlock(hdev);
+
         if (ret) {
                 reason = SMP_UNSPECIFIED;
                 goto error;
         }
 
-        swap128(res, confirm);
-
         if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
                 BT_ERR("Pairing failed (confirmation values mismatch)");
                 reason = SMP_CONFIRM_FAILED;
@@ -433,14 +516,11 @@ static void random_work(struct work_struct *work)
         }
 
         if (hcon->out) {
-                u8 stk[16], rand[8];
-                __le16 ediv;
-
-                memset(rand, 0, sizeof(rand));
-                ediv = 0;
+                u8 stk[16];
+                __le64 rand = 0;
+                __le16 ediv = 0;
 
-                smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
-                swap128(key, stk);
+                smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, stk);
 
                 memset(stk + smp->enc_key_size, 0,
                        SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
@@ -453,23 +533,20 @@ static void random_work(struct work_struct *work)
                 hci_le_start_enc(hcon, ediv, rand, stk);
                 hcon->enc_key_size = smp->enc_key_size;
         } else {
-                u8 stk[16], r[16], rand[8];
-                __le16 ediv;
-
-                memset(rand, 0, sizeof(rand));
-                ediv = 0;
+                u8 stk[16];
+                __le64 rand = 0;
+                __le16 ediv = 0;
 
-                swap128(smp->prnd, r);
-                smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
+                smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
+                             smp->prnd);
 
-                smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
-                swap128(key, stk);
+                smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, stk);
 
                 memset(stk + smp->enc_key_size, 0,
                        SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
 
                 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
-                            HCI_SMP_STK_SLAVE, 0, 0, stk, smp->enc_key_size,
+                            HCI_SMP_STK_SLAVE, 0, stk, smp->enc_key_size,
                             ediv, rand);
         }
 
@@ -502,11 +579,33 @@ static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
 void smp_chan_destroy(struct l2cap_conn *conn)
 {
         struct smp_chan *smp = conn->smp_chan;
+        bool complete;
 
         BUG_ON(!smp);
 
-        if (smp->tfm)
-                crypto_free_blkcipher(smp->tfm);
+        complete = test_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
+        mgmt_smp_complete(conn->hcon, complete);
+
+        kfree(smp->csrk);
+        kfree(smp->slave_csrk);
+
+        /* If pairing failed clean up any keys we might have */
+        if (!complete) {
+                if (smp->ltk) {
+                        list_del(&smp->ltk->list);
+                        kfree(smp->ltk);
+                }
+
+                if (smp->slave_ltk) {
+                        list_del(&smp->slave_ltk->list);
+                        kfree(smp->slave_ltk);
+                }
+
+                if (smp->remote_irk) {
+                        list_del(&smp->remote_irk->list);
+                        kfree(smp->remote_irk);
+                }
+        }
 
         kfree(smp);
         conn->smp_chan = NULL;
@@ -519,7 +618,6 @@ int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
         struct l2cap_conn *conn = hcon->smp_conn;
         struct smp_chan *smp;
         u32 value;
-        u8 key[16];
 
         BT_DBG("");
 
@@ -531,10 +629,9 @@ int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
         switch (mgmt_op) {
         case MGMT_OP_USER_PASSKEY_REPLY:
                 value = le32_to_cpu(passkey);
-                memset(key, 0, sizeof(key));
+                memset(smp->tk, 0, sizeof(smp->tk));
                 BT_DBG("PassKey: %d", value);
-                put_unaligned_le32(value, key);
-                swap128(key, smp->tk);
+                put_unaligned_le32(value, smp->tk);
                 /* Fall Through */
         case MGMT_OP_USER_CONFIRM_REPLY:
                 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
@@ -565,6 +662,9 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
         BT_DBG("conn %p", conn);
 
+        if (skb->len < sizeof(*req))
+                return SMP_UNSPECIFIED;
+
         if (conn->hcon->link_mode & HCI_LM_MASTER)
                 return SMP_CMD_NOTSUPP;
 
@@ -604,6 +704,8 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
         if (ret)
                 return SMP_UNSPECIFIED;
 
+        clear_bit(SMP_FLAG_INITIATOR, &smp->smp_flags);
+
         return 0;
 }
 
@@ -617,6 +719,9 @@ static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
 
         BT_DBG("conn %p", conn);
 
+        if (skb->len < sizeof(*rsp))
+                return SMP_UNSPECIFIED;
+
         if (!(conn->hcon->link_mode & HCI_LM_MASTER))
                 return SMP_CMD_NOTSUPP;
 
@@ -633,6 +738,11 @@ static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
         smp->prsp[0] = SMP_CMD_PAIRING_RSP;
         memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
 
+        /* Update remote key distribution in case the remote cleared
+         * some bits that we had enabled in our request.
+         */
+        smp->remote_key_dist &= rsp->resp_key_dist;
+
         if ((req->auth_req & SMP_AUTH_BONDING) &&
             (rsp->auth_req & SMP_AUTH_BONDING))
                 auth = SMP_AUTH_BONDING;
@@ -646,10 +756,8 @@ static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
         set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
 
         /* Can't compose response until we have been confirmed */
-        if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
-                return 0;
-
-        queue_work(hdev->workqueue, &smp->confirm);
+        if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
+                queue_work(hdev->workqueue, &smp->confirm);
 
         return 0;
 }
@@ -661,20 +769,19 @@ static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
 
         BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
 
+        if (skb->len < sizeof(smp->pcnf))
+                return SMP_UNSPECIFIED;
+
         memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
         skb_pull(skb, sizeof(smp->pcnf));
 
-        if (conn->hcon->out) {
-                u8 random[16];
-
-                swap128(smp->prnd, random);
-                smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
-                             random);
-        } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
+        if (conn->hcon->out)
+                smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
+                             smp->prnd);
+        else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
                 queue_work(hdev->workqueue, &smp->confirm);
-        } else {
+        else
                 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
-        }
 
         return 0;
 }
@@ -686,7 +793,10 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
 
         BT_DBG("conn %p", conn);
 
-        swap128(skb->data, smp->rrnd);
+        if (skb->len < sizeof(smp->rrnd))
+                return SMP_UNSPECIFIED;
+
+        memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
         skb_pull(skb, sizeof(smp->rrnd));
 
         queue_work(hdev->workqueue, &smp->random);
@@ -699,7 +809,8 @@ static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
         struct smp_ltk *key;
         struct hci_conn *hcon = conn->hcon;
 
-        key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type);
+        key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
+                                   hcon->out);
         if (!key)
                 return 0;
 
@@ -724,6 +835,9 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
         BT_DBG("conn %p", conn);
 
+        if (skb->len < sizeof(*rp))
+                return SMP_UNSPECIFIED;
+
         if (!(conn->hcon->link_mode & HCI_LM_MASTER))
                 return SMP_CMD_NOTSUPP;
 
@@ -747,6 +861,8 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
         smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
 
+        clear_bit(SMP_FLAG_INITIATOR, &smp->smp_flags);
+
         return 0;
 }
 
@@ -764,11 +880,15 @@ bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
 int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
 {
         struct l2cap_conn *conn = hcon->l2cap_data;
-        struct smp_chan *smp = conn->smp_chan;
+        struct smp_chan *smp;
         __u8 authreq;
 
         BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
 
+        /* This may be NULL if there's an unexpected disconnection */
+        if (!conn)
+                return 1;
+
         if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
                 return 1;
 
@@ -788,6 +908,12 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
 
         authreq = seclevel_to_authreq(sec_level);
 
+        /* hcon->auth_type is set by pair_device in mgmt.c. If the MITM
+         * flag is set we should also set it for the SMP request.
+         */
+        if ((hcon->auth_type & 0x01))
+                authreq |= SMP_AUTH_MITM;
+
         if (hcon->link_mode & HCI_LM_MASTER) {
                 struct smp_cmd_pairing cp;
 
@@ -802,6 +928,8 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
                 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
         }
 
+        set_bit(SMP_FLAG_INITIATOR, &smp->smp_flags);
+
 done:
         hcon->pending_sec_level = sec_level;
 
@@ -813,6 +941,15 @@ static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
         struct smp_cmd_encrypt_info *rp = (void *) skb->data;
         struct smp_chan *smp = conn->smp_chan;
 
+        BT_DBG("conn %p", conn);
+
+        if (skb->len < sizeof(*rp))
+                return SMP_UNSPECIFIED;
+
+        /* Ignore this PDU if it wasn't requested */
+        if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
+                return 0;
+
         skb_pull(skb, sizeof(*rp));
 
         memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
@@ -826,16 +963,138 @@ static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
         struct smp_chan *smp = conn->smp_chan;
         struct hci_dev *hdev = conn->hcon->hdev;
         struct hci_conn *hcon = conn->hcon;
+        struct smp_ltk *ltk;
         u8 authenticated;
 
+        BT_DBG("conn %p", conn);
+
+        if (skb->len < sizeof(*rp))
+                return SMP_UNSPECIFIED;
+
+        /* Ignore this PDU if it wasn't requested */
+        if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
+                return 0;
+
+        /* Mark the information as received */
+        smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
+
         skb_pull(skb, sizeof(*rp));
 
         hci_dev_lock(hdev);
         authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
-        hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, HCI_SMP_LTK, 1,
-                    authenticated, smp->tk, smp->enc_key_size,
-                    rp->ediv, rp->rand);
-        smp_distribute_keys(conn, 1);
+        ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, HCI_SMP_LTK,
+                          authenticated, smp->tk, smp->enc_key_size,
+                          rp->ediv, rp->rand);
+        smp->ltk = ltk;
+        if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
+                smp_distribute_keys(conn);
+        hci_dev_unlock(hdev);
+
+        return 0;
+}
+
+static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        struct smp_cmd_ident_info *info = (void *) skb->data;
+        struct smp_chan *smp = conn->smp_chan;
+
+        BT_DBG("");
+
+        if (skb->len < sizeof(*info))
+                return SMP_UNSPECIFIED;
+
+        /* Ignore this PDU if it wasn't requested */
+        if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
+                return 0;
+
+        skb_pull(skb, sizeof(*info));
+
+        memcpy(smp->irk, info->irk, 16);
+
+        return 0;
+}
+
+static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
+                                   struct sk_buff *skb)
+{
+        struct smp_cmd_ident_addr_info *info = (void *) skb->data;
+        struct smp_chan *smp = conn->smp_chan;
+        struct hci_conn *hcon = conn->hcon;
+        bdaddr_t rpa;
+
+        BT_DBG("");
+
+        if (skb->len < sizeof(*info))
+                return SMP_UNSPECIFIED;
+
+        /* Ignore this PDU if it wasn't requested */
+        if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
+                return 0;
+
+        /* Mark the information as received */
+        smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
+
+        skb_pull(skb, sizeof(*info));
+
+        /* Strictly speaking the Core Specification (4.1) allows sending
+         * an empty address which would force us to rely on just the IRK
+         * as "identity information". However, since such
+         * implementations are not known of and in order to not over
+         * complicate our implementation, simply pretend that we never
+         * received an IRK for such a device.
+         */
+        if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
+                BT_ERR("Ignoring IRK with no identity address");
+                smp_distribute_keys(conn);
+                return 0;
+        }
+
+        bacpy(&smp->id_addr, &info->bdaddr);
+        smp->id_addr_type = info->addr_type;
+
+        if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
+                bacpy(&rpa, &hcon->dst);
+        else
+                bacpy(&rpa, BDADDR_ANY);
+
+        smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
+                                      smp->id_addr_type, smp->irk, &rpa);
+
+        smp_distribute_keys(conn);
+
+        return 0;
+}
+
+static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        struct smp_cmd_sign_info *rp = (void *) skb->data;
+        struct smp_chan *smp = conn->smp_chan;
+        struct hci_dev *hdev = conn->hcon->hdev;
+        struct smp_csrk *csrk;
+
+        BT_DBG("conn %p", conn);
+
+        if (skb->len < sizeof(*rp))
+                return SMP_UNSPECIFIED;
+
+        /* Ignore this PDU if it wasn't requested */
+        if (!(smp->remote_key_dist & SMP_DIST_SIGN))
+                return 0;
+
+        /* Mark the information as received */
+        smp->remote_key_dist &= ~SMP_DIST_SIGN;
+
+        skb_pull(skb, sizeof(*rp));
+
+        hci_dev_lock(hdev);
+        csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
+        if (csrk) {
+                csrk->master = 0x01;
+                memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
+        }
+        smp->csrk = csrk;
+        if (!(smp->remote_key_dist & SMP_DIST_SIGN))
+                smp_distribute_keys(conn);
         hci_dev_unlock(hdev);
 
         return 0;
@@ -915,10 +1174,15 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
                 break;
 
         case SMP_CMD_IDENT_INFO:
+                reason = smp_cmd_ident_info(conn, skb);
+                break;
+
         case SMP_CMD_IDENT_ADDR_INFO:
+                reason = smp_cmd_ident_addr_info(conn, skb);
+                break;
+
         case SMP_CMD_SIGN_INFO:
-                /* Just ignored */
-                reason = 0;
+                reason = smp_cmd_sign_info(conn, skb);
                 break;
 
         default:
@@ -937,26 +1201,78 @@ done:
         return err;
 }
 
-int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
+static void smp_notify_keys(struct l2cap_conn *conn)
+{
+        struct smp_chan *smp = conn->smp_chan;
+        struct hci_conn *hcon = conn->hcon;
+        struct hci_dev *hdev = hcon->hdev;
+        struct smp_cmd_pairing *req = (void *) &smp->preq[1];
+        struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
+        bool persistent;
+
+        if (smp->remote_irk) {
+                mgmt_new_irk(hdev, smp->remote_irk);
+                /* Now that user space can be considered to know the
+                 * identity address track the connection based on it
+                 * from now on.
+                 */
+                bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
+                hcon->dst_type = smp->remote_irk->addr_type;
+                l2cap_conn_update_id_addr(hcon);
+        }
+
+        /* The LTKs and CSRKs should be persistent only if both sides
+         * had the bonding bit set in their authentication requests.
+         */
+        persistent = !!((req->auth_req & rsp->auth_req) & SMP_AUTH_BONDING);
+
+        if (smp->csrk) {
+                smp->csrk->bdaddr_type = hcon->dst_type;
+                bacpy(&smp->csrk->bdaddr, &hcon->dst);
+                mgmt_new_csrk(hdev, smp->csrk, persistent);
+        }
+
+        if (smp->slave_csrk) {
+                smp->slave_csrk->bdaddr_type = hcon->dst_type;
+                bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
+                mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
+        }
+
+        if (smp->ltk) {
+                smp->ltk->bdaddr_type = hcon->dst_type;
+                bacpy(&smp->ltk->bdaddr, &hcon->dst);
+                mgmt_new_ltk(hdev, smp->ltk, persistent);
+        }
+
+        if (smp->slave_ltk) {
+                smp->slave_ltk->bdaddr_type = hcon->dst_type;
+                bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
+                mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
+        }
+}
+
+int smp_distribute_keys(struct l2cap_conn *conn)
 {
         struct smp_cmd_pairing *req, *rsp;
         struct smp_chan *smp = conn->smp_chan;
+        struct hci_conn *hcon = conn->hcon;
+        struct hci_dev *hdev = hcon->hdev;
         __u8 *keydist;
 
-        BT_DBG("conn %p force %d", conn, force);
+        BT_DBG("conn %p", conn);
 
-        if (!test_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
+        if (!test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
                 return 0;
 
         rsp = (void *) &smp->prsp[1];
 
         /* The responder sends its keys first */
-        if (!force && conn->hcon->out && (rsp->resp_key_dist & 0x07))
+        if (hcon->out && (smp->remote_key_dist & 0x07))
                 return 0;
 
         req = (void *) &smp->preq[1];
 
-        if (conn->hcon->out) {
+        if (hcon->out) {
                 keydist = &rsp->init_key_dist;
                 *keydist &= req->init_key_dist;
         } else {
@@ -964,28 +1280,30 @@ int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
                 *keydist &= req->resp_key_dist;
         }
 
-
         BT_DBG("keydist 0x%x", *keydist);
 
         if (*keydist & SMP_DIST_ENC_KEY) {
                 struct smp_cmd_encrypt_info enc;
                 struct smp_cmd_master_ident ident;
-                struct hci_conn *hcon = conn->hcon;
+                struct smp_ltk *ltk;
                 u8 authenticated;
                 __le16 ediv;
+                __le64 rand;
 
                 get_random_bytes(enc.ltk, sizeof(enc.ltk));
                 get_random_bytes(&ediv, sizeof(ediv));
-                get_random_bytes(ident.rand, sizeof(ident.rand));
+                get_random_bytes(&rand, sizeof(rand));
 
                 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
 
                 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
-                hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
-                            HCI_SMP_LTK_SLAVE, 1, authenticated,
-                            enc.ltk, smp->enc_key_size, ediv, ident.rand);
+                ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
+                                  HCI_SMP_LTK_SLAVE, authenticated, enc.ltk,
+                                  smp->enc_key_size, ediv, rand);
+                smp->slave_ltk = ltk;
 
                 ident.ediv = ediv;
+                ident.rand = rand;
 
                 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
 
@@ -996,14 +1314,18 @@ int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
                 struct smp_cmd_ident_addr_info addrinfo;
                 struct smp_cmd_ident_info idinfo;
 
-                /* Send a dummy key */
-                get_random_bytes(idinfo.irk, sizeof(idinfo.irk));
+                memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
 
                 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
 
-                /* Just public address */
-                memset(&addrinfo, 0, sizeof(addrinfo));
-                bacpy(&addrinfo.bdaddr, &conn->hcon->src);
+                /* The hci_conn contains the local identity address
+                 * after the connection has been established.
+                 *
+                 * This is true even when the connection has been
+                 * established using a resolvable random address.
+                 */
+                bacpy(&addrinfo.bdaddr, &hcon->src);
+                addrinfo.addr_type = hcon->src_type;
 
                 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
                              &addrinfo);
@@ -1013,20 +1335,33 @@ int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
 
         if (*keydist & SMP_DIST_SIGN) {
                 struct smp_cmd_sign_info sign;
+                struct smp_csrk *csrk;
 
-                /* Send a dummy key */
+                /* Generate a new random key */
                 get_random_bytes(sign.csrk, sizeof(sign.csrk));
 
+                csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
+                if (csrk) {
+                        csrk->master = 0x00;
+                        memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
+                }
+                smp->slave_csrk = csrk;
+
                 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
 
                 *keydist &= ~SMP_DIST_SIGN;
         }
 
-        if (conn->hcon->out || force) {
-                clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
-                cancel_delayed_work_sync(&conn->security_timer);
-                smp_chan_destroy(conn);
-        }
+        /* If there are still keys to be received wait for them */
+        if ((smp->remote_key_dist & 0x07))
+                return 0;
+
+        clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags);
+        cancel_delayed_work_sync(&conn->security_timer);
+        set_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
+        smp_notify_keys(conn);
+
+        smp_chan_destroy(conn);
 
         return 0;
 }
diff --git a/net/bluetooth/smp.h b/net/bluetooth/smp.h
index a700bcb490d7..1277147a9150 100644
--- a/net/bluetooth/smp.h
+++ b/net/bluetooth/smp.h
@@ -78,7 +78,7 @@ struct smp_cmd_encrypt_info {
 #define SMP_CMD_MASTER_IDENT    0x07
 struct smp_cmd_master_ident {
         __le16  ediv;
-        __u8    rand[8];
+        __le64  rand;
 } __packed;
 
 #define SMP_CMD_IDENT_INFO      0x08
@@ -118,6 +118,8 @@ struct smp_cmd_security_req {
 #define SMP_FLAG_TK_VALID       1
 #define SMP_FLAG_CFM_PENDING    2
 #define SMP_FLAG_MITM_AUTH      3
+#define SMP_FLAG_COMPLETE       4
+#define SMP_FLAG_INITIATOR      5
 
 struct smp_chan {
         struct l2cap_conn *conn;
@@ -128,20 +130,31 @@ struct smp_chan {
         u8              pcnf[16]; /* SMP Pairing Confirm */
         u8              tk[16]; /* SMP Temporary Key */
         u8              enc_key_size;
+        u8              remote_key_dist;
+        bdaddr_t        id_addr;
+        u8              id_addr_type;
+        u8              irk[16];
+        struct smp_csrk *csrk;
+        struct smp_csrk *slave_csrk;
+        struct smp_ltk  *ltk;
+        struct smp_ltk  *slave_ltk;
+        struct smp_irk  *remote_irk;
         unsigned long   smp_flags;
-        struct crypto_blkcipher *tfm;
         struct work_struct confirm;
         struct work_struct random;
-
 };
 
 /* SMP Commands */
 bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level);
 int smp_conn_security(struct hci_conn *hcon, __u8 sec_level);
 int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb);
-int smp_distribute_keys(struct l2cap_conn *conn, __u8 force);
+int smp_distribute_keys(struct l2cap_conn *conn);
 int smp_user_confirm_reply(struct hci_conn *conn, u16 mgmt_op, __le32 passkey);
 
 void smp_chan_destroy(struct l2cap_conn *conn);
 
+bool smp_irk_matches(struct crypto_blkcipher *tfm, u8 irk[16],
+                     bdaddr_t *bdaddr);
+int smp_generate_rpa(struct crypto_blkcipher *tfm, u8 irk[16], bdaddr_t *rpa);
+
 #endif /* __SMP_H */
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 8fe8b71b487a..3e2da2cb72db 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -88,18 +88,11 @@ out:
 static int br_dev_init(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
-        int i;
 
-        br->stats = alloc_percpu(struct pcpu_sw_netstats);
+        br->stats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!br->stats)
                 return -ENOMEM;
 
-        for_each_possible_cpu(i) {
-                struct pcpu_sw_netstats *br_dev_stats;
-                br_dev_stats = per_cpu_ptr(br->stats, i);
-                u64_stats_init(&br_dev_stats->syncp);
-        }
-
         return 0;
 }
 
@@ -143,9 +136,9 @@ static struct rtnl_link_stats64 *br_get_stats64(struct net_device *dev,
                 const struct pcpu_sw_netstats *bstats
                         = per_cpu_ptr(br->stats, cpu);
                 do {
-                        start = u64_stats_fetch_begin_bh(&bstats->syncp);
+                        start = u64_stats_fetch_begin_irq(&bstats->syncp);
                         memcpy(&tmp, bstats, sizeof(tmp));
-                } while (u64_stats_fetch_retry_bh(&bstats->syncp, start));
+                } while (u64_stats_fetch_retry_irq(&bstats->syncp, start));
                 sum.tx_bytes   += tmp.tx_bytes;
                 sum.tx_packets += tmp.tx_packets;
                 sum.rx_bytes   += tmp.rx_bytes;
@@ -225,16 +218,16 @@ static void br_netpoll_cleanup(struct net_device *dev)
                 br_netpoll_disable(p);
 }
 
-static int __br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp)
+static int __br_netpoll_enable(struct net_bridge_port *p)
 {
         struct netpoll *np;
         int err;
 
-        np = kzalloc(sizeof(*p->np), gfp);
+        np = kzalloc(sizeof(*p->np), GFP_KERNEL);
         if (!np)
                 return -ENOMEM;
 
-        err = __netpoll_setup(np, p->dev, gfp);
+        err = __netpoll_setup(np, p->dev);
         if (err) {
                 kfree(np);
                 return err;
@@ -244,16 +237,15 @@ static int __br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp)
         return err;
 }
 
-int br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp)
+int br_netpoll_enable(struct net_bridge_port *p)
 {
         if (!p->br->dev->npinfo)
                 return 0;
 
-        return __br_netpoll_enable(p, gfp);
+        return __br_netpoll_enable(p);
 }
 
-static int br_netpoll_setup(struct net_device *dev, struct netpoll_info *ni,
-                            gfp_t gfp)
+static int br_netpoll_setup(struct net_device *dev, struct netpoll_info *ni)
 {
         struct net_bridge *br = netdev_priv(dev);
         struct net_bridge_port *p;
@@ -262,7 +254,7 @@ static int br_netpoll_setup(struct net_device *dev, struct netpoll_info *ni,
         list_for_each_entry(p, &br->port_list, list) {
                 if (!p->dev)
                         continue;
-                err = __br_netpoll_enable(p, gfp);
+                err = __br_netpoll_enable(p);
                 if (err)
                         goto fail;
         }
@@ -374,7 +366,7 @@ void br_dev_setup(struct net_device *dev)
         br->bridge_id.prio[0] = 0x80;
         br->bridge_id.prio[1] = 0x00;
 
-        memcpy(br->group_addr, eth_reserved_addr_base, ETH_ALEN);
+        ether_addr_copy(br->group_addr, eth_reserved_addr_base);
 
         br->stp_enabled = BR_NO_STP;
         br->group_fwd_mask = BR_GROUPFWD_DEFAULT;
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index d3409e6b5453..056b67b0e277 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -35,16 +35,11 @@ static inline int should_deliver(const struct net_bridge_port *p,
                 p->state == BR_STATE_FORWARDING;
 }
 
-static inline unsigned int packet_length(const struct sk_buff *skb)
-{
-        return skb->len - (skb->protocol == htons(ETH_P_8021Q) ? VLAN_HLEN : 0);
-}
-
 int br_dev_queue_push_xmit(struct sk_buff *skb)
 {
         /* ip_fragment doesn't copy the MAC header */
         if (nf_bridge_maybe_copy_header(skb) ||
-            (packet_length(skb) > skb->dev->mtu && !skb_is_gso(skb))) {
+            !is_skb_forwardable(skb->dev, skb)) {
                 kfree_skb(skb);
         } else {
                 skb_push(skb, ETH_HLEN);
@@ -71,7 +66,7 @@ static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
         skb->dev = to->dev;
 
         if (unlikely(netpoll_tx_running(to->br->dev))) {
-                if (packet_length(skb) > skb->dev->mtu && !skb_is_gso(skb))
+                if (!is_skb_forwardable(skb->dev, skb))
                         kfree_skb(skb);
                 else {
                         skb_push(skb, ETH_HLEN);
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 54d207d3a31c..5262b8617eb9 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -366,7 +366,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
         if (err)
                 goto err2;
 
-        err = br_netpoll_enable(p, GFP_KERNEL);
+        err = br_netpoll_enable(p);
         if (err)
                 goto err3;
 
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index d0cca3c65f01..7985deaff52f 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -73,7 +73,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
                 goto drop;
 
         if (!br_allowed_ingress(p->br, nbp_get_vlan_info(p), skb, &vid))
-                goto drop;
+                goto out;
 
         /* insert into forwarding database after filtering to avoid spoofing */
         br = p->br;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 93067ecdb9a2..7b757b5dc773 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -363,7 +363,7 @@ static struct sk_buff *br_ip4_multicast_alloc_query(struct net_bridge *br,
         skb_reset_mac_header(skb);
         eth = eth_hdr(skb);
 
-        memcpy(eth->h_source, br->dev->dev_addr, ETH_ALEN);
+        ether_addr_copy(eth->h_source, br->dev->dev_addr);
         eth->h_dest[0] = 1;
         eth->h_dest[1] = 0;
         eth->h_dest[2] = 0x5e;
@@ -433,7 +433,7 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
         skb_reset_mac_header(skb);
         eth = eth_hdr(skb);
 
-        memcpy(eth->h_source, br->dev->dev_addr, ETH_ALEN);
+        ether_addr_copy(eth->h_source, br->dev->dev_addr);
         eth->h_proto = htons(ETH_P_IPV6);
         skb_put(skb, sizeof(*eth));
 
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index b008c59a92c4..80e1b0f60a30 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -167,7 +167,7 @@ void br_netfilter_rtable_init(struct net_bridge *br)
         rt->dst.dev = br->dev;
         rt->dst.path = &rt->dst;
         dst_init_metrics(&rt->dst, br_dst_default_metrics, true);
-        rt->dst.flags   = DST_NOXFRM | DST_NOPEER | DST_FAKE_RTABLE;
+        rt->dst.flags   = DST_NOXFRM | DST_FAKE_RTABLE;
         rt->dst.ops = &fake_dst_ops;
 }
 
@@ -506,7 +506,7 @@ bridged_dnat:
                                                1);
                                 return 0;
                         }
-                        memcpy(eth_hdr(skb)->h_dest, dev->dev_addr, ETH_ALEN);
+                        ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
                         skb->pkt_type = PACKET_HOST;
                 }
         } else {
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 3ba11bc99b65..06811d79f89f 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -46,12 +46,12 @@ typedef __u16 port_id;
 struct bridge_id
 {
         unsigned char   prio[2];
-        unsigned char   addr[6];
+        unsigned char   addr[ETH_ALEN];
 };
 
 struct mac_addr
 {
-        unsigned char   addr[6];
+        unsigned char   addr[ETH_ALEN];
 };
 
 struct br_ip
@@ -349,7 +349,7 @@ static inline void br_netpoll_send_skb(const struct net_bridge_port *p,
                 netpoll_send_skb(np, skb);
 }
 
-int br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp);
+int br_netpoll_enable(struct net_bridge_port *p);
 void br_netpoll_disable(struct net_bridge_port *p);
 #else
 static inline void br_netpoll_send_skb(const struct net_bridge_port *p,
@@ -357,7 +357,7 @@ static inline void br_netpoll_send_skb(const struct net_bridge_port *p,
 {
 }
 
-static inline int br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp)
+static inline int br_netpoll_enable(struct net_bridge_port *p)
 {
         return 0;
 }
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index f23c74b3a953..4a3716102789 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -99,9 +99,9 @@ static int __vlan_del(struct net_port_vlans *v, u16 vid)
         v->num_vlans--;
         if (bitmap_empty(v->vlan_bitmap, VLAN_N_VID)) {
                 if (v->port_idx)
-                        rcu_assign_pointer(v->parent.port->vlan_info, NULL);
+                        RCU_INIT_POINTER(v->parent.port->vlan_info, NULL);
                 else
-                        rcu_assign_pointer(v->parent.br->vlan_info, NULL);
+                        RCU_INIT_POINTER(v->parent.br->vlan_info, NULL);
                 kfree_rcu(v, rcu);
         }
         return 0;
@@ -113,9 +113,9 @@ static void __vlan_flush(struct net_port_vlans *v)
         v->pvid = 0;
         bitmap_zero(v->vlan_bitmap, VLAN_N_VID);
         if (v->port_idx)
-                rcu_assign_pointer(v->parent.port->vlan_info, NULL);
+                RCU_INIT_POINTER(v->parent.port->vlan_info, NULL);
         else
-                rcu_assign_pointer(v->parent.br->vlan_info, NULL);
+                RCU_INIT_POINTER(v->parent.br->vlan_info, NULL);
         kfree_rcu(v, rcu);
 }
 
@@ -170,7 +170,7 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
          * rejected.
          */
         if (!v)
-                return false;
+                goto drop;
 
         /* If vlan tx offload is disabled on bridge device and frame was
          * sent from vlan device on the bridge device, it does not have
@@ -193,7 +193,7 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
                  * vlan untagged or priority-tagged traffic belongs to.
                  */
                 if (pvid == VLAN_N_VID)
-                        return false;
+                        goto drop;
 
                 /* PVID is set on this port.  Any untagged or priority-tagged
                  * ingress frame is considered to belong to this vlan.
@@ -216,7 +216,8 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
         /* Frame had a valid vlan tag.  See if vlan is allowed */
         if (test_bit(*vid, v->vlan_bitmap))
                 return true;
-
+drop:
+        kfree_skb(skb);
         return false;
 }
 
diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c
index 3fb3c848affe..9024283d2bca 100644
--- a/net/bridge/netfilter/ebt_among.c
+++ b/net/bridge/netfilter/ebt_among.c
@@ -28,7 +28,7 @@ static bool ebt_mac_wormhash_contains(const struct ebt_mac_wormhash *wh,
         uint32_t cmp[2] = { 0, 0 };
         int key = ((const unsigned char *)mac)[5];
 
-        memcpy(((char *) cmp) + 2, mac, ETH_ALEN);
+        ether_addr_copy(((char *) cmp) + 2, mac);
         start = wh->table[key];
         limit = wh->table[key + 1];
         if (ip) {
diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index c59f7bfae6e2..4e0b0c359325 100644
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -22,7 +22,7 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
         if (!skb_make_writable(skb, 0))
                 return EBT_DROP;
 
-        memcpy(eth_hdr(skb)->h_dest, info->mac, ETH_ALEN);
+        ether_addr_copy(eth_hdr(skb)->h_dest, info->mac);
         return info->target;
 }
 
diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
index 46624bb6d9be..203964997a51 100644
--- a/net/bridge/netfilter/ebt_redirect.c
+++ b/net/bridge/netfilter/ebt_redirect.c
@@ -25,10 +25,10 @@ ebt_redirect_tg(struct sk_buff *skb, const struct xt_action_param *par)
 
         if (par->hooknum != NF_BR_BROUTING)
                 /* rcu_read_lock()ed by nf_hook_slow */
-                memcpy(eth_hdr(skb)->h_dest,
-                       br_port_get_rcu(par->in)->br->dev->dev_addr, ETH_ALEN);
+                ether_addr_copy(eth_hdr(skb)->h_dest,
+                                br_port_get_rcu(par->in)->br->dev->dev_addr);
         else
-                memcpy(eth_hdr(skb)->h_dest, par->in->dev_addr, ETH_ALEN);
+                ether_addr_copy(eth_hdr(skb)->h_dest, par->in->dev_addr);
         skb->pkt_type = PACKET_HOST;
         return info->target;
 }
diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
index 0f6b118d6cb2..e56ccd060d26 100644
--- a/net/bridge/netfilter/ebt_snat.c
+++ b/net/bridge/netfilter/ebt_snat.c
@@ -24,7 +24,7 @@ ebt_snat_tg(struct sk_buff *skb, const struct xt_action_param *par)
         if (!skb_make_writable(skb, 0))
                 return EBT_DROP;
 
-        memcpy(eth_hdr(skb)->h_source, info->mac, ETH_ALEN);
+        ether_addr_copy(eth_hdr(skb)->h_source, info->mac);
         if (!(info->target & NAT_ARP_BIT) &&
             eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) {
                 const struct arphdr *ap;
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 0e474b13463b..1059ed3bc255 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1044,10 +1044,9 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,
         if (repl->num_counters &&
            copy_to_user(repl->counters, counterstmp,
            repl->num_counters * sizeof(struct ebt_counter))) {
-                ret = -EFAULT;
+                /* Silent error, can't fail, new table is already in place */
+                net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");
         }
-        else
-                ret = 0;
 
         /* decrease module count and free resources */
         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index d6be3edb7a43..e8437094d15f 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -124,7 +124,6 @@ static void caif_flow_ctrl(struct sock *sk, int mode)
 static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         int err;
-        int skb_len;
         unsigned long flags;
         struct sk_buff_head *list = &sk->sk_receive_queue;
         struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
@@ -153,14 +152,13 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
          * may be freed by other threads of control pulling packets
          * from the queue.
          */
-        skb_len = skb->len;
         spin_lock_irqsave(&list->lock, flags);
         if (!sock_flag(sk, SOCK_DEAD))
                 __skb_queue_tail(list, skb);
         spin_unlock_irqrestore(&list->lock, flags);
 
         if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk, skb_len);
+                sk->sk_data_ready(sk);
         else
                 kfree_skb(skb);
         return 0;
diff --git a/net/ceph/crush/mapper.c b/net/ceph/crush/mapper.c
index b703790b4e44..a1ef53c04415 100644
--- a/net/ceph/crush/mapper.c
+++ b/net/ceph/crush/mapper.c
@@ -292,10 +292,12 @@ static int is_out(const struct crush_map *map,
  * @outpos: our position in that vector
  * @tries: number of attempts to make
  * @recurse_tries: number of attempts to have recursive chooseleaf make
- * @local_tries: localized retries
- * @local_fallback_tries: localized fallback retries
+ * @local_retries: localized retries
+ * @local_fallback_retries: localized fallback retries
  * @recurse_to_leaf: true if we want one device under each item of given type (chooseleaf instead of choose)
+ * @vary_r: pass r to recursive calls
  * @out2: second output vector for leaf items (if @recurse_to_leaf)
+ * @parent_r: r value passed from the parent
  */
 static int crush_choose_firstn(const struct crush_map *map,
                                struct crush_bucket *bucket,
@@ -304,10 +306,12 @@ static int crush_choose_firstn(const struct crush_map *map,
                                int *out, int outpos,
                                unsigned int tries,
                                unsigned int recurse_tries,
-                               unsigned int local_tries,
-                               unsigned int local_fallback_tries,
+                               unsigned int local_retries,
+                               unsigned int local_fallback_retries,
                                int recurse_to_leaf,
-                               int *out2)
+                               unsigned int vary_r,
+                               int *out2,
+                               int parent_r)
 {
         int rep;
         unsigned int ftotal, flocal;
@@ -319,8 +323,11 @@ static int crush_choose_firstn(const struct crush_map *map,
         int itemtype;
         int collide, reject;
 
-        dprintk("CHOOSE%s bucket %d x %d outpos %d numrep %d\n", recurse_to_leaf ? "_LEAF" : "",
-                bucket->id, x, outpos, numrep);
+        dprintk("CHOOSE%s bucket %d x %d outpos %d numrep %d tries %d recurse_tries %d local_retries %d local_fallback_retries %d parent_r %d\n",
+                recurse_to_leaf ? "_LEAF" : "",
+                bucket->id, x, outpos, numrep,
+                tries, recurse_tries, local_retries, local_fallback_retries,
+                parent_r);
 
         for (rep = outpos; rep < numrep; rep++) {
                 /* keep trying until we get a non-out, non-colliding item */
@@ -335,7 +342,7 @@ static int crush_choose_firstn(const struct crush_map *map,
                         do {
                                 collide = 0;
                                 retry_bucket = 0;
-                                r = rep;
+                                r = rep + parent_r;
                                 /* r' = r + f_total */
                                 r += ftotal;
 
@@ -344,9 +351,9 @@ static int crush_choose_firstn(const struct crush_map *map,
                                         reject = 1;
                                         goto reject;
                                 }
-                                if (local_fallback_tries > 0 &&
+                                if (local_fallback_retries > 0 &&
                                     flocal >= (in->size>>1) &&
-                                    flocal > local_fallback_tries)
+                                    flocal > local_fallback_retries)
                                         item = bucket_perm_choose(in, x, r);
                                 else
                                         item = crush_bucket_choose(in, x, r);
@@ -387,16 +394,23 @@ static int crush_choose_firstn(const struct crush_map *map,
                                 reject = 0;
                                 if (!collide && recurse_to_leaf) {
                                         if (item < 0) {
+                                                int sub_r;
+                                                if (vary_r)
+                                                        sub_r = r >> (vary_r-1);
+                                                else
+                                                        sub_r = 0;
                                                 if (crush_choose_firstn(map,
                                                          map->buckets[-1-item],
                                                          weight, weight_max,
                                                          x, outpos+1, 0,
                                                          out2, outpos,
                                                          recurse_tries, 0,
-                                                         local_tries,
-                                                         local_fallback_tries,
+                                                         local_retries,
+                                                         local_fallback_retries,
                                                          0,
-                                                         NULL) <= outpos)
+                                                         vary_r,
+                                                         NULL,
+                                                         sub_r) <= outpos)
                                                         /* didn't get leaf */
                                                         reject = 1;
                                         } else {
@@ -420,14 +434,14 @@ reject:
                                         ftotal++;
                                         flocal++;
 
-                                        if (collide && flocal <= local_tries)
+                                        if (collide && flocal <= local_retries)
                                                 /* retry locally a few times */
                                                 retry_bucket = 1;
-                                        else if (local_fallback_tries > 0 &&
-                                                 flocal <= in->size + local_fallback_tries)
+                                        else if (local_fallback_retries > 0 &&
+                                                 flocal <= in->size + local_fallback_retries)
                                                 /* exhaustive bucket search */
                                                 retry_bucket = 1;
-                                        else if (ftotal <= tries)
+                                        else if (ftotal < tries)
                                                 /* then retry descent */
                                                 retry_descent = 1;
                                         else
@@ -640,10 +654,20 @@ int crush_do_rule(const struct crush_map *map,
         __u32 step;
         int i, j;
         int numrep;
-        int choose_tries = map->choose_total_tries;
-        int choose_local_tries = map->choose_local_tries;
-        int choose_local_fallback_tries = map->choose_local_fallback_tries;
+        /*
+         * the original choose_total_tries value was off by one (it
+         * counted "retries" and not "tries").  add one.
+         */
+        int choose_tries = map->choose_total_tries + 1;
         int choose_leaf_tries = 0;
+        /*
+         * the local tries values were counted as "retries", though,
+         * and need no adjustment
+         */
+        int choose_local_retries = map->choose_local_tries;
+        int choose_local_fallback_retries = map->choose_local_fallback_tries;
+
+        int vary_r = map->chooseleaf_vary_r;
 
         if ((__u32)ruleno >= map->max_rules) {
                 dprintk(" bad ruleno %d\n", ruleno);
@@ -676,13 +700,18 @@ int crush_do_rule(const struct crush_map *map,
                         break;
 
                 case CRUSH_RULE_SET_CHOOSE_LOCAL_TRIES:
-                        if (curstep->arg1 > 0)
-                                choose_local_tries = curstep->arg1;
+                        if (curstep->arg1 >= 0)
+                                choose_local_retries = curstep->arg1;
                         break;
 
                 case CRUSH_RULE_SET_CHOOSE_LOCAL_FALLBACK_TRIES:
-                        if (curstep->arg1 > 0)
-                                choose_local_fallback_tries = curstep->arg1;
+                        if (curstep->arg1 >= 0)
+                                choose_local_fallback_retries = curstep->arg1;
+                        break;
+
+                case CRUSH_RULE_SET_CHOOSELEAF_VARY_R:
+                        if (curstep->arg1 >= 0)
+                                vary_r = curstep->arg1;
                         break;
 
                 case CRUSH_RULE_CHOOSELEAF_FIRSTN:
@@ -734,10 +763,12 @@ int crush_do_rule(const struct crush_map *map,
                                                 o+osize, j,
                                                 choose_tries,
                                                 recurse_tries,
-                                                choose_local_tries,
-                                                choose_local_fallback_tries,
+                                                choose_local_retries,
+                                                choose_local_fallback_retries,
                                                 recurse_to_leaf,
-                                                c+osize);
+                                                vary_r,
+                                                c+osize,
+                                                0);
                                 } else {
                                         crush_choose_indep(
                                                 map,
diff --git a/net/ceph/debugfs.c b/net/ceph/debugfs.c
index 258a382e75ed..10421a4b76f8 100644
--- a/net/ceph/debugfs.c
+++ b/net/ceph/debugfs.c
@@ -53,34 +53,55 @@ static int osdmap_show(struct seq_file *s, void *p)
 {
         int i;
         struct ceph_client *client = s->private;
+        struct ceph_osdmap *map = client->osdc.osdmap;
         struct rb_node *n;
 
-        if (client->osdc.osdmap == NULL)
+        if (map == NULL)
                 return 0;
-        seq_printf(s, "epoch %d\n", client->osdc.osdmap->epoch);
+
+        seq_printf(s, "epoch %d\n", map->epoch);
         seq_printf(s, "flags%s%s\n",
-                   (client->osdc.osdmap->flags & CEPH_OSDMAP_NEARFULL) ?
-                   " NEARFULL" : "",
-                   (client->osdc.osdmap->flags & CEPH_OSDMAP_FULL) ?
-                   " FULL" : "");
-        for (n = rb_first(&client->osdc.osdmap->pg_pools); n; n = rb_next(n)) {
+                   (map->flags & CEPH_OSDMAP_NEARFULL) ?  " NEARFULL" : "",
+                   (map->flags & CEPH_OSDMAP_FULL) ?  " FULL" : "");
+
+        for (n = rb_first(&map->pg_pools); n; n = rb_next(n)) {
                 struct ceph_pg_pool_info *pool =
                         rb_entry(n, struct ceph_pg_pool_info, node);
-                seq_printf(s, "pg_pool %llu pg_num %d / %d\n",
-                           (unsigned long long)pool->id, pool->pg_num,
-                           pool->pg_num_mask);
+
+                seq_printf(s, "pool %lld pg_num %u (%d) read_tier %lld write_tier %lld\n",
+                           pool->id, pool->pg_num, pool->pg_num_mask,
+                           pool->read_tier, pool->write_tier);
         }
-        for (i = 0; i < client->osdc.osdmap->max_osd; i++) {
-                struct ceph_entity_addr *addr =
-                        &client->osdc.osdmap->osd_addr[i];
-                int state = client->osdc.osdmap->osd_state[i];
+        for (i = 0; i < map->max_osd; i++) {
+                struct ceph_entity_addr *addr = &map->osd_addr[i];
+                int state = map->osd_state[i];
                 char sb[64];
 
-                seq_printf(s, "\tosd%d\t%s\t%3d%%\t(%s)\n",
+                seq_printf(s, "osd%d\t%s\t%3d%%\t(%s)\t%3d%%\n",
                            i, ceph_pr_addr(&addr->in_addr),
-                           ((client->osdc.osdmap->osd_weight[i]*100) >> 16),
-                           ceph_osdmap_state_str(sb, sizeof(sb), state));
+                           ((map->osd_weight[i]*100) >> 16),
+                           ceph_osdmap_state_str(sb, sizeof(sb), state),
+                           ((ceph_get_primary_affinity(map, i)*100) >> 16));
+        }
+        for (n = rb_first(&map->pg_temp); n; n = rb_next(n)) {
+                struct ceph_pg_mapping *pg =
+                        rb_entry(n, struct ceph_pg_mapping, node);
+
+                seq_printf(s, "pg_temp %llu.%x [", pg->pgid.pool,
+                           pg->pgid.seed);
+                for (i = 0; i < pg->pg_temp.len; i++)
+                        seq_printf(s, "%s%d", (i == 0 ? "" : ","),
+                                   pg->pg_temp.osds[i]);
+                seq_printf(s, "]\n");
         }
+        for (n = rb_first(&map->primary_temp); n; n = rb_next(n)) {
+                struct ceph_pg_mapping *pg =
+                        rb_entry(n, struct ceph_pg_mapping, node);
+
+                seq_printf(s, "primary_temp %llu.%x %d\n", pg->pgid.pool,
+                           pg->pgid.seed, pg->primary_temp.osd);
+        }
+
         return 0;
 }
 
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 30efc5c18622..dac7f9b98687 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -383,7 +383,7 @@ static void con_sock_state_closed(struct ceph_connection *con)
  */
 
 /* data available on socket, or listen socket received a connect */
-static void ceph_sock_data_ready(struct sock *sk, int count_unused)
+static void ceph_sock_data_ready(struct sock *sk)
 {
         struct ceph_connection *con = sk->sk_user_data;
         if (atomic_read(&con->msgr->stopping)) {
@@ -919,6 +919,9 @@ static bool ceph_msg_data_pages_advance(struct ceph_msg_data_cursor *cursor,
         if (!bytes || cursor->page_offset)
                 return false;   /* more bytes to process in the current page */
 
+        if (!cursor->resid)
+                return false;   /* no more data */
+
         /* Move on to the next page; offset is already at 0 */
 
         BUG_ON(cursor->page_index >= cursor->page_count);
@@ -1004,6 +1007,9 @@ static bool ceph_msg_data_pagelist_advance(struct ceph_msg_data_cursor *cursor,
         if (!bytes || cursor->offset & ~PAGE_MASK)
                 return false;   /* more bytes to process in the current page */
 
+        if (!cursor->resid)
+                return false;   /* no more data */
+
         /* Move on to the next page */
 
         BUG_ON(list_is_last(&cursor->page->lru, &pagelist->head));
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 0676f2b199d6..b0dfce77656a 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -436,6 +436,7 @@ static bool osd_req_opcode_valid(u16 opcode)
         case CEPH_OSD_OP_OMAPCLEAR:
         case CEPH_OSD_OP_OMAPRMKEYS:
         case CEPH_OSD_OP_OMAP_CMP:
+        case CEPH_OSD_OP_SETALLOCHINT:
         case CEPH_OSD_OP_CLONERANGE:
         case CEPH_OSD_OP_ASSERT_SRC_VERSION:
         case CEPH_OSD_OP_SRC_CMPXATTR:
@@ -591,6 +592,26 @@ void osd_req_op_watch_init(struct ceph_osd_request *osd_req,
 }
 EXPORT_SYMBOL(osd_req_op_watch_init);
 
+void osd_req_op_alloc_hint_init(struct ceph_osd_request *osd_req,
+                                unsigned int which,
+                                u64 expected_object_size,
+                                u64 expected_write_size)
+{
+        struct ceph_osd_req_op *op = _osd_req_op_init(osd_req, which,
+                                                      CEPH_OSD_OP_SETALLOCHINT);
+
+        op->alloc_hint.expected_object_size = expected_object_size;
+        op->alloc_hint.expected_write_size = expected_write_size;
+
+        /*
+         * CEPH_OSD_OP_SETALLOCHINT op is advisory and therefore deemed
+         * not worth a feature bit.  Set FAILOK per-op flag to make
+         * sure older osds don't trip over an unsupported opcode.
+         */
+        op->flags |= CEPH_OSD_OP_FLAG_FAILOK;
+}
+EXPORT_SYMBOL(osd_req_op_alloc_hint_init);
+
 static void ceph_osdc_msg_data_add(struct ceph_msg *msg,
                                 struct ceph_osd_data *osd_data)
 {
@@ -681,6 +702,12 @@ static u64 osd_req_encode_op(struct ceph_osd_request *req,
                 dst->watch.ver = cpu_to_le64(src->watch.ver);
                 dst->watch.flag = src->watch.flag;
                 break;
+        case CEPH_OSD_OP_SETALLOCHINT:
+                dst->alloc_hint.expected_object_size =
+                    cpu_to_le64(src->alloc_hint.expected_object_size);
+                dst->alloc_hint.expected_write_size =
+                    cpu_to_le64(src->alloc_hint.expected_write_size);
+                break;
         default:
                 pr_err("unsupported osd opcode %s\n",
                         ceph_osd_op_name(src->op));
@@ -688,7 +715,9 @@ static u64 osd_req_encode_op(struct ceph_osd_request *req,
 
                 return 0;
         }
+
         dst->op = cpu_to_le16(src->op);
+        dst->flags = cpu_to_le32(src->flags);
         dst->payload_len = cpu_to_le32(src->payload_len);
 
         return request_data_len;
@@ -1304,7 +1333,7 @@ static int __map_request(struct ceph_osd_client *osdc,
 {
         struct ceph_pg pgid;
         int acting[CEPH_PG_MAX_SIZE];
-        int o = -1, num = 0;
+        int num, o;
         int err;
         bool was_paused;
 
@@ -1317,11 +1346,9 @@ static int __map_request(struct ceph_osd_client *osdc,
         }
         req->r_pgid = pgid;
 
-        err = ceph_calc_pg_acting(osdc->osdmap, pgid, acting);
-        if (err > 0) {
-                o = acting[0];
-                num = err;
-        }
+        num = ceph_calc_pg_acting(osdc->osdmap, pgid, acting, &o);
+        if (num < 0)
+                num = 0;
 
         was_paused = req->r_paused;
         req->r_paused = __req_should_be_paused(osdc, req);
@@ -2033,7 +2060,7 @@ void ceph_osdc_handle_map(struct ceph_osd_client *osdc, struct ceph_msg *msg)
                         int skipped_map = 0;
 
                         dout("taking full map %u len %d\n", epoch, maplen);
-                        newmap = osdmap_decode(&p, p+maplen);
+                        newmap = ceph_osdmap_decode(&p, p+maplen);
                         if (IS_ERR(newmap)) {
                                 err = PTR_ERR(newmap);
                                 goto bad;
@@ -2082,7 +2109,6 @@ bad:
         pr_err("osdc handle_map corrupt msg\n");
         ceph_msg_dump(msg);
         up_write(&osdc->map_sem);
-        return;
 }
 
 /*
@@ -2281,7 +2307,6 @@ done_err:
 
 bad:
         pr_err("osdc handle_watch_notify corrupt msg\n");
-        return;
 }
 
 /*
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index aade4a5c1c07..e632b5a52f5b 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -343,7 +343,7 @@ bad:
 
 /*
  * rbtree of pg_mapping for handling pg_temp (explicit mapping of pgid
- * to a set of osds)
+ * to a set of osds) and primary_temp (explicit primary setting)
  */
 static int pgid_cmp(struct ceph_pg l, struct ceph_pg r)
 {
@@ -506,7 +506,7 @@ static void __remove_pg_pool(struct rb_root *root, struct ceph_pg_pool_info *pi)
         kfree(pi);
 }
 
-static int __decode_pool(void **p, void *end, struct ceph_pg_pool_info *pi)
+static int decode_pool(void **p, void *end, struct ceph_pg_pool_info *pi)
 {
         u8 ev, cv;
         unsigned len, num;
@@ -587,7 +587,7 @@ bad:
         return -EINVAL;
 }
 
-static int __decode_pool_names(void **p, void *end, struct ceph_osdmap *map)
+static int decode_pool_names(void **p, void *end, struct ceph_osdmap *map)
 {
         struct ceph_pg_pool_info *pi;
         u32 num, len;
@@ -633,6 +633,13 @@ void ceph_osdmap_destroy(struct ceph_osdmap *map)
                 rb_erase(&pg->node, &map->pg_temp);
                 kfree(pg);
         }
+        while (!RB_EMPTY_ROOT(&map->primary_temp)) {
+                struct ceph_pg_mapping *pg =
+                        rb_entry(rb_first(&map->primary_temp),
+                                 struct ceph_pg_mapping, node);
+                rb_erase(&pg->node, &map->primary_temp);
+                kfree(pg);
+        }
         while (!RB_EMPTY_ROOT(&map->pg_pools)) {
                 struct ceph_pg_pool_info *pi =
                         rb_entry(rb_first(&map->pg_pools),
@@ -642,186 +649,516 @@ void ceph_osdmap_destroy(struct ceph_osdmap *map)
         kfree(map->osd_state);
         kfree(map->osd_weight);
         kfree(map->osd_addr);
+        kfree(map->osd_primary_affinity);
         kfree(map);
 }
 
 /*
- * adjust max osd value.  reallocate arrays.
+ * Adjust max_osd value, (re)allocate arrays.
+ *
+ * The new elements are properly initialized.
  */
 static int osdmap_set_max_osd(struct ceph_osdmap *map, int max)
 {
         u8 *state;
-        struct ceph_entity_addr *addr;
         u32 *weight;
+        struct ceph_entity_addr *addr;
+        int i;
 
-        state = kcalloc(max, sizeof(*state), GFP_NOFS);
-        addr = kcalloc(max, sizeof(*addr), GFP_NOFS);
-        weight = kcalloc(max, sizeof(*weight), GFP_NOFS);
-        if (state == NULL || addr == NULL || weight == NULL) {
+        state = krealloc(map->osd_state, max*sizeof(*state), GFP_NOFS);
+        weight = krealloc(map->osd_weight, max*sizeof(*weight), GFP_NOFS);
+        addr = krealloc(map->osd_addr, max*sizeof(*addr), GFP_NOFS);
+        if (!state || !weight || !addr) {
                 kfree(state);
-                kfree(addr);
                 kfree(weight);
+                kfree(addr);
+
                 return -ENOMEM;
         }
 
-        /* copy old? */
-        if (map->osd_state) {
-                memcpy(state, map->osd_state, map->max_osd*sizeof(*state));
-                memcpy(addr, map->osd_addr, map->max_osd*sizeof(*addr));
-                memcpy(weight, map->osd_weight, map->max_osd*sizeof(*weight));
-                kfree(map->osd_state);
-                kfree(map->osd_addr);
-                kfree(map->osd_weight);
+        for (i = map->max_osd; i < max; i++) {
+                state[i] = 0;
+                weight[i] = CEPH_OSD_OUT;
+                memset(addr + i, 0, sizeof(*addr));
         }
 
         map->osd_state = state;
         map->osd_weight = weight;
         map->osd_addr = addr;
+
+        if (map->osd_primary_affinity) {
+                u32 *affinity;
+
+                affinity = krealloc(map->osd_primary_affinity,
+                                    max*sizeof(*affinity), GFP_NOFS);
+                if (!affinity)
+                        return -ENOMEM;
+
+                for (i = map->max_osd; i < max; i++)
+                        affinity[i] = CEPH_OSD_DEFAULT_PRIMARY_AFFINITY;
+
+                map->osd_primary_affinity = affinity;
+        }
+
         map->max_osd = max;
+
         return 0;
 }
 
+#define OSDMAP_WRAPPER_COMPAT_VER       7
+#define OSDMAP_CLIENT_DATA_COMPAT_VER   1
+
 /*
- * decode a full map.
+ * Return 0 or error.  On success, *v is set to 0 for old (v6) osdmaps,
+ * to struct_v of the client_data section for new (v7 and above)
+ * osdmaps.
  */
-struct ceph_osdmap *osdmap_decode(void **p, void *end)
+static int get_osdmap_client_data_v(void **p, void *end,
+                                    const char *prefix, u8 *v)
 {
-        struct ceph_osdmap *map;
-        u16 version;
-        u32 len, max, i;
-        int err = -EINVAL;
-        void *start = *p;
-        struct ceph_pg_pool_info *pi;
+        u8 struct_v;
+
+        ceph_decode_8_safe(p, end, struct_v, e_inval);
+        if (struct_v >= 7) {
+                u8 struct_compat;
+
+                ceph_decode_8_safe(p, end, struct_compat, e_inval);
+                if (struct_compat > OSDMAP_WRAPPER_COMPAT_VER) {
+                        pr_warning("got v %d cv %d > %d of %s ceph_osdmap\n",
+                                   struct_v, struct_compat,
+                                   OSDMAP_WRAPPER_COMPAT_VER, prefix);
+                        return -EINVAL;
+                }
+                *p += 4; /* ignore wrapper struct_len */
+
+                ceph_decode_8_safe(p, end, struct_v, e_inval);
+                ceph_decode_8_safe(p, end, struct_compat, e_inval);
+                if (struct_compat > OSDMAP_CLIENT_DATA_COMPAT_VER) {
+                        pr_warning("got v %d cv %d > %d of %s ceph_osdmap client data\n",
+                                   struct_v, struct_compat,
+                                   OSDMAP_CLIENT_DATA_COMPAT_VER, prefix);
+                        return -EINVAL;
+                }
+                *p += 4; /* ignore client data struct_len */
+        } else {
+                u16 version;
+
+                *p -= 1;
+                ceph_decode_16_safe(p, end, version, e_inval);
+                if (version < 6) {
+                        pr_warning("got v %d < 6 of %s ceph_osdmap\n", version,
+                                   prefix);
+                        return -EINVAL;
+                }
 
-        dout("osdmap_decode %p to %p len %d\n", *p, end, (int)(end - *p));
+                /* old osdmap enconding */
+                struct_v = 0;
+        }
 
-        map = kzalloc(sizeof(*map), GFP_NOFS);
-        if (map == NULL)
-                return ERR_PTR(-ENOMEM);
-        map->pg_temp = RB_ROOT;
+        *v = struct_v;
+        return 0;
 
-        ceph_decode_16_safe(p, end, version, bad);
-        if (version > 6) {
-                pr_warning("got unknown v %d > 6 of osdmap\n", version);
-                goto bad;
+e_inval:
+        return -EINVAL;
+}
+
+static int __decode_pools(void **p, void *end, struct ceph_osdmap *map,
+                          bool incremental)
+{
+        u32 n;
+
+        ceph_decode_32_safe(p, end, n, e_inval);
+        while (n--) {
+                struct ceph_pg_pool_info *pi;
+                u64 pool;
+                int ret;
+
+                ceph_decode_64_safe(p, end, pool, e_inval);
+
+                pi = __lookup_pg_pool(&map->pg_pools, pool);
+                if (!incremental || !pi) {
+                        pi = kzalloc(sizeof(*pi), GFP_NOFS);
+                        if (!pi)
+                                return -ENOMEM;
+
+                        pi->id = pool;
+
+                        ret = __insert_pg_pool(&map->pg_pools, pi);
+                        if (ret) {
+                                kfree(pi);
+                                return ret;
+                        }
+                }
+
+                ret = decode_pool(p, end, pi);
+                if (ret)
+                        return ret;
         }
-        if (version < 6) {
-                pr_warning("got old v %d < 6 of osdmap\n", version);
-                goto bad;
+
+        return 0;
+
+e_inval:
+        return -EINVAL;
+}
+
+static int decode_pools(void **p, void *end, struct ceph_osdmap *map)
+{
+        return __decode_pools(p, end, map, false);
+}
+
+static int decode_new_pools(void **p, void *end, struct ceph_osdmap *map)
+{
+        return __decode_pools(p, end, map, true);
+}
+
+static int __decode_pg_temp(void **p, void *end, struct ceph_osdmap *map,
+                            bool incremental)
+{
+        u32 n;
+
+        ceph_decode_32_safe(p, end, n, e_inval);
+        while (n--) {
+                struct ceph_pg pgid;
+                u32 len, i;
+                int ret;
+
+                ret = ceph_decode_pgid(p, end, &pgid);
+                if (ret)
+                        return ret;
+
+                ceph_decode_32_safe(p, end, len, e_inval);
+
+                ret = __remove_pg_mapping(&map->pg_temp, pgid);
+                BUG_ON(!incremental && ret != -ENOENT);
+
+                if (!incremental || len > 0) {
+                        struct ceph_pg_mapping *pg;
+
+                        ceph_decode_need(p, end, len*sizeof(u32), e_inval);
+
+                        if (len > (UINT_MAX - sizeof(*pg)) / sizeof(u32))
+                                return -EINVAL;
+
+                        pg = kzalloc(sizeof(*pg) + len*sizeof(u32), GFP_NOFS);
+                        if (!pg)
+                                return -ENOMEM;
+
+                        pg->pgid = pgid;
+                        pg->pg_temp.len = len;
+                        for (i = 0; i < len; i++)
+                                pg->pg_temp.osds[i] = ceph_decode_32(p);
+
+                        ret = __insert_pg_mapping(pg, &map->pg_temp);
+                        if (ret) {
+                                kfree(pg);
+                                return ret;
+                        }
+                }
         }
 
-        ceph_decode_need(p, end, 2*sizeof(u64)+6*sizeof(u32), bad);
+        return 0;
+
+e_inval:
+        return -EINVAL;
+}
+
+static int decode_pg_temp(void **p, void *end, struct ceph_osdmap *map)
+{
+        return __decode_pg_temp(p, end, map, false);
+}
+
+static int decode_new_pg_temp(void **p, void *end, struct ceph_osdmap *map)
+{
+        return __decode_pg_temp(p, end, map, true);
+}
+
+static int __decode_primary_temp(void **p, void *end, struct ceph_osdmap *map,
+                                 bool incremental)
+{
+        u32 n;
+
+        ceph_decode_32_safe(p, end, n, e_inval);
+        while (n--) {
+                struct ceph_pg pgid;
+                u32 osd;
+                int ret;
+
+                ret = ceph_decode_pgid(p, end, &pgid);
+                if (ret)
+                        return ret;
+
+                ceph_decode_32_safe(p, end, osd, e_inval);
+
+                ret = __remove_pg_mapping(&map->primary_temp, pgid);
+                BUG_ON(!incremental && ret != -ENOENT);
+
+                if (!incremental || osd != (u32)-1) {
+                        struct ceph_pg_mapping *pg;
+
+                        pg = kzalloc(sizeof(*pg), GFP_NOFS);
+                        if (!pg)
+                                return -ENOMEM;
+
+                        pg->pgid = pgid;
+                        pg->primary_temp.osd = osd;
+
+                        ret = __insert_pg_mapping(pg, &map->primary_temp);
+                        if (ret) {
+                                kfree(pg);
+                                return ret;
+                        }
+                }
+        }
+
+        return 0;
+
+e_inval:
+        return -EINVAL;
+}
+
+static int decode_primary_temp(void **p, void *end, struct ceph_osdmap *map)
+{
+        return __decode_primary_temp(p, end, map, false);
+}
+
+static int decode_new_primary_temp(void **p, void *end,
+                                   struct ceph_osdmap *map)
+{
+        return __decode_primary_temp(p, end, map, true);
+}
+
+u32 ceph_get_primary_affinity(struct ceph_osdmap *map, int osd)
+{
+        BUG_ON(osd >= map->max_osd);
+
+        if (!map->osd_primary_affinity)
+                return CEPH_OSD_DEFAULT_PRIMARY_AFFINITY;
+
+        return map->osd_primary_affinity[osd];
+}
+
+static int set_primary_affinity(struct ceph_osdmap *map, int osd, u32 aff)
+{
+        BUG_ON(osd >= map->max_osd);
+
+        if (!map->osd_primary_affinity) {
+                int i;
+
+                map->osd_primary_affinity = kmalloc(map->max_osd*sizeof(u32),
+                                                    GFP_NOFS);
+                if (!map->osd_primary_affinity)
+                        return -ENOMEM;
+
+                for (i = 0; i < map->max_osd; i++)
+                        map->osd_primary_affinity[i] =
+                            CEPH_OSD_DEFAULT_PRIMARY_AFFINITY;
+        }
+
+        map->osd_primary_affinity[osd] = aff;
+
+        return 0;
+}
+
+static int decode_primary_affinity(void **p, void *end,
+                                   struct ceph_osdmap *map)
+{
+        u32 len, i;
+
+        ceph_decode_32_safe(p, end, len, e_inval);
+        if (len == 0) {
+                kfree(map->osd_primary_affinity);
+                map->osd_primary_affinity = NULL;
+                return 0;
+        }
+        if (len != map->max_osd)
+                goto e_inval;
+
+        ceph_decode_need(p, end, map->max_osd*sizeof(u32), e_inval);
+
+        for (i = 0; i < map->max_osd; i++) {
+                int ret;
+
+                ret = set_primary_affinity(map, i, ceph_decode_32(p));
+                if (ret)
+                        return ret;
+        }
+
+        return 0;
+
+e_inval:
+        return -EINVAL;
+}
+
+static int decode_new_primary_affinity(void **p, void *end,
+                                       struct ceph_osdmap *map)
+{
+        u32 n;
+
+        ceph_decode_32_safe(p, end, n, e_inval);
+        while (n--) {
+                u32 osd, aff;
+                int ret;
+
+                ceph_decode_32_safe(p, end, osd, e_inval);
+                ceph_decode_32_safe(p, end, aff, e_inval);
+
+                ret = set_primary_affinity(map, osd, aff);
+                if (ret)
+                        return ret;
+
+                pr_info("osd%d primary-affinity 0x%x\n", osd, aff);
+        }
+
+        return 0;
+
+e_inval:
+        return -EINVAL;
+}
+
+/*
+ * decode a full map.
+ */
+static int osdmap_decode(void **p, void *end, struct ceph_osdmap *map)
+{
+        u8 struct_v;
+        u32 epoch = 0;
+        void *start = *p;
+        u32 max;
+        u32 len, i;
+        int err;
+
+        dout("%s %p to %p len %d\n", __func__, *p, end, (int)(end - *p));
+
+        err = get_osdmap_client_data_v(p, end, "full", &struct_v);
+        if (err)
+                goto bad;
+
+        /* fsid, epoch, created, modified */
+        ceph_decode_need(p, end, sizeof(map->fsid) + sizeof(u32) +
+                         sizeof(map->created) + sizeof(map->modified), e_inval);
         ceph_decode_copy(p, &map->fsid, sizeof(map->fsid));
-        map->epoch = ceph_decode_32(p);
+        epoch = map->epoch = ceph_decode_32(p);
         ceph_decode_copy(p, &map->created, sizeof(map->created));
         ceph_decode_copy(p, &map->modified, sizeof(map->modified));
 
-        ceph_decode_32_safe(p, end, max, bad);
-        while (max--) {
-                ceph_decode_need(p, end, 8 + 2, bad);
-                err = -ENOMEM;
-                pi = kzalloc(sizeof(*pi), GFP_NOFS);
-                if (!pi)
-                        goto bad;
-                pi->id = ceph_decode_64(p);
-                err = __decode_pool(p, end, pi);
-                if (err < 0) {
-                        kfree(pi);
-                        goto bad;
-                }
-                __insert_pg_pool(&map->pg_pools, pi);
-        }
+        /* pools */
+        err = decode_pools(p, end, map);
+        if (err)
+                goto bad;
 
-        err = __decode_pool_names(p, end, map);
-        if (err < 0) {
-                dout("fail to decode pool names");
+        /* pool_name */
+        err = decode_pool_names(p, end, map);
+        if (err)
                 goto bad;
-        }
 
-        ceph_decode_32_safe(p, end, map->pool_max, bad);
+        ceph_decode_32_safe(p, end, map->pool_max, e_inval);
 
-        ceph_decode_32_safe(p, end, map->flags, bad);
+        ceph_decode_32_safe(p, end, map->flags, e_inval);
 
-        max = ceph_decode_32(p);
+        /* max_osd */
+        ceph_decode_32_safe(p, end, max, e_inval);
 
         /* (re)alloc osd arrays */
         err = osdmap_set_max_osd(map, max);
-        if (err < 0)
+        if (err)
                 goto bad;
-        dout("osdmap_decode max_osd = %d\n", map->max_osd);
 
-        /* osds */
-        err = -EINVAL;
+        /* osd_state, osd_weight, osd_addrs->client_addr */
         ceph_decode_need(p, end, 3*sizeof(u32) +
                          map->max_osd*(1 + sizeof(*map->osd_weight) +
-                                       sizeof(*map->osd_addr)), bad);
-        *p += 4; /* skip length field (should match max) */
+                                       sizeof(*map->osd_addr)), e_inval);
+
+        if (ceph_decode_32(p) != map->max_osd)
+                goto e_inval;
+
         ceph_decode_copy(p, map->osd_state, map->max_osd);
 
-        *p += 4; /* skip length field (should match max) */
+        if (ceph_decode_32(p) != map->max_osd)
+                goto e_inval;
+
         for (i = 0; i < map->max_osd; i++)
                 map->osd_weight[i] = ceph_decode_32(p);
 
-        *p += 4; /* skip length field (should match max) */
+        if (ceph_decode_32(p) != map->max_osd)
+                goto e_inval;
+
         ceph_decode_copy(p, map->osd_addr, map->max_osd*sizeof(*map->osd_addr));
         for (i = 0; i < map->max_osd; i++)
                 ceph_decode_addr(&map->osd_addr[i]);
 
         /* pg_temp */
-        ceph_decode_32_safe(p, end, len, bad);
-        for (i = 0; i < len; i++) {
-                int n, j;
-                struct ceph_pg pgid;
-                struct ceph_pg_mapping *pg;
+        err = decode_pg_temp(p, end, map);
+        if (err)
+                goto bad;
 
-                err = ceph_decode_pgid(p, end, &pgid);
+        /* primary_temp */
+        if (struct_v >= 1) {
+                err = decode_primary_temp(p, end, map);
                 if (err)
                         goto bad;
-                ceph_decode_need(p, end, sizeof(u32), bad);
-                n = ceph_decode_32(p);
-                err = -EINVAL;
-                if (n > (UINT_MAX - sizeof(*pg)) / sizeof(u32))
-                        goto bad;
-                ceph_decode_need(p, end, n * sizeof(u32), bad);
-                err = -ENOMEM;
-                pg = kmalloc(sizeof(*pg) + n*sizeof(u32), GFP_NOFS);
-                if (!pg)
-                        goto bad;
-                pg->pgid = pgid;
-                pg->len = n;
-                for (j = 0; j < n; j++)
-                        pg->osds[j] = ceph_decode_32(p);
+        }
 
-                err = __insert_pg_mapping(pg, &map->pg_temp);
+        /* primary_affinity */
+        if (struct_v >= 2) {
+                err = decode_primary_affinity(p, end, map);
                 if (err)
                         goto bad;
-                dout(" added pg_temp %lld.%x len %d\n", pgid.pool, pgid.seed,
-                     len);
+        } else {
+                /* XXX can this happen? */
+                kfree(map->osd_primary_affinity);
+                map->osd_primary_affinity = NULL;
         }
 
         /* crush */
-        ceph_decode_32_safe(p, end, len, bad);
-        dout("osdmap_decode crush len %d from off 0x%x\n", len,
-             (int)(*p - start));
-        ceph_decode_need(p, end, len, bad);
-        map->crush = crush_decode(*p, end);
-        *p += len;
+        ceph_decode_32_safe(p, end, len, e_inval);
+        map->crush = crush_decode(*p, min(*p + len, end));
         if (IS_ERR(map->crush)) {
                 err = PTR_ERR(map->crush);
                 map->crush = NULL;
                 goto bad;
         }
+        *p += len;
 
-        /* ignore the rest of the map */
+        /* ignore the rest */
         *p = end;
 
-        dout("osdmap_decode done %p %p\n", *p, end);
-        return map;
+        dout("full osdmap epoch %d max_osd %d\n", map->epoch, map->max_osd);
+        return 0;
 
+e_inval:
+        err = -EINVAL;
 bad:
-        dout("osdmap_decode fail err %d\n", err);
-        ceph_osdmap_destroy(map);
-        return ERR_PTR(err);
+        pr_err("corrupt full osdmap (%d) epoch %d off %d (%p of %p-%p)\n",
+               err, epoch, (int)(*p - start), *p, start, end);
+        print_hex_dump(KERN_DEBUG, "osdmap: ",
+                       DUMP_PREFIX_OFFSET, 16, 1,
+                       start, end - start, true);
+        return err;
+}
+
+/*
+ * Allocate and decode a full map.
+ */
+struct ceph_osdmap *ceph_osdmap_decode(void **p, void *end)
+{
+        struct ceph_osdmap *map;
+        int ret;
+
+        map = kzalloc(sizeof(*map), GFP_NOFS);
+        if (!map)
+                return ERR_PTR(-ENOMEM);
+
+        map->pg_temp = RB_ROOT;
+        map->primary_temp = RB_ROOT;
+        mutex_init(&map->crush_scratch_mutex);
+
+        ret = osdmap_decode(p, end, map);
+        if (ret) {
+                ceph_osdmap_destroy(map);
+                return ERR_PTR(ret);
+        }
+
+        return map;
 }
 
 /*
@@ -840,17 +1177,18 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
         __s64 new_pool_max;
         __s32 new_flags, max;
         void *start = *p;
-        int err = -EINVAL;
-        u16 version;
+        int err;
+        u8 struct_v;
+
+        dout("%s %p to %p len %d\n", __func__, *p, end, (int)(end - *p));
 
-        ceph_decode_16_safe(p, end, version, bad);
-        if (version != 6) {
-                pr_warning("got unknown v %d != 6 of inc osdmap\n", version);
+        err = get_osdmap_client_data_v(p, end, "inc", &struct_v);
+        if (err)
                 goto bad;
-        }
 
-        ceph_decode_need(p, end, sizeof(fsid)+sizeof(modified)+2*sizeof(u32),
-                         bad);
+        /* fsid, epoch, modified, new_pool_max, new_flags */
+        ceph_decode_need(p, end, sizeof(fsid) + sizeof(u32) + sizeof(modified) +
+                         sizeof(u64) + sizeof(u32), e_inval);
         ceph_decode_copy(p, &fsid, sizeof(fsid));
         epoch = ceph_decode_32(p);
         BUG_ON(epoch != map->epoch+1);
@@ -859,21 +1197,22 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
         new_flags = ceph_decode_32(p);
 
         /* full map? */
-        ceph_decode_32_safe(p, end, len, bad);
+        ceph_decode_32_safe(p, end, len, e_inval);
         if (len > 0) {
                 dout("apply_incremental full map len %d, %p to %p\n",
                      len, *p, end);
-                return osdmap_decode(p, min(*p+len, end));
+                return ceph_osdmap_decode(p, min(*p+len, end));
         }
 
         /* new crush? */
-        ceph_decode_32_safe(p, end, len, bad);
+        ceph_decode_32_safe(p, end, len, e_inval);
         if (len > 0) {
-                dout("apply_incremental new crush map len %d, %p to %p\n",
-                     len, *p, end);
                 newcrush = crush_decode(*p, min(*p+len, end));
-                if (IS_ERR(newcrush))
-                        return ERR_CAST(newcrush);
+                if (IS_ERR(newcrush)) {
+                        err = PTR_ERR(newcrush);
+                        newcrush = NULL;
+                        goto bad;
+                }
                 *p += len;
         }
 
@@ -883,13 +1222,11 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
         if (new_pool_max >= 0)
                 map->pool_max = new_pool_max;
 
-        ceph_decode_need(p, end, 5*sizeof(u32), bad);
-
         /* new max? */
-        max = ceph_decode_32(p);
+        ceph_decode_32_safe(p, end, max, e_inval);
         if (max >= 0) {
                 err = osdmap_set_max_osd(map, max);
-                if (err < 0)
+                if (err)
                         goto bad;
         }
 
@@ -902,51 +1239,34 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                 newcrush = NULL;
         }
 
-        /* new_pool */
-        ceph_decode_32_safe(p, end, len, bad);
-        while (len--) {
-                struct ceph_pg_pool_info *pi;
+        /* new_pools */
+        err = decode_new_pools(p, end, map);
+        if (err)
+                goto bad;
 
-                ceph_decode_64_safe(p, end, pool, bad);
-                pi = __lookup_pg_pool(&map->pg_pools, pool);
-                if (!pi) {
-                        pi = kzalloc(sizeof(*pi), GFP_NOFS);
-                        if (!pi) {
-                                err = -ENOMEM;
-                                goto bad;
-                        }
-                        pi->id = pool;
-                        __insert_pg_pool(&map->pg_pools, pi);
-                }
-                err = __decode_pool(p, end, pi);
-                if (err < 0)
-                        goto bad;
-        }
-        if (version >= 5) {
-                err = __decode_pool_names(p, end, map);
-                if (err < 0)
-                        goto bad;
-        }
+        /* new_pool_names */
+        err = decode_pool_names(p, end, map);
+        if (err)
+                goto bad;
 
         /* old_pool */
-        ceph_decode_32_safe(p, end, len, bad);
+        ceph_decode_32_safe(p, end, len, e_inval);
         while (len--) {
                 struct ceph_pg_pool_info *pi;
 
-                ceph_decode_64_safe(p, end, pool, bad);
+                ceph_decode_64_safe(p, end, pool, e_inval);
                 pi = __lookup_pg_pool(&map->pg_pools, pool);
                 if (pi)
                         __remove_pg_pool(&map->pg_pools, pi);
         }
 
         /* new_up */
-        err = -EINVAL;
-        ceph_decode_32_safe(p, end, len, bad);
+        ceph_decode_32_safe(p, end, len, e_inval);
         while (len--) {
                 u32 osd;
                 struct ceph_entity_addr addr;
-                ceph_decode_32_safe(p, end, osd, bad);
-                ceph_decode_copy_safe(p, end, &addr, sizeof(addr), bad);
+                ceph_decode_32_safe(p, end, osd, e_inval);
+                ceph_decode_copy_safe(p, end, &addr, sizeof(addr), e_inval);
                 ceph_decode_addr(&addr);
                 pr_info("osd%d up\n", osd);
                 BUG_ON(osd >= map->max_osd);
@@ -955,11 +1275,11 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
         }
 
         /* new_state */
-        ceph_decode_32_safe(p, end, len, bad);
+        ceph_decode_32_safe(p, end, len, e_inval);
         while (len--) {
                 u32 osd;
                 u8 xorstate;
-                ceph_decode_32_safe(p, end, osd, bad);
+                ceph_decode_32_safe(p, end, osd, e_inval);
                 xorstate = **(u8 **)p;
                 (*p)++;  /* clean flag */
                 if (xorstate == 0)
@@ -971,10 +1291,10 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
         }
 
         /* new_weight */
-        ceph_decode_32_safe(p, end, len, bad);
+        ceph_decode_32_safe(p, end, len, e_inval);
         while (len--) {
                 u32 osd, off;
-                ceph_decode_need(p, end, sizeof(u32)*2, bad);
+                ceph_decode_need(p, end, sizeof(u32)*2, e_inval);
                 osd = ceph_decode_32(p);
                 off = ceph_decode_32(p);
                 pr_info("osd%d weight 0x%x %s\n", osd, off,
@@ -985,56 +1305,35 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
         }
 
         /* new_pg_temp */
-        ceph_decode_32_safe(p, end, len, bad);
-        while (len--) {
-                struct ceph_pg_mapping *pg;
-                int j;
-                struct ceph_pg pgid;
-                u32 pglen;
+        err = decode_new_pg_temp(p, end, map);
+        if (err)
+                goto bad;
 
-                err = ceph_decode_pgid(p, end, &pgid);
+        /* new_primary_temp */
+        if (struct_v >= 1) {
+                err = decode_new_primary_temp(p, end, map);
                 if (err)
                         goto bad;
-                ceph_decode_need(p, end, sizeof(u32), bad);
-                pglen = ceph_decode_32(p);
-                if (pglen) {
-                        ceph_decode_need(p, end, pglen*sizeof(u32), bad);
-
-                        /* removing existing (if any) */
-                        (void) __remove_pg_mapping(&map->pg_temp, pgid);
+        }
 
-                        /* insert */
-                        err = -EINVAL;
-                        if (pglen > (UINT_MAX - sizeof(*pg)) / sizeof(u32))
-                                goto bad;
-                        err = -ENOMEM;
-                        pg = kmalloc(sizeof(*pg) + sizeof(u32)*pglen, GFP_NOFS);
-                        if (!pg)
-                                goto bad;
-                        pg->pgid = pgid;
-                        pg->len = pglen;
-                        for (j = 0; j < pglen; j++)
-                                pg->osds[j] = ceph_decode_32(p);
-                        err = __insert_pg_mapping(pg, &map->pg_temp);
-                        if (err) {
-                                kfree(pg);
-                                goto bad;
-                        }
-                        dout(" added pg_temp %lld.%x len %d\n", pgid.pool,
-                             pgid.seed, pglen);
-                } else {
-                        /* remove */
-                        __remove_pg_mapping(&map->pg_temp, pgid);
-                }
+        /* new_primary_affinity */
+        if (struct_v >= 2) {
+                err = decode_new_primary_affinity(p, end, map);
+                if (err)
+                        goto bad;
         }
 
         /* ignore the rest */
         *p = end;
+
+        dout("inc osdmap epoch %d max_osd %d\n", map->epoch, map->max_osd);
         return map;
 
+e_inval:
+        err = -EINVAL;
 bad:
-        pr_err("corrupt inc osdmap epoch %d off %d (%p of %p-%p)\n",
-               epoch, (int)(*p - start), *p, start, end);
+        pr_err("corrupt inc osdmap (%d) epoch %d off %d (%p of %p-%p)\n",
+               err, epoch, (int)(*p - start), *p, start, end);
         print_hex_dump(KERN_DEBUG, "osdmap: ",
                        DUMP_PREFIX_OFFSET, 16, 1,
                        start, end - start, true);
@@ -1142,61 +1441,249 @@ int ceph_oloc_oid_to_pg(struct ceph_osdmap *osdmap,
 }
 EXPORT_SYMBOL(ceph_oloc_oid_to_pg);
 
-static int crush_do_rule_ary(const struct crush_map *map, int ruleno, int x,
-                             int *result, int result_max,
-                             const __u32 *weight, int weight_max)
+static int do_crush(struct ceph_osdmap *map, int ruleno, int x,
+                    int *result, int result_max,
+                    const __u32 *weight, int weight_max)
 {
-        int scratch[result_max * 3];
+        int r;
 
-        return crush_do_rule(map, ruleno, x, result, result_max,
-                             weight, weight_max, scratch);
+        BUG_ON(result_max > CEPH_PG_MAX_SIZE);
+
+        mutex_lock(&map->crush_scratch_mutex);
+        r = crush_do_rule(map->crush, ruleno, x, result, result_max,
+                          weight, weight_max, map->crush_scratch_ary);
+        mutex_unlock(&map->crush_scratch_mutex);
+
+        return r;
 }
 
 /*
- * Calculate raw osd vector for the given pgid.  Return pointer to osd
- * array, or NULL on failure.
+ * Calculate raw (crush) set for given pgid.
+ *
+ * Return raw set length, or error.
  */
-static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
-                        int *osds, int *num)
+static int pg_to_raw_osds(struct ceph_osdmap *osdmap,
+                          struct ceph_pg_pool_info *pool,
+                          struct ceph_pg pgid, u32 pps, int *osds)
 {
-        struct ceph_pg_mapping *pg;
-        struct ceph_pg_pool_info *pool;
         int ruleno;
-        int r;
-        u32 pps;
+        int len;
 
-        pool = __lookup_pg_pool(&osdmap->pg_pools, pgid.pool);
-        if (!pool)
-                return NULL;
+        /* crush */
+        ruleno = crush_find_rule(osdmap->crush, pool->crush_ruleset,
+                                 pool->type, pool->size);
+        if (ruleno < 0) {
+                pr_err("no crush rule: pool %lld ruleset %d type %d size %d\n",
+                       pgid.pool, pool->crush_ruleset, pool->type,
+                       pool->size);
+                return -ENOENT;
+        }
 
-        /* pg_temp? */
+        len = do_crush(osdmap, ruleno, pps, osds,
+                       min_t(int, pool->size, CEPH_PG_MAX_SIZE),
+                       osdmap->osd_weight, osdmap->max_osd);
+        if (len < 0) {
+                pr_err("error %d from crush rule %d: pool %lld ruleset %d type %d size %d\n",
+                       len, ruleno, pgid.pool, pool->crush_ruleset,
+                       pool->type, pool->size);
+                return len;
+        }
+
+        return len;
+}
+
+/*
+ * Given raw set, calculate up set and up primary.
+ *
+ * Return up set length.  *primary is set to up primary osd id, or -1
+ * if up set is empty.
+ */
+static int raw_to_up_osds(struct ceph_osdmap *osdmap,
+                          struct ceph_pg_pool_info *pool,
+                          int *osds, int len, int *primary)
+{
+        int up_primary = -1;
+        int i;
+
+        if (ceph_can_shift_osds(pool)) {
+                int removed = 0;
+
+                for (i = 0; i < len; i++) {
+                        if (ceph_osd_is_down(osdmap, osds[i])) {
+                                removed++;
+                                continue;
+                        }
+                        if (removed)
+                                osds[i - removed] = osds[i];
+                }
+
+                len -= removed;
+                if (len > 0)
+                        up_primary = osds[0];
+        } else {
+                for (i = len - 1; i >= 0; i--) {
+                        if (ceph_osd_is_down(osdmap, osds[i]))
+                                osds[i] = CRUSH_ITEM_NONE;
+                        else
+                                up_primary = osds[i];
+                }
+        }
+
+        *primary = up_primary;
+        return len;
+}
+
+static void apply_primary_affinity(struct ceph_osdmap *osdmap, u32 pps,
+                                   struct ceph_pg_pool_info *pool,
+                                   int *osds, int len, int *primary)
+{
+        int i;
+        int pos = -1;
+
+        /*
+         * Do we have any non-default primary_affinity values for these
+         * osds?
+         */
+        if (!osdmap->osd_primary_affinity)
+                return;
+
+        for (i = 0; i < len; i++) {
+                if (osds[i] != CRUSH_ITEM_NONE &&
+                    osdmap->osd_primary_affinity[i] !=
+                                        CEPH_OSD_DEFAULT_PRIMARY_AFFINITY) {
+                        break;
+                }
+        }
+        if (i == len)
+                return;
+
+        /*
+         * Pick the primary.  Feed both the seed (for the pg) and the
+         * osd into the hash/rng so that a proportional fraction of an
+         * osd's pgs get rejected as primary.
+         */
+        for (i = 0; i < len; i++) {
+                int osd;
+                u32 aff;
+
+                osd = osds[i];
+                if (osd == CRUSH_ITEM_NONE)
+                        continue;
+
+                aff = osdmap->osd_primary_affinity[osd];
+                if (aff < CEPH_OSD_MAX_PRIMARY_AFFINITY &&
+                    (crush_hash32_2(CRUSH_HASH_RJENKINS1,
+                                    pps, osd) >> 16) >= aff) {
+                        /*
+                         * We chose not to use this primary.  Note it
+                         * anyway as a fallback in case we don't pick
+                         * anyone else, but keep looking.
+                         */
+                        if (pos < 0)
+                                pos = i;
+                } else {
+                        pos = i;
+                        break;
+                }
+        }
+        if (pos < 0)
+                return;
+
+        *primary = osds[pos];
+
+        if (ceph_can_shift_osds(pool) && pos > 0) {
+                /* move the new primary to the front */
+                for (i = pos; i > 0; i--)
+                        osds[i] = osds[i - 1];
+                osds[0] = *primary;
+        }
+}
+
+/*
+ * Given up set, apply pg_temp and primary_temp mappings.
+ *
+ * Return acting set length.  *primary is set to acting primary osd id,
+ * or -1 if acting set is empty.
+ */
+static int apply_temps(struct ceph_osdmap *osdmap,
+                       struct ceph_pg_pool_info *pool, struct ceph_pg pgid,
+                       int *osds, int len, int *primary)
+{
+        struct ceph_pg_mapping *pg;
+        int temp_len;
+        int temp_primary;
+        int i;
+
+        /* raw_pg -> pg */
         pgid.seed = ceph_stable_mod(pgid.seed, pool->pg_num,
                                     pool->pg_num_mask);
+
+        /* pg_temp? */
         pg = __lookup_pg_mapping(&osdmap->pg_temp, pgid);
         if (pg) {
-                *num = pg->len;
-                return pg->osds;
+                temp_len = 0;
+                temp_primary = -1;
+
+                for (i = 0; i < pg->pg_temp.len; i++) {
+                        if (ceph_osd_is_down(osdmap, pg->pg_temp.osds[i])) {
+                                if (ceph_can_shift_osds(pool))
+                                        continue;
+                                else
+                                        osds[temp_len++] = CRUSH_ITEM_NONE;
+                        } else {
+                                osds[temp_len++] = pg->pg_temp.osds[i];
+                        }
+                }
+
+                /* apply pg_temp's primary */
+                for (i = 0; i < temp_len; i++) {
+                        if (osds[i] != CRUSH_ITEM_NONE) {
+                                temp_primary = osds[i];
+                                break;
+                        }
+                }
+        } else {
+                temp_len = len;
+                temp_primary = *primary;
         }
 
-        /* crush */
-        ruleno = crush_find_rule(osdmap->crush, pool->crush_ruleset,
-                                 pool->type, pool->size);
-        if (ruleno < 0) {
-                pr_err("no crush rule pool %lld ruleset %d type %d size %d\n",
-                       pgid.pool, pool->crush_ruleset, pool->type,
-                       pool->size);
-                return NULL;
+        /* primary_temp? */
+        pg = __lookup_pg_mapping(&osdmap->primary_temp, pgid);
+        if (pg)
+                temp_primary = pg->primary_temp.osd;
+
+        *primary = temp_primary;
+        return temp_len;
+}
+
+/*
+ * Calculate acting set for given pgid.
+ *
+ * Return acting set length, or error.  *primary is set to acting
+ * primary osd id, or -1 if acting set is empty or on error.
+ */
+int ceph_calc_pg_acting(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
+                        int *osds, int *primary)
+{
+        struct ceph_pg_pool_info *pool;
+        u32 pps;
+        int len;
+
+        pool = __lookup_pg_pool(&osdmap->pg_pools, pgid.pool);
+        if (!pool) {
+                *primary = -1;
+                return -ENOENT;
         }
 
         if (pool->flags & CEPH_POOL_FLAG_HASHPSPOOL) {
-                /* hash pool id and seed sothat pool PGs do not overlap */
+                /* hash pool id and seed so that pool PGs do not overlap */
                 pps = crush_hash32_2(CRUSH_HASH_RJENKINS1,
                                      ceph_stable_mod(pgid.seed, pool->pgp_num,
                                                      pool->pgp_num_mask),
                                      pgid.pool);
         } else {
                 /*
-                 * legacy ehavior: add ps and pool together.  this is
+                 * legacy behavior: add ps and pool together.  this is
                  * not a great approach because the PGs from each pool
                  * will overlap on top of each other: 0.5 == 1.4 ==
                  * 2.3 == ...
@@ -1205,38 +1692,20 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
                                       pool->pgp_num_mask) +
                         (unsigned)pgid.pool;
         }
-        r = crush_do_rule_ary(osdmap->crush, ruleno, pps,
-                              osds, min_t(int, pool->size, *num),
-                              osdmap->osd_weight, osdmap->max_osd);
-        if (r < 0) {
-                pr_err("error %d from crush rule: pool %lld ruleset %d type %d"
-                       " size %d\n", r, pgid.pool, pool->crush_ruleset,
-                       pool->type, pool->size);
-                return NULL;
+
+        len = pg_to_raw_osds(osdmap, pool, pgid, pps, osds);
+        if (len < 0) {
+                *primary = -1;
+                return len;
         }
-        *num = r;
-        return osds;
-}
 
-/*
- * Return acting set for given pgid.
- */
-int ceph_calc_pg_acting(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
-                        int *acting)
-{
-        int rawosds[CEPH_PG_MAX_SIZE], *osds;
-        int i, o, num = CEPH_PG_MAX_SIZE;
+        len = raw_to_up_osds(osdmap, pool, osds, len, primary);
 
-        osds = calc_pg_raw(osdmap, pgid, rawosds, &num);
-        if (!osds)
-                return -1;
+        apply_primary_affinity(osdmap, pps, pool, osds, len, primary);
 
-        /* primary is first up osd */
-        o = 0;
-        for (i = 0; i < num; i++)
-                if (ceph_osd_is_up(osdmap, osds[i]))
-                        acting[o++] = osds[i];
-        return o;
+        len = apply_temps(osdmap, pool, pgid, osds, len, primary);
+
+        return len;
 }
 
 /*
@@ -1244,17 +1713,11 @@ int ceph_calc_pg_acting(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
  */
 int ceph_calc_pg_primary(struct ceph_osdmap *osdmap, struct ceph_pg pgid)
 {
-        int rawosds[CEPH_PG_MAX_SIZE], *osds;
-        int i, num = CEPH_PG_MAX_SIZE;
+        int osds[CEPH_PG_MAX_SIZE];
+        int primary;
 
-        osds = calc_pg_raw(osdmap, pgid, rawosds, &num);
-        if (!osds)
-                return -1;
+        ceph_calc_pg_acting(osdmap, pgid, osds, &primary);
 
-        /* primary is first up osd */
-        for (i = 0; i < num; i++)
-                if (ceph_osd_is_up(osdmap, osds[i]))
-                        return osds[i];
-        return -1;
+        return primary;
 }
 EXPORT_SYMBOL(ceph_calc_pg_primary);
diff --git a/net/core/Makefile b/net/core/Makefile
index 9628c20acff6..826b925aa453 100644
--- a/net/core/Makefile
+++ b/net/core/Makefile
@@ -21,5 +21,6 @@ obj-$(CONFIG_FIB_RULES) += fib_rules.o
 obj-$(CONFIG_TRACEPOINTS) += net-traces.o
 obj-$(CONFIG_NET_DROP_MONITOR) += drop_monitor.o
 obj-$(CONFIG_NETWORK_PHY_TIMESTAMPING) += timestamping.o
+obj-$(CONFIG_NET_PTP_CLASSIFY) += ptp_classifier.o
 obj-$(CONFIG_CGROUP_NET_PRIO) += netprio_cgroup.o
 obj-$(CONFIG_CGROUP_NET_CLASSID) += netclassid_cgroup.o
diff --git a/net/core/dev.c b/net/core/dev.c
index 4a91591b30a6..5b3042e69f85 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1245,7 +1245,7 @@ static int __dev_open(struct net_device *dev)
          * If we don't do this there is a chance ndo_poll_controller
          * or ndo_poll may be running while we open the device
          */
-        netpoll_rx_disable(dev);
+        netpoll_poll_disable(dev);
 
         ret = call_netdevice_notifiers(NETDEV_PRE_UP, dev);
         ret = notifier_to_errno(ret);
@@ -1260,7 +1260,7 @@ static int __dev_open(struct net_device *dev)
         if (!ret && ops->ndo_open)
                 ret = ops->ndo_open(dev);
 
-        netpoll_rx_enable(dev);
+        netpoll_poll_enable(dev);
 
         if (ret)
                 clear_bit(__LINK_STATE_START, &dev->state);
@@ -1313,6 +1313,9 @@ static int __dev_close_many(struct list_head *head)
         might_sleep();
 
         list_for_each_entry(dev, head, close_list) {
+                /* Temporarily disable netpoll until the interface is down */
+                netpoll_poll_disable(dev);
+
                 call_netdevice_notifiers(NETDEV_GOING_DOWN, dev);
 
                 clear_bit(__LINK_STATE_START, &dev->state);
@@ -1343,6 +1346,7 @@ static int __dev_close_many(struct list_head *head)
 
                 dev->flags &= ~IFF_UP;
                 net_dmaengine_put();
+                netpoll_poll_enable(dev);
         }
 
         return 0;
@@ -1353,14 +1357,10 @@ static int __dev_close(struct net_device *dev)
         int retval;
         LIST_HEAD(single);
 
-        /* Temporarily disable netpoll until the interface is down */
-        netpoll_rx_disable(dev);
-
         list_add(&dev->close_list, &single);
         retval = __dev_close_many(&single);
         list_del(&single);
 
-        netpoll_rx_enable(dev);
         return retval;
 }
 
@@ -1398,14 +1398,9 @@ int dev_close(struct net_device *dev)
         if (dev->flags & IFF_UP) {
                 LIST_HEAD(single);
 
-                /* Block netpoll rx while the interface is going down */
-                netpoll_rx_disable(dev);
-
                 list_add(&dev->close_list, &single);
                 dev_close_many(&single);
                 list_del(&single);
-
-                netpoll_rx_enable(dev);
         }
         return 0;
 }
@@ -1645,8 +1640,7 @@ static inline void net_timestamp_set(struct sk_buff *skb)
                         __net_timestamp(SKB);           \
         }                                               \
 
-static inline bool is_skb_forwardable(struct net_device *dev,
-                                      struct sk_buff *skb)
+bool is_skb_forwardable(struct net_device *dev, struct sk_buff *skb)
 {
         unsigned int len;
 
@@ -1665,6 +1659,7 @@ static inline bool is_skb_forwardable(struct net_device *dev,
 
         return false;
 }
+EXPORT_SYMBOL_GPL(is_skb_forwardable);
 
 /**
  * dev_forward_skb - loopback an skb to another netif
@@ -2289,7 +2284,7 @@ EXPORT_SYMBOL(skb_checksum_help);
 __be16 skb_network_protocol(struct sk_buff *skb, int *depth)
 {
         __be16 type = skb->protocol;
-        int vlan_depth = ETH_HLEN;
+        int vlan_depth = skb->mac_len;
 
         /* Tunnel gso handlers can set protocol to ethernet. */
         if (type == htons(ETH_P_TEB)) {
@@ -2885,6 +2880,7 @@ recursion_alert:
         rc = -ENETDOWN;
         rcu_read_unlock_bh();
 
+        atomic_long_inc(&dev->tx_dropped);
         kfree_skb(skb);
         return rc;
 out:
@@ -2957,7 +2953,7 @@ set_rps_cpu(struct net_device *dev, struct sk_buff *skb,
                 flow_table = rcu_dereference(rxqueue->rps_flow_table);
                 if (!flow_table)
                         goto out;
-                flow_id = skb->rxhash & flow_table->mask;
+                flow_id = skb_get_hash(skb) & flow_table->mask;
                 rc = dev->netdev_ops->ndo_rx_flow_steer(dev, skb,
                                                         rxq_index, flow_id);
                 if (rc < 0)
@@ -2991,6 +2987,7 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
         struct rps_sock_flow_table *sock_flow_table;
         int cpu = -1;
         u16 tcpu;
+        u32 hash;
 
         if (skb_rx_queue_recorded(skb)) {
                 u16 index = skb_get_rx_queue(skb);
@@ -3019,7 +3016,8 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
         }
 
         skb_reset_network_header(skb);
-        if (!skb_get_hash(skb))
+        hash = skb_get_hash(skb);
+        if (!hash)
                 goto done;
 
         flow_table = rcu_dereference(rxqueue->rps_flow_table);
@@ -3028,11 +3026,10 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
                 u16 next_cpu;
                 struct rps_dev_flow *rflow;
 
-                rflow = &flow_table->flows[skb->rxhash & flow_table->mask];
+                rflow = &flow_table->flows[hash & flow_table->mask];
                 tcpu = rflow->cpu;
 
-                next_cpu = sock_flow_table->ents[skb->rxhash &
-                    sock_flow_table->mask];
+                next_cpu = sock_flow_table->ents[hash & sock_flow_table->mask];
 
                 /*
                  * If the desired CPU (where last recvmsg was done) is
@@ -3061,7 +3058,7 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
         }
 
         if (map) {
-                tcpu = map->cpus[((u64) skb->rxhash * map->len) >> 32];
+                tcpu = map->cpus[((u64) hash * map->len) >> 32];
 
                 if (cpu_online(tcpu)) {
                         cpu = tcpu;
@@ -3236,10 +3233,6 @@ static int netif_rx_internal(struct sk_buff *skb)
 {
         int ret;
 
-        /* if netpoll wants it, pretend we never saw it */
-        if (netpoll_rx(skb))
-                return NET_RX_DROP;
-
         net_timestamp_check(netdev_tstamp_prequeue, skb);
 
         trace_netif_rx(skb);
@@ -3500,11 +3493,11 @@ EXPORT_SYMBOL_GPL(netdev_rx_handler_unregister);
 static bool skb_pfmemalloc_protocol(struct sk_buff *skb)
 {
         switch (skb->protocol) {
-        case __constant_htons(ETH_P_ARP):
-        case __constant_htons(ETH_P_IP):
-        case __constant_htons(ETH_P_IPV6):
-        case __constant_htons(ETH_P_8021Q):
-        case __constant_htons(ETH_P_8021AD):
+        case htons(ETH_P_ARP):
+        case htons(ETH_P_IP):
+        case htons(ETH_P_IPV6):
+        case htons(ETH_P_8021Q):
+        case htons(ETH_P_8021AD):
                 return true;
         default:
                 return false;
@@ -3525,10 +3518,6 @@ static int __netif_receive_skb_core(struct sk_buff *skb, bool pfmemalloc)
 
         trace_netif_receive_skb(skb);
 
-        /* if we've gotten here through NAPI, check netpoll */
-        if (netpoll_receive_skb(skb))
-                goto out;
-
         orig_dev = skb->dev;
 
         skb_reset_network_header(skb);
@@ -3655,7 +3644,6 @@ drop:
 
 unlock:
         rcu_read_unlock();
-out:
         return ret;
 }
 
@@ -3845,10 +3833,10 @@ static void gro_list_prepare(struct napi_struct *napi, struct sk_buff *skb)
                 diffs |= p->vlan_tci ^ skb->vlan_tci;
                 if (maclen == ETH_HLEN)
                         diffs |= compare_ether_header(skb_mac_header(p),
-                                                      skb_gro_mac_header(skb));
+                                                      skb_mac_header(skb));
                 else if (!diffs)
                         diffs = memcmp(skb_mac_header(p),
-                                       skb_gro_mac_header(skb),
+                                       skb_mac_header(skb),
                                        maclen);
                 NAPI_GRO_CB(p)->same_flow = !diffs;
         }
@@ -3871,6 +3859,27 @@ static void skb_gro_reset_offset(struct sk_buff *skb)
         }
 }
 
+static void gro_pull_from_frag0(struct sk_buff *skb, int grow)
+{
+        struct skb_shared_info *pinfo = skb_shinfo(skb);
+
+        BUG_ON(skb->end - skb->tail < grow);
+
+        memcpy(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow);
+
+        skb->data_len -= grow;
+        skb->tail += grow;
+
+        pinfo->frags[0].page_offset += grow;
+        skb_frag_size_sub(&pinfo->frags[0], grow);
+
+        if (unlikely(!skb_frag_size(&pinfo->frags[0]))) {
+                skb_frag_unref(skb, 0);
+                memmove(pinfo->frags, pinfo->frags + 1,
+                        --pinfo->nr_frags * sizeof(pinfo->frags[0]));
+        }
+}
+
 static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
         struct sk_buff **pp = NULL;
@@ -3879,14 +3888,14 @@ static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff
         struct list_head *head = &offload_base;
         int same_flow;
         enum gro_result ret;
+        int grow;
 
-        if (!(skb->dev->features & NETIF_F_GRO) || netpoll_rx_on(skb))
+        if (!(skb->dev->features & NETIF_F_GRO))
                 goto normal;
 
         if (skb_is_gso(skb) || skb_has_frag_list(skb))
                 goto normal;
 
-        skb_gro_reset_offset(skb);
         gro_list_prepare(napi, skb);
         NAPI_GRO_CB(skb)->csum = skb->csum; /* Needed for CHECKSUM_COMPLETE */
 
@@ -3950,27 +3959,9 @@ static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff
         ret = GRO_HELD;
 
 pull:
-        if (skb_headlen(skb) < skb_gro_offset(skb)) {
-                int grow = skb_gro_offset(skb) - skb_headlen(skb);
-
-                BUG_ON(skb->end - skb->tail < grow);
-
-                memcpy(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow);
-
-                skb->tail += grow;
-                skb->data_len -= grow;
-
-                skb_shinfo(skb)->frags[0].page_offset += grow;
-                skb_frag_size_sub(&skb_shinfo(skb)->frags[0], grow);
-
-                if (unlikely(!skb_frag_size(&skb_shinfo(skb)->frags[0]))) {
-                        skb_frag_unref(skb, 0);
-                        memmove(skb_shinfo(skb)->frags,
-                                skb_shinfo(skb)->frags + 1,
-                                --skb_shinfo(skb)->nr_frags * sizeof(skb_frag_t));
-                }
-        }
-
+        grow = skb_gro_offset(skb) - skb_headlen(skb);
+        if (grow > 0)
+                gro_pull_from_frag0(skb, grow);
 ok:
         return ret;
 
@@ -4038,6 +4029,8 @@ gro_result_t napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
         trace_napi_gro_receive_entry(skb);
 
+        skb_gro_reset_offset(skb);
+
         return napi_skb_finish(dev_gro_receive(napi, skb), skb);
 }
 EXPORT_SYMBOL(napi_gro_receive);
@@ -4050,6 +4043,7 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
         skb->vlan_tci = 0;
         skb->dev = napi->dev;
         skb->skb_iif = 0;
+        skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
 
         napi->skb = skb;
 }
@@ -4066,12 +4060,16 @@ struct sk_buff *napi_get_frags(struct napi_struct *napi)
 }
 EXPORT_SYMBOL(napi_get_frags);
 
-static gro_result_t napi_frags_finish(struct napi_struct *napi, struct sk_buff *skb,
-                               gro_result_t ret)
+static gro_result_t napi_frags_finish(struct napi_struct *napi,
+                                      struct sk_buff *skb,
+                                      gro_result_t ret)
 {
         switch (ret) {
         case GRO_NORMAL:
-                if (netif_receive_skb_internal(skb))
+        case GRO_HELD:
+                __skb_push(skb, ETH_HLEN);
+                skb->protocol = eth_type_trans(skb, skb->dev);
+                if (ret == GRO_NORMAL && netif_receive_skb_internal(skb))
                         ret = GRO_DROP;
                 break;
 
@@ -4080,7 +4078,6 @@ static gro_result_t napi_frags_finish(struct napi_struct *napi, struct sk_buff *
                 napi_reuse_skb(napi, skb);
                 break;
 
-        case GRO_HELD:
         case GRO_MERGED:
                 break;
         }
@@ -4088,17 +4085,41 @@ static gro_result_t napi_frags_finish(struct napi_struct *napi, struct sk_buff *
         return ret;
 }
 
+/* Upper GRO stack assumes network header starts at gro_offset=0
+ * Drivers could call both napi_gro_frags() and napi_gro_receive()
+ * We copy ethernet header into skb->data to have a common layout.
+ */
 static struct sk_buff *napi_frags_skb(struct napi_struct *napi)
 {
         struct sk_buff *skb = napi->skb;
+        const struct ethhdr *eth;
+        unsigned int hlen = sizeof(*eth);
 
         napi->skb = NULL;
 
-        if (unlikely(!pskb_may_pull(skb, sizeof(struct ethhdr)))) {
-                napi_reuse_skb(napi, skb);
-                return NULL;
+        skb_reset_mac_header(skb);
+        skb_gro_reset_offset(skb);
+
+        eth = skb_gro_header_fast(skb, 0);
+        if (unlikely(skb_gro_header_hard(skb, hlen))) {
+                eth = skb_gro_header_slow(skb, hlen, 0);
+                if (unlikely(!eth)) {
+                        napi_reuse_skb(napi, skb);
+                        return NULL;
+                }
+        } else {
+                gro_pull_from_frag0(skb, hlen);
+                NAPI_GRO_CB(skb)->frag0 += hlen;
+                NAPI_GRO_CB(skb)->frag0_len -= hlen;
         }
-        skb->protocol = eth_type_trans(skb, skb->dev);
+        __skb_pull(skb, hlen);
+
+        /*
+         * This works because the only protocols we care about don't require
+         * special handling.
+         * We'll fix it up properly in napi_frags_finish()
+         */
+        skb->protocol = eth->h_proto;
 
         return skb;
 }
@@ -4568,8 +4589,7 @@ void *netdev_lower_get_next_private(struct net_device *dev,
         if (&lower->list == &dev->adj_list.lower)
                 return NULL;
 
-        if (iter)
-                *iter = lower->list.next;
+        *iter = lower->list.next;
 
         return lower->private;
 }
@@ -4597,8 +4617,7 @@ void *netdev_lower_get_next_private_rcu(struct net_device *dev,
         if (&lower->list == &dev->adj_list.lower)
                 return NULL;
 
-        if (iter)
-                *iter = &lower->list;
+        *iter = &lower->list;
 
         return lower->private;
 }
@@ -5676,6 +5695,13 @@ static netdev_features_t netdev_fix_features(struct net_device *dev,
                 }
         }
 
+#ifdef CONFIG_NET_RX_BUSY_POLL
+        if (dev->netdev_ops->ndo_busy_poll)
+                features |= NETIF_F_BUSY_POLL;
+        else
+#endif
+                features &= ~NETIF_F_BUSY_POLL;
+
         return features;
 }
 
@@ -6251,6 +6277,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
                 netdev_stats_to_stats64(storage, &dev->stats);
         }
         storage->rx_dropped += atomic_long_read(&dev->rx_dropped);
+        storage->tx_dropped += atomic_long_read(&dev->tx_dropped);
         return storage;
 }
 EXPORT_SYMBOL(dev_get_stats);
diff --git a/net/core/dst.c b/net/core/dst.c
index ca4231ec7347..80d6286c8b62 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -142,12 +142,12 @@ loop:
         mutex_unlock(&dst_gc_mutex);
 }
 
-int dst_discard(struct sk_buff *skb)
+int dst_discard_sk(struct sock *sk, struct sk_buff *skb)
 {
         kfree_skb(skb);
         return 0;
 }
-EXPORT_SYMBOL(dst_discard);
+EXPORT_SYMBOL(dst_discard_sk);
 
 const u32 dst_default_metrics[RTAX_MAX + 1] = {
         /* This initializer is needed to force linker to place this variable
@@ -184,7 +184,7 @@ void *dst_alloc(struct dst_ops *ops, struct net_device *dev,
         dst->xfrm = NULL;
 #endif
         dst->input = dst_discard;
-        dst->output = dst_discard;
+        dst->output = dst_discard_sk;
         dst->error = 0;
         dst->obsolete = initial_obsolete;
         dst->header_len = 0;
@@ -209,8 +209,10 @@ static void ___dst_free(struct dst_entry *dst)
         /* The first case (dev==NULL) is required, when
            protocol module is unloaded.
          */
-        if (dst->dev == NULL || !(dst->dev->flags&IFF_UP))
-                dst->input = dst->output = dst_discard;
+        if (dst->dev == NULL || !(dst->dev->flags&IFF_UP)) {
+                dst->input = dst_discard;
+                dst->output = dst_discard_sk;
+        }
         dst->obsolete = DST_OBSOLETE_DEAD;
 }
 
@@ -361,7 +363,8 @@ static void dst_ifdown(struct dst_entry *dst, struct net_device *dev,
                 return;
 
         if (!unregister) {
-                dst->input = dst->output = dst_discard;
+                dst->input = dst_discard;
+                dst->output = dst_discard_sk;
         } else {
                 dst->dev = dev_net(dst->dev)->loopback_dev;
                 dev_hold(dst->dev);
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 30071dec287a..640ba0e5831c 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -97,6 +97,7 @@ static const char netdev_features_strings[NETDEV_FEATURE_COUNT][ETH_GSTRING_LEN]
         [NETIF_F_RXFCS_BIT] =            "rx-fcs",
         [NETIF_F_RXALL_BIT] =            "rx-all",
         [NETIF_F_HW_L2FW_DOFFLOAD_BIT] = "l2-fwd-offload",
+        [NETIF_F_BUSY_POLL_BIT] =        "busy-poll",
 };
 
 static int ethtool_get_features(struct net_device *dev, void __user *useraddr)
diff --git a/net/core/filter.c b/net/core/filter.c
index ad30d626a5bd..cd58614660cf 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1,11 +1,16 @@
 /*
  * Linux Socket Filter - Kernel level socket filtering
  *
- * Author:
- *     Jay Schulist <jschlst@samba.org>
+ * Based on the design of the Berkeley Packet Filter. The new
+ * internal format has been designed by PLUMgrid:
  *
- * Based on the design of:
- *     - The Berkeley Packet Filter
+ *      Copyright (c) 2011 - 2014 PLUMgrid, http://plumgrid.com
+ *
+ * Authors:
+ *
+ *      Jay Schulist <jschlst@samba.org>
+ *      Alexei Starovoitov <ast@plumgrid.com>
+ *      Daniel Borkmann <dborkman@redhat.com>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -108,304 +113,1051 @@ int sk_filter(struct sock *sk, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(sk_filter);
 
+/* Base function for offset calculation. Needs to go into .text section,
+ * therefore keeping it non-static as well; will also be used by JITs
+ * anyway later on, so do not let the compiler omit it.
+ */
+noinline u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
+{
+        return 0;
+}
+
 /**
- *      sk_run_filter - run a filter on a socket
- *      @skb: buffer to run the filter on
- *      @fentry: filter to apply
+ *      __sk_run_filter - run a filter on a given context
+ *      @ctx: buffer to run the filter on
+ *      @insn: filter to apply
  *
- * Decode and apply filter instructions to the skb->data.
- * Return length to keep, 0 for none. @skb is the data we are
- * filtering, @filter is the array of filter instructions.
- * Because all jumps are guaranteed to be before last instruction,
- * and last instruction guaranteed to be a RET, we dont need to check
- * flen. (We used to pass to this function the length of filter)
+ * Decode and apply filter instructions to the skb->data. Return length to
+ * keep, 0 for none. @ctx is the data we are operating on, @insn is the
+ * array of filter instructions.
  */
-unsigned int sk_run_filter(const struct sk_buff *skb,
-                           const struct sock_filter *fentry)
+unsigned int __sk_run_filter(void *ctx, const struct sock_filter_int *insn)
 {
+        u64 stack[MAX_BPF_STACK / sizeof(u64)];
+        u64 regs[MAX_BPF_REG], tmp;
         void *ptr;
-        u32 A = 0;                      /* Accumulator */
-        u32 X = 0;                      /* Index Register */
-        u32 mem[BPF_MEMWORDS];          /* Scratch Memory Store */
-        u32 tmp;
-        int k;
+        int off;
 
-        /*
-         * Process array of filter instructions.
-         */
-        for (;; fentry++) {
-#if defined(CONFIG_X86_32)
-#define K (fentry->k)
-#else
-                const u32 K = fentry->k;
-#endif
-
-                switch (fentry->code) {
-                case BPF_S_ALU_ADD_X:
-                        A += X;
-                        continue;
-                case BPF_S_ALU_ADD_K:
-                        A += K;
-                        continue;
-                case BPF_S_ALU_SUB_X:
-                        A -= X;
-                        continue;
-                case BPF_S_ALU_SUB_K:
-                        A -= K;
-                        continue;
-                case BPF_S_ALU_MUL_X:
-                        A *= X;
-                        continue;
-                case BPF_S_ALU_MUL_K:
-                        A *= K;
-                        continue;
-                case BPF_S_ALU_DIV_X:
-                        if (X == 0)
-                                return 0;
-                        A /= X;
-                        continue;
-                case BPF_S_ALU_DIV_K:
-                        A /= K;
-                        continue;
-                case BPF_S_ALU_MOD_X:
-                        if (X == 0)
-                                return 0;
-                        A %= X;
-                        continue;
-                case BPF_S_ALU_MOD_K:
-                        A %= K;
-                        continue;
-                case BPF_S_ALU_AND_X:
-                        A &= X;
-                        continue;
-                case BPF_S_ALU_AND_K:
-                        A &= K;
-                        continue;
-                case BPF_S_ALU_OR_X:
-                        A |= X;
-                        continue;
-                case BPF_S_ALU_OR_K:
-                        A |= K;
-                        continue;
-                case BPF_S_ANC_ALU_XOR_X:
-                case BPF_S_ALU_XOR_X:
-                        A ^= X;
-                        continue;
-                case BPF_S_ALU_XOR_K:
-                        A ^= K;
-                        continue;
-                case BPF_S_ALU_LSH_X:
-                        A <<= X;
-                        continue;
-                case BPF_S_ALU_LSH_K:
-                        A <<= K;
-                        continue;
-                case BPF_S_ALU_RSH_X:
-                        A >>= X;
-                        continue;
-                case BPF_S_ALU_RSH_K:
-                        A >>= K;
-                        continue;
-                case BPF_S_ALU_NEG:
-                        A = -A;
-                        continue;
-                case BPF_S_JMP_JA:
-                        fentry += K;
-                        continue;
-                case BPF_S_JMP_JGT_K:
-                        fentry += (A > K) ? fentry->jt : fentry->jf;
-                        continue;
-                case BPF_S_JMP_JGE_K:
-                        fentry += (A >= K) ? fentry->jt : fentry->jf;
-                        continue;
-                case BPF_S_JMP_JEQ_K:
-                        fentry += (A == K) ? fentry->jt : fentry->jf;
-                        continue;
-                case BPF_S_JMP_JSET_K:
-                        fentry += (A & K) ? fentry->jt : fentry->jf;
-                        continue;
-                case BPF_S_JMP_JGT_X:
-                        fentry += (A > X) ? fentry->jt : fentry->jf;
-                        continue;
-                case BPF_S_JMP_JGE_X:
-                        fentry += (A >= X) ? fentry->jt : fentry->jf;
-                        continue;
-                case BPF_S_JMP_JEQ_X:
-                        fentry += (A == X) ? fentry->jt : fentry->jf;
-                        continue;
-                case BPF_S_JMP_JSET_X:
-                        fentry += (A & X) ? fentry->jt : fentry->jf;
-                        continue;
-                case BPF_S_LD_W_ABS:
-                        k = K;
-load_w:
-                        ptr = load_pointer(skb, k, 4, &tmp);
-                        if (ptr != NULL) {
-                                A = get_unaligned_be32(ptr);
-                                continue;
-                        }
+#define K  insn->imm
+#define A  regs[insn->a_reg]
+#define X  regs[insn->x_reg]
+#define R0 regs[0]
+
+#define CONT     ({insn++; goto select_insn; })
+#define CONT_JMP ({insn++; goto select_insn; })
+
+        static const void *jumptable[256] = {
+                [0 ... 255] = &&default_label,
+                /* Now overwrite non-defaults ... */
+#define DL(A, B, C)     [A|B|C] = &&A##_##B##_##C
+                DL(BPF_ALU, BPF_ADD, BPF_X),
+                DL(BPF_ALU, BPF_ADD, BPF_K),
+                DL(BPF_ALU, BPF_SUB, BPF_X),
+                DL(BPF_ALU, BPF_SUB, BPF_K),
+                DL(BPF_ALU, BPF_AND, BPF_X),
+                DL(BPF_ALU, BPF_AND, BPF_K),
+                DL(BPF_ALU, BPF_OR, BPF_X),
+                DL(BPF_ALU, BPF_OR, BPF_K),
+                DL(BPF_ALU, BPF_LSH, BPF_X),
+                DL(BPF_ALU, BPF_LSH, BPF_K),
+                DL(BPF_ALU, BPF_RSH, BPF_X),
+                DL(BPF_ALU, BPF_RSH, BPF_K),
+                DL(BPF_ALU, BPF_XOR, BPF_X),
+                DL(BPF_ALU, BPF_XOR, BPF_K),
+                DL(BPF_ALU, BPF_MUL, BPF_X),
+                DL(BPF_ALU, BPF_MUL, BPF_K),
+                DL(BPF_ALU, BPF_MOV, BPF_X),
+                DL(BPF_ALU, BPF_MOV, BPF_K),
+                DL(BPF_ALU, BPF_DIV, BPF_X),
+                DL(BPF_ALU, BPF_DIV, BPF_K),
+                DL(BPF_ALU, BPF_MOD, BPF_X),
+                DL(BPF_ALU, BPF_MOD, BPF_K),
+                DL(BPF_ALU, BPF_NEG, 0),
+                DL(BPF_ALU, BPF_END, BPF_TO_BE),
+                DL(BPF_ALU, BPF_END, BPF_TO_LE),
+                DL(BPF_ALU64, BPF_ADD, BPF_X),
+                DL(BPF_ALU64, BPF_ADD, BPF_K),
+                DL(BPF_ALU64, BPF_SUB, BPF_X),
+                DL(BPF_ALU64, BPF_SUB, BPF_K),
+                DL(BPF_ALU64, BPF_AND, BPF_X),
+                DL(BPF_ALU64, BPF_AND, BPF_K),
+                DL(BPF_ALU64, BPF_OR, BPF_X),
+                DL(BPF_ALU64, BPF_OR, BPF_K),
+                DL(BPF_ALU64, BPF_LSH, BPF_X),
+                DL(BPF_ALU64, BPF_LSH, BPF_K),
+                DL(BPF_ALU64, BPF_RSH, BPF_X),
+                DL(BPF_ALU64, BPF_RSH, BPF_K),
+                DL(BPF_ALU64, BPF_XOR, BPF_X),
+                DL(BPF_ALU64, BPF_XOR, BPF_K),
+                DL(BPF_ALU64, BPF_MUL, BPF_X),
+                DL(BPF_ALU64, BPF_MUL, BPF_K),
+                DL(BPF_ALU64, BPF_MOV, BPF_X),
+                DL(BPF_ALU64, BPF_MOV, BPF_K),
+                DL(BPF_ALU64, BPF_ARSH, BPF_X),
+                DL(BPF_ALU64, BPF_ARSH, BPF_K),
+                DL(BPF_ALU64, BPF_DIV, BPF_X),
+                DL(BPF_ALU64, BPF_DIV, BPF_K),
+                DL(BPF_ALU64, BPF_MOD, BPF_X),
+                DL(BPF_ALU64, BPF_MOD, BPF_K),
+                DL(BPF_ALU64, BPF_NEG, 0),
+                DL(BPF_JMP, BPF_CALL, 0),
+                DL(BPF_JMP, BPF_JA, 0),
+                DL(BPF_JMP, BPF_JEQ, BPF_X),
+                DL(BPF_JMP, BPF_JEQ, BPF_K),
+                DL(BPF_JMP, BPF_JNE, BPF_X),
+                DL(BPF_JMP, BPF_JNE, BPF_K),
+                DL(BPF_JMP, BPF_JGT, BPF_X),
+                DL(BPF_JMP, BPF_JGT, BPF_K),
+                DL(BPF_JMP, BPF_JGE, BPF_X),
+                DL(BPF_JMP, BPF_JGE, BPF_K),
+                DL(BPF_JMP, BPF_JSGT, BPF_X),
+                DL(BPF_JMP, BPF_JSGT, BPF_K),
+                DL(BPF_JMP, BPF_JSGE, BPF_X),
+                DL(BPF_JMP, BPF_JSGE, BPF_K),
+                DL(BPF_JMP, BPF_JSET, BPF_X),
+                DL(BPF_JMP, BPF_JSET, BPF_K),
+                DL(BPF_JMP, BPF_EXIT, 0),
+                DL(BPF_STX, BPF_MEM, BPF_B),
+                DL(BPF_STX, BPF_MEM, BPF_H),
+                DL(BPF_STX, BPF_MEM, BPF_W),
+                DL(BPF_STX, BPF_MEM, BPF_DW),
+                DL(BPF_STX, BPF_XADD, BPF_W),
+                DL(BPF_STX, BPF_XADD, BPF_DW),
+                DL(BPF_ST, BPF_MEM, BPF_B),
+                DL(BPF_ST, BPF_MEM, BPF_H),
+                DL(BPF_ST, BPF_MEM, BPF_W),
+                DL(BPF_ST, BPF_MEM, BPF_DW),
+                DL(BPF_LDX, BPF_MEM, BPF_B),
+                DL(BPF_LDX, BPF_MEM, BPF_H),
+                DL(BPF_LDX, BPF_MEM, BPF_W),
+                DL(BPF_LDX, BPF_MEM, BPF_DW),
+                DL(BPF_LD, BPF_ABS, BPF_W),
+                DL(BPF_LD, BPF_ABS, BPF_H),
+                DL(BPF_LD, BPF_ABS, BPF_B),
+                DL(BPF_LD, BPF_IND, BPF_W),
+                DL(BPF_LD, BPF_IND, BPF_H),
+                DL(BPF_LD, BPF_IND, BPF_B),
+#undef DL
+        };
+
+        regs[FP_REG]  = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)];
+        regs[ARG1_REG] = (u64) (unsigned long) ctx;
+
+select_insn:
+        goto *jumptable[insn->code];
+
+        /* ALU */
+#define ALU(OPCODE, OP)                 \
+        BPF_ALU64_##OPCODE##_BPF_X:     \
+                A = A OP X;             \
+                CONT;                   \
+        BPF_ALU_##OPCODE##_BPF_X:       \
+                A = (u32) A OP (u32) X; \
+                CONT;                   \
+        BPF_ALU64_##OPCODE##_BPF_K:     \
+                A = A OP K;             \
+                CONT;                   \
+        BPF_ALU_##OPCODE##_BPF_K:       \
+                A = (u32) A OP (u32) K; \
+                CONT;
+
+        ALU(BPF_ADD,  +)
+        ALU(BPF_SUB,  -)
+        ALU(BPF_AND,  &)
+        ALU(BPF_OR,   |)
+        ALU(BPF_LSH, <<)
+        ALU(BPF_RSH, >>)
+        ALU(BPF_XOR,  ^)
+        ALU(BPF_MUL,  *)
+#undef ALU
+        BPF_ALU_BPF_NEG_0:
+                A = (u32) -A;
+                CONT;
+        BPF_ALU64_BPF_NEG_0:
+                A = -A;
+                CONT;
+        BPF_ALU_BPF_MOV_BPF_X:
+                A = (u32) X;
+                CONT;
+        BPF_ALU_BPF_MOV_BPF_K:
+                A = (u32) K;
+                CONT;
+        BPF_ALU64_BPF_MOV_BPF_X:
+                A = X;
+                CONT;
+        BPF_ALU64_BPF_MOV_BPF_K:
+                A = K;
+                CONT;
+        BPF_ALU64_BPF_ARSH_BPF_X:
+                (*(s64 *) &A) >>= X;
+                CONT;
+        BPF_ALU64_BPF_ARSH_BPF_K:
+                (*(s64 *) &A) >>= K;
+                CONT;
+        BPF_ALU64_BPF_MOD_BPF_X:
+                if (unlikely(X == 0))
                         return 0;
-                case BPF_S_LD_H_ABS:
-                        k = K;
-load_h:
-                        ptr = load_pointer(skb, k, 2, &tmp);
-                        if (ptr != NULL) {
-                                A = get_unaligned_be16(ptr);
-                                continue;
-                        }
+                tmp = A;
+                A = do_div(tmp, X);
+                CONT;
+        BPF_ALU_BPF_MOD_BPF_X:
+                if (unlikely(X == 0))
                         return 0;
-                case BPF_S_LD_B_ABS:
-                        k = K;
-load_b:
-                        ptr = load_pointer(skb, k, 1, &tmp);
-                        if (ptr != NULL) {
-                                A = *(u8 *)ptr;
-                                continue;
-                        }
+                tmp = (u32) A;
+                A = do_div(tmp, (u32) X);
+                CONT;
+        BPF_ALU64_BPF_MOD_BPF_K:
+                tmp = A;
+                A = do_div(tmp, K);
+                CONT;
+        BPF_ALU_BPF_MOD_BPF_K:
+                tmp = (u32) A;
+                A = do_div(tmp, (u32) K);
+                CONT;
+        BPF_ALU64_BPF_DIV_BPF_X:
+                if (unlikely(X == 0))
                         return 0;
-                case BPF_S_LD_W_LEN:
-                        A = skb->len;
-                        continue;
-                case BPF_S_LDX_W_LEN:
-                        X = skb->len;
-                        continue;
-                case BPF_S_LD_W_IND:
-                        k = X + K;
-                        goto load_w;
-                case BPF_S_LD_H_IND:
-                        k = X + K;
-                        goto load_h;
-                case BPF_S_LD_B_IND:
-                        k = X + K;
-                        goto load_b;
-                case BPF_S_LDX_B_MSH:
-                        ptr = load_pointer(skb, K, 1, &tmp);
-                        if (ptr != NULL) {
-                                X = (*(u8 *)ptr & 0xf) << 2;
-                                continue;
-                        }
+                do_div(A, X);
+                CONT;
+        BPF_ALU_BPF_DIV_BPF_X:
+                if (unlikely(X == 0))
                         return 0;
-                case BPF_S_LD_IMM:
-                        A = K;
-                        continue;
-                case BPF_S_LDX_IMM:
-                        X = K;
-                        continue;
-                case BPF_S_LD_MEM:
-                        A = mem[K];
-                        continue;
-                case BPF_S_LDX_MEM:
-                        X = mem[K];
-                        continue;
-                case BPF_S_MISC_TAX:
-                        X = A;
-                        continue;
-                case BPF_S_MISC_TXA:
-                        A = X;
-                        continue;
-                case BPF_S_RET_K:
-                        return K;
-                case BPF_S_RET_A:
-                        return A;
-                case BPF_S_ST:
-                        mem[K] = A;
-                        continue;
-                case BPF_S_STX:
-                        mem[K] = X;
-                        continue;
-                case BPF_S_ANC_PROTOCOL:
-                        A = ntohs(skb->protocol);
-                        continue;
-                case BPF_S_ANC_PKTTYPE:
-                        A = skb->pkt_type;
-                        continue;
-                case BPF_S_ANC_IFINDEX:
-                        if (!skb->dev)
-                                return 0;
-                        A = skb->dev->ifindex;
-                        continue;
-                case BPF_S_ANC_MARK:
-                        A = skb->mark;
-                        continue;
-                case BPF_S_ANC_QUEUE:
-                        A = skb->queue_mapping;
-                        continue;
-                case BPF_S_ANC_HATYPE:
-                        if (!skb->dev)
-                                return 0;
-                        A = skb->dev->type;
-                        continue;
-                case BPF_S_ANC_RXHASH:
-                        A = skb->rxhash;
-                        continue;
-                case BPF_S_ANC_CPU:
-                        A = raw_smp_processor_id();
-                        continue;
-                case BPF_S_ANC_VLAN_TAG:
-                        A = vlan_tx_tag_get(skb);
-                        continue;
-                case BPF_S_ANC_VLAN_TAG_PRESENT:
-                        A = !!vlan_tx_tag_present(skb);
-                        continue;
-                case BPF_S_ANC_PAY_OFFSET:
-                        A = __skb_get_poff(skb);
-                        continue;
-                case BPF_S_ANC_NLATTR: {
-                        struct nlattr *nla;
-
-                        if (skb_is_nonlinear(skb))
-                                return 0;
-                        if (A > skb->len - sizeof(struct nlattr))
-                                return 0;
-
-                        nla = nla_find((struct nlattr *)&skb->data[A],
-                                       skb->len - A, X);
-                        if (nla)
-                                A = (void *)nla - (void *)skb->data;
-                        else
-                                A = 0;
-                        continue;
+                tmp = (u32) A;
+                do_div(tmp, (u32) X);
+                A = (u32) tmp;
+                CONT;
+        BPF_ALU64_BPF_DIV_BPF_K:
+                do_div(A, K);
+                CONT;
+        BPF_ALU_BPF_DIV_BPF_K:
+                tmp = (u32) A;
+                do_div(tmp, (u32) K);
+                A = (u32) tmp;
+                CONT;
+        BPF_ALU_BPF_END_BPF_TO_BE:
+                switch (K) {
+                case 16:
+                        A = (__force u16) cpu_to_be16(A);
+                        break;
+                case 32:
+                        A = (__force u32) cpu_to_be32(A);
+                        break;
+                case 64:
+                        A = (__force u64) cpu_to_be64(A);
+                        break;
+                }
+                CONT;
+        BPF_ALU_BPF_END_BPF_TO_LE:
+                switch (K) {
+                case 16:
+                        A = (__force u16) cpu_to_le16(A);
+                        break;
+                case 32:
+                        A = (__force u32) cpu_to_le32(A);
+                        break;
+                case 64:
+                        A = (__force u64) cpu_to_le64(A);
+                        break;
+                }
+                CONT;
+
+        /* CALL */
+        BPF_JMP_BPF_CALL_0:
+                /* Function call scratches R1-R5 registers, preserves R6-R9,
+                 * and stores return value into R0.
+                 */
+                R0 = (__bpf_call_base + insn->imm)(regs[1], regs[2], regs[3],
+                                                   regs[4], regs[5]);
+                CONT;
+
+        /* JMP */
+        BPF_JMP_BPF_JA_0:
+                insn += insn->off;
+                CONT;
+        BPF_JMP_BPF_JEQ_BPF_X:
+                if (A == X) {
+                        insn += insn->off;
+                        CONT_JMP;
+                }
+                CONT;
+        BPF_JMP_BPF_JEQ_BPF_K:
+                if (A == K) {
+                        insn += insn->off;
+                        CONT_JMP;
+                }
+                CONT;
+        BPF_JMP_BPF_JNE_BPF_X:
+                if (A != X) {
+                        insn += insn->off;
+                        CONT_JMP;
+                }
+                CONT;
+        BPF_JMP_BPF_JNE_BPF_K:
+                if (A != K) {
+                        insn += insn->off;
+                        CONT_JMP;
+                }
+                CONT;
+        BPF_JMP_BPF_JGT_BPF_X:
+                if (A > X) {
+                        insn += insn->off;
+                        CONT_JMP;
+                }
+                CONT;
+        BPF_JMP_BPF_JGT_BPF_K:
+                if (A > K) {
+                        insn += insn->off;
+                        CONT_JMP;
+                }
+                CONT;
+        BPF_JMP_BPF_JGE_BPF_X:
+                if (A >= X) {
+                        insn += insn->off;
+                        CONT_JMP;
+                }
+                CONT;
+        BPF_JMP_BPF_JGE_BPF_K:
+                if (A >= K) {
+                        insn += insn->off;
+                        CONT_JMP;
+                }
+                CONT;
+        BPF_JMP_BPF_JSGT_BPF_X:
+                if (((s64)A) > ((s64)X)) {
+                        insn += insn->off;
+                        CONT_JMP;
+                }
+                CONT;
+        BPF_JMP_BPF_JSGT_BPF_K:
+                if (((s64)A) > ((s64)K)) {
+                        insn += insn->off;
+                        CONT_JMP;
+                }
+                CONT;
+        BPF_JMP_BPF_JSGE_BPF_X:
+                if (((s64)A) >= ((s64)X)) {
+                        insn += insn->off;
+                        CONT_JMP;
+                }
+                CONT;
+        BPF_JMP_BPF_JSGE_BPF_K:
+                if (((s64)A) >= ((s64)K)) {
+                        insn += insn->off;
+                        CONT_JMP;
+                }
+                CONT;
+        BPF_JMP_BPF_JSET_BPF_X:
+                if (A & X) {
+                        insn += insn->off;
+                        CONT_JMP;
+                }
+                CONT;
+        BPF_JMP_BPF_JSET_BPF_K:
+                if (A & K) {
+                        insn += insn->off;
+                        CONT_JMP;
+                }
+                CONT;
+        BPF_JMP_BPF_EXIT_0:
+                return R0;
+
+        /* STX and ST and LDX*/
+#define LDST(SIZEOP, SIZE)                                      \
+        BPF_STX_BPF_MEM_##SIZEOP:                               \
+                *(SIZE *)(unsigned long) (A + insn->off) = X;   \
+                CONT;                                           \
+        BPF_ST_BPF_MEM_##SIZEOP:                                \
+                *(SIZE *)(unsigned long) (A + insn->off) = K;   \
+                CONT;                                           \
+        BPF_LDX_BPF_MEM_##SIZEOP:                               \
+                A = *(SIZE *)(unsigned long) (X + insn->off);   \
+                CONT;
+
+        LDST(BPF_B,   u8)
+        LDST(BPF_H,  u16)
+        LDST(BPF_W,  u32)
+        LDST(BPF_DW, u64)
+#undef LDST
+        BPF_STX_BPF_XADD_BPF_W: /* lock xadd *(u32 *)(A + insn->off) += X */
+                atomic_add((u32) X, (atomic_t *)(unsigned long)
+                           (A + insn->off));
+                CONT;
+        BPF_STX_BPF_XADD_BPF_DW: /* lock xadd *(u64 *)(A + insn->off) += X */
+                atomic64_add((u64) X, (atomic64_t *)(unsigned long)
+                             (A + insn->off));
+                CONT;
+        BPF_LD_BPF_ABS_BPF_W: /* R0 = ntohl(*(u32 *) (skb->data + K)) */
+                off = K;
+load_word:
+                /* BPF_LD + BPD_ABS and BPF_LD + BPF_IND insns are only
+                 * appearing in the programs where ctx == skb. All programs
+                 * keep 'ctx' in regs[CTX_REG] == R6, sk_convert_filter()
+                 * saves it in R6, internal BPF verifier will check that
+                 * R6 == ctx.
+                 *
+                 * BPF_ABS and BPF_IND are wrappers of function calls, so
+                 * they scratch R1-R5 registers, preserve R6-R9, and store
+                 * return value into R0.
+                 *
+                 * Implicit input:
+                 *   ctx
+                 *
+                 * Explicit input:
+                 *   X == any register
+                 *   K == 32-bit immediate
+                 *
+                 * Output:
+                 *   R0 - 8/16/32-bit skb data converted to cpu endianness
+                 */
+                ptr = load_pointer((struct sk_buff *) ctx, off, 4, &tmp);
+                if (likely(ptr != NULL)) {
+                        R0 = get_unaligned_be32(ptr);
+                        CONT;
+                }
+                return 0;
+        BPF_LD_BPF_ABS_BPF_H: /* R0 = ntohs(*(u16 *) (skb->data + K)) */
+                off = K;
+load_half:
+                ptr = load_pointer((struct sk_buff *) ctx, off, 2, &tmp);
+                if (likely(ptr != NULL)) {
+                        R0 = get_unaligned_be16(ptr);
+                        CONT;
+                }
+                return 0;
+        BPF_LD_BPF_ABS_BPF_B: /* R0 = *(u8 *) (ctx + K) */
+                off = K;
+load_byte:
+                ptr = load_pointer((struct sk_buff *) ctx, off, 1, &tmp);
+                if (likely(ptr != NULL)) {
+                        R0 = *(u8 *)ptr;
+                        CONT;
+                }
+                return 0;
+        BPF_LD_BPF_IND_BPF_W: /* R0 = ntohl(*(u32 *) (skb->data + X + K)) */
+                off = K + X;
+                goto load_word;
+        BPF_LD_BPF_IND_BPF_H: /* R0 = ntohs(*(u16 *) (skb->data + X + K)) */
+                off = K + X;
+                goto load_half;
+        BPF_LD_BPF_IND_BPF_B: /* R0 = *(u8 *) (skb->data + X + K) */
+                off = K + X;
+                goto load_byte;
+
+        default_label:
+                /* If we ever reach this, we have a bug somewhere. */
+                WARN_RATELIMIT(1, "unknown opcode %02x\n", insn->code);
+                return 0;
+#undef CONT_JMP
+#undef CONT
+
+#undef R0
+#undef X
+#undef A
+#undef K
+}
+
+u32 sk_run_filter_int_seccomp(const struct seccomp_data *ctx,
+                              const struct sock_filter_int *insni)
+    __attribute__ ((alias ("__sk_run_filter")));
+
+u32 sk_run_filter_int_skb(const struct sk_buff *ctx,
+                          const struct sock_filter_int *insni)
+    __attribute__ ((alias ("__sk_run_filter")));
+EXPORT_SYMBOL_GPL(sk_run_filter_int_skb);
+
+/* Helper to find the offset of pkt_type in sk_buff structure. We want
+ * to make sure its still a 3bit field starting at a byte boundary;
+ * taken from arch/x86/net/bpf_jit_comp.c.
+ */
+#define PKT_TYPE_MAX    7
+static unsigned int pkt_type_offset(void)
+{
+        struct sk_buff skb_probe = { .pkt_type = ~0, };
+        u8 *ct = (u8 *) &skb_probe;
+        unsigned int off;
+
+        for (off = 0; off < sizeof(struct sk_buff); off++) {
+                if (ct[off] == PKT_TYPE_MAX)
+                        return off;
+        }
+
+        pr_err_once("Please fix %s, as pkt_type couldn't be found!\n", __func__);
+        return -1;
+}
+
+static u64 __skb_get_pay_offset(u64 ctx, u64 A, u64 X, u64 r4, u64 r5)
+{
+        struct sk_buff *skb = (struct sk_buff *)(long) ctx;
+
+        return __skb_get_poff(skb);
+}
+
+static u64 __skb_get_nlattr(u64 ctx, u64 A, u64 X, u64 r4, u64 r5)
+{
+        struct sk_buff *skb = (struct sk_buff *)(long) ctx;
+        struct nlattr *nla;
+
+        if (skb_is_nonlinear(skb))
+                return 0;
+
+        if (skb->len < sizeof(struct nlattr))
+                return 0;
+
+        if (A > skb->len - sizeof(struct nlattr))
+                return 0;
+
+        nla = nla_find((struct nlattr *) &skb->data[A], skb->len - A, X);
+        if (nla)
+                return (void *) nla - (void *) skb->data;
+
+        return 0;
+}
+
+static u64 __skb_get_nlattr_nest(u64 ctx, u64 A, u64 X, u64 r4, u64 r5)
+{
+        struct sk_buff *skb = (struct sk_buff *)(long) ctx;
+        struct nlattr *nla;
+
+        if (skb_is_nonlinear(skb))
+                return 0;
+
+        if (skb->len < sizeof(struct nlattr))
+                return 0;
+
+        if (A > skb->len - sizeof(struct nlattr))
+                return 0;
+
+        nla = (struct nlattr *) &skb->data[A];
+        if (nla->nla_len > skb->len - A)
+                return 0;
+
+        nla = nla_find_nested(nla, X);
+        if (nla)
+                return (void *) nla - (void *) skb->data;
+
+        return 0;
+}
+
+static u64 __get_raw_cpu_id(u64 ctx, u64 A, u64 X, u64 r4, u64 r5)
+{
+        return raw_smp_processor_id();
+}
+
+/* Register mappings for user programs. */
+#define A_REG           0
+#define X_REG           7
+#define TMP_REG         8
+#define ARG2_REG        2
+#define ARG3_REG        3
+
+static bool convert_bpf_extensions(struct sock_filter *fp,
+                                   struct sock_filter_int **insnp)
+{
+        struct sock_filter_int *insn = *insnp;
+
+        switch (fp->k) {
+        case SKF_AD_OFF + SKF_AD_PROTOCOL:
+                BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, protocol) != 2);
+
+                insn->code = BPF_LDX | BPF_MEM | BPF_H;
+                insn->a_reg = A_REG;
+                insn->x_reg = CTX_REG;
+                insn->off = offsetof(struct sk_buff, protocol);
+                insn++;
+
+                /* A = ntohs(A) [emitting a nop or swap16] */
+                insn->code = BPF_ALU | BPF_END | BPF_FROM_BE;
+                insn->a_reg = A_REG;
+                insn->imm = 16;
+                break;
+
+        case SKF_AD_OFF + SKF_AD_PKTTYPE:
+                insn->code = BPF_LDX | BPF_MEM | BPF_B;
+                insn->a_reg = A_REG;
+                insn->x_reg = CTX_REG;
+                insn->off = pkt_type_offset();
+                if (insn->off < 0)
+                        return false;
+                insn++;
+
+                insn->code = BPF_ALU | BPF_AND | BPF_K;
+                insn->a_reg = A_REG;
+                insn->imm = PKT_TYPE_MAX;
+                break;
+
+        case SKF_AD_OFF + SKF_AD_IFINDEX:
+        case SKF_AD_OFF + SKF_AD_HATYPE:
+                if (FIELD_SIZEOF(struct sk_buff, dev) == 8)
+                        insn->code = BPF_LDX | BPF_MEM | BPF_DW;
+                else
+                        insn->code = BPF_LDX | BPF_MEM | BPF_W;
+                insn->a_reg = TMP_REG;
+                insn->x_reg = CTX_REG;
+                insn->off = offsetof(struct sk_buff, dev);
+                insn++;
+
+                insn->code = BPF_JMP | BPF_JNE | BPF_K;
+                insn->a_reg = TMP_REG;
+                insn->imm = 0;
+                insn->off = 1;
+                insn++;
+
+                insn->code = BPF_JMP | BPF_EXIT;
+                insn++;
+
+                BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, ifindex) != 4);
+                BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, type) != 2);
+
+                insn->a_reg = A_REG;
+                insn->x_reg = TMP_REG;
+
+                if (fp->k == SKF_AD_OFF + SKF_AD_IFINDEX) {
+                        insn->code = BPF_LDX | BPF_MEM | BPF_W;
+                        insn->off = offsetof(struct net_device, ifindex);
+                } else {
+                        insn->code = BPF_LDX | BPF_MEM | BPF_H;
+                        insn->off = offsetof(struct net_device, type);
                 }
-                case BPF_S_ANC_NLATTR_NEST: {
-                        struct nlattr *nla;
-
-                        if (skb_is_nonlinear(skb))
-                                return 0;
-                        if (A > skb->len - sizeof(struct nlattr))
-                                return 0;
-
-                        nla = (struct nlattr *)&skb->data[A];
-                        if (nla->nla_len > A - skb->len)
-                                return 0;
-
-                        nla = nla_find_nested(nla, X);
-                        if (nla)
-                                A = (void *)nla - (void *)skb->data;
-                        else
-                                A = 0;
-                        continue;
+                break;
+
+        case SKF_AD_OFF + SKF_AD_MARK:
+                BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, mark) != 4);
+
+                insn->code = BPF_LDX | BPF_MEM | BPF_W;
+                insn->a_reg = A_REG;
+                insn->x_reg = CTX_REG;
+                insn->off = offsetof(struct sk_buff, mark);
+                break;
+
+        case SKF_AD_OFF + SKF_AD_RXHASH:
+                BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, hash) != 4);
+
+                insn->code = BPF_LDX | BPF_MEM | BPF_W;
+                insn->a_reg = A_REG;
+                insn->x_reg = CTX_REG;
+                insn->off = offsetof(struct sk_buff, hash);
+                break;
+
+        case SKF_AD_OFF + SKF_AD_QUEUE:
+                BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, queue_mapping) != 2);
+
+                insn->code = BPF_LDX | BPF_MEM | BPF_H;
+                insn->a_reg = A_REG;
+                insn->x_reg = CTX_REG;
+                insn->off = offsetof(struct sk_buff, queue_mapping);
+                break;
+
+        case SKF_AD_OFF + SKF_AD_VLAN_TAG:
+        case SKF_AD_OFF + SKF_AD_VLAN_TAG_PRESENT:
+                BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, vlan_tci) != 2);
+
+                insn->code = BPF_LDX | BPF_MEM | BPF_H;
+                insn->a_reg = A_REG;
+                insn->x_reg = CTX_REG;
+                insn->off = offsetof(struct sk_buff, vlan_tci);
+                insn++;
+
+                BUILD_BUG_ON(VLAN_TAG_PRESENT != 0x1000);
+
+                if (fp->k == SKF_AD_OFF + SKF_AD_VLAN_TAG) {
+                        insn->code = BPF_ALU | BPF_AND | BPF_K;
+                        insn->a_reg = A_REG;
+                        insn->imm = ~VLAN_TAG_PRESENT;
+                } else {
+                        insn->code = BPF_ALU | BPF_RSH | BPF_K;
+                        insn->a_reg = A_REG;
+                        insn->imm = 12;
+                        insn++;
+
+                        insn->code = BPF_ALU | BPF_AND | BPF_K;
+                        insn->a_reg = A_REG;
+                        insn->imm = 1;
                 }
-#ifdef CONFIG_SECCOMP_FILTER
-                case BPF_S_ANC_SECCOMP_LD_W:
-                        A = seccomp_bpf_load(fentry->k);
-                        continue;
-#endif
+                break;
+
+        case SKF_AD_OFF + SKF_AD_PAY_OFFSET:
+        case SKF_AD_OFF + SKF_AD_NLATTR:
+        case SKF_AD_OFF + SKF_AD_NLATTR_NEST:
+        case SKF_AD_OFF + SKF_AD_CPU:
+                /* arg1 = ctx */
+                insn->code = BPF_ALU64 | BPF_MOV | BPF_X;
+                insn->a_reg = ARG1_REG;
+                insn->x_reg = CTX_REG;
+                insn++;
+
+                /* arg2 = A */
+                insn->code = BPF_ALU64 | BPF_MOV | BPF_X;
+                insn->a_reg = ARG2_REG;
+                insn->x_reg = A_REG;
+                insn++;
+
+                /* arg3 = X */
+                insn->code = BPF_ALU64 | BPF_MOV | BPF_X;
+                insn->a_reg = ARG3_REG;
+                insn->x_reg = X_REG;
+                insn++;
+
+                /* Emit call(ctx, arg2=A, arg3=X) */
+                insn->code = BPF_JMP | BPF_CALL;
+                switch (fp->k) {
+                case SKF_AD_OFF + SKF_AD_PAY_OFFSET:
+                        insn->imm = __skb_get_pay_offset - __bpf_call_base;
+                        break;
+                case SKF_AD_OFF + SKF_AD_NLATTR:
+                        insn->imm = __skb_get_nlattr - __bpf_call_base;
+                        break;
+                case SKF_AD_OFF + SKF_AD_NLATTR_NEST:
+                        insn->imm = __skb_get_nlattr_nest - __bpf_call_base;
+                        break;
+                case SKF_AD_OFF + SKF_AD_CPU:
+                        insn->imm = __get_raw_cpu_id - __bpf_call_base;
+                        break;
+                }
+                break;
+
+        case SKF_AD_OFF + SKF_AD_ALU_XOR_X:
+                insn->code = BPF_ALU | BPF_XOR | BPF_X;
+                insn->a_reg = A_REG;
+                insn->x_reg = X_REG;
+                break;
+
+        default:
+                /* This is just a dummy call to avoid letting the compiler
+                 * evict __bpf_call_base() as an optimization. Placed here
+                 * where no-one bothers.
+                 */
+                BUG_ON(__bpf_call_base(0, 0, 0, 0, 0) != 0);
+                return false;
+        }
+
+        *insnp = insn;
+        return true;
+}
+
+/**
+ *      sk_convert_filter - convert filter program
+ *      @prog: the user passed filter program
+ *      @len: the length of the user passed filter program
+ *      @new_prog: buffer where converted program will be stored
+ *      @new_len: pointer to store length of converted program
+ *
+ * Remap 'sock_filter' style BPF instruction set to 'sock_filter_ext' style.
+ * Conversion workflow:
+ *
+ * 1) First pass for calculating the new program length:
+ *   sk_convert_filter(old_prog, old_len, NULL, &new_len)
+ *
+ * 2) 2nd pass to remap in two passes: 1st pass finds new
+ *    jump offsets, 2nd pass remapping:
+ *   new_prog = kmalloc(sizeof(struct sock_filter_int) * new_len);
+ *   sk_convert_filter(old_prog, old_len, new_prog, &new_len);
+ *
+ * User BPF's register A is mapped to our BPF register 6, user BPF
+ * register X is mapped to BPF register 7; frame pointer is always
+ * register 10; Context 'void *ctx' is stored in register 1, that is,
+ * for socket filters: ctx == 'struct sk_buff *', for seccomp:
+ * ctx == 'struct seccomp_data *'.
+ */
+int sk_convert_filter(struct sock_filter *prog, int len,
+                      struct sock_filter_int *new_prog, int *new_len)
+{
+        int new_flen = 0, pass = 0, target, i;
+        struct sock_filter_int *new_insn;
+        struct sock_filter *fp;
+        int *addrs = NULL;
+        u8 bpf_src;
+
+        BUILD_BUG_ON(BPF_MEMWORDS * sizeof(u32) > MAX_BPF_STACK);
+        BUILD_BUG_ON(FP_REG + 1 != MAX_BPF_REG);
+
+        if (len <= 0 || len >= BPF_MAXINSNS)
+                return -EINVAL;
+
+        if (new_prog) {
+                addrs = kzalloc(len * sizeof(*addrs), GFP_KERNEL);
+                if (!addrs)
+                        return -ENOMEM;
+        }
+
+do_pass:
+        new_insn = new_prog;
+        fp = prog;
+
+        if (new_insn) {
+                new_insn->code = BPF_ALU64 | BPF_MOV | BPF_X;
+                new_insn->a_reg = CTX_REG;
+                new_insn->x_reg = ARG1_REG;
+        }
+        new_insn++;
+
+        for (i = 0; i < len; fp++, i++) {
+                struct sock_filter_int tmp_insns[6] = { };
+                struct sock_filter_int *insn = tmp_insns;
+
+                if (addrs)
+                        addrs[i] = new_insn - new_prog;
+
+                switch (fp->code) {
+                /* All arithmetic insns and skb loads map as-is. */
+                case BPF_ALU | BPF_ADD | BPF_X:
+                case BPF_ALU | BPF_ADD | BPF_K:
+                case BPF_ALU | BPF_SUB | BPF_X:
+                case BPF_ALU | BPF_SUB | BPF_K:
+                case BPF_ALU | BPF_AND | BPF_X:
+                case BPF_ALU | BPF_AND | BPF_K:
+                case BPF_ALU | BPF_OR | BPF_X:
+                case BPF_ALU | BPF_OR | BPF_K:
+                case BPF_ALU | BPF_LSH | BPF_X:
+                case BPF_ALU | BPF_LSH | BPF_K:
+                case BPF_ALU | BPF_RSH | BPF_X:
+                case BPF_ALU | BPF_RSH | BPF_K:
+                case BPF_ALU | BPF_XOR | BPF_X:
+                case BPF_ALU | BPF_XOR | BPF_K:
+                case BPF_ALU | BPF_MUL | BPF_X:
+                case BPF_ALU | BPF_MUL | BPF_K:
+                case BPF_ALU | BPF_DIV | BPF_X:
+                case BPF_ALU | BPF_DIV | BPF_K:
+                case BPF_ALU | BPF_MOD | BPF_X:
+                case BPF_ALU | BPF_MOD | BPF_K:
+                case BPF_ALU | BPF_NEG:
+                case BPF_LD | BPF_ABS | BPF_W:
+                case BPF_LD | BPF_ABS | BPF_H:
+                case BPF_LD | BPF_ABS | BPF_B:
+                case BPF_LD | BPF_IND | BPF_W:
+                case BPF_LD | BPF_IND | BPF_H:
+                case BPF_LD | BPF_IND | BPF_B:
+                        /* Check for overloaded BPF extension and
+                         * directly convert it if found, otherwise
+                         * just move on with mapping.
+                         */
+                        if (BPF_CLASS(fp->code) == BPF_LD &&
+                            BPF_MODE(fp->code) == BPF_ABS &&
+                            convert_bpf_extensions(fp, &insn))
+                                break;
+
+                        insn->code = fp->code;
+                        insn->a_reg = A_REG;
+                        insn->x_reg = X_REG;
+                        insn->imm = fp->k;
+                        break;
+
+                /* Jump opcodes map as-is, but offsets need adjustment. */
+                case BPF_JMP | BPF_JA:
+                        target = i + fp->k + 1;
+                        insn->code = fp->code;
+#define EMIT_JMP                                                        \
+        do {                                                            \
+                if (target >= len || target < 0)                        \
+                        goto err;                                       \
+                insn->off = addrs ? addrs[target] - addrs[i] - 1 : 0;   \
+                /* Adjust pc relative offset for 2nd or 3rd insn. */    \
+                insn->off -= insn - tmp_insns;                          \
+        } while (0)
+
+                        EMIT_JMP;
+                        break;
+
+                case BPF_JMP | BPF_JEQ | BPF_K:
+                case BPF_JMP | BPF_JEQ | BPF_X:
+                case BPF_JMP | BPF_JSET | BPF_K:
+                case BPF_JMP | BPF_JSET | BPF_X:
+                case BPF_JMP | BPF_JGT | BPF_K:
+                case BPF_JMP | BPF_JGT | BPF_X:
+                case BPF_JMP | BPF_JGE | BPF_K:
+                case BPF_JMP | BPF_JGE | BPF_X:
+                        if (BPF_SRC(fp->code) == BPF_K && (int) fp->k < 0) {
+                                /* BPF immediates are signed, zero extend
+                                 * immediate into tmp register and use it
+                                 * in compare insn.
+                                 */
+                                insn->code = BPF_ALU | BPF_MOV | BPF_K;
+                                insn->a_reg = TMP_REG;
+                                insn->imm = fp->k;
+                                insn++;
+
+                                insn->a_reg = A_REG;
+                                insn->x_reg = TMP_REG;
+                                bpf_src = BPF_X;
+                        } else {
+                                insn->a_reg = A_REG;
+                                insn->x_reg = X_REG;
+                                insn->imm = fp->k;
+                                bpf_src = BPF_SRC(fp->code);
+                        }
+
+                        /* Common case where 'jump_false' is next insn. */
+                        if (fp->jf == 0) {
+                                insn->code = BPF_JMP | BPF_OP(fp->code) | bpf_src;
+                                target = i + fp->jt + 1;
+                                EMIT_JMP;
+                                break;
+                        }
+
+                        /* Convert JEQ into JNE when 'jump_true' is next insn. */
+                        if (fp->jt == 0 && BPF_OP(fp->code) == BPF_JEQ) {
+                                insn->code = BPF_JMP | BPF_JNE | bpf_src;
+                                target = i + fp->jf + 1;
+                                EMIT_JMP;
+                                break;
+                        }
+
+                        /* Other jumps are mapped into two insns: Jxx and JA. */
+                        target = i + fp->jt + 1;
+                        insn->code = BPF_JMP | BPF_OP(fp->code) | bpf_src;
+                        EMIT_JMP;
+                        insn++;
+
+                        insn->code = BPF_JMP | BPF_JA;
+                        target = i + fp->jf + 1;
+                        EMIT_JMP;
+                        break;
+
+                /* ldxb 4 * ([14] & 0xf) is remaped into 6 insns. */
+                case BPF_LDX | BPF_MSH | BPF_B:
+                        insn->code = BPF_ALU64 | BPF_MOV | BPF_X;
+                        insn->a_reg = TMP_REG;
+                        insn->x_reg = A_REG;
+                        insn++;
+
+                        insn->code = BPF_LD | BPF_ABS | BPF_B;
+                        insn->a_reg = A_REG;
+                        insn->imm = fp->k;
+                        insn++;
+
+                        insn->code = BPF_ALU | BPF_AND | BPF_K;
+                        insn->a_reg = A_REG;
+                        insn->imm = 0xf;
+                        insn++;
+
+                        insn->code = BPF_ALU | BPF_LSH | BPF_K;
+                        insn->a_reg = A_REG;
+                        insn->imm = 2;
+                        insn++;
+
+                        insn->code = BPF_ALU64 | BPF_MOV | BPF_X;
+                        insn->a_reg = X_REG;
+                        insn->x_reg = A_REG;
+                        insn++;
+
+                        insn->code = BPF_ALU64 | BPF_MOV | BPF_X;
+                        insn->a_reg = A_REG;
+                        insn->x_reg = TMP_REG;
+                        break;
+
+                /* RET_K, RET_A are remaped into 2 insns. */
+                case BPF_RET | BPF_A:
+                case BPF_RET | BPF_K:
+                        insn->code = BPF_ALU | BPF_MOV |
+                                     (BPF_RVAL(fp->code) == BPF_K ?
+                                      BPF_K : BPF_X);
+                        insn->a_reg = 0;
+                        insn->x_reg = A_REG;
+                        insn->imm = fp->k;
+                        insn++;
+
+                        insn->code = BPF_JMP | BPF_EXIT;
+                        break;
+
+                /* Store to stack. */
+                case BPF_ST:
+                case BPF_STX:
+                        insn->code = BPF_STX | BPF_MEM | BPF_W;
+                        insn->a_reg = FP_REG;
+                        insn->x_reg = fp->code == BPF_ST ? A_REG : X_REG;
+                        insn->off = -(BPF_MEMWORDS - fp->k) * 4;
+                        break;
+
+                /* Load from stack. */
+                case BPF_LD | BPF_MEM:
+                case BPF_LDX | BPF_MEM:
+                        insn->code = BPF_LDX | BPF_MEM | BPF_W;
+                        insn->a_reg = BPF_CLASS(fp->code) == BPF_LD ?
+                                      A_REG : X_REG;
+                        insn->x_reg = FP_REG;
+                        insn->off = -(BPF_MEMWORDS - fp->k) * 4;
+                        break;
+
+                /* A = K or X = K */
+                case BPF_LD | BPF_IMM:
+                case BPF_LDX | BPF_IMM:
+                        insn->code = BPF_ALU | BPF_MOV | BPF_K;
+                        insn->a_reg = BPF_CLASS(fp->code) == BPF_LD ?
+                                      A_REG : X_REG;
+                        insn->imm = fp->k;
+                        break;
+
+                /* X = A */
+                case BPF_MISC | BPF_TAX:
+                        insn->code = BPF_ALU64 | BPF_MOV | BPF_X;
+                        insn->a_reg = X_REG;
+                        insn->x_reg = A_REG;
+                        break;
+
+                /* A = X */
+                case BPF_MISC | BPF_TXA:
+                        insn->code = BPF_ALU64 | BPF_MOV | BPF_X;
+                        insn->a_reg = A_REG;
+                        insn->x_reg = X_REG;
+                        break;
+
+                /* A = skb->len or X = skb->len */
+                case BPF_LD | BPF_W | BPF_LEN:
+                case BPF_LDX | BPF_W | BPF_LEN:
+                        insn->code = BPF_LDX | BPF_MEM | BPF_W;
+                        insn->a_reg = BPF_CLASS(fp->code) == BPF_LD ?
+                                      A_REG : X_REG;
+                        insn->x_reg = CTX_REG;
+                        insn->off = offsetof(struct sk_buff, len);
+                        break;
+
+                /* access seccomp_data fields */
+                case BPF_LDX | BPF_ABS | BPF_W:
+                        insn->code = BPF_LDX | BPF_MEM | BPF_W;
+                        insn->a_reg = A_REG;
+                        insn->x_reg = CTX_REG;
+                        insn->off = fp->k;
+                        break;
+
                 default:
-                        WARN_RATELIMIT(1, "Unknown code:%u jt:%u tf:%u k:%u\n",
-                                       fentry->code, fentry->jt,
-                                       fentry->jf, fentry->k);
-                        return 0;
+                        goto err;
                 }
+
+                insn++;
+                if (new_prog)
+                        memcpy(new_insn, tmp_insns,
+                               sizeof(*insn) * (insn - tmp_insns));
+
+                new_insn += insn - tmp_insns;
         }
 
+        if (!new_prog) {
+                /* Only calculating new length. */
+                *new_len = new_insn - new_prog;
+                return 0;
+        }
+
+        pass++;
+        if (new_flen != new_insn - new_prog) {
+                new_flen = new_insn - new_prog;
+                if (pass > 2)
+                        goto err;
+
+                goto do_pass;
+        }
+
+        kfree(addrs);
+        BUG_ON(*new_len != new_flen);
         return 0;
+err:
+        kfree(addrs);
+        return -EINVAL;
 }
-EXPORT_SYMBOL(sk_run_filter);
 
-/*
- * Security :
+/* Security:
+ *
  * A BPF program is able to use 16 cells of memory to store intermediate
- * values (check u32 mem[BPF_MEMWORDS] in sk_run_filter())
+ * values (check u32 mem[BPF_MEMWORDS] in sk_run_filter()).
+ *
  * As we dont want to clear mem[] array for each packet going through
  * sk_run_filter(), we check that filter loaded by user never try to read
  * a cell if not previously written, and we check all branches to be sure
@@ -629,30 +1381,197 @@ int sk_chk_filter(struct sock_filter *filter, unsigned int flen)
 }
 EXPORT_SYMBOL(sk_chk_filter);
 
+static int sk_store_orig_filter(struct sk_filter *fp,
+                                const struct sock_fprog *fprog)
+{
+        unsigned int fsize = sk_filter_proglen(fprog);
+        struct sock_fprog_kern *fkprog;
+
+        fp->orig_prog = kmalloc(sizeof(*fkprog), GFP_KERNEL);
+        if (!fp->orig_prog)
+                return -ENOMEM;
+
+        fkprog = fp->orig_prog;
+        fkprog->len = fprog->len;
+        fkprog->filter = kmemdup(fp->insns, fsize, GFP_KERNEL);
+        if (!fkprog->filter) {
+                kfree(fp->orig_prog);
+                return -ENOMEM;
+        }
+
+        return 0;
+}
+
+static void sk_release_orig_filter(struct sk_filter *fp)
+{
+        struct sock_fprog_kern *fprog = fp->orig_prog;
+
+        if (fprog) {
+                kfree(fprog->filter);
+                kfree(fprog);
+        }
+}
+
 /**
  *      sk_filter_release_rcu - Release a socket filter by rcu_head
  *      @rcu: rcu_head that contains the sk_filter to free
  */
-void sk_filter_release_rcu(struct rcu_head *rcu)
+static void sk_filter_release_rcu(struct rcu_head *rcu)
 {
         struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
 
+        sk_release_orig_filter(fp);
         bpf_jit_free(fp);
 }
-EXPORT_SYMBOL(sk_filter_release_rcu);
 
-static int __sk_prepare_filter(struct sk_filter *fp)
+/**
+ *      sk_filter_release - release a socket filter
+ *      @fp: filter to remove
+ *
+ *      Remove a filter from a socket and release its resources.
+ */
+static void sk_filter_release(struct sk_filter *fp)
+{
+        if (atomic_dec_and_test(&fp->refcnt))
+                call_rcu(&fp->rcu, sk_filter_release_rcu);
+}
+
+void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp)
+{
+        atomic_sub(sk_filter_size(fp->len), &sk->sk_omem_alloc);
+        sk_filter_release(fp);
+}
+
+void sk_filter_charge(struct sock *sk, struct sk_filter *fp)
+{
+        atomic_inc(&fp->refcnt);
+        atomic_add(sk_filter_size(fp->len), &sk->sk_omem_alloc);
+}
+
+static struct sk_filter *__sk_migrate_realloc(struct sk_filter *fp,
+                                              struct sock *sk,
+                                              unsigned int len)
+{
+        struct sk_filter *fp_new;
+
+        if (sk == NULL)
+                return krealloc(fp, len, GFP_KERNEL);
+
+        fp_new = sock_kmalloc(sk, len, GFP_KERNEL);
+        if (fp_new) {
+                memcpy(fp_new, fp, sizeof(struct sk_filter));
+                /* As we're kepping orig_prog in fp_new along,
+                 * we need to make sure we're not evicting it
+                 * from the old fp.
+                 */
+                fp->orig_prog = NULL;
+                sk_filter_uncharge(sk, fp);
+        }
+
+        return fp_new;
+}
+
+static struct sk_filter *__sk_migrate_filter(struct sk_filter *fp,
+                                             struct sock *sk)
+{
+        struct sock_filter *old_prog;
+        struct sk_filter *old_fp;
+        int i, err, new_len, old_len = fp->len;
+
+        /* We are free to overwrite insns et al right here as it
+         * won't be used at this point in time anymore internally
+         * after the migration to the internal BPF instruction
+         * representation.
+         */
+        BUILD_BUG_ON(sizeof(struct sock_filter) !=
+                     sizeof(struct sock_filter_int));
+
+        /* For now, we need to unfiddle BPF_S_* identifiers in place.
+         * This can sooner or later on be subject to removal, e.g. when
+         * JITs have been converted.
+         */
+        for (i = 0; i < fp->len; i++)
+                sk_decode_filter(&fp->insns[i], &fp->insns[i]);
+
+        /* Conversion cannot happen on overlapping memory areas,
+         * so we need to keep the user BPF around until the 2nd
+         * pass. At this time, the user BPF is stored in fp->insns.
+         */
+        old_prog = kmemdup(fp->insns, old_len * sizeof(struct sock_filter),
+                           GFP_KERNEL);
+        if (!old_prog) {
+                err = -ENOMEM;
+                goto out_err;
+        }
+
+        /* 1st pass: calculate the new program length. */
+        err = sk_convert_filter(old_prog, old_len, NULL, &new_len);
+        if (err)
+                goto out_err_free;
+
+        /* Expand fp for appending the new filter representation. */
+        old_fp = fp;
+        fp = __sk_migrate_realloc(old_fp, sk, sk_filter_size(new_len));
+        if (!fp) {
+                /* The old_fp is still around in case we couldn't
+                 * allocate new memory, so uncharge on that one.
+                 */
+                fp = old_fp;
+                err = -ENOMEM;
+                goto out_err_free;
+        }
+
+        fp->bpf_func = sk_run_filter_int_skb;
+        fp->len = new_len;
+
+        /* 2nd pass: remap sock_filter insns into sock_filter_int insns. */
+        err = sk_convert_filter(old_prog, old_len, fp->insnsi, &new_len);
+        if (err)
+                /* 2nd sk_convert_filter() can fail only if it fails
+                 * to allocate memory, remapping must succeed. Note,
+                 * that at this time old_fp has already been released
+                 * by __sk_migrate_realloc().
+                 */
+                goto out_err_free;
+
+        kfree(old_prog);
+        return fp;
+
+out_err_free:
+        kfree(old_prog);
+out_err:
+        /* Rollback filter setup. */
+        if (sk != NULL)
+                sk_filter_uncharge(sk, fp);
+        else
+                kfree(fp);
+        return ERR_PTR(err);
+}
+
+static struct sk_filter *__sk_prepare_filter(struct sk_filter *fp,
+                                             struct sock *sk)
 {
         int err;
 
-        fp->bpf_func = sk_run_filter;
+        fp->bpf_func = NULL;
+        fp->jited = 0;
 
         err = sk_chk_filter(fp->insns, fp->len);
         if (err)
-                return err;
+                return ERR_PTR(err);
 
+        /* Probe if we can JIT compile the filter and if so, do
+         * the compilation of the filter.
+         */
         bpf_jit_compile(fp);
-        return 0;
+
+        /* JIT compiler couldn't process this filter, so do the
+         * internal BPF translation for the optimized interpreter.
+         */
+        if (!fp->jited)
+                fp = __sk_migrate_filter(fp, sk);
+
+        return fp;
 }
 
 /**
@@ -668,9 +1587,8 @@ static int __sk_prepare_filter(struct sk_filter *fp)
 int sk_unattached_filter_create(struct sk_filter **pfp,
                                 struct sock_fprog *fprog)
 {
+        unsigned int fsize = sk_filter_proglen(fprog);
         struct sk_filter *fp;
-        unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
-        int err;
 
         /* Make sure new filter is there and in the right amounts. */
         if (fprog->filter == NULL)
@@ -679,20 +1597,26 @@ int sk_unattached_filter_create(struct sk_filter **pfp,
         fp = kmalloc(sk_filter_size(fprog->len), GFP_KERNEL);
         if (!fp)
                 return -ENOMEM;
+
         memcpy(fp->insns, fprog->filter, fsize);
 
         atomic_set(&fp->refcnt, 1);
         fp->len = fprog->len;
+        /* Since unattached filters are not copied back to user
+         * space through sk_get_filter(), we do not need to hold
+         * a copy here, and can spare us the work.
+         */
+        fp->orig_prog = NULL;
 
-        err = __sk_prepare_filter(fp);
-        if (err)
-                goto free_mem;
+        /* __sk_prepare_filter() already takes care of uncharging
+         * memory in case something goes wrong.
+         */
+        fp = __sk_prepare_filter(fp, NULL);
+        if (IS_ERR(fp))
+                return PTR_ERR(fp);
 
         *pfp = fp;
         return 0;
-free_mem:
-        kfree(fp);
-        return err;
 }
 EXPORT_SYMBOL_GPL(sk_unattached_filter_create);
 
@@ -715,7 +1639,7 @@ EXPORT_SYMBOL_GPL(sk_unattached_filter_destroy);
 int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
 {
         struct sk_filter *fp, *old_fp;
-        unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
+        unsigned int fsize = sk_filter_proglen(fprog);
         unsigned int sk_fsize = sk_filter_size(fprog->len);
         int err;
 
@@ -729,6 +1653,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
         fp = sock_kmalloc(sk, sk_fsize, GFP_KERNEL);
         if (!fp)
                 return -ENOMEM;
+
         if (copy_from_user(fp->insns, fprog->filter, fsize)) {
                 sock_kfree_s(sk, fp, sk_fsize);
                 return -EFAULT;
@@ -737,18 +1662,26 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
         atomic_set(&fp->refcnt, 1);
         fp->len = fprog->len;
 
-        err = __sk_prepare_filter(fp);
+        err = sk_store_orig_filter(fp, fprog);
         if (err) {
                 sk_filter_uncharge(sk, fp);
-                return err;
+                return -ENOMEM;
         }
 
+        /* __sk_prepare_filter() already takes care of uncharging
+         * memory in case something goes wrong.
+         */
+        fp = __sk_prepare_filter(fp, sk);
+        if (IS_ERR(fp))
+                return PTR_ERR(fp);
+
         old_fp = rcu_dereference_protected(sk->sk_filter,
                                            sock_owned_by_user(sk));
         rcu_assign_pointer(sk->sk_filter, fp);
 
         if (old_fp)
                 sk_filter_uncharge(sk, old_fp);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(sk_attach_filter);
@@ -768,6 +1701,7 @@ int sk_detach_filter(struct sock *sk)
                 sk_filter_uncharge(sk, filter);
                 ret = 0;
         }
+
         return ret;
 }
 EXPORT_SYMBOL_GPL(sk_detach_filter);
@@ -809,7 +1743,6 @@ void sk_decode_filter(struct sock_filter *filt, struct sock_filter *to)
                 [BPF_S_ANC_RXHASH]      = BPF_LD|BPF_B|BPF_ABS,
                 [BPF_S_ANC_CPU]         = BPF_LD|BPF_B|BPF_ABS,
                 [BPF_S_ANC_ALU_XOR_X]   = BPF_LD|BPF_B|BPF_ABS,
-                [BPF_S_ANC_SECCOMP_LD_W] = BPF_LD|BPF_B|BPF_ABS,
                 [BPF_S_ANC_VLAN_TAG]    = BPF_LD|BPF_B|BPF_ABS,
                 [BPF_S_ANC_VLAN_TAG_PRESENT] = BPF_LD|BPF_B|BPF_ABS,
                 [BPF_S_ANC_PAY_OFFSET]  = BPF_LD|BPF_B|BPF_ABS,
@@ -850,34 +1783,41 @@ void sk_decode_filter(struct sock_filter *filt, struct sock_filter *to)
         to->k = filt->k;
 }
 
-int sk_get_filter(struct sock *sk, struct sock_filter __user *ubuf, unsigned int len)
+int sk_get_filter(struct sock *sk, struct sock_filter __user *ubuf,
+                  unsigned int len)
 {
+        struct sock_fprog_kern *fprog;
         struct sk_filter *filter;
-        int i, ret;
+        int ret = 0;
 
         lock_sock(sk);
         filter = rcu_dereference_protected(sk->sk_filter,
-                        sock_owned_by_user(sk));
-        ret = 0;
+                                           sock_owned_by_user(sk));
         if (!filter)
                 goto out;
-        ret = filter->len;
+
+        /* We're copying the filter that has been originally attached,
+         * so no conversion/decode needed anymore.
+         */
+        fprog = filter->orig_prog;
+
+        ret = fprog->len;
         if (!len)
+                /* User space only enquires number of filter blocks. */
                 goto out;
+
         ret = -EINVAL;
-        if (len < filter->len)
+        if (len < fprog->len)
                 goto out;
 
         ret = -EFAULT;
-        for (i = 0; i < filter->len; i++) {
-                struct sock_filter fb;
-
-                sk_decode_filter(&filter->insns[i], &fb);
-                if (copy_to_user(&ubuf[i], &fb, sizeof(fb)))
-                        goto out;
-        }
+        if (copy_to_user(ubuf, fprog->filter, sk_filter_proglen(fprog)))
+                goto out;
 
-        ret = filter->len;
+        /* Instead of bytes, the API requests to return the number
+         * of filter blocks.
+         */
+        ret = fprog->len;
 out:
         release_sock(sk);
         return ret;
diff --git a/net/core/flow.c b/net/core/flow.c
index dfa602ceb8cd..a0348fde1fdf 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -24,6 +24,7 @@
 #include <net/flow.h>
 #include <linux/atomic.h>
 #include <linux/security.h>
+#include <net/net_namespace.h>
 
 struct flow_cache_entry {
         union {
@@ -38,37 +39,14 @@ struct flow_cache_entry {
         struct flow_cache_object        *object;
 };
 
-struct flow_cache_percpu {
-        struct hlist_head               *hash_table;
-        int                             hash_count;
-        u32                             hash_rnd;
-        int                             hash_rnd_recalc;
-        struct tasklet_struct           flush_tasklet;
-};
-
 struct flow_flush_info {
         struct flow_cache               *cache;
         atomic_t                        cpuleft;
         struct completion               completion;
 };
 
-struct flow_cache {
-        u32                             hash_shift;
-        struct flow_cache_percpu __percpu *percpu;
-        struct notifier_block           hotcpu_notifier;
-        int                             low_watermark;
-        int                             high_watermark;
-        struct timer_list               rnd_timer;
-};
-
-atomic_t flow_cache_genid = ATOMIC_INIT(0);
-EXPORT_SYMBOL(flow_cache_genid);
-static struct flow_cache flow_cache_global;
 static struct kmem_cache *flow_cachep __read_mostly;
 
-static DEFINE_SPINLOCK(flow_cache_gc_lock);
-static LIST_HEAD(flow_cache_gc_list);
-
 #define flow_cache_hash_size(cache)     (1 << (cache)->hash_shift)
 #define FLOW_HASH_RND_PERIOD            (10 * 60 * HZ)
 
@@ -84,16 +62,18 @@ static void flow_cache_new_hashrnd(unsigned long arg)
         add_timer(&fc->rnd_timer);
 }
 
-static int flow_entry_valid(struct flow_cache_entry *fle)
+static int flow_entry_valid(struct flow_cache_entry *fle,
+                                struct netns_xfrm *xfrm)
 {
-        if (atomic_read(&flow_cache_genid) != fle->genid)
+        if (atomic_read(&xfrm->flow_cache_genid) != fle->genid)
                 return 0;
         if (fle->object && !fle->object->ops->check(fle->object))
                 return 0;
         return 1;
 }
 
-static void flow_entry_kill(struct flow_cache_entry *fle)
+static void flow_entry_kill(struct flow_cache_entry *fle,
+                                struct netns_xfrm *xfrm)
 {
         if (fle->object)
                 fle->object->ops->delete(fle->object);
@@ -104,26 +84,28 @@ static void flow_cache_gc_task(struct work_struct *work)
 {
         struct list_head gc_list;
         struct flow_cache_entry *fce, *n;
+        struct netns_xfrm *xfrm = container_of(work, struct netns_xfrm,
+                                                flow_cache_gc_work);
 
         INIT_LIST_HEAD(&gc_list);
-        spin_lock_bh(&flow_cache_gc_lock);
-        list_splice_tail_init(&flow_cache_gc_list, &gc_list);
-        spin_unlock_bh(&flow_cache_gc_lock);
+        spin_lock_bh(&xfrm->flow_cache_gc_lock);
+        list_splice_tail_init(&xfrm->flow_cache_gc_list, &gc_list);
+        spin_unlock_bh(&xfrm->flow_cache_gc_lock);
 
         list_for_each_entry_safe(fce, n, &gc_list, u.gc_list)
-                flow_entry_kill(fce);
+                flow_entry_kill(fce, xfrm);
 }
-static DECLARE_WORK(flow_cache_gc_work, flow_cache_gc_task);
 
 static void flow_cache_queue_garbage(struct flow_cache_percpu *fcp,
-                                     int deleted, struct list_head *gc_list)
+                                     int deleted, struct list_head *gc_list,
+                                     struct netns_xfrm *xfrm)
 {
         if (deleted) {
                 fcp->hash_count -= deleted;
-                spin_lock_bh(&flow_cache_gc_lock);
-                list_splice_tail(gc_list, &flow_cache_gc_list);
-                spin_unlock_bh(&flow_cache_gc_lock);
-                schedule_work(&flow_cache_gc_work);
+                spin_lock_bh(&xfrm->flow_cache_gc_lock);
+                list_splice_tail(gc_list, &xfrm->flow_cache_gc_list);
+                spin_unlock_bh(&xfrm->flow_cache_gc_lock);
+                schedule_work(&xfrm->flow_cache_gc_work);
         }
 }
 
@@ -135,6 +117,8 @@ static void __flow_cache_shrink(struct flow_cache *fc,
         struct hlist_node *tmp;
         LIST_HEAD(gc_list);
         int i, deleted = 0;
+        struct netns_xfrm *xfrm = container_of(fc, struct netns_xfrm,
+                                                flow_cache_global);
 
         for (i = 0; i < flow_cache_hash_size(fc); i++) {
                 int saved = 0;
@@ -142,7 +126,7 @@ static void __flow_cache_shrink(struct flow_cache *fc,
                 hlist_for_each_entry_safe(fle, tmp,
                                           &fcp->hash_table[i], u.hlist) {
                         if (saved < shrink_to &&
-                            flow_entry_valid(fle)) {
+                            flow_entry_valid(fle, xfrm)) {
                                 saved++;
                         } else {
                                 deleted++;
@@ -152,7 +136,7 @@ static void __flow_cache_shrink(struct flow_cache *fc,
                 }
         }
 
-        flow_cache_queue_garbage(fcp, deleted, &gc_list);
+        flow_cache_queue_garbage(fcp, deleted, &gc_list, xfrm);
 }
 
 static void flow_cache_shrink(struct flow_cache *fc,
@@ -208,7 +192,7 @@ struct flow_cache_object *
 flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
                   flow_resolve_t resolver, void *ctx)
 {
-        struct flow_cache *fc = &flow_cache_global;
+        struct flow_cache *fc = &net->xfrm.flow_cache_global;
         struct flow_cache_percpu *fcp;
         struct flow_cache_entry *fle, *tfle;
         struct flow_cache_object *flo;
@@ -258,7 +242,7 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
                         hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
                         fcp->hash_count++;
                 }
-        } else if (likely(fle->genid == atomic_read(&flow_cache_genid))) {
+        } else if (likely(fle->genid == atomic_read(&net->xfrm.flow_cache_genid))) {
                 flo = fle->object;
                 if (!flo)
                         goto ret_object;
@@ -279,7 +263,7 @@ nocache:
         }
         flo = resolver(net, key, family, dir, flo, ctx);
         if (fle) {
-                fle->genid = atomic_read(&flow_cache_genid);
+                fle->genid = atomic_read(&net->xfrm.flow_cache_genid);
                 if (!IS_ERR(flo))
                         fle->object = flo;
                 else
@@ -303,12 +287,14 @@ static void flow_cache_flush_tasklet(unsigned long data)
         struct hlist_node *tmp;
         LIST_HEAD(gc_list);
         int i, deleted = 0;
+        struct netns_xfrm *xfrm = container_of(fc, struct netns_xfrm,
+                                                flow_cache_global);
 
         fcp = this_cpu_ptr(fc->percpu);
         for (i = 0; i < flow_cache_hash_size(fc); i++) {
                 hlist_for_each_entry_safe(fle, tmp,
                                           &fcp->hash_table[i], u.hlist) {
-                        if (flow_entry_valid(fle))
+                        if (flow_entry_valid(fle, xfrm))
                                 continue;
 
                         deleted++;
@@ -317,7 +303,7 @@ static void flow_cache_flush_tasklet(unsigned long data)
                 }
         }
 
-        flow_cache_queue_garbage(fcp, deleted, &gc_list);
+        flow_cache_queue_garbage(fcp, deleted, &gc_list, xfrm);
 
         if (atomic_dec_and_test(&info->cpuleft))
                 complete(&info->completion);
@@ -351,10 +337,9 @@ static void flow_cache_flush_per_cpu(void *data)
         tasklet_schedule(tasklet);
 }
 
-void flow_cache_flush(void)
+void flow_cache_flush(struct net *net)
 {
         struct flow_flush_info info;
-        static DEFINE_MUTEX(flow_flush_sem);
         cpumask_var_t mask;
         int i, self;
 
@@ -365,8 +350,8 @@ void flow_cache_flush(void)
 
         /* Don't want cpus going down or up during this. */
         get_online_cpus();
-        mutex_lock(&flow_flush_sem);
-        info.cache = &flow_cache_global;
+        mutex_lock(&net->xfrm.flow_flush_sem);
+        info.cache = &net->xfrm.flow_cache_global;
         for_each_online_cpu(i)
                 if (!flow_cache_percpu_empty(info.cache, i))
                         cpumask_set_cpu(i, mask);
@@ -386,21 +371,23 @@ void flow_cache_flush(void)
         wait_for_completion(&info.completion);
 
 done:
-        mutex_unlock(&flow_flush_sem);
+        mutex_unlock(&net->xfrm.flow_flush_sem);
         put_online_cpus();
         free_cpumask_var(mask);
 }
 
 static void flow_cache_flush_task(struct work_struct *work)
 {
-        flow_cache_flush();
-}
+        struct netns_xfrm *xfrm = container_of(work, struct netns_xfrm,
+                                                flow_cache_gc_work);
+        struct net *net = container_of(xfrm, struct net, xfrm);
 
-static DECLARE_WORK(flow_cache_flush_work, flow_cache_flush_task);
+        flow_cache_flush(net);
+}
 
-void flow_cache_flush_deferred(void)
+void flow_cache_flush_deferred(struct net *net)
 {
-        schedule_work(&flow_cache_flush_work);
+        schedule_work(&net->xfrm.flow_cache_flush_work);
 }
 
 static int flow_cache_cpu_prepare(struct flow_cache *fc, int cpu)
@@ -425,7 +412,8 @@ static int flow_cache_cpu(struct notifier_block *nfb,
                           unsigned long action,
                           void *hcpu)
 {
-        struct flow_cache *fc = container_of(nfb, struct flow_cache, hotcpu_notifier);
+        struct flow_cache *fc = container_of(nfb, struct flow_cache,
+                                                hotcpu_notifier);
         int res, cpu = (unsigned long) hcpu;
         struct flow_cache_percpu *fcp = per_cpu_ptr(fc->percpu, cpu);
 
@@ -444,9 +432,20 @@ static int flow_cache_cpu(struct notifier_block *nfb,
         return NOTIFY_OK;
 }
 
-static int __init flow_cache_init(struct flow_cache *fc)
+int flow_cache_init(struct net *net)
 {
         int i;
+        struct flow_cache *fc = &net->xfrm.flow_cache_global;
+
+        if (!flow_cachep)
+                flow_cachep = kmem_cache_create("flow_cache",
+                                                sizeof(struct flow_cache_entry),
+                                                0, SLAB_PANIC, NULL);
+        spin_lock_init(&net->xfrm.flow_cache_gc_lock);
+        INIT_LIST_HEAD(&net->xfrm.flow_cache_gc_list);
+        INIT_WORK(&net->xfrm.flow_cache_gc_work, flow_cache_gc_task);
+        INIT_WORK(&net->xfrm.flow_cache_flush_work, flow_cache_flush_task);
+        mutex_init(&net->xfrm.flow_flush_sem);
 
         fc->hash_shift = 10;
         fc->low_watermark = 2 * flow_cache_hash_size(fc);
@@ -456,6 +455,8 @@ static int __init flow_cache_init(struct flow_cache *fc)
         if (!fc->percpu)
                 return -ENOMEM;
 
+        cpu_notifier_register_begin();
+
         for_each_online_cpu(i) {
                 if (flow_cache_cpu_prepare(fc, i))
                         goto err;
@@ -463,7 +464,9 @@ static int __init flow_cache_init(struct flow_cache *fc)
         fc->hotcpu_notifier = (struct notifier_block){
                 .notifier_call = flow_cache_cpu,
         };
-        register_hotcpu_notifier(&fc->hotcpu_notifier);
+        __register_hotcpu_notifier(&fc->hotcpu_notifier);
+
+        cpu_notifier_register_done();
 
         setup_timer(&fc->rnd_timer, flow_cache_new_hashrnd,
                     (unsigned long) fc);
@@ -479,19 +482,30 @@ err:
                 fcp->hash_table = NULL;
         }
 
+        cpu_notifier_register_done();
+
         free_percpu(fc->percpu);
         fc->percpu = NULL;
 
         return -ENOMEM;
 }
+EXPORT_SYMBOL(flow_cache_init);
 
-static int __init flow_cache_init_global(void)
+void flow_cache_fini(struct net *net)
 {
-        flow_cachep = kmem_cache_create("flow_cache",
-                                        sizeof(struct flow_cache_entry),
-                                        0, SLAB_PANIC, NULL);
+        int i;
+        struct flow_cache *fc = &net->xfrm.flow_cache_global;
 
-        return flow_cache_init(&flow_cache_global);
-}
+        del_timer_sync(&fc->rnd_timer);
+        unregister_hotcpu_notifier(&fc->hotcpu_notifier);
+
+        for_each_possible_cpu(i) {
+                struct flow_cache_percpu *fcp = per_cpu_ptr(fc->percpu, i);
+                kfree(fcp->hash_table);
+                fcp->hash_table = NULL;
+        }
 
-module_init(flow_cache_init_global);
+        free_percpu(fc->percpu);
+        fc->percpu = NULL;
+}
+EXPORT_SYMBOL(flow_cache_fini);
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index e29e810663d7..107ed12a5323 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -61,7 +61,7 @@ bool skb_flow_dissect(const struct sk_buff *skb, struct flow_keys *flow)
 
 again:
         switch (proto) {
-        case __constant_htons(ETH_P_IP): {
+        case htons(ETH_P_IP): {
                 const struct iphdr *iph;
                 struct iphdr _iph;
 ip:
@@ -77,7 +77,7 @@ ip:
                 iph_to_flow_copy_addrs(flow, iph);
                 break;
         }
-        case __constant_htons(ETH_P_IPV6): {
+        case htons(ETH_P_IPV6): {
                 const struct ipv6hdr *iph;
                 struct ipv6hdr _iph;
 ipv6:
@@ -91,8 +91,8 @@ ipv6:
                 nhoff += sizeof(struct ipv6hdr);
                 break;
         }
-        case __constant_htons(ETH_P_8021AD):
-        case __constant_htons(ETH_P_8021Q): {
+        case htons(ETH_P_8021AD):
+        case htons(ETH_P_8021Q): {
                 const struct vlan_hdr *vlan;
                 struct vlan_hdr _vlan;
 
@@ -104,7 +104,7 @@ ipv6:
                 nhoff += sizeof(*vlan);
                 goto again;
         }
-        case __constant_htons(ETH_P_PPP_SES): {
+        case htons(ETH_P_PPP_SES): {
                 struct {
                         struct pppoe_hdr hdr;
                         __be16 proto;
@@ -115,9 +115,9 @@ ipv6:
                 proto = hdr->proto;
                 nhoff += PPPOE_SES_HLEN;
                 switch (proto) {
-                case __constant_htons(PPP_IP):
+                case htons(PPP_IP):
                         goto ip;
-                case __constant_htons(PPP_IPV6):
+                case htons(PPP_IPV6):
                         goto ipv6;
                 default:
                         return false;
@@ -203,8 +203,8 @@ static __always_inline u32 __flow_hash_1word(u32 a)
 
 /*
  * __skb_get_hash: calculate a flow hash based on src/dst addresses
- * and src/dst port numbers.  Sets rxhash in skb to non-zero hash value
- * on success, zero indicates no valid hash.  Also, sets l4_rxhash in skb
+ * and src/dst port numbers.  Sets hash in skb to non-zero hash value
+ * on success, zero indicates no valid hash.  Also, sets l4_hash in skb
  * if hash is a canonical 4-tuple hash over transport ports.
  */
 void __skb_get_hash(struct sk_buff *skb)
@@ -216,7 +216,7 @@ void __skb_get_hash(struct sk_buff *skb)
                 return;
 
         if (keys.ports)
-                skb->l4_rxhash = 1;
+                skb->l4_hash = 1;
 
         /* get a consistent hash (same value on both flow directions) */
         if (((__force u32)keys.dst < (__force u32)keys.src) ||
@@ -232,7 +232,7 @@ void __skb_get_hash(struct sk_buff *skb)
         if (!hash)
                 hash = 1;
 
-        skb->rxhash = hash;
+        skb->hash = hash;
 }
 EXPORT_SYMBOL(__skb_get_hash);
 
@@ -344,7 +344,7 @@ static inline int get_xps_queue(struct net_device *dev, struct sk_buff *skb)
                                         hash = skb->sk->sk_hash;
                                 else
                                         hash = (__force u16) skb->protocol ^
-                                            skb->rxhash;
+                                            skb->hash;
                                 hash = __flow_hash_1word(hash);
                                 queue_index = map->queues[
                                     ((u64)hash * map->len) >> 32];
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index e16129019c66..8f8a96ef9f3f 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -836,10 +836,10 @@ out:
 static __inline__ int neigh_max_probes(struct neighbour *n)
 {
         struct neigh_parms *p = n->parms;
-        return (n->nud_state & NUD_PROBE) ?
-                NEIGH_VAR(p, UCAST_PROBES) :
-                NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
-                NEIGH_VAR(p, MCAST_PROBES);
+        int max_probes = NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES);
+        if (!(n->nud_state & NUD_PROBE))
+                max_probes += NEIGH_VAR(p, MCAST_PROBES);
+        return max_probes;
 }
 
 static void neigh_invalidate(struct neighbour *neigh)
@@ -945,6 +945,7 @@ static void neigh_timer_handler(unsigned long arg)
                 neigh->nud_state = NUD_FAILED;
                 notify = 1;
                 neigh_invalidate(neigh);
+                goto out;
         }
 
         if (neigh->nud_state & NUD_IN_TIMER) {
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 549043c078c9..1cac29ebb05b 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -104,6 +104,7 @@ static ssize_t netdev_store(struct device *dev, struct device_attribute *attr,
 }
 
 NETDEVICE_SHOW_RO(dev_id, fmt_hex);
+NETDEVICE_SHOW_RO(dev_port, fmt_dec);
 NETDEVICE_SHOW_RO(addr_assign_type, fmt_dec);
 NETDEVICE_SHOW_RO(addr_len, fmt_dec);
 NETDEVICE_SHOW_RO(iflink, fmt_dec);
@@ -252,6 +253,16 @@ static ssize_t operstate_show(struct device *dev,
 }
 static DEVICE_ATTR_RO(operstate);
 
+static ssize_t carrier_changes_show(struct device *dev,
+                                    struct device_attribute *attr,
+                                    char *buf)
+{
+        struct net_device *netdev = to_net_dev(dev);
+        return sprintf(buf, fmt_dec,
+                       atomic_read(&netdev->carrier_changes));
+}
+static DEVICE_ATTR_RO(carrier_changes);
+
 /* read-write attributes */
 
 static int change_mtu(struct net_device *net, unsigned long new_mtu)
@@ -373,6 +384,7 @@ static struct attribute *net_class_attrs[] = {
         &dev_attr_netdev_group.attr,
         &dev_attr_type.attr,
         &dev_attr_dev_id.attr,
+        &dev_attr_dev_port.attr,
         &dev_attr_iflink.attr,
         &dev_attr_ifindex.attr,
         &dev_attr_addr_assign_type.attr,
@@ -384,6 +396,7 @@ static struct attribute *net_class_attrs[] = {
         &dev_attr_duplex.attr,
         &dev_attr_dormant.attr,
         &dev_attr_operstate.attr,
+        &dev_attr_carrier_changes.attr,
         &dev_attr_ifalias.attr,
         &dev_attr_carrier.attr,
         &dev_attr_mtu.attr,
@@ -996,15 +1009,12 @@ static struct attribute_group dql_group = {
 #endif /* CONFIG_BQL */
 
 #ifdef CONFIG_XPS
-static inline unsigned int get_netdev_queue_index(struct netdev_queue *queue)
+static unsigned int get_netdev_queue_index(struct netdev_queue *queue)
 {
         struct net_device *dev = queue->dev;
-        int i;
-
-        for (i = 0; i < dev->num_tx_queues; i++)
-                if (queue == &dev->_tx[i])
-                        break;
+        unsigned int i;
 
+        i = queue - dev->_tx;
         BUG_ON(i >= dev->num_tx_queues);
 
         return i;
diff --git a/net/core/netclassid_cgroup.c b/net/core/netclassid_cgroup.c
index 719efd541668..22931e1b99b4 100644
--- a/net/core/netclassid_cgroup.c
+++ b/net/core/netclassid_cgroup.c
@@ -23,7 +23,7 @@ static inline struct cgroup_cls_state *css_cls_state(struct cgroup_subsys_state
 
 struct cgroup_cls_state *task_cls_state(struct task_struct *p)
 {
-        return css_cls_state(task_css(p, net_cls_subsys_id));
+        return css_cls_state(task_css(p, net_cls_cgrp_id));
 }
 EXPORT_SYMBOL_GPL(task_cls_state);
 
@@ -73,7 +73,7 @@ static void cgrp_attach(struct cgroup_subsys_state *css,
         void *v = (void *)(unsigned long)cs->classid;
         struct task_struct *p;
 
-        cgroup_taskset_for_each(p, css, tset) {
+        cgroup_taskset_for_each(p, tset) {
                 task_lock(p);
                 iterate_fd(p->files, 0, update_classid, v);
                 task_unlock(p);
@@ -102,19 +102,10 @@ static struct cftype ss_files[] = {
         { }     /* terminate */
 };
 
-struct cgroup_subsys net_cls_subsys = {
-        .name                   = "net_cls",
+struct cgroup_subsys net_cls_cgrp_subsys = {
         .css_alloc              = cgrp_css_alloc,
         .css_online             = cgrp_css_online,
         .css_free               = cgrp_css_free,
         .attach                 = cgrp_attach,
-        .subsys_id              = net_cls_subsys_id,
         .base_cftypes           = ss_files,
-        .module                 = THIS_MODULE,
 };
-
-static int __init init_netclassid_cgroup(void)
-{
-        return cgroup_load_subsys(&net_cls_subsys);
-}
-__initcall(init_netclassid_cgroup);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index df9e6b1a9759..e33937fb32a0 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -46,13 +46,9 @@
 
 static struct sk_buff_head skb_pool;
 
-static atomic_t trapped;
-
 DEFINE_STATIC_SRCU(netpoll_srcu);
 
 #define USEC_PER_POLL   50
-#define NETPOLL_RX_ENABLED  1
-#define NETPOLL_RX_DROP     2
 
 #define MAX_SKB_SIZE                                                    \
         (sizeof(struct ethhdr) +                                        \
@@ -61,7 +57,6 @@ DEFINE_STATIC_SRCU(netpoll_srcu);
          MAX_UDP_CHUNK)
 
 static void zap_completion_queue(void);
-static void netpoll_neigh_reply(struct sk_buff *skb, struct netpoll_info *npinfo);
 static void netpoll_async_cleanup(struct work_struct *work);
 
 static unsigned int carrier_timeout = 4;
@@ -74,6 +69,37 @@ module_param(carrier_timeout, uint, 0644);
 #define np_notice(np, fmt, ...)                         \
         pr_notice("%s: " fmt, np->name, ##__VA_ARGS__)
 
+static int netpoll_start_xmit(struct sk_buff *skb, struct net_device *dev,
+                              struct netdev_queue *txq)
+{
+        const struct net_device_ops *ops = dev->netdev_ops;
+        int status = NETDEV_TX_OK;
+        netdev_features_t features;
+
+        features = netif_skb_features(skb);
+
+        if (vlan_tx_tag_present(skb) &&
+            !vlan_hw_offload_capable(features, skb->vlan_proto)) {
+                skb = __vlan_put_tag(skb, skb->vlan_proto,
+                                     vlan_tx_tag_get(skb));
+                if (unlikely(!skb)) {
+                        /* This is actually a packet drop, but we
+                         * don't want the code that calls this
+                         * function to try and operate on a NULL skb.
+                         */
+                        goto out;
+                }
+                skb->vlan_tci = 0;
+        }
+
+        status = ops->ndo_start_xmit(skb, dev);
+        if (status == NETDEV_TX_OK)
+                txq_trans_update(txq);
+
+out:
+        return status;
+}
+
 static void queue_process(struct work_struct *work)
 {
         struct netpoll_info *npinfo =
@@ -83,51 +109,31 @@ static void queue_process(struct work_struct *work)
 
         while ((skb = skb_dequeue(&npinfo->txq))) {
                 struct net_device *dev = skb->dev;
-                const struct net_device_ops *ops = dev->netdev_ops;
                 struct netdev_queue *txq;
 
                 if (!netif_device_present(dev) || !netif_running(dev)) {
-                        __kfree_skb(skb);
+                        kfree_skb(skb);
                         continue;
                 }
 
                 txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
 
                 local_irq_save(flags);
-                __netif_tx_lock(txq, smp_processor_id());
+                HARD_TX_LOCK(dev, txq, smp_processor_id());
                 if (netif_xmit_frozen_or_stopped(txq) ||
-                    ops->ndo_start_xmit(skb, dev) != NETDEV_TX_OK) {
+                    netpoll_start_xmit(skb, dev, txq) != NETDEV_TX_OK) {
                         skb_queue_head(&npinfo->txq, skb);
-                        __netif_tx_unlock(txq);
+                        HARD_TX_UNLOCK(dev, txq);
                         local_irq_restore(flags);
 
                         schedule_delayed_work(&npinfo->tx_work, HZ/10);
                         return;
                 }
-                __netif_tx_unlock(txq);
+                HARD_TX_UNLOCK(dev, txq);
                 local_irq_restore(flags);
         }
 }
 
-static __sum16 checksum_udp(struct sk_buff *skb, struct udphdr *uh,
-                            unsigned short ulen, __be32 saddr, __be32 daddr)
-{
-        __wsum psum;
-
-        if (uh->check == 0 || skb_csum_unnecessary(skb))
-                return 0;
-
-        psum = csum_tcpudp_nofold(saddr, daddr, ulen, IPPROTO_UDP, 0);
-
-        if (skb->ip_summed == CHECKSUM_COMPLETE &&
-            !csum_fold(csum_add(psum, skb->csum)))
-                return 0;
-
-        skb->csum = psum;
-
-        return __skb_checksum_complete(skb);
-}
-
 /*
  * Check whether delayed processing was scheduled for our NIC. If so,
  * we attempt to grab the poll lock and use ->poll() to pump the card.
@@ -138,14 +144,8 @@ static __sum16 checksum_udp(struct sk_buff *skb, struct udphdr *uh,
  * trylock here and interrupts are already disabled in the softirq
  * case. Further, we test the poll_owner to avoid recursion on UP
  * systems where the lock doesn't exist.
- *
- * In cases where there is bi-directional communications, reading only
- * one message at a time can lead to packets being dropped by the
- * network adapter, forcing superfluous retries and possibly timeouts.
- * Thus, we set our budget to greater than 1.
  */
-static int poll_one_napi(struct netpoll_info *npinfo,
-                         struct napi_struct *napi, int budget)
+static int poll_one_napi(struct napi_struct *napi, int budget)
 {
         int work;
 
@@ -156,52 +156,35 @@ static int poll_one_napi(struct netpoll_info *npinfo,
         if (!test_bit(NAPI_STATE_SCHED, &napi->state))
                 return budget;
 
-        npinfo->rx_flags |= NETPOLL_RX_DROP;
-        atomic_inc(&trapped);
         set_bit(NAPI_STATE_NPSVC, &napi->state);
 
         work = napi->poll(napi, budget);
+        WARN_ONCE(work > budget, "%pF exceeded budget in poll\n", napi->poll);
         trace_napi_poll(napi);
 
         clear_bit(NAPI_STATE_NPSVC, &napi->state);
-        atomic_dec(&trapped);
-        npinfo->rx_flags &= ~NETPOLL_RX_DROP;
 
         return budget - work;
 }
 
-static void poll_napi(struct net_device *dev)
+static void poll_napi(struct net_device *dev, int budget)
 {
         struct napi_struct *napi;
-        int budget = 16;
 
         list_for_each_entry(napi, &dev->napi_list, dev_list) {
                 if (napi->poll_owner != smp_processor_id() &&
                     spin_trylock(&napi->poll_lock)) {
-                        budget = poll_one_napi(rcu_dereference_bh(dev->npinfo),
-                                               napi, budget);
+                        budget = poll_one_napi(napi, budget);
                         spin_unlock(&napi->poll_lock);
-
-                        if (!budget)
-                                break;
                 }
         }
 }
 
-static void service_neigh_queue(struct netpoll_info *npi)
-{
-        if (npi) {
-                struct sk_buff *skb;
-
-                while ((skb = skb_dequeue(&npi->neigh_tx)))
-                        netpoll_neigh_reply(skb, npi);
-        }
-}
-
 static void netpoll_poll_dev(struct net_device *dev)
 {
         const struct net_device_ops *ops;
         struct netpoll_info *ni = rcu_dereference_bh(dev->npinfo);
+        int budget = 0;
 
         /* Don't do any rx activity if the dev_lock mutex is held
          * the dev_open/close paths use this to block netpoll activity
@@ -224,31 +207,14 @@ static void netpoll_poll_dev(struct net_device *dev)
         /* Process pending work on NIC */
         ops->ndo_poll_controller(dev);
 
-        poll_napi(dev);
+        poll_napi(dev, budget);
 
         up(&ni->dev_lock);
 
-        if (dev->flags & IFF_SLAVE) {
-                if (ni) {
-                        struct net_device *bond_dev;
-                        struct sk_buff *skb;
-                        struct netpoll_info *bond_ni;
-
-                        bond_dev = netdev_master_upper_dev_get_rcu(dev);
-                        bond_ni = rcu_dereference_bh(bond_dev->npinfo);
-                        while ((skb = skb_dequeue(&ni->neigh_tx))) {
-                                skb->dev = bond_dev;
-                                skb_queue_tail(&bond_ni->neigh_tx, skb);
-                        }
-                }
-        }
-
-        service_neigh_queue(ni);
-
         zap_completion_queue();
 }
 
-void netpoll_rx_disable(struct net_device *dev)
+void netpoll_poll_disable(struct net_device *dev)
 {
         struct netpoll_info *ni;
         int idx;
@@ -259,9 +225,9 @@ void netpoll_rx_disable(struct net_device *dev)
                 down(&ni->dev_lock);
         srcu_read_unlock(&netpoll_srcu, idx);
 }
-EXPORT_SYMBOL(netpoll_rx_disable);
+EXPORT_SYMBOL(netpoll_poll_disable);
 
-void netpoll_rx_enable(struct net_device *dev)
+void netpoll_poll_enable(struct net_device *dev)
 {
         struct netpoll_info *ni;
         rcu_read_lock();
@@ -270,7 +236,7 @@ void netpoll_rx_enable(struct net_device *dev)
                 up(&ni->dev_lock);
         rcu_read_unlock();
 }
-EXPORT_SYMBOL(netpoll_rx_enable);
+EXPORT_SYMBOL(netpoll_poll_enable);
 
 static void refill_skbs(void)
 {
@@ -304,7 +270,7 @@ static void zap_completion_queue(void)
                 while (clist != NULL) {
                         struct sk_buff *skb = clist;
                         clist = clist->next;
-                        if (skb->destructor) {
+                        if (!skb_irq_freeable(skb)) {
                                 atomic_inc(&skb->users);
                                 dev_kfree_skb_any(skb); /* put this one back */
                         } else {
@@ -359,7 +325,6 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
 {
         int status = NETDEV_TX_BUSY;
         unsigned long tries;
-        const struct net_device_ops *ops = dev->netdev_ops;
         /* It is up to the caller to keep npinfo alive. */
         struct netpoll_info *npinfo;
 
@@ -367,7 +332,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
 
         npinfo = rcu_dereference_bh(np->dev->npinfo);
         if (!npinfo || !netif_running(dev) || !netif_device_present(dev)) {
-                __kfree_skb(skb);
+                dev_kfree_skb_irq(skb);
                 return;
         }
 
@@ -380,29 +345,11 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
                 /* try until next clock tick */
                 for (tries = jiffies_to_usecs(1)/USEC_PER_POLL;
                      tries > 0; --tries) {
-                        if (__netif_tx_trylock(txq)) {
-                                if (!netif_xmit_stopped(txq)) {
-                                        if (vlan_tx_tag_present(skb) &&
-                                            !vlan_hw_offload_capable(netif_skb_features(skb),
-                                                                     skb->vlan_proto)) {
-                                                skb = __vlan_put_tag(skb, skb->vlan_proto, vlan_tx_tag_get(skb));
-                                                if (unlikely(!skb)) {
-                                                        /* This is actually a packet drop, but we
-                                                         * don't want the code at the end of this
-                                                         * function to try and re-queue a NULL skb.
-                                                         */
-                                                        status = NETDEV_TX_OK;
-                                                        goto unlock_txq;
-                                                }
-                                                skb->vlan_tci = 0;
-                                        }
-
-                                        status = ops->ndo_start_xmit(skb, dev);
-                                        if (status == NETDEV_TX_OK)
-                                                txq_trans_update(txq);
-                                }
-                        unlock_txq:
-                                __netif_tx_unlock(txq);
+                        if (HARD_TX_TRYLOCK(dev, txq)) {
+                                if (!netif_xmit_stopped(txq))
+                                        status = netpoll_start_xmit(skb, dev, txq);
+
+                                HARD_TX_UNLOCK(dev, txq);
 
                                 if (status == NETDEV_TX_OK)
                                         break;
@@ -417,7 +364,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
 
                 WARN_ONCE(!irqs_disabled(),
                         "netpoll_send_skb_on_dev(): %s enabled interrupts in poll (%pF)\n",
-                        dev->name, ops->ndo_start_xmit);
+                        dev->name, dev->netdev_ops->ndo_start_xmit);
 
         }
 
@@ -529,384 +476,6 @@ void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
 }
 EXPORT_SYMBOL(netpoll_send_udp);
 
-static void netpoll_neigh_reply(struct sk_buff *skb, struct netpoll_info *npinfo)
-{
-        int size, type = ARPOP_REPLY;
-        __be32 sip, tip;
-        unsigned char *sha;
-        struct sk_buff *send_skb;
-        struct netpoll *np, *tmp;
-        unsigned long flags;
-        int hlen, tlen;
-        int hits = 0, proto;
-
-        if (list_empty(&npinfo->rx_np))
-                return;
-
-        /* Before checking the packet, we do some early
-           inspection whether this is interesting at all */
-        spin_lock_irqsave(&npinfo->rx_lock, flags);
-        list_for_each_entry_safe(np, tmp, &npinfo->rx_np, rx) {
-                if (np->dev == skb->dev)
-                        hits++;
-        }
-        spin_unlock_irqrestore(&npinfo->rx_lock, flags);
-
-        /* No netpoll struct is using this dev */
-        if (!hits)
-                return;
-
-        proto = ntohs(eth_hdr(skb)->h_proto);
-        if (proto == ETH_P_ARP) {
-                struct arphdr *arp;
-                unsigned char *arp_ptr;
-                /* No arp on this interface */
-                if (skb->dev->flags & IFF_NOARP)
-                        return;
-
-                if (!pskb_may_pull(skb, arp_hdr_len(skb->dev)))
-                        return;
-
-                skb_reset_network_header(skb);
-                skb_reset_transport_header(skb);
-                arp = arp_hdr(skb);
-
-                if ((arp->ar_hrd != htons(ARPHRD_ETHER) &&
-                     arp->ar_hrd != htons(ARPHRD_IEEE802)) ||
-                    arp->ar_pro != htons(ETH_P_IP) ||
-                    arp->ar_op != htons(ARPOP_REQUEST))
-                        return;
-
-                arp_ptr = (unsigned char *)(arp+1);
-                /* save the location of the src hw addr */
-                sha = arp_ptr;
-                arp_ptr += skb->dev->addr_len;
-                memcpy(&sip, arp_ptr, 4);
-                arp_ptr += 4;
-                /* If we actually cared about dst hw addr,
-                   it would get copied here */
-                arp_ptr += skb->dev->addr_len;
-                memcpy(&tip, arp_ptr, 4);
-
-                /* Should we ignore arp? */
-                if (ipv4_is_loopback(tip) || ipv4_is_multicast(tip))
-                        return;
-
-                size = arp_hdr_len(skb->dev);
-
-                spin_lock_irqsave(&npinfo->rx_lock, flags);
-                list_for_each_entry_safe(np, tmp, &npinfo->rx_np, rx) {
-                        if (tip != np->local_ip.ip)
-                                continue;
-
-                        hlen = LL_RESERVED_SPACE(np->dev);
-                        tlen = np->dev->needed_tailroom;
-                        send_skb = find_skb(np, size + hlen + tlen, hlen);
-                        if (!send_skb)
-                                continue;
-
-                        skb_reset_network_header(send_skb);
-                        arp = (struct arphdr *) skb_put(send_skb, size);
-                        send_skb->dev = skb->dev;
-                        send_skb->protocol = htons(ETH_P_ARP);
-
-                        /* Fill the device header for the ARP frame */
-                        if (dev_hard_header(send_skb, skb->dev, ETH_P_ARP,
-                                            sha, np->dev->dev_addr,
-                                            send_skb->len) < 0) {
-                                kfree_skb(send_skb);
-                                continue;
-                        }
-
-                        /*
-                         * Fill out the arp protocol part.
-                         *
-                         * we only support ethernet device type,
-                         * which (according to RFC 1390) should
-                         * always equal 1 (Ethernet).
-                         */
-
-                        arp->ar_hrd = htons(np->dev->type);
-                        arp->ar_pro = htons(ETH_P_IP);
-                        arp->ar_hln = np->dev->addr_len;
-                        arp->ar_pln = 4;
-                        arp->ar_op = htons(type);
-
-                        arp_ptr = (unsigned char *)(arp + 1);
-                        memcpy(arp_ptr, np->dev->dev_addr, np->dev->addr_len);
-                        arp_ptr += np->dev->addr_len;
-                        memcpy(arp_ptr, &tip, 4);
-                        arp_ptr += 4;
-                        memcpy(arp_ptr, sha, np->dev->addr_len);
-                        arp_ptr += np->dev->addr_len;
-                        memcpy(arp_ptr, &sip, 4);
-
-                        netpoll_send_skb(np, send_skb);
-
-                        /* If there are several rx_skb_hooks for the same
-                         * address we're fine by sending a single reply
-                         */
-                        break;
-                }
-                spin_unlock_irqrestore(&npinfo->rx_lock, flags);
-        } else if( proto == ETH_P_IPV6) {
-#if IS_ENABLED(CONFIG_IPV6)
-                struct nd_msg *msg;
-                u8 *lladdr = NULL;
-                struct ipv6hdr *hdr;
-                struct icmp6hdr *icmp6h;
-                const struct in6_addr *saddr;
-                const struct in6_addr *daddr;
-                struct inet6_dev *in6_dev = NULL;
-                struct in6_addr *target;
-
-                in6_dev = in6_dev_get(skb->dev);
-                if (!in6_dev || !in6_dev->cnf.accept_ra)
-                        return;
-
-                if (!pskb_may_pull(skb, skb->len))
-                        return;
-
-                msg = (struct nd_msg *)skb_transport_header(skb);
-
-                __skb_push(skb, skb->data - skb_transport_header(skb));
-
-                if (ipv6_hdr(skb)->hop_limit != 255)
-                        return;
-                if (msg->icmph.icmp6_code != 0)
-                        return;
-                if (msg->icmph.icmp6_type != NDISC_NEIGHBOUR_SOLICITATION)
-                        return;
-
-                saddr = &ipv6_hdr(skb)->saddr;
-                daddr = &ipv6_hdr(skb)->daddr;
-
-                size = sizeof(struct icmp6hdr) + sizeof(struct in6_addr);
-
-                spin_lock_irqsave(&npinfo->rx_lock, flags);
-                list_for_each_entry_safe(np, tmp, &npinfo->rx_np, rx) {
-                        if (!ipv6_addr_equal(daddr, &np->local_ip.in6))
-                                continue;
-
-                        hlen = LL_RESERVED_SPACE(np->dev);
-                        tlen = np->dev->needed_tailroom;
-                        send_skb = find_skb(np, size + hlen + tlen, hlen);
-                        if (!send_skb)
-                                continue;
-
-                        send_skb->protocol = htons(ETH_P_IPV6);
-                        send_skb->dev = skb->dev;
-
-                        skb_reset_network_header(send_skb);
-                        hdr = (struct ipv6hdr *) skb_put(send_skb, sizeof(struct ipv6hdr));
-                        *(__be32*)hdr = htonl(0x60000000);
-                        hdr->payload_len = htons(size);
-                        hdr->nexthdr = IPPROTO_ICMPV6;
-                        hdr->hop_limit = 255;
-                        hdr->saddr = *saddr;
-                        hdr->daddr = *daddr;
-
-                        icmp6h = (struct icmp6hdr *) skb_put(send_skb, sizeof(struct icmp6hdr));
-                        icmp6h->icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
-                        icmp6h->icmp6_router = 0;
-                        icmp6h->icmp6_solicited = 1;
-
-                        target = (struct in6_addr *) skb_put(send_skb, sizeof(struct in6_addr));
-                        *target = msg->target;
-                        icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, size,
-                                                              IPPROTO_ICMPV6,
-                                                              csum_partial(icmp6h,
-                                                                           size, 0));
-
-                        if (dev_hard_header(send_skb, skb->dev, ETH_P_IPV6,
-                                            lladdr, np->dev->dev_addr,
-                                            send_skb->len) < 0) {
-                                kfree_skb(send_skb);
-                                continue;
-                        }
-
-                        netpoll_send_skb(np, send_skb);
-
-                        /* If there are several rx_skb_hooks for the same
-                         * address, we're fine by sending a single reply
-                         */
-                        break;
-                }
-                spin_unlock_irqrestore(&npinfo->rx_lock, flags);
-#endif
-        }
-}
-
-static bool pkt_is_ns(struct sk_buff *skb)
-{
-        struct nd_msg *msg;
-        struct ipv6hdr *hdr;
-
-        if (skb->protocol != htons(ETH_P_IPV6))
-                return false;
-        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + sizeof(struct nd_msg)))
-                return false;
-
-        msg = (struct nd_msg *)skb_transport_header(skb);
-        __skb_push(skb, skb->data - skb_transport_header(skb));
-        hdr = ipv6_hdr(skb);
-
-        if (hdr->nexthdr != IPPROTO_ICMPV6)
-                return false;
-        if (hdr->hop_limit != 255)
-                return false;
-        if (msg->icmph.icmp6_code != 0)
-                return false;
-        if (msg->icmph.icmp6_type != NDISC_NEIGHBOUR_SOLICITATION)
-                return false;
-
-        return true;
-}
-
-int __netpoll_rx(struct sk_buff *skb, struct netpoll_info *npinfo)
-{
-        int proto, len, ulen, data_len;
-        int hits = 0, offset;
-        const struct iphdr *iph;
-        struct udphdr *uh;
-        struct netpoll *np, *tmp;
-        uint16_t source;
-
-        if (list_empty(&npinfo->rx_np))
-                goto out;
-
-        if (skb->dev->type != ARPHRD_ETHER)
-                goto out;
-
-        /* check if netpoll clients need ARP */
-        if (skb->protocol == htons(ETH_P_ARP) && atomic_read(&trapped)) {
-                skb_queue_tail(&npinfo->neigh_tx, skb);
-                return 1;
-        } else if (pkt_is_ns(skb) && atomic_read(&trapped)) {
-                skb_queue_tail(&npinfo->neigh_tx, skb);
-                return 1;
-        }
-
-        if (skb->protocol == cpu_to_be16(ETH_P_8021Q)) {
-                skb = vlan_untag(skb);
-                if (unlikely(!skb))
-                        goto out;
-        }
-
-        proto = ntohs(eth_hdr(skb)->h_proto);
-        if (proto != ETH_P_IP && proto != ETH_P_IPV6)
-                goto out;
-        if (skb->pkt_type == PACKET_OTHERHOST)
-                goto out;
-        if (skb_shared(skb))
-                goto out;
-
-        if (proto == ETH_P_IP) {
-                if (!pskb_may_pull(skb, sizeof(struct iphdr)))
-                        goto out;
-                iph = (struct iphdr *)skb->data;
-                if (iph->ihl < 5 || iph->version != 4)
-                        goto out;
-                if (!pskb_may_pull(skb, iph->ihl*4))
-                        goto out;
-                iph = (struct iphdr *)skb->data;
-                if (ip_fast_csum((u8 *)iph, iph->ihl) != 0)
-                        goto out;
-
-                len = ntohs(iph->tot_len);
-                if (skb->len < len || len < iph->ihl*4)
-                        goto out;
-
-                /*
-                 * Our transport medium may have padded the buffer out.
-                 * Now We trim to the true length of the frame.
-                 */
-                if (pskb_trim_rcsum(skb, len))
-                        goto out;
-
-                iph = (struct iphdr *)skb->data;
-                if (iph->protocol != IPPROTO_UDP)
-                        goto out;
-
-                len -= iph->ihl*4;
-                uh = (struct udphdr *)(((char *)iph) + iph->ihl*4);
-                offset = (unsigned char *)(uh + 1) - skb->data;
-                ulen = ntohs(uh->len);
-                data_len = skb->len - offset;
-                source = ntohs(uh->source);
-
-                if (ulen != len)
-                        goto out;
-                if (checksum_udp(skb, uh, ulen, iph->saddr, iph->daddr))
-                        goto out;
-                list_for_each_entry_safe(np, tmp, &npinfo->rx_np, rx) {
-                        if (np->local_ip.ip && np->local_ip.ip != iph->daddr)
-                                continue;
-                        if (np->remote_ip.ip && np->remote_ip.ip != iph->saddr)
-                                continue;
-                        if (np->local_port && np->local_port != ntohs(uh->dest))
-                                continue;
-
-                        np->rx_skb_hook(np, source, skb, offset, data_len);
-                        hits++;
-                }
-        } else {
-#if IS_ENABLED(CONFIG_IPV6)
-                const struct ipv6hdr *ip6h;
-
-                if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
-                        goto out;
-                ip6h = (struct ipv6hdr *)skb->data;
-                if (ip6h->version != 6)
-                        goto out;
-                len = ntohs(ip6h->payload_len);
-                if (!len)
-                        goto out;
-                if (len + sizeof(struct ipv6hdr) > skb->len)
-                        goto out;
-                if (pskb_trim_rcsum(skb, len + sizeof(struct ipv6hdr)))
-                        goto out;
-                ip6h = ipv6_hdr(skb);
-                if (!pskb_may_pull(skb, sizeof(struct udphdr)))
-                        goto out;
-                uh = udp_hdr(skb);
-                offset = (unsigned char *)(uh + 1) - skb->data;
-                ulen = ntohs(uh->len);
-                data_len = skb->len - offset;
-                source = ntohs(uh->source);
-                if (ulen != skb->len)
-                        goto out;
-                if (udp6_csum_init(skb, uh, IPPROTO_UDP))
-                        goto out;
-                list_for_each_entry_safe(np, tmp, &npinfo->rx_np, rx) {
-                        if (!ipv6_addr_equal(&np->local_ip.in6, &ip6h->daddr))
-                                continue;
-                        if (!ipv6_addr_equal(&np->remote_ip.in6, &ip6h->saddr))
-                                continue;
-                        if (np->local_port && np->local_port != ntohs(uh->dest))
-                                continue;
-
-                        np->rx_skb_hook(np, source, skb, offset, data_len);
-                        hits++;
-                }
-#endif
-        }
-
-        if (!hits)
-                goto out;
-
-        kfree_skb(skb);
-        return 1;
-
-out:
-        if (atomic_read(&trapped)) {
-                kfree_skb(skb);
-                return 1;
-        }
-
-        return 0;
-}
-
 void netpoll_print_options(struct netpoll *np)
 {
         np_info(np, "local port %d\n", np->local_port);
@@ -1026,11 +595,10 @@ int netpoll_parse_options(struct netpoll *np, char *opt)
 }
 EXPORT_SYMBOL(netpoll_parse_options);
 
-int __netpoll_setup(struct netpoll *np, struct net_device *ndev, gfp_t gfp)
+int __netpoll_setup(struct netpoll *np, struct net_device *ndev)
 {
         struct netpoll_info *npinfo;
         const struct net_device_ops *ops;
-        unsigned long flags;
         int err;
 
         np->dev = ndev;
@@ -1046,18 +614,13 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev, gfp_t gfp)
         }
 
         if (!ndev->npinfo) {
-                npinfo = kmalloc(sizeof(*npinfo), gfp);
+                npinfo = kmalloc(sizeof(*npinfo), GFP_KERNEL);
                 if (!npinfo) {
                         err = -ENOMEM;
                         goto out;
                 }
 
-                npinfo->rx_flags = 0;
-                INIT_LIST_HEAD(&npinfo->rx_np);
-
-                spin_lock_init(&npinfo->rx_lock);
                 sema_init(&npinfo->dev_lock, 1);
-                skb_queue_head_init(&npinfo->neigh_tx);
                 skb_queue_head_init(&npinfo->txq);
                 INIT_DELAYED_WORK(&npinfo->tx_work, queue_process);
 
@@ -1065,7 +628,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev, gfp_t gfp)
 
                 ops = np->dev->netdev_ops;
                 if (ops->ndo_netpoll_setup) {
-                        err = ops->ndo_netpoll_setup(ndev, npinfo, gfp);
+                        err = ops->ndo_netpoll_setup(ndev, npinfo);
                         if (err)
                                 goto free_npinfo;
                 }
@@ -1076,13 +639,6 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev, gfp_t gfp)
 
         npinfo->netpoll = np;
 
-        if (np->rx_skb_hook) {
-                spin_lock_irqsave(&npinfo->rx_lock, flags);
-                npinfo->rx_flags |= NETPOLL_RX_ENABLED;
-                list_add_tail(&np->rx, &npinfo->rx_np);
-                spin_unlock_irqrestore(&npinfo->rx_lock, flags);
-        }
-
         /* last thing to do is link it to the net device structure */
         rcu_assign_pointer(ndev->npinfo, npinfo);
 
@@ -1204,7 +760,7 @@ int netpoll_setup(struct netpoll *np)
         /* fill up the skb queue */
         refill_skbs();
 
-        err = __netpoll_setup(np, ndev, GFP_KERNEL);
+        err = __netpoll_setup(np, ndev);
         if (err)
                 goto put;
 
@@ -1231,7 +787,6 @@ static void rcu_cleanup_netpoll_info(struct rcu_head *rcu_head)
         struct netpoll_info *npinfo =
                         container_of(rcu_head, struct netpoll_info, rcu);
 
-        skb_queue_purge(&npinfo->neigh_tx);
         skb_queue_purge(&npinfo->txq);
 
         /* we can't call cancel_delayed_work_sync here, as we are in softirq */
@@ -1247,7 +802,6 @@ static void rcu_cleanup_netpoll_info(struct rcu_head *rcu_head)
 void __netpoll_cleanup(struct netpoll *np)
 {
         struct netpoll_info *npinfo;
-        unsigned long flags;
 
         /* rtnl_dereference would be preferable here but
          * rcu_cleanup_netpoll path can put us in here safely without
@@ -1257,14 +811,6 @@ void __netpoll_cleanup(struct netpoll *np)
         if (!npinfo)
                 return;
 
-        if (!list_empty(&npinfo->rx_np)) {
-                spin_lock_irqsave(&npinfo->rx_lock, flags);
-                list_del(&np->rx);
-                if (list_empty(&npinfo->rx_np))
-                        npinfo->rx_flags &= ~NETPOLL_RX_ENABLED;
-                spin_unlock_irqrestore(&npinfo->rx_lock, flags);
-        }
-
         synchronize_srcu(&netpoll_srcu);
 
         if (atomic_dec_and_test(&npinfo->refcnt)) {
@@ -1274,7 +820,7 @@ void __netpoll_cleanup(struct netpoll *np)
                 if (ops->ndo_netpoll_cleanup)
                         ops->ndo_netpoll_cleanup(np->dev);
 
-                rcu_assign_pointer(np->dev->npinfo, NULL);
+                RCU_INIT_POINTER(np->dev->npinfo, NULL);
                 call_rcu_bh(&npinfo->rcu, rcu_cleanup_netpoll_info);
         }
 }
@@ -1308,18 +854,3 @@ out:
         rtnl_unlock();
 }
 EXPORT_SYMBOL(netpoll_cleanup);
-
-int netpoll_trap(void)
-{
-        return atomic_read(&trapped);
-}
-EXPORT_SYMBOL(netpoll_trap);
-
-void netpoll_set_trap(int trap)
-{
-        if (trap)
-                atomic_inc(&trapped);
-        else
-                atomic_dec(&trapped);
-}
-EXPORT_SYMBOL(netpoll_set_trap);
diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
index 9043caedcd08..3825f669147b 100644
--- a/net/core/netprio_cgroup.c
+++ b/net/core/netprio_cgroup.c
@@ -186,7 +186,7 @@ static int read_priomap(struct seq_file *sf, void *v)
 }
 
 static int write_priomap(struct cgroup_subsys_state *css, struct cftype *cft,
-                         const char *buffer)
+                         char *buffer)
 {
         char devname[IFNAMSIZ + 1];
         struct net_device *dev;
@@ -224,7 +224,7 @@ static void net_prio_attach(struct cgroup_subsys_state *css,
         struct task_struct *p;
         void *v = (void *)(unsigned long)css->cgroup->id;
 
-        cgroup_taskset_for_each(p, css, tset) {
+        cgroup_taskset_for_each(p, tset) {
                 task_lock(p);
                 iterate_fd(p->files, 0, update_netprio, v);
                 task_unlock(p);
@@ -244,15 +244,12 @@ static struct cftype ss_files[] = {
         { }     /* terminate */
 };
 
-struct cgroup_subsys net_prio_subsys = {
-        .name           = "net_prio",
+struct cgroup_subsys net_prio_cgrp_subsys = {
         .css_alloc      = cgrp_css_alloc,
         .css_online     = cgrp_css_online,
         .css_free       = cgrp_css_free,
         .attach         = net_prio_attach,
-        .subsys_id      = net_prio_subsys_id,
         .base_cftypes   = ss_files,
-        .module         = THIS_MODULE,
 };
 
 static int netprio_device_event(struct notifier_block *unused,
@@ -283,37 +280,9 @@ static struct notifier_block netprio_device_notifier = {
 
 static int __init init_cgroup_netprio(void)
 {
-        int ret;
-
-        ret = cgroup_load_subsys(&net_prio_subsys);
-        if (ret)
-                goto out;
-
         register_netdevice_notifier(&netprio_device_notifier);
-
-out:
-        return ret;
-}
-
-static void __exit exit_cgroup_netprio(void)
-{
-        struct netprio_map *old;
-        struct net_device *dev;
-
-        unregister_netdevice_notifier(&netprio_device_notifier);
-
-        cgroup_unload_subsys(&net_prio_subsys);
-
-        rtnl_lock();
-        for_each_netdev(&init_net, dev) {
-                old = rtnl_dereference(dev->priomap);
-                RCU_INIT_POINTER(dev->priomap, NULL);
-                if (old)
-                        kfree_rcu(old, rcu);
-        }
-        rtnl_unlock();
+        return 0;
 }
 
-module_init(init_cgroup_netprio);
-module_exit(exit_cgroup_netprio);
+subsys_initcall(init_cgroup_netprio);
 MODULE_LICENSE("GPL v2");
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index fdac61cac1bd..0304f981f7ff 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -476,23 +476,22 @@ static int pgctrl_show(struct seq_file *seq, void *v)
 static ssize_t pgctrl_write(struct file *file, const char __user *buf,
                             size_t count, loff_t *ppos)
 {
-        int err = 0;
         char data[128];
         struct pktgen_net *pn = net_generic(current->nsproxy->net_ns, pg_net_id);
 
-        if (!capable(CAP_NET_ADMIN)) {
-                err = -EPERM;
-                goto out;
-        }
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        if (count == 0)
+                return -EINVAL;
 
         if (count > sizeof(data))
                 count = sizeof(data);
 
-        if (copy_from_user(data, buf, count)) {
-                err = -EFAULT;
-                goto out;
-        }
-        data[count - 1] = 0;    /* Make string */
+        if (copy_from_user(data, buf, count))
+                return -EFAULT;
+
+        data[count - 1] = 0;    /* Strip trailing '\n' and terminate string */
 
         if (!strcmp(data, "stop"))
                 pktgen_stop_all_threads_ifs(pn);
@@ -506,10 +505,7 @@ static ssize_t pgctrl_write(struct file *file, const char __user *buf,
         else
                 pr_warning("Unknown command: %s\n", data);
 
-        err = count;
-
-out:
-        return err;
+        return count;
 }
 
 static int pgctrl_open(struct inode *inode, struct file *file)
@@ -1251,7 +1247,13 @@ static ssize_t pktgen_if_write(struct file *file,
                                 "Flag -:%s:- unknown\nAvailable flags, (prepend ! to un-set flag):\n%s",
                                 f,
                                 "IPSRC_RND, IPDST_RND, UDPSRC_RND, UDPDST_RND, "
-                                "MACSRC_RND, MACDST_RND, TXSIZE_RND, IPV6, MPLS_RND, VID_RND, SVID_RND, FLOW_SEQ, IPSEC, NODE_ALLOC\n");
+                                "MACSRC_RND, MACDST_RND, TXSIZE_RND, IPV6, "
+                                "MPLS_RND, VID_RND, SVID_RND, FLOW_SEQ, "
+                                "QUEUE_MAP_RND, QUEUE_MAP_CPU, UDPCSUM, "
+#ifdef CONFIG_XFRM
+                                "IPSEC, "
+#endif
+                                "NODE_ALLOC\n");
                         return count;
                 }
                 sprintf(pg_result, "OK: flags=0x%x", pkt_dev->flags);
@@ -3336,9 +3338,11 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
         queue_map = skb_get_queue_mapping(pkt_dev->skb);
         txq = netdev_get_tx_queue(odev, queue_map);
 
-        __netif_tx_lock_bh(txq);
+        local_bh_disable();
 
-        if (unlikely(netif_xmit_frozen_or_stopped(txq))) {
+        HARD_TX_LOCK(odev, txq, smp_processor_id());
+
+        if (unlikely(netif_xmit_frozen_or_drv_stopped(txq))) {
                 ret = NETDEV_TX_BUSY;
                 pkt_dev->last_ok = 0;
                 goto unlock;
@@ -3372,7 +3376,9 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
                 pkt_dev->last_ok = 0;
         }
 unlock:
-        __netif_tx_unlock_bh(txq);
+        HARD_TX_UNLOCK(odev, txq);
+
+        local_bh_enable();
 
         /* If pkt_dev->count is zero, then run forever */
         if ((pkt_dev->count != 0) && (pkt_dev->sofar >= pkt_dev->count)) {
diff --git a/net/core/ptp_classifier.c b/net/core/ptp_classifier.c
new file mode 100644
index 000000000000..eaba0f68f860
--- /dev/null
+++ b/net/core/ptp_classifier.c
@@ -0,0 +1,141 @@
+/* PTP classifier
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ */
+
+/* The below program is the bpf_asm (tools/net/) representation of
+ * the opcode array in the ptp_filter structure.
+ *
+ * For convenience, this can easily be altered and reviewed with
+ * bpf_asm and bpf_dbg, e.g. `./bpf_asm -c prog` where prog is a
+ * simple file containing the below program:
+ *
+ * ldh [12]                        ; load ethertype
+ *
+ * ; PTP over UDP over IPv4 over Ethernet
+ * test_ipv4:
+ *   jneq #0x800, test_ipv6        ; ETH_P_IP ?
+ *   ldb [23]                      ; load proto
+ *   jneq #17, drop_ipv4           ; IPPROTO_UDP ?
+ *   ldh [20]                      ; load frag offset field
+ *   jset #0x1fff, drop_ipv4       ; don't allow fragments
+ *   ldxb 4*([14]&0xf)             ; load IP header len
+ *   ldh [x + 16]                  ; load UDP dst port
+ *   jneq #319, drop_ipv4          ; is port PTP_EV_PORT ?
+ *   ldh [x + 22]                  ; load payload
+ *   and #0xf                      ; mask PTP_CLASS_VMASK
+ *   or #0x10                      ; PTP_CLASS_IPV4
+ *   ret a                         ; return PTP class
+ *   drop_ipv4: ret #0x0           ; PTP_CLASS_NONE
+ *
+ * ; PTP over UDP over IPv6 over Ethernet
+ * test_ipv6:
+ *   jneq #0x86dd, test_8021q      ; ETH_P_IPV6 ?
+ *   ldb [20]                      ; load proto
+ *   jneq #17, drop_ipv6           ; IPPROTO_UDP ?
+ *   ldh [56]                      ; load UDP dst port
+ *   jneq #319, drop_ipv6          ; is port PTP_EV_PORT ?
+ *   ldh [62]                      ; load payload
+ *   and #0xf                      ; mask PTP_CLASS_VMASK
+ *   or #0x20                      ; PTP_CLASS_IPV6
+ *   ret a                         ; return PTP class
+ *   drop_ipv6: ret #0x0           ; PTP_CLASS_NONE
+ *
+ * ; PTP over 802.1Q over Ethernet
+ * test_8021q:
+ *   jneq #0x8100, test_ieee1588   ; ETH_P_8021Q ?
+ *   ldh [16]                      ; load inner type
+ *   jneq #0x88f7, drop_ieee1588   ; ETH_P_1588 ?
+ *   ldb [18]                      ; load payload
+ *   and #0x8                      ; as we don't have ports here, test
+ *   jneq #0x0, drop_ieee1588      ; for PTP_GEN_BIT and drop these
+ *   ldh [18]                      ; reload payload
+ *   and #0xf                      ; mask PTP_CLASS_VMASK
+ *   or #0x40                      ; PTP_CLASS_V2_VLAN
+ *   ret a                         ; return PTP class
+ *
+ * ; PTP over Ethernet
+ * test_ieee1588:
+ *   jneq #0x88f7, drop_ieee1588   ; ETH_P_1588 ?
+ *   ldb [14]                      ; load payload
+ *   and #0x8                      ; as we don't have ports here, test
+ *   jneq #0x0, drop_ieee1588      ; for PTP_GEN_BIT and drop these
+ *   ldh [14]                      ; reload payload
+ *   and #0xf                      ; mask PTP_CLASS_VMASK
+ *   or #0x30                      ; PTP_CLASS_L2
+ *   ret a                         ; return PTP class
+ *   drop_ieee1588: ret #0x0       ; PTP_CLASS_NONE
+ */
+
+#include <linux/skbuff.h>
+#include <linux/filter.h>
+#include <linux/ptp_classify.h>
+
+static struct sk_filter *ptp_insns __read_mostly;
+
+unsigned int ptp_classify_raw(const struct sk_buff *skb)
+{
+        return SK_RUN_FILTER(ptp_insns, skb);
+}
+EXPORT_SYMBOL_GPL(ptp_classify_raw);
+
+void __init ptp_classifier_init(void)
+{
+        static struct sock_filter ptp_filter[] = {
+                { 0x28,  0,  0, 0x0000000c },
+                { 0x15,  0, 12, 0x00000800 },
+                { 0x30,  0,  0, 0x00000017 },
+                { 0x15,  0,  9, 0x00000011 },
+                { 0x28,  0,  0, 0x00000014 },
+                { 0x45,  7,  0, 0x00001fff },
+                { 0xb1,  0,  0, 0x0000000e },
+                { 0x48,  0,  0, 0x00000010 },
+                { 0x15,  0,  4, 0x0000013f },
+                { 0x48,  0,  0, 0x00000016 },
+                { 0x54,  0,  0, 0x0000000f },
+                { 0x44,  0,  0, 0x00000010 },
+                { 0x16,  0,  0, 0x00000000 },
+                { 0x06,  0,  0, 0x00000000 },
+                { 0x15,  0,  9, 0x000086dd },
+                { 0x30,  0,  0, 0x00000014 },
+                { 0x15,  0,  6, 0x00000011 },
+                { 0x28,  0,  0, 0x00000038 },
+                { 0x15,  0,  4, 0x0000013f },
+                { 0x28,  0,  0, 0x0000003e },
+                { 0x54,  0,  0, 0x0000000f },
+                { 0x44,  0,  0, 0x00000020 },
+                { 0x16,  0,  0, 0x00000000 },
+                { 0x06,  0,  0, 0x00000000 },
+                { 0x15,  0,  9, 0x00008100 },
+                { 0x28,  0,  0, 0x00000010 },
+                { 0x15,  0, 15, 0x000088f7 },
+                { 0x30,  0,  0, 0x00000012 },
+                { 0x54,  0,  0, 0x00000008 },
+                { 0x15,  0, 12, 0x00000000 },
+                { 0x28,  0,  0, 0x00000012 },
+                { 0x54,  0,  0, 0x0000000f },
+                { 0x44,  0,  0, 0x00000040 },
+                { 0x16,  0,  0, 0x00000000 },
+                { 0x15,  0,  7, 0x000088f7 },
+                { 0x30,  0,  0, 0x0000000e },
+                { 0x54,  0,  0, 0x00000008 },
+                { 0x15,  0,  4, 0x00000000 },
+                { 0x28,  0,  0, 0x0000000e },
+                { 0x54,  0,  0, 0x0000000f },
+                { 0x44,  0,  0, 0x00000030 },
+                { 0x16,  0,  0, 0x00000000 },
+                { 0x06,  0,  0, 0x00000000 },
+        };
+        struct sock_fprog ptp_prog = {
+                .len = ARRAY_SIZE(ptp_filter), .filter = ptp_filter,
+        };
+
+        BUG_ON(sk_unattached_filter_create(&ptp_insns, &ptp_prog));
+}
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index 4425148d2b51..467f326126e0 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -221,5 +221,4 @@ void reqsk_fastopen_remove(struct sock *sk, struct request_sock *req,
 out:
         spin_unlock_bh(&fastopenq->lock);
         sock_put(lsk);
-        return;
 }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 120eecc0f5a4..d4ff41739b0f 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -822,6 +822,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
                + nla_total_size(4) /* IFLA_NUM_RX_QUEUES */
                + nla_total_size(1) /* IFLA_OPERSTATE */
                + nla_total_size(1) /* IFLA_LINKMODE */
+               + nla_total_size(4) /* IFLA_CARRIER_CHANGES */
                + nla_total_size(ext_filter_mask
                                 & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
                + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
@@ -970,7 +971,9 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
             (dev->qdisc &&
              nla_put_string(skb, IFLA_QDISC, dev->qdisc->ops->id)) ||
             (dev->ifalias &&
-             nla_put_string(skb, IFLA_IFALIAS, dev->ifalias)))
+             nla_put_string(skb, IFLA_IFALIAS, dev->ifalias)) ||
+            nla_put_u32(skb, IFLA_CARRIER_CHANGES,
+                        atomic_read(&dev->carrier_changes)))
                 goto nla_put_failure;
 
         if (1) {
@@ -1121,56 +1124,7 @@ nla_put_failure:
         return -EMSGSIZE;
 }
 
-static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
-{
-        struct net *net = sock_net(skb->sk);
-        int h, s_h;
-        int idx = 0, s_idx;
-        struct net_device *dev;
-        struct hlist_head *head;
-        struct nlattr *tb[IFLA_MAX+1];
-        u32 ext_filter_mask = 0;
-
-        s_h = cb->args[0];
-        s_idx = cb->args[1];
-
-        rcu_read_lock();
-        cb->seq = net->dev_base_seq;
-
-        if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
-                        ifla_policy) >= 0) {
-
-                if (tb[IFLA_EXT_MASK])
-                        ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
-        }
-
-        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
-                idx = 0;
-                head = &net->dev_index_head[h];
-                hlist_for_each_entry_rcu(dev, head, index_hlist) {
-                        if (idx < s_idx)
-                                goto cont;
-                        if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
-                                             NETLINK_CB(cb->skb).portid,
-                                             cb->nlh->nlmsg_seq, 0,
-                                             NLM_F_MULTI,
-                                             ext_filter_mask) <= 0)
-                                goto out;
-
-                        nl_dump_check_consistent(cb, nlmsg_hdr(skb));
-cont:
-                        idx++;
-                }
-        }
-out:
-        rcu_read_unlock();
-        cb->args[1] = idx;
-        cb->args[0] = h;
-
-        return skb->len;
-}
-
-const struct nla_policy ifla_policy[IFLA_MAX+1] = {
+static const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_IFNAME]           = { .type = NLA_STRING, .len = IFNAMSIZ-1 },
         [IFLA_ADDRESS]          = { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
         [IFLA_BROADCAST]        = { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
@@ -1196,8 +1150,8 @@ const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_NUM_TX_QUEUES]    = { .type = NLA_U32 },
         [IFLA_NUM_RX_QUEUES]    = { .type = NLA_U32 },
         [IFLA_PHYS_PORT_ID]     = { .type = NLA_BINARY, .len = MAX_PHYS_PORT_ID_LEN },
+        [IFLA_CARRIER_CHANGES]  = { .type = NLA_U32 },  /* ignored */
 };
-EXPORT_SYMBOL(ifla_policy);
 
 static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
         [IFLA_INFO_KIND]        = { .type = NLA_STRING },
@@ -1235,6 +1189,61 @@ static const struct nla_policy ifla_port_policy[IFLA_PORT_MAX+1] = {
         [IFLA_PORT_RESPONSE]    = { .type = NLA_U16, },
 };
 
+static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        struct net *net = sock_net(skb->sk);
+        int h, s_h;
+        int idx = 0, s_idx;
+        struct net_device *dev;
+        struct hlist_head *head;
+        struct nlattr *tb[IFLA_MAX+1];
+        u32 ext_filter_mask = 0;
+
+        s_h = cb->args[0];
+        s_idx = cb->args[1];
+
+        rcu_read_lock();
+        cb->seq = net->dev_base_seq;
+
+        if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
+                        ifla_policy) >= 0) {
+
+                if (tb[IFLA_EXT_MASK])
+                        ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+        }
+
+        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
+                idx = 0;
+                head = &net->dev_index_head[h];
+                hlist_for_each_entry_rcu(dev, head, index_hlist) {
+                        if (idx < s_idx)
+                                goto cont;
+                        if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
+                                             NETLINK_CB(cb->skb).portid,
+                                             cb->nlh->nlmsg_seq, 0,
+                                             NLM_F_MULTI,
+                                             ext_filter_mask) <= 0)
+                                goto out;
+
+                        nl_dump_check_consistent(cb, nlmsg_hdr(skb));
+cont:
+                        idx++;
+                }
+        }
+out:
+        rcu_read_unlock();
+        cb->args[1] = idx;
+        cb->args[0] = h;
+
+        return skb->len;
+}
+
+int rtnl_nla_parse_ifla(struct nlattr **tb, const struct nlattr *head, int len)
+{
+        return nla_parse(tb, IFLA_MAX, head, len, ifla_policy);
+}
+EXPORT_SYMBOL(rtnl_nla_parse_ifla);
+
 struct net *rtnl_link_get_net(struct net *src_net, struct nlattr *tb[])
 {
         struct net *net;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 90b96a11b974..1b62343f5837 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3300,6 +3300,32 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
         return elt;
 }
 
+/* As compared with skb_to_sgvec, skb_to_sgvec_nomark only map skb to given
+ * sglist without mark the sg which contain last skb data as the end.
+ * So the caller can mannipulate sg list as will when padding new data after
+ * the first call without calling sg_unmark_end to expend sg list.
+ *
+ * Scenario to use skb_to_sgvec_nomark:
+ * 1. sg_init_table
+ * 2. skb_to_sgvec_nomark(payload1)
+ * 3. skb_to_sgvec_nomark(payload2)
+ *
+ * This is equivalent to:
+ * 1. sg_init_table
+ * 2. skb_to_sgvec(payload1)
+ * 3. sg_unmark_end
+ * 4. skb_to_sgvec(payload2)
+ *
+ * When mapping mutilple payload conditionally, skb_to_sgvec_nomark
+ * is more preferable.
+ */
+int skb_to_sgvec_nomark(struct sk_buff *skb, struct scatterlist *sg,
+                        int offset, int len)
+{
+        return __skb_to_sgvec(skb, sg, offset, len);
+}
+EXPORT_SYMBOL_GPL(skb_to_sgvec_nomark);
+
 int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
 {
         int nsg = __skb_to_sgvec(skb, sg, offset, len);
@@ -3432,8 +3458,6 @@ static void sock_rmem_free(struct sk_buff *skb)
  */
 int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
 {
-        int len = skb->len;
-
         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
             (unsigned int)sk->sk_rcvbuf)
                 return -ENOMEM;
@@ -3448,7 +3472,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
 
         skb_queue_tail(&sk->sk_error_queue, skb);
         if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk, len);
+                sk->sk_data_ready(sk);
         return 0;
 }
 EXPORT_SYMBOL(sock_queue_err_skb);
@@ -3562,15 +3586,47 @@ static int skb_maybe_pull_tail(struct sk_buff *skb, unsigned int len,
         return 0;
 }
 
+#define MAX_TCP_HDR_LEN (15 * 4)
+
+static __sum16 *skb_checksum_setup_ip(struct sk_buff *skb,
+                                      typeof(IPPROTO_IP) proto,
+                                      unsigned int off)
+{
+        switch (proto) {
+                int err;
+
+        case IPPROTO_TCP:
+                err = skb_maybe_pull_tail(skb, off + sizeof(struct tcphdr),
+                                          off + MAX_TCP_HDR_LEN);
+                if (!err && !skb_partial_csum_set(skb, off,
+                                                  offsetof(struct tcphdr,
+                                                           check)))
+                        err = -EPROTO;
+                return err ? ERR_PTR(err) : &tcp_hdr(skb)->check;
+
+        case IPPROTO_UDP:
+                err = skb_maybe_pull_tail(skb, off + sizeof(struct udphdr),
+                                          off + sizeof(struct udphdr));
+                if (!err && !skb_partial_csum_set(skb, off,
+                                                  offsetof(struct udphdr,
+                                                           check)))
+                        err = -EPROTO;
+                return err ? ERR_PTR(err) : &udp_hdr(skb)->check;
+        }
+
+        return ERR_PTR(-EPROTO);
+}
+
 /* This value should be large enough to cover a tagged ethernet header plus
  * maximally sized IP and TCP or UDP headers.
  */
 #define MAX_IP_HDR_LEN 128
 
-static int skb_checksum_setup_ip(struct sk_buff *skb, bool recalculate)
+static int skb_checksum_setup_ipv4(struct sk_buff *skb, bool recalculate)
 {
         unsigned int off;
         bool fragment;
+        __sum16 *csum;
         int err;
 
         fragment = false;
@@ -3591,51 +3647,15 @@ static int skb_checksum_setup_ip(struct sk_buff *skb, bool recalculate)
         if (fragment)
                 goto out;
 
-        switch (ip_hdr(skb)->protocol) {
-        case IPPROTO_TCP:
-                err = skb_maybe_pull_tail(skb,
-                                          off + sizeof(struct tcphdr),
-                                          MAX_IP_HDR_LEN);
-                if (err < 0)
-                        goto out;
-
-                if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct tcphdr, check))) {
-                        err = -EPROTO;
-                        goto out;
-                }
-
-                if (recalculate)
-                        tcp_hdr(skb)->check =
-                                ~csum_tcpudp_magic(ip_hdr(skb)->saddr,
-                                                   ip_hdr(skb)->daddr,
-                                                   skb->len - off,
-                                                   IPPROTO_TCP, 0);
-                break;
-        case IPPROTO_UDP:
-                err = skb_maybe_pull_tail(skb,
-                                          off + sizeof(struct udphdr),
-                                          MAX_IP_HDR_LEN);
-                if (err < 0)
-                        goto out;
-
-                if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct udphdr, check))) {
-                        err = -EPROTO;
-                        goto out;
-                }
-
-                if (recalculate)
-                        udp_hdr(skb)->check =
-                                ~csum_tcpudp_magic(ip_hdr(skb)->saddr,
-                                                   ip_hdr(skb)->daddr,
-                                                   skb->len - off,
-                                                   IPPROTO_UDP, 0);
-                break;
-        default:
-                goto out;
-        }
+        csum = skb_checksum_setup_ip(skb, ip_hdr(skb)->protocol, off);
+        if (IS_ERR(csum))
+                return PTR_ERR(csum);
 
+        if (recalculate)
+                *csum = ~csum_tcpudp_magic(ip_hdr(skb)->saddr,
+                                           ip_hdr(skb)->daddr,
+                                           skb->len - off,
+                                           ip_hdr(skb)->protocol, 0);
         err = 0;
 
 out:
@@ -3658,6 +3678,7 @@ static int skb_checksum_setup_ipv6(struct sk_buff *skb, bool recalculate)
         unsigned int len;
         bool fragment;
         bool done;
+        __sum16 *csum;
 
         fragment = false;
         done = false;
@@ -3735,51 +3756,14 @@ static int skb_checksum_setup_ipv6(struct sk_buff *skb, bool recalculate)
         if (!done || fragment)
                 goto out;
 
-        switch (nexthdr) {
-        case IPPROTO_TCP:
-                err = skb_maybe_pull_tail(skb,
-                                          off + sizeof(struct tcphdr),
-                                          MAX_IPV6_HDR_LEN);
-                if (err < 0)
-                        goto out;
-
-                if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct tcphdr, check))) {
-                        err = -EPROTO;
-                        goto out;
-                }
-
-                if (recalculate)
-                        tcp_hdr(skb)->check =
-                                ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
-                                                 &ipv6_hdr(skb)->daddr,
-                                                 skb->len - off,
-                                                 IPPROTO_TCP, 0);
-                break;
-        case IPPROTO_UDP:
-                err = skb_maybe_pull_tail(skb,
-                                          off + sizeof(struct udphdr),
-                                          MAX_IPV6_HDR_LEN);
-                if (err < 0)
-                        goto out;
-
-                if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct udphdr, check))) {
-                        err = -EPROTO;
-                        goto out;
-                }
-
-                if (recalculate)
-                        udp_hdr(skb)->check =
-                                ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
-                                                 &ipv6_hdr(skb)->daddr,
-                                                 skb->len - off,
-                                                 IPPROTO_UDP, 0);
-                break;
-        default:
-                goto out;
-        }
+        csum = skb_checksum_setup_ip(skb, nexthdr, off);
+        if (IS_ERR(csum))
+                return PTR_ERR(csum);
 
+        if (recalculate)
+                *csum = ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
+                                         &ipv6_hdr(skb)->daddr,
+                                         skb->len - off, nexthdr, 0);
         err = 0;
 
 out:
@@ -3797,7 +3781,7 @@ int skb_checksum_setup(struct sk_buff *skb, bool recalculate)
 
         switch (skb->protocol) {
         case htons(ETH_P_IP):
-                err = skb_checksum_setup_ip(skb, recalculate);
+                err = skb_checksum_setup_ipv4(skb, recalculate);
                 break;
 
         case htons(ETH_P_IPV6):
@@ -3951,12 +3935,14 @@ EXPORT_SYMBOL_GPL(skb_scrub_packet);
 unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
 {
         const struct skb_shared_info *shinfo = skb_shinfo(skb);
-        unsigned int hdr_len;
 
         if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
-                hdr_len = tcp_hdrlen(skb);
-        else
-                hdr_len = sizeof(struct udphdr);
-        return hdr_len + shinfo->gso_size;
+                return tcp_hdrlen(skb) + shinfo->gso_size;
+
+        /* UFO sets gso_size to the size of the fragmentation
+         * payload, i.e. the size of the L4 (UDP) header is already
+         * accounted for.
+         */
+        return shinfo->gso_size;
 }
 EXPORT_SYMBOL_GPL(skb_gso_transport_seglen);
diff --git a/net/core/sock.c b/net/core/sock.c
index c0fc6bdad1e3..b4fff008136f 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -428,7 +428,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
         spin_unlock_irqrestore(&list->lock, flags);
 
         if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk, skb_len);
+                sk->sk_data_ready(sk);
         return 0;
 }
 EXPORT_SYMBOL(sock_queue_rcv_skb);
@@ -2196,7 +2196,7 @@ static void sock_def_error_report(struct sock *sk)
         rcu_read_unlock();
 }
 
-static void sock_def_readable(struct sock *sk, int len)
+static void sock_def_readable(struct sock *sk)
 {
         struct socket_wq *wq;
 
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index a0e9cf6379de..d7af18859322 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -52,9 +52,10 @@ EXPORT_SYMBOL_GPL(sock_diag_put_meminfo);
 int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,
                              struct sk_buff *skb, int attrtype)
 {
-        struct nlattr *attr;
+        struct sock_fprog_kern *fprog;
         struct sk_filter *filter;
-        unsigned int len;
+        struct nlattr *attr;
+        unsigned int flen;
         int err = 0;
 
         if (!ns_capable(user_ns, CAP_NET_ADMIN)) {
@@ -63,24 +64,20 @@ int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,
         }
 
         rcu_read_lock();
-
         filter = rcu_dereference(sk->sk_filter);
-        len = filter ? filter->len * sizeof(struct sock_filter) : 0;
+        if (!filter)
+                goto out;
 
-        attr = nla_reserve(skb, attrtype, len);
+        fprog = filter->orig_prog;
+        flen = sk_filter_proglen(fprog);
+
+        attr = nla_reserve(skb, attrtype, flen);
         if (attr == NULL) {
                 err = -EMSGSIZE;
                 goto out;
         }
 
-        if (filter) {
-                struct sock_filter *fb = (struct sock_filter *)nla_data(attr);
-                int i;
-
-                for (i = 0; i < filter->len; i++, fb++)
-                        sk_decode_filter(&filter->insns[i], fb);
-        }
-
+        memcpy(nla_data(attr), fprog->filter, flen);
 out:
         rcu_read_unlock();
         return err;
diff --git a/net/core/timestamping.c b/net/core/timestamping.c
index 661b5a40ec10..6521dfd8b7c8 100644
--- a/net/core/timestamping.c
+++ b/net/core/timestamping.c
@@ -23,16 +23,11 @@
 #include <linux/skbuff.h>
 #include <linux/export.h>
 
-static struct sock_filter ptp_filter[] = {
-        PTP_FILTER
-};
-
 static unsigned int classify(const struct sk_buff *skb)
 {
-        if (likely(skb->dev &&
-                   skb->dev->phydev &&
+        if (likely(skb->dev && skb->dev->phydev &&
                    skb->dev->phydev->drv))
-                return sk_run_filter(skb, ptp_filter);
+                return ptp_classify_raw(skb);
         else
                 return PTP_CLASS_NONE;
 }
@@ -60,11 +55,13 @@ void skb_clone_tx_timestamp(struct sk_buff *skb)
                 if (likely(phydev->drv->txtstamp)) {
                         if (!atomic_inc_not_zero(&sk->sk_refcnt))
                                 return;
+
                         clone = skb_clone(skb, GFP_ATOMIC);
                         if (!clone) {
                                 sock_put(sk);
                                 return;
                         }
+
                         clone->sk = sk;
                         phydev->drv->txtstamp(phydev, clone, type);
                 }
@@ -89,12 +86,15 @@ void skb_complete_tx_timestamp(struct sk_buff *skb,
         }
 
         *skb_hwtstamps(skb) = *hwtstamps;
+
         serr = SKB_EXT_ERR(skb);
         memset(serr, 0, sizeof(*serr));
         serr->ee.ee_errno = ENOMSG;
         serr->ee.ee_origin = SO_EE_ORIGIN_TIMESTAMPING;
         skb->sk = NULL;
+
         err = sock_queue_err_skb(sk, skb);
+
         sock_put(sk);
         if (err)
                 kfree_skb(skb);
@@ -132,8 +132,3 @@ bool skb_defer_rx_timestamp(struct sk_buff *skb)
         return false;
 }
 EXPORT_SYMBOL_GPL(skb_defer_rx_timestamp);
-
-void __init skb_timestamping_init(void)
-{
-        BUG_ON(sk_chk_filter(ptp_filter, ARRAY_SIZE(ptp_filter)));
-}
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 14cdafad7a90..3c8ec7d4a34e 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -28,7 +28,7 @@ static void dccp_enqueue_skb(struct sock *sk, struct sk_buff *skb)
         __skb_pull(skb, dccp_hdr(skb)->dccph_doff * 4);
         __skb_queue_tail(&sk->sk_receive_queue, skb);
         skb_set_owner_r(skb, sk);
-        sk->sk_data_ready(sk, 0);
+        sk->sk_data_ready(sk);
 }
 
 static void dccp_fin(struct sock *sk, struct sk_buff *skb)
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index 9e2f78bc1553..c69eb9c4fbb8 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -237,7 +237,7 @@ int dccp_child_process(struct sock *parent, struct sock *child,
 
                 /* Wakeup parent, send SIGIO */
                 if (state == DCCP_RESPOND && child->sk_state != state)
-                        parent->sk_data_ready(parent, 0);
+                        parent->sk_data_ready(parent);
         } else {
                 /* Alas, it is possible again, because we do lookup
                  * in main socket hash table and lock on listening
diff --git a/net/dccp/output.c b/net/dccp/output.c
index 8876078859da..0248e8a3460c 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -138,7 +138,7 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
 
                 DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
 
-                err = icsk->icsk_af_ops->queue_xmit(skb, &inet->cork.fl);
+                err = icsk->icsk_af_ops->queue_xmit(sk, skb, &inet->cork.fl);
                 return net_xmit_eval(err);
         }
         return -ENOBUFS;
diff --git a/net/decnet/dn_nsp_in.c b/net/decnet/dn_nsp_in.c
index c344163e6ac0..fe5f01485d33 100644
--- a/net/decnet/dn_nsp_in.c
+++ b/net/decnet/dn_nsp_in.c
@@ -585,7 +585,6 @@ out:
 static __inline__ int dn_queue_skb(struct sock *sk, struct sk_buff *skb, int sig, struct sk_buff_head *queue)
 {
         int err;
-        int skb_len;
 
         /* Cast skb->rcvbuf to unsigned... It's pointless, but reduces
            number of warnings when compiling with -W --ANK
@@ -600,12 +599,11 @@ static __inline__ int dn_queue_skb(struct sock *sk, struct sk_buff *skb, int sig
         if (err)
                 goto out;
 
-        skb_len = skb->len;
         skb_set_owner_r(skb, sk);
         skb_queue_tail(queue, skb);
 
         if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk, skb_len);
+                sk->sk_data_ready(sk);
 out:
         return err;
 }
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index ce0cbbfe0f43..daccc4a36d80 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -752,7 +752,7 @@ static int dn_to_neigh_output(struct sk_buff *skb)
         return n->output(n, skb);
 }
 
-static int dn_output(struct sk_buff *skb)
+static int dn_output(struct sock *sk, struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
         struct dn_route *rt = (struct dn_route *)dst;
@@ -838,6 +838,18 @@ drop:
  * Used to catch bugs. This should never normally get
  * called.
  */
+static int dn_rt_bug_sk(struct sock *sk, struct sk_buff *skb)
+{
+        struct dn_skb_cb *cb = DN_SKB_CB(skb);
+
+        net_dbg_ratelimited("dn_rt_bug: skb from:%04x to:%04x\n",
+                            le16_to_cpu(cb->src), le16_to_cpu(cb->dst));
+
+        kfree_skb(skb);
+
+        return NET_RX_DROP;
+}
+
 static int dn_rt_bug(struct sk_buff *skb)
 {
         struct dn_skb_cb *cb = DN_SKB_CB(skb);
@@ -1463,7 +1475,7 @@ make_route:
 
         rt->n = neigh;
         rt->dst.lastuse = jiffies;
-        rt->dst.output = dn_rt_bug;
+        rt->dst.output = dn_rt_bug_sk;
         switch (res.type) {
         case RTN_UNICAST:
                 rt->dst.input = dn_forward;
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index cac505f166d5..e5302b7f7ca9 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -209,7 +209,7 @@ static int slave_xmit(struct sk_buff *skb, struct hsr_priv *hsr_priv,
         /* Address substitution (IEC62439-3 pp 26, 50): replace mac
          * address of outgoing frame with that of the outgoing slave's.
          */
-        memcpy(hsr_ethhdr->ethhdr.h_source, skb->dev->dev_addr, ETH_ALEN);
+        ether_addr_copy(hsr_ethhdr->ethhdr.h_source, skb->dev->dev_addr);
 
         return dev_queue_xmit(skb);
 }
@@ -346,7 +346,7 @@ static void send_hsr_supervision_frame(struct net_device *hsr_dev, u8 type)
 
         /* Payload: MacAddressA */
         hsr_sp = (typeof(hsr_sp)) skb_put(skb, sizeof(*hsr_sp));
-        memcpy(hsr_sp->MacAddressA, hsr_dev->dev_addr, ETH_ALEN);
+        ether_addr_copy(hsr_sp->MacAddressA, hsr_dev->dev_addr);
 
         dev_queue_xmit(skb);
         return;
@@ -493,7 +493,7 @@ static int check_slave_ok(struct net_device *dev)
 
 
 /* Default multicast address for HSR Supervision frames */
-static const unsigned char def_multicast_addr[ETH_ALEN] = {
+static const unsigned char def_multicast_addr[ETH_ALEN] __aligned(2) = {
         0x01, 0x15, 0x4e, 0x00, 0x01, 0x00
 };
 
@@ -519,7 +519,7 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],
         hsr_priv->announce_timer.function = hsr_announce;
         hsr_priv->announce_timer.data = (unsigned long) hsr_priv;
 
-        memcpy(hsr_priv->sup_multicast_addr, def_multicast_addr, ETH_ALEN);
+        ether_addr_copy(hsr_priv->sup_multicast_addr, def_multicast_addr);
         hsr_priv->sup_multicast_addr[ETH_ALEN - 1] = multicast_spec;
 
 /* FIXME: should I modify the value of these?
@@ -547,7 +547,7 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],
         hsr_dev->features |= NETIF_F_VLAN_CHALLENGED;
 
         /* Set hsr_dev's MAC address to that of mac_slave1 */
-        memcpy(hsr_dev->dev_addr, hsr_priv->slave[0]->dev_addr, ETH_ALEN);
+        ether_addr_copy(hsr_dev->dev_addr, hsr_priv->slave[0]->dev_addr);
 
         /* Set required header length */
         for (i = 0; i < HSR_MAX_SLAVE; i++) {
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index 7ae0d7f6dbd0..83e58449366a 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -108,8 +108,8 @@ int hsr_create_self_node(struct list_head *self_node_db,
         if (!node)
                 return -ENOMEM;
 
-        memcpy(node->MacAddressA, addr_a, ETH_ALEN);
-        memcpy(node->MacAddressB, addr_b, ETH_ALEN);
+        ether_addr_copy(node->MacAddressA, addr_a);
+        ether_addr_copy(node->MacAddressB, addr_b);
 
         rcu_read_lock();
         oldnode = list_first_or_null_rcu(self_node_db,
@@ -199,7 +199,7 @@ struct node_entry *hsr_merge_node(struct hsr_priv *hsr_priv,
                 /* Node is known, but frame was received from an unknown
                  * address. Node is PICS_SUBS capable; merge its AddrB.
                  */
-                memcpy(node->MacAddressB, hsr_ethsup->ethhdr.h_source, ETH_ALEN);
+                ether_addr_copy(node->MacAddressB, hsr_ethsup->ethhdr.h_source);
                 node->AddrB_if = dev_idx;
                 return node;
         }
@@ -208,8 +208,8 @@ struct node_entry *hsr_merge_node(struct hsr_priv *hsr_priv,
         if (!node)
                 return NULL;
 
-        memcpy(node->MacAddressA, hsr_sp->MacAddressA, ETH_ALEN);
-        memcpy(node->MacAddressB, hsr_ethsup->ethhdr.h_source, ETH_ALEN);
+        ether_addr_copy(node->MacAddressA, hsr_sp->MacAddressA);
+        ether_addr_copy(node->MacAddressB, hsr_ethsup->ethhdr.h_source);
         if (!ether_addr_equal(hsr_sp->MacAddressA, hsr_ethsup->ethhdr.h_source))
                 node->AddrB_if = dev_idx;
         else
@@ -250,7 +250,7 @@ void hsr_addr_subst_source(struct hsr_priv *hsr_priv, struct sk_buff *skb)
         rcu_read_lock();
         node = find_node_by_AddrB(&hsr_priv->node_db, ethhdr->h_source);
         if (node)
-                memcpy(ethhdr->h_source, node->MacAddressA, ETH_ALEN);
+                ether_addr_copy(ethhdr->h_source, node->MacAddressA);
         rcu_read_unlock();
 }
 
@@ -272,7 +272,7 @@ void hsr_addr_subst_dest(struct hsr_priv *hsr_priv, struct ethhdr *ethhdr,
         rcu_read_lock();
         node = find_node_by_AddrA(&hsr_priv->node_db, ethhdr->h_dest);
         if (node && (node->AddrB_if == dev_idx))
-                memcpy(ethhdr->h_dest, node->MacAddressB, ETH_ALEN);
+                ether_addr_copy(ethhdr->h_dest, node->MacAddressB);
         rcu_read_unlock();
 }
 
@@ -428,13 +428,13 @@ void *hsr_get_next_node(struct hsr_priv *hsr_priv, void *_pos,
                 node = list_first_or_null_rcu(&hsr_priv->node_db,
                                                 struct node_entry, mac_list);
                 if (node)
-                        memcpy(addr, node->MacAddressA, ETH_ALEN);
+                        ether_addr_copy(addr, node->MacAddressA);
                 return node;
         }
 
         node = _pos;
         list_for_each_entry_continue_rcu(node, &hsr_priv->node_db, mac_list) {
-                memcpy(addr, node->MacAddressA, ETH_ALEN);
+                ether_addr_copy(addr, node->MacAddressA);
                 return node;
         }
 
@@ -462,7 +462,7 @@ int hsr_get_node_data(struct hsr_priv *hsr_priv,
                 return -ENOENT; /* No such entry */
         }
 
-        memcpy(addr_b, node->MacAddressB, ETH_ALEN);
+        ether_addr_copy(addr_b, node->MacAddressB);
 
         tdiff = jiffies - node->time_in[HSR_DEV_SLAVE_A];
         if (node->time_in_stale[HSR_DEV_SLAVE_A])
diff --git a/net/hsr/hsr_main.c b/net/hsr/hsr_main.c
index af68dd83a4e3..3fee5218a691 100644
--- a/net/hsr/hsr_main.c
+++ b/net/hsr/hsr_main.c
@@ -138,8 +138,8 @@ static int hsr_netdev_notify(struct notifier_block *nb, unsigned long event,
                         break;
 
                 if (dev == hsr_priv->slave[0])
-                        memcpy(hsr_priv->dev->dev_addr,
-                               hsr_priv->slave[0]->dev_addr, ETH_ALEN);
+                        ether_addr_copy(hsr_priv->dev->dev_addr,
+                                        hsr_priv->slave[0]->dev_addr);
 
                 /* Make sure we recognize frames from ourselves in hsr_rcv() */
                 res = hsr_create_self_node(&hsr_priv->self_node_db,
@@ -459,7 +459,7 @@ static int __init hsr_init(void)
 static void __exit hsr_exit(void)
 {
         unregister_netdevice_notifier(&hsr_nb);
-        del_timer(&prune_timer);
+        del_timer_sync(&prune_timer);
         hsr_netlink_exit();
         dev_remove_pack(&hsr_pt);
 }
diff --git a/net/ieee802154/6lowpan.h b/net/ieee802154/6lowpan.h
deleted file mode 100644
index 2b835db3bda8..000000000000
--- a/net/ieee802154/6lowpan.h
+++ /dev/null
@@ -1,319 +0,0 @@
-/*
- * Copyright 2011, Siemens AG
- * written by Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
- */
-
-/*
- * Based on patches from Jon Smirl <jonsmirl@gmail.com>
- * Copyright (c) 2011 Jon Smirl <jonsmirl@gmail.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- */
-
-/* Jon's code is based on 6lowpan implementation for Contiki which is:
- * Copyright (c) 2008, Swedish Institute of Computer Science.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the Institute nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef __6LOWPAN_H__
-#define __6LOWPAN_H__
-
-#define UIP_802154_SHORTADDR_LEN        2  /* compressed ipv6 address length */
-#define UIP_IPH_LEN                     40 /* ipv6 fixed header size */
-#define UIP_PROTO_UDP                   17 /* ipv6 next header value for UDP */
-#define UIP_FRAGH_LEN                   8  /* ipv6 fragment header size */
-
-/*
- * ipv6 address based on mac
- * second bit-flip (Universe/Local) is done according RFC2464
- */
-#define is_addr_mac_addr_based(a, m) \
-        ((((a)->s6_addr[8])  == (((m)[0]) ^ 0x02)) &&   \
-         (((a)->s6_addr[9])  == (m)[1]) &&              \
-         (((a)->s6_addr[10]) == (m)[2]) &&              \
-         (((a)->s6_addr[11]) == (m)[3]) &&              \
-         (((a)->s6_addr[12]) == (m)[4]) &&              \
-         (((a)->s6_addr[13]) == (m)[5]) &&              \
-         (((a)->s6_addr[14]) == (m)[6]) &&              \
-         (((a)->s6_addr[15]) == (m)[7]))
-
-/* ipv6 address is unspecified */
-#define is_addr_unspecified(a)          \
-        ((((a)->s6_addr32[0]) == 0) &&  \
-         (((a)->s6_addr32[1]) == 0) &&  \
-         (((a)->s6_addr32[2]) == 0) &&  \
-         (((a)->s6_addr32[3]) == 0))
-
-/* compare ipv6 addresses prefixes */
-#define ipaddr_prefixcmp(addr1, addr2, length) \
-        (memcmp(addr1, addr2, length >> 3) == 0)
-
-/* local link, i.e. FE80::/10 */
-#define is_addr_link_local(a) (((a)->s6_addr16[0]) == htons(0xFE80))
-
-/*
- * check whether we can compress the IID to 16 bits,
- * it's possible for unicast adresses with first 49 bits are zero only.
- */
-#define lowpan_is_iid_16_bit_compressable(a)    \
-        ((((a)->s6_addr16[4]) == 0) &&          \
-         (((a)->s6_addr[10]) == 0) &&           \
-         (((a)->s6_addr[11]) == 0xff) &&        \
-         (((a)->s6_addr[12]) == 0xfe) &&        \
-         (((a)->s6_addr[13]) == 0))
-
-/* multicast address */
-#define is_addr_mcast(a) (((a)->s6_addr[0]) == 0xFF)
-
-/* check whether the 112-bit gid of the multicast address is mappable to: */
-
-/* 9 bits, for FF02::1 (all nodes) and FF02::2 (all routers) addresses only. */
-#define lowpan_is_mcast_addr_compressable(a)    \
-        ((((a)->s6_addr16[1]) == 0) &&          \
-         (((a)->s6_addr16[2]) == 0) &&          \
-         (((a)->s6_addr16[3]) == 0) &&          \
-         (((a)->s6_addr16[4]) == 0) &&          \
-         (((a)->s6_addr16[5]) == 0) &&          \
-         (((a)->s6_addr16[6]) == 0) &&          \
-         (((a)->s6_addr[14])  == 0) &&          \
-         ((((a)->s6_addr[15]) == 1) || (((a)->s6_addr[15]) == 2)))
-
-/* 48 bits, FFXX::00XX:XXXX:XXXX */
-#define lowpan_is_mcast_addr_compressable48(a)  \
-        ((((a)->s6_addr16[1]) == 0) &&          \
-         (((a)->s6_addr16[2]) == 0) &&          \
-         (((a)->s6_addr16[3]) == 0) &&          \
-         (((a)->s6_addr16[4]) == 0) &&          \
-         (((a)->s6_addr[10]) == 0))
-
-/* 32 bits, FFXX::00XX:XXXX */
-#define lowpan_is_mcast_addr_compressable32(a)  \
-        ((((a)->s6_addr16[1]) == 0) &&          \
-         (((a)->s6_addr16[2]) == 0) &&          \
-         (((a)->s6_addr16[3]) == 0) &&          \
-         (((a)->s6_addr16[4]) == 0) &&          \
-         (((a)->s6_addr16[5]) == 0) &&          \
-         (((a)->s6_addr[12]) == 0))
-
-/* 8 bits, FF02::00XX */
-#define lowpan_is_mcast_addr_compressable8(a)   \
-        ((((a)->s6_addr[1])  == 2) &&           \
-         (((a)->s6_addr16[1]) == 0) &&          \
-         (((a)->s6_addr16[2]) == 0) &&          \
-         (((a)->s6_addr16[3]) == 0) &&          \
-         (((a)->s6_addr16[4]) == 0) &&          \
-         (((a)->s6_addr16[5]) == 0) &&          \
-         (((a)->s6_addr16[6]) == 0) &&          \
-         (((a)->s6_addr[14]) == 0))
-
-#define lowpan_is_addr_broadcast(a)     \
-        ((((a)[0]) == 0xFF) &&  \
-         (((a)[1]) == 0xFF) &&  \
-         (((a)[2]) == 0xFF) &&  \
-         (((a)[3]) == 0xFF) &&  \
-         (((a)[4]) == 0xFF) &&  \
-         (((a)[5]) == 0xFF) &&  \
-         (((a)[6]) == 0xFF) &&  \
-         (((a)[7]) == 0xFF))
-
-#define LOWPAN_DISPATCH_IPV6    0x41 /* 01000001 = 65 */
-#define LOWPAN_DISPATCH_HC1     0x42 /* 01000010 = 66 */
-#define LOWPAN_DISPATCH_IPHC    0x60 /* 011xxxxx = ... */
-#define LOWPAN_DISPATCH_FRAG1   0xc0 /* 11000xxx */
-#define LOWPAN_DISPATCH_FRAGN   0xe0 /* 11100xxx */
-
-#define LOWPAN_DISPATCH_MASK    0xf8 /* 11111000 */
-
-#define LOWPAN_FRAG_TIMEOUT     (HZ * 60)       /* time-out 60 sec */
-
-#define LOWPAN_FRAG1_HEAD_SIZE  0x4
-#define LOWPAN_FRAGN_HEAD_SIZE  0x5
-
-/*
- * According IEEE802.15.4 standard:
- *   - MTU is 127 octets
- *   - maximum MHR size is 37 octets
- *   - MFR size is 2 octets
- *
- * so minimal payload size that we may guarantee is:
- *   MTU - MHR - MFR = 88 octets
- */
-#define LOWPAN_FRAG_SIZE        88
-
-/*
- * Values of fields within the IPHC encoding first byte
- * (C stands for compressed and I for inline)
- */
-#define LOWPAN_IPHC_TF          0x18
-
-#define LOWPAN_IPHC_FL_C        0x10
-#define LOWPAN_IPHC_TC_C        0x08
-#define LOWPAN_IPHC_NH_C        0x04
-#define LOWPAN_IPHC_TTL_1       0x01
-#define LOWPAN_IPHC_TTL_64      0x02
-#define LOWPAN_IPHC_TTL_255     0x03
-#define LOWPAN_IPHC_TTL_I       0x00
-
-
-/* Values of fields within the IPHC encoding second byte */
-#define LOWPAN_IPHC_CID         0x80
-
-#define LOWPAN_IPHC_ADDR_00     0x00
-#define LOWPAN_IPHC_ADDR_01     0x01
-#define LOWPAN_IPHC_ADDR_02     0x02
-#define LOWPAN_IPHC_ADDR_03     0x03
-
-#define LOWPAN_IPHC_SAC         0x40
-#define LOWPAN_IPHC_SAM         0x30
-
-#define LOWPAN_IPHC_SAM_BIT     4
-
-#define LOWPAN_IPHC_M           0x08
-#define LOWPAN_IPHC_DAC         0x04
-#define LOWPAN_IPHC_DAM_00      0x00
-#define LOWPAN_IPHC_DAM_01      0x01
-#define LOWPAN_IPHC_DAM_10      0x02
-#define LOWPAN_IPHC_DAM_11      0x03
-
-#define LOWPAN_IPHC_DAM_BIT     0
-/*
- * LOWPAN_UDP encoding (works together with IPHC)
- */
-#define LOWPAN_NHC_UDP_MASK             0xF8
-#define LOWPAN_NHC_UDP_ID               0xF0
-#define LOWPAN_NHC_UDP_CHECKSUMC        0x04
-#define LOWPAN_NHC_UDP_CHECKSUMI        0x00
-
-#define LOWPAN_NHC_UDP_4BIT_PORT        0xF0B0
-#define LOWPAN_NHC_UDP_4BIT_MASK        0xFFF0
-#define LOWPAN_NHC_UDP_8BIT_PORT        0xF000
-#define LOWPAN_NHC_UDP_8BIT_MASK        0xFF00
-
-/* values for port compression, _with checksum_ ie bit 5 set to 0 */
-#define LOWPAN_NHC_UDP_CS_P_00  0xF0 /* all inline */
-#define LOWPAN_NHC_UDP_CS_P_01  0xF1 /* source 16bit inline,
-                                        dest = 0xF0 + 8 bit inline */
-#define LOWPAN_NHC_UDP_CS_P_10  0xF2 /* source = 0xF0 + 8bit inline,
-                                        dest = 16 bit inline */
-#define LOWPAN_NHC_UDP_CS_P_11  0xF3 /* source & dest = 0xF0B + 4bit inline */
-#define LOWPAN_NHC_UDP_CS_C     0x04 /* checksum elided */
-
-#ifdef DEBUG
-/* print data in line */
-static inline void raw_dump_inline(const char *caller, char *msg,
-                                   unsigned char *buf, int len)
-{
-        if (msg)
-                pr_debug("%s():%s: ", caller, msg);
-
-        print_hex_dump_debug("", DUMP_PREFIX_NONE, 16, 1, buf, len, false);
-}
-
-/* print data in a table format:
- *
- * addr: xx xx xx xx xx xx
- * addr: xx xx xx xx xx xx
- * ...
- */
-static inline void raw_dump_table(const char *caller, char *msg,
-                                  unsigned char *buf, int len)
-{
-        if (msg)
-                pr_debug("%s():%s:\n", caller, msg);
-
-        print_hex_dump_debug("\t", DUMP_PREFIX_OFFSET, 16, 1, buf, len, false);
-}
-#else
-static inline void raw_dump_table(const char *caller, char *msg,
-                                  unsigned char *buf, int len) { }
-static inline void raw_dump_inline(const char *caller, char *msg,
-                                   unsigned char *buf, int len) { }
-#endif
-
-static inline int lowpan_fetch_skb_u8(struct sk_buff *skb, u8 *val)
-{
-        if (unlikely(!pskb_may_pull(skb, 1)))
-                return -EINVAL;
-
-        *val = skb->data[0];
-        skb_pull(skb, 1);
-
-        return 0;
-}
-
-static inline int lowpan_fetch_skb_u16(struct sk_buff *skb, u16 *val)
-{
-        if (unlikely(!pskb_may_pull(skb, 2)))
-                return -EINVAL;
-
-        *val = (skb->data[0] << 8) | skb->data[1];
-        skb_pull(skb, 2);
-
-        return 0;
-}
-
-static inline bool lowpan_fetch_skb(struct sk_buff *skb,
-                void *data, const unsigned int len)
-{
-        if (unlikely(!pskb_may_pull(skb, len)))
-                return true;
-
-        skb_copy_from_linear_data(skb, data, len);
-        skb_pull(skb, len);
-
-        return false;
-}
-
-static inline void lowpan_push_hc_data(u8 **hc_ptr, const void *data,
-                                       const size_t len)
-{
-        memcpy(*hc_ptr, data, len);
-        *hc_ptr += len;
-}
-
-typedef int (*skb_delivery_cb)(struct sk_buff *skb, struct net_device *dev);
-
-int lowpan_process_data(struct sk_buff *skb, struct net_device *dev,
-                const u8 *saddr, const u8 saddr_type, const u8 saddr_len,
-                const u8 *daddr, const u8 daddr_type, const u8 daddr_len,
-                u8 iphc0, u8 iphc1, skb_delivery_cb skb_deliver);
-int lowpan_header_compress(struct sk_buff *skb, struct net_device *dev,
-                        unsigned short type, const void *_daddr,
-                        const void *_saddr, unsigned int len);
-
-#endif /* __6LOWPAN_H__ */
diff --git a/net/ieee802154/6lowpan_iphc.c b/net/ieee802154/6lowpan_iphc.c
index 860aa2d445ba..211b5686d719 100644
--- a/net/ieee802154/6lowpan_iphc.c
+++ b/net/ieee802154/6lowpan_iphc.c
@@ -54,11 +54,10 @@
 #include <linux/if_arp.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
+#include <net/6lowpan.h>
 #include <net/ipv6.h>
 #include <net/af_ieee802154.h>
 
-#include "6lowpan.h"
-
 /*
  * Uncompress address function for source and
  * destination address(non-multicast).
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan_rtnl.c
index 8edfea5da572..0f5a69ed746d 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan_rtnl.c
@@ -1,10 +1,8 @@
-/*
- * Copyright 2011, Siemens AG
+/* Copyright 2011, Siemens AG
  * written by Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
  */
 
-/*
- * Based on patches from Jon Smirl <jonsmirl@gmail.com>
+/* Based on patches from Jon Smirl <jonsmirl@gmail.com>
  * Copyright (c) 2011 Jon Smirl <jonsmirl@gmail.com>
  *
  * This program is free software; you can redistribute it and/or modify
@@ -15,10 +13,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
 /* Jon's code is based on 6lowpan implementation for Contiki which is:
@@ -58,9 +52,10 @@
 #include <net/af_ieee802154.h>
 #include <net/ieee802154.h>
 #include <net/ieee802154_netdev.h>
+#include <net/6lowpan.h>
 #include <net/ipv6.h>
 
-#include "6lowpan.h"
+#include "reassembly.h"
 
 static LIST_HEAD(lowpan_devices);
 
@@ -68,7 +63,7 @@ static LIST_HEAD(lowpan_devices);
 struct lowpan_dev_info {
         struct net_device       *real_dev; /* real WPAN device ptr */
         struct mutex            dev_list_mtx; /* mutex for list ops */
-        unsigned short          fragment_tag;
+        __be16                  fragment_tag;
 };
 
 struct lowpan_dev_record {
@@ -76,18 +71,6 @@ struct lowpan_dev_record {
         struct list_head list;
 };
 
-struct lowpan_fragment {
-        struct sk_buff          *skb;           /* skb to be assembled */
-        u16                     length;         /* length to be assemled */
-        u32                     bytes_rcv;      /* bytes received */
-        u16                     tag;            /* current fragment tag */
-        struct timer_list       timer;          /* assembling timer */
-        struct list_head        list;           /* fragments list */
-};
-
-static LIST_HEAD(lowpan_fragments);
-static DEFINE_SPINLOCK(flist_lock);
-
 static inline struct
 lowpan_dev_info *lowpan_dev_info(const struct net_device *dev)
 {
@@ -124,13 +107,11 @@ static int lowpan_header_create(struct sk_buff *skb,
 
         lowpan_header_compress(skb, dev, type, daddr, saddr, len);
 
-        /*
-         * NOTE1: I'm still unsure about the fact that compression and WPAN
+        /* NOTE1: I'm still unsure about the fact that compression and WPAN
          * header are created here and not later in the xmit. So wait for
          * an opinion of net maintainers.
          */
-        /*
-         * NOTE2: to be absolutely correct, we must derive PANid information
+        /* NOTE2: to be absolutely correct, we must derive PANid information
          * from MAC subif of the 'dev' and 'real_dev' network devices, but
          * this isn't implemented in mainline yet, so currently we assign 0xff
          */
@@ -138,30 +119,29 @@ static int lowpan_header_create(struct sk_buff *skb,
         mac_cb(skb)->seq = ieee802154_mlme_ops(dev)->get_dsn(dev);
 
         /* prepare wpan address data */
-        sa.addr_type = IEEE802154_ADDR_LONG;
+        sa.mode = IEEE802154_ADDR_LONG;
         sa.pan_id = ieee802154_mlme_ops(dev)->get_pan_id(dev);
+        sa.extended_addr = ieee802154_devaddr_from_raw(saddr);
 
-        memcpy(&(sa.hwaddr), saddr, 8);
         /* intra-PAN communications */
-        da.pan_id = ieee802154_mlme_ops(dev)->get_pan_id(dev);
+        da.pan_id = sa.pan_id;
 
-        /*
-         * if the destination address is the broadcast address, use the
+        /* if the destination address is the broadcast address, use the
          * corresponding short address
          */
         if (lowpan_is_addr_broadcast(daddr)) {
-                da.addr_type = IEEE802154_ADDR_SHORT;
-                da.short_addr = IEEE802154_ADDR_BROADCAST;
+                da.mode = IEEE802154_ADDR_SHORT;
+                da.short_addr = cpu_to_le16(IEEE802154_ADDR_BROADCAST);
         } else {
-                da.addr_type = IEEE802154_ADDR_LONG;
-                memcpy(&(da.hwaddr), daddr, IEEE802154_ADDR_LEN);
+                da.mode = IEEE802154_ADDR_LONG;
+                da.extended_addr = ieee802154_devaddr_from_raw(daddr);
 
                 /* request acknowledgment */
                 mac_cb(skb)->flags |= MAC_CB_FLAG_ACKREQ;
         }
 
         return dev_hard_header(skb, lowpan_dev_info(dev)->real_dev,
-                        type, (void *)&da, (void *)&sa, skb->len);
+                        type, (void *)&da, (void *)&sa, 0);
 }
 
 static int lowpan_give_skb_to_devices(struct sk_buff *skb,
@@ -188,73 +168,11 @@ static int lowpan_give_skb_to_devices(struct sk_buff *skb,
         return stat;
 }
 
-static void lowpan_fragment_timer_expired(unsigned long entry_addr)
-{
-        struct lowpan_fragment *entry = (struct lowpan_fragment *)entry_addr;
-
-        pr_debug("timer expired for frame with tag %d\n", entry->tag);
-
-        list_del(&entry->list);
-        dev_kfree_skb(entry->skb);
-        kfree(entry);
-}
-
-static struct lowpan_fragment *
-lowpan_alloc_new_frame(struct sk_buff *skb, u16 len, u16 tag)
-{
-        struct lowpan_fragment *frame;
-
-        frame = kzalloc(sizeof(struct lowpan_fragment),
-                        GFP_ATOMIC);
-        if (!frame)
-                goto frame_err;
-
-        INIT_LIST_HEAD(&frame->list);
-
-        frame->length = len;
-        frame->tag = tag;
-
-        /* allocate buffer for frame assembling */
-        frame->skb = netdev_alloc_skb_ip_align(skb->dev, frame->length +
-                                               sizeof(struct ipv6hdr));
-
-        if (!frame->skb)
-                goto skb_err;
-
-        frame->skb->priority = skb->priority;
-
-        /* reserve headroom for uncompressed ipv6 header */
-        skb_reserve(frame->skb, sizeof(struct ipv6hdr));
-        skb_put(frame->skb, frame->length);
-
-        /* copy the first control block to keep a
-         * trace of the link-layer addresses in case
-         * of a link-local compressed address
-         */
-        memcpy(frame->skb->cb, skb->cb, sizeof(skb->cb));
-
-        init_timer(&frame->timer);
-        /* time out is the same as for ipv6 - 60 sec */
-        frame->timer.expires = jiffies + LOWPAN_FRAG_TIMEOUT;
-        frame->timer.data = (unsigned long)frame;
-        frame->timer.function = lowpan_fragment_timer_expired;
-
-        add_timer(&frame->timer);
-
-        list_add_tail(&frame->list, &lowpan_fragments);
-
-        return frame;
-
-skb_err:
-        kfree(frame);
-frame_err:
-        return NULL;
-}
-
-static int process_data(struct sk_buff *skb)
+static int process_data(struct sk_buff *skb, const struct ieee802154_hdr *hdr)
 {
         u8 iphc0, iphc1;
-        const struct ieee802154_addr *_saddr, *_daddr;
+        struct ieee802154_addr_sa sa, da;
+        void *sap, *dap;
 
         raw_dump_table(__func__, "raw skb data dump", skb->data, skb->len);
         /* at least two bytes will be used for the encoding */
@@ -264,108 +182,27 @@ static int process_data(struct sk_buff *skb)
         if (lowpan_fetch_skb_u8(skb, &iphc0))
                 goto drop;
 
-        /* fragments assembling */
-        switch (iphc0 & LOWPAN_DISPATCH_MASK) {
-        case LOWPAN_DISPATCH_FRAG1:
-        case LOWPAN_DISPATCH_FRAGN:
-        {
-                struct lowpan_fragment *frame;
-                /* slen stores the rightmost 8 bits of the 11 bits length */
-                u8 slen, offset = 0;
-                u16 len, tag;
-                bool found = false;
-
-                if (lowpan_fetch_skb_u8(skb, &slen) || /* frame length */
-                    lowpan_fetch_skb_u16(skb, &tag))  /* fragment tag */
-                        goto drop;
-
-                /* adds the 3 MSB to the 8 LSB to retrieve the 11 bits length */
-                len = ((iphc0 & 7) << 8) | slen;
-
-                if ((iphc0 & LOWPAN_DISPATCH_MASK) == LOWPAN_DISPATCH_FRAG1) {
-                        pr_debug("%s received a FRAG1 packet (tag: %d, "
-                                 "size of the entire IP packet: %d)",
-                                 __func__, tag, len);
-                } else { /* FRAGN */
-                        if (lowpan_fetch_skb_u8(skb, &offset))
-                                goto unlock_and_drop;
-                        pr_debug("%s received a FRAGN packet (tag: %d, "
-                                 "size of the entire IP packet: %d, "
-                                 "offset: %d)", __func__, tag, len, offset * 8);
-                }
-
-                /*
-                 * check if frame assembling with the same tag is
-                 * already in progress
-                 */
-                spin_lock_bh(&flist_lock);
-
-                list_for_each_entry(frame, &lowpan_fragments, list)
-                        if (frame->tag == tag) {
-                                found = true;
-                                break;
-                        }
-
-                /* alloc new frame structure */
-                if (!found) {
-                        pr_debug("%s first fragment received for tag %d, "
-                                 "begin packet reassembly", __func__, tag);
-                        frame = lowpan_alloc_new_frame(skb, len, tag);
-                        if (!frame)
-                                goto unlock_and_drop;
-                }
-
-                /* if payload fits buffer, copy it */
-                if (likely((offset * 8 + skb->len) <= frame->length))
-                        skb_copy_to_linear_data_offset(frame->skb, offset * 8,
-                                                        skb->data, skb->len);
-                else
-                        goto unlock_and_drop;
-
-                frame->bytes_rcv += skb->len;
-
-                /* frame assembling complete */
-                if ((frame->bytes_rcv == frame->length) &&
-                     frame->timer.expires > jiffies) {
-                        /* if timer haven't expired - first of all delete it */
-                        del_timer_sync(&frame->timer);
-                        list_del(&frame->list);
-                        spin_unlock_bh(&flist_lock);
-
-                        pr_debug("%s successfully reassembled fragment "
-                                 "(tag %d)", __func__, tag);
-
-                        dev_kfree_skb(skb);
-                        skb = frame->skb;
-                        kfree(frame);
-
-                        if (lowpan_fetch_skb_u8(skb, &iphc0))
-                                goto drop;
-
-                        break;
-                }
-                spin_unlock_bh(&flist_lock);
-
-                return kfree_skb(skb), 0;
-        }
-        default:
-                break;
-        }
-
         if (lowpan_fetch_skb_u8(skb, &iphc1))
                 goto drop;
 
-        _saddr = &mac_cb(skb)->sa;
-        _daddr = &mac_cb(skb)->da;
+        ieee802154_addr_to_sa(&sa, &hdr->source);
+        ieee802154_addr_to_sa(&da, &hdr->dest);
+
+        if (sa.addr_type == IEEE802154_ADDR_SHORT)
+                sap = &sa.short_addr;
+        else
+                sap = &sa.hwaddr;
 
-        return lowpan_process_data(skb, skb->dev, (u8 *)_saddr->hwaddr,
-                                _saddr->addr_type, IEEE802154_ADDR_LEN,
-                                (u8 *)_daddr->hwaddr, _daddr->addr_type,
-                                IEEE802154_ADDR_LEN, iphc0, iphc1,
-                                lowpan_give_skb_to_devices);
+        if (da.addr_type == IEEE802154_ADDR_SHORT)
+                dap = &da.short_addr;
+        else
+                dap = &da.hwaddr;
+
+        return lowpan_process_data(skb, skb->dev, sap, sa.addr_type,
+                                   IEEE802154_ADDR_LEN, dap, da.addr_type,
+                                   IEEE802154_ADDR_LEN, iphc0, iphc1,
+                                   lowpan_give_skb_to_devices);
 
-unlock_and_drop:
-        spin_unlock_bh(&flist_lock);
 drop:
         kfree_skb(skb);
         return -EINVAL;
@@ -386,7 +223,7 @@ static int lowpan_set_address(struct net_device *dev, void *p)
 
 static int
 lowpan_fragment_xmit(struct sk_buff *skb, u8 *head,
-                        int mlen, int plen, int offset, int type)
+                     int mlen, int plen, int offset, int type)
 {
         struct sk_buff *frag;
         int hlen;
@@ -422,51 +259,68 @@ lowpan_fragment_xmit(struct sk_buff *skb, u8 *head,
 static int
 lowpan_skb_fragmentation(struct sk_buff *skb, struct net_device *dev)
 {
-        int  err, header_length, payload_length, tag, offset = 0;
+        int err;
+        u16 dgram_offset, dgram_size, payload_length, header_length,
+            lowpan_size, frag_plen, offset;
+        __be16 tag;
         u8 head[5];
 
         header_length = skb->mac_len;
         payload_length = skb->len - header_length;
         tag = lowpan_dev_info(dev)->fragment_tag++;
+        lowpan_size = skb_network_header_len(skb);
+        dgram_size = lowpan_uncompress_size(skb, &dgram_offset) -
+                     header_length;
 
         /* first fragment header */
-        head[0] = LOWPAN_DISPATCH_FRAG1 | ((payload_length >> 8) & 0x7);
-        head[1] = payload_length & 0xff;
-        head[2] = tag >> 8;
-        head[3] = tag & 0xff;
+        head[0] = LOWPAN_DISPATCH_FRAG1 | ((dgram_size >> 8) & 0x7);
+        head[1] = dgram_size & 0xff;
+        memcpy(head + 2, &tag, sizeof(tag));
 
-        err = lowpan_fragment_xmit(skb, head, header_length, LOWPAN_FRAG_SIZE,
-                                   0, LOWPAN_DISPATCH_FRAG1);
+        /* calc the nearest payload length(divided to 8) for first fragment
+         * which fits into a IEEE802154_MTU
+         */
+        frag_plen = round_down(IEEE802154_MTU - header_length -
+                               LOWPAN_FRAG1_HEAD_SIZE - lowpan_size -
+                               IEEE802154_MFR_SIZE, 8);
 
+        err = lowpan_fragment_xmit(skb, head, header_length,
+                                   frag_plen + lowpan_size, 0,
+                                   LOWPAN_DISPATCH_FRAG1);
         if (err) {
                 pr_debug("%s unable to send FRAG1 packet (tag: %d)",
                          __func__, tag);
                 goto exit;
         }
 
-        offset = LOWPAN_FRAG_SIZE;
+        offset = lowpan_size + frag_plen;
+        dgram_offset += frag_plen;
 
         /* next fragment header */
         head[0] &= ~LOWPAN_DISPATCH_FRAG1;
         head[0] |= LOWPAN_DISPATCH_FRAGN;
 
+        frag_plen = round_down(IEEE802154_MTU - header_length -
+                               LOWPAN_FRAGN_HEAD_SIZE - IEEE802154_MFR_SIZE, 8);
+
         while (payload_length - offset > 0) {
-                int len = LOWPAN_FRAG_SIZE;
+                int len = frag_plen;
 
-                head[4] = offset / 8;
+                head[4] = dgram_offset >> 3;
 
                 if (payload_length - offset < len)
                         len = payload_length - offset;
 
-                err = lowpan_fragment_xmit(skb, head, header_length,
-                                           len, offset, LOWPAN_DISPATCH_FRAGN);
+                err = lowpan_fragment_xmit(skb, head, header_length, len,
+                                           offset, LOWPAN_DISPATCH_FRAGN);
                 if (err) {
-                        pr_debug("%s unable to send a subsequent FRAGN packet "
-                                 "(tag: %d, offset: %d", __func__, tag, offset);
+                        pr_debug("%s unable to send a FRAGN packet. (tag: %d, offset: %d)\n",
+                                 __func__, tag, offset);
                         goto exit;
                 }
 
                 offset += len;
+                dgram_offset += len;
         }
 
 exit:
@@ -508,13 +362,13 @@ static struct wpan_phy *lowpan_get_phy(const struct net_device *dev)
         return ieee802154_mlme_ops(real_dev)->get_phy(real_dev);
 }
 
-static u16 lowpan_get_pan_id(const struct net_device *dev)
+static __le16 lowpan_get_pan_id(const struct net_device *dev)
 {
         struct net_device *real_dev = lowpan_dev_info(dev)->real_dev;
         return ieee802154_mlme_ops(real_dev)->get_pan_id(real_dev);
 }
 
-static u16 lowpan_get_short_addr(const struct net_device *dev)
+static __le16 lowpan_get_short_addr(const struct net_device *dev)
 {
         struct net_device *real_dev = lowpan_dev_info(dev)->real_dev;
         return ieee802154_mlme_ops(real_dev)->get_short_addr(real_dev);
@@ -593,45 +447,55 @@ static int lowpan_validate(struct nlattr *tb[], struct nlattr *data[])
 static int lowpan_rcv(struct sk_buff *skb, struct net_device *dev,
         struct packet_type *pt, struct net_device *orig_dev)
 {
-        struct sk_buff *local_skb;
+        struct ieee802154_hdr hdr;
+        int ret;
 
-        if (!netif_running(dev))
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
                 goto drop;
 
+        if (!netif_running(dev))
+                goto drop_skb;
+
         if (dev->type != ARPHRD_IEEE802154)
-                goto drop;
+                goto drop_skb;
+
+        if (ieee802154_hdr_peek_addrs(skb, &hdr) < 0)
+                goto drop_skb;
 
         /* check that it's our buffer */
         if (skb->data[0] == LOWPAN_DISPATCH_IPV6) {
-                /* Copy the packet so that the IPv6 header is
-                 * properly aligned.
-                 */
-                local_skb = skb_copy_expand(skb, NET_SKB_PAD - 1,
-                                            skb_tailroom(skb), GFP_ATOMIC);
-                if (!local_skb)
-                        goto drop;
-
-                local_skb->protocol = htons(ETH_P_IPV6);
-                local_skb->pkt_type = PACKET_HOST;
+                skb->protocol = htons(ETH_P_IPV6);
+                skb->pkt_type = PACKET_HOST;
 
                 /* Pull off the 1-byte of 6lowpan header. */
-                skb_pull(local_skb, 1);
-
-                lowpan_give_skb_to_devices(local_skb, NULL);
+                skb_pull(skb, 1);
 
-                kfree_skb(local_skb);
-                kfree_skb(skb);
+                ret = lowpan_give_skb_to_devices(skb, NULL);
+                if (ret == NET_RX_DROP)
+                        goto drop;
         } else {
                 switch (skb->data[0] & 0xe0) {
                 case LOWPAN_DISPATCH_IPHC:      /* ipv6 datagram */
+                        ret = process_data(skb, &hdr);
+                        if (ret == NET_RX_DROP)
+                                goto drop;
+                        break;
                 case LOWPAN_DISPATCH_FRAG1:     /* first fragment header */
+                        ret = lowpan_frag_rcv(skb, LOWPAN_DISPATCH_FRAG1);
+                        if (ret == 1) {
+                                ret = process_data(skb, &hdr);
+                                if (ret == NET_RX_DROP)
+                                        goto drop;
+                        }
+                        break;
                 case LOWPAN_DISPATCH_FRAGN:     /* next fragments headers */
-                        local_skb = skb_clone(skb, GFP_ATOMIC);
-                        if (!local_skb)
-                                goto drop;
-                        process_data(local_skb);
-
-                        kfree_skb(skb);
+                        ret = lowpan_frag_rcv(skb, LOWPAN_DISPATCH_FRAGN);
+                        if (ret == 1) {
+                                ret = process_data(skb, &hdr);
+                                if (ret == NET_RX_DROP)
+                                        goto drop;
+                        }
                         break;
                 default:
                         break;
@@ -639,9 +503,9 @@ static int lowpan_rcv(struct sk_buff *skb, struct net_device *dev,
         }
 
         return NET_RX_SUCCESS;
-
-drop:
+drop_skb:
         kfree_skb(skb);
+drop:
         return NET_RX_DROP;
 }
 
@@ -665,10 +529,9 @@ static int lowpan_newlink(struct net *src_net, struct net_device *dev,
         }
 
         lowpan_dev_info(dev)->real_dev = real_dev;
-        lowpan_dev_info(dev)->fragment_tag = 0;
         mutex_init(&lowpan_dev_info(dev)->dev_list_mtx);
 
-        entry = kzalloc(sizeof(struct lowpan_dev_record), GFP_KERNEL);
+        entry = kzalloc(sizeof(*entry), GFP_KERNEL);
         if (!entry) {
                 dev_put(real_dev);
                 lowpan_dev_info(dev)->real_dev = NULL;
@@ -761,7 +624,7 @@ static struct notifier_block lowpan_dev_notifier = {
 };
 
 static struct packet_type lowpan_packet_type = {
-        .type = __constant_htons(ETH_P_IEEE802154),
+        .type = htons(ETH_P_IEEE802154),
         .func = lowpan_rcv,
 };
 
@@ -769,43 +632,40 @@ static int __init lowpan_init_module(void)
 {
         int err = 0;
 
-        err = lowpan_netlink_init();
+        err = lowpan_net_frag_init();
         if (err < 0)
                 goto out;
 
+        err = lowpan_netlink_init();
+        if (err < 0)
+                goto out_frag;
+
         dev_add_pack(&lowpan_packet_type);
 
         err = register_netdevice_notifier(&lowpan_dev_notifier);
-        if (err < 0) {
-                dev_remove_pack(&lowpan_packet_type);
-                lowpan_netlink_fini();
-        }
+        if (err < 0)
+                goto out_pack;
+
+        return 0;
+
+out_pack:
+        dev_remove_pack(&lowpan_packet_type);
+        lowpan_netlink_fini();
+out_frag:
+        lowpan_net_frag_exit();
 out:
         return err;
 }
 
 static void __exit lowpan_cleanup_module(void)
 {
-        struct lowpan_fragment *frame, *tframe;
-
         lowpan_netlink_fini();
 
         dev_remove_pack(&lowpan_packet_type);
 
-        unregister_netdevice_notifier(&lowpan_dev_notifier);
+        lowpan_net_frag_exit();
 
-        /* Now 6lowpan packet_type is removed, so no new fragments are
-         * expected on RX, therefore that's the time to clean incomplete
-         * fragments.
-         */
-        spin_lock_bh(&flist_lock);
-        list_for_each_entry_safe(frame, tframe, &lowpan_fragments, list) {
-                del_timer_sync(&frame->timer);
-                list_del(&frame->list);
-                dev_kfree_skb(frame->skb);
-                kfree(frame);
-        }
-        spin_unlock_bh(&flist_lock);
+        unregister_netdevice_notifier(&lowpan_dev_notifier);
 }
 
 module_init(lowpan_init_module);
diff --git a/net/ieee802154/Kconfig b/net/ieee802154/Kconfig
index 9c9879d5ea64..8af1330b3137 100644
--- a/net/ieee802154/Kconfig
+++ b/net/ieee802154/Kconfig
@@ -15,7 +15,7 @@ config IEEE802154_6LOWPAN
         depends on IEEE802154 && IPV6
         select 6LOWPAN_IPHC
         ---help---
-        IPv6 compression over IEEE 802.15.4.
+          IPv6 compression over IEEE 802.15.4.
 
 config 6LOWPAN_IPHC
         tristate
diff --git a/net/ieee802154/Makefile b/net/ieee802154/Makefile
index e8f05885ced6..bf1b51497a41 100644
--- a/net/ieee802154/Makefile
+++ b/net/ieee802154/Makefile
@@ -2,5 +2,9 @@ obj-$(CONFIG_IEEE802154) += ieee802154.o af_802154.o
 obj-$(CONFIG_IEEE802154_6LOWPAN) += 6lowpan.o
 obj-$(CONFIG_6LOWPAN_IPHC) += 6lowpan_iphc.o
 
-ieee802154-y := netlink.o nl-mac.o nl-phy.o nl_policy.o wpan-class.o
+6lowpan-y := 6lowpan_rtnl.o reassembly.o
+ieee802154-y := netlink.o nl-mac.o nl-phy.o nl_policy.o wpan-class.o \
+                header_ops.o
 af_802154-y := af_ieee802154.o raw.o dgram.o
+
+ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/ieee802154/af802154.h b/net/ieee802154/af802154.h
index b1ec52537522..8330a09bfc95 100644
--- a/net/ieee802154/af802154.h
+++ b/net/ieee802154/af802154.h
@@ -25,12 +25,13 @@
 #define AF802154_H
 
 struct sk_buff;
-struct net_devce;
+struct net_device;
+struct ieee802154_addr;
 extern struct proto ieee802154_raw_prot;
 extern struct proto ieee802154_dgram_prot;
 void ieee802154_raw_deliver(struct net_device *dev, struct sk_buff *skb);
 int ieee802154_dgram_deliver(struct net_device *dev, struct sk_buff *skb);
 struct net_device *ieee802154_get_dev(struct net *net,
-                struct ieee802154_addr *addr);
+                                      const struct ieee802154_addr *addr);
 
 #endif
diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
index 40e606f3788f..351d9a94ec2f 100644
--- a/net/ieee802154/af_ieee802154.c
+++ b/net/ieee802154/af_ieee802154.c
@@ -43,25 +43,27 @@
 /*
  * Utility function for families
  */
-struct net_device *ieee802154_get_dev(struct net *net,
-                struct ieee802154_addr *addr)
+struct net_device*
+ieee802154_get_dev(struct net *net, const struct ieee802154_addr *addr)
 {
         struct net_device *dev = NULL;
         struct net_device *tmp;
-        u16 pan_id, short_addr;
+        __le16 pan_id, short_addr;
+        u8 hwaddr[IEEE802154_ADDR_LEN];
 
-        switch (addr->addr_type) {
+        switch (addr->mode) {
         case IEEE802154_ADDR_LONG:
+                ieee802154_devaddr_to_raw(hwaddr, addr->extended_addr);
                 rcu_read_lock();
-                dev = dev_getbyhwaddr_rcu(net, ARPHRD_IEEE802154, addr->hwaddr);
+                dev = dev_getbyhwaddr_rcu(net, ARPHRD_IEEE802154, hwaddr);
                 if (dev)
                         dev_hold(dev);
                 rcu_read_unlock();
                 break;
         case IEEE802154_ADDR_SHORT:
-                if (addr->pan_id == 0xffff ||
-                    addr->short_addr == IEEE802154_ADDR_UNDEF ||
-                    addr->short_addr == 0xffff)
+                if (addr->pan_id == cpu_to_le16(IEEE802154_PANID_BROADCAST) ||
+                    addr->short_addr == cpu_to_le16(IEEE802154_ADDR_UNDEF) ||
+                    addr->short_addr == cpu_to_le16(IEEE802154_ADDR_BROADCAST))
                         break;
 
                 rtnl_lock();
@@ -86,7 +88,7 @@ struct net_device *ieee802154_get_dev(struct net *net,
                 break;
         default:
                 pr_warning("Unsupported ieee802154 address type: %d\n",
-                                addr->addr_type);
+                                addr->mode);
                 break;
         }
 
@@ -326,7 +328,7 @@ drop:
 
 
 static struct packet_type ieee802154_packet_type = {
-        .type = __constant_htons(ETH_P_IEEE802154),
+        .type = htons(ETH_P_IEEE802154),
         .func = ieee802154_rcv,
 };
 
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 1846c1fe0d06..786437bc0c08 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -73,10 +73,10 @@ static int dgram_init(struct sock *sk)
 {
         struct dgram_sock *ro = dgram_sk(sk);
 
-        ro->dst_addr.addr_type = IEEE802154_ADDR_LONG;
-        ro->dst_addr.pan_id = 0xffff;
+        ro->dst_addr.mode = IEEE802154_ADDR_LONG;
+        ro->dst_addr.pan_id = cpu_to_le16(IEEE802154_PANID_BROADCAST);
         ro->want_ack = 1;
-        memset(&ro->dst_addr.hwaddr, 0xff, sizeof(ro->dst_addr.hwaddr));
+        memset(&ro->dst_addr.extended_addr, 0xff, IEEE802154_ADDR_LEN);
         return 0;
 }
 
@@ -88,6 +88,7 @@ static void dgram_close(struct sock *sk, long timeout)
 static int dgram_bind(struct sock *sk, struct sockaddr *uaddr, int len)
 {
         struct sockaddr_ieee802154 *addr = (struct sockaddr_ieee802154 *)uaddr;
+        struct ieee802154_addr haddr;
         struct dgram_sock *ro = dgram_sk(sk);
         int err = -EINVAL;
         struct net_device *dev;
@@ -102,7 +103,8 @@ static int dgram_bind(struct sock *sk, struct sockaddr *uaddr, int len)
         if (addr->family != AF_IEEE802154)
                 goto out;
 
-        dev = ieee802154_get_dev(sock_net(sk), &addr->addr);
+        ieee802154_addr_from_sa(&haddr, &addr->addr);
+        dev = ieee802154_get_dev(sock_net(sk), &haddr);
         if (!dev) {
                 err = -ENODEV;
                 goto out;
@@ -113,7 +115,7 @@ static int dgram_bind(struct sock *sk, struct sockaddr *uaddr, int len)
                 goto out_put;
         }
 
-        memcpy(&ro->src_addr, &addr->addr, sizeof(struct ieee802154_addr));
+        ro->src_addr = haddr;
 
         ro->bound = 1;
         err = 0;
@@ -149,8 +151,7 @@ static int dgram_ioctl(struct sock *sk, int cmd, unsigned long arg)
                          * of this packet since that is all
                          * that will be read.
                          */
-                        /* FIXME: parse the header for more correct value */
-                        amount = skb->len - (3+8+8);
+                        amount = skb->len - ieee802154_hdr_length(skb);
                 }
                 spin_unlock_bh(&sk->sk_receive_queue.lock);
                 return put_user(amount, (int __user *)arg);
@@ -181,7 +182,7 @@ static int dgram_connect(struct sock *sk, struct sockaddr *uaddr,
                 goto out;
         }
 
-        memcpy(&ro->dst_addr, &addr->addr, sizeof(struct ieee802154_addr));
+        ieee802154_addr_from_sa(&ro->dst_addr, &addr->addr);
 
 out:
         release_sock(sk);
@@ -194,8 +195,8 @@ static int dgram_disconnect(struct sock *sk, int flags)
 
         lock_sock(sk);
 
-        ro->dst_addr.addr_type = IEEE802154_ADDR_LONG;
-        memset(&ro->dst_addr.hwaddr, 0xff, sizeof(ro->dst_addr.hwaddr));
+        ro->dst_addr.mode = IEEE802154_ADDR_LONG;
+        memset(&ro->dst_addr.extended_addr, 0xff, IEEE802154_ADDR_LEN);
 
         release_sock(sk);
 
@@ -232,7 +233,7 @@ static int dgram_sendmsg(struct kiocb *iocb, struct sock *sk,
 
         if (size > mtu) {
                 pr_debug("size = %Zu, mtu = %u\n", size, mtu);
-                err = -EINVAL;
+                err = -EMSGSIZE;
                 goto out_dev;
         }
 
@@ -312,7 +313,7 @@ static int dgram_recvmsg(struct kiocb *iocb, struct sock *sk,
 
         if (saddr) {
                 saddr->family = AF_IEEE802154;
-                saddr->addr = mac_cb(skb)->sa;
+                ieee802154_addr_to_sa(&saddr->addr, &mac_cb(skb)->source);
                 *addr_len = sizeof(*saddr);
         }
 
@@ -328,6 +329,10 @@ out:
 
 static int dgram_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
+                return NET_RX_DROP;
+
         if (sock_queue_rcv_skb(sk, skb) < 0) {
                 kfree_skb(skb);
                 return NET_RX_DROP;
@@ -336,40 +341,43 @@ static int dgram_rcv_skb(struct sock *sk, struct sk_buff *skb)
         return NET_RX_SUCCESS;
 }
 
-static inline int ieee802154_match_sock(u8 *hw_addr, u16 pan_id,
-                u16 short_addr, struct dgram_sock *ro)
+static inline bool
+ieee802154_match_sock(__le64 hw_addr, __le16 pan_id, __le16 short_addr,
+                      struct dgram_sock *ro)
 {
         if (!ro->bound)
-                return 1;
+                return true;
 
-        if (ro->src_addr.addr_type == IEEE802154_ADDR_LONG &&
-            !memcmp(ro->src_addr.hwaddr, hw_addr, IEEE802154_ADDR_LEN))
-                return 1;
+        if (ro->src_addr.mode == IEEE802154_ADDR_LONG &&
+            hw_addr == ro->src_addr.extended_addr)
+                return true;
 
-        if (ro->src_addr.addr_type == IEEE802154_ADDR_SHORT &&
-                     pan_id == ro->src_addr.pan_id &&
-                     short_addr == ro->src_addr.short_addr)
-                return 1;
+        if (ro->src_addr.mode == IEEE802154_ADDR_SHORT &&
+            pan_id == ro->src_addr.pan_id &&
+            short_addr == ro->src_addr.short_addr)
+                return true;
 
-        return 0;
+        return false;
 }
 
 int ieee802154_dgram_deliver(struct net_device *dev, struct sk_buff *skb)
 {
         struct sock *sk, *prev = NULL;
         int ret = NET_RX_SUCCESS;
-        u16 pan_id, short_addr;
+        __le16 pan_id, short_addr;
+        __le64 hw_addr;
 
         /* Data frame processing */
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
         pan_id = ieee802154_mlme_ops(dev)->get_pan_id(dev);
         short_addr = ieee802154_mlme_ops(dev)->get_short_addr(dev);
+        hw_addr = ieee802154_devaddr_from_raw(dev->dev_addr);
 
         read_lock(&dgram_lock);
         sk_for_each(sk, &dgram_head) {
-                if (ieee802154_match_sock(dev->dev_addr, pan_id, short_addr,
-                                        dgram_sk(sk))) {
+                if (ieee802154_match_sock(hw_addr, pan_id, short_addr,
+                                          dgram_sk(sk))) {
                         if (prev) {
                                 struct sk_buff *clone;
                                 clone = skb_clone(skb, GFP_ATOMIC);
diff --git a/net/ieee802154/header_ops.c b/net/ieee802154/header_ops.c
new file mode 100644
index 000000000000..bed42a48408c
--- /dev/null
+++ b/net/ieee802154/header_ops.c
@@ -0,0 +1,287 @@
+/*
+ * Copyright (C) 2014 Fraunhofer ITWM
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * Written by:
+ * Phoebe Buckheister <phoebe.buckheister@itwm.fraunhofer.de>
+ */
+
+#include <net/mac802154.h>
+#include <net/ieee802154.h>
+#include <net/ieee802154_netdev.h>
+
+static int
+ieee802154_hdr_push_addr(u8 *buf, const struct ieee802154_addr *addr,
+                         bool omit_pan)
+{
+        int pos = 0;
+
+        if (addr->mode == IEEE802154_ADDR_NONE)
+                return 0;
+
+        if (!omit_pan) {
+                memcpy(buf + pos, &addr->pan_id, 2);
+                pos += 2;
+        }
+
+        switch (addr->mode) {
+        case IEEE802154_ADDR_SHORT:
+                memcpy(buf + pos, &addr->short_addr, 2);
+                pos += 2;
+                break;
+
+        case IEEE802154_ADDR_LONG:
+                memcpy(buf + pos, &addr->extended_addr, IEEE802154_ADDR_LEN);
+                pos += IEEE802154_ADDR_LEN;
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        return pos;
+}
+
+static int
+ieee802154_hdr_push_sechdr(u8 *buf, const struct ieee802154_sechdr *hdr)
+{
+        int pos = 5;
+
+        memcpy(buf, hdr, 1);
+        memcpy(buf + 1, &hdr->frame_counter, 4);
+
+        switch (hdr->key_id_mode) {
+        case IEEE802154_SCF_KEY_IMPLICIT:
+                return pos;
+
+        case IEEE802154_SCF_KEY_INDEX:
+                break;
+
+        case IEEE802154_SCF_KEY_SHORT_INDEX:
+                memcpy(buf + pos, &hdr->short_src, 4);
+                pos += 4;
+                break;
+
+        case IEEE802154_SCF_KEY_HW_INDEX:
+                memcpy(buf + pos, &hdr->extended_src, IEEE802154_ADDR_LEN);
+                pos += IEEE802154_ADDR_LEN;
+                break;
+        }
+
+        buf[pos++] = hdr->key_id;
+
+        return pos;
+}
+
+int
+ieee802154_hdr_push(struct sk_buff *skb, const struct ieee802154_hdr *hdr)
+{
+        u8 buf[MAC802154_FRAME_HARD_HEADER_LEN];
+        int pos = 2;
+        int rc;
+        struct ieee802154_hdr_fc fc = hdr->fc;
+
+        buf[pos++] = hdr->seq;
+
+        fc.dest_addr_mode = hdr->dest.mode;
+
+        rc = ieee802154_hdr_push_addr(buf + pos, &hdr->dest, false);
+        if (rc < 0)
+                return -EINVAL;
+        pos += rc;
+
+        fc.source_addr_mode = hdr->source.mode;
+
+        if (hdr->source.pan_id == hdr->dest.pan_id &&
+            hdr->dest.mode != IEEE802154_ADDR_NONE)
+                fc.intra_pan = true;
+
+        rc = ieee802154_hdr_push_addr(buf + pos, &hdr->source, fc.intra_pan);
+        if (rc < 0)
+                return -EINVAL;
+        pos += rc;
+
+        if (fc.security_enabled) {
+                fc.version = 1;
+
+                rc = ieee802154_hdr_push_sechdr(buf + pos, &hdr->sec);
+                if (rc < 0)
+                        return -EINVAL;
+
+                pos += rc;
+        }
+
+        memcpy(buf, &fc, 2);
+
+        memcpy(skb_push(skb, pos), buf, pos);
+
+        return pos;
+}
+EXPORT_SYMBOL_GPL(ieee802154_hdr_push);
+
+static int
+ieee802154_hdr_get_addr(const u8 *buf, int mode, bool omit_pan,
+                        struct ieee802154_addr *addr)
+{
+        int pos = 0;
+
+        addr->mode = mode;
+
+        if (mode == IEEE802154_ADDR_NONE)
+                return 0;
+
+        if (!omit_pan) {
+                memcpy(&addr->pan_id, buf + pos, 2);
+                pos += 2;
+        }
+
+        if (mode == IEEE802154_ADDR_SHORT) {
+                memcpy(&addr->short_addr, buf + pos, 2);
+                return pos + 2;
+        } else {
+                memcpy(&addr->extended_addr, buf + pos, IEEE802154_ADDR_LEN);
+                return pos + IEEE802154_ADDR_LEN;
+        }
+}
+
+static int ieee802154_hdr_addr_len(int mode, bool omit_pan)
+{
+        int pan_len = omit_pan ? 0 : 2;
+
+        switch (mode) {
+        case IEEE802154_ADDR_NONE: return 0;
+        case IEEE802154_ADDR_SHORT: return 2 + pan_len;
+        case IEEE802154_ADDR_LONG: return IEEE802154_ADDR_LEN + pan_len;
+        default: return -EINVAL;
+        }
+}
+
+static int
+ieee802154_hdr_get_sechdr(const u8 *buf, struct ieee802154_sechdr *hdr)
+{
+        int pos = 5;
+
+        memcpy(hdr, buf, 1);
+        memcpy(&hdr->frame_counter, buf + 1, 4);
+
+        switch (hdr->key_id_mode) {
+        case IEEE802154_SCF_KEY_IMPLICIT:
+                return pos;
+
+        case IEEE802154_SCF_KEY_INDEX:
+                break;
+
+        case IEEE802154_SCF_KEY_SHORT_INDEX:
+                memcpy(&hdr->short_src, buf + pos, 4);
+                pos += 4;
+                break;
+
+        case IEEE802154_SCF_KEY_HW_INDEX:
+                memcpy(&hdr->extended_src, buf + pos, IEEE802154_ADDR_LEN);
+                pos += IEEE802154_ADDR_LEN;
+                break;
+        }
+
+        hdr->key_id = buf[pos++];
+
+        return pos;
+}
+
+static int ieee802154_hdr_sechdr_len(u8 sc)
+{
+        switch (IEEE802154_SCF_KEY_ID_MODE(sc)) {
+        case IEEE802154_SCF_KEY_IMPLICIT: return 5;
+        case IEEE802154_SCF_KEY_INDEX: return 6;
+        case IEEE802154_SCF_KEY_SHORT_INDEX: return 10;
+        case IEEE802154_SCF_KEY_HW_INDEX: return 14;
+        default: return -EINVAL;
+        }
+}
+
+static int ieee802154_hdr_minlen(const struct ieee802154_hdr *hdr)
+{
+        int dlen, slen;
+
+        dlen = ieee802154_hdr_addr_len(hdr->fc.dest_addr_mode, false);
+        slen = ieee802154_hdr_addr_len(hdr->fc.source_addr_mode,
+                                       hdr->fc.intra_pan);
+
+        if (slen < 0 || dlen < 0)
+                return -EINVAL;
+
+        return 3 + dlen + slen + hdr->fc.security_enabled;
+}
+
+static int
+ieee802154_hdr_get_addrs(const u8 *buf, struct ieee802154_hdr *hdr)
+{
+        int pos = 0;
+
+        pos += ieee802154_hdr_get_addr(buf + pos, hdr->fc.dest_addr_mode,
+                                       false, &hdr->dest);
+        pos += ieee802154_hdr_get_addr(buf + pos, hdr->fc.source_addr_mode,
+                                       hdr->fc.intra_pan, &hdr->source);
+
+        if (hdr->fc.intra_pan)
+                hdr->source.pan_id = hdr->dest.pan_id;
+
+        return pos;
+}
+
+int
+ieee802154_hdr_pull(struct sk_buff *skb, struct ieee802154_hdr *hdr)
+{
+        int pos = 3, rc;
+
+        if (!pskb_may_pull(skb, 3))
+                return -EINVAL;
+
+        memcpy(hdr, skb->data, 3);
+
+        rc = ieee802154_hdr_minlen(hdr);
+        if (rc < 0 || !pskb_may_pull(skb, rc))
+                return -EINVAL;
+
+        pos += ieee802154_hdr_get_addrs(skb->data + pos, hdr);
+
+        if (hdr->fc.security_enabled) {
+                int want = pos + ieee802154_hdr_sechdr_len(skb->data[pos]);
+
+                if (!pskb_may_pull(skb, want))
+                        return -EINVAL;
+
+                pos += ieee802154_hdr_get_sechdr(skb->data + pos, &hdr->sec);
+        }
+
+        skb_pull(skb, pos);
+        return pos;
+}
+EXPORT_SYMBOL_GPL(ieee802154_hdr_pull);
+
+int
+ieee802154_hdr_peek_addrs(const struct sk_buff *skb, struct ieee802154_hdr *hdr)
+{
+        const u8 *buf = skb_mac_header(skb);
+        int pos = 3, rc;
+
+        if (buf + 3 > skb_tail_pointer(skb))
+                return -EINVAL;
+
+        memcpy(hdr, buf, 3);
+
+        rc = ieee802154_hdr_minlen(hdr);
+        if (rc < 0 || buf + rc > skb_tail_pointer(skb))
+                return -EINVAL;
+
+        pos += ieee802154_hdr_get_addrs(buf + pos, hdr);
+        return pos;
+}
+EXPORT_SYMBOL_GPL(ieee802154_hdr_peek_addrs);
diff --git a/net/ieee802154/ieee802154.h b/net/ieee802154/ieee802154.h
index cee4425b9956..6693a5cf01ce 100644
--- a/net/ieee802154/ieee802154.h
+++ b/net/ieee802154/ieee802154.h
@@ -66,5 +66,6 @@ int ieee802154_scan_req(struct sk_buff *skb, struct genl_info *info);
 int ieee802154_start_req(struct sk_buff *skb, struct genl_info *info);
 int ieee802154_list_iface(struct sk_buff *skb, struct genl_info *info);
 int ieee802154_dump_iface(struct sk_buff *skb, struct netlink_callback *cb);
+int ieee802154_set_macparams(struct sk_buff *skb, struct genl_info *info);
 
 #endif
diff --git a/net/ieee802154/netlink.c b/net/ieee802154/netlink.c
index 43f1b2bf469f..04b20589d97a 100644
--- a/net/ieee802154/netlink.c
+++ b/net/ieee802154/netlink.c
@@ -123,6 +123,7 @@ static const struct genl_ops ieee8021154_ops[] = {
         IEEE802154_OP(IEEE802154_START_REQ, ieee802154_start_req),
         IEEE802154_DUMP(IEEE802154_LIST_IFACE, ieee802154_list_iface,
                         ieee802154_dump_iface),
+        IEEE802154_OP(IEEE802154_SET_MACPARAMS, ieee802154_set_macparams),
 };
 
 static const struct genl_multicast_group ieee802154_mcgrps[] = {
diff --git a/net/ieee802154/nl-mac.c b/net/ieee802154/nl-mac.c
index ba5c1e002f37..5d285498c0f6 100644
--- a/net/ieee802154/nl-mac.c
+++ b/net/ieee802154/nl-mac.c
@@ -39,6 +39,26 @@
 
 #include "ieee802154.h"
 
+static int nla_put_hwaddr(struct sk_buff *msg, int type, __le64 hwaddr)
+{
+        return nla_put_u64(msg, type, swab64((__force u64)hwaddr));
+}
+
+static __le64 nla_get_hwaddr(const struct nlattr *nla)
+{
+        return ieee802154_devaddr_from_raw(nla_data(nla));
+}
+
+static int nla_put_shortaddr(struct sk_buff *msg, int type, __le16 addr)
+{
+        return nla_put_u16(msg, type, le16_to_cpu(addr));
+}
+
+static __le16 nla_get_shortaddr(const struct nlattr *nla)
+{
+        return cpu_to_le16(nla_get_u16(nla));
+}
+
 int ieee802154_nl_assoc_indic(struct net_device *dev,
                 struct ieee802154_addr *addr, u8 cap)
 {
@@ -46,7 +66,7 @@ int ieee802154_nl_assoc_indic(struct net_device *dev,
 
         pr_debug("%s\n", __func__);
 
-        if (addr->addr_type != IEEE802154_ADDR_LONG) {
+        if (addr->mode != IEEE802154_ADDR_LONG) {
                 pr_err("%s: received non-long source address!\n", __func__);
                 return -EINVAL;
         }
@@ -59,8 +79,8 @@ int ieee802154_nl_assoc_indic(struct net_device *dev,
             nla_put_u32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex) ||
             nla_put(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
                     dev->dev_addr) ||
-            nla_put(msg, IEEE802154_ATTR_SRC_HW_ADDR, IEEE802154_ADDR_LEN,
-                    addr->hwaddr) ||
+            nla_put_hwaddr(msg, IEEE802154_ATTR_SRC_HW_ADDR,
+                           addr->extended_addr) ||
             nla_put_u8(msg, IEEE802154_ATTR_CAPABILITY, cap))
                 goto nla_put_failure;
 
@@ -72,7 +92,7 @@ nla_put_failure:
 }
 EXPORT_SYMBOL(ieee802154_nl_assoc_indic);
 
-int ieee802154_nl_assoc_confirm(struct net_device *dev, u16 short_addr,
+int ieee802154_nl_assoc_confirm(struct net_device *dev, __le16 short_addr,
                 u8 status)
 {
         struct sk_buff *msg;
@@ -87,7 +107,7 @@ int ieee802154_nl_assoc_confirm(struct net_device *dev, u16 short_addr,
             nla_put_u32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex) ||
             nla_put(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
                     dev->dev_addr) ||
-            nla_put_u16(msg, IEEE802154_ATTR_SHORT_ADDR, short_addr) ||
+            nla_put_shortaddr(msg, IEEE802154_ATTR_SHORT_ADDR, short_addr) ||
             nla_put_u8(msg, IEEE802154_ATTR_STATUS, status))
                 goto nla_put_failure;
         return ieee802154_nl_mcast(msg, IEEE802154_COORD_MCGRP);
@@ -114,13 +134,13 @@ int ieee802154_nl_disassoc_indic(struct net_device *dev,
             nla_put(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
                     dev->dev_addr))
                 goto nla_put_failure;
-        if (addr->addr_type == IEEE802154_ADDR_LONG) {
-                if (nla_put(msg, IEEE802154_ATTR_SRC_HW_ADDR, IEEE802154_ADDR_LEN,
-                            addr->hwaddr))
+        if (addr->mode == IEEE802154_ADDR_LONG) {
+                if (nla_put_hwaddr(msg, IEEE802154_ATTR_SRC_HW_ADDR,
+                                   addr->extended_addr))
                         goto nla_put_failure;
         } else {
-                if (nla_put_u16(msg, IEEE802154_ATTR_SRC_SHORT_ADDR,
-                                addr->short_addr))
+                if (nla_put_shortaddr(msg, IEEE802154_ATTR_SRC_SHORT_ADDR,
+                                      addr->short_addr))
                         goto nla_put_failure;
         }
         if (nla_put_u8(msg, IEEE802154_ATTR_REASON, reason))
@@ -157,8 +177,8 @@ nla_put_failure:
 }
 EXPORT_SYMBOL(ieee802154_nl_disassoc_confirm);
 
-int ieee802154_nl_beacon_indic(struct net_device *dev,
-                u16 panid, u16 coord_addr)
+int ieee802154_nl_beacon_indic(struct net_device *dev, __le16 panid,
+                               __le16 coord_addr)
 {
         struct sk_buff *msg;
 
@@ -172,8 +192,9 @@ int ieee802154_nl_beacon_indic(struct net_device *dev,
             nla_put_u32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex) ||
             nla_put(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
                     dev->dev_addr) ||
-            nla_put_u16(msg, IEEE802154_ATTR_COORD_SHORT_ADDR, coord_addr) ||
-            nla_put_u16(msg, IEEE802154_ATTR_COORD_PAN_ID, panid))
+            nla_put_shortaddr(msg, IEEE802154_ATTR_COORD_SHORT_ADDR,
+                              coord_addr) ||
+            nla_put_shortaddr(msg, IEEE802154_ATTR_COORD_PAN_ID, panid))
                 goto nla_put_failure;
         return ieee802154_nl_mcast(msg, IEEE802154_COORD_MCGRP);
 
@@ -243,6 +264,8 @@ static int ieee802154_nl_fill_iface(struct sk_buff *msg, u32 portid,
 {
         void *hdr;
         struct wpan_phy *phy;
+        struct ieee802154_mlme_ops *ops;
+        __le16 short_addr, pan_id;
 
         pr_debug("%s\n", __func__);
 
@@ -251,19 +274,45 @@ static int ieee802154_nl_fill_iface(struct sk_buff *msg, u32 portid,
         if (!hdr)
                 goto out;
 
-        phy = ieee802154_mlme_ops(dev)->get_phy(dev);
+        ops = ieee802154_mlme_ops(dev);
+        phy = ops->get_phy(dev);
         BUG_ON(!phy);
 
+        short_addr = ops->get_short_addr(dev);
+        pan_id = ops->get_pan_id(dev);
+
         if (nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, dev->name) ||
             nla_put_string(msg, IEEE802154_ATTR_PHY_NAME, wpan_phy_name(phy)) ||
             nla_put_u32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex) ||
             nla_put(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
                     dev->dev_addr) ||
-            nla_put_u16(msg, IEEE802154_ATTR_SHORT_ADDR,
-                        ieee802154_mlme_ops(dev)->get_short_addr(dev)) ||
-            nla_put_u16(msg, IEEE802154_ATTR_PAN_ID,
-                        ieee802154_mlme_ops(dev)->get_pan_id(dev)))
+            nla_put_shortaddr(msg, IEEE802154_ATTR_SHORT_ADDR, short_addr) ||
+            nla_put_shortaddr(msg, IEEE802154_ATTR_PAN_ID, pan_id))
                 goto nla_put_failure;
+
+        if (ops->get_mac_params) {
+                struct ieee802154_mac_params params;
+
+                ops->get_mac_params(dev, &params);
+
+                if (nla_put_s8(msg, IEEE802154_ATTR_TXPOWER,
+                               params.transmit_power) ||
+                    nla_put_u8(msg, IEEE802154_ATTR_LBT_ENABLED, params.lbt) ||
+                    nla_put_u8(msg, IEEE802154_ATTR_CCA_MODE,
+                               params.cca_mode) ||
+                    nla_put_s32(msg, IEEE802154_ATTR_CCA_ED_LEVEL,
+                                params.cca_ed_level) ||
+                    nla_put_u8(msg, IEEE802154_ATTR_CSMA_RETRIES,
+                               params.csma_retries) ||
+                    nla_put_u8(msg, IEEE802154_ATTR_CSMA_MIN_BE,
+                               params.min_be) ||
+                    nla_put_u8(msg, IEEE802154_ATTR_CSMA_MAX_BE,
+                               params.max_be) ||
+                    nla_put_s8(msg, IEEE802154_ATTR_FRAME_RETRIES,
+                               params.frame_retries))
+                        goto nla_put_failure;
+        }
+
         wpan_phy_put(phy);
         return genlmsg_end(msg, hdr);
 
@@ -322,16 +371,16 @@ int ieee802154_associate_req(struct sk_buff *skb, struct genl_info *info)
                 goto out;
 
         if (info->attrs[IEEE802154_ATTR_COORD_HW_ADDR]) {
-                addr.addr_type = IEEE802154_ADDR_LONG;
-                nla_memcpy(addr.hwaddr,
-                                info->attrs[IEEE802154_ATTR_COORD_HW_ADDR],
-                                IEEE802154_ADDR_LEN);
+                addr.mode = IEEE802154_ADDR_LONG;
+                addr.extended_addr = nla_get_hwaddr(
+                                info->attrs[IEEE802154_ATTR_COORD_HW_ADDR]);
         } else {
-                addr.addr_type = IEEE802154_ADDR_SHORT;
-                addr.short_addr = nla_get_u16(
+                addr.mode = IEEE802154_ADDR_SHORT;
+                addr.short_addr = nla_get_shortaddr(
                                 info->attrs[IEEE802154_ATTR_COORD_SHORT_ADDR]);
         }
-        addr.pan_id = nla_get_u16(info->attrs[IEEE802154_ATTR_COORD_PAN_ID]);
+        addr.pan_id = nla_get_shortaddr(
+                        info->attrs[IEEE802154_ATTR_COORD_PAN_ID]);
 
         if (info->attrs[IEEE802154_ATTR_PAGE])
                 page = nla_get_u8(info->attrs[IEEE802154_ATTR_PAGE]);
@@ -365,14 +414,13 @@ int ieee802154_associate_resp(struct sk_buff *skb, struct genl_info *info)
         if (!ieee802154_mlme_ops(dev)->assoc_resp)
                 goto out;
 
-        addr.addr_type = IEEE802154_ADDR_LONG;
-        nla_memcpy(addr.hwaddr, info->attrs[IEEE802154_ATTR_DEST_HW_ADDR],
-                        IEEE802154_ADDR_LEN);
+        addr.mode = IEEE802154_ADDR_LONG;
+        addr.extended_addr = nla_get_hwaddr(
+                        info->attrs[IEEE802154_ATTR_DEST_HW_ADDR]);
         addr.pan_id = ieee802154_mlme_ops(dev)->get_pan_id(dev);
 
-
         ret = ieee802154_mlme_ops(dev)->assoc_resp(dev, &addr,
-                nla_get_u16(info->attrs[IEEE802154_ATTR_DEST_SHORT_ADDR]),
+                nla_get_shortaddr(info->attrs[IEEE802154_ATTR_DEST_SHORT_ADDR]),
                 nla_get_u8(info->attrs[IEEE802154_ATTR_STATUS]));
 
 out:
@@ -398,13 +446,12 @@ int ieee802154_disassociate_req(struct sk_buff *skb, struct genl_info *info)
                 goto out;
 
         if (info->attrs[IEEE802154_ATTR_DEST_HW_ADDR]) {
-                addr.addr_type = IEEE802154_ADDR_LONG;
-                nla_memcpy(addr.hwaddr,
-                                info->attrs[IEEE802154_ATTR_DEST_HW_ADDR],
-                                IEEE802154_ADDR_LEN);
+                addr.mode = IEEE802154_ADDR_LONG;
+                addr.extended_addr = nla_get_hwaddr(
+                                info->attrs[IEEE802154_ATTR_DEST_HW_ADDR]);
         } else {
-                addr.addr_type = IEEE802154_ADDR_SHORT;
-                addr.short_addr = nla_get_u16(
+                addr.mode = IEEE802154_ADDR_SHORT;
+                addr.short_addr = nla_get_shortaddr(
                                 info->attrs[IEEE802154_ATTR_DEST_SHORT_ADDR]);
         }
         addr.pan_id = ieee802154_mlme_ops(dev)->get_pan_id(dev);
@@ -449,10 +496,11 @@ int ieee802154_start_req(struct sk_buff *skb, struct genl_info *info)
         if (!ieee802154_mlme_ops(dev)->start_req)
                 goto out;
 
-        addr.addr_type = IEEE802154_ADDR_SHORT;
-        addr.short_addr = nla_get_u16(
+        addr.mode = IEEE802154_ADDR_SHORT;
+        addr.short_addr = nla_get_shortaddr(
                         info->attrs[IEEE802154_ATTR_COORD_SHORT_ADDR]);
-        addr.pan_id = nla_get_u16(info->attrs[IEEE802154_ATTR_COORD_PAN_ID]);
+        addr.pan_id = nla_get_shortaddr(
+                        info->attrs[IEEE802154_ATTR_COORD_PAN_ID]);
 
         channel = nla_get_u8(info->attrs[IEEE802154_ATTR_CHANNEL]);
         bcn_ord = nla_get_u8(info->attrs[IEEE802154_ATTR_BCN_ORD]);
@@ -467,7 +515,7 @@ int ieee802154_start_req(struct sk_buff *skb, struct genl_info *info)
                 page = 0;
 
 
-        if (addr.short_addr == IEEE802154_ADDR_BROADCAST) {
+        if (addr.short_addr == cpu_to_le16(IEEE802154_ADDR_BROADCAST)) {
                 ieee802154_nl_start_confirm(dev, IEEE802154_NO_SHORT_ADDRESS);
                 dev_put(dev);
                 return -EINVAL;
@@ -577,3 +625,93 @@ cont:
 
         return skb->len;
 }
+
+int ieee802154_set_macparams(struct sk_buff *skb, struct genl_info *info)
+{
+        struct net_device *dev = NULL;
+        struct ieee802154_mlme_ops *ops;
+        struct ieee802154_mac_params params;
+        struct wpan_phy *phy;
+        int rc = -EINVAL;
+
+        pr_debug("%s\n", __func__);
+
+        dev = ieee802154_nl_get_dev(info);
+        if (!dev)
+                return -ENODEV;
+
+        ops = ieee802154_mlme_ops(dev);
+
+        if (!ops->get_mac_params || !ops->set_mac_params) {
+                rc = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (netif_running(dev)) {
+                rc = -EBUSY;
+                goto out;
+        }
+
+        if (!info->attrs[IEEE802154_ATTR_LBT_ENABLED] &&
+            !info->attrs[IEEE802154_ATTR_CCA_MODE] &&
+            !info->attrs[IEEE802154_ATTR_CCA_ED_LEVEL] &&
+            !info->attrs[IEEE802154_ATTR_CSMA_RETRIES] &&
+            !info->attrs[IEEE802154_ATTR_CSMA_MIN_BE] &&
+            !info->attrs[IEEE802154_ATTR_CSMA_MAX_BE] &&
+            !info->attrs[IEEE802154_ATTR_FRAME_RETRIES])
+                goto out;
+
+        phy = ops->get_phy(dev);
+
+        if ((!phy->set_lbt && info->attrs[IEEE802154_ATTR_LBT_ENABLED]) ||
+            (!phy->set_cca_mode && info->attrs[IEEE802154_ATTR_CCA_MODE]) ||
+            (!phy->set_cca_ed_level &&
+             info->attrs[IEEE802154_ATTR_CCA_ED_LEVEL]) ||
+            (!phy->set_csma_params &&
+             (info->attrs[IEEE802154_ATTR_CSMA_RETRIES] ||
+              info->attrs[IEEE802154_ATTR_CSMA_MIN_BE] ||
+              info->attrs[IEEE802154_ATTR_CSMA_MAX_BE])) ||
+            (!phy->set_frame_retries &&
+             info->attrs[IEEE802154_ATTR_FRAME_RETRIES])) {
+                rc = -EOPNOTSUPP;
+                goto out_phy;
+        }
+
+        ops->get_mac_params(dev, &params);
+
+        if (info->attrs[IEEE802154_ATTR_TXPOWER])
+                params.transmit_power = nla_get_s8(info->attrs[IEEE802154_ATTR_TXPOWER]);
+
+        if (info->attrs[IEEE802154_ATTR_LBT_ENABLED])
+                params.lbt = nla_get_u8(info->attrs[IEEE802154_ATTR_LBT_ENABLED]);
+
+        if (info->attrs[IEEE802154_ATTR_CCA_MODE])
+                params.cca_mode = nla_get_u8(info->attrs[IEEE802154_ATTR_CCA_MODE]);
+
+        if (info->attrs[IEEE802154_ATTR_CCA_ED_LEVEL])
+                params.cca_ed_level = nla_get_s32(info->attrs[IEEE802154_ATTR_CCA_ED_LEVEL]);
+
+        if (info->attrs[IEEE802154_ATTR_CSMA_RETRIES])
+                params.csma_retries = nla_get_u8(info->attrs[IEEE802154_ATTR_CSMA_RETRIES]);
+
+        if (info->attrs[IEEE802154_ATTR_CSMA_MIN_BE])
+                params.min_be = nla_get_u8(info->attrs[IEEE802154_ATTR_CSMA_MIN_BE]);
+
+        if (info->attrs[IEEE802154_ATTR_CSMA_MAX_BE])
+                params.max_be = nla_get_u8(info->attrs[IEEE802154_ATTR_CSMA_MAX_BE]);
+
+        if (info->attrs[IEEE802154_ATTR_FRAME_RETRIES])
+                params.frame_retries = nla_get_s8(info->attrs[IEEE802154_ATTR_FRAME_RETRIES]);
+
+        rc = ops->set_mac_params(dev, &params);
+
+        wpan_phy_put(phy);
+        dev_put(dev);
+        return rc;
+
+out_phy:
+        wpan_phy_put(phy);
+out:
+        dev_put(dev);
+        return rc;
+}
diff --git a/net/ieee802154/nl_policy.c b/net/ieee802154/nl_policy.c
index 6adda4d46f95..fd7be5e45cef 100644
--- a/net/ieee802154/nl_policy.c
+++ b/net/ieee802154/nl_policy.c
@@ -52,5 +52,15 @@ const struct nla_policy ieee802154_policy[IEEE802154_ATTR_MAX + 1] = {
         [IEEE802154_ATTR_DURATION] = { .type = NLA_U8, },
         [IEEE802154_ATTR_ED_LIST] = { .len = 27 },
         [IEEE802154_ATTR_CHANNEL_PAGE_LIST] = { .len = 32 * 4, },
+
+        [IEEE802154_ATTR_TXPOWER] = { .type = NLA_S8, },
+        [IEEE802154_ATTR_LBT_ENABLED] = { .type = NLA_U8, },
+        [IEEE802154_ATTR_CCA_MODE] = { .type = NLA_U8, },
+        [IEEE802154_ATTR_CCA_ED_LEVEL] = { .type = NLA_S32, },
+        [IEEE802154_ATTR_CSMA_RETRIES] = { .type = NLA_U8, },
+        [IEEE802154_ATTR_CSMA_MIN_BE] = { .type = NLA_U8, },
+        [IEEE802154_ATTR_CSMA_MAX_BE] = { .type = NLA_U8, },
+
+        [IEEE802154_ATTR_FRAME_RETRIES] = { .type = NLA_S8, },
 };
 
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index 41f538b8e59c..74d54fae33d7 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -28,6 +28,7 @@
 #include <linux/slab.h>
 #include <net/sock.h>
 #include <net/af_ieee802154.h>
+#include <net/ieee802154_netdev.h>
 
 #include "af802154.h"
 
@@ -55,21 +56,24 @@ static void raw_close(struct sock *sk, long timeout)
         sk_common_release(sk);
 }
 
-static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int len)
+static int raw_bind(struct sock *sk, struct sockaddr *_uaddr, int len)
 {
-        struct sockaddr_ieee802154 *addr = (struct sockaddr_ieee802154 *)uaddr;
+        struct ieee802154_addr addr;
+        struct sockaddr_ieee802154 *uaddr = (struct sockaddr_ieee802154 *)_uaddr;
         int err = 0;
         struct net_device *dev = NULL;
 
-        if (len < sizeof(*addr))
+        if (len < sizeof(*uaddr))
                 return -EINVAL;
 
-        if (addr->family != AF_IEEE802154)
+        uaddr = (struct sockaddr_ieee802154 *)_uaddr;
+        if (uaddr->family != AF_IEEE802154)
                 return -EINVAL;
 
         lock_sock(sk);
 
-        dev = ieee802154_get_dev(sock_net(sk), &addr->addr);
+        ieee802154_addr_from_sa(&addr, &uaddr->addr);
+        dev = ieee802154_get_dev(sock_net(sk), &addr);
         if (!dev) {
                 err = -ENODEV;
                 goto out;
@@ -209,6 +213,10 @@ out:
 
 static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
+                return NET_RX_DROP;
+
         if (sock_queue_rcv_skb(sk, skb) < 0) {
                 kfree_skb(skb);
                 return NET_RX_DROP;
diff --git a/net/ieee802154/reassembly.c b/net/ieee802154/reassembly.c
new file mode 100644
index 000000000000..ef2d54372b13
--- /dev/null
+++ b/net/ieee802154/reassembly.c
@@ -0,0 +1,571 @@
+/*      6LoWPAN fragment reassembly
+ *
+ *
+ *      Authors:
+ *      Alexander Aring         <aar@pengutronix.de>
+ *
+ *      Based on: net/ipv6/reassembly.c
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ */
+
+#define pr_fmt(fmt) "6LoWPAN: " fmt
+
+#include <linux/net.h>
+#include <linux/list.h>
+#include <linux/netdevice.h>
+#include <linux/random.h>
+#include <linux/jhash.h>
+#include <linux/skbuff.h>
+#include <linux/slab.h>
+#include <linux/export.h>
+
+#include <net/ieee802154_netdev.h>
+#include <net/6lowpan.h>
+#include <net/ipv6.h>
+#include <net/inet_frag.h>
+
+#include "reassembly.h"
+
+struct lowpan_frag_info {
+        __be16 d_tag;
+        u16 d_size;
+        u8 d_offset;
+};
+
+struct lowpan_frag_info *lowpan_cb(struct sk_buff *skb)
+{
+        return (struct lowpan_frag_info *)skb->cb;
+}
+
+static struct inet_frags lowpan_frags;
+
+static int lowpan_frag_reasm(struct lowpan_frag_queue *fq,
+                             struct sk_buff *prev, struct net_device *dev);
+
+static unsigned int lowpan_hash_frag(__be16 tag, u16 d_size,
+                                     const struct ieee802154_addr *saddr,
+                                     const struct ieee802154_addr *daddr)
+{
+        u32 c;
+
+        net_get_random_once(&lowpan_frags.rnd, sizeof(lowpan_frags.rnd));
+        c = jhash_3words(ieee802154_addr_hash(saddr),
+                         ieee802154_addr_hash(daddr),
+                         (__force u32)(tag + (d_size << 16)),
+                         lowpan_frags.rnd);
+
+        return c & (INETFRAGS_HASHSZ - 1);
+}
+
+static unsigned int lowpan_hashfn(struct inet_frag_queue *q)
+{
+        struct lowpan_frag_queue *fq;
+
+        fq = container_of(q, struct lowpan_frag_queue, q);
+        return lowpan_hash_frag(fq->tag, fq->d_size, &fq->saddr, &fq->daddr);
+}
+
+static bool lowpan_frag_match(struct inet_frag_queue *q, void *a)
+{
+        struct lowpan_frag_queue *fq;
+        struct lowpan_create_arg *arg = a;
+
+        fq = container_of(q, struct lowpan_frag_queue, q);
+        return  fq->tag == arg->tag && fq->d_size == arg->d_size &&
+                ieee802154_addr_equal(&fq->saddr, arg->src) &&
+                ieee802154_addr_equal(&fq->daddr, arg->dst);
+}
+
+static void lowpan_frag_init(struct inet_frag_queue *q, void *a)
+{
+        struct lowpan_frag_queue *fq;
+        struct lowpan_create_arg *arg = a;
+
+        fq = container_of(q, struct lowpan_frag_queue, q);
+
+        fq->tag = arg->tag;
+        fq->d_size = arg->d_size;
+        fq->saddr = *arg->src;
+        fq->daddr = *arg->dst;
+}
+
+static void lowpan_frag_expire(unsigned long data)
+{
+        struct frag_queue *fq;
+        struct net *net;
+
+        fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q);
+        net = container_of(fq->q.net, struct net, ieee802154_lowpan.frags);
+
+        spin_lock(&fq->q.lock);
+
+        if (fq->q.last_in & INET_FRAG_COMPLETE)
+                goto out;
+
+        inet_frag_kill(&fq->q, &lowpan_frags);
+out:
+        spin_unlock(&fq->q.lock);
+        inet_frag_put(&fq->q, &lowpan_frags);
+}
+
+static inline struct lowpan_frag_queue *
+fq_find(struct net *net, const struct lowpan_frag_info *frag_info,
+        const struct ieee802154_addr *src,
+        const struct ieee802154_addr *dst)
+{
+        struct inet_frag_queue *q;
+        struct lowpan_create_arg arg;
+        unsigned int hash;
+
+        arg.tag = frag_info->d_tag;
+        arg.d_size = frag_info->d_size;
+        arg.src = src;
+        arg.dst = dst;
+
+        read_lock(&lowpan_frags.lock);
+        hash = lowpan_hash_frag(frag_info->d_tag, frag_info->d_size, src, dst);
+
+        q = inet_frag_find(&net->ieee802154_lowpan.frags,
+                           &lowpan_frags, &arg, hash);
+        if (IS_ERR_OR_NULL(q)) {
+                inet_frag_maybe_warn_overflow(q, pr_fmt());
+                return NULL;
+        }
+        return container_of(q, struct lowpan_frag_queue, q);
+}
+
+static int lowpan_frag_queue(struct lowpan_frag_queue *fq,
+                             struct sk_buff *skb, const u8 frag_type)
+{
+        struct sk_buff *prev, *next;
+        struct net_device *dev;
+        int end, offset;
+
+        if (fq->q.last_in & INET_FRAG_COMPLETE)
+                goto err;
+
+        offset = lowpan_cb(skb)->d_offset << 3;
+        end = lowpan_cb(skb)->d_size;
+
+        /* Is this the final fragment? */
+        if (offset + skb->len == end) {
+                /* If we already have some bits beyond end
+                 * or have different end, the segment is corrupted.
+                 */
+                if (end < fq->q.len ||
+                    ((fq->q.last_in & INET_FRAG_LAST_IN) && end != fq->q.len))
+                        goto err;
+                fq->q.last_in |= INET_FRAG_LAST_IN;
+                fq->q.len = end;
+        } else {
+                if (end > fq->q.len) {
+                        /* Some bits beyond end -> corruption. */
+                        if (fq->q.last_in & INET_FRAG_LAST_IN)
+                                goto err;
+                        fq->q.len = end;
+                }
+        }
+
+        /* Find out which fragments are in front and at the back of us
+         * in the chain of fragments so far.  We must know where to put
+         * this fragment, right?
+         */
+        prev = fq->q.fragments_tail;
+        if (!prev || lowpan_cb(prev)->d_offset < lowpan_cb(skb)->d_offset) {
+                next = NULL;
+                goto found;
+        }
+        prev = NULL;
+        for (next = fq->q.fragments; next != NULL; next = next->next) {
+                if (lowpan_cb(next)->d_offset >= lowpan_cb(skb)->d_offset)
+                        break;  /* bingo! */
+                prev = next;
+        }
+
+found:
+        /* Insert this fragment in the chain of fragments. */
+        skb->next = next;
+        if (!next)
+                fq->q.fragments_tail = skb;
+        if (prev)
+                prev->next = skb;
+        else
+                fq->q.fragments = skb;
+
+        dev = skb->dev;
+        if (dev)
+                skb->dev = NULL;
+
+        fq->q.stamp = skb->tstamp;
+        if (frag_type == LOWPAN_DISPATCH_FRAG1) {
+                /* Calculate uncomp. 6lowpan header to estimate full size */
+                fq->q.meat += lowpan_uncompress_size(skb, NULL);
+                fq->q.last_in |= INET_FRAG_FIRST_IN;
+        } else {
+                fq->q.meat += skb->len;
+        }
+        add_frag_mem_limit(&fq->q, skb->truesize);
+
+        if (fq->q.last_in == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
+            fq->q.meat == fq->q.len) {
+                int res;
+                unsigned long orefdst = skb->_skb_refdst;
+
+                skb->_skb_refdst = 0UL;
+                res = lowpan_frag_reasm(fq, prev, dev);
+                skb->_skb_refdst = orefdst;
+                return res;
+        }
+
+        inet_frag_lru_move(&fq->q);
+        return -1;
+err:
+        kfree_skb(skb);
+        return -1;
+}
+
+/*      Check if this packet is complete.
+ *      Returns NULL on failure by any reason, and pointer
+ *      to current nexthdr field in reassembled frame.
+ *
+ *      It is called with locked fq, and caller must check that
+ *      queue is eligible for reassembly i.e. it is not COMPLETE,
+ *      the last and the first frames arrived and all the bits are here.
+ */
+static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, struct sk_buff *prev,
+                             struct net_device *dev)
+{
+        struct sk_buff *fp, *head = fq->q.fragments;
+        int sum_truesize;
+
+        inet_frag_kill(&fq->q, &lowpan_frags);
+
+        /* Make the one we just received the head. */
+        if (prev) {
+                head = prev->next;
+                fp = skb_clone(head, GFP_ATOMIC);
+
+                if (!fp)
+                        goto out_oom;
+
+                fp->next = head->next;
+                if (!fp->next)
+                        fq->q.fragments_tail = fp;
+                prev->next = fp;
+
+                skb_morph(head, fq->q.fragments);
+                head->next = fq->q.fragments->next;
+
+                consume_skb(fq->q.fragments);
+                fq->q.fragments = head;
+        }
+
+        /* Head of list must not be cloned. */
+        if (skb_unclone(head, GFP_ATOMIC))
+                goto out_oom;
+
+        /* If the first fragment is fragmented itself, we split
+         * it to two chunks: the first with data and paged part
+         * and the second, holding only fragments.
+         */
+        if (skb_has_frag_list(head)) {
+                struct sk_buff *clone;
+                int i, plen = 0;
+
+                clone = alloc_skb(0, GFP_ATOMIC);
+                if (!clone)
+                        goto out_oom;
+                clone->next = head->next;
+                head->next = clone;
+                skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
+                skb_frag_list_init(head);
+                for (i = 0; i < skb_shinfo(head)->nr_frags; i++)
+                        plen += skb_frag_size(&skb_shinfo(head)->frags[i]);
+                clone->len = head->data_len - plen;
+                clone->data_len = clone->len;
+                head->data_len -= clone->len;
+                head->len -= clone->len;
+                add_frag_mem_limit(&fq->q, clone->truesize);
+        }
+
+        WARN_ON(head == NULL);
+
+        sum_truesize = head->truesize;
+        for (fp = head->next; fp;) {
+                bool headstolen;
+                int delta;
+                struct sk_buff *next = fp->next;
+
+                sum_truesize += fp->truesize;
+                if (skb_try_coalesce(head, fp, &headstolen, &delta)) {
+                        kfree_skb_partial(fp, headstolen);
+                } else {
+                        if (!skb_shinfo(head)->frag_list)
+                                skb_shinfo(head)->frag_list = fp;
+                        head->data_len += fp->len;
+                        head->len += fp->len;
+                        head->truesize += fp->truesize;
+                }
+                fp = next;
+        }
+        sub_frag_mem_limit(&fq->q, sum_truesize);
+
+        head->next = NULL;
+        head->dev = dev;
+        head->tstamp = fq->q.stamp;
+
+        fq->q.fragments = NULL;
+        fq->q.fragments_tail = NULL;
+
+        return 1;
+out_oom:
+        net_dbg_ratelimited("lowpan_frag_reasm: no memory for reassembly\n");
+        return -1;
+}
+
+static int lowpan_get_frag_info(struct sk_buff *skb, const u8 frag_type,
+                                struct lowpan_frag_info *frag_info)
+{
+        bool fail;
+        u8 pattern = 0, low = 0;
+
+        fail = lowpan_fetch_skb(skb, &pattern, 1);
+        fail |= lowpan_fetch_skb(skb, &low, 1);
+        frag_info->d_size = (pattern & 7) << 8 | low;
+        fail |= lowpan_fetch_skb(skb, &frag_info->d_tag, 2);
+
+        if (frag_type == LOWPAN_DISPATCH_FRAGN) {
+                fail |= lowpan_fetch_skb(skb, &frag_info->d_offset, 1);
+        } else {
+                skb_reset_network_header(skb);
+                frag_info->d_offset = 0;
+        }
+
+        if (unlikely(fail))
+                return -EIO;
+
+        return 0;
+}
+
+int lowpan_frag_rcv(struct sk_buff *skb, const u8 frag_type)
+{
+        struct lowpan_frag_queue *fq;
+        struct net *net = dev_net(skb->dev);
+        struct lowpan_frag_info *frag_info = lowpan_cb(skb);
+        struct ieee802154_addr source, dest;
+        int err;
+
+        source = mac_cb(skb)->source;
+        dest = mac_cb(skb)->dest;
+
+        err = lowpan_get_frag_info(skb, frag_type, frag_info);
+        if (err < 0)
+                goto err;
+
+        if (frag_info->d_size > net->ieee802154_lowpan.max_dsize)
+                goto err;
+
+        inet_frag_evictor(&net->ieee802154_lowpan.frags, &lowpan_frags, false);
+
+        fq = fq_find(net, frag_info, &source, &dest);
+        if (fq != NULL) {
+                int ret;
+                spin_lock(&fq->q.lock);
+                ret = lowpan_frag_queue(fq, skb, frag_type);
+                spin_unlock(&fq->q.lock);
+
+                inet_frag_put(&fq->q, &lowpan_frags);
+                return ret;
+        }
+
+err:
+        kfree_skb(skb);
+        return -1;
+}
+EXPORT_SYMBOL(lowpan_frag_rcv);
+
+#ifdef CONFIG_SYSCTL
+static struct ctl_table lowpan_frags_ns_ctl_table[] = {
+        {
+                .procname       = "6lowpanfrag_high_thresh",
+                .data           = &init_net.ieee802154_lowpan.frags.high_thresh,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "6lowpanfrag_low_thresh",
+                .data           = &init_net.ieee802154_lowpan.frags.low_thresh,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "6lowpanfrag_time",
+                .data           = &init_net.ieee802154_lowpan.frags.timeout,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_jiffies,
+        },
+        {
+                .procname       = "6lowpanfrag_max_datagram_size",
+                .data           = &init_net.ieee802154_lowpan.max_dsize,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        { }
+};
+
+static struct ctl_table lowpan_frags_ctl_table[] = {
+        {
+                .procname       = "6lowpanfrag_secret_interval",
+                .data           = &lowpan_frags.secret_interval,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_jiffies,
+        },
+        { }
+};
+
+static int __net_init lowpan_frags_ns_sysctl_register(struct net *net)
+{
+        struct ctl_table *table;
+        struct ctl_table_header *hdr;
+
+        table = lowpan_frags_ns_ctl_table;
+        if (!net_eq(net, &init_net)) {
+                table = kmemdup(table, sizeof(lowpan_frags_ns_ctl_table),
+                                GFP_KERNEL);
+                if (table == NULL)
+                        goto err_alloc;
+
+                table[0].data = &net->ieee802154_lowpan.frags.high_thresh;
+                table[1].data = &net->ieee802154_lowpan.frags.low_thresh;
+                table[2].data = &net->ieee802154_lowpan.frags.timeout;
+                table[3].data = &net->ieee802154_lowpan.max_dsize;
+
+                /* Don't export sysctls to unprivileged users */
+                if (net->user_ns != &init_user_ns)
+                        table[0].procname = NULL;
+        }
+
+        hdr = register_net_sysctl(net, "net/ieee802154/6lowpan", table);
+        if (hdr == NULL)
+                goto err_reg;
+
+        net->ieee802154_lowpan.sysctl.frags_hdr = hdr;
+        return 0;
+
+err_reg:
+        if (!net_eq(net, &init_net))
+                kfree(table);
+err_alloc:
+        return -ENOMEM;
+}
+
+static void __net_exit lowpan_frags_ns_sysctl_unregister(struct net *net)
+{
+        struct ctl_table *table;
+
+        table = net->ieee802154_lowpan.sysctl.frags_hdr->ctl_table_arg;
+        unregister_net_sysctl_table(net->ieee802154_lowpan.sysctl.frags_hdr);
+        if (!net_eq(net, &init_net))
+                kfree(table);
+}
+
+static struct ctl_table_header *lowpan_ctl_header;
+
+static int lowpan_frags_sysctl_register(void)
+{
+        lowpan_ctl_header = register_net_sysctl(&init_net,
+                                                "net/ieee802154/6lowpan",
+                                                lowpan_frags_ctl_table);
+        return lowpan_ctl_header == NULL ? -ENOMEM : 0;
+}
+
+static void lowpan_frags_sysctl_unregister(void)
+{
+        unregister_net_sysctl_table(lowpan_ctl_header);
+}
+#else
+static inline int lowpan_frags_ns_sysctl_register(struct net *net)
+{
+        return 0;
+}
+
+static inline void lowpan_frags_ns_sysctl_unregister(struct net *net)
+{
+}
+
+static inline int lowpan_frags_sysctl_register(void)
+{
+        return 0;
+}
+
+static inline void lowpan_frags_sysctl_unregister(void)
+{
+}
+#endif
+
+static int __net_init lowpan_frags_init_net(struct net *net)
+{
+        net->ieee802154_lowpan.frags.high_thresh = IPV6_FRAG_HIGH_THRESH;
+        net->ieee802154_lowpan.frags.low_thresh = IPV6_FRAG_LOW_THRESH;
+        net->ieee802154_lowpan.frags.timeout = IPV6_FRAG_TIMEOUT;
+        net->ieee802154_lowpan.max_dsize = 0xFFFF;
+
+        inet_frags_init_net(&net->ieee802154_lowpan.frags);
+
+        return lowpan_frags_ns_sysctl_register(net);
+}
+
+static void __net_exit lowpan_frags_exit_net(struct net *net)
+{
+        lowpan_frags_ns_sysctl_unregister(net);
+        inet_frags_exit_net(&net->ieee802154_lowpan.frags, &lowpan_frags);
+}
+
+static struct pernet_operations lowpan_frags_ops = {
+        .init = lowpan_frags_init_net,
+        .exit = lowpan_frags_exit_net,
+};
+
+int __init lowpan_net_frag_init(void)
+{
+        int ret;
+
+        ret = lowpan_frags_sysctl_register();
+        if (ret)
+                return ret;
+
+        ret = register_pernet_subsys(&lowpan_frags_ops);
+        if (ret)
+                goto err_pernet;
+
+        lowpan_frags.hashfn = lowpan_hashfn;
+        lowpan_frags.constructor = lowpan_frag_init;
+        lowpan_frags.destructor = NULL;
+        lowpan_frags.skb_free = NULL;
+        lowpan_frags.qsize = sizeof(struct frag_queue);
+        lowpan_frags.match = lowpan_frag_match;
+        lowpan_frags.frag_expire = lowpan_frag_expire;
+        lowpan_frags.secret_interval = 10 * 60 * HZ;
+        inet_frags_init(&lowpan_frags);
+
+        return ret;
+err_pernet:
+        lowpan_frags_sysctl_unregister();
+        return ret;
+}
+
+void lowpan_net_frag_exit(void)
+{
+        inet_frags_fini(&lowpan_frags);
+        lowpan_frags_sysctl_unregister();
+        unregister_pernet_subsys(&lowpan_frags_ops);
+}
diff --git a/net/ieee802154/reassembly.h b/net/ieee802154/reassembly.h
new file mode 100644
index 000000000000..74e4a7c98191
--- /dev/null
+++ b/net/ieee802154/reassembly.h
@@ -0,0 +1,41 @@
+#ifndef __IEEE802154_6LOWPAN_REASSEMBLY_H__
+#define __IEEE802154_6LOWPAN_REASSEMBLY_H__
+
+#include <net/inet_frag.h>
+
+struct lowpan_create_arg {
+        __be16 tag;
+        u16 d_size;
+        const struct ieee802154_addr *src;
+        const struct ieee802154_addr *dst;
+};
+
+/* Equivalent of ipv4 struct ip
+ */
+struct lowpan_frag_queue {
+        struct inet_frag_queue  q;
+
+        __be16                  tag;
+        u16                     d_size;
+        struct ieee802154_addr  saddr;
+        struct ieee802154_addr  daddr;
+};
+
+static inline u32 ieee802154_addr_hash(const struct ieee802154_addr *a)
+{
+        switch (a->mode) {
+        case IEEE802154_ADDR_LONG:
+                return (((__force u64)a->extended_addr) >> 32) ^
+                        (((__force u64)a->extended_addr) & 0xffffffff);
+        case IEEE802154_ADDR_SHORT:
+                return (__force u32)(a->short_addr);
+        default:
+                return 0;
+        }
+}
+
+int lowpan_frag_rcv(struct sk_buff *skb, const u8 frag_type);
+void lowpan_net_frag_exit(void);
+int lowpan_net_frag_init(void);
+
+#endif /* __IEEE802154_6LOWPAN_REASSEMBLY_H__ */
diff --git a/net/ieee802154/wpan-class.c b/net/ieee802154/wpan-class.c
index 4dd37615a749..8d6f6704da84 100644
--- a/net/ieee802154/wpan-class.c
+++ b/net/ieee802154/wpan-class.c
@@ -44,9 +44,7 @@ static DEVICE_ATTR_RO(name);
 
 MASTER_SHOW(current_channel, "%d");
 MASTER_SHOW(current_page, "%d");
-MASTER_SHOW_COMPLEX(transmit_power, "%d +- %d dB",
-        ((signed char) (phy->transmit_power << 2)) >> 2,
-        (phy->transmit_power >> 6) ? (phy->transmit_power >> 6) * 3 : 1);
+MASTER_SHOW(transmit_power, "%d +- 1 dB");
 MASTER_SHOW(cca_mode, "%d");
 
 static ssize_t channels_supported_show(struct device *dev,
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index f8c49ce5b283..f032688d20d3 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -55,4 +55,4 @@ obj-$(CONFIG_MEMCG_KMEM) += tcp_memcontrol.o
 obj-$(CONFIG_NETLABEL) += cipso_ipv4.o
 
 obj-$(CONFIG_XFRM) += xfrm4_policy.o xfrm4_state.o xfrm4_input.o \
-                      xfrm4_output.o
+                      xfrm4_output.o xfrm4_protocol.o
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 19ab78aca547..8c54870db792 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1505,9 +1505,9 @@ u64 snmp_fold_field64(void __percpu *mib[], int offt, size_t syncp_offset)
                 bhptr = per_cpu_ptr(mib[0], cpu);
                 syncp = (struct u64_stats_sync *)(bhptr + syncp_offset);
                 do {
-                        start = u64_stats_fetch_begin_bh(syncp);
+                        start = u64_stats_fetch_begin_irq(syncp);
                         v = *(((u64 *) bhptr) + offt);
-                } while (u64_stats_fetch_retry_bh(syncp, start));
+                } while (u64_stats_fetch_retry_irq(syncp, start));
 
                 res += v;
         }
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 717902669d2f..a2afa89513a0 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -155,6 +155,10 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
         struct iphdr *iph, *top_iph;
         struct ip_auth_hdr *ah;
         struct ah_data *ahp;
+        int seqhi_len = 0;
+        __be32 *seqhi;
+        int sglists = 0;
+        struct scatterlist *seqhisg;
 
         ahp = x->data;
         ahash = ahp->ahash;
@@ -167,14 +171,19 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
         ah = ip_auth_hdr(skb);
         ihl = ip_hdrlen(skb);
 
+        if (x->props.flags & XFRM_STATE_ESN) {
+                sglists = 1;
+                seqhi_len = sizeof(*seqhi);
+        }
         err = -ENOMEM;
-        iph = ah_alloc_tmp(ahash, nfrags, ihl);
+        iph = ah_alloc_tmp(ahash, nfrags + sglists, ihl + seqhi_len);
         if (!iph)
                 goto out;
-
-        icv = ah_tmp_icv(ahash, iph, ihl);
+        seqhi = (__be32 *)((char *)iph + ihl);
+        icv = ah_tmp_icv(ahash, seqhi, seqhi_len);
         req = ah_tmp_req(ahash, icv);
         sg = ah_req_sg(ahash, req);
+        seqhisg = sg + nfrags;
 
         memset(ah->auth_data, 0, ahp->icv_trunc_len);
 
@@ -210,10 +219,15 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
         ah->spi = x->id.spi;
         ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
 
-        sg_init_table(sg, nfrags);
-        skb_to_sgvec(skb, sg, 0, skb->len);
+        sg_init_table(sg, nfrags + sglists);
+        skb_to_sgvec_nomark(skb, sg, 0, skb->len);
 
-        ahash_request_set_crypt(req, sg, icv, skb->len);
+        if (x->props.flags & XFRM_STATE_ESN) {
+                /* Attach seqhi sg right after packet payload */
+                *seqhi = htonl(XFRM_SKB_CB(skb)->seq.output.hi);
+                sg_set_buf(seqhisg, seqhi, seqhi_len);
+        }
+        ahash_request_set_crypt(req, sg, icv, skb->len + seqhi_len);
         ahash_request_set_callback(req, 0, ah_output_done, skb);
 
         AH_SKB_CB(skb)->tmp = iph;
@@ -295,6 +309,10 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
         struct ip_auth_hdr *ah;
         struct ah_data *ahp;
         int err = -ENOMEM;
+        int seqhi_len = 0;
+        __be32 *seqhi;
+        int sglists = 0;
+        struct scatterlist *seqhisg;
 
         if (!pskb_may_pull(skb, sizeof(*ah)))
                 goto out;
@@ -335,14 +353,22 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
         iph = ip_hdr(skb);
         ihl = ip_hdrlen(skb);
 
-        work_iph = ah_alloc_tmp(ahash, nfrags, ihl + ahp->icv_trunc_len);
+        if (x->props.flags & XFRM_STATE_ESN) {
+                sglists = 1;
+                seqhi_len = sizeof(*seqhi);
+        }
+
+        work_iph = ah_alloc_tmp(ahash, nfrags + sglists, ihl +
+                                ahp->icv_trunc_len + seqhi_len);
         if (!work_iph)
                 goto out;
 
-        auth_data = ah_tmp_auth(work_iph, ihl);
+        seqhi = (__be32 *)((char *)work_iph + ihl);
+        auth_data = ah_tmp_auth(seqhi, seqhi_len);
         icv = ah_tmp_icv(ahash, auth_data, ahp->icv_trunc_len);
         req = ah_tmp_req(ahash, icv);
         sg = ah_req_sg(ahash, req);
+        seqhisg = sg + nfrags;
 
         memcpy(work_iph, iph, ihl);
         memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
@@ -361,10 +387,15 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb_push(skb, ihl);
 
-        sg_init_table(sg, nfrags);
-        skb_to_sgvec(skb, sg, 0, skb->len);
+        sg_init_table(sg, nfrags + sglists);
+        skb_to_sgvec_nomark(skb, sg, 0, skb->len);
 
-        ahash_request_set_crypt(req, sg, icv, skb->len);
+        if (x->props.flags & XFRM_STATE_ESN) {
+                /* Attach seqhi sg right after packet payload */
+                *seqhi = XFRM_SKB_CB(skb)->seq.input.hi;
+                sg_set_buf(seqhisg, seqhi, seqhi_len);
+        }
+        ahash_request_set_crypt(req, sg, icv, skb->len + seqhi_len);
         ahash_request_set_callback(req, 0, ah_input_done, skb);
 
         AH_SKB_CB(skb)->tmp = work_iph;
@@ -397,7 +428,7 @@ out:
         return err;
 }
 
-static void ah4_err(struct sk_buff *skb, u32 info)
+static int ah4_err(struct sk_buff *skb, u32 info)
 {
         struct net *net = dev_net(skb->dev);
         const struct iphdr *iph = (const struct iphdr *)skb->data;
@@ -407,23 +438,25 @@ static void ah4_err(struct sk_buff *skb, u32 info)
         switch (icmp_hdr(skb)->type) {
         case ICMP_DEST_UNREACH:
                 if (icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
-                        return;
+                        return 0;
         case ICMP_REDIRECT:
                 break;
         default:
-                return;
+                return 0;
         }
 
         x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
                               ah->spi, IPPROTO_AH, AF_INET);
         if (!x)
-                return;
+                return 0;
 
         if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
                 ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_AH, 0);
         else
                 ipv4_redirect(skb, net, 0, 0, IPPROTO_AH, 0);
         xfrm_state_put(x);
+
+        return 0;
 }
 
 static int ah_init_state(struct xfrm_state *x)
@@ -505,6 +538,10 @@ static void ah_destroy(struct xfrm_state *x)
         kfree(ahp);
 }
 
+static int ah4_rcv_cb(struct sk_buff *skb, int err)
+{
+        return 0;
+}
 
 static const struct xfrm_type ah_type =
 {
@@ -518,11 +555,12 @@ static const struct xfrm_type ah_type =
         .output         = ah_output
 };
 
-static const struct net_protocol ah4_protocol = {
+static struct xfrm4_protocol ah4_protocol = {
         .handler        =       xfrm4_rcv,
+        .input_handler  =       xfrm_input,
+        .cb_handler     =       ah4_rcv_cb,
         .err_handler    =       ah4_err,
-        .no_policy      =       1,
-        .netns_ok       =       1,
+        .priority       =       0,
 };
 
 static int __init ah4_init(void)
@@ -531,7 +569,7 @@ static int __init ah4_init(void)
                 pr_info("%s: can't add xfrm type\n", __func__);
                 return -EAGAIN;
         }
-        if (inet_add_protocol(&ah4_protocol, IPPROTO_AH) < 0) {
+        if (xfrm4_protocol_register(&ah4_protocol, IPPROTO_AH) < 0) {
                 pr_info("%s: can't add protocol\n", __func__);
                 xfrm_unregister_type(&ah_type, AF_INET);
                 return -EAGAIN;
@@ -541,7 +579,7 @@ static int __init ah4_init(void)
 
 static void __exit ah4_fini(void)
 {
-        if (inet_del_protocol(&ah4_protocol, IPPROTO_AH) < 0)
+        if (xfrm4_protocol_deregister(&ah4_protocol, IPPROTO_AH) < 0)
                 pr_info("%s: can't remove protocol\n", __func__);
         if (xfrm_unregister_type(&ah_type, AF_INET) < 0)
                 pr_info("%s: can't remove xfrm type\n", __func__);
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 7785b28061ac..360b565918c4 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -473,7 +473,7 @@ static u32 esp4_get_mtu(struct xfrm_state *x, int mtu)
                  net_adj) & ~(blksize - 1)) + net_adj - 2;
 }
 
-static void esp4_err(struct sk_buff *skb, u32 info)
+static int esp4_err(struct sk_buff *skb, u32 info)
 {
         struct net *net = dev_net(skb->dev);
         const struct iphdr *iph = (const struct iphdr *)skb->data;
@@ -483,23 +483,25 @@ static void esp4_err(struct sk_buff *skb, u32 info)
         switch (icmp_hdr(skb)->type) {
         case ICMP_DEST_UNREACH:
                 if (icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
-                        return;
+                        return 0;
         case ICMP_REDIRECT:
                 break;
         default:
-                return;
+                return 0;
         }
 
         x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
                               esph->spi, IPPROTO_ESP, AF_INET);
         if (!x)
-                return;
+                return 0;
 
         if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
                 ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_ESP, 0);
         else
                 ipv4_redirect(skb, net, 0, 0, IPPROTO_ESP, 0);
         xfrm_state_put(x);
+
+        return 0;
 }
 
 static void esp_destroy(struct xfrm_state *x)
@@ -672,6 +674,11 @@ error:
         return err;
 }
 
+static int esp4_rcv_cb(struct sk_buff *skb, int err)
+{
+        return 0;
+}
+
 static const struct xfrm_type esp_type =
 {
         .description    = "ESP4",
@@ -685,11 +692,12 @@ static const struct xfrm_type esp_type =
         .output         = esp_output
 };
 
-static const struct net_protocol esp4_protocol = {
+static struct xfrm4_protocol esp4_protocol = {
         .handler        =       xfrm4_rcv,
+        .input_handler  =       xfrm_input,
+        .cb_handler     =       esp4_rcv_cb,
         .err_handler    =       esp4_err,
-        .no_policy      =       1,
-        .netns_ok       =       1,
+        .priority       =       0,
 };
 
 static int __init esp4_init(void)
@@ -698,7 +706,7 @@ static int __init esp4_init(void)
                 pr_info("%s: can't add xfrm type\n", __func__);
                 return -EAGAIN;
         }
-        if (inet_add_protocol(&esp4_protocol, IPPROTO_ESP) < 0) {
+        if (xfrm4_protocol_register(&esp4_protocol, IPPROTO_ESP) < 0) {
                 pr_info("%s: can't add protocol\n", __func__);
                 xfrm_unregister_type(&esp_type, AF_INET);
                 return -EAGAIN;
@@ -708,7 +716,7 @@ static int __init esp4_init(void)
 
 static void __exit esp4_fini(void)
 {
-        if (inet_del_protocol(&esp4_protocol, IPPROTO_ESP) < 0)
+        if (xfrm4_protocol_deregister(&esp4_protocol, IPPROTO_ESP) < 0)
                 pr_info("%s: can't remove protocol\n", __func__);
         if (xfrm_unregister_type(&esp_type, AF_INET) < 0)
                 pr_info("%s: can't remove xfrm type\n", __func__);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index c7539e22868b..1a629f870274 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -659,7 +659,7 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
 
         if (nlmsg_len(cb->nlh) >= sizeof(struct rtmsg) &&
             ((struct rtmsg *) nlmsg_data(cb->nlh))->rtm_flags & RTM_F_CLONED)
-                return ip_rt_dump(skb, cb);
+                return skb->len;
 
         s_h = cb->args[0];
         s_e = cb->args[1];
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index f3869c186d97..be8abe73bb9f 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -127,6 +127,10 @@ int ip_forward(struct sk_buff *skb)
         struct rtable *rt;      /* Route we use */
         struct ip_options *opt  = &(IPCB(skb)->opt);
 
+        /* that should never happen */
+        if (skb->pkt_type != PACKET_HOST)
+                goto drop;
+
         if (skb_warn_if_lro(skb))
                 goto drop;
 
@@ -136,9 +140,6 @@ int ip_forward(struct sk_buff *skb)
         if (IPCB(skb)->opt.router_alert && ip_call_ra_chain(skb))
                 return NET_RX_SUCCESS;
 
-        if (skb->pkt_type != PACKET_HOST)
-                goto drop;
-
         skb_forward_csum(skb);
 
         /*
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index ec4f762efda5..94213c891565 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -463,6 +463,7 @@ static const struct net_device_ops ipgre_netdev_ops = {
 static void ipgre_tunnel_setup(struct net_device *dev)
 {
         dev->netdev_ops         = &ipgre_netdev_ops;
+        dev->type               = ARPHRD_IPGRE;
         ip_tunnel_setup(dev, ipgre_net_id);
 }
 
@@ -501,7 +502,6 @@ static int ipgre_tunnel_init(struct net_device *dev)
         memcpy(dev->dev_addr, &iph->saddr, 4);
         memcpy(dev->broadcast, &iph->daddr, 4);
 
-        dev->type               = ARPHRD_IPGRE;
         dev->flags              = IFF_NOARP;
         dev->priv_flags         &= ~IFF_XMIT_DST_RELEASE;
         dev->addr_len           = 4;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 73c6b63bba74..1cbeba5edff9 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -101,17 +101,17 @@ int __ip_local_out(struct sk_buff *skb)
                        skb_dst(skb)->dev, dst_output);
 }
 
-int ip_local_out(struct sk_buff *skb)
+int ip_local_out_sk(struct sock *sk, struct sk_buff *skb)
 {
         int err;
 
         err = __ip_local_out(skb);
         if (likely(err == 1))
-                err = dst_output(skb);
+                err = dst_output_sk(sk, skb);
 
         return err;
 }
-EXPORT_SYMBOL_GPL(ip_local_out);
+EXPORT_SYMBOL_GPL(ip_local_out_sk);
 
 static inline int ip_select_ttl(struct inet_sock *inet, struct dst_entry *dst)
 {
@@ -226,9 +226,8 @@ static int ip_finish_output(struct sk_buff *skb)
                 return ip_finish_output2(skb);
 }
 
-int ip_mc_output(struct sk_buff *skb)
+int ip_mc_output(struct sock *sk, struct sk_buff *skb)
 {
-        struct sock *sk = skb->sk;
         struct rtable *rt = skb_rtable(skb);
         struct net_device *dev = rt->dst.dev;
 
@@ -287,7 +286,7 @@ int ip_mc_output(struct sk_buff *skb)
                             !(IPCB(skb)->flags & IPSKB_REROUTED));
 }
 
-int ip_output(struct sk_buff *skb)
+int ip_output(struct sock *sk, struct sk_buff *skb)
 {
         struct net_device *dev = skb_dst(skb)->dev;
 
@@ -315,9 +314,9 @@ static void ip_copy_addrs(struct iphdr *iph, const struct flowi4 *fl4)
                sizeof(fl4->saddr) + sizeof(fl4->daddr));
 }
 
-int ip_queue_xmit(struct sk_buff *skb, struct flowi *fl)
+/* Note: skb->sk can be different from sk, in case of tunnels */
+int ip_queue_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl)
 {
-        struct sock *sk = skb->sk;
         struct inet_sock *inet = inet_sk(sk);
         struct ip_options_rcu *inet_opt;
         struct flowi4 *fl4;
@@ -389,6 +388,7 @@ packet_routed:
         ip_select_ident_more(skb, &rt->dst, sk,
                              (skb_shinfo(skb)->gso_segs ?: 1) - 1);
 
+        /* TODO : should we use skb->sk here instead of sk ? */
         skb->priority = sk->sk_priority;
         skb->mark = sk->sk_mark;
 
@@ -446,7 +446,6 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         __be16 not_last_frag;
         struct rtable *rt = skb_rtable(skb);
         int err = 0;
-        bool forwarding = IPCB(skb)->flags & IPSKB_FORWARDED;
 
         dev = rt->dst.dev;
 
@@ -456,7 +455,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
         iph = ip_hdr(skb);
 
-        mtu = ip_dst_mtu_maybe_forward(&rt->dst, forwarding);
+        mtu = ip_skb_dst_mtu(skb);
         if (unlikely(((iph->frag_off & htons(IP_DF)) && !skb->local_df) ||
                      (IPCB(skb)->frag_max_size &&
                       IPCB(skb)->frag_max_size > mtu))) {
@@ -822,8 +821,7 @@ static int __ip_append_data(struct sock *sk,
 
         fragheaderlen = sizeof(struct iphdr) + (opt ? opt->optlen : 0);
         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen;
-        maxnonfragsize = (inet->pmtudisc >= IP_PMTUDISC_DO) ?
-                         mtu : 0xFFFF;
+        maxnonfragsize = ip_sk_local_df(sk) ? 0xFFFF : mtu;
 
         if (cork->length + length > maxnonfragsize - fragheaderlen) {
                 ip_local_error(sk, EMSGSIZE, fl4->daddr, inet->inet_dport,
@@ -1146,8 +1144,7 @@ ssize_t	ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
 
         fragheaderlen = sizeof(struct iphdr) + (opt ? opt->optlen : 0);
         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen;
-        maxnonfragsize = (inet->pmtudisc >= IP_PMTUDISC_DO) ?
-                         mtu : 0xFFFF;
+        maxnonfragsize = ip_sk_local_df(sk) ? 0xFFFF : mtu;
 
         if (cork->length + size > maxnonfragsize - fragheaderlen) {
                 ip_local_error(sk, EMSGSIZE, fl4->daddr, inet->inet_dport,
@@ -1308,8 +1305,7 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
          * to fragment the frame generated here. No matter, what transforms
          * how transforms change size of the packet, it will come out.
          */
-        if (inet->pmtudisc < IP_PMTUDISC_DO)
-                skb->local_df = 1;
+        skb->local_df = ip_sk_local_df(sk);
 
         /* DF bit is set when we want to see DF on outgoing frames.
          * If local_df is set too, we still allow to fragment this frame
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 580dd96666e0..64741b938632 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -186,7 +186,8 @@ void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(ip_cmsg_recv);
 
-int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc)
+int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc,
+                 bool allow_ipv6)
 {
         int err, val;
         struct cmsghdr *cmsg;
@@ -194,6 +195,22 @@ int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc)
         for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
                 if (!CMSG_OK(msg, cmsg))
                         return -EINVAL;
+#if defined(CONFIG_IPV6)
+                if (allow_ipv6 &&
+                    cmsg->cmsg_level == SOL_IPV6 &&
+                    cmsg->cmsg_type == IPV6_PKTINFO) {
+                        struct in6_pktinfo *src_info;
+
+                        if (cmsg->cmsg_len < CMSG_LEN(sizeof(*src_info)))
+                                return -EINVAL;
+                        src_info = (struct in6_pktinfo *)CMSG_DATA(cmsg);
+                        if (!ipv6_addr_v4mapped(&src_info->ipi6_addr))
+                                return -EINVAL;
+                        ipc->oif = src_info->ipi6_ifindex;
+                        ipc->addr = src_info->ipi6_addr.s6_addr32[3];
+                        continue;
+                }
+#endif
                 if (cmsg->cmsg_level != SOL_IP)
                         continue;
                 switch (cmsg->cmsg_type) {
@@ -626,7 +643,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                 inet->nodefrag = val ? 1 : 0;
                 break;
         case IP_MTU_DISCOVER:
-                if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_INTERFACE)
+                if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_OMIT)
                         goto e_inval;
                 inet->pmtudisc = val;
                 break;
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index a82a22d8f77f..484d0ce27ef7 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -235,13 +235,17 @@ static struct hlist_head *ip_bucket(struct ip_tunnel_net *itn,
 {
         unsigned int h;
         __be32 remote;
+        __be32 i_key = parms->i_key;
 
         if (parms->iph.daddr && !ipv4_is_multicast(parms->iph.daddr))
                 remote = parms->iph.daddr;
         else
                 remote = 0;
 
-        h = ip_tunnel_hash(parms->i_key, remote);
+        if (!(parms->i_flags & TUNNEL_KEY) && (parms->i_flags & VTI_ISVTI))
+                i_key = 0;
+
+        h = ip_tunnel_hash(i_key, remote);
         return &itn->tunnels[h];
 }
 
@@ -398,7 +402,7 @@ static struct ip_tunnel *ip_tunnel_create(struct net *net,
         fbt = netdev_priv(itn->fb_tunnel_dev);
         dev = __ip_tunnel_create(net, itn->fb_tunnel_dev->rtnl_link_ops, parms);
         if (IS_ERR(dev))
-                return NULL;
+                return ERR_CAST(dev);
 
         dev->mtu = ip_tunnel_bind_dev(dev);
 
@@ -666,7 +670,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                 return;
         }
 
-        err = iptunnel_xmit(rt, skb, fl4.saddr, fl4.daddr, protocol,
+        err = iptunnel_xmit(skb->sk, rt, skb, fl4.saddr, fl4.daddr, protocol,
                             tos, ttl, df, !net_eq(tunnel->net, dev_net(dev)));
         iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
 
@@ -748,9 +752,13 @@ int ip_tunnel_ioctl(struct net_device *dev, struct ip_tunnel_parm *p, int cmd)
 
                 t = ip_tunnel_find(itn, p, itn->fb_tunnel_dev->type);
 
-                if (!t && (cmd == SIOCADDTUNNEL))
+                if (!t && (cmd == SIOCADDTUNNEL)) {
                         t = ip_tunnel_create(net, itn, p);
-
+                        if (IS_ERR(t)) {
+                                err = PTR_ERR(t);
+                                break;
+                        }
+                }
                 if (dev != itn->fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {
                         if (t != NULL) {
                                 if (t->dev != dev) {
@@ -777,8 +785,9 @@ int ip_tunnel_ioctl(struct net_device *dev, struct ip_tunnel_parm *p, int cmd)
                 if (t) {
                         err = 0;
                         ip_tunnel_update(itn, t, dev, p, true);
-                } else
-                        err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
+                } else {
+                        err = -ENOENT;
+                }
                 break;
 
         case SIOCDELTUNNEL:
@@ -993,19 +1002,13 @@ int ip_tunnel_init(struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct iphdr *iph = &tunnel->parms.iph;
-        int i, err;
+        int err;
 
         dev->destructor = ip_tunnel_dev_free;
-        dev->tstats = alloc_percpu(struct pcpu_sw_netstats);
+        dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!dev->tstats)
                 return -ENOMEM;
 
-        for_each_possible_cpu(i) {
-                struct pcpu_sw_netstats *ipt_stats;
-                ipt_stats = per_cpu_ptr(dev->tstats, i);
-                u64_stats_init(&ipt_stats->syncp);
-        }
-
         tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);
         if (!tunnel->dst_cache) {
                 free_percpu(dev->tstats);
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 8d69626f2206..bcf206c79005 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -46,7 +46,7 @@
 #include <net/netns/generic.h>
 #include <net/rtnetlink.h>
 
-int iptunnel_xmit(struct rtable *rt, struct sk_buff *skb,
+int iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
                   __be32 src, __be32 dst, __u8 proto,
                   __u8 tos, __u8 ttl, __be16 df, bool xnet)
 {
@@ -76,7 +76,7 @@ int iptunnel_xmit(struct rtable *rt, struct sk_buff *skb,
         iph->ttl        =       ttl;
         __ip_select_ident(iph, &rt->dst, (skb_shinfo(skb)->gso_segs ?: 1) - 1);
 
-        err = ip_local_out(skb);
+        err = ip_local_out_sk(sk, skb);
         if (unlikely(net_xmit_eval(err)))
                 pkt_len = 0;
         return pkt_len;
@@ -162,12 +162,12 @@ struct rtnl_link_stats64 *ip_tunnel_get_stats64(struct net_device *dev,
                 unsigned int start;
 
                 do {
-                        start = u64_stats_fetch_begin_bh(&tstats->syncp);
+                        start = u64_stats_fetch_begin_irq(&tstats->syncp);
                         rx_packets = tstats->rx_packets;
                         tx_packets = tstats->tx_packets;
                         rx_bytes = tstats->rx_bytes;
                         tx_bytes = tstats->tx_bytes;
-                } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
+                } while (u64_stats_fetch_retry_irq(&tstats->syncp, start));
 
                 tot->rx_packets += rx_packets;
                 tot->tx_packets += tx_packets;
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 48eafae51769..afcee51b90ed 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -34,6 +34,7 @@
 #include <linux/init.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/if_ether.h>
+#include <linux/icmpv6.h>
 
 #include <net/sock.h>
 #include <net/ip.h>
@@ -49,8 +50,8 @@ static struct rtnl_link_ops vti_link_ops __read_mostly;
 static int vti_net_id __read_mostly;
 static int vti_tunnel_init(struct net_device *dev);
 
-/* We dont digest the packet therefore let the packet pass */
-static int vti_rcv(struct sk_buff *skb)
+static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,
+                     int encap_type)
 {
         struct ip_tunnel *tunnel;
         const struct iphdr *iph = ip_hdr(skb);
@@ -60,79 +61,120 @@ static int vti_rcv(struct sk_buff *skb)
         tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
                                   iph->saddr, iph->daddr, 0);
         if (tunnel != NULL) {
-                struct pcpu_sw_netstats *tstats;
-                u32 oldmark = skb->mark;
-                int ret;
-
-
-                /* temporarily mark the skb with the tunnel o_key, to
-                 * only match policies with this mark.
-                 */
-                skb->mark = be32_to_cpu(tunnel->parms.o_key);
-                ret = xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb);
-                skb->mark = oldmark;
-                if (!ret)
-                        return -1;
-
-                tstats = this_cpu_ptr(tunnel->dev->tstats);
-                u64_stats_update_begin(&tstats->syncp);
-                tstats->rx_packets++;
-                tstats->rx_bytes += skb->len;
-                u64_stats_update_end(&tstats->syncp);
-
-                secpath_reset(skb);
-                skb->dev = tunnel->dev;
+                if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
+                        goto drop;
+
+                XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
+                skb->mark = be32_to_cpu(tunnel->parms.i_key);
+
+                return xfrm_input(skb, nexthdr, spi, encap_type);
+        }
+
+        return -EINVAL;
+drop:
+        kfree_skb(skb);
+        return 0;
+}
+
+static int vti_rcv(struct sk_buff *skb)
+{
+        XFRM_SPI_SKB_CB(skb)->family = AF_INET;
+        XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
+
+        return vti_input(skb, ip_hdr(skb)->protocol, 0, 0);
+}
+
+static int vti_rcv_cb(struct sk_buff *skb, int err)
+{
+        unsigned short family;
+        struct net_device *dev;
+        struct pcpu_sw_netstats *tstats;
+        struct xfrm_state *x;
+        struct ip_tunnel *tunnel = XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4;
+
+        if (!tunnel)
                 return 1;
+
+        dev = tunnel->dev;
+
+        if (err) {
+                dev->stats.rx_errors++;
+                dev->stats.rx_dropped++;
+
+                return 0;
         }
 
-        return -1;
+        x = xfrm_input_state(skb);
+        family = x->inner_mode->afinfo->family;
+
+        if (!xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family))
+                return -EPERM;
+
+        skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(skb->dev)));
+        skb->dev = dev;
+
+        tstats = this_cpu_ptr(dev->tstats);
+
+        u64_stats_update_begin(&tstats->syncp);
+        tstats->rx_packets++;
+        tstats->rx_bytes += skb->len;
+        u64_stats_update_end(&tstats->syncp);
+
+        return 0;
 }
 
-/* This function assumes it is being called from dev_queue_xmit()
- * and that skb is filled properly by that function.
- */
+static bool vti_state_check(const struct xfrm_state *x, __be32 dst, __be32 src)
+{
+        xfrm_address_t *daddr = (xfrm_address_t *)&dst;
+        xfrm_address_t *saddr = (xfrm_address_t *)&src;
 
-static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+        /* if there is no transform then this tunnel is not functional.
+         * Or if the xfrm is not mode tunnel.
+         */
+        if (!x || x->props.mode != XFRM_MODE_TUNNEL ||
+            x->props.family != AF_INET)
+                return false;
+
+        if (!dst)
+                return xfrm_addr_equal(saddr, &x->props.saddr, AF_INET);
+
+        if (!xfrm_state_addr_check(x, daddr, saddr, AF_INET))
+                return false;
+
+        return true;
+}
+
+static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
+                            struct flowi *fl)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct iphdr  *tiph = &tunnel->parms.iph;
-        u8     tos;
-        struct rtable *rt;              /* Route to the other host */
+        struct ip_tunnel_parm *parms = &tunnel->parms;
+        struct dst_entry *dst = skb_dst(skb);
         struct net_device *tdev;        /* Device to other host */
-        struct iphdr  *old_iph = ip_hdr(skb);
-        __be32 dst = tiph->daddr;
-        struct flowi4 fl4;
         int err;
 
-        if (skb->protocol != htons(ETH_P_IP))
-                goto tx_error;
-
-        tos = old_iph->tos;
+        if (!dst) {
+                dev->stats.tx_carrier_errors++;
+                goto tx_error_icmp;
+        }
 
-        memset(&fl4, 0, sizeof(fl4));
-        flowi4_init_output(&fl4, tunnel->parms.link,
-                           be32_to_cpu(tunnel->parms.o_key), RT_TOS(tos),
-                           RT_SCOPE_UNIVERSE,
-                           IPPROTO_IPIP, 0,
-                           dst, tiph->saddr, 0, 0);
-        rt = ip_route_output_key(dev_net(dev), &fl4);
-        if (IS_ERR(rt)) {
+        dst_hold(dst);
+        dst = xfrm_lookup(tunnel->net, dst, fl, NULL, 0);
+        if (IS_ERR(dst)) {
                 dev->stats.tx_carrier_errors++;
                 goto tx_error_icmp;
         }
-        /* if there is no transform then this tunnel is not functional.
-         * Or if the xfrm is not mode tunnel.
-         */
-        if (!rt->dst.xfrm ||
-            rt->dst.xfrm->props.mode != XFRM_MODE_TUNNEL) {
+
+        if (!vti_state_check(dst->xfrm, parms->iph.daddr, parms->iph.saddr)) {
                 dev->stats.tx_carrier_errors++;
-                ip_rt_put(rt);
+                dst_release(dst);
                 goto tx_error_icmp;
         }
-        tdev = rt->dst.dev;
+
+        tdev = dst->dev;
 
         if (tdev == dev) {
-                ip_rt_put(rt);
+                dst_release(dst);
                 dev->stats.collisions++;
                 goto tx_error;
         }
@@ -146,10 +188,8 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                         tunnel->err_count = 0;
         }
 
-        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
-        skb_dst_drop(skb);
-        skb_dst_set(skb, &rt->dst);
-        nf_reset(skb);
+        skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(dev)));
+        skb_dst_set(skb, dst);
         skb->dev = skb_dst(skb)->dev;
 
         err = dst_output(skb);
@@ -166,6 +206,95 @@ tx_error:
         return NETDEV_TX_OK;
 }
 
+/* This function assumes it is being called from dev_queue_xmit()
+ * and that skb is filled properly by that function.
+ */
+static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct ip_tunnel *tunnel = netdev_priv(dev);
+        struct flowi fl;
+
+        memset(&fl, 0, sizeof(fl));
+
+        skb->mark = be32_to_cpu(tunnel->parms.o_key);
+
+        switch (skb->protocol) {
+        case htons(ETH_P_IP):
+                xfrm_decode_session(skb, &fl, AF_INET);
+                memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+                break;
+        case htons(ETH_P_IPV6):
+                xfrm_decode_session(skb, &fl, AF_INET6);
+                memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+                break;
+        default:
+                dev->stats.tx_errors++;
+                dev_kfree_skb(skb);
+                return NETDEV_TX_OK;
+        }
+
+        return vti_xmit(skb, dev, &fl);
+}
+
+static int vti4_err(struct sk_buff *skb, u32 info)
+{
+        __be32 spi;
+        struct xfrm_state *x;
+        struct ip_tunnel *tunnel;
+        struct ip_esp_hdr *esph;
+        struct ip_auth_hdr *ah ;
+        struct ip_comp_hdr *ipch;
+        struct net *net = dev_net(skb->dev);
+        const struct iphdr *iph = (const struct iphdr *)skb->data;
+        int protocol = iph->protocol;
+        struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
+
+        tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
+                                  iph->daddr, iph->saddr, 0);
+        if (!tunnel)
+                return -1;
+
+        switch (protocol) {
+        case IPPROTO_ESP:
+                esph = (struct ip_esp_hdr *)(skb->data+(iph->ihl<<2));
+                spi = esph->spi;
+                break;
+        case IPPROTO_AH:
+                ah = (struct ip_auth_hdr *)(skb->data+(iph->ihl<<2));
+                spi = ah->spi;
+                break;
+        case IPPROTO_COMP:
+                ipch = (struct ip_comp_hdr *)(skb->data+(iph->ihl<<2));
+                spi = htonl(ntohs(ipch->cpi));
+                break;
+        default:
+                return 0;
+        }
+
+        switch (icmp_hdr(skb)->type) {
+        case ICMP_DEST_UNREACH:
+                if (icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
+                        return 0;
+        case ICMP_REDIRECT:
+                break;
+        default:
+                return 0;
+        }
+
+        x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
+                              spi, protocol, AF_INET);
+        if (!x)
+                return 0;
+
+        if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
+                ipv4_update_pmtu(skb, net, info, 0, 0, protocol, 0);
+        else
+                ipv4_redirect(skb, net, 0, 0, protocol, 0);
+        xfrm_state_put(x);
+
+        return 0;
+}
+
 static int
 vti_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
@@ -181,12 +310,13 @@ vti_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         return -EINVAL;
         }
 
+        p.i_flags |= VTI_ISVTI;
         err = ip_tunnel_ioctl(dev, &p, cmd);
         if (err)
                 return err;
 
         if (cmd != SIOCDELTUNNEL) {
-                p.i_flags |= GRE_KEY | VTI_ISVTI;
+                p.i_flags |= GRE_KEY;
                 p.o_flags |= GRE_KEY;
         }
 
@@ -207,6 +337,7 @@ static const struct net_device_ops vti_netdev_ops = {
 static void vti_tunnel_setup(struct net_device *dev)
 {
         dev->netdev_ops         = &vti_netdev_ops;
+        dev->type               = ARPHRD_TUNNEL;
         ip_tunnel_setup(dev, vti_net_id);
 }
 
@@ -218,13 +349,11 @@ static int vti_tunnel_init(struct net_device *dev)
         memcpy(dev->dev_addr, &iph->saddr, 4);
         memcpy(dev->broadcast, &iph->daddr, 4);
 
-        dev->type               = ARPHRD_TUNNEL;
         dev->hard_header_len    = LL_MAX_HEADER + sizeof(struct iphdr);
         dev->mtu                = ETH_DATA_LEN;
         dev->flags              = IFF_NOARP;
         dev->iflink             = 0;
         dev->addr_len           = 4;
-        dev->features           |= NETIF_F_NETNS_LOCAL;
         dev->features           |= NETIF_F_LLTX;
         dev->priv_flags         &= ~IFF_XMIT_DST_RELEASE;
 
@@ -241,9 +370,28 @@ static void __net_init vti_fb_tunnel_init(struct net_device *dev)
         iph->ihl                = 5;
 }
 
-static struct xfrm_tunnel_notifier vti_handler __read_mostly = {
+static struct xfrm4_protocol vti_esp4_protocol __read_mostly = {
+        .handler        =       vti_rcv,
+        .input_handler  =       vti_input,
+        .cb_handler     =       vti_rcv_cb,
+        .err_handler    =       vti4_err,
+        .priority       =       100,
+};
+
+static struct xfrm4_protocol vti_ah4_protocol __read_mostly = {
         .handler        =       vti_rcv,
-        .priority       =       1,
+        .input_handler  =       vti_input,
+        .cb_handler     =       vti_rcv_cb,
+        .err_handler    =       vti4_err,
+        .priority       =       100,
+};
+
+static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = {
+        .handler        =       vti_rcv,
+        .input_handler  =       vti_input,
+        .cb_handler     =       vti_rcv_cb,
+        .err_handler    =       vti4_err,
+        .priority       =       100,
 };
 
 static int __net_init vti_init_net(struct net *net)
@@ -287,6 +435,8 @@ static void vti_netlink_parms(struct nlattr *data[],
         if (!data)
                 return;
 
+        parms->i_flags = VTI_ISVTI;
+
         if (data[IFLA_VTI_LINK])
                 parms->link = nla_get_u32(data[IFLA_VTI_LINK]);
 
@@ -382,10 +532,31 @@ static int __init vti_init(void)
         err = register_pernet_device(&vti_net_ops);
         if (err < 0)
                 return err;
-        err = xfrm4_mode_tunnel_input_register(&vti_handler);
+        err = xfrm4_protocol_register(&vti_esp4_protocol, IPPROTO_ESP);
         if (err < 0) {
                 unregister_pernet_device(&vti_net_ops);
                 pr_info("vti init: can't register tunnel\n");
+
+                return err;
+        }
+
+        err = xfrm4_protocol_register(&vti_ah4_protocol, IPPROTO_AH);
+        if (err < 0) {
+                xfrm4_protocol_deregister(&vti_esp4_protocol, IPPROTO_ESP);
+                unregister_pernet_device(&vti_net_ops);
+                pr_info("vti init: can't register tunnel\n");
+
+                return err;
+        }
+
+        err = xfrm4_protocol_register(&vti_ipcomp4_protocol, IPPROTO_COMP);
+        if (err < 0) {
+                xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
+                xfrm4_protocol_deregister(&vti_esp4_protocol, IPPROTO_ESP);
+                unregister_pernet_device(&vti_net_ops);
+                pr_info("vti init: can't register tunnel\n");
+
+                return err;
         }
 
         err = rtnl_link_register(&vti_link_ops);
@@ -395,7 +566,9 @@ static int __init vti_init(void)
         return err;
 
 rtnl_link_failed:
-        xfrm4_mode_tunnel_input_deregister(&vti_handler);
+        xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP);
+        xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
+        xfrm4_protocol_deregister(&vti_esp4_protocol, IPPROTO_ESP);
         unregister_pernet_device(&vti_net_ops);
         return err;
 }
@@ -403,8 +576,13 @@ rtnl_link_failed:
 static void __exit vti_fini(void)
 {
         rtnl_link_unregister(&vti_link_ops);
-        if (xfrm4_mode_tunnel_input_deregister(&vti_handler))
+        if (xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP))
                 pr_info("vti close: can't deregister tunnel\n");
+        if (xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH))
+                pr_info("vti close: can't deregister tunnel\n");
+        if (xfrm4_protocol_deregister(&vti_esp4_protocol, IPPROTO_ESP))
+                pr_info("vti close: can't deregister tunnel\n");
+
 
         unregister_pernet_device(&vti_net_ops);
 }
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 826be4cb482a..c0855d50a3fa 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -23,7 +23,7 @@
 #include <net/protocol.h>
 #include <net/sock.h>
 
-static void ipcomp4_err(struct sk_buff *skb, u32 info)
+static int ipcomp4_err(struct sk_buff *skb, u32 info)
 {
         struct net *net = dev_net(skb->dev);
         __be32 spi;
@@ -34,24 +34,26 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
         switch (icmp_hdr(skb)->type) {
         case ICMP_DEST_UNREACH:
                 if (icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
-                        return;
+                        return 0;
         case ICMP_REDIRECT:
                 break;
         default:
-                return;
+                return 0;
         }
 
         spi = htonl(ntohs(ipch->cpi));
         x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
                               spi, IPPROTO_COMP, AF_INET);
         if (!x)
-                return;
+                return 0;
 
         if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
                 ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_COMP, 0);
         else
                 ipv4_redirect(skb, net, 0, 0, IPPROTO_COMP, 0);
         xfrm_state_put(x);
+
+        return 0;
 }
 
 /* We always hold one tunnel user reference to indicate a tunnel */
@@ -147,6 +149,11 @@ out:
         return err;
 }
 
+static int ipcomp4_rcv_cb(struct sk_buff *skb, int err)
+{
+        return 0;
+}
+
 static const struct xfrm_type ipcomp_type = {
         .description    = "IPCOMP4",
         .owner          = THIS_MODULE,
@@ -157,11 +164,12 @@ static const struct xfrm_type ipcomp_type = {
         .output         = ipcomp_output
 };
 
-static const struct net_protocol ipcomp4_protocol = {
+static struct xfrm4_protocol ipcomp4_protocol = {
         .handler        =       xfrm4_rcv,
+        .input_handler  =       xfrm_input,
+        .cb_handler     =       ipcomp4_rcv_cb,
         .err_handler    =       ipcomp4_err,
-        .no_policy      =       1,
-        .netns_ok       =       1,
+        .priority       =       0,
 };
 
 static int __init ipcomp4_init(void)
@@ -170,7 +178,7 @@ static int __init ipcomp4_init(void)
                 pr_info("%s: can't add xfrm type\n", __func__);
                 return -EAGAIN;
         }
-        if (inet_add_protocol(&ipcomp4_protocol, IPPROTO_COMP) < 0) {
+        if (xfrm4_protocol_register(&ipcomp4_protocol, IPPROTO_COMP) < 0) {
                 pr_info("%s: can't add protocol\n", __func__);
                 xfrm_unregister_type(&ipcomp_type, AF_INET);
                 return -EAGAIN;
@@ -180,7 +188,7 @@ static int __init ipcomp4_init(void)
 
 static void __exit ipcomp4_fini(void)
 {
-        if (inet_del_protocol(&ipcomp4_protocol, IPPROTO_COMP) < 0)
+        if (xfrm4_protocol_deregister(&ipcomp4_protocol, IPPROTO_COMP) < 0)
                 pr_info("%s: can't remove protocol\n", __func__);
         if (xfrm_unregister_type(&ipcomp_type, AF_INET) < 0)
                 pr_info("%s: can't remove xfrm type\n", __func__);
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index c3e0adea9c27..7ebd6e37875c 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -61,7 +61,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned int addr_type)
                 skb_dst_set(skb, NULL);
                 dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), skb->sk, 0);
                 if (IS_ERR(dst))
-                        return PTR_ERR(dst);;
+                        return PTR_ERR(dst);
                 skb_dst_set(skb, dst);
         }
 #endif
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 59da7cde0724..f95b6f93814b 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1044,8 +1044,10 @@ static int __do_replace(struct net *net, const char *name,
 
         xt_free_table_info(oldinfo);
         if (copy_to_user(counters_ptr, counters,
-                         sizeof(struct xt_counters) * num_counters) != 0)
-                ret = -EFAULT;
+                         sizeof(struct xt_counters) * num_counters) != 0) {
+                /* Silent error, can't fail, new table is already in place */
+                net_warn_ratelimited("arptables: counters copy to user failed while replacing table\n");
+        }
         vfree(counters);
         xt_table_unlock(t);
         return ret;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 718dfbd30cbe..99e810f84671 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1231,8 +1231,10 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 
         xt_free_table_info(oldinfo);
         if (copy_to_user(counters_ptr, counters,
-                         sizeof(struct xt_counters) * num_counters) != 0)
-                ret = -EFAULT;
+                         sizeof(struct xt_counters) * num_counters) != 0) {
+                /* Silent error, can't fail, new table is already in place */
+                net_warn_ratelimited("iptables: counters copy to user failed while replacing table\n");
+        }
         vfree(counters);
         xt_table_unlock(t);
         return ret;
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 2d11c094296e..8210964a9f19 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -252,26 +252,33 @@ int ping_init_sock(struct sock *sk)
 {
         struct net *net = sock_net(sk);
         kgid_t group = current_egid();
-        struct group_info *group_info = get_current_groups();
-        int i, j, count = group_info->ngroups;
+        struct group_info *group_info;
+        int i, j, count;
         kgid_t low, high;
+        int ret = 0;
 
         inet_get_ping_group_range_net(net, &low, &high);
         if (gid_lte(low, group) && gid_lte(group, high))
                 return 0;
 
+        group_info = get_current_groups();
+        count = group_info->ngroups;
         for (i = 0; i < group_info->nblocks; i++) {
                 int cp_count = min_t(int, NGROUPS_PER_BLOCK, count);
                 for (j = 0; j < cp_count; j++) {
                         kgid_t gid = group_info->blocks[i][j];
                         if (gid_lte(low, gid) && gid_lte(gid, high))
-                                return 0;
+                                goto out_release_group;
                 }
 
                 count -= cp_count;
         }
 
-        return -EACCES;
+        ret = -EACCES;
+
+out_release_group:
+        put_group_info(group_info);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(ping_init_sock);
 
@@ -727,7 +734,7 @@ static int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
         sock_tx_timestamp(sk, &ipc.tx_flags);
 
         if (msg->msg_controllen) {
-                err = ip_cmsg_send(sock_net(sk), msg, &ipc);
+                err = ip_cmsg_send(sock_net(sk), msg, &ipc, false);
                 if (err)
                         return err;
                 if (ipc.opt)
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index a6c8a80ec9d6..ad737fad6d8b 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -273,6 +273,7 @@ static const struct snmp_mib snmp4_net_list[] = {
         SNMP_MIB_ITEM("TCPChallengeACK", LINUX_MIB_TCPCHALLENGEACK),
         SNMP_MIB_ITEM("TCPSYNChallenge", LINUX_MIB_TCPSYNCHALLENGE),
         SNMP_MIB_ITEM("TCPFastOpenActive", LINUX_MIB_TCPFASTOPENACTIVE),
+        SNMP_MIB_ITEM("TCPFastOpenActiveFail", LINUX_MIB_TCPFASTOPENACTIVEFAIL),
         SNMP_MIB_ITEM("TCPFastOpenPassive", LINUX_MIB_TCPFASTOPENPASSIVE),
         SNMP_MIB_ITEM("TCPFastOpenPassiveFail", LINUX_MIB_TCPFASTOPENPASSIVEFAIL),
         SNMP_MIB_ITEM("TCPFastOpenListenOverflow", LINUX_MIB_TCPFASTOPENLISTENOVERFLOW),
@@ -280,6 +281,11 @@ static const struct snmp_mib snmp4_net_list[] = {
         SNMP_MIB_ITEM("TCPSpuriousRtxHostQueues", LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES),
         SNMP_MIB_ITEM("BusyPollRxPackets", LINUX_MIB_BUSYPOLLRXPACKETS),
         SNMP_MIB_ITEM("TCPAutoCorking", LINUX_MIB_TCPAUTOCORKING),
+        SNMP_MIB_ITEM("TCPFromZeroWindowAdv", LINUX_MIB_TCPFROMZEROWINDOWADV),
+        SNMP_MIB_ITEM("TCPToZeroWindowAdv", LINUX_MIB_TCPTOZEROWINDOWADV),
+        SNMP_MIB_ITEM("TCPWantZeroWindowAdv", LINUX_MIB_TCPWANTZEROWINDOWADV),
+        SNMP_MIB_ITEM("TCPSynRetrans", LINUX_MIB_TCPSYNRETRANS),
+        SNMP_MIB_ITEM("TCPOrigDataSent", LINUX_MIB_TCPORIGDATASENT),
         SNMP_MIB_SENTINEL
 };
 
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index c04518f4850a..a9dbe58bdfe7 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -524,7 +524,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         ipc.oif = sk->sk_bound_dev_if;
 
         if (msg->msg_controllen) {
-                err = ip_cmsg_send(sock_net(sk), msg, &ipc);
+                err = ip_cmsg_send(sock_net(sk), msg, &ipc, false);
                 if (err)
                         goto out;
                 if (ipc.opt)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 4c011ec69ed4..1485aafcad59 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -139,11 +139,6 @@ static void		 ip_do_redirect(struct dst_entry *dst, struct sock *sk,
                                         struct sk_buff *skb);
 static void             ipv4_dst_destroy(struct dst_entry *dst);
 
-static void ipv4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
-                            int how)
-{
-}
-
 static u32 *ipv4_cow_metrics(struct dst_entry *dst, unsigned long old)
 {
         WARN_ON(1);
@@ -162,7 +157,6 @@ static struct dst_ops ipv4_dst_ops = {
         .mtu =                  ipv4_mtu,
         .cow_metrics =          ipv4_cow_metrics,
         .destroy =              ipv4_dst_destroy,
-        .ifdown =               ipv4_dst_ifdown,
         .negative_advice =      ipv4_negative_advice,
         .link_failure =         ipv4_link_failure,
         .update_pmtu =          ip_rt_update_pmtu,
@@ -194,7 +188,7 @@ const __u8 ip_tos2prio[16] = {
 EXPORT_SYMBOL(ip_tos2prio);
 
 static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat);
-#define RT_CACHE_STAT_INC(field) __this_cpu_inc(rt_cache_stat.field)
+#define RT_CACHE_STAT_INC(field) raw_cpu_inc(rt_cache_stat.field)
 
 #ifdef CONFIG_PROC_FS
 static void *rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
@@ -697,7 +691,6 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
 
 out_unlock:
         spin_unlock_bh(&fnhe_lock);
-        return;
 }
 
 static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flowi4 *fl4,
@@ -1136,7 +1129,7 @@ static void ipv4_link_failure(struct sk_buff *skb)
                 dst_set_expires(&rt->dst, 0);
 }
 
-static int ip_rt_bug(struct sk_buff *skb)
+static int ip_rt_bug(struct sock *sk, struct sk_buff *skb)
 {
         pr_debug("%s: %pI4 -> %pI4, %s\n",
                  __func__, &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
@@ -2225,7 +2218,7 @@ struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_or
 
                 new->__use = 1;
                 new->input = dst_discard;
-                new->output = dst_discard;
+                new->output = dst_discard_sk;
 
                 new->dev = ort->dst.dev;
                 if (new->dev)
@@ -2364,7 +2357,7 @@ static int rt_fill_info(struct net *net,  __be32 dst, __be32 src,
                         }
                 } else
 #endif
-                        if (nla_put_u32(skb, RTA_IIF, rt->rt_iif))
+                        if (nla_put_u32(skb, RTA_IIF, skb->dev->ifindex))
                                 goto nla_put_failure;
         }
 
@@ -2475,11 +2468,6 @@ errout_free:
         goto errout;
 }
 
-int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb)
-{
-        return skb->len;
-}
-
 void ip_rt_multicast_event(struct in_device *in_dev)
 {
         rt_cache_flush(dev_net(in_dev->dev));
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 97c8f5620c43..4bd6d52eeffb 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -387,7 +387,7 @@ void tcp_init_sock(struct sock *sk)
         INIT_LIST_HEAD(&tp->tsq_node);
 
         icsk->icsk_rto = TCP_TIMEOUT_INIT;
-        tp->mdev = TCP_TIMEOUT_INIT;
+        tp->mdev_us = jiffies_to_usecs(TCP_TIMEOUT_INIT);
 
         /* So many TCP implementations out there (incorrectly) count the
          * initial SYN frame in their delayed-ACK and congestion control
@@ -2341,7 +2341,7 @@ int tcp_disconnect(struct sock *sk, int flags)
 
         sk->sk_shutdown = 0;
         sock_reset_flag(sk, SOCK_DONE);
-        tp->srtt = 0;
+        tp->srtt_us = 0;
         if ((tp->write_seq += tp->max_window + 2) == 0)
                 tp->write_seq = 1;
         icsk->icsk_backoff = 0;
@@ -2785,8 +2785,8 @@ void tcp_get_info(const struct sock *sk, struct tcp_info *info)
 
         info->tcpi_pmtu = icsk->icsk_pmtu_cookie;
         info->tcpi_rcv_ssthresh = tp->rcv_ssthresh;
-        info->tcpi_rtt = jiffies_to_usecs(tp->srtt)>>3;
-        info->tcpi_rttvar = jiffies_to_usecs(tp->mdev)>>2;
+        info->tcpi_rtt = tp->srtt_us >> 3;
+        info->tcpi_rttvar = tp->mdev_us >> 2;
         info->tcpi_snd_ssthresh = tp->snd_ssthresh;
         info->tcpi_snd_cwnd = tp->snd_cwnd;
         info->tcpi_advmss = tp->advmss;
@@ -2796,6 +2796,11 @@ void tcp_get_info(const struct sock *sk, struct tcp_info *info)
         info->tcpi_rcv_space = tp->rcvq_space.space;
 
         info->tcpi_total_retrans = tp->total_retrans;
+
+        info->tcpi_pacing_rate = sk->sk_pacing_rate != ~0U ?
+                                        sk->sk_pacing_rate : ~0ULL;
+        info->tcpi_max_pacing_rate = sk->sk_max_pacing_rate != ~0U ?
+                                        sk->sk_max_pacing_rate : ~0ULL;
 }
 EXPORT_SYMBOL_GPL(tcp_get_info);
 
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 2388275adb9b..2b9464c93b88 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -361,21 +361,12 @@ u32 tcp_reno_ssthresh(struct sock *sk)
 }
 EXPORT_SYMBOL_GPL(tcp_reno_ssthresh);
 
-/* Lower bound on congestion window with halving. */
-u32 tcp_reno_min_cwnd(const struct sock *sk)
-{
-        const struct tcp_sock *tp = tcp_sk(sk);
-        return tp->snd_ssthresh/2;
-}
-EXPORT_SYMBOL_GPL(tcp_reno_min_cwnd);
-
 struct tcp_congestion_ops tcp_reno = {
         .flags          = TCP_CONG_NON_RESTRICTED,
         .name           = "reno",
         .owner          = THIS_MODULE,
         .ssthresh       = tcp_reno_ssthresh,
         .cong_avoid     = tcp_reno_cong_avoid,
-        .min_cwnd       = tcp_reno_min_cwnd,
 };
 
 /* Initial congestion control used (until SYN)
@@ -387,6 +378,5 @@ struct tcp_congestion_ops tcp_init_congestion_ops  = {
         .owner          = THIS_MODULE,
         .ssthresh       = tcp_reno_ssthresh,
         .cong_avoid     = tcp_reno_cong_avoid,
-        .min_cwnd       = tcp_reno_min_cwnd,
 };
 EXPORT_SYMBOL_GPL(tcp_init_congestion_ops);
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index 828e4c3ffbaf..8bf224516ba2 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -476,10 +476,6 @@ static int __init cubictcp_register(void)
         /* divide by bic_scale and by constant Srtt (100ms) */
         do_div(cube_factor, bic_scale * 10);
 
-        /* hystart needs ms clock resolution */
-        if (hystart && HZ < 1000)
-                cubictcp.flags |= TCP_CONG_RTT_STAMP;
-
         return tcp_register_congestion_control(&cubictcp);
 }
 
diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c
index 8ed9305dfdf4..8b9e7bad77c0 100644
--- a/net/ipv4/tcp_highspeed.c
+++ b/net/ipv4/tcp_highspeed.c
@@ -162,7 +162,6 @@ static struct tcp_congestion_ops tcp_highspeed __read_mostly = {
         .init           = hstcp_init,
         .ssthresh       = hstcp_ssthresh,
         .cong_avoid     = hstcp_cong_avoid,
-        .min_cwnd       = tcp_reno_min_cwnd,
 
         .owner          = THIS_MODULE,
         .name           = "highspeed"
diff --git a/net/ipv4/tcp_hybla.c b/net/ipv4/tcp_hybla.c
index 478fe82611bf..a15a799bf768 100644
--- a/net/ipv4/tcp_hybla.c
+++ b/net/ipv4/tcp_hybla.c
@@ -21,7 +21,7 @@ struct hybla {
         u32   rho2;           /* Rho * Rho, integer part */
         u32   rho_3ls;        /* Rho parameter, <<3 */
         u32   rho2_7ls;       /* Rho^2, <<7     */
-        u32   minrtt;         /* Minimum smoothed round trip time value seen */
+        u32   minrtt_us;      /* Minimum smoothed round trip time value seen */
 };
 
 /* Hybla reference round trip time (default= 1/40 sec = 25 ms), in ms */
@@ -35,7 +35,9 @@ static inline void hybla_recalc_param (struct sock *sk)
 {
         struct hybla *ca = inet_csk_ca(sk);
 
-        ca->rho_3ls = max_t(u32, tcp_sk(sk)->srtt / msecs_to_jiffies(rtt0), 8);
+        ca->rho_3ls = max_t(u32,
+                            tcp_sk(sk)->srtt_us / (rtt0 * USEC_PER_MSEC),
+                            8U);
         ca->rho = ca->rho_3ls >> 3;
         ca->rho2_7ls = (ca->rho_3ls * ca->rho_3ls) << 1;
         ca->rho2 = ca->rho2_7ls >> 7;
@@ -59,7 +61,7 @@ static void hybla_init(struct sock *sk)
         hybla_recalc_param(sk);
 
         /* set minimum rtt as this is the 1st ever seen */
-        ca->minrtt = tp->srtt;
+        ca->minrtt_us = tp->srtt_us;
         tp->snd_cwnd = ca->rho;
 }
 
@@ -94,9 +96,9 @@ static void hybla_cong_avoid(struct sock *sk, u32 ack, u32 acked,
         int is_slowstart = 0;
 
         /*  Recalculate rho only if this srtt is the lowest */
-        if (tp->srtt < ca->minrtt){
+        if (tp->srtt_us < ca->minrtt_us) {
                 hybla_recalc_param(sk);
-                ca->minrtt = tp->srtt;
+                ca->minrtt_us = tp->srtt_us;
         }
 
         if (!tcp_is_cwnd_limited(sk, in_flight))
@@ -166,7 +168,6 @@ static void hybla_cong_avoid(struct sock *sk, u32 ack, u32 acked,
 static struct tcp_congestion_ops tcp_hybla __read_mostly = {
         .init           = hybla_init,
         .ssthresh       = tcp_reno_ssthresh,
-        .min_cwnd       = tcp_reno_min_cwnd,
         .cong_avoid     = hybla_cong_avoid,
         .set_state      = hybla_state,
 
diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
index e498a62b8f97..863d105e3015 100644
--- a/net/ipv4/tcp_illinois.c
+++ b/net/ipv4/tcp_illinois.c
@@ -325,10 +325,8 @@ static void tcp_illinois_info(struct sock *sk, u32 ext,
 }
 
 static struct tcp_congestion_ops tcp_illinois __read_mostly = {
-        .flags          = TCP_CONG_RTT_STAMP,
         .init           = tcp_illinois_init,
         .ssthresh       = tcp_illinois_ssthresh,
-        .min_cwnd       = tcp_reno_min_cwnd,
         .cong_avoid     = tcp_illinois_cong_avoid,
         .set_state      = tcp_illinois_state,
         .get_info       = tcp_illinois_info,
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index eeaac399420d..d6b46eb2f94c 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -667,11 +667,11 @@ static void tcp_event_data_recv(struct sock *sk, struct sk_buff *skb)
  * To save cycles in the RFC 1323 implementation it was better to break
  * it up into three procedures. -- erics
  */
-static void tcp_rtt_estimator(struct sock *sk, const __u32 mrtt)
+static void tcp_rtt_estimator(struct sock *sk, long mrtt_us)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        long m = mrtt; /* RTT */
-        u32 srtt = tp->srtt;
+        long m = mrtt_us; /* RTT */
+        u32 srtt = tp->srtt_us;
 
         /*      The following amusing code comes from Jacobson's
          *      article in SIGCOMM '88.  Note that rtt and mdev
@@ -694,7 +694,7 @@ static void tcp_rtt_estimator(struct sock *sk, const __u32 mrtt)
                 srtt += m;              /* rtt = 7/8 rtt + 1/8 new */
                 if (m < 0) {
                         m = -m;         /* m is now abs(error) */
-                        m -= (tp->mdev >> 2);   /* similar update on mdev */
+                        m -= (tp->mdev_us >> 2);   /* similar update on mdev */
                         /* This is similar to one of Eifel findings.
                          * Eifel blocks mdev updates when rtt decreases.
                          * This solution is a bit different: we use finer gain
@@ -706,28 +706,29 @@ static void tcp_rtt_estimator(struct sock *sk, const __u32 mrtt)
                         if (m > 0)
                                 m >>= 3;
                 } else {
-                        m -= (tp->mdev >> 2);   /* similar update on mdev */
+                        m -= (tp->mdev_us >> 2);   /* similar update on mdev */
                 }
-                tp->mdev += m;          /* mdev = 3/4 mdev + 1/4 new */
-                if (tp->mdev > tp->mdev_max) {
-                        tp->mdev_max = tp->mdev;
-                        if (tp->mdev_max > tp->rttvar)
-                                tp->rttvar = tp->mdev_max;
+                tp->mdev_us += m;               /* mdev = 3/4 mdev + 1/4 new */
+                if (tp->mdev_us > tp->mdev_max_us) {
+                        tp->mdev_max_us = tp->mdev_us;
+                        if (tp->mdev_max_us > tp->rttvar_us)
+                                tp->rttvar_us = tp->mdev_max_us;
                 }
                 if (after(tp->snd_una, tp->rtt_seq)) {
-                        if (tp->mdev_max < tp->rttvar)
-                                tp->rttvar -= (tp->rttvar - tp->mdev_max) >> 2;
+                        if (tp->mdev_max_us < tp->rttvar_us)
+                                tp->rttvar_us -= (tp->rttvar_us - tp->mdev_max_us) >> 2;
                         tp->rtt_seq = tp->snd_nxt;
-                        tp->mdev_max = tcp_rto_min(sk);
+                        tp->mdev_max_us = tcp_rto_min_us(sk);
                 }
         } else {
                 /* no previous measure. */
                 srtt = m << 3;          /* take the measured time to be rtt */
-                tp->mdev = m << 1;      /* make sure rto = 3*rtt */
-                tp->mdev_max = tp->rttvar = max(tp->mdev, tcp_rto_min(sk));
+                tp->mdev_us = m << 1;   /* make sure rto = 3*rtt */
+                tp->rttvar_us = max(tp->mdev_us, tcp_rto_min_us(sk));
+                tp->mdev_max_us = tp->rttvar_us;
                 tp->rtt_seq = tp->snd_nxt;
         }
-        tp->srtt = max(1U, srtt);
+        tp->srtt_us = max(1U, srtt);
 }
 
 /* Set the sk_pacing_rate to allow proper sizing of TSO packets.
@@ -742,20 +743,12 @@ static void tcp_update_pacing_rate(struct sock *sk)
         u64 rate;
 
         /* set sk_pacing_rate to 200 % of current rate (mss * cwnd / srtt) */
-        rate = (u64)tp->mss_cache * 2 * (HZ << 3);
+        rate = (u64)tp->mss_cache * 2 * (USEC_PER_SEC << 3);
 
         rate *= max(tp->snd_cwnd, tp->packets_out);
 
-        /* Correction for small srtt and scheduling constraints.
-         * For small rtt, consider noise is too high, and use
-         * the minimal value (srtt = 1 -> 125 us for HZ=1000)
-         *
-         * We probably need usec resolution in the future.
-         * Note: This also takes care of possible srtt=0 case,
-         * when tcp_rtt_estimator() was not yet called.
-         */
-        if (tp->srtt > 8 + 2)
-                do_div(rate, tp->srtt);
+        if (likely(tp->srtt_us))
+                do_div(rate, tp->srtt_us);
 
         /* ACCESS_ONCE() is needed because sch_fq fetches sk_pacing_rate
          * without any lock. We want to make sure compiler wont store
@@ -1122,10 +1115,10 @@ static bool tcp_check_dsack(struct sock *sk, const struct sk_buff *ack_skb,
 }
 
 struct tcp_sacktag_state {
-        int reord;
-        int fack_count;
-        int flag;
-        s32 rtt; /* RTT measured by SACKing never-retransmitted data */
+        int     reord;
+        int     fack_count;
+        long    rtt_us; /* RTT measured by SACKing never-retransmitted data */
+        int     flag;
 };
 
 /* Check if skb is fully within the SACK block. In presence of GSO skbs,
@@ -1186,7 +1179,8 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
 static u8 tcp_sacktag_one(struct sock *sk,
                           struct tcp_sacktag_state *state, u8 sacked,
                           u32 start_seq, u32 end_seq,
-                          int dup_sack, int pcount, u32 xmit_time)
+                          int dup_sack, int pcount,
+                          const struct skb_mstamp *xmit_time)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int fack_count = state->fack_count;
@@ -1227,8 +1221,13 @@ static u8 tcp_sacktag_one(struct sock *sk,
                                 if (!after(end_seq, tp->high_seq))
                                         state->flag |= FLAG_ORIG_SACK_ACKED;
                                 /* Pick the earliest sequence sacked for RTT */
-                                if (state->rtt < 0)
-                                        state->rtt = tcp_time_stamp - xmit_time;
+                                if (state->rtt_us < 0) {
+                                        struct skb_mstamp now;
+
+                                        skb_mstamp_get(&now);
+                                        state->rtt_us = skb_mstamp_us_delta(&now,
+                                                                xmit_time);
+                                }
                         }
 
                         if (sacked & TCPCB_LOST) {
@@ -1287,7 +1286,7 @@ static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
          */
         tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
                         start_seq, end_seq, dup_sack, pcount,
-                        TCP_SKB_CB(skb)->when);
+                        &skb->skb_mstamp);
 
         if (skb == tp->lost_skb_hint)
                 tp->lost_cnt_hint += pcount;
@@ -1565,7 +1564,7 @@ static struct sk_buff *tcp_sacktag_walk(struct sk_buff *skb, struct sock *sk,
                                                 TCP_SKB_CB(skb)->end_seq,
                                                 dup_sack,
                                                 tcp_skb_pcount(skb),
-                                                TCP_SKB_CB(skb)->when);
+                                                &skb->skb_mstamp);
 
                         if (!before(TCP_SKB_CB(skb)->seq,
                                     tcp_highest_sack_seq(tp)))
@@ -1622,7 +1621,7 @@ static int tcp_sack_cache_ok(const struct tcp_sock *tp, const struct tcp_sack_bl
 
 static int
 tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
-                        u32 prior_snd_una, s32 *sack_rtt)
+                        u32 prior_snd_una, long *sack_rtt_us)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         const unsigned char *ptr = (skb_transport_header(ack_skb) +
@@ -1640,7 +1639,7 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
 
         state.flag = 0;
         state.reord = tp->packets_out;
-        state.rtt = -1;
+        state.rtt_us = -1L;
 
         if (!tp->sacked_out) {
                 if (WARN_ON(tp->fackets_out))
@@ -1824,7 +1823,7 @@ out:
         WARN_ON((int)tp->retrans_out < 0);
         WARN_ON((int)tcp_packets_in_flight(tp) < 0);
 #endif
-        *sack_rtt = state.rtt;
+        *sack_rtt_us = state.rtt_us;
         return state.flag;
 }
 
@@ -2035,10 +2034,12 @@ static bool tcp_pause_early_retransmit(struct sock *sk, int flag)
          * available, or RTO is scheduled to fire first.
          */
         if (sysctl_tcp_early_retrans < 2 || sysctl_tcp_early_retrans > 3 ||
-            (flag & FLAG_ECE) || !tp->srtt)
+            (flag & FLAG_ECE) || !tp->srtt_us)
                 return false;
 
-        delay = max_t(unsigned long, (tp->srtt >> 5), msecs_to_jiffies(2));
+        delay = max(usecs_to_jiffies(tp->srtt_us >> 5),
+                    msecs_to_jiffies(2));
+
         if (!time_after(inet_csk(sk)->icsk_timeout, (jiffies + delay)))
                 return false;
 
@@ -2885,7 +2886,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const int acked,
 }
 
 static inline bool tcp_ack_update_rtt(struct sock *sk, const int flag,
-                                      s32 seq_rtt, s32 sack_rtt)
+                                      long seq_rtt_us, long sack_rtt_us)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
 
@@ -2895,10 +2896,10 @@ static inline bool tcp_ack_update_rtt(struct sock *sk, const int flag,
          * is acked (RFC6298).
          */
         if (flag & FLAG_RETRANS_DATA_ACKED)
-                seq_rtt = -1;
+                seq_rtt_us = -1L;
 
-        if (seq_rtt < 0)
-                seq_rtt = sack_rtt;
+        if (seq_rtt_us < 0)
+                seq_rtt_us = sack_rtt_us;
 
         /* RTTM Rule: A TSecr value received in a segment is used to
          * update the averaged RTT measurement only if the segment
@@ -2906,14 +2907,14 @@ static inline bool tcp_ack_update_rtt(struct sock *sk, const int flag,
          * left edge of the send window.
          * See draft-ietf-tcplw-high-performance-00, section 3.3.
          */
-        if (seq_rtt < 0 && tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr &&
+        if (seq_rtt_us < 0 && tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr &&
             flag & FLAG_ACKED)
-                seq_rtt = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
+                seq_rtt_us = jiffies_to_usecs(tcp_time_stamp - tp->rx_opt.rcv_tsecr);
 
-        if (seq_rtt < 0)
+        if (seq_rtt_us < 0)
                 return false;
 
-        tcp_rtt_estimator(sk, seq_rtt);
+        tcp_rtt_estimator(sk, seq_rtt_us);
         tcp_set_rto(sk);
 
         /* RFC6298: only reset backoff on valid RTT measurement. */
@@ -2925,16 +2926,16 @@ static inline bool tcp_ack_update_rtt(struct sock *sk, const int flag,
 static void tcp_synack_rtt_meas(struct sock *sk, const u32 synack_stamp)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        s32 seq_rtt = -1;
+        long seq_rtt_us = -1L;
 
         if (synack_stamp && !tp->total_retrans)
-                seq_rtt = tcp_time_stamp - synack_stamp;
+                seq_rtt_us = jiffies_to_usecs(tcp_time_stamp - synack_stamp);
 
         /* If the ACK acks both the SYNACK and the (Fast Open'd) data packets
          * sent in SYN_RECV, SYNACK RTT is the smooth RTT computed in tcp_ack()
          */
-        if (!tp->srtt)
-                tcp_ack_update_rtt(sk, FLAG_SYN_ACKED, seq_rtt, -1);
+        if (!tp->srtt_us)
+                tcp_ack_update_rtt(sk, FLAG_SYN_ACKED, seq_rtt_us, -1L);
 }
 
 static void tcp_cong_avoid(struct sock *sk, u32 ack, u32 acked, u32 in_flight)
@@ -3023,26 +3024,27 @@ static u32 tcp_tso_acked(struct sock *sk, struct sk_buff *skb)
  * arrived at the other end.
  */
 static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
-                               u32 prior_snd_una, s32 sack_rtt)
+                               u32 prior_snd_una, long sack_rtt_us)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
-        struct sk_buff *skb;
-        u32 now = tcp_time_stamp;
+        struct skb_mstamp first_ackt, last_ackt, now;
+        struct tcp_sock *tp = tcp_sk(sk);
+        u32 prior_sacked = tp->sacked_out;
+        u32 reord = tp->packets_out;
         bool fully_acked = true;
-        int flag = 0;
+        long ca_seq_rtt_us = -1L;
+        long seq_rtt_us = -1L;
+        struct sk_buff *skb;
         u32 pkts_acked = 0;
-        u32 reord = tp->packets_out;
-        u32 prior_sacked = tp->sacked_out;
-        s32 seq_rtt = -1;
-        s32 ca_seq_rtt = -1;
-        ktime_t last_ackt = net_invalid_timestamp();
         bool rtt_update;
+        int flag = 0;
+
+        first_ackt.v64 = 0;
 
         while ((skb = tcp_write_queue_head(sk)) && skb != tcp_send_head(sk)) {
                 struct tcp_skb_cb *scb = TCP_SKB_CB(skb);
-                u32 acked_pcount;
                 u8 sacked = scb->sacked;
+                u32 acked_pcount;
 
                 /* Determine how many packets and what bytes were acked, tso and else */
                 if (after(scb->end_seq, tp->snd_una)) {
@@ -3064,11 +3066,11 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                                 tp->retrans_out -= acked_pcount;
                         flag |= FLAG_RETRANS_DATA_ACKED;
                 } else {
-                        ca_seq_rtt = now - scb->when;
-                        last_ackt = skb->tstamp;
-                        if (seq_rtt < 0) {
-                                seq_rtt = ca_seq_rtt;
-                        }
+                        last_ackt = skb->skb_mstamp;
+                        WARN_ON_ONCE(last_ackt.v64 == 0);
+                        if (!first_ackt.v64)
+                                first_ackt = last_ackt;
+
                         if (!(sacked & TCPCB_SACKED_ACKED))
                                 reord = min(pkts_acked, reord);
                         if (!after(scb->end_seq, tp->high_seq))
@@ -3114,7 +3116,13 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
         if (skb && (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED))
                 flag |= FLAG_SACK_RENEGING;
 
-        rtt_update = tcp_ack_update_rtt(sk, flag, seq_rtt, sack_rtt);
+        skb_mstamp_get(&now);
+        if (first_ackt.v64) {
+                seq_rtt_us = skb_mstamp_us_delta(&now, &first_ackt);
+                ca_seq_rtt_us = skb_mstamp_us_delta(&now, &last_ackt);
+        }
+
+        rtt_update = tcp_ack_update_rtt(sk, flag, seq_rtt_us, sack_rtt_us);
 
         if (flag & FLAG_ACKED) {
                 const struct tcp_congestion_ops *ca_ops
@@ -3142,25 +3150,11 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
 
                 tp->fackets_out -= min(pkts_acked, tp->fackets_out);
 
-                if (ca_ops->pkts_acked) {
-                        s32 rtt_us = -1;
-
-                        /* Is the ACK triggering packet unambiguous? */
-                        if (!(flag & FLAG_RETRANS_DATA_ACKED)) {
-                                /* High resolution needed and available? */
-                                if (ca_ops->flags & TCP_CONG_RTT_STAMP &&
-                                    !ktime_equal(last_ackt,
-                                                 net_invalid_timestamp()))
-                                        rtt_us = ktime_us_delta(ktime_get_real(),
-                                                                last_ackt);
-                                else if (ca_seq_rtt >= 0)
-                                        rtt_us = jiffies_to_usecs(ca_seq_rtt);
-                        }
+                if (ca_ops->pkts_acked)
+                        ca_ops->pkts_acked(sk, pkts_acked, ca_seq_rtt_us);
 
-                        ca_ops->pkts_acked(sk, pkts_acked, rtt_us);
-                }
-        } else if (skb && rtt_update && sack_rtt >= 0 &&
-                   sack_rtt > (s32)(now - TCP_SKB_CB(skb)->when)) {
+        } else if (skb && rtt_update && sack_rtt_us >= 0 &&
+                   sack_rtt_us > skb_mstamp_us_delta(&now, &skb->skb_mstamp)) {
                 /* Do not re-arm RTO if the sack RTT is measured from data sent
                  * after when the head was last (re)transmitted. Otherwise the
                  * timeout may continue to extend in loss recovery.
@@ -3370,12 +3364,12 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
         u32 ack_seq = TCP_SKB_CB(skb)->seq;
         u32 ack = TCP_SKB_CB(skb)->ack_seq;
         bool is_dupack = false;
-        u32 prior_in_flight, prior_cwnd = tp->snd_cwnd, prior_rtt = tp->srtt;
+        u32 prior_in_flight;
         u32 prior_fackets;
         int prior_packets = tp->packets_out;
         const int prior_unsacked = tp->packets_out - tp->sacked_out;
         int acked = 0; /* Number of packets newly acked */
-        s32 sack_rtt = -1;
+        long sack_rtt_us = -1L;
 
         /* If the ack is older than previous acks
          * then we can probably ignore it.
@@ -3433,7 +3427,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
 
                 if (TCP_SKB_CB(skb)->sacked)
                         flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una,
-                                                        &sack_rtt);
+                                                        &sack_rtt_us);
 
                 if (TCP_ECN_rcv_ecn_echo(tp, tcp_hdr(skb)))
                         flag |= FLAG_ECE;
@@ -3452,7 +3446,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
 
         /* See if we can take anything off of the retransmit queue. */
         acked = tp->packets_out;
-        flag |= tcp_clean_rtx_queue(sk, prior_fackets, prior_snd_una, sack_rtt);
+        flag |= tcp_clean_rtx_queue(sk, prior_fackets, prior_snd_una,
+                                    sack_rtt_us);
         acked -= tp->packets_out;
 
         /* Advance cwnd if state allows */
@@ -3475,8 +3470,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
 
         if (icsk->icsk_pending == ICSK_TIME_RETRANS)
                 tcp_schedule_loss_probe(sk);
-        if (tp->srtt != prior_rtt || tp->snd_cwnd != prior_cwnd)
-                tcp_update_pacing_rate(sk);
+        tcp_update_pacing_rate(sk);
         return 1;
 
 no_queue:
@@ -3505,7 +3499,7 @@ old_ack:
          */
         if (TCP_SKB_CB(skb)->sacked) {
                 flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una,
-                                                &sack_rtt);
+                                                &sack_rtt_us);
                 tcp_fastretrans_alert(sk, acked, prior_unsacked,
                                       is_dupack, flag);
         }
@@ -4419,7 +4413,7 @@ queue_and_out:
                 if (eaten > 0)
                         kfree_skb_partial(skb, fragstolen);
                 if (!sock_flag(sk, SOCK_DEAD))
-                        sk->sk_data_ready(sk, 0);
+                        sk->sk_data_ready(sk);
                 return;
         }
 
@@ -4920,7 +4914,7 @@ static void tcp_urg(struct sock *sk, struct sk_buff *skb, const struct tcphdr *t
                                 BUG();
                         tp->urg_data = TCP_URG_VALID | tmp;
                         if (!sock_flag(sk, SOCK_DEAD))
-                                sk->sk_data_ready(sk, 0);
+                                sk->sk_data_ready(sk);
                 }
         }
 }
@@ -5006,11 +5000,11 @@ static bool tcp_dma_try_early_copy(struct sock *sk, struct sk_buff *skb,
                     (tcp_flag_word(tcp_hdr(skb)) & TCP_FLAG_PSH) ||
                     (atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1))) {
                         tp->ucopy.wakeup = 1;
-                        sk->sk_data_ready(sk, 0);
+                        sk->sk_data_ready(sk);
                 }
         } else if (chunk > 0) {
                 tp->ucopy.wakeup = 1;
-                sk->sk_data_ready(sk, 0);
+                sk->sk_data_ready(sk);
         }
 out:
         return copied_early;
@@ -5281,7 +5275,7 @@ no_ack:
 #endif
                         if (eaten)
                                 kfree_skb_partial(skb, fragstolen);
-                        sk->sk_data_ready(sk, 0);
+                        sk->sk_data_ready(sk);
                         return;
                 }
         }
@@ -5401,9 +5395,12 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,
                                 break;
                 }
                 tcp_rearm_rto(sk);
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPFASTOPENACTIVEFAIL);
                 return true;
         }
         tp->syn_data_acked = tp->syn_data;
+        if (tp->syn_data_acked)
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPFASTOPENACTIVE);
         return false;
 }
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 1e4eac779f51..438f3b95143d 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -435,7 +435,7 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                         break;
 
                 icsk->icsk_backoff--;
-                inet_csk(sk)->icsk_rto = (tp->srtt ? __tcp_set_rto(tp) :
+                inet_csk(sk)->icsk_rto = (tp->srtt_us ? __tcp_set_rto(tp) :
                         TCP_TIMEOUT_INIT) << icsk->icsk_backoff;
                 tcp_bound_rto(sk);
 
@@ -854,8 +854,10 @@ static int tcp_v4_rtx_synack(struct sock *sk, struct request_sock *req)
 {
         int res = tcp_v4_send_synack(sk, NULL, req, 0);
 
-        if (!res)
+        if (!res) {
                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
+        }
         return res;
 }
 
@@ -878,8 +880,6 @@ bool tcp_syn_flood_action(struct sock *sk,
         bool want_cookie = false;
         struct listen_sock *lopt;
 
-
-
 #ifdef CONFIG_SYN_COOKIES
         if (sysctl_tcp_syncookies) {
                 msg = "Sending cookies";
@@ -1434,7 +1434,7 @@ static int tcp_v4_conn_req_fastopen(struct sock *sk,
                 tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
                 tp->syn_data_acked = 1;
         }
-        sk->sk_data_ready(sk, 0);
+        sk->sk_data_ready(sk);
         bh_unlock_sock(child);
         sock_put(child);
         WARN_ON(req->sk == NULL);
diff --git a/net/ipv4/tcp_lp.c b/net/ipv4/tcp_lp.c
index 991d62a2f9bb..c9aecae31327 100644
--- a/net/ipv4/tcp_lp.c
+++ b/net/ipv4/tcp_lp.c
@@ -315,11 +315,9 @@ static void tcp_lp_pkts_acked(struct sock *sk, u32 num_acked, s32 rtt_us)
 }
 
 static struct tcp_congestion_ops tcp_lp __read_mostly = {
-        .flags = TCP_CONG_RTT_STAMP,
         .init = tcp_lp_init,
         .ssthresh = tcp_reno_ssthresh,
         .cong_avoid = tcp_lp_cong_avoid,
-        .min_cwnd = tcp_reno_min_cwnd,
         .pkts_acked = tcp_lp_pkts_acked,
 
         .owner = THIS_MODULE,
diff --git a/net/ipv4/tcp_memcontrol.c b/net/ipv4/tcp_memcontrol.c
index f7e522c558ba..d4f015ad6c84 100644
--- a/net/ipv4/tcp_memcontrol.c
+++ b/net/ipv4/tcp_memcontrol.c
@@ -103,7 +103,7 @@ static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
 }
 
 static int tcp_cgroup_write(struct cgroup_subsys_state *css, struct cftype *cft,
-                            const char *buffer)
+                            char *buffer)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_css(css);
         unsigned long long val;
@@ -219,7 +219,7 @@ static struct cftype tcp_files[] = {
 
 static int __init tcp_memcontrol_init(void)
 {
-        WARN_ON(cgroup_add_cftypes(&mem_cgroup_subsys, tcp_files));
+        WARN_ON(cgroup_add_cftypes(&memory_cgrp_subsys, tcp_files));
         return 0;
 }
 __initcall(tcp_memcontrol_init);
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index d547075d8300..dcaf72f10216 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -33,6 +33,11 @@ struct tcp_fastopen_metrics {
         struct  tcp_fastopen_cookie     cookie;
 };
 
+/* TCP_METRIC_MAX includes 2 extra fields for userspace compatibility
+ * Kernel only stores RTT and RTTVAR in usec resolution
+ */
+#define TCP_METRIC_MAX_KERNEL (TCP_METRIC_MAX - 2)
+
 struct tcp_metrics_block {
         struct tcp_metrics_block __rcu  *tcpm_next;
         struct inetpeer_addr            tcpm_saddr;
@@ -41,7 +46,7 @@ struct tcp_metrics_block {
         u32                             tcpm_ts;
         u32                             tcpm_ts_stamp;
         u32                             tcpm_lock;
-        u32                             tcpm_vals[TCP_METRIC_MAX + 1];
+        u32                             tcpm_vals[TCP_METRIC_MAX_KERNEL + 1];
         struct tcp_fastopen_metrics     tcpm_fastopen;
 
         struct rcu_head                 rcu_head;
@@ -59,12 +64,6 @@ static u32 tcp_metric_get(struct tcp_metrics_block *tm,
         return tm->tcpm_vals[idx];
 }
 
-static u32 tcp_metric_get_jiffies(struct tcp_metrics_block *tm,
-                                  enum tcp_metric_index idx)
-{
-        return msecs_to_jiffies(tm->tcpm_vals[idx]);
-}
-
 static void tcp_metric_set(struct tcp_metrics_block *tm,
                            enum tcp_metric_index idx,
                            u32 val)
@@ -72,13 +71,6 @@ static void tcp_metric_set(struct tcp_metrics_block *tm,
         tm->tcpm_vals[idx] = val;
 }
 
-static void tcp_metric_set_msecs(struct tcp_metrics_block *tm,
-                                 enum tcp_metric_index idx,
-                                 u32 val)
-{
-        tm->tcpm_vals[idx] = jiffies_to_msecs(val);
-}
-
 static bool addr_same(const struct inetpeer_addr *a,
                       const struct inetpeer_addr *b)
 {
@@ -101,9 +93,11 @@ struct tcpm_hash_bucket {
 
 static DEFINE_SPINLOCK(tcp_metrics_lock);
 
-static void tcpm_suck_dst(struct tcp_metrics_block *tm, struct dst_entry *dst,
+static void tcpm_suck_dst(struct tcp_metrics_block *tm,
+                          const struct dst_entry *dst,
                           bool fastopen_clear)
 {
+        u32 msval;
         u32 val;
 
         tm->tcpm_stamp = jiffies;
@@ -121,8 +115,11 @@ static void tcpm_suck_dst(struct tcp_metrics_block *tm, struct dst_entry *dst,
                 val |= 1 << TCP_METRIC_REORDERING;
         tm->tcpm_lock = val;
 
-        tm->tcpm_vals[TCP_METRIC_RTT] = dst_metric_raw(dst, RTAX_RTT);
-        tm->tcpm_vals[TCP_METRIC_RTTVAR] = dst_metric_raw(dst, RTAX_RTTVAR);
+        msval = dst_metric_raw(dst, RTAX_RTT);
+        tm->tcpm_vals[TCP_METRIC_RTT] = msval * USEC_PER_MSEC;
+
+        msval = dst_metric_raw(dst, RTAX_RTTVAR);
+        tm->tcpm_vals[TCP_METRIC_RTTVAR] = msval * USEC_PER_MSEC;
         tm->tcpm_vals[TCP_METRIC_SSTHRESH] = dst_metric_raw(dst, RTAX_SSTHRESH);
         tm->tcpm_vals[TCP_METRIC_CWND] = dst_metric_raw(dst, RTAX_CWND);
         tm->tcpm_vals[TCP_METRIC_REORDERING] = dst_metric_raw(dst, RTAX_REORDERING);
@@ -384,7 +381,7 @@ void tcp_update_metrics(struct sock *sk)
                 dst_confirm(dst);
 
         rcu_read_lock();
-        if (icsk->icsk_backoff || !tp->srtt) {
+        if (icsk->icsk_backoff || !tp->srtt_us) {
                 /* This session failed to estimate rtt. Why?
                  * Probably, no packets returned in time.  Reset our
                  * results.
@@ -399,8 +396,8 @@ void tcp_update_metrics(struct sock *sk)
         if (!tm)
                 goto out_unlock;
 
-        rtt = tcp_metric_get_jiffies(tm, TCP_METRIC_RTT);
-        m = rtt - tp->srtt;
+        rtt = tcp_metric_get(tm, TCP_METRIC_RTT);
+        m = rtt - tp->srtt_us;
 
         /* If newly calculated rtt larger than stored one, store new
          * one. Otherwise, use EWMA. Remember, rtt overestimation is
@@ -408,10 +405,10 @@ void tcp_update_metrics(struct sock *sk)
          */
         if (!tcp_metric_locked(tm, TCP_METRIC_RTT)) {
                 if (m <= 0)
-                        rtt = tp->srtt;
+                        rtt = tp->srtt_us;
                 else
                         rtt -= (m >> 3);
-                tcp_metric_set_msecs(tm, TCP_METRIC_RTT, rtt);
+                tcp_metric_set(tm, TCP_METRIC_RTT, rtt);
         }
 
         if (!tcp_metric_locked(tm, TCP_METRIC_RTTVAR)) {
@@ -422,16 +419,16 @@ void tcp_update_metrics(struct sock *sk)
 
                 /* Scale deviation to rttvar fixed point */
                 m >>= 1;
-                if (m < tp->mdev)
-                        m = tp->mdev;
+                if (m < tp->mdev_us)
+                        m = tp->mdev_us;
 
-                var = tcp_metric_get_jiffies(tm, TCP_METRIC_RTTVAR);
+                var = tcp_metric_get(tm, TCP_METRIC_RTTVAR);
                 if (m >= var)
                         var = m;
                 else
                         var -= (var - m) >> 2;
 
-                tcp_metric_set_msecs(tm, TCP_METRIC_RTTVAR, var);
+                tcp_metric_set(tm, TCP_METRIC_RTTVAR, var);
         }
 
         if (tcp_in_initial_slowstart(tp)) {
@@ -528,7 +525,7 @@ void tcp_init_metrics(struct sock *sk)
                 tp->reordering = val;
         }
 
-        crtt = tcp_metric_get_jiffies(tm, TCP_METRIC_RTT);
+        crtt = tcp_metric_get(tm, TCP_METRIC_RTT);
         rcu_read_unlock();
 reset:
         /* The initial RTT measurement from the SYN/SYN-ACK is not ideal
@@ -551,18 +548,20 @@ reset:
          * to low value, and then abruptly stops to do it and starts to delay
          * ACKs, wait for troubles.
          */
-        if (crtt > tp->srtt) {
+        if (crtt > tp->srtt_us) {
                 /* Set RTO like tcp_rtt_estimator(), but from cached RTT. */
-                crtt >>= 3;
+                crtt /= 8 * USEC_PER_MSEC;
                 inet_csk(sk)->icsk_rto = crtt + max(2 * crtt, tcp_rto_min(sk));
-        } else if (tp->srtt == 0) {
+        } else if (tp->srtt_us == 0) {
                 /* RFC6298: 5.7 We've failed to get a valid RTT sample from
                  * 3WHS. This is most likely due to retransmission,
                  * including spurious one. Reset the RTO back to 3secs
                  * from the more aggressive 1sec to avoid more spurious
                  * retransmission.
                  */
-                tp->mdev = tp->mdev_max = tp->rttvar = TCP_TIMEOUT_FALLBACK;
+                tp->rttvar_us = jiffies_to_usecs(TCP_TIMEOUT_FALLBACK);
+                tp->mdev_us = tp->mdev_max_us = tp->rttvar_us;
+
                 inet_csk(sk)->icsk_rto = TCP_TIMEOUT_FALLBACK;
         }
         /* Cut cwnd down to 1 per RFC5681 if SYN or SYN-ACK has been
@@ -809,10 +808,26 @@ static int tcp_metrics_fill_info(struct sk_buff *msg,
                 nest = nla_nest_start(msg, TCP_METRICS_ATTR_VALS);
                 if (!nest)
                         goto nla_put_failure;
-                for (i = 0; i < TCP_METRIC_MAX + 1; i++) {
-                        if (!tm->tcpm_vals[i])
+                for (i = 0; i < TCP_METRIC_MAX_KERNEL + 1; i++) {
+                        u32 val = tm->tcpm_vals[i];
+
+                        if (!val)
                                 continue;
-                        if (nla_put_u32(msg, i + 1, tm->tcpm_vals[i]) < 0)
+                        if (i == TCP_METRIC_RTT) {
+                                if (nla_put_u32(msg, TCP_METRIC_RTT_US + 1,
+                                                val) < 0)
+                                        goto nla_put_failure;
+                                n++;
+                                val = max(val / 1000, 1U);
+                        }
+                        if (i == TCP_METRIC_RTTVAR) {
+                                if (nla_put_u32(msg, TCP_METRIC_RTTVAR_US + 1,
+                                                val) < 0)
+                                        goto nla_put_failure;
+                                n++;
+                                val = max(val / 1000, 1U);
+                        }
+                        if (nla_put_u32(msg, i + 1, val) < 0)
                                 goto nla_put_failure;
                         n++;
                 }
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 7a436c517e44..05c1b155251d 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -398,8 +398,8 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
 
                 tcp_init_wl(newtp, treq->rcv_isn);
 
-                newtp->srtt = 0;
-                newtp->mdev = TCP_TIMEOUT_INIT;
+                newtp->srtt_us = 0;
+                newtp->mdev_us = jiffies_to_usecs(TCP_TIMEOUT_INIT);
                 newicsk->icsk_rto = TCP_TIMEOUT_INIT;
 
                 newtp->packets_out = 0;
@@ -745,7 +745,7 @@ int tcp_child_process(struct sock *parent, struct sock *child,
                                             skb->len);
                 /* Wakeup parent, send SIGIO */
                 if (state == TCP_SYN_RECV && child->sk_state != state)
-                        parent->sk_data_ready(parent, 0);
+                        parent->sk_data_ready(parent);
         } else {
                 /* Alas, it is possible again, because we do lookup
                  * in main socket hash table and lock on listening
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 17a11e65e57f..025e25093984 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -86,6 +86,9 @@ static void tcp_event_new_data_sent(struct sock *sk, const struct sk_buff *skb)
             icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
                 tcp_rearm_rto(sk);
         }
+
+        NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPORIGDATASENT,
+                      tcp_skb_pcount(skb));
 }
 
 /* SND.NXT, if window was not shrunk.
@@ -269,6 +272,7 @@ EXPORT_SYMBOL(tcp_select_initial_window);
 static u16 tcp_select_window(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
+        u32 old_win = tp->rcv_wnd;
         u32 cur_win = tcp_receive_window(tp);
         u32 new_win = __tcp_select_window(sk);
 
@@ -281,6 +285,9 @@ static u16 tcp_select_window(struct sock *sk)
                  *
                  * Relax Will Robinson.
                  */
+                if (new_win == 0)
+                        NET_INC_STATS(sock_net(sk),
+                                      LINUX_MIB_TCPWANTZEROWINDOWADV);
                 new_win = ALIGN(cur_win, 1 << tp->rx_opt.rcv_wscale);
         }
         tp->rcv_wnd = new_win;
@@ -298,8 +305,14 @@ static u16 tcp_select_window(struct sock *sk)
         new_win >>= tp->rx_opt.rcv_wscale;
 
         /* If we advertise zero window, disable fast path. */
-        if (new_win == 0)
+        if (new_win == 0) {
                 tp->pred_flags = 0;
+                if (old_win)
+                        NET_INC_STATS(sock_net(sk),
+                                      LINUX_MIB_TCPTOZEROWINDOWADV);
+        } else if (old_win == 0) {
+                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFROMZEROWINDOWADV);
+        }
 
         return new_win;
 }
@@ -867,11 +880,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         if (clone_it) {
                 const struct sk_buff *fclone = skb + 1;
 
-                /* If congestion control is doing timestamping, we must
-                 * take such a timestamp before we potentially clone/copy.
-                 */
-                if (icsk->icsk_ca_ops->flags & TCP_CONG_RTT_STAMP)
-                        __net_timestamp(skb);
+                skb_mstamp_get(&skb->skb_mstamp);
 
                 if (unlikely(skb->fclone == SKB_FCLONE_ORIG &&
                              fclone->fclone == SKB_FCLONE_CLONE))
@@ -884,6 +893,8 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
                         skb = skb_clone(skb, gfp_mask);
                 if (unlikely(!skb))
                         return -ENOBUFS;
+                /* Our usage of tstamp should remain private */
+                skb->tstamp.tv64 = 0;
         }
 
         inet = inet_sk(sk);
@@ -970,7 +981,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
                 TCP_ADD_STATS(sock_net(sk), TCP_MIB_OUTSEGS,
                               tcp_skb_pcount(skb));
 
-        err = icsk->icsk_af_ops->queue_xmit(skb, &inet->cork.fl);
+        err = icsk->icsk_af_ops->queue_xmit(sk, skb, &inet->cork.fl);
         if (likely(err <= 0))
                 return err;
 
@@ -1426,7 +1437,7 @@ static void tcp_minshall_update(struct tcp_sock *tp, unsigned int mss_now,
  *    With Minshall's modification: all sent small packets are ACKed.
  */
 static bool tcp_nagle_check(bool partial, const struct tcp_sock *tp,
-                            unsigned int mss_now, int nonagle)
+                            int nonagle)
 {
         return partial &&
                 ((nonagle & TCP_NAGLE_CORK) ||
@@ -1458,7 +1469,7 @@ static unsigned int tcp_mss_split_point(const struct sock *sk,
          * to include this last segment in this skb.
          * Otherwise, we'll split the skb at last MSS boundary
          */
-        if (tcp_nagle_check(partial != 0, tp, mss_now, nonagle))
+        if (tcp_nagle_check(partial != 0, tp, nonagle))
                 return needed - partial;
 
         return needed;
@@ -1521,7 +1532,7 @@ static inline bool tcp_nagle_test(const struct tcp_sock *tp, const struct sk_buf
         if (tcp_urg_mode(tp) || (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN))
                 return true;
 
-        if (!tcp_nagle_check(skb->len < cur_mss, tp, cur_mss, nonagle))
+        if (!tcp_nagle_check(skb->len < cur_mss, tp, nonagle))
                 return true;
 
         return false;
@@ -1975,7 +1986,7 @@ bool tcp_schedule_loss_probe(struct sock *sk)
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         u32 timeout, tlp_time_stamp, rto_time_stamp;
-        u32 rtt = tp->srtt >> 3;
+        u32 rtt = usecs_to_jiffies(tp->srtt_us >> 3);
 
         if (WARN_ON(icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS))
                 return false;
@@ -1997,7 +2008,7 @@ bool tcp_schedule_loss_probe(struct sock *sk)
         /* Schedule a loss probe in 2*RTT for SACK capable connections
          * in Open state, that are either limited by cwnd or application.
          */
-        if (sysctl_tcp_early_retrans < 3 || !tp->srtt || !tp->packets_out ||
+        if (sysctl_tcp_early_retrans < 3 || !tp->srtt_us || !tp->packets_out ||
             !tcp_is_sack(tp) || inet_csk(sk)->icsk_ca_state != TCP_CA_Open)
                 return false;
 
@@ -2082,7 +2093,6 @@ rearm_timer:
         if (likely(!err))
                 NET_INC_STATS_BH(sock_net(sk),
                                  LINUX_MIB_TCPLOSSPROBES);
-        return;
 }
 
 /* Push out any pending frames which were held back due to
@@ -2180,7 +2190,8 @@ u32 __tcp_select_window(struct sock *sk)
          */
         int mss = icsk->icsk_ack.rcv_mss;
         int free_space = tcp_space(sk);
-        int full_space = min_t(int, tp->window_clamp, tcp_full_space(sk));
+        int allowed_space = tcp_full_space(sk);
+        int full_space = min_t(int, tp->window_clamp, allowed_space);
         int window;
 
         if (mss > full_space)
@@ -2193,7 +2204,19 @@ u32 __tcp_select_window(struct sock *sk)
                         tp->rcv_ssthresh = min(tp->rcv_ssthresh,
                                                4U * tp->advmss);
 
-                if (free_space < mss)
+                /* free_space might become our new window, make sure we don't
+                 * increase it due to wscale.
+                 */
+                free_space = round_down(free_space, 1 << tp->rx_opt.rcv_wscale);
+
+                /* if free space is less than mss estimate, or is below 1/16th
+                 * of the maximum allowed, try to move to zero-window, else
+                 * tcp_clamp_window() will grow rcv buf up to tcp_rmem[2], and
+                 * new incoming data is dropped due to memory limits.
+                 * With large window, mss test triggers way too late in order
+                 * to announce zero window in time before rmem limit kicks in.
+                 */
+                if (free_space < (allowed_space >> 4) || free_space < mss)
                         return 0;
         }
 
@@ -2431,7 +2454,8 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
         if (err == 0) {
                 /* Update global TCP statistics. */
                 TCP_INC_STATS(sock_net(sk), TCP_MIB_RETRANSSEGS);
-
+                if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)
+                        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
                 tp->total_retrans++;
 
 #if FASTRETRANS_DEBUG > 0
@@ -2717,7 +2741,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         int tcp_header_size;
         int mss;
 
-        skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
+        skb = sock_wmalloc(sk, MAX_TCP_HEADER, 1, GFP_ATOMIC);
         if (unlikely(!skb)) {
                 dst_release(dst);
                 return NULL;
@@ -2787,7 +2811,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         th->window = htons(min(req->rcv_wnd, 65535U));
         tcp_options_write((__be32 *)(th + 1), tp, &opts);
         th->doff = (tcp_header_size >> 2);
-        TCP_ADD_STATS(sock_net(sk), TCP_MIB_OUTSEGS, tcp_skb_pcount(skb));
+        TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_OUTSEGS);
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Okay, we have all we need - do the md5 hash if needed */
@@ -2959,9 +2983,15 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
         tcp_connect_queue_skb(sk, data);
         fo->copied = data->len;
 
+        /* syn_data is about to be sent, we need to take current time stamps
+         * for the packets that are in write queue : SYN packet and DATA
+         */
+        skb_mstamp_get(&syn->skb_mstamp);
+        data->skb_mstamp = syn->skb_mstamp;
+
         if (tcp_transmit_skb(sk, syn_data, 0, sk->sk_allocation) == 0) {
                 tp->syn_data = (fo->copied > 0);
-                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENACTIVE);
+                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPORIGDATASENT);
                 goto done;
         }
         syn_data = NULL;
@@ -3049,8 +3079,9 @@ void tcp_send_delayed_ack(struct sock *sk)
                  * Do not use inet_csk(sk)->icsk_rto here, use results of rtt measurements
                  * directly.
                  */
-                if (tp->srtt) {
-                        int rtt = max(tp->srtt >> 3, TCP_DELACK_MIN);
+                if (tp->srtt_us) {
+                        int rtt = max_t(int, usecs_to_jiffies(tp->srtt_us >> 3),
+                                        TCP_DELACK_MIN);
 
                         if (rtt < max_ato)
                                 max_ato = rtt;
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 1f2d37613c9e..3b66610d4156 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -154,7 +154,7 @@ static void jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                         p->snd_wnd = tp->snd_wnd;
                         p->rcv_wnd = tp->rcv_wnd;
                         p->ssthresh = tcp_current_ssthresh(sk);
-                        p->srtt = tp->srtt >> 3;
+                        p->srtt = tp->srtt_us >> 3;
 
                         tcp_probe.head = (tcp_probe.head + 1) & (bufsize - 1);
                 }
diff --git a/net/ipv4/tcp_scalable.c b/net/ipv4/tcp_scalable.c
index 19ea6c2951f3..0ac50836da4d 100644
--- a/net/ipv4/tcp_scalable.c
+++ b/net/ipv4/tcp_scalable.c
@@ -39,7 +39,6 @@ static u32 tcp_scalable_ssthresh(struct sock *sk)
 static struct tcp_congestion_ops tcp_scalable __read_mostly = {
         .ssthresh       = tcp_scalable_ssthresh,
         .cong_avoid     = tcp_scalable_cong_avoid,
-        .min_cwnd       = tcp_reno_min_cwnd,
 
         .owner          = THIS_MODULE,
         .name           = "scalable",
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 64f0354c84c7..286227abed10 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -165,6 +165,9 @@ static int tcp_write_timeout(struct sock *sk)
                         dst_negative_advice(sk);
                         if (tp->syn_fastopen || tp->syn_data)
                                 tcp_fastopen_cache_set(sk, 0, NULL, true);
+                        if (tp->syn_data)
+                                NET_INC_STATS_BH(sock_net(sk),
+                                                 LINUX_MIB_TCPFASTOPENACTIVEFAIL);
                 }
                 retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
                 syn_set = true;
diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
index 06cae62bf208..48539fff6357 100644
--- a/net/ipv4/tcp_vegas.c
+++ b/net/ipv4/tcp_vegas.c
@@ -306,11 +306,9 @@ void tcp_vegas_get_info(struct sock *sk, u32 ext, struct sk_buff *skb)
 EXPORT_SYMBOL_GPL(tcp_vegas_get_info);
 
 static struct tcp_congestion_ops tcp_vegas __read_mostly = {
-        .flags          = TCP_CONG_RTT_STAMP,
         .init           = tcp_vegas_init,
         .ssthresh       = tcp_reno_ssthresh,
         .cong_avoid     = tcp_vegas_cong_avoid,
-        .min_cwnd       = tcp_reno_min_cwnd,
         .pkts_acked     = tcp_vegas_pkts_acked,
         .set_state      = tcp_vegas_state,
         .cwnd_event     = tcp_vegas_cwnd_event,
diff --git a/net/ipv4/tcp_veno.c b/net/ipv4/tcp_veno.c
index 326475a94865..1b8e28fcd7e1 100644
--- a/net/ipv4/tcp_veno.c
+++ b/net/ipv4/tcp_veno.c
@@ -203,7 +203,6 @@ static u32 tcp_veno_ssthresh(struct sock *sk)
 }
 
 static struct tcp_congestion_ops tcp_veno __read_mostly = {
-        .flags          = TCP_CONG_RTT_STAMP,
         .init           = tcp_veno_init,
         .ssthresh       = tcp_veno_ssthresh,
         .cong_avoid     = tcp_veno_cong_avoid,
diff --git a/net/ipv4/tcp_westwood.c b/net/ipv4/tcp_westwood.c
index 76a1e23259e1..b94a04ae2ed5 100644
--- a/net/ipv4/tcp_westwood.c
+++ b/net/ipv4/tcp_westwood.c
@@ -276,7 +276,6 @@ static struct tcp_congestion_ops tcp_westwood __read_mostly = {
         .init           = tcp_westwood_init,
         .ssthresh       = tcp_reno_ssthresh,
         .cong_avoid     = tcp_reno_cong_avoid,
-        .min_cwnd       = tcp_westwood_bw_rttmin,
         .cwnd_event     = tcp_westwood_event,
         .get_info       = tcp_westwood_info,
         .pkts_acked     = tcp_westwood_pkts_acked,
diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c
index 1a8d271f994d..5ede0e727945 100644
--- a/net/ipv4/tcp_yeah.c
+++ b/net/ipv4/tcp_yeah.c
@@ -227,11 +227,9 @@ static u32 tcp_yeah_ssthresh(struct sock *sk) {
 }
 
 static struct tcp_congestion_ops tcp_yeah __read_mostly = {
-        .flags          = TCP_CONG_RTT_STAMP,
         .init           = tcp_yeah_init,
         .ssthresh       = tcp_yeah_ssthresh,
         .cong_avoid     = tcp_yeah_cong_avoid,
-        .min_cwnd       = tcp_reno_min_cwnd,
         .set_state      = tcp_vegas_state,
         .cwnd_event     = tcp_vegas_cwnd_event,
         .get_info       = tcp_vegas_get_info,
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 77bd16fa9f34..4468e1adc094 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -931,7 +931,8 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         sock_tx_timestamp(sk, &ipc.tx_flags);
 
         if (msg->msg_controllen) {
-                err = ip_cmsg_send(sock_net(sk), msg, &ipc);
+                err = ip_cmsg_send(sock_net(sk), msg, &ipc,
+                                   sk->sk_family == AF_INET6);
                 if (err)
                         return err;
                 if (ipc.opt)
diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index 1f12c8b45864..aac6197b7a71 100644
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -37,15 +37,6 @@ drop:
         return NET_RX_DROP;
 }
 
-int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
-                    int encap_type)
-{
-        XFRM_SPI_SKB_CB(skb)->family = AF_INET;
-        XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
-        return xfrm_input(skb, nexthdr, spi, encap_type);
-}
-EXPORT_SYMBOL(xfrm4_rcv_encap);
-
 int xfrm4_transport_finish(struct sk_buff *skb, int async)
 {
         struct iphdr *iph = ip_hdr(skb);
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 31b18152528f..05f2b484954f 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -15,65 +15,6 @@
 #include <net/ip.h>
 #include <net/xfrm.h>
 
-/* Informational hook. The decap is still done here. */
-static struct xfrm_tunnel_notifier __rcu *rcv_notify_handlers __read_mostly;
-static DEFINE_MUTEX(xfrm4_mode_tunnel_input_mutex);
-
-int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel_notifier *handler)
-{
-        struct xfrm_tunnel_notifier __rcu **pprev;
-        struct xfrm_tunnel_notifier *t;
-        int ret = -EEXIST;
-        int priority = handler->priority;
-
-        mutex_lock(&xfrm4_mode_tunnel_input_mutex);
-
-        for (pprev = &rcv_notify_handlers;
-             (t = rcu_dereference_protected(*pprev,
-             lockdep_is_held(&xfrm4_mode_tunnel_input_mutex))) != NULL;
-             pprev = &t->next) {
-                if (t->priority > priority)
-                        break;
-                if (t->priority == priority)
-                        goto err;
-
-        }
-
-        handler->next = *pprev;
-        rcu_assign_pointer(*pprev, handler);
-
-        ret = 0;
-
-err:
-        mutex_unlock(&xfrm4_mode_tunnel_input_mutex);
-        return ret;
-}
-EXPORT_SYMBOL_GPL(xfrm4_mode_tunnel_input_register);
-
-int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel_notifier *handler)
-{
-        struct xfrm_tunnel_notifier __rcu **pprev;
-        struct xfrm_tunnel_notifier *t;
-        int ret = -ENOENT;
-
-        mutex_lock(&xfrm4_mode_tunnel_input_mutex);
-        for (pprev = &rcv_notify_handlers;
-             (t = rcu_dereference_protected(*pprev,
-             lockdep_is_held(&xfrm4_mode_tunnel_input_mutex))) != NULL;
-             pprev = &t->next) {
-                if (t == handler) {
-                        *pprev = handler->next;
-                        ret = 0;
-                        break;
-                }
-        }
-        mutex_unlock(&xfrm4_mode_tunnel_input_mutex);
-        synchronize_net();
-
-        return ret;
-}
-EXPORT_SYMBOL_GPL(xfrm4_mode_tunnel_input_deregister);
-
 static inline void ipip_ecn_decapsulate(struct sk_buff *skb)
 {
         struct iphdr *inner_iph = ipip_hdr(skb);
@@ -127,14 +68,8 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
         return 0;
 }
 
-#define for_each_input_rcu(head, handler)       \
-        for (handler = rcu_dereference(head);   \
-             handler != NULL;                   \
-             handler = rcu_dereference(handler->next))
-
 static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
-        struct xfrm_tunnel_notifier *handler;
         int err = -EINVAL;
 
         if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP)
@@ -143,9 +78,6 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!pskb_may_pull(skb, sizeof(struct iphdr)))
                 goto out;
 
-        for_each_input_rcu(rcv_notify_handlers, handler)
-                handler->handler(skb);
-
         err = skb_unclone(skb, GFP_ATOMIC);
         if (err)
                 goto out;
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index baa0f63731fd..40e701f2e1e0 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -86,7 +86,7 @@ int xfrm4_output_finish(struct sk_buff *skb)
         return xfrm_output(skb);
 }
 
-int xfrm4_output(struct sk_buff *skb)
+int xfrm4_output(struct sock *sk, struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
         struct xfrm_state *x = dst->xfrm;
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index e1a63930a967..6156f68a1e90 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -325,6 +325,7 @@ void __init xfrm4_init(void)
 
         xfrm4_state_init();
         xfrm4_policy_init();
+        xfrm4_protocol_init();
 #ifdef CONFIG_SYSCTL
         register_pernet_subsys(&xfrm4_net_ops);
 #endif
diff --git a/net/ipv4/xfrm4_protocol.c b/net/ipv4/xfrm4_protocol.c
new file mode 100644
index 000000000000..7f7b243e8139
--- /dev/null
+++ b/net/ipv4/xfrm4_protocol.c
@@ -0,0 +1,286 @@
+/* xfrm4_protocol.c - Generic xfrm protocol multiplexer.
+ *
+ * Copyright (C) 2013 secunet Security Networks AG
+ *
+ * Author:
+ * Steffen Klassert <steffen.klassert@secunet.com>
+ *
+ * Based on:
+ * net/ipv4/tunnel4.c
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/init.h>
+#include <linux/mutex.h>
+#include <linux/skbuff.h>
+#include <net/icmp.h>
+#include <net/ip.h>
+#include <net/protocol.h>
+#include <net/xfrm.h>
+
+static struct xfrm4_protocol __rcu *esp4_handlers __read_mostly;
+static struct xfrm4_protocol __rcu *ah4_handlers __read_mostly;
+static struct xfrm4_protocol __rcu *ipcomp4_handlers __read_mostly;
+static DEFINE_MUTEX(xfrm4_protocol_mutex);
+
+static inline struct xfrm4_protocol __rcu **proto_handlers(u8 protocol)
+{
+        switch (protocol) {
+        case IPPROTO_ESP:
+                return &esp4_handlers;
+        case IPPROTO_AH:
+                return &ah4_handlers;
+        case IPPROTO_COMP:
+                return &ipcomp4_handlers;
+        }
+
+        return NULL;
+}
+
+#define for_each_protocol_rcu(head, handler)            \
+        for (handler = rcu_dereference(head);           \
+             handler != NULL;                           \
+             handler = rcu_dereference(handler->next))  \
+
+int xfrm4_rcv_cb(struct sk_buff *skb, u8 protocol, int err)
+{
+        int ret;
+        struct xfrm4_protocol *handler;
+
+        for_each_protocol_rcu(*proto_handlers(protocol), handler)
+                if ((ret = handler->cb_handler(skb, err)) <= 0)
+                        return ret;
+
+        return 0;
+}
+EXPORT_SYMBOL(xfrm4_rcv_cb);
+
+int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
+                    int encap_type)
+{
+        int ret;
+        struct xfrm4_protocol *handler;
+
+        XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
+        XFRM_SPI_SKB_CB(skb)->family = AF_INET;
+        XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
+
+        for_each_protocol_rcu(*proto_handlers(nexthdr), handler)
+                if ((ret = handler->input_handler(skb, nexthdr, spi, encap_type)) != -EINVAL)
+                        return ret;
+
+        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+
+        kfree_skb(skb);
+        return 0;
+}
+EXPORT_SYMBOL(xfrm4_rcv_encap);
+
+static int xfrm4_esp_rcv(struct sk_buff *skb)
+{
+        int ret;
+        struct xfrm4_protocol *handler;
+
+        XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
+
+        for_each_protocol_rcu(esp4_handlers, handler)
+                if ((ret = handler->handler(skb)) != -EINVAL)
+                        return ret;
+
+        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+
+        kfree_skb(skb);
+        return 0;
+}
+
+static void xfrm4_esp_err(struct sk_buff *skb, u32 info)
+{
+        struct xfrm4_protocol *handler;
+
+        for_each_protocol_rcu(esp4_handlers, handler)
+                if (!handler->err_handler(skb, info))
+                        break;
+}
+
+static int xfrm4_ah_rcv(struct sk_buff *skb)
+{
+        int ret;
+        struct xfrm4_protocol *handler;
+
+        XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
+
+        for_each_protocol_rcu(ah4_handlers, handler)
+                if ((ret = handler->handler(skb)) != -EINVAL)
+                        return ret;;
+
+        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+
+        kfree_skb(skb);
+        return 0;
+}
+
+static void xfrm4_ah_err(struct sk_buff *skb, u32 info)
+{
+        struct xfrm4_protocol *handler;
+
+        for_each_protocol_rcu(ah4_handlers, handler)
+                if (!handler->err_handler(skb, info))
+                        break;
+}
+
+static int xfrm4_ipcomp_rcv(struct sk_buff *skb)
+{
+        int ret;
+        struct xfrm4_protocol *handler;
+
+        XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
+
+        for_each_protocol_rcu(ipcomp4_handlers, handler)
+                if ((ret = handler->handler(skb)) != -EINVAL)
+                        return ret;
+
+        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+
+        kfree_skb(skb);
+        return 0;
+}
+
+static void xfrm4_ipcomp_err(struct sk_buff *skb, u32 info)
+{
+        struct xfrm4_protocol *handler;
+
+        for_each_protocol_rcu(ipcomp4_handlers, handler)
+                if (!handler->err_handler(skb, info))
+                        break;
+}
+
+static const struct net_protocol esp4_protocol = {
+        .handler        =       xfrm4_esp_rcv,
+        .err_handler    =       xfrm4_esp_err,
+        .no_policy      =       1,
+        .netns_ok       =       1,
+};
+
+static const struct net_protocol ah4_protocol = {
+        .handler        =       xfrm4_ah_rcv,
+        .err_handler    =       xfrm4_ah_err,
+        .no_policy      =       1,
+        .netns_ok       =       1,
+};
+
+static const struct net_protocol ipcomp4_protocol = {
+        .handler        =       xfrm4_ipcomp_rcv,
+        .err_handler    =       xfrm4_ipcomp_err,
+        .no_policy      =       1,
+        .netns_ok       =       1,
+};
+
+static struct xfrm_input_afinfo xfrm4_input_afinfo = {
+        .family         =       AF_INET,
+        .owner          =       THIS_MODULE,
+        .callback       =       xfrm4_rcv_cb,
+};
+
+static inline const struct net_protocol *netproto(unsigned char protocol)
+{
+        switch (protocol) {
+        case IPPROTO_ESP:
+                return &esp4_protocol;
+        case IPPROTO_AH:
+                return &ah4_protocol;
+        case IPPROTO_COMP:
+                return &ipcomp4_protocol;
+        }
+
+        return NULL;
+}
+
+int xfrm4_protocol_register(struct xfrm4_protocol *handler,
+                            unsigned char protocol)
+{
+        struct xfrm4_protocol __rcu **pprev;
+        struct xfrm4_protocol *t;
+        bool add_netproto = false;
+        int ret = -EEXIST;
+        int priority = handler->priority;
+
+        mutex_lock(&xfrm4_protocol_mutex);
+
+        if (!rcu_dereference_protected(*proto_handlers(protocol),
+                                       lockdep_is_held(&xfrm4_protocol_mutex)))
+                add_netproto = true;
+
+        for (pprev = proto_handlers(protocol);
+             (t = rcu_dereference_protected(*pprev,
+                        lockdep_is_held(&xfrm4_protocol_mutex))) != NULL;
+             pprev = &t->next) {
+                if (t->priority < priority)
+                        break;
+                if (t->priority == priority)
+                        goto err;
+        }
+
+        handler->next = *pprev;
+        rcu_assign_pointer(*pprev, handler);
+
+        ret = 0;
+
+err:
+        mutex_unlock(&xfrm4_protocol_mutex);
+
+        if (add_netproto) {
+                if (inet_add_protocol(netproto(protocol), protocol)) {
+                        pr_err("%s: can't add protocol\n", __func__);
+                        ret = -EAGAIN;
+                }
+        }
+
+        return ret;
+}
+EXPORT_SYMBOL(xfrm4_protocol_register);
+
+int xfrm4_protocol_deregister(struct xfrm4_protocol *handler,
+                              unsigned char protocol)
+{
+        struct xfrm4_protocol __rcu **pprev;
+        struct xfrm4_protocol *t;
+        int ret = -ENOENT;
+
+        mutex_lock(&xfrm4_protocol_mutex);
+
+        for (pprev = proto_handlers(protocol);
+             (t = rcu_dereference_protected(*pprev,
+                        lockdep_is_held(&xfrm4_protocol_mutex))) != NULL;
+             pprev = &t->next) {
+                if (t == handler) {
+                        *pprev = handler->next;
+                        ret = 0;
+                        break;
+                }
+        }
+
+        if (!rcu_dereference_protected(*proto_handlers(protocol),
+                                       lockdep_is_held(&xfrm4_protocol_mutex))) {
+                if (inet_del_protocol(netproto(protocol), protocol) < 0) {
+                        pr_err("%s: can't remove protocol\n", __func__);
+                        ret = -EAGAIN;
+                }
+        }
+
+        mutex_unlock(&xfrm4_protocol_mutex);
+
+        synchronize_net();
+
+        return ret;
+}
+EXPORT_SYMBOL(xfrm4_protocol_deregister);
+
+void __init xfrm4_protocol_init(void)
+{
+        xfrm_input_register_afinfo(&xfrm4_input_afinfo);
+}
+EXPORT_SYMBOL(xfrm4_protocol_init);
diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile
index 17bb830872db..2fe68364bb20 100644
--- a/net/ipv6/Makefile
+++ b/net/ipv6/Makefile
@@ -16,7 +16,7 @@ ipv6-$(CONFIG_SYSCTL) = sysctl_net_ipv6.o
 ipv6-$(CONFIG_IPV6_MROUTE) += ip6mr.o
 
 ipv6-$(CONFIG_XFRM) += xfrm6_policy.o xfrm6_state.o xfrm6_input.o \
-        xfrm6_output.o
+        xfrm6_output.o xfrm6_protocol.o
 ipv6-$(CONFIG_NETFILTER) += netfilter.o
 ipv6-$(CONFIG_IPV6_MULTIPLE_TABLES) += fib6_rules.o
 ipv6-$(CONFIG_PROC_FS) += proc.o
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index b30ad3741b46..731e1e1722d9 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -6,7 +6,7 @@
  */
 /*
  * Author:
- *      YOSHIFUJI Hideaki @ USAGI/WIDE Project <yoshfuji@linux-ipv6.org>
+ *      YOSHIFUJI Hideaki @ USAGI/WIDE Project <yoshfuji@linux-ipv6.org>
  */
 
 #include <linux/kernel.h>
@@ -22,14 +22,13 @@
 #if 0
 #define ADDRLABEL(x...) printk(x)
 #else
-#define ADDRLABEL(x...) do { ; } while(0)
+#define ADDRLABEL(x...) do { ; } while (0)
 #endif
 
 /*
  * Policy Table
  */
-struct ip6addrlbl_entry
-{
+struct ip6addrlbl_entry {
 #ifdef CONFIG_NET_NS
         struct net *lbl_net;
 #endif
@@ -88,39 +87,39 @@ static const __net_initconst struct ip6addrlbl_init_table
         {       /* ::/0 */
                 .prefix = &in6addr_any,
                 .label = 1,
-        },{     /* fc00::/7 */
-                .prefix = &(struct in6_addr){{{ 0xfc }}},
+        }, {    /* fc00::/7 */
+                .prefix = &(struct in6_addr){ { { 0xfc } } } ,
                 .prefixlen = 7,
                 .label = 5,
-        },{     /* fec0::/10 */
-                .prefix = &(struct in6_addr){{{ 0xfe, 0xc0 }}},
+        }, {    /* fec0::/10 */
+                .prefix = &(struct in6_addr){ { { 0xfe, 0xc0 } } },
                 .prefixlen = 10,
                 .label = 11,
-        },{     /* 2002::/16 */
-                .prefix = &(struct in6_addr){{{ 0x20, 0x02 }}},
+        }, {    /* 2002::/16 */
+                .prefix = &(struct in6_addr){ { { 0x20, 0x02 } } },
                 .prefixlen = 16,
                 .label = 2,
-        },{     /* 3ffe::/16 */
-                .prefix = &(struct in6_addr){{{ 0x3f, 0xfe }}},
+        }, {    /* 3ffe::/16 */
+                .prefix = &(struct in6_addr){ { { 0x3f, 0xfe } } },
                 .prefixlen = 16,
                 .label = 12,
-        },{     /* 2001::/32 */
-                .prefix = &(struct in6_addr){{{ 0x20, 0x01 }}},
+        }, {    /* 2001::/32 */
+                .prefix = &(struct in6_addr){ { { 0x20, 0x01 } } },
                 .prefixlen = 32,
                 .label = 6,
-        },{     /* 2001:10::/28 */
-                .prefix = &(struct in6_addr){{{ 0x20, 0x01, 0x00, 0x10 }}},
+        }, {    /* 2001:10::/28 */
+                .prefix = &(struct in6_addr){ { { 0x20, 0x01, 0x00, 0x10 } } },
                 .prefixlen = 28,
                 .label = 7,
-        },{     /* ::ffff:0:0 */
-                .prefix = &(struct in6_addr){{{ [10] = 0xff, [11] = 0xff }}},
+        }, {    /* ::ffff:0:0 */
+                .prefix = &(struct in6_addr){ { { [10] = 0xff, [11] = 0xff } } },
                 .prefixlen = 96,
                 .label = 4,
-        },{     /* ::/96 */
+        }, {    /* ::/96 */
                 .prefix = &in6addr_any,
                 .prefixlen = 96,
                 .label = 3,
-        },{     /* ::1/128 */
+        }, {    /* ::1/128 */
                 .prefix = &in6addr_loopback,
                 .prefixlen = 128,
                 .label = 0,
@@ -441,7 +440,7 @@ static int ip6addrlbl_newdel(struct sk_buff *skb, struct nlmsghdr *nlh)
         if (label == IPV6_ADDR_LABEL_DEFAULT)
                 return -EINVAL;
 
-        switch(nlh->nlmsg_type) {
+        switch (nlh->nlmsg_type) {
         case RTM_NEWADDRLABEL:
                 if (ifal->ifal_index &&
                     !__dev_get_by_index(net, ifal->ifal_index))
@@ -505,12 +504,13 @@ static int ip6addrlbl_dump(struct sk_buff *skb, struct netlink_callback *cb)
         hlist_for_each_entry_rcu(p, &ip6addrlbl_table.head, list) {
                 if (idx >= s_idx &&
                     net_eq(ip6addrlbl_net(p), net)) {
-                        if ((err = ip6addrlbl_fill(skb, p,
-                                                   ip6addrlbl_table.seq,
-                                                   NETLINK_CB(cb->skb).portid,
-                                                   cb->nlh->nlmsg_seq,
-                                                   RTM_NEWADDRLABEL,
-                                                   NLM_F_MULTI)) <= 0)
+                        err = ip6addrlbl_fill(skb, p,
+                                              ip6addrlbl_table.seq,
+                                              NETLINK_CB(cb->skb).portid,
+                                              cb->nlh->nlmsg_seq,
+                                              RTM_NEWADDRLABEL,
+                                              NLM_F_MULTI);
+                        if (err <= 0)
                                 break;
                 }
                 idx++;
@@ -527,7 +527,7 @@ static inline int ip6addrlbl_msgsize(void)
                 + nla_total_size(4);    /* IFAL_LABEL */
 }
 
-static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh)
+static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr *nlh)
 {
         struct net *net = sock_net(in_skb->sk);
         struct ifaddrlblmsg *ifal;
@@ -568,7 +568,8 @@ static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh)
                 goto out;
         }
 
-        if (!(skb = nlmsg_new(ip6addrlbl_msgsize(), GFP_KERNEL))) {
+        skb = nlmsg_new(ip6addrlbl_msgsize(), GFP_KERNEL);
+        if (!skb) {
                 ip6addrlbl_put(p);
                 return -ENOBUFS;
         }
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 81e496a2e008..72a4930bdc0a 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -346,6 +346,10 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         struct ip_auth_hdr *ah;
         struct ah_data *ahp;
         struct tmp_ext *iph_ext;
+        int seqhi_len = 0;
+        __be32 *seqhi;
+        int sglists = 0;
+        struct scatterlist *seqhisg;
 
         ahp = x->data;
         ahash = ahp->ahash;
@@ -359,15 +363,22 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         if (extlen)
                 extlen += sizeof(*iph_ext);
 
+        if (x->props.flags & XFRM_STATE_ESN) {
+                sglists = 1;
+                seqhi_len = sizeof(*seqhi);
+        }
         err = -ENOMEM;
-        iph_base = ah_alloc_tmp(ahash, nfrags, IPV6HDR_BASELEN + extlen);
+        iph_base = ah_alloc_tmp(ahash, nfrags + sglists, IPV6HDR_BASELEN +
+                                extlen + seqhi_len);
         if (!iph_base)
                 goto out;
 
         iph_ext = ah_tmp_ext(iph_base);
-        icv = ah_tmp_icv(ahash, iph_ext, extlen);
+        seqhi = (__be32 *)((char *)iph_ext + extlen);
+        icv = ah_tmp_icv(ahash, seqhi, seqhi_len);
         req = ah_tmp_req(ahash, icv);
         sg = ah_req_sg(ahash, req);
+        seqhisg = sg + nfrags;
 
         ah = ip_auth_hdr(skb);
         memset(ah->auth_data, 0, ahp->icv_trunc_len);
@@ -411,10 +422,15 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         ah->spi = x->id.spi;
         ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
 
-        sg_init_table(sg, nfrags);
-        skb_to_sgvec(skb, sg, 0, skb->len);
+        sg_init_table(sg, nfrags + sglists);
+        skb_to_sgvec_nomark(skb, sg, 0, skb->len);
 
-        ahash_request_set_crypt(req, sg, icv, skb->len);
+        if (x->props.flags & XFRM_STATE_ESN) {
+                /* Attach seqhi sg right after packet payload */
+                *seqhi = htonl(XFRM_SKB_CB(skb)->seq.output.hi);
+                sg_set_buf(seqhisg, seqhi, seqhi_len);
+        }
+        ahash_request_set_crypt(req, sg, icv, skb->len + seqhi_len);
         ahash_request_set_callback(req, 0, ah6_output_done, skb);
 
         AH_SKB_CB(skb)->tmp = iph_base;
@@ -514,6 +530,10 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
         int nexthdr;
         int nfrags;
         int err = -ENOMEM;
+        int seqhi_len = 0;
+        __be32 *seqhi;
+        int sglists = 0;
+        struct scatterlist *seqhisg;
 
         if (!pskb_may_pull(skb, sizeof(struct ip_auth_hdr)))
                 goto out;
@@ -550,14 +570,22 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb_push(skb, hdr_len);
 
-        work_iph = ah_alloc_tmp(ahash, nfrags, hdr_len + ahp->icv_trunc_len);
+        if (x->props.flags & XFRM_STATE_ESN) {
+                sglists = 1;
+                seqhi_len = sizeof(*seqhi);
+        }
+
+        work_iph = ah_alloc_tmp(ahash, nfrags + sglists, hdr_len +
+                                ahp->icv_trunc_len + seqhi_len);
         if (!work_iph)
                 goto out;
 
-        auth_data = ah_tmp_auth(work_iph, hdr_len);
-        icv = ah_tmp_icv(ahash, auth_data, ahp->icv_trunc_len);
+        auth_data = ah_tmp_auth((u8 *)work_iph, hdr_len);
+        seqhi = (__be32 *)(auth_data + ahp->icv_trunc_len);
+        icv = ah_tmp_icv(ahash, seqhi, seqhi_len);
         req = ah_tmp_req(ahash, icv);
         sg = ah_req_sg(ahash, req);
+        seqhisg = sg + nfrags;
 
         memcpy(work_iph, ip6h, hdr_len);
         memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
@@ -572,10 +600,16 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
         ip6h->flow_lbl[2] = 0;
         ip6h->hop_limit   = 0;
 
-        sg_init_table(sg, nfrags);
-        skb_to_sgvec(skb, sg, 0, skb->len);
+        sg_init_table(sg, nfrags + sglists);
+        skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+
+        if (x->props.flags & XFRM_STATE_ESN) {
+                /* Attach seqhi sg right after packet payload */
+                *seqhi = XFRM_SKB_CB(skb)->seq.input.hi;
+                sg_set_buf(seqhisg, seqhi, seqhi_len);
+        }
 
-        ahash_request_set_crypt(req, sg, icv, skb->len);
+        ahash_request_set_crypt(req, sg, icv, skb->len + seqhi_len);
         ahash_request_set_callback(req, 0, ah6_input_done, skb);
 
         AH_SKB_CB(skb)->tmp = work_iph;
@@ -609,8 +643,8 @@ out:
         return err;
 }
 
-static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                    u8 type, u8 code, int offset, __be32 info)
+static int ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+                   u8 type, u8 code, int offset, __be32 info)
 {
         struct net *net = dev_net(skb->dev);
         struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
@@ -619,17 +653,19 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
         if (type != ICMPV6_PKT_TOOBIG &&
             type != NDISC_REDIRECT)
-                return;
+                return 0;
 
         x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET6);
         if (!x)
-                return;
+                return 0;
 
         if (type == NDISC_REDIRECT)
                 ip6_redirect(skb, net, skb->dev->ifindex, 0);
         else
                 ip6_update_pmtu(skb, net, info, 0, 0);
         xfrm_state_put(x);
+
+        return 0;
 }
 
 static int ah6_init_state(struct xfrm_state *x)
@@ -714,6 +750,11 @@ static void ah6_destroy(struct xfrm_state *x)
         kfree(ahp);
 }
 
+static int ah6_rcv_cb(struct sk_buff *skb, int err)
+{
+        return 0;
+}
+
 static const struct xfrm_type ah6_type =
 {
         .description    = "AH6",
@@ -727,10 +768,11 @@ static const struct xfrm_type ah6_type =
         .hdr_offset     = xfrm6_find_1stfragopt,
 };
 
-static const struct inet6_protocol ah6_protocol = {
+static struct xfrm6_protocol ah6_protocol = {
         .handler        =       xfrm6_rcv,
+        .cb_handler     =       ah6_rcv_cb,
         .err_handler    =       ah6_err,
-        .flags          =       INET6_PROTO_NOPOLICY,
+        .priority       =       0,
 };
 
 static int __init ah6_init(void)
@@ -740,7 +782,7 @@ static int __init ah6_init(void)
                 return -EAGAIN;
         }
 
-        if (inet6_add_protocol(&ah6_protocol, IPPROTO_AH) < 0) {
+        if (xfrm6_protocol_register(&ah6_protocol, IPPROTO_AH) < 0) {
                 pr_info("%s: can't add protocol\n", __func__);
                 xfrm_unregister_type(&ah6_type, AF_INET6);
                 return -EAGAIN;
@@ -751,7 +793,7 @@ static int __init ah6_init(void)
 
 static void __exit ah6_fini(void)
 {
-        if (inet6_del_protocol(&ah6_protocol, IPPROTO_AH) < 0)
+        if (xfrm6_protocol_deregister(&ah6_protocol, IPPROTO_AH) < 0)
                 pr_info("%s: can't remove protocol\n", __func__);
 
         if (xfrm_unregister_type(&ah6_type, AF_INET6) < 0)
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 6eef8a7e35f2..d15da1377149 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -421,8 +421,8 @@ static u32 esp6_get_mtu(struct xfrm_state *x, int mtu)
                  net_adj) & ~(blksize - 1)) + net_adj - 2;
 }
 
-static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                     u8 type, u8 code, int offset, __be32 info)
+static int esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+                    u8 type, u8 code, int offset, __be32 info)
 {
         struct net *net = dev_net(skb->dev);
         const struct ipv6hdr *iph = (const struct ipv6hdr *)skb->data;
@@ -431,18 +431,20 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
         if (type != ICMPV6_PKT_TOOBIG &&
             type != NDISC_REDIRECT)
-                return;
+                return 0;
 
         x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
                               esph->spi, IPPROTO_ESP, AF_INET6);
         if (!x)
-                return;
+                return 0;
 
         if (type == NDISC_REDIRECT)
                 ip6_redirect(skb, net, skb->dev->ifindex, 0);
         else
                 ip6_update_pmtu(skb, net, info, 0, 0);
         xfrm_state_put(x);
+
+        return 0;
 }
 
 static void esp6_destroy(struct xfrm_state *x)
@@ -614,6 +616,11 @@ error:
         return err;
 }
 
+static int esp6_rcv_cb(struct sk_buff *skb, int err)
+{
+        return 0;
+}
+
 static const struct xfrm_type esp6_type =
 {
         .description    = "ESP6",
@@ -628,10 +635,11 @@ static const struct xfrm_type esp6_type =
         .hdr_offset     = xfrm6_find_1stfragopt,
 };
 
-static const struct inet6_protocol esp6_protocol = {
-        .handler        =       xfrm6_rcv,
+static struct xfrm6_protocol esp6_protocol = {
+        .handler        =       xfrm6_rcv,
+        .cb_handler     =       esp6_rcv_cb,
         .err_handler    =       esp6_err,
-        .flags          =       INET6_PROTO_NOPOLICY,
+        .priority       =       0,
 };
 
 static int __init esp6_init(void)
@@ -640,7 +648,7 @@ static int __init esp6_init(void)
                 pr_info("%s: can't add xfrm type\n", __func__);
                 return -EAGAIN;
         }
-        if (inet6_add_protocol(&esp6_protocol, IPPROTO_ESP) < 0) {
+        if (xfrm6_protocol_register(&esp6_protocol, IPPROTO_ESP) < 0) {
                 pr_info("%s: can't add protocol\n", __func__);
                 xfrm_unregister_type(&esp6_type, AF_INET6);
                 return -EAGAIN;
@@ -651,7 +659,7 @@ static int __init esp6_init(void)
 
 static void __exit esp6_fini(void)
 {
-        if (inet6_del_protocol(&esp6_protocol, IPPROTO_ESP) < 0)
+        if (xfrm6_protocol_deregister(&esp6_protocol, IPPROTO_ESP) < 0)
                 pr_info("%s: can't remove protocol\n", __func__);
         if (xfrm_unregister_type(&esp6_type, AF_INET6) < 0)
                 pr_info("%s: can't remove xfrm type\n", __func__);
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index f2610e157660..7b326529e6a2 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -520,7 +520,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
                               np->tclass, NULL, &fl6, (struct rt6_info *)dst,
                               MSG_DONTWAIT, np->dontfrag);
         if (err) {
-                ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
+                ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
                 ip6_flush_pending_frames(sk);
         } else {
                 err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index c9138189415a..d4ade34ab375 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -224,9 +224,8 @@ static struct dst_entry *inet6_csk_route_socket(struct sock *sk,
         return dst;
 }
 
-int inet6_csk_xmit(struct sk_buff *skb, struct flowi *fl_unused)
+int inet6_csk_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl_unused)
 {
-        struct sock *sk = skb->sk;
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct flowi6 fl6;
         struct dst_entry *dst;
diff --git a/net/ipv6/ip6_checksum.c b/net/ipv6/ip6_checksum.c
index 72d198b8e4d2..ee7a97f510cb 100644
--- a/net/ipv6/ip6_checksum.c
+++ b/net/ipv6/ip6_checksum.c
@@ -79,7 +79,9 @@ int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh, int proto)
                 /* RFC 2460 section 8.1 says that we SHOULD log
                    this error. Well, it is reasonable.
                  */
-                LIMIT_NETDEBUG(KERN_INFO "IPv6: udp checksum is 0\n");
+                LIMIT_NETDEBUG(KERN_INFO "IPv6: udp checksum is 0 for [%pI6c]:%u->[%pI6c]:%u\n",
+                               &ipv6_hdr(skb)->saddr, ntohs(uh->source),
+                               &ipv6_hdr(skb)->daddr, ntohs(uh->dest));
                 return 1;
         }
         if (skb->ip_summed == CHECKSUM_COMPLETE &&
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 075602fc6b6a..34e0ded5c14b 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -9,14 +9,12 @@
  *      modify it under the terms of the GNU General Public License
  *      as published by the Free Software Foundation; either version
  *      2 of the License, or (at your option) any later version.
- */
-
-/*
- *      Changes:
- *      Yuji SEKIYA @USAGI:     Support default route on router node;
- *                              remove ip6_null_entry from the top of
- *                              routing table.
- *      Ville Nuorvala:         Fixed routing subtrees.
+ *
+ *      Changes:
+ *      Yuji SEKIYA @USAGI:     Support default route on router node;
+ *                              remove ip6_null_entry from the top of
+ *                              routing table.
+ *      Ville Nuorvala:         Fixed routing subtrees.
  */
 
 #define pr_fmt(fmt) "IPv6: " fmt
@@ -46,10 +44,9 @@
 #define RT6_TRACE(x...) do { ; } while (0)
 #endif
 
-static struct kmem_cache * fib6_node_kmem __read_mostly;
+static struct kmem_cache *fib6_node_kmem __read_mostly;
 
-enum fib_walk_state_t
-{
+enum fib_walk_state_t {
 #ifdef CONFIG_IPV6_SUBTREES
         FWS_S,
 #endif
@@ -59,8 +56,7 @@ enum fib_walk_state_t
         FWS_U
 };
 
-struct fib6_cleaner_t
-{
+struct fib6_cleaner_t {
         struct fib6_walker_t w;
         struct net *net;
         int (*func)(struct rt6_info *, void *arg);
@@ -138,7 +134,7 @@ static __inline__ __be32 addr_bit_set(const void *token, int fn_bit)
         const __be32 *addr = token;
         /*
          * Here,
-         *      1 << ((~fn_bit ^ BITOP_BE32_SWIZZLE) & 0x1f)
+         *      1 << ((~fn_bit ^ BITOP_BE32_SWIZZLE) & 0x1f)
          * is optimized version of
          *      htonl(1 << ((~fn_bit)&0x1F))
          * See include/asm-generic/bitops/le.h.
@@ -147,7 +143,7 @@ static __inline__ __be32 addr_bit_set(const void *token, int fn_bit)
                addr[fn_bit >> 5];
 }
 
-static __inline__ struct fib6_node * node_alloc(void)
+static __inline__ struct fib6_node *node_alloc(void)
 {
         struct fib6_node *fn;
 
@@ -156,7 +152,7 @@ static __inline__ struct fib6_node * node_alloc(void)
         return fn;
 }
 
-static __inline__ void node_free(struct fib6_node * fn)
+static __inline__ void node_free(struct fib6_node *fn)
 {
         kmem_cache_free(fib6_node_kmem, fn);
 }
@@ -292,7 +288,7 @@ static int fib6_dump_node(struct fib6_walker_t *w)
 
 static void fib6_dump_end(struct netlink_callback *cb)
 {
-        struct fib6_walker_t *w = (void*)cb->args[2];
+        struct fib6_walker_t *w = (void *)cb->args[2];
 
         if (w) {
                 if (cb->args[4]) {
@@ -302,7 +298,7 @@ static void fib6_dump_end(struct netlink_callback *cb)
                 cb->args[2] = 0;
                 kfree(w);
         }
-        cb->done = (void*)cb->args[3];
+        cb->done = (void *)cb->args[3];
         cb->args[1] = 3;
 }
 
@@ -485,7 +481,7 @@ static struct fib6_node *fib6_add_1(struct fib6_node *root,
                 fn->fn_sernum = sernum;
                 dir = addr_bit_set(addr, fn->fn_bit);
                 pn = fn;
-                fn = dir ? fn->right: fn->left;
+                fn = dir ? fn->right : fn->left;
         } while (fn);
 
         if (!allow_create) {
@@ -638,12 +634,41 @@ static inline bool rt6_qualify_for_ecmp(struct rt6_info *rt)
                RTF_GATEWAY;
 }
 
+static int fib6_commit_metrics(struct dst_entry *dst,
+                               struct nlattr *mx, int mx_len)
+{
+        struct nlattr *nla;
+        int remaining;
+        u32 *mp;
+
+        if (dst->flags & DST_HOST) {
+                mp = dst_metrics_write_ptr(dst);
+        } else {
+                mp = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
+                if (!mp)
+                        return -ENOMEM;
+                dst_init_metrics(dst, mp, 0);
+        }
+
+        nla_for_each_attr(nla, mx, mx_len, remaining) {
+                int type = nla_type(nla);
+
+                if (type) {
+                        if (type > RTAX_MAX)
+                                return -EINVAL;
+
+                        mp[type - 1] = nla_get_u32(nla);
+                }
+        }
+        return 0;
+}
+
 /*
  *      Insert routing information in a node.
  */
 
 static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
-                            struct nl_info *info)
+                            struct nl_info *info, struct nlattr *mx, int mx_len)
 {
         struct rt6_info *iter = NULL;
         struct rt6_info **ins;
@@ -653,6 +678,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                    (info->nlh->nlmsg_flags & NLM_F_CREATE));
         int found = 0;
         bool rt_can_ecmp = rt6_qualify_for_ecmp(rt);
+        int err;
 
         ins = &fn->leaf;
 
@@ -751,6 +777,11 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                         pr_warn("NLM_F_CREATE should be set when creating new route\n");
 
 add:
+                if (mx) {
+                        err = fib6_commit_metrics(&rt->dst, mx, mx_len);
+                        if (err)
+                                return err;
+                }
                 rt->dst.rt6_next = iter;
                 *ins = rt;
                 rt->rt6i_node = fn;
@@ -770,6 +801,11 @@ add:
                         pr_warn("NLM_F_REPLACE set, but no existing node found!\n");
                         return -ENOENT;
                 }
+                if (mx) {
+                        err = fib6_commit_metrics(&rt->dst, mx, mx_len);
+                        if (err)
+                                return err;
+                }
                 *ins = rt;
                 rt->rt6i_node = fn;
                 rt->dst.rt6_next = iter->dst.rt6_next;
@@ -806,7 +842,8 @@ void fib6_force_start_gc(struct net *net)
  *      with source addr info in sub-trees
  */
 
-int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
+int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info,
+             struct nlattr *mx, int mx_len)
 {
         struct fib6_node *fn, *pn = NULL;
         int err = -ENOMEM;
@@ -900,7 +937,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
         }
 #endif
 
-        err = fib6_add_rt2node(fn, rt, info);
+        err = fib6_add_rt2node(fn, rt, info, mx, mx_len);
         if (!err) {
                 fib6_start_gc(info->nl_net, rt);
                 if (!(rt->rt6i_flags & RTF_CACHE))
@@ -955,8 +992,8 @@ struct lookup_args {
         const struct in6_addr   *addr;          /* search key                   */
 };
 
-static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
-                                        struct lookup_args *args)
+static struct fib6_node *fib6_lookup_1(struct fib6_node *root,
+                                       struct lookup_args *args)
 {
         struct fib6_node *fn;
         __be32 dir;
@@ -1018,8 +1055,8 @@ backtrack:
         return NULL;
 }
 
-struct fib6_node * fib6_lookup(struct fib6_node *root, const struct in6_addr *daddr,
-                               const struct in6_addr *saddr)
+struct fib6_node *fib6_lookup(struct fib6_node *root, const struct in6_addr *daddr,
+                              const struct in6_addr *saddr)
 {
         struct fib6_node *fn;
         struct lookup_args args[] = {
@@ -1051,9 +1088,9 @@ struct fib6_node * fib6_lookup(struct fib6_node *root, const struct in6_addr *da
  */
 
 
-static struct fib6_node * fib6_locate_1(struct fib6_node *root,
-                                        const struct in6_addr *addr,
-                                        int plen, int offset)
+static struct fib6_node *fib6_locate_1(struct fib6_node *root,
+                                       const struct in6_addr *addr,
+                                       int plen, int offset)
 {
         struct fib6_node *fn;
 
@@ -1081,9 +1118,9 @@ static struct fib6_node * fib6_locate_1(struct fib6_node *root,
         return NULL;
 }
 
-struct fib6_node * fib6_locate(struct fib6_node *root,
-                               const struct in6_addr *daddr, int dst_len,
-                               const struct in6_addr *saddr, int src_len)
+struct fib6_node *fib6_locate(struct fib6_node *root,
+                              const struct in6_addr *daddr, int dst_len,
+                              const struct in6_addr *saddr, int src_len)
 {
         struct fib6_node *fn;
 
@@ -1151,8 +1188,10 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
 
                 children = 0;
                 child = NULL;
-                if (fn->right) child = fn->right, children |= 1;
-                if (fn->left) child = fn->left, children |= 2;
+                if (fn->right)
+                        child = fn->right, children |= 1;
+                if (fn->left)
+                        child = fn->left, children |= 2;
 
                 if (children == 3 || FIB6_SUBTREE(fn)
 #ifdef CONFIG_IPV6_SUBTREES
@@ -1180,8 +1219,10 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
                 } else {
                         WARN_ON(fn->fn_flags & RTN_ROOT);
 #endif
-                        if (pn->right == fn) pn->right = child;
-                        else if (pn->left == fn) pn->left = child;
+                        if (pn->right == fn)
+                                pn->right = child;
+                        else if (pn->left == fn)
+                                pn->left = child;
 #if RT6_DEBUG >= 2
                         else
                                 WARN_ON(1);
@@ -1213,10 +1254,10 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
                                         w->node = child;
                                         if (children&2) {
                                                 RT6_TRACE("W %p adjusted by delnode 2, s=%d\n", w, w->state);
-                                                w->state = w->state>=FWS_R ? FWS_U : FWS_INIT;
+                                                w->state = w->state >= FWS_R ? FWS_U : FWS_INIT;
                                         } else {
                                                 RT6_TRACE("W %p adjusted by delnode 2, s=%d\n", w, w->state);
-                                                w->state = w->state>=FWS_C ? FWS_U : FWS_INIT;
+                                                w->state = w->state >= FWS_C ? FWS_U : FWS_INIT;
                                         }
                                 }
                         }
@@ -1314,7 +1355,7 @@ int fib6_del(struct rt6_info *rt, struct nl_info *info)
         struct rt6_info **rtp;
 
 #if RT6_DEBUG >= 2
-        if (rt->dst.obsolete>0) {
+        if (rt->dst.obsolete > 0) {
                 WARN_ON(fn != NULL);
                 return -ENOENT;
         }
@@ -1707,7 +1748,7 @@ out_rt6_stats:
         kfree(net->ipv6.rt6_stats);
 out_timer:
         return -ENOMEM;
- }
+}
 
 static void fib6_net_exit(struct net *net)
 {
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index dfa41bb4e0dc..0961b5ef866d 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -15,9 +15,7 @@
 #include <linux/socket.h>
 #include <linux/net.h>
 #include <linux/netdevice.h>
-#include <linux/if_arp.h>
 #include <linux/in6.h>
-#include <linux/route.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
@@ -28,12 +26,8 @@
 #include <net/sock.h>
 
 #include <net/ipv6.h>
-#include <net/ndisc.h>
-#include <net/protocol.h>
-#include <net/ip6_route.h>
 #include <net/addrconf.h>
 #include <net/rawv6.h>
-#include <net/icmp.h>
 #include <net/transp_v6.h>
 
 #include <asm/uaccess.h>
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index f3ffb43f59c0..9d921462b57f 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1454,7 +1454,6 @@ static void ip6gre_netlink_parms(struct nlattr *data[],
 static int ip6gre_tap_init(struct net_device *dev)
 {
         struct ip6_tnl *tunnel;
-        int i;
 
         tunnel = netdev_priv(dev);
 
@@ -1464,16 +1463,10 @@ static int ip6gre_tap_init(struct net_device *dev)
 
         ip6gre_tnl_link_config(tunnel, 1);
 
-        dev->tstats = alloc_percpu(struct pcpu_sw_netstats);
+        dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!dev->tstats)
                 return -ENOMEM;
 
-        for_each_possible_cpu(i) {
-                struct pcpu_sw_netstats *ip6gre_tap_stats;
-                ip6gre_tap_stats = per_cpu_ptr(dev->tstats, i);
-                u64_stats_init(&ip6gre_tap_stats->syncp);
-        }
-
         return 0;
 }
 
@@ -1566,6 +1559,15 @@ static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[],
         return 0;
 }
 
+static void ip6gre_dellink(struct net_device *dev, struct list_head *head)
+{
+        struct net *net = dev_net(dev);
+        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
+
+        if (dev != ign->fb_tunnel_dev)
+                unregister_netdevice_queue(dev, head);
+}
+
 static size_t ip6gre_get_size(const struct net_device *dev)
 {
         return
@@ -1643,6 +1645,7 @@ static struct rtnl_link_ops ip6gre_link_ops __read_mostly = {
         .validate       = ip6gre_tunnel_validate,
         .newlink        = ip6gre_newlink,
         .changelink     = ip6gre_changelink,
+        .dellink        = ip6gre_dellink,
         .get_size       = ip6gre_get_size,
         .fill_info      = ip6gre_fill_info,
 };
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 64d6073731d3..40e7581374f7 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -132,7 +132,7 @@ static int ip6_finish_output(struct sk_buff *skb)
                 return ip6_finish_output2(skb);
 }
 
-int ip6_output(struct sk_buff *skb)
+int ip6_output(struct sock *sk, struct sk_buff *skb)
 {
         struct net_device *dev = skb_dst(skb)->dev;
         struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
@@ -367,6 +367,9 @@ int ip6_forward(struct sk_buff *skb)
         if (net->ipv6.devconf_all->forwarding == 0)
                 goto error;
 
+        if (skb->pkt_type != PACKET_HOST)
+                goto drop;
+
         if (skb_warn_if_lro(skb))
                 goto drop;
 
@@ -376,9 +379,6 @@ int ip6_forward(struct sk_buff *skb)
                 goto drop;
         }
 
-        if (skb->pkt_type != PACKET_HOST)
-                goto drop;
-
         skb_forward_csum(skb);
 
         /*
@@ -1230,8 +1230,10 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                               sizeof(struct frag_hdr) : 0) +
                              rt->rt6i_nfheader_len;
 
-                maxnonfragsize = (np->pmtudisc >= IPV6_PMTUDISC_DO) ?
-                                 mtu : sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
+                if (ip6_sk_local_df(sk))
+                        maxnonfragsize = sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
+                else
+                        maxnonfragsize = mtu;
 
                 /* dontfrag active */
                 if ((cork->length + length > mtu - headersize) && dontfrag &&
@@ -1538,8 +1540,7 @@ int ip6_push_pending_frames(struct sock *sk)
         }
 
         /* Allow local fragmentation. */
-        if (np->pmtudisc < IPV6_PMTUDISC_DO)
-                skb->local_df = 1;
+        skb->local_df = ip6_sk_local_df(sk);
 
         *final_dst = fl6->daddr;
         __skb_pull(skb, skb_network_header_len(skb));
@@ -1566,8 +1567,8 @@ int ip6_push_pending_frames(struct sock *sk)
         if (proto == IPPROTO_ICMPV6) {
                 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
 
-                ICMP6MSGOUT_INC_STATS_BH(net, idev, icmp6_hdr(skb)->icmp6_type);
-                ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
+                ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type);
+                ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
         }
 
         err = ip6_local_out(skb);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 5db8d310f9c0..e1df691d78be 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -108,12 +108,12 @@ static struct net_device_stats *ip6_get_stats(struct net_device *dev)
                                                    per_cpu_ptr(dev->tstats, i);
 
                 do {
-                        start = u64_stats_fetch_begin_bh(&tstats->syncp);
+                        start = u64_stats_fetch_begin_irq(&tstats->syncp);
                         tmp.rx_packets = tstats->rx_packets;
                         tmp.rx_bytes = tstats->rx_bytes;
                         tmp.tx_packets = tstats->tx_packets;
                         tmp.tx_bytes =  tstats->tx_bytes;
-                } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
+                } while (u64_stats_fetch_retry_irq(&tstats->syncp, start));
 
                 sum.rx_packets += tmp.rx_packets;
                 sum.rx_bytes   += tmp.rx_bytes;
@@ -1502,19 +1502,12 @@ static inline int
 ip6_tnl_dev_init_gen(struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
-        int i;
 
         t->dev = dev;
         t->net = dev_net(dev);
-        dev->tstats = alloc_percpu(struct pcpu_sw_netstats);
+        dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!dev->tstats)
                 return -ENOMEM;
-
-        for_each_possible_cpu(i) {
-                struct pcpu_sw_netstats *ip6_tnl_stats;
-                ip6_tnl_stats = per_cpu_ptr(dev->tstats, i);
-                u64_stats_init(&ip6_tnl_stats->syncp);
-        }
         return 0;
 }
 
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 2d19272b8cee..b7c0f827140b 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -278,7 +278,6 @@ static void vti6_dev_uninit(struct net_device *dev)
                 RCU_INIT_POINTER(ip6n->tnls_wc[0], NULL);
         else
                 vti6_tnl_unlink(ip6n, t);
-        ip6_tnl_dst_reset(t);
         dev_put(dev);
 }
 
@@ -288,11 +287,8 @@ static int vti6_rcv(struct sk_buff *skb)
         const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 
         rcu_read_lock();
-
         if ((t = vti6_tnl_lookup(dev_net(skb->dev), &ipv6h->saddr,
                                  &ipv6h->daddr)) != NULL) {
-                struct pcpu_sw_netstats *tstats;
-
                 if (t->parms.proto != IPPROTO_IPV6 && t->parms.proto != 0) {
                         rcu_read_unlock();
                         goto discard;
@@ -309,27 +305,58 @@ static int vti6_rcv(struct sk_buff *skb)
                         goto discard;
                 }
 
-                tstats = this_cpu_ptr(t->dev->tstats);
-                u64_stats_update_begin(&tstats->syncp);
-                tstats->rx_packets++;
-                tstats->rx_bytes += skb->len;
-                u64_stats_update_end(&tstats->syncp);
-
-                skb->mark = 0;
-                secpath_reset(skb);
-                skb->dev = t->dev;
+                XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t;
+                skb->mark = be32_to_cpu(t->parms.i_key);
 
                 rcu_read_unlock();
-                return 0;
+
+                return xfrm6_rcv(skb);
         }
         rcu_read_unlock();
-        return 1;
-
+        return -EINVAL;
 discard:
         kfree_skb(skb);
         return 0;
 }
 
+static int vti6_rcv_cb(struct sk_buff *skb, int err)
+{
+        unsigned short family;
+        struct net_device *dev;
+        struct pcpu_sw_netstats *tstats;
+        struct xfrm_state *x;
+        struct ip6_tnl *t = XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6;
+
+        if (!t)
+                return 1;
+
+        dev = t->dev;
+
+        if (err) {
+                dev->stats.rx_errors++;
+                dev->stats.rx_dropped++;
+
+                return 0;
+        }
+
+        x = xfrm_input_state(skb);
+        family = x->inner_mode->afinfo->family;
+
+        if (!xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family))
+                return -EPERM;
+
+        skb_scrub_packet(skb, !net_eq(t->net, dev_net(skb->dev)));
+        skb->dev = dev;
+
+        tstats = this_cpu_ptr(dev->tstats);
+        u64_stats_update_begin(&tstats->syncp);
+        tstats->rx_packets++;
+        tstats->rx_bytes += skb->len;
+        u64_stats_update_end(&tstats->syncp);
+
+        return 0;
+}
+
 /**
  * vti6_addr_conflict - compare packet addresses to tunnel's own
  *   @t: the outgoing tunnel device
@@ -349,44 +376,56 @@ vti6_addr_conflict(const struct ip6_tnl *t, const struct ipv6hdr *hdr)
         return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
 }
 
+static bool vti6_state_check(const struct xfrm_state *x,
+                             const struct in6_addr *dst,
+                             const struct in6_addr *src)
+{
+        xfrm_address_t *daddr = (xfrm_address_t *)dst;
+        xfrm_address_t *saddr = (xfrm_address_t *)src;
+
+        /* if there is no transform then this tunnel is not functional.
+         * Or if the xfrm is not mode tunnel.
+         */
+        if (!x || x->props.mode != XFRM_MODE_TUNNEL ||
+            x->props.family != AF_INET6)
+                return false;
+
+        if (ipv6_addr_any(dst))
+                return xfrm_addr_equal(saddr, &x->props.saddr, AF_INET6);
+
+        if (!xfrm_state_addr_check(x, daddr, saddr, AF_INET6))
+                return false;
+
+        return true;
+}
+
 /**
  * vti6_xmit - send a packet
  *   @skb: the outgoing socket buffer
  *   @dev: the outgoing tunnel device
+ *   @fl: the flow informations for the xfrm_lookup
  **/
-static int vti6_xmit(struct sk_buff *skb, struct net_device *dev)
+static int
+vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
 {
-        struct net *net = dev_net(dev);
         struct ip6_tnl *t = netdev_priv(dev);
         struct net_device_stats *stats = &t->dev->stats;
-        struct dst_entry *dst = NULL, *ndst = NULL;
-        struct flowi6 fl6;
-        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+        struct dst_entry *dst = skb_dst(skb);
         struct net_device *tdev;
         int err = -1;
 
-        if ((t->parms.proto != IPPROTO_IPV6 && t->parms.proto != 0) ||
-            !ip6_tnl_xmit_ctl(t) || vti6_addr_conflict(t, ipv6h))
-                return err;
-
-        dst = ip6_tnl_dst_check(t);
-        if (!dst) {
-                memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
-
-                ndst = ip6_route_output(net, NULL, &fl6);
+        if (!dst)
+                goto tx_err_link_failure;
 
-                if (ndst->error)
-                        goto tx_err_link_failure;
-                ndst = xfrm_lookup(net, ndst, flowi6_to_flowi(&fl6), NULL, 0);
-                if (IS_ERR(ndst)) {
-                        err = PTR_ERR(ndst);
-                        ndst = NULL;
-                        goto tx_err_link_failure;
-                }
-                dst = ndst;
+        dst_hold(dst);
+        dst = xfrm_lookup(t->net, dst, fl, NULL, 0);
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
+                dst = NULL;
+                goto tx_err_link_failure;
         }
 
-        if (!dst->xfrm || dst->xfrm->props.mode != XFRM_MODE_TUNNEL)
+        if (!vti6_state_check(dst->xfrm, &t->parms.raddr, &t->parms.laddr))
                 goto tx_err_link_failure;
 
         tdev = dst->dev;
@@ -398,14 +437,21 @@ static int vti6_xmit(struct sk_buff *skb, struct net_device *dev)
                 goto tx_err_dst_release;
         }
 
+        skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
+        skb_dst_set(skb, dst);
+        skb->dev = skb_dst(skb)->dev;
 
-        skb_dst_drop(skb);
-        skb_dst_set_noref(skb, dst);
+        err = dst_output(skb);
+        if (net_xmit_eval(err) == 0) {
+                struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
 
-        ip6tunnel_xmit(skb, dev);
-        if (ndst) {
-                dev->mtu = dst_mtu(ndst);
-                ip6_tnl_dst_store(t, ndst);
+                u64_stats_update_begin(&tstats->syncp);
+                tstats->tx_bytes += skb->len;
+                tstats->tx_packets++;
+                u64_stats_update_end(&tstats->syncp);
+        } else {
+                stats->tx_errors++;
+                stats->tx_aborted_errors++;
         }
 
         return 0;
@@ -413,7 +459,7 @@ tx_err_link_failure:
         stats->tx_carrier_errors++;
         dst_link_failure(skb);
 tx_err_dst_release:
-        dst_release(ndst);
+        dst_release(dst);
         return err;
 }
 
@@ -422,16 +468,33 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
         struct net_device_stats *stats = &t->dev->stats;
+        struct ipv6hdr *ipv6h;
+        struct flowi fl;
         int ret;
 
+        memset(&fl, 0, sizeof(fl));
+        skb->mark = be32_to_cpu(t->parms.o_key);
+
         switch (skb->protocol) {
         case htons(ETH_P_IPV6):
-                ret = vti6_xmit(skb, dev);
+                ipv6h = ipv6_hdr(skb);
+
+                if ((t->parms.proto != IPPROTO_IPV6 && t->parms.proto != 0) ||
+                    !ip6_tnl_xmit_ctl(t) || vti6_addr_conflict(t, ipv6h))
+                        goto tx_err;
+
+                xfrm_decode_session(skb, &fl, AF_INET6);
+                memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+                break;
+        case htons(ETH_P_IP):
+                xfrm_decode_session(skb, &fl, AF_INET);
+                memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
                 break;
         default:
                 goto tx_err;
         }
 
+        ret = vti6_xmit(skb, dev, &fl);
         if (ret < 0)
                 goto tx_err;
 
@@ -444,24 +507,66 @@ tx_err:
         return NETDEV_TX_OK;
 }
 
+static int vti6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+                    u8 type, u8 code, int offset, __be32 info)
+{
+        __be32 spi;
+        struct xfrm_state *x;
+        struct ip6_tnl *t;
+        struct ip_esp_hdr *esph;
+        struct ip_auth_hdr *ah;
+        struct ip_comp_hdr *ipch;
+        struct net *net = dev_net(skb->dev);
+        const struct ipv6hdr *iph = (const struct ipv6hdr *)skb->data;
+        int protocol = iph->nexthdr;
+
+        t = vti6_tnl_lookup(dev_net(skb->dev), &iph->daddr, &iph->saddr);
+        if (!t)
+                return -1;
+
+        switch (protocol) {
+        case IPPROTO_ESP:
+                esph = (struct ip_esp_hdr *)(skb->data + offset);
+                spi = esph->spi;
+                break;
+        case IPPROTO_AH:
+                ah = (struct ip_auth_hdr *)(skb->data + offset);
+                spi = ah->spi;
+                break;
+        case IPPROTO_COMP:
+                ipch = (struct ip_comp_hdr *)(skb->data + offset);
+                spi = htonl(ntohs(ipch->cpi));
+                break;
+        default:
+                return 0;
+        }
+
+        if (type != ICMPV6_PKT_TOOBIG &&
+            type != NDISC_REDIRECT)
+                return 0;
+
+        x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
+                              spi, protocol, AF_INET6);
+        if (!x)
+                return 0;
+
+        if (type == NDISC_REDIRECT)
+                ip6_redirect(skb, net, skb->dev->ifindex, 0);
+        else
+                ip6_update_pmtu(skb, net, info, 0, 0);
+        xfrm_state_put(x);
+
+        return 0;
+}
+
 static void vti6_link_config(struct ip6_tnl *t)
 {
-        struct dst_entry *dst;
         struct net_device *dev = t->dev;
         struct __ip6_tnl_parm *p = &t->parms;
-        struct flowi6 *fl6 = &t->fl.u.ip6;
 
         memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
         memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr));
 
-        /* Set up flowi template */
-        fl6->saddr = p->laddr;
-        fl6->daddr = p->raddr;
-        fl6->flowi6_oif = p->link;
-        fl6->flowi6_mark = be32_to_cpu(p->i_key);
-        fl6->flowi6_proto = p->proto;
-        fl6->flowlabel = 0;
-
         p->flags &= ~(IP6_TNL_F_CAP_XMIT | IP6_TNL_F_CAP_RCV |
                       IP6_TNL_F_CAP_PER_PACKET);
         p->flags |= ip6_tnl_get_cap(t, &p->laddr, &p->raddr);
@@ -472,28 +577,6 @@ static void vti6_link_config(struct ip6_tnl *t)
                 dev->flags &= ~IFF_POINTOPOINT;
 
         dev->iflink = p->link;
-
-        if (p->flags & IP6_TNL_F_CAP_XMIT) {
-
-                dst = ip6_route_output(dev_net(dev), NULL, fl6);
-                if (dst->error)
-                        return;
-
-                dst = xfrm_lookup(dev_net(dev), dst, flowi6_to_flowi(fl6),
-                                  NULL, 0);
-                if (IS_ERR(dst))
-                        return;
-
-                if (dst->dev) {
-                        dev->hard_header_len = dst->dev->hard_header_len;
-
-                        dev->mtu = dst_mtu(dst);
-
-                        if (dev->mtu < IPV6_MIN_MTU)
-                                dev->mtu = IPV6_MIN_MTU;
-                }
-                dst_release(dst);
-        }
 }
 
 /**
@@ -720,7 +803,6 @@ static void vti6_dev_setup(struct net_device *dev)
         t = netdev_priv(dev);
         dev->flags |= IFF_NOARP;
         dev->addr_len = sizeof(struct in6_addr);
-        dev->features |= NETIF_F_NETNS_LOCAL;
         dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
 }
 
@@ -731,18 +813,12 @@ static void vti6_dev_setup(struct net_device *dev)
 static inline int vti6_dev_init_gen(struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
-        int i;
 
         t->dev = dev;
         t->net = dev_net(dev);
-        dev->tstats = alloc_percpu(struct pcpu_sw_netstats);
+        dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!dev->tstats)
                 return -ENOMEM;
-        for_each_possible_cpu(i) {
-                struct pcpu_sw_netstats *stats;
-                stats = per_cpu_ptr(dev->tstats, i);
-                u64_stats_init(&stats->syncp);
-        }
         return 0;
 }
 
@@ -914,11 +990,6 @@ static struct rtnl_link_ops vti6_link_ops __read_mostly = {
         .fill_info      = vti6_fill_info,
 };
 
-static struct xfrm_tunnel_notifier vti6_handler __read_mostly = {
-        .handler        = vti6_rcv,
-        .priority       =       1,
-};
-
 static void __net_exit vti6_destroy_tunnels(struct vti6_net *ip6n)
 {
         int h;
@@ -990,6 +1061,27 @@ static struct pernet_operations vti6_net_ops = {
         .size = sizeof(struct vti6_net),
 };
 
+static struct xfrm6_protocol vti_esp6_protocol __read_mostly = {
+        .handler        =       vti6_rcv,
+        .cb_handler     =       vti6_rcv_cb,
+        .err_handler    =       vti6_err,
+        .priority       =       100,
+};
+
+static struct xfrm6_protocol vti_ah6_protocol __read_mostly = {
+        .handler        =       vti6_rcv,
+        .cb_handler     =       vti6_rcv_cb,
+        .err_handler    =       vti6_err,
+        .priority       =       100,
+};
+
+static struct xfrm6_protocol vti_ipcomp6_protocol __read_mostly = {
+        .handler        =       vti6_rcv,
+        .cb_handler     =       vti6_rcv_cb,
+        .err_handler    =       vti6_err,
+        .priority       =       100,
+};
+
 /**
  * vti6_tunnel_init - register protocol and reserve needed resources
  *
@@ -1003,11 +1095,33 @@ static int __init vti6_tunnel_init(void)
         if (err < 0)
                 goto out_pernet;
 
-        err = xfrm6_mode_tunnel_input_register(&vti6_handler);
+        err = xfrm6_protocol_register(&vti_esp6_protocol, IPPROTO_ESP);
         if (err < 0) {
-                pr_err("%s: can't register vti6\n", __func__);
+                unregister_pernet_device(&vti6_net_ops);
+                pr_err("%s: can't register vti6 protocol\n", __func__);
+
                 goto out;
         }
+
+        err = xfrm6_protocol_register(&vti_ah6_protocol, IPPROTO_AH);
+        if (err < 0) {
+                xfrm6_protocol_deregister(&vti_esp6_protocol, IPPROTO_ESP);
+                unregister_pernet_device(&vti6_net_ops);
+                pr_err("%s: can't register vti6 protocol\n", __func__);
+
+                goto out;
+        }
+
+        err = xfrm6_protocol_register(&vti_ipcomp6_protocol, IPPROTO_COMP);
+        if (err < 0) {
+                xfrm6_protocol_deregister(&vti_ah6_protocol, IPPROTO_AH);
+                xfrm6_protocol_deregister(&vti_esp6_protocol, IPPROTO_ESP);
+                unregister_pernet_device(&vti6_net_ops);
+                pr_err("%s: can't register vti6 protocol\n", __func__);
+
+                goto out;
+        }
+
         err = rtnl_link_register(&vti6_link_ops);
         if (err < 0)
                 goto rtnl_link_failed;
@@ -1015,7 +1129,9 @@ static int __init vti6_tunnel_init(void)
         return 0;
 
 rtnl_link_failed:
-        xfrm6_mode_tunnel_input_deregister(&vti6_handler);
+        xfrm6_protocol_deregister(&vti_ipcomp6_protocol, IPPROTO_COMP);
+        xfrm6_protocol_deregister(&vti_ah6_protocol, IPPROTO_AH);
+        xfrm6_protocol_deregister(&vti_esp6_protocol, IPPROTO_ESP);
 out:
         unregister_pernet_device(&vti6_net_ops);
 out_pernet:
@@ -1028,8 +1144,12 @@ out_pernet:
 static void __exit vti6_tunnel_cleanup(void)
 {
         rtnl_link_unregister(&vti6_link_ops);
-        if (xfrm6_mode_tunnel_input_deregister(&vti6_handler))
-                pr_info("%s: can't deregister vti6\n", __func__);
+        if (xfrm6_protocol_deregister(&vti_ipcomp6_protocol, IPPROTO_COMP))
+                pr_info("%s: can't deregister protocol\n", __func__);
+        if (xfrm6_protocol_deregister(&vti_ah6_protocol, IPPROTO_AH))
+                pr_info("%s: can't deregister protocol\n", __func__);
+        if (xfrm6_protocol_deregister(&vti_esp6_protocol, IPPROTO_ESP))
+                pr_info("%s: can't deregister protocol\n", __func__);
 
         unregister_pernet_device(&vti6_net_ops);
 }
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index da9becb42e81..d1c793cffcb5 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -53,7 +53,7 @@
 #include <linux/icmpv6.h>
 #include <linux/mutex.h>
 
-static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+static int ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                                 u8 type, u8 code, int offset, __be32 info)
 {
         struct net *net = dev_net(skb->dev);
@@ -65,19 +65,21 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
         if (type != ICMPV6_PKT_TOOBIG &&
             type != NDISC_REDIRECT)
-                return;
+                return 0;
 
         spi = htonl(ntohs(ipcomph->cpi));
         x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
                               spi, IPPROTO_COMP, AF_INET6);
         if (!x)
-                return;
+                return 0;
 
         if (type == NDISC_REDIRECT)
                 ip6_redirect(skb, net, skb->dev->ifindex, 0);
         else
                 ip6_update_pmtu(skb, net, info, 0, 0);
         xfrm_state_put(x);
+
+        return 0;
 }
 
 static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
@@ -174,6 +176,11 @@ out:
         return err;
 }
 
+static int ipcomp6_rcv_cb(struct sk_buff *skb, int err)
+{
+        return 0;
+}
+
 static const struct xfrm_type ipcomp6_type =
 {
         .description    = "IPCOMP6",
@@ -186,11 +193,12 @@ static const struct xfrm_type ipcomp6_type =
         .hdr_offset     = xfrm6_find_1stfragopt,
 };
 
-static const struct inet6_protocol ipcomp6_protocol =
+static struct xfrm6_protocol ipcomp6_protocol =
 {
         .handler        = xfrm6_rcv,
+        .cb_handler     = ipcomp6_rcv_cb,
         .err_handler    = ipcomp6_err,
-        .flags          = INET6_PROTO_NOPOLICY,
+        .priority       = 0,
 };
 
 static int __init ipcomp6_init(void)
@@ -199,7 +207,7 @@ static int __init ipcomp6_init(void)
                 pr_info("%s: can't add xfrm type\n", __func__);
                 return -EAGAIN;
         }
-        if (inet6_add_protocol(&ipcomp6_protocol, IPPROTO_COMP) < 0) {
+        if (xfrm6_protocol_register(&ipcomp6_protocol, IPPROTO_COMP) < 0) {
                 pr_info("%s: can't add protocol\n", __func__);
                 xfrm_unregister_type(&ipcomp6_type, AF_INET6);
                 return -EAGAIN;
@@ -209,7 +217,7 @@ static int __init ipcomp6_init(void)
 
 static void __exit ipcomp6_fini(void)
 {
-        if (inet6_del_protocol(&ipcomp6_protocol, IPPROTO_COMP) < 0)
+        if (xfrm6_protocol_deregister(&ipcomp6_protocol, IPPROTO_COMP) < 0)
                 pr_info("%s: can't remove protocol\n", __func__);
         if (xfrm_unregister_type(&ipcomp6_type, AF_INET6) < 0)
                 pr_info("%s: can't remove xfrm type\n", __func__);
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 0a00f449de5e..edb58aff4ae7 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -722,7 +722,7 @@ done:
         case IPV6_MTU_DISCOVER:
                 if (optlen < sizeof(int))
                         goto e_inval;
-                if (val < IPV6_PMTUDISC_DONT || val > IPV6_PMTUDISC_INTERFACE)
+                if (val < IPV6_PMTUDISC_DONT || val > IPV6_PMTUDISC_OMIT)
                         goto e_inval;
                 np->pmtudisc = val;
                 retv = 0;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index e1e47350784b..08b367c6b9cf 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1620,11 +1620,12 @@ static void mld_sendpack(struct sk_buff *skb)
                       dst_output);
 out:
         if (!err) {
-                ICMP6MSGOUT_INC_STATS_BH(net, idev, ICMPV6_MLD2_REPORT);
-                ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
-                IP6_UPD_PO_STATS_BH(net, idev, IPSTATS_MIB_OUTMCAST, payload_len);
-        } else
-                IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_OUTDISCARDS);
+                ICMP6MSGOUT_INC_STATS(net, idev, ICMPV6_MLD2_REPORT);
+                ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
+                IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, payload_len);
+        } else {
+                IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
+        }
 
         rcu_read_unlock();
         return;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 710238f58aa9..e080fbbbc0e5 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1241,8 +1241,10 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 
         xt_free_table_info(oldinfo);
         if (copy_to_user(counters_ptr, counters,
-                         sizeof(struct xt_counters) * num_counters) != 0)
-                ret = -EFAULT;
+                         sizeof(struct xt_counters) * num_counters) != 0) {
+                /* Silent error, can't fail, new table is already in place */
+                net_warn_ratelimited("ip6tables: counters copy to user failed while replacing table\n");
+        }
         vfree(counters);
         xt_table_unlock(t);
         return ret;
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index 827f795209cf..6313abd53c9d 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -6,24 +6,24 @@
 #include <net/ipv6.h>
 #include <net/ip6_fib.h>
 #include <net/addrconf.h>
+#include <net/secure_seq.h>
 
 void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
 {
         static atomic_t ipv6_fragmentation_id;
+        struct in6_addr addr;
         int old, new;
 
 #if IS_ENABLED(CONFIG_IPV6)
-        if (rt && !(rt->dst.flags & DST_NOPEER)) {
-                struct inet_peer *peer;
-                struct net *net;
-
-                net = dev_net(rt->dst.dev);
-                peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
-                if (peer) {
-                        fhdr->identification = htonl(inet_getid(peer, 0));
-                        inet_putpeer(peer);
-                        return;
-                }
+        struct inet_peer *peer;
+        struct net *net;
+
+        net = dev_net(rt->dst.dev);
+        peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
+        if (peer) {
+                fhdr->identification = htonl(inet_getid(peer, 0));
+                inet_putpeer(peer);
+                return;
         }
 #endif
         do {
@@ -32,7 +32,10 @@ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
                 if (!new)
                         new = 1;
         } while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old);
-        fhdr->identification = htonl(new);
+
+        addr = rt->rt6i_dst.addr;
+        addr.s6_addr32[0] ^= (__force __be32)new;
+        fhdr->identification = htonl(secure_ipv6_id(addr.s6_addr32));
 }
 EXPORT_SYMBOL(ipv6_select_ident);
 
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 587bbdcb22b4..bda74291c3e0 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -182,8 +182,8 @@ int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                               MSG_DONTWAIT, np->dontfrag);
 
         if (err) {
-                ICMP6_INC_STATS_BH(sock_net(sk), rt->rt6i_idev,
-                                   ICMP6_MIB_OUTERRORS);
+                ICMP6_INC_STATS(sock_net(sk), rt->rt6i_idev,
+                                ICMP6_MIB_OUTERRORS);
                 ip6_flush_pending_frames(sk);
         } else {
                 err = icmpv6_push_pending_frames(sk, &fl6,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index fba54a407bb2..4011617cca68 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -84,9 +84,9 @@ static void		ip6_dst_ifdown(struct dst_entry *,
 static int               ip6_dst_gc(struct dst_ops *ops);
 
 static int              ip6_pkt_discard(struct sk_buff *skb);
-static int              ip6_pkt_discard_out(struct sk_buff *skb);
+static int              ip6_pkt_discard_out(struct sock *sk, struct sk_buff *skb);
 static int              ip6_pkt_prohibit(struct sk_buff *skb);
-static int              ip6_pkt_prohibit_out(struct sk_buff *skb);
+static int              ip6_pkt_prohibit_out(struct sock *sk, struct sk_buff *skb);
 static void             ip6_link_failure(struct sk_buff *skb);
 static void             ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
                                            struct sk_buff *skb, u32 mtu);
@@ -149,7 +149,8 @@ static u32 *ipv6_cow_metrics(struct dst_entry *dst, unsigned long old)
                 unsigned long prev, new;
 
                 p = peer->metrics;
-                if (inet_metrics_new(peer))
+                if (inet_metrics_new(peer) ||
+                    (old & DST_METRICS_FORCE_OVERWRITE))
                         memcpy(p, old_p, sizeof(u32) * RTAX_MAX);
 
                 new = (unsigned long) p;
@@ -289,7 +290,7 @@ static const struct rt6_info ip6_blk_hole_entry_template = {
                 .obsolete       = DST_OBSOLETE_FORCE_CHK,
                 .error          = -EINVAL,
                 .input          = dst_discard,
-                .output         = dst_discard,
+                .output         = dst_discard_sk,
         },
         .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
         .rt6i_protocol  = RTPROT_KERNEL,
@@ -373,12 +374,6 @@ static bool rt6_check_expired(const struct rt6_info *rt)
         return false;
 }
 
-static bool rt6_need_strict(const struct in6_addr *daddr)
-{
-        return ipv6_addr_type(daddr) &
-                (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
-}
-
 /* Multipath route selection:
  *   Hash based function using packet header and flowlabel.
  * Adapted from fib_info_hashfn()
@@ -857,14 +852,15 @@ EXPORT_SYMBOL(rt6_lookup);
    be destroyed.
  */
 
-static int __ip6_ins_rt(struct rt6_info *rt, struct nl_info *info)
+static int __ip6_ins_rt(struct rt6_info *rt, struct nl_info *info,
+                        struct nlattr *mx, int mx_len)
 {
         int err;
         struct fib6_table *table;
 
         table = rt->rt6i_table;
         write_lock_bh(&table->tb6_lock);
-        err = fib6_add(&table->tb6_root, rt, info);
+        err = fib6_add(&table->tb6_root, rt, info, mx, mx_len);
         write_unlock_bh(&table->tb6_lock);
 
         return err;
@@ -875,7 +871,7 @@ int ip6_ins_rt(struct rt6_info *rt)
         struct nl_info info = {
                 .nl_net = dev_net(rt->dst.dev),
         };
-        return __ip6_ins_rt(rt, &info);
+        return __ip6_ins_rt(rt, &info, NULL, 0);
 }
 
 static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort,
@@ -1062,7 +1058,7 @@ struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_ori
 
                 new->__use = 1;
                 new->input = dst_discard;
-                new->output = dst_discard;
+                new->output = dst_discard_sk;
 
                 if (dst_metrics_read_only(&ort->dst))
                         new->_metrics = ort->dst._metrics;
@@ -1342,7 +1338,7 @@ static unsigned int ip6_mtu(const struct dst_entry *dst)
         unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
 
         if (mtu)
-                return mtu;
+                goto out;
 
         mtu = IPV6_MIN_MTU;
 
@@ -1352,7 +1348,8 @@ static unsigned int ip6_mtu(const struct dst_entry *dst)
                 mtu = idev->cnf.mtu6;
         rcu_read_unlock();
 
-        return mtu;
+out:
+        return min_t(unsigned int, mtu, IP6_MAX_MTU);
 }
 
 static struct dst_entry *icmp6_dst_gc_list;
@@ -1543,17 +1540,11 @@ int ip6_route_add(struct fib6_config *cfg)
 
         ipv6_addr_prefix(&rt->rt6i_dst.addr, &cfg->fc_dst, cfg->fc_dst_len);
         rt->rt6i_dst.plen = cfg->fc_dst_len;
-        if (rt->rt6i_dst.plen == 128)
-               rt->dst.flags |= DST_HOST;
-
-        if (!(rt->dst.flags & DST_HOST) && cfg->fc_mx) {
-                u32 *metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
-                if (!metrics) {
-                        err = -ENOMEM;
-                        goto out;
-                }
-                dst_init_metrics(&rt->dst, metrics, 0);
+        if (rt->rt6i_dst.plen == 128) {
+                rt->dst.flags |= DST_HOST;
+                dst_metrics_set_force_overwrite(&rt->dst);
         }
+
 #ifdef CONFIG_IPV6_SUBTREES
         ipv6_addr_prefix(&rt->rt6i_src.addr, &cfg->fc_src, cfg->fc_src_len);
         rt->rt6i_src.plen = cfg->fc_src_len;
@@ -1586,7 +1577,7 @@ int ip6_route_add(struct fib6_config *cfg)
                 switch (cfg->fc_type) {
                 case RTN_BLACKHOLE:
                         rt->dst.error = -EINVAL;
-                        rt->dst.output = dst_discard;
+                        rt->dst.output = dst_discard_sk;
                         rt->dst.input = dst_discard;
                         break;
                 case RTN_PROHIBIT:
@@ -1672,31 +1663,13 @@ int ip6_route_add(struct fib6_config *cfg)
         rt->rt6i_flags = cfg->fc_flags;
 
 install_route:
-        if (cfg->fc_mx) {
-                struct nlattr *nla;
-                int remaining;
-
-                nla_for_each_attr(nla, cfg->fc_mx, cfg->fc_mx_len, remaining) {
-                        int type = nla_type(nla);
-
-                        if (type) {
-                                if (type > RTAX_MAX) {
-                                        err = -EINVAL;
-                                        goto out;
-                                }
-
-                                dst_metric_set(&rt->dst, type, nla_get_u32(nla));
-                        }
-                }
-        }
-
         rt->dst.dev = dev;
         rt->rt6i_idev = idev;
         rt->rt6i_table = table;
 
         cfg->fc_nlinfo.nl_net = dev_net(dev);
 
-        return __ip6_ins_rt(rt, &cfg->fc_nlinfo);
+        return __ip6_ins_rt(rt, &cfg->fc_nlinfo, cfg->fc_mx, cfg->fc_mx_len);
 
 out:
         if (dev)
@@ -2156,7 +2129,7 @@ static int ip6_pkt_discard(struct sk_buff *skb)
         return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_INNOROUTES);
 }
 
-static int ip6_pkt_discard_out(struct sk_buff *skb)
+static int ip6_pkt_discard_out(struct sock *sk, struct sk_buff *skb)
 {
         skb->dev = skb_dst(skb)->dev;
         return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_OUTNOROUTES);
@@ -2167,7 +2140,7 @@ static int ip6_pkt_prohibit(struct sk_buff *skb)
         return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_INNOROUTES);
 }
 
-static int ip6_pkt_prohibit_out(struct sk_buff *skb)
+static int ip6_pkt_prohibit_out(struct sock *sk, struct sk_buff *skb)
 {
         skb->dev = skb_dst(skb)->dev;
         return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index b4d74c86586c..8da8268d65f8 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -974,8 +974,9 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 goto out;
         }
 
-        err = iptunnel_xmit(rt, skb, fl4.saddr, fl4.daddr, IPPROTO_IPV6, tos,
-                            ttl, df, !net_eq(tunnel->net, dev_net(dev)));
+        err = iptunnel_xmit(skb->sk, rt, skb, fl4.saddr, fl4.daddr,
+                            IPPROTO_IPV6, tos, ttl, df,
+                            !net_eq(tunnel->net, dev_net(dev)));
         iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
         return NETDEV_TX_OK;
 
@@ -1363,7 +1364,6 @@ static void ipip6_tunnel_setup(struct net_device *dev)
 static int ipip6_tunnel_init(struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        int i;
 
         tunnel->dev = dev;
         tunnel->net = dev_net(dev);
@@ -1372,16 +1372,10 @@ static int ipip6_tunnel_init(struct net_device *dev)
         memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
 
         ipip6_tunnel_bind_dev(dev);
-        dev->tstats = alloc_percpu(struct pcpu_sw_netstats);
+        dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!dev->tstats)
                 return -ENOMEM;
 
-        for_each_possible_cpu(i) {
-                struct pcpu_sw_netstats *ipip6_tunnel_stats;
-                ipip6_tunnel_stats = per_cpu_ptr(dev->tstats, i);
-                u64_stats_init(&ipip6_tunnel_stats->syncp);
-        }
-
         tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);
         if (!tunnel->dst_cache) {
                 free_percpu(dev->tstats);
@@ -1397,7 +1391,6 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
         struct iphdr *iph = &tunnel->parms.iph;
         struct net *net = dev_net(dev);
         struct sit_net *sitn = net_generic(net, sit_net_id);
-        int i;
 
         tunnel->dev = dev;
         tunnel->net = dev_net(dev);
@@ -1408,16 +1401,10 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
         iph->ihl                = 5;
         iph->ttl                = 64;
 
-        dev->tstats = alloc_percpu(struct pcpu_sw_netstats);
+        dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!dev->tstats)
                 return -ENOMEM;
 
-        for_each_possible_cpu(i) {
-                struct pcpu_sw_netstats *ipip6_fb_stats;
-                ipip6_fb_stats = per_cpu_ptr(dev->tstats, i);
-                u64_stats_init(&ipip6_fb_stats->syncp);
-        }
-
         tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);
         if (!tunnel->dst_cache) {
                 free_percpu(dev->tstats);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 889079b2ea85..e289830ed6e3 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -39,7 +39,7 @@
 #include <linux/ipsec.h>
 #include <linux/times.h>
 #include <linux/slab.h>
-
+#include <linux/uaccess.h>
 #include <linux/ipv6.h>
 #include <linux/icmpv6.h>
 #include <linux/random.h>
@@ -65,8 +65,6 @@
 #include <net/tcp_memcontrol.h>
 #include <net/busy_poll.h>
 
-#include <asm/uaccess.h>
-
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 
@@ -501,8 +499,10 @@ static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req)
         int res;
 
         res = tcp_v6_send_synack(sk, NULL, &fl6, req, 0);
-        if (!res)
+        if (!res) {
                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
+        }
         return res;
 }
 
@@ -530,8 +530,8 @@ static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
         return tcp_v6_md5_do_lookup(sk, &inet_rsk(req)->ir_v6_rmt_addr);
 }
 
-static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
-                                  int optlen)
+static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
+                                 int optlen)
 {
         struct tcp_md5sig cmd;
         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
@@ -715,7 +715,7 @@ struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
         .send_ack       =       tcp_v6_reqsk_send_ack,
         .destructor     =       tcp_v6_reqsk_destructor,
         .send_reset     =       tcp_v6_send_reset,
-        .syn_ack_timeout =      tcp_syn_ack_timeout,
+        .syn_ack_timeout =      tcp_syn_ack_timeout,
 };
 
 #ifdef CONFIG_TCP_MD5SIG
@@ -726,7 +726,7 @@ static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 #endif
 
 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
-                                 u32 tsval, u32 tsecr,
+                                 u32 tsval, u32 tsecr, int oif,
                                  struct tcp_md5sig_key *key, int rst, u8 tclass,
                                  u32 label)
 {
@@ -798,8 +798,10 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 
         fl6.flowi6_proto = IPPROTO_TCP;
-        if (ipv6_addr_type(&fl6.daddr) & IPV6_ADDR_LINKLOCAL)
+        if (rt6_need_strict(&fl6.daddr) && !oif)
                 fl6.flowi6_oif = inet6_iif(skb);
+        else
+                fl6.flowi6_oif = oif;
         fl6.fl6_dport = t1->dest;
         fl6.fl6_sport = t1->source;
         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
@@ -833,6 +835,7 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
         int genhash;
         struct sock *sk1 = NULL;
 #endif
+        int oif;
 
         if (th->rst)
                 return;
@@ -876,7 +879,8 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
                           (th->doff << 2);
 
-        tcp_v6_send_response(skb, seq, ack_seq, 0, 0, 0, key, 1, 0, 0);
+        oif = sk ? sk->sk_bound_dev_if : 0;
+        tcp_v6_send_response(skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 
 #ifdef CONFIG_TCP_MD5SIG
 release_sk1:
@@ -888,11 +892,11 @@ release_sk1:
 }
 
 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
-                            u32 win, u32 tsval, u32 tsecr,
+                            u32 win, u32 tsval, u32 tsecr, int oif,
                             struct tcp_md5sig_key *key, u8 tclass,
                             u32 label)
 {
-        tcp_v6_send_response(skb, seq, ack, win, tsval, tsecr, key, 0, tclass,
+        tcp_v6_send_response(skb, seq, ack, win, tsval, tsecr, oif, key, 0, tclass,
                              label);
 }
 
@@ -904,7 +908,7 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
                         tcp_time_stamp + tcptw->tw_ts_offset,
-                        tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw),
+                        tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
                         tw->tw_tclass, (tw->tw_flowlabel << 12));
 
         inet_twsk_put(tw);
@@ -914,7 +918,7 @@ static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
                                   struct request_sock *req)
 {
         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1,
-                        req->rcv_wnd, tcp_time_stamp, req->ts_recent,
+                        req->rcv_wnd, tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
                         0, 0);
 }
@@ -1259,7 +1263,8 @@ static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Copy over the MD5 key from the original socket */
-        if ((key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr)) != NULL) {
+        key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
+        if (key != NULL) {
                 /* We're using one, so create a matching key
                  * on the newsk structure. If we fail to get
                  * memory, then we end up not copying the key
@@ -1303,9 +1308,8 @@ static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
                                               &ipv6_hdr(skb)->saddr,
                                               &ipv6_hdr(skb)->daddr, 0));
 
-        if (skb->len <= 76) {
+        if (skb->len <= 76)
                 return __skb_checksum_complete(skb);
-        }
         return 0;
 }
 
@@ -1335,7 +1339,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                 return tcp_v4_do_rcv(sk, skb);
 
 #ifdef CONFIG_TCP_MD5SIG
-        if (tcp_v6_inbound_md5_hash (sk, skb))
+        if (tcp_v6_inbound_md5_hash(sk, skb))
                 goto discard;
 #endif
 
@@ -1602,7 +1606,8 @@ do_time_wait:
                 break;
         case TCP_TW_RST:
                 goto no_tcp_socket;
-        case TCP_TW_SUCCESS:;
+        case TCP_TW_SUCCESS:
+                ;
         }
         goto discard_it;
 }
@@ -1647,7 +1652,7 @@ static void tcp_v6_early_demux(struct sk_buff *skb)
 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
         .twsk_unique    = tcp_twsk_unique,
-        .twsk_destructor= tcp_twsk_destructor,
+        .twsk_destructor = tcp_twsk_destructor,
 };
 
 static const struct inet_connection_sock_af_ops ipv6_specific = {
@@ -1681,7 +1686,6 @@ static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
 /*
  *      TCP over IPv4 via INET6 API
  */
-
 static const struct inet_connection_sock_af_ops ipv6_mapped = {
         .queue_xmit        = ip_queue_xmit,
         .send_check        = tcp_v4_send_check,
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index cb04f7a16b5e..901ef6f8addc 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -18,65 +18,6 @@
 #include <net/ipv6.h>
 #include <net/xfrm.h>
 
-/* Informational hook. The decap is still done here. */
-static struct xfrm_tunnel_notifier __rcu *rcv_notify_handlers __read_mostly;
-static DEFINE_MUTEX(xfrm6_mode_tunnel_input_mutex);
-
-int xfrm6_mode_tunnel_input_register(struct xfrm_tunnel_notifier *handler)
-{
-        struct xfrm_tunnel_notifier __rcu **pprev;
-        struct xfrm_tunnel_notifier *t;
-        int ret = -EEXIST;
-        int priority = handler->priority;
-
-        mutex_lock(&xfrm6_mode_tunnel_input_mutex);
-
-        for (pprev = &rcv_notify_handlers;
-             (t = rcu_dereference_protected(*pprev,
-             lockdep_is_held(&xfrm6_mode_tunnel_input_mutex))) != NULL;
-             pprev = &t->next) {
-                if (t->priority > priority)
-                        break;
-                if (t->priority == priority)
-                        goto err;
-
-        }
-
-        handler->next = *pprev;
-        rcu_assign_pointer(*pprev, handler);
-
-        ret = 0;
-
-err:
-        mutex_unlock(&xfrm6_mode_tunnel_input_mutex);
-        return ret;
-}
-EXPORT_SYMBOL_GPL(xfrm6_mode_tunnel_input_register);
-
-int xfrm6_mode_tunnel_input_deregister(struct xfrm_tunnel_notifier *handler)
-{
-        struct xfrm_tunnel_notifier __rcu **pprev;
-        struct xfrm_tunnel_notifier *t;
-        int ret = -ENOENT;
-
-        mutex_lock(&xfrm6_mode_tunnel_input_mutex);
-        for (pprev = &rcv_notify_handlers;
-             (t = rcu_dereference_protected(*pprev,
-             lockdep_is_held(&xfrm6_mode_tunnel_input_mutex))) != NULL;
-             pprev = &t->next) {
-                if (t == handler) {
-                        *pprev = handler->next;
-                        ret = 0;
-                        break;
-                }
-        }
-        mutex_unlock(&xfrm6_mode_tunnel_input_mutex);
-        synchronize_net();
-
-        return ret;
-}
-EXPORT_SYMBOL_GPL(xfrm6_mode_tunnel_input_deregister);
-
 static inline void ipip6_ecn_decapsulate(struct sk_buff *skb)
 {
         const struct ipv6hdr *outer_iph = ipv6_hdr(skb);
@@ -130,7 +71,6 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 
 static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
-        struct xfrm_tunnel_notifier *handler;
         int err = -EINVAL;
 
         if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPV6)
@@ -138,9 +78,6 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
                 goto out;
 
-        for_each_input_rcu(rcv_notify_handlers, handler)
-                handler->handler(skb);
-
         err = skb_unclone(skb, GFP_ATOMIC);
         if (err)
                 goto out;
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 6cd625e37706..19ef329bdbf8 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -163,7 +163,7 @@ static int __xfrm6_output(struct sk_buff *skb)
         return x->outer_mode->afinfo->output_finish(skb);
 }
 
-int xfrm6_output(struct sk_buff *skb)
+int xfrm6_output(struct sock *sk, struct sk_buff *skb)
 {
         return NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL,
                        skb_dst(skb)->dev, __xfrm6_output);
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 5f8e128c512d..2a0bbda2c76a 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -389,11 +389,17 @@ int __init xfrm6_init(void)
         if (ret)
                 goto out_policy;
 
+        ret = xfrm6_protocol_init();
+        if (ret)
+                goto out_state;
+
 #ifdef CONFIG_SYSCTL
         register_pernet_subsys(&xfrm6_net_ops);
 #endif
 out:
         return ret;
+out_state:
+        xfrm6_state_fini();
 out_policy:
         xfrm6_policy_fini();
         goto out;
@@ -404,6 +410,7 @@ void xfrm6_fini(void)
 #ifdef CONFIG_SYSCTL
         unregister_pernet_subsys(&xfrm6_net_ops);
 #endif
+        xfrm6_protocol_fini();
         xfrm6_policy_fini();
         xfrm6_state_fini();
         dst_entries_destroy(&xfrm6_dst_ops);
diff --git a/net/ipv6/xfrm6_protocol.c b/net/ipv6/xfrm6_protocol.c
new file mode 100644
index 000000000000..6ab989c486f7
--- /dev/null
+++ b/net/ipv6/xfrm6_protocol.c
@@ -0,0 +1,270 @@
+/* xfrm6_protocol.c - Generic xfrm protocol multiplexer for ipv6.
+ *
+ * Copyright (C) 2013 secunet Security Networks AG
+ *
+ * Author:
+ * Steffen Klassert <steffen.klassert@secunet.com>
+ *
+ * Based on:
+ * net/ipv4/xfrm4_protocol.c
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/init.h>
+#include <linux/mutex.h>
+#include <linux/skbuff.h>
+#include <linux/icmpv6.h>
+#include <net/ipv6.h>
+#include <net/protocol.h>
+#include <net/xfrm.h>
+
+static struct xfrm6_protocol __rcu *esp6_handlers __read_mostly;
+static struct xfrm6_protocol __rcu *ah6_handlers __read_mostly;
+static struct xfrm6_protocol __rcu *ipcomp6_handlers __read_mostly;
+static DEFINE_MUTEX(xfrm6_protocol_mutex);
+
+static inline struct xfrm6_protocol __rcu **proto_handlers(u8 protocol)
+{
+        switch (protocol) {
+        case IPPROTO_ESP:
+                return &esp6_handlers;
+        case IPPROTO_AH:
+                return &ah6_handlers;
+        case IPPROTO_COMP:
+                return &ipcomp6_handlers;
+        }
+
+        return NULL;
+}
+
+#define for_each_protocol_rcu(head, handler)            \
+        for (handler = rcu_dereference(head);           \
+             handler != NULL;                           \
+             handler = rcu_dereference(handler->next))  \
+
+int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err)
+{
+        int ret;
+        struct xfrm6_protocol *handler;
+
+        for_each_protocol_rcu(*proto_handlers(protocol), handler)
+                if ((ret = handler->cb_handler(skb, err)) <= 0)
+                        return ret;
+
+        return 0;
+}
+EXPORT_SYMBOL(xfrm6_rcv_cb);
+
+static int xfrm6_esp_rcv(struct sk_buff *skb)
+{
+        int ret;
+        struct xfrm6_protocol *handler;
+
+        XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
+
+        for_each_protocol_rcu(esp6_handlers, handler)
+                if ((ret = handler->handler(skb)) != -EINVAL)
+                        return ret;
+
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
+
+        kfree_skb(skb);
+        return 0;
+}
+
+static void xfrm6_esp_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+                          u8 type, u8 code, int offset, __be32 info)
+{
+        struct xfrm6_protocol *handler;
+
+        for_each_protocol_rcu(esp6_handlers, handler)
+                if (!handler->err_handler(skb, opt, type, code, offset, info))
+                        break;
+}
+
+static int xfrm6_ah_rcv(struct sk_buff *skb)
+{
+        int ret;
+        struct xfrm6_protocol *handler;
+
+        XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
+
+        for_each_protocol_rcu(ah6_handlers, handler)
+                if ((ret = handler->handler(skb)) != -EINVAL)
+                        return ret;
+
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
+
+        kfree_skb(skb);
+        return 0;
+}
+
+static void xfrm6_ah_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+                         u8 type, u8 code, int offset, __be32 info)
+{
+        struct xfrm6_protocol *handler;
+
+        for_each_protocol_rcu(ah6_handlers, handler)
+                if (!handler->err_handler(skb, opt, type, code, offset, info))
+                        break;
+}
+
+static int xfrm6_ipcomp_rcv(struct sk_buff *skb)
+{
+        int ret;
+        struct xfrm6_protocol *handler;
+
+        XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
+
+        for_each_protocol_rcu(ipcomp6_handlers, handler)
+                if ((ret = handler->handler(skb)) != -EINVAL)
+                        return ret;
+
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
+
+        kfree_skb(skb);
+        return 0;
+}
+
+static void xfrm6_ipcomp_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+                             u8 type, u8 code, int offset, __be32 info)
+{
+        struct xfrm6_protocol *handler;
+
+        for_each_protocol_rcu(ipcomp6_handlers, handler)
+                if (!handler->err_handler(skb, opt, type, code, offset, info))
+                        break;
+}
+
+static const struct inet6_protocol esp6_protocol = {
+        .handler        =       xfrm6_esp_rcv,
+        .err_handler    =       xfrm6_esp_err,
+        .flags          =       INET6_PROTO_NOPOLICY,
+};
+
+static const struct inet6_protocol ah6_protocol = {
+        .handler        =       xfrm6_ah_rcv,
+        .err_handler    =       xfrm6_ah_err,
+        .flags          =       INET6_PROTO_NOPOLICY,
+};
+
+static const struct inet6_protocol ipcomp6_protocol = {
+        .handler        =       xfrm6_ipcomp_rcv,
+        .err_handler    =       xfrm6_ipcomp_err,
+        .flags          =       INET6_PROTO_NOPOLICY,
+};
+
+static struct xfrm_input_afinfo xfrm6_input_afinfo = {
+        .family         =       AF_INET6,
+        .owner          =       THIS_MODULE,
+        .callback       =       xfrm6_rcv_cb,
+};
+
+static inline const struct inet6_protocol *netproto(unsigned char protocol)
+{
+        switch (protocol) {
+        case IPPROTO_ESP:
+                return &esp6_protocol;
+        case IPPROTO_AH:
+                return &ah6_protocol;
+        case IPPROTO_COMP:
+                return &ipcomp6_protocol;
+        }
+
+        return NULL;
+}
+
+int xfrm6_protocol_register(struct xfrm6_protocol *handler,
+                            unsigned char protocol)
+{
+        struct xfrm6_protocol __rcu **pprev;
+        struct xfrm6_protocol *t;
+        bool add_netproto = false;
+
+        int ret = -EEXIST;
+        int priority = handler->priority;
+
+        mutex_lock(&xfrm6_protocol_mutex);
+
+        if (!rcu_dereference_protected(*proto_handlers(protocol),
+                                       lockdep_is_held(&xfrm6_protocol_mutex)))
+                add_netproto = true;
+
+        for (pprev = proto_handlers(protocol);
+             (t = rcu_dereference_protected(*pprev,
+                        lockdep_is_held(&xfrm6_protocol_mutex))) != NULL;
+             pprev = &t->next) {
+                if (t->priority < priority)
+                        break;
+                if (t->priority == priority)
+                        goto err;
+        }
+
+        handler->next = *pprev;
+        rcu_assign_pointer(*pprev, handler);
+
+        ret = 0;
+
+err:
+        mutex_unlock(&xfrm6_protocol_mutex);
+
+        if (add_netproto) {
+                if (inet6_add_protocol(netproto(protocol), protocol)) {
+                        pr_err("%s: can't add protocol\n", __func__);
+                        ret = -EAGAIN;
+                }
+        }
+
+        return ret;
+}
+EXPORT_SYMBOL(xfrm6_protocol_register);
+
+int xfrm6_protocol_deregister(struct xfrm6_protocol *handler,
+                              unsigned char protocol)
+{
+        struct xfrm6_protocol __rcu **pprev;
+        struct xfrm6_protocol *t;
+        int ret = -ENOENT;
+
+        mutex_lock(&xfrm6_protocol_mutex);
+
+        for (pprev = proto_handlers(protocol);
+             (t = rcu_dereference_protected(*pprev,
+                        lockdep_is_held(&xfrm6_protocol_mutex))) != NULL;
+             pprev = &t->next) {
+                if (t == handler) {
+                        *pprev = handler->next;
+                        ret = 0;
+                        break;
+                }
+        }
+
+        if (!rcu_dereference_protected(*proto_handlers(protocol),
+                                       lockdep_is_held(&xfrm6_protocol_mutex))) {
+                if (inet6_del_protocol(netproto(protocol), protocol) < 0) {
+                        pr_err("%s: can't remove protocol\n", __func__);
+                        ret = -EAGAIN;
+                }
+        }
+
+        mutex_unlock(&xfrm6_protocol_mutex);
+
+        synchronize_net();
+
+        return ret;
+}
+EXPORT_SYMBOL(xfrm6_protocol_deregister);
+
+int __init xfrm6_protocol_init(void)
+{
+        return xfrm_input_register_afinfo(&xfrm6_input_afinfo);
+}
+
+void xfrm6_protocol_fini(void)
+{
+        xfrm_input_unregister_afinfo(&xfrm6_input_afinfo);
+}
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 00b2a6d1c009..41e4e93cb3aa 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -1368,6 +1368,7 @@ static int ipx_release(struct socket *sock)
                 goto out;
 
         lock_sock(sk);
+        sk->sk_shutdown = SHUTDOWN_MASK;
         if (!sock_flag(sk, SOCK_DEAD))
                 sk->sk_state_change(sk);
 
@@ -1791,8 +1792,11 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                 flags & MSG_DONTWAIT, &rc);
-        if (!skb)
+        if (!skb) {
+                if (rc == -EAGAIN && (sk->sk_shutdown & RCV_SHUTDOWN))
+                        rc = 0;
                 goto out;
+        }
 
         ipx     = ipx_hdr(skb);
         copied  = ntohs(ipx->ipx_pktsize) - sizeof(struct ipxhdr);
@@ -1922,6 +1926,26 @@ static int ipx_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long
 }
 #endif
 
+static int ipx_shutdown(struct socket *sock, int mode)
+{
+        struct sock *sk = sock->sk;
+
+        if (mode < SHUT_RD || mode > SHUT_RDWR)
+                return -EINVAL;
+        /* This maps:
+         * SHUT_RD   (0) -> RCV_SHUTDOWN  (1)
+         * SHUT_WR   (1) -> SEND_SHUTDOWN (2)
+         * SHUT_RDWR (2) -> SHUTDOWN_MASK (3)
+         */
+        ++mode;
+
+        lock_sock(sk);
+        sk->sk_shutdown |= mode;
+        release_sock(sk);
+        sk->sk_state_change(sk);
+
+        return 0;
+}
 
 /*
  * Socket family declarations
@@ -1948,7 +1972,7 @@ static const struct proto_ops ipx_dgram_ops = {
         .compat_ioctl   = ipx_compat_ioctl,
 #endif
         .listen         = sock_no_listen,
-        .shutdown       = sock_no_shutdown, /* FIXME: support shutdown */
+        .shutdown       = ipx_shutdown,
         .setsockopt     = ipx_setsockopt,
         .getsockopt     = ipx_getsockopt,
         .sendmsg        = ipx_sendmsg,
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index c4b7218058b6..01e77b0ae075 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1382,6 +1382,7 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                 if (sk->sk_type == SOCK_STREAM) {
                         if (copied < rlen) {
                                 IUCV_SKB_CB(skb)->offset = offset + copied;
+                                skb_queue_head(&sk->sk_receive_queue, skb);
                                 goto done;
                         }
                 }
@@ -1756,7 +1757,7 @@ static int iucv_callback_connreq(struct iucv_path *path,
 
         /* Wake up accept */
         nsk->sk_state = IUCV_CONNECTED;
-        sk->sk_data_ready(sk, 1);
+        sk->sk_data_ready(sk);
         err = 0;
 fail:
         bh_unlock_sock(sk);
@@ -1967,7 +1968,7 @@ static int afiucv_hs_callback_syn(struct sock *sk, struct sk_buff *skb)
         if (!err) {
                 iucv_accept_enqueue(sk, nsk);
                 nsk->sk_state = IUCV_CONNECTED;
-                sk->sk_data_ready(sk, 1);
+                sk->sk_data_ready(sk);
         } else
                 iucv_sock_kill(nsk);
         bh_unlock_sock(sk);
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index cd5b8ec9be04..da787930df0a 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -621,6 +621,42 @@ static void iucv_disable(void)
         put_online_cpus();
 }
 
+static void free_iucv_data(int cpu)
+{
+        kfree(iucv_param_irq[cpu]);
+        iucv_param_irq[cpu] = NULL;
+        kfree(iucv_param[cpu]);
+        iucv_param[cpu] = NULL;
+        kfree(iucv_irq_data[cpu]);
+        iucv_irq_data[cpu] = NULL;
+}
+
+static int alloc_iucv_data(int cpu)
+{
+        /* Note: GFP_DMA used to get memory below 2G */
+        iucv_irq_data[cpu] = kmalloc_node(sizeof(struct iucv_irq_data),
+                             GFP_KERNEL|GFP_DMA, cpu_to_node(cpu));
+        if (!iucv_irq_data[cpu])
+                goto out_free;
+
+        /* Allocate parameter blocks. */
+        iucv_param[cpu] = kmalloc_node(sizeof(union iucv_param),
+                          GFP_KERNEL|GFP_DMA, cpu_to_node(cpu));
+        if (!iucv_param[cpu])
+                goto out_free;
+
+        iucv_param_irq[cpu] = kmalloc_node(sizeof(union iucv_param),
+                          GFP_KERNEL|GFP_DMA, cpu_to_node(cpu));
+        if (!iucv_param_irq[cpu])
+                goto out_free;
+
+        return 0;
+
+out_free:
+        free_iucv_data(cpu);
+        return -ENOMEM;
+}
+
 static int iucv_cpu_notify(struct notifier_block *self,
                                      unsigned long action, void *hcpu)
 {
@@ -630,38 +666,14 @@ static int iucv_cpu_notify(struct notifier_block *self,
         switch (action) {
         case CPU_UP_PREPARE:
         case CPU_UP_PREPARE_FROZEN:
-                iucv_irq_data[cpu] = kmalloc_node(sizeof(struct iucv_irq_data),
-                                        GFP_KERNEL|GFP_DMA, cpu_to_node(cpu));
-                if (!iucv_irq_data[cpu])
-                        return notifier_from_errno(-ENOMEM);
-
-                iucv_param[cpu] = kmalloc_node(sizeof(union iucv_param),
-                                     GFP_KERNEL|GFP_DMA, cpu_to_node(cpu));
-                if (!iucv_param[cpu]) {
-                        kfree(iucv_irq_data[cpu]);
-                        iucv_irq_data[cpu] = NULL;
+                if (alloc_iucv_data(cpu))
                         return notifier_from_errno(-ENOMEM);
-                }
-                iucv_param_irq[cpu] = kmalloc_node(sizeof(union iucv_param),
-                                        GFP_KERNEL|GFP_DMA, cpu_to_node(cpu));
-                if (!iucv_param_irq[cpu]) {
-                        kfree(iucv_param[cpu]);
-                        iucv_param[cpu] = NULL;
-                        kfree(iucv_irq_data[cpu]);
-                        iucv_irq_data[cpu] = NULL;
-                        return notifier_from_errno(-ENOMEM);
-                }
                 break;
         case CPU_UP_CANCELED:
         case CPU_UP_CANCELED_FROZEN:
         case CPU_DEAD:
         case CPU_DEAD_FROZEN:
-                kfree(iucv_param_irq[cpu]);
-                iucv_param_irq[cpu] = NULL;
-                kfree(iucv_param[cpu]);
-                iucv_param[cpu] = NULL;
-                kfree(iucv_irq_data[cpu]);
-                iucv_irq_data[cpu] = NULL;
+                free_iucv_data(cpu);
                 break;
         case CPU_ONLINE:
         case CPU_ONLINE_FROZEN:
@@ -2016,7 +2028,7 @@ static int __init iucv_init(void)
         rc = iucv_query_maxconn();
         if (rc)
                 goto out_ctl;
-        rc = register_external_interrupt(0x4000, iucv_external_interrupt);
+        rc = register_external_irq(EXT_IRQ_IUCV, iucv_external_interrupt);
         if (rc)
                 goto out_ctl;
         iucv_root = root_device_register("iucv");
@@ -2025,33 +2037,20 @@ static int __init iucv_init(void)
                 goto out_int;
         }
 
-        for_each_online_cpu(cpu) {
-                /* Note: GFP_DMA used to get memory below 2G */
-                iucv_irq_data[cpu] = kmalloc_node(sizeof(struct iucv_irq_data),
-                                     GFP_KERNEL|GFP_DMA, cpu_to_node(cpu));
-                if (!iucv_irq_data[cpu]) {
-                        rc = -ENOMEM;
-                        goto out_free;
-                }
+        cpu_notifier_register_begin();
 
-                /* Allocate parameter blocks. */
-                iucv_param[cpu] = kmalloc_node(sizeof(union iucv_param),
-                                  GFP_KERNEL|GFP_DMA, cpu_to_node(cpu));
-                if (!iucv_param[cpu]) {
-                        rc = -ENOMEM;
-                        goto out_free;
-                }
-                iucv_param_irq[cpu] = kmalloc_node(sizeof(union iucv_param),
-                                  GFP_KERNEL|GFP_DMA, cpu_to_node(cpu));
-                if (!iucv_param_irq[cpu]) {
+        for_each_online_cpu(cpu) {
+                if (alloc_iucv_data(cpu)) {
                         rc = -ENOMEM;
                         goto out_free;
                 }
-
         }
-        rc = register_hotcpu_notifier(&iucv_cpu_notifier);
+        rc = __register_hotcpu_notifier(&iucv_cpu_notifier);
         if (rc)
                 goto out_free;
+
+        cpu_notifier_register_done();
+
         rc = register_reboot_notifier(&iucv_reboot_notifier);
         if (rc)
                 goto out_cpu;
@@ -2069,19 +2068,17 @@ static int __init iucv_init(void)
 out_reboot:
         unregister_reboot_notifier(&iucv_reboot_notifier);
 out_cpu:
-        unregister_hotcpu_notifier(&iucv_cpu_notifier);
+        cpu_notifier_register_begin();
+        __unregister_hotcpu_notifier(&iucv_cpu_notifier);
 out_free:
-        for_each_possible_cpu(cpu) {
-                kfree(iucv_param_irq[cpu]);
-                iucv_param_irq[cpu] = NULL;
-                kfree(iucv_param[cpu]);
-                iucv_param[cpu] = NULL;
-                kfree(iucv_irq_data[cpu]);
-                iucv_irq_data[cpu] = NULL;
-        }
+        for_each_possible_cpu(cpu)
+                free_iucv_data(cpu);
+
+        cpu_notifier_register_done();
+
         root_device_unregister(iucv_root);
 out_int:
-        unregister_external_interrupt(0x4000, iucv_external_interrupt);
+        unregister_external_irq(EXT_IRQ_IUCV, iucv_external_interrupt);
 out_ctl:
         ctl_clear_bit(0, 1);
 out:
@@ -2105,18 +2102,14 @@ static void __exit iucv_exit(void)
                 kfree(p);
         spin_unlock_irq(&iucv_queue_lock);
         unregister_reboot_notifier(&iucv_reboot_notifier);
-        unregister_hotcpu_notifier(&iucv_cpu_notifier);
-        for_each_possible_cpu(cpu) {
-                kfree(iucv_param_irq[cpu]);
-                iucv_param_irq[cpu] = NULL;
-                kfree(iucv_param[cpu]);
-                iucv_param[cpu] = NULL;
-                kfree(iucv_irq_data[cpu]);
-                iucv_irq_data[cpu] = NULL;
-        }
+        cpu_notifier_register_begin();
+        __unregister_hotcpu_notifier(&iucv_cpu_notifier);
+        for_each_possible_cpu(cpu)
+                free_iucv_data(cpu);
+        cpu_notifier_register_done();
         root_device_unregister(iucv_root);
         bus_unregister(&iucv_bus);
-        unregister_external_interrupt(0x4000, iucv_external_interrupt);
+        unregister_external_irq(EXT_IRQ_IUCV, iucv_external_interrupt);
 }
 
 subsys_initcall(iucv_init);
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 79326978517a..f3c83073afc4 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -205,7 +205,7 @@ static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
                 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) {
                         skb_set_owner_r(*skb2, sk);
                         skb_queue_tail(&sk->sk_receive_queue, *skb2);
-                        sk->sk_data_ready(sk, (*skb2)->len);
+                        sk->sk_data_ready(sk);
                         *skb2 = NULL;
                         err = 0;
                 }
@@ -365,6 +365,7 @@ static const u8 sadb_ext_min_len[] = {
         [SADB_X_EXT_NAT_T_OA]           = (u8) sizeof(struct sadb_address),
         [SADB_X_EXT_SEC_CTX]            = (u8) sizeof(struct sadb_x_sec_ctx),
         [SADB_X_EXT_KMADDRESS]          = (u8) sizeof(struct sadb_x_kmaddress),
+        [SADB_X_EXT_FILTER]             = (u8) sizeof(struct sadb_x_filter),
 };
 
 /* Verify sadb_address_{len,prefixlen} against sa_family.  */
@@ -1799,6 +1800,7 @@ static void pfkey_dump_sa_done(struct pfkey_sock *pfk)
 static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
 {
         u8 proto;
+        struct xfrm_address_filter *filter = NULL;
         struct pfkey_sock *pfk = pfkey_sk(sk);
 
         if (pfk->dump.dump != NULL)
@@ -1808,11 +1810,27 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
         if (proto == 0)
                 return -EINVAL;
 
+        if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
+                struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
+
+                filter = kmalloc(sizeof(*filter), GFP_KERNEL);
+                if (filter == NULL)
+                        return -ENOMEM;
+
+                memcpy(&filter->saddr, &xfilter->sadb_x_filter_saddr,
+                       sizeof(xfrm_address_t));
+                memcpy(&filter->daddr, &xfilter->sadb_x_filter_daddr,
+                       sizeof(xfrm_address_t));
+                filter->family = xfilter->sadb_x_filter_family;
+                filter->splen = xfilter->sadb_x_filter_splen;
+                filter->dplen = xfilter->sadb_x_filter_dplen;
+        }
+
         pfk->dump.msg_version = hdr->sadb_msg_version;
         pfk->dump.msg_portid = hdr->sadb_msg_pid;
         pfk->dump.dump = pfkey_dump_sa;
         pfk->dump.done = pfkey_dump_sa_done;
-        xfrm_state_walk_init(&pfk->dump.u.state, proto);
+        xfrm_state_walk_init(&pfk->dump.u.state, proto, filter);
 
         return pfkey_do_dump(pfk);
 }
@@ -3060,6 +3078,24 @@ static u32 get_acqseq(void)
         return res;
 }
 
+static bool pfkey_is_alive(const struct km_event *c)
+{
+        struct netns_pfkey *net_pfkey = net_generic(c->net, pfkey_net_id);
+        struct sock *sk;
+        bool is_alive = false;
+
+        rcu_read_lock();
+        sk_for_each_rcu(sk, &net_pfkey->table) {
+                if (pfkey_sk(sk)->registered) {
+                        is_alive = true;
+                        break;
+                }
+        }
+        rcu_read_unlock();
+
+        return is_alive;
+}
+
 static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *xp)
 {
         struct sk_buff *skb;
@@ -3785,6 +3821,7 @@ static struct xfrm_mgr pfkeyv2_mgr =
         .new_mapping    = pfkey_send_new_mapping,
         .notify_policy  = pfkey_send_policy_notify,
         .migrate        = pfkey_send_migrate,
+        .is_alive       = pfkey_is_alive,
 };
 
 static int __net_init pfkey_net_init(struct net *net)
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index c83827e7c324..a4e37d7158dc 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1130,11 +1130,11 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
         /* Queue the packet to IP for output */
         skb->local_df = 1;
 #if IS_ENABLED(CONFIG_IPV6)
-        if (skb->sk->sk_family == PF_INET6 && !tunnel->v4mapped)
-                error = inet6_csk_xmit(skb, NULL);
+        if (tunnel->sock->sk_family == PF_INET6 && !tunnel->v4mapped)
+                error = inet6_csk_xmit(tunnel->sock, skb, NULL);
         else
 #endif
-                error = ip_queue_xmit(skb, fl);
+                error = ip_queue_xmit(tunnel->sock, skb, fl);
 
         /* Update stats */
         if (error >= 0) {
@@ -1150,23 +1150,6 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
         return 0;
 }
 
-/* Automatically called when the skb is freed.
- */
-static void l2tp_sock_wfree(struct sk_buff *skb)
-{
-        sock_put(skb->sk);
-}
-
-/* For data skbs that we transmit, we associate with the tunnel socket
- * but don't do accounting.
- */
-static inline void l2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
-{
-        sock_hold(sk);
-        skb->sk = sk;
-        skb->destructor = l2tp_sock_wfree;
-}
-
 #if IS_ENABLED(CONFIG_IPV6)
 static void l2tp_xmit_ipv6_csum(struct sock *sk, struct sk_buff *skb,
                                 int udp_len)
@@ -1220,7 +1203,6 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
                 return NET_XMIT_DROP;
         }
 
-        skb_orphan(skb);
         /* Setup L2TP header */
         session->build_header(session, __skb_push(skb, hdr_len));
 
@@ -1286,8 +1268,6 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
                 break;
         }
 
-        l2tp_skb_set_owner_w(skb, sk);
-
         l2tp_xmit_core(session, skb, fl, data_len);
 out_unlock:
         bh_unlock_sock(sk);
@@ -1808,8 +1788,6 @@ void l2tp_session_free(struct l2tp_session *session)
         }
 
         kfree(session);
-
-        return;
 }
 EXPORT_SYMBOL_GPL(l2tp_session_free);
 
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 0b44d855269c..3397fe6897c0 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -487,7 +487,7 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
 
 xmit:
         /* Queue the packet to IP for output */
-        rc = ip_queue_xmit(skb, &inet->cork.fl);
+        rc = ip_queue_xmit(sk, skb, &inet->cork.fl);
         rcu_read_unlock();
 
 error:
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 5990919356a5..950909f04ee6 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -456,13 +456,11 @@ static void pppol2tp_session_close(struct l2tp_session *session)
 
         BUG_ON(session->magic != L2TP_SESSION_MAGIC);
 
-
         if (sock) {
                 inet_shutdown(sock, 2);
                 /* Don't let the session go away before our socket does */
                 l2tp_session_inc_refcount(session);
         }
-        return;
 }
 
 /* Really kill the session socket. (Called from sock_put() if
@@ -476,7 +474,6 @@ static void pppol2tp_session_destruct(struct sock *sk)
                 BUG_ON(session->magic != L2TP_SESSION_MAGIC);
                 l2tp_session_dec_refcount(session);
         }
-        return;
 }
 
 /* Called when the PPPoX socket (session) is closed.
@@ -756,9 +753,9 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
         session->deref = pppol2tp_session_sock_put;
 
         /* If PMTU discovery was enabled, use the MTU that was discovered */
-        dst = sk_dst_get(sk);
+        dst = sk_dst_get(tunnel->sock);
         if (dst != NULL) {
-                u32 pmtu = dst_mtu(__sk_dst_get(sk));
+                u32 pmtu = dst_mtu(__sk_dst_get(tunnel->sock));
                 if (pmtu != 0)
                         session->mtu = session->mru = pmtu -
                                 PPPOL2TP_HEADER_OVERHEAD;
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 13b7683de5a4..ce9633a3cfb0 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -107,7 +107,7 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
         mgmt->u.action.u.addba_req.start_seq_num =
                                         cpu_to_le16(start_seq_num << 4);
 
-        ieee80211_tx_skb_tid(sdata, skb, tid);
+        ieee80211_tx_skb(sdata, skb);
 }
 
 void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 453e974287d1..aaa59d719592 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -451,11 +451,11 @@ void sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
                 rinfo->flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
         if (sta->last_rx_rate_flag & RX_FLAG_SHORT_GI)
                 rinfo->flags |= RATE_INFO_FLAGS_SHORT_GI;
-        if (sta->last_rx_rate_flag & RX_FLAG_80MHZ)
+        if (sta->last_rx_rate_vht_flag & RX_VHT_FLAG_80MHZ)
                 rinfo->flags |= RATE_INFO_FLAGS_80_MHZ_WIDTH;
-        if (sta->last_rx_rate_flag & RX_FLAG_80P80MHZ)
+        if (sta->last_rx_rate_vht_flag & RX_VHT_FLAG_80P80MHZ)
                 rinfo->flags |= RATE_INFO_FLAGS_80P80_MHZ_WIDTH;
-        if (sta->last_rx_rate_flag & RX_FLAG_160MHZ)
+        if (sta->last_rx_rate_vht_flag & RX_VHT_FLAG_160MHZ)
                 rinfo->flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
 }
 
@@ -970,9 +970,9 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
         /* TODO: make hostapd tell us what it wants */
         sdata->smps_mode = IEEE80211_SMPS_OFF;
         sdata->needed_rx_chains = sdata->local->rx_chains;
-        sdata->radar_required = params->radar_required;
 
         mutex_lock(&local->mtx);
+        sdata->radar_required = params->radar_required;
         err = ieee80211_vif_use_channel(sdata, &params->chandef,
                                         IEEE80211_CHANCTX_SHARED);
         mutex_unlock(&local->mtx);
@@ -1056,6 +1056,7 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
         int err;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        sdata_assert_lock(sdata);
 
         /* don't allow changing the beacon while CSA is in place - offset
          * of channel switch counter may change
@@ -1083,6 +1084,8 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         struct probe_resp *old_probe_resp;
         struct cfg80211_chan_def chandef;
 
+        sdata_assert_lock(sdata);
+
         old_beacon = sdata_dereference(sdata->u.ap.beacon, sdata);
         if (!old_beacon)
                 return -ENOENT;
@@ -1343,6 +1346,15 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
                                                     params->vht_capa, sta);
 
+        if (params->opmode_notif_used) {
+                /* returned value is only needed for rc update, but the
+                 * rc isn't initialized here yet, so ignore it
+                 */
+                __ieee80211_vht_handle_opmode(sdata, sta,
+                                              params->opmode_notif,
+                                              band, false);
+        }
+
         if (ieee80211_vif_is_mesh(&sdata->vif)) {
 #ifdef CONFIG_MAC80211_MESH
                 u32 changed = 0;
@@ -2630,6 +2642,18 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
         if (!roc)
                 return -ENOMEM;
 
+        /*
+         * If the duration is zero, then the driver
+         * wouldn't actually do anything. Set it to
+         * 10 for now.
+         *
+         * TODO: cancel the off-channel operation
+         *       when we get the SKB's TX status and
+         *       the wait time was zero before.
+         */
+        if (!duration)
+                duration = 10;
+
         roc->chan = channel;
         roc->duration = duration;
         roc->req_duration = duration;
@@ -2671,18 +2695,6 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
 
         /* otherwise actually kick it off here (for error handling) */
 
-        /*
-         * If the duration is zero, then the driver
-         * wouldn't actually do anything. Set it to
-         * 10 for now.
-         *
-         * TODO: cancel the off-channel operation
-         *       when we get the SKB's TX status and
-         *       the wait time was zero before.
-         */
-        if (!duration)
-                duration = 10;
-
         ret = drv_remain_on_channel(local, sdata, channel, duration, type);
         if (ret) {
                 kfree(roc);
@@ -2902,11 +2914,11 @@ static int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
 
 static int ieee80211_start_radar_detection(struct wiphy *wiphy,
                                            struct net_device *dev,
-                                           struct cfg80211_chan_def *chandef)
+                                           struct cfg80211_chan_def *chandef,
+                                           u32 cac_time_ms)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
-        unsigned long timeout;
         int err;
 
         mutex_lock(&local->mtx);
@@ -2925,9 +2937,9 @@ static int ieee80211_start_radar_detection(struct wiphy *wiphy,
         if (err)
                 goto out_unlock;
 
-        timeout = msecs_to_jiffies(IEEE80211_DFS_MIN_CAC_TIME_MS);
         ieee80211_queue_delayed_work(&sdata->local->hw,
-                                     &sdata->dfs_cac_timer_work, timeout);
+                                     &sdata->dfs_cac_timer_work,
+                                     msecs_to_jiffies(cac_time_ms));
 
  out_unlock:
         mutex_unlock(&local->mtx);
@@ -2990,136 +3002,135 @@ cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon)
         return new_beacon;
 }
 
-void ieee80211_csa_finalize_work(struct work_struct *work)
+void ieee80211_csa_finish(struct ieee80211_vif *vif)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+
+        ieee80211_queue_work(&sdata->local->hw,
+                             &sdata->csa_finalize_work);
+}
+EXPORT_SYMBOL(ieee80211_csa_finish);
+
+static void ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_sub_if_data *sdata =
-                container_of(work, struct ieee80211_sub_if_data,
-                             csa_finalize_work);
         struct ieee80211_local *local = sdata->local;
         int err, changed = 0;
 
-        sdata_lock(sdata);
-        /* AP might have been stopped while waiting for the lock. */
-        if (!sdata->vif.csa_active)
-                goto unlock;
-
-        if (!ieee80211_sdata_running(sdata))
-                goto unlock;
+        sdata_assert_lock(sdata);
 
-        sdata->radar_required = sdata->csa_radar_required;
         mutex_lock(&local->mtx);
+        sdata->radar_required = sdata->csa_radar_required;
         err = ieee80211_vif_change_channel(sdata, &changed);
         mutex_unlock(&local->mtx);
         if (WARN_ON(err < 0))
-                goto unlock;
+                return;
 
         if (!local->use_chanctx) {
                 local->_oper_chandef = sdata->csa_chandef;
                 ieee80211_hw_config(local, 0);
         }
 
-        ieee80211_bss_info_change_notify(sdata, changed);
-
         sdata->vif.csa_active = false;
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP:
                 err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
-                if (err < 0)
-                        goto unlock;
-
-                changed |= err;
                 kfree(sdata->u.ap.next_beacon);
                 sdata->u.ap.next_beacon = NULL;
 
-                ieee80211_bss_info_change_notify(sdata, err);
+                if (err < 0)
+                        return;
+                changed |= err;
                 break;
         case NL80211_IFTYPE_ADHOC:
-                ieee80211_ibss_finish_csa(sdata);
+                err = ieee80211_ibss_finish_csa(sdata);
+                if (err < 0)
+                        return;
+                changed |= err;
                 break;
 #ifdef CONFIG_MAC80211_MESH
         case NL80211_IFTYPE_MESH_POINT:
                 err = ieee80211_mesh_finish_csa(sdata);
                 if (err < 0)
-                        goto unlock;
+                        return;
+                changed |= err;
                 break;
 #endif
         default:
                 WARN_ON(1);
-                goto unlock;
+                return;
         }
 
+        ieee80211_bss_info_change_notify(sdata, changed);
+
         ieee80211_wake_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
 
         cfg80211_ch_switch_notify(sdata->dev, &sdata->csa_chandef);
-
-unlock:
-        sdata_unlock(sdata);
 }
 
-int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
-                             struct cfg80211_csa_settings *params)
+void ieee80211_csa_finalize_work(struct work_struct *work)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_chanctx_conf *chanctx_conf;
-        struct ieee80211_chanctx *chanctx;
-        struct ieee80211_if_mesh __maybe_unused *ifmsh;
-        int err, num_chanctx;
-
-        lockdep_assert_held(&sdata->wdev.mtx);
-
-        if (!list_empty(&local->roc_list) || local->scanning)
-                return -EBUSY;
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data,
+                             csa_finalize_work);
 
-        if (sdata->wdev.cac_started)
-                return -EBUSY;
+        sdata_lock(sdata);
+        /* AP might have been stopped while waiting for the lock. */
+        if (!sdata->vif.csa_active)
+                goto unlock;
 
-        if (cfg80211_chandef_identical(&params->chandef,
-                                       &sdata->vif.bss_conf.chandef))
-                return -EINVAL;
+        if (!ieee80211_sdata_running(sdata))
+                goto unlock;
 
-        rcu_read_lock();
-        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-        if (!chanctx_conf) {
-                rcu_read_unlock();
-                return -EBUSY;
-        }
+        ieee80211_csa_finalize(sdata);
 
-        /* don't handle for multi-VIF cases */
-        chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
-        if (chanctx->refcount > 1) {
-                rcu_read_unlock();
-                return -EBUSY;
-        }
-        num_chanctx = 0;
-        list_for_each_entry_rcu(chanctx, &local->chanctx_list, list)
-                num_chanctx++;
-        rcu_read_unlock();
-
-        if (num_chanctx > 1)
-                return -EBUSY;
+unlock:
+        sdata_unlock(sdata);
+}
 
-        /* don't allow another channel switch if one is already active. */
-        if (sdata->vif.csa_active)
-                return -EBUSY;
+static int ieee80211_set_csa_beacon(struct ieee80211_sub_if_data *sdata,
+                                    struct cfg80211_csa_settings *params,
+                                    u32 *changed)
+{
+        int err;
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP:
-                sdata->csa_counter_offset_beacon =
-                        params->counter_offset_beacon;
-                sdata->csa_counter_offset_presp = params->counter_offset_presp;
                 sdata->u.ap.next_beacon =
                         cfg80211_beacon_dup(&params->beacon_after);
                 if (!sdata->u.ap.next_beacon)
                         return -ENOMEM;
 
+                /*
+                 * With a count of 0, we don't have to wait for any
+                 * TBTT before switching, so complete the CSA
+                 * immediately.  In theory, with a count == 1 we
+                 * should delay the switch until just before the next
+                 * TBTT, but that would complicate things so we switch
+                 * immediately too.  If we would delay the switch
+                 * until the next TBTT, we would have to set the probe
+                 * response here.
+                 *
+                 * TODO: A channel switch with count <= 1 without
+                 * sending a CSA action frame is kind of useless,
+                 * because the clients won't know we're changing
+                 * channels.  The action frame must be implemented
+                 * either here or in the userspace.
+                 */
+                if (params->count <= 1)
+                        break;
+
+                sdata->csa_counter_offset_beacon =
+                        params->counter_offset_beacon;
+                sdata->csa_counter_offset_presp = params->counter_offset_presp;
                 err = ieee80211_assign_beacon(sdata, &params->beacon_csa);
                 if (err < 0) {
                         kfree(sdata->u.ap.next_beacon);
                         return err;
                 }
+                *changed |= err;
+
                 break;
         case NL80211_IFTYPE_ADHOC:
                 if (!sdata->vif.bss_conf.ibss_joined)
@@ -3147,16 +3158,20 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                     params->chandef.chan->band)
                         return -EINVAL;
 
-                err = ieee80211_ibss_csa_beacon(sdata, params);
-                if (err < 0)
-                        return err;
+                /* see comments in the NL80211_IFTYPE_AP block */
+                if (params->count > 1) {
+                        err = ieee80211_ibss_csa_beacon(sdata, params);
+                        if (err < 0)
+                                return err;
+                        *changed |= err;
+                }
+
+                ieee80211_send_action_csa(sdata, params);
+
                 break;
 #ifdef CONFIG_MAC80211_MESH
-        case NL80211_IFTYPE_MESH_POINT:
-                ifmsh = &sdata->u.mesh;
-
-                if (!ifmsh->mesh_id)
-                        return -EINVAL;
+        case NL80211_IFTYPE_MESH_POINT: {
+                struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
                 if (params->chandef.width != sdata->vif.bss_conf.chandef.width)
                         return -EINVAL;
@@ -3166,23 +3181,87 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                     params->chandef.chan->band)
                         return -EINVAL;
 
-                ifmsh->chsw_init = true;
-                if (!ifmsh->pre_value)
-                        ifmsh->pre_value = 1;
-                else
-                        ifmsh->pre_value++;
+                if (ifmsh->csa_role == IEEE80211_MESH_CSA_ROLE_NONE) {
+                        ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_INIT;
+                        if (!ifmsh->pre_value)
+                                ifmsh->pre_value = 1;
+                        else
+                                ifmsh->pre_value++;
+                }
 
-                err = ieee80211_mesh_csa_beacon(sdata, params, true);
-                if (err < 0) {
-                        ifmsh->chsw_init = false;
-                        return err;
+                /* see comments in the NL80211_IFTYPE_AP block */
+                if (params->count > 1) {
+                        err = ieee80211_mesh_csa_beacon(sdata, params);
+                        if (err < 0) {
+                                ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_NONE;
+                                return err;
+                        }
+                        *changed |= err;
                 }
+
+                if (ifmsh->csa_role == IEEE80211_MESH_CSA_ROLE_INIT)
+                        ieee80211_send_action_csa(sdata, params);
+
                 break;
+                }
 #endif
         default:
                 return -EOPNOTSUPP;
         }
 
+        return 0;
+}
+
+int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+                             struct cfg80211_csa_settings *params)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_chanctx *chanctx;
+        int err, num_chanctx, changed = 0;
+
+        sdata_assert_lock(sdata);
+
+        if (!list_empty(&local->roc_list) || local->scanning)
+                return -EBUSY;
+
+        if (sdata->wdev.cac_started)
+                return -EBUSY;
+
+        if (cfg80211_chandef_identical(&params->chandef,
+                                       &sdata->vif.bss_conf.chandef))
+                return -EINVAL;
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+        if (!chanctx_conf) {
+                rcu_read_unlock();
+                return -EBUSY;
+        }
+
+        /* don't handle for multi-VIF cases */
+        chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
+        if (chanctx->refcount > 1) {
+                rcu_read_unlock();
+                return -EBUSY;
+        }
+        num_chanctx = 0;
+        list_for_each_entry_rcu(chanctx, &local->chanctx_list, list)
+                num_chanctx++;
+        rcu_read_unlock();
+
+        if (num_chanctx > 1)
+                return -EBUSY;
+
+        /* don't allow another channel switch if one is already active. */
+        if (sdata->vif.csa_active)
+                return -EBUSY;
+
+        err = ieee80211_set_csa_beacon(sdata, params, &changed);
+        if (err)
+                return err;
+
         sdata->csa_radar_required = params->radar_required;
 
         if (params->block_tx)
@@ -3193,8 +3272,13 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
         sdata->csa_chandef = params->chandef;
         sdata->vif.csa_active = true;
 
-        ieee80211_bss_info_change_notify(sdata, err);
-        drv_channel_switch_beacon(sdata, &params->chandef);
+        if (changed) {
+                ieee80211_bss_info_change_notify(sdata, changed);
+                drv_channel_switch_beacon(sdata, &params->chandef);
+        } else {
+                /* if the beacon didn't change, we can finalize immediately */
+                ieee80211_csa_finalize(sdata);
+        }
 
         return 0;
 }
@@ -3573,8 +3657,8 @@ ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
 
 static int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
                                u8 *peer, u8 action_code, u8 dialog_token,
-                               u16 status_code, const u8 *extra_ies,
-                               size_t extra_ies_len)
+                               u16 status_code, u32 peer_capability,
+                               const u8 *extra_ies, size_t extra_ies_len)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
@@ -3865,7 +3949,7 @@ static int ieee80211_set_qos_map(struct wiphy *wiphy,
         return 0;
 }
 
-struct cfg80211_ops mac80211_config_ops = {
+const struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
         .change_virtual_intf = ieee80211_change_iface,
diff --git a/net/mac80211/cfg.h b/net/mac80211/cfg.h
index 7d7879f5b00b..2d51f62dc76c 100644
--- a/net/mac80211/cfg.h
+++ b/net/mac80211/cfg.h
@@ -4,6 +4,6 @@
 #ifndef __CFG_H
 #define __CFG_H
 
-extern struct cfg80211_ops mac80211_config_ops;
+extern const struct cfg80211_ops mac80211_config_ops;
 
 #endif /* __CFG_H */
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 0c1ecfdf9a12..bd1fd8ea5105 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -202,6 +202,8 @@ static bool ieee80211_is_radar_required(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
 
+        lockdep_assert_held(&local->mtx);
+
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 if (sdata->radar_required) {
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index ebf80f3abd83..40a648938985 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -358,6 +358,18 @@ static ssize_t ieee80211_if_parse_tkip_mic_test(
 }
 IEEE80211_IF_FILE_W(tkip_mic_test);
 
+static ssize_t ieee80211_if_parse_beacon_loss(
+        struct ieee80211_sub_if_data *sdata, const char *buf, int buflen)
+{
+        if (!ieee80211_sdata_running(sdata) || !sdata->vif.bss_conf.assoc)
+                return -ENOTCONN;
+
+        ieee80211_beacon_loss(&sdata->vif);
+
+        return buflen;
+}
+IEEE80211_IF_FILE_W(beacon_loss);
+
 static ssize_t ieee80211_if_fmt_uapsd_queues(
         const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
 {
@@ -569,6 +581,7 @@ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
         DEBUGFS_ADD(beacon_timeout);
         DEBUGFS_ADD_MODE(smps, 0600);
         DEBUGFS_ADD_MODE(tkip_mic_test, 0200);
+        DEBUGFS_ADD_MODE(beacon_loss, 0200);
         DEBUGFS_ADD_MODE(uapsd_queues, 0600);
         DEBUGFS_ADD_MODE(uapsd_max_sp_len, 0600);
 }
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 80194b557a0c..2ecb4deddb5d 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -195,7 +195,7 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
 static ssize_t sta_agg_status_write(struct file *file, const char __user *userbuf,
                                     size_t count, loff_t *ppos)
 {
-        char _buf[12], *buf = _buf;
+        char _buf[12] = {}, *buf = _buf;
         struct sta_info *sta = file->private_data;
         bool start, tx;
         unsigned long tid;
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index ef8b385eff04..fc689f5d971e 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -354,16 +354,20 @@ drv_sched_scan_start(struct ieee80211_local *local,
         return ret;
 }
 
-static inline void drv_sched_scan_stop(struct ieee80211_local *local,
-                                       struct ieee80211_sub_if_data *sdata)
+static inline int drv_sched_scan_stop(struct ieee80211_local *local,
+                                      struct ieee80211_sub_if_data *sdata)
 {
+        int ret;
+
         might_sleep();
 
         check_sdata_in_driver(sdata);
 
         trace_drv_sched_scan_stop(local, sdata);
-        local->ops->sched_scan_stop(&local->hw, &sdata->vif);
-        trace_drv_return_void(local);
+        ret = local->ops->sched_scan_stop(&local->hw, &sdata->vif);
+        trace_drv_return_int(local, ret);
+
+        return ret;
 }
 
 static inline void drv_sw_scan_start(struct ieee80211_local *local)
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 70dd013de836..c150b68436d7 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -375,7 +375,7 @@ void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
         mgmt->u.action.u.delba.params = cpu_to_le16(params);
         mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
 
-        ieee80211_tx_skb_tid(sdata, skb, tid);
+        ieee80211_tx_skb(sdata, skb);
 }
 
 void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
@@ -482,8 +482,6 @@ void ieee80211_request_smps(struct ieee80211_vif *vif,
                 return;
 
         if (vif->type == NL80211_IFTYPE_STATION) {
-                if (WARN_ON(smps_mode == IEEE80211_SMPS_OFF))
-                        smps_mode = IEEE80211_SMPS_AUTOMATIC;
                 if (sdata->u.mgd.driver_smps_mode == smps_mode)
                         return;
                 sdata->u.mgd.driver_smps_mode = smps_mode;
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 2796a198728f..06d28787945b 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -220,7 +220,6 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_supported_band *sband;
         struct ieee80211_mgmt *mgmt;
         struct cfg80211_bss *bss;
         u32 bss_change;
@@ -284,6 +283,11 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
                                             &chandef);
+        if (err < 0) {
+                sdata_info(sdata,
+                           "Failed to join IBSS, invalid chandef\n");
+                return;
+        }
         if (err > 0) {
                 if (!ifibss->userspace_handles_dfs) {
                         sdata_info(sdata,
@@ -294,7 +298,6 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         }
 
         mutex_lock(&local->mtx);
-        ieee80211_vif_release_channel(sdata);
         if (ieee80211_vif_use_channel(sdata, &chandef,
                                       ifibss->fixed_channel ?
                                         IEEE80211_CHANCTX_SHARED :
@@ -303,12 +306,11 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                 mutex_unlock(&local->mtx);
                 return;
         }
+        sdata->radar_required = radar_required;
         mutex_unlock(&local->mtx);
 
         memcpy(ifibss->bssid, bssid, ETH_ALEN);
 
-        sband = local->hw.wiphy->bands[chan->band];
-
         presp = ieee80211_ibss_build_presp(sdata, beacon_int, basic_rates,
                                            capability, tsf, &chandef,
                                            &have_higher_than_11mbit, NULL);
@@ -318,7 +320,6 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         rcu_assign_pointer(ifibss->presp, presp);
         mgmt = (void *)presp->head;
 
-        sdata->radar_required = radar_required;
         sdata->vif.bss_conf.enable_beacon = true;
         sdata->vif.bss_conf.beacon_int = beacon_int;
         sdata->vif.bss_conf.basic_rates = basic_rates;
@@ -386,7 +387,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                                               presp->head_len, 0, GFP_KERNEL);
         cfg80211_put_bss(local->hw.wiphy, bss);
         netif_carrier_on(sdata->dev);
-        cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
+        cfg80211_ibss_joined(sdata->dev, ifibss->bssid, chan, GFP_KERNEL);
 }
 
 static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
@@ -521,12 +522,6 @@ int ieee80211_ibss_csa_beacon(struct ieee80211_sub_if_data *sdata,
         if (old_presp)
                 kfree_rcu(old_presp, rcu_head);
 
-        /* it might not send the beacon for a while. send an action frame
-         * immediately to announce the channel switch.
-         */
-        if (csa_settings)
-                ieee80211_send_action_csa(sdata, csa_settings);
-
         return BSS_CHANGED_BEACON;
  out:
         return ret;
@@ -536,7 +531,7 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct cfg80211_bss *cbss;
-        int err;
+        int err, changed = 0;
         u16 capability;
 
         sdata_assert_lock(sdata);
@@ -568,10 +563,9 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata)
         if (err < 0)
                 return err;
 
-        if (err)
-                ieee80211_bss_info_change_notify(sdata, err);
+        changed |= err;
 
-        return 0;
+        return changed;
 }
 
 void ieee80211_ibss_stop(struct ieee80211_sub_if_data *sdata)
@@ -799,6 +793,8 @@ ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         int err;
         u32 sta_flags;
 
+        sdata_assert_lock(sdata);
+
         sta_flags = IEEE80211_STA_DISABLE_VHT;
         switch (ifibss->chandef.width) {
         case NL80211_CHAN_WIDTH_5:
@@ -995,7 +991,6 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                   struct ieee802_11_elems *elems)
 {
         struct ieee80211_local *local = sdata->local;
-        int freq;
         struct cfg80211_bss *cbss;
         struct ieee80211_bss *bss;
         struct sta_info *sta;
@@ -1007,15 +1002,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
         bool rates_updated = false;
 
-        if (elems->ds_params)
-                freq = ieee80211_channel_to_frequency(elems->ds_params[0],
-                                                      band);
-        else
-                freq = rx_status->freq;
-
-        channel = ieee80211_get_channel(local->hw.wiphy, freq);
-
-        if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
+        channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
+        if (!channel)
                 return;
 
         if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
@@ -1468,6 +1456,11 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         memcpy(((struct ieee80211_mgmt *) skb->data)->da, mgmt->sa, ETH_ALEN);
         ibss_dbg(sdata, "Sending ProbeResp to %pM\n", mgmt->sa);
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+
+        /* avoid excessive retries for probe request to wildcard SSIDs */
+        if (pos[1] == 0)
+                IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_NO_ACK;
+
         ieee80211_tx_skb(sdata, skb);
 }
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 5e44e3179e02..222c28b75315 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -616,7 +616,11 @@ struct ieee80211_if_mesh {
         struct ps_data ps;
         /* Channel Switching Support */
         struct mesh_csa_settings __rcu *csa;
-        bool chsw_init;
+        enum {
+                IEEE80211_MESH_CSA_ROLE_NONE,
+                IEEE80211_MESH_CSA_ROLE_INIT,
+                IEEE80211_MESH_CSA_ROLE_REPEATER,
+        } csa_role;
         u8 chsw_ttl;
         u16 pre_value;
 
@@ -1238,6 +1242,8 @@ struct ieee80211_local {
 
         struct ieee80211_sub_if_data __rcu *p2p_sdata;
 
+        struct napi_struct *napi;
+
         /* virtual monitor interface */
         struct ieee80211_sub_if_data __rcu *monitor_sdata;
         struct cfg80211_chan_def monitor_chandef;
@@ -1385,6 +1391,7 @@ void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
                                   __le16 fc, bool acked);
+void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata);
 
 /* IBSS code */
@@ -1408,8 +1415,7 @@ void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                    struct sk_buff *skb);
 int ieee80211_mesh_csa_beacon(struct ieee80211_sub_if_data *sdata,
-                              struct cfg80211_csa_settings *csa_settings,
-                              bool csa_action);
+                              struct cfg80211_csa_settings *csa_settings);
 int ieee80211_mesh_finish_csa(struct ieee80211_sub_if_data *sdata);
 
 /* scan/BSS handling */
@@ -1553,6 +1559,9 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
                                     struct sta_info *sta);
 enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta);
 void ieee80211_sta_set_rx_nss(struct sta_info *sta);
+u32 __ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
+                                  struct sta_info *sta, u8 opmode,
+                                  enum ieee80211_band band, bool nss_only);
 void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
                                  struct sta_info *sta, u8 opmode,
                                  enum ieee80211_band band, bool nss_only);
@@ -1605,7 +1614,7 @@ static inline int __ieee80211_resume(struct ieee80211_hw *hw)
 }
 
 /* utility functions/constants */
-extern void *mac80211_wiphy_privid; /* for wiphy privid */
+extern const void *const mac80211_wiphy_privid; /* for wiphy privid */
 u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
                         enum nl80211_iftype type);
 int ieee80211_frame_duration(enum ieee80211_band band, size_t len,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index ce1c44370610..b8d331e7d883 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -101,9 +101,8 @@ static u32 __ieee80211_idle_on(struct ieee80211_local *local)
 static u32 __ieee80211_recalc_idle(struct ieee80211_local *local,
                                    bool force_active)
 {
-        bool working = false, scanning, active;
+        bool working, scanning, active;
         unsigned int led_trig_start = 0, led_trig_stop = 0;
-        struct ieee80211_roc_work *roc;
 
         lockdep_assert_held(&local->mtx);
 
@@ -111,12 +110,8 @@ static u32 __ieee80211_recalc_idle(struct ieee80211_local *local,
                  !list_empty(&local->chanctx_list) ||
                  local->monitors;
 
-        if (!local->ops->remain_on_channel) {
-                list_for_each_entry(roc, &local->roc_list, list) {
-                        working = true;
-                        break;
-                }
-        }
+        working = !local->ops->remain_on_channel &&
+                  !list_empty(&local->roc_list);
 
         scanning = test_bit(SCAN_SW_SCANNING, &local->scanning) ||
                    test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning);
@@ -833,7 +828,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         cancel_work_sync(&local->dynamic_ps_enable_work);
 
         cancel_work_sync(&sdata->recalc_smps);
+        sdata_lock(sdata);
         sdata->vif.csa_active = false;
+        sdata_unlock(sdata);
         cancel_work_sync(&sdata->csa_finalize_work);
 
         cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index d767cfb9b45f..b055f6a55c68 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -893,10 +893,15 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         /* mac80211 supports control port protocol changing */
         local->hw.wiphy->flags |= WIPHY_FLAG_CONTROL_PORT_PROTOCOL;
 
-        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
                 local->hw.wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
-        else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
+        } else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC) {
                 local->hw.wiphy->signal_type = CFG80211_SIGNAL_TYPE_UNSPEC;
+                if (hw->max_signal <= 0) {
+                        result = -EINVAL;
+                        goto fail_wiphy_register;
+                }
+        }
 
         WARN((local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)
              && (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK),
@@ -1071,6 +1076,18 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL(ieee80211_register_hw);
 
+void ieee80211_napi_add(struct ieee80211_hw *hw, struct napi_struct *napi,
+                        struct net_device *napi_dev,
+                        int (*poll)(struct napi_struct *, int),
+                        int weight)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+
+        netif_napi_add(napi_dev, napi, poll, weight);
+        local->napi = napi;
+}
+EXPORT_SYMBOL_GPL(ieee80211_napi_add);
+
 void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 5b919cab1de0..f70e9cd10552 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -688,7 +688,7 @@ ieee80211_mesh_build_beacon(struct ieee80211_if_mesh *ifmsh)
                 *pos++ = csa->settings.count;
                 *pos++ = WLAN_EID_CHAN_SWITCH_PARAM;
                 *pos++ = 6;
-                if (ifmsh->chsw_init) {
+                if (ifmsh->csa_role == IEEE80211_MESH_CSA_ROLE_INIT) {
                         *pos++ = ifmsh->mshcfg.dot11MeshTTL;
                         *pos |= WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR;
                 } else {
@@ -859,18 +859,12 @@ ieee80211_mesh_process_chnswitch(struct ieee80211_sub_if_data *sdata,
 {
         struct cfg80211_csa_settings params;
         struct ieee80211_csa_ie csa_ie;
-        struct ieee80211_chanctx_conf *chanctx_conf;
-        struct ieee80211_chanctx *chanctx;
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
-        int err, num_chanctx;
+        int err;
         u32 sta_flags;
 
-        if (sdata->vif.csa_active)
-                return true;
-
-        if (!ifmsh->mesh_id)
-                return false;
+        sdata_assert_lock(sdata);
 
         sta_flags = IEEE80211_STA_DISABLE_VHT;
         switch (sdata->vif.bss_conf.chandef.width) {
@@ -896,10 +890,6 @@ ieee80211_mesh_process_chnswitch(struct ieee80211_sub_if_data *sdata,
         params.chandef = csa_ie.chandef;
         params.count = csa_ie.count;
 
-        if (sdata->vif.bss_conf.chandef.chan->band !=
-            params.chandef.chan->band)
-                return false;
-
         if (!cfg80211_chandef_usable(sdata->local->hw.wiphy, &params.chandef,
                                      IEEE80211_CHAN_DISABLED)) {
                 sdata_info(sdata,
@@ -922,24 +912,12 @@ ieee80211_mesh_process_chnswitch(struct ieee80211_sub_if_data *sdata,
                 return false;
         }
 
-        rcu_read_lock();
-        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-        if (!chanctx_conf)
-                goto failed_chswitch;
-
-        /* don't handle for multi-VIF cases */
-        chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
-        if (chanctx->refcount > 1)
-                goto failed_chswitch;
-
-        num_chanctx = 0;
-        list_for_each_entry_rcu(chanctx, &sdata->local->chanctx_list, list)
-                num_chanctx++;
-
-        if (num_chanctx > 1)
-                goto failed_chswitch;
-
-        rcu_read_unlock();
+        if (cfg80211_chandef_identical(&params.chandef,
+                                       &sdata->vif.bss_conf.chandef)) {
+                mcsa_dbg(sdata,
+                         "received csa with an identical chandef, ignoring\n");
+                return true;
+        }
 
         mcsa_dbg(sdata,
                  "received channel switch announcement to go to channel %d MHz\n",
@@ -953,30 +931,16 @@ ieee80211_mesh_process_chnswitch(struct ieee80211_sub_if_data *sdata,
                 ifmsh->pre_value = csa_ie.pre_value;
         }
 
-        if (ifmsh->chsw_ttl < ifmsh->mshcfg.dot11MeshTTL) {
-                if (ieee80211_mesh_csa_beacon(sdata, &params, false) < 0)
-                        return false;
-        } else {
+        if (ifmsh->chsw_ttl >= ifmsh->mshcfg.dot11MeshTTL)
                 return false;
-        }
 
-        sdata->csa_radar_required = params.radar_required;
+        ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_REPEATER;
 
-        if (params.block_tx)
-                ieee80211_stop_queues_by_reason(&sdata->local->hw,
-                                IEEE80211_MAX_QUEUE_MAP,
-                                IEEE80211_QUEUE_STOP_REASON_CSA);
-
-        sdata->csa_chandef = params.chandef;
-        sdata->vif.csa_active = true;
-
-        ieee80211_bss_info_change_notify(sdata, err);
-        drv_channel_switch_beacon(sdata, &params.chandef);
+        if (ieee80211_channel_switch(sdata->local->hw.wiphy, sdata->dev,
+                                     &params) < 0)
+                return false;
 
         return true;
-failed_chswitch:
-        rcu_read_unlock();
-        return false;
 }
 
 static void
@@ -1086,7 +1050,8 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
                 ifmsh->sync_ops->rx_bcn_presp(sdata,
                         stype, mgmt, &elems, rx_status);
 
-        if (!ifmsh->chsw_init)
+        if (ifmsh->csa_role != IEEE80211_MESH_CSA_ROLE_INIT &&
+            !sdata->vif.csa_active)
                 ieee80211_mesh_process_chnswitch(sdata, &elems, true);
 }
 
@@ -1095,29 +1060,30 @@ int ieee80211_mesh_finish_csa(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_csa_settings *tmp_csa_settings;
         int ret = 0;
+        int changed = 0;
 
         /* Reset the TTL value and Initiator flag */
-        ifmsh->chsw_init = false;
+        ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_NONE;
         ifmsh->chsw_ttl = 0;
 
         /* Remove the CSA and MCSP elements from the beacon */
         tmp_csa_settings = rcu_dereference(ifmsh->csa);
         rcu_assign_pointer(ifmsh->csa, NULL);
-        kfree_rcu(tmp_csa_settings, rcu_head);
+        if (tmp_csa_settings)
+                kfree_rcu(tmp_csa_settings, rcu_head);
         ret = ieee80211_mesh_rebuild_beacon(sdata);
         if (ret)
                 return -EINVAL;
 
-        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+        changed |= BSS_CHANGED_BEACON;
 
         mcsa_dbg(sdata, "complete switching to center freq %d MHz",
                  sdata->vif.bss_conf.chandef.chan->center_freq);
-        return 0;
+        return changed;
 }
 
 int ieee80211_mesh_csa_beacon(struct ieee80211_sub_if_data *sdata,
-                              struct cfg80211_csa_settings *csa_settings,
-                              bool csa_action)
+                              struct cfg80211_csa_settings *csa_settings)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_csa_settings *tmp_csa_settings;
@@ -1141,12 +1107,7 @@ int ieee80211_mesh_csa_beacon(struct ieee80211_sub_if_data *sdata,
                 return ret;
         }
 
-        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
-
-        if (csa_action)
-                ieee80211_send_action_csa(sdata, csa_settings);
-
-        return 0;
+        return BSS_CHANGED_BEACON;
 }
 
 static int mesh_fwd_csa_frame(struct ieee80211_sub_if_data *sdata,
@@ -1210,7 +1171,8 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
 
         ifmsh->pre_value = pre_value;
 
-        if (!ieee80211_mesh_process_chnswitch(sdata, &elems, false)) {
+        if (!sdata->vif.csa_active &&
+            !ieee80211_mesh_process_chnswitch(sdata, &elems, false)) {
                 mcsa_dbg(sdata, "Failed to process CSA action frame");
                 return;
         }
@@ -1257,7 +1219,7 @@ void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         sdata_lock(sdata);
 
         /* mesh already went down */
-        if (!sdata->wdev.mesh_id_len)
+        if (!sdata->u.mesh.mesh_id_len)
                 goto out;
 
         rx_status = IEEE80211_SKB_RXCB(skb);
@@ -1310,7 +1272,7 @@ void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata)
         sdata_lock(sdata);
 
         /* mesh already went down */
-        if (!sdata->wdev.mesh_id_len)
+        if (!sdata->u.mesh.mesh_id_len)
                 goto out;
 
         if (ifmsh->preq_queue_len &&
@@ -1365,7 +1327,7 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
         mesh_rmc_init(sdata);
         ifmsh->last_preq = jiffies;
         ifmsh->next_perr = jiffies;
-        ifmsh->chsw_init = false;
+        ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_NONE;
         /* Allocate all mesh structures when creating the first mesh interface. */
         if (!mesh_allocated)
                 ieee80211s_init();
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 245dce969b31..dee50aefd6e8 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -131,13 +131,13 @@ void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
         if (unlikely(!sdata->u.mgd.associated))
                 return;
 
+        ifmgd->probe_send_count = 0;
+
         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
                 return;
 
         mod_timer(&sdata->u.mgd.conn_mon_timer,
                   round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
-
-        ifmgd->probe_send_count = 0;
 }
 
 static int ecw2cw(int ecw)
@@ -531,6 +531,7 @@ static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
         u8 *pos;
         u32 cap;
         struct ieee80211_sta_vht_cap vht_cap;
+        u32 mask, ap_bf_sts, our_bf_sts;
 
         BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
 
@@ -558,6 +559,16 @@ static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
                         cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
                 cap &= ~IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
 
+        mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
+
+        ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
+        our_bf_sts = cap & mask;
+
+        if (ap_bf_sts < our_bf_sts) {
+                cap &= ~mask;
+                cap |= ap_bf_sts;
+        }
+
         /* reserve and fill IE */
         pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
         ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
@@ -768,6 +779,34 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                 ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
                                     sband, chan, sdata->smps_mode);
 
+        /* if present, add any custom IEs that go before VHT */
+        if (assoc_data->ie_len) {
+                static const u8 before_vht[] = {
+                        WLAN_EID_SSID,
+                        WLAN_EID_SUPP_RATES,
+                        WLAN_EID_EXT_SUPP_RATES,
+                        WLAN_EID_PWR_CAPABILITY,
+                        WLAN_EID_SUPPORTED_CHANNELS,
+                        WLAN_EID_RSN,
+                        WLAN_EID_QOS_CAPA,
+                        WLAN_EID_RRM_ENABLED_CAPABILITIES,
+                        WLAN_EID_MOBILITY_DOMAIN,
+                        WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
+                        WLAN_EID_HT_CAPABILITY,
+                        WLAN_EID_BSS_COEX_2040,
+                        WLAN_EID_EXT_CAPABILITY,
+                        WLAN_EID_QOS_TRAFFIC_CAPA,
+                        WLAN_EID_TIM_BCAST_REQ,
+                        WLAN_EID_INTERWORKING,
+                };
+                noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
+                                             before_vht, ARRAY_SIZE(before_vht),
+                                             offset);
+                pos = skb_put(skb, noffset - offset);
+                memcpy(pos, assoc_data->ie + offset, noffset - offset);
+                offset = noffset;
+        }
+
         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
                 ieee80211_add_vht_ie(sdata, skb, sband,
                                      &assoc_data->ap_vht_cap);
@@ -1024,7 +1063,6 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         }
 
         ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
-        sdata->vif.csa_active = true;
 
         mutex_lock(&local->chanctx_mtx);
         if (local->use_chanctx) {
@@ -1062,6 +1100,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         mutex_unlock(&local->chanctx_mtx);
 
         sdata->csa_chandef = csa_ie.chandef;
+        sdata->vif.csa_active = true;
 
         if (csa_ie.mode)
                 ieee80211_stop_queues_by_reason(&local->hw,
@@ -2233,6 +2272,62 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
         /* ignore frame -- wait for timeout */
 }
 
+#define case_WLAN(type) \
+        case WLAN_REASON_##type: return #type
+
+static const char *ieee80211_get_reason_code_string(u16 reason_code)
+{
+        switch (reason_code) {
+        case_WLAN(UNSPECIFIED);
+        case_WLAN(PREV_AUTH_NOT_VALID);
+        case_WLAN(DEAUTH_LEAVING);
+        case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
+        case_WLAN(DISASSOC_AP_BUSY);
+        case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
+        case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
+        case_WLAN(DISASSOC_STA_HAS_LEFT);
+        case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
+        case_WLAN(DISASSOC_BAD_POWER);
+        case_WLAN(DISASSOC_BAD_SUPP_CHAN);
+        case_WLAN(INVALID_IE);
+        case_WLAN(MIC_FAILURE);
+        case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
+        case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
+        case_WLAN(IE_DIFFERENT);
+        case_WLAN(INVALID_GROUP_CIPHER);
+        case_WLAN(INVALID_PAIRWISE_CIPHER);
+        case_WLAN(INVALID_AKMP);
+        case_WLAN(UNSUPP_RSN_VERSION);
+        case_WLAN(INVALID_RSN_IE_CAP);
+        case_WLAN(IEEE8021X_FAILED);
+        case_WLAN(CIPHER_SUITE_REJECTED);
+        case_WLAN(DISASSOC_UNSPECIFIED_QOS);
+        case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
+        case_WLAN(DISASSOC_LOW_ACK);
+        case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
+        case_WLAN(QSTA_LEAVE_QBSS);
+        case_WLAN(QSTA_NOT_USE);
+        case_WLAN(QSTA_REQUIRE_SETUP);
+        case_WLAN(QSTA_TIMEOUT);
+        case_WLAN(QSTA_CIPHER_NOT_SUPP);
+        case_WLAN(MESH_PEER_CANCELED);
+        case_WLAN(MESH_MAX_PEERS);
+        case_WLAN(MESH_CONFIG);
+        case_WLAN(MESH_CLOSE);
+        case_WLAN(MESH_MAX_RETRIES);
+        case_WLAN(MESH_CONFIRM_TIMEOUT);
+        case_WLAN(MESH_INVALID_GTK);
+        case_WLAN(MESH_INCONSISTENT_PARAM);
+        case_WLAN(MESH_INVALID_SECURITY);
+        case_WLAN(MESH_PATH_ERROR);
+        case_WLAN(MESH_PATH_NOFORWARD);
+        case_WLAN(MESH_PATH_DEST_UNREACHABLE);
+        case_WLAN(MAC_EXISTS_IN_MBSS);
+        case_WLAN(MESH_CHAN_REGULATORY);
+        case_WLAN(MESH_CHAN);
+        default: return "<unknown>";
+        }
+}
 
 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_mgmt *mgmt, size_t len)
@@ -2254,8 +2349,8 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
 
         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 
-        sdata_info(sdata, "deauthenticated from %pM (Reason: %u)\n",
-                   bssid, reason_code);
+        sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
+                   bssid, reason_code, ieee80211_get_reason_code_string(reason_code));
 
         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
 
@@ -2688,28 +2783,20 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                   struct ieee802_11_elems *elems)
 {
         struct ieee80211_local *local = sdata->local;
-        int freq;
         struct ieee80211_bss *bss;
         struct ieee80211_channel *channel;
 
         sdata_assert_lock(sdata);
 
-        if (elems->ds_params)
-                freq = ieee80211_channel_to_frequency(elems->ds_params[0],
-                                                      rx_status->band);
-        else
-                freq = rx_status->freq;
-
-        channel = ieee80211_get_channel(local->hw.wiphy, freq);
-
-        if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
+        channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
+        if (!channel)
                 return;
 
         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
                                         channel);
         if (bss) {
-                ieee80211_rx_bss_put(local, bss);
                 sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
+                ieee80211_rx_bss_put(local, bss);
         }
 }
 
@@ -3504,6 +3591,32 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
 }
 
 #ifdef CONFIG_PM
+void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+
+        sdata_lock(sdata);
+
+        if (ifmgd->auth_data) {
+                /*
+                 * If we are trying to authenticate while suspending, cfg80211
+                 * won't know and won't actually abort those attempts, thus we
+                 * need to do that ourselves.
+                 */
+                ieee80211_send_deauth_disassoc(sdata,
+                                               ifmgd->auth_data->bss->bssid,
+                                               IEEE80211_STYPE_DEAUTH,
+                                               WLAN_REASON_DEAUTH_LEAVING,
+                                               false, frame_buf);
+                ieee80211_destroy_auth_data(sdata, false);
+                cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
+                                      IEEE80211_DEAUTH_FRAME_LEN);
+        }
+
+        sdata_unlock(sdata);
+}
+
 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
@@ -4322,37 +4435,41 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
         bool tx = !req->local_state_change;
-        bool report_frame = false;
 
-        sdata_info(sdata,
-                   "deauthenticating from %pM by local choice (reason=%d)\n",
-                   req->bssid, req->reason_code);
+        if (ifmgd->auth_data &&
+            ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
+                sdata_info(sdata,
+                           "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
+                           req->bssid, req->reason_code,
+                           ieee80211_get_reason_code_string(req->reason_code));
 
-        if (ifmgd->auth_data) {
                 drv_mgd_prepare_tx(sdata->local, sdata);
                 ieee80211_send_deauth_disassoc(sdata, req->bssid,
                                                IEEE80211_STYPE_DEAUTH,
                                                req->reason_code, tx,
                                                frame_buf);
                 ieee80211_destroy_auth_data(sdata, false);
+                cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
+                                      IEEE80211_DEAUTH_FRAME_LEN);
 
-                report_frame = true;
-                goto out;
+                return 0;
         }
 
         if (ifmgd->associated &&
             ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
+                sdata_info(sdata,
+                           "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
+                           req->bssid, req->reason_code,
+                           ieee80211_get_reason_code_string(req->reason_code));
+
                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
                                        req->reason_code, tx, frame_buf);
-                report_frame = true;
-        }
-
- out:
-        if (report_frame)
                 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
                                       IEEE80211_DEAUTH_FRAME_LEN);
+                return 0;
+        }
 
-        return 0;
+        return -ENOTCONN;
 }
 
 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
@@ -4372,8 +4489,8 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
                 return -ENOLINK;
 
         sdata_info(sdata,
-                   "disassociating from %pM by local choice (reason=%d)\n",
-                   req->bss->bssid, req->reason_code);
+                   "disassociating from %pM by local choice (Reason: %u=%s)\n",
+                   req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
 
         memcpy(bssid, req->bss->bssid, ETH_ALEN);
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index af64fb8e8add..d478b880a0af 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -100,10 +100,18 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 
         /* remove all interfaces that were created in the driver */
         list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!ieee80211_sdata_running(sdata) ||
-                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
-                    sdata->vif.type == NL80211_IFTYPE_MONITOR)
+                if (!ieee80211_sdata_running(sdata))
                         continue;
+                switch (sdata->vif.type) {
+                case NL80211_IFTYPE_AP_VLAN:
+                case NL80211_IFTYPE_MONITOR:
+                        continue;
+                case NL80211_IFTYPE_STATION:
+                        ieee80211_mgd_quiesce(sdata);
+                        break;
+                default:
+                        break;
+                }
 
                 drv_remove_interface(local, sdata);
         }
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 22b223f13c9f..8fdadfd94ba8 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -10,15 +10,15 @@
 
 #include <linux/kernel.h>
 #include <linux/rtnetlink.h>
-#include <linux/slab.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include "rate.h"
 #include "ieee80211_i.h"
 #include "debugfs.h"
 
 struct rate_control_alg {
         struct list_head list;
-        struct rate_control_ops *ops;
+        const struct rate_control_ops *ops;
 };
 
 static LIST_HEAD(rate_ctrl_algs);
@@ -29,7 +29,7 @@ module_param(ieee80211_default_rc_algo, charp, 0644);
 MODULE_PARM_DESC(ieee80211_default_rc_algo,
                  "Default rate control algorithm for mac80211 to use");
 
-int ieee80211_rate_control_register(struct rate_control_ops *ops)
+int ieee80211_rate_control_register(const struct rate_control_ops *ops)
 {
         struct rate_control_alg *alg;
 
@@ -60,7 +60,7 @@ int ieee80211_rate_control_register(struct rate_control_ops *ops)
 }
 EXPORT_SYMBOL(ieee80211_rate_control_register);
 
-void ieee80211_rate_control_unregister(struct rate_control_ops *ops)
+void ieee80211_rate_control_unregister(const struct rate_control_ops *ops)
 {
         struct rate_control_alg *alg;
 
@@ -76,32 +76,31 @@ void ieee80211_rate_control_unregister(struct rate_control_ops *ops)
 }
 EXPORT_SYMBOL(ieee80211_rate_control_unregister);
 
-static struct rate_control_ops *
+static const struct rate_control_ops *
 ieee80211_try_rate_control_ops_get(const char *name)
 {
         struct rate_control_alg *alg;
-        struct rate_control_ops *ops = NULL;
+        const struct rate_control_ops *ops = NULL;
 
         if (!name)
                 return NULL;
 
         mutex_lock(&rate_ctrl_mutex);
         list_for_each_entry(alg, &rate_ctrl_algs, list) {
-                if (!strcmp(alg->ops->name, name))
-                        if (try_module_get(alg->ops->module)) {
-                                ops = alg->ops;
-                                break;
-                        }
+                if (!strcmp(alg->ops->name, name)) {
+                        ops = alg->ops;
+                        break;
+                }
         }
         mutex_unlock(&rate_ctrl_mutex);
         return ops;
 }
 
 /* Get the rate control algorithm. */
-static struct rate_control_ops *
+static const struct rate_control_ops *
 ieee80211_rate_control_ops_get(const char *name)
 {
-        struct rate_control_ops *ops;
+        const struct rate_control_ops *ops;
         const char *alg_name;
 
         kparam_block_sysfs_write(ieee80211_default_rc_algo);
@@ -111,10 +110,6 @@ ieee80211_rate_control_ops_get(const char *name)
                 alg_name = name;
 
         ops = ieee80211_try_rate_control_ops_get(alg_name);
-        if (!ops) {
-                request_module("rc80211_%s", alg_name);
-                ops = ieee80211_try_rate_control_ops_get(alg_name);
-        }
         if (!ops && name)
                 /* try default if specific alg requested but not found */
                 ops = ieee80211_try_rate_control_ops_get(ieee80211_default_rc_algo);
@@ -127,11 +122,6 @@ ieee80211_rate_control_ops_get(const char *name)
         return ops;
 }
 
-static void ieee80211_rate_control_ops_put(struct rate_control_ops *ops)
-{
-        module_put(ops->module);
-}
-
 #ifdef CONFIG_MAC80211_DEBUGFS
 static ssize_t rcname_read(struct file *file, char __user *userbuf,
                            size_t count, loff_t *ppos)
@@ -158,11 +148,11 @@ static struct rate_control_ref *rate_control_alloc(const char *name,
 
         ref = kmalloc(sizeof(struct rate_control_ref), GFP_KERNEL);
         if (!ref)
-                goto fail_ref;
+                return NULL;
         ref->local = local;
         ref->ops = ieee80211_rate_control_ops_get(name);
         if (!ref->ops)
-                goto fail_ops;
+                goto free;
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         debugfsdir = debugfs_create_dir("rc", local->hw.wiphy->debugfsdir);
@@ -172,14 +162,11 @@ static struct rate_control_ref *rate_control_alloc(const char *name,
 
         ref->priv = ref->ops->alloc(&local->hw, debugfsdir);
         if (!ref->priv)
-                goto fail_priv;
+                goto free;
         return ref;
 
-fail_priv:
-        ieee80211_rate_control_ops_put(ref->ops);
-fail_ops:
+free:
         kfree(ref);
-fail_ref:
         return NULL;
 }
 
@@ -192,7 +179,6 @@ static void rate_control_free(struct rate_control_ref *ctrl_ref)
         ctrl_ref->local->debugfs.rcdir = NULL;
 #endif
 
-        ieee80211_rate_control_ops_put(ctrl_ref->ops);
         kfree(ctrl_ref);
 }
 
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index b95e16c07081..9aa2a1190a86 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -21,7 +21,7 @@
 
 struct rate_control_ref {
         struct ieee80211_local *local;
-        struct rate_control_ops *ops;
+        const struct rate_control_ops *ops;
         void *priv;
 };
 
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index f3d88b0c054c..26fd94fa0aed 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -657,7 +657,7 @@ minstrel_free(void *priv)
         kfree(priv);
 }
 
-struct rate_control_ops mac80211_minstrel = {
+const struct rate_control_ops mac80211_minstrel = {
         .name = "minstrel",
         .tx_status = minstrel_tx_status,
         .get_rate = minstrel_get_rate,
diff --git a/net/mac80211/rc80211_minstrel.h b/net/mac80211/rc80211_minstrel.h
index f4301f4b2e41..046d1bd598a8 100644
--- a/net/mac80211/rc80211_minstrel.h
+++ b/net/mac80211/rc80211_minstrel.h
@@ -123,7 +123,7 @@ struct minstrel_debugfs_info {
         char buf[];
 };
 
-extern struct rate_control_ops mac80211_minstrel;
+extern const struct rate_control_ops mac80211_minstrel;
 void minstrel_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir);
 void minstrel_remove_sta_debugfs(void *priv, void *priv_sta);
 
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index c1b5b73c5b91..bccaf854a309 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -124,7 +124,7 @@ const struct mcs_group minstrel_mcs_groups[] = {
 
 #define MINSTREL_CCK_GROUP      (ARRAY_SIZE(minstrel_mcs_groups) - 1)
 
-static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES];
+static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES] __read_mostly;
 
 static void
 minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi);
@@ -1031,7 +1031,7 @@ minstrel_ht_free(void *priv)
         mac80211_minstrel.free(priv);
 }
 
-static struct rate_control_ops mac80211_minstrel_ht = {
+static const struct rate_control_ops mac80211_minstrel_ht = {
         .name = "minstrel_ht",
         .tx_status = minstrel_ht_tx_status,
         .get_rate = minstrel_ht_get_rate,
@@ -1048,8 +1048,7 @@ static struct rate_control_ops mac80211_minstrel_ht = {
 };
 
 
-static void
-init_sample_table(void)
+static void __init init_sample_table(void)
 {
         int col, i, new_idx;
         u8 rnd[MCS_GROUP_RATES];
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index 958fad07b54c..d0da2a70fe68 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -452,7 +452,7 @@ static void rate_control_pid_free_sta(void *priv, struct ieee80211_sta *sta,
         kfree(priv_sta);
 }
 
-static struct rate_control_ops mac80211_rcpid = {
+static const struct rate_control_ops mac80211_rcpid = {
         .name = "pid",
         .tx_status = rate_control_pid_tx_status,
         .get_rate = rate_control_pid_get_rate,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 3e57f96c9666..216c45b949e5 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -40,8 +40,6 @@
 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
                                            struct sk_buff *skb)
 {
-        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-
         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
                 if (likely(skb->len > FCS_LEN))
                         __pskb_trim(skb, skb->len - FCS_LEN);
@@ -53,9 +51,6 @@ static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
                 }
         }
 
-        if (status->vendor_radiotap_len)
-                __pskb_pull(skb, status->vendor_radiotap_len);
-
         return skb;
 }
 
@@ -64,14 +59,13 @@ static inline int should_drop_frame(struct sk_buff *skb, int present_fcs_len)
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr;
 
-        hdr = (void *)(skb->data + status->vendor_radiotap_len);
+        hdr = (void *)(skb->data);
 
         if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
                             RX_FLAG_FAILED_PLCP_CRC |
                             RX_FLAG_AMPDU_IS_ZEROLEN))
                 return 1;
-        if (unlikely(skb->len < 16 + present_fcs_len +
-                                status->vendor_radiotap_len))
+        if (unlikely(skb->len < 16 + present_fcs_len))
                 return 1;
         if (ieee80211_is_ctl(hdr->frame_control) &&
             !ieee80211_is_pspoll(hdr->frame_control) &&
@@ -90,8 +84,6 @@ ieee80211_rx_radiotap_space(struct ieee80211_local *local,
         len = sizeof(struct ieee80211_radiotap_header) + 8;
 
         /* allocate extra bitmaps */
-        if (status->vendor_radiotap_len)
-                len += 4;
         if (status->chains)
                 len += 4 * hweight8(status->chains);
 
@@ -127,18 +119,6 @@ ieee80211_rx_radiotap_space(struct ieee80211_local *local,
                 len += 2 * hweight8(status->chains);
         }
 
-        if (status->vendor_radiotap_len) {
-                if (WARN_ON_ONCE(status->vendor_radiotap_align == 0))
-                        status->vendor_radiotap_align = 1;
-                /* align standard part of vendor namespace */
-                len = ALIGN(len, 2);
-                /* allocate standard part of vendor namespace */
-                len += 6;
-                /* align vendor-defined part */
-                len = ALIGN(len, status->vendor_radiotap_align);
-                /* vendor-defined part is already in skb */
-        }
-
         return len;
 }
 
@@ -172,7 +152,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         it_present = &rthdr->it_present;
 
         /* radiotap header, set always present flags */
-        rthdr->it_len = cpu_to_le16(rtap_len + status->vendor_radiotap_len);
+        rthdr->it_len = cpu_to_le16(rtap_len);
         it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
                          BIT(IEEE80211_RADIOTAP_CHANNEL) |
                          BIT(IEEE80211_RADIOTAP_RX_FLAGS);
@@ -190,14 +170,6 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                                  BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
         }
 
-        if (status->vendor_radiotap_len) {
-                it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
-                                  BIT(IEEE80211_RADIOTAP_EXT);
-                put_unaligned_le32(it_present_val, it_present);
-                it_present++;
-                it_present_val = status->vendor_radiotap_bitmap;
-        }
-
         put_unaligned_le32(it_present_val, it_present);
 
         pos = (void *)(it_present + 1);
@@ -307,6 +279,8 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                         *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
                 if (status->flag & RX_FLAG_HT_GF)
                         *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
+                if (status->flag & RX_FLAG_LDPC)
+                        *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
                 stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT;
                 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
                 pos++;
@@ -349,20 +323,25 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
 
                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
                 /* known field - how to handle 80+80? */
-                if (status->flag & RX_FLAG_80P80MHZ)
+                if (status->vht_flag & RX_VHT_FLAG_80P80MHZ)
                         known &= ~IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
                 put_unaligned_le16(known, pos);
                 pos += 2;
                 /* flags */
                 if (status->flag & RX_FLAG_SHORT_GI)
                         *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
+                /* in VHT, STBC is binary */
+                if (status->flag & RX_FLAG_STBC_MASK)
+                        *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
+                if (status->vht_flag & RX_VHT_FLAG_BF)
+                        *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
                 pos++;
                 /* bandwidth */
-                if (status->flag & RX_FLAG_80MHZ)
+                if (status->vht_flag & RX_VHT_FLAG_80MHZ)
                         *pos++ = 4;
-                else if (status->flag & RX_FLAG_80P80MHZ)
+                else if (status->vht_flag & RX_VHT_FLAG_80P80MHZ)
                         *pos++ = 0; /* marked not known above */
-                else if (status->flag & RX_FLAG_160MHZ)
+                else if (status->vht_flag & RX_VHT_FLAG_160MHZ)
                         *pos++ = 11;
                 else if (status->flag & RX_FLAG_40MHZ)
                         *pos++ = 1;
@@ -372,6 +351,8 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                 *pos = (status->rate_idx << 4) | status->vht_nss;
                 pos += 4;
                 /* coding field */
+                if (status->flag & RX_FLAG_LDPC)
+                        *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
                 pos++;
                 /* group ID */
                 pos++;
@@ -383,21 +364,6 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                 *pos++ = status->chain_signal[chain];
                 *pos++ = chain;
         }
-
-        if (status->vendor_radiotap_len) {
-                /* ensure 2 byte alignment for the vendor field as required */
-                if ((pos - (u8 *)rthdr) & 1)
-                        *pos++ = 0;
-                *pos++ = status->vendor_radiotap_oui[0];
-                *pos++ = status->vendor_radiotap_oui[1];
-                *pos++ = status->vendor_radiotap_oui[2];
-                *pos++ = status->vendor_radiotap_subns;
-                put_unaligned_le16(status->vendor_radiotap_len, pos);
-                pos += 2;
-                /* align the actual payload as requested */
-                while ((pos - (u8 *)rthdr) & (status->vendor_radiotap_align - 1))
-                        *pos++ = 0;
-        }
 }
 
 /*
@@ -428,8 +394,8 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
                 present_fcs_len = FCS_LEN;
 
-        /* ensure hdr->frame_control and vendor radiotap data are in skb head */
-        if (!pskb_may_pull(origskb, 2 + status->vendor_radiotap_len)) {
+        /* ensure hdr->frame_control is in skb head */
+        if (!pskb_may_pull(origskb, 2)) {
                 dev_kfree_skb(origskb);
                 return NULL;
         }
@@ -599,10 +565,10 @@ static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 
-        if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
+        if (is_multicast_ether_addr(hdr->addr1))
                 return 0;
 
-        return ieee80211_is_robust_mgmt_frame(hdr);
+        return ieee80211_is_robust_mgmt_frame(skb);
 }
 
 
@@ -610,10 +576,10 @@ static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 
-        if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
+        if (!is_multicast_ether_addr(hdr->addr1))
                 return 0;
 
-        return ieee80211_is_robust_mgmt_frame(hdr);
+        return ieee80211_is_robust_mgmt_frame(skb);
 }
 
 
@@ -626,7 +592,7 @@ static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
         if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
                 return -1;
 
-        if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
+        if (!ieee80211_is_robust_mgmt_frame(skb))
                 return -1; /* not a robust management frame */
 
         mmie = (struct ieee80211_mmie *)
@@ -1268,6 +1234,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
                         if (ieee80211_is_data(hdr->frame_control)) {
                                 sta->last_rx_rate_idx = status->rate_idx;
                                 sta->last_rx_rate_flag = status->flag;
+                                sta->last_rx_rate_vht_flag = status->vht_flag;
                                 sta->last_rx_rate_vht_nss = status->vht_nss;
                         }
                 }
@@ -1280,6 +1247,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
                 if (ieee80211_is_data(hdr->frame_control)) {
                         sta->last_rx_rate_idx = status->rate_idx;
                         sta->last_rx_rate_flag = status->flag;
+                        sta->last_rx_rate_vht_flag = status->vht_flag;
                         sta->last_rx_rate_vht_nss = status->vht_nss;
                 }
         }
@@ -1318,18 +1286,15 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
             !ieee80211_has_morefrags(hdr->frame_control) &&
             !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
-             rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
+             rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
+            /* PM bit is only checked in frames where it isn't reserved,
+             * in AP mode it's reserved in non-bufferable management frames
+             * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
+             */
+            (!ieee80211_is_mgmt(hdr->frame_control) ||
+             ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
                 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
-                        /*
-                         * Ignore doze->wake transitions that are
-                         * indicated by non-data frames, the standard
-                         * is unclear here, but for example going to
-                         * PS mode and then scanning would cause a
-                         * doze->wake transition for the probe request,
-                         * and that is clearly undesirable.
-                         */
-                        if (ieee80211_is_data(hdr->frame_control) &&
-                            !ieee80211_has_pm(hdr->frame_control))
+                        if (!ieee80211_has_pm(hdr->frame_control))
                                 sta_ps_end(sta);
                 } else {
                         if (ieee80211_has_pm(hdr->frame_control))
@@ -1852,8 +1817,7 @@ static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
                  * having configured keys.
                  */
                 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
-                             ieee80211_is_robust_mgmt_frame(
-                                     (struct ieee80211_hdr *) rx->skb->data)))
+                             ieee80211_is_robust_mgmt_frame(rx->skb)))
                         return -EACCES;
         }
 
@@ -2000,7 +1964,10 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
                 /* deliver to local stack */
                 skb->protocol = eth_type_trans(skb, dev);
                 memset(skb->cb, 0, sizeof(skb->cb));
-                netif_receive_skb(skb);
+                if (rx->local->napi)
+                        napi_gro_receive(rx->local->napi, skb);
+                else
+                        netif_receive_skb(skb);
         }
 
         if (xmit_skb) {
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 88c81616f8f7..3ce7f2c8539a 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -472,9 +472,7 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         if (local->ops->hw_scan) {
                 u8 *ies;
 
-                local->hw_scan_ies_bufsize = 2 + IEEE80211_MAX_SSID_LEN +
-                                             local->scan_ies_len +
-                                             req->ie_len;
+                local->hw_scan_ies_bufsize = local->scan_ies_len + req->ie_len;
                 local->hw_scan_req = kmalloc(
                                 sizeof(*local->hw_scan_req) +
                                 req->n_channels * sizeof(req->channels[0]) +
@@ -979,8 +977,7 @@ int __ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
         struct cfg80211_chan_def chandef;
         int ret, i, iebufsz;
 
-        iebufsz = 2 + IEEE80211_MAX_SSID_LEN +
-                  local->scan_ies_len + req->ie_len;
+        iebufsz = local->scan_ies_len + req->ie_len;
 
         lockdep_assert_held(&local->mtx);
 
@@ -1058,9 +1055,11 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata)
         /* We don't want to restart sched scan anymore. */
         local->sched_scan_req = NULL;
 
-        if (rcu_access_pointer(local->sched_scan_sdata))
-                drv_sched_scan_stop(local, sdata);
-
+        if (rcu_access_pointer(local->sched_scan_sdata)) {
+                ret = drv_sched_scan_stop(local, sdata);
+                if (!ret)
+                        rcu_assign_pointer(local->sched_scan_sdata, NULL);
+        }
 out:
         mutex_unlock(&local->mtx);
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index d3a6d8208f2f..4acc5fc402fa 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -261,6 +261,7 @@ struct ieee80211_tx_latency_stat {
  *      "the" transmit rate
  * @last_rx_rate_idx: rx status rate index of the last data packet
  * @last_rx_rate_flag: rx status flag of the last data packet
+ * @last_rx_rate_vht_flag: rx status vht flag of the last data packet
  * @last_rx_rate_vht_nss: rx status nss of last data packet
  * @lock: used for locking all fields that require locking, see comments
  *      in the header file.
@@ -396,6 +397,7 @@ struct sta_info {
         struct ieee80211_tx_rate last_tx_rate;
         int last_rx_rate_idx;
         u32 last_rx_rate_flag;
+        u32 last_rx_rate_vht_flag;
         u8 last_rx_rate_vht_nss;
         u16 tid_seq[IEEE80211_QOS_CTL_TID_MASK + 1];
 
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 1ee85c402439..e6e574a307c8 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -479,7 +479,7 @@ static void ieee80211_tx_latency_end_msrmnt(struct ieee80211_local *local,
         u32 msrmnt;
         u16 tid;
         u8 *qc;
-        int i, bin_range_count, bin_count;
+        int i, bin_range_count;
         u32 *bin_ranges;
         __le16 fc;
         struct ieee80211_tx_latency_stat *tx_lat;
@@ -522,7 +522,6 @@ static void ieee80211_tx_latency_end_msrmnt(struct ieee80211_local *local,
         /* count how many Tx frames transmitted with the appropriate latency */
         bin_range_count = tx_latency->n_ranges;
         bin_ranges = tx_latency->ranges;
-        bin_count = tx_lat->bin_count;
 
         for (i = 0; i < bin_range_count; i++) {
                 if (msrmnt <= bin_ranges[i]) {
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 4080c615636f..19d36d4117e0 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -452,8 +452,7 @@ static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
         if (sta == NULL || !test_sta_flag(sta, WLAN_STA_MFP))
                 return 0;
 
-        if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *)
-                                            skb->data))
+        if (!ieee80211_is_robust_mgmt_frame(skb))
                 return 0;
 
         return 1;
@@ -538,11 +537,8 @@ ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
         if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))
                 return TX_CONTINUE;
 
-        /* only deauth, disassoc and action are bufferable MMPDUs */
         if (ieee80211_is_mgmt(hdr->frame_control) &&
-            !ieee80211_is_deauth(hdr->frame_control) &&
-            !ieee80211_is_disassoc(hdr->frame_control) &&
-            !ieee80211_is_action(hdr->frame_control)) {
+            !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
                 if (tx->flags & IEEE80211_TX_UNICAST)
                         info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
                 return TX_CONTINUE;
@@ -582,7 +578,7 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
                 tx->key = key;
         else if (ieee80211_is_mgmt(hdr->frame_control) &&
                  is_multicast_ether_addr(hdr->addr1) &&
-                 ieee80211_is_robust_mgmt_frame(hdr) &&
+                 ieee80211_is_robust_mgmt_frame(tx->skb) &&
                  (key = rcu_dereference(tx->sdata->default_mgmt_key)))
                 tx->key = key;
         else if (is_multicast_ether_addr(hdr->addr1) &&
@@ -597,12 +593,12 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
                 tx->key = NULL;
         else if (tx->skb->protocol == tx->sdata->control_port_protocol)
                 tx->key = NULL;
-        else if (ieee80211_is_robust_mgmt_frame(hdr) &&
+        else if (ieee80211_is_robust_mgmt_frame(tx->skb) &&
                  !(ieee80211_is_action(hdr->frame_control) &&
                    tx->sta && test_sta_flag(tx->sta, WLAN_STA_MFP)))
                 tx->key = NULL;
         else if (ieee80211_is_mgmt(hdr->frame_control) &&
-                 !ieee80211_is_robust_mgmt_frame(hdr))
+                 !ieee80211_is_robust_mgmt_frame(tx->skb))
                 tx->key = NULL;
         else {
                 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
@@ -2417,15 +2413,6 @@ static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-void ieee80211_csa_finish(struct ieee80211_vif *vif)
-{
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-
-        ieee80211_queue_work(&sdata->local->hw,
-                             &sdata->csa_finalize_work);
-}
-EXPORT_SYMBOL(ieee80211_csa_finish);
-
 static void ieee80211_update_csa(struct ieee80211_sub_if_data *sdata,
                                  struct beacon_data *beacon)
 {
@@ -2454,8 +2441,12 @@ static void ieee80211_update_csa(struct ieee80211_sub_if_data *sdata,
         if (WARN_ON(counter_offset_beacon >= beacon_data_len))
                 return;
 
-        /* warn if the driver did not check for/react to csa completeness */
-        if (WARN_ON(beacon_data[counter_offset_beacon] == 0))
+        /* Warn if the driver did not check for/react to csa
+         * completeness.  A beacon with CSA counter set to 0 should
+         * never occur, because a counter of 1 means switch just
+         * before the next beacon.
+         */
+        if (WARN_ON(beacon_data[counter_offset_beacon] == 1))
                 return;
 
         beacon_data[counter_offset_beacon]--;
@@ -2521,7 +2512,7 @@ bool ieee80211_csa_is_complete(struct ieee80211_vif *vif)
         if (WARN_ON(counter_beacon > beacon_data_len))
                 goto out;
 
-        if (beacon_data[counter_beacon] == 0)
+        if (beacon_data[counter_beacon] == 1)
                 ret = true;
  out:
         rcu_read_unlock();
@@ -2909,7 +2900,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
                                 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
                 }
 
-                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                if (sdata->vif.type == NL80211_IFTYPE_AP)
                         sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
                 if (!ieee80211_tx_prepare(sdata, &tx, skb))
                         break;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index b8700d417a9c..275c94f995f7 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -34,7 +34,7 @@
 #include "wep.h"
 
 /* privid for wiphys to determine whether they belong to us or not */
-void *mac80211_wiphy_privid = &mac80211_wiphy_privid;
+const void *const mac80211_wiphy_privid = &mac80211_wiphy_privid;
 
 struct ieee80211_hw *wiphy_to_ieee80211_hw(struct wiphy *wiphy)
 {
@@ -1277,13 +1277,32 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
          * that calculates local->scan_ies_len.
          */
 
-        /* add any remaining custom IEs */
+        /* insert custom IEs that go before VHT */
         if (ie && ie_len) {
-                noffset = ie_len;
+                static const u8 before_vht[] = {
+                        WLAN_EID_SSID,
+                        WLAN_EID_SUPP_RATES,
+                        WLAN_EID_REQUEST,
+                        WLAN_EID_EXT_SUPP_RATES,
+                        WLAN_EID_DS_PARAMS,
+                        WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
+                        WLAN_EID_HT_CAPABILITY,
+                        WLAN_EID_BSS_COEX_2040,
+                        WLAN_EID_EXT_CAPABILITY,
+                        WLAN_EID_SSID_LIST,
+                        WLAN_EID_CHANNEL_USAGE,
+                        WLAN_EID_INTERWORKING,
+                        /* mesh ID can't happen here */
+                        /* 60 GHz can't happen here right now */
+                };
+                noffset = ieee80211_ie_split(ie, ie_len,
+                                             before_vht, ARRAY_SIZE(before_vht),
+                                             offset);
                 if (end - pos < noffset - offset)
                         goto out_err;
                 memcpy(pos, ie + offset, noffset - offset);
                 pos += noffset - offset;
+                offset = noffset;
         }
 
         if (sband->vht_cap.vht_supported) {
@@ -1293,6 +1312,15 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                                                  sband->vht_cap.cap);
         }
 
+        /* add any remaining custom IEs */
+        if (ie && ie_len) {
+                noffset = ie_len;
+                if (end - pos < noffset - offset)
+                        goto out_err;
+                memcpy(pos, ie + offset, noffset - offset);
+                pos += noffset - offset;
+        }
+
         return pos - buffer;
  out_err:
         WARN_ONCE(1, "not enough space for preq IEs\n");
@@ -1370,7 +1398,6 @@ u32 ieee80211_sta_get_rates(struct ieee80211_sub_if_data *sdata,
                             enum ieee80211_band band, u32 *basic_rates)
 {
         struct ieee80211_supported_band *sband;
-        struct ieee80211_rate *bitrates;
         size_t num_rates;
         u32 supp_rates, rate_flags;
         int i, j, shift;
@@ -1382,7 +1409,6 @@ u32 ieee80211_sta_get_rates(struct ieee80211_sub_if_data *sdata,
         if (WARN_ON(!sband))
                 return 1;
 
-        bitrates = sband->bitrates;
         num_rates = sband->n_bitrates;
         supp_rates = 0;
         for (i = 0; i < elems->supp_rates_len +
@@ -2268,11 +2294,11 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
                 ri.nss = status->vht_nss;
                 if (status->flag & RX_FLAG_40MHZ)
                         ri.flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
-                if (status->flag & RX_FLAG_80MHZ)
+                if (status->vht_flag & RX_VHT_FLAG_80MHZ)
                         ri.flags |= RATE_INFO_FLAGS_80_MHZ_WIDTH;
-                if (status->flag & RX_FLAG_80P80MHZ)
+                if (status->vht_flag & RX_VHT_FLAG_80P80MHZ)
                         ri.flags |= RATE_INFO_FLAGS_80P80_MHZ_WIDTH;
-                if (status->flag & RX_FLAG_160MHZ)
+                if (status->vht_flag & RX_VHT_FLAG_160MHZ)
                         ri.flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
                 if (status->flag & RX_FLAG_SHORT_GI)
                         ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index d75f35c6e1a0..e9e36a256165 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -349,9 +349,9 @@ void ieee80211_sta_set_rx_nss(struct sta_info *sta)
         sta->sta.rx_nss = max_t(u8, 1, ht_rx_nss);
 }
 
-void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
-                                 struct sta_info *sta, u8 opmode,
-                                 enum ieee80211_band band, bool nss_only)
+u32 __ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
+                                  struct sta_info *sta, u8 opmode,
+                                  enum ieee80211_band band, bool nss_only)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
@@ -363,7 +363,7 @@ void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
 
         /* ignore - no support for BF yet */
         if (opmode & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)
-                return;
+                return 0;
 
         nss = opmode & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
         nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
@@ -375,7 +375,7 @@ void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
         }
 
         if (nss_only)
-                goto change;
+                return changed;
 
         switch (opmode & IEEE80211_OPMODE_NOTIF_CHANWIDTH_MASK) {
         case IEEE80211_OPMODE_NOTIF_CHANWIDTH_20MHZ:
@@ -398,7 +398,19 @@ void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
                 changed |= IEEE80211_RC_BW_CHANGED;
         }
 
- change:
-        if (changed)
+        return changed;
+}
+
+void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
+                                 struct sta_info *sta, u8 opmode,
+                                 enum ieee80211_band band, bool nss_only)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
+
+        u32 changed = __ieee80211_vht_handle_opmode(sdata, sta, opmode,
+                                                    band, nss_only);
+
+        if (changed > 0)
                 rate_control_rate_update(local, sband, sta, changed);
 }
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 21448d629b15..b8600e3c29c8 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -301,8 +301,7 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
 }
 
 
-static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad,
-                                int encrypted)
+static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad)
 {
         __le16 mask_fc;
         int a4_included, mgmt;
@@ -456,7 +455,7 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
                 return 0;
 
         pos += IEEE80211_CCMP_HDR_LEN;
-        ccmp_special_blocks(skb, pn, b_0, aad, 0);
+        ccmp_special_blocks(skb, pn, b_0, aad);
         ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
                                   skb_put(skb, IEEE80211_CCMP_MIC_LEN));
 
@@ -495,7 +494,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
         if (!ieee80211_is_data(hdr->frame_control) &&
-            !ieee80211_is_robust_mgmt_frame(hdr))
+            !ieee80211_is_robust_mgmt_frame(skb))
                 return RX_CONTINUE;
 
         data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN -
@@ -524,7 +523,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
                 u8 aad[2 * AES_BLOCK_SIZE];
                 u8 b_0[AES_BLOCK_SIZE];
                 /* hardware didn't decrypt/verify MIC */
-                ccmp_special_blocks(skb, pn, b_0, aad, 1);
+                ccmp_special_blocks(skb, pn, b_0, aad);
 
                 if (ieee80211_aes_ccm_decrypt(
                             key->u.ccmp.tfm, b_0, aad,
diff --git a/net/mac802154/Makefile b/net/mac802154/Makefile
index 57cf5d1a2e4a..15d62df52182 100644
--- a/net/mac802154/Makefile
+++ b/net/mac802154/Makefile
@@ -1,2 +1,4 @@
 obj-$(CONFIG_MAC802154) += mac802154.o
 mac802154-objs          := ieee802154_dev.o rx.o tx.o mac_cmd.o mib.o monitor.o wpan.o
+
+ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/mac802154/ieee802154_dev.c b/net/mac802154/ieee802154_dev.c
index 52ae6646a411..2cf66d885e68 100644
--- a/net/mac802154/ieee802154_dev.c
+++ b/net/mac802154/ieee802154_dev.c
@@ -27,6 +27,7 @@
 #include <net/netlink.h>
 #include <linux/nl802154.h>
 #include <net/mac802154.h>
+#include <net/ieee802154_netdev.h>
 #include <net/route.h>
 #include <net/wpan-phy.h>
 
@@ -35,9 +36,28 @@
 int mac802154_slave_open(struct net_device *dev)
 {
         struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct mac802154_sub_if_data *subif;
         struct mac802154_priv *ipriv = priv->hw;
         int res = 0;
 
+        ASSERT_RTNL();
+
+        if (priv->type == IEEE802154_DEV_WPAN) {
+                mutex_lock(&priv->hw->slaves_mtx);
+                list_for_each_entry(subif, &priv->hw->slaves, list) {
+                        if (subif != priv && subif->type == priv->type &&
+                            subif->running) {
+                                mutex_unlock(&priv->hw->slaves_mtx);
+                                return -EBUSY;
+                        }
+                }
+                mutex_unlock(&priv->hw->slaves_mtx);
+        }
+
+        mutex_lock(&priv->hw->slaves_mtx);
+        priv->running = true;
+        mutex_unlock(&priv->hw->slaves_mtx);
+
         if (ipriv->open_count++ == 0) {
                 res = ipriv->ops->start(&ipriv->hw);
                 WARN_ON(res);
@@ -46,7 +66,9 @@ int mac802154_slave_open(struct net_device *dev)
         }
 
         if (ipriv->ops->ieee_addr) {
-                res = ipriv->ops->ieee_addr(&ipriv->hw, dev->dev_addr);
+                __le64 addr = ieee802154_devaddr_from_raw(dev->dev_addr);
+
+                res = ipriv->ops->ieee_addr(&ipriv->hw, addr);
                 WARN_ON(res);
                 if (res)
                         goto err;
@@ -66,8 +88,14 @@ int mac802154_slave_close(struct net_device *dev)
         struct mac802154_sub_if_data *priv = netdev_priv(dev);
         struct mac802154_priv *ipriv = priv->hw;
 
+        ASSERT_RTNL();
+
         netif_stop_queue(dev);
 
+        mutex_lock(&priv->hw->slaves_mtx);
+        priv->running = false;
+        mutex_unlock(&priv->hw->slaves_mtx);
+
         if (!--ipriv->open_count)
                 ipriv->ops->stop(&ipriv->hw);
 
@@ -165,6 +193,49 @@ err:
         return ERR_PTR(err);
 }
 
+static int mac802154_set_txpower(struct wpan_phy *phy, int db)
+{
+        struct mac802154_priv *priv = wpan_phy_priv(phy);
+
+        return priv->ops->set_txpower(&priv->hw, db);
+}
+
+static int mac802154_set_lbt(struct wpan_phy *phy, bool on)
+{
+        struct mac802154_priv *priv = wpan_phy_priv(phy);
+
+        return priv->ops->set_lbt(&priv->hw, on);
+}
+
+static int mac802154_set_cca_mode(struct wpan_phy *phy, u8 mode)
+{
+        struct mac802154_priv *priv = wpan_phy_priv(phy);
+
+        return priv->ops->set_cca_mode(&priv->hw, mode);
+}
+
+static int mac802154_set_cca_ed_level(struct wpan_phy *phy, s32 level)
+{
+        struct mac802154_priv *priv = wpan_phy_priv(phy);
+
+        return priv->ops->set_cca_ed_level(&priv->hw, level);
+}
+
+static int mac802154_set_csma_params(struct wpan_phy *phy, u8 min_be,
+                                     u8 max_be, u8 retries)
+{
+        struct mac802154_priv *priv = wpan_phy_priv(phy);
+
+        return priv->ops->set_csma_params(&priv->hw, min_be, max_be, retries);
+}
+
+static int mac802154_set_frame_retries(struct wpan_phy *phy, s8 retries)
+{
+        struct mac802154_priv *priv = wpan_phy_priv(phy);
+
+        return priv->ops->set_frame_retries(&priv->hw, retries);
+}
+
 struct ieee802154_dev *
 ieee802154_alloc_device(size_t priv_data_len, struct ieee802154_ops *ops)
 {
@@ -242,6 +313,18 @@ int ieee802154_register_device(struct ieee802154_dev *dev)
 
         priv->phy->add_iface = mac802154_add_iface;
         priv->phy->del_iface = mac802154_del_iface;
+        if (priv->ops->set_txpower)
+                priv->phy->set_txpower = mac802154_set_txpower;
+        if (priv->ops->set_lbt)
+                priv->phy->set_lbt = mac802154_set_lbt;
+        if (priv->ops->set_cca_mode)
+                priv->phy->set_cca_mode = mac802154_set_cca_mode;
+        if (priv->ops->set_cca_ed_level)
+                priv->phy->set_cca_ed_level = mac802154_set_cca_ed_level;
+        if (priv->ops->set_csma_params)
+                priv->phy->set_csma_params = mac802154_set_csma_params;
+        if (priv->ops->set_frame_retries)
+                priv->phy->set_frame_retries = mac802154_set_frame_retries;
 
         rc = wpan_phy_register(priv->phy);
         if (rc < 0)
diff --git a/net/mac802154/mac802154.h b/net/mac802154/mac802154.h
index d48422e27110..28ef59c566e6 100644
--- a/net/mac802154/mac802154.h
+++ b/net/mac802154/mac802154.h
@@ -23,6 +23,8 @@
 #ifndef MAC802154_H
 #define MAC802154_H
 
+#include <net/ieee802154_netdev.h>
+
 /* mac802154 device private data */
 struct mac802154_priv {
         struct ieee802154_dev hw;
@@ -71,15 +73,19 @@ struct mac802154_sub_if_data {
         struct net_device *dev;
 
         int type;
+        bool running;
 
         spinlock_t mib_lock;
 
         __le16 pan_id;
         __le16 short_addr;
+        __le64 extended_addr;
 
         u8 chan;
         u8 page;
 
+        struct ieee802154_mac_params mac_params;
+
         /* MAC BSN field */
         u8 bsn;
         /* MAC DSN field */
@@ -106,12 +112,17 @@ netdev_tx_t mac802154_tx(struct mac802154_priv *priv, struct sk_buff *skb,
                          u8 page, u8 chan);
 
 /* MIB callbacks */
-void mac802154_dev_set_short_addr(struct net_device *dev, u16 val);
-u16 mac802154_dev_get_short_addr(const struct net_device *dev);
+void mac802154_dev_set_short_addr(struct net_device *dev, __le16 val);
+__le16 mac802154_dev_get_short_addr(const struct net_device *dev);
 void mac802154_dev_set_ieee_addr(struct net_device *dev);
-u16 mac802154_dev_get_pan_id(const struct net_device *dev);
-void mac802154_dev_set_pan_id(struct net_device *dev, u16 val);
+__le16 mac802154_dev_get_pan_id(const struct net_device *dev);
+void mac802154_dev_set_pan_id(struct net_device *dev, __le16 val);
 void mac802154_dev_set_page_channel(struct net_device *dev, u8 page, u8 chan);
 u8 mac802154_dev_get_dsn(const struct net_device *dev);
 
+int mac802154_set_mac_params(struct net_device *dev,
+                             const struct ieee802154_mac_params *params);
+void mac802154_get_mac_params(struct net_device *dev,
+                              struct ieee802154_mac_params *params);
+
 #endif /* MAC802154_H */
diff --git a/net/mac802154/mac_cmd.c b/net/mac802154/mac_cmd.c
index a99910d4d52f..d40c0928bc62 100644
--- a/net/mac802154/mac_cmd.c
+++ b/net/mac802154/mac_cmd.c
@@ -40,7 +40,7 @@ static int mac802154_mlme_start_req(struct net_device *dev,
                                     u8 pan_coord, u8 blx,
                                     u8 coord_realign)
 {
-        BUG_ON(addr->addr_type != IEEE802154_ADDR_SHORT);
+        BUG_ON(addr->mode != IEEE802154_ADDR_SHORT);
 
         mac802154_dev_set_pan_id(dev, addr->pan_id);
         mac802154_dev_set_short_addr(dev, addr->short_addr);
@@ -74,4 +74,7 @@ struct ieee802154_mlme_ops mac802154_mlme_wpan = {
         .get_pan_id = mac802154_dev_get_pan_id,
         .get_short_addr = mac802154_dev_get_short_addr,
         .get_dsn = mac802154_dev_get_dsn,
+
+        .set_mac_params = mac802154_set_mac_params,
+        .get_mac_params = mac802154_get_mac_params,
 };
diff --git a/net/mac802154/mib.c b/net/mac802154/mib.c
index 8ded97cf1c33..f0991f2344d4 100644
--- a/net/mac802154/mib.c
+++ b/net/mac802154/mib.c
@@ -24,6 +24,7 @@
 #include <linux/if_arp.h>
 
 #include <net/mac802154.h>
+#include <net/ieee802154_netdev.h>
 #include <net/wpan-phy.h>
 
 #include "mac802154.h"
@@ -62,8 +63,6 @@ static void hw_addr_notify(struct work_struct *work)
                 pr_debug("failed changed mask %lx\n", nw->changed);
 
         kfree(nw);
-
-        return;
 }
 
 static void set_hw_addr_filt(struct net_device *dev, unsigned long changed)
@@ -79,11 +78,9 @@ static void set_hw_addr_filt(struct net_device *dev, unsigned long changed)
         work->dev = dev;
         work->changed = changed;
         queue_work(priv->hw->dev_workqueue, &work->work);
-
-        return;
 }
 
-void mac802154_dev_set_short_addr(struct net_device *dev, u16 val)
+void mac802154_dev_set_short_addr(struct net_device *dev, __le16 val)
 {
         struct mac802154_sub_if_data *priv = netdev_priv(dev);
 
@@ -100,10 +97,10 @@ void mac802154_dev_set_short_addr(struct net_device *dev, u16 val)
         }
 }
 
-u16 mac802154_dev_get_short_addr(const struct net_device *dev)
+__le16 mac802154_dev_get_short_addr(const struct net_device *dev)
 {
         struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        u16 ret;
+        __le16 ret;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
@@ -119,19 +116,19 @@ void mac802154_dev_set_ieee_addr(struct net_device *dev)
         struct mac802154_sub_if_data *priv = netdev_priv(dev);
         struct mac802154_priv *mac = priv->hw;
 
+        priv->extended_addr = ieee802154_devaddr_from_raw(dev->dev_addr);
+
         if (mac->ops->set_hw_addr_filt &&
-            memcmp(mac->hw.hw_filt.ieee_addr,
-                   dev->dev_addr, IEEE802154_ADDR_LEN)) {
-                memcpy(mac->hw.hw_filt.ieee_addr,
-                       dev->dev_addr, IEEE802154_ADDR_LEN);
+            mac->hw.hw_filt.ieee_addr != priv->extended_addr) {
+                mac->hw.hw_filt.ieee_addr = priv->extended_addr;
                 set_hw_addr_filt(dev, IEEE802515_AFILT_IEEEADDR_CHANGED);
         }
 }
 
-u16 mac802154_dev_get_pan_id(const struct net_device *dev)
+__le16 mac802154_dev_get_pan_id(const struct net_device *dev)
 {
         struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        u16 ret;
+        __le16 ret;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
@@ -142,7 +139,7 @@ u16 mac802154_dev_get_pan_id(const struct net_device *dev)
         return ret;
 }
 
-void mac802154_dev_set_pan_id(struct net_device *dev, u16 val)
+void mac802154_dev_set_pan_id(struct net_device *dev, __le16 val)
 {
         struct mac802154_sub_if_data *priv = netdev_priv(dev);
 
diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index 38548ec2098f..03855b0677cc 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -80,7 +80,6 @@ mac802154_subif_rx(struct ieee802154_dev *hw, struct sk_buff *skb, u8 lqi)
         mac802154_wpans_rx(priv, skb);
 out:
         dev_kfree_skb(skb);
-        return;
 }
 
 static void mac802154_rx_worker(struct work_struct *work)
diff --git a/net/mac802154/wpan.c b/net/mac802154/wpan.c
index 372d8a222b91..1df7a6a57386 100644
--- a/net/mac802154/wpan.c
+++ b/net/mac802154/wpan.c
@@ -35,35 +35,6 @@
 
 #include "mac802154.h"
 
-static inline int mac802154_fetch_skb_u8(struct sk_buff *skb, u8 *val)
-{
-        if (unlikely(!pskb_may_pull(skb, 1)))
-                return -EINVAL;
-
-        *val = skb->data[0];
-        skb_pull(skb, 1);
-
-        return 0;
-}
-
-static inline int mac802154_fetch_skb_u16(struct sk_buff *skb, u16 *val)
-{
-        if (unlikely(!pskb_may_pull(skb, 2)))
-                return -EINVAL;
-
-        *val = skb->data[0] | (skb->data[1] << 8);
-        skb_pull(skb, 2);
-
-        return 0;
-}
-
-static inline void mac802154_haddr_copy_swap(u8 *dest, const u8 *src)
-{
-        int i;
-        for (i = 0; i < IEEE802154_ADDR_LEN; i++)
-                dest[IEEE802154_ADDR_LEN - i - 1] = src[i];
-}
-
 static int
 mac802154_wpan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
@@ -76,19 +47,25 @@ mac802154_wpan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 
         switch (cmd) {
         case SIOCGIFADDR:
-                if (priv->pan_id == IEEE802154_PANID_BROADCAST ||
-                    priv->short_addr == IEEE802154_ADDR_BROADCAST) {
+        {
+                u16 pan_id, short_addr;
+
+                pan_id = le16_to_cpu(priv->pan_id);
+                short_addr = le16_to_cpu(priv->short_addr);
+                if (pan_id == IEEE802154_PANID_BROADCAST ||
+                    short_addr == IEEE802154_ADDR_BROADCAST) {
                         err = -EADDRNOTAVAIL;
                         break;
                 }
 
                 sa->family = AF_IEEE802154;
                 sa->addr.addr_type = IEEE802154_ADDR_SHORT;
-                sa->addr.pan_id = priv->pan_id;
-                sa->addr.short_addr = priv->short_addr;
+                sa->addr.pan_id = pan_id;
+                sa->addr.short_addr = short_addr;
 
                 err = 0;
                 break;
+        }
         case SIOCSIFADDR:
                 dev_warn(&dev->dev,
                          "Using DEBUGing ioctl SIOCSIFADDR isn't recommened!\n");
@@ -101,8 +78,8 @@ mac802154_wpan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         break;
                 }
 
-                priv->pan_id = sa->addr.pan_id;
-                priv->short_addr = sa->addr.short_addr;
+                priv->pan_id = cpu_to_le16(sa->addr.pan_id);
+                priv->short_addr = cpu_to_le16(sa->addr.short_addr);
 
                 err = 0;
                 break;
@@ -125,190 +102,154 @@ static int mac802154_wpan_mac_addr(struct net_device *dev, void *p)
         return 0;
 }
 
-static int mac802154_header_create(struct sk_buff *skb,
-                                   struct net_device *dev,
-                                   unsigned short type,
-                                   const void *_daddr,
-                                   const void *_saddr,
-                                   unsigned len)
+int mac802154_set_mac_params(struct net_device *dev,
+                             const struct ieee802154_mac_params *params)
 {
-        const struct ieee802154_addr *saddr = _saddr;
-        const struct ieee802154_addr *daddr = _daddr;
-        struct ieee802154_addr dev_addr;
         struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        int pos = 2;
-        u8 head[MAC802154_FRAME_HARD_HEADER_LEN];
-        u16 fc;
 
-        if (!daddr)
-                return -EINVAL;
+        mutex_lock(&priv->hw->slaves_mtx);
+        priv->mac_params = *params;
+        mutex_unlock(&priv->hw->slaves_mtx);
 
-        head[pos++] = mac_cb(skb)->seq; /* DSN/BSN */
-        fc = mac_cb_type(skb);
-        if (mac_cb_is_ackreq(skb))
-                fc |= IEEE802154_FC_ACK_REQ;
+        return 0;
+}
 
-        if (!saddr) {
-                spin_lock_bh(&priv->mib_lock);
+void mac802154_get_mac_params(struct net_device *dev,
+                              struct ieee802154_mac_params *params)
+{
+        struct mac802154_sub_if_data *priv = netdev_priv(dev);
 
-                if (priv->short_addr == IEEE802154_ADDR_BROADCAST ||
-                    priv->short_addr == IEEE802154_ADDR_UNDEF ||
-                    priv->pan_id == IEEE802154_PANID_BROADCAST) {
-                        dev_addr.addr_type = IEEE802154_ADDR_LONG;
-                        memcpy(dev_addr.hwaddr, dev->dev_addr,
-                               IEEE802154_ADDR_LEN);
-                } else {
-                        dev_addr.addr_type = IEEE802154_ADDR_SHORT;
-                        dev_addr.short_addr = priv->short_addr;
-                }
+        mutex_lock(&priv->hw->slaves_mtx);
+        *params = priv->mac_params;
+        mutex_unlock(&priv->hw->slaves_mtx);
+}
 
-                dev_addr.pan_id = priv->pan_id;
-                saddr = &dev_addr;
+int mac802154_wpan_open(struct net_device *dev)
+{
+        int rc;
+        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct wpan_phy *phy = priv->hw->phy;
 
-                spin_unlock_bh(&priv->mib_lock);
-        }
+        rc = mac802154_slave_open(dev);
+        if (rc < 0)
+                return rc;
 
-        if (daddr->addr_type != IEEE802154_ADDR_NONE) {
-                fc |= (daddr->addr_type << IEEE802154_FC_DAMODE_SHIFT);
+        mutex_lock(&phy->pib_lock);
 
-                head[pos++] = daddr->pan_id & 0xff;
-                head[pos++] = daddr->pan_id >> 8;
+        if (phy->set_txpower) {
+                rc = phy->set_txpower(phy, priv->mac_params.transmit_power);
+                if (rc < 0)
+                        goto out;
+        }
 
-                if (daddr->addr_type == IEEE802154_ADDR_SHORT) {
-                        head[pos++] = daddr->short_addr & 0xff;
-                        head[pos++] = daddr->short_addr >> 8;
-                } else {
-                        mac802154_haddr_copy_swap(head + pos, daddr->hwaddr);
-                        pos += IEEE802154_ADDR_LEN;
-                }
+        if (phy->set_lbt) {
+                rc = phy->set_lbt(phy, priv->mac_params.lbt);
+                if (rc < 0)
+                        goto out;
         }
 
-        if (saddr->addr_type != IEEE802154_ADDR_NONE) {
-                fc |= (saddr->addr_type << IEEE802154_FC_SAMODE_SHIFT);
+        if (phy->set_cca_mode) {
+                rc = phy->set_cca_mode(phy, priv->mac_params.cca_mode);
+                if (rc < 0)
+                        goto out;
+        }
 
-                if ((saddr->pan_id == daddr->pan_id) &&
-                    (saddr->pan_id != IEEE802154_PANID_BROADCAST)) {
-                        /* PANID compression/intra PAN */
-                        fc |= IEEE802154_FC_INTRA_PAN;
-                } else {
-                        head[pos++] = saddr->pan_id & 0xff;
-                        head[pos++] = saddr->pan_id >> 8;
-                }
+        if (phy->set_cca_ed_level) {
+                rc = phy->set_cca_ed_level(phy, priv->mac_params.cca_ed_level);
+                if (rc < 0)
+                        goto out;
+        }
 
-                if (saddr->addr_type == IEEE802154_ADDR_SHORT) {
-                        head[pos++] = saddr->short_addr & 0xff;
-                        head[pos++] = saddr->short_addr >> 8;
-                } else {
-                        mac802154_haddr_copy_swap(head + pos, saddr->hwaddr);
-                        pos += IEEE802154_ADDR_LEN;
-                }
+        if (phy->set_csma_params) {
+                rc = phy->set_csma_params(phy, priv->mac_params.min_be,
+                                          priv->mac_params.max_be,
+                                          priv->mac_params.csma_retries);
+                if (rc < 0)
+                        goto out;
         }
 
-        head[0] = fc;
-        head[1] = fc >> 8;
+        if (phy->set_frame_retries) {
+                rc = phy->set_frame_retries(phy,
+                                            priv->mac_params.frame_retries);
+                if (rc < 0)
+                        goto out;
+        }
 
-        memcpy(skb_push(skb, pos), head, pos);
-        skb_reset_mac_header(skb);
-        skb->mac_len = pos;
+        mutex_unlock(&phy->pib_lock);
+        return 0;
 
-        return pos;
+out:
+        mutex_unlock(&phy->pib_lock);
+        return rc;
 }
 
-static int
-mac802154_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+static int mac802154_header_create(struct sk_buff *skb,
+                                   struct net_device *dev,
+                                   unsigned short type,
+                                   const void *daddr,
+                                   const void *saddr,
+                                   unsigned len)
 {
-        const u8 *hdr = skb_mac_header(skb);
-        const u8 *tail = skb_tail_pointer(skb);
-        struct ieee802154_addr *addr = (struct ieee802154_addr *)haddr;
-        u16 fc;
-        int da_type;
-
-        if (hdr + 3 > tail)
-                goto malformed;
+        struct ieee802154_hdr hdr;
+        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        int hlen;
 
-        fc = hdr[0] | (hdr[1] << 8);
+        if (!daddr)
+                return -EINVAL;
 
-        hdr += 3;
+        memset(&hdr.fc, 0, sizeof(hdr.fc));
+        hdr.fc.type = mac_cb_type(skb);
+        hdr.fc.security_enabled = mac_cb_is_secen(skb);
+        hdr.fc.ack_request = mac_cb_is_ackreq(skb);
 
-        da_type = IEEE802154_FC_DAMODE(fc);
-        addr->addr_type = IEEE802154_FC_SAMODE(fc);
+        if (!saddr) {
+                spin_lock_bh(&priv->mib_lock);
 
-        switch (da_type) {
-        case IEEE802154_ADDR_NONE:
-                if (fc & IEEE802154_FC_INTRA_PAN)
-                        goto malformed;
-                break;
-        case IEEE802154_ADDR_LONG:
-                if (fc & IEEE802154_FC_INTRA_PAN) {
-                        if (hdr + 2 > tail)
-                                goto malformed;
-                        addr->pan_id = hdr[0] | (hdr[1] << 8);
-                        hdr += 2;
+                if (priv->short_addr == cpu_to_le16(IEEE802154_ADDR_BROADCAST) ||
+                    priv->short_addr == cpu_to_le16(IEEE802154_ADDR_UNDEF) ||
+                    priv->pan_id == cpu_to_le16(IEEE802154_PANID_BROADCAST)) {
+                        hdr.source.mode = IEEE802154_ADDR_LONG;
+                        hdr.source.extended_addr = priv->extended_addr;
+                } else {
+                        hdr.source.mode = IEEE802154_ADDR_SHORT;
+                        hdr.source.short_addr = priv->short_addr;
                 }
 
-                if (hdr + IEEE802154_ADDR_LEN > tail)
-                        goto malformed;
+                hdr.source.pan_id = priv->pan_id;
 
-                hdr += IEEE802154_ADDR_LEN;
-                break;
-        case IEEE802154_ADDR_SHORT:
-                if (fc & IEEE802154_FC_INTRA_PAN) {
-                        if (hdr + 2 > tail)
-                                goto malformed;
-                        addr->pan_id = hdr[0] | (hdr[1] << 8);
-                        hdr += 2;
-                }
-
-                if (hdr + 2 > tail)
-                        goto malformed;
+                spin_unlock_bh(&priv->mib_lock);
+        } else {
+                hdr.source = *(const struct ieee802154_addr *)saddr;
+        }
 
-                hdr += 2;
-                break;
-        default:
-                goto malformed;
+        hdr.dest = *(const struct ieee802154_addr *)daddr;
 
-        }
+        hlen = ieee802154_hdr_push(skb, &hdr);
+        if (hlen < 0)
+                return -EINVAL;
 
-        switch (addr->addr_type) {
-        case IEEE802154_ADDR_NONE:
-                break;
-        case IEEE802154_ADDR_LONG:
-                if (!(fc & IEEE802154_FC_INTRA_PAN)) {
-                        if (hdr + 2 > tail)
-                                goto malformed;
-                        addr->pan_id = hdr[0] | (hdr[1] << 8);
-                        hdr += 2;
-                }
+        skb_reset_mac_header(skb);
+        skb->mac_len = hlen;
 
-                if (hdr + IEEE802154_ADDR_LEN > tail)
-                        goto malformed;
+        if (hlen + len + 2 > dev->mtu)
+                return -EMSGSIZE;
 
-                mac802154_haddr_copy_swap(addr->hwaddr, hdr);
-                hdr += IEEE802154_ADDR_LEN;
-                break;
-        case IEEE802154_ADDR_SHORT:
-                if (!(fc & IEEE802154_FC_INTRA_PAN)) {
-                        if (hdr + 2 > tail)
-                                goto malformed;
-                        addr->pan_id = hdr[0] | (hdr[1] << 8);
-                        hdr += 2;
-                }
+        return hlen;
+}
 
-                if (hdr + 2 > tail)
-                        goto malformed;
+static int
+mac802154_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+{
+        struct ieee802154_hdr hdr;
+        struct ieee802154_addr *addr = (struct ieee802154_addr *)haddr;
 
-                addr->short_addr = hdr[0] | (hdr[1] << 8);
-                hdr += 2;
-                break;
-        default:
-                goto malformed;
+        if (ieee802154_hdr_peek_addrs(skb, &hdr) < 0) {
+                pr_debug("malformed packet\n");
+                return 0;
         }
 
-        return sizeof(struct ieee802154_addr);
-
-malformed:
-        pr_debug("malformed packet\n");
-        return 0;
+        *addr = hdr.source;
+        return sizeof(*addr);
 }
 
 static netdev_tx_t
@@ -344,7 +285,7 @@ static struct header_ops mac802154_header_ops = {
 };
 
 static const struct net_device_ops mac802154_wpan_ops = {
-        .ndo_open               = mac802154_slave_open,
+        .ndo_open               = mac802154_wpan_open,
         .ndo_stop               = mac802154_slave_close,
         .ndo_start_xmit         = mac802154_wpan_xmit,
         .ndo_do_ioctl           = mac802154_wpan_ioctl,
@@ -382,8 +323,14 @@ void mac802154_wpan_setup(struct net_device *dev)
         get_random_bytes(&priv->bsn, 1);
         get_random_bytes(&priv->dsn, 1);
 
-        priv->pan_id = IEEE802154_PANID_BROADCAST;
-        priv->short_addr = IEEE802154_ADDR_BROADCAST;
+        /* defaults per 802.15.4-2011 */
+        priv->mac_params.min_be = 3;
+        priv->mac_params.max_be = 5;
+        priv->mac_params.csma_retries = 4;
+        priv->mac_params.frame_retries = -1; /* for compatibility, actual default is 3 */
+
+        priv->pan_id = cpu_to_le16(IEEE802154_PANID_BROADCAST);
+        priv->short_addr = cpu_to_le16(IEEE802154_ADDR_BROADCAST);
 }
 
 static int mac802154_process_data(struct net_device *dev, struct sk_buff *skb)
@@ -394,13 +341,18 @@ static int mac802154_process_data(struct net_device *dev, struct sk_buff *skb)
 static int
 mac802154_subif_frame(struct mac802154_sub_if_data *sdata, struct sk_buff *skb)
 {
+        __le16 span, sshort;
+
         pr_debug("getting packet via slave interface %s\n", sdata->dev->name);
 
         spin_lock_bh(&sdata->mib_lock);
 
-        switch (mac_cb(skb)->da.addr_type) {
+        span = sdata->pan_id;
+        sshort = sdata->short_addr;
+
+        switch (mac_cb(skb)->dest.mode) {
         case IEEE802154_ADDR_NONE:
-                if (mac_cb(skb)->sa.addr_type != IEEE802154_ADDR_NONE)
+                if (mac_cb(skb)->dest.mode != IEEE802154_ADDR_NONE)
                         /* FIXME: check if we are PAN coordinator */
                         skb->pkt_type = PACKET_OTHERHOST;
                 else
@@ -408,23 +360,22 @@ mac802154_subif_frame(struct mac802154_sub_if_data *sdata, struct sk_buff *skb)
                         skb->pkt_type = PACKET_HOST;
                 break;
         case IEEE802154_ADDR_LONG:
-                if (mac_cb(skb)->da.pan_id != sdata->pan_id &&
-                    mac_cb(skb)->da.pan_id != IEEE802154_PANID_BROADCAST)
+                if (mac_cb(skb)->dest.pan_id != span &&
+                    mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST))
                         skb->pkt_type = PACKET_OTHERHOST;
-                else if (!memcmp(mac_cb(skb)->da.hwaddr, sdata->dev->dev_addr,
-                                 IEEE802154_ADDR_LEN))
+                else if (mac_cb(skb)->dest.extended_addr == sdata->extended_addr)
                         skb->pkt_type = PACKET_HOST;
                 else
                         skb->pkt_type = PACKET_OTHERHOST;
                 break;
         case IEEE802154_ADDR_SHORT:
-                if (mac_cb(skb)->da.pan_id != sdata->pan_id &&
-                    mac_cb(skb)->da.pan_id != IEEE802154_PANID_BROADCAST)
+                if (mac_cb(skb)->dest.pan_id != span &&
+                    mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST))
                         skb->pkt_type = PACKET_OTHERHOST;
-                else if (mac_cb(skb)->da.short_addr == sdata->short_addr)
+                else if (mac_cb(skb)->dest.short_addr == sshort)
                         skb->pkt_type = PACKET_HOST;
-                else if (mac_cb(skb)->da.short_addr ==
-                                        IEEE802154_ADDR_BROADCAST)
+                else if (mac_cb(skb)->dest.short_addr ==
+                          cpu_to_le16(IEEE802154_ADDR_BROADCAST))
                         skb->pkt_type = PACKET_BROADCAST;
                 else
                         skb->pkt_type = PACKET_OTHERHOST;
@@ -451,88 +402,82 @@ mac802154_subif_frame(struct mac802154_sub_if_data *sdata, struct sk_buff *skb)
         }
 }
 
-static int mac802154_parse_frame_start(struct sk_buff *skb)
+static void mac802154_print_addr(const char *name,
+                                 const struct ieee802154_addr *addr)
 {
-        u8 *head = skb->data;
-        u16 fc;
-
-        if (mac802154_fetch_skb_u16(skb, &fc) ||
-            mac802154_fetch_skb_u8(skb, &(mac_cb(skb)->seq)))
-                goto err;
-
-        pr_debug("fc: %04x dsn: %02x\n", fc, head[2]);
-
-        mac_cb(skb)->flags = IEEE802154_FC_TYPE(fc);
-        mac_cb(skb)->sa.addr_type = IEEE802154_FC_SAMODE(fc);
-        mac_cb(skb)->da.addr_type = IEEE802154_FC_DAMODE(fc);
+        if (addr->mode == IEEE802154_ADDR_NONE)
+                pr_debug("%s not present\n", name);
 
-        if (fc & IEEE802154_FC_INTRA_PAN)
-                mac_cb(skb)->flags |= MAC_CB_FLAG_INTRAPAN;
+        pr_debug("%s PAN ID: %04x\n", name, le16_to_cpu(addr->pan_id));
+        if (addr->mode == IEEE802154_ADDR_SHORT) {
+                pr_debug("%s is short: %04x\n", name,
+                         le16_to_cpu(addr->short_addr));
+        } else {
+                u64 hw = swab64((__force u64) addr->extended_addr);
 
-        if (mac_cb(skb)->da.addr_type != IEEE802154_ADDR_NONE) {
-                if (mac802154_fetch_skb_u16(skb, &(mac_cb(skb)->da.pan_id)))
-                        goto err;
-
-                /* source PAN id compression */
-                if (mac_cb_is_intrapan(skb))
-                        mac_cb(skb)->sa.pan_id = mac_cb(skb)->da.pan_id;
+                pr_debug("%s is hardware: %8phC\n", name, &hw);
+        }
+}
 
-                pr_debug("dest PAN addr: %04x\n", mac_cb(skb)->da.pan_id);
+static int mac802154_parse_frame_start(struct sk_buff *skb)
+{
+        int hlen;
+        struct ieee802154_hdr hdr;
 
-                if (mac_cb(skb)->da.addr_type == IEEE802154_ADDR_SHORT) {
-                        u16 *da = &(mac_cb(skb)->da.short_addr);
+        hlen = ieee802154_hdr_pull(skb, &hdr);
+        if (hlen < 0)
+                return -EINVAL;
 
-                        if (mac802154_fetch_skb_u16(skb, da))
-                                goto err;
+        skb->mac_len = hlen;
 
-                        pr_debug("destination address is short: %04x\n",
-                                 mac_cb(skb)->da.short_addr);
-                } else {
-                        if (!pskb_may_pull(skb, IEEE802154_ADDR_LEN))
-                                goto err;
+        pr_debug("fc: %04x dsn: %02x\n", le16_to_cpup((__le16 *)&hdr.fc),
+                 hdr.seq);
 
-                        mac802154_haddr_copy_swap(mac_cb(skb)->da.hwaddr,
-                                                  skb->data);
-                        skb_pull(skb, IEEE802154_ADDR_LEN);
+        mac_cb(skb)->flags = hdr.fc.type;
 
-                        pr_debug("destination address is hardware\n");
-                }
-        }
+        if (hdr.fc.ack_request)
+                mac_cb(skb)->flags |= MAC_CB_FLAG_ACKREQ;
+        if (hdr.fc.security_enabled)
+                mac_cb(skb)->flags |= MAC_CB_FLAG_SECEN;
 
-        if (mac_cb(skb)->sa.addr_type != IEEE802154_ADDR_NONE) {
-                /* non PAN-compression, fetch source address id */
-                if (!(mac_cb_is_intrapan(skb))) {
-                        u16 *sa_pan = &(mac_cb(skb)->sa.pan_id);
+        mac802154_print_addr("destination", &hdr.dest);
+        mac802154_print_addr("source", &hdr.source);
 
-                        if (mac802154_fetch_skb_u16(skb, sa_pan))
-                                goto err;
-                }
+        mac_cb(skb)->source = hdr.source;
+        mac_cb(skb)->dest = hdr.dest;
 
-                pr_debug("source PAN addr: %04x\n", mac_cb(skb)->da.pan_id);
+        if (hdr.fc.security_enabled) {
+                u64 key;
 
-                if (mac_cb(skb)->sa.addr_type == IEEE802154_ADDR_SHORT) {
-                        u16 *sa = &(mac_cb(skb)->sa.short_addr);
+                pr_debug("seclevel %i\n", hdr.sec.level);
 
-                        if (mac802154_fetch_skb_u16(skb, sa))
-                                goto err;
+                switch (hdr.sec.key_id_mode) {
+                case IEEE802154_SCF_KEY_IMPLICIT:
+                        pr_debug("implicit key\n");
+                        break;
 
-                        pr_debug("source address is short: %04x\n",
-                                 mac_cb(skb)->sa.short_addr);
-                } else {
-                        if (!pskb_may_pull(skb, IEEE802154_ADDR_LEN))
-                                goto err;
+                case IEEE802154_SCF_KEY_INDEX:
+                        pr_debug("key %02x\n", hdr.sec.key_id);
+                        break;
 
-                        mac802154_haddr_copy_swap(mac_cb(skb)->sa.hwaddr,
-                                                  skb->data);
-                        skb_pull(skb, IEEE802154_ADDR_LEN);
+                case IEEE802154_SCF_KEY_SHORT_INDEX:
+                        pr_debug("key %04x:%04x %02x\n",
+                                 le32_to_cpu(hdr.sec.short_src) >> 16,
+                                 le32_to_cpu(hdr.sec.short_src) & 0xffff,
+                                 hdr.sec.key_id);
+                        break;
 
-                        pr_debug("source address is hardware\n");
+                case IEEE802154_SCF_KEY_HW_INDEX:
+                        key = swab64((__force u64) hdr.sec.extended_src);
+                        pr_debug("key source %8phC %02x\n", &key,
+                                 hdr.sec.key_id);
+                        break;
                 }
+
+                return -EINVAL;
         }
 
         return 0;
-err:
-        return -EINVAL;
 }
 
 void mac802154_wpans_rx(struct mac802154_priv *priv, struct sk_buff *skb)
diff --git a/net/netfilter/ipset/Kconfig b/net/netfilter/ipset/Kconfig
index 44cd4f58adf0..2f7f5c32c6f9 100644
--- a/net/netfilter/ipset/Kconfig
+++ b/net/netfilter/ipset/Kconfig
@@ -61,6 +61,15 @@ config IP_SET_HASH_IP
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config IP_SET_HASH_IPMARK
+        tristate "hash:ip,mark set support"
+        depends on IP_SET
+        help
+          This option adds the hash:ip,mark set type support, by which one
+          can store IPv4/IPv6 address and mark pairs.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config IP_SET_HASH_IPPORT
         tristate "hash:ip,port set support"
         depends on IP_SET
diff --git a/net/netfilter/ipset/Makefile b/net/netfilter/ipset/Makefile
index 44b2d38476fa..231f10196cb9 100644
--- a/net/netfilter/ipset/Makefile
+++ b/net/netfilter/ipset/Makefile
@@ -14,6 +14,7 @@ obj-$(CONFIG_IP_SET_BITMAP_PORT) += ip_set_bitmap_port.o
 
 # hash types
 obj-$(CONFIG_IP_SET_HASH_IP) += ip_set_hash_ip.o
+obj-$(CONFIG_IP_SET_HASH_IPMARK) += ip_set_hash_ipmark.o
 obj-$(CONFIG_IP_SET_HASH_IPPORT) += ip_set_hash_ipport.o
 obj-$(CONFIG_IP_SET_HASH_IPPORTIP) += ip_set_hash_ipportip.o
 obj-$(CONFIG_IP_SET_HASH_IPPORTNET) += ip_set_hash_ipportnet.o
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index de770ec39e51..117208321f16 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -54,10 +54,10 @@ MODULE_DESCRIPTION("core IP set support");
 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);
 
 /* When the nfnl mutex is held: */
-#define nfnl_dereference(p)             \
+#define ip_set_dereference(p)           \
         rcu_dereference_protected(p, 1)
-#define nfnl_set(inst, id)                      \
-        nfnl_dereference((inst)->ip_set_list)[id]
+#define ip_set(inst, id)                \
+        ip_set_dereference((inst)->ip_set_list)[id]
 
 /*
  * The set types are implemented in modules and registered set types
@@ -368,6 +368,8 @@ ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], size_t len)
 
         if (tb[IPSET_ATTR_CADT_FLAGS])
                 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
+        if (cadt_flags & IPSET_FLAG_WITH_FORCEADD)
+                set->flags |= IPSET_CREATE_FLAG_FORCEADD;
         for (id = 0; id < IPSET_EXT_ID_MAX; id++) {
                 if (!add_extension(id, cadt_flags, tb))
                         continue;
@@ -510,7 +512,7 @@ ip_set_add(ip_set_id_t index, const struct sk_buff *skb,
 
         if (opt->dim < set->type->dimension ||
             !(opt->family == set->family || set->family == NFPROTO_UNSPEC))
-                return 0;
+                return -IPSET_ERR_TYPE_MISMATCH;
 
         write_lock_bh(&set->lock);
         ret = set->variant->kadt(set, skb, par, IPSET_ADD, opt);
@@ -533,7 +535,7 @@ ip_set_del(ip_set_id_t index, const struct sk_buff *skb,
 
         if (opt->dim < set->type->dimension ||
             !(opt->family == set->family || set->family == NFPROTO_UNSPEC))
-                return 0;
+                return -IPSET_ERR_TYPE_MISMATCH;
 
         write_lock_bh(&set->lock);
         ret = set->variant->kadt(set, skb, par, IPSET_DEL, opt);
@@ -640,7 +642,7 @@ ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index)
                 return IPSET_INVALID_ID;
 
         nfnl_lock(NFNL_SUBSYS_IPSET);
-        set = nfnl_set(inst, index);
+        set = ip_set(inst, index);
         if (set)
                 __ip_set_get(set);
         else
@@ -666,7 +668,7 @@ ip_set_nfnl_put(struct net *net, ip_set_id_t index)
 
         nfnl_lock(NFNL_SUBSYS_IPSET);
         if (!inst->is_deleted) { /* already deleted from ip_set_net_exit() */
-                set = nfnl_set(inst, index);
+                set = ip_set(inst, index);
                 if (set != NULL)
                         __ip_set_put(set);
         }
@@ -734,7 +736,7 @@ find_set_and_id(struct ip_set_net *inst, const char *name, ip_set_id_t *id)
 
         *id = IPSET_INVALID_ID;
         for (i = 0; i < inst->ip_set_max; i++) {
-                set = nfnl_set(inst, i);
+                set = ip_set(inst, i);
                 if (set != NULL && STREQ(set->name, name)) {
                         *id = i;
                         break;
@@ -760,7 +762,7 @@ find_free_id(struct ip_set_net *inst, const char *name, ip_set_id_t *index,
 
         *index = IPSET_INVALID_ID;
         for (i = 0;  i < inst->ip_set_max; i++) {
-                s = nfnl_set(inst, i);
+                s = ip_set(inst, i);
                 if (s == NULL) {
                         if (*index == IPSET_INVALID_ID)
                                 *index = i;
@@ -883,7 +885,7 @@ ip_set_create(struct sock *ctnl, struct sk_buff *skb,
                 if (!list)
                         goto cleanup;
                 /* nfnl mutex is held, both lists are valid */
-                tmp = nfnl_dereference(inst->ip_set_list);
+                tmp = ip_set_dereference(inst->ip_set_list);
                 memcpy(list, tmp, sizeof(struct ip_set *) * inst->ip_set_max);
                 rcu_assign_pointer(inst->ip_set_list, list);
                 /* Make sure all current packets have passed through */
@@ -900,7 +902,7 @@ ip_set_create(struct sock *ctnl, struct sk_buff *skb,
          * Finally! Add our shiny new set to the list, and be done.
          */
         pr_debug("create: '%s' created with index %u!\n", set->name, index);
-        nfnl_set(inst, index) = set;
+        ip_set(inst, index) = set;
 
         return ret;
 
@@ -925,10 +927,10 @@ ip_set_setname_policy[IPSET_ATTR_CMD_MAX + 1] = {
 static void
 ip_set_destroy_set(struct ip_set_net *inst, ip_set_id_t index)
 {
-        struct ip_set *set = nfnl_set(inst, index);
+        struct ip_set *set = ip_set(inst, index);
 
         pr_debug("set: %s\n",  set->name);
-        nfnl_set(inst, index) = NULL;
+        ip_set(inst, index) = NULL;
 
         /* Must call it without holding any lock */
         set->variant->destroy(set);
@@ -962,7 +964,7 @@ ip_set_destroy(struct sock *ctnl, struct sk_buff *skb,
         read_lock_bh(&ip_set_ref_lock);
         if (!attr[IPSET_ATTR_SETNAME]) {
                 for (i = 0; i < inst->ip_set_max; i++) {
-                        s = nfnl_set(inst, i);
+                        s = ip_set(inst, i);
                         if (s != NULL && s->ref) {
                                 ret = -IPSET_ERR_BUSY;
                                 goto out;
@@ -970,7 +972,7 @@ ip_set_destroy(struct sock *ctnl, struct sk_buff *skb,
                 }
                 read_unlock_bh(&ip_set_ref_lock);
                 for (i = 0; i < inst->ip_set_max; i++) {
-                        s = nfnl_set(inst, i);
+                        s = ip_set(inst, i);
                         if (s != NULL)
                                 ip_set_destroy_set(inst, i);
                 }
@@ -1020,7 +1022,7 @@ ip_set_flush(struct sock *ctnl, struct sk_buff *skb,
 
         if (!attr[IPSET_ATTR_SETNAME]) {
                 for (i = 0; i < inst->ip_set_max; i++) {
-                        s = nfnl_set(inst, i);
+                        s = ip_set(inst, i);
                         if (s != NULL)
                                 ip_set_flush_set(s);
                 }
@@ -1074,7 +1076,7 @@ ip_set_rename(struct sock *ctnl, struct sk_buff *skb,
 
         name2 = nla_data(attr[IPSET_ATTR_SETNAME2]);
         for (i = 0; i < inst->ip_set_max; i++) {
-                s = nfnl_set(inst, i);
+                s = ip_set(inst, i);
                 if (s != NULL && STREQ(s->name, name2)) {
                         ret = -IPSET_ERR_EXIST_SETNAME2;
                         goto out;
@@ -1134,8 +1136,8 @@ ip_set_swap(struct sock *ctnl, struct sk_buff *skb,
 
         write_lock_bh(&ip_set_ref_lock);
         swap(from->ref, to->ref);
-        nfnl_set(inst, from_id) = to;
-        nfnl_set(inst, to_id) = from;
+        ip_set(inst, from_id) = to;
+        ip_set(inst, to_id) = from;
         write_unlock_bh(&ip_set_ref_lock);
 
         return 0;
@@ -1157,7 +1159,7 @@ ip_set_dump_done(struct netlink_callback *cb)
         struct ip_set_net *inst = (struct ip_set_net *)cb->args[IPSET_CB_NET];
         if (cb->args[IPSET_CB_ARG0]) {
                 pr_debug("release set %s\n",
-                         nfnl_set(inst, cb->args[IPSET_CB_INDEX])->name);
+                         ip_set(inst, cb->args[IPSET_CB_INDEX])->name);
                 __ip_set_put_byindex(inst,
                         (ip_set_id_t) cb->args[IPSET_CB_INDEX]);
         }
@@ -1254,7 +1256,7 @@ dump_last:
                  dump_type, dump_flags, cb->args[IPSET_CB_INDEX]);
         for (; cb->args[IPSET_CB_INDEX] < max; cb->args[IPSET_CB_INDEX]++) {
                 index = (ip_set_id_t) cb->args[IPSET_CB_INDEX];
-                set = nfnl_set(inst, index);
+                set = ip_set(inst, index);
                 if (set == NULL) {
                         if (dump_type == DUMP_ONE) {
                                 ret = -ENOENT;
@@ -1332,7 +1334,7 @@ next_set:
 release_refcount:
         /* If there was an error or set is done, release set */
         if (ret || !cb->args[IPSET_CB_ARG0]) {
-                pr_debug("release set %s\n", nfnl_set(inst, index)->name);
+                pr_debug("release set %s\n", ip_set(inst, index)->name);
                 __ip_set_put_byindex(inst, index);
                 cb->args[IPSET_CB_ARG0] = 0;
         }
@@ -1887,7 +1889,7 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
                 find_set_and_id(inst, req_get->set.name, &id);
                 req_get->set.index = id;
                 if (id != IPSET_INVALID_ID)
-                        req_get->family = nfnl_set(inst, id)->family;
+                        req_get->family = ip_set(inst, id)->family;
                 nfnl_unlock(NFNL_SUBSYS_IPSET);
                 goto copy;
         }
@@ -1901,7 +1903,7 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
                         goto done;
                 }
                 nfnl_lock(NFNL_SUBSYS_IPSET);
-                set = nfnl_set(inst, req_get->set.index);
+                set = ip_set(inst, req_get->set.index);
                 strncpy(req_get->set.name, set ? set->name : "",
                         IPSET_MAXNAMELEN);
                 nfnl_unlock(NFNL_SUBSYS_IPSET);
@@ -1945,7 +1947,6 @@ ip_set_net_init(struct net *net)
                 return -ENOMEM;
         inst->is_deleted = 0;
         rcu_assign_pointer(inst->ip_set_list, list);
-        pr_notice("ip_set: protocol %u\n", IPSET_PROTOCOL);
         return 0;
 }
 
@@ -1960,7 +1961,7 @@ ip_set_net_exit(struct net *net)
         inst->is_deleted = 1; /* flag for ip_set_nfnl_put */
 
         for (i = 0; i < inst->ip_set_max; i++) {
-                set = nfnl_set(inst, i);
+                set = ip_set(inst, i);
                 if (set != NULL)
                         ip_set_destroy_set(inst, i);
         }
@@ -1996,6 +1997,7 @@ ip_set_init(void)
                 nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
                 return ret;
         }
+        pr_info("ip_set: protocol %u\n", IPSET_PROTOCOL);
         return 0;
 }
 
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index be6932ad3a86..61c7fb052802 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -263,6 +263,9 @@ struct htype {
         u32 maxelem;            /* max elements in the hash */
         u32 elements;           /* current element (vs timeout) */
         u32 initval;            /* random jhash init value */
+#ifdef IP_SET_HASH_WITH_MARKMASK
+        u32 markmask;           /* markmask value for mark mask to store */
+#endif
         struct timer_list gc;   /* garbage collection when timeout enabled */
         struct mtype_elem next; /* temporary storage for uadd */
 #ifdef IP_SET_HASH_WITH_MULTI
@@ -454,6 +457,9 @@ mtype_same_set(const struct ip_set *a, const struct ip_set *b)
 #ifdef IP_SET_HASH_WITH_NETMASK
                x->netmask == y->netmask &&
 #endif
+#ifdef IP_SET_HASH_WITH_MARKMASK
+               x->markmask == y->markmask &&
+#endif
                a->extensions == b->extensions;
 }
 
@@ -627,6 +633,18 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
         bool flag_exist = flags & IPSET_FLAG_EXIST;
         u32 key, multi = 0;
 
+        if (h->elements >= h->maxelem && SET_WITH_FORCEADD(set)) {
+                rcu_read_lock_bh();
+                t = rcu_dereference_bh(h->table);
+                key = HKEY(value, h->initval, t->htable_bits);
+                n = hbucket(t,key);
+                if (n->pos) {
+                        /* Choosing the first entry in the array to replace */
+                        j = 0;
+                        goto reuse_slot;
+                }
+                rcu_read_unlock_bh();
+        }
         if (SET_WITH_TIMEOUT(set) && h->elements >= h->maxelem)
                 /* FIXME: when set is full, we slow down here */
                 mtype_expire(set, h, NLEN(set->family), set->dsize);
@@ -908,6 +926,10 @@ mtype_head(struct ip_set *set, struct sk_buff *skb)
             nla_put_u8(skb, IPSET_ATTR_NETMASK, h->netmask))
                 goto nla_put_failure;
 #endif
+#ifdef IP_SET_HASH_WITH_MARKMASK
+        if (nla_put_u32(skb, IPSET_ATTR_MARKMASK, h->markmask))
+                goto nla_put_failure;
+#endif
         if (nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1)) ||
             nla_put_net32(skb, IPSET_ATTR_MEMSIZE, htonl(memsize)))
                 goto nla_put_failure;
@@ -1016,6 +1038,9 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set,
                             struct nlattr *tb[], u32 flags)
 {
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
+#ifdef IP_SET_HASH_WITH_MARKMASK
+        u32 markmask;
+#endif
         u8 hbits;
 #ifdef IP_SET_HASH_WITH_NETMASK
         u8 netmask;
@@ -1026,6 +1051,10 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set,
 
         if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
+
+#ifdef IP_SET_HASH_WITH_MARKMASK
+        markmask = 0xffffffff;
+#endif
 #ifdef IP_SET_HASH_WITH_NETMASK
         netmask = set->family == NFPROTO_IPV4 ? 32 : 128;
         pr_debug("Create set %s with family %s\n",
@@ -1034,6 +1063,9 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set,
 
         if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
                      !ip_set_optattr_netorder(tb, IPSET_ATTR_MAXELEM) ||
+#ifdef IP_SET_HASH_WITH_MARKMASK
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_MARKMASK) ||
+#endif
                      !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
                      !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
                 return -IPSET_ERR_PROTOCOL;
@@ -1057,6 +1089,14 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set,
                         return -IPSET_ERR_INVALID_NETMASK;
         }
 #endif
+#ifdef IP_SET_HASH_WITH_MARKMASK
+        if (tb[IPSET_ATTR_MARKMASK]) {
+                markmask = ntohl(nla_get_u32(tb[IPSET_ATTR_MARKMASK]));
+
+                if ((markmask > 4294967295u) || markmask == 0)
+                        return -IPSET_ERR_INVALID_MARKMASK;
+        }
+#endif
 
         hsize = sizeof(*h);
 #ifdef IP_SET_HASH_WITH_NETS
@@ -1071,6 +1111,9 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set,
 #ifdef IP_SET_HASH_WITH_NETMASK
         h->netmask = netmask;
 #endif
+#ifdef IP_SET_HASH_WITH_MARKMASK
+        h->markmask = markmask;
+#endif
         get_random_bytes(&h->initval, sizeof(h->initval));
         set->timeout = IPSET_NO_TIMEOUT;
 
diff --git a/net/netfilter/ipset/ip_set_hash_ip.c b/net/netfilter/ipset/ip_set_hash_ip.c
index e65fc2423d56..dd40607f878e 100644
--- a/net/netfilter/ipset/ip_set_hash_ip.c
+++ b/net/netfilter/ipset/ip_set_hash_ip.c
@@ -25,7 +25,8 @@
 
 #define IPSET_TYPE_REV_MIN      0
 /*                              1          Counters support */
-#define IPSET_TYPE_REV_MAX      2       /* Comments support */
+/*                              2          Comments support */
+#define IPSET_TYPE_REV_MAX      3       /* Forceadd support */
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
diff --git a/net/netfilter/ipset/ip_set_hash_ipmark.c b/net/netfilter/ipset/ip_set_hash_ipmark.c
new file mode 100644
index 000000000000..4eff0a297254
--- /dev/null
+++ b/net/netfilter/ipset/ip_set_hash_ipmark.c
@@ -0,0 +1,321 @@
+/* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+ * Copyright (C) 2013 Smoothwall Ltd. <vytas.dauksa@smoothwall.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/* Kernel module implementing an IP set type: the hash:ip,mark type */
+
+#include <linux/jhash.h>
+#include <linux/module.h>
+#include <linux/ip.h>
+#include <linux/skbuff.h>
+#include <linux/errno.h>
+#include <linux/random.h>
+#include <net/ip.h>
+#include <net/ipv6.h>
+#include <net/netlink.h>
+#include <net/tcp.h>
+
+#include <linux/netfilter.h>
+#include <linux/netfilter/ipset/pfxlen.h>
+#include <linux/netfilter/ipset/ip_set.h>
+#include <linux/netfilter/ipset/ip_set_hash.h>
+
+#define IPSET_TYPE_REV_MIN      0
+#define IPSET_TYPE_REV_MAX      1       /* Forceadd support */
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Vytas Dauksa <vytas.dauksa@smoothwall.net>");
+IP_SET_MODULE_DESC("hash:ip,mark", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
+MODULE_ALIAS("ip_set_hash:ip,mark");
+
+/* Type specific function prefix */
+#define HTYPE           hash_ipmark
+#define IP_SET_HASH_WITH_MARKMASK
+
+/* IPv4 variant */
+
+/* Member elements */
+struct hash_ipmark4_elem {
+        __be32 ip;
+        __u32 mark;
+};
+
+/* Common functions */
+
+static inline bool
+hash_ipmark4_data_equal(const struct hash_ipmark4_elem *ip1,
+                        const struct hash_ipmark4_elem *ip2,
+                        u32 *multi)
+{
+        return ip1->ip == ip2->ip &&
+               ip1->mark == ip2->mark;
+}
+
+static bool
+hash_ipmark4_data_list(struct sk_buff *skb,
+                       const struct hash_ipmark4_elem *data)
+{
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) ||
+            nla_put_net32(skb, IPSET_ATTR_MARK, htonl(data->mark)))
+                goto nla_put_failure;
+        return 0;
+
+nla_put_failure:
+        return 1;
+}
+
+static inline void
+hash_ipmark4_data_next(struct hash_ipmark4_elem *next,
+                       const struct hash_ipmark4_elem *d)
+{
+        next->ip = d->ip;
+}
+
+#define MTYPE           hash_ipmark4
+#define PF              4
+#define HOST_MASK       32
+#define HKEY_DATALEN    sizeof(struct hash_ipmark4_elem)
+#include "ip_set_hash_gen.h"
+
+static int
+hash_ipmark4_kadt(struct ip_set *set, const struct sk_buff *skb,
+                  const struct xt_action_param *par,
+                  enum ipset_adt adt, struct ip_set_adt_opt *opt)
+{
+        const struct hash_ipmark *h = set->data;
+        ipset_adtfn adtfn = set->variant->adt[adt];
+        struct hash_ipmark4_elem e = { };
+        struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
+
+        e.mark = skb->mark;
+        e.mark &= h->markmask;
+
+        ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip);
+        return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
+}
+
+static int
+hash_ipmark4_uadt(struct ip_set *set, struct nlattr *tb[],
+                  enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
+{
+        const struct hash_ipmark *h = set->data;
+        ipset_adtfn adtfn = set->variant->adt[adt];
+        struct hash_ipmark4_elem e = { };
+        struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
+        u32 ip, ip_to = 0;
+        int ret;
+
+        if (unlikely(!tb[IPSET_ATTR_IP] ||
+                     !ip_set_attr_netorder(tb, IPSET_ATTR_MARK) ||
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) ||
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES)))
+                return -IPSET_ERR_PROTOCOL;
+
+        if (tb[IPSET_ATTR_LINENO])
+                *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
+
+        ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP], &e.ip) ||
+              ip_set_get_extensions(set, tb, &ext);
+        if (ret)
+                return ret;
+
+        e.mark = ntohl(nla_get_u32(tb[IPSET_ATTR_MARK]));
+        e.mark &= h->markmask;
+
+        if (adt == IPSET_TEST ||
+            !(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_CIDR])) {
+                ret = adtfn(set, &e, &ext, &ext, flags);
+                return ip_set_eexist(ret, flags) ? 0 : ret;
+        }
+
+        ip_to = ip = ntohl(e.ip);
+        if (tb[IPSET_ATTR_IP_TO]) {
+                ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
+                if (ret)
+                        return ret;
+                if (ip > ip_to)
+                        swap(ip, ip_to);
+        } else if (tb[IPSET_ATTR_CIDR]) {
+                u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+
+                if (!cidr || cidr > 32)
+                        return -IPSET_ERR_INVALID_CIDR;
+                ip_set_mask_from_to(ip, ip_to, cidr);
+        }
+
+        if (retried)
+                ip = ntohl(h->next.ip);
+        for (; !before(ip_to, ip); ip++) {
+                e.ip = htonl(ip);
+                ret = adtfn(set, &e, &ext, &ext, flags);
+
+                if (ret && !ip_set_eexist(ret, flags))
+                        return ret;
+                else
+                        ret = 0;
+        }
+        return ret;
+}
+
+/* IPv6 variant */
+
+struct hash_ipmark6_elem {
+        union nf_inet_addr ip;
+        __u32 mark;
+};
+
+/* Common functions */
+
+static inline bool
+hash_ipmark6_data_equal(const struct hash_ipmark6_elem *ip1,
+                        const struct hash_ipmark6_elem *ip2,
+                        u32 *multi)
+{
+        return ipv6_addr_equal(&ip1->ip.in6, &ip2->ip.in6) &&
+               ip1->mark == ip2->mark;
+}
+
+static bool
+hash_ipmark6_data_list(struct sk_buff *skb,
+                       const struct hash_ipmark6_elem *data)
+{
+        if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip.in6) ||
+            nla_put_net32(skb, IPSET_ATTR_MARK, htonl(data->mark)))
+                goto nla_put_failure;
+        return 0;
+
+nla_put_failure:
+        return 1;
+}
+
+static inline void
+hash_ipmark6_data_next(struct hash_ipmark4_elem *next,
+                       const struct hash_ipmark6_elem *d)
+{
+}
+
+#undef MTYPE
+#undef PF
+#undef HOST_MASK
+#undef HKEY_DATALEN
+
+#define MTYPE           hash_ipmark6
+#define PF              6
+#define HOST_MASK       128
+#define HKEY_DATALEN    sizeof(struct hash_ipmark6_elem)
+#define IP_SET_EMIT_CREATE
+#include "ip_set_hash_gen.h"
+
+
+static int
+hash_ipmark6_kadt(struct ip_set *set, const struct sk_buff *skb,
+                  const struct xt_action_param *par,
+                  enum ipset_adt adt, struct ip_set_adt_opt *opt)
+{
+        const struct hash_ipmark *h = set->data;
+        ipset_adtfn adtfn = set->variant->adt[adt];
+        struct hash_ipmark6_elem e = { };
+        struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
+
+        e.mark = skb->mark;
+        e.mark &= h->markmask;
+
+        ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip.in6);
+        return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
+}
+
+static int
+hash_ipmark6_uadt(struct ip_set *set, struct nlattr *tb[],
+                  enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
+{
+        const struct hash_ipmark *h = set->data;
+        ipset_adtfn adtfn = set->variant->adt[adt];
+        struct hash_ipmark6_elem e = { };
+        struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
+        int ret;
+
+        if (unlikely(!tb[IPSET_ATTR_IP] ||
+                     !ip_set_attr_netorder(tb, IPSET_ATTR_MARK) ||
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) ||
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES) ||
+                     tb[IPSET_ATTR_IP_TO] ||
+                     tb[IPSET_ATTR_CIDR]))
+                return -IPSET_ERR_PROTOCOL;
+
+        if (tb[IPSET_ATTR_LINENO])
+                *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
+
+        ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip) ||
+              ip_set_get_extensions(set, tb, &ext);
+        if (ret)
+                return ret;
+
+        e.mark = ntohl(nla_get_u32(tb[IPSET_ATTR_MARK]));
+        e.mark &= h->markmask;
+
+        if (adt == IPSET_TEST) {
+                ret = adtfn(set, &e, &ext, &ext, flags);
+                return ip_set_eexist(ret, flags) ? 0 : ret;
+        }
+
+        ret = adtfn(set, &e, &ext, &ext, flags);
+        if (ret && !ip_set_eexist(ret, flags))
+                return ret;
+        else
+                ret = 0;
+
+        return ret;
+}
+
+static struct ip_set_type hash_ipmark_type __read_mostly = {
+        .name           = "hash:ip,mark",
+        .protocol       = IPSET_PROTOCOL,
+        .features       = IPSET_TYPE_IP | IPSET_TYPE_MARK,
+        .dimension      = IPSET_DIM_TWO,
+        .family         = NFPROTO_UNSPEC,
+        .revision_min   = IPSET_TYPE_REV_MIN,
+        .revision_max   = IPSET_TYPE_REV_MAX,
+        .create         = hash_ipmark_create,
+        .create_policy  = {
+                [IPSET_ATTR_MARKMASK]   = { .type = NLA_U32 },
+                [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
+                [IPSET_ATTR_MAXELEM]    = { .type = NLA_U32 },
+                [IPSET_ATTR_PROBES]     = { .type = NLA_U8 },
+                [IPSET_ATTR_RESIZE]     = { .type = NLA_U8  },
+                [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
+                [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
+        },
+        .adt_policy     = {
+                [IPSET_ATTR_IP]         = { .type = NLA_NESTED },
+                [IPSET_ATTR_IP_TO]      = { .type = NLA_NESTED },
+                [IPSET_ATTR_MARK]       = { .type = NLA_U32 },
+                [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
+                [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
+                [IPSET_ATTR_LINENO]     = { .type = NLA_U32 },
+                [IPSET_ATTR_BYTES]      = { .type = NLA_U64 },
+                [IPSET_ATTR_PACKETS]    = { .type = NLA_U64 },
+                [IPSET_ATTR_COMMENT]    = { .type = NLA_NUL_STRING },
+        },
+        .me             = THIS_MODULE,
+};
+
+static int __init
+hash_ipmark_init(void)
+{
+        return ip_set_type_register(&hash_ipmark_type);
+}
+
+static void __exit
+hash_ipmark_fini(void)
+{
+        ip_set_type_unregister(&hash_ipmark_type);
+}
+
+module_init(hash_ipmark_init);
+module_exit(hash_ipmark_fini);
diff --git a/net/netfilter/ipset/ip_set_hash_ipport.c b/net/netfilter/ipset/ip_set_hash_ipport.c
index 525a595dd1fe..7597b82a8b03 100644
--- a/net/netfilter/ipset/ip_set_hash_ipport.c
+++ b/net/netfilter/ipset/ip_set_hash_ipport.c
@@ -27,7 +27,8 @@
 #define IPSET_TYPE_REV_MIN      0
 /*                              1    SCTP and UDPLITE support added */
 /*                              2    Counters support added */
-#define IPSET_TYPE_REV_MAX      3 /* Comments support added */
+/*                              3    Comments support added */
+#define IPSET_TYPE_REV_MAX      4 /* Forceadd support added */
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
diff --git a/net/netfilter/ipset/ip_set_hash_ipportip.c b/net/netfilter/ipset/ip_set_hash_ipportip.c
index f5636631466e..672655ffd573 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportip.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportip.c
@@ -27,7 +27,8 @@
 #define IPSET_TYPE_REV_MIN      0
 /*                              1    SCTP and UDPLITE support added */
 /*                              2    Counters support added */
-#define IPSET_TYPE_REV_MAX      3 /* Comments support added */
+/*                              3    Comments support added */
+#define IPSET_TYPE_REV_MAX      4 /* Forceadd support added */
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index 5d87fe8a41ff..7308d84f9277 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -29,7 +29,8 @@
 /*                              2    Range as input support for IPv4 added */
 /*                              3    nomatch flag support added */
 /*                              4    Counters support added */
-#define IPSET_TYPE_REV_MAX      5 /* Comments support added */
+/*                              5    Comments support added */
+#define IPSET_TYPE_REV_MAX      6 /* Forceadd support added */
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c
index 8295cf4f9fdc..4c7d495783a3 100644
--- a/net/netfilter/ipset/ip_set_hash_net.c
+++ b/net/netfilter/ipset/ip_set_hash_net.c
@@ -26,7 +26,8 @@
 /*                              1    Range as input support for IPv4 added */
 /*                              2    nomatch flag support added */
 /*                              3    Counters support added */
-#define IPSET_TYPE_REV_MAX      4 /* Comments support added */
+/*                              4    Comments support added */
+#define IPSET_TYPE_REV_MAX      5 /* Forceadd support added */
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index b827a0f1f351..db2606805b35 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -27,7 +27,8 @@
 /*                              1    nomatch flag support added */
 /*                              2    /0 support added */
 /*                              3    Counters support added */
-#define IPSET_TYPE_REV_MAX      4 /* Comments support added */
+/*                              4    Comments support added */
+#define IPSET_TYPE_REV_MAX      5 /* Forceadd support added */
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
diff --git a/net/netfilter/ipset/ip_set_hash_netnet.c b/net/netfilter/ipset/ip_set_hash_netnet.c
index 6226803fc490..3e99987e4bf2 100644
--- a/net/netfilter/ipset/ip_set_hash_netnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netnet.c
@@ -24,7 +24,7 @@
 #include <linux/netfilter/ipset/ip_set_hash.h>
 
 #define IPSET_TYPE_REV_MIN      0
-#define IPSET_TYPE_REV_MAX      0
+#define IPSET_TYPE_REV_MAX      1       /* Forceadd support added */
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>");
@@ -112,10 +112,10 @@ hash_netnet4_data_list(struct sk_buff *skb,
             (flags &&
              nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
                 goto nla_put_failure;
-        return 0;
+        return false;
 
 nla_put_failure:
-        return 1;
+        return true;
 }
 
 static inline void
@@ -334,10 +334,10 @@ hash_netnet6_data_list(struct sk_buff *skb,
             (flags &&
              nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
                 goto nla_put_failure;
-        return 0;
+        return false;
 
 nla_put_failure:
-        return 1;
+        return true;
 }
 
 static inline void
diff --git a/net/netfilter/ipset/ip_set_hash_netport.c b/net/netfilter/ipset/ip_set_hash_netport.c
index 7097fb0141bf..1c645fbd09c7 100644
--- a/net/netfilter/ipset/ip_set_hash_netport.c
+++ b/net/netfilter/ipset/ip_set_hash_netport.c
@@ -28,7 +28,8 @@
 /*                              2    Range as input support for IPv4 added */
 /*                              3    nomatch flag support added */
 /*                              4    Counters support added */
-#define IPSET_TYPE_REV_MAX      5 /* Comments support added */
+/*                              5    Comments support added */
+#define IPSET_TYPE_REV_MAX      6 /* Forceadd support added */
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c
index 703d1192a6a2..c0d2ba73f8b2 100644
--- a/net/netfilter/ipset/ip_set_hash_netportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netportnet.c
@@ -25,7 +25,8 @@
 #include <linux/netfilter/ipset/ip_set_hash.h>
 
 #define IPSET_TYPE_REV_MIN      0
-#define IPSET_TYPE_REV_MAX      0 /* Comments support added */
+/*                              0    Comments support added */
+#define IPSET_TYPE_REV_MAX      1 /* Forceadd support added */
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>");
diff --git a/net/netfilter/ipset/pfxlen.c b/net/netfilter/ipset/pfxlen.c
index 4f29fa97044b..04d15fdc99ee 100644
--- a/net/netfilter/ipset/pfxlen.c
+++ b/net/netfilter/ipset/pfxlen.c
@@ -7,8 +7,8 @@
 
 #define E(a, b, c, d) \
         {.ip6 = { \
-                __constant_htonl(a), __constant_htonl(b), \
-                __constant_htonl(c), __constant_htonl(d), \
+                htonl(a), htonl(b), \
+                htonl(c), htonl(d), \
         } }
 
 /*
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 35be035ee0ce..c42e83d2751c 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2177,10 +2177,10 @@ static int ip_vs_stats_percpu_show(struct seq_file *seq, void *v)
                 __u64 inbytes, outbytes;
 
                 do {
-                        start = u64_stats_fetch_begin_bh(&u->syncp);
+                        start = u64_stats_fetch_begin_irq(&u->syncp);
                         inbytes = u->ustats.inbytes;
                         outbytes = u->ustats.outbytes;
-                } while (u64_stats_fetch_retry_bh(&u->syncp, start));
+                } while (u64_stats_fetch_retry_irq(&u->syncp, start));
 
                 seq_printf(seq, "%3X %8X %8X %8X %16LX %16LX\n",
                            i, u->ustats.conns, u->ustats.inpkts,
@@ -3580,7 +3580,7 @@ out:
 }
 
 
-static const struct genl_ops ip_vs_genl_ops[] __read_mostly = {
+static const struct genl_ops ip_vs_genl_ops[] = {
         {
                 .cmd    = IPVS_CMD_NEW_SERVICE,
                 .flags  = GENL_ADMIN_PERM,
diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
index ca056a331e60..547ff33c1efd 100644
--- a/net/netfilter/ipvs/ip_vs_lblc.c
+++ b/net/netfilter/ipvs/ip_vs_lblc.c
@@ -238,7 +238,7 @@ static void ip_vs_lblc_flush(struct ip_vs_service *svc)
 
         spin_lock_bh(&svc->sched_lock);
         tbl->dead = 1;
-        for (i=0; i<IP_VS_LBLC_TAB_SIZE; i++) {
+        for (i = 0; i < IP_VS_LBLC_TAB_SIZE; i++) {
                 hlist_for_each_entry_safe(en, next, &tbl->bucket[i], list) {
                         ip_vs_lblc_del(en);
                         atomic_dec(&tbl->entries);
@@ -265,7 +265,7 @@ static inline void ip_vs_lblc_full_check(struct ip_vs_service *svc)
         unsigned long now = jiffies;
         int i, j;
 
-        for (i=0, j=tbl->rover; i<IP_VS_LBLC_TAB_SIZE; i++) {
+        for (i = 0, j = tbl->rover; i < IP_VS_LBLC_TAB_SIZE; i++) {
                 j = (j + 1) & IP_VS_LBLC_TAB_MASK;
 
                 spin_lock(&svc->sched_lock);
@@ -321,7 +321,7 @@ static void ip_vs_lblc_check_expire(unsigned long data)
         if (goal > tbl->max_size/2)
                 goal = tbl->max_size/2;
 
-        for (i=0, j=tbl->rover; i<IP_VS_LBLC_TAB_SIZE; i++) {
+        for (i = 0, j = tbl->rover; i < IP_VS_LBLC_TAB_SIZE; i++) {
                 j = (j + 1) & IP_VS_LBLC_TAB_MASK;
 
                 spin_lock(&svc->sched_lock);
@@ -340,7 +340,7 @@ static void ip_vs_lblc_check_expire(unsigned long data)
         tbl->rover = j;
 
   out:
-        mod_timer(&tbl->periodic_timer, jiffies+CHECK_EXPIRE_INTERVAL);
+        mod_timer(&tbl->periodic_timer, jiffies + CHECK_EXPIRE_INTERVAL);
 }
 
 
@@ -363,7 +363,7 @@ static int ip_vs_lblc_init_svc(struct ip_vs_service *svc)
         /*
          *    Initialize the hash buckets
          */
-        for (i=0; i<IP_VS_LBLC_TAB_SIZE; i++) {
+        for (i = 0; i < IP_VS_LBLC_TAB_SIZE; i++) {
                 INIT_HLIST_HEAD(&tbl->bucket[i]);
         }
         tbl->max_size = IP_VS_LBLC_TAB_SIZE*16;
@@ -536,8 +536,7 @@ out:
 /*
  *      IPVS LBLC Scheduler structure
  */
-static struct ip_vs_scheduler ip_vs_lblc_scheduler =
-{
+static struct ip_vs_scheduler ip_vs_lblc_scheduler = {
         .name =                 "lblc",
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 356bef519fe5..75421f2ba8be 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -60,8 +60,59 @@ int (*nfnetlink_parse_nat_setup_hook)(struct nf_conn *ct,
                                       const struct nlattr *attr) __read_mostly;
 EXPORT_SYMBOL_GPL(nfnetlink_parse_nat_setup_hook);
 
-DEFINE_SPINLOCK(nf_conntrack_lock);
-EXPORT_SYMBOL_GPL(nf_conntrack_lock);
+__cacheline_aligned_in_smp spinlock_t nf_conntrack_locks[CONNTRACK_LOCKS];
+EXPORT_SYMBOL_GPL(nf_conntrack_locks);
+
+__cacheline_aligned_in_smp DEFINE_SPINLOCK(nf_conntrack_expect_lock);
+EXPORT_SYMBOL_GPL(nf_conntrack_expect_lock);
+
+static void nf_conntrack_double_unlock(unsigned int h1, unsigned int h2)
+{
+        h1 %= CONNTRACK_LOCKS;
+        h2 %= CONNTRACK_LOCKS;
+        spin_unlock(&nf_conntrack_locks[h1]);
+        if (h1 != h2)
+                spin_unlock(&nf_conntrack_locks[h2]);
+}
+
+/* return true if we need to recompute hashes (in case hash table was resized) */
+static bool nf_conntrack_double_lock(struct net *net, unsigned int h1,
+                                     unsigned int h2, unsigned int sequence)
+{
+        h1 %= CONNTRACK_LOCKS;
+        h2 %= CONNTRACK_LOCKS;
+        if (h1 <= h2) {
+                spin_lock(&nf_conntrack_locks[h1]);
+                if (h1 != h2)
+                        spin_lock_nested(&nf_conntrack_locks[h2],
+                                         SINGLE_DEPTH_NESTING);
+        } else {
+                spin_lock(&nf_conntrack_locks[h2]);
+                spin_lock_nested(&nf_conntrack_locks[h1],
+                                 SINGLE_DEPTH_NESTING);
+        }
+        if (read_seqcount_retry(&net->ct.generation, sequence)) {
+                nf_conntrack_double_unlock(h1, h2);
+                return true;
+        }
+        return false;
+}
+
+static void nf_conntrack_all_lock(void)
+{
+        int i;
+
+        for (i = 0; i < CONNTRACK_LOCKS; i++)
+                spin_lock_nested(&nf_conntrack_locks[i], i);
+}
+
+static void nf_conntrack_all_unlock(void)
+{
+        int i;
+
+        for (i = 0; i < CONNTRACK_LOCKS; i++)
+                spin_unlock(&nf_conntrack_locks[i]);
+}
 
 unsigned int nf_conntrack_htable_size __read_mostly;
 EXPORT_SYMBOL_GPL(nf_conntrack_htable_size);
@@ -192,6 +243,50 @@ clean_from_lists(struct nf_conn *ct)
         nf_ct_remove_expectations(ct);
 }
 
+/* must be called with local_bh_disable */
+static void nf_ct_add_to_dying_list(struct nf_conn *ct)
+{
+        struct ct_pcpu *pcpu;
+
+        /* add this conntrack to the (per cpu) dying list */
+        ct->cpu = smp_processor_id();
+        pcpu = per_cpu_ptr(nf_ct_net(ct)->ct.pcpu_lists, ct->cpu);
+
+        spin_lock(&pcpu->lock);
+        hlist_nulls_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
+                             &pcpu->dying);
+        spin_unlock(&pcpu->lock);
+}
+
+/* must be called with local_bh_disable */
+static void nf_ct_add_to_unconfirmed_list(struct nf_conn *ct)
+{
+        struct ct_pcpu *pcpu;
+
+        /* add this conntrack to the (per cpu) unconfirmed list */
+        ct->cpu = smp_processor_id();
+        pcpu = per_cpu_ptr(nf_ct_net(ct)->ct.pcpu_lists, ct->cpu);
+
+        spin_lock(&pcpu->lock);
+        hlist_nulls_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
+                             &pcpu->unconfirmed);
+        spin_unlock(&pcpu->lock);
+}
+
+/* must be called with local_bh_disable */
+static void nf_ct_del_from_dying_or_unconfirmed_list(struct nf_conn *ct)
+{
+        struct ct_pcpu *pcpu;
+
+        /* We overload first tuple to link into unconfirmed or dying list.*/
+        pcpu = per_cpu_ptr(nf_ct_net(ct)->ct.pcpu_lists, ct->cpu);
+
+        spin_lock(&pcpu->lock);
+        BUG_ON(hlist_nulls_unhashed(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode));
+        hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode);
+        spin_unlock(&pcpu->lock);
+}
+
 static void
 destroy_conntrack(struct nf_conntrack *nfct)
 {
@@ -203,9 +298,6 @@ destroy_conntrack(struct nf_conntrack *nfct)
         NF_CT_ASSERT(atomic_read(&nfct->use) == 0);
         NF_CT_ASSERT(!timer_pending(&ct->timeout));
 
-        /* To make sure we don't get any weird locking issues here:
-         * destroy_conntrack() MUST NOT be called with a write lock
-         * to nf_conntrack_lock!!! -HW */
         rcu_read_lock();
         l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
         if (l4proto && l4proto->destroy)
@@ -213,19 +305,18 @@ destroy_conntrack(struct nf_conntrack *nfct)
 
         rcu_read_unlock();
 
-        spin_lock_bh(&nf_conntrack_lock);
+        local_bh_disable();
         /* Expectations will have been removed in clean_from_lists,
          * except TFTP can create an expectation on the first packet,
          * before connection is in the list, so we need to clean here,
-         * too. */
+         * too.
+         */
         nf_ct_remove_expectations(ct);
 
-        /* We overload first tuple to link into unconfirmed or dying list.*/
-        BUG_ON(hlist_nulls_unhashed(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode));
-        hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode);
+        nf_ct_del_from_dying_or_unconfirmed_list(ct);
 
         NF_CT_STAT_INC(net, delete);
-        spin_unlock_bh(&nf_conntrack_lock);
+        local_bh_enable();
 
         if (ct->master)
                 nf_ct_put(ct->master);
@@ -237,17 +328,28 @@ destroy_conntrack(struct nf_conntrack *nfct)
 static void nf_ct_delete_from_lists(struct nf_conn *ct)
 {
         struct net *net = nf_ct_net(ct);
+        unsigned int hash, reply_hash;
+        u16 zone = nf_ct_zone(ct);
+        unsigned int sequence;
 
         nf_ct_helper_destroy(ct);
-        spin_lock_bh(&nf_conntrack_lock);
-        /* Inside lock so preempt is disabled on module removal path.
-         * Otherwise we can get spurious warnings. */
-        NF_CT_STAT_INC(net, delete_list);
+
+        local_bh_disable();
+        do {
+                sequence = read_seqcount_begin(&net->ct.generation);
+                hash = hash_conntrack(net, zone,
+                                      &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+                reply_hash = hash_conntrack(net, zone,
+                                           &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+        } while (nf_conntrack_double_lock(net, hash, reply_hash, sequence));
+
         clean_from_lists(ct);
-        /* add this conntrack to the dying list */
-        hlist_nulls_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
-                             &net->ct.dying);
-        spin_unlock_bh(&nf_conntrack_lock);
+        nf_conntrack_double_unlock(hash, reply_hash);
+
+        nf_ct_add_to_dying_list(ct);
+
+        NF_CT_STAT_INC(net, delete_list);
+        local_bh_enable();
 }
 
 static void death_by_event(unsigned long ul_conntrack)
@@ -331,8 +433,6 @@ nf_ct_key_equal(struct nf_conntrack_tuple_hash *h,
  * Warning :
  * - Caller must take a reference on returned object
  *   and recheck nf_ct_tuple_equal(tuple, &h->tuple)
- * OR
- * - Caller must lock nf_conntrack_lock before calling this function
  */
 static struct nf_conntrack_tuple_hash *
 ____nf_conntrack_find(struct net *net, u16 zone,
@@ -408,32 +508,36 @@ EXPORT_SYMBOL_GPL(nf_conntrack_find_get);
 
 static void __nf_conntrack_hash_insert(struct nf_conn *ct,
                                        unsigned int hash,
-                                       unsigned int repl_hash)
+                                       unsigned int reply_hash)
 {
         struct net *net = nf_ct_net(ct);
 
         hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
                            &net->ct.hash[hash]);
         hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode,
-                           &net->ct.hash[repl_hash]);
+                           &net->ct.hash[reply_hash]);
 }
 
 int
 nf_conntrack_hash_check_insert(struct nf_conn *ct)
 {
         struct net *net = nf_ct_net(ct);
-        unsigned int hash, repl_hash;
+        unsigned int hash, reply_hash;
         struct nf_conntrack_tuple_hash *h;
         struct hlist_nulls_node *n;
         u16 zone;
+        unsigned int sequence;
 
         zone = nf_ct_zone(ct);
-        hash = hash_conntrack(net, zone,
-                              &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
-        repl_hash = hash_conntrack(net, zone,
-                                   &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 
-        spin_lock_bh(&nf_conntrack_lock);
+        local_bh_disable();
+        do {
+                sequence = read_seqcount_begin(&net->ct.generation);
+                hash = hash_conntrack(net, zone,
+                                      &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+                reply_hash = hash_conntrack(net, zone,
+                                           &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+        } while (nf_conntrack_double_lock(net, hash, reply_hash, sequence));
 
         /* See if there's one in the list already, including reverse */
         hlist_nulls_for_each_entry(h, n, &net->ct.hash[hash], hnnode)
@@ -441,7 +545,7 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
                                       &h->tuple) &&
                     zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
                         goto out;
-        hlist_nulls_for_each_entry(h, n, &net->ct.hash[repl_hash], hnnode)
+        hlist_nulls_for_each_entry(h, n, &net->ct.hash[reply_hash], hnnode)
                 if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
                                       &h->tuple) &&
                     zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
@@ -451,15 +555,16 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
         smp_wmb();
         /* The caller holds a reference to this object */
         atomic_set(&ct->ct_general.use, 2);
-        __nf_conntrack_hash_insert(ct, hash, repl_hash);
+        __nf_conntrack_hash_insert(ct, hash, reply_hash);
+        nf_conntrack_double_unlock(hash, reply_hash);
         NF_CT_STAT_INC(net, insert);
-        spin_unlock_bh(&nf_conntrack_lock);
-
+        local_bh_enable();
         return 0;
 
 out:
+        nf_conntrack_double_unlock(hash, reply_hash);
         NF_CT_STAT_INC(net, insert_failed);
-        spin_unlock_bh(&nf_conntrack_lock);
+        local_bh_enable();
         return -EEXIST;
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
@@ -467,15 +572,22 @@ EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
 /* deletion from this larval template list happens via nf_ct_put() */
 void nf_conntrack_tmpl_insert(struct net *net, struct nf_conn *tmpl)
 {
+        struct ct_pcpu *pcpu;
+
         __set_bit(IPS_TEMPLATE_BIT, &tmpl->status);
         __set_bit(IPS_CONFIRMED_BIT, &tmpl->status);
         nf_conntrack_get(&tmpl->ct_general);
 
-        spin_lock_bh(&nf_conntrack_lock);
+        /* add this conntrack to the (per cpu) tmpl list */
+        local_bh_disable();
+        tmpl->cpu = smp_processor_id();
+        pcpu = per_cpu_ptr(nf_ct_net(tmpl)->ct.pcpu_lists, tmpl->cpu);
+
+        spin_lock(&pcpu->lock);
         /* Overload tuple linked list to put us in template list. */
         hlist_nulls_add_head_rcu(&tmpl->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
-                                 &net->ct.tmpl);
-        spin_unlock_bh(&nf_conntrack_lock);
+                                 &pcpu->tmpl);
+        spin_unlock_bh(&pcpu->lock);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_tmpl_insert);
 
@@ -483,7 +595,7 @@ EXPORT_SYMBOL_GPL(nf_conntrack_tmpl_insert);
 int
 __nf_conntrack_confirm(struct sk_buff *skb)
 {
-        unsigned int hash, repl_hash;
+        unsigned int hash, reply_hash;
         struct nf_conntrack_tuple_hash *h;
         struct nf_conn *ct;
         struct nf_conn_help *help;
@@ -492,6 +604,7 @@ __nf_conntrack_confirm(struct sk_buff *skb)
         enum ip_conntrack_info ctinfo;
         struct net *net;
         u16 zone;
+        unsigned int sequence;
 
         ct = nf_ct_get(skb, &ctinfo);
         net = nf_ct_net(ct);
@@ -504,31 +617,37 @@ __nf_conntrack_confirm(struct sk_buff *skb)
                 return NF_ACCEPT;
 
         zone = nf_ct_zone(ct);
-        /* reuse the hash saved before */
-        hash = *(unsigned long *)&ct->tuplehash[IP_CT_DIR_REPLY].hnnode.pprev;
-        hash = hash_bucket(hash, net);
-        repl_hash = hash_conntrack(net, zone,
-                                   &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+        local_bh_disable();
+
+        do {
+                sequence = read_seqcount_begin(&net->ct.generation);
+                /* reuse the hash saved before */
+                hash = *(unsigned long *)&ct->tuplehash[IP_CT_DIR_REPLY].hnnode.pprev;
+                hash = hash_bucket(hash, net);
+                reply_hash = hash_conntrack(net, zone,
+                                           &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+
+        } while (nf_conntrack_double_lock(net, hash, reply_hash, sequence));
 
         /* We're not in hash table, and we refuse to set up related
-           connections for unconfirmed conns.  But packet copies and
-           REJECT will give spurious warnings here. */
+         * connections for unconfirmed conns.  But packet copies and
+         * REJECT will give spurious warnings here.
+         */
         /* NF_CT_ASSERT(atomic_read(&ct->ct_general.use) == 1); */
 
         /* No external references means no one else could have
-           confirmed us. */
+         * confirmed us.
+         */
         NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
         pr_debug("Confirming conntrack %p\n", ct);
-
-        spin_lock_bh(&nf_conntrack_lock);
-
         /* We have to check the DYING flag inside the lock to prevent
            a race against nf_ct_get_next_corpse() possibly called from
            user context, else we insert an already 'dead' hash, blocking
            further use of that particular connection -JM */
 
         if (unlikely(nf_ct_is_dying(ct))) {
-                spin_unlock_bh(&nf_conntrack_lock);
+                nf_conntrack_double_unlock(hash, reply_hash);
+                local_bh_enable();
                 return NF_ACCEPT;
         }
 
@@ -540,14 +659,13 @@ __nf_conntrack_confirm(struct sk_buff *skb)
                                       &h->tuple) &&
                     zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
                         goto out;
-        hlist_nulls_for_each_entry(h, n, &net->ct.hash[repl_hash], hnnode)
+        hlist_nulls_for_each_entry(h, n, &net->ct.hash[reply_hash], hnnode)
                 if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
                                       &h->tuple) &&
                     zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
                         goto out;
 
-        /* Remove from unconfirmed list */
-        hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode);
+        nf_ct_del_from_dying_or_unconfirmed_list(ct);
 
         /* Timer relative to confirmation time, not original
            setting time, otherwise we'd get timer wrap in
@@ -570,9 +688,10 @@ __nf_conntrack_confirm(struct sk_buff *skb)
          * guarantee that no other CPU can find the conntrack before the above
          * stores are visible.
          */
-        __nf_conntrack_hash_insert(ct, hash, repl_hash);
+        __nf_conntrack_hash_insert(ct, hash, reply_hash);
+        nf_conntrack_double_unlock(hash, reply_hash);
         NF_CT_STAT_INC(net, insert);
-        spin_unlock_bh(&nf_conntrack_lock);
+        local_bh_enable();
 
         help = nfct_help(ct);
         if (help && help->helper)
@@ -583,8 +702,9 @@ __nf_conntrack_confirm(struct sk_buff *skb)
         return NF_ACCEPT;
 
 out:
+        nf_conntrack_double_unlock(hash, reply_hash);
         NF_CT_STAT_INC(net, insert_failed);
-        spin_unlock_bh(&nf_conntrack_lock);
+        local_bh_enable();
         return NF_DROP;
 }
 EXPORT_SYMBOL_GPL(__nf_conntrack_confirm);
@@ -627,39 +747,48 @@ EXPORT_SYMBOL_GPL(nf_conntrack_tuple_taken);
 
 /* There's a small race here where we may free a just-assured
    connection.  Too bad: we're in trouble anyway. */
-static noinline int early_drop(struct net *net, unsigned int hash)
+static noinline int early_drop(struct net *net, unsigned int _hash)
 {
         /* Use oldest entry, which is roughly LRU */
         struct nf_conntrack_tuple_hash *h;
         struct nf_conn *ct = NULL, *tmp;
         struct hlist_nulls_node *n;
-        unsigned int i, cnt = 0;
+        unsigned int i = 0, cnt = 0;
         int dropped = 0;
+        unsigned int hash, sequence;
+        spinlock_t *lockp;
 
-        rcu_read_lock();
-        for (i = 0; i < net->ct.htable_size; i++) {
+        local_bh_disable();
+restart:
+        sequence = read_seqcount_begin(&net->ct.generation);
+        hash = hash_bucket(_hash, net);
+        for (; i < net->ct.htable_size; i++) {
+                lockp = &nf_conntrack_locks[hash % CONNTRACK_LOCKS];
+                spin_lock(lockp);
+                if (read_seqcount_retry(&net->ct.generation, sequence)) {
+                        spin_unlock(lockp);
+                        goto restart;
+                }
                 hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[hash],
                                          hnnode) {
                         tmp = nf_ct_tuplehash_to_ctrack(h);
-                        if (!test_bit(IPS_ASSURED_BIT, &tmp->status))
+                        if (!test_bit(IPS_ASSURED_BIT, &tmp->status) &&
+                            !nf_ct_is_dying(tmp) &&
+                            atomic_inc_not_zero(&tmp->ct_general.use)) {
                                 ct = tmp;
+                                break;
+                        }
                         cnt++;
                 }
 
-                if (ct != NULL) {
-                        if (likely(!nf_ct_is_dying(ct) &&
-                                   atomic_inc_not_zero(&ct->ct_general.use)))
-                                break;
-                        else
-                                ct = NULL;
-                }
+                hash = (hash + 1) % net->ct.htable_size;
+                spin_unlock(lockp);
 
-                if (cnt >= NF_CT_EVICTION_RANGE)
+                if (ct || cnt >= NF_CT_EVICTION_RANGE)
                         break;
 
-                hash = (hash + 1) % net->ct.htable_size;
         }
-        rcu_read_unlock();
+        local_bh_enable();
 
         if (!ct)
                 return dropped;
@@ -708,7 +837,7 @@ __nf_conntrack_alloc(struct net *net, u16 zone,
 
         if (nf_conntrack_max &&
             unlikely(atomic_read(&net->ct.count) > nf_conntrack_max)) {
-                if (!early_drop(net, hash_bucket(hash, net))) {
+                if (!early_drop(net, hash)) {
                         atomic_dec(&net->ct.count);
                         net_warn_ratelimited("nf_conntrack: table full, dropping packet\n");
                         return ERR_PTR(-ENOMEM);
@@ -805,7 +934,7 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
         struct nf_conn_help *help;
         struct nf_conntrack_tuple repl_tuple;
         struct nf_conntrack_ecache *ecache;
-        struct nf_conntrack_expect *exp;
+        struct nf_conntrack_expect *exp = NULL;
         u16 zone = tmpl ? nf_ct_zone(tmpl) : NF_CT_DEFAULT_ZONE;
         struct nf_conn_timeout *timeout_ext;
         unsigned int *timeouts;
@@ -849,42 +978,44 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
                                  ecache ? ecache->expmask : 0,
                              GFP_ATOMIC);
 
-        spin_lock_bh(&nf_conntrack_lock);
-        exp = nf_ct_find_expectation(net, zone, tuple);
-        if (exp) {
-                pr_debug("conntrack: expectation arrives ct=%p exp=%p\n",
-                         ct, exp);
-                /* Welcome, Mr. Bond.  We've been expecting you... */
-                __set_bit(IPS_EXPECTED_BIT, &ct->status);
-                ct->master = exp->master;
-                if (exp->helper) {
-                        help = nf_ct_helper_ext_add(ct, exp->helper,
-                                                    GFP_ATOMIC);
-                        if (help)
-                                rcu_assign_pointer(help->helper, exp->helper);
-                }
+        local_bh_disable();
+        if (net->ct.expect_count) {
+                spin_lock(&nf_conntrack_expect_lock);
+                exp = nf_ct_find_expectation(net, zone, tuple);
+                if (exp) {
+                        pr_debug("conntrack: expectation arrives ct=%p exp=%p\n",
+                                 ct, exp);
+                        /* Welcome, Mr. Bond.  We've been expecting you... */
+                        __set_bit(IPS_EXPECTED_BIT, &ct->status);
+                        /* exp->master safe, refcnt bumped in nf_ct_find_expectation */
+                        ct->master = exp->master;
+                        if (exp->helper) {
+                                help = nf_ct_helper_ext_add(ct, exp->helper,
+                                                            GFP_ATOMIC);
+                                if (help)
+                                        rcu_assign_pointer(help->helper, exp->helper);
+                        }
 
 #ifdef CONFIG_NF_CONNTRACK_MARK
-                ct->mark = exp->master->mark;
+                        ct->mark = exp->master->mark;
 #endif
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
-                ct->secmark = exp->master->secmark;
+                        ct->secmark = exp->master->secmark;
 #endif
-                nf_conntrack_get(&ct->master->ct_general);
-                NF_CT_STAT_INC(net, expect_new);
-        } else {
+                        NF_CT_STAT_INC(net, expect_new);
+                }
+                spin_unlock(&nf_conntrack_expect_lock);
+        }
+        if (!exp) {
                 __nf_ct_try_assign_helper(ct, tmpl, GFP_ATOMIC);
                 NF_CT_STAT_INC(net, new);
         }
 
         /* Now it is inserted into the unconfirmed list, bump refcount */
         nf_conntrack_get(&ct->ct_general);
+        nf_ct_add_to_unconfirmed_list(ct);
 
-        /* Overload tuple linked list to put us in unconfirmed list. */
-        hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
-                       &net->ct.unconfirmed);
-
-        spin_unlock_bh(&nf_conntrack_lock);
+        local_bh_enable();
 
         if (exp) {
                 if (exp->expectfn)
@@ -1254,27 +1385,42 @@ get_next_corpse(struct net *net, int (*iter)(struct nf_conn *i, void *data),
         struct nf_conntrack_tuple_hash *h;
         struct nf_conn *ct;
         struct hlist_nulls_node *n;
+        int cpu;
+        spinlock_t *lockp;
 
-        spin_lock_bh(&nf_conntrack_lock);
         for (; *bucket < net->ct.htable_size; (*bucket)++) {
-                hlist_nulls_for_each_entry(h, n, &net->ct.hash[*bucket], hnnode) {
-                        if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
-                                continue;
+                lockp = &nf_conntrack_locks[*bucket % CONNTRACK_LOCKS];
+                local_bh_disable();
+                spin_lock(lockp);
+                if (*bucket < net->ct.htable_size) {
+                        hlist_nulls_for_each_entry(h, n, &net->ct.hash[*bucket], hnnode) {
+                                if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
+                                        continue;
+                                ct = nf_ct_tuplehash_to_ctrack(h);
+                                if (iter(ct, data))
+                                        goto found;
+                        }
+                }
+                spin_unlock(lockp);
+                local_bh_enable();
+        }
+
+        for_each_possible_cpu(cpu) {
+                struct ct_pcpu *pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
+
+                spin_lock_bh(&pcpu->lock);
+                hlist_nulls_for_each_entry(h, n, &pcpu->unconfirmed, hnnode) {
                         ct = nf_ct_tuplehash_to_ctrack(h);
                         if (iter(ct, data))
-                                goto found;
+                                set_bit(IPS_DYING_BIT, &ct->status);
                 }
+                spin_unlock_bh(&pcpu->lock);
         }
-        hlist_nulls_for_each_entry(h, n, &net->ct.unconfirmed, hnnode) {
-                ct = nf_ct_tuplehash_to_ctrack(h);
-                if (iter(ct, data))
-                        set_bit(IPS_DYING_BIT, &ct->status);
-        }
-        spin_unlock_bh(&nf_conntrack_lock);
         return NULL;
 found:
         atomic_inc(&ct->ct_general.use);
-        spin_unlock_bh(&nf_conntrack_lock);
+        spin_unlock(lockp);
+        local_bh_enable();
         return ct;
 }
 
@@ -1323,14 +1469,19 @@ static void nf_ct_release_dying_list(struct net *net)
         struct nf_conntrack_tuple_hash *h;
         struct nf_conn *ct;
         struct hlist_nulls_node *n;
+        int cpu;
 
-        spin_lock_bh(&nf_conntrack_lock);
-        hlist_nulls_for_each_entry(h, n, &net->ct.dying, hnnode) {
-                ct = nf_ct_tuplehash_to_ctrack(h);
-                /* never fails to remove them, no listeners at this point */
-                nf_ct_kill(ct);
+        for_each_possible_cpu(cpu) {
+                struct ct_pcpu *pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
+
+                spin_lock_bh(&pcpu->lock);
+                hlist_nulls_for_each_entry(h, n, &pcpu->dying, hnnode) {
+                        ct = nf_ct_tuplehash_to_ctrack(h);
+                        /* never fails to remove them, no listeners at this point */
+                        nf_ct_kill(ct);
+                }
+                spin_unlock_bh(&pcpu->lock);
         }
-        spin_unlock_bh(&nf_conntrack_lock);
 }
 
 static int untrack_refs(void)
@@ -1417,6 +1568,7 @@ i_see_dead_people:
                 kmem_cache_destroy(net->ct.nf_conntrack_cachep);
                 kfree(net->ct.slabname);
                 free_percpu(net->ct.stat);
+                free_percpu(net->ct.pcpu_lists);
         }
 }
 
@@ -1469,12 +1621,16 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
         if (!hash)
                 return -ENOMEM;
 
+        local_bh_disable();
+        nf_conntrack_all_lock();
+        write_seqcount_begin(&init_net.ct.generation);
+
         /* Lookups in the old hash might happen in parallel, which means we
          * might get false negatives during connection lookup. New connections
          * created because of a false negative won't make it into the hash
-         * though since that required taking the lock.
+         * though since that required taking the locks.
          */
-        spin_lock_bh(&nf_conntrack_lock);
+
         for (i = 0; i < init_net.ct.htable_size; i++) {
                 while (!hlist_nulls_empty(&init_net.ct.hash[i])) {
                         h = hlist_nulls_entry(init_net.ct.hash[i].first,
@@ -1491,7 +1647,10 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
 
         init_net.ct.htable_size = nf_conntrack_htable_size = hashsize;
         init_net.ct.hash = hash;
-        spin_unlock_bh(&nf_conntrack_lock);
+
+        write_seqcount_end(&init_net.ct.generation);
+        nf_conntrack_all_unlock();
+        local_bh_enable();
 
         nf_ct_free_hashtable(old_hash, old_size);
         return 0;
@@ -1513,7 +1672,10 @@ EXPORT_SYMBOL_GPL(nf_ct_untracked_status_or);
 int nf_conntrack_init_start(void)
 {
         int max_factor = 8;
-        int ret, cpu;
+        int i, ret, cpu;
+
+        for (i = 0; i < CONNTRACK_LOCKS; i++)
+                spin_lock_init(&nf_conntrack_locks[i]);
 
         /* Idea from tcp.c: use 1/16384 of memory.  On i386: 32MB
          * machine has 512 buckets. >= 1GB machines have 16384 buckets. */
@@ -1629,37 +1791,44 @@ void nf_conntrack_init_end(void)
 
 int nf_conntrack_init_net(struct net *net)
 {
-        int ret;
+        int ret = -ENOMEM;
+        int cpu;
 
         atomic_set(&net->ct.count, 0);
-        INIT_HLIST_NULLS_HEAD(&net->ct.unconfirmed, UNCONFIRMED_NULLS_VAL);
-        INIT_HLIST_NULLS_HEAD(&net->ct.dying, DYING_NULLS_VAL);
-        INIT_HLIST_NULLS_HEAD(&net->ct.tmpl, TEMPLATE_NULLS_VAL);
-        net->ct.stat = alloc_percpu(struct ip_conntrack_stat);
-        if (!net->ct.stat) {
-                ret = -ENOMEM;
+        seqcount_init(&net->ct.generation);
+
+        net->ct.pcpu_lists = alloc_percpu(struct ct_pcpu);
+        if (!net->ct.pcpu_lists)
                 goto err_stat;
+
+        for_each_possible_cpu(cpu) {
+                struct ct_pcpu *pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
+
+                spin_lock_init(&pcpu->lock);
+                INIT_HLIST_NULLS_HEAD(&pcpu->unconfirmed, UNCONFIRMED_NULLS_VAL);
+                INIT_HLIST_NULLS_HEAD(&pcpu->dying, DYING_NULLS_VAL);
+                INIT_HLIST_NULLS_HEAD(&pcpu->tmpl, TEMPLATE_NULLS_VAL);
         }
 
+        net->ct.stat = alloc_percpu(struct ip_conntrack_stat);
+        if (!net->ct.stat)
+                goto err_pcpu_lists;
+
         net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net);
-        if (!net->ct.slabname) {
-                ret = -ENOMEM;
+        if (!net->ct.slabname)
                 goto err_slabname;
-        }
 
         net->ct.nf_conntrack_cachep = kmem_cache_create(net->ct.slabname,
                                                         sizeof(struct nf_conn), 0,
                                                         SLAB_DESTROY_BY_RCU, NULL);
         if (!net->ct.nf_conntrack_cachep) {
                 printk(KERN_ERR "Unable to create nf_conn slab cache\n");
-                ret = -ENOMEM;
                 goto err_cache;
         }
 
         net->ct.htable_size = nf_conntrack_htable_size;
         net->ct.hash = nf_ct_alloc_hashtable(&net->ct.htable_size, 1);
         if (!net->ct.hash) {
-                ret = -ENOMEM;
                 printk(KERN_ERR "Unable to create nf_conntrack_hash\n");
                 goto err_hash;
         }
@@ -1701,6 +1870,8 @@ err_cache:
         kfree(net->ct.slabname);
 err_slabname:
         free_percpu(net->ct.stat);
+err_pcpu_lists:
+        free_percpu(net->ct.pcpu_lists);
 err_stat:
         return ret;
 }
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 4fd1ca94fd4a..f87e8f68ad45 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -66,9 +66,9 @@ static void nf_ct_expectation_timed_out(unsigned long ul_expect)
 {
         struct nf_conntrack_expect *exp = (void *)ul_expect;
 
-        spin_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_expect_lock);
         nf_ct_unlink_expect(exp);
-        spin_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_expect_lock);
         nf_ct_expect_put(exp);
 }
 
@@ -155,6 +155,18 @@ nf_ct_find_expectation(struct net *net, u16 zone,
         if (!nf_ct_is_confirmed(exp->master))
                 return NULL;
 
+        /* Avoid race with other CPUs, that for exp->master ct, is
+         * about to invoke ->destroy(), or nf_ct_delete() via timeout
+         * or early_drop().
+         *
+         * The atomic_inc_not_zero() check tells:  If that fails, we
+         * know that the ct is being destroyed.  If it succeeds, we
+         * can be sure the ct cannot disappear underneath.
+         */
+        if (unlikely(nf_ct_is_dying(exp->master) ||
+                     !atomic_inc_not_zero(&exp->master->ct_general.use)))
+                return NULL;
+
         if (exp->flags & NF_CT_EXPECT_PERMANENT) {
                 atomic_inc(&exp->use);
                 return exp;
@@ -162,6 +174,8 @@ nf_ct_find_expectation(struct net *net, u16 zone,
                 nf_ct_unlink_expect(exp);
                 return exp;
         }
+        /* Undo exp->master refcnt increase, if del_timer() failed */
+        nf_ct_put(exp->master);
 
         return NULL;
 }
@@ -177,12 +191,14 @@ void nf_ct_remove_expectations(struct nf_conn *ct)
         if (!help)
                 return;
 
+        spin_lock_bh(&nf_conntrack_expect_lock);
         hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {
                 if (del_timer(&exp->timeout)) {
                         nf_ct_unlink_expect(exp);
                         nf_ct_expect_put(exp);
                 }
         }
+        spin_unlock_bh(&nf_conntrack_expect_lock);
 }
 EXPORT_SYMBOL_GPL(nf_ct_remove_expectations);
 
@@ -217,12 +233,12 @@ static inline int expect_matches(const struct nf_conntrack_expect *a,
 /* Generally a bad idea to call this: could have matched already. */
 void nf_ct_unexpect_related(struct nf_conntrack_expect *exp)
 {
-        spin_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_expect_lock);
         if (del_timer(&exp->timeout)) {
                 nf_ct_unlink_expect(exp);
                 nf_ct_expect_put(exp);
         }
-        spin_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_expect_lock);
 }
 EXPORT_SYMBOL_GPL(nf_ct_unexpect_related);
 
@@ -335,7 +351,7 @@ static int nf_ct_expect_insert(struct nf_conntrack_expect *exp)
         setup_timer(&exp->timeout, nf_ct_expectation_timed_out,
                     (unsigned long)exp);
         helper = rcu_dereference_protected(master_help->helper,
-                                           lockdep_is_held(&nf_conntrack_lock));
+                                           lockdep_is_held(&nf_conntrack_expect_lock));
         if (helper) {
                 exp->timeout.expires = jiffies +
                         helper->expect_policy[exp->class].timeout * HZ;
@@ -395,7 +411,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
         }
         /* Will be over limit? */
         helper = rcu_dereference_protected(master_help->helper,
-                                           lockdep_is_held(&nf_conntrack_lock));
+                                           lockdep_is_held(&nf_conntrack_expect_lock));
         if (helper) {
                 p = &helper->expect_policy[expect->class];
                 if (p->max_expected &&
@@ -417,12 +433,12 @@ out:
         return ret;
 }
 
-int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, 
+int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,
                                 u32 portid, int report)
 {
         int ret;
 
-        spin_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_expect_lock);
         ret = __nf_ct_expect_check(expect);
         if (ret <= 0)
                 goto out;
@@ -430,11 +446,11 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,
         ret = nf_ct_expect_insert(expect);
         if (ret < 0)
                 goto out;
-        spin_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_expect_lock);
         nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report);
         return ret;
 out:
-        spin_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_expect_lock);
         return ret;
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_related_report);
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 70866d192efc..3a3a60b126e0 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -1476,7 +1476,7 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
                 nf_ct_refresh(ct, skb, info->timeout * HZ);
 
                 /* Set expect timeout */
-                spin_lock_bh(&nf_conntrack_lock);
+                spin_lock_bh(&nf_conntrack_expect_lock);
                 exp = find_expect(ct, &ct->tuplehash[dir].tuple.dst.u3,
                                   info->sig_port[!dir]);
                 if (exp) {
@@ -1486,7 +1486,7 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
                         nf_ct_dump_tuple(&exp->tuple);
                         set_expect_timeout(exp, info->timeout);
                 }
-                spin_unlock_bh(&nf_conntrack_lock);
+                spin_unlock_bh(&nf_conntrack_expect_lock);
         }
 
         return 0;
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 974a2a4adefa..5b3eae7d4c9a 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -250,16 +250,14 @@ out:
 }
 EXPORT_SYMBOL_GPL(__nf_ct_try_assign_helper);
 
+/* appropiate ct lock protecting must be taken by caller */
 static inline int unhelp(struct nf_conntrack_tuple_hash *i,
                          const struct nf_conntrack_helper *me)
 {
         struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(i);
         struct nf_conn_help *help = nfct_help(ct);
 
-        if (help && rcu_dereference_protected(
-                        help->helper,
-                        lockdep_is_held(&nf_conntrack_lock)
-                        ) == me) {
+        if (help && rcu_dereference_raw(help->helper) == me) {
                 nf_conntrack_event(IPCT_HELPER, ct);
                 RCU_INIT_POINTER(help->helper, NULL);
         }
@@ -284,17 +282,17 @@ static LIST_HEAD(nf_ct_helper_expectfn_list);
 
 void nf_ct_helper_expectfn_register(struct nf_ct_helper_expectfn *n)
 {
-        spin_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_expect_lock);
         list_add_rcu(&n->head, &nf_ct_helper_expectfn_list);
-        spin_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_expect_lock);
 }
 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_register);
 
 void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n)
 {
-        spin_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_expect_lock);
         list_del_rcu(&n->head);
-        spin_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_expect_lock);
 }
 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_unregister);
 
@@ -396,15 +394,17 @@ static void __nf_conntrack_helper_unregister(struct nf_conntrack_helper *me,
         const struct hlist_node *next;
         const struct hlist_nulls_node *nn;
         unsigned int i;
+        int cpu;
 
         /* Get rid of expectations */
+        spin_lock_bh(&nf_conntrack_expect_lock);
         for (i = 0; i < nf_ct_expect_hsize; i++) {
                 hlist_for_each_entry_safe(exp, next,
                                           &net->ct.expect_hash[i], hnode) {
                         struct nf_conn_help *help = nfct_help(exp->master);
                         if ((rcu_dereference_protected(
                                         help->helper,
-                                        lockdep_is_held(&nf_conntrack_lock)
+                                        lockdep_is_held(&nf_conntrack_expect_lock)
                                         ) == me || exp->helper == me) &&
                             del_timer(&exp->timeout)) {
                                 nf_ct_unlink_expect(exp);
@@ -412,14 +412,27 @@ static void __nf_conntrack_helper_unregister(struct nf_conntrack_helper *me,
                         }
                 }
         }
+        spin_unlock_bh(&nf_conntrack_expect_lock);
 
         /* Get rid of expecteds, set helpers to NULL. */
-        hlist_nulls_for_each_entry(h, nn, &net->ct.unconfirmed, hnnode)
-                unhelp(h, me);
-        for (i = 0; i < net->ct.htable_size; i++) {
-                hlist_nulls_for_each_entry(h, nn, &net->ct.hash[i], hnnode)
+        for_each_possible_cpu(cpu) {
+                struct ct_pcpu *pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
+
+                spin_lock_bh(&pcpu->lock);
+                hlist_nulls_for_each_entry(h, nn, &pcpu->unconfirmed, hnnode)
                         unhelp(h, me);
+                spin_unlock_bh(&pcpu->lock);
+        }
+        local_bh_disable();
+        for (i = 0; i < net->ct.htable_size; i++) {
+                spin_lock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
+                if (i < net->ct.htable_size) {
+                        hlist_nulls_for_each_entry(h, nn, &net->ct.hash[i], hnnode)
+                                unhelp(h, me);
+                }
+                spin_unlock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
         }
+        local_bh_enable();
 }
 
 void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
@@ -437,10 +450,8 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
         synchronize_rcu();
 
         rtnl_lock();
-        spin_lock_bh(&nf_conntrack_lock);
         for_each_net(net)
                 __nf_conntrack_helper_unregister(me, net);
-        spin_unlock_bh(&nf_conntrack_lock);
         rtnl_unlock();
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index b9f0e0374322..ccc46fa5edbc 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -764,14 +764,23 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
         u_int8_t l3proto = nfmsg->nfgen_family;
         int res;
+        spinlock_t *lockp;
+
 #ifdef CONFIG_NF_CONNTRACK_MARK
         const struct ctnetlink_dump_filter *filter = cb->data;
 #endif
 
-        spin_lock_bh(&nf_conntrack_lock);
         last = (struct nf_conn *)cb->args[1];
+
+        local_bh_disable();
         for (; cb->args[0] < net->ct.htable_size; cb->args[0]++) {
 restart:
+                lockp = &nf_conntrack_locks[cb->args[0] % CONNTRACK_LOCKS];
+                spin_lock(lockp);
+                if (cb->args[0] >= net->ct.htable_size) {
+                        spin_unlock(lockp);
+                        goto out;
+                }
                 hlist_nulls_for_each_entry(h, n, &net->ct.hash[cb->args[0]],
                                          hnnode) {
                         if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
@@ -803,16 +812,18 @@ restart:
                         if (res < 0) {
                                 nf_conntrack_get(&ct->ct_general);
                                 cb->args[1] = (unsigned long)ct;
+                                spin_unlock(lockp);
                                 goto out;
                         }
                 }
+                spin_unlock(lockp);
                 if (cb->args[1]) {
                         cb->args[1] = 0;
                         goto restart;
                 }
         }
 out:
-        spin_unlock_bh(&nf_conntrack_lock);
+        local_bh_enable();
         if (last)
                 nf_ct_put(last);
 
@@ -966,7 +977,6 @@ ctnetlink_parse_help(const struct nlattr *attr, char **helper_name,
         return 0;
 }
 
-#define __CTA_LABELS_MAX_LENGTH ((XT_CONNLABEL_MAXBIT + 1) / BITS_PER_BYTE)
 static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {
         [CTA_TUPLE_ORIG]        = { .type = NLA_NESTED },
         [CTA_TUPLE_REPLY]       = { .type = NLA_NESTED },
@@ -984,9 +994,9 @@ static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {
         [CTA_ZONE]              = { .type = NLA_U16 },
         [CTA_MARK_MASK]         = { .type = NLA_U32 },
         [CTA_LABELS]            = { .type = NLA_BINARY,
-                                    .len = __CTA_LABELS_MAX_LENGTH },
+                                    .len = NF_CT_LABELS_MAX_SIZE },
         [CTA_LABELS_MASK]       = { .type = NLA_BINARY,
-                                    .len = __CTA_LABELS_MAX_LENGTH },
+                                    .len = NF_CT_LABELS_MAX_SIZE },
 };
 
 static int
@@ -1138,50 +1148,65 @@ static int ctnetlink_done_list(struct netlink_callback *cb)
 }
 
 static int
-ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb,
-                    struct hlist_nulls_head *list)
+ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying)
 {
-        struct nf_conn *ct, *last;
+        struct nf_conn *ct, *last = NULL;
         struct nf_conntrack_tuple_hash *h;
         struct hlist_nulls_node *n;
         struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
         u_int8_t l3proto = nfmsg->nfgen_family;
         int res;
+        int cpu;
+        struct hlist_nulls_head *list;
+        struct net *net = sock_net(skb->sk);
 
         if (cb->args[2])
                 return 0;
 
-        spin_lock_bh(&nf_conntrack_lock);
-        last = (struct nf_conn *)cb->args[1];
-restart:
-        hlist_nulls_for_each_entry(h, n, list, hnnode) {
-                ct = nf_ct_tuplehash_to_ctrack(h);
-                if (l3proto && nf_ct_l3num(ct) != l3proto)
+        if (cb->args[0] == nr_cpu_ids)
+                return 0;
+
+        for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {
+                struct ct_pcpu *pcpu;
+
+                if (!cpu_possible(cpu))
                         continue;
-                if (cb->args[1]) {
-                        if (ct != last)
+
+                pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
+                spin_lock_bh(&pcpu->lock);
+                last = (struct nf_conn *)cb->args[1];
+                list = dying ? &pcpu->dying : &pcpu->unconfirmed;
+restart:
+                hlist_nulls_for_each_entry(h, n, list, hnnode) {
+                        ct = nf_ct_tuplehash_to_ctrack(h);
+                        if (l3proto && nf_ct_l3num(ct) != l3proto)
                                 continue;
-                        cb->args[1] = 0;
-                }
-                rcu_read_lock();
-                res = ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid,
-                                          cb->nlh->nlmsg_seq,
-                                          NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
-                                          ct);
-                rcu_read_unlock();
-                if (res < 0) {
-                        nf_conntrack_get(&ct->ct_general);
-                        cb->args[1] = (unsigned long)ct;
-                        goto out;
+                        if (cb->args[1]) {
+                                if (ct != last)
+                                        continue;
+                                cb->args[1] = 0;
+                        }
+                        rcu_read_lock();
+                        res = ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid,
+                                                  cb->nlh->nlmsg_seq,
+                                                  NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
+                                                  ct);
+                        rcu_read_unlock();
+                        if (res < 0) {
+                                nf_conntrack_get(&ct->ct_general);
+                                cb->args[1] = (unsigned long)ct;
+                                spin_unlock_bh(&pcpu->lock);
+                                goto out;
+                        }
                 }
+                if (cb->args[1]) {
+                        cb->args[1] = 0;
+                        goto restart;
+                } else
+                        cb->args[2] = 1;
+                spin_unlock_bh(&pcpu->lock);
         }
-        if (cb->args[1]) {
-                cb->args[1] = 0;
-                goto restart;
-        } else
-                cb->args[2] = 1;
 out:
-        spin_unlock_bh(&nf_conntrack_lock);
         if (last)
                 nf_ct_put(last);
 
@@ -1191,9 +1216,7 @@ out:
 static int
 ctnetlink_dump_dying(struct sk_buff *skb, struct netlink_callback *cb)
 {
-        struct net *net = sock_net(skb->sk);
-
-        return ctnetlink_dump_list(skb, cb, &net->ct.dying);
+        return ctnetlink_dump_list(skb, cb, true);
 }
 
 static int
@@ -1215,9 +1238,7 @@ ctnetlink_get_ct_dying(struct sock *ctnl, struct sk_buff *skb,
 static int
 ctnetlink_dump_unconfirmed(struct sk_buff *skb, struct netlink_callback *cb)
 {
-        struct net *net = sock_net(skb->sk);
-
-        return ctnetlink_dump_list(skb, cb, &net->ct.unconfirmed);
+        return ctnetlink_dump_list(skb, cb, false);
 }
 
 static int
@@ -1361,14 +1382,14 @@ ctnetlink_change_helper(struct nf_conn *ct, const struct nlattr * const cda[])
                                             nf_ct_protonum(ct));
         if (helper == NULL) {
 #ifdef CONFIG_MODULES
-                spin_unlock_bh(&nf_conntrack_lock);
+                spin_unlock_bh(&nf_conntrack_expect_lock);
 
                 if (request_module("nfct-helper-%s", helpname) < 0) {
-                        spin_lock_bh(&nf_conntrack_lock);
+                        spin_lock_bh(&nf_conntrack_expect_lock);
                         return -EOPNOTSUPP;
                 }
 
-                spin_lock_bh(&nf_conntrack_lock);
+                spin_lock_bh(&nf_conntrack_expect_lock);
                 helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
                                                     nf_ct_protonum(ct));
                 if (helper)
@@ -1804,9 +1825,9 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
         err = -EEXIST;
         ct = nf_ct_tuplehash_to_ctrack(h);
         if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {
-                spin_lock_bh(&nf_conntrack_lock);
+                spin_lock_bh(&nf_conntrack_expect_lock);
                 err = ctnetlink_change_conntrack(ct, cda);
-                spin_unlock_bh(&nf_conntrack_lock);
+                spin_unlock_bh(&nf_conntrack_expect_lock);
                 if (err == 0) {
                         nf_conntrack_eventmask_report((1 << IPCT_REPLY) |
                                                       (1 << IPCT_ASSURED) |
@@ -2135,9 +2156,9 @@ ctnetlink_nfqueue_parse(const struct nlattr *attr, struct nf_conn *ct)
         if (ret < 0)
                 return ret;
 
-        spin_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_expect_lock);
         ret = ctnetlink_nfqueue_parse_ct((const struct nlattr **)cda, ct);
-        spin_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_expect_lock);
 
         return ret;
 }
@@ -2692,13 +2713,13 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                 }
 
                 /* after list removal, usage count == 1 */
-                spin_lock_bh(&nf_conntrack_lock);
+                spin_lock_bh(&nf_conntrack_expect_lock);
                 if (del_timer(&exp->timeout)) {
                         nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid,
                                                    nlmsg_report(nlh));
                         nf_ct_expect_put(exp);
                 }
-                spin_unlock_bh(&nf_conntrack_lock);
+                spin_unlock_bh(&nf_conntrack_expect_lock);
                 /* have to put what we 'get' above.
                  * after this line usage count == 0 */
                 nf_ct_expect_put(exp);
@@ -2707,7 +2728,7 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                 struct nf_conn_help *m_help;
 
                 /* delete all expectations for this helper */
-                spin_lock_bh(&nf_conntrack_lock);
+                spin_lock_bh(&nf_conntrack_expect_lock);
                 for (i = 0; i < nf_ct_expect_hsize; i++) {
                         hlist_for_each_entry_safe(exp, next,
                                                   &net->ct.expect_hash[i],
@@ -2722,10 +2743,10 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                                 }
                         }
                 }
-                spin_unlock_bh(&nf_conntrack_lock);
+                spin_unlock_bh(&nf_conntrack_expect_lock);
         } else {
                 /* This basically means we have to flush everything*/
-                spin_lock_bh(&nf_conntrack_lock);
+                spin_lock_bh(&nf_conntrack_expect_lock);
                 for (i = 0; i < nf_ct_expect_hsize; i++) {
                         hlist_for_each_entry_safe(exp, next,
                                                   &net->ct.expect_hash[i],
@@ -2738,7 +2759,7 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                                 }
                         }
                 }
-                spin_unlock_bh(&nf_conntrack_lock);
+                spin_unlock_bh(&nf_conntrack_expect_lock);
         }
 
         return 0;
@@ -2964,11 +2985,11 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
         if (err < 0)
                 return err;
 
-        spin_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_expect_lock);
         exp = __nf_ct_expect_find(net, zone, &tuple);
 
         if (!exp) {
-                spin_unlock_bh(&nf_conntrack_lock);
+                spin_unlock_bh(&nf_conntrack_expect_lock);
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE) {
                         err = ctnetlink_create_expect(net, zone, cda,
@@ -2982,7 +3003,7 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
         err = -EEXIST;
         if (!(nlh->nlmsg_flags & NLM_F_EXCL))
                 err = ctnetlink_change_expect(exp, cda);
-        spin_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_expect_lock);
 
         return err;
 }
diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
index 7bd03decd36c..825c3e3f8305 100644
--- a/net/netfilter/nf_conntrack_pptp.c
+++ b/net/netfilter/nf_conntrack_pptp.c
@@ -605,32 +605,14 @@ static struct nf_conntrack_helper pptp __read_mostly = {
         .expect_policy          = &pptp_exp_policy,
 };
 
-static void nf_conntrack_pptp_net_exit(struct net *net)
-{
-        nf_ct_gre_keymap_flush(net);
-}
-
-static struct pernet_operations nf_conntrack_pptp_net_ops = {
-        .exit = nf_conntrack_pptp_net_exit,
-};
-
 static int __init nf_conntrack_pptp_init(void)
 {
-        int rv;
-
-        rv = nf_conntrack_helper_register(&pptp);
-        if (rv < 0)
-                return rv;
-        rv = register_pernet_subsys(&nf_conntrack_pptp_net_ops);
-        if (rv < 0)
-                nf_conntrack_helper_unregister(&pptp);
-        return rv;
+        return nf_conntrack_helper_register(&pptp);
 }
 
 static void __exit nf_conntrack_pptp_fini(void)
 {
         nf_conntrack_helper_unregister(&pptp);
-        unregister_pernet_subsys(&nf_conntrack_pptp_net_ops);
 }
 
 module_init(nf_conntrack_pptp_init);
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index 9d9c0dade602..d5665739e3b1 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -66,7 +66,7 @@ static inline struct netns_proto_gre *gre_pernet(struct net *net)
         return net_generic(net, proto_gre_net_id);
 }
 
-void nf_ct_gre_keymap_flush(struct net *net)
+static void nf_ct_gre_keymap_flush(struct net *net)
 {
         struct netns_proto_gre *net_gre = gre_pernet(net);
         struct nf_ct_gre_keymap *km, *tmp;
@@ -78,7 +78,6 @@ void nf_ct_gre_keymap_flush(struct net *net)
         }
         write_unlock_bh(&net_gre->keymap_lock);
 }
-EXPORT_SYMBOL(nf_ct_gre_keymap_flush);
 
 static inline int gre_key_cmpfn(const struct nf_ct_gre_keymap *km,
                                 const struct nf_conntrack_tuple *t)
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 466410eaa482..4c3ba1c8d682 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -800,7 +800,7 @@ static int refresh_signalling_expectation(struct nf_conn *ct,
         struct hlist_node *next;
         int found = 0;
 
-        spin_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_expect_lock);
         hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {
                 if (exp->class != SIP_EXPECT_SIGNALLING ||
                     !nf_inet_addr_cmp(&exp->tuple.dst.u3, addr) ||
@@ -815,7 +815,7 @@ static int refresh_signalling_expectation(struct nf_conn *ct,
                 found = 1;
                 break;
         }
-        spin_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_expect_lock);
         return found;
 }
 
@@ -825,7 +825,7 @@ static void flush_expectations(struct nf_conn *ct, bool media)
         struct nf_conntrack_expect *exp;
         struct hlist_node *next;
 
-        spin_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_expect_lock);
         hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {
                 if ((exp->class != SIP_EXPECT_SIGNALLING) ^ media)
                         continue;
@@ -836,7 +836,7 @@ static void flush_expectations(struct nf_conn *ct, bool media)
                 if (!media)
                         break;
         }
-        spin_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_expect_lock);
 }
 
 static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff,
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index adce01e8bb57..3fd159db9f06 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -152,8 +152,8 @@ nf_tables_chain_type_lookup(const struct nft_af_info *afi,
 #ifdef CONFIG_MODULES
         if (autoload) {
                 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
-                request_module("nft-chain-%u-%*.s", afi->family,
-                               nla_len(nla)-1, (const char *)nla_data(nla));
+                request_module("nft-chain-%u-%.*s", afi->family,
+                               nla_len(nla), (const char *)nla_data(nla));
                 nfnl_lock(NFNL_SUBSYS_NFTABLES);
                 type = __nf_tables_chain_type_lookup(afi->family, nla);
                 if (type != NULL)
@@ -794,9 +794,8 @@ nf_tables_counters(struct nft_base_chain *chain, const struct nlattr *attr)
         stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
 
         if (chain->stats) {
-                /* nfnl_lock is held, add some nfnl function for this, later */
                 struct nft_stats __percpu *oldstats =
-                        rcu_dereference_protected(chain->stats, 1);
+                                nft_dereference(chain->stats);
 
                 rcu_assign_pointer(chain->stats, newstats);
                 synchronize_rcu();
@@ -1254,10 +1253,11 @@ err1:
         return err;
 }
 
-static void nf_tables_expr_destroy(struct nft_expr *expr)
+static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
+                                   struct nft_expr *expr)
 {
         if (expr->ops->destroy)
-                expr->ops->destroy(expr);
+                expr->ops->destroy(ctx, expr);
         module_put(expr->ops->type->owner);
 }
 
@@ -1296,6 +1296,8 @@ static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
         [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
         [NFTA_RULE_COMPAT]      = { .type = NLA_NESTED },
         [NFTA_RULE_POSITION]    = { .type = NLA_U64 },
+        [NFTA_RULE_USERDATA]    = { .type = NLA_BINARY,
+                                    .len = NFT_USERDATA_MAXLEN },
 };
 
 static int nf_tables_fill_rule_info(struct sk_buff *skb, u32 portid, u32 seq,
@@ -1348,6 +1350,10 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, u32 portid, u32 seq,
         }
         nla_nest_end(skb, list);
 
+        if (rule->ulen &&
+            nla_put(skb, NFTA_RULE_USERDATA, rule->ulen, nft_userdata(rule)))
+                goto nla_put_failure;
+
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
@@ -1531,7 +1537,8 @@ err:
         return err;
 }
 
-static void nf_tables_rule_destroy(struct nft_rule *rule)
+static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
+                                   struct nft_rule *rule)
 {
         struct nft_expr *expr;
 
@@ -1541,7 +1548,7 @@ static void nf_tables_rule_destroy(struct nft_rule *rule)
          */
         expr = nft_expr_first(rule);
         while (expr->ops && expr != nft_expr_last(rule)) {
-                nf_tables_expr_destroy(expr);
+                nf_tables_expr_destroy(ctx, expr);
                 expr = nft_expr_next(expr);
         }
         kfree(rule);
@@ -1552,7 +1559,7 @@ static void nf_tables_rule_destroy(struct nft_rule *rule)
 static struct nft_expr_info *info;
 
 static struct nft_rule_trans *
-nf_tables_trans_add(struct nft_rule *rule, const struct nft_ctx *ctx)
+nf_tables_trans_add(struct nft_ctx *ctx, struct nft_rule *rule)
 {
         struct nft_rule_trans *rupd;
 
@@ -1560,11 +1567,8 @@ nf_tables_trans_add(struct nft_rule *rule, const struct nft_ctx *ctx)
         if (rupd == NULL)
                return NULL;
 
-        rupd->chain = ctx->chain;
-        rupd->table = ctx->table;
+        rupd->ctx = *ctx;
         rupd->rule = rule;
-        rupd->family = ctx->afi->family;
-        rupd->nlh = ctx->nlh;
         list_add_tail(&rupd->list, &ctx->net->nft.commit_list);
 
         return rupd;
@@ -1584,7 +1588,7 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
         struct nft_expr *expr;
         struct nft_ctx ctx;
         struct nlattr *tmp;
-        unsigned int size, i, n;
+        unsigned int size, i, n, ulen = 0;
         int err, rem;
         bool create;
         u64 handle, pos_handle;
@@ -1650,8 +1654,11 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
                 }
         }
 
+        if (nla[NFTA_RULE_USERDATA])
+                ulen = nla_len(nla[NFTA_RULE_USERDATA]);
+
         err = -ENOMEM;
-        rule = kzalloc(sizeof(*rule) + size, GFP_KERNEL);
+        rule = kzalloc(sizeof(*rule) + size + ulen, GFP_KERNEL);
         if (rule == NULL)
                 goto err1;
 
@@ -1659,6 +1666,10 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
 
         rule->handle = handle;
         rule->dlen   = size;
+        rule->ulen   = ulen;
+
+        if (ulen)
+                nla_memcpy(nft_userdata(rule), nla[NFTA_RULE_USERDATA], ulen);
 
         expr = nft_expr_first(rule);
         for (i = 0; i < n; i++) {
@@ -1671,7 +1682,7 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
 
         if (nlh->nlmsg_flags & NLM_F_REPLACE) {
                 if (nft_rule_is_active_next(net, old_rule)) {
-                        repl = nf_tables_trans_add(old_rule, &ctx);
+                        repl = nf_tables_trans_add(&ctx, old_rule);
                         if (repl == NULL) {
                                 err = -ENOMEM;
                                 goto err2;
@@ -1694,7 +1705,7 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
                         list_add_rcu(&rule->list, &chain->rules);
         }
 
-        if (nf_tables_trans_add(rule, &ctx) == NULL) {
+        if (nf_tables_trans_add(&ctx, rule) == NULL) {
                 err = -ENOMEM;
                 goto err3;
         }
@@ -1709,7 +1720,7 @@ err3:
                 kfree(repl);
         }
 err2:
-        nf_tables_rule_destroy(rule);
+        nf_tables_rule_destroy(&ctx, rule);
 err1:
         for (i = 0; i < n; i++) {
                 if (info[i].ops != NULL)
@@ -1723,7 +1734,7 @@ nf_tables_delrule_one(struct nft_ctx *ctx, struct nft_rule *rule)
 {
         /* You cannot delete the same rule twice */
         if (nft_rule_is_active_next(ctx->net, rule)) {
-                if (nf_tables_trans_add(rule, ctx) == NULL)
+                if (nf_tables_trans_add(ctx, rule) == NULL)
                         return -ENOMEM;
                 nft_rule_disactivate_next(ctx->net, rule);
                 return 0;
@@ -1819,10 +1830,10 @@ static int nf_tables_commit(struct sk_buff *skb)
                  */
                 if (nft_rule_is_active(net, rupd->rule)) {
                         nft_rule_clear(net, rupd->rule);
-                        nf_tables_rule_notify(skb, rupd->nlh, rupd->table,
-                                              rupd->chain, rupd->rule,
-                                              NFT_MSG_NEWRULE, 0,
-                                              rupd->family);
+                        nf_tables_rule_notify(skb, rupd->ctx.nlh,
+                                              rupd->ctx.table, rupd->ctx.chain,
+                                              rupd->rule, NFT_MSG_NEWRULE, 0,
+                                              rupd->ctx.afi->family);
                         list_del(&rupd->list);
                         kfree(rupd);
                         continue;
@@ -1830,9 +1841,10 @@ static int nf_tables_commit(struct sk_buff *skb)
 
                 /* This rule is in the past, get rid of it */
                 list_del_rcu(&rupd->rule->list);
-                nf_tables_rule_notify(skb, rupd->nlh, rupd->table, rupd->chain,
+                nf_tables_rule_notify(skb, rupd->ctx.nlh,
+                                      rupd->ctx.table, rupd->ctx.chain,
                                       rupd->rule, NFT_MSG_DELRULE, 0,
-                                      rupd->family);
+                                      rupd->ctx.afi->family);
         }
 
         /* Make sure we don't see any packet traversing old rules */
@@ -1840,7 +1852,7 @@ static int nf_tables_commit(struct sk_buff *skb)
 
         /* Now we can safely release unused old rules */
         list_for_each_entry_safe(rupd, tmp, &net->nft.commit_list, list) {
-                nf_tables_rule_destroy(rupd->rule);
+                nf_tables_rule_destroy(&rupd->ctx, rupd->rule);
                 list_del(&rupd->list);
                 kfree(rupd);
         }
@@ -1869,7 +1881,7 @@ static int nf_tables_abort(struct sk_buff *skb)
         synchronize_rcu();
 
         list_for_each_entry_safe(rupd, tmp, &net->nft.commit_list, list) {
-                nf_tables_rule_destroy(rupd->rule);
+                nf_tables_rule_destroy(&rupd->ctx, rupd->rule);
                 list_del(&rupd->list);
                 kfree(rupd);
         }
@@ -1934,7 +1946,8 @@ static const struct nft_set_ops *nft_select_set_ops(const struct nlattr * const
 
 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
         [NFTA_SET_TABLE]                = { .type = NLA_STRING },
-        [NFTA_SET_NAME]                 = { .type = NLA_STRING },
+        [NFTA_SET_NAME]                 = { .type = NLA_STRING,
+                                            .len = IFNAMSIZ - 1 },
         [NFTA_SET_FLAGS]                = { .type = NLA_U32 },
         [NFTA_SET_KEY_TYPE]             = { .type = NLA_U32 },
         [NFTA_SET_KEY_LEN]              = { .type = NLA_U32 },
@@ -2430,8 +2443,7 @@ err1:
 static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
 {
         list_del(&set->list);
-        if (!(set->flags & NFT_SET_ANONYMOUS))
-                nf_tables_set_notify(ctx, set, NFT_MSG_DELSET);
+        nf_tables_set_notify(ctx, set, NFT_MSG_DELSET);
 
         set->ops->destroy(set);
         module_put(set->ops->owner);
@@ -3175,9 +3187,16 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
         data->verdict = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
 
         switch (data->verdict) {
-        case NF_ACCEPT:
-        case NF_DROP:
-        case NF_QUEUE:
+        default:
+                switch (data->verdict & NF_VERDICT_MASK) {
+                case NF_ACCEPT:
+                case NF_DROP:
+                case NF_QUEUE:
+                        break;
+                default:
+                        return -EINVAL;
+                }
+                /* fall through */
         case NFT_CONTINUE:
         case NFT_BREAK:
         case NFT_RETURN:
@@ -3198,8 +3217,6 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
                 data->chain = chain;
                 desc->len = sizeof(data);
                 break;
-        default:
-                return -EINVAL;
         }
 
         desc->type = NFT_DATA_VERDICT;
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 90998a6ff8b9..804105391b9a 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -25,9 +25,8 @@ static void nft_cmp_fast_eval(const struct nft_expr *expr,
                               struct nft_data data[NFT_REG_MAX + 1])
 {
         const struct nft_cmp_fast_expr *priv = nft_expr_priv(expr);
-        u32 mask;
+        u32 mask = nft_cmp_fast_mask(priv->len);
 
-        mask = ~0U >> (sizeof(priv->data) * BITS_PER_BYTE - priv->len);
         if ((data[priv->sreg].data[0] & mask) == priv->data)
                 return;
         data[NFT_REG_VERDICT].verdict = NFT_BREAK;
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 046aa13b4fea..e8138da4c14f 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -61,6 +61,14 @@ void nfnl_unlock(__u8 subsys_id)
 }
 EXPORT_SYMBOL_GPL(nfnl_unlock);
 
+#ifdef CONFIG_PROVE_LOCKING
+int lockdep_nfnl_is_held(u8 subsys_id)
+{
+        return lockdep_is_held(&table[subsys_id].mutex);
+}
+EXPORT_SYMBOL_GPL(lockdep_nfnl_is_held);
+#endif
+
 int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n)
 {
         nfnl_lock(n->subsys_id);
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index a155d19a225e..d292c8d286eb 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -28,8 +28,6 @@
 #include <linux/proc_fs.h>
 #include <linux/security.h>
 #include <linux/list.h>
-#include <linux/jhash.h>
-#include <linux/random.h>
 #include <linux/slab.h>
 #include <net/sock.h>
 #include <net/netfilter/nf_log.h>
@@ -75,7 +73,6 @@ struct nfulnl_instance {
 };
 
 #define INSTANCE_BUCKETS        16
-static unsigned int hash_init;
 
 static int nfnl_log_net_id __read_mostly;
 
@@ -1067,11 +1064,6 @@ static int __init nfnetlink_log_init(void)
 {
         int status = -ENOMEM;
 
-        /* it's not really all that important to have a random value, so
-         * we can do this from the init function, even if there hasn't
-         * been that much entropy yet */
-        get_random_bytes(&hash_init, sizeof(hash_init));
-
         netlink_register_notifier(&nfulnl_rtnl_notifier);
         status = nfnetlink_subsys_register(&nfulnl_subsys);
         if (status < 0) {
diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
index 954925db414d..e2b3f51c81f1 100644
--- a/net/netfilter/nft_cmp.c
+++ b/net/netfilter/nft_cmp.c
@@ -128,7 +128,7 @@ static int nft_cmp_fast_init(const struct nft_ctx *ctx,
         BUG_ON(err < 0);
         desc.len *= BITS_PER_BYTE;
 
-        mask = ~0U >> (sizeof(priv->data) * BITS_PER_BYTE - desc.len);
+        mask = nft_cmp_fast_mask(desc.len);
         priv->data = data.data[0] & mask;
         priv->len  = desc.len;
         return 0;
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 82cb8236f8a1..8a779be832fb 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -192,7 +192,7 @@ err:
 }
 
 static void
-nft_target_destroy(const struct nft_expr *expr)
+nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
         struct xt_target *target = expr->ops->data;
 
@@ -379,7 +379,7 @@ err:
 }
 
 static void
-nft_match_destroy(const struct nft_expr *expr)
+nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
         struct xt_match *match = expr->ops->data;
 
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 46e275403838..bd0d41e69341 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -19,15 +19,15 @@
 #include <net/netfilter/nf_conntrack_tuple.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
+#include <net/netfilter/nf_conntrack_labels.h>
 
 struct nft_ct {
         enum nft_ct_keys        key:8;
         enum ip_conntrack_dir   dir:8;
-        union{
+        union {
                 enum nft_registers      dreg:8;
                 enum nft_registers      sreg:8;
         };
-        uint8_t                 family;
 };
 
 static void nft_ct_get_eval(const struct nft_expr *expr,
@@ -97,6 +97,26 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
                         goto err;
                 strncpy((char *)dest->data, helper->name, sizeof(dest->data));
                 return;
+#ifdef CONFIG_NF_CONNTRACK_LABELS
+        case NFT_CT_LABELS: {
+                struct nf_conn_labels *labels = nf_ct_labels_find(ct);
+                unsigned int size;
+
+                if (!labels) {
+                        memset(dest->data, 0, sizeof(dest->data));
+                        return;
+                }
+
+                BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > sizeof(dest->data));
+                size = labels->words * sizeof(long);
+
+                memcpy(dest->data, labels->bits, size);
+                if (size < sizeof(dest->data))
+                        memset(((char *) dest->data) + size, 0,
+                               sizeof(dest->data) - size);
+                return;
+        }
+#endif
         }
 
         tuple = &ct->tuplehash[priv->dir].tuple;
@@ -221,6 +241,9 @@ static int nft_ct_init_validate_get(const struct nft_expr *expr,
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
         case NFT_CT_SECMARK:
 #endif
+#ifdef CONFIG_NF_CONNTRACK_LABELS
+        case NFT_CT_LABELS:
+#endif
         case NFT_CT_EXPIRATION:
         case NFT_CT_HELPER:
                 if (tb[NFTA_CT_DIRECTION] != NULL)
@@ -292,16 +315,13 @@ static int nft_ct_init(const struct nft_ctx *ctx,
         if (err < 0)
                 return err;
 
-        priv->family = ctx->afi->family;
-
         return 0;
 }
 
-static void nft_ct_destroy(const struct nft_expr *expr)
+static void nft_ct_destroy(const struct nft_ctx *ctx,
+                           const struct nft_expr *expr)
 {
-        struct nft_ct *priv = nft_expr_priv(expr);
-
-        nft_ct_l3proto_module_put(priv->family);
+        nft_ct_l3proto_module_put(ctx->afi->family);
 }
 
 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index 3d3f8fce10a5..3b1ad876d6b0 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
+ * Copyright (c) 2008-2014 Patrick McHardy <kaber@trash.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -14,21 +14,34 @@
 #include <linux/list.h>
 #include <linux/jhash.h>
 #include <linux/netlink.h>
+#include <linux/vmalloc.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter/nf_tables.h>
 #include <net/netfilter/nf_tables.h>
 
+#define NFT_HASH_MIN_SIZE       4
+
 struct nft_hash {
-        struct hlist_head       *hash;
-        unsigned int            hsize;
+        struct nft_hash_table __rcu     *tbl;
+};
+
+struct nft_hash_table {
+        unsigned int                    size;
+        unsigned int                    elements;
+        struct nft_hash_elem __rcu      *buckets[];
 };
 
 struct nft_hash_elem {
-        struct hlist_node       hnode;
-        struct nft_data         key;
-        struct nft_data         data[];
+        struct nft_hash_elem __rcu      *next;
+        struct nft_data                 key;
+        struct nft_data                 data[];
 };
 
+#define nft_hash_for_each_entry(i, head) \
+        for (i = nft_dereference(head); i != NULL; i = nft_dereference(i->next))
+#define nft_hash_for_each_entry_rcu(i, head) \
+        for (i = rcu_dereference(head); i != NULL; i = rcu_dereference(i->next))
+
 static u32 nft_hash_rnd __read_mostly;
 static bool nft_hash_rnd_initted __read_mostly;
 
@@ -38,7 +51,7 @@ static unsigned int nft_hash_data(const struct nft_data *data,
         unsigned int h;
 
         h = jhash(data->data, len, nft_hash_rnd);
-        return ((u64)h * hsize) >> 32;
+        return h & (hsize - 1);
 }
 
 static bool nft_hash_lookup(const struct nft_set *set,
@@ -46,11 +59,12 @@ static bool nft_hash_lookup(const struct nft_set *set,
                             struct nft_data *data)
 {
         const struct nft_hash *priv = nft_set_priv(set);
+        const struct nft_hash_table *tbl = rcu_dereference(priv->tbl);
         const struct nft_hash_elem *he;
         unsigned int h;
 
-        h = nft_hash_data(key, priv->hsize, set->klen);
-        hlist_for_each_entry(he, &priv->hash[h], hnode) {
+        h = nft_hash_data(key, tbl->size, set->klen);
+        nft_hash_for_each_entry_rcu(he, tbl->buckets[h]) {
                 if (nft_data_cmp(&he->key, key, set->klen))
                         continue;
                 if (set->flags & NFT_SET_MAP)
@@ -60,19 +74,148 @@ static bool nft_hash_lookup(const struct nft_set *set,
         return false;
 }
 
-static void nft_hash_elem_destroy(const struct nft_set *set,
-                                  struct nft_hash_elem *he)
+static void nft_hash_tbl_free(const struct nft_hash_table *tbl)
 {
-        nft_data_uninit(&he->key, NFT_DATA_VALUE);
-        if (set->flags & NFT_SET_MAP)
-                nft_data_uninit(he->data, set->dtype);
-        kfree(he);
+        if (is_vmalloc_addr(tbl))
+                vfree(tbl);
+        else
+                kfree(tbl);
+}
+
+static struct nft_hash_table *nft_hash_tbl_alloc(unsigned int nbuckets)
+{
+        struct nft_hash_table *tbl;
+        size_t size;
+
+        size = sizeof(*tbl) + nbuckets * sizeof(tbl->buckets[0]);
+        tbl = kzalloc(size, GFP_KERNEL | __GFP_REPEAT | __GFP_NOWARN);
+        if (tbl == NULL)
+                tbl = vzalloc(size);
+        if (tbl == NULL)
+                return NULL;
+        tbl->size = nbuckets;
+
+        return tbl;
+}
+
+static void nft_hash_chain_unzip(const struct nft_set *set,
+                                 const struct nft_hash_table *ntbl,
+                                 struct nft_hash_table *tbl, unsigned int n)
+{
+        struct nft_hash_elem *he, *last, *next;
+        unsigned int h;
+
+        he = nft_dereference(tbl->buckets[n]);
+        if (he == NULL)
+                return;
+        h = nft_hash_data(&he->key, ntbl->size, set->klen);
+
+        /* Find last element of first chain hashing to bucket h */
+        last = he;
+        nft_hash_for_each_entry(he, he->next) {
+                if (nft_hash_data(&he->key, ntbl->size, set->klen) != h)
+                        break;
+                last = he;
+        }
+
+        /* Unlink first chain from the old table */
+        RCU_INIT_POINTER(tbl->buckets[n], last->next);
+
+        /* If end of chain reached, done */
+        if (he == NULL)
+                return;
+
+        /* Find first element of second chain hashing to bucket h */
+        next = NULL;
+        nft_hash_for_each_entry(he, he->next) {
+                if (nft_hash_data(&he->key, ntbl->size, set->klen) != h)
+                        continue;
+                next = he;
+                break;
+        }
+
+        /* Link the two chains */
+        RCU_INIT_POINTER(last->next, next);
+}
+
+static int nft_hash_tbl_expand(const struct nft_set *set, struct nft_hash *priv)
+{
+        struct nft_hash_table *tbl = nft_dereference(priv->tbl), *ntbl;
+        struct nft_hash_elem *he;
+        unsigned int i, h;
+        bool complete;
+
+        ntbl = nft_hash_tbl_alloc(tbl->size * 2);
+        if (ntbl == NULL)
+                return -ENOMEM;
+
+        /* Link new table's buckets to first element in the old table
+         * hashing to the new bucket.
+         */
+        for (i = 0; i < ntbl->size; i++) {
+                h = i < tbl->size ? i : i - tbl->size;
+                nft_hash_for_each_entry(he, tbl->buckets[h]) {
+                        if (nft_hash_data(&he->key, ntbl->size, set->klen) != i)
+                                continue;
+                        RCU_INIT_POINTER(ntbl->buckets[i], he);
+                        break;
+                }
+        }
+        ntbl->elements = tbl->elements;
+
+        /* Publish new table */
+        rcu_assign_pointer(priv->tbl, ntbl);
+
+        /* Unzip interleaved hash chains */
+        do {
+                /* Wait for readers to use new table/unzipped chains */
+                synchronize_rcu();
+
+                complete = true;
+                for (i = 0; i < tbl->size; i++) {
+                        nft_hash_chain_unzip(set, ntbl, tbl, i);
+                        if (tbl->buckets[i] != NULL)
+                                complete = false;
+                }
+        } while (!complete);
+
+        nft_hash_tbl_free(tbl);
+        return 0;
+}
+
+static int nft_hash_tbl_shrink(const struct nft_set *set, struct nft_hash *priv)
+{
+        struct nft_hash_table *tbl = nft_dereference(priv->tbl), *ntbl;
+        struct nft_hash_elem __rcu **pprev;
+        unsigned int i;
+
+        ntbl = nft_hash_tbl_alloc(tbl->size / 2);
+        if (ntbl == NULL)
+                return -ENOMEM;
+
+        for (i = 0; i < ntbl->size; i++) {
+                ntbl->buckets[i] = tbl->buckets[i];
+
+                for (pprev = &ntbl->buckets[i]; *pprev != NULL;
+                     pprev = &nft_dereference(*pprev)->next)
+                        ;
+                RCU_INIT_POINTER(*pprev, tbl->buckets[i + ntbl->size]);
+        }
+        ntbl->elements = tbl->elements;
+
+        /* Publish new table */
+        rcu_assign_pointer(priv->tbl, ntbl);
+        synchronize_rcu();
+
+        nft_hash_tbl_free(tbl);
+        return 0;
 }
 
 static int nft_hash_insert(const struct nft_set *set,
                            const struct nft_set_elem *elem)
 {
         struct nft_hash *priv = nft_set_priv(set);
+        struct nft_hash_table *tbl = nft_dereference(priv->tbl);
         struct nft_hash_elem *he;
         unsigned int size, h;
 
@@ -91,33 +234,66 @@ static int nft_hash_insert(const struct nft_set *set,
         if (set->flags & NFT_SET_MAP)
                 nft_data_copy(he->data, &elem->data);
 
-        h = nft_hash_data(&he->key, priv->hsize, set->klen);
-        hlist_add_head_rcu(&he->hnode, &priv->hash[h]);
+        h = nft_hash_data(&he->key, tbl->size, set->klen);
+        RCU_INIT_POINTER(he->next, tbl->buckets[h]);
+        rcu_assign_pointer(tbl->buckets[h], he);
+        tbl->elements++;
+
+        /* Expand table when exceeding 75% load */
+        if (tbl->elements > tbl->size / 4 * 3)
+                nft_hash_tbl_expand(set, priv);
+
         return 0;
 }
 
+static void nft_hash_elem_destroy(const struct nft_set *set,
+                                  struct nft_hash_elem *he)
+{
+        nft_data_uninit(&he->key, NFT_DATA_VALUE);
+        if (set->flags & NFT_SET_MAP)
+                nft_data_uninit(he->data, set->dtype);
+        kfree(he);
+}
+
 static void nft_hash_remove(const struct nft_set *set,
                             const struct nft_set_elem *elem)
 {
-        struct nft_hash_elem *he = elem->cookie;
+        struct nft_hash *priv = nft_set_priv(set);
+        struct nft_hash_table *tbl = nft_dereference(priv->tbl);
+        struct nft_hash_elem *he, __rcu **pprev;
 
-        hlist_del_rcu(&he->hnode);
+        pprev = elem->cookie;
+        he = nft_dereference((*pprev));
+
+        RCU_INIT_POINTER(*pprev, he->next);
+        synchronize_rcu();
         kfree(he);
+        tbl->elements--;
+
+        /* Shrink table beneath 30% load */
+        if (tbl->elements < tbl->size * 3 / 10 &&
+            tbl->size > NFT_HASH_MIN_SIZE)
+                nft_hash_tbl_shrink(set, priv);
 }
 
 static int nft_hash_get(const struct nft_set *set, struct nft_set_elem *elem)
 {
         const struct nft_hash *priv = nft_set_priv(set);
+        const struct nft_hash_table *tbl = nft_dereference(priv->tbl);
+        struct nft_hash_elem __rcu * const *pprev;
         struct nft_hash_elem *he;
         unsigned int h;
 
-        h = nft_hash_data(&elem->key, priv->hsize, set->klen);
-        hlist_for_each_entry(he, &priv->hash[h], hnode) {
-                if (nft_data_cmp(&he->key, &elem->key, set->klen))
+        h = nft_hash_data(&elem->key, tbl->size, set->klen);
+        pprev = &tbl->buckets[h];
+        nft_hash_for_each_entry(he, tbl->buckets[h]) {
+                if (nft_data_cmp(&he->key, &elem->key, set->klen)) {
+                        pprev = &he->next;
                         continue;
+                }
 
-                elem->cookie = he;
-                elem->flags  = 0;
+                elem->cookie = (void *)pprev;
+                elem->flags = 0;
                 if (set->flags & NFT_SET_MAP)
                         nft_data_copy(&elem->data, he->data);
                 return 0;
@@ -129,12 +305,13 @@ static void nft_hash_walk(const struct nft_ctx *ctx, const struct nft_set *set,
                           struct nft_set_iter *iter)
 {
         const struct nft_hash *priv = nft_set_priv(set);
+        const struct nft_hash_table *tbl = nft_dereference(priv->tbl);
         const struct nft_hash_elem *he;
         struct nft_set_elem elem;
         unsigned int i;
 
-        for (i = 0; i < priv->hsize; i++) {
-                hlist_for_each_entry(he, &priv->hash[i], hnode) {
+        for (i = 0; i < tbl->size; i++) {
+                nft_hash_for_each_entry(he, tbl->buckets[i]) {
                         if (iter->count < iter->skip)
                                 goto cont;
 
@@ -161,43 +338,35 @@ static int nft_hash_init(const struct nft_set *set,
                          const struct nlattr * const tb[])
 {
         struct nft_hash *priv = nft_set_priv(set);
-        unsigned int cnt, i;
+        struct nft_hash_table *tbl;
 
         if (unlikely(!nft_hash_rnd_initted)) {
                 get_random_bytes(&nft_hash_rnd, 4);
                 nft_hash_rnd_initted = true;
         }
 
-        /* Aim for a load factor of 0.75 */
-        // FIXME: temporarily broken until we have set descriptions
-        cnt = 100;
-        cnt = cnt * 4 / 3;
-
-        priv->hash = kcalloc(cnt, sizeof(struct hlist_head), GFP_KERNEL);
-        if (priv->hash == NULL)
+        tbl = nft_hash_tbl_alloc(NFT_HASH_MIN_SIZE);
+        if (tbl == NULL)
                 return -ENOMEM;
-        priv->hsize = cnt;
-
-        for (i = 0; i < cnt; i++)
-                INIT_HLIST_HEAD(&priv->hash[i]);
-
+        RCU_INIT_POINTER(priv->tbl, tbl);
         return 0;
 }
 
 static void nft_hash_destroy(const struct nft_set *set)
 {
         const struct nft_hash *priv = nft_set_priv(set);
-        const struct hlist_node *next;
-        struct nft_hash_elem *elem;
+        const struct nft_hash_table *tbl = nft_dereference(priv->tbl);
+        struct nft_hash_elem *he, *next;
         unsigned int i;
 
-        for (i = 0; i < priv->hsize; i++) {
-                hlist_for_each_entry_safe(elem, next, &priv->hash[i], hnode) {
-                        hlist_del(&elem->hnode);
-                        nft_hash_elem_destroy(set, elem);
+        for (i = 0; i < tbl->size; i++) {
+                for (he = nft_dereference(tbl->buckets[i]); he != NULL;
+                     he = next) {
+                        next = nft_dereference(he->next);
+                        nft_hash_elem_destroy(set, he);
                 }
         }
-        kfree(priv->hash);
+        kfree(tbl);
 }
 
 static struct nft_set_ops nft_hash_ops __read_mostly = {
diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index f169501f1ad4..810385eb7249 100644
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -70,7 +70,8 @@ err1:
         return err;
 }
 
-static void nft_immediate_destroy(const struct nft_expr *expr)
+static void nft_immediate_destroy(const struct nft_ctx *ctx,
+                                  const struct nft_expr *expr)
 {
         const struct nft_immediate_expr *priv = nft_expr_priv(expr);
         return nft_data_uninit(&priv->data, nft_dreg_to_type(priv->dreg));
diff --git a/net/netfilter/nft_log.c b/net/netfilter/nft_log.c
index 26c5154e05f3..10cfb156cdf4 100644
--- a/net/netfilter/nft_log.c
+++ b/net/netfilter/nft_log.c
@@ -74,7 +74,8 @@ static int nft_log_init(const struct nft_ctx *ctx,
         return 0;
 }
 
-static void nft_log_destroy(const struct nft_expr *expr)
+static void nft_log_destroy(const struct nft_ctx *ctx,
+                            const struct nft_expr *expr)
 {
         struct nft_log *priv = nft_expr_priv(expr);
 
diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
index bb4ef4cccb6e..7fd2bea8aa23 100644
--- a/net/netfilter/nft_lookup.c
+++ b/net/netfilter/nft_lookup.c
@@ -89,11 +89,12 @@ static int nft_lookup_init(const struct nft_ctx *ctx,
         return 0;
 }
 
-static void nft_lookup_destroy(const struct nft_expr *expr)
+static void nft_lookup_destroy(const struct nft_ctx *ctx,
+                               const struct nft_expr *expr)
 {
         struct nft_lookup *priv = nft_expr_priv(expr);
 
-        nf_tables_unbind_set(NULL, priv->set, &priv->binding);
+        nf_tables_unbind_set(ctx, priv->set, &priv->binding);
 }
 
 static int nft_lookup_dump(struct sk_buff *skb, const struct nft_expr *expr)
diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index d3b1ffe26181..a0195d28bcfc 100644
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -31,8 +31,8 @@ struct nft_nat {
         enum nft_registers      sreg_addr_max:8;
         enum nft_registers      sreg_proto_min:8;
         enum nft_registers      sreg_proto_max:8;
-        int                     family;
-        enum nf_nat_manip_type  type;
+        enum nf_nat_manip_type  type:8;
+        u8                      family;
 };
 
 static void nft_nat_eval(const struct nft_expr *expr,
@@ -88,6 +88,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
                         const struct nlattr * const tb[])
 {
         struct nft_nat *priv = nft_expr_priv(expr);
+        u32 family;
         int err;
 
         if (tb[NFTA_NAT_TYPE] == NULL)
@@ -107,9 +108,12 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
         if (tb[NFTA_NAT_FAMILY] == NULL)
                 return -EINVAL;
 
-        priv->family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY]));
-        if (priv->family != AF_INET && priv->family != AF_INET6)
-                return -EINVAL;
+        family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY]));
+        if (family != AF_INET && family != AF_INET6)
+                return -EAFNOSUPPORT;
+        if (family != ctx->afi->family)
+                return -EOPNOTSUPP;
+        priv->family = family;
 
         if (tb[NFTA_NAT_REG_ADDR_MIN]) {
                 priv->sreg_addr_min = ntohl(nla_get_be32(
@@ -202,13 +206,7 @@ static struct nft_expr_type nft_nat_type __read_mostly = {
 
 static int __init nft_nat_module_init(void)
 {
-        int err;
-
-        err = nft_register_expr(&nft_nat_type);
-        if (err < 0)
-                return err;
-
-        return 0;
+        return nft_register_expr(&nft_nat_type);
 }
 
 static void __exit nft_nat_module_exit(void)
diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c
index 3228d7f24eb4..4973cbddc446 100644
--- a/net/netfilter/xt_AUDIT.c
+++ b/net/netfilter/xt_AUDIT.c
@@ -146,11 +146,11 @@ audit_tg(struct sk_buff *skb, const struct xt_action_param *par)
 
                 if (par->family == NFPROTO_BRIDGE) {
                         switch (eth_hdr(skb)->h_proto) {
-                        case __constant_htons(ETH_P_IP):
+                        case htons(ETH_P_IP):
                                 audit_ip4(ab, skb);
                                 break;
 
-                        case __constant_htons(ETH_P_IPV6):
+                        case htons(ETH_P_IPV6):
                                 audit_ip6(ab, skb);
                                 break;
                         }
diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
index 9a8e77e7f8d4..f4e833005320 100644
--- a/net/netfilter/xt_cgroup.c
+++ b/net/netfilter/xt_cgroup.c
@@ -54,7 +54,8 @@ static struct xt_match cgroup_mt_reg __read_mostly = {
         .matchsize  = sizeof(struct xt_cgroup_info),
         .me         = THIS_MODULE,
         .hooks      = (1 << NF_INET_LOCAL_OUT) |
-                      (1 << NF_INET_POST_ROUTING),
+                      (1 << NF_INET_POST_ROUTING) |
+                      (1 << NF_INET_LOCAL_IN),
 };
 
 static int __init cgroup_mt_init(void)
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index c40b2695633b..fbc66bb250d5 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -19,6 +19,7 @@
 #include <linux/jhash.h>
 #include <linux/slab.h>
 #include <linux/list.h>
+#include <linux/rbtree.h>
 #include <linux/module.h>
 #include <linux/random.h>
 #include <linux/skbuff.h>
@@ -31,6 +32,16 @@
 #include <net/netfilter/nf_conntrack_tuple.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 
+#define CONNLIMIT_SLOTS         256U
+
+#ifdef CONFIG_LOCKDEP
+#define CONNLIMIT_LOCK_SLOTS    8U
+#else
+#define CONNLIMIT_LOCK_SLOTS    256U
+#endif
+
+#define CONNLIMIT_GC_MAX_NODES  8
+
 /* we will save the tuples of all connections we care about */
 struct xt_connlimit_conn {
         struct hlist_node               node;
@@ -38,16 +49,27 @@ struct xt_connlimit_conn {
         union nf_inet_addr              addr;
 };
 
+struct xt_connlimit_rb {
+        struct rb_node node;
+        struct hlist_head hhead; /* connections/hosts in same subnet */
+        union nf_inet_addr addr; /* search key */
+};
+
+static spinlock_t xt_connlimit_locks[CONNLIMIT_LOCK_SLOTS] __cacheline_aligned_in_smp;
+
 struct xt_connlimit_data {
-        struct hlist_head       iphash[256];
-        spinlock_t              lock;
+        struct rb_root climit_root4[CONNLIMIT_SLOTS];
+        struct rb_root climit_root6[CONNLIMIT_SLOTS];
 };
 
 static u_int32_t connlimit_rnd __read_mostly;
+static struct kmem_cache *connlimit_rb_cachep __read_mostly;
+static struct kmem_cache *connlimit_conn_cachep __read_mostly;
 
 static inline unsigned int connlimit_iphash(__be32 addr)
 {
-        return jhash_1word((__force __u32)addr, connlimit_rnd) & 0xFF;
+        return jhash_1word((__force __u32)addr,
+                            connlimit_rnd) % CONNLIMIT_SLOTS;
 }
 
 static inline unsigned int
@@ -60,7 +82,8 @@ connlimit_iphash6(const union nf_inet_addr *addr,
         for (i = 0; i < ARRAY_SIZE(addr->ip6); ++i)
                 res.ip6[i] = addr->ip6[i] & mask->ip6[i];
 
-        return jhash2((u32 *)res.ip6, ARRAY_SIZE(res.ip6), connlimit_rnd) & 0xFF;
+        return jhash2((u32 *)res.ip6, ARRAY_SIZE(res.ip6),
+                       connlimit_rnd) % CONNLIMIT_SLOTS;
 }
 
 static inline bool already_closed(const struct nf_conn *conn)
@@ -72,13 +95,14 @@ static inline bool already_closed(const struct nf_conn *conn)
                 return 0;
 }
 
-static inline unsigned int
+static int
 same_source_net(const union nf_inet_addr *addr,
                 const union nf_inet_addr *mask,
                 const union nf_inet_addr *u3, u_int8_t family)
 {
         if (family == NFPROTO_IPV4) {
-                return (addr->ip & mask->ip) == (u3->ip & mask->ip);
+                return ntohl(addr->ip & mask->ip) -
+                       ntohl(u3->ip & mask->ip);
         } else {
                 union nf_inet_addr lh, rh;
                 unsigned int i;
@@ -88,89 +112,205 @@ same_source_net(const union nf_inet_addr *addr,
                         rh.ip6[i] = u3->ip6[i] & mask->ip6[i];
                 }
 
-                return memcmp(&lh.ip6, &rh.ip6, sizeof(lh.ip6)) == 0;
+                return memcmp(&lh.ip6, &rh.ip6, sizeof(lh.ip6));
         }
 }
 
-static int count_them(struct net *net,
-                      struct xt_connlimit_data *data,
+static bool add_hlist(struct hlist_head *head,
                       const struct nf_conntrack_tuple *tuple,
-                      const union nf_inet_addr *addr,
-                      const union nf_inet_addr *mask,
-                      u_int8_t family)
+                      const union nf_inet_addr *addr)
+{
+        struct xt_connlimit_conn *conn;
+
+        conn = kmem_cache_alloc(connlimit_conn_cachep, GFP_ATOMIC);
+        if (conn == NULL)
+                return false;
+        conn->tuple = *tuple;
+        conn->addr = *addr;
+        hlist_add_head(&conn->node, head);
+        return true;
+}
+
+static unsigned int check_hlist(struct net *net,
+                                struct hlist_head *head,
+                                const struct nf_conntrack_tuple *tuple,
+                                bool *addit)
 {
         const struct nf_conntrack_tuple_hash *found;
         struct xt_connlimit_conn *conn;
         struct hlist_node *n;
         struct nf_conn *found_ct;
-        struct hlist_head *hash;
-        bool addit = true;
-        int matches = 0;
-
-        if (family == NFPROTO_IPV6)
-                hash = &data->iphash[connlimit_iphash6(addr, mask)];
-        else
-                hash = &data->iphash[connlimit_iphash(addr->ip & mask->ip)];
+        unsigned int length = 0;
 
+        *addit = true;
         rcu_read_lock();
 
         /* check the saved connections */
-        hlist_for_each_entry_safe(conn, n, hash, node) {
+        hlist_for_each_entry_safe(conn, n, head, node) {
                 found    = nf_conntrack_find_get(net, NF_CT_DEFAULT_ZONE,
                                                  &conn->tuple);
-                found_ct = NULL;
+                if (found == NULL) {
+                        hlist_del(&conn->node);
+                        kmem_cache_free(connlimit_conn_cachep, conn);
+                        continue;
+                }
 
-                if (found != NULL)
-                        found_ct = nf_ct_tuplehash_to_ctrack(found);
+                found_ct = nf_ct_tuplehash_to_ctrack(found);
 
-                if (found_ct != NULL &&
-                    nf_ct_tuple_equal(&conn->tuple, tuple) &&
-                    !already_closed(found_ct))
+                if (nf_ct_tuple_equal(&conn->tuple, tuple)) {
                         /*
                          * Just to be sure we have it only once in the list.
                          * We should not see tuples twice unless someone hooks
                          * this into a table without "-p tcp --syn".
                          */
-                        addit = false;
-
-                if (found == NULL) {
-                        /* this one is gone */
-                        hlist_del(&conn->node);
-                        kfree(conn);
-                        continue;
-                }
-
-                if (already_closed(found_ct)) {
+                        *addit = false;
+                } else if (already_closed(found_ct)) {
                         /*
                          * we do not care about connections which are
                          * closed already -> ditch it
                          */
                         nf_ct_put(found_ct);
                         hlist_del(&conn->node);
-                        kfree(conn);
+                        kmem_cache_free(connlimit_conn_cachep, conn);
                         continue;
                 }
 
-                if (same_source_net(addr, mask, &conn->addr, family))
-                        /* same source network -> be counted! */
-                        ++matches;
                 nf_ct_put(found_ct);
+                length++;
         }
 
         rcu_read_unlock();
 
-        if (addit) {
-                /* save the new connection in our list */
-                conn = kmalloc(sizeof(*conn), GFP_ATOMIC);
-                if (conn == NULL)
-                        return -ENOMEM;
-                conn->tuple = *tuple;
-                conn->addr = *addr;
-                hlist_add_head(&conn->node, hash);
-                ++matches;
+        return length;
+}
+
+static void tree_nodes_free(struct rb_root *root,
+                            struct xt_connlimit_rb *gc_nodes[],
+                            unsigned int gc_count)
+{
+        struct xt_connlimit_rb *rbconn;
+
+        while (gc_count) {
+                rbconn = gc_nodes[--gc_count];
+                rb_erase(&rbconn->node, root);
+                kmem_cache_free(connlimit_rb_cachep, rbconn);
+        }
+}
+
+static unsigned int
+count_tree(struct net *net, struct rb_root *root,
+           const struct nf_conntrack_tuple *tuple,
+           const union nf_inet_addr *addr, const union nf_inet_addr *mask,
+           u8 family)
+{
+        struct xt_connlimit_rb *gc_nodes[CONNLIMIT_GC_MAX_NODES];
+        struct rb_node **rbnode, *parent;
+        struct xt_connlimit_rb *rbconn;
+        struct xt_connlimit_conn *conn;
+        unsigned int gc_count;
+        bool no_gc = false;
+
+ restart:
+        gc_count = 0;
+        parent = NULL;
+        rbnode = &(root->rb_node);
+        while (*rbnode) {
+                int diff;
+                bool addit;
+
+                rbconn = container_of(*rbnode, struct xt_connlimit_rb, node);
+
+                parent = *rbnode;
+                diff = same_source_net(addr, mask, &rbconn->addr, family);
+                if (diff < 0) {
+                        rbnode = &((*rbnode)->rb_left);
+                } else if (diff > 0) {
+                        rbnode = &((*rbnode)->rb_right);
+                } else {
+                        /* same source network -> be counted! */
+                        unsigned int count;
+                        count = check_hlist(net, &rbconn->hhead, tuple, &addit);
+
+                        tree_nodes_free(root, gc_nodes, gc_count);
+                        if (!addit)
+                                return count;
+
+                        if (!add_hlist(&rbconn->hhead, tuple, addr))
+                                return 0; /* hotdrop */
+
+                        return count + 1;
+                }
+
+                if (no_gc || gc_count >= ARRAY_SIZE(gc_nodes))
+                        continue;
+
+                /* only used for GC on hhead, retval and 'addit' ignored */
+                check_hlist(net, &rbconn->hhead, tuple, &addit);
+                if (hlist_empty(&rbconn->hhead))
+                        gc_nodes[gc_count++] = rbconn;
+        }
+
+        if (gc_count) {
+                no_gc = true;
+                tree_nodes_free(root, gc_nodes, gc_count);
+                /* tree_node_free before new allocation permits
+                 * allocator to re-use newly free'd object.
+                 *
+                 * This is a rare event; in most cases we will find
+                 * existing node to re-use. (or gc_count is 0).
+                 */
+                goto restart;
+        }
+
+        /* no match, need to insert new node */
+        rbconn = kmem_cache_alloc(connlimit_rb_cachep, GFP_ATOMIC);
+        if (rbconn == NULL)
+                return 0;
+
+        conn = kmem_cache_alloc(connlimit_conn_cachep, GFP_ATOMIC);
+        if (conn == NULL) {
+                kmem_cache_free(connlimit_rb_cachep, rbconn);
+                return 0;
+        }
+
+        conn->tuple = *tuple;
+        conn->addr = *addr;
+        rbconn->addr = *addr;
+
+        INIT_HLIST_HEAD(&rbconn->hhead);
+        hlist_add_head(&conn->node, &rbconn->hhead);
+
+        rb_link_node(&rbconn->node, parent, rbnode);
+        rb_insert_color(&rbconn->node, root);
+        return 1;
+}
+
+static int count_them(struct net *net,
+                      struct xt_connlimit_data *data,
+                      const struct nf_conntrack_tuple *tuple,
+                      const union nf_inet_addr *addr,
+                      const union nf_inet_addr *mask,
+                      u_int8_t family)
+{
+        struct rb_root *root;
+        int count;
+        u32 hash;
+
+        if (family == NFPROTO_IPV6) {
+                hash = connlimit_iphash6(addr, mask);
+                root = &data->climit_root6[hash];
+        } else {
+                hash = connlimit_iphash(addr->ip & mask->ip);
+                root = &data->climit_root4[hash];
         }
 
-        return matches;
+        spin_lock_bh(&xt_connlimit_locks[hash % CONNLIMIT_LOCK_SLOTS]);
+
+        count = count_tree(net, root, tuple, addr, mask, family);
+
+        spin_unlock_bh(&xt_connlimit_locks[hash % CONNLIMIT_LOCK_SLOTS]);
+
+        return count;
 }
 
 static bool
@@ -183,7 +323,7 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
         const struct nf_conntrack_tuple *tuple_ptr = &tuple;
         enum ip_conntrack_info ctinfo;
         const struct nf_conn *ct;
-        int connections;
+        unsigned int connections;
 
         ct = nf_ct_get(skb, &ctinfo);
         if (ct != NULL)
@@ -202,12 +342,9 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
                           iph->daddr : iph->saddr;
         }
 
-        spin_lock_bh(&info->data->lock);
         connections = count_them(net, info->data, tuple_ptr, &addr,
                                  &info->mask, par->family);
-        spin_unlock_bh(&info->data->lock);
-
-        if (connections < 0)
+        if (connections == 0)
                 /* kmalloc failed, drop it entirely */
                 goto hotdrop;
 
@@ -247,29 +384,44 @@ static int connlimit_mt_check(const struct xt_mtchk_param *par)
                 return -ENOMEM;
         }
 
-        spin_lock_init(&info->data->lock);
-        for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i)
-                INIT_HLIST_HEAD(&info->data->iphash[i]);
+        for (i = 0; i < ARRAY_SIZE(info->data->climit_root4); ++i)
+                info->data->climit_root4[i] = RB_ROOT;
+        for (i = 0; i < ARRAY_SIZE(info->data->climit_root6); ++i)
+                info->data->climit_root6[i] = RB_ROOT;
 
         return 0;
 }
 
-static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)
+static void destroy_tree(struct rb_root *r)
 {
-        const struct xt_connlimit_info *info = par->matchinfo;
         struct xt_connlimit_conn *conn;
+        struct xt_connlimit_rb *rbconn;
         struct hlist_node *n;
-        struct hlist_head *hash = info->data->iphash;
+        struct rb_node *node;
+
+        while ((node = rb_first(r)) != NULL) {
+                rbconn = container_of(node, struct xt_connlimit_rb, node);
+
+                rb_erase(node, r);
+
+                hlist_for_each_entry_safe(conn, n, &rbconn->hhead, node)
+                        kmem_cache_free(connlimit_conn_cachep, conn);
+
+                kmem_cache_free(connlimit_rb_cachep, rbconn);
+        }
+}
+
+static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)
+{
+        const struct xt_connlimit_info *info = par->matchinfo;
         unsigned int i;
 
         nf_ct_l3proto_module_put(par->family);
 
-        for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i) {
-                hlist_for_each_entry_safe(conn, n, &hash[i], node) {
-                        hlist_del(&conn->node);
-                        kfree(conn);
-                }
-        }
+        for (i = 0; i < ARRAY_SIZE(info->data->climit_root4); ++i)
+                destroy_tree(&info->data->climit_root4[i]);
+        for (i = 0; i < ARRAY_SIZE(info->data->climit_root6); ++i)
+                destroy_tree(&info->data->climit_root6[i]);
 
         kfree(info->data);
 }
@@ -287,12 +439,40 @@ static struct xt_match connlimit_mt_reg __read_mostly = {
 
 static int __init connlimit_mt_init(void)
 {
-        return xt_register_match(&connlimit_mt_reg);
+        int ret, i;
+
+        BUILD_BUG_ON(CONNLIMIT_LOCK_SLOTS > CONNLIMIT_SLOTS);
+        BUILD_BUG_ON((CONNLIMIT_SLOTS % CONNLIMIT_LOCK_SLOTS) != 0);
+
+        for (i = 0; i < CONNLIMIT_LOCK_SLOTS; ++i)
+                spin_lock_init(&xt_connlimit_locks[i]);
+
+        connlimit_conn_cachep = kmem_cache_create("xt_connlimit_conn",
+                                           sizeof(struct xt_connlimit_conn),
+                                           0, 0, NULL);
+        if (!connlimit_conn_cachep)
+                return -ENOMEM;
+
+        connlimit_rb_cachep = kmem_cache_create("xt_connlimit_rb",
+                                           sizeof(struct xt_connlimit_rb),
+                                           0, 0, NULL);
+        if (!connlimit_rb_cachep) {
+                kmem_cache_destroy(connlimit_conn_cachep);
+                return -ENOMEM;
+        }
+        ret = xt_register_match(&connlimit_mt_reg);
+        if (ret != 0) {
+                kmem_cache_destroy(connlimit_conn_cachep);
+                kmem_cache_destroy(connlimit_rb_cachep);
+        }
+        return ret;
 }
 
 static void __exit connlimit_mt_exit(void)
 {
         xt_unregister_match(&connlimit_mt_reg);
+        kmem_cache_destroy(connlimit_conn_cachep);
+        kmem_cache_destroy(connlimit_rb_cachep);
 }
 
 module_init(connlimit_mt_init);
diff --git a/net/netfilter/xt_ipcomp.c b/net/netfilter/xt_ipcomp.c
index a4c7561698c5..89d53104c6b3 100644
--- a/net/netfilter/xt_ipcomp.c
+++ b/net/netfilter/xt_ipcomp.c
@@ -60,7 +60,7 @@ static bool comp_mt(const struct sk_buff *skb, struct xt_action_param *par)
         }
 
         return spi_match(compinfo->spis[0], compinfo->spis[1],
-                         ntohl(chdr->cpi << 16),
+                         ntohs(chdr->cpi),
                          !!(compinfo->invflags & XT_IPCOMP_INV_SPI));
 }
 
diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
index 7174611bd672..c529161cdbf8 100644
--- a/net/netfilter/xt_osf.c
+++ b/net/netfilter/xt_osf.c
@@ -422,4 +422,6 @@ module_exit(xt_osf_fini);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Passive OS fingerprint matching.");
+MODULE_ALIAS("ipt_osf");
+MODULE_ALIAS("ip6t_osf");
 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_OSF);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 04748ab649c2..894cda0206bb 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1460,7 +1460,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
         if (nlk->netlink_bind && nlk->groups[0]) {
                 int i;
 
-                for (i=0; i<nlk->ngroups; i++) {
+                for (i = 0; i < nlk->ngroups; i++) {
                         if (test_bit(i, nlk->groups))
                                 nlk->netlink_bind(i);
                 }
@@ -1653,7 +1653,7 @@ static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
         else
 #endif /* CONFIG_NETLINK_MMAP */
                 skb_queue_tail(&sk->sk_receive_queue, skb);
-        sk->sk_data_ready(sk, len);
+        sk->sk_data_ready(sk);
         return len;
 }
 
@@ -2343,6 +2343,11 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         }
 #endif
 
+        /* Record the max length of recvmsg() calls for future allocations */
+        nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len);
+        nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len,
+                                     16384);
+
         copied = data_skb->len;
         if (len < copied) {
                 msg->msg_flags |= MSG_TRUNC;
@@ -2389,7 +2394,7 @@ out:
         return err ? : copied;
 }
 
-static void netlink_data_ready(struct sock *sk, int len)
+static void netlink_data_ready(struct sock *sk)
 {
         BUG();
 }
@@ -2549,7 +2554,7 @@ __nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, int type, int len, int fla
         struct nlmsghdr *nlh;
         int size = nlmsg_msg_size(len);
 
-        nlh = (struct nlmsghdr*)skb_put(skb, NLMSG_ALIGN(size));
+        nlh = (struct nlmsghdr *)skb_put(skb, NLMSG_ALIGN(size));
         nlh->nlmsg_type = type;
         nlh->nlmsg_len = size;
         nlh->nlmsg_flags = flags;
@@ -2587,7 +2592,27 @@ static int netlink_dump(struct sock *sk)
         if (!netlink_rx_is_mmaped(sk) &&
             atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
                 goto errout_skb;
-        skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, GFP_KERNEL);
+
+        /* NLMSG_GOODSIZE is small to avoid high order allocations being
+         * required, but it makes sense to _attempt_ a 16K bytes allocation
+         * to reduce number of system calls on dump operations, if user
+         * ever provided a big enough buffer.
+         */
+        if (alloc_size < nlk->max_recvmsg_len) {
+                skb = netlink_alloc_skb(sk,
+                                        nlk->max_recvmsg_len,
+                                        nlk->portid,
+                                        GFP_KERNEL |
+                                        __GFP_NOWARN |
+                                        __GFP_NORETRY);
+                /* available room should be exact amount to avoid MSG_TRUNC */
+                if (skb)
+                        skb_reserve(skb, skb_tailroom(skb) -
+                                         nlk->max_recvmsg_len);
+        }
+        if (!skb)
+                skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
+                                        GFP_KERNEL);
         if (!skb)
                 goto errout_skb;
         netlink_skb_set_owner_r(skb, sk);
diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h
index acbd774eeb7c..ed13a790b00e 100644
--- a/net/netlink/af_netlink.h
+++ b/net/netlink/af_netlink.h
@@ -31,6 +31,7 @@ struct netlink_sock {
         u32                     ngroups;
         unsigned long           *groups;
         unsigned long           state;
+        size_t                  max_recvmsg_len;
         wait_queue_head_t       wait;
         bool                    cb_running;
         struct netlink_callback cb;
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index b74aa0755521..ede50d197e10 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1011,7 +1011,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
         skb_queue_head(&sk->sk_receive_queue, skb);
 
         if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk, skb->len);
+                sk->sk_data_ready(sk);
 
         bh_unlock_sock(sk);
 
diff --git a/net/nfc/core.c b/net/nfc/core.c
index ca1e65f4b133..819b87702b70 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -280,9 +280,6 @@ static struct nfc_target *nfc_find_target(struct nfc_dev *dev, u32 target_idx)
 {
         int i;
 
-        if (dev->n_targets == 0)
-                return NULL;
-
         for (i = 0; i < dev->n_targets; i++) {
                 if (dev->targets[i].idx == target_idx)
                         return &dev->targets[i];
@@ -546,9 +543,9 @@ error:
 
 struct nfc_se *nfc_find_se(struct nfc_dev *dev, u32 se_idx)
 {
-        struct nfc_se *se, *n;
+        struct nfc_se *se;
 
-        list_for_each_entry_safe(se, n, &dev->secure_elements, list)
+        list_for_each_entry(se, &dev->secure_elements, list)
                 if (se->idx == se_idx)
                         return se;
 
@@ -655,9 +652,6 @@ int nfc_set_remote_general_bytes(struct nfc_dev *dev, u8 *gb, u8 gb_len)
 {
         pr_debug("dev_name=%s gb_len=%d\n", dev_name(&dev->dev), gb_len);
 
-        if (gb_len > NFC_MAX_GT_LEN)
-                return -EINVAL;
-
         return nfc_llcp_set_remote_gb(dev, gb, gb_len);
 }
 EXPORT_SYMBOL(nfc_set_remote_general_bytes);
diff --git a/net/nfc/digital.h b/net/nfc/digital.h
index 08b29b55ea63..3759add68b1b 100644
--- a/net/nfc/digital.h
+++ b/net/nfc/digital.h
@@ -72,6 +72,12 @@ void digital_poll_next_tech(struct nfc_digital_dev *ddev);
 
 int digital_in_send_sens_req(struct nfc_digital_dev *ddev, u8 rf_tech);
 int digital_in_send_sensf_req(struct nfc_digital_dev *ddev, u8 rf_tech);
+int digital_in_send_iso15693_inv_req(struct nfc_digital_dev *ddev, u8 rf_tech);
+
+int digital_in_iso_dep_pull_sod(struct nfc_digital_dev *ddev,
+                                struct sk_buff *skb);
+int digital_in_iso_dep_push_sod(struct nfc_digital_dev *ddev,
+                                struct sk_buff *skb);
 
 int digital_target_found(struct nfc_digital_dev *ddev,
                          struct nfc_target *target, u8 protocol);
diff --git a/net/nfc/digital_core.c b/net/nfc/digital_core.c
index c129d1571ca6..e01e15dbf1ab 100644
--- a/net/nfc/digital_core.c
+++ b/net/nfc/digital_core.c
@@ -25,6 +25,8 @@
 #define DIGITAL_PROTO_NFCF_RF_TECH \
         (NFC_PROTO_FELICA_MASK | NFC_PROTO_NFC_DEP_MASK)
 
+#define DIGITAL_PROTO_ISO15693_RF_TECH  NFC_PROTO_ISO15693_MASK
+
 struct digital_cmd {
         struct list_head queue;
 
@@ -331,6 +333,18 @@ int digital_target_found(struct nfc_digital_dev *ddev,
                 }
                 break;
 
+        case NFC_PROTO_ISO15693:
+                framing = NFC_DIGITAL_FRAMING_ISO15693_T5T;
+                check_crc = digital_skb_check_crc_b;
+                add_crc = digital_skb_add_crc_b;
+                break;
+
+        case NFC_PROTO_ISO14443:
+                framing = NFC_DIGITAL_FRAMING_NFCA_T4T;
+                check_crc = digital_skb_check_crc_a;
+                add_crc = digital_skb_add_crc_a;
+                break;
+
         default:
                 pr_err("Invalid protocol %d\n", protocol);
                 return -EINVAL;
@@ -461,7 +475,7 @@ static int digital_start_poll(struct nfc_dev *nfc_dev, __u32 im_protocols,
                 digital_add_poll_tech(ddev, NFC_DIGITAL_RF_TECH_106A,
                                       digital_in_send_sens_req);
 
-        if (im_protocols & DIGITAL_PROTO_NFCF_RF_TECH) {
+        if (matching_im_protocols & DIGITAL_PROTO_NFCF_RF_TECH) {
                 digital_add_poll_tech(ddev, NFC_DIGITAL_RF_TECH_212F,
                                       digital_in_send_sensf_req);
 
@@ -469,7 +483,11 @@ static int digital_start_poll(struct nfc_dev *nfc_dev, __u32 im_protocols,
                                       digital_in_send_sensf_req);
         }
 
-        if (tm_protocols & NFC_PROTO_NFC_DEP_MASK) {
+        if (matching_im_protocols & DIGITAL_PROTO_ISO15693_RF_TECH)
+                digital_add_poll_tech(ddev, NFC_DIGITAL_RF_TECH_ISO15693,
+                                      digital_in_send_iso15693_inv_req);
+
+        if (matching_tm_protocols & NFC_PROTO_NFC_DEP_MASK) {
                 if (ddev->ops->tg_listen_mdaa) {
                         digital_add_poll_tech(ddev, 0,
                                               digital_tg_listen_mdaa);
@@ -607,20 +625,30 @@ static void digital_in_send_complete(struct nfc_digital_dev *ddev, void *arg,
 
         if (IS_ERR(resp)) {
                 rc = PTR_ERR(resp);
+                resp = NULL;
                 goto done;
         }
 
-        if (ddev->curr_protocol == NFC_PROTO_MIFARE)
+        if (ddev->curr_protocol == NFC_PROTO_MIFARE) {
                 rc = digital_in_recv_mifare_res(resp);
-        else
-                rc = ddev->skb_check_crc(resp);
+                /* crc check is done in digital_in_recv_mifare_res() */
+                goto done;
+        }
 
+        if (ddev->curr_protocol == NFC_PROTO_ISO14443) {
+                rc = digital_in_iso_dep_pull_sod(ddev, resp);
+                if (rc)
+                        goto done;
+        }
+
+        rc = ddev->skb_check_crc(resp);
+
+done:
         if (rc) {
                 kfree_skb(resp);
                 resp = NULL;
         }
 
-done:
         data_exch->cb(data_exch->cb_context, resp, rc);
 
         kfree(data_exch);
@@ -632,6 +660,7 @@ static int digital_in_send(struct nfc_dev *nfc_dev, struct nfc_target *target,
 {
         struct nfc_digital_dev *ddev = nfc_get_drvdata(nfc_dev);
         struct digital_data_exch *data_exch;
+        int rc;
 
         data_exch = kzalloc(sizeof(struct digital_data_exch), GFP_KERNEL);
         if (!data_exch) {
@@ -642,13 +671,27 @@ static int digital_in_send(struct nfc_dev *nfc_dev, struct nfc_target *target,
         data_exch->cb = cb;
         data_exch->cb_context = cb_context;
 
-        if (ddev->curr_protocol == NFC_PROTO_NFC_DEP)
-                return digital_in_send_dep_req(ddev, target, skb, data_exch);
+        if (ddev->curr_protocol == NFC_PROTO_NFC_DEP) {
+                rc = digital_in_send_dep_req(ddev, target, skb, data_exch);
+                goto exit;
+        }
+
+        if (ddev->curr_protocol == NFC_PROTO_ISO14443) {
+                rc = digital_in_iso_dep_push_sod(ddev, skb);
+                if (rc)
+                        goto exit;
+        }
 
         ddev->skb_add_crc(skb);
 
-        return digital_in_send_cmd(ddev, skb, 500, digital_in_send_complete,
-                                   data_exch);
+        rc = digital_in_send_cmd(ddev, skb, 500, digital_in_send_complete,
+                                 data_exch);
+
+exit:
+        if (rc)
+                kfree(data_exch);
+
+        return rc;
 }
 
 static struct nfc_ops digital_nfc_ops = {
@@ -700,6 +743,10 @@ struct nfc_digital_dev *nfc_digital_allocate_device(struct nfc_digital_ops *ops,
                 ddev->protocols |= NFC_PROTO_FELICA_MASK;
         if (supported_protocols & NFC_PROTO_NFC_DEP_MASK)
                 ddev->protocols |= NFC_PROTO_NFC_DEP_MASK;
+        if (supported_protocols & NFC_PROTO_ISO15693_MASK)
+                ddev->protocols |= NFC_PROTO_ISO15693_MASK;
+        if (supported_protocols & NFC_PROTO_ISO14443_MASK)
+                ddev->protocols |= NFC_PROTO_ISO14443_MASK;
 
         ddev->tx_headroom = tx_headroom + DIGITAL_MAX_HEADER_LEN;
         ddev->tx_tailroom = tx_tailroom + DIGITAL_CRC_LEN;
diff --git a/net/nfc/digital_technology.c b/net/nfc/digital_technology.c
index 251c8c753ebe..278c3fed27e0 100644
--- a/net/nfc/digital_technology.c
+++ b/net/nfc/digital_technology.c
@@ -30,6 +30,7 @@
 
 #define DIGITAL_SEL_RES_NFCID1_COMPLETE(sel_res) (!((sel_res) & 0x04))
 #define DIGITAL_SEL_RES_IS_T2T(sel_res) (!((sel_res) & 0x60))
+#define DIGITAL_SEL_RES_IS_T4T(sel_res) ((sel_res) & 0x20)
 #define DIGITAL_SEL_RES_IS_NFC_DEP(sel_res) ((sel_res) & 0x40)
 
 #define DIGITAL_SENS_RES_IS_T1T(sens_res) (((sens_res) & 0x0C00) == 0x0C00)
@@ -51,6 +52,34 @@
 #define DIGITAL_SENSF_REQ_RC_SC   1
 #define DIGITAL_SENSF_REQ_RC_AP   2
 
+#define DIGITAL_CMD_ISO15693_INVENTORY_REQ      0x01
+
+#define DIGITAL_ISO15693_REQ_FLAG_DATA_RATE     BIT(1)
+#define DIGITAL_ISO15693_REQ_FLAG_INVENTORY     BIT(2)
+#define DIGITAL_ISO15693_REQ_FLAG_NB_SLOTS      BIT(5)
+#define DIGITAL_ISO15693_RES_FLAG_ERROR         BIT(0)
+#define DIGITAL_ISO15693_RES_IS_VALID(flags) \
+        (!((flags) & DIGITAL_ISO15693_RES_FLAG_ERROR))
+
+#define DIGITAL_ISO_DEP_I_PCB    0x02
+#define DIGITAL_ISO_DEP_PNI(pni) ((pni) & 0x01)
+
+#define DIGITAL_ISO_DEP_PCB_TYPE(pcb) ((pcb) & 0xC0)
+
+#define DIGITAL_ISO_DEP_I_BLOCK 0x00
+
+#define DIGITAL_ISO_DEP_BLOCK_HAS_DID(pcb) ((pcb) & 0x08)
+
+static const u8 digital_ats_fsc[] = {
+         16,  24,  32,  40,  48,  64,  96, 128,
+};
+
+#define DIGITAL_ATS_FSCI(t0) ((t0) & 0x0F)
+#define DIGITAL_ATS_MAX_FSC  256
+
+#define DIGITAL_RATS_BYTE1 0xE0
+#define DIGITAL_RATS_PARAM 0x80
+
 struct digital_sdd_res {
         u8 nfcid1[4];
         u8 bcc;
@@ -82,9 +111,127 @@ struct digital_sensf_res {
         u8 rd[2];
 } __packed;
 
+struct digital_iso15693_inv_req {
+        u8 flags;
+        u8 cmd;
+        u8 mask_len;
+        u64 mask;
+} __packed;
+
+struct digital_iso15693_inv_res {
+        u8 flags;
+        u8 dsfid;
+        u64 uid;
+} __packed;
+
 static int digital_in_send_sdd_req(struct nfc_digital_dev *ddev,
                                    struct nfc_target *target);
 
+int digital_in_iso_dep_pull_sod(struct nfc_digital_dev *ddev,
+                                struct sk_buff *skb)
+{
+        u8 pcb;
+        u8 block_type;
+
+        if (skb->len < 1)
+                return -EIO;
+
+        pcb = *skb->data;
+        block_type = DIGITAL_ISO_DEP_PCB_TYPE(pcb);
+
+        /* No support fo R-block nor S-block */
+        if (block_type != DIGITAL_ISO_DEP_I_BLOCK) {
+                pr_err("ISO_DEP R-block and S-block not supported\n");
+                return -EIO;
+        }
+
+        if (DIGITAL_ISO_DEP_BLOCK_HAS_DID(pcb)) {
+                pr_err("DID field in ISO_DEP PCB not supported\n");
+                return -EIO;
+        }
+
+        skb_pull(skb, 1);
+
+        return 0;
+}
+
+int digital_in_iso_dep_push_sod(struct nfc_digital_dev *ddev,
+                                struct sk_buff *skb)
+{
+        /*
+         * Chaining not supported so skb->len + 1 PCB byte + 2 CRC bytes must
+         * not be greater than remote FSC
+         */
+        if (skb->len + 3 > ddev->target_fsc)
+                return -EIO;
+
+        skb_push(skb, 1);
+
+        *skb->data = DIGITAL_ISO_DEP_I_PCB | ddev->curr_nfc_dep_pni;
+
+        ddev->curr_nfc_dep_pni =
+                DIGITAL_ISO_DEP_PNI(ddev->curr_nfc_dep_pni + 1);
+
+        return 0;
+}
+
+static void digital_in_recv_ats(struct nfc_digital_dev *ddev, void *arg,
+                                struct sk_buff *resp)
+{
+        struct nfc_target *target = arg;
+        u8 fsdi;
+        int rc;
+
+        if (IS_ERR(resp)) {
+                rc = PTR_ERR(resp);
+                resp = NULL;
+                goto exit;
+        }
+
+        if (resp->len < 2) {
+                rc = -EIO;
+                goto exit;
+        }
+
+        fsdi = DIGITAL_ATS_FSCI(resp->data[1]);
+        if (fsdi >= 8)
+                ddev->target_fsc = DIGITAL_ATS_MAX_FSC;
+        else
+                ddev->target_fsc = digital_ats_fsc[fsdi];
+
+        ddev->curr_nfc_dep_pni = 0;
+
+        rc = digital_target_found(ddev, target, NFC_PROTO_ISO14443);
+
+exit:
+        dev_kfree_skb(resp);
+        kfree(target);
+
+        if (rc)
+                digital_poll_next_tech(ddev);
+}
+
+static int digital_in_send_rats(struct nfc_digital_dev *ddev,
+                                struct nfc_target *target)
+{
+        int rc;
+        struct sk_buff *skb;
+
+        skb = digital_skb_alloc(ddev, 2);
+        if (!skb)
+                return -ENOMEM;
+
+        *skb_put(skb, 1) = DIGITAL_RATS_BYTE1;
+        *skb_put(skb, 1) = DIGITAL_RATS_PARAM;
+
+        rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_ats,
+                                 target);
+        if (rc)
+                kfree_skb(skb);
+
+        return rc;
+}
+
 static void digital_in_recv_sel_res(struct nfc_digital_dev *ddev, void *arg,
                                     struct sk_buff *resp)
 {
@@ -122,8 +269,19 @@ static void digital_in_recv_sel_res(struct nfc_digital_dev *ddev, void *arg,
                 goto exit_free_skb;
         }
 
+        target->sel_res = sel_res;
+
         if (DIGITAL_SEL_RES_IS_T2T(sel_res)) {
                 nfc_proto = NFC_PROTO_MIFARE;
+        } else if (DIGITAL_SEL_RES_IS_T4T(sel_res)) {
+                rc = digital_in_send_rats(ddev, target);
+                if (rc)
+                        goto exit;
+                /*
+                 * Skip target_found and don't free it for now. This will be
+                 * done when receiving the ATS
+                 */
+                goto exit_free_skb;
         } else if (DIGITAL_SEL_RES_IS_NFC_DEP(sel_res)) {
                 nfc_proto = NFC_PROTO_NFC_DEP;
         } else {
@@ -131,8 +289,6 @@ static void digital_in_recv_sel_res(struct nfc_digital_dev *ddev, void *arg,
                 goto exit;
         }
 
-        target->sel_res = sel_res;
-
         rc = digital_target_found(ddev, target, nfc_proto);
 
 exit:
@@ -473,6 +629,93 @@ int digital_in_send_sensf_req(struct nfc_digital_dev *ddev, u8 rf_tech)
         return rc;
 }
 
+static void digital_in_recv_iso15693_inv_res(struct nfc_digital_dev *ddev,
+                void *arg, struct sk_buff *resp)
+{
+        struct digital_iso15693_inv_res *res;
+        struct nfc_target *target = NULL;
+        int rc;
+
+        if (IS_ERR(resp)) {
+                rc = PTR_ERR(resp);
+                resp = NULL;
+                goto out_free_skb;
+        }
+
+        if (resp->len != sizeof(*res)) {
+                rc = -EIO;
+                goto out_free_skb;
+        }
+
+        res = (struct digital_iso15693_inv_res *)resp->data;
+
+        if (!DIGITAL_ISO15693_RES_IS_VALID(res->flags)) {
+                PROTOCOL_ERR("ISO15693 - 10.3.1");
+                rc = -EINVAL;
+                goto out_free_skb;
+        }
+
+        target = kzalloc(sizeof(*target), GFP_KERNEL);
+        if (!target) {
+                rc = -ENOMEM;
+                goto out_free_skb;
+        }
+
+        target->is_iso15693 = 1;
+        target->iso15693_dsfid = res->dsfid;
+        memcpy(target->iso15693_uid, &res->uid, sizeof(target->iso15693_uid));
+
+        rc = digital_target_found(ddev, target, NFC_PROTO_ISO15693);
+
+        kfree(target);
+
+out_free_skb:
+        dev_kfree_skb(resp);
+
+        if (rc)
+                digital_poll_next_tech(ddev);
+}
+
+int digital_in_send_iso15693_inv_req(struct nfc_digital_dev *ddev, u8 rf_tech)
+{
+        struct digital_iso15693_inv_req *req;
+        struct sk_buff *skb;
+        int rc;
+
+        rc = digital_in_configure_hw(ddev, NFC_DIGITAL_CONFIG_RF_TECH,
+                                     NFC_DIGITAL_RF_TECH_ISO15693);
+        if (rc)
+                return rc;
+
+        rc = digital_in_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,
+                                     NFC_DIGITAL_FRAMING_ISO15693_INVENTORY);
+        if (rc)
+                return rc;
+
+        skb = digital_skb_alloc(ddev, sizeof(*req));
+        if (!skb)
+                return -ENOMEM;
+
+        skb_put(skb, sizeof(*req) - sizeof(req->mask)); /* No mask */
+        req = (struct digital_iso15693_inv_req *)skb->data;
+
+        /* Single sub-carrier, high data rate, no AFI, single slot
+         * Inventory command
+         */
+        req->flags = DIGITAL_ISO15693_REQ_FLAG_DATA_RATE |
+                     DIGITAL_ISO15693_REQ_FLAG_INVENTORY |
+                     DIGITAL_ISO15693_REQ_FLAG_NB_SLOTS;
+        req->cmd = DIGITAL_CMD_ISO15693_INVENTORY_REQ;
+        req->mask_len = 0;
+
+        rc = digital_in_send_cmd(ddev, skb, 30,
+                                 digital_in_recv_iso15693_inv_res, NULL);
+        if (rc)
+                kfree_skb(skb);
+
+        return rc;
+}
+
 static int digital_tg_send_sel_res(struct nfc_digital_dev *ddev)
 {
         struct sk_buff *skb;
diff --git a/net/nfc/hci/llc.c b/net/nfc/hci/llc.c
index a07d2b818487..1b90c0531852 100644
--- a/net/nfc/hci/llc.c
+++ b/net/nfc/hci/llc.c
@@ -20,14 +20,12 @@
 
 #include "llc.h"
 
-static struct list_head llc_engines;
+static LIST_HEAD(llc_engines);
 
 int nfc_llc_init(void)
 {
         int r;
 
-        INIT_LIST_HEAD(&llc_engines);
-
         r = nfc_llc_nop_register();
         if (r)
                 goto exit;
diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index 6184bd1fba3a..b4671958fcf9 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -27,7 +27,7 @@
 
 static u8 llcp_magic[3] = {0x46, 0x66, 0x6d};
 
-static struct list_head llcp_devices;
+static LIST_HEAD(llcp_devices);
 
 static void nfc_llcp_rx_skb(struct nfc_llcp_local *local, struct sk_buff *skb);
 
@@ -293,9 +293,9 @@ static void nfc_llcp_sdreq_timer(unsigned long data)
 
 struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev)
 {
-        struct nfc_llcp_local *local, *n;
+        struct nfc_llcp_local *local;
 
-        list_for_each_entry_safe(local, n, &llcp_devices, list)
+        list_for_each_entry(local, &llcp_devices, list)
                 if (local->dev == dev)
                         return local;
 
@@ -609,14 +609,16 @@ u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
 
 int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len)
 {
-        struct nfc_llcp_local *local = nfc_llcp_find_local(dev);
+        struct nfc_llcp_local *local;
+
+        if (gb_len < 3 || gb_len > NFC_MAX_GT_LEN)
+                return -EINVAL;
 
+        local = nfc_llcp_find_local(dev);
         if (local == NULL) {
                 pr_err("No LLCP device\n");
                 return -ENODEV;
         }
-        if (gb_len < 3)
-                return -EINVAL;
 
         memset(local->remote_gb, 0, NFC_MAX_GT_LEN);
         memcpy(local->remote_gb, gb, gb_len);
@@ -974,7 +976,7 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local,
         new_sk->sk_state = LLCP_CONNECTED;
 
         /* Wake the listening processes */
-        parent->sk_data_ready(parent, 0);
+        parent->sk_data_ready(parent);
 
         /* Send CC */
         nfc_llcp_send_cc(new_sock);
@@ -1622,8 +1624,6 @@ void nfc_llcp_unregister_device(struct nfc_dev *dev)
 
 int __init nfc_llcp_init(void)
 {
-        INIT_LIST_HEAD(&llcp_devices);
-
         return nfc_llcp_sock_init();
 }
 
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 56db888b1cd5..6c34ac978501 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -74,7 +74,7 @@ static int __nci_request(struct nci_dev *ndev,
 
         ndev->req_status = NCI_REQ_PEND;
 
-        init_completion(&ndev->req_completion);
+        reinit_completion(&ndev->req_completion);
         req(ndev, opt);
         completion_rc =
                 wait_for_completion_interruptible_timeout(&ndev->req_completion,
@@ -709,6 +709,7 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops,
         ndev->ops = ops;
         ndev->tx_headroom = tx_headroom;
         ndev->tx_tailroom = tx_tailroom;
+        init_completion(&ndev->req_completion);
 
         ndev->nfc_dev = nfc_allocate_device(&nci_nfc_ops,
                                             supported_protocols,
diff --git a/net/nfc/nci/spi.c b/net/nfc/nci/spi.c
index f1d426f10cce..ec250e77763a 100644
--- a/net/nfc/nci/spi.c
+++ b/net/nfc/nci/spi.c
@@ -105,7 +105,7 @@ int nci_spi_send(struct nci_spi *nspi,
         if (ret != 0 || nspi->acknowledge_mode == NCI_SPI_CRC_DISABLED)
                 goto done;
 
-        init_completion(&nspi->req_completion);
+        reinit_completion(&nspi->req_completion);
         completion_rc = wait_for_completion_interruptible_timeout(
                                                         &nspi->req_completion,
                                                         NCI_SPI_SEND_TIMEOUT);
@@ -145,6 +145,7 @@ struct nci_spi *nci_spi_allocate_spi(struct spi_device *spi,
 
         nspi->spi = spi;
         nspi->ndev = ndev;
+        init_completion(&nspi->req_completion);
 
         return nspi;
 }
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index ebbf6fb88b35..43cb1c17e267 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -94,6 +94,14 @@ static int nfc_genl_send_target(struct sk_buff *msg, struct nfc_target *target,
                     target->sensf_res))
                 goto nla_put_failure;
 
+        if (target->is_iso15693) {
+                if (nla_put_u8(msg, NFC_ATTR_TARGET_ISO15693_DSFID,
+                               target->iso15693_dsfid) ||
+                    nla_put(msg, NFC_ATTR_TARGET_ISO15693_UID,
+                            sizeof(target->iso15693_uid), target->iso15693_uid))
+                        goto nla_put_failure;
+        }
+
         return genlmsg_end(msg, hdr);
 
 nla_put_failure:
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 270b77dfac30..a3276e3c4feb 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -256,10 +256,10 @@ void ovs_dp_process_received_packet(struct vport *p, struct sk_buff *skb)
 
 out:
         /* Update datapath statistics. */
-        u64_stats_update_begin(&stats->sync);
+        u64_stats_update_begin(&stats->syncp);
         (*stats_counter)++;
         stats->n_mask_hit += n_mask_hit;
-        u64_stats_update_end(&stats->sync);
+        u64_stats_update_end(&stats->syncp);
 }
 
 static struct genl_family dp_packet_genl_family = {
@@ -295,9 +295,9 @@ int ovs_dp_upcall(struct datapath *dp, struct sk_buff *skb,
 err:
         stats = this_cpu_ptr(dp->stats_percpu);
 
-        u64_stats_update_begin(&stats->sync);
+        u64_stats_update_begin(&stats->syncp);
         stats->n_lost++;
-        u64_stats_update_end(&stats->sync);
+        u64_stats_update_end(&stats->syncp);
 
         return err;
 }
@@ -610,9 +610,9 @@ static void get_dp_stats(struct datapath *dp, struct ovs_dp_stats *stats,
                 percpu_stats = per_cpu_ptr(dp->stats_percpu, i);
 
                 do {
-                        start = u64_stats_fetch_begin_bh(&percpu_stats->sync);
+                        start = u64_stats_fetch_begin_irq(&percpu_stats->syncp);
                         local_stats = *percpu_stats;
-                } while (u64_stats_fetch_retry_bh(&percpu_stats->sync, start));
+                } while (u64_stats_fetch_retry_irq(&percpu_stats->syncp, start));
 
                 stats->n_hit += local_stats.n_hit;
                 stats->n_missed += local_stats.n_missed;
@@ -1219,18 +1219,12 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto err_free_dp;
 
-        dp->stats_percpu = alloc_percpu(struct dp_stats_percpu);
+        dp->stats_percpu = netdev_alloc_pcpu_stats(struct dp_stats_percpu);
         if (!dp->stats_percpu) {
                 err = -ENOMEM;
                 goto err_destroy_table;
         }
 
-        for_each_possible_cpu(i) {
-                struct dp_stats_percpu *dpath_stats;
-                dpath_stats = per_cpu_ptr(dp->stats_percpu, i);
-                u64_stats_init(&dpath_stats->sync);
-        }
-
         dp->ports = kmalloc(DP_VPORT_HASH_BUCKETS * sizeof(struct hlist_head),
                             GFP_KERNEL);
         if (!dp->ports) {
diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h
index 6be9fbb5e9cb..05317380fc03 100644
--- a/net/openvswitch/datapath.h
+++ b/net/openvswitch/datapath.h
@@ -55,7 +55,7 @@ struct dp_stats_percpu {
         u64 n_missed;
         u64 n_lost;
         u64 n_mask_hit;
-        struct u64_stats_sync sync;
+        struct u64_stats_sync syncp;
 };
 
 /**
diff --git a/net/openvswitch/vport-gre.c b/net/openvswitch/vport-gre.c
index a3d6951602db..ebb6e2442554 100644
--- a/net/openvswitch/vport-gre.c
+++ b/net/openvswitch/vport-gre.c
@@ -174,7 +174,7 @@ static int gre_tnl_send(struct vport *vport, struct sk_buff *skb)
 
         skb->local_df = 1;
 
-        return iptunnel_xmit(rt, skb, fl.saddr,
+        return iptunnel_xmit(skb->sk, rt, skb, fl.saddr,
                              OVS_CB(skb)->tun_key->ipv4_dst, IPPROTO_GRE,
                              OVS_CB(skb)->tun_key->ipv4_tos,
                              OVS_CB(skb)->tun_key->ipv4_ttl, df, false);
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index 208dd9a26dd1..42c0f4a0b78c 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -121,7 +121,6 @@ struct vport *ovs_vport_alloc(int priv_size, const struct vport_ops *ops,
 {
         struct vport *vport;
         size_t alloc_size;
-        int i;
 
         alloc_size = sizeof(struct vport);
         if (priv_size) {
@@ -139,19 +138,12 @@ struct vport *ovs_vport_alloc(int priv_size, const struct vport_ops *ops,
         vport->ops = ops;
         INIT_HLIST_NODE(&vport->dp_hash_node);
 
-        vport->percpu_stats = alloc_percpu(struct pcpu_sw_netstats);
+        vport->percpu_stats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!vport->percpu_stats) {
                 kfree(vport);
                 return ERR_PTR(-ENOMEM);
         }
 
-        for_each_possible_cpu(i) {
-                struct pcpu_sw_netstats *vport_stats;
-                vport_stats = per_cpu_ptr(vport->percpu_stats, i);
-                u64_stats_init(&vport_stats->syncp);
-        }
-
-
         spin_lock_init(&vport->stats_lock);
 
         return vport;
@@ -285,9 +277,9 @@ void ovs_vport_get_stats(struct vport *vport, struct ovs_vport_stats *stats)
                 percpu_stats = per_cpu_ptr(vport->percpu_stats, i);
 
                 do {
-                        start = u64_stats_fetch_begin_bh(&percpu_stats->syncp);
+                        start = u64_stats_fetch_begin_irq(&percpu_stats->syncp);
                         local_stats = *percpu_stats;
-                } while (u64_stats_fetch_retry_bh(&percpu_stats->syncp, start));
+                } while (u64_stats_fetch_retry_irq(&percpu_stats->syncp, start));
 
                 stats->rx_bytes         += local_stats.rx_bytes;
                 stats->rx_packets       += local_stats.rx_packets;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 48a6a93db296..b85c67ccb797 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -243,40 +243,41 @@ static int packet_direct_xmit(struct sk_buff *skb)
         const struct net_device_ops *ops = dev->netdev_ops;
         netdev_features_t features;
         struct netdev_queue *txq;
+        int ret = NETDEV_TX_BUSY;
         u16 queue_map;
-        int ret;
 
         if (unlikely(!netif_running(dev) ||
-                     !netif_carrier_ok(dev))) {
-                kfree_skb(skb);
-                return NET_XMIT_DROP;
-        }
+                     !netif_carrier_ok(dev)))
+                goto drop;
 
         features = netif_skb_features(skb);
         if (skb_needs_linearize(skb, features) &&
-            __skb_linearize(skb)) {
-                kfree_skb(skb);
-                return NET_XMIT_DROP;
-        }
+            __skb_linearize(skb))
+                goto drop;
 
         queue_map = skb_get_queue_mapping(skb);
         txq = netdev_get_tx_queue(dev, queue_map);
 
-        __netif_tx_lock_bh(txq);
-        if (unlikely(netif_xmit_frozen_or_stopped(txq))) {
-                ret = NETDEV_TX_BUSY;
-                kfree_skb(skb);
-                goto out;
+        local_bh_disable();
+
+        HARD_TX_LOCK(dev, txq, smp_processor_id());
+        if (!netif_xmit_frozen_or_drv_stopped(txq)) {
+                ret = ops->ndo_start_xmit(skb, dev);
+                if (ret == NETDEV_TX_OK)
+                        txq_trans_update(txq);
         }
+        HARD_TX_UNLOCK(dev, txq);
 
-        ret = ops->ndo_start_xmit(skb, dev);
-        if (likely(dev_xmit_complete(ret)))
-                txq_trans_update(txq);
-        else
+        local_bh_enable();
+
+        if (!dev_xmit_complete(ret))
                 kfree_skb(skb);
-out:
-        __netif_tx_unlock_bh(txq);
+
         return ret;
+drop:
+        atomic_long_inc(&dev->tx_dropped);
+        kfree_skb(skb);
+        return NET_XMIT_DROP;
 }
 
 static struct net_device *packet_cached_dev_get(struct packet_sock *po)
@@ -1277,7 +1278,7 @@ static unsigned int fanout_demux_hash(struct packet_fanout *f,
                                       struct sk_buff *skb,
                                       unsigned int num)
 {
-        return reciprocal_scale(skb->rxhash, num);
+        return reciprocal_scale(skb_get_hash(skb), num);
 }
 
 static unsigned int fanout_demux_lb(struct packet_fanout *f,
@@ -1362,7 +1363,6 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
                         if (!skb)
                                 return 0;
                 }
-                skb_get_hash(skb);
                 idx = fanout_demux_hash(f, skb, num);
                 break;
         case PACKET_FANOUT_LB:
@@ -1848,7 +1848,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
         skb->dropcount = atomic_read(&sk->sk_drops);
         __skb_queue_tail(&sk->sk_receive_queue, skb);
         spin_unlock(&sk->sk_receive_queue.lock);
-        sk->sk_data_ready(sk, skb->len);
+        sk->sk_data_ready(sk);
         return 0;
 
 drop_n_acct:
@@ -2054,7 +2054,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
         else
                 prb_clear_blk_fill_status(&po->rx_ring);
 
-        sk->sk_data_ready(sk, 0);
+        sk->sk_data_ready(sk);
 
 drop_n_restore:
         if (skb_head != skb->data && skb_shared(skb)) {
@@ -2069,7 +2069,7 @@ ring_is_full:
         po->stats.stats1.tp_drops++;
         spin_unlock(&sk->sk_receive_queue.lock);
 
-        sk->sk_data_ready(sk, 0);
+        sk->sk_data_ready(sk);
         kfree_skb(copy_skb);
         goto drop_n_restore;
 }
@@ -2257,8 +2257,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
         if (unlikely(!(dev->flags & IFF_UP)))
                 goto out_put;
 
-        reserve = dev->hard_header_len;
-
+        reserve = dev->hard_header_len + VLAN_HLEN;
         size_max = po->tx_ring.frame_size
                 - (po->tp_hdrlen - sizeof(struct sockaddr_ll));
 
@@ -2285,8 +2284,19 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                         goto out_status;
 
                 tp_len = tpacket_fill_skb(po, skb, ph, dev, size_max, proto,
-                                addr, hlen);
+                                          addr, hlen);
+                if (tp_len > dev->mtu + dev->hard_header_len) {
+                        struct ethhdr *ehdr;
+                        /* Earlier code assumed this would be a VLAN pkt,
+                         * double-check this now that we have the actual
+                         * packet in hand.
+                         */
 
+                        skb_reset_mac_header(skb);
+                        ehdr = eth_hdr(skb);
+                        if (ehdr->h_proto != htons(ETH_P_8021Q))
+                                tp_len = -EMSGSIZE;
+                }
                 if (unlikely(tp_len < 0)) {
                         if (po->tp_loss) {
                                 __packet_set_status(po, ph,
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index a2fba7edfd1f..66dc65e7c6a1 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -37,7 +37,7 @@
 struct gprs_dev {
         struct sock             *sk;
         void                    (*old_state_change)(struct sock *);
-        void                    (*old_data_ready)(struct sock *, int);
+        void                    (*old_data_ready)(struct sock *);
         void                    (*old_write_space)(struct sock *);
 
         struct net_device       *dev;
@@ -146,7 +146,7 @@ drop:
         return err;
 }
 
-static void gprs_data_ready(struct sock *sk, int len)
+static void gprs_data_ready(struct sock *sk)
 {
         struct gprs_dev *gp = sk->sk_user_data;
         struct sk_buff *skb;
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index e77411735de8..70a547ea5177 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -462,10 +462,9 @@ out:
 queue:
         skb->dev = NULL;
         skb_set_owner_r(skb, sk);
-        err = skb->len;
         skb_queue_tail(queue, skb);
         if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk, err);
+                sk->sk_data_ready(sk);
         return NET_RX_SUCCESS;
 }
 
@@ -587,10 +586,9 @@ static int pipe_handler_do_rcv(struct sock *sk, struct sk_buff *skb)
                 pn->rx_credits--;
                 skb->dev = NULL;
                 skb_set_owner_r(skb, sk);
-                err = skb->len;
                 skb_queue_tail(&sk->sk_receive_queue, skb);
                 if (!sock_flag(sk, SOCK_DEAD))
-                        sk->sk_data_ready(sk, err);
+                        sk->sk_data_ready(sk);
                 return NET_RX_SUCCESS;
 
         case PNS_PEP_CONNECT_RESP:
@@ -698,7 +696,7 @@ static int pep_do_rcv(struct sock *sk, struct sk_buff *skb)
                 skb_queue_head(&sk->sk_receive_queue, skb);
                 sk_acceptq_added(sk);
                 if (!sock_flag(sk, SOCK_DEAD))
-                        sk->sk_data_ready(sk, 0);
+                        sk->sk_data_ready(sk);
                 return NET_RX_SUCCESS;
 
         case PNS_PEP_DISCONNECT_REQ:
diff --git a/net/rds/iw.c b/net/rds/iw.c
index 7826d46baa70..589935661d66 100644
--- a/net/rds/iw.c
+++ b/net/rds/iw.c
@@ -239,7 +239,8 @@ static int rds_iw_laddr_check(__be32 addr)
         ret = rdma_bind_addr(cm_id, (struct sockaddr *)&sin);
         /* due to this, we will claim to support IB devices unless we
            check node_type. */
-        if (ret || cm_id->device->node_type != RDMA_NODE_RNIC)
+        if (ret || !cm_id->device ||
+            cm_id->device->node_type != RDMA_NODE_RNIC)
                 ret = -EADDRNOTAVAIL;
 
         rdsdebug("addr %pI4 ret %d node type %d\n",
diff --git a/net/rds/tcp.h b/net/rds/tcp.h
index 9cf2927d0021..65637491f728 100644
--- a/net/rds/tcp.h
+++ b/net/rds/tcp.h
@@ -61,12 +61,12 @@ void rds_tcp_state_change(struct sock *sk);
 /* tcp_listen.c */
 int rds_tcp_listen_init(void);
 void rds_tcp_listen_stop(void);
-void rds_tcp_listen_data_ready(struct sock *sk, int bytes);
+void rds_tcp_listen_data_ready(struct sock *sk);
 
 /* tcp_recv.c */
 int rds_tcp_recv_init(void);
 void rds_tcp_recv_exit(void);
-void rds_tcp_data_ready(struct sock *sk, int bytes);
+void rds_tcp_data_ready(struct sock *sk);
 int rds_tcp_recv(struct rds_connection *conn);
 void rds_tcp_inc_free(struct rds_incoming *inc);
 int rds_tcp_inc_copy_to_user(struct rds_incoming *inc, struct iovec *iov,
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 7787537e9c2e..4e638f851185 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -108,9 +108,9 @@ static void rds_tcp_accept_worker(struct work_struct *work)
                 cond_resched();
 }
 
-void rds_tcp_listen_data_ready(struct sock *sk, int bytes)
+void rds_tcp_listen_data_ready(struct sock *sk)
 {
-        void (*ready)(struct sock *sk, int bytes);
+        void (*ready)(struct sock *sk);
 
         rdsdebug("listen data ready sk %p\n", sk);
 
@@ -132,7 +132,7 @@ void rds_tcp_listen_data_ready(struct sock *sk, int bytes)
 
 out:
         read_unlock(&sk->sk_callback_lock);
-        ready(sk, bytes);
+        ready(sk);
 }
 
 int rds_tcp_listen_init(void)
diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c
index 4fac4f2bb9dc..9ae6e0a264ec 100644
--- a/net/rds/tcp_recv.c
+++ b/net/rds/tcp_recv.c
@@ -314,13 +314,13 @@ int rds_tcp_recv(struct rds_connection *conn)
         return ret;
 }
 
-void rds_tcp_data_ready(struct sock *sk, int bytes)
+void rds_tcp_data_ready(struct sock *sk)
 {
-        void (*ready)(struct sock *sk, int bytes);
+        void (*ready)(struct sock *sk);
         struct rds_connection *conn;
         struct rds_tcp_connection *tc;
 
-        rdsdebug("data ready sk %p bytes %d\n", sk, bytes);
+        rdsdebug("data ready sk %p\n", sk);
 
         read_lock(&sk->sk_callback_lock);
         conn = sk->sk_user_data;
@@ -337,7 +337,7 @@ void rds_tcp_data_ready(struct sock *sk, int bytes)
                 queue_delayed_work(rds_wq, &conn->c_recv_w, 0);
 out:
         read_unlock(&sk->sk_callback_lock);
-        ready(sk, bytes);
+        ready(sk);
 }
 
 int rds_tcp_recv_init(void)
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index ed7e0b4e7f90..b3b16c070a7f 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -789,7 +789,8 @@ void rfkill_resume_polling(struct rfkill *rfkill)
         if (!rfkill->ops->poll)
                 return;
 
-        schedule_work(&rfkill->poll_work.work);
+        queue_delayed_work(system_power_efficient_wq,
+                           &rfkill->poll_work, 0);
 }
 EXPORT_SYMBOL(rfkill_resume_polling);
 
@@ -894,7 +895,8 @@ static void rfkill_poll(struct work_struct *work)
          */
         rfkill->ops->poll(rfkill, rfkill->data);
 
-        schedule_delayed_work(&rfkill->poll_work,
+        queue_delayed_work(system_power_efficient_wq,
+                &rfkill->poll_work,
                 round_jiffies_relative(POLL_INTERVAL));
 }
 
@@ -958,7 +960,8 @@ int __must_check rfkill_register(struct rfkill *rfkill)
         INIT_WORK(&rfkill->sync_work, rfkill_sync_work);
 
         if (rfkill->ops->poll)
-                schedule_delayed_work(&rfkill->poll_work,
+                queue_delayed_work(system_power_efficient_wq,
+                        &rfkill->poll_work,
                         round_jiffies_relative(POLL_INTERVAL));
 
         if (!rfkill->persistent || rfkill_epo_lock_active) {
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index c2cca2ee6aef..8451c8cdc9de 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1041,7 +1041,7 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
         rose_start_heartbeat(make);
 
         if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk, skb->len);
+                sk->sk_data_ready(sk);
 
         return 1;
 }
diff --git a/net/rxrpc/Makefile b/net/rxrpc/Makefile
index d1c3429b69ed..ec126f91276b 100644
--- a/net/rxrpc/Makefile
+++ b/net/rxrpc/Makefile
@@ -20,9 +20,8 @@ af-rxrpc-y := \
         ar-skbuff.o \
         ar-transport.o
 
-ifeq ($(CONFIG_PROC_FS),y)
-af-rxrpc-y += ar-proc.o
-endif
+af-rxrpc-$(CONFIG_PROC_FS) += ar-proc.o
+af-rxrpc-$(CONFIG_SYSCTL) += sysctl.o
 
 obj-$(CONFIG_AF_RXRPC) += af-rxrpc.o
 
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index e61aa6001c65..7b1670489638 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -838,6 +838,12 @@ static int __init af_rxrpc_init(void)
                 goto error_key_type_s;
         }
 
+        ret = rxrpc_sysctl_init();
+        if (ret < 0) {
+                printk(KERN_CRIT "RxRPC: Cannot register sysctls\n");
+                goto error_sysctls;
+        }
+
 #ifdef CONFIG_PROC_FS
         proc_create("rxrpc_calls", 0, init_net.proc_net, &rxrpc_call_seq_fops);
         proc_create("rxrpc_conns", 0, init_net.proc_net,
@@ -845,6 +851,8 @@ static int __init af_rxrpc_init(void)
 #endif
         return 0;
 
+error_sysctls:
+        unregister_key_type(&key_type_rxrpc_s);
 error_key_type_s:
         unregister_key_type(&key_type_rxrpc);
 error_key_type:
@@ -865,6 +873,7 @@ error_call_jar:
 static void __exit af_rxrpc_exit(void)
 {
         _enter("");
+        rxrpc_sysctl_exit();
         unregister_key_type(&key_type_rxrpc_s);
         unregister_key_type(&key_type_rxrpc);
         sock_unregister(PF_RXRPC);
diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
index cd97a0ce48d8..c6be17a959a6 100644
--- a/net/rxrpc/ar-ack.c
+++ b/net/rxrpc/ar-ack.c
@@ -19,7 +19,49 @@
 #include <net/af_rxrpc.h>
 #include "ar-internal.h"
 
-static unsigned int rxrpc_ack_defer = 1;
+/*
+ * How long to wait before scheduling ACK generation after seeing a
+ * packet with RXRPC_REQUEST_ACK set (in jiffies).
+ */
+unsigned rxrpc_requested_ack_delay = 1;
+
+/*
+ * How long to wait before scheduling an ACK with subtype DELAY (in jiffies).
+ *
+ * We use this when we've received new data packets.  If those packets aren't
+ * all consumed within this time we will send a DELAY ACK if an ACK was not
+ * requested to let the sender know it doesn't need to resend.
+ */
+unsigned rxrpc_soft_ack_delay = 1 * HZ;
+
+/*
+ * How long to wait before scheduling an ACK with subtype IDLE (in jiffies).
+ *
+ * We use this when we've consumed some previously soft-ACK'd packets when
+ * further packets aren't immediately received to decide when to send an IDLE
+ * ACK let the other end know that it can free up its Tx buffer space.
+ */
+unsigned rxrpc_idle_ack_delay = 0.5 * HZ;
+
+/*
+ * Receive window size in packets.  This indicates the maximum number of
+ * unconsumed received packets we're willing to retain in memory.  Once this
+ * limit is hit, we should generate an EXCEEDS_WINDOW ACK and discard further
+ * packets.
+ */
+unsigned rxrpc_rx_window_size = 32;
+
+/*
+ * Maximum Rx MTU size.  This indicates to the sender the size of jumbo packet
+ * made by gluing normal packets together that we're willing to handle.
+ */
+unsigned rxrpc_rx_mtu = 5692;
+
+/*
+ * The maximum number of fragments in a received jumbo packet that we tell the
+ * sender that we're willing to handle.
+ */
+unsigned rxrpc_rx_jumbo_max = 4;
 
 static const char *rxrpc_acks(u8 reason)
 {
@@ -82,24 +124,23 @@ void __rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
         switch (ack_reason) {
         case RXRPC_ACK_DELAY:
                 _debug("run delay timer");
-                call->ack_timer.expires = jiffies + rxrpc_ack_timeout * HZ;
-                add_timer(&call->ack_timer);
-                return;
+                expiry = rxrpc_soft_ack_delay;
+                goto run_timer;
 
         case RXRPC_ACK_IDLE:
                 if (!immediate) {
                         _debug("run defer timer");
-                        expiry = 1;
+                        expiry = rxrpc_idle_ack_delay;
                         goto run_timer;
                 }
                 goto cancel_timer;
 
         case RXRPC_ACK_REQUESTED:
-                if (!rxrpc_ack_defer)
+                expiry = rxrpc_requested_ack_delay;
+                if (!expiry)
                         goto cancel_timer;
                 if (!immediate || serial == cpu_to_be32(1)) {
                         _debug("run defer timer");
-                        expiry = rxrpc_ack_defer;
                         goto run_timer;
                 }
 
@@ -1174,11 +1215,11 @@ send_ACK:
         mtu = call->conn->trans->peer->if_mtu;
         mtu -= call->conn->trans->peer->hdrsize;
         ackinfo.maxMTU  = htonl(mtu);
-        ackinfo.rwind   = htonl(32);
+        ackinfo.rwind   = htonl(rxrpc_rx_window_size);
 
         /* permit the peer to send us jumbo packets if it wants to */
-        ackinfo.rxMTU   = htonl(5692);
-        ackinfo.jumbo_max = htonl(4);
+        ackinfo.rxMTU   = htonl(rxrpc_rx_mtu);
+        ackinfo.jumbo_max = htonl(rxrpc_rx_jumbo_max);
 
         hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
         _proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
diff --git a/net/rxrpc/ar-call.c b/net/rxrpc/ar-call.c
index a3bbb360a3f9..a9e05db0f5d5 100644
--- a/net/rxrpc/ar-call.c
+++ b/net/rxrpc/ar-call.c
@@ -12,10 +12,22 @@
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/circ_buf.h>
+#include <linux/hashtable.h>
+#include <linux/spinlock_types.h>
 #include <net/sock.h>
 #include <net/af_rxrpc.h>
 #include "ar-internal.h"
 
+/*
+ * Maximum lifetime of a call (in jiffies).
+ */
+unsigned rxrpc_max_call_lifetime = 60 * HZ;
+
+/*
+ * Time till dead call expires after last use (in jiffies).
+ */
+unsigned rxrpc_dead_call_expiry = 2 * HZ;
+
 const char *const rxrpc_call_states[] = {
         [RXRPC_CALL_CLIENT_SEND_REQUEST]        = "ClSndReq",
         [RXRPC_CALL_CLIENT_AWAIT_REPLY]         = "ClAwtRpl",
@@ -38,8 +50,6 @@ const char *const rxrpc_call_states[] = {
 struct kmem_cache *rxrpc_call_jar;
 LIST_HEAD(rxrpc_calls);
 DEFINE_RWLOCK(rxrpc_call_lock);
-static unsigned int rxrpc_call_max_lifetime = 60;
-static unsigned int rxrpc_dead_call_timeout = 2;
 
 static void rxrpc_destroy_call(struct work_struct *work);
 static void rxrpc_call_life_expired(unsigned long _call);
@@ -47,6 +57,145 @@ static void rxrpc_dead_call_expired(unsigned long _call);
 static void rxrpc_ack_time_expired(unsigned long _call);
 static void rxrpc_resend_time_expired(unsigned long _call);
 
+static DEFINE_SPINLOCK(rxrpc_call_hash_lock);
+static DEFINE_HASHTABLE(rxrpc_call_hash, 10);
+
+/*
+ * Hash function for rxrpc_call_hash
+ */
+static unsigned long rxrpc_call_hashfunc(
+        u8              clientflag,
+        __be32          cid,
+        __be32          call_id,
+        __be32          epoch,
+        __be16          service_id,
+        sa_family_t     proto,
+        void            *localptr,
+        unsigned int    addr_size,
+        const u8        *peer_addr)
+{
+        const u16 *p;
+        unsigned int i;
+        unsigned long key;
+        u32 hcid = ntohl(cid);
+
+        _enter("");
+
+        key = (unsigned long)localptr;
+        /* We just want to add up the __be32 values, so forcing the
+         * cast should be okay.
+         */
+        key += (__force u32)epoch;
+        key += (__force u16)service_id;
+        key += (__force u32)call_id;
+        key += (hcid & RXRPC_CIDMASK) >> RXRPC_CIDSHIFT;
+        key += hcid & RXRPC_CHANNELMASK;
+        key += clientflag;
+        key += proto;
+        /* Step through the peer address in 16-bit portions for speed */
+        for (i = 0, p = (const u16 *)peer_addr; i < addr_size >> 1; i++, p++)
+                key += *p;
+        _leave(" key = 0x%lx", key);
+        return key;
+}
+
+/*
+ * Add a call to the hashtable
+ */
+static void rxrpc_call_hash_add(struct rxrpc_call *call)
+{
+        unsigned long key;
+        unsigned int addr_size = 0;
+
+        _enter("");
+        switch (call->proto) {
+        case AF_INET:
+                addr_size = sizeof(call->peer_ip.ipv4_addr);
+                break;
+        case AF_INET6:
+                addr_size = sizeof(call->peer_ip.ipv6_addr);
+                break;
+        default:
+                break;
+        }
+        key = rxrpc_call_hashfunc(call->in_clientflag, call->cid,
+                                  call->call_id, call->epoch,
+                                  call->service_id, call->proto,
+                                  call->conn->trans->local, addr_size,
+                                  call->peer_ip.ipv6_addr);
+        /* Store the full key in the call */
+        call->hash_key = key;
+        spin_lock(&rxrpc_call_hash_lock);
+        hash_add_rcu(rxrpc_call_hash, &call->hash_node, key);
+        spin_unlock(&rxrpc_call_hash_lock);
+        _leave("");
+}
+
+/*
+ * Remove a call from the hashtable
+ */
+static void rxrpc_call_hash_del(struct rxrpc_call *call)
+{
+        _enter("");
+        spin_lock(&rxrpc_call_hash_lock);
+        hash_del_rcu(&call->hash_node);
+        spin_unlock(&rxrpc_call_hash_lock);
+        _leave("");
+}
+
+/*
+ * Find a call in the hashtable and return it, or NULL if it
+ * isn't there.
+ */
+struct rxrpc_call *rxrpc_find_call_hash(
+        u8              clientflag,
+        __be32          cid,
+        __be32          call_id,
+        __be32          epoch,
+        __be16          service_id,
+        void            *localptr,
+        sa_family_t     proto,
+        const u8        *peer_addr)
+{
+        unsigned long key;
+        unsigned int addr_size = 0;
+        struct rxrpc_call *call = NULL;
+        struct rxrpc_call *ret = NULL;
+
+        _enter("");
+        switch (proto) {
+        case AF_INET:
+                addr_size = sizeof(call->peer_ip.ipv4_addr);
+                break;
+        case AF_INET6:
+                addr_size = sizeof(call->peer_ip.ipv6_addr);
+                break;
+        default:
+                break;
+        }
+
+        key = rxrpc_call_hashfunc(clientflag, cid, call_id, epoch,
+                                  service_id, proto, localptr, addr_size,
+                                  peer_addr);
+        hash_for_each_possible_rcu(rxrpc_call_hash, call, hash_node, key) {
+                if (call->hash_key == key &&
+                    call->call_id == call_id &&
+                    call->cid == cid &&
+                    call->in_clientflag == clientflag &&
+                    call->service_id == service_id &&
+                    call->proto == proto &&
+                    call->local == localptr &&
+                    memcmp(call->peer_ip.ipv6_addr, peer_addr,
+                              addr_size) == 0 &&
+                    call->epoch == epoch) {
+                        ret = call;
+                        break;
+                }
+        }
+        _leave(" = %p", ret);
+        return ret;
+}
+
 /*
  * allocate a new call
  */
@@ -91,7 +240,7 @@ static struct rxrpc_call *rxrpc_alloc_call(gfp_t gfp)
         call->rx_data_expect = 1;
         call->rx_data_eaten = 0;
         call->rx_first_oos = 0;
-        call->ackr_win_top = call->rx_data_eaten + 1 + RXRPC_MAXACKS;
+        call->ackr_win_top = call->rx_data_eaten + 1 + rxrpc_rx_window_size;
         call->creation_jif = jiffies;
         return call;
 }
@@ -128,11 +277,31 @@ static struct rxrpc_call *rxrpc_alloc_client_call(
                 return ERR_PTR(ret);
         }
 
+        /* Record copies of information for hashtable lookup */
+        call->proto = rx->proto;
+        call->local = trans->local;
+        switch (call->proto) {
+        case AF_INET:
+                call->peer_ip.ipv4_addr =
+                        trans->peer->srx.transport.sin.sin_addr.s_addr;
+                break;
+        case AF_INET6:
+                memcpy(call->peer_ip.ipv6_addr,
+                       trans->peer->srx.transport.sin6.sin6_addr.in6_u.u6_addr8,
+                       sizeof(call->peer_ip.ipv6_addr));
+                break;
+        }
+        call->epoch = call->conn->epoch;
+        call->service_id = call->conn->service_id;
+        call->in_clientflag = call->conn->in_clientflag;
+        /* Add the new call to the hashtable */
+        rxrpc_call_hash_add(call);
+
         spin_lock(&call->conn->trans->peer->lock);
         list_add(&call->error_link, &call->conn->trans->peer->error_targets);
         spin_unlock(&call->conn->trans->peer->lock);
 
-        call->lifetimer.expires = jiffies + rxrpc_call_max_lifetime * HZ;
+        call->lifetimer.expires = jiffies + rxrpc_max_call_lifetime;
         add_timer(&call->lifetimer);
 
         _leave(" = %p", call);
@@ -320,9 +489,12 @@ struct rxrpc_call *rxrpc_incoming_call(struct rxrpc_sock *rx,
                 parent = *p;
                 call = rb_entry(parent, struct rxrpc_call, conn_node);
 
-                if (call_id < call->call_id)
+                /* The tree is sorted in order of the __be32 value without
+                 * turning it into host order.
+                 */
+                if ((__force u32)call_id < (__force u32)call->call_id)
                         p = &(*p)->rb_left;
-                else if (call_id > call->call_id)
+                else if ((__force u32)call_id > (__force u32)call->call_id)
                         p = &(*p)->rb_right;
                 else
                         goto old_call;
@@ -347,9 +519,31 @@ struct rxrpc_call *rxrpc_incoming_call(struct rxrpc_sock *rx,
         list_add_tail(&call->link, &rxrpc_calls);
         write_unlock_bh(&rxrpc_call_lock);
 
+        /* Record copies of information for hashtable lookup */
+        call->proto = rx->proto;
+        call->local = conn->trans->local;
+        switch (call->proto) {
+        case AF_INET:
+                call->peer_ip.ipv4_addr =
+                        conn->trans->peer->srx.transport.sin.sin_addr.s_addr;
+                break;
+        case AF_INET6:
+                memcpy(call->peer_ip.ipv6_addr,
+                       conn->trans->peer->srx.transport.sin6.sin6_addr.in6_u.u6_addr8,
+                       sizeof(call->peer_ip.ipv6_addr));
+                break;
+        default:
+                break;
+        }
+        call->epoch = conn->epoch;
+        call->service_id = conn->service_id;
+        call->in_clientflag = conn->in_clientflag;
+        /* Add the new call to the hashtable */
+        rxrpc_call_hash_add(call);
+
         _net("CALL incoming %d on CONN %d", call->debug_id, call->conn->debug_id);
 
-        call->lifetimer.expires = jiffies + rxrpc_call_max_lifetime * HZ;
+        call->lifetimer.expires = jiffies + rxrpc_max_call_lifetime;
         add_timer(&call->lifetimer);
         _leave(" = %p {%d} [new]", call, call->debug_id);
         return call;
@@ -533,7 +727,7 @@ void rxrpc_release_call(struct rxrpc_call *call)
         del_timer_sync(&call->resend_timer);
         del_timer_sync(&call->ack_timer);
         del_timer_sync(&call->lifetimer);
-        call->deadspan.expires = jiffies + rxrpc_dead_call_timeout * HZ;
+        call->deadspan.expires = jiffies + rxrpc_dead_call_expiry;
         add_timer(&call->deadspan);
 
         _leave("");
@@ -665,6 +859,9 @@ static void rxrpc_cleanup_call(struct rxrpc_call *call)
                 rxrpc_put_connection(call->conn);
         }
 
+        /* Remove the call from the hash */
+        rxrpc_call_hash_del(call);
+
         if (call->acks_window) {
                 _debug("kill Tx window %d",
                        CIRC_CNT(call->acks_head, call->acks_tail,
diff --git a/net/rxrpc/ar-connection.c b/net/rxrpc/ar-connection.c
index 7bf5b5b9e8b9..6631f4f1e39b 100644
--- a/net/rxrpc/ar-connection.c
+++ b/net/rxrpc/ar-connection.c
@@ -18,11 +18,15 @@
 #include <net/af_rxrpc.h>
 #include "ar-internal.h"
 
+/*
+ * Time till a connection expires after last use (in seconds).
+ */
+unsigned rxrpc_connection_expiry = 10 * 60;
+
 static void rxrpc_connection_reaper(struct work_struct *work);
 
 LIST_HEAD(rxrpc_connections);
 DEFINE_RWLOCK(rxrpc_connection_lock);
-static unsigned long rxrpc_connection_timeout = 10 * 60;
 static DECLARE_DELAYED_WORK(rxrpc_connection_reap, rxrpc_connection_reaper);
 
 /*
@@ -862,7 +866,7 @@ static void rxrpc_connection_reaper(struct work_struct *work)
 
                 spin_lock(&conn->trans->client_lock);
                 write_lock(&conn->trans->conn_lock);
-                reap_time = conn->put_time + rxrpc_connection_timeout;
+                reap_time = conn->put_time + rxrpc_connection_expiry;
 
                 if (atomic_read(&conn->usage) > 0) {
                         ;
@@ -916,7 +920,7 @@ void __exit rxrpc_destroy_all_connections(void)
 {
         _enter("");
 
-        rxrpc_connection_timeout = 0;
+        rxrpc_connection_expiry = 0;
         cancel_delayed_work(&rxrpc_connection_reap);
         rxrpc_queue_delayed_work(&rxrpc_connection_reap, 0);
 
diff --git a/net/rxrpc/ar-error.c b/net/rxrpc/ar-error.c
index a9206087b4d7..db57458c824c 100644
--- a/net/rxrpc/ar-error.c
+++ b/net/rxrpc/ar-error.c
@@ -83,6 +83,7 @@ void rxrpc_UDP_error_report(struct sock *sk)
 
                 if (mtu == 0) {
                         /* they didn't give us a size, estimate one */
+                        mtu = peer->if_mtu;
                         if (mtu > 1500) {
                                 mtu >>= 1;
                                 if (mtu < 1500)
diff --git a/net/rxrpc/ar-input.c b/net/rxrpc/ar-input.c
index 529572f18d1f..63b21e580de9 100644
--- a/net/rxrpc/ar-input.c
+++ b/net/rxrpc/ar-input.c
@@ -25,8 +25,6 @@
 #include <net/net_namespace.h>
 #include "ar-internal.h"
 
-unsigned long rxrpc_ack_timeout = 1;
-
 const char *rxrpc_pkts[] = {
         "?00",
         "DATA", "ACK", "BUSY", "ABORT", "ACKALL", "CHALL", "RESP", "DEBUG",
@@ -115,7 +113,7 @@ int rxrpc_queue_rcv_skb(struct rxrpc_call *call, struct sk_buff *skb,
                         spin_unlock_bh(&sk->sk_receive_queue.lock);
 
                         if (!sock_flag(sk, SOCK_DEAD))
-                                sk->sk_data_ready(sk, skb_len);
+                                sk->sk_data_ready(sk);
                 }
                 skb = NULL;
         } else {
@@ -349,8 +347,7 @@ void rxrpc_fast_process_packet(struct rxrpc_call *call, struct sk_buff *skb)
          * it */
         if (sp->hdr.flags & RXRPC_REQUEST_ACK) {
                 _proto("ACK Requested on %%%u", serial);
-                rxrpc_propose_ACK(call, RXRPC_ACK_REQUESTED, sp->hdr.serial,
-                                  !(sp->hdr.flags & RXRPC_MORE_PACKETS));
+                rxrpc_propose_ACK(call, RXRPC_ACK_REQUESTED, sp->hdr.serial, false);
         }
 
         switch (sp->hdr.type) {
@@ -526,36 +523,38 @@ protocol_error:
  * post an incoming packet to the appropriate call/socket to deal with
  * - must get rid of the sk_buff, either by freeing it or by queuing it
  */
-static void rxrpc_post_packet_to_call(struct rxrpc_connection *conn,
+static void rxrpc_post_packet_to_call(struct rxrpc_call *call,
                                       struct sk_buff *skb)
 {
         struct rxrpc_skb_priv *sp;
-        struct rxrpc_call *call;
-        struct rb_node *p;
-        __be32 call_id;
-
-        _enter("%p,%p", conn, skb);
 
-        read_lock_bh(&conn->lock);
+        _enter("%p,%p", call, skb);
 
         sp = rxrpc_skb(skb);
 
-        /* look at extant calls by channel number first */
-        call = conn->channels[ntohl(sp->hdr.cid) & RXRPC_CHANNELMASK];
-        if (!call || call->call_id != sp->hdr.callNumber)
-                goto call_not_extant;
-
         _debug("extant call [%d]", call->state);
-        ASSERTCMP(call->conn, ==, conn);
 
         read_lock(&call->state_lock);
         switch (call->state) {
         case RXRPC_CALL_LOCALLY_ABORTED:
-                if (!test_and_set_bit(RXRPC_CALL_ABORT, &call->events))
+                if (!test_and_set_bit(RXRPC_CALL_ABORT, &call->events)) {
                         rxrpc_queue_call(call);
+                        goto free_unlock;
+                }
         case RXRPC_CALL_REMOTELY_ABORTED:
         case RXRPC_CALL_NETWORK_ERROR:
         case RXRPC_CALL_DEAD:
+                goto dead_call;
+        case RXRPC_CALL_COMPLETE:
+        case RXRPC_CALL_CLIENT_FINAL_ACK:
+                /* complete server call */
+                if (call->conn->in_clientflag)
+                        goto dead_call;
+                /* resend last packet of a completed call */
+                _debug("final ack again");
+                rxrpc_get_call(call);
+                set_bit(RXRPC_CALL_ACK_FINAL, &call->events);
+                rxrpc_queue_call(call);
                 goto free_unlock;
         default:
                 break;
@@ -563,7 +562,6 @@ static void rxrpc_post_packet_to_call(struct rxrpc_connection *conn,
 
         read_unlock(&call->state_lock);
         rxrpc_get_call(call);
-        read_unlock_bh(&conn->lock);
 
         if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
             sp->hdr.flags & RXRPC_JUMBO_PACKET)
@@ -574,78 +572,16 @@ static void rxrpc_post_packet_to_call(struct rxrpc_connection *conn,
         rxrpc_put_call(call);
         goto done;
 
-call_not_extant:
-        /* search the completed calls in case what we're dealing with is
-         * there */
-        _debug("call not extant");
-
-        call_id = sp->hdr.callNumber;
-        p = conn->calls.rb_node;
-        while (p) {
-                call = rb_entry(p, struct rxrpc_call, conn_node);
-
-                if (call_id < call->call_id)
-                        p = p->rb_left;
-                else if (call_id > call->call_id)
-                        p = p->rb_right;
-                else
-                        goto found_completed_call;
-        }
-
 dead_call:
-        /* it's a either a really old call that we no longer remember or its a
-         * new incoming call */
-        read_unlock_bh(&conn->lock);
-
-        if (sp->hdr.flags & RXRPC_CLIENT_INITIATED &&
-            sp->hdr.seq == cpu_to_be32(1)) {
-                _debug("incoming call");
-                skb_queue_tail(&conn->trans->local->accept_queue, skb);
-                rxrpc_queue_work(&conn->trans->local->acceptor);
-                goto done;
-        }
-
-        _debug("dead call");
-        skb->priority = RX_CALL_DEAD;
-        rxrpc_reject_packet(conn->trans->local, skb);
-        goto done;
-
-        /* resend last packet of a completed call
-         * - client calls may have been aborted or ACK'd
-         * - server calls may have been aborted
-         */
-found_completed_call:
-        _debug("completed call");
-
-        if (atomic_read(&call->usage) == 0)
-                goto dead_call;
-
-        /* synchronise any state changes */
-        read_lock(&call->state_lock);
-        ASSERTIFCMP(call->state != RXRPC_CALL_CLIENT_FINAL_ACK,
-                    call->state, >=, RXRPC_CALL_COMPLETE);
-
-        if (call->state == RXRPC_CALL_LOCALLY_ABORTED ||
-            call->state == RXRPC_CALL_REMOTELY_ABORTED ||
-            call->state == RXRPC_CALL_DEAD) {
-                read_unlock(&call->state_lock);
-                goto dead_call;
-        }
-
-        if (call->conn->in_clientflag) {
-                read_unlock(&call->state_lock);
-                goto dead_call; /* complete server call */
+        if (sp->hdr.type != RXRPC_PACKET_TYPE_ABORT) {
+                skb->priority = RX_CALL_DEAD;
+                rxrpc_reject_packet(call->conn->trans->local, skb);
+                goto unlock;
         }
-
-        _debug("final ack again");
-        rxrpc_get_call(call);
-        set_bit(RXRPC_CALL_ACK_FINAL, &call->events);
-        rxrpc_queue_call(call);
-
 free_unlock:
-        read_unlock(&call->state_lock);
-        read_unlock_bh(&conn->lock);
         rxrpc_free_skb(skb);
+unlock:
+        read_unlock(&call->state_lock);
 done:
         _leave("");
 }
@@ -664,21 +600,46 @@ static void rxrpc_post_packet_to_conn(struct rxrpc_connection *conn,
         rxrpc_queue_conn(conn);
 }
 
+static struct rxrpc_connection *rxrpc_conn_from_local(struct rxrpc_local *local,
+                                               struct sk_buff *skb,
+                                               struct rxrpc_skb_priv *sp)
+{
+        struct rxrpc_peer *peer;
+        struct rxrpc_transport *trans;
+        struct rxrpc_connection *conn;
+
+        peer = rxrpc_find_peer(local, ip_hdr(skb)->saddr,
+                                udp_hdr(skb)->source);
+        if (IS_ERR(peer))
+                goto cant_find_conn;
+
+        trans = rxrpc_find_transport(local, peer);
+        rxrpc_put_peer(peer);
+        if (!trans)
+                goto cant_find_conn;
+
+        conn = rxrpc_find_connection(trans, &sp->hdr);
+        rxrpc_put_transport(trans);
+        if (!conn)
+                goto cant_find_conn;
+
+        return conn;
+cant_find_conn:
+        return NULL;
+}
+
 /*
  * handle data received on the local endpoint
  * - may be called in interrupt context
  */
-void rxrpc_data_ready(struct sock *sk, int count)
+void rxrpc_data_ready(struct sock *sk)
 {
-        struct rxrpc_connection *conn;
-        struct rxrpc_transport *trans;
         struct rxrpc_skb_priv *sp;
         struct rxrpc_local *local;
-        struct rxrpc_peer *peer;
         struct sk_buff *skb;
         int ret;
 
-        _enter("%p, %d", sk, count);
+        _enter("%p", sk);
 
         ASSERT(!irqs_disabled());
 
@@ -749,27 +710,34 @@ void rxrpc_data_ready(struct sock *sk, int count)
             (sp->hdr.callNumber == 0 || sp->hdr.seq == 0))
                 goto bad_message;
 
-        peer = rxrpc_find_peer(local, ip_hdr(skb)->saddr, udp_hdr(skb)->source);
-        if (IS_ERR(peer))
-                goto cant_route_call;
+        if (sp->hdr.callNumber == 0) {
+                /* This is a connection-level packet. These should be
+                 * fairly rare, so the extra overhead of looking them up the
+                 * old-fashioned way doesn't really hurt */
+                struct rxrpc_connection *conn;
 
-        trans = rxrpc_find_transport(local, peer);
-        rxrpc_put_peer(peer);
-        if (!trans)
-                goto cant_route_call;
+                conn = rxrpc_conn_from_local(local, skb, sp);
+                if (!conn)
+                        goto cant_route_call;
 
-        conn = rxrpc_find_connection(trans, &sp->hdr);
-        rxrpc_put_transport(trans);
-        if (!conn)
-                goto cant_route_call;
-
-        _debug("CONN %p {%d}", conn, conn->debug_id);
-
-        if (sp->hdr.callNumber == 0)
+                _debug("CONN %p {%d}", conn, conn->debug_id);
                 rxrpc_post_packet_to_conn(conn, skb);
-        else
-                rxrpc_post_packet_to_call(conn, skb);
-        rxrpc_put_connection(conn);
+                rxrpc_put_connection(conn);
+        } else {
+                struct rxrpc_call *call;
+                u8 in_clientflag = 0;
+
+                if (sp->hdr.flags & RXRPC_CLIENT_INITIATED)
+                        in_clientflag = RXRPC_CLIENT_INITIATED;
+                call = rxrpc_find_call_hash(in_clientflag, sp->hdr.cid,
+                                            sp->hdr.callNumber, sp->hdr.epoch,
+                                            sp->hdr.serviceId, local, AF_INET,
+                                            (u8 *)&ip_hdr(skb)->saddr);
+                if (call)
+                        rxrpc_post_packet_to_call(call, skb);
+                else
+                        goto cant_route_call;
+        }
         rxrpc_put_local(local);
         return;
 
@@ -790,8 +758,10 @@ cant_route_call:
                 skb->priority = RX_CALL_DEAD;
         }
 
-        _debug("reject");
-        rxrpc_reject_packet(local, skb);
+        if (sp->hdr.type != RXRPC_PACKET_TYPE_ABORT) {
+                _debug("reject type %d",sp->hdr.type);
+                rxrpc_reject_packet(local, skb);
+        }
         rxrpc_put_local(local);
         _leave(" [no call]");
         return;
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 5f43675ee1df..ba9fd36d3f15 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -396,9 +396,20 @@ struct rxrpc_call {
 #define RXRPC_ACKR_WINDOW_ASZ DIV_ROUND_UP(RXRPC_MAXACKS, BITS_PER_LONG)
         unsigned long           ackr_window[RXRPC_ACKR_WINDOW_ASZ + 1];
 
+        struct hlist_node       hash_node;
+        unsigned long           hash_key;       /* Full hash key */
+        u8                      in_clientflag;  /* Copy of conn->in_clientflag for hashing */
+        struct rxrpc_local      *local;         /* Local endpoint. Used for hashing. */
+        sa_family_t             proto;          /* Frame protocol */
         /* the following should all be in net order */
         __be32                  cid;            /* connection ID + channel index  */
         __be32                  call_id;        /* call ID on connection  */
+        __be32                  epoch;          /* epoch of this connection */
+        __be16                  service_id;     /* service ID */
+        union {                                 /* Peer IP address for hashing */
+                __be32  ipv4_addr;
+                __u8    ipv6_addr[16];          /* Anticipates eventual IPv6 support */
+        } peer_ip;
 };
 
 /*
@@ -433,6 +444,13 @@ int rxrpc_reject_call(struct rxrpc_sock *);
 /*
  * ar-ack.c
  */
+extern unsigned rxrpc_requested_ack_delay;
+extern unsigned rxrpc_soft_ack_delay;
+extern unsigned rxrpc_idle_ack_delay;
+extern unsigned rxrpc_rx_window_size;
+extern unsigned rxrpc_rx_mtu;
+extern unsigned rxrpc_rx_jumbo_max;
+
 void __rxrpc_propose_ACK(struct rxrpc_call *, u8, __be32, bool);
 void rxrpc_propose_ACK(struct rxrpc_call *, u8, __be32, bool);
 void rxrpc_process_call(struct work_struct *);
@@ -440,10 +458,14 @@ void rxrpc_process_call(struct work_struct *);
 /*
  * ar-call.c
  */
+extern unsigned rxrpc_max_call_lifetime;
+extern unsigned rxrpc_dead_call_expiry;
 extern struct kmem_cache *rxrpc_call_jar;
 extern struct list_head rxrpc_calls;
 extern rwlock_t rxrpc_call_lock;
 
+struct rxrpc_call *rxrpc_find_call_hash(u8,  __be32, __be32, __be32,
+                                        __be16, void *, sa_family_t, const u8 *);
 struct rxrpc_call *rxrpc_get_client_call(struct rxrpc_sock *,
                                          struct rxrpc_transport *,
                                          struct rxrpc_conn_bundle *,
@@ -460,6 +482,7 @@ void __exit rxrpc_destroy_all_calls(void);
 /*
  * ar-connection.c
  */
+extern unsigned rxrpc_connection_expiry;
 extern struct list_head rxrpc_connections;
 extern rwlock_t rxrpc_connection_lock;
 
@@ -493,10 +516,9 @@ void rxrpc_UDP_error_handler(struct work_struct *);
 /*
  * ar-input.c
  */
-extern unsigned long rxrpc_ack_timeout;
 extern const char *rxrpc_pkts[];
 
-void rxrpc_data_ready(struct sock *, int);
+void rxrpc_data_ready(struct sock *);
 int rxrpc_queue_rcv_skb(struct rxrpc_call *, struct sk_buff *, bool, bool);
 void rxrpc_fast_process_packet(struct rxrpc_call *, struct sk_buff *);
 
@@ -504,6 +526,7 @@ void rxrpc_fast_process_packet(struct rxrpc_call *, struct sk_buff *);
  * ar-local.c
  */
 extern rwlock_t rxrpc_local_lock;
+
 struct rxrpc_local *rxrpc_lookup_local(struct sockaddr_rxrpc *);
 void rxrpc_put_local(struct rxrpc_local *);
 void __exit rxrpc_destroy_all_locals(void);
@@ -522,7 +545,7 @@ int rxrpc_get_server_data_key(struct rxrpc_connection *, const void *, time_t,
 /*
  * ar-output.c
  */
-extern int rxrpc_resend_timeout;
+extern unsigned rxrpc_resend_timeout;
 
 int rxrpc_send_packet(struct rxrpc_transport *, struct sk_buff *);
 int rxrpc_client_sendmsg(struct kiocb *, struct rxrpc_sock *,
@@ -572,6 +595,8 @@ void rxrpc_packet_destructor(struct sk_buff *);
 /*
  * ar-transport.c
  */
+extern unsigned rxrpc_transport_expiry;
+
 struct rxrpc_transport *rxrpc_get_transport(struct rxrpc_local *,
                                             struct rxrpc_peer *, gfp_t);
 void rxrpc_put_transport(struct rxrpc_transport *);
@@ -580,6 +605,17 @@ struct rxrpc_transport *rxrpc_find_transport(struct rxrpc_local *,
                                              struct rxrpc_peer *);
 
 /*
+ * sysctl.c
+ */
+#ifdef CONFIG_SYSCTL
+extern int __init rxrpc_sysctl_init(void);
+extern void rxrpc_sysctl_exit(void);
+#else
+static inline int __init rxrpc_sysctl_init(void) { return 0; }
+static inline void rxrpc_sysctl_exit(void) {}
+#endif
+
+/*
  * debug tracing
  */
 extern unsigned int rxrpc_debug;
diff --git a/net/rxrpc/ar-output.c b/net/rxrpc/ar-output.c
index d0e8f1c1898a..0b4b9a79f5ab 100644
--- a/net/rxrpc/ar-output.c
+++ b/net/rxrpc/ar-output.c
@@ -18,7 +18,10 @@
 #include <net/af_rxrpc.h>
 #include "ar-internal.h"
 
-int rxrpc_resend_timeout = 4;
+/*
+ * Time till packet resend (in jiffies).
+ */
+unsigned rxrpc_resend_timeout = 4 * HZ;
 
 static int rxrpc_send_data(struct kiocb *iocb,
                            struct rxrpc_sock *rx,
@@ -487,7 +490,7 @@ static void rxrpc_queue_packet(struct rxrpc_call *call, struct sk_buff *skb,
                ntohl(sp->hdr.serial), ntohl(sp->hdr.seq));
 
         sp->need_resend = false;
-        sp->resend_at = jiffies + rxrpc_resend_timeout * HZ;
+        sp->resend_at = jiffies + rxrpc_resend_timeout;
         if (!test_and_set_bit(RXRPC_CALL_RUN_RTIMER, &call->flags)) {
                 _debug("run timer");
                 call->resend_timer.expires = sp->resend_at;
@@ -666,6 +669,7 @@ static int rxrpc_send_data(struct kiocb *iocb,
                 /* add the packet to the send queue if it's now full */
                 if (sp->remain <= 0 || (segment == 0 && !more)) {
                         struct rxrpc_connection *conn = call->conn;
+                        uint32_t seq;
                         size_t pad;
 
                         /* pad out if we're using security */
@@ -678,11 +682,12 @@ static int rxrpc_send_data(struct kiocb *iocb,
                                         memset(skb_put(skb, pad), 0, pad);
                         }
 
+                        seq = atomic_inc_return(&call->sequence);
+
                         sp->hdr.epoch = conn->epoch;
                         sp->hdr.cid = call->cid;
                         sp->hdr.callNumber = call->call_id;
-                        sp->hdr.seq =
-                                htonl(atomic_inc_return(&call->sequence));
+                        sp->hdr.seq = htonl(seq);
                         sp->hdr.serial =
                                 htonl(atomic_inc_return(&conn->serial));
                         sp->hdr.type = RXRPC_PACKET_TYPE_DATA;
@@ -697,6 +702,8 @@ static int rxrpc_send_data(struct kiocb *iocb,
                         else if (CIRC_SPACE(call->acks_head, call->acks_tail,
                                             call->acks_winsz) > 1)
                                 sp->hdr.flags |= RXRPC_MORE_PACKETS;
+                        if (more && seq & 1)
+                                sp->hdr.flags |= RXRPC_REQUEST_ACK;
 
                         ret = rxrpc_secure_packet(
                                 call, skb, skb->mark,
diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
index 34b5490dde65..e9aaa65c0778 100644
--- a/net/rxrpc/ar-recvmsg.c
+++ b/net/rxrpc/ar-recvmsg.c
@@ -180,16 +180,7 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
                 if (copy > len - copied)
                         copy = len - copied;
 
-                if (skb->ip_summed == CHECKSUM_UNNECESSARY ||
-                    skb->ip_summed == CHECKSUM_PARTIAL) {
-                        ret = skb_copy_datagram_iovec(skb, offset,
-                                                      msg->msg_iov, copy);
-                } else {
-                        ret = skb_copy_and_csum_datagram_iovec(skb, offset,
-                                                               msg->msg_iov);
-                        if (ret == -EINVAL)
-                                goto csum_copy_error;
-                }
+                ret = skb_copy_datagram_iovec(skb, offset, msg->msg_iov, copy);
 
                 if (ret < 0)
                         goto copy_error;
@@ -348,20 +339,6 @@ copy_error:
         _leave(" = %d", ret);
         return ret;
 
-csum_copy_error:
-        _debug("csum error");
-        release_sock(&rx->sk);
-        if (continue_call)
-                rxrpc_put_call(continue_call);
-        rxrpc_kill_skb(skb);
-        if (!(flags & MSG_PEEK)) {
-                if (skb_dequeue(&rx->sk.sk_receive_queue) != skb)
-                        BUG();
-        }
-        skb_kill_datagram(&rx->sk, skb, flags);
-        rxrpc_put_call(call);
-        return -EAGAIN;
-
 wait_interrupted:
         ret = sock_intr_errno(timeo);
 wait_error:
diff --git a/net/rxrpc/ar-skbuff.c b/net/rxrpc/ar-skbuff.c
index de755e04d29c..4cfab49e329d 100644
--- a/net/rxrpc/ar-skbuff.c
+++ b/net/rxrpc/ar-skbuff.c
@@ -83,9 +83,14 @@ static void rxrpc_hard_ACK_data(struct rxrpc_call *call,
                 rxrpc_request_final_ACK(call);
         } else if (atomic_dec_and_test(&call->ackr_not_idle) &&
                    test_and_clear_bit(RXRPC_CALL_TX_SOFT_ACK, &call->flags)) {
+                /* We previously soft-ACK'd some received packets that have now
+                 * been consumed, so send a hard-ACK if no more packets are
+                 * immediately forthcoming to allow the transmitter to free up
+                 * its Tx bufferage.
+                 */
                 _debug("send Rx idle ACK");
                 __rxrpc_propose_ACK(call, RXRPC_ACK_IDLE, sp->hdr.serial,
-                                    true);
+                                    false);
         }
 
         spin_unlock_bh(&call->lock);
diff --git a/net/rxrpc/ar-transport.c b/net/rxrpc/ar-transport.c
index 92df566930b9..1976dec84f29 100644
--- a/net/rxrpc/ar-transport.c
+++ b/net/rxrpc/ar-transport.c
@@ -17,11 +17,15 @@
 #include <net/af_rxrpc.h>
 #include "ar-internal.h"
 
+/*
+ * Time after last use at which transport record is cleaned up.
+ */
+unsigned rxrpc_transport_expiry = 3600 * 24;
+
 static void rxrpc_transport_reaper(struct work_struct *work);
 
 static LIST_HEAD(rxrpc_transports);
 static DEFINE_RWLOCK(rxrpc_transport_lock);
-static unsigned long rxrpc_transport_timeout = 3600 * 24;
 static DECLARE_DELAYED_WORK(rxrpc_transport_reap, rxrpc_transport_reaper);
 
 /*
@@ -235,7 +239,7 @@ static void rxrpc_transport_reaper(struct work_struct *work)
                 if (likely(atomic_read(&trans->usage) > 0))
                         continue;
 
-                reap_time = trans->put_time + rxrpc_transport_timeout;
+                reap_time = trans->put_time + rxrpc_transport_expiry;
                 if (reap_time <= now)
                         list_move_tail(&trans->link, &graveyard);
                 else if (reap_time < earliest)
@@ -271,7 +275,7 @@ void __exit rxrpc_destroy_all_transports(void)
 {
         _enter("");
 
-        rxrpc_transport_timeout = 0;
+        rxrpc_transport_expiry = 0;
         cancel_delayed_work(&rxrpc_transport_reap);
         rxrpc_queue_delayed_work(&rxrpc_transport_reap, 0);
 
diff --git a/net/rxrpc/sysctl.c b/net/rxrpc/sysctl.c
new file mode 100644
index 000000000000..50a98a910eb1
--- /dev/null
+++ b/net/rxrpc/sysctl.c
@@ -0,0 +1,146 @@
+/* sysctls for configuring RxRPC operating parameters
+ *
+ * Copyright (C) 2014 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#include <linux/sysctl.h>
+#include <net/sock.h>
+#include <net/af_rxrpc.h>
+#include "ar-internal.h"
+
+static struct ctl_table_header *rxrpc_sysctl_reg_table;
+static const unsigned zero = 0;
+static const unsigned one = 1;
+static const unsigned four = 4;
+static const unsigned n_65535 = 65535;
+static const unsigned n_max_acks = RXRPC_MAXACKS;
+
+/*
+ * RxRPC operating parameters.
+ *
+ * See Documentation/networking/rxrpc.txt and the variable definitions for more
+ * information on the individual parameters.
+ */
+static struct ctl_table rxrpc_sysctl_table[] = {
+        /* Values measured in milliseconds */
+        {
+                .procname       = "req_ack_delay",
+                .data           = &rxrpc_requested_ack_delay,
+                .maxlen         = sizeof(unsigned),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_ms_jiffies,
+                .extra1         = (void *)&zero,
+        },
+        {
+                .procname       = "soft_ack_delay",
+                .data           = &rxrpc_soft_ack_delay,
+                .maxlen         = sizeof(unsigned),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_ms_jiffies,
+                .extra1         = (void *)&one,
+        },
+        {
+                .procname       = "idle_ack_delay",
+                .data           = &rxrpc_idle_ack_delay,
+                .maxlen         = sizeof(unsigned),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_ms_jiffies,
+                .extra1         = (void *)&one,
+        },
+        {
+                .procname       = "resend_timeout",
+                .data           = &rxrpc_resend_timeout,
+                .maxlen         = sizeof(unsigned),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_ms_jiffies,
+                .extra1         = (void *)&one,
+        },
+
+        /* Values measured in seconds but used in jiffies */
+        {
+                .procname       = "max_call_lifetime",
+                .data           = &rxrpc_max_call_lifetime,
+                .maxlen         = sizeof(unsigned),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_jiffies,
+                .extra1         = (void *)&one,
+        },
+        {
+                .procname       = "dead_call_expiry",
+                .data           = &rxrpc_dead_call_expiry,
+                .maxlen         = sizeof(unsigned),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_jiffies,
+                .extra1         = (void *)&one,
+        },
+
+        /* Values measured in seconds */
+        {
+                .procname       = "connection_expiry",
+                .data           = &rxrpc_connection_expiry,
+                .maxlen         = sizeof(unsigned),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = (void *)&one,
+        },
+        {
+                .procname       = "transport_expiry",
+                .data           = &rxrpc_transport_expiry,
+                .maxlen         = sizeof(unsigned),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = (void *)&one,
+        },
+
+        /* Non-time values */
+        {
+                .procname       = "rx_window_size",
+                .data           = &rxrpc_rx_window_size,
+                .maxlen         = sizeof(unsigned),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = (void *)&one,
+                .extra2         = (void *)&n_max_acks,
+        },
+        {
+                .procname       = "rx_mtu",
+                .data           = &rxrpc_rx_mtu,
+                .maxlen         = sizeof(unsigned),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = (void *)&one,
+                .extra1         = (void *)&n_65535,
+        },
+        {
+                .procname       = "rx_jumbo_max",
+                .data           = &rxrpc_rx_jumbo_max,
+                .maxlen         = sizeof(unsigned),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = (void *)&one,
+                .extra2         = (void *)&four,
+        },
+
+        { }
+};
+
+int __init rxrpc_sysctl_init(void)
+{
+        rxrpc_sysctl_reg_table = register_net_sysctl(&init_net, "net/rxrpc",
+                                                     rxrpc_sysctl_table);
+        if (!rxrpc_sysctl_reg_table)
+                return -ENOMEM;
+        return 0;
+}
+
+void rxrpc_sysctl_exit(void)
+{
+        if (rxrpc_sysctl_reg_table)
+                unregister_net_sysctl_table(rxrpc_sysctl_reg_table);
+}
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 72bdc7166345..8a5ba5add4bc 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -27,8 +27,11 @@
 #include <net/act_api.h>
 #include <net/netlink.h>
 
-void tcf_hash_destroy(struct tcf_common *p, struct tcf_hashinfo *hinfo)
+void tcf_hash_destroy(struct tc_action *a)
 {
+        struct tcf_common *p = a->priv;
+        struct tcf_hashinfo *hinfo = a->ops->hinfo;
+
         spin_lock_bh(&hinfo->lock);
         hlist_del(&p->tcfc_head);
         spin_unlock_bh(&hinfo->lock);
@@ -42,18 +45,22 @@ void tcf_hash_destroy(struct tcf_common *p, struct tcf_hashinfo *hinfo)
 }
 EXPORT_SYMBOL(tcf_hash_destroy);
 
-int tcf_hash_release(struct tcf_common *p, int bind,
-                     struct tcf_hashinfo *hinfo)
+int tcf_hash_release(struct tc_action *a, int bind)
 {
+        struct tcf_common *p = a->priv;
         int ret = 0;
 
         if (p) {
                 if (bind)
                         p->tcfc_bindcnt--;
+                else if (p->tcfc_bindcnt > 0)
+                        return -EPERM;
 
                 p->tcfc_refcnt--;
                 if (p->tcfc_bindcnt <= 0 && p->tcfc_refcnt <= 0) {
-                        tcf_hash_destroy(p, hinfo);
+                        if (a->ops->cleanup)
+                                a->ops->cleanup(a, bind);
+                        tcf_hash_destroy(a);
                         ret = 1;
                 }
         }
@@ -118,6 +125,7 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a)
         struct tcf_common *p;
         struct nlattr *nest;
         int i = 0, n_i = 0;
+        int ret = -EINVAL;
 
         nest = nla_nest_start(skb, a->order);
         if (nest == NULL)
@@ -127,10 +135,13 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a)
         for (i = 0; i < (hinfo->hmask + 1); i++) {
                 head = &hinfo->htab[tcf_hash(i, hinfo->hmask)];
                 hlist_for_each_entry_safe(p, n, head, tcfc_head) {
-                        if (ACT_P_DELETED == tcf_hash_release(p, 0, hinfo)) {
+                        a->priv = p;
+                        ret = tcf_hash_release(a, 0);
+                        if (ret == ACT_P_DELETED) {
                                 module_put(a->ops->owner);
                                 n_i++;
-                        }
+                        } else if (ret < 0)
+                                goto nla_put_failure;
                 }
         }
         if (nla_put_u32(skb, TCA_FCNT, n_i))
@@ -140,7 +151,7 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a)
         return n_i;
 nla_put_failure:
         nla_nest_cancel(skb, nest);
-        return -EINVAL;
+        return ret;
 }
 
 static int tcf_generic_walker(struct sk_buff *skb, struct netlink_callback *cb,
@@ -198,7 +209,7 @@ int tcf_hash_search(struct tc_action *a, u32 index)
 }
 EXPORT_SYMBOL(tcf_hash_search);
 
-struct tcf_common *tcf_hash_check(u32 index, struct tc_action *a, int bind)
+int tcf_hash_check(u32 index, struct tc_action *a, int bind)
 {
         struct tcf_hashinfo *hinfo = a->ops->hinfo;
         struct tcf_common *p = NULL;
@@ -207,19 +218,30 @@ struct tcf_common *tcf_hash_check(u32 index, struct tc_action *a, int bind)
                         p->tcfc_bindcnt++;
                 p->tcfc_refcnt++;
                 a->priv = p;
+                return 1;
         }
-        return p;
+        return 0;
 }
 EXPORT_SYMBOL(tcf_hash_check);
 
-struct tcf_common *tcf_hash_create(u32 index, struct nlattr *est,
-                                   struct tc_action *a, int size, int bind)
+void tcf_hash_cleanup(struct tc_action *a, struct nlattr *est)
+{
+        struct tcf_common *pc = a->priv;
+        if (est)
+                gen_kill_estimator(&pc->tcfc_bstats,
+                                   &pc->tcfc_rate_est);
+        kfree_rcu(pc, tcfc_rcu);
+}
+EXPORT_SYMBOL(tcf_hash_cleanup);
+
+int tcf_hash_create(u32 index, struct nlattr *est, struct tc_action *a,
+                    int size, int bind)
 {
         struct tcf_hashinfo *hinfo = a->ops->hinfo;
         struct tcf_common *p = kzalloc(size, GFP_KERNEL);
 
         if (unlikely(!p))
-                return ERR_PTR(-ENOMEM);
+                return -ENOMEM;
         p->tcfc_refcnt = 1;
         if (bind)
                 p->tcfc_bindcnt = 1;
@@ -234,17 +256,19 @@ struct tcf_common *tcf_hash_create(u32 index, struct nlattr *est,
                                             &p->tcfc_lock, est);
                 if (err) {
                         kfree(p);
-                        return ERR_PTR(err);
+                        return err;
                 }
         }
 
         a->priv = (void *) p;
-        return p;
+        return 0;
 }
 EXPORT_SYMBOL(tcf_hash_create);
 
-void tcf_hash_insert(struct tcf_common *p, struct tcf_hashinfo *hinfo)
+void tcf_hash_insert(struct tc_action *a)
 {
+        struct tcf_common *p = a->priv;
+        struct tcf_hashinfo *hinfo = a->ops->hinfo;
         unsigned int h = tcf_hash(p->tcfc_index, hinfo->hmask);
 
         spin_lock_bh(&hinfo->lock);
@@ -256,12 +280,13 @@ EXPORT_SYMBOL(tcf_hash_insert);
 static LIST_HEAD(act_base);
 static DEFINE_RWLOCK(act_mod_lock);
 
-int tcf_register_action(struct tc_action_ops *act)
+int tcf_register_action(struct tc_action_ops *act, unsigned int mask)
 {
         struct tc_action_ops *a;
+        int err;
 
-        /* Must supply act, dump, cleanup and init */
-        if (!act->act || !act->dump || !act->cleanup || !act->init)
+        /* Must supply act, dump and init */
+        if (!act->act || !act->dump || !act->init)
                 return -EINVAL;
 
         /* Supply defaults */
@@ -270,10 +295,21 @@ int tcf_register_action(struct tc_action_ops *act)
         if (!act->walk)
                 act->walk = tcf_generic_walker;
 
+        act->hinfo = kmalloc(sizeof(struct tcf_hashinfo), GFP_KERNEL);
+        if (!act->hinfo)
+                return -ENOMEM;
+        err = tcf_hashinfo_init(act->hinfo, mask);
+        if (err) {
+                kfree(act->hinfo);
+                return err;
+        }
+
         write_lock(&act_mod_lock);
         list_for_each_entry(a, &act_base, head) {
                 if (act->type == a->type || (strcmp(act->kind, a->kind) == 0)) {
                         write_unlock(&act_mod_lock);
+                        tcf_hashinfo_destroy(act->hinfo);
+                        kfree(act->hinfo);
                         return -EEXIST;
                 }
         }
@@ -292,6 +328,8 @@ int tcf_unregister_action(struct tc_action_ops *act)
         list_for_each_entry(a, &act_base, head) {
                 if (a == act) {
                         list_del(&act->head);
+                        tcf_hashinfo_destroy(act->hinfo);
+                        kfree(act->hinfo);
                         err = 0;
                         break;
                 }
@@ -368,16 +406,21 @@ exec_done:
 }
 EXPORT_SYMBOL(tcf_action_exec);
 
-void tcf_action_destroy(struct list_head *actions, int bind)
+int tcf_action_destroy(struct list_head *actions, int bind)
 {
         struct tc_action *a, *tmp;
+        int ret = 0;
 
         list_for_each_entry_safe(a, tmp, actions, list) {
-                if (a->ops->cleanup(a, bind) == ACT_P_DELETED)
+                ret = tcf_hash_release(a, bind);
+                if (ret == ACT_P_DELETED)
                         module_put(a->ops->owner);
+                else if (ret < 0)
+                        return ret;
                 list_del(&a->list);
                 kfree(a);
         }
+        return ret;
 }
 
 int
@@ -642,6 +685,20 @@ act_get_notify(struct net *net, u32 portid, struct nlmsghdr *n,
         return rtnl_unicast(skb, net, portid);
 }
 
+static struct tc_action *create_a(int i)
+{
+        struct tc_action *act;
+
+        act = kzalloc(sizeof(*act), GFP_KERNEL);
+        if (act == NULL) {
+                pr_debug("create_a: failed to alloc!\n");
+                return NULL;
+        }
+        act->order = i;
+        INIT_LIST_HEAD(&act->list);
+        return act;
+}
+
 static struct tc_action *
 tcf_action_get_1(struct nlattr *nla, struct nlmsghdr *n, u32 portid)
 {
@@ -661,11 +718,10 @@ tcf_action_get_1(struct nlattr *nla, struct nlmsghdr *n, u32 portid)
         index = nla_get_u32(tb[TCA_ACT_INDEX]);
 
         err = -ENOMEM;
-        a = kzalloc(sizeof(struct tc_action), GFP_KERNEL);
+        a = create_a(0);
         if (a == NULL)
                 goto err_out;
 
-        INIT_LIST_HEAD(&a->list);
         err = -EINVAL;
         a->ops = tc_lookup_action(tb[TCA_ACT_KIND]);
         if (a->ops == NULL) /* could happen in batch of actions */
@@ -695,20 +751,6 @@ static void cleanup_a(struct list_head *actions)
         }
 }
 
-static struct tc_action *create_a(int i)
-{
-        struct tc_action *act;
-
-        act = kzalloc(sizeof(*act), GFP_KERNEL);
-        if (act == NULL) {
-                pr_debug("create_a: failed to alloc!\n");
-                return NULL;
-        }
-        act->order = i;
-        INIT_LIST_HEAD(&act->list);
-        return act;
-}
-
 static int tca_action_flush(struct net *net, struct nlattr *nla,
                             struct nlmsghdr *n, u32 portid)
 {
@@ -720,18 +762,12 @@ static int tca_action_flush(struct net *net, struct nlattr *nla,
         struct nlattr *nest;
         struct nlattr *tb[TCA_ACT_MAX + 1];
         struct nlattr *kind;
-        struct tc_action *a = create_a(0);
+        struct tc_action a;
         int err = -ENOMEM;
 
-        if (a == NULL) {
-                pr_debug("tca_action_flush: couldnt create tc_action\n");
-                return err;
-        }
-
         skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
         if (!skb) {
                 pr_debug("tca_action_flush: failed skb alloc\n");
-                kfree(a);
                 return err;
         }
 
@@ -743,8 +779,10 @@ static int tca_action_flush(struct net *net, struct nlattr *nla,
 
         err = -EINVAL;
         kind = tb[TCA_ACT_KIND];
-        a->ops = tc_lookup_action(kind);
-        if (a->ops == NULL) /*some idjot trying to flush unknown action */
+        memset(&a, 0, sizeof(struct tc_action));
+        INIT_LIST_HEAD(&a.list);
+        a.ops = tc_lookup_action(kind);
+        if (a.ops == NULL) /*some idjot trying to flush unknown action */
                 goto err_out;
 
         nlh = nlmsg_put(skb, portid, n->nlmsg_seq, RTM_DELACTION, sizeof(*t), 0);
@@ -759,7 +797,7 @@ static int tca_action_flush(struct net *net, struct nlattr *nla,
         if (nest == NULL)
                 goto out_module_put;
 
-        err = a->ops->walk(skb, &dcb, RTM_DELACTION, a);
+        err = a.ops->walk(skb, &dcb, RTM_DELACTION, &a);
         if (err < 0)
                 goto out_module_put;
         if (err == 0)
@@ -769,8 +807,7 @@ static int tca_action_flush(struct net *net, struct nlattr *nla,
 
         nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         nlh->nlmsg_flags |= NLM_F_ROOT;
-        module_put(a->ops->owner);
-        kfree(a);
+        module_put(a.ops->owner);
         err = rtnetlink_send(skb, net, portid, RTNLGRP_TC,
                              n->nlmsg_flags & NLM_F_ECHO);
         if (err > 0)
@@ -779,11 +816,10 @@ static int tca_action_flush(struct net *net, struct nlattr *nla,
         return err;
 
 out_module_put:
-        module_put(a->ops->owner);
+        module_put(a.ops->owner);
 err_out:
 noflush_out:
         kfree_skb(skb);
-        kfree(a);
         return err;
 }
 
@@ -805,7 +841,11 @@ tcf_del_notify(struct net *net, struct nlmsghdr *n, struct list_head *actions,
         }
 
         /* now do the delete */
-        tcf_action_destroy(actions, 0);
+        ret = tcf_action_destroy(actions, 0);
+        if (ret < 0) {
+                kfree_skb(skb);
+                return ret;
+        }
 
         ret = rtnetlink_send(skb, net, portid, RTNLGRP_TC,
                              n->nlmsg_flags & NLM_F_ECHO);
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 2210187c45c2..edbf40dac709 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -37,7 +37,6 @@
 #include <net/tc_act/tc_csum.h>
 
 #define CSUM_TAB_MASK 15
-static struct tcf_hashinfo csum_hash_info;
 
 static const struct nla_policy csum_policy[TCA_CSUM_MAX + 1] = {
         [TCA_CSUM_PARMS] = { .len = sizeof(struct tc_csum), },
@@ -48,7 +47,6 @@ static int tcf_csum_init(struct net *n, struct nlattr *nla, struct nlattr *est,
 {
         struct nlattr *tb[TCA_CSUM_MAX + 1];
         struct tc_csum *parm;
-        struct tcf_common *pc;
         struct tcf_csum *p;
         int ret = 0, err;
 
@@ -63,38 +61,31 @@ static int tcf_csum_init(struct net *n, struct nlattr *nla, struct nlattr *est,
                 return -EINVAL;
         parm = nla_data(tb[TCA_CSUM_PARMS]);
 
-        pc = tcf_hash_check(parm->index, a, bind);
-        if (!pc) {
-                pc = tcf_hash_create(parm->index, est, a, sizeof(*p), bind);
-                if (IS_ERR(pc))
-                        return PTR_ERR(pc);
+        if (!tcf_hash_check(parm->index, a, bind)) {
+                ret = tcf_hash_create(parm->index, est, a, sizeof(*p), bind);
+                if (ret)
+                        return ret;
                 ret = ACT_P_CREATED;
         } else {
                 if (bind)/* dont override defaults */
                         return 0;
-                tcf_hash_release(pc, bind, a->ops->hinfo);
+                tcf_hash_release(a, bind);
                 if (!ovr)
                         return -EEXIST;
         }
 
-        p = to_tcf_csum(pc);
+        p = to_tcf_csum(a);
         spin_lock_bh(&p->tcf_lock);
         p->tcf_action = parm->action;
         p->update_flags = parm->update_flags;
         spin_unlock_bh(&p->tcf_lock);
 
         if (ret == ACT_P_CREATED)
-                tcf_hash_insert(pc, a->ops->hinfo);
+                tcf_hash_insert(a);
 
         return ret;
 }
 
-static int tcf_csum_cleanup(struct tc_action *a, int bind)
-{
-        struct tcf_csum *p = a->priv;
-        return tcf_hash_release(&p->common, bind, &csum_hash_info);
-}
-
 /**
  * tcf_csum_skb_nextlayer - Get next layer pointer
  * @skb: sk_buff to use
@@ -569,12 +560,10 @@ nla_put_failure:
 
 static struct tc_action_ops act_csum_ops = {
         .kind           = "csum",
-        .hinfo          = &csum_hash_info,
         .type           = TCA_ACT_CSUM,
         .owner          = THIS_MODULE,
         .act            = tcf_csum,
         .dump           = tcf_csum_dump,
-        .cleanup        = tcf_csum_cleanup,
         .init           = tcf_csum_init,
 };
 
@@ -583,11 +572,7 @@ MODULE_LICENSE("GPL");
 
 static int __init csum_init_module(void)
 {
-        int err = tcf_hashinfo_init(&csum_hash_info, CSUM_TAB_MASK);
-        if (err)
-                return err;
-
-        return tcf_register_action(&act_csum_ops);
+        return tcf_register_action(&act_csum_ops, CSUM_TAB_MASK);
 }
 
 static void __exit csum_cleanup_module(void)
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index a0eed30d5811..d6bcbd9f7791 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -24,7 +24,6 @@
 #include <net/tc_act/tc_gact.h>
 
 #define GACT_TAB_MASK   15
-static struct tcf_hashinfo gact_hash_info;
 
 #ifdef CONFIG_GACT_PROB
 static int gact_net_rand(struct tcf_gact *gact)
@@ -57,7 +56,6 @@ static int tcf_gact_init(struct net *net, struct nlattr *nla,
         struct nlattr *tb[TCA_GACT_MAX + 1];
         struct tc_gact *parm;
         struct tcf_gact *gact;
-        struct tcf_common *pc;
         int ret = 0;
         int err;
 #ifdef CONFIG_GACT_PROB
@@ -86,21 +84,20 @@ static int tcf_gact_init(struct net *net, struct nlattr *nla,
         }
 #endif
 
-        pc = tcf_hash_check(parm->index, a, bind);
-        if (!pc) {
-                pc = tcf_hash_create(parm->index, est, a, sizeof(*gact), bind);
-                if (IS_ERR(pc))
-                        return PTR_ERR(pc);
+        if (!tcf_hash_check(parm->index, a, bind)) {
+                ret = tcf_hash_create(parm->index, est, a, sizeof(*gact), bind);
+                if (ret)
+                        return ret;
                 ret = ACT_P_CREATED;
         } else {
                 if (bind)/* dont override defaults */
                         return 0;
-                tcf_hash_release(pc, bind, a->ops->hinfo);
+                tcf_hash_release(a, bind);
                 if (!ovr)
                         return -EEXIST;
         }
 
-        gact = to_gact(pc);
+        gact = to_gact(a);
 
         spin_lock_bh(&gact->tcf_lock);
         gact->tcf_action = parm->action;
@@ -113,19 +110,10 @@ static int tcf_gact_init(struct net *net, struct nlattr *nla,
 #endif
         spin_unlock_bh(&gact->tcf_lock);
         if (ret == ACT_P_CREATED)
-                tcf_hash_insert(pc, a->ops->hinfo);
+                tcf_hash_insert(a);
         return ret;
 }
 
-static int tcf_gact_cleanup(struct tc_action *a, int bind)
-{
-        struct tcf_gact *gact = a->priv;
-
-        if (gact)
-                return tcf_hash_release(&gact->common, bind, a->ops->hinfo);
-        return 0;
-}
-
 static int tcf_gact(struct sk_buff *skb, const struct tc_action *a,
                     struct tcf_result *res)
 {
@@ -191,12 +179,10 @@ nla_put_failure:
 
 static struct tc_action_ops act_gact_ops = {
         .kind           =       "gact",
-        .hinfo          =       &gact_hash_info,
         .type           =       TCA_ACT_GACT,
         .owner          =       THIS_MODULE,
         .act            =       tcf_gact,
         .dump           =       tcf_gact_dump,
-        .cleanup        =       tcf_gact_cleanup,
         .init           =       tcf_gact_init,
 };
 
@@ -206,21 +192,17 @@ MODULE_LICENSE("GPL");
 
 static int __init gact_init_module(void)
 {
-        int err = tcf_hashinfo_init(&gact_hash_info, GACT_TAB_MASK);
-        if (err)
-                return err;
 #ifdef CONFIG_GACT_PROB
         pr_info("GACT probability on\n");
 #else
         pr_info("GACT probability NOT on\n");
 #endif
-        return tcf_register_action(&act_gact_ops);
+        return tcf_register_action(&act_gact_ops, GACT_TAB_MASK);
 }
 
 static void __exit gact_cleanup_module(void)
 {
         tcf_unregister_action(&act_gact_ops);
-        tcf_hashinfo_destroy(&gact_hash_info);
 }
 
 module_init(gact_init_module);
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 0a6d62174027..8a64a0734aee 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -29,7 +29,6 @@
 
 
 #define IPT_TAB_MASK     15
-static struct tcf_hashinfo ipt_hash_info;
 
 static int ipt_init_target(struct xt_entry_target *t, char *table, unsigned int hook)
 {
@@ -69,22 +68,12 @@ static void ipt_destroy_target(struct xt_entry_target *t)
         module_put(par.target->me);
 }
 
-static int tcf_ipt_release(struct tcf_ipt *ipt, int bind)
+static void tcf_ipt_release(struct tc_action *a, int bind)
 {
-        int ret = 0;
-        if (ipt) {
-                if (bind)
-                        ipt->tcf_bindcnt--;
-                ipt->tcf_refcnt--;
-                if (ipt->tcf_bindcnt <= 0 && ipt->tcf_refcnt <= 0) {
-                        ipt_destroy_target(ipt->tcfi_t);
-                        kfree(ipt->tcfi_tname);
-                        kfree(ipt->tcfi_t);
-                        tcf_hash_destroy(&ipt->common, &ipt_hash_info);
-                        ret = ACT_P_DELETED;
-                }
-        }
-        return ret;
+        struct tcf_ipt *ipt = to_ipt(a);
+        ipt_destroy_target(ipt->tcfi_t);
+        kfree(ipt->tcfi_tname);
+        kfree(ipt->tcfi_t);
 }
 
 static const struct nla_policy ipt_policy[TCA_IPT_MAX + 1] = {
@@ -99,7 +88,6 @@ static int tcf_ipt_init(struct net *net, struct nlattr *nla, struct nlattr *est,
 {
         struct nlattr *tb[TCA_IPT_MAX + 1];
         struct tcf_ipt *ipt;
-        struct tcf_common *pc;
         struct xt_entry_target *td, *t;
         char *tname;
         int ret = 0, err;
@@ -125,21 +113,20 @@ static int tcf_ipt_init(struct net *net, struct nlattr *nla, struct nlattr *est,
         if (tb[TCA_IPT_INDEX] != NULL)
                 index = nla_get_u32(tb[TCA_IPT_INDEX]);
 
-        pc = tcf_hash_check(index, a, bind);
-        if (!pc) {
-                pc = tcf_hash_create(index, est, a, sizeof(*ipt), bind);
-                if (IS_ERR(pc))
-                        return PTR_ERR(pc);
+        if (!tcf_hash_check(index, a, bind) ) {
+                ret = tcf_hash_create(index, est, a, sizeof(*ipt), bind);
+                if (ret)
+                        return ret;
                 ret = ACT_P_CREATED;
         } else {
                 if (bind)/* dont override defaults */
                         return 0;
-                tcf_ipt_release(to_ipt(pc), bind);
+                tcf_hash_release(a, bind);
 
                 if (!ovr)
                         return -EEXIST;
         }
-        ipt = to_ipt(pc);
+        ipt = to_ipt(a);
 
         hook = nla_get_u32(tb[TCA_IPT_HOOK]);
 
@@ -170,7 +157,7 @@ static int tcf_ipt_init(struct net *net, struct nlattr *nla, struct nlattr *est,
         ipt->tcfi_hook  = hook;
         spin_unlock_bh(&ipt->tcf_lock);
         if (ret == ACT_P_CREATED)
-                tcf_hash_insert(pc, a->ops->hinfo);
+                tcf_hash_insert(a);
         return ret;
 
 err3:
@@ -178,21 +165,11 @@ err3:
 err2:
         kfree(tname);
 err1:
-        if (ret == ACT_P_CREATED) {
-                if (est)
-                        gen_kill_estimator(&pc->tcfc_bstats,
-                                           &pc->tcfc_rate_est);
-                kfree_rcu(pc, tcfc_rcu);
-        }
+        if (ret == ACT_P_CREATED)
+                tcf_hash_cleanup(a, est);
         return err;
 }
 
-static int tcf_ipt_cleanup(struct tc_action *a, int bind)
-{
-        struct tcf_ipt *ipt = a->priv;
-        return tcf_ipt_release(ipt, bind);
-}
-
 static int tcf_ipt(struct sk_buff *skb, const struct tc_action *a,
                    struct tcf_result *res)
 {
@@ -284,23 +261,21 @@ nla_put_failure:
 
 static struct tc_action_ops act_ipt_ops = {
         .kind           =       "ipt",
-        .hinfo          =       &ipt_hash_info,
         .type           =       TCA_ACT_IPT,
         .owner          =       THIS_MODULE,
         .act            =       tcf_ipt,
         .dump           =       tcf_ipt_dump,
-        .cleanup        =       tcf_ipt_cleanup,
+        .cleanup        =       tcf_ipt_release,
         .init           =       tcf_ipt_init,
 };
 
 static struct tc_action_ops act_xt_ops = {
         .kind           =       "xt",
-        .hinfo          =       &ipt_hash_info,
         .type           =       TCA_ACT_XT,
         .owner          =       THIS_MODULE,
         .act            =       tcf_ipt,
         .dump           =       tcf_ipt_dump,
-        .cleanup        =       tcf_ipt_cleanup,
+        .cleanup        =       tcf_ipt_release,
         .init           =       tcf_ipt_init,
 };
 
@@ -311,20 +286,16 @@ MODULE_ALIAS("act_xt");
 
 static int __init ipt_init_module(void)
 {
-        int ret1, ret2, err;
-        err = tcf_hashinfo_init(&ipt_hash_info, IPT_TAB_MASK);
-        if (err)
-                return err;
+        int ret1, ret2;
 
-        ret1 = tcf_register_action(&act_xt_ops);
+        ret1 = tcf_register_action(&act_xt_ops, IPT_TAB_MASK);
         if (ret1 < 0)
                 printk("Failed to load xt action\n");
-        ret2 = tcf_register_action(&act_ipt_ops);
+        ret2 = tcf_register_action(&act_ipt_ops, IPT_TAB_MASK);
         if (ret2 < 0)
                 printk("Failed to load ipt action\n");
 
         if (ret1 < 0 && ret2 < 0) {
-                tcf_hashinfo_destroy(&ipt_hash_info);
                 return ret1;
         } else
                 return 0;
@@ -334,7 +305,6 @@ static void __exit ipt_cleanup_module(void)
 {
         tcf_unregister_action(&act_xt_ops);
         tcf_unregister_action(&act_ipt_ops);
-        tcf_hashinfo_destroy(&ipt_hash_info);
 }
 
 module_init(ipt_init_module);
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 0b2c6d39d396..4f912c0e225b 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -31,23 +31,13 @@
 
 #define MIRRED_TAB_MASK     7
 static LIST_HEAD(mirred_list);
-static struct tcf_hashinfo mirred_hash_info;
 
-static int tcf_mirred_release(struct tcf_mirred *m, int bind)
+static void tcf_mirred_release(struct tc_action *a, int bind)
 {
-        if (m) {
-                if (bind)
-                        m->tcf_bindcnt--;
-                m->tcf_refcnt--;
-                if (!m->tcf_bindcnt && m->tcf_refcnt <= 0) {
-                        list_del(&m->tcfm_list);
-                        if (m->tcfm_dev)
-                                dev_put(m->tcfm_dev);
-                        tcf_hash_destroy(&m->common, &mirred_hash_info);
-                        return 1;
-                }
-        }
-        return 0;
+        struct tcf_mirred *m = to_mirred(a);
+        list_del(&m->tcfm_list);
+        if (m->tcfm_dev)
+                dev_put(m->tcfm_dev);
 }
 
 static const struct nla_policy mirred_policy[TCA_MIRRED_MAX + 1] = {
@@ -61,7 +51,6 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
         struct nlattr *tb[TCA_MIRRED_MAX + 1];
         struct tc_mirred *parm;
         struct tcf_mirred *m;
-        struct tcf_common *pc;
         struct net_device *dev;
         int ret, ok_push = 0;
 
@@ -101,21 +90,20 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
                 dev = NULL;
         }
 
-        pc = tcf_hash_check(parm->index, a, bind);
-        if (!pc) {
+        if (!tcf_hash_check(parm->index, a, bind)) {
                 if (dev == NULL)
                         return -EINVAL;
-                pc = tcf_hash_create(parm->index, est, a, sizeof(*m), bind);
-                if (IS_ERR(pc))
-                        return PTR_ERR(pc);
+                ret = tcf_hash_create(parm->index, est, a, sizeof(*m), bind);
+                if (ret)
+                        return ret;
                 ret = ACT_P_CREATED;
         } else {
                 if (!ovr) {
-                        tcf_mirred_release(to_mirred(pc), bind);
+                        tcf_hash_release(a, bind);
                         return -EEXIST;
                 }
         }
-        m = to_mirred(pc);
+        m = to_mirred(a);
 
         spin_lock_bh(&m->tcf_lock);
         m->tcf_action = parm->action;
@@ -131,21 +119,12 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
         spin_unlock_bh(&m->tcf_lock);
         if (ret == ACT_P_CREATED) {
                 list_add(&m->tcfm_list, &mirred_list);
-                tcf_hash_insert(pc, a->ops->hinfo);
+                tcf_hash_insert(a);
         }
 
         return ret;
 }
 
-static int tcf_mirred_cleanup(struct tc_action *a, int bind)
-{
-        struct tcf_mirred *m = a->priv;
-
-        if (m)
-                return tcf_mirred_release(m, bind);
-        return 0;
-}
-
 static int tcf_mirred(struct sk_buff *skb, const struct tc_action *a,
                       struct tcf_result *res)
 {
@@ -254,12 +233,11 @@ static struct notifier_block mirred_device_notifier = {
 
 static struct tc_action_ops act_mirred_ops = {
         .kind           =       "mirred",
-        .hinfo          =       &mirred_hash_info,
         .type           =       TCA_ACT_MIRRED,
         .owner          =       THIS_MODULE,
         .act            =       tcf_mirred,
         .dump           =       tcf_mirred_dump,
-        .cleanup        =       tcf_mirred_cleanup,
+        .cleanup        =       tcf_mirred_release,
         .init           =       tcf_mirred_init,
 };
 
@@ -273,19 +251,13 @@ static int __init mirred_init_module(void)
         if (err)
                 return err;
 
-        err = tcf_hashinfo_init(&mirred_hash_info, MIRRED_TAB_MASK);
-        if (err) {
-                unregister_netdevice_notifier(&mirred_device_notifier);
-                return err;
-        }
         pr_info("Mirror/redirect action on\n");
-        return tcf_register_action(&act_mirred_ops);
+        return tcf_register_action(&act_mirred_ops, MIRRED_TAB_MASK);
 }
 
 static void __exit mirred_cleanup_module(void)
 {
         tcf_unregister_action(&act_mirred_ops);
-        tcf_hashinfo_destroy(&mirred_hash_info);
         unregister_netdevice_notifier(&mirred_device_notifier);
 }
 
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 81f0404bb335..270a030d5fd0 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -31,8 +31,6 @@
 
 #define NAT_TAB_MASK    15
 
-static struct tcf_hashinfo nat_hash_info;
-
 static const struct nla_policy nat_policy[TCA_NAT_MAX + 1] = {
         [TCA_NAT_PARMS] = { .len = sizeof(struct tc_nat) },
 };
@@ -44,7 +42,6 @@ static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est,
         struct tc_nat *parm;
         int ret = 0, err;
         struct tcf_nat *p;
-        struct tcf_common *pc;
 
         if (nla == NULL)
                 return -EINVAL;
@@ -57,20 +54,19 @@ static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est,
                 return -EINVAL;
         parm = nla_data(tb[TCA_NAT_PARMS]);
 
-        pc = tcf_hash_check(parm->index, a, bind);
-        if (!pc) {
-                pc = tcf_hash_create(parm->index, est, a, sizeof(*p), bind);
-                if (IS_ERR(pc))
-                        return PTR_ERR(pc);
+        if (!tcf_hash_check(parm->index, a, bind)) {
+                ret = tcf_hash_create(parm->index, est, a, sizeof(*p), bind);
+                if (ret)
+                        return ret;
                 ret = ACT_P_CREATED;
         } else {
                 if (bind)
                         return 0;
-                tcf_hash_release(pc, bind, a->ops->hinfo);
+                tcf_hash_release(a, bind);
                 if (!ovr)
                         return -EEXIST;
         }
-        p = to_tcf_nat(pc);
+        p = to_tcf_nat(a);
 
         spin_lock_bh(&p->tcf_lock);
         p->old_addr = parm->old_addr;
@@ -82,18 +78,11 @@ static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est,
         spin_unlock_bh(&p->tcf_lock);
 
         if (ret == ACT_P_CREATED)
-                tcf_hash_insert(pc, a->ops->hinfo);
+                tcf_hash_insert(a);
 
         return ret;
 }
 
-static int tcf_nat_cleanup(struct tc_action *a, int bind)
-{
-        struct tcf_nat *p = a->priv;
-
-        return tcf_hash_release(&p->common, bind, &nat_hash_info);
-}
-
 static int tcf_nat(struct sk_buff *skb, const struct tc_action *a,
                    struct tcf_result *res)
 {
@@ -293,12 +282,10 @@ nla_put_failure:
 
 static struct tc_action_ops act_nat_ops = {
         .kind           =       "nat",
-        .hinfo          =       &nat_hash_info,
         .type           =       TCA_ACT_NAT,
         .owner          =       THIS_MODULE,
         .act            =       tcf_nat,
         .dump           =       tcf_nat_dump,
-        .cleanup        =       tcf_nat_cleanup,
         .init           =       tcf_nat_init,
 };
 
@@ -307,16 +294,12 @@ MODULE_LICENSE("GPL");
 
 static int __init nat_init_module(void)
 {
-        int err = tcf_hashinfo_init(&nat_hash_info, NAT_TAB_MASK);
-        if (err)
-                return err;
-        return tcf_register_action(&act_nat_ops);
+        return tcf_register_action(&act_nat_ops, NAT_TAB_MASK);
 }
 
 static void __exit nat_cleanup_module(void)
 {
         tcf_unregister_action(&act_nat_ops);
-        tcf_hashinfo_destroy(&nat_hash_info);
 }
 
 module_init(nat_init_module);
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index be3f0f6875bb..5f9bcb2e080b 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -25,8 +25,6 @@
 
 #define PEDIT_TAB_MASK  15
 
-static struct tcf_hashinfo pedit_hash_info;
-
 static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = {
         [TCA_PEDIT_PARMS]       = { .len = sizeof(struct tc_pedit) },
 };
@@ -39,7 +37,6 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
         struct tc_pedit *parm;
         int ret = 0, err;
         struct tcf_pedit *p;
-        struct tcf_common *pc;
         struct tc_pedit_key *keys = NULL;
         int ksize;
 
@@ -57,26 +54,22 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
         if (nla_len(tb[TCA_PEDIT_PARMS]) < sizeof(*parm) + ksize)
                 return -EINVAL;
 
-        pc = tcf_hash_check(parm->index, a, bind);
-        if (!pc) {
+        if (!tcf_hash_check(parm->index, a, bind)) {
                 if (!parm->nkeys)
                         return -EINVAL;
-                pc = tcf_hash_create(parm->index, est, a, sizeof(*p), bind);
-                if (IS_ERR(pc))
-                        return PTR_ERR(pc);
-                p = to_pedit(pc);
+                ret = tcf_hash_create(parm->index, est, a, sizeof(*p), bind);
+                if (ret)
+                        return ret;
+                p = to_pedit(a);
                 keys = kmalloc(ksize, GFP_KERNEL);
                 if (keys == NULL) {
-                        if (est)
-                                gen_kill_estimator(&pc->tcfc_bstats,
-                                                   &pc->tcfc_rate_est);
-                        kfree_rcu(pc, tcfc_rcu);
+                        tcf_hash_cleanup(a, est);
                         return -ENOMEM;
                 }
                 ret = ACT_P_CREATED;
         } else {
-                p = to_pedit(pc);
-                tcf_hash_release(pc, bind, a->ops->hinfo);
+                p = to_pedit(a);
+                tcf_hash_release(a, bind);
                 if (bind)
                         return 0;
                 if (!ovr)
@@ -100,22 +93,15 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
         memcpy(p->tcfp_keys, parm->keys, ksize);
         spin_unlock_bh(&p->tcf_lock);
         if (ret == ACT_P_CREATED)
-                tcf_hash_insert(pc, a->ops->hinfo);
+                tcf_hash_insert(a);
         return ret;
 }
 
-static int tcf_pedit_cleanup(struct tc_action *a, int bind)
+static void tcf_pedit_cleanup(struct tc_action *a, int bind)
 {
         struct tcf_pedit *p = a->priv;
-
-        if (p) {
-                struct tc_pedit_key *keys = p->tcfp_keys;
-                if (tcf_hash_release(&p->common, bind, &pedit_hash_info)) {
-                        kfree(keys);
-                        return 1;
-                }
-        }
-        return 0;
+        struct tc_pedit_key *keys = p->tcfp_keys;
+        kfree(keys);
 }
 
 static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
@@ -230,7 +216,6 @@ nla_put_failure:
 
 static struct tc_action_ops act_pedit_ops = {
         .kind           =       "pedit",
-        .hinfo          =       &pedit_hash_info,
         .type           =       TCA_ACT_PEDIT,
         .owner          =       THIS_MODULE,
         .act            =       tcf_pedit,
@@ -245,15 +230,11 @@ MODULE_LICENSE("GPL");
 
 static int __init pedit_init_module(void)
 {
-        int err = tcf_hashinfo_init(&pedit_hash_info, PEDIT_TAB_MASK);
-        if (err)
-                return err;
-        return tcf_register_action(&act_pedit_ops);
+        return tcf_register_action(&act_pedit_ops, PEDIT_TAB_MASK);
 }
 
 static void __exit pedit_cleanup_module(void)
 {
-        tcf_hashinfo_destroy(&pedit_hash_info);
         tcf_unregister_action(&act_pedit_ops);
 }
 
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 1778209a332f..0566e4606a4a 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -41,7 +41,6 @@ struct tcf_police {
         container_of(pc, struct tcf_police, common)
 
 #define POL_TAB_MASK     15
-static struct tcf_hashinfo police_hash_info;
 
 /* old policer structure from before tc actions */
 struct tc_police_compat {
@@ -234,7 +233,7 @@ override:
 
         police->tcfp_t_c = ktime_to_ns(ktime_get());
         police->tcf_index = parm->index ? parm->index :
-                tcf_hash_new_index(a->ops->hinfo);
+                tcf_hash_new_index(hinfo);
         h = tcf_hash(police->tcf_index, POL_TAB_MASK);
         spin_lock_bh(&hinfo->lock);
         hlist_add_head(&police->tcf_head, &hinfo->htab[h]);
@@ -253,14 +252,6 @@ failure:
         return err;
 }
 
-static int tcf_act_police_cleanup(struct tc_action *a, int bind)
-{
-        struct tcf_police *p = a->priv;
-        if (p)
-                return tcf_hash_release(&p->common, bind, &police_hash_info);
-        return 0;
-}
-
 static int tcf_act_police(struct sk_buff *skb, const struct tc_action *a,
                           struct tcf_result *res)
 {
@@ -357,12 +348,10 @@ MODULE_LICENSE("GPL");
 
 static struct tc_action_ops act_police_ops = {
         .kind           =       "police",
-        .hinfo          =       &police_hash_info,
         .type           =       TCA_ID_POLICE,
         .owner          =       THIS_MODULE,
         .act            =       tcf_act_police,
         .dump           =       tcf_act_police_dump,
-        .cleanup        =       tcf_act_police_cleanup,
         .init           =       tcf_act_police_locate,
         .walk           =       tcf_act_police_walker
 };
@@ -370,19 +359,12 @@ static struct tc_action_ops act_police_ops = {
 static int __init
 police_init_module(void)
 {
-        int err = tcf_hashinfo_init(&police_hash_info, POL_TAB_MASK);
-        if (err)
-                return err;
-        err = tcf_register_action(&act_police_ops);
-        if (err)
-                tcf_hashinfo_destroy(&police_hash_info);
-        return err;
+        return tcf_register_action(&act_police_ops, POL_TAB_MASK);
 }
 
 static void __exit
 police_cleanup_module(void)
 {
-        tcf_hashinfo_destroy(&police_hash_info);
         tcf_unregister_action(&act_police_ops);
 }
 
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 8ef2f1fcbfba..992c2317ce88 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -25,7 +25,6 @@
 #include <net/tc_act/tc_defact.h>
 
 #define SIMP_TAB_MASK     7
-static struct tcf_hashinfo simp_hash_info;
 
 #define SIMP_MAX_DATA   32
 static int tcf_simp(struct sk_buff *skb, const struct tc_action *a,
@@ -47,20 +46,10 @@ static int tcf_simp(struct sk_buff *skb, const struct tc_action *a,
         return d->tcf_action;
 }
 
-static int tcf_simp_release(struct tcf_defact *d, int bind)
+static void tcf_simp_release(struct tc_action *a, int bind)
 {
-        int ret = 0;
-        if (d) {
-                if (bind)
-                        d->tcf_bindcnt--;
-                d->tcf_refcnt--;
-                if (d->tcf_bindcnt <= 0 && d->tcf_refcnt <= 0) {
-                        kfree(d->tcfd_defdata);
-                        tcf_hash_destroy(&d->common, &simp_hash_info);
-                        ret = 1;
-                }
-        }
-        return ret;
+        struct tcf_defact *d = to_defact(a);
+        kfree(d->tcfd_defdata);
 }
 
 static int alloc_defdata(struct tcf_defact *d, char *defdata)
@@ -94,7 +83,6 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
         struct nlattr *tb[TCA_DEF_MAX + 1];
         struct tc_defact *parm;
         struct tcf_defact *d;
-        struct tcf_common *pc;
         char *defdata;
         int ret = 0, err;
 
@@ -114,29 +102,25 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
         parm = nla_data(tb[TCA_DEF_PARMS]);
         defdata = nla_data(tb[TCA_DEF_DATA]);
 
-        pc = tcf_hash_check(parm->index, a, bind);
-        if (!pc) {
-                pc = tcf_hash_create(parm->index, est, a, sizeof(*d), bind);
-                if (IS_ERR(pc))
-                        return PTR_ERR(pc);
+        if (!tcf_hash_check(parm->index, a, bind)) {
+                ret = tcf_hash_create(parm->index, est, a, sizeof(*d), bind);
+                if (ret)
+                        return ret;
 
-                d = to_defact(pc);
+                d = to_defact(a);
                 ret = alloc_defdata(d, defdata);
                 if (ret < 0) {
-                        if (est)
-                                gen_kill_estimator(&pc->tcfc_bstats,
-                                                   &pc->tcfc_rate_est);
-                        kfree_rcu(pc, tcfc_rcu);
+                        tcf_hash_cleanup(a, est);
                         return ret;
                 }
                 d->tcf_action = parm->action;
                 ret = ACT_P_CREATED;
         } else {
-                d = to_defact(pc);
+                d = to_defact(a);
 
                 if (bind)
                         return 0;
-                tcf_simp_release(d, bind);
+                tcf_hash_release(a, bind);
                 if (!ovr)
                         return -EEXIST;
 
@@ -144,19 +128,10 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
         }
 
         if (ret == ACT_P_CREATED)
-                tcf_hash_insert(pc, a->ops->hinfo);
+                tcf_hash_insert(a);
         return ret;
 }
 
-static int tcf_simp_cleanup(struct tc_action *a, int bind)
-{
-        struct tcf_defact *d = a->priv;
-
-        if (d)
-                return tcf_simp_release(d, bind);
-        return 0;
-}
-
 static int tcf_simp_dump(struct sk_buff *skb, struct tc_action *a,
                          int bind, int ref)
 {
@@ -187,12 +162,11 @@ nla_put_failure:
 
 static struct tc_action_ops act_simp_ops = {
         .kind           =       "simple",
-        .hinfo          =       &simp_hash_info,
         .type           =       TCA_ACT_SIMP,
         .owner          =       THIS_MODULE,
         .act            =       tcf_simp,
         .dump           =       tcf_simp_dump,
-        .cleanup        =       tcf_simp_cleanup,
+        .cleanup        =       tcf_simp_release,
         .init           =       tcf_simp_init,
 };
 
@@ -202,23 +176,15 @@ MODULE_LICENSE("GPL");
 
 static int __init simp_init_module(void)
 {
-        int err, ret;
-        err = tcf_hashinfo_init(&simp_hash_info, SIMP_TAB_MASK);
-        if (err)
-                return err;
-
-        ret = tcf_register_action(&act_simp_ops);
+        int ret;
+        ret = tcf_register_action(&act_simp_ops, SIMP_TAB_MASK);
         if (!ret)
                 pr_info("Simple TC action Loaded\n");
-        else
-                tcf_hashinfo_destroy(&simp_hash_info);
-
         return ret;
 }
 
 static void __exit simp_cleanup_module(void)
 {
-        tcf_hashinfo_destroy(&simp_hash_info);
         tcf_unregister_action(&act_simp_ops);
 }
 
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index 98725080b5aa..fcfeeaf838be 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -28,7 +28,6 @@
 #include <net/tc_act/tc_skbedit.h>
 
 #define SKBEDIT_TAB_MASK     15
-static struct tcf_hashinfo skbedit_hash_info;
 
 static int tcf_skbedit(struct sk_buff *skb, const struct tc_action *a,
                        struct tcf_result *res)
@@ -65,7 +64,6 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
         struct nlattr *tb[TCA_SKBEDIT_MAX + 1];
         struct tc_skbedit *parm;
         struct tcf_skbedit *d;
-        struct tcf_common *pc;
         u32 flags = 0, *priority = NULL, *mark = NULL;
         u16 *queue_mapping = NULL;
         int ret = 0, err;
@@ -100,19 +98,18 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
 
         parm = nla_data(tb[TCA_SKBEDIT_PARMS]);
 
-        pc = tcf_hash_check(parm->index, a, bind);
-        if (!pc) {
-                pc = tcf_hash_create(parm->index, est, a, sizeof(*d), bind);
-                if (IS_ERR(pc))
-                        return PTR_ERR(pc);
+        if (!tcf_hash_check(parm->index, a, bind)) {
+                ret = tcf_hash_create(parm->index, est, a, sizeof(*d), bind);
+                if (ret)
+                        return ret;
 
-                d = to_skbedit(pc);
+                d = to_skbedit(a);
                 ret = ACT_P_CREATED;
         } else {
-                d = to_skbedit(pc);
+                d = to_skbedit(a);
                 if (bind)
                         return 0;
-                tcf_hash_release(pc, bind, a->ops->hinfo);
+                tcf_hash_release(a, bind);
                 if (!ovr)
                         return -EEXIST;
         }
@@ -132,19 +129,10 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
         spin_unlock_bh(&d->tcf_lock);
 
         if (ret == ACT_P_CREATED)
-                tcf_hash_insert(pc, a->ops->hinfo);
+                tcf_hash_insert(a);
         return ret;
 }
 
-static int tcf_skbedit_cleanup(struct tc_action *a, int bind)
-{
-        struct tcf_skbedit *d = a->priv;
-
-        if (d)
-                return tcf_hash_release(&d->common, bind, &skbedit_hash_info);
-        return 0;
-}
-
 static int tcf_skbedit_dump(struct sk_buff *skb, struct tc_action *a,
                             int bind, int ref)
 {
@@ -186,12 +174,10 @@ nla_put_failure:
 
 static struct tc_action_ops act_skbedit_ops = {
         .kind           =       "skbedit",
-        .hinfo          =       &skbedit_hash_info,
         .type           =       TCA_ACT_SKBEDIT,
         .owner          =       THIS_MODULE,
         .act            =       tcf_skbedit,
         .dump           =       tcf_skbedit_dump,
-        .cleanup        =       tcf_skbedit_cleanup,
         .init           =       tcf_skbedit_init,
 };
 
@@ -201,15 +187,11 @@ MODULE_LICENSE("GPL");
 
 static int __init skbedit_init_module(void)
 {
-        int err = tcf_hashinfo_init(&skbedit_hash_info, SKBEDIT_TAB_MASK);
-        if (err)
-                return err;
-        return tcf_register_action(&act_skbedit_ops);
+        return tcf_register_action(&act_skbedit_ops, SKBEDIT_TAB_MASK);
 }
 
 static void __exit skbedit_cleanup_module(void)
 {
-        tcf_hashinfo_destroy(&skbedit_hash_info);
         tcf_unregister_action(&act_skbedit_ops);
 }
 
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index a366537f82c6..63a3ce75c02e 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -29,11 +29,11 @@
 #include <net/act_api.h>
 #include <net/pkt_cls.h>
 
-#define HTSIZE (PAGE_SIZE/sizeof(struct fw_filter *))
+#define HTSIZE 256
 
 struct fw_head {
-        struct fw_filter *ht[HTSIZE];
-        u32 mask;
+        u32                     mask;
+        struct fw_filter        *ht[HTSIZE];
 };
 
 struct fw_filter {
@@ -46,30 +46,11 @@ struct fw_filter {
         struct tcf_exts         exts;
 };
 
-static inline int fw_hash(u32 handle)
+static u32 fw_hash(u32 handle)
 {
-        if (HTSIZE == 4096)
-                return ((handle >> 24) & 0xFFF) ^
-                       ((handle >> 12) & 0xFFF) ^
-                       (handle & 0xFFF);
-        else if (HTSIZE == 2048)
-                return ((handle >> 22) & 0x7FF) ^
-                       ((handle >> 11) & 0x7FF) ^
-                       (handle & 0x7FF);
-        else if (HTSIZE == 1024)
-                return ((handle >> 20) & 0x3FF) ^
-                       ((handle >> 10) & 0x3FF) ^
-                       (handle & 0x3FF);
-        else if (HTSIZE == 512)
-                return (handle >> 27) ^
-                       ((handle >> 18) & 0x1FF) ^
-                       ((handle >> 9) & 0x1FF) ^
-                       (handle & 0x1FF);
-        else if (HTSIZE == 256) {
-                u8 *t = (u8 *) &handle;
-                return t[0] ^ t[1] ^ t[2] ^ t[3];
-        } else
-                return handle & (HTSIZE - 1);
+        handle ^= (handle >> 16);
+        handle ^= (handle >> 8);
+        return handle % HTSIZE;
 }
 
 static int fw_classify(struct sk_buff *skb, const struct tcf_proto *tp,
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index a07d55e75698..a0b84e0e22de 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1304,6 +1304,7 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
         struct gnet_dump d;
         struct qdisc_size_table *stab;
 
+        cond_resched();
         nlh = nlmsg_put(skb, portid, seq, event, sizeof(*tcm), flags);
         if (!nlh)
                 goto out_nlmsg_trim;
@@ -1435,9 +1436,9 @@ static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
         s_idx = cb->args[0];
         s_q_idx = q_idx = cb->args[1];
 
-        rcu_read_lock();
         idx = 0;
-        for_each_netdev_rcu(net, dev) {
+        ASSERT_RTNL();
+        for_each_netdev(net, dev) {
                 struct netdev_queue *dev_queue;
 
                 if (idx < s_idx)
@@ -1460,8 +1461,6 @@ cont:
         }
 
 done:
-        rcu_read_unlock();
-
         cb->args[0] = idx;
         cb->args[1] = q_idx;
 
@@ -1618,6 +1617,7 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
         struct gnet_dump d;
         const struct Qdisc_class_ops *cl_ops = q->ops->cl_ops;
 
+        cond_resched();
         nlh = nlmsg_put(skb, portid, seq, event, sizeof(*tcm), flags);
         if (!nlh)
                 goto out_nlmsg_trim;
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 1f9c31411f19..8449b337f9e3 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -623,8 +623,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
                 if (nla_put_u32(skb, TCA_ATM_EXCESS, 0))
                         goto nla_put_failure;
         }
-        nla_nest_end(skb, nest);
-        return skb->len;
+        return nla_nest_end(skb, nest);
 
 nla_put_failure:
         nla_nest_cancel(skb, nest);
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 2f80d01d42a6..ead526467cca 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1563,8 +1563,7 @@ static int cbq_dump(struct Qdisc *sch, struct sk_buff *skb)
                 goto nla_put_failure;
         if (cbq_dump_attr(skb, &q->link) < 0)
                 goto nla_put_failure;
-        nla_nest_end(skb, nest);
-        return skb->len;
+        return nla_nest_end(skb, nest);
 
 nla_put_failure:
         nla_nest_cancel(skb, nest);
@@ -1599,8 +1598,7 @@ cbq_dump_class(struct Qdisc *sch, unsigned long arg,
                 goto nla_put_failure;
         if (cbq_dump_attr(skb, cl) < 0)
                 goto nla_put_failure;
-        nla_nest_end(skb, nest);
-        return skb->len;
+        return nla_nest_end(skb, nest);
 
 nla_put_failure:
         nla_nest_cancel(skb, nest);
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 21e251766eb1..23c682b42f99 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -781,8 +781,7 @@ static int fq_dump(struct Qdisc *sch, struct sk_buff *skb)
             nla_put_u32(skb, TCA_FQ_BUCKETS_LOG, q->fq_trees_log))
                 goto nla_put_failure;
 
-        nla_nest_end(skb, opts);
-        return skb->len;
+        return nla_nest_end(skb, opts);
 
 nla_put_failure:
         return -1;
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index ba5bc929eac7..0bf432c782c1 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -450,8 +450,7 @@ static int fq_codel_dump(struct Qdisc *sch, struct sk_buff *skb)
                         q->flows_cnt))
                 goto nla_put_failure;
 
-        nla_nest_end(skb, opts);
-        return skb->len;
+        return nla_nest_end(skb, opts);
 
 nla_put_failure:
         return -1;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index e82e43b69c33..e1543b03e39d 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -310,6 +310,7 @@ void netif_carrier_on(struct net_device *dev)
         if (test_and_clear_bit(__LINK_STATE_NOCARRIER, &dev->state)) {
                 if (dev->reg_state == NETREG_UNINITIALIZED)
                         return;
+                atomic_inc(&dev->carrier_changes);
                 linkwatch_fire_event(dev);
                 if (netif_running(dev))
                         __netdev_watchdog_up(dev);
@@ -328,6 +329,7 @@ void netif_carrier_off(struct net_device *dev)
         if (!test_and_set_bit(__LINK_STATE_NOCARRIER, &dev->state)) {
                 if (dev->reg_state == NETREG_UNINITIALIZED)
                         return;
+                atomic_inc(&dev->carrier_changes);
                 linkwatch_fire_event(dev);
         }
 }
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index c4075610502c..ec8aeaac1dd7 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1353,8 +1353,7 @@ hfsc_dump_class(struct Qdisc *sch, unsigned long arg, struct sk_buff *skb,
                 goto nla_put_failure;
         if (hfsc_dump_curves(skb, cl) < 0)
                 goto nla_put_failure;
-        nla_nest_end(skb, nest);
-        return skb->len;
+        return nla_nest_end(skb, nest);
 
  nla_put_failure:
         nla_nest_cancel(skb, nest);
diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
index 647680b1c625..edee03d922e2 100644
--- a/net/sched/sch_hhf.c
+++ b/net/sched/sch_hhf.c
@@ -691,8 +691,7 @@ static int hhf_dump(struct Qdisc *sch, struct sk_buff *skb)
             nla_put_u32(skb, TCA_HHF_NON_HH_WEIGHT, q->hhf_non_hh_weight))
                 goto nla_put_failure;
 
-        nla_nest_end(skb, opts);
-        return skb->len;
+        return nla_nest_end(skb, opts);
 
 nla_put_failure:
         return -1;
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 722e137df244..9f949abcacef 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1062,12 +1062,13 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt)
 
 static int htb_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
-        spinlock_t *root_lock = qdisc_root_sleeping_lock(sch);
         struct htb_sched *q = qdisc_priv(sch);
         struct nlattr *nest;
         struct tc_htb_glob gopt;
 
-        spin_lock_bh(root_lock);
+        /* Its safe to not acquire qdisc lock. As we hold RTNL,
+         * no change can happen on the qdisc parameters.
+         */
 
         gopt.direct_pkts = q->direct_pkts;
         gopt.version = HTB_VER;
@@ -1081,13 +1082,10 @@ static int htb_dump(struct Qdisc *sch, struct sk_buff *skb)
         if (nla_put(skb, TCA_HTB_INIT, sizeof(gopt), &gopt) ||
             nla_put_u32(skb, TCA_HTB_DIRECT_QLEN, q->direct_qlen))
                 goto nla_put_failure;
-        nla_nest_end(skb, nest);
 
-        spin_unlock_bh(root_lock);
-        return skb->len;
+        return nla_nest_end(skb, nest);
 
 nla_put_failure:
-        spin_unlock_bh(root_lock);
         nla_nest_cancel(skb, nest);
         return -1;
 }
@@ -1096,11 +1094,12 @@ static int htb_dump_class(struct Qdisc *sch, unsigned long arg,
                           struct sk_buff *skb, struct tcmsg *tcm)
 {
         struct htb_class *cl = (struct htb_class *)arg;
-        spinlock_t *root_lock = qdisc_root_sleeping_lock(sch);
         struct nlattr *nest;
         struct tc_htb_opt opt;
 
-        spin_lock_bh(root_lock);
+        /* Its safe to not acquire qdisc lock. As we hold RTNL,
+         * no change can happen on the class parameters.
+         */
         tcm->tcm_parent = cl->parent ? cl->parent->common.classid : TC_H_ROOT;
         tcm->tcm_handle = cl->common.classid;
         if (!cl->level && cl->un.leaf.q)
@@ -1128,12 +1127,9 @@ static int htb_dump_class(struct Qdisc *sch, unsigned long arg,
             nla_put_u64(skb, TCA_HTB_CEIL64, cl->ceil.rate_bytes_ps))
                 goto nla_put_failure;
 
-        nla_nest_end(skb, nest);
-        spin_unlock_bh(root_lock);
-        return skb->len;
+        return nla_nest_end(skb, nest);
 
 nla_put_failure:
-        spin_unlock_bh(root_lock);
         nla_nest_cancel(skb, nest);
         return -1;
 }
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index bce1665239b8..62871c14e1f9 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -100,8 +100,7 @@ static int ingress_dump(struct Qdisc *sch, struct sk_buff *skb)
         nest = nla_nest_start(skb, TCA_OPTIONS);
         if (nest == NULL)
                 goto nla_put_failure;
-        nla_nest_end(skb, nest);
-        return skb->len;
+        return nla_nest_end(skb, nest);
 
 nla_put_failure:
         nla_nest_cancel(skb, nest);
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index de1059af6da1..f1669a00f571 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -117,6 +117,11 @@ struct netem_sched_data {
                 LOST_IN_BURST_PERIOD,
         } _4_state_model;
 
+        enum {
+                GOOD_STATE = 1,
+                BAD_STATE,
+        } GE_state_model;
+
         /* Correlated Loss Generation models */
         struct clgstate {
                 /* state of the Markov chain */
@@ -272,15 +277,15 @@ static bool loss_gilb_ell(struct netem_sched_data *q)
         struct clgstate *clg = &q->clg;
 
         switch (clg->state) {
-        case 1:
+        case GOOD_STATE:
                 if (prandom_u32() < clg->a1)
-                        clg->state = 2;
+                        clg->state = BAD_STATE;
                 if (prandom_u32() < clg->a4)
                         return true;
                 break;
-        case 2:
+        case BAD_STATE:
                 if (prandom_u32() < clg->a2)
-                        clg->state = 1;
+                        clg->state = GOOD_STATE;
                 if (prandom_u32() > clg->a3)
                         return true;
         }
@@ -689,9 +694,8 @@ static int get_dist_table(struct Qdisc *sch, const struct nlattr *attr)
         return 0;
 }
 
-static void get_correlation(struct Qdisc *sch, const struct nlattr *attr)
+static void get_correlation(struct netem_sched_data *q, const struct nlattr *attr)
 {
-        struct netem_sched_data *q = qdisc_priv(sch);
         const struct tc_netem_corr *c = nla_data(attr);
 
         init_crandom(&q->delay_cor, c->delay_corr);
@@ -699,27 +703,24 @@ static void get_correlation(struct Qdisc *sch, const struct nlattr *attr)
         init_crandom(&q->dup_cor, c->dup_corr);
 }
 
-static void get_reorder(struct Qdisc *sch, const struct nlattr *attr)
+static void get_reorder(struct netem_sched_data *q, const struct nlattr *attr)
 {
-        struct netem_sched_data *q = qdisc_priv(sch);
         const struct tc_netem_reorder *r = nla_data(attr);
 
         q->reorder = r->probability;
         init_crandom(&q->reorder_cor, r->correlation);
 }
 
-static void get_corrupt(struct Qdisc *sch, const struct nlattr *attr)
+static void get_corrupt(struct netem_sched_data *q, const struct nlattr *attr)
 {
-        struct netem_sched_data *q = qdisc_priv(sch);
         const struct tc_netem_corrupt *r = nla_data(attr);
 
         q->corrupt = r->probability;
         init_crandom(&q->corrupt_cor, r->correlation);
 }
 
-static void get_rate(struct Qdisc *sch, const struct nlattr *attr)
+static void get_rate(struct netem_sched_data *q, const struct nlattr *attr)
 {
-        struct netem_sched_data *q = qdisc_priv(sch);
         const struct tc_netem_rate *r = nla_data(attr);
 
         q->rate = r->rate;
@@ -732,9 +733,8 @@ static void get_rate(struct Qdisc *sch, const struct nlattr *attr)
                 q->cell_size_reciprocal = (struct reciprocal_value) { 0 };
 }
 
-static int get_loss_clg(struct Qdisc *sch, const struct nlattr *attr)
+static int get_loss_clg(struct netem_sched_data *q, const struct nlattr *attr)
 {
-        struct netem_sched_data *q = qdisc_priv(sch);
         const struct nlattr *la;
         int rem;
 
@@ -752,7 +752,7 @@ static int get_loss_clg(struct Qdisc *sch, const struct nlattr *attr)
 
                         q->loss_model = CLG_4_STATES;
 
-                        q->clg.state = 1;
+                        q->clg.state = TX_IN_GAP_PERIOD;
                         q->clg.a1 = gi->p13;
                         q->clg.a2 = gi->p31;
                         q->clg.a3 = gi->p32;
@@ -770,7 +770,7 @@ static int get_loss_clg(struct Qdisc *sch, const struct nlattr *attr)
                         }
 
                         q->loss_model = CLG_GILB_ELL;
-                        q->clg.state = 1;
+                        q->clg.state = GOOD_STATE;
                         q->clg.a1 = ge->p;
                         q->clg.a2 = ge->r;
                         q->clg.a3 = ge->h;
@@ -821,6 +821,8 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt)
         struct netem_sched_data *q = qdisc_priv(sch);
         struct nlattr *tb[TCA_NETEM_MAX + 1];
         struct tc_netem_qopt *qopt;
+        struct clgstate old_clg;
+        int old_loss_model = CLG_RANDOM;
         int ret;
 
         if (opt == NULL)
@@ -831,6 +833,33 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt)
         if (ret < 0)
                 return ret;
 
+        /* backup q->clg and q->loss_model */
+        old_clg = q->clg;
+        old_loss_model = q->loss_model;
+
+        if (tb[TCA_NETEM_LOSS]) {
+                ret = get_loss_clg(q, tb[TCA_NETEM_LOSS]);
+                if (ret) {
+                        q->loss_model = old_loss_model;
+                        return ret;
+                }
+        } else {
+                q->loss_model = CLG_RANDOM;
+        }
+
+        if (tb[TCA_NETEM_DELAY_DIST]) {
+                ret = get_dist_table(sch, tb[TCA_NETEM_DELAY_DIST]);
+                if (ret) {
+                        /* recover clg and loss_model, in case of
+                         * q->clg and q->loss_model were modified
+                         * in get_loss_clg()
+                         */
+                        q->clg = old_clg;
+                        q->loss_model = old_loss_model;
+                        return ret;
+                }
+        }
+
         sch->limit = qopt->limit;
 
         q->latency = qopt->latency;
@@ -848,22 +877,16 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt)
                 q->reorder = ~0;
 
         if (tb[TCA_NETEM_CORR])
-                get_correlation(sch, tb[TCA_NETEM_CORR]);
-
-        if (tb[TCA_NETEM_DELAY_DIST]) {
-                ret = get_dist_table(sch, tb[TCA_NETEM_DELAY_DIST]);
-                if (ret)
-                        return ret;
-        }
+                get_correlation(q, tb[TCA_NETEM_CORR]);
 
         if (tb[TCA_NETEM_REORDER])
-                get_reorder(sch, tb[TCA_NETEM_REORDER]);
+                get_reorder(q, tb[TCA_NETEM_REORDER]);
 
         if (tb[TCA_NETEM_CORRUPT])
-                get_corrupt(sch, tb[TCA_NETEM_CORRUPT]);
+                get_corrupt(q, tb[TCA_NETEM_CORRUPT]);
 
         if (tb[TCA_NETEM_RATE])
-                get_rate(sch, tb[TCA_NETEM_RATE]);
+                get_rate(q, tb[TCA_NETEM_RATE]);
 
         if (tb[TCA_NETEM_RATE64])
                 q->rate = max_t(u64, q->rate,
@@ -872,10 +895,6 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt)
         if (tb[TCA_NETEM_ECN])
                 q->ecn = nla_get_u32(tb[TCA_NETEM_ECN]);
 
-        q->loss_model = CLG_RANDOM;
-        if (tb[TCA_NETEM_LOSS])
-                ret = get_loss_clg(sch, tb[TCA_NETEM_LOSS]);
-
         return ret;
 }
 
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 4f505a006896..18ff63433709 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -101,12 +101,11 @@
 struct tbf_sched_data {
 /* Parameters */
         u32             limit;          /* Maximal length of backlog: bytes */
+        u32             max_size;
         s64             buffer;         /* Token bucket depth/rate: MUST BE >= MTU/B */
         s64             mtu;
-        u32             max_size;
         struct psched_ratecfg rate;
         struct psched_ratecfg peak;
-        bool peak_present;
 
 /* Variables */
         s64     tokens;                 /* Current number of B tokens */
@@ -222,6 +221,11 @@ static unsigned int tbf_drop(struct Qdisc *sch)
         return len;
 }
 
+static bool tbf_peak_present(const struct tbf_sched_data *q)
+{
+        return q->peak.rate_bytes_ps;
+}
+
 static struct sk_buff *tbf_dequeue(struct Qdisc *sch)
 {
         struct tbf_sched_data *q = qdisc_priv(sch);
@@ -238,7 +242,7 @@ static struct sk_buff *tbf_dequeue(struct Qdisc *sch)
                 now = ktime_to_ns(ktime_get());
                 toks = min_t(s64, now - q->t_c, q->buffer);
 
-                if (q->peak_present) {
+                if (tbf_peak_present(q)) {
                         ptoks = toks + q->ptokens;
                         if (ptoks > q->mtu)
                                 ptoks = q->mtu;
@@ -366,6 +370,8 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
                 } else {
                         max_size = min_t(u64, max_size, psched_ns_t2l(&peak, mtu));
                 }
+        } else {
+                memset(&peak, 0, sizeof(peak));
         }
 
         if (max_size < psched_mtu(qdisc_dev(sch)))
@@ -410,12 +416,7 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
         q->ptokens = q->mtu;
 
         memcpy(&q->rate, &rate, sizeof(struct psched_ratecfg));
-        if (qopt->peakrate.rate) {
-                memcpy(&q->peak, &peak, sizeof(struct psched_ratecfg));
-                q->peak_present = true;
-        } else {
-                q->peak_present = false;
-        }
+        memcpy(&q->peak, &peak, sizeof(struct psched_ratecfg));
 
         sch_tree_unlock(sch);
         err = 0;
@@ -458,7 +459,7 @@ static int tbf_dump(struct Qdisc *sch, struct sk_buff *skb)
 
         opt.limit = q->limit;
         psched_ratecfg_getrate(&opt.rate, &q->rate);
-        if (q->peak_present)
+        if (tbf_peak_present(q))
                 psched_ratecfg_getrate(&opt.peakrate, &q->peak);
         else
                 memset(&opt.peakrate, 0, sizeof(opt.peakrate));
@@ -469,13 +470,12 @@ static int tbf_dump(struct Qdisc *sch, struct sk_buff *skb)
         if (q->rate.rate_bytes_ps >= (1ULL << 32) &&
             nla_put_u64(skb, TCA_TBF_RATE64, q->rate.rate_bytes_ps))
                 goto nla_put_failure;
-        if (q->peak_present &&
+        if (tbf_peak_present(q) &&
             q->peak.rate_bytes_ps >= (1ULL << 32) &&
             nla_put_u64(skb, TCA_TBF_PRATE64, q->peak.rate_bytes_ps))
                 goto nla_put_failure;
 
-        nla_nest_end(skb, nest);
-        return skb->len;
+        return nla_nest_end(skb, nest);
 
 nla_put_failure:
         nla_nest_cancel(skb, nest);
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index ee13d28d39d1..39579c3e0d14 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1319,8 +1319,7 @@ void sctp_assoc_update_retran_path(struct sctp_association *asoc)
                         break;
         }
 
-        if (trans_next != NULL)
-                asoc->peer.retran_path = trans_next;
+        asoc->peer.retran_path = trans_next;
 
         pr_debug("%s: association:%p updated new path to addr:%pISpc\n",
                  __func__, asoc, &asoc->peer.retran_path->ipaddr.sa);
@@ -1396,35 +1395,44 @@ static inline bool sctp_peer_needs_update(struct sctp_association *asoc)
         return false;
 }
 
-/* Update asoc's rwnd for the approximated state in the buffer,
- * and check whether SACK needs to be sent.
- */
-void sctp_assoc_rwnd_update(struct sctp_association *asoc, bool update_peer)
+/* Increase asoc's rwnd by len and send any window update SACK if needed. */
+void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned int len)
 {
-        int rx_count;
         struct sctp_chunk *sack;
         struct timer_list *timer;
 
-        if (asoc->ep->rcvbuf_policy)
-                rx_count = atomic_read(&asoc->rmem_alloc);
-        else
-                rx_count = atomic_read(&asoc->base.sk->sk_rmem_alloc);
+        if (asoc->rwnd_over) {
+                if (asoc->rwnd_over >= len) {
+                        asoc->rwnd_over -= len;
+                } else {
+                        asoc->rwnd += (len - asoc->rwnd_over);
+                        asoc->rwnd_over = 0;
+                }
+        } else {
+                asoc->rwnd += len;
+        }
 
-        if ((asoc->base.sk->sk_rcvbuf - rx_count) > 0)
-                asoc->rwnd = (asoc->base.sk->sk_rcvbuf - rx_count) >> 1;
-        else
-                asoc->rwnd = 0;
+        /* If we had window pressure, start recovering it
+         * once our rwnd had reached the accumulated pressure
+         * threshold.  The idea is to recover slowly, but up
+         * to the initial advertised window.
+         */
+        if (asoc->rwnd_press && asoc->rwnd >= asoc->rwnd_press) {
+                int change = min(asoc->pathmtu, asoc->rwnd_press);
+                asoc->rwnd += change;
+                asoc->rwnd_press -= change;
+        }
 
-        pr_debug("%s: asoc:%p rwnd=%u, rx_count=%d, sk_rcvbuf=%d\n",
-                 __func__, asoc, asoc->rwnd, rx_count,
-                 asoc->base.sk->sk_rcvbuf);
+        pr_debug("%s: asoc:%p rwnd increased by %d to (%u, %u) - %u\n",
+                 __func__, asoc, len, asoc->rwnd, asoc->rwnd_over,
+                 asoc->a_rwnd);
 
         /* Send a window update SACK if the rwnd has increased by at least the
          * minimum of the association's PMTU and half of the receive buffer.
          * The algorithm used is similar to the one described in
          * Section 4.2.3.3 of RFC 1122.
          */
-        if (update_peer && sctp_peer_needs_update(asoc)) {
+        if (sctp_peer_needs_update(asoc)) {
                 asoc->a_rwnd = asoc->rwnd;
 
                 pr_debug("%s: sending window update SACK- asoc:%p rwnd:%u "
@@ -1446,6 +1454,45 @@ void sctp_assoc_rwnd_update(struct sctp_association *asoc, bool update_peer)
         }
 }
 
+/* Decrease asoc's rwnd by len. */
+void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned int len)
+{
+        int rx_count;
+        int over = 0;
+
+        if (unlikely(!asoc->rwnd || asoc->rwnd_over))
+                pr_debug("%s: association:%p has asoc->rwnd:%u, "
+                         "asoc->rwnd_over:%u!\n", __func__, asoc,
+                         asoc->rwnd, asoc->rwnd_over);
+
+        if (asoc->ep->rcvbuf_policy)
+                rx_count = atomic_read(&asoc->rmem_alloc);
+        else
+                rx_count = atomic_read(&asoc->base.sk->sk_rmem_alloc);
+
+        /* If we've reached or overflowed our receive buffer, announce
+         * a 0 rwnd if rwnd would still be positive.  Store the
+         * the potential pressure overflow so that the window can be restored
+         * back to original value.
+         */
+        if (rx_count >= asoc->base.sk->sk_rcvbuf)
+                over = 1;
+
+        if (asoc->rwnd >= len) {
+                asoc->rwnd -= len;
+                if (over) {
+                        asoc->rwnd_press += asoc->rwnd;
+                        asoc->rwnd = 0;
+                }
+        } else {
+                asoc->rwnd_over = len - asoc->rwnd;
+                asoc->rwnd = 0;
+        }
+
+        pr_debug("%s: asoc:%p rwnd decreased by %d to (%u, %u, %u)\n",
+                 __func__, asoc, len, asoc->rwnd, asoc->rwnd_over,
+                 asoc->rwnd_press);
+}
 
 /* Build the bind address list for the association based on info from the
  * local endpoint and the remote peer.
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 4e1d0fcb028e..c09757fbf803 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -957,7 +957,7 @@ static inline int sctp_v4_xmit(struct sk_buff *skb,
 
         SCTP_INC_STATS(sock_net(&inet->sk), SCTP_MIB_OUTSCTPPACKS);
 
-        return ip_queue_xmit(skb, &transport->fl);
+        return ip_queue_xmit(&inet->sk, skb, &transport->fl);
 }
 
 static struct sctp_af sctp_af_inet;
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 01e002430c85..ae9fbeba40b0 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -6178,7 +6178,7 @@ static int sctp_eat_data(const struct sctp_association *asoc,
          * PMTU.  In cases, such as loopback, this might be a rather
          * large spill over.
          */
-        if ((!chunk->data_accepted) && (!asoc->rwnd ||
+        if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
             (datalen > asoc->rwnd + asoc->frag_point))) {
 
                 /* If this is the next TSN, consider reneging to make
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 981aaf8b6ace..ff20e2dbbbc7 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2115,6 +2115,12 @@ static int sctp_recvmsg(struct kiocb *iocb, struct sock *sk,
                 sctp_skb_pull(skb, copied);
                 skb_queue_head(&sk->sk_receive_queue, skb);
 
+                /* When only partial message is copied to the user, increase
+                 * rwnd by that amount. If all the data in the skb is read,
+                 * rwnd is updated when the event is freed.
+                 */
+                if (!sctp_ulpevent_is_notification(event))
+                        sctp_assoc_rwnd_increase(event->asoc, copied);
                 goto out;
         } else if ((event->msg_flags & MSG_NOTIFICATION) ||
                    (event->msg_flags & MSG_EOR))
@@ -6593,6 +6599,46 @@ static void __sctp_write_space(struct sctp_association *asoc)
         }
 }
 
+static void sctp_wake_up_waiters(struct sock *sk,
+                                 struct sctp_association *asoc)
+{
+        struct sctp_association *tmp = asoc;
+
+        /* We do accounting for the sndbuf space per association,
+         * so we only need to wake our own association.
+         */
+        if (asoc->ep->sndbuf_policy)
+                return __sctp_write_space(asoc);
+
+        /* If association goes down and is just flushing its
+         * outq, then just normally notify others.
+         */
+        if (asoc->base.dead)
+                return sctp_write_space(sk);
+
+        /* Accounting for the sndbuf space is per socket, so we
+         * need to wake up others, try to be fair and in case of
+         * other associations, let them have a go first instead
+         * of just doing a sctp_write_space() call.
+         *
+         * Note that we reach sctp_wake_up_waiters() only when
+         * associations free up queued chunks, thus we are under
+         * lock and the list of associations on a socket is
+         * guaranteed not to change.
+         */
+        for (tmp = list_next_entry(tmp, asocs); 1;
+             tmp = list_next_entry(tmp, asocs)) {
+                /* Manually skip the head element. */
+                if (&tmp->asocs == &((sctp_sk(sk))->ep->asocs))
+                        continue;
+                /* Wake up association. */
+                __sctp_write_space(tmp);
+                /* We've reached the end. */
+                if (tmp == asoc)
+                        break;
+        }
+}
+
 /* Do accounting for the sndbuf space.
  * Decrement the used sndbuf space of the corresponding association by the
  * data size which was just transmitted(freed).
@@ -6620,7 +6666,7 @@ static void sctp_wfree(struct sk_buff *skb)
         sk_mem_uncharge(sk, skb->truesize);
 
         sock_wfree(skb);
-        __sctp_write_space(asoc);
+        sctp_wake_up_waiters(sk, asoc);
 
         sctp_association_put(asoc);
 }
@@ -6705,7 +6751,7 @@ do_nonblock:
         goto out;
 }
 
-void sctp_data_ready(struct sock *sk, int len)
+void sctp_data_ready(struct sock *sk)
 {
         struct socket_wq *wq;
 
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index d0810dc5f079..1d348d15b33d 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -652,5 +652,4 @@ void sctp_transport_immediate_rtx(struct sctp_transport *t)
                 if (!mod_timer(&t->T3_rtx_timer, jiffies + t->rto))
                         sctp_transport_hold(t);
         }
-        return;
 }
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 8d198ae03606..85c64658bd0b 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -989,7 +989,7 @@ static void sctp_ulpevent_receive_data(struct sctp_ulpevent *event,
         skb = sctp_event2skb(event);
         /* Set the owner and charge rwnd for bytes received.  */
         sctp_ulpevent_set_owner(event, asoc);
-        sctp_assoc_rwnd_update(asoc, false);
+        sctp_assoc_rwnd_decrease(asoc, skb_headlen(skb));
 
         if (!skb->data_len)
                 return;
@@ -1011,7 +1011,6 @@ static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
 {
         struct sk_buff *skb, *frag;
         unsigned int    len;
-        struct sctp_association *asoc;
 
         /* Current stack structures assume that the rcv buffer is
          * per socket.   For UDP style sockets this is not true as
@@ -1036,11 +1035,8 @@ static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
         }
 
 done:
-        asoc = event->asoc;
-        sctp_association_hold(asoc);
+        sctp_assoc_rwnd_increase(event->asoc, len);
         sctp_ulpevent_release_owner(event);
-        sctp_assoc_rwnd_update(asoc, true);
-        sctp_association_put(asoc);
 }
 
 static void sctp_ulpevent_release_frag_data(struct sctp_ulpevent *event)
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index 5dc94117e9d4..7144eb6a1b95 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -259,7 +259,7 @@ int sctp_ulpq_tail_event(struct sctp_ulpq *ulpq, struct sctp_ulpevent *event)
                 sctp_ulpq_clear_pd(ulpq);
 
         if (queue == &sk->sk_receive_queue)
-                sk->sk_data_ready(sk, 0);
+                sk->sk_data_ready(sk);
         return 1;
 
 out_free:
@@ -1135,5 +1135,5 @@ void sctp_ulpq_abort_pd(struct sctp_ulpq *ulpq, gfp_t gfp)
 
         /* If there is data waiting, send it up the socket now. */
         if (sctp_ulpq_clear_pd(ulpq) || ev)
-                sk->sk_data_ready(sk, 0);
+                sk->sk_data_ready(sk);
 }
diff --git a/net/socket.c b/net/socket.c
index a19ae1968d37..1b1e7e6a960f 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -72,6 +72,7 @@
 #include <linux/if_bridge.h>
 #include <linux/if_frad.h>
 #include <linux/if_vlan.h>
+#include <linux/ptp_classify.h>
 #include <linux/init.h>
 #include <linux/poll.h>
 #include <linux/cache.h>
@@ -594,7 +595,7 @@ void sock_release(struct socket *sock)
         }
 
         if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
-                printk(KERN_ERR "sock_release: fasync list not empty!\n");
+                pr_err("%s: fasync list not empty!\n", __func__);
 
         if (test_bit(SOCK_EXTERNALLY_ALLOCATED, &sock->flags))
                 return;
@@ -1266,8 +1267,8 @@ int __sock_create(struct net *net, int family, int type, int protocol,
                 static int warned;
                 if (!warned) {
                         warned = 1;
-                        printk(KERN_INFO "%s uses obsolete (PF_INET,SOCK_PACKET)\n",
-                               current->comm);
+                        pr_info("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
+                                current->comm);
                 }
                 family = PF_PACKET;
         }
@@ -2600,8 +2601,7 @@ int sock_register(const struct net_proto_family *ops)
         int err;
 
         if (ops->family >= NPROTO) {
-                printk(KERN_CRIT "protocol %d >= NPROTO(%d)\n", ops->family,
-                       NPROTO);
+                pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO);
                 return -ENOBUFS;
         }
 
@@ -2615,7 +2615,7 @@ int sock_register(const struct net_proto_family *ops)
         }
         spin_unlock(&net_family_lock);
 
-        printk(KERN_INFO "NET: Registered protocol family %d\n", ops->family);
+        pr_info("NET: Registered protocol family %d\n", ops->family);
         return err;
 }
 EXPORT_SYMBOL(sock_register);
@@ -2643,7 +2643,7 @@ void sock_unregister(int family)
 
         synchronize_rcu();
 
-        printk(KERN_INFO "NET: Unregistered protocol family %d\n", family);
+        pr_info("NET: Unregistered protocol family %d\n", family);
 }
 EXPORT_SYMBOL(sock_unregister);
 
@@ -2686,9 +2686,7 @@ static int __init sock_init(void)
                 goto out;
 #endif
 
-#ifdef CONFIG_NETWORK_PHY_TIMESTAMPING
-        skb_timestamping_init();
-#endif
+        ptp_classifier_init();
 
 out:
         return err;
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
index 241b54f30204..0754d0f466d2 100644
--- a/net/sunrpc/Kconfig
+++ b/net/sunrpc/Kconfig
@@ -9,19 +9,6 @@ config SUNRPC_BACKCHANNEL
         bool
         depends on SUNRPC
 
-config SUNRPC_XPRT_RDMA
-        tristate
-        depends on SUNRPC && INFINIBAND && INFINIBAND_ADDR_TRANS
-        default SUNRPC && INFINIBAND
-        help
-          This option allows the NFS client and server to support
-          an RDMA-enabled transport.
-
-          To compile RPC client RDMA transport support as a module,
-          choose M here: the module will be called xprtrdma.
-
-          If unsure, say N.
-
 config SUNRPC_SWAP
         bool
         depends on SUNRPC
@@ -57,3 +44,29 @@ config SUNRPC_DEBUG
           but makes troubleshooting NFS issues significantly harder.
 
           If unsure, say Y.
+
+config SUNRPC_XPRT_RDMA_CLIENT
+        tristate "RPC over RDMA Client Support"
+        depends on SUNRPC && INFINIBAND && INFINIBAND_ADDR_TRANS
+        default SUNRPC && INFINIBAND
+        help
+          This option allows the NFS client to support an RDMA-enabled
+          transport.
+
+          To compile RPC client RDMA transport support as a module,
+          choose M here: the module will be called xprtrdma.
+
+          If unsure, say N.
+
+config SUNRPC_XPRT_RDMA_SERVER
+        tristate "RPC over RDMA Server Support"
+        depends on SUNRPC && INFINIBAND && INFINIBAND_ADDR_TRANS
+        default SUNRPC && INFINIBAND
+        help
+          This option allows the NFS server to support an RDMA-enabled
+          transport.
+
+          To compile RPC server RDMA transport support as a module,
+          choose M here: the module will be called svcrdma.
+
+          If unsure, say N.
diff --git a/net/sunrpc/Makefile b/net/sunrpc/Makefile
index 8209a0411bca..e5a7a1cac8f3 100644
--- a/net/sunrpc/Makefile
+++ b/net/sunrpc/Makefile
@@ -5,7 +5,8 @@
 
 obj-$(CONFIG_SUNRPC) += sunrpc.o
 obj-$(CONFIG_SUNRPC_GSS) += auth_gss/
-obj-$(CONFIG_SUNRPC_XPRT_RDMA) += xprtrdma/
+
+obj-y += xprtrdma/
 
 sunrpc-y := clnt.o xprt.o socklib.o xprtsock.o sched.o \
             auth.o auth_null.o auth_unix.o auth_generic.o \
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index e860d4f7ed2a..3513d559bc45 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -212,39 +212,23 @@ out:
 }
 EXPORT_SYMBOL_GPL(xprt_destroy_backchannel);
 
-/*
- * One or more rpc_rqst structure have been preallocated during the
- * backchannel setup.  Buffer space for the send and private XDR buffers
- * has been preallocated as well.  Use xprt_alloc_bc_request to allocate
- * to this request.  Use xprt_free_bc_request to return it.
- *
- * We know that we're called in soft interrupt context, grab the spin_lock
- * since there is no need to grab the bottom half spin_lock.
- *
- * Return an available rpc_rqst, otherwise NULL if non are available.
- */
-struct rpc_rqst *xprt_alloc_bc_request(struct rpc_xprt *xprt)
+static struct rpc_rqst *xprt_alloc_bc_request(struct rpc_xprt *xprt, __be32 xid)
 {
-        struct rpc_rqst *req;
+        struct rpc_rqst *req = NULL;
 
         dprintk("RPC:       allocate a backchannel request\n");
-        spin_lock(&xprt->bc_pa_lock);
-        if (!list_empty(&xprt->bc_pa_list)) {
-                req = list_first_entry(&xprt->bc_pa_list, struct rpc_rqst,
-                                rq_bc_pa_list);
-                list_del(&req->rq_bc_pa_list);
-        } else {
-                req = NULL;
-        }
-        spin_unlock(&xprt->bc_pa_lock);
+        if (list_empty(&xprt->bc_pa_list))
+                goto not_found;
 
-        if (req != NULL) {
-                set_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state);
-                req->rq_reply_bytes_recvd = 0;
-                req->rq_bytes_sent = 0;
-                memcpy(&req->rq_private_buf, &req->rq_rcv_buf,
+        req = list_first_entry(&xprt->bc_pa_list, struct rpc_rqst,
+                                rq_bc_pa_list);
+        req->rq_reply_bytes_recvd = 0;
+        req->rq_bytes_sent = 0;
+        memcpy(&req->rq_private_buf, &req->rq_rcv_buf,
                         sizeof(req->rq_private_buf));
-        }
+        req->rq_xid = xid;
+        req->rq_connect_cookie = xprt->connect_cookie;
+not_found:
         dprintk("RPC:       backchannel req=%p\n", req);
         return req;
 }
@@ -259,6 +243,7 @@ void xprt_free_bc_request(struct rpc_rqst *req)
 
         dprintk("RPC:       free backchannel req=%p\n", req);
 
+        req->rq_connect_cookie = xprt->connect_cookie - 1;
         smp_mb__before_clear_bit();
         WARN_ON_ONCE(!test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
         clear_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state);
@@ -281,7 +266,57 @@ void xprt_free_bc_request(struct rpc_rqst *req)
          * may be reused by a new callback request.
          */
         spin_lock_bh(&xprt->bc_pa_lock);
-        list_add(&req->rq_bc_pa_list, &xprt->bc_pa_list);
+        list_add_tail(&req->rq_bc_pa_list, &xprt->bc_pa_list);
         spin_unlock_bh(&xprt->bc_pa_lock);
 }
 
+/*
+ * One or more rpc_rqst structure have been preallocated during the
+ * backchannel setup.  Buffer space for the send and private XDR buffers
+ * has been preallocated as well.  Use xprt_alloc_bc_request to allocate
+ * to this request.  Use xprt_free_bc_request to return it.
+ *
+ * We know that we're called in soft interrupt context, grab the spin_lock
+ * since there is no need to grab the bottom half spin_lock.
+ *
+ * Return an available rpc_rqst, otherwise NULL if non are available.
+ */
+struct rpc_rqst *xprt_lookup_bc_request(struct rpc_xprt *xprt, __be32 xid)
+{
+        struct rpc_rqst *req;
+
+        spin_lock(&xprt->bc_pa_lock);
+        list_for_each_entry(req, &xprt->bc_pa_list, rq_bc_pa_list) {
+                if (req->rq_connect_cookie != xprt->connect_cookie)
+                        continue;
+                if (req->rq_xid == xid)
+                        goto found;
+        }
+        req = xprt_alloc_bc_request(xprt, xid);
+found:
+        spin_unlock(&xprt->bc_pa_lock);
+        return req;
+}
+
+/*
+ * Add callback request to callback list.  The callback
+ * service sleeps on the sv_cb_waitq waiting for new
+ * requests.  Wake it up after adding enqueing the
+ * request.
+ */
+void xprt_complete_bc_request(struct rpc_rqst *req, uint32_t copied)
+{
+        struct rpc_xprt *xprt = req->rq_xprt;
+        struct svc_serv *bc_serv = xprt->bc_serv;
+
+        req->rq_private_buf.len = copied;
+        set_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state);
+
+        dprintk("RPC:       add callback request to list\n");
+        spin_lock(&bc_serv->sv_cb_lock);
+        list_del(&req->rq_bc_pa_list);
+        list_add(&req->rq_bc_list, &bc_serv->sv_cb_list);
+        wake_up(&bc_serv->sv_cb_waitq);
+        spin_unlock(&bc_serv->sv_cb_lock);
+}
+
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 0edada973434..2e6ab10734f6 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -438,6 +438,38 @@ out_no_rpciod:
         return ERR_PTR(err);
 }
 
+struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
+                                        struct rpc_xprt *xprt)
+{
+        struct rpc_clnt *clnt = NULL;
+
+        clnt = rpc_new_client(args, xprt, NULL);
+        if (IS_ERR(clnt))
+                return clnt;
+
+        if (!(args->flags & RPC_CLNT_CREATE_NOPING)) {
+                int err = rpc_ping(clnt);
+                if (err != 0) {
+                        rpc_shutdown_client(clnt);
+                        return ERR_PTR(err);
+                }
+        }
+
+        clnt->cl_softrtry = 1;
+        if (args->flags & RPC_CLNT_CREATE_HARDRTRY)
+                clnt->cl_softrtry = 0;
+
+        if (args->flags & RPC_CLNT_CREATE_AUTOBIND)
+                clnt->cl_autobind = 1;
+        if (args->flags & RPC_CLNT_CREATE_DISCRTRY)
+                clnt->cl_discrtry = 1;
+        if (!(args->flags & RPC_CLNT_CREATE_QUIET))
+                clnt->cl_chatty = 1;
+
+        return clnt;
+}
+EXPORT_SYMBOL_GPL(rpc_create_xprt);
+
 /**
  * rpc_create - create an RPC client and transport with one call
  * @args: rpc_clnt create argument structure
@@ -451,7 +483,6 @@ out_no_rpciod:
 struct rpc_clnt *rpc_create(struct rpc_create_args *args)
 {
         struct rpc_xprt *xprt;
-        struct rpc_clnt *clnt;
         struct xprt_create xprtargs = {
                 .net = args->net,
                 .ident = args->protocol,
@@ -515,30 +546,7 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
         if (args->flags & RPC_CLNT_CREATE_NONPRIVPORT)
                 xprt->resvport = 0;
 
-        clnt = rpc_new_client(args, xprt, NULL);
-        if (IS_ERR(clnt))
-                return clnt;
-
-        if (!(args->flags & RPC_CLNT_CREATE_NOPING)) {
-                int err = rpc_ping(clnt);
-                if (err != 0) {
-                        rpc_shutdown_client(clnt);
-                        return ERR_PTR(err);
-                }
-        }
-
-        clnt->cl_softrtry = 1;
-        if (args->flags & RPC_CLNT_CREATE_HARDRTRY)
-                clnt->cl_softrtry = 0;
-
-        if (args->flags & RPC_CLNT_CREATE_AUTOBIND)
-                clnt->cl_autobind = 1;
-        if (args->flags & RPC_CLNT_CREATE_DISCRTRY)
-                clnt->cl_discrtry = 1;
-        if (!(args->flags & RPC_CLNT_CREATE_QUIET))
-                clnt->cl_chatty = 1;
-
-        return clnt;
+        return rpc_create_xprt(args, xprt);
 }
 EXPORT_SYMBOL_GPL(rpc_create);
 
@@ -1363,6 +1371,7 @@ rpc_restart_call_prepare(struct rpc_task *task)
         if (RPC_ASSASSINATED(task))
                 return 0;
         task->tk_action = call_start;
+        task->tk_status = 0;
         if (task->tk_ops->rpc_call_prepare != NULL)
                 task->tk_action = rpc_prepare_task;
         return 1;
@@ -1379,6 +1388,7 @@ rpc_restart_call(struct rpc_task *task)
         if (RPC_ASSASSINATED(task))
                 return 0;
         task->tk_action = call_start;
+        task->tk_status = 0;
         return 1;
 }
 EXPORT_SYMBOL_GPL(rpc_restart_call);
@@ -1728,9 +1738,7 @@ call_bind_status(struct rpc_task *task)
         case -EPROTONOSUPPORT:
                 dprintk("RPC: %5u remote rpcbind version unavailable, retrying\n",
                                 task->tk_pid);
-                task->tk_status = 0;
-                task->tk_action = call_bind;
-                return;
+                goto retry_timeout;
         case -ECONNREFUSED:             /* connection problems */
         case -ECONNRESET:
         case -ECONNABORTED:
@@ -1756,6 +1764,7 @@ call_bind_status(struct rpc_task *task)
         return;
 
 retry_timeout:
+        task->tk_status = 0;
         task->tk_action = call_timeout;
 }
 
@@ -1798,21 +1807,19 @@ call_connect_status(struct rpc_task *task)
         trace_rpc_connect_status(task, status);
         task->tk_status = 0;
         switch (status) {
-                /* if soft mounted, test if we've timed out */
-        case -ETIMEDOUT:
-                task->tk_action = call_timeout;
-                return;
         case -ECONNREFUSED:
         case -ECONNRESET:
         case -ECONNABORTED:
         case -ENETUNREACH:
         case -EHOSTUNREACH:
-                /* retry with existing socket, after a delay */
-                rpc_delay(task, 3*HZ);
                 if (RPC_IS_SOFTCONN(task))
                         break;
+                /* retry with existing socket, after a delay */
+                rpc_delay(task, 3*HZ);
         case -EAGAIN:
-                task->tk_action = call_bind;
+                /* Check for timeouts before looping back to call_bind */
+        case -ETIMEDOUT:
+                task->tk_action = call_timeout;
                 return;
         case 0:
                 clnt->cl_stats->netreconn++;
@@ -2007,6 +2014,10 @@ call_status(struct rpc_task *task)
         case -EHOSTDOWN:
         case -EHOSTUNREACH:
         case -ENETUNREACH:
+                if (RPC_IS_SOFTCONN(task)) {
+                        rpc_exit(task, status);
+                        break;
+                }
                 /*
                  * Delay any retries for 3 seconds, then handle as if it
                  * were a timeout.
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index ff3cc4bf4b24..25578afe1548 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -637,7 +637,8 @@ static void __rpc_queue_timer_fn(unsigned long ptr)
 
 static void __rpc_atrun(struct rpc_task *task)
 {
-        task->tk_status = 0;
+        if (task->tk_status == -ETIMEDOUT)
+                task->tk_status = 0;
 }
 
 /*
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index b6e59f0a9475..43bcb4699d69 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -60,7 +60,7 @@
 
 static struct svc_sock *svc_setup_socket(struct svc_serv *, struct socket *,
                                          int flags);
-static void             svc_udp_data_ready(struct sock *, int);
+static void             svc_udp_data_ready(struct sock *);
 static int              svc_udp_recvfrom(struct svc_rqst *);
 static int              svc_udp_sendto(struct svc_rqst *);
 static void             svc_sock_detach(struct svc_xprt *);
@@ -403,14 +403,14 @@ static void svc_sock_setbufsize(struct socket *sock, unsigned int snd,
 /*
  * INET callback when data has been received on the socket.
  */
-static void svc_udp_data_ready(struct sock *sk, int count)
+static void svc_udp_data_ready(struct sock *sk)
 {
         struct svc_sock *svsk = (struct svc_sock *)sk->sk_user_data;
         wait_queue_head_t *wq = sk_sleep(sk);
 
         if (svsk) {
-                dprintk("svc: socket %p(inet %p), count=%d, busy=%d\n",
-                        svsk, sk, count,
+                dprintk("svc: socket %p(inet %p), busy=%d\n",
+                        svsk, sk,
                         test_bit(XPT_BUSY, &svsk->sk_xprt.xpt_flags));
                 set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
                 svc_xprt_enqueue(&svsk->sk_xprt);
@@ -731,7 +731,7 @@ static void svc_udp_init(struct svc_sock *svsk, struct svc_serv *serv)
  * A data_ready event on a listening socket means there's a connection
  * pending. Do not use state_change as a substitute for it.
  */
-static void svc_tcp_listen_data_ready(struct sock *sk, int count_unused)
+static void svc_tcp_listen_data_ready(struct sock *sk)
 {
         struct svc_sock *svsk = (struct svc_sock *)sk->sk_user_data;
         wait_queue_head_t *wq;
@@ -783,7 +783,7 @@ static void svc_tcp_state_change(struct sock *sk)
                 wake_up_interruptible_all(wq);
 }
 
-static void svc_tcp_data_ready(struct sock *sk, int count)
+static void svc_tcp_data_ready(struct sock *sk)
 {
         struct svc_sock *svsk = (struct svc_sock *)sk->sk_user_data;
         wait_queue_head_t *wq = sk_sleep(sk);
@@ -1397,6 +1397,22 @@ static struct svc_sock *svc_setup_socket(struct svc_serv *serv,
         return svsk;
 }
 
+bool svc_alien_sock(struct net *net, int fd)
+{
+        int err;
+        struct socket *sock = sockfd_lookup(fd, &err);
+        bool ret = false;
+
+        if (!sock)
+                goto out;
+        if (sock_net(sock->sk) != net)
+                ret = true;
+        sockfd_put(sock);
+out:
+        return ret;
+}
+EXPORT_SYMBOL_GPL(svc_alien_sock);
+
 /**
  * svc_addsock - add a listener socket to an RPC service
  * @serv: pointer to RPC service to which to add a new listener
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 1504bb11e4f3..dd97ba3c4456 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -833,8 +833,20 @@ xdr_buf_from_iov(struct kvec *iov, struct xdr_buf *buf)
 }
 EXPORT_SYMBOL_GPL(xdr_buf_from_iov);
 
-/* Sets subbuf to the portion of buf of length len beginning base bytes
- * from the start of buf. Returns -1 if base of length are out of bounds. */
+/**
+ * xdr_buf_subsegment - set subbuf to a portion of buf
+ * @buf: an xdr buffer
+ * @subbuf: the result buffer
+ * @base: beginning of range in bytes
+ * @len: length of range in bytes
+ *
+ * sets @subbuf to an xdr buffer representing the portion of @buf of
+ * length @len starting at offset @base.
+ *
+ * @buf and @subbuf may be pointers to the same struct xdr_buf.
+ *
+ * Returns -1 if base of length are out of bounds.
+ */
 int
 xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
                         unsigned int base, unsigned int len)
@@ -847,9 +859,8 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
                 len -= subbuf->head[0].iov_len;
                 base = 0;
         } else {
-                subbuf->head[0].iov_base = NULL;
-                subbuf->head[0].iov_len = 0;
                 base -= buf->head[0].iov_len;
+                subbuf->head[0].iov_len = 0;
         }
 
         if (base < buf->page_len) {
@@ -871,9 +882,8 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
                 len -= subbuf->tail[0].iov_len;
                 base = 0;
         } else {
-                subbuf->tail[0].iov_base = NULL;
-                subbuf->tail[0].iov_len = 0;
                 base -= buf->tail[0].iov_len;
+                subbuf->tail[0].iov_len = 0;
         }
 
         if (base || len)
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 7d4df99f761f..d173f79947c6 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1383,15 +1383,3 @@ void xprt_put(struct rpc_xprt *xprt)
         if (atomic_dec_and_test(&xprt->count))
                 xprt_destroy(xprt);
 }
-
-/**
- * xprt_get - return a reference to an RPC transport.
- * @xprt: pointer to the transport
- *
- */
-struct rpc_xprt *xprt_get(struct rpc_xprt *xprt)
-{
-        if (atomic_inc_not_zero(&xprt->count))
-                return xprt;
-        return NULL;
-}
diff --git a/net/sunrpc/xprtrdma/Makefile b/net/sunrpc/xprtrdma/Makefile
index 5a8f268bdd30..da5136fd5694 100644
--- a/net/sunrpc/xprtrdma/Makefile
+++ b/net/sunrpc/xprtrdma/Makefile
@@ -1,8 +1,8 @@
-obj-$(CONFIG_SUNRPC_XPRT_RDMA) += xprtrdma.o
+obj-$(CONFIG_SUNRPC_XPRT_RDMA_CLIENT) += xprtrdma.o
 
 xprtrdma-y := transport.o rpc_rdma.o verbs.o
 
-obj-$(CONFIG_SUNRPC_XPRT_RDMA) += svcrdma.o
+obj-$(CONFIG_SUNRPC_XPRT_RDMA_SERVER) += svcrdma.o
 
 svcrdma-y := svc_rdma.o svc_rdma_transport.o \
         svc_rdma_marshal.o svc_rdma_sendto.o svc_rdma_recvfrom.o
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index e03725bfe2b8..96ead526b125 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -649,9 +649,7 @@ rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len, int pad)
                                 break;
                         page_base = 0;
                 }
-                rqst->rq_rcv_buf.page_len = olen - copy_len;
-        } else
-                rqst->rq_rcv_buf.page_len = 0;
+        }
 
         if (copy_len && rqst->rq_rcv_buf.tail[0].iov_len) {
                 curlen = copy_len;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index 0ce75524ed21..8d904e4eef15 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -90,6 +90,7 @@ static void rdma_build_arg_xdr(struct svc_rqst *rqstp,
                 sge_no++;
         }
         rqstp->rq_respages = &rqstp->rq_pages[sge_no];
+        rqstp->rq_next_page = rqstp->rq_respages + 1;
 
         /* We should never run out of SGE because the limit is defined to
          * support the max allowed RPC data length
@@ -169,6 +170,7 @@ static int map_read_chunks(struct svcxprt_rdma *xprt,
                  */
                 head->arg.pages[page_no] = rqstp->rq_arg.pages[page_no];
                 rqstp->rq_respages = &rqstp->rq_arg.pages[page_no+1];
+                rqstp->rq_next_page = rqstp->rq_respages + 1;
 
                 byte_count -= sge_bytes;
                 ch_bytes -= sge_bytes;
@@ -276,6 +278,7 @@ static int fast_reg_read_chunks(struct svcxprt_rdma *xprt,
 
         /* rq_respages points one past arg pages */
         rqstp->rq_respages = &rqstp->rq_arg.pages[page_no];
+        rqstp->rq_next_page = rqstp->rq_respages + 1;
 
         /* Create the reply and chunk maps */
         offset = 0;
@@ -520,13 +523,6 @@ next_sge:
         for (ch_no = 0; &rqstp->rq_pages[ch_no] < rqstp->rq_respages; ch_no++)
                 rqstp->rq_pages[ch_no] = NULL;
 
-        /*
-         * Detach res pages. If svc_release sees any it will attempt to
-         * put them.
-         */
-        while (rqstp->rq_next_page != rqstp->rq_respages)
-                *(--rqstp->rq_next_page) = NULL;
-
         return err;
 }
 
@@ -550,7 +546,7 @@ static int rdma_read_complete(struct svc_rqst *rqstp,
 
         /* rq_respages starts after the last arg page */
         rqstp->rq_respages = &rqstp->rq_arg.pages[page_no];
-        rqstp->rq_next_page = &rqstp->rq_arg.pages[page_no];
+        rqstp->rq_next_page = rqstp->rq_respages + 1;
 
         /* Rebuild rq_arg head and tail. */
         rqstp->rq_arg.head[0] = head->arg.head[0];
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index c1d124dc772b..7e024a51617e 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -265,6 +265,7 @@ static dma_addr_t dma_map_xdr(struct svcxprt_rdma *xprt,
                 xdr_off -= xdr->head[0].iov_len;
                 if (xdr_off < xdr->page_len) {
                         /* This offset is in the page list */
+                        xdr_off += xdr->page_base;
                         page = xdr->pages[xdr_off >> PAGE_SHIFT];
                         xdr_off &= ~PAGE_MASK;
                 } else {
@@ -625,6 +626,7 @@ static int send_reply(struct svcxprt_rdma *rdma,
                 if (page_no+1 >= sge_no)
                         ctxt->sge[page_no+1].length = 0;
         }
+        rqstp->rq_next_page = rqstp->rq_respages + 1;
         BUG_ON(sge_no > rdma->sc_max_sge);
         memset(&send_wr, 0, sizeof send_wr);
         ctxt->wr_op = IB_WR_SEND;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 62e4f9bcc387..25688fa2207f 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -477,8 +477,7 @@ struct page *svc_rdma_get_page(void)
 
         while ((page = alloc_page(GFP_KERNEL)) == NULL) {
                 /* If we can't get memory, wait a bit and try again */
-                printk(KERN_INFO "svcrdma: out of memory...retrying in 1000 "
-                       "jiffies.\n");
+                printk(KERN_INFO "svcrdma: out of memory...retrying in 1s\n");
                 schedule_timeout_uninterruptible(msecs_to_jiffies(1000));
         }
         return page;
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 285dc0884115..1eb9c468d0c9 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -733,7 +733,7 @@ static void __exit xprt_rdma_cleanup(void)
 {
         int rc;
 
-        dprintk(KERN_INFO "RPCRDMA Module Removed, deregister RPC RDMA transport\n");
+        dprintk("RPCRDMA Module Removed, deregister RPC RDMA transport\n");
 #ifdef RPC_DEBUG
         if (sunrpc_table_header) {
                 unregister_sysctl_table(sunrpc_table_header);
@@ -755,14 +755,14 @@ static int __init xprt_rdma_init(void)
         if (rc)
                 return rc;
 
-        dprintk(KERN_INFO "RPCRDMA Module Init, register RPC RDMA transport\n");
+        dprintk("RPCRDMA Module Init, register RPC RDMA transport\n");
 
-        dprintk(KERN_INFO "Defaults:\n");
-        dprintk(KERN_INFO "\tSlots %d\n"
+        dprintk("Defaults:\n");
+        dprintk("\tSlots %d\n"
                 "\tMaxInlineRead %d\n\tMaxInlineWrite %d\n",
                 xprt_rdma_slot_table_entries,
                 xprt_rdma_max_inline_read, xprt_rdma_max_inline_write);
-        dprintk(KERN_INFO "\tPadding %d\n\tMemreg %d\n",
+        dprintk("\tPadding %d\n\tMemreg %d\n",
                 xprt_rdma_inline_write_padding, xprt_rdma_memreg_strategy);
 
 #ifdef RPC_DEBUG
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 0addefca8e77..25a3dcf15cae 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -254,7 +254,7 @@ struct sock_xprt {
         /*
          * Saved socket callback addresses
          */
-        void                    (*old_data_ready)(struct sock *, int);
+        void                    (*old_data_ready)(struct sock *);
         void                    (*old_state_change)(struct sock *);
         void                    (*old_write_space)(struct sock *);
         void                    (*old_error_report)(struct sock *);
@@ -909,6 +909,12 @@ static void xs_tcp_close(struct rpc_xprt *xprt)
                 xs_tcp_shutdown(xprt);
 }
 
+static void xs_xprt_free(struct rpc_xprt *xprt)
+{
+        xs_free_peer_addresses(xprt);
+        xprt_free(xprt);
+}
+
 /**
  * xs_destroy - prepare to shutdown a transport
  * @xprt: doomed transport
@@ -919,8 +925,7 @@ static void xs_destroy(struct rpc_xprt *xprt)
         dprintk("RPC:       xs_destroy xprt %p\n", xprt);
 
         xs_close(xprt);
-        xs_free_peer_addresses(xprt);
-        xprt_free(xprt);
+        xs_xprt_free(xprt);
         module_put(THIS_MODULE);
 }
 
@@ -946,7 +951,7 @@ static int xs_local_copy_to_xdr(struct xdr_buf *xdr, struct sk_buff *skb)
  *
  * Currently this assumes we can read the whole reply in a single gulp.
  */
-static void xs_local_data_ready(struct sock *sk, int len)
+static void xs_local_data_ready(struct sock *sk)
 {
         struct rpc_task *task;
         struct rpc_xprt *xprt;
@@ -1009,7 +1014,7 @@ static void xs_local_data_ready(struct sock *sk, int len)
  * @len: how much data to read
  *
  */
-static void xs_udp_data_ready(struct sock *sk, int len)
+static void xs_udp_data_ready(struct sock *sk)
 {
         struct rpc_task *task;
         struct rpc_xprt *xprt;
@@ -1306,41 +1311,29 @@ static inline int xs_tcp_read_reply(struct rpc_xprt *xprt,
  * If we're unable to obtain the rpc_rqst we schedule the closing of the
  * connection and return -1.
  */
-static inline int xs_tcp_read_callback(struct rpc_xprt *xprt,
+static int xs_tcp_read_callback(struct rpc_xprt *xprt,
                                        struct xdr_skb_reader *desc)
 {
         struct sock_xprt *transport =
                                 container_of(xprt, struct sock_xprt, xprt);
         struct rpc_rqst *req;
 
-        req = xprt_alloc_bc_request(xprt);
+        /* Look up and lock the request corresponding to the given XID */
+        spin_lock(&xprt->transport_lock);
+        req = xprt_lookup_bc_request(xprt, transport->tcp_xid);
         if (req == NULL) {
+                spin_unlock(&xprt->transport_lock);
                 printk(KERN_WARNING "Callback slot table overflowed\n");
                 xprt_force_disconnect(xprt);
                 return -1;
         }
 
-        req->rq_xid = transport->tcp_xid;
         dprintk("RPC:       read callback  XID %08x\n", ntohl(req->rq_xid));
         xs_tcp_read_common(xprt, desc, req);
 
-        if (!(transport->tcp_flags & TCP_RCV_COPY_DATA)) {
-                struct svc_serv *bc_serv = xprt->bc_serv;
-
-                /*
-                 * Add callback request to callback list.  The callback
-                 * service sleeps on the sv_cb_waitq waiting for new
-                 * requests.  Wake it up after adding enqueing the
-                 * request.
-                 */
-                dprintk("RPC:       add callback request to list\n");
-                spin_lock(&bc_serv->sv_cb_lock);
-                list_add(&req->rq_bc_list, &bc_serv->sv_cb_list);
-                spin_unlock(&bc_serv->sv_cb_lock);
-                wake_up(&bc_serv->sv_cb_waitq);
-        }
-
-        req->rq_private_buf.len = transport->tcp_copied;
+        if (!(transport->tcp_flags & TCP_RCV_COPY_DATA))
+                xprt_complete_bc_request(req, transport->tcp_copied);
+        spin_unlock(&xprt->transport_lock);
 
         return 0;
 }
@@ -1444,7 +1437,7 @@ static int xs_tcp_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb, uns
  * @bytes: how much data to read
  *
  */
-static void xs_tcp_data_ready(struct sock *sk, int bytes)
+static void xs_tcp_data_ready(struct sock *sk)
 {
         struct rpc_xprt *xprt;
         read_descriptor_t rd_desc;
@@ -2544,6 +2537,10 @@ static void bc_close(struct rpc_xprt *xprt)
 
 static void bc_destroy(struct rpc_xprt *xprt)
 {
+        dprintk("RPC:       bc_destroy xprt %p\n", xprt);
+
+        xs_xprt_free(xprt);
+        module_put(THIS_MODULE);
 }
 
 static struct rpc_xprt_ops xs_local_ops = {
@@ -2744,7 +2741,7 @@ static struct rpc_xprt *xs_setup_local(struct xprt_create *args)
                 return xprt;
         ret = ERR_PTR(-EINVAL);
 out_err:
-        xprt_free(xprt);
+        xs_xprt_free(xprt);
         return ret;
 }
 
@@ -2822,7 +2819,7 @@ static struct rpc_xprt *xs_setup_udp(struct xprt_create *args)
                 return xprt;
         ret = ERR_PTR(-EINVAL);
 out_err:
-        xprt_free(xprt);
+        xs_xprt_free(xprt);
         return ret;
 }
 
@@ -2897,12 +2894,11 @@ static struct rpc_xprt *xs_setup_tcp(struct xprt_create *args)
                                 xprt->address_strings[RPC_DISPLAY_ADDR],
                                 xprt->address_strings[RPC_DISPLAY_PROTO]);
 
-
         if (try_module_get(THIS_MODULE))
                 return xprt;
         ret = ERR_PTR(-EINVAL);
 out_err:
-        xprt_free(xprt);
+        xs_xprt_free(xprt);
         return ret;
 }
 
@@ -2919,15 +2915,6 @@ static struct rpc_xprt *xs_setup_bc_tcp(struct xprt_create *args)
         struct svc_sock *bc_sock;
         struct rpc_xprt *ret;
 
-        if (args->bc_xprt->xpt_bc_xprt) {
-                /*
-                 * This server connection already has a backchannel
-                 * transport; we can't create a new one, as we wouldn't
-                 * be able to match replies based on xid any more.  So,
-                 * reuse the already-existing one:
-                 */
-                 return args->bc_xprt->xpt_bc_xprt;
-        }
         xprt = xs_setup_xprt(args, xprt_tcp_slot_table_entries,
                         xprt_tcp_slot_table_entries);
         if (IS_ERR(xprt))
@@ -2985,13 +2972,14 @@ static struct rpc_xprt *xs_setup_bc_tcp(struct xprt_create *args)
          */
         xprt_set_connected(xprt);
 
-
         if (try_module_get(THIS_MODULE))
                 return xprt;
+
+        args->bc_xprt->xpt_bc_xprt = NULL;
         xprt_put(xprt);
         ret = ERR_PTR(-EINVAL);
 out_err:
-        xprt_free(xprt);
+        xs_xprt_free(xprt);
         return ret;
 }
 
diff --git a/net/tipc/addr.h b/net/tipc/addr.h
index 60b00ab93d74..a74acf9ee804 100644
--- a/net/tipc/addr.h
+++ b/net/tipc/addr.h
@@ -37,6 +37,8 @@
 #ifndef _TIPC_ADDR_H
 #define _TIPC_ADDR_H
 
+#include "core.h"
+
 #define TIPC_ZONE_MASK          0xff000000u
 #define TIPC_CLUSTER_MASK       0xfffff000u
 
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index bf860d9e75af..95ab5ef92920 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -41,9 +41,9 @@
 #include "bcast.h"
 #include "name_distr.h"
 
-#define MAX_PKT_DEFAULT_MCAST 1500      /* bcast link max packet size (fixed) */
-
-#define BCLINK_WIN_DEFAULT 20           /* bcast link window size (default) */
+#define MAX_PKT_DEFAULT_MCAST   1500    /* bcast link max packet size (fixed) */
+#define BCLINK_WIN_DEFAULT      20      /* bcast link window size (default) */
+#define BCBEARER                MAX_BEARERS
 
 /**
  * struct tipc_bcbearer_pair - a pair of bearers used by broadcast link
@@ -356,9 +356,9 @@ static void bclink_peek_nack(struct tipc_msg *msg)
 }
 
 /*
- * tipc_bclink_send_msg - broadcast a packet to all nodes in cluster
+ * tipc_bclink_xmit - broadcast a packet to all nodes in cluster
  */
-int tipc_bclink_send_msg(struct sk_buff *buf)
+int tipc_bclink_xmit(struct sk_buff *buf)
 {
         int res;
 
@@ -370,7 +370,7 @@ int tipc_bclink_send_msg(struct sk_buff *buf)
                 goto exit;
         }
 
-        res = tipc_link_send_buf(bcl, buf);
+        res = __tipc_link_xmit(bcl, buf);
         if (likely(res >= 0)) {
                 bclink_set_last_sent();
                 bcl->stats.queue_sz_counts++;
@@ -399,19 +399,18 @@ static void bclink_accept_pkt(struct tipc_node *node, u32 seqno)
          */
 
         if (((seqno - tipc_own_addr) % TIPC_MIN_LINK_WIN) == 0) {
-                tipc_link_send_proto_msg(
-                        node->active_links[node->addr & 1],
-                        STATE_MSG, 0, 0, 0, 0, 0);
+                tipc_link_proto_xmit(node->active_links[node->addr & 1],
+                                     STATE_MSG, 0, 0, 0, 0, 0);
                 bcl->stats.sent_acks++;
         }
 }
 
 /**
- * tipc_bclink_recv_pkt - receive a broadcast packet, and deliver upwards
+ * tipc_bclink_rcv - receive a broadcast packet, and deliver upwards
  *
  * tipc_net_lock is read_locked, no other locks set
  */
-void tipc_bclink_recv_pkt(struct sk_buff *buf)
+void tipc_bclink_rcv(struct sk_buff *buf)
 {
         struct tipc_msg *msg = buf_msg(buf);
         struct tipc_node *node;
@@ -468,7 +467,7 @@ receive:
                         spin_unlock_bh(&bc_lock);
                         tipc_node_unlock(node);
                         if (likely(msg_mcast(msg)))
-                                tipc_port_recv_mcast(buf, NULL);
+                                tipc_port_mcast_rcv(buf, NULL);
                         else
                                 kfree_skb(buf);
                 } else if (msg_user(msg) == MSG_BUNDLER) {
@@ -478,12 +477,12 @@ receive:
                         bcl->stats.recv_bundled += msg_msgcnt(msg);
                         spin_unlock_bh(&bc_lock);
                         tipc_node_unlock(node);
-                        tipc_link_recv_bundle(buf);
+                        tipc_link_bundle_rcv(buf);
                 } else if (msg_user(msg) == MSG_FRAGMENTER) {
                         int ret;
-                        ret = tipc_link_recv_fragment(&node->bclink.reasm_head,
-                                                      &node->bclink.reasm_tail,
-                                                      &buf);
+                        ret = tipc_link_frag_rcv(&node->bclink.reasm_head,
+                                                 &node->bclink.reasm_tail,
+                                                 &buf);
                         if (ret == LINK_REASM_ERROR)
                                 goto unlock;
                         spin_lock_bh(&bc_lock);
@@ -503,7 +502,7 @@ receive:
                         bclink_accept_pkt(node, seqno);
                         spin_unlock_bh(&bc_lock);
                         tipc_node_unlock(node);
-                        tipc_named_recv(buf);
+                        tipc_named_rcv(buf);
                 } else {
                         spin_lock_bh(&bc_lock);
                         bclink_accept_pkt(node, seqno);
@@ -669,9 +668,8 @@ void tipc_bcbearer_sort(void)
         memset(bp_temp, 0, sizeof(bcbearer->bpairs_temp));
 
         for (b_index = 0; b_index < MAX_BEARERS; b_index++) {
-                struct tipc_bearer *b = &tipc_bearers[b_index];
-
-                if (!b->active || !b->nodes.count)
+                struct tipc_bearer *b = bearer_list[b_index];
+                if (!b || !b->nodes.count)
                         continue;
 
                 if (!bp_temp[b->priority].primary)
@@ -785,8 +783,8 @@ void tipc_bclink_init(void)
         bcl->owner = &bclink->node;
         bcl->max_pkt = MAX_PKT_DEFAULT_MCAST;
         tipc_link_set_queue_limits(bcl, BCLINK_WIN_DEFAULT);
-        spin_lock_init(&bcbearer->bearer.lock);
         bcl->b_ptr = &bcbearer->bearer;
+        bearer_list[BCBEARER] = &bcbearer->bearer;
         bcl->state = WORKING_WORKING;
         strlcpy(bcl->name, tipc_bclink_name, TIPC_MAX_LINK_NAME);
 }
@@ -797,6 +795,7 @@ void tipc_bclink_stop(void)
         tipc_link_purge_queues(bcl);
         spin_unlock_bh(&bc_lock);
 
+        bearer_list[BCBEARER] = NULL;
         memset(bclink, 0, sizeof(*bclink));
         memset(bcbearer, 0, sizeof(*bcbearer));
 }
diff --git a/net/tipc/bcast.h b/net/tipc/bcast.h
index 6ee587b469fd..a80ef54b818e 100644
--- a/net/tipc/bcast.h
+++ b/net/tipc/bcast.h
@@ -90,8 +90,8 @@ void tipc_bclink_add_node(u32 addr);
 void tipc_bclink_remove_node(u32 addr);
 struct tipc_node *tipc_bclink_retransmit_to(void);
 void tipc_bclink_acknowledge(struct tipc_node *n_ptr, u32 acked);
-int  tipc_bclink_send_msg(struct sk_buff *buf);
-void tipc_bclink_recv_pkt(struct sk_buff *buf);
+int  tipc_bclink_xmit(struct sk_buff *buf);
+void tipc_bclink_rcv(struct sk_buff *buf);
 u32  tipc_bclink_get_last_sent(void);
 u32  tipc_bclink_acks_missing(struct tipc_node *n_ptr);
 void tipc_bclink_update_link_state(struct tipc_node *n_ptr, u32 last_sent);
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 574b86193b15..3fef7eb776dc 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -49,9 +49,9 @@ static struct tipc_media * const media_info_array[] = {
         NULL
 };
 
-struct tipc_bearer tipc_bearers[MAX_BEARERS];
+struct tipc_bearer *bearer_list[MAX_BEARERS + 1];
 
-static void bearer_disable(struct tipc_bearer *b_ptr);
+static void bearer_disable(struct tipc_bearer *b_ptr, bool shutting_down);
 
 /**
  * tipc_media_find - locates specified media object by name
@@ -177,8 +177,9 @@ struct tipc_bearer *tipc_bearer_find(const char *name)
         struct tipc_bearer *b_ptr;
         u32 i;
 
-        for (i = 0, b_ptr = tipc_bearers; i < MAX_BEARERS; i++, b_ptr++) {
-                if (b_ptr->active && (!strcmp(b_ptr->name, name)))
+        for (i = 0; i < MAX_BEARERS; i++) {
+                b_ptr = bearer_list[i];
+                if (b_ptr && (!strcmp(b_ptr->name, name)))
                         return b_ptr;
         }
         return NULL;
@@ -200,8 +201,10 @@ struct sk_buff *tipc_bearer_get_names(void)
         read_lock_bh(&tipc_net_lock);
         for (i = 0; media_info_array[i] != NULL; i++) {
                 for (j = 0; j < MAX_BEARERS; j++) {
-                        b = &tipc_bearers[j];
-                        if (b->active && (b->media == media_info_array[i])) {
+                        b = bearer_list[j];
+                        if (!b)
+                                continue;
+                        if (b->media == media_info_array[i]) {
                                 tipc_cfg_append_tlv(buf, TIPC_TLV_BEARER_NAME,
                                                     b->name,
                                                     strlen(b->name) + 1);
@@ -284,16 +287,17 @@ restart:
         bearer_id = MAX_BEARERS;
         with_this_prio = 1;
         for (i = MAX_BEARERS; i-- != 0; ) {
-                if (!tipc_bearers[i].active) {
+                b_ptr = bearer_list[i];
+                if (!b_ptr) {
                         bearer_id = i;
                         continue;
                 }
-                if (!strcmp(name, tipc_bearers[i].name)) {
+                if (!strcmp(name, b_ptr->name)) {
                         pr_warn("Bearer <%s> rejected, already enabled\n",
                                 name);
                         goto exit;
                 }
-                if ((tipc_bearers[i].priority == priority) &&
+                if ((b_ptr->priority == priority) &&
                     (++with_this_prio > 2)) {
                         if (priority-- == 0) {
                                 pr_warn("Bearer <%s> rejected, duplicate priority\n",
@@ -311,7 +315,11 @@ restart:
                 goto exit;
         }
 
-        b_ptr = &tipc_bearers[bearer_id];
+        b_ptr = kzalloc(sizeof(*b_ptr), GFP_ATOMIC);
+        if (!b_ptr) {
+                res = -ENOMEM;
+                goto exit;
+        }
         strcpy(b_ptr->name, name);
         b_ptr->media = m_ptr;
         res = m_ptr->enable_media(b_ptr);
@@ -324,19 +332,20 @@ restart:
         b_ptr->identity = bearer_id;
         b_ptr->tolerance = m_ptr->tolerance;
         b_ptr->window = m_ptr->window;
+        b_ptr->domain = disc_domain;
         b_ptr->net_plane = bearer_id + 'A';
-        b_ptr->active = 1;
         b_ptr->priority = priority;
-        INIT_LIST_HEAD(&b_ptr->links);
-        spin_lock_init(&b_ptr->lock);
 
-        res = tipc_disc_create(b_ptr, &b_ptr->bcast_addr, disc_domain);
+        res = tipc_disc_create(b_ptr, &b_ptr->bcast_addr);
         if (res) {
-                bearer_disable(b_ptr);
+                bearer_disable(b_ptr, false);
                 pr_warn("Bearer <%s> rejected, discovery object creation failed\n",
                         name);
                 goto exit;
         }
+
+        bearer_list[bearer_id] = b_ptr;
+
         pr_info("Enabled bearer <%s>, discovery domain %s, priority %u\n",
                 name,
                 tipc_addr_string_fill(addr_string, disc_domain), priority);
@@ -350,20 +359,11 @@ exit:
  */
 static int tipc_reset_bearer(struct tipc_bearer *b_ptr)
 {
-        struct tipc_link *l_ptr;
-        struct tipc_link *temp_l_ptr;
-
         read_lock_bh(&tipc_net_lock);
         pr_info("Resetting bearer <%s>\n", b_ptr->name);
-        spin_lock_bh(&b_ptr->lock);
-        list_for_each_entry_safe(l_ptr, temp_l_ptr, &b_ptr->links, link_list) {
-                struct tipc_node *n_ptr = l_ptr->owner;
-
-                spin_lock_bh(&n_ptr->lock);
-                tipc_link_reset(l_ptr);
-                spin_unlock_bh(&n_ptr->lock);
-        }
-        spin_unlock_bh(&b_ptr->lock);
+        tipc_disc_delete(b_ptr->link_req);
+        tipc_link_reset_list(b_ptr->identity);
+        tipc_disc_create(b_ptr, &b_ptr->bcast_addr);
         read_unlock_bh(&tipc_net_lock);
         return 0;
 }
@@ -373,26 +373,24 @@ static int tipc_reset_bearer(struct tipc_bearer *b_ptr)
  *
  * Note: This routine assumes caller holds tipc_net_lock.
  */
-static void bearer_disable(struct tipc_bearer *b_ptr)
+static void bearer_disable(struct tipc_bearer *b_ptr, bool shutting_down)
 {
-        struct tipc_link *l_ptr;
-        struct tipc_link *temp_l_ptr;
-        struct tipc_link_req *temp_req;
+        u32 i;
 
         pr_info("Disabling bearer <%s>\n", b_ptr->name);
-        spin_lock_bh(&b_ptr->lock);
         b_ptr->media->disable_media(b_ptr);
-        list_for_each_entry_safe(l_ptr, temp_l_ptr, &b_ptr->links, link_list) {
-                tipc_link_delete(l_ptr);
-        }
-        temp_req = b_ptr->link_req;
-        b_ptr->link_req = NULL;
-        spin_unlock_bh(&b_ptr->lock);
 
-        if (temp_req)
-                tipc_disc_delete(temp_req);
+        tipc_link_delete_list(b_ptr->identity, shutting_down);
+        if (b_ptr->link_req)
+                tipc_disc_delete(b_ptr->link_req);
 
-        memset(b_ptr, 0, sizeof(struct tipc_bearer));
+        for (i = 0; i < MAX_BEARERS; i++) {
+                if (b_ptr == bearer_list[i]) {
+                        bearer_list[i] = NULL;
+                        break;
+                }
+        }
+        kfree(b_ptr);
 }
 
 int tipc_disable_bearer(const char *name)
@@ -406,7 +404,7 @@ int tipc_disable_bearer(const char *name)
                 pr_warn("Attempt to disable unknown bearer <%s>\n", name);
                 res = -EINVAL;
         } else {
-                bearer_disable(b_ptr);
+                bearer_disable(b_ptr, false);
                 res = 0;
         }
         write_unlock_bh(&tipc_net_lock);
@@ -585,7 +583,11 @@ static int tipc_l2_device_event(struct notifier_block *nb, unsigned long evt,
                         break;
         case NETDEV_DOWN:
         case NETDEV_CHANGEMTU:
+                tipc_reset_bearer(b_ptr);
+                break;
         case NETDEV_CHANGEADDR:
+                tipc_l2_media_addr_set(b_ptr, &b_ptr->addr,
+                                       (char *)dev->dev_addr);
                 tipc_reset_bearer(b_ptr);
                 break;
         case NETDEV_UNREGISTER:
@@ -599,7 +601,7 @@ static int tipc_l2_device_event(struct notifier_block *nb, unsigned long evt,
 }
 
 static struct packet_type tipc_packet_type __read_mostly = {
-        .type = __constant_htons(ETH_P_TIPC),
+        .type = htons(ETH_P_TIPC),
         .func = tipc_l2_rcv_msg,
 };
 
@@ -627,10 +629,14 @@ void tipc_bearer_cleanup(void)
 
 void tipc_bearer_stop(void)
 {
+        struct tipc_bearer *b_ptr;
         u32 i;
 
         for (i = 0; i < MAX_BEARERS; i++) {
-                if (tipc_bearers[i].active)
-                        bearer_disable(&tipc_bearers[i]);
+                b_ptr = bearer_list[i];
+                if (b_ptr) {
+                        bearer_disable(b_ptr, true);
+                        bearer_list[i] = NULL;
+                }
         }
 }
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index 4f5db9ad5bf6..ba48145e871d 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -107,10 +107,8 @@ struct tipc_media {
 
 /**
  * struct tipc_bearer - Generic TIPC bearer structure
- * @dev: ptr to associated network device
- * @usr_handle: pointer to additional media-specific information about bearer
+ * @media_ptr: pointer to additional media-specific information about bearer
  * @mtu: max packet size bearer can support
- * @lock: spinlock for controlling access to bearer
  * @addr: media-specific address associated with bearer
  * @name: bearer name (format = media:interface)
  * @media: ptr to media structure associated with bearer
@@ -118,10 +116,9 @@ struct tipc_media {
  * @priority: default link priority for bearer
  * @window: default window size for bearer
  * @tolerance: default link tolerance for bearer
+ * @domain: network domain to which links can be established
  * @identity: array index of this bearer within TIPC bearer array
  * @link_req: ptr to (optional) structure making periodic link setup requests
- * @links: list of non-congested links associated with bearer
- * @active: non-zero if bearer structure is represents a bearer
  * @net_plane: network plane ('A' through 'H') currently associated with bearer
  * @nodes: indicates which nodes in cluster can be reached through bearer
  *
@@ -134,16 +131,14 @@ struct tipc_bearer {
         u32 mtu;                                /* initalized by media */
         struct tipc_media_addr addr;            /* initalized by media */
         char name[TIPC_MAX_BEARER_NAME];
-        spinlock_t lock;
         struct tipc_media *media;
         struct tipc_media_addr bcast_addr;
         u32 priority;
         u32 window;
         u32 tolerance;
+        u32 domain;
         u32 identity;
         struct tipc_link_req *link_req;
-        struct list_head links;
-        int active;
         char net_plane;
         struct tipc_node_map nodes;
 };
@@ -155,7 +150,7 @@ struct tipc_bearer_names {
 
 struct tipc_link;
 
-extern struct tipc_bearer tipc_bearers[];
+extern struct tipc_bearer *bearer_list[];
 
 /*
  * TIPC routines available to supported media types
diff --git a/net/tipc/config.c b/net/tipc/config.c
index e6d721692ae0..4b981c053823 100644
--- a/net/tipc/config.c
+++ b/net/tipc/config.c
@@ -43,13 +43,11 @@
 #define REPLY_TRUNCATED "<truncated>\n"
 
 static DEFINE_MUTEX(config_mutex);
-static struct tipc_server cfgsrv;
 
 static const void *req_tlv_area;        /* request message TLV area */
 static int req_tlv_space;               /* request message TLV area size */
 static int rep_headroom;                /* reply message headroom to use */
 
-
 struct sk_buff *tipc_cfg_reply_alloc(int payload_size)
 {
         struct sk_buff *buf;
@@ -185,18 +183,6 @@ static struct sk_buff *cfg_set_own_addr(void)
         return tipc_cfg_reply_none();
 }
 
-static struct sk_buff *cfg_set_remote_mng(void)
-{
-        u32 value;
-
-        if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_UNSIGNED))
-                return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
-
-        value = ntohl(*(__be32 *)TLV_DATA(req_tlv_area));
-        tipc_remote_management = (value != 0);
-        return tipc_cfg_reply_none();
-}
-
 static struct sk_buff *cfg_set_max_ports(void)
 {
         u32 value;
@@ -247,21 +233,10 @@ struct sk_buff *tipc_cfg_do_cmd(u32 orig_node, u16 cmd, const void *request_area
         /* Check command authorization */
         if (likely(in_own_node(orig_node))) {
                 /* command is permitted */
-        } else if (cmd >= 0x8000) {
+        } else {
                 rep_tlv_buf = tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
                                                           " (cannot be done remotely)");
                 goto exit;
-        } else if (!tipc_remote_management) {
-                rep_tlv_buf = tipc_cfg_reply_error_string(TIPC_CFG_NO_REMOTE);
-                goto exit;
-        } else if (cmd >= 0x4000) {
-                u32 domain = 0;
-
-                if ((tipc_nametbl_translate(TIPC_ZM_SRV, 0, &domain) == 0) ||
-                    (domain != orig_node)) {
-                        rep_tlv_buf = tipc_cfg_reply_error_string(TIPC_CFG_NOT_ZONE_MSTR);
-                        goto exit;
-                }
         }
 
         /* Call appropriate processing routine */
@@ -310,18 +285,12 @@ struct sk_buff *tipc_cfg_do_cmd(u32 orig_node, u16 cmd, const void *request_area
         case TIPC_CMD_SET_NODE_ADDR:
                 rep_tlv_buf = cfg_set_own_addr();
                 break;
-        case TIPC_CMD_SET_REMOTE_MNG:
-                rep_tlv_buf = cfg_set_remote_mng();
-                break;
         case TIPC_CMD_SET_MAX_PORTS:
                 rep_tlv_buf = cfg_set_max_ports();
                 break;
         case TIPC_CMD_SET_NETID:
                 rep_tlv_buf = cfg_set_netid();
                 break;
-        case TIPC_CMD_GET_REMOTE_MNG:
-                rep_tlv_buf = tipc_cfg_reply_unsigned(tipc_remote_management);
-                break;
         case TIPC_CMD_GET_MAX_PORTS:
                 rep_tlv_buf = tipc_cfg_reply_unsigned(tipc_max_ports);
                 break;
@@ -345,6 +314,8 @@ struct sk_buff *tipc_cfg_do_cmd(u32 orig_node, u16 cmd, const void *request_area
         case TIPC_CMD_SET_MAX_PUBL:
         case TIPC_CMD_GET_MAX_PUBL:
         case TIPC_CMD_SET_LOG_SIZE:
+        case TIPC_CMD_SET_REMOTE_MNG:
+        case TIPC_CMD_GET_REMOTE_MNG:
         case TIPC_CMD_DUMP_LOG:
                 rep_tlv_buf = tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
                                                           " (obsolete command)");
@@ -369,75 +340,3 @@ exit:
         mutex_unlock(&config_mutex);
         return rep_tlv_buf;
 }
-
-static void cfg_conn_msg_event(int conid, struct sockaddr_tipc *addr,
-                               void *usr_data, void *buf, size_t len)
-{
-        struct tipc_cfg_msg_hdr *req_hdr;
-        struct tipc_cfg_msg_hdr *rep_hdr;
-        struct sk_buff *rep_buf;
-
-        /* Validate configuration message header (ignore invalid message) */
-        req_hdr = (struct tipc_cfg_msg_hdr *)buf;
-        if ((len < sizeof(*req_hdr)) ||
-            (len != TCM_ALIGN(ntohl(req_hdr->tcm_len))) ||
-            (ntohs(req_hdr->tcm_flags) != TCM_F_REQUEST)) {
-                pr_warn("Invalid configuration message discarded\n");
-                return;
-        }
-
-        /* Generate reply for request (if can't, return request) */
-        rep_buf = tipc_cfg_do_cmd(addr->addr.id.node, ntohs(req_hdr->tcm_type),
-                                  buf + sizeof(*req_hdr),
-                                  len - sizeof(*req_hdr),
-                                  BUF_HEADROOM + MAX_H_SIZE + sizeof(*rep_hdr));
-        if (rep_buf) {
-                skb_push(rep_buf, sizeof(*rep_hdr));
-                rep_hdr = (struct tipc_cfg_msg_hdr *)rep_buf->data;
-                memcpy(rep_hdr, req_hdr, sizeof(*rep_hdr));
-                rep_hdr->tcm_len = htonl(rep_buf->len);
-                rep_hdr->tcm_flags &= htons(~TCM_F_REQUEST);
-                tipc_conn_sendmsg(&cfgsrv, conid, addr, rep_buf->data,
-                                  rep_buf->len);
-                kfree_skb(rep_buf);
-        }
-}
-
-static struct sockaddr_tipc cfgsrv_addr __read_mostly = {
-        .family                 = AF_TIPC,
-        .addrtype               = TIPC_ADDR_NAMESEQ,
-        .addr.nameseq.type      = TIPC_CFG_SRV,
-        .addr.nameseq.lower     = 0,
-        .addr.nameseq.upper     = 0,
-        .scope                  = TIPC_ZONE_SCOPE
-};
-
-static struct tipc_server cfgsrv __read_mostly = {
-        .saddr                  = &cfgsrv_addr,
-        .imp                    = TIPC_CRITICAL_IMPORTANCE,
-        .type                   = SOCK_RDM,
-        .max_rcvbuf_size        = 64 * 1024,
-        .name                   = "cfg_server",
-        .tipc_conn_recvmsg      = cfg_conn_msg_event,
-        .tipc_conn_new          = NULL,
-        .tipc_conn_shutdown     = NULL
-};
-
-int tipc_cfg_init(void)
-{
-        return tipc_server_start(&cfgsrv);
-}
-
-void tipc_cfg_reinit(void)
-{
-        tipc_server_stop(&cfgsrv);
-
-        cfgsrv_addr.addr.nameseq.lower = tipc_own_addr;
-        cfgsrv_addr.addr.nameseq.upper = tipc_own_addr;
-        tipc_server_start(&cfgsrv);
-}
-
-void tipc_cfg_stop(void)
-{
-        tipc_server_stop(&cfgsrv);
-}
diff --git a/net/tipc/config.h b/net/tipc/config.h
index 1f252f3fa058..47b1bf181612 100644
--- a/net/tipc/config.h
+++ b/net/tipc/config.h
@@ -64,9 +64,4 @@ static inline struct sk_buff *tipc_cfg_reply_ultra_string(char *string)
 struct sk_buff *tipc_cfg_do_cmd(u32 orig_node, u16 cmd,
                                 const void *req_tlv_area, int req_tlv_space,
                                 int headroom);
-
-int  tipc_cfg_init(void);
-void tipc_cfg_reinit(void);
-void tipc_cfg_stop(void);
-
 #endif
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 80c20647b3d2..50d57429ebca 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -1,7 +1,7 @@
 /*
  * net/tipc/core.c: TIPC module code
  *
- * Copyright (c) 2003-2006, Ericsson AB
+ * Copyright (c) 2003-2006, 2013, Ericsson AB
  * Copyright (c) 2005-2006, 2010-2013, Wind River Systems
  * All rights reserved.
  *
@@ -50,7 +50,6 @@ int tipc_random __read_mostly;
 u32 tipc_own_addr __read_mostly;
 int tipc_max_ports __read_mostly;
 int tipc_net_id __read_mostly;
-int tipc_remote_management __read_mostly;
 int sysctl_tipc_rmem[3] __read_mostly;  /* min/default/max */
 
 /**
@@ -85,7 +84,6 @@ static void tipc_core_stop(void)
         tipc_net_stop();
         tipc_bearer_cleanup();
         tipc_netlink_stop();
-        tipc_cfg_stop();
         tipc_subscr_stop();
         tipc_nametbl_stop();
         tipc_ref_table_stop();
@@ -130,18 +128,12 @@ static int tipc_core_start(void)
         if (err)
                 goto out_subscr;
 
-        err = tipc_cfg_init();
-        if (err)
-                goto out_cfg;
-
         err = tipc_bearer_setup();
         if (err)
                 goto out_bearer;
 
         return 0;
 out_bearer:
-        tipc_cfg_stop();
-out_cfg:
         tipc_subscr_stop();
 out_subscr:
         tipc_unregister_sysctl();
@@ -166,7 +158,6 @@ static int __init tipc_init(void)
         pr_info("Activated (version " TIPC_MOD_VER ")\n");
 
         tipc_own_addr = 0;
-        tipc_remote_management = 1;
         tipc_max_ports = CONFIG_TIPC_PORTS;
         tipc_net_id = 4711;
 
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 4dfe137587bb..8985bbcb942b 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -79,7 +79,6 @@ int tipc_snprintf(char *buf, int len, const char *fmt, ...);
 extern u32 tipc_own_addr __read_mostly;
 extern int tipc_max_ports __read_mostly;
 extern int tipc_net_id __read_mostly;
-extern int tipc_remote_management __read_mostly;
 extern int sysctl_tipc_rmem[3] __read_mostly;
 
 /*
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index 412ff41b8611..542fe3413dc4 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -48,7 +48,6 @@
  * struct tipc_link_req - information about an ongoing link setup request
  * @bearer: bearer issuing requests
  * @dest: destination address for request messages
- * @domain: network domain to which links can be established
  * @num_nodes: number of nodes currently discovered (i.e. with an active link)
  * @lock: spinlock for controlling access to requests
  * @buf: request message to be (repeatedly) sent
@@ -58,7 +57,6 @@
 struct tipc_link_req {
         struct tipc_bearer *bearer;
         struct tipc_media_addr dest;
-        u32 domain;
         int num_nodes;
         spinlock_t lock;
         struct sk_buff *buf;
@@ -69,14 +67,13 @@ struct tipc_link_req {
 /**
  * tipc_disc_init_msg - initialize a link setup message
  * @type: message type (request or response)
- * @dest_domain: network domain of node(s) which should respond to message
  * @b_ptr: ptr to bearer issuing message
  */
-static struct sk_buff *tipc_disc_init_msg(u32 type, u32 dest_domain,
-                                          struct tipc_bearer *b_ptr)
+static struct sk_buff *tipc_disc_init_msg(u32 type, struct tipc_bearer *b_ptr)
 {
         struct sk_buff *buf = tipc_buf_acquire(INT_H_SIZE);
         struct tipc_msg *msg;
+        u32 dest_domain = b_ptr->domain;
 
         if (buf) {
                 msg = buf_msg(buf);
@@ -110,11 +107,11 @@ static void disc_dupl_alert(struct tipc_bearer *b_ptr, u32 node_addr,
 }
 
 /**
- * tipc_disc_recv_msg - handle incoming link setup message (request or response)
+ * tipc_disc_rcv - handle incoming link setup message (request or response)
  * @buf: buffer containing message
  * @b_ptr: bearer that message arrived on
  */
-void tipc_disc_recv_msg(struct sk_buff *buf, struct tipc_bearer *b_ptr)
+void tipc_disc_rcv(struct sk_buff *buf, struct tipc_bearer *b_ptr)
 {
         struct tipc_node *n_ptr;
         struct tipc_link *link;
@@ -149,7 +146,7 @@ void tipc_disc_recv_msg(struct sk_buff *buf, struct tipc_bearer *b_ptr)
         }
         if (!tipc_in_scope(dest, tipc_own_addr))
                 return;
-        if (!tipc_in_scope(b_ptr->link_req->domain, orig))
+        if (!tipc_in_scope(b_ptr->domain, orig))
                 return;
 
         /* Locate structure corresponding to requesting node */
@@ -242,7 +239,7 @@ void tipc_disc_recv_msg(struct sk_buff *buf, struct tipc_bearer *b_ptr)
         link_fully_up = link_working_working(link);
 
         if ((type == DSC_REQ_MSG) && !link_fully_up) {
-                rbuf = tipc_disc_init_msg(DSC_RESP_MSG, orig, b_ptr);
+                rbuf = tipc_disc_init_msg(DSC_RESP_MSG, b_ptr);
                 if (rbuf) {
                         tipc_bearer_send(b_ptr, rbuf, &media_addr);
                         kfree_skb(rbuf);
@@ -306,7 +303,7 @@ static void disc_timeout(struct tipc_link_req *req)
         spin_lock_bh(&req->lock);
 
         /* Stop searching if only desired node has been found */
-        if (tipc_node(req->domain) && req->num_nodes) {
+        if (tipc_node(req->bearer->domain) && req->num_nodes) {
                 req->timer_intv = TIPC_LINK_REQ_INACTIVE;
                 goto exit;
         }
@@ -342,8 +339,7 @@ exit:
  *
  * Returns 0 if successful, otherwise -errno.
  */
-int tipc_disc_create(struct tipc_bearer *b_ptr, struct tipc_media_addr *dest,
-                     u32 dest_domain)
+int tipc_disc_create(struct tipc_bearer *b_ptr, struct tipc_media_addr *dest)
 {
         struct tipc_link_req *req;
 
@@ -351,7 +347,7 @@ int tipc_disc_create(struct tipc_bearer *b_ptr, struct tipc_media_addr *dest,
         if (!req)
                 return -ENOMEM;
 
-        req->buf = tipc_disc_init_msg(DSC_REQ_MSG, dest_domain, b_ptr);
+        req->buf = tipc_disc_init_msg(DSC_REQ_MSG, b_ptr);
         if (!req->buf) {
                 kfree(req);
                 return -ENOMSG;
@@ -359,7 +355,6 @@ int tipc_disc_create(struct tipc_bearer *b_ptr, struct tipc_media_addr *dest,
 
         memcpy(&req->dest, dest, sizeof(*dest));
         req->bearer = b_ptr;
-        req->domain = dest_domain;
         req->num_nodes = 0;
         req->timer_intv = TIPC_LINK_REQ_INIT;
         spin_lock_init(&req->lock);
diff --git a/net/tipc/discover.h b/net/tipc/discover.h
index 75b67c403aa3..07f34729459d 100644
--- a/net/tipc/discover.h
+++ b/net/tipc/discover.h
@@ -39,11 +39,10 @@
 
 struct tipc_link_req;
 
-int tipc_disc_create(struct tipc_bearer *b_ptr, struct tipc_media_addr *dest,
-                     u32 dest_domain);
+int tipc_disc_create(struct tipc_bearer *b_ptr, struct tipc_media_addr *dest);
 void tipc_disc_delete(struct tipc_link_req *req);
 void tipc_disc_add_dest(struct tipc_link_req *req);
 void tipc_disc_remove_dest(struct tipc_link_req *req);
-void tipc_disc_recv_msg(struct sk_buff *buf, struct tipc_bearer *b_ptr);
+void tipc_disc_rcv(struct sk_buff *buf, struct tipc_bearer *b_ptr);
 
 #endif
diff --git a/net/tipc/link.c b/net/tipc/link.c
index da6018beb6eb..c5190ab75290 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -77,19 +77,19 @@ static const char *link_unk_evt = "Unknown link event ";
 
 static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
                                        struct sk_buff *buf);
-static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf);
-static int  tipc_link_tunnel_rcv(struct tipc_link **l_ptr,
+static void tipc_link_proto_rcv(struct tipc_link *l_ptr, struct sk_buff *buf);
+static int  tipc_link_tunnel_rcv(struct tipc_node *n_ptr,
                                  struct sk_buff **buf);
 static void link_set_supervision_props(struct tipc_link *l_ptr, u32 tolerance);
-static int  link_send_sections_long(struct tipc_port *sender,
-                                    struct iovec const *msg_sect,
-                                    unsigned int len, u32 destnode);
+static int  tipc_link_iovec_long_xmit(struct tipc_port *sender,
+                                      struct iovec const *msg_sect,
+                                      unsigned int len, u32 destnode);
 static void link_state_event(struct tipc_link *l_ptr, u32 event);
 static void link_reset_statistics(struct tipc_link *l_ptr);
 static void link_print(struct tipc_link *l_ptr, const char *str);
-static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf);
-static void tipc_link_send_sync(struct tipc_link *l);
-static void tipc_link_recv_sync(struct tipc_node *n, struct sk_buff *buf);
+static int tipc_link_frag_xmit(struct tipc_link *l_ptr, struct sk_buff *buf);
+static void tipc_link_sync_xmit(struct tipc_link *l);
+static void tipc_link_sync_rcv(struct tipc_node *n, struct sk_buff *buf);
 
 /*
  *  Simple link routines
@@ -147,11 +147,6 @@ int tipc_link_is_active(struct tipc_link *l_ptr)
 /**
  * link_timeout - handle expiration of link timer
  * @l_ptr: pointer to link
- *
- * This routine must not grab "tipc_net_lock" to avoid a potential deadlock conflict
- * with tipc_link_delete().  (There is no risk that the node will be deleted by
- * another thread because tipc_link_delete() always cancels the link timer before
- * tipc_node_delete() is called.)
  */
 static void link_timeout(struct tipc_link *l_ptr)
 {
@@ -213,8 +208,8 @@ static void link_set_timer(struct tipc_link *l_ptr, u32 time)
  * Returns pointer to link.
  */
 struct tipc_link *tipc_link_create(struct tipc_node *n_ptr,
-                              struct tipc_bearer *b_ptr,
-                              const struct tipc_media_addr *media_addr)
+                                   struct tipc_bearer *b_ptr,
+                                   const struct tipc_media_addr *media_addr)
 {
         struct tipc_link *l_ptr;
         struct tipc_msg *msg;
@@ -279,41 +274,44 @@ struct tipc_link *tipc_link_create(struct tipc_node *n_ptr,
 
         k_init_timer(&l_ptr->timer, (Handler)link_timeout,
                      (unsigned long)l_ptr);
-        list_add_tail(&l_ptr->link_list, &b_ptr->links);
 
         link_state_event(l_ptr, STARTING_EVT);
 
         return l_ptr;
 }
 
-/**
- * tipc_link_delete - delete a link
- * @l_ptr: pointer to link
- *
- * Note: 'tipc_net_lock' is write_locked, bearer is locked.
- * This routine must not grab the node lock until after link timer cancellation
- * to avoid a potential deadlock situation.
- */
-void tipc_link_delete(struct tipc_link *l_ptr)
+void tipc_link_delete_list(unsigned int bearer_id, bool shutting_down)
 {
-        if (!l_ptr) {
-                pr_err("Attempt to delete non-existent link\n");
-                return;
-        }
-
-        k_cancel_timer(&l_ptr->timer);
+        struct tipc_link *l_ptr;
+        struct tipc_node *n_ptr;
 
-        tipc_node_lock(l_ptr->owner);
-        tipc_link_reset(l_ptr);
-        tipc_node_detach_link(l_ptr->owner, l_ptr);
-        tipc_link_purge_queues(l_ptr);
-        list_del_init(&l_ptr->link_list);
-        tipc_node_unlock(l_ptr->owner);
-        k_term_timer(&l_ptr->timer);
-        kfree(l_ptr);
+        rcu_read_lock();
+        list_for_each_entry_rcu(n_ptr, &tipc_node_list, list) {
+                spin_lock_bh(&n_ptr->lock);
+                l_ptr = n_ptr->links[bearer_id];
+                if (l_ptr) {
+                        tipc_link_reset(l_ptr);
+                        if (shutting_down || !tipc_node_is_up(n_ptr)) {
+                                tipc_node_detach_link(l_ptr->owner, l_ptr);
+                                tipc_link_reset_fragments(l_ptr);
+                                spin_unlock_bh(&n_ptr->lock);
+
+                                /* Nobody else can access this link now: */
+                                del_timer_sync(&l_ptr->timer);
+                                kfree(l_ptr);
+                        } else {
+                                /* Detach/delete when failover is finished: */
+                                l_ptr->flags |= LINK_STOPPED;
+                                spin_unlock_bh(&n_ptr->lock);
+                                del_timer_sync(&l_ptr->timer);
+                        }
+                        continue;
+                }
+                spin_unlock_bh(&n_ptr->lock);
+        }
+        rcu_read_unlock();
 }
 
-
 /**
  * link_schedule_port - schedule port for deferred sending
  * @l_ptr: pointer to link
@@ -330,8 +328,6 @@ static int link_schedule_port(struct tipc_link *l_ptr, u32 origport, u32 sz)
         spin_lock_bh(&tipc_port_list_lock);
         p_ptr = tipc_port_lock(origport);
         if (p_ptr) {
-                if (!p_ptr->wakeup)
-                        goto exit;
                 if (!list_empty(&p_ptr->wait_list))
                         goto exit;
                 p_ptr->congested = 1;
@@ -366,7 +362,7 @@ void tipc_link_wakeup_ports(struct tipc_link *l_ptr, int all)
                 list_del_init(&p_ptr->wait_list);
                 spin_lock_bh(p_ptr->lock);
                 p_ptr->congested = 0;
-                p_ptr->wakeup(p_ptr);
+                tipc_port_wakeup(p_ptr);
                 win -= p_ptr->waiting_pkts;
                 spin_unlock_bh(p_ptr->lock);
         }
@@ -461,6 +457,21 @@ void tipc_link_reset(struct tipc_link *l_ptr)
         link_reset_statistics(l_ptr);
 }
 
+void tipc_link_reset_list(unsigned int bearer_id)
+{
+        struct tipc_link *l_ptr;
+        struct tipc_node *n_ptr;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(n_ptr, &tipc_node_list, list) {
+                spin_lock_bh(&n_ptr->lock);
+                l_ptr = n_ptr->links[bearer_id];
+                if (l_ptr)
+                        tipc_link_reset(l_ptr);
+                spin_unlock_bh(&n_ptr->lock);
+        }
+        rcu_read_unlock();
+}
 
 static void link_activate(struct tipc_link *l_ptr)
 {
@@ -479,7 +490,10 @@ static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
         struct tipc_link *other;
         u32 cont_intv = l_ptr->continuity_interval;
 
-        if (!l_ptr->started && (event != STARTING_EVT))
+        if (l_ptr->flags & LINK_STOPPED)
+                return;
+
+        if (!(l_ptr->flags & LINK_STARTED) && (event != STARTING_EVT))
                 return;         /* Not yet. */
 
         /* Check whether changeover is going on */
@@ -499,12 +513,12 @@ static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
                         if (l_ptr->next_in_no != l_ptr->checkpoint) {
                                 l_ptr->checkpoint = l_ptr->next_in_no;
                                 if (tipc_bclink_acks_missing(l_ptr->owner)) {
-                                        tipc_link_send_proto_msg(l_ptr, STATE_MSG,
-                                                                 0, 0, 0, 0, 0);
+                                        tipc_link_proto_xmit(l_ptr, STATE_MSG,
+                                                             0, 0, 0, 0, 0);
                                         l_ptr->fsm_msg_cnt++;
                                 } else if (l_ptr->max_pkt < l_ptr->max_pkt_target) {
-                                        tipc_link_send_proto_msg(l_ptr, STATE_MSG,
-                                                                 1, 0, 0, 0, 0);
+                                        tipc_link_proto_xmit(l_ptr, STATE_MSG,
+                                                             1, 0, 0, 0, 0);
                                         l_ptr->fsm_msg_cnt++;
                                 }
                                 link_set_timer(l_ptr, cont_intv);
@@ -512,7 +526,7 @@ static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
                         }
                         l_ptr->state = WORKING_UNKNOWN;
                         l_ptr->fsm_msg_cnt = 0;
-                        tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
+                        tipc_link_proto_xmit(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
                         l_ptr->fsm_msg_cnt++;
                         link_set_timer(l_ptr, cont_intv / 4);
                         break;
@@ -522,7 +536,8 @@ static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
                         tipc_link_reset(l_ptr);
                         l_ptr->state = RESET_RESET;
                         l_ptr->fsm_msg_cnt = 0;
-                        tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
+                        tipc_link_proto_xmit(l_ptr, ACTIVATE_MSG,
+                                             0, 0, 0, 0, 0);
                         l_ptr->fsm_msg_cnt++;
                         link_set_timer(l_ptr, cont_intv);
                         break;
@@ -544,7 +559,8 @@ static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
                         tipc_link_reset(l_ptr);
                         l_ptr->state = RESET_RESET;
                         l_ptr->fsm_msg_cnt = 0;
-                        tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
+                        tipc_link_proto_xmit(l_ptr, ACTIVATE_MSG,
+                                             0, 0, 0, 0, 0);
                         l_ptr->fsm_msg_cnt++;
                         link_set_timer(l_ptr, cont_intv);
                         break;
@@ -554,14 +570,14 @@ static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
                                 l_ptr->fsm_msg_cnt = 0;
                                 l_ptr->checkpoint = l_ptr->next_in_no;
                                 if (tipc_bclink_acks_missing(l_ptr->owner)) {
-                                        tipc_link_send_proto_msg(l_ptr, STATE_MSG,
-                                                                 0, 0, 0, 0, 0);
+                                        tipc_link_proto_xmit(l_ptr, STATE_MSG,
+                                                             0, 0, 0, 0, 0);
                                         l_ptr->fsm_msg_cnt++;
                                 }
                                 link_set_timer(l_ptr, cont_intv);
                         } else if (l_ptr->fsm_msg_cnt < l_ptr->abort_limit) {
-                                tipc_link_send_proto_msg(l_ptr, STATE_MSG,
-                                                         1, 0, 0, 0, 0);
+                                tipc_link_proto_xmit(l_ptr, STATE_MSG,
+                                                     1, 0, 0, 0, 0);
                                 l_ptr->fsm_msg_cnt++;
                                 link_set_timer(l_ptr, cont_intv / 4);
                         } else {        /* Link has failed */
@@ -570,8 +586,8 @@ static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
                                 tipc_link_reset(l_ptr);
                                 l_ptr->state = RESET_UNKNOWN;
                                 l_ptr->fsm_msg_cnt = 0;
-                                tipc_link_send_proto_msg(l_ptr, RESET_MSG,
-                                                         0, 0, 0, 0, 0);
+                                tipc_link_proto_xmit(l_ptr, RESET_MSG,
+                                                     0, 0, 0, 0, 0);
                                 l_ptr->fsm_msg_cnt++;
                                 link_set_timer(l_ptr, cont_intv);
                         }
@@ -591,24 +607,25 @@ static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
                         l_ptr->state = WORKING_WORKING;
                         l_ptr->fsm_msg_cnt = 0;
                         link_activate(l_ptr);
-                        tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
+                        tipc_link_proto_xmit(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
                         l_ptr->fsm_msg_cnt++;
                         if (l_ptr->owner->working_links == 1)
-                                tipc_link_send_sync(l_ptr);
+                                tipc_link_sync_xmit(l_ptr);
                         link_set_timer(l_ptr, cont_intv);
                         break;
                 case RESET_MSG:
                         l_ptr->state = RESET_RESET;
                         l_ptr->fsm_msg_cnt = 0;
-                        tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 1, 0, 0, 0, 0);
+                        tipc_link_proto_xmit(l_ptr, ACTIVATE_MSG,
+                                             1, 0, 0, 0, 0);
                         l_ptr->fsm_msg_cnt++;
                         link_set_timer(l_ptr, cont_intv);
                         break;
                 case STARTING_EVT:
-                        l_ptr->started = 1;
+                        l_ptr->flags |= LINK_STARTED;
                         /* fall through */
                 case TIMEOUT_EVT:
-                        tipc_link_send_proto_msg(l_ptr, RESET_MSG, 0, 0, 0, 0, 0);
+                        tipc_link_proto_xmit(l_ptr, RESET_MSG, 0, 0, 0, 0, 0);
                         l_ptr->fsm_msg_cnt++;
                         link_set_timer(l_ptr, cont_intv);
                         break;
@@ -626,16 +643,17 @@ static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
                         l_ptr->state = WORKING_WORKING;
                         l_ptr->fsm_msg_cnt = 0;
                         link_activate(l_ptr);
-                        tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
+                        tipc_link_proto_xmit(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
                         l_ptr->fsm_msg_cnt++;
                         if (l_ptr->owner->working_links == 1)
-                                tipc_link_send_sync(l_ptr);
+                                tipc_link_sync_xmit(l_ptr);
                         link_set_timer(l_ptr, cont_intv);
                         break;
                 case RESET_MSG:
                         break;
                 case TIMEOUT_EVT:
-                        tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
+                        tipc_link_proto_xmit(l_ptr, ACTIVATE_MSG,
+                                             0, 0, 0, 0, 0);
                         l_ptr->fsm_msg_cnt++;
                         link_set_timer(l_ptr, cont_intv);
                         break;
@@ -721,11 +739,11 @@ static void link_add_chain_to_outqueue(struct tipc_link *l_ptr,
 }
 
 /*
- * tipc_link_send_buf() is the 'full path' for messages, called from
- * inside TIPC when the 'fast path' in tipc_send_buf
+ * tipc_link_xmit() is the 'full path' for messages, called from
+ * inside TIPC when the 'fast path' in tipc_send_xmit
  * has failed, and from link_send()
  */
-int tipc_link_send_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
+int __tipc_link_xmit(struct tipc_link *l_ptr, struct sk_buff *buf)
 {
         struct tipc_msg *msg = buf_msg(buf);
         u32 size = msg_size(msg);
@@ -753,7 +771,7 @@ int tipc_link_send_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
 
         /* Fragmentation needed ? */
         if (size > max_packet)
-                return link_send_long_buf(l_ptr, buf);
+                return tipc_link_frag_xmit(l_ptr, buf);
 
         /* Packet can be queued or sent. */
         if (likely(!link_congested(l_ptr))) {
@@ -797,11 +815,11 @@ int tipc_link_send_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
 }
 
 /*
- * tipc_link_send(): same as tipc_link_send_buf(), but the link to use has
- * not been selected yet, and the the owner node is not locked
+ * tipc_link_xmit(): same as __tipc_link_xmit(), but the link to use
+ * has not been selected yet, and the the owner node is not locked
  * Called by TIPC internal users, e.g. the name distributor
  */
-int tipc_link_send(struct sk_buff *buf, u32 dest, u32 selector)
+int tipc_link_xmit(struct sk_buff *buf, u32 dest, u32 selector)
 {
         struct tipc_link *l_ptr;
         struct tipc_node *n_ptr;
@@ -813,7 +831,7 @@ int tipc_link_send(struct sk_buff *buf, u32 dest, u32 selector)
                 tipc_node_lock(n_ptr);
                 l_ptr = n_ptr->active_links[selector & 1];
                 if (l_ptr)
-                        res = tipc_link_send_buf(l_ptr, buf);
+                        res = __tipc_link_xmit(l_ptr, buf);
                 else
                         kfree_skb(buf);
                 tipc_node_unlock(n_ptr);
@@ -825,14 +843,14 @@ int tipc_link_send(struct sk_buff *buf, u32 dest, u32 selector)
 }
 
 /*
- * tipc_link_send_sync - synchronize broadcast link endpoints.
+ * tipc_link_sync_xmit - synchronize broadcast link endpoints.
  *
  * Give a newly added peer node the sequence number where it should
  * start receiving and acking broadcast packets.
  *
  * Called with node locked
  */
-static void tipc_link_send_sync(struct tipc_link *l)
+static void tipc_link_sync_xmit(struct tipc_link *l)
 {
         struct sk_buff *buf;
         struct tipc_msg *msg;
@@ -849,14 +867,14 @@ static void tipc_link_send_sync(struct tipc_link *l)
 }
 
 /*
- * tipc_link_recv_sync - synchronize broadcast link endpoints.
+ * tipc_link_sync_rcv - synchronize broadcast link endpoints.
  * Receive the sequence number where we should start receiving and
  * acking broadcast packets from a newly added peer node, and open
  * up for reception of such packets.
  *
  * Called with node locked
  */
-static void tipc_link_recv_sync(struct tipc_node *n, struct sk_buff *buf)
+static void tipc_link_sync_rcv(struct tipc_node *n, struct sk_buff *buf)
 {
         struct tipc_msg *msg = buf_msg(buf);
 
@@ -866,7 +884,7 @@ static void tipc_link_recv_sync(struct tipc_node *n, struct sk_buff *buf)
 }
 
 /*
- * tipc_link_send_names - send name table entries to new neighbor
+ * tipc_link_names_xmit - send name table entries to new neighbor
  *
  * Send routine for bulk delivery of name table messages when contact
  * with a new neighbor occurs. No link congestion checking is performed
@@ -874,7 +892,7 @@ static void tipc_link_recv_sync(struct tipc_node *n, struct sk_buff *buf)
  * small enough not to require fragmentation.
  * Called without any locks held.
  */
-void tipc_link_send_names(struct list_head *message_list, u32 dest)
+void tipc_link_names_xmit(struct list_head *message_list, u32 dest)
 {
         struct tipc_node *n_ptr;
         struct tipc_link *l_ptr;
@@ -909,13 +927,13 @@ void tipc_link_send_names(struct list_head *message_list, u32 dest)
 }
 
 /*
- * link_send_buf_fast: Entry for data messages where the
+ * tipc_link_xmit_fast: Entry for data messages where the
  * destination link is known and the header is complete,
  * inclusive total message length. Very time critical.
  * Link is locked. Returns user data length.
  */
-static int link_send_buf_fast(struct tipc_link *l_ptr, struct sk_buff *buf,
-                              u32 *used_max_pkt)
+static int tipc_link_xmit_fast(struct tipc_link *l_ptr, struct sk_buff *buf,
+                               u32 *used_max_pkt)
 {
         struct tipc_msg *msg = buf_msg(buf);
         int res = msg_data_sz(msg);
@@ -931,18 +949,18 @@ static int link_send_buf_fast(struct tipc_link *l_ptr, struct sk_buff *buf,
                 else
                         *used_max_pkt = l_ptr->max_pkt;
         }
-        return tipc_link_send_buf(l_ptr, buf);  /* All other cases */
+        return __tipc_link_xmit(l_ptr, buf);  /* All other cases */
 }
 
 /*
- * tipc_link_send_sections_fast: Entry for messages where the
+ * tipc_link_iovec_xmit_fast: Entry for messages where the
  * destination processor is known and the header is complete,
  * except for total message length.
  * Returns user data length or errno.
  */
-int tipc_link_send_sections_fast(struct tipc_port *sender,
-                                 struct iovec const *msg_sect,
-                                 unsigned int len, u32 destaddr)
+int tipc_link_iovec_xmit_fast(struct tipc_port *sender,
+                              struct iovec const *msg_sect,
+                              unsigned int len, u32 destaddr)
 {
         struct tipc_msg *hdr = &sender->phdr;
         struct tipc_link *l_ptr;
@@ -968,8 +986,8 @@ again:
                 l_ptr = node->active_links[selector];
                 if (likely(l_ptr)) {
                         if (likely(buf)) {
-                                res = link_send_buf_fast(l_ptr, buf,
-                                                         &sender->max_pkt);
+                                res = tipc_link_xmit_fast(l_ptr, buf,
+                                                          &sender->max_pkt);
 exit:
                                 tipc_node_unlock(node);
                                 read_unlock_bh(&tipc_net_lock);
@@ -995,24 +1013,21 @@ exit:
                         if ((msg_hdr_sz(hdr) + res) <= sender->max_pkt)
                                 goto again;
 
-                        return link_send_sections_long(sender, msg_sect, len,
-                                                       destaddr);
+                        return tipc_link_iovec_long_xmit(sender, msg_sect,
+                                                         len, destaddr);
                 }
                 tipc_node_unlock(node);
         }
         read_unlock_bh(&tipc_net_lock);
 
         /* Couldn't find a link to the destination node */
-        if (buf)
-                return tipc_reject_msg(buf, TIPC_ERR_NO_NODE);
-        if (res >= 0)
-                return tipc_port_reject_sections(sender, hdr, msg_sect,
-                                                 len, TIPC_ERR_NO_NODE);
-        return res;
+        kfree_skb(buf);
+        tipc_port_iovec_reject(sender, hdr, msg_sect, len, TIPC_ERR_NO_NODE);
+        return -ENETUNREACH;
 }
 
 /*
- * link_send_sections_long(): Entry for long messages where the
+ * tipc_link_iovec_long_xmit(): Entry for long messages where the
  * destination node is known and the header is complete,
  * inclusive total message length.
  * Link and bearer congestion status have been checked to be ok,
@@ -1025,9 +1040,9 @@ exit:
  *
  * Returns user data length or errno.
  */
-static int link_send_sections_long(struct tipc_port *sender,
-                                   struct iovec const *msg_sect,
-                                   unsigned int len, u32 destaddr)
+static int tipc_link_iovec_long_xmit(struct tipc_port *sender,
+                                     struct iovec const *msg_sect,
+                                     unsigned int len, u32 destaddr)
 {
         struct tipc_link *l_ptr;
         struct tipc_node *node;
@@ -1146,8 +1161,9 @@ error:
         } else {
 reject:
                 kfree_skb_list(buf_chain);
-                return tipc_port_reject_sections(sender, hdr, msg_sect,
-                                                 len, TIPC_ERR_NO_NODE);
+                tipc_port_iovec_reject(sender, hdr, msg_sect, len,
+                                       TIPC_ERR_NO_NODE);
+                return -ENETUNREACH;
         }
 
         /* Append chain of fragments to send queue & send them */
@@ -1441,15 +1457,10 @@ void tipc_rcv(struct sk_buff *head, struct tipc_bearer *b_ptr)
                 u32 seq_no;
                 u32 ackd;
                 u32 released = 0;
-                int type;
 
                 head = head->next;
                 buf->next = NULL;
 
-                /* Ensure bearer is still enabled */
-                if (unlikely(!b_ptr->active))
-                        goto discard;
-
                 /* Ensure message is well-formed */
                 if (unlikely(!link_recv_buf_validate(buf)))
                         goto discard;
@@ -1463,9 +1474,9 @@ void tipc_rcv(struct sk_buff *head, struct tipc_bearer *b_ptr)
 
                 if (unlikely(msg_non_seq(msg))) {
                         if (msg_user(msg) ==  LINK_CONFIG)
-                                tipc_disc_recv_msg(buf, b_ptr);
+                                tipc_disc_rcv(buf, b_ptr);
                         else
-                                tipc_bclink_recv_pkt(buf);
+                                tipc_bclink_rcv(buf);
                         continue;
                 }
 
@@ -1489,7 +1500,7 @@ void tipc_rcv(struct sk_buff *head, struct tipc_bearer *b_ptr)
                 if ((n_ptr->block_setup & WAIT_PEER_DOWN) &&
                         msg_user(msg) == LINK_PROTOCOL &&
                         (msg_type(msg) == RESET_MSG ||
-                                        msg_type(msg) == ACTIVATE_MSG) &&
+                         msg_type(msg) == ACTIVATE_MSG) &&
                         !msg_redundant_link(msg))
                         n_ptr->block_setup &= ~WAIT_PEER_DOWN;
 
@@ -1508,7 +1519,6 @@ void tipc_rcv(struct sk_buff *head, struct tipc_bearer *b_ptr)
                 while ((crs != l_ptr->next_out) &&
                        less_eq(buf_seqno(crs), ackd)) {
                         struct sk_buff *next = crs->next;
-
                         kfree_skb(crs);
                         crs = next;
                         released++;
@@ -1521,18 +1531,19 @@ void tipc_rcv(struct sk_buff *head, struct tipc_bearer *b_ptr)
                 /* Try sending any messages link endpoint has pending */
                 if (unlikely(l_ptr->next_out))
                         tipc_link_push_queue(l_ptr);
+
                 if (unlikely(!list_empty(&l_ptr->waiting_ports)))
                         tipc_link_wakeup_ports(l_ptr, 0);
+
                 if (unlikely(++l_ptr->unacked_window >= TIPC_MIN_LINK_WIN)) {
                         l_ptr->stats.sent_acks++;
-                        tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
+                        tipc_link_proto_xmit(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
                 }
 
-                /* Now (finally!) process the incoming message */
-protocol_check:
+                /* Process the incoming packet */
                 if (unlikely(!link_working_working(l_ptr))) {
                         if (msg_user(msg) == LINK_PROTOCOL) {
-                                link_recv_proto_msg(l_ptr, buf);
+                                tipc_link_proto_rcv(l_ptr, buf);
                                 head = link_insert_deferred_queue(l_ptr, head);
                                 tipc_node_unlock(n_ptr);
                                 continue;
@@ -1561,67 +1572,65 @@ protocol_check:
                 l_ptr->next_in_no++;
                 if (unlikely(l_ptr->oldest_deferred_in))
                         head = link_insert_deferred_queue(l_ptr, head);
-deliver:
-                if (likely(msg_isdata(msg))) {
-                        tipc_node_unlock(n_ptr);
-                        tipc_port_recv_msg(buf);
-                        continue;
+
+                /* Deliver packet/message to correct user: */
+                if (unlikely(msg_user(msg) ==  CHANGEOVER_PROTOCOL)) {
+                        if (!tipc_link_tunnel_rcv(n_ptr, &buf)) {
+                                tipc_node_unlock(n_ptr);
+                                continue;
+                        }
+                        msg = buf_msg(buf);
+                } else if (msg_user(msg) == MSG_FRAGMENTER) {
+                        int rc;
+
+                        l_ptr->stats.recv_fragments++;
+                        rc = tipc_link_frag_rcv(&l_ptr->reasm_head,
+                                                &l_ptr->reasm_tail,
+                                                &buf);
+                        if (rc == LINK_REASM_COMPLETE) {
+                                l_ptr->stats.recv_fragmented++;
+                                msg = buf_msg(buf);
+                        } else {
+                                if (rc == LINK_REASM_ERROR)
+                                        tipc_link_reset(l_ptr);
+                                tipc_node_unlock(n_ptr);
+                                continue;
+                        }
                 }
+
                 switch (msg_user(msg)) {
-                        int ret;
+                case TIPC_LOW_IMPORTANCE:
+                case TIPC_MEDIUM_IMPORTANCE:
+                case TIPC_HIGH_IMPORTANCE:
+                case TIPC_CRITICAL_IMPORTANCE:
+                        tipc_node_unlock(n_ptr);
+                        tipc_port_rcv(buf);
+                        continue;
                 case MSG_BUNDLER:
                         l_ptr->stats.recv_bundles++;
                         l_ptr->stats.recv_bundled += msg_msgcnt(msg);
                         tipc_node_unlock(n_ptr);
-                        tipc_link_recv_bundle(buf);
+                        tipc_link_bundle_rcv(buf);
                         continue;
                 case NAME_DISTRIBUTOR:
                         n_ptr->bclink.recv_permitted = true;
                         tipc_node_unlock(n_ptr);
-                        tipc_named_recv(buf);
-                        continue;
-                case BCAST_PROTOCOL:
-                        tipc_link_recv_sync(n_ptr, buf);
-                        tipc_node_unlock(n_ptr);
+                        tipc_named_rcv(buf);
                         continue;
                 case CONN_MANAGER:
                         tipc_node_unlock(n_ptr);
-                        tipc_port_recv_proto_msg(buf);
+                        tipc_port_proto_rcv(buf);
                         continue;
-                case MSG_FRAGMENTER:
-                        l_ptr->stats.recv_fragments++;
-                        ret = tipc_link_recv_fragment(&l_ptr->reasm_head,
-                                                      &l_ptr->reasm_tail,
-                                                      &buf);
-                        if (ret == LINK_REASM_COMPLETE) {
-                                l_ptr->stats.recv_fragmented++;
-                                msg = buf_msg(buf);
-                                goto deliver;
-                        }
-                        if (ret == LINK_REASM_ERROR)
-                                tipc_link_reset(l_ptr);
-                        tipc_node_unlock(n_ptr);
-                        continue;
-                case CHANGEOVER_PROTOCOL:
-                        type = msg_type(msg);
-                        if (tipc_link_tunnel_rcv(&l_ptr, &buf)) {
-                                msg = buf_msg(buf);
-                                seq_no = msg_seqno(msg);
-                                if (type == ORIGINAL_MSG)
-                                        goto deliver;
-                                goto protocol_check;
-                        }
+                case BCAST_PROTOCOL:
+                        tipc_link_sync_rcv(n_ptr, buf);
                         break;
                 default:
                         kfree_skb(buf);
-                        buf = NULL;
                         break;
                 }
                 tipc_node_unlock(n_ptr);
-                tipc_net_route_msg(buf);
                 continue;
 unlock_discard:
-
                 tipc_node_unlock(n_ptr);
 discard:
                 kfree_skb(buf);
@@ -1688,7 +1697,7 @@ static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
         u32 seq_no = buf_seqno(buf);
 
         if (likely(msg_user(buf_msg(buf)) == LINK_PROTOCOL)) {
-                link_recv_proto_msg(l_ptr, buf);
+                tipc_link_proto_rcv(l_ptr, buf);
                 return;
         }
 
@@ -1711,7 +1720,7 @@ static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
                 l_ptr->stats.deferred_recv++;
                 TIPC_SKB_CB(buf)->deferred = true;
                 if ((l_ptr->deferred_inqueue_sz % 16) == 1)
-                        tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
+                        tipc_link_proto_xmit(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
         } else
                 l_ptr->stats.duplicates++;
 }
@@ -1719,9 +1728,8 @@ static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
 /*
  * Send protocol message to the other endpoint.
  */
-void tipc_link_send_proto_msg(struct tipc_link *l_ptr, u32 msg_typ,
-                              int probe_msg, u32 gap, u32 tolerance,
-                              u32 priority, u32 ack_mtu)
+void tipc_link_proto_xmit(struct tipc_link *l_ptr, u32 msg_typ, int probe_msg,
+                          u32 gap, u32 tolerance, u32 priority, u32 ack_mtu)
 {
         struct sk_buff *buf = NULL;
         struct tipc_msg *msg = l_ptr->pmsg;
@@ -1820,7 +1828,7 @@ void tipc_link_send_proto_msg(struct tipc_link *l_ptr, u32 msg_typ,
  * Note that network plane id propagates through the network, and may
  * change at any time. The node with lowest address rules
  */
-static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf)
+static void tipc_link_proto_rcv(struct tipc_link *l_ptr, struct sk_buff *buf)
 {
         u32 rec_gap = 0;
         u32 max_pkt_info;
@@ -1939,8 +1947,8 @@ static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf)
                                                       msg_last_bcast(msg));
 
                 if (rec_gap || (msg_probe(msg))) {
-                        tipc_link_send_proto_msg(l_ptr, STATE_MSG,
-                                                 0, rec_gap, 0, 0, max_pkt_ack);
+                        tipc_link_proto_xmit(l_ptr, STATE_MSG, 0, rec_gap, 0,
+                                             0, max_pkt_ack);
                 }
                 if (msg_seq_gap(msg)) {
                         l_ptr->stats.recv_nacks++;
@@ -1979,7 +1987,7 @@ static void tipc_link_tunnel_xmit(struct tipc_link *l_ptr,
         }
         skb_copy_to_linear_data(buf, tunnel_hdr, INT_H_SIZE);
         skb_copy_to_linear_data_offset(buf, INT_H_SIZE, msg, length);
-        tipc_link_send_buf(tunnel, buf);
+        __tipc_link_xmit(tunnel, buf);
 }
 
 
@@ -2012,7 +2020,7 @@ void tipc_link_failover_send_queue(struct tipc_link *l_ptr)
                 if (buf) {
                         skb_copy_to_linear_data(buf, &tunnel_hdr, INT_H_SIZE);
                         msg_set_size(&tunnel_hdr, INT_H_SIZE);
-                        tipc_link_send_buf(tunnel, buf);
+                        __tipc_link_xmit(tunnel, buf);
                 } else {
                         pr_warn("%sunable to send changeover msg\n",
                                 link_co_err);
@@ -2046,7 +2054,7 @@ void tipc_link_failover_send_queue(struct tipc_link *l_ptr)
         }
 }
 
-/* tipc_link_dup_send_queue(): A second link has become active. Tunnel a
+/* tipc_link_dup_queue_xmit(): A second link has become active. Tunnel a
  * duplicate of the first link's send queue via the new link. This way, we
  * are guaranteed that currently queued packets from a socket are delivered
  * before future traffic from the same socket, even if this is using the
@@ -2055,7 +2063,7 @@ void tipc_link_failover_send_queue(struct tipc_link *l_ptr)
  * and sequence order is preserved per sender/receiver socket pair.
  * Owner node is locked.
  */
-void tipc_link_dup_send_queue(struct tipc_link *l_ptr,
+void tipc_link_dup_queue_xmit(struct tipc_link *l_ptr,
                               struct tipc_link *tunnel)
 {
         struct sk_buff *iter;
@@ -2085,7 +2093,7 @@ void tipc_link_dup_send_queue(struct tipc_link *l_ptr,
                 skb_copy_to_linear_data(outbuf, &tunnel_hdr, INT_H_SIZE);
                 skb_copy_to_linear_data_offset(outbuf, INT_H_SIZE, iter->data,
                                                length);
-                tipc_link_send_buf(tunnel, outbuf);
+                __tipc_link_xmit(tunnel, outbuf);
                 if (!tipc_link_is_up(l_ptr))
                         return;
                 iter = iter->next;
@@ -2112,89 +2120,114 @@ static struct sk_buff *buf_extract(struct sk_buff *skb, u32 from_pos)
         return eb;
 }
 
-/*  tipc_link_tunnel_rcv(): Receive a tunneled packet, sent
- *  via other link as result of a failover (ORIGINAL_MSG) or
- *  a new active link (DUPLICATE_MSG). Failover packets are
- *  returned to the active link for delivery upwards.
+
+
+/* tipc_link_dup_rcv(): Receive a tunnelled DUPLICATE_MSG packet.
+ * Owner node is locked.
+ */
+static void tipc_link_dup_rcv(struct tipc_link *l_ptr,
+                              struct sk_buff *t_buf)
+{
+        struct sk_buff *buf;
+
+        if (!tipc_link_is_up(l_ptr))
+                return;
+
+        buf = buf_extract(t_buf, INT_H_SIZE);
+        if (buf == NULL) {
+                pr_warn("%sfailed to extract inner dup pkt\n", link_co_err);
+                return;
+        }
+
+        /* Add buffer to deferred queue, if applicable: */
+        link_handle_out_of_seq_msg(l_ptr, buf);
+}
+
+/*  tipc_link_failover_rcv(): Receive a tunnelled ORIGINAL_MSG packet
  *  Owner node is locked.
  */
-static int tipc_link_tunnel_rcv(struct tipc_link **l_ptr,
-                                struct sk_buff **buf)
+static struct sk_buff *tipc_link_failover_rcv(struct tipc_link *l_ptr,
+                                              struct sk_buff *t_buf)
 {
-        struct sk_buff *tunnel_buf = *buf;
-        struct tipc_link *dest_link;
+        struct tipc_msg *t_msg = buf_msg(t_buf);
+        struct sk_buff *buf = NULL;
         struct tipc_msg *msg;
-        struct tipc_msg *tunnel_msg = buf_msg(tunnel_buf);
-        u32 msg_typ = msg_type(tunnel_msg);
-        u32 msg_count = msg_msgcnt(tunnel_msg);
-        u32 bearer_id = msg_bearer_id(tunnel_msg);
 
-        if (bearer_id >= MAX_BEARERS)
-                goto exit;
-        dest_link = (*l_ptr)->owner->links[bearer_id];
-        if (!dest_link)
-                goto exit;
-        if (dest_link == *l_ptr) {
-                pr_err("Unexpected changeover message on link <%s>\n",
-                       (*l_ptr)->name);
-                goto exit;
-        }
-        *l_ptr = dest_link;
-        msg = msg_get_wrapped(tunnel_msg);
+        if (tipc_link_is_up(l_ptr))
+                tipc_link_reset(l_ptr);
 
-        if (msg_typ == DUPLICATE_MSG) {
-                if (less(msg_seqno(msg), mod(dest_link->next_in_no)))
-                        goto exit;
-                *buf = buf_extract(tunnel_buf, INT_H_SIZE);
-                if (*buf == NULL) {
-                        pr_warn("%sduplicate msg dropped\n", link_co_err);
+        /* First failover packet? */
+        if (l_ptr->exp_msg_count == START_CHANGEOVER)
+                l_ptr->exp_msg_count = msg_msgcnt(t_msg);
+
+        /* Should there be an inner packet? */
+        if (l_ptr->exp_msg_count) {
+                l_ptr->exp_msg_count--;
+                buf = buf_extract(t_buf, INT_H_SIZE);
+                if (buf == NULL) {
+                        pr_warn("%sno inner failover pkt\n", link_co_err);
                         goto exit;
                 }
-                kfree_skb(tunnel_buf);
-                return 1;
-        }
+                msg = buf_msg(buf);
 
-        /* First original message ?: */
-        if (tipc_link_is_up(dest_link)) {
-                pr_info("%s<%s>, changeover initiated by peer\n", link_rst_msg,
-                        dest_link->name);
-                tipc_link_reset(dest_link);
-                dest_link->exp_msg_count = msg_count;
-                if (!msg_count)
-                        goto exit;
-        } else if (dest_link->exp_msg_count == START_CHANGEOVER) {
-                dest_link->exp_msg_count = msg_count;
-                if (!msg_count)
+                if (less(msg_seqno(msg), l_ptr->reset_checkpoint)) {
+                        kfree_skb(buf);
+                        buf = NULL;
                         goto exit;
+                }
+                if (msg_user(msg) == MSG_FRAGMENTER) {
+                        l_ptr->stats.recv_fragments++;
+                        tipc_link_frag_rcv(&l_ptr->reasm_head,
+                                           &l_ptr->reasm_tail,
+                                           &buf);
+                }
+        }
+exit:
+        if ((l_ptr->exp_msg_count == 0) && (l_ptr->flags & LINK_STOPPED)) {
+                tipc_node_detach_link(l_ptr->owner, l_ptr);
+                kfree(l_ptr);
         }
+        return buf;
+}
 
-        /* Receive original message */
-        if (dest_link->exp_msg_count == 0) {
-                pr_warn("%sgot too many tunnelled messages\n", link_co_err);
+/*  tipc_link_tunnel_rcv(): Receive a tunnelled packet, sent
+ *  via other link as result of a failover (ORIGINAL_MSG) or
+ *  a new active link (DUPLICATE_MSG). Failover packets are
+ *  returned to the active link for delivery upwards.
+ *  Owner node is locked.
+ */
+static int tipc_link_tunnel_rcv(struct tipc_node *n_ptr,
+                                struct sk_buff **buf)
+{
+        struct sk_buff *t_buf = *buf;
+        struct tipc_link *l_ptr;
+        struct tipc_msg *t_msg = buf_msg(t_buf);
+        u32 bearer_id = msg_bearer_id(t_msg);
+
+        *buf = NULL;
+
+        if (bearer_id >= MAX_BEARERS)
                 goto exit;
-        }
-        dest_link->exp_msg_count--;
-        if (less(msg_seqno(msg), dest_link->reset_checkpoint)) {
+
+        l_ptr = n_ptr->links[bearer_id];
+        if (!l_ptr)
                 goto exit;
-        } else {
-                *buf = buf_extract(tunnel_buf, INT_H_SIZE);
-                if (*buf != NULL) {
-                        kfree_skb(tunnel_buf);
-                        return 1;
-                } else {
-                        pr_warn("%soriginal msg dropped\n", link_co_err);
-                }
-        }
+
+        if (msg_type(t_msg) == DUPLICATE_MSG)
+                tipc_link_dup_rcv(l_ptr, t_buf);
+        else if (msg_type(t_msg) == ORIGINAL_MSG)
+                *buf = tipc_link_failover_rcv(l_ptr, t_buf);
+        else
+                pr_warn("%sunknown tunnel pkt received\n", link_co_err);
 exit:
-        *buf = NULL;
-        kfree_skb(tunnel_buf);
-        return 0;
+        kfree_skb(t_buf);
+        return *buf != NULL;
 }
 
 /*
  *  Bundler functionality:
  */
-void tipc_link_recv_bundle(struct sk_buff *buf)
+void tipc_link_bundle_rcv(struct sk_buff *buf)
 {
         u32 msgcount = msg_msgcnt(buf_msg(buf));
         u32 pos = INT_H_SIZE;
@@ -2217,11 +2250,11 @@ void tipc_link_recv_bundle(struct sk_buff *buf)
  */
 
 /*
- * link_send_long_buf: Entry for buffers needing fragmentation.
+ * tipc_link_frag_xmit: Entry for buffers needing fragmentation.
  * The buffer is complete, inclusive total message length.
  * Returns user data length.
  */
-static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
+static int tipc_link_frag_xmit(struct tipc_link *l_ptr, struct sk_buff *buf)
 {
         struct sk_buff *buf_chain = NULL;
         struct sk_buff *buf_chain_tail = (struct sk_buff *)&buf_chain;
@@ -2284,12 +2317,11 @@ static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
         return dsz;
 }
 
-/*
- * tipc_link_recv_fragment(): Called with node lock on. Returns
+/* tipc_link_frag_rcv(): Called with node lock on. Returns
  * the reassembled buffer if message is complete.
  */
-int tipc_link_recv_fragment(struct sk_buff **head, struct sk_buff **tail,
-                            struct sk_buff **fbuf)
+int tipc_link_frag_rcv(struct sk_buff **head, struct sk_buff **tail,
+                       struct sk_buff **fbuf)
 {
         struct sk_buff *frag = *fbuf;
         struct tipc_msg *msg = buf_msg(frag);
@@ -2303,6 +2335,7 @@ int tipc_link_recv_fragment(struct sk_buff **head, struct sk_buff **tail,
                         goto out_free;
                 *head = frag;
                 skb_frag_list_init(*head);
+                *fbuf = NULL;
                 return 0;
         } else if (*head &&
                    skb_try_coalesce(*head, frag, &headstolen, &delta)) {
@@ -2322,10 +2355,12 @@ int tipc_link_recv_fragment(struct sk_buff **head, struct sk_buff **tail,
                 *tail = *head = NULL;
                 return LINK_REASM_COMPLETE;
         }
+        *fbuf = NULL;
         return 0;
 out_free:
         pr_warn_ratelimited("Link unable to reassemble fragmented message\n");
         kfree_skb(*fbuf);
+        *fbuf = NULL;
         return LINK_REASM_ERROR;
 }
 
@@ -2359,35 +2394,41 @@ void tipc_link_set_queue_limits(struct tipc_link *l_ptr, u32 window)
         l_ptr->queue_limit[MSG_FRAGMENTER] = 4000;
 }
 
-/**
- * link_find_link - locate link by name
- * @name: ptr to link name string
- * @node: ptr to area to be filled with ptr to associated node
- *
+/* tipc_link_find_owner - locate owner node of link by link's name
+ * @name: pointer to link name string
+ * @bearer_id: pointer to index in 'node->links' array where the link was found.
  * Caller must hold 'tipc_net_lock' to ensure node and bearer are not deleted;
  * this also prevents link deletion.
  *
- * Returns pointer to link (or 0 if invalid link name).
+ * Returns pointer to node owning the link, or 0 if no matching link is found.
  */
-static struct tipc_link *link_find_link(const char *name,
-                                        struct tipc_node **node)
+static struct tipc_node *tipc_link_find_owner(const char *link_name,
+                                              unsigned int *bearer_id)
 {
         struct tipc_link *l_ptr;
         struct tipc_node *n_ptr;
+        struct tipc_node *found_node = 0;
         int i;
 
-        list_for_each_entry(n_ptr, &tipc_node_list, list) {
+        *bearer_id = 0;
+        rcu_read_lock();
+        list_for_each_entry_rcu(n_ptr, &tipc_node_list, list) {
+                tipc_node_lock(n_ptr);
                 for (i = 0; i < MAX_BEARERS; i++) {
                         l_ptr = n_ptr->links[i];
-                        if (l_ptr && !strcmp(l_ptr->name, name))
-                                goto found;
+                        if (l_ptr && !strcmp(l_ptr->name, link_name)) {
+                                *bearer_id = i;
+                                found_node = n_ptr;
+                                break;
+                        }
                 }
+                tipc_node_unlock(n_ptr);
+                if (found_node)
+                        break;
         }
-        l_ptr = NULL;
-        n_ptr = NULL;
-found:
-        *node = n_ptr;
-        return l_ptr;
+        rcu_read_unlock();
+
+        return found_node;
 }
 
 /**
@@ -2429,32 +2470,33 @@ static int link_cmd_set_value(const char *name, u32 new_value, u16 cmd)
         struct tipc_link *l_ptr;
         struct tipc_bearer *b_ptr;
         struct tipc_media *m_ptr;
+        int bearer_id;
         int res = 0;
 
-        l_ptr = link_find_link(name, &node);
-        if (l_ptr) {
-                /*
-                 * acquire node lock for tipc_link_send_proto_msg().
-                 * see "TIPC locking policy" in net.c.
-                 */
+        node = tipc_link_find_owner(name, &bearer_id);
+        if (node) {
                 tipc_node_lock(node);
-                switch (cmd) {
-                case TIPC_CMD_SET_LINK_TOL:
-                        link_set_supervision_props(l_ptr, new_value);
-                        tipc_link_send_proto_msg(l_ptr,
-                                STATE_MSG, 0, 0, new_value, 0, 0);
-                        break;
-                case TIPC_CMD_SET_LINK_PRI:
-                        l_ptr->priority = new_value;
-                        tipc_link_send_proto_msg(l_ptr,
-                                STATE_MSG, 0, 0, 0, new_value, 0);
-                        break;
-                case TIPC_CMD_SET_LINK_WINDOW:
-                        tipc_link_set_queue_limits(l_ptr, new_value);
-                        break;
-                default:
-                        res = -EINVAL;
-                        break;
+                l_ptr = node->links[bearer_id];
+
+                if (l_ptr) {
+                        switch (cmd) {
+                        case TIPC_CMD_SET_LINK_TOL:
+                                link_set_supervision_props(l_ptr, new_value);
+                                tipc_link_proto_xmit(l_ptr, STATE_MSG, 0, 0,
+                                                     new_value, 0, 0);
+                                break;
+                        case TIPC_CMD_SET_LINK_PRI:
+                                l_ptr->priority = new_value;
+                                tipc_link_proto_xmit(l_ptr, STATE_MSG, 0, 0,
+                                                     0, new_value, 0);
+                                break;
+                        case TIPC_CMD_SET_LINK_WINDOW:
+                                tipc_link_set_queue_limits(l_ptr, new_value);
+                                break;
+                        default:
+                                res = -EINVAL;
+                                break;
+                        }
                 }
                 tipc_node_unlock(node);
                 return res;
@@ -2549,6 +2591,7 @@ struct sk_buff *tipc_link_cmd_reset_stats(const void *req_tlv_area, int req_tlv_
         char *link_name;
         struct tipc_link *l_ptr;
         struct tipc_node *node;
+        unsigned int bearer_id;
 
         if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_NAME))
                 return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
@@ -2559,15 +2602,19 @@ struct sk_buff *tipc_link_cmd_reset_stats(const void *req_tlv_area, int req_tlv_
                         return tipc_cfg_reply_error_string("link not found");
                 return tipc_cfg_reply_none();
         }
-
         read_lock_bh(&tipc_net_lock);
-        l_ptr = link_find_link(link_name, &node);
-        if (!l_ptr) {
+        node = tipc_link_find_owner(link_name, &bearer_id);
+        if (!node) {
                 read_unlock_bh(&tipc_net_lock);
                 return tipc_cfg_reply_error_string("link not found");
         }
-
         tipc_node_lock(node);
+        l_ptr = node->links[bearer_id];
+        if (!l_ptr) {
+                tipc_node_unlock(node);
+                read_unlock_bh(&tipc_net_lock);
+                return tipc_cfg_reply_error_string("link not found");
+        }
         link_reset_statistics(l_ptr);
         tipc_node_unlock(node);
         read_unlock_bh(&tipc_net_lock);
@@ -2597,18 +2644,27 @@ static int tipc_link_stats(const char *name, char *buf, const u32 buf_size)
         struct tipc_node *node;
         char *status;
         u32 profile_total = 0;
+        unsigned int bearer_id;
         int ret;
 
         if (!strcmp(name, tipc_bclink_name))
                 return tipc_bclink_stats(buf, buf_size);
 
         read_lock_bh(&tipc_net_lock);
-        l = link_find_link(name, &node);
-        if (!l) {
+        node = tipc_link_find_owner(name, &bearer_id);
+        if (!node) {
                 read_unlock_bh(&tipc_net_lock);
                 return 0;
         }
         tipc_node_lock(node);
+
+        l = node->links[bearer_id];
+        if (!l) {
+                tipc_node_unlock(node);
+                read_unlock_bh(&tipc_net_lock);
+                return 0;
+        }
+
         s = &l->stats;
 
         if (tipc_link_is_active(l))
diff --git a/net/tipc/link.h b/net/tipc/link.h
index 3b6aa65b608c..8c0b49b5b2ee 100644
--- a/net/tipc/link.h
+++ b/net/tipc/link.h
@@ -1,7 +1,7 @@
 /*
  * net/tipc/link.h: Include file for TIPC link code
  *
- * Copyright (c) 1995-2006, Ericsson AB
+ * Copyright (c) 1995-2006, 2013, Ericsson AB
  * Copyright (c) 2004-2005, 2010-2011, Wind River Systems
  * All rights reserved.
  *
@@ -40,27 +40,28 @@
 #include "msg.h"
 #include "node.h"
 
-/*
- * Link reassembly status codes
+/* Link reassembly status codes
  */
 #define LINK_REASM_ERROR        -1
 #define LINK_REASM_COMPLETE     1
 
-/*
- * Out-of-range value for link sequence numbers
+/* Out-of-range value for link sequence numbers
  */
 #define INVALID_LINK_SEQ 0x10000
 
-/*
- * Link states
+/* Link working states
  */
 #define WORKING_WORKING 560810u
 #define WORKING_UNKNOWN 560811u
 #define RESET_UNKNOWN   560812u
 #define RESET_RESET     560813u
 
-/*
- * Starting value for maximum packet size negotiation on unicast links
+/* Link endpoint execution states
+ */
+#define LINK_STARTED    0x0001
+#define LINK_STOPPED    0x0002
+
+/* Starting value for maximum packet size negotiation on unicast links
  * (unless bearer MTU is less)
  */
 #define MAX_PKT_DEFAULT 1500
@@ -102,8 +103,7 @@ struct tipc_stats {
  * @media_addr: media address to use when sending messages over link
  * @timer: link timer
  * @owner: pointer to peer node
- * @link_list: adjacent links in bearer's list of links
- * @started: indicates if link has been started
+ * @flags: execution state flags for link endpoint instance
  * @checkpoint: reference point for triggering link continuity checking
  * @peer_session: link session # being used by peer end of link
  * @peer_bearer_id: bearer id used by link's peer endpoint
@@ -149,10 +149,9 @@ struct tipc_link {
         struct tipc_media_addr media_addr;
         struct timer_list timer;
         struct tipc_node *owner;
-        struct list_head link_list;
 
         /* Management and link supervision data */
-        int started;
+        unsigned int flags;
         u32 checkpoint;
         u32 peer_session;
         u32 peer_bearer_id;
@@ -215,10 +214,9 @@ struct tipc_port;
 struct tipc_link *tipc_link_create(struct tipc_node *n_ptr,
                               struct tipc_bearer *b_ptr,
                               const struct tipc_media_addr *media_addr);
-void tipc_link_delete(struct tipc_link *l_ptr);
+void tipc_link_delete_list(unsigned int bearer_id, bool shutting_down);
 void tipc_link_failover_send_queue(struct tipc_link *l_ptr);
-void tipc_link_dup_send_queue(struct tipc_link *l_ptr,
-                              struct tipc_link *dest);
+void tipc_link_dup_queue_xmit(struct tipc_link *l_ptr, struct tipc_link *dest);
 void tipc_link_reset_fragments(struct tipc_link *l_ptr);
 int tipc_link_is_up(struct tipc_link *l_ptr);
 int tipc_link_is_active(struct tipc_link *l_ptr);
@@ -231,23 +229,24 @@ struct sk_buff *tipc_link_cmd_show_stats(const void *req_tlv_area,
 struct sk_buff *tipc_link_cmd_reset_stats(const void *req_tlv_area,
                                           int req_tlv_space);
 void tipc_link_reset(struct tipc_link *l_ptr);
-int tipc_link_send(struct sk_buff *buf, u32 dest, u32 selector);
-void tipc_link_send_names(struct list_head *message_list, u32 dest);
+void tipc_link_reset_list(unsigned int bearer_id);
+int tipc_link_xmit(struct sk_buff *buf, u32 dest, u32 selector);
+void tipc_link_names_xmit(struct list_head *message_list, u32 dest);
+int __tipc_link_xmit(struct tipc_link *l_ptr, struct sk_buff *buf);
 int tipc_link_send_buf(struct tipc_link *l_ptr, struct sk_buff *buf);
 u32 tipc_link_get_max_pkt(u32 dest, u32 selector);
-int tipc_link_send_sections_fast(struct tipc_port *sender,
-                                 struct iovec const *msg_sect,
-                                 unsigned int len, u32 destnode);
-void tipc_link_recv_bundle(struct sk_buff *buf);
-int  tipc_link_recv_fragment(struct sk_buff **reasm_head,
-                             struct sk_buff **reasm_tail,
-                             struct sk_buff **fbuf);
-void tipc_link_send_proto_msg(struct tipc_link *l_ptr, u32 msg_typ, int prob,
-                              u32 gap, u32 tolerance, u32 priority,
-                              u32 acked_mtu);
+int tipc_link_iovec_xmit_fast(struct tipc_port *sender,
+                              struct iovec const *msg_sect,
+                              unsigned int len, u32 destnode);
+void tipc_link_bundle_rcv(struct sk_buff *buf);
+int tipc_link_frag_rcv(struct sk_buff **reasm_head,
+                       struct sk_buff **reasm_tail,
+                       struct sk_buff **fbuf);
+void tipc_link_proto_xmit(struct tipc_link *l_ptr, u32 msg_typ, int prob,
+                          u32 gap, u32 tolerance, u32 priority, u32 acked_mtu);
 void tipc_link_push_queue(struct tipc_link *l_ptr);
 u32 tipc_link_defer_pkt(struct sk_buff **head, struct sk_buff **tail,
-                   struct sk_buff *buf);
+                        struct sk_buff *buf);
 void tipc_link_wakeup_ports(struct tipc_link *l_ptr, int all);
 void tipc_link_set_queue_limits(struct tipc_link *l_ptr, u32 window);
 void tipc_link_retransmit(struct tipc_link *l_ptr,
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index e0d08055754e..aff8041dc157 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -131,16 +131,24 @@ static void named_cluster_distribute(struct sk_buff *buf)
 {
         struct sk_buff *buf_copy;
         struct tipc_node *n_ptr;
+        struct tipc_link *l_ptr;
 
-        list_for_each_entry(n_ptr, &tipc_node_list, list) {
-                if (tipc_node_active_links(n_ptr)) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(n_ptr, &tipc_node_list, list) {
+                spin_lock_bh(&n_ptr->lock);
+                l_ptr = n_ptr->active_links[n_ptr->addr & 1];
+                if (l_ptr) {
                         buf_copy = skb_copy(buf, GFP_ATOMIC);
-                        if (!buf_copy)
+                        if (!buf_copy) {
+                                spin_unlock_bh(&n_ptr->lock);
                                 break;
+                        }
                         msg_set_destnode(buf_msg(buf_copy), n_ptr->addr);
-                        tipc_link_send(buf_copy, n_ptr->addr, n_ptr->addr);
+                        __tipc_link_xmit(l_ptr, buf_copy);
                 }
+                spin_unlock_bh(&n_ptr->lock);
         }
+        rcu_read_unlock();
 
         kfree_skb(buf);
 }
@@ -262,7 +270,7 @@ void tipc_named_node_up(unsigned long nodearg)
         named_distribute(&message_list, node, &publ_zone, max_item_buf);
         read_unlock_bh(&tipc_nametbl_lock);
 
-        tipc_link_send_names(&message_list, node);
+        tipc_link_names_xmit(&message_list, node);
 }
 
 /**
@@ -293,9 +301,9 @@ static void named_purge_publ(struct publication *publ)
 }
 
 /**
- * tipc_named_recv - process name table update message sent by another node
+ * tipc_named_rcv - process name table update message sent by another node
  */
-void tipc_named_recv(struct sk_buff *buf)
+void tipc_named_rcv(struct sk_buff *buf)
 {
         struct publication *publ;
         struct tipc_msg *msg = buf_msg(buf);
diff --git a/net/tipc/name_distr.h b/net/tipc/name_distr.h
index 1e41bdd4f255..9b312ccfd43e 100644
--- a/net/tipc/name_distr.h
+++ b/net/tipc/name_distr.h
@@ -42,7 +42,7 @@
 void tipc_named_publish(struct publication *publ);
 void tipc_named_withdraw(struct publication *publ);
 void tipc_named_node_up(unsigned long node);
-void tipc_named_recv(struct sk_buff *buf);
+void tipc_named_rcv(struct sk_buff *buf);
 void tipc_named_reinit(void);
 
 #endif
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 7d305ecc09c2..4c564eb69e1a 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -146,19 +146,19 @@ void tipc_net_route_msg(struct sk_buff *buf)
         if (tipc_in_scope(dnode, tipc_own_addr)) {
                 if (msg_isdata(msg)) {
                         if (msg_mcast(msg))
-                                tipc_port_recv_mcast(buf, NULL);
+                                tipc_port_mcast_rcv(buf, NULL);
                         else if (msg_destport(msg))
-                                tipc_port_recv_msg(buf);
+                                tipc_port_rcv(buf);
                         else
                                 net_route_named_msg(buf);
                         return;
                 }
                 switch (msg_user(msg)) {
                 case NAME_DISTRIBUTOR:
-                        tipc_named_recv(buf);
+                        tipc_named_rcv(buf);
                         break;
                 case CONN_MANAGER:
-                        tipc_port_recv_proto_msg(buf);
+                        tipc_port_proto_rcv(buf);
                         break;
                 default:
                         kfree_skb(buf);
@@ -168,7 +168,7 @@ void tipc_net_route_msg(struct sk_buff *buf)
 
         /* Handle message for another node */
         skb_trim(buf, msg_size(msg));
-        tipc_link_send(buf, dnode, msg_link_selector(msg));
+        tipc_link_xmit(buf, dnode, msg_link_selector(msg));
 }
 
 void tipc_net_start(u32 addr)
@@ -182,8 +182,8 @@ void tipc_net_start(u32 addr)
         tipc_bclink_init();
         write_unlock_bh(&tipc_net_lock);
 
-        tipc_cfg_reinit();
-
+        tipc_nametbl_publish(TIPC_CFG_SRV, tipc_own_addr, tipc_own_addr,
+                             TIPC_ZONE_SCOPE, 0, tipc_own_addr);
         pr_info("Started in network mode\n");
         pr_info("Own node address %s, network identity %u\n",
                 tipc_addr_string_fill(addr_string, tipc_own_addr), tipc_net_id);
@@ -191,15 +191,15 @@ void tipc_net_start(u32 addr)
 
 void tipc_net_stop(void)
 {
-        struct tipc_node *node, *t_node;
-
         if (!tipc_own_addr)
                 return;
+
+        tipc_nametbl_withdraw(TIPC_CFG_SRV, tipc_own_addr, 0, tipc_own_addr);
         write_lock_bh(&tipc_net_lock);
         tipc_bearer_stop();
         tipc_bclink_stop();
-        list_for_each_entry_safe(node, t_node, &tipc_node_list, list)
-                tipc_node_delete(node);
+        tipc_node_stop();
         write_unlock_bh(&tipc_net_lock);
+
         pr_info("Left network mode\n");
 }
diff --git a/net/tipc/node.c b/net/tipc/node.c
index efe4d41bf11b..1d3a4999a70f 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -2,7 +2,7 @@
  * net/tipc/node.c: TIPC node management routines
  *
  * Copyright (c) 2000-2006, 2012 Ericsson AB
- * Copyright (c) 2005-2006, 2010-2011, Wind River Systems
+ * Copyright (c) 2005-2006, 2010-2014, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -44,13 +44,11 @@
 static void node_lost_contact(struct tipc_node *n_ptr);
 static void node_established_contact(struct tipc_node *n_ptr);
 
-static DEFINE_SPINLOCK(node_create_lock);
-
 static struct hlist_head node_htable[NODE_HTABLE_SIZE];
 LIST_HEAD(tipc_node_list);
 static u32 tipc_num_nodes;
-
-static atomic_t tipc_num_links = ATOMIC_INIT(0);
+static u32 tipc_num_links;
+static DEFINE_SPINLOCK(node_list_lock);
 
 /*
  * A trivial power-of-two bitmask technique is used for speed, since this
@@ -73,37 +71,26 @@ struct tipc_node *tipc_node_find(u32 addr)
         if (unlikely(!in_own_cluster_exact(addr)))
                 return NULL;
 
-        hlist_for_each_entry(node, &node_htable[tipc_hashfn(addr)], hash) {
-                if (node->addr == addr)
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(node, &node_htable[tipc_hashfn(addr)], hash) {
+                if (node->addr == addr) {
+                        rcu_read_unlock();
                         return node;
+                }
         }
+        rcu_read_unlock();
         return NULL;
 }
 
-/**
- * tipc_node_create - create neighboring node
- *
- * Currently, this routine is called by neighbor discovery code, which holds
- * net_lock for reading only.  We must take node_create_lock to ensure a node
- * isn't created twice if two different bearers discover the node at the same
- * time.  (It would be preferable to switch to holding net_lock in write mode,
- * but this is a non-trivial change.)
- */
 struct tipc_node *tipc_node_create(u32 addr)
 {
         struct tipc_node *n_ptr, *temp_node;
 
-        spin_lock_bh(&node_create_lock);
-
-        n_ptr = tipc_node_find(addr);
-        if (n_ptr) {
-                spin_unlock_bh(&node_create_lock);
-                return n_ptr;
-        }
+        spin_lock_bh(&node_list_lock);
 
         n_ptr = kzalloc(sizeof(*n_ptr), GFP_ATOMIC);
         if (!n_ptr) {
-                spin_unlock_bh(&node_create_lock);
+                spin_unlock_bh(&node_list_lock);
                 pr_warn("Node creation failed, no memory\n");
                 return NULL;
         }
@@ -114,31 +101,41 @@ struct tipc_node *tipc_node_create(u32 addr)
         INIT_LIST_HEAD(&n_ptr->list);
         INIT_LIST_HEAD(&n_ptr->nsub);
 
-        hlist_add_head(&n_ptr->hash, &node_htable[tipc_hashfn(addr)]);
+        hlist_add_head_rcu(&n_ptr->hash, &node_htable[tipc_hashfn(addr)]);
 
-        list_for_each_entry(temp_node, &tipc_node_list, list) {
+        list_for_each_entry_rcu(temp_node, &tipc_node_list, list) {
                 if (n_ptr->addr < temp_node->addr)
                         break;
         }
-        list_add_tail(&n_ptr->list, &temp_node->list);
+        list_add_tail_rcu(&n_ptr->list, &temp_node->list);
         n_ptr->block_setup = WAIT_PEER_DOWN;
         n_ptr->signature = INVALID_NODE_SIG;
 
         tipc_num_nodes++;
 
-        spin_unlock_bh(&node_create_lock);
+        spin_unlock_bh(&node_list_lock);
         return n_ptr;
 }
 
-void tipc_node_delete(struct tipc_node *n_ptr)
+static void tipc_node_delete(struct tipc_node *n_ptr)
 {
-        list_del(&n_ptr->list);
-        hlist_del(&n_ptr->hash);
-        kfree(n_ptr);
+        list_del_rcu(&n_ptr->list);
+        hlist_del_rcu(&n_ptr->hash);
+        kfree_rcu(n_ptr, rcu);
 
         tipc_num_nodes--;
 }
 
+void tipc_node_stop(void)
+{
+        struct tipc_node *node, *t_node;
+
+        spin_lock_bh(&node_list_lock);
+        list_for_each_entry_safe(node, t_node, &tipc_node_list, list)
+                tipc_node_delete(node);
+        spin_unlock_bh(&node_list_lock);
+}
+
 /**
  * tipc_node_link_up - handle addition of link
  *
@@ -162,7 +159,7 @@ void tipc_node_link_up(struct tipc_node *n_ptr, struct tipc_link *l_ptr)
                 pr_info("New link <%s> becomes standby\n", l_ptr->name);
                 return;
         }
-        tipc_link_dup_send_queue(active[0], l_ptr);
+        tipc_link_dup_queue_xmit(active[0], l_ptr);
         if (l_ptr->priority == active[0]->priority) {
                 active[0] = l_ptr;
                 return;
@@ -243,15 +240,25 @@ int tipc_node_is_up(struct tipc_node *n_ptr)
 void tipc_node_attach_link(struct tipc_node *n_ptr, struct tipc_link *l_ptr)
 {
         n_ptr->links[l_ptr->b_ptr->identity] = l_ptr;
-        atomic_inc(&tipc_num_links);
+        spin_lock_bh(&node_list_lock);
+        tipc_num_links++;
+        spin_unlock_bh(&node_list_lock);
         n_ptr->link_cnt++;
 }
 
 void tipc_node_detach_link(struct tipc_node *n_ptr, struct tipc_link *l_ptr)
 {
-        n_ptr->links[l_ptr->b_ptr->identity] = NULL;
-        atomic_dec(&tipc_num_links);
-        n_ptr->link_cnt--;
+        int i;
+
+        for (i = 0; i < MAX_BEARERS; i++) {
+                if (l_ptr != n_ptr->links[i])
+                        continue;
+                n_ptr->links[i] = NULL;
+                spin_lock_bh(&node_list_lock);
+                tipc_num_links--;
+                spin_unlock_bh(&node_list_lock);
+                n_ptr->link_cnt--;
+        }
 }
 
 static void node_established_contact(struct tipc_node *n_ptr)
@@ -335,27 +342,28 @@ struct sk_buff *tipc_node_get_nodes(const void *req_tlv_area, int req_tlv_space)
                 return tipc_cfg_reply_error_string(TIPC_CFG_INVALID_VALUE
                                                    " (network address)");
 
-        read_lock_bh(&tipc_net_lock);
+        spin_lock_bh(&node_list_lock);
         if (!tipc_num_nodes) {
-                read_unlock_bh(&tipc_net_lock);
+                spin_unlock_bh(&node_list_lock);
                 return tipc_cfg_reply_none();
         }
 
         /* For now, get space for all other nodes */
         payload_size = TLV_SPACE(sizeof(node_info)) * tipc_num_nodes;
         if (payload_size > 32768u) {
-                read_unlock_bh(&tipc_net_lock);
+                spin_unlock_bh(&node_list_lock);
                 return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
                                                    " (too many nodes)");
         }
+        spin_unlock_bh(&node_list_lock);
+
         buf = tipc_cfg_reply_alloc(payload_size);
-        if (!buf) {
-                read_unlock_bh(&tipc_net_lock);
+        if (!buf)
                 return NULL;
-        }
 
         /* Add TLVs for all nodes in scope */
-        list_for_each_entry(n_ptr, &tipc_node_list, list) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(n_ptr, &tipc_node_list, list) {
                 if (!tipc_in_scope(domain, n_ptr->addr))
                         continue;
                 node_info.addr = htonl(n_ptr->addr);
@@ -363,8 +371,7 @@ struct sk_buff *tipc_node_get_nodes(const void *req_tlv_area, int req_tlv_space)
                 tipc_cfg_append_tlv(buf, TIPC_TLV_NODE_INFO,
                                     &node_info, sizeof(node_info));
         }
-
-        read_unlock_bh(&tipc_net_lock);
+        rcu_read_unlock();
         return buf;
 }
 
@@ -387,21 +394,19 @@ struct sk_buff *tipc_node_get_links(const void *req_tlv_area, int req_tlv_space)
         if (!tipc_own_addr)
                 return tipc_cfg_reply_none();
 
-        read_lock_bh(&tipc_net_lock);
-
+        spin_lock_bh(&node_list_lock);
         /* Get space for all unicast links + broadcast link */
-        payload_size = TLV_SPACE(sizeof(link_info)) *
-                (atomic_read(&tipc_num_links) + 1);
+        payload_size = TLV_SPACE((sizeof(link_info)) * (tipc_num_links + 1));
         if (payload_size > 32768u) {
-                read_unlock_bh(&tipc_net_lock);
+                spin_unlock_bh(&node_list_lock);
                 return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
                                                    " (too many links)");
         }
+        spin_unlock_bh(&node_list_lock);
+
         buf = tipc_cfg_reply_alloc(payload_size);
-        if (!buf) {
-                read_unlock_bh(&tipc_net_lock);
+        if (!buf)
                 return NULL;
-        }
 
         /* Add TLV for broadcast link */
         link_info.dest = htonl(tipc_cluster_mask(tipc_own_addr));
@@ -410,7 +415,8 @@ struct sk_buff *tipc_node_get_links(const void *req_tlv_area, int req_tlv_space)
         tipc_cfg_append_tlv(buf, TIPC_TLV_LINK_INFO, &link_info, sizeof(link_info));
 
         /* Add TLVs for any other links in scope */
-        list_for_each_entry(n_ptr, &tipc_node_list, list) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(n_ptr, &tipc_node_list, list) {
                 u32 i;
 
                 if (!tipc_in_scope(domain, n_ptr->addr))
@@ -427,7 +433,6 @@ struct sk_buff *tipc_node_get_links(const void *req_tlv_area, int req_tlv_space)
                 }
                 tipc_node_unlock(n_ptr);
         }
-
-        read_unlock_bh(&tipc_net_lock);
+        rcu_read_unlock();
         return buf;
 }
diff --git a/net/tipc/node.h b/net/tipc/node.h
index 63e2e8ead2fe..7cbb8cec1a93 100644
--- a/net/tipc/node.h
+++ b/net/tipc/node.h
@@ -2,7 +2,7 @@
  * net/tipc/node.h: Include file for TIPC node management routines
  *
  * Copyright (c) 2000-2006, Ericsson AB
- * Copyright (c) 2005, 2010-2011, Wind River Systems
+ * Copyright (c) 2005, 2010-2014, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -66,6 +66,7 @@
  * @link_cnt: number of links to node
  * @signature: node instance identifier
  * @bclink: broadcast-related info
+ * @rcu: rcu struct for tipc_node
  *    @acked: sequence # of last outbound b'cast message acknowledged by node
  *    @last_in: sequence # of last in-sequence b'cast message received from node
  *    @last_sent: sequence # of last b'cast message sent by node
@@ -89,6 +90,7 @@ struct tipc_node {
         int working_links;
         int block_setup;
         u32 signature;
+        struct rcu_head rcu;
         struct {
                 u32 acked;
                 u32 last_in;
@@ -107,7 +109,7 @@ extern struct list_head tipc_node_list;
 
 struct tipc_node *tipc_node_find(u32 addr);
 struct tipc_node *tipc_node_create(u32 addr);
-void tipc_node_delete(struct tipc_node *n_ptr);
+void tipc_node_stop(void);
 void tipc_node_attach_link(struct tipc_node *n_ptr, struct tipc_link *l_ptr);
 void tipc_node_detach_link(struct tipc_node *n_ptr, struct tipc_link *l_ptr);
 void tipc_node_link_down(struct tipc_node *n_ptr, struct tipc_link *l_ptr);
diff --git a/net/tipc/port.c b/net/tipc/port.c
index b742b2654525..5c14c7801ee6 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -1,7 +1,7 @@
 /*
  * net/tipc/port.c: TIPC port code
  *
- * Copyright (c) 1992-2007, Ericsson AB
+ * Copyright (c) 1992-2007, 2014, Ericsson AB
  * Copyright (c) 2004-2008, 2010-2013, Wind River Systems
  * All rights reserved.
  *
@@ -38,6 +38,7 @@
 #include "config.h"
 #include "port.h"
 #include "name_table.h"
+#include "socket.h"
 
 /* Connection management: */
 #define PROBING_INTERVAL 3600000        /* [ms] => 1 h */
@@ -54,17 +55,6 @@ static struct sk_buff *port_build_self_abort_msg(struct tipc_port *, u32 err);
 static struct sk_buff *port_build_peer_abort_msg(struct tipc_port *, u32 err);
 static void port_timeout(unsigned long ref);
 
-
-static u32 port_peernode(struct tipc_port *p_ptr)
-{
-        return msg_destnode(&p_ptr->phdr);
-}
-
-static u32 port_peerport(struct tipc_port *p_ptr)
-{
-        return msg_destport(&p_ptr->phdr);
-}
-
 /**
  * tipc_port_peer_msg - verify message was sent by connected port's peer
  *
@@ -76,33 +66,32 @@ int tipc_port_peer_msg(struct tipc_port *p_ptr, struct tipc_msg *msg)
         u32 peernode;
         u32 orignode;
 
-        if (msg_origport(msg) != port_peerport(p_ptr))
+        if (msg_origport(msg) != tipc_port_peerport(p_ptr))
                 return 0;
 
         orignode = msg_orignode(msg);
-        peernode = port_peernode(p_ptr);
+        peernode = tipc_port_peernode(p_ptr);
         return (orignode == peernode) ||
                 (!orignode && (peernode == tipc_own_addr)) ||
                 (!peernode && (orignode == tipc_own_addr));
 }
 
 /**
- * tipc_multicast - send a multicast message to local and remote destinations
+ * tipc_port_mcast_xmit - send a multicast message to local and remote
+ * destinations
  */
-int tipc_multicast(u32 ref, struct tipc_name_seq const *seq,
-                   struct iovec const *msg_sect, unsigned int len)
+int tipc_port_mcast_xmit(struct tipc_port *oport,
+                         struct tipc_name_seq const *seq,
+                         struct iovec const *msg_sect,
+                         unsigned int len)
 {
         struct tipc_msg *hdr;
         struct sk_buff *buf;
         struct sk_buff *ibuf = NULL;
         struct tipc_port_list dports = {0, NULL, };
-        struct tipc_port *oport = tipc_port_deref(ref);
         int ext_targets;
         int res;
 
-        if (unlikely(!oport))
-                return -EINVAL;
-
         /* Create multicast message */
         hdr = &oport->phdr;
         msg_set_type(hdr, TIPC_MCAST_MSG);
@@ -131,7 +120,7 @@ int tipc_multicast(u32 ref, struct tipc_name_seq const *seq,
                                 return -ENOMEM;
                         }
                 }
-                res = tipc_bclink_send_msg(buf);
+                res = tipc_bclink_xmit(buf);
                 if ((res < 0) && (dports.count != 0))
                         kfree_skb(ibuf);
         } else {
@@ -140,7 +129,7 @@ int tipc_multicast(u32 ref, struct tipc_name_seq const *seq,
 
         if (res >= 0) {
                 if (ibuf)
-                        tipc_port_recv_mcast(ibuf, &dports);
+                        tipc_port_mcast_rcv(ibuf, &dports);
         } else {
                 tipc_port_list_free(&dports);
         }
@@ -148,11 +137,11 @@ int tipc_multicast(u32 ref, struct tipc_name_seq const *seq,
 }
 
 /**
- * tipc_port_recv_mcast - deliver multicast message to all destination ports
+ * tipc_port_mcast_rcv - deliver multicast message to all destination ports
  *
  * If there is no port list, perform a lookup to create one
  */
-void tipc_port_recv_mcast(struct sk_buff *buf, struct tipc_port_list *dp)
+void tipc_port_mcast_rcv(struct sk_buff *buf, struct tipc_port_list *dp)
 {
         struct tipc_msg *msg;
         struct tipc_port_list dports = {0, NULL, };
@@ -176,7 +165,7 @@ void tipc_port_recv_mcast(struct sk_buff *buf, struct tipc_port_list *dp)
                 msg_set_destnode(msg, tipc_own_addr);
                 if (dp->count == 1) {
                         msg_set_destport(msg, dp->ports[0]);
-                        tipc_port_recv_msg(buf);
+                        tipc_port_rcv(buf);
                         tipc_port_list_free(dp);
                         return;
                 }
@@ -191,7 +180,7 @@ void tipc_port_recv_mcast(struct sk_buff *buf, struct tipc_port_list *dp)
                         if ((index == 0) && (cnt != 0))
                                 item = item->next;
                         msg_set_destport(buf_msg(b), item->ports[index]);
-                        tipc_port_recv_msg(b);
+                        tipc_port_rcv(b);
                 }
         }
 exit:
@@ -199,40 +188,32 @@ exit:
         tipc_port_list_free(dp);
 }
 
-/**
- * tipc_createport - create a generic TIPC port
+
+void tipc_port_wakeup(struct tipc_port *port)
+{
+        tipc_sock_wakeup(tipc_port_to_sock(port));
+}
+
+/* tipc_port_init - intiate TIPC port and lock it
  *
- * Returns pointer to (locked) TIPC port, or NULL if unable to create it
+ * Returns obtained reference if initialization is successful, zero otherwise
  */
-struct tipc_port *tipc_createport(struct sock *sk,
-                                  u32 (*dispatcher)(struct tipc_port *,
-                                  struct sk_buff *),
-                                  void (*wakeup)(struct tipc_port *),
-                                  const u32 importance)
+u32 tipc_port_init(struct tipc_port *p_ptr,
+                   const unsigned int importance)
 {
-        struct tipc_port *p_ptr;
         struct tipc_msg *msg;
         u32 ref;
 
-        p_ptr = kzalloc(sizeof(*p_ptr), GFP_ATOMIC);
-        if (!p_ptr) {
-                pr_warn("Port creation failed, no memory\n");
-                return NULL;
-        }
         ref = tipc_ref_acquire(p_ptr, &p_ptr->lock);
         if (!ref) {
-                pr_warn("Port creation failed, ref. table exhausted\n");
-                kfree(p_ptr);
-                return NULL;
+                pr_warn("Port registration failed, ref. table exhausted\n");
+                return 0;
         }
 
-        p_ptr->sk = sk;
         p_ptr->max_pkt = MAX_PKT_DEFAULT;
         p_ptr->ref = ref;
         INIT_LIST_HEAD(&p_ptr->wait_list);
         INIT_LIST_HEAD(&p_ptr->subscription.nodesub_list);
-        p_ptr->dispatcher = dispatcher;
-        p_ptr->wakeup = wakeup;
         k_init_timer(&p_ptr->timer, (Handler)port_timeout, ref);
         INIT_LIST_HEAD(&p_ptr->publications);
         INIT_LIST_HEAD(&p_ptr->port_list);
@@ -248,10 +229,10 @@ struct tipc_port *tipc_createport(struct sock *sk,
         msg_set_origport(msg, ref);
         list_add_tail(&p_ptr->port_list, &ports);
         spin_unlock_bh(&tipc_port_list_lock);
-        return p_ptr;
+        return ref;
 }
 
-int tipc_deleteport(struct tipc_port *p_ptr)
+void tipc_port_destroy(struct tipc_port *p_ptr)
 {
         struct sk_buff *buf = NULL;
 
@@ -272,67 +253,7 @@ int tipc_deleteport(struct tipc_port *p_ptr)
         list_del(&p_ptr->wait_list);
         spin_unlock_bh(&tipc_port_list_lock);
         k_term_timer(&p_ptr->timer);
-        kfree(p_ptr);
         tipc_net_route_msg(buf);
-        return 0;
-}
-
-static int port_unreliable(struct tipc_port *p_ptr)
-{
-        return msg_src_droppable(&p_ptr->phdr);
-}
-
-int tipc_portunreliable(u32 ref, unsigned int *isunreliable)
-{
-        struct tipc_port *p_ptr;
-
-        p_ptr = tipc_port_lock(ref);
-        if (!p_ptr)
-                return -EINVAL;
-        *isunreliable = port_unreliable(p_ptr);
-        tipc_port_unlock(p_ptr);
-        return 0;
-}
-
-int tipc_set_portunreliable(u32 ref, unsigned int isunreliable)
-{
-        struct tipc_port *p_ptr;
-
-        p_ptr = tipc_port_lock(ref);
-        if (!p_ptr)
-                return -EINVAL;
-        msg_set_src_droppable(&p_ptr->phdr, (isunreliable != 0));
-        tipc_port_unlock(p_ptr);
-        return 0;
-}
-
-static int port_unreturnable(struct tipc_port *p_ptr)
-{
-        return msg_dest_droppable(&p_ptr->phdr);
-}
-
-int tipc_portunreturnable(u32 ref, unsigned int *isunrejectable)
-{
-        struct tipc_port *p_ptr;
-
-        p_ptr = tipc_port_lock(ref);
-        if (!p_ptr)
-                return -EINVAL;
-        *isunrejectable = port_unreturnable(p_ptr);
-        tipc_port_unlock(p_ptr);
-        return 0;
-}
-
-int tipc_set_portunreturnable(u32 ref, unsigned int isunrejectable)
-{
-        struct tipc_port *p_ptr;
-
-        p_ptr = tipc_port_lock(ref);
-        if (!p_ptr)
-                return -EINVAL;
-        msg_set_dest_droppable(&p_ptr->phdr, (isunrejectable != 0));
-        tipc_port_unlock(p_ptr);
-        return 0;
 }
 
 /*
@@ -350,8 +271,8 @@ static struct sk_buff *port_build_proto_msg(struct tipc_port *p_ptr,
         if (buf) {
                 msg = buf_msg(buf);
                 tipc_msg_init(msg, CONN_MANAGER, type, INT_H_SIZE,
-                              port_peernode(p_ptr));
-                msg_set_destport(msg, port_peerport(p_ptr));
+                              tipc_port_peernode(p_ptr));
+                msg_set_destport(msg, tipc_port_peerport(p_ptr));
                 msg_set_origport(msg, p_ptr->ref);
                 msg_set_msgcnt(msg, ack);
         }
@@ -422,17 +343,17 @@ int tipc_reject_msg(struct sk_buff *buf, u32 err)
         /* send returned message & dispose of rejected message */
         src_node = msg_prevnode(msg);
         if (in_own_node(src_node))
-                tipc_port_recv_msg(rbuf);
+                tipc_port_rcv(rbuf);
         else
-                tipc_link_send(rbuf, src_node, msg_link_selector(rmsg));
+                tipc_link_xmit(rbuf, src_node, msg_link_selector(rmsg));
 exit:
         kfree_skb(buf);
         return data_sz;
 }
 
-int tipc_port_reject_sections(struct tipc_port *p_ptr, struct tipc_msg *hdr,
-                              struct iovec const *msg_sect, unsigned int len,
-                              int err)
+int tipc_port_iovec_reject(struct tipc_port *p_ptr, struct tipc_msg *hdr,
+                           struct iovec const *msg_sect, unsigned int len,
+                           int err)
 {
         struct sk_buff *buf;
         int res;
@@ -519,7 +440,7 @@ static struct sk_buff *port_build_peer_abort_msg(struct tipc_port *p_ptr, u32 er
         return buf;
 }
 
-void tipc_port_recv_proto_msg(struct sk_buff *buf)
+void tipc_port_proto_rcv(struct sk_buff *buf)
 {
         struct tipc_msg *msg = buf_msg(buf);
         struct tipc_port *p_ptr;
@@ -547,13 +468,12 @@ void tipc_port_recv_proto_msg(struct sk_buff *buf)
         /* Process protocol message sent by peer */
         switch (msg_type(msg)) {
         case CONN_ACK:
-                wakeable = tipc_port_congested(p_ptr) && p_ptr->congested &&
-                        p_ptr->wakeup;
+                wakeable = tipc_port_congested(p_ptr) && p_ptr->congested;
                 p_ptr->acked += msg_msgcnt(msg);
                 if (!tipc_port_congested(p_ptr)) {
                         p_ptr->congested = 0;
                         if (wakeable)
-                                p_ptr->wakeup(p_ptr);
+                                tipc_port_wakeup(p_ptr);
                 }
                 break;
         case CONN_PROBE:
@@ -584,8 +504,8 @@ static int port_print(struct tipc_port *p_ptr, char *buf, int len, int full_id)
                 ret = tipc_snprintf(buf, len, "%-10u:", p_ptr->ref);
 
         if (p_ptr->connected) {
-                u32 dport = port_peerport(p_ptr);
-                u32 destnode = port_peernode(p_ptr);
+                u32 dport = tipc_port_peerport(p_ptr);
+                u32 destnode = tipc_port_peernode(p_ptr);
 
                 ret += tipc_snprintf(buf + ret, len - ret,
                                      " connected to <%u.%u.%u:%u>",
@@ -673,34 +593,6 @@ void tipc_acknowledge(u32 ref, u32 ack)
         tipc_net_route_msg(buf);
 }
 
-int tipc_portimportance(u32 ref, unsigned int *importance)
-{
-        struct tipc_port *p_ptr;
-
-        p_ptr = tipc_port_lock(ref);
-        if (!p_ptr)
-                return -EINVAL;
-        *importance = (unsigned int)msg_importance(&p_ptr->phdr);
-        tipc_port_unlock(p_ptr);
-        return 0;
-}
-
-int tipc_set_portimportance(u32 ref, unsigned int imp)
-{
-        struct tipc_port *p_ptr;
-
-        if (imp > TIPC_CRITICAL_IMPORTANCE)
-                return -EINVAL;
-
-        p_ptr = tipc_port_lock(ref);
-        if (!p_ptr)
-                return -EINVAL;
-        msg_set_importance(&p_ptr->phdr, (u32)imp);
-        tipc_port_unlock(p_ptr);
-        return 0;
-}
-
-
 int tipc_publish(struct tipc_port *p_ptr, unsigned int scope,
                  struct tipc_name_seq const *seq)
 {
@@ -760,7 +652,7 @@ int tipc_withdraw(struct tipc_port *p_ptr, unsigned int scope,
         return res;
 }
 
-int tipc_connect(u32 ref, struct tipc_portid const *peer)
+int tipc_port_connect(u32 ref, struct tipc_portid const *peer)
 {
         struct tipc_port *p_ptr;
         int res;
@@ -768,17 +660,17 @@ int tipc_connect(u32 ref, struct tipc_portid const *peer)
         p_ptr = tipc_port_lock(ref);
         if (!p_ptr)
                 return -EINVAL;
-        res = __tipc_connect(ref, p_ptr, peer);
+        res = __tipc_port_connect(ref, p_ptr, peer);
         tipc_port_unlock(p_ptr);
         return res;
 }
 
 /*
- * __tipc_connect - connect to a remote peer
+ * __tipc_port_connect - connect to a remote peer
  *
  * Port must be locked.
  */
-int __tipc_connect(u32 ref, struct tipc_port *p_ptr,
+int __tipc_port_connect(u32 ref, struct tipc_port *p_ptr,
                         struct tipc_portid const *peer)
 {
         struct tipc_msg *msg;
@@ -815,7 +707,7 @@ exit:
  *
  * Port must be locked.
  */
-int __tipc_disconnect(struct tipc_port *tp_ptr)
+int __tipc_port_disconnect(struct tipc_port *tp_ptr)
 {
         if (tp_ptr->connected) {
                 tp_ptr->connected = 0;
@@ -828,10 +720,10 @@ int __tipc_disconnect(struct tipc_port *tp_ptr)
 }
 
 /*
- * tipc_disconnect(): Disconnect port form peer.
+ * tipc_port_disconnect(): Disconnect port form peer.
  *                    This is a node local operation.
  */
-int tipc_disconnect(u32 ref)
+int tipc_port_disconnect(u32 ref)
 {
         struct tipc_port *p_ptr;
         int res;
@@ -839,15 +731,15 @@ int tipc_disconnect(u32 ref)
         p_ptr = tipc_port_lock(ref);
         if (!p_ptr)
                 return -EINVAL;
-        res = __tipc_disconnect(p_ptr);
+        res = __tipc_port_disconnect(p_ptr);
         tipc_port_unlock(p_ptr);
         return res;
 }
 
 /*
- * tipc_shutdown(): Send a SHUTDOWN msg to peer and disconnect
+ * tipc_port_shutdown(): Send a SHUTDOWN msg to peer and disconnect
  */
-int tipc_shutdown(u32 ref)
+int tipc_port_shutdown(u32 ref)
 {
         struct tipc_port *p_ptr;
         struct sk_buff *buf = NULL;
@@ -859,13 +751,13 @@ int tipc_shutdown(u32 ref)
         buf = port_build_peer_abort_msg(p_ptr, TIPC_CONN_SHUTDOWN);
         tipc_port_unlock(p_ptr);
         tipc_net_route_msg(buf);
-        return tipc_disconnect(ref);
+        return tipc_port_disconnect(ref);
 }
 
 /**
- * tipc_port_recv_msg - receive message from lower layer and deliver to port user
+ * tipc_port_rcv - receive message from lower layer and deliver to port user
  */
-int tipc_port_recv_msg(struct sk_buff *buf)
+int tipc_port_rcv(struct sk_buff *buf)
 {
         struct tipc_port *p_ptr;
         struct tipc_msg *msg = buf_msg(buf);
@@ -882,7 +774,7 @@ int tipc_port_recv_msg(struct sk_buff *buf)
         /* validate destination & pass to port, otherwise reject message */
         p_ptr = tipc_port_lock(destport);
         if (likely(p_ptr)) {
-                err = p_ptr->dispatcher(p_ptr, buf);
+                err = tipc_sk_rcv(&tipc_port_to_sock(p_ptr)->sk, buf);
                 tipc_port_unlock(p_ptr);
                 if (likely(!err))
                         return dsz;
@@ -894,43 +786,43 @@ int tipc_port_recv_msg(struct sk_buff *buf)
 }
 
 /*
- *  tipc_port_recv_sections(): Concatenate and deliver sectioned
- *                        message for this node.
+ *  tipc_port_iovec_rcv: Concatenate and deliver sectioned
+ *                       message for this node.
  */
-static int tipc_port_recv_sections(struct tipc_port *sender,
-                                   struct iovec const *msg_sect,
-                                   unsigned int len)
+static int tipc_port_iovec_rcv(struct tipc_port *sender,
+                               struct iovec const *msg_sect,
+                               unsigned int len)
 {
         struct sk_buff *buf;
         int res;
 
         res = tipc_msg_build(&sender->phdr, msg_sect, len, MAX_MSG_SIZE, &buf);
         if (likely(buf))
-                tipc_port_recv_msg(buf);
+                tipc_port_rcv(buf);
         return res;
 }
 
 /**
  * tipc_send - send message sections on connection
  */
-int tipc_send(u32 ref, struct iovec const *msg_sect, unsigned int len)
+int tipc_send(struct tipc_port *p_ptr,
+              struct iovec const *msg_sect,
+              unsigned int len)
 {
-        struct tipc_port *p_ptr;
         u32 destnode;
         int res;
 
-        p_ptr = tipc_port_deref(ref);
-        if (!p_ptr || !p_ptr->connected)
+        if (!p_ptr->connected)
                 return -EINVAL;
 
         p_ptr->congested = 1;
         if (!tipc_port_congested(p_ptr)) {
-                destnode = port_peernode(p_ptr);
+                destnode = tipc_port_peernode(p_ptr);
                 if (likely(!in_own_node(destnode)))
-                        res = tipc_link_send_sections_fast(p_ptr, msg_sect,
-                                                           len, destnode);
+                        res = tipc_link_iovec_xmit_fast(p_ptr, msg_sect, len,
+                                                        destnode);
                 else
-                        res = tipc_port_recv_sections(p_ptr, msg_sect, len);
+                        res = tipc_port_iovec_rcv(p_ptr, msg_sect, len);
 
                 if (likely(res != -ELINKCONG)) {
                         p_ptr->congested = 0;
@@ -939,7 +831,7 @@ int tipc_send(u32 ref, struct iovec const *msg_sect, unsigned int len)
                         return res;
                 }
         }
-        if (port_unreliable(p_ptr)) {
+        if (tipc_port_unreliable(p_ptr)) {
                 p_ptr->congested = 0;
                 return len;
         }
@@ -949,17 +841,18 @@ int tipc_send(u32 ref, struct iovec const *msg_sect, unsigned int len)
 /**
  * tipc_send2name - send message sections to port name
  */
-int tipc_send2name(u32 ref, struct tipc_name const *name, unsigned int domain,
-                   struct iovec const *msg_sect, unsigned int len)
+int tipc_send2name(struct tipc_port *p_ptr,
+                   struct tipc_name const *name,
+                   unsigned int domain,
+                   struct iovec const *msg_sect,
+                   unsigned int len)
 {
-        struct tipc_port *p_ptr;
         struct tipc_msg *msg;
         u32 destnode = domain;
         u32 destport;
         int res;
 
-        p_ptr = tipc_port_deref(ref);
-        if (!p_ptr || p_ptr->connected)
+        if (p_ptr->connected)
                 return -EINVAL;
 
         msg = &p_ptr->phdr;
@@ -974,39 +867,39 @@ int tipc_send2name(u32 ref, struct tipc_name const *name, unsigned int domain,
 
         if (likely(destport || destnode)) {
                 if (likely(in_own_node(destnode)))
-                        res = tipc_port_recv_sections(p_ptr, msg_sect, len);
+                        res = tipc_port_iovec_rcv(p_ptr, msg_sect, len);
                 else if (tipc_own_addr)
-                        res = tipc_link_send_sections_fast(p_ptr, msg_sect,
-                                                           len, destnode);
+                        res = tipc_link_iovec_xmit_fast(p_ptr, msg_sect, len,
+                                                        destnode);
                 else
-                        res = tipc_port_reject_sections(p_ptr, msg, msg_sect,
-                                                        len, TIPC_ERR_NO_NODE);
+                        res = tipc_port_iovec_reject(p_ptr, msg, msg_sect,
+                                                     len, TIPC_ERR_NO_NODE);
                 if (likely(res != -ELINKCONG)) {
                         if (res > 0)
                                 p_ptr->sent++;
                         return res;
                 }
-                if (port_unreliable(p_ptr)) {
+                if (tipc_port_unreliable(p_ptr))
                         return len;
-                }
+
                 return -ELINKCONG;
         }
-        return tipc_port_reject_sections(p_ptr, msg, msg_sect, len,
-                                         TIPC_ERR_NO_NAME);
+        return tipc_port_iovec_reject(p_ptr, msg, msg_sect, len,
+                                      TIPC_ERR_NO_NAME);
 }
 
 /**
  * tipc_send2port - send message sections to port identity
  */
-int tipc_send2port(u32 ref, struct tipc_portid const *dest,
-                   struct iovec const *msg_sect, unsigned int len)
+int tipc_send2port(struct tipc_port *p_ptr,
+                   struct tipc_portid const *dest,
+                   struct iovec const *msg_sect,
+                   unsigned int len)
 {
-        struct tipc_port *p_ptr;
         struct tipc_msg *msg;
         int res;
 
-        p_ptr = tipc_port_deref(ref);
-        if (!p_ptr || p_ptr->connected)
+        if (p_ptr->connected)
                 return -EINVAL;
 
         msg = &p_ptr->phdr;
@@ -1017,20 +910,20 @@ int tipc_send2port(u32 ref, struct tipc_portid const *dest,
         msg_set_hdr_sz(msg, BASIC_H_SIZE);
 
         if (in_own_node(dest->node))
-                res =  tipc_port_recv_sections(p_ptr, msg_sect, len);
+                res =  tipc_port_iovec_rcv(p_ptr, msg_sect, len);
         else if (tipc_own_addr)
-                res = tipc_link_send_sections_fast(p_ptr, msg_sect, len,
-                                                   dest->node);
+                res = tipc_link_iovec_xmit_fast(p_ptr, msg_sect, len,
+                                                dest->node);
         else
-                res = tipc_port_reject_sections(p_ptr, msg, msg_sect, len,
+                res = tipc_port_iovec_reject(p_ptr, msg, msg_sect, len,
                                                 TIPC_ERR_NO_NODE);
         if (likely(res != -ELINKCONG)) {
                 if (res > 0)
                         p_ptr->sent++;
                 return res;
         }
-        if (port_unreliable(p_ptr)) {
+        if (tipc_port_unreliable(p_ptr))
                 return len;
-        }
+
         return -ELINKCONG;
 }
diff --git a/net/tipc/port.h b/net/tipc/port.h
index 34f12bd4074e..a00397393bd1 100644
--- a/net/tipc/port.h
+++ b/net/tipc/port.h
@@ -1,7 +1,7 @@
 /*
  * net/tipc/port.h: Include file for TIPC port code
  *
- * Copyright (c) 1994-2007, Ericsson AB
+ * Copyright (c) 1994-2007, 2014, Ericsson AB
  * Copyright (c) 2004-2007, 2010-2013, Wind River Systems
  * All rights reserved.
  *
@@ -48,7 +48,6 @@
 
 /**
  * struct tipc_port - TIPC port structure
- * @sk: pointer to socket handle
  * @lock: pointer to spinlock for controlling access to port
  * @connected: non-zero if port is currently connected to a peer port
  * @conn_type: TIPC type used when connection was established
@@ -60,8 +59,6 @@
  * @ref: unique reference to port in TIPC object registry
  * @phdr: preformatted message header used when sending messages
  * @port_list: adjacent ports in TIPC's global list of ports
- * @dispatcher: ptr to routine which handles received messages
- * @wakeup: ptr to routine to call when port is no longer congested
  * @wait_list: adjacent ports in list of ports waiting on link congestion
  * @waiting_pkts:
  * @sent: # of non-empty messages sent by port
@@ -74,7 +71,6 @@
  * @subscription: "node down" subscription used to terminate failed connections
  */
 struct tipc_port {
-        struct sock *sk;
         spinlock_t *lock;
         int connected;
         u32 conn_type;
@@ -86,8 +82,6 @@ struct tipc_port {
         u32 ref;
         struct tipc_msg phdr;
         struct list_head port_list;
-        u32 (*dispatcher)(struct tipc_port *, struct sk_buff *);
-        void (*wakeup)(struct tipc_port *);
         struct list_head wait_list;
         u32 waiting_pkts;
         u32 sent;
@@ -106,68 +100,71 @@ struct tipc_port_list;
 /*
  * TIPC port manipulation routines
  */
-struct tipc_port *tipc_createport(struct sock *sk,
-                                  u32 (*dispatcher)(struct tipc_port *,
-                                  struct sk_buff *),
-                                  void (*wakeup)(struct tipc_port *),
-                                  const u32 importance);
+u32 tipc_port_init(struct tipc_port *p_ptr,
+                   const unsigned int importance);
 
 int tipc_reject_msg(struct sk_buff *buf, u32 err);
 
 void tipc_acknowledge(u32 port_ref, u32 ack);
 
-int tipc_deleteport(struct tipc_port *p_ptr);
-
-int tipc_portimportance(u32 portref, unsigned int *importance);
-int tipc_set_portimportance(u32 portref, unsigned int importance);
-
-int tipc_portunreliable(u32 portref, unsigned int *isunreliable);
-int tipc_set_portunreliable(u32 portref, unsigned int isunreliable);
-
-int tipc_portunreturnable(u32 portref, unsigned int *isunreturnable);
-int tipc_set_portunreturnable(u32 portref, unsigned int isunreturnable);
+void tipc_port_destroy(struct tipc_port *p_ptr);
 
 int tipc_publish(struct tipc_port *p_ptr, unsigned int scope,
                  struct tipc_name_seq const *name_seq);
+
 int tipc_withdraw(struct tipc_port *p_ptr, unsigned int scope,
                   struct tipc_name_seq const *name_seq);
 
-int tipc_connect(u32 portref, struct tipc_portid const *port);
+int tipc_port_connect(u32 portref, struct tipc_portid const *port);
 
-int tipc_disconnect(u32 portref);
+int tipc_port_disconnect(u32 portref);
 
-int tipc_shutdown(u32 ref);
+int tipc_port_shutdown(u32 ref);
 
+void tipc_port_wakeup(struct tipc_port *port);
 
 /*
  * The following routines require that the port be locked on entry
  */
-int __tipc_disconnect(struct tipc_port *tp_ptr);
-int __tipc_connect(u32 ref, struct tipc_port *p_ptr,
+int __tipc_port_disconnect(struct tipc_port *tp_ptr);
+int __tipc_port_connect(u32 ref, struct tipc_port *p_ptr,
                    struct tipc_portid const *peer);
 int tipc_port_peer_msg(struct tipc_port *p_ptr, struct tipc_msg *msg);
 
 /*
  * TIPC messaging routines
  */
-int tipc_port_recv_msg(struct sk_buff *buf);
-int tipc_send(u32 portref, struct iovec const *msg_sect, unsigned int len);
-
-int tipc_send2name(u32 portref, struct tipc_name const *name, u32 domain,
-                   struct iovec const *msg_sect, unsigned int len);
+int tipc_port_rcv(struct sk_buff *buf);
+
+int tipc_send(struct tipc_port *port,
+              struct iovec const *msg_sect,
+              unsigned int len);
+
+int tipc_send2name(struct tipc_port *port,
+                   struct tipc_name const *name,
+                   u32 domain,
+                   struct iovec const *msg_sect,
+                   unsigned int len);
+
+int tipc_send2port(struct tipc_port *port,
+                   struct tipc_portid const *dest,
+                   struct iovec const *msg_sect,
+                   unsigned int len);
+
+int tipc_port_mcast_xmit(struct tipc_port *port,
+                         struct tipc_name_seq const *seq,
+                         struct iovec const *msg,
+                         unsigned int len);
+
+int tipc_port_iovec_reject(struct tipc_port *p_ptr,
+                           struct tipc_msg *hdr,
+                           struct iovec const *msg_sect,
+                           unsigned int len,
+                           int err);
 
-int tipc_send2port(u32 portref, struct tipc_portid const *dest,
-                   struct iovec const *msg_sect, unsigned int len);
-
-int tipc_multicast(u32 portref, struct tipc_name_seq const *seq,
-                   struct iovec const *msg, unsigned int len);
-
-int tipc_port_reject_sections(struct tipc_port *p_ptr, struct tipc_msg *hdr,
-                              struct iovec const *msg_sect, unsigned int len,
-                              int err);
 struct sk_buff *tipc_port_get_ports(void);
-void tipc_port_recv_proto_msg(struct sk_buff *buf);
-void tipc_port_recv_mcast(struct sk_buff *buf, struct tipc_port_list *dp);
+void tipc_port_proto_rcv(struct sk_buff *buf);
+void tipc_port_mcast_rcv(struct sk_buff *buf, struct tipc_port_list *dp);
 void tipc_port_reinit(void);
 
 /**
@@ -188,14 +185,53 @@ static inline void tipc_port_unlock(struct tipc_port *p_ptr)
         spin_unlock_bh(p_ptr->lock);
 }
 
-static inline struct tipc_port *tipc_port_deref(u32 ref)
+static inline int tipc_port_congested(struct tipc_port *p_ptr)
 {
-        return (struct tipc_port *)tipc_ref_deref(ref);
+        return (p_ptr->sent - p_ptr->acked) >= (TIPC_FLOW_CONTROL_WIN * 2);
 }
 
-static inline int tipc_port_congested(struct tipc_port *p_ptr)
+
+static inline u32 tipc_port_peernode(struct tipc_port *p_ptr)
 {
-        return (p_ptr->sent - p_ptr->acked) >= (TIPC_FLOW_CONTROL_WIN * 2);
+        return msg_destnode(&p_ptr->phdr);
+}
+
+static inline u32 tipc_port_peerport(struct tipc_port *p_ptr)
+{
+        return msg_destport(&p_ptr->phdr);
+}
+
+static inline  bool tipc_port_unreliable(struct tipc_port *port)
+{
+        return msg_src_droppable(&port->phdr) != 0;
+}
+
+static inline void tipc_port_set_unreliable(struct tipc_port *port,
+                                            bool unreliable)
+{
+        msg_set_src_droppable(&port->phdr, unreliable ? 1 : 0);
+}
+
+static inline bool tipc_port_unreturnable(struct tipc_port *port)
+{
+        return msg_dest_droppable(&port->phdr) != 0;
+}
+
+static inline void tipc_port_set_unreturnable(struct tipc_port *port,
+                                             bool unreturnable)
+{
+        msg_set_dest_droppable(&port->phdr, unreturnable ? 1 : 0);
+}
+
+
+static inline int tipc_port_importance(struct tipc_port *port)
+{
+        return msg_importance(&port->phdr);
+}
+
+static inline void tipc_port_set_importance(struct tipc_port *port, int imp)
+{
+        msg_set_importance(&port->phdr, (u32)imp);
 }
 
 #endif
diff --git a/net/tipc/ref.c b/net/tipc/ref.c
index de3d593e2fee..3d4ecd754eee 100644
--- a/net/tipc/ref.c
+++ b/net/tipc/ref.c
@@ -89,7 +89,7 @@ struct ref_table {
 
 static struct ref_table tipc_ref_table;
 
-static DEFINE_RWLOCK(ref_table_lock);
+static DEFINE_SPINLOCK(ref_table_lock);
 
 /**
  * tipc_ref_table_init - create reference table for objects
@@ -159,7 +159,7 @@ u32 tipc_ref_acquire(void *object, spinlock_t **lock)
         }
 
         /* take a free entry, if available; otherwise initialize a new entry */
-        write_lock_bh(&ref_table_lock);
+        spin_lock_bh(&ref_table_lock);
         if (tipc_ref_table.first_free) {
                 index = tipc_ref_table.first_free;
                 entry = &(tipc_ref_table.entries[index]);
@@ -175,7 +175,7 @@ u32 tipc_ref_acquire(void *object, spinlock_t **lock)
         } else {
                 ref = 0;
         }
-        write_unlock_bh(&ref_table_lock);
+        spin_unlock_bh(&ref_table_lock);
 
         /*
          * Grab the lock so no one else can modify this entry
@@ -216,7 +216,7 @@ void tipc_ref_discard(u32 ref)
         index = ref & index_mask;
         entry = &(tipc_ref_table.entries[index]);
 
-        write_lock_bh(&ref_table_lock);
+        spin_lock_bh(&ref_table_lock);
 
         if (!entry->object) {
                 pr_err("Attempt to discard ref. to non-existent obj\n");
@@ -242,7 +242,7 @@ void tipc_ref_discard(u32 ref)
         tipc_ref_table.last_free = index;
 
 exit:
-        write_unlock_bh(&ref_table_lock);
+        spin_unlock_bh(&ref_table_lock);
 }
 
 /**
@@ -264,20 +264,3 @@ void *tipc_ref_lock(u32 ref)
         }
         return NULL;
 }
-
-
-/**
- * tipc_ref_deref - return pointer referenced object (without locking it)
- */
-void *tipc_ref_deref(u32 ref)
-{
-        if (likely(tipc_ref_table.entries)) {
-                struct reference *entry;
-
-                entry = &tipc_ref_table.entries[ref &
-                                                tipc_ref_table.index_mask];
-                if (likely(entry->ref == ref))
-                        return entry->object;
-        }
-        return NULL;
-}
diff --git a/net/tipc/ref.h b/net/tipc/ref.h
index 5bc8e7ab84de..d01aa1df63b8 100644
--- a/net/tipc/ref.h
+++ b/net/tipc/ref.h
@@ -44,6 +44,5 @@ u32 tipc_ref_acquire(void *object, spinlock_t **lock);
 void tipc_ref_discard(u32 ref);
 
 void *tipc_ref_lock(u32 ref);
-void *tipc_ref_deref(u32 ref);
 
 #endif
diff --git a/net/tipc/server.c b/net/tipc/server.c
index 646a930eefbf..a538a02f869b 100644
--- a/net/tipc/server.c
+++ b/net/tipc/server.c
@@ -119,7 +119,7 @@ static struct tipc_conn *tipc_conn_lookup(struct tipc_server *s, int conid)
         return con;
 }
 
-static void sock_data_ready(struct sock *sk, int unused)
+static void sock_data_ready(struct sock *sk)
 {
         struct tipc_conn *con;
 
@@ -297,7 +297,7 @@ static int tipc_accept_from_sock(struct tipc_conn *con)
         newcon->usr_data = s->tipc_conn_new(newcon->conid);
 
         /* Wake up receive process in case of 'SYN+' message */
-        newsock->sk->sk_data_ready(newsock->sk, 0);
+        newsock->sk->sk_data_ready(newsock->sk);
         return ret;
 }
 
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 0ed0eaa62f29..3c0256962f7d 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1,7 +1,7 @@
 /*
  * net/tipc/socket.c: TIPC socket API
  *
- * Copyright (c) 2001-2007, 2012 Ericsson AB
+ * Copyright (c) 2001-2007, 2012-2014, Ericsson AB
  * Copyright (c) 2004-2008, 2010-2013, Wind River Systems
  * All rights reserved.
  *
@@ -38,30 +38,17 @@
 #include "port.h"
 
 #include <linux/export.h>
-#include <net/sock.h>
 
 #define SS_LISTENING    -1      /* socket is listening */
 #define SS_READY        -2      /* socket is connectionless */
 
 #define CONN_TIMEOUT_DEFAULT    8000    /* default connect timeout = 8s */
 
-struct tipc_sock {
-        struct sock sk;
-        struct tipc_port *p;
-        struct tipc_portid peer_name;
-        unsigned int conn_timeout;
-};
-
-#define tipc_sk(sk) ((struct tipc_sock *)(sk))
-#define tipc_sk_port(sk) (tipc_sk(sk)->p)
-
 static int backlog_rcv(struct sock *sk, struct sk_buff *skb);
-static u32 dispatch(struct tipc_port *tport, struct sk_buff *buf);
-static void wakeupdispatch(struct tipc_port *tport);
-static void tipc_data_ready(struct sock *sk, int len);
+static void tipc_data_ready(struct sock *sk);
 static void tipc_write_space(struct sock *sk);
-static int release(struct socket *sock);
-static int accept(struct socket *sock, struct socket *new_sock, int flags);
+static int tipc_release(struct socket *sock);
+static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags);
 
 static const struct proto_ops packet_ops;
 static const struct proto_ops stream_ops;
@@ -115,6 +102,8 @@ static struct proto tipc_proto_kern;
  *   - port reference
  */
 
+#include "socket.h"
+
 /**
  * advance_rx_queue - discard first buffer in socket receive queue
  *
@@ -150,13 +139,15 @@ static void reject_rx_queue(struct sock *sk)
  *
  * Returns 0 on success, errno otherwise
  */
-static int tipc_sk_create(struct net *net, struct socket *sock, int protocol,
-                          int kern)
+static int tipc_sk_create(struct net *net, struct socket *sock,
+                          int protocol, int kern)
 {
         const struct proto_ops *ops;
         socket_state state;
         struct sock *sk;
-        struct tipc_port *tp_ptr;
+        struct tipc_sock *tsk;
+        struct tipc_port *port;
+        u32 ref;
 
         /* Validate arguments */
         if (unlikely(protocol != 0))
@@ -189,10 +180,12 @@ static int tipc_sk_create(struct net *net, struct socket *sock, int protocol,
         if (sk == NULL)
                 return -ENOMEM;
 
-        /* Allocate TIPC port for socket to use */
-        tp_ptr = tipc_createport(sk, &dispatch, &wakeupdispatch,
-                                 TIPC_LOW_IMPORTANCE);
-        if (unlikely(!tp_ptr)) {
+        tsk = tipc_sk(sk);
+        port = &tsk->port;
+
+        ref = tipc_port_init(port, TIPC_LOW_IMPORTANCE);
+        if (!ref) {
+                pr_warn("Socket registration failed, ref. table exhausted\n");
                 sk_free(sk);
                 return -ENOMEM;
         }
@@ -206,17 +199,14 @@ static int tipc_sk_create(struct net *net, struct socket *sock, int protocol,
         sk->sk_rcvbuf = sysctl_tipc_rmem[1];
         sk->sk_data_ready = tipc_data_ready;
         sk->sk_write_space = tipc_write_space;
-        tipc_sk(sk)->p = tp_ptr;
         tipc_sk(sk)->conn_timeout = CONN_TIMEOUT_DEFAULT;
-
-        spin_unlock_bh(tp_ptr->lock);
+        tipc_port_unlock(port);
 
         if (sock->state == SS_READY) {
-                tipc_set_portunreturnable(tp_ptr->ref, 1);
+                tipc_port_set_unreturnable(port, true);
                 if (sock->type == SOCK_DGRAM)
-                        tipc_set_portunreliable(tp_ptr->ref, 1);
+                        tipc_port_set_unreliable(port, true);
         }
-
         return 0;
 }
 
@@ -254,7 +244,7 @@ int tipc_sock_create_local(int type, struct socket **res)
  */
 void tipc_sock_release_local(struct socket *sock)
 {
-        release(sock);
+        tipc_release(sock);
         sock->ops = NULL;
         sock_release(sock);
 }
@@ -280,7 +270,7 @@ int tipc_sock_accept_local(struct socket *sock, struct socket **newsock,
         if (ret < 0)
                 return ret;
 
-        ret = accept(sock, *newsock, flags);
+        ret = tipc_accept(sock, *newsock, flags);
         if (ret < 0) {
                 sock_release(*newsock);
                 return ret;
@@ -290,7 +280,7 @@ int tipc_sock_accept_local(struct socket *sock, struct socket **newsock,
 }
 
 /**
- * release - destroy a TIPC socket
+ * tipc_release - destroy a TIPC socket
  * @sock: socket to destroy
  *
  * This routine cleans up any messages that are still queued on the socket.
@@ -305,12 +295,12 @@ int tipc_sock_accept_local(struct socket *sock, struct socket **newsock,
  *
  * Returns 0 on success, errno otherwise
  */
-static int release(struct socket *sock)
+static int tipc_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
-        struct tipc_port *tport;
+        struct tipc_sock *tsk;
+        struct tipc_port *port;
         struct sk_buff *buf;
-        int res;
 
         /*
          * Exit if socket isn't fully initialized (occurs when a failed accept()
@@ -319,7 +309,8 @@ static int release(struct socket *sock)
         if (sk == NULL)
                 return 0;
 
-        tport = tipc_sk_port(sk);
+        tsk = tipc_sk(sk);
+        port = &tsk->port;
         lock_sock(sk);
 
         /*
@@ -336,17 +327,16 @@ static int release(struct socket *sock)
                         if ((sock->state == SS_CONNECTING) ||
                             (sock->state == SS_CONNECTED)) {
                                 sock->state = SS_DISCONNECTING;
-                                tipc_disconnect(tport->ref);
+                                tipc_port_disconnect(port->ref);
                         }
                         tipc_reject_msg(buf, TIPC_ERR_NO_PORT);
                 }
         }
 
-        /*
-         * Delete TIPC port; this ensures no more messages are queued
-         * (also disconnects an active connection & sends a 'FIN-' to peer)
+        /* Destroy TIPC port; also disconnects an active connection and
+         * sends a 'FIN-' to peer.
          */
-        res = tipc_deleteport(tport);
+        tipc_port_destroy(port);
 
         /* Discard any remaining (connection-based) messages in receive queue */
         __skb_queue_purge(&sk->sk_receive_queue);
@@ -358,11 +348,11 @@ static int release(struct socket *sock)
         sock_put(sk);
         sock->sk = NULL;
 
-        return res;
+        return 0;
 }
 
 /**
- * bind - associate or disassocate TIPC name(s) with a socket
+ * tipc_bind - associate or disassocate TIPC name(s) with a socket
  * @sock: socket structure
  * @uaddr: socket address describing name(s) and desired operation
  * @uaddr_len: size of socket address data structure
@@ -376,16 +366,17 @@ static int release(struct socket *sock)
  * NOTE: This routine doesn't need to take the socket lock since it doesn't
  *       access any non-constant socket information.
  */
-static int bind(struct socket *sock, struct sockaddr *uaddr, int uaddr_len)
+static int tipc_bind(struct socket *sock, struct sockaddr *uaddr,
+                     int uaddr_len)
 {
         struct sock *sk = sock->sk;
         struct sockaddr_tipc *addr = (struct sockaddr_tipc *)uaddr;
-        struct tipc_port *tport = tipc_sk_port(sock->sk);
+        struct tipc_sock *tsk = tipc_sk(sk);
         int res = -EINVAL;
 
         lock_sock(sk);
         if (unlikely(!uaddr_len)) {
-                res = tipc_withdraw(tport, 0, NULL);
+                res = tipc_withdraw(&tsk->port, 0, NULL);
                 goto exit;
         }
 
@@ -413,15 +404,15 @@ static int bind(struct socket *sock, struct sockaddr *uaddr, int uaddr_len)
         }
 
         res = (addr->scope > 0) ?
-                tipc_publish(tport, addr->scope, &addr->addr.nameseq) :
-                tipc_withdraw(tport, -addr->scope, &addr->addr.nameseq);
+                tipc_publish(&tsk->port, addr->scope, &addr->addr.nameseq) :
+                tipc_withdraw(&tsk->port, -addr->scope, &addr->addr.nameseq);
 exit:
         release_sock(sk);
         return res;
 }
 
 /**
- * get_name - get port ID of socket or peer socket
+ * tipc_getname - get port ID of socket or peer socket
  * @sock: socket structure
  * @uaddr: area for returned socket address
  * @uaddr_len: area for returned length of socket address
@@ -433,21 +424,21 @@ exit:
  *       accesses socket information that is unchanging (or which changes in
  *       a completely predictable manner).
  */
-static int get_name(struct socket *sock, struct sockaddr *uaddr,
-                    int *uaddr_len, int peer)
+static int tipc_getname(struct socket *sock, struct sockaddr *uaddr,
+                        int *uaddr_len, int peer)
 {
         struct sockaddr_tipc *addr = (struct sockaddr_tipc *)uaddr;
-        struct tipc_sock *tsock = tipc_sk(sock->sk);
+        struct tipc_sock *tsk = tipc_sk(sock->sk);
 
         memset(addr, 0, sizeof(*addr));
         if (peer) {
                 if ((sock->state != SS_CONNECTED) &&
                         ((peer != 2) || (sock->state != SS_DISCONNECTING)))
                         return -ENOTCONN;
-                addr->addr.id.ref = tsock->peer_name.ref;
-                addr->addr.id.node = tsock->peer_name.node;
+                addr->addr.id.ref = tipc_port_peerport(&tsk->port);
+                addr->addr.id.node = tipc_port_peernode(&tsk->port);
         } else {
-                addr->addr.id.ref = tsock->p->ref;
+                addr->addr.id.ref = tsk->port.ref;
                 addr->addr.id.node = tipc_own_addr;
         }
 
@@ -461,7 +452,7 @@ static int get_name(struct socket *sock, struct sockaddr *uaddr,
 }
 
 /**
- * poll - read and possibly block on pollmask
+ * tipc_poll - read and possibly block on pollmask
  * @file: file structure associated with the socket
  * @sock: socket for which to calculate the poll bits
  * @wait: ???
@@ -500,22 +491,23 @@ static int get_name(struct socket *sock, struct sockaddr *uaddr,
  * imply that the operation will succeed, merely that it should be performed
  * and will not block.
  */
-static unsigned int poll(struct file *file, struct socket *sock,
-                         poll_table *wait)
+static unsigned int tipc_poll(struct file *file, struct socket *sock,
+                              poll_table *wait)
 {
         struct sock *sk = sock->sk;
+        struct tipc_sock *tsk = tipc_sk(sk);
         u32 mask = 0;
 
         sock_poll_wait(file, sk_sleep(sk), wait);
 
         switch ((int)sock->state) {
         case SS_UNCONNECTED:
-                if (!tipc_sk_port(sk)->congested)
+                if (!tsk->port.congested)
                         mask |= POLLOUT;
                 break;
         case SS_READY:
         case SS_CONNECTED:
-                if (!tipc_sk_port(sk)->congested)
+                if (!tsk->port.congested)
                         mask |= POLLOUT;
                 /* fall thru' */
         case SS_CONNECTING:
@@ -565,7 +557,7 @@ static int dest_name_check(struct sockaddr_tipc *dest, struct msghdr *m)
 static int tipc_wait_for_sndmsg(struct socket *sock, long *timeo_p)
 {
         struct sock *sk = sock->sk;
-        struct tipc_port *tport = tipc_sk_port(sk);
+        struct tipc_sock *tsk = tipc_sk(sk);
         DEFINE_WAIT(wait);
         int done;
 
@@ -581,14 +573,15 @@ static int tipc_wait_for_sndmsg(struct socket *sock, long *timeo_p)
                         return sock_intr_errno(*timeo_p);
 
                 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
-                done = sk_wait_event(sk, timeo_p, !tport->congested);
+                done = sk_wait_event(sk, timeo_p, !tsk->port.congested);
                 finish_wait(sk_sleep(sk), &wait);
         } while (!done);
         return 0;
 }
 
+
 /**
- * send_msg - send message in connectionless manner
+ * tipc_sendmsg - send message in connectionless manner
  * @iocb: if NULL, indicates that socket lock is already held
  * @sock: socket structure
  * @m: message to send
@@ -601,11 +594,12 @@ static int tipc_wait_for_sndmsg(struct socket *sock, long *timeo_p)
  *
  * Returns the number of bytes sent on success, or errno otherwise
  */
-static int send_msg(struct kiocb *iocb, struct socket *sock,
-                    struct msghdr *m, size_t total_len)
+static int tipc_sendmsg(struct kiocb *iocb, struct socket *sock,
+                        struct msghdr *m, size_t total_len)
 {
         struct sock *sk = sock->sk;
-        struct tipc_port *tport = tipc_sk_port(sk);
+        struct tipc_sock *tsk = tipc_sk(sk);
+        struct tipc_port *port = &tsk->port;
         DECLARE_SOCKADDR(struct sockaddr_tipc *, dest, m->msg_name);
         int needs_conn;
         long timeo;
@@ -632,13 +626,13 @@ static int send_msg(struct kiocb *iocb, struct socket *sock,
                         res = -EISCONN;
                         goto exit;
                 }
-                if (tport->published) {
+                if (tsk->port.published) {
                         res = -EOPNOTSUPP;
                         goto exit;
                 }
                 if (dest->addrtype == TIPC_ADDR_NAME) {
-                        tport->conn_type = dest->addr.name.name.type;
-                        tport->conn_instance = dest->addr.name.name.instance;
+                        tsk->port.conn_type = dest->addr.name.name.type;
+                        tsk->port.conn_instance = dest->addr.name.name.instance;
                 }
 
                 /* Abort any pending connection attempts (very unlikely) */
@@ -651,13 +645,13 @@ static int send_msg(struct kiocb *iocb, struct socket *sock,
                         res = dest_name_check(dest, m);
                         if (res)
                                 break;
-                        res = tipc_send2name(tport->ref,
+                        res = tipc_send2name(port,
                                              &dest->addr.name.name,
                                              dest->addr.name.domain,
                                              m->msg_iov,
                                              total_len);
                 } else if (dest->addrtype == TIPC_ADDR_ID) {
-                        res = tipc_send2port(tport->ref,
+                        res = tipc_send2port(port,
                                              &dest->addr.id,
                                              m->msg_iov,
                                              total_len);
@@ -669,10 +663,10 @@ static int send_msg(struct kiocb *iocb, struct socket *sock,
                         res = dest_name_check(dest, m);
                         if (res)
                                 break;
-                        res = tipc_multicast(tport->ref,
-                                             &dest->addr.nameseq,
-                                             m->msg_iov,
-                                             total_len);
+                        res = tipc_port_mcast_xmit(port,
+                                                   &dest->addr.nameseq,
+                                                   m->msg_iov,
+                                                   total_len);
                 }
                 if (likely(res != -ELINKCONG)) {
                         if (needs_conn && (res >= 0))
@@ -693,7 +687,8 @@ exit:
 static int tipc_wait_for_sndpkt(struct socket *sock, long *timeo_p)
 {
         struct sock *sk = sock->sk;
-        struct tipc_port *tport = tipc_sk_port(sk);
+        struct tipc_sock *tsk = tipc_sk(sk);
+        struct tipc_port *port = &tsk->port;
         DEFINE_WAIT(wait);
         int done;
 
@@ -712,14 +707,14 @@ static int tipc_wait_for_sndpkt(struct socket *sock, long *timeo_p)
 
                 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                 done = sk_wait_event(sk, timeo_p,
-                                     (!tport->congested || !tport->connected));
+                                     (!port->congested || !port->connected));
                 finish_wait(sk_sleep(sk), &wait);
         } while (!done);
         return 0;
 }
 
 /**
- * send_packet - send a connection-oriented message
+ * tipc_send_packet - send a connection-oriented message
  * @iocb: if NULL, indicates that socket lock is already held
  * @sock: socket structure
  * @m: message to send
@@ -729,18 +724,18 @@ static int tipc_wait_for_sndpkt(struct socket *sock, long *timeo_p)
  *
  * Returns the number of bytes sent on success, or errno otherwise
  */
-static int send_packet(struct kiocb *iocb, struct socket *sock,
-                       struct msghdr *m, size_t total_len)
+static int tipc_send_packet(struct kiocb *iocb, struct socket *sock,
+                            struct msghdr *m, size_t total_len)
 {
         struct sock *sk = sock->sk;
-        struct tipc_port *tport = tipc_sk_port(sk);
+        struct tipc_sock *tsk = tipc_sk(sk);
         DECLARE_SOCKADDR(struct sockaddr_tipc *, dest, m->msg_name);
         int res = -EINVAL;
         long timeo;
 
         /* Handle implied connection establishment */
         if (unlikely(dest))
-                return send_msg(iocb, sock, m, total_len);
+                return tipc_sendmsg(iocb, sock, m, total_len);
 
         if (total_len > TIPC_MAX_USER_MSG_SIZE)
                 return -EMSGSIZE;
@@ -758,7 +753,7 @@ static int send_packet(struct kiocb *iocb, struct socket *sock,
 
         timeo = sock_sndtimeo(sk, m->msg_flags & MSG_DONTWAIT);
         do {
-                res = tipc_send(tport->ref, m->msg_iov, total_len);
+                res = tipc_send(&tsk->port, m->msg_iov, total_len);
                 if (likely(res != -ELINKCONG))
                         break;
                 res = tipc_wait_for_sndpkt(sock, &timeo);
@@ -772,7 +767,7 @@ exit:
 }
 
 /**
- * send_stream - send stream-oriented data
+ * tipc_send_stream - send stream-oriented data
  * @iocb: (unused)
  * @sock: socket structure
  * @m: data to send
@@ -783,11 +778,11 @@ exit:
  * Returns the number of bytes sent on success (or partial success),
  * or errno if no data sent
  */
-static int send_stream(struct kiocb *iocb, struct socket *sock,
-                       struct msghdr *m, size_t total_len)
+static int tipc_send_stream(struct kiocb *iocb, struct socket *sock,
+                            struct msghdr *m, size_t total_len)
 {
         struct sock *sk = sock->sk;
-        struct tipc_port *tport = tipc_sk_port(sk);
+        struct tipc_sock *tsk = tipc_sk(sk);
         struct msghdr my_msg;
         struct iovec my_iov;
         struct iovec *curr_iov;
@@ -804,7 +799,7 @@ static int send_stream(struct kiocb *iocb, struct socket *sock,
         /* Handle special cases where there is no connection */
         if (unlikely(sock->state != SS_CONNECTED)) {
                 if (sock->state == SS_UNCONNECTED)
-                        res = send_packet(NULL, sock, m, total_len);
+                        res = tipc_send_packet(NULL, sock, m, total_len);
                 else
                         res = sock->state == SS_DISCONNECTING ? -EPIPE : -ENOTCONN;
                 goto exit;
@@ -835,21 +830,22 @@ static int send_stream(struct kiocb *iocb, struct socket *sock,
         my_msg.msg_name = NULL;
         bytes_sent = 0;
 
-        hdr_size = msg_hdr_sz(&tport->phdr);
+        hdr_size = msg_hdr_sz(&tsk->port.phdr);
 
         while (curr_iovlen--) {
                 curr_start = curr_iov->iov_base;
                 curr_left = curr_iov->iov_len;
 
                 while (curr_left) {
-                        bytes_to_send = tport->max_pkt - hdr_size;
+                        bytes_to_send = tsk->port.max_pkt - hdr_size;
                         if (bytes_to_send > TIPC_MAX_USER_MSG_SIZE)
                                 bytes_to_send = TIPC_MAX_USER_MSG_SIZE;
                         if (curr_left < bytes_to_send)
                                 bytes_to_send = curr_left;
                         my_iov.iov_base = curr_start;
                         my_iov.iov_len = bytes_to_send;
-                        res = send_packet(NULL, sock, &my_msg, bytes_to_send);
+                        res = tipc_send_packet(NULL, sock, &my_msg,
+                                               bytes_to_send);
                         if (res < 0) {
                                 if (bytes_sent)
                                         res = bytes_sent;
@@ -870,27 +866,25 @@ exit:
 
 /**
  * auto_connect - complete connection setup to a remote port
- * @sock: socket structure
+ * @tsk: tipc socket structure
  * @msg: peer's response message
  *
  * Returns 0 on success, errno otherwise
  */
-static int auto_connect(struct socket *sock, struct tipc_msg *msg)
+static int auto_connect(struct tipc_sock *tsk, struct tipc_msg *msg)
 {
-        struct tipc_sock *tsock = tipc_sk(sock->sk);
-        struct tipc_port *p_ptr;
+        struct tipc_port *port = &tsk->port;
+        struct socket *sock = tsk->sk.sk_socket;
+        struct tipc_portid peer;
 
-        tsock->peer_name.ref = msg_origport(msg);
-        tsock->peer_name.node = msg_orignode(msg);
-        p_ptr = tipc_port_deref(tsock->p->ref);
-        if (!p_ptr)
-                return -EINVAL;
+        peer.ref = msg_origport(msg);
+        peer.node = msg_orignode(msg);
 
-        __tipc_connect(tsock->p->ref, p_ptr, &tsock->peer_name);
+        __tipc_port_connect(port->ref, port, &peer);
 
         if (msg_importance(msg) > TIPC_CRITICAL_IMPORTANCE)
                 return -EINVAL;
-        msg_set_importance(&p_ptr->phdr, (u32)msg_importance(msg));
+        msg_set_importance(&port->phdr, (u32)msg_importance(msg));
         sock->state = SS_CONNECTED;
         return 0;
 }
@@ -1021,7 +1015,7 @@ static int tipc_wait_for_rcvmsg(struct socket *sock, long timeo)
 }
 
 /**
- * recv_msg - receive packet-oriented message
+ * tipc_recvmsg - receive packet-oriented message
  * @iocb: (unused)
  * @m: descriptor for message info
  * @buf_len: total size of user buffer area
@@ -1032,11 +1026,12 @@ static int tipc_wait_for_rcvmsg(struct socket *sock, long timeo)
  *
  * Returns size of returned message data, errno otherwise
  */
-static int recv_msg(struct kiocb *iocb, struct socket *sock,
-                    struct msghdr *m, size_t buf_len, int flags)
+static int tipc_recvmsg(struct kiocb *iocb, struct socket *sock,
+                        struct msghdr *m, size_t buf_len, int flags)
 {
         struct sock *sk = sock->sk;
-        struct tipc_port *tport = tipc_sk_port(sk);
+        struct tipc_sock *tsk = tipc_sk(sk);
+        struct tipc_port *port = &tsk->port;
         struct sk_buff *buf;
         struct tipc_msg *msg;
         long timeo;
@@ -1079,7 +1074,7 @@ restart:
         set_orig_addr(m, msg);
 
         /* Capture ancillary data (optional) */
-        res = anc_data_recv(m, msg, tport);
+        res = anc_data_recv(m, msg, port);
         if (res)
                 goto exit;
 
@@ -1105,8 +1100,8 @@ restart:
         /* Consume received message (optional) */
         if (likely(!(flags & MSG_PEEK))) {
                 if ((sock->state != SS_READY) &&
-                    (++tport->conn_unacked >= TIPC_FLOW_CONTROL_WIN))
-                        tipc_acknowledge(tport->ref, tport->conn_unacked);
+                    (++port->conn_unacked >= TIPC_FLOW_CONTROL_WIN))
+                        tipc_acknowledge(port->ref, port->conn_unacked);
                 advance_rx_queue(sk);
         }
 exit:
@@ -1115,7 +1110,7 @@ exit:
 }
 
 /**
- * recv_stream - receive stream-oriented data
+ * tipc_recv_stream - receive stream-oriented data
  * @iocb: (unused)
  * @m: descriptor for message info
  * @buf_len: total size of user buffer area
@@ -1126,11 +1121,12 @@ exit:
  *
  * Returns size of returned message data, errno otherwise
  */
-static int recv_stream(struct kiocb *iocb, struct socket *sock,
-                       struct msghdr *m, size_t buf_len, int flags)
+static int tipc_recv_stream(struct kiocb *iocb, struct socket *sock,
+                            struct msghdr *m, size_t buf_len, int flags)
 {
         struct sock *sk = sock->sk;
-        struct tipc_port *tport = tipc_sk_port(sk);
+        struct tipc_sock *tsk = tipc_sk(sk);
+        struct tipc_port *port = &tsk->port;
         struct sk_buff *buf;
         struct tipc_msg *msg;
         long timeo;
@@ -1175,7 +1171,7 @@ restart:
         /* Optionally capture sender's address & ancillary data of first msg */
         if (sz_copied == 0) {
                 set_orig_addr(m, msg);
-                res = anc_data_recv(m, msg, tport);
+                res = anc_data_recv(m, msg, port);
                 if (res)
                         goto exit;
         }
@@ -1213,8 +1209,8 @@ restart:
 
         /* Consume received message (optional) */
         if (likely(!(flags & MSG_PEEK))) {
-                if (unlikely(++tport->conn_unacked >= TIPC_FLOW_CONTROL_WIN))
-                        tipc_acknowledge(tport->ref, tport->conn_unacked);
+                if (unlikely(++port->conn_unacked >= TIPC_FLOW_CONTROL_WIN))
+                        tipc_acknowledge(port->ref, port->conn_unacked);
                 advance_rx_queue(sk);
         }
 
@@ -1252,7 +1248,7 @@ static void tipc_write_space(struct sock *sk)
  * @sk: socket
  * @len: the length of messages
  */
-static void tipc_data_ready(struct sock *sk, int len)
+static void tipc_data_ready(struct sock *sk)
 {
         struct socket_wq *wq;
 
@@ -1266,17 +1262,19 @@ static void tipc_data_ready(struct sock *sk, int len)
 
 /**
  * filter_connect - Handle all incoming messages for a connection-based socket
- * @tsock: TIPC socket
+ * @tsk: TIPC socket
  * @msg: message
  *
  * Returns TIPC error status code and socket error status code
  * once it encounters some errors
  */
-static u32 filter_connect(struct tipc_sock *tsock, struct sk_buff **buf)
+static u32 filter_connect(struct tipc_sock *tsk, struct sk_buff **buf)
 {
-        struct socket *sock = tsock->sk.sk_socket;
+        struct sock *sk = &tsk->sk;
+        struct tipc_port *port = &tsk->port;
+        struct socket *sock = sk->sk_socket;
         struct tipc_msg *msg = buf_msg(*buf);
-        struct sock *sk = &tsock->sk;
+
         u32 retval = TIPC_ERR_NO_PORT;
         int res;
 
@@ -1286,10 +1284,10 @@ static u32 filter_connect(struct tipc_sock *tsock, struct sk_buff **buf)
         switch ((int)sock->state) {
         case SS_CONNECTED:
                 /* Accept only connection-based messages sent by peer */
-                if (msg_connected(msg) && tipc_port_peer_msg(tsock->p, msg)) {
+                if (msg_connected(msg) && tipc_port_peer_msg(port, msg)) {
                         if (unlikely(msg_errcode(msg))) {
                                 sock->state = SS_DISCONNECTING;
-                                __tipc_disconnect(tsock->p);
+                                __tipc_port_disconnect(port);
                         }
                         retval = TIPC_OK;
                 }
@@ -1306,7 +1304,7 @@ static u32 filter_connect(struct tipc_sock *tsock, struct sk_buff **buf)
                 if (unlikely(!msg_connected(msg)))
                         break;
 
-                res = auto_connect(sock, msg);
+                res = auto_connect(tsk, msg);
                 if (res) {
                         sock->state = SS_DISCONNECTING;
                         sk->sk_err = -res;
@@ -1385,6 +1383,7 @@ static unsigned int rcvbuf_limit(struct sock *sk, struct sk_buff *buf)
 static u32 filter_rcv(struct sock *sk, struct sk_buff *buf)
 {
         struct socket *sock = sk->sk_socket;
+        struct tipc_sock *tsk = tipc_sk(sk);
         struct tipc_msg *msg = buf_msg(buf);
         unsigned int limit = rcvbuf_limit(sk, buf);
         u32 res = TIPC_OK;
@@ -1397,7 +1396,7 @@ static u32 filter_rcv(struct sock *sk, struct sk_buff *buf)
                 if (msg_connected(msg))
                         return TIPC_ERR_NO_PORT;
         } else {
-                res = filter_connect(tipc_sk(sk), &buf);
+                res = filter_connect(tsk, &buf);
                 if (res != TIPC_OK || buf == NULL)
                         return res;
         }
@@ -1411,7 +1410,7 @@ static u32 filter_rcv(struct sock *sk, struct sk_buff *buf)
         __skb_queue_tail(&sk->sk_receive_queue, buf);
         skb_set_owner_r(buf, sk);
 
-        sk->sk_data_ready(sk, 0);
+        sk->sk_data_ready(sk);
         return TIPC_OK;
 }
 
@@ -1435,17 +1434,16 @@ static int backlog_rcv(struct sock *sk, struct sk_buff *buf)
 }
 
 /**
- * dispatch - handle incoming message
- * @tport: TIPC port that received message
+ * tipc_sk_rcv - handle incoming message
+ * @sk:  socket receiving message
  * @buf: message
  *
  * Called with port lock already taken.
  *
  * Returns TIPC error status code (TIPC_OK if message is not to be rejected)
  */
-static u32 dispatch(struct tipc_port *tport, struct sk_buff *buf)
+u32 tipc_sk_rcv(struct sock *sk, struct sk_buff *buf)
 {
-        struct sock *sk = tport->sk;
         u32 res;
 
         /*
@@ -1468,19 +1466,6 @@ static u32 dispatch(struct tipc_port *tport, struct sk_buff *buf)
         return res;
 }
 
-/**
- * wakeupdispatch - wake up port after congestion
- * @tport: port to wakeup
- *
- * Called with port lock already taken.
- */
-static void wakeupdispatch(struct tipc_port *tport)
-{
-        struct sock *sk = tport->sk;
-
-        sk->sk_write_space(sk);
-}
-
 static int tipc_wait_for_connect(struct socket *sock, long *timeo_p)
 {
         struct sock *sk = sock->sk;
@@ -1504,7 +1489,7 @@ static int tipc_wait_for_connect(struct socket *sock, long *timeo_p)
 }
 
 /**
- * connect - establish a connection to another TIPC port
+ * tipc_connect - establish a connection to another TIPC port
  * @sock: socket structure
  * @dest: socket address for destination port
  * @destlen: size of socket address data structure
@@ -1512,8 +1497,8 @@ static int tipc_wait_for_connect(struct socket *sock, long *timeo_p)
  *
  * Returns 0 on success, errno otherwise
  */
-static int connect(struct socket *sock, struct sockaddr *dest, int destlen,
-                   int flags)
+static int tipc_connect(struct socket *sock, struct sockaddr *dest,
+                        int destlen, int flags)
 {
         struct sock *sk = sock->sk;
         struct sockaddr_tipc *dst = (struct sockaddr_tipc *)dest;
@@ -1554,7 +1539,7 @@ static int connect(struct socket *sock, struct sockaddr *dest, int destlen,
                 if (!timeout)
                         m.msg_flags = MSG_DONTWAIT;
 
-                res = send_msg(NULL, sock, &m, 0);
+                res = tipc_sendmsg(NULL, sock, &m, 0);
                 if ((res < 0) && (res != -EWOULDBLOCK))
                         goto exit;
 
@@ -1585,13 +1570,13 @@ exit:
 }
 
 /**
- * listen - allow socket to listen for incoming connections
+ * tipc_listen - allow socket to listen for incoming connections
  * @sock: socket structure
  * @len: (unused)
  *
  * Returns 0 on success, errno otherwise
  */
-static int listen(struct socket *sock, int len)
+static int tipc_listen(struct socket *sock, int len)
 {
         struct sock *sk = sock->sk;
         int res;
@@ -1646,20 +1631,20 @@ static int tipc_wait_for_accept(struct socket *sock, long timeo)
 }
 
 /**
- * accept - wait for connection request
+ * tipc_accept - wait for connection request
  * @sock: listening socket
  * @newsock: new socket that is to be connected
  * @flags: file-related flags associated with socket
  *
  * Returns 0 on success, errno otherwise
  */
-static int accept(struct socket *sock, struct socket *new_sock, int flags)
+static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags)
 {
         struct sock *new_sk, *sk = sock->sk;
         struct sk_buff *buf;
-        struct tipc_sock *new_tsock;
-        struct tipc_port *new_tport;
+        struct tipc_port *new_port;
         struct tipc_msg *msg;
+        struct tipc_portid peer;
         u32 new_ref;
         long timeo;
         int res;
@@ -1670,7 +1655,6 @@ static int accept(struct socket *sock, struct socket *new_sock, int flags)
                 res = -EINVAL;
                 goto exit;
         }
-
         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
         res = tipc_wait_for_accept(sock, timeo);
         if (res)
@@ -1683,9 +1667,8 @@ static int accept(struct socket *sock, struct socket *new_sock, int flags)
                 goto exit;
 
         new_sk = new_sock->sk;
-        new_tsock = tipc_sk(new_sk);
-        new_tport = new_tsock->p;
-        new_ref = new_tport->ref;
+        new_port = &tipc_sk(new_sk)->port;
+        new_ref = new_port->ref;
         msg = buf_msg(buf);
 
         /* we lock on new_sk; but lockdep sees the lock on sk */
@@ -1698,15 +1681,15 @@ static int accept(struct socket *sock, struct socket *new_sock, int flags)
         reject_rx_queue(new_sk);
 
         /* Connect new socket to it's peer */
-        new_tsock->peer_name.ref = msg_origport(msg);
-        new_tsock->peer_name.node = msg_orignode(msg);
-        tipc_connect(new_ref, &new_tsock->peer_name);
+        peer.ref = msg_origport(msg);
+        peer.node = msg_orignode(msg);
+        tipc_port_connect(new_ref, &peer);
         new_sock->state = SS_CONNECTED;
 
-        tipc_set_portimportance(new_ref, msg_importance(msg));
+        tipc_port_set_importance(new_port, msg_importance(msg));
         if (msg_named(msg)) {
-                new_tport->conn_type = msg_nametype(msg);
-                new_tport->conn_instance = msg_nameinst(msg);
+                new_port->conn_type = msg_nametype(msg);
+                new_port->conn_instance = msg_nameinst(msg);
         }
 
         /*
@@ -1717,21 +1700,20 @@ static int accept(struct socket *sock, struct socket *new_sock, int flags)
                 struct msghdr m = {NULL,};
 
                 advance_rx_queue(sk);
-                send_packet(NULL, new_sock, &m, 0);
+                tipc_send_packet(NULL, new_sock, &m, 0);
         } else {
                 __skb_dequeue(&sk->sk_receive_queue);
                 __skb_queue_head(&new_sk->sk_receive_queue, buf);
                 skb_set_owner_r(buf, new_sk);
         }
         release_sock(new_sk);
-
 exit:
         release_sock(sk);
         return res;
 }
 
 /**
- * shutdown - shutdown socket connection
+ * tipc_shutdown - shutdown socket connection
  * @sock: socket structure
  * @how: direction to close (must be SHUT_RDWR)
  *
@@ -1739,10 +1721,11 @@ exit:
  *
  * Returns 0 on success, errno otherwise
  */
-static int shutdown(struct socket *sock, int how)
+static int tipc_shutdown(struct socket *sock, int how)
 {
         struct sock *sk = sock->sk;
-        struct tipc_port *tport = tipc_sk_port(sk);
+        struct tipc_sock *tsk = tipc_sk(sk);
+        struct tipc_port *port = &tsk->port;
         struct sk_buff *buf;
         int res;
 
@@ -1763,10 +1746,10 @@ restart:
                                 kfree_skb(buf);
                                 goto restart;
                         }
-                        tipc_disconnect(tport->ref);
+                        tipc_port_disconnect(port->ref);
                         tipc_reject_msg(buf, TIPC_CONN_SHUTDOWN);
                 } else {
-                        tipc_shutdown(tport->ref);
+                        tipc_port_shutdown(port->ref);
                 }
 
                 sock->state = SS_DISCONNECTING;
@@ -1792,7 +1775,7 @@ restart:
 }
 
 /**
- * setsockopt - set socket option
+ * tipc_setsockopt - set socket option
  * @sock: socket structure
  * @lvl: option level
  * @opt: option identifier
@@ -1804,11 +1787,12 @@ restart:
  *
  * Returns 0 on success, errno otherwise
  */
-static int setsockopt(struct socket *sock, int lvl, int opt, char __user *ov,
-                      unsigned int ol)
+static int tipc_setsockopt(struct socket *sock, int lvl, int opt,
+                           char __user *ov, unsigned int ol)
 {
         struct sock *sk = sock->sk;
-        struct tipc_port *tport = tipc_sk_port(sk);
+        struct tipc_sock *tsk = tipc_sk(sk);
+        struct tipc_port *port = &tsk->port;
         u32 value;
         int res;
 
@@ -1826,16 +1810,16 @@ static int setsockopt(struct socket *sock, int lvl, int opt, char __user *ov,
 
         switch (opt) {
         case TIPC_IMPORTANCE:
-                res = tipc_set_portimportance(tport->ref, value);
+                tipc_port_set_importance(port, value);
                 break;
         case TIPC_SRC_DROPPABLE:
                 if (sock->type != SOCK_STREAM)
-                        res = tipc_set_portunreliable(tport->ref, value);
+                        tipc_port_set_unreliable(port, value);
                 else
                         res = -ENOPROTOOPT;
                 break;
         case TIPC_DEST_DROPPABLE:
-                res = tipc_set_portunreturnable(tport->ref, value);
+                tipc_port_set_unreturnable(port, value);
                 break;
         case TIPC_CONN_TIMEOUT:
                 tipc_sk(sk)->conn_timeout = value;
@@ -1851,7 +1835,7 @@ static int setsockopt(struct socket *sock, int lvl, int opt, char __user *ov,
 }
 
 /**
- * getsockopt - get socket option
+ * tipc_getsockopt - get socket option
  * @sock: socket structure
  * @lvl: option level
  * @opt: option identifier
@@ -1863,11 +1847,12 @@ static int setsockopt(struct socket *sock, int lvl, int opt, char __user *ov,
  *
  * Returns 0 on success, errno otherwise
  */
-static int getsockopt(struct socket *sock, int lvl, int opt, char __user *ov,
-                      int __user *ol)
+static int tipc_getsockopt(struct socket *sock, int lvl, int opt,
+                           char __user *ov, int __user *ol)
 {
         struct sock *sk = sock->sk;
-        struct tipc_port *tport = tipc_sk_port(sk);
+        struct tipc_sock *tsk = tipc_sk(sk);
+        struct tipc_port *port = &tsk->port;
         int len;
         u32 value;
         int res;
@@ -1884,13 +1869,13 @@ static int getsockopt(struct socket *sock, int lvl, int opt, char __user *ov,
 
         switch (opt) {
         case TIPC_IMPORTANCE:
-                res = tipc_portimportance(tport->ref, &value);
+                value = tipc_port_importance(port);
                 break;
         case TIPC_SRC_DROPPABLE:
-                res = tipc_portunreliable(tport->ref, &value);
+                value = tipc_port_unreliable(port);
                 break;
         case TIPC_DEST_DROPPABLE:
-                res = tipc_portunreturnable(tport->ref, &value);
+                value = tipc_port_unreturnable(port);
                 break;
         case TIPC_CONN_TIMEOUT:
                 value = tipc_sk(sk)->conn_timeout;
@@ -1925,20 +1910,20 @@ static int getsockopt(struct socket *sock, int lvl, int opt, char __user *ov,
 static const struct proto_ops msg_ops = {
         .owner          = THIS_MODULE,
         .family         = AF_TIPC,
-        .release        = release,
-        .bind           = bind,
-        .connect        = connect,
+        .release        = tipc_release,
+        .bind           = tipc_bind,
+        .connect        = tipc_connect,
         .socketpair     = sock_no_socketpair,
         .accept         = sock_no_accept,
-        .getname        = get_name,
-        .poll           = poll,
+        .getname        = tipc_getname,
+        .poll           = tipc_poll,
         .ioctl          = sock_no_ioctl,
         .listen         = sock_no_listen,
-        .shutdown       = shutdown,
-        .setsockopt     = setsockopt,
-        .getsockopt     = getsockopt,
-        .sendmsg        = send_msg,
-        .recvmsg        = recv_msg,
+        .shutdown       = tipc_shutdown,
+        .setsockopt     = tipc_setsockopt,
+        .getsockopt     = tipc_getsockopt,
+        .sendmsg        = tipc_sendmsg,
+        .recvmsg        = tipc_recvmsg,
         .mmap           = sock_no_mmap,
         .sendpage       = sock_no_sendpage
 };
@@ -1946,20 +1931,20 @@ static const struct proto_ops msg_ops = {
 static const struct proto_ops packet_ops = {
         .owner          = THIS_MODULE,
         .family         = AF_TIPC,
-        .release        = release,
-        .bind           = bind,
-        .connect        = connect,
+        .release        = tipc_release,
+        .bind           = tipc_bind,
+        .connect        = tipc_connect,
         .socketpair     = sock_no_socketpair,
-        .accept         = accept,
-        .getname        = get_name,
-        .poll           = poll,
+        .accept         = tipc_accept,
+        .getname        = tipc_getname,
+        .poll           = tipc_poll,
         .ioctl          = sock_no_ioctl,
-        .listen         = listen,
-        .shutdown       = shutdown,
-        .setsockopt     = setsockopt,
-        .getsockopt     = getsockopt,
-        .sendmsg        = send_packet,
-        .recvmsg        = recv_msg,
+        .listen         = tipc_listen,
+        .shutdown       = tipc_shutdown,
+        .setsockopt     = tipc_setsockopt,
+        .getsockopt     = tipc_getsockopt,
+        .sendmsg        = tipc_send_packet,
+        .recvmsg        = tipc_recvmsg,
         .mmap           = sock_no_mmap,
         .sendpage       = sock_no_sendpage
 };
@@ -1967,20 +1952,20 @@ static const struct proto_ops packet_ops = {
 static const struct proto_ops stream_ops = {
         .owner          = THIS_MODULE,
         .family         = AF_TIPC,
-        .release        = release,
-        .bind           = bind,
-        .connect        = connect,
+        .release        = tipc_release,
+        .bind           = tipc_bind,
+        .connect        = tipc_connect,
         .socketpair     = sock_no_socketpair,
-        .accept         = accept,
-        .getname        = get_name,
-        .poll           = poll,
+        .accept         = tipc_accept,
+        .getname        = tipc_getname,
+        .poll           = tipc_poll,
         .ioctl          = sock_no_ioctl,
-        .listen         = listen,
-        .shutdown       = shutdown,
-        .setsockopt     = setsockopt,
-        .getsockopt     = getsockopt,
-        .sendmsg        = send_stream,
-        .recvmsg        = recv_stream,
+        .listen         = tipc_listen,
+        .shutdown       = tipc_shutdown,
+        .setsockopt     = tipc_setsockopt,
+        .getsockopt     = tipc_getsockopt,
+        .sendmsg        = tipc_send_stream,
+        .recvmsg        = tipc_recv_stream,
         .mmap           = sock_no_mmap,
         .sendpage       = sock_no_sendpage
 };
diff --git a/net/tipc/socket.h b/net/tipc/socket.h
new file mode 100644
index 000000000000..74e5c7f195a6
--- /dev/null
+++ b/net/tipc/socket.h
@@ -0,0 +1,72 @@
+/* net/tipc/socket.h: Include file for TIPC socket code
+ *
+ * Copyright (c) 2014, Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the names of the copyright holders nor the names of its
+ *    contributors may be used to endorse or promote products derived from
+ *    this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef _TIPC_SOCK_H
+#define _TIPC_SOCK_H
+
+#include "port.h"
+#include <net/sock.h>
+
+/**
+ * struct tipc_sock - TIPC socket structure
+ * @sk: socket - interacts with 'port' and with user via the socket API
+ * @port: port - interacts with 'sk' and with the rest of the TIPC stack
+ * @peer_name: the peer of the connection, if any
+ * @conn_timeout: the time we can wait for an unresponded setup request
+ */
+
+struct tipc_sock {
+        struct sock sk;
+        struct tipc_port port;
+        unsigned int conn_timeout;
+};
+
+static inline struct tipc_sock *tipc_sk(const struct sock *sk)
+{
+        return container_of(sk, struct tipc_sock, sk);
+}
+
+static inline struct tipc_sock *tipc_port_to_sock(const struct tipc_port *port)
+{
+        return container_of(port, struct tipc_sock, port);
+}
+
+static inline void tipc_sock_wakeup(struct tipc_sock *tsk)
+{
+        tsk->sk.sk_write_space(&tsk->sk);
+}
+
+u32 tipc_sk_rcv(struct sock *sk, struct sk_buff *buf);
+
+#endif
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 94404f19f9de..bb7e8ba821f4 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1217,7 +1217,7 @@ restart:
         __skb_queue_tail(&other->sk_receive_queue, skb);
         spin_unlock(&other->sk_receive_queue.lock);
         unix_state_unlock(other);
-        other->sk_data_ready(other, 0);
+        other->sk_data_ready(other);
         sock_put(other);
         return 0;
 
@@ -1600,7 +1600,7 @@ restart:
         if (max_level > unix_sk(other)->recursion_level)
                 unix_sk(other)->recursion_level = max_level;
         unix_state_unlock(other);
-        other->sk_data_ready(other, len);
+        other->sk_data_ready(other);
         sock_put(other);
         scm_destroy(siocb->scm);
         return len;
@@ -1706,7 +1706,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                 if (max_level > unix_sk(other)->recursion_level)
                         unix_sk(other)->recursion_level = max_level;
                 unix_state_unlock(other);
-                other->sk_data_ready(other, size);
+                other->sk_data_ready(other);
                 sent += size;
         }
 
diff --git a/net/vmw_vsock/vmci_transport_notify.c b/net/vmw_vsock/vmci_transport_notify.c
index 9a730744e7bc..9b7f207f2bee 100644
--- a/net/vmw_vsock/vmci_transport_notify.c
+++ b/net/vmw_vsock/vmci_transport_notify.c
@@ -315,7 +315,7 @@ vmci_transport_handle_wrote(struct sock *sk,
         struct vsock_sock *vsk = vsock_sk(sk);
         PKT_FIELD(vsk, sent_waiting_read) = false;
 #endif
-        sk->sk_data_ready(sk, 0);
+        sk->sk_data_ready(sk);
 }
 
 static void vmci_transport_notify_pkt_socket_init(struct sock *sk)
diff --git a/net/vmw_vsock/vmci_transport_notify_qstate.c b/net/vmw_vsock/vmci_transport_notify_qstate.c
index 622bd7aa1016..dc9c7929a2f9 100644
--- a/net/vmw_vsock/vmci_transport_notify_qstate.c
+++ b/net/vmw_vsock/vmci_transport_notify_qstate.c
@@ -92,7 +92,7 @@ vmci_transport_handle_wrote(struct sock *sk,
                             bool bottom_half,
                             struct sockaddr_vm *dst, struct sockaddr_vm *src)
 {
-        sk->sk_data_ready(sk, 0);
+        sk->sk_data_ready(sk);
 }
 
 static void vsock_block_update_write_window(struct sock *sk)
@@ -290,7 +290,7 @@ vmci_transport_notify_pkt_recv_post_dequeue(
                 /* See the comment in
                  * vmci_transport_notify_pkt_send_post_enqueue().
                  */
-                sk->sk_data_ready(sk, 0);
+                sk->sk_data_ready(sk);
         }
 
         return err;
diff --git a/net/wireless/ap.c b/net/wireless/ap.c
index 11ee4ed04f73..3e02ade508d8 100644
--- a/net/wireless/ap.c
+++ b/net/wireless/ap.c
@@ -7,7 +7,7 @@
 
 
 static int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
-                              struct net_device *dev)
+                              struct net_device *dev, bool notify)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
@@ -27,22 +27,24 @@ static int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
         err = rdev_stop_ap(rdev, dev);
         if (!err) {
                 wdev->beacon_interval = 0;
-                wdev->channel = NULL;
+                memset(&wdev->chandef, 0, sizeof(wdev->chandef));
                 wdev->ssid_len = 0;
                 rdev_set_qos_map(rdev, dev, NULL);
+                if (notify)
+                        nl80211_send_ap_stopped(wdev);
         }
 
         return err;
 }
 
 int cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
-                     struct net_device *dev)
+                     struct net_device *dev, bool notify)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
 
         wdev_lock(wdev);
-        err = __cfg80211_stop_ap(rdev, dev);
+        err = __cfg80211_stop_ap(rdev, dev, notify);
         wdev_unlock(wdev);
 
         return err;
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 78559b5bbd1f..9c9501a35fb5 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -490,6 +490,62 @@ static bool cfg80211_chandef_dfs_available(struct wiphy *wiphy,
         return r;
 }
 
+static unsigned int cfg80211_get_chans_dfs_cac_time(struct wiphy *wiphy,
+                                                    u32 center_freq,
+                                                    u32 bandwidth)
+{
+        struct ieee80211_channel *c;
+        u32 start_freq, end_freq, freq;
+        unsigned int dfs_cac_ms = 0;
+
+        start_freq = cfg80211_get_start_freq(center_freq, bandwidth);
+        end_freq = cfg80211_get_end_freq(center_freq, bandwidth);
+
+        for (freq = start_freq; freq <= end_freq; freq += 20) {
+                c = ieee80211_get_channel(wiphy, freq);
+                if (!c)
+                        return 0;
+
+                if (c->flags & IEEE80211_CHAN_DISABLED)
+                        return 0;
+
+                if (!(c->flags & IEEE80211_CHAN_RADAR))
+                        continue;
+
+                if (c->dfs_cac_ms > dfs_cac_ms)
+                        dfs_cac_ms = c->dfs_cac_ms;
+        }
+
+        return dfs_cac_ms;
+}
+
+unsigned int
+cfg80211_chandef_dfs_cac_time(struct wiphy *wiphy,
+                              const struct cfg80211_chan_def *chandef)
+{
+        int width;
+        unsigned int t1 = 0, t2 = 0;
+
+        if (WARN_ON(!cfg80211_chandef_valid(chandef)))
+                return 0;
+
+        width = cfg80211_chandef_get_width(chandef);
+        if (width < 0)
+                return 0;
+
+        t1 = cfg80211_get_chans_dfs_cac_time(wiphy,
+                                             chandef->center_freq1,
+                                             width);
+
+        if (!chandef->center_freq2)
+                return t1;
+
+        t2 = cfg80211_get_chans_dfs_cac_time(wiphy,
+                                             chandef->center_freq2,
+                                             width);
+
+        return max(t1, t2);
+}
 
 static bool cfg80211_secondary_chans_ok(struct wiphy *wiphy,
                                         u32 center_freq, u32 bandwidth,
@@ -642,7 +698,8 @@ int cfg80211_set_monitor_channel(struct cfg80211_registered_device *rdev,
 void
 cfg80211_get_chan_state(struct wireless_dev *wdev,
                         struct ieee80211_channel **chan,
-                        enum cfg80211_chan_mode *chanmode)
+                        enum cfg80211_chan_mode *chanmode,
+                        u8 *radar_detect)
 {
         *chan = NULL;
         *chanmode = CHAN_MODE_UNDEFINED;
@@ -660,6 +717,11 @@ cfg80211_get_chan_state(struct wireless_dev *wdev,
                                      !wdev->ibss_dfs_possible)
                                   ? CHAN_MODE_SHARED
                                   : CHAN_MODE_EXCLUSIVE;
+
+                        /* consider worst-case - IBSS can try to return to the
+                         * original user-specified channel as creator */
+                        if (wdev->ibss_dfs_possible)
+                                *radar_detect |= BIT(wdev->chandef.width);
                         return;
                 }
                 break;
@@ -674,33 +736,36 @@ cfg80211_get_chan_state(struct wireless_dev *wdev,
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
                 if (wdev->cac_started) {
-                        *chan = wdev->channel;
+                        *chan = wdev->chandef.chan;
                         *chanmode = CHAN_MODE_SHARED;
+                        *radar_detect |= BIT(wdev->chandef.width);
                 } else if (wdev->beacon_interval) {
-                        *chan = wdev->channel;
+                        *chan = wdev->chandef.chan;
                         *chanmode = CHAN_MODE_SHARED;
+
+                        if (cfg80211_chandef_dfs_required(wdev->wiphy,
+                                                          &wdev->chandef))
+                                *radar_detect |= BIT(wdev->chandef.width);
                 }
                 return;
         case NL80211_IFTYPE_MESH_POINT:
                 if (wdev->mesh_id_len) {
-                        *chan = wdev->channel;
+                        *chan = wdev->chandef.chan;
                         *chanmode = CHAN_MODE_SHARED;
+
+                        if (cfg80211_chandef_dfs_required(wdev->wiphy,
+                                                          &wdev->chandef))
+                                *radar_detect |= BIT(wdev->chandef.width);
                 }
                 return;
         case NL80211_IFTYPE_MONITOR:
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_WDS:
-                /* these interface types don't really have a channel */
-                return;
         case NL80211_IFTYPE_P2P_DEVICE:
-                if (wdev->wiphy->features &
-                                NL80211_FEATURE_P2P_DEVICE_NEEDS_CHANNEL)
-                        *chanmode = CHAN_MODE_EXCLUSIVE;
+                /* these interface types don't really have a channel */
                 return;
         case NL80211_IFTYPE_UNSPECIFIED:
         case NUM_NL80211_IFTYPES:
                 WARN_ON(1);
         }
-
-        return;
 }
diff --git a/net/wireless/core.c b/net/wireless/core.c
index a3bf18d11609..086cddd03ba6 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -737,7 +737,7 @@ void cfg80211_unregister_wdev(struct wireless_dev *wdev)
 }
 EXPORT_SYMBOL(cfg80211_unregister_wdev);
 
-static struct device_type wiphy_type = {
+static const struct device_type wiphy_type = {
         .name   = "wlan",
 };
 
@@ -783,7 +783,7 @@ void cfg80211_leave(struct cfg80211_registered_device *rdev,
                 break;
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
-                cfg80211_stop_ap(rdev, dev);
+                cfg80211_stop_ap(rdev, dev, true);
                 break;
         default:
                 break;
diff --git a/net/wireless/core.h b/net/wireless/core.h
index f1d193b557b6..5b1fdcadd469 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -166,7 +166,6 @@ static inline void wdev_unlock(struct wireless_dev *wdev)
         mutex_unlock(&wdev->mtx);
 }
 
-#define ASSERT_RDEV_LOCK(rdev) ASSERT_RTNL()
 #define ASSERT_WDEV_LOCK(wdev) lockdep_assert_held(&(wdev)->mtx)
 
 static inline bool cfg80211_has_monitors_only(struct cfg80211_registered_device *rdev)
@@ -211,6 +210,7 @@ struct cfg80211_event {
                 } dc;
                 struct {
                         u8 bssid[ETH_ALEN];
+                        struct ieee80211_channel *channel;
                 } ij;
         };
 };
@@ -245,10 +245,6 @@ void cfg80211_bss_age(struct cfg80211_registered_device *dev,
                       unsigned long age_secs);
 
 /* IBSS */
-int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
-                         struct net_device *dev,
-                         struct cfg80211_ibss_params *params,
-                         struct cfg80211_cached_keys *connkeys);
 int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
                        struct net_device *dev,
                        struct cfg80211_ibss_params *params,
@@ -258,7 +254,8 @@ int __cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
                           struct net_device *dev, bool nowext);
 int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
                         struct net_device *dev, bool nowext);
-void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid);
+void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
+                            struct ieee80211_channel *channel);
 int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
                             struct wireless_dev *wdev);
 
@@ -281,7 +278,7 @@ int cfg80211_set_mesh_channel(struct cfg80211_registered_device *rdev,
 
 /* AP */
 int cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
-                     struct net_device *dev);
+                     struct net_device *dev, bool notify);
 
 /* MLME */
 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
@@ -400,6 +397,9 @@ void cfg80211_set_dfs_state(struct wiphy *wiphy,
 
 void cfg80211_dfs_channels_update_work(struct work_struct *work);
 
+unsigned int
+cfg80211_chandef_dfs_cac_time(struct wiphy *wiphy,
+                              const struct cfg80211_chan_def *chandef);
 
 static inline int
 cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
@@ -443,7 +443,8 @@ static inline unsigned int elapsed_jiffies_msecs(unsigned long start)
 void
 cfg80211_get_chan_state(struct wireless_dev *wdev,
                         struct ieee80211_channel **chan,
-                        enum cfg80211_chan_mode *chanmode);
+                        enum cfg80211_chan_mode *chanmode,
+                        u8 *radar_detect);
 
 int cfg80211_set_monitor_channel(struct cfg80211_registered_device *rdev,
                                  struct cfg80211_chan_def *chandef);
diff --git a/net/wireless/genregdb.awk b/net/wireless/genregdb.awk
index 9a8217d2a908..b35da8dc85de 100644
--- a/net/wireless/genregdb.awk
+++ b/net/wireless/genregdb.awk
@@ -66,6 +66,7 @@ function parse_reg_rule()
         units = $8
         sub(/\)/, "", units)
         sub(/,/, "", units)
+        dfs_cac = $9
         if (units == "mW") {
                 if (power == 100) {
                         power = 20
@@ -78,7 +79,12 @@ function parse_reg_rule()
                 } else {
                         print "Unknown power value in database!"
                 }
+        } else {
+                dfs_cac = $8
         }
+        sub(/,/, "", dfs_cac)
+        sub(/\(/, "", dfs_cac)
+        sub(/\)/, "", dfs_cac)
         flagstr = ""
         for (i=8; i<=NF; i++)
                 flagstr = flagstr $i
@@ -105,11 +111,13 @@ function parse_reg_rule()
                         flags = flags "\n\t\t\tNL80211_RRF_NO_IR | "
                 } else if (flagarray[arg] == "NO-IR") {
                         flags = flags "\n\t\t\tNL80211_RRF_NO_IR | "
+                } else if (flagarray[arg] == "AUTO-BW") {
+                        flags = flags "\n\t\t\tNL80211_RRF_AUTO_BW | "
                 }
 
         }
         flags = flags "0"
-        printf "\t\tREG_RULE(%d, %d, %d, %d, %d, %s),\n", start, end, bw, gain, power, flags
+        printf "\t\tREG_RULE_EXT(%d, %d, %d, %d, %d, %d, %s),\n", start, end, bw, gain, power, dfs_cac, flags
         rules++
 }
 
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index f911c5f9f903..a6b5bdad039c 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -14,7 +14,8 @@
 #include "rdev-ops.h"
 
 
-void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
+void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
+                            struct ieee80211_channel *channel)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_bss *bss;
@@ -28,8 +29,7 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
         if (!wdev->ssid_len)
                 return;
 
-        bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
-                               wdev->ssid, wdev->ssid_len,
+        bss = cfg80211_get_bss(wdev->wiphy, channel, bssid, NULL, 0,
                                WLAN_CAPABILITY_IBSS, WLAN_CAPABILITY_IBSS);
 
         if (WARN_ON(!bss))
@@ -54,21 +54,26 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
 #endif
 }
 
-void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
+void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
+                          struct ieee80211_channel *channel, gfp_t gfp)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         struct cfg80211_event *ev;
         unsigned long flags;
 
-        trace_cfg80211_ibss_joined(dev, bssid);
+        trace_cfg80211_ibss_joined(dev, bssid, channel);
+
+        if (WARN_ON(!channel))
+                return;
 
         ev = kzalloc(sizeof(*ev), gfp);
         if (!ev)
                 return;
 
         ev->type = EVENT_IBSS_JOINED;
-        memcpy(ev->cr.bssid, bssid, ETH_ALEN);
+        memcpy(ev->ij.bssid, bssid, ETH_ALEN);
+        ev->ij.channel = channel;
 
         spin_lock_irqsave(&wdev->event_lock, flags);
         list_add_tail(&ev->list, &wdev->event_list);
@@ -77,10 +82,10 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
 }
 EXPORT_SYMBOL(cfg80211_ibss_joined);
 
-int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
-                         struct net_device *dev,
-                         struct cfg80211_ibss_params *params,
-                         struct cfg80211_cached_keys *connkeys)
+static int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
+                                struct net_device *dev,
+                                struct cfg80211_ibss_params *params,
+                                struct cfg80211_cached_keys *connkeys)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct ieee80211_channel *check_chan;
@@ -117,17 +122,17 @@ int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
 
         wdev->ibss_fixed = params->channel_fixed;
         wdev->ibss_dfs_possible = params->userspace_handles_dfs;
+        wdev->chandef = params->chandef;
 #ifdef CONFIG_CFG80211_WEXT
         wdev->wext.ibss.chandef = params->chandef;
 #endif
         check_chan = params->chandef.chan;
         if (params->userspace_handles_dfs) {
-                /* use channel NULL to check for radar even if the current
-                 * channel is not a radar channel - it might decide to change
-                 * to DFS channel later.
+                /* Check for radar even if the current channel is not
+                 * a radar channel - it might decide to change to DFS
+                 * channel later.
                  */
                 radar_detect_width = BIT(params->chandef.width);
-                check_chan = NULL;
         }
 
         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
@@ -200,6 +205,7 @@ static void __cfg80211_clear_ibss(struct net_device *dev, bool nowext)
 
         wdev->current_bss = NULL;
         wdev->ssid_len = 0;
+        memset(&wdev->chandef, 0, sizeof(wdev->chandef));
 #ifdef CONFIG_CFG80211_WEXT
         if (!nowext)
                 wdev->wext.ibss.ssid_len = 0;
diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c
index 885862447b63..5af5cc6b2c4c 100644
--- a/net/wireless/mesh.c
+++ b/net/wireless/mesh.c
@@ -195,7 +195,7 @@ int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
         if (!err) {
                 memcpy(wdev->ssid, setup->mesh_id, setup->mesh_id_len);
                 wdev->mesh_id_len = setup->mesh_id_len;
-                wdev->channel = setup->chandef.chan;
+                wdev->chandef = setup->chandef;
         }
 
         return err;
@@ -236,6 +236,12 @@ int cfg80211_set_mesh_channel(struct cfg80211_registered_device *rdev,
                 if (!netif_running(wdev->netdev))
                         return -ENETDOWN;
 
+                /* cfg80211_can_use_chan() calls
+                 * cfg80211_can_use_iftype_chan() with no radar
+                 * detection, so if we're trying to use a radar
+                 * channel here, something is wrong.
+                 */
+                WARN_ON_ONCE(chandef->chan->flags & IEEE80211_CHAN_RADAR);
                 err = cfg80211_can_use_chan(rdev, wdev, chandef->chan,
                                             CHAN_MODE_SHARED);
                 if (err)
@@ -244,7 +250,7 @@ int cfg80211_set_mesh_channel(struct cfg80211_registered_device *rdev,
                 err = rdev_libertas_set_mesh_channel(rdev, wdev->netdev,
                                                      chandef->chan);
                 if (!err)
-                        wdev->channel = chandef->chan;
+                        wdev->chandef = *chandef;
 
                 return err;
         }
@@ -276,7 +282,7 @@ static int __cfg80211_leave_mesh(struct cfg80211_registered_device *rdev,
         err = rdev_leave_mesh(rdev, dev);
         if (!err) {
                 wdev->mesh_id_len = 0;
-                wdev->channel = NULL;
+                memset(&wdev->chandef, 0, sizeof(wdev->chandef));
                 rdev_set_qos_map(rdev, dev, NULL);
         }
 
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 52cca05044a8..c52ff59a3e96 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -772,13 +772,13 @@ void cfg80211_cac_event(struct net_device *netdev,
         if (WARN_ON(!wdev->cac_started))
                 return;
 
-        if (WARN_ON(!wdev->channel))
+        if (WARN_ON(!wdev->chandef.chan))
                 return;
 
         switch (event) {
         case NL80211_RADAR_CAC_FINISHED:
                 timeout = wdev->cac_start_time +
-                          msecs_to_jiffies(IEEE80211_DFS_MIN_CAC_TIME_MS);
+                          msecs_to_jiffies(wdev->cac_time_ms);
                 WARN_ON(!time_after_eq(jiffies, timeout));
                 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
                 break;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 4fe2e6e2bc76..052c1bf8ffac 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -382,6 +382,9 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
+        [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
+        [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
+        [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 };
 
 /* policy for the key attributes */
@@ -590,6 +593,10 @@ static int nl80211_msg_put_channel(struct sk_buff *msg,
                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
                                         time))
                                 goto nla_put_failure;
+                        if (nla_put_u32(msg,
+                                        NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
+                                        chan->dfs_cac_ms))
+                                goto nla_put_failure;
                 }
         }
 
@@ -855,6 +862,19 @@ static int nl80211_key_allowed(struct wireless_dev *wdev)
         return 0;
 }
 
+static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
+                                                        struct nlattr *tb)
+{
+        struct ieee80211_channel *chan;
+
+        if (tb == NULL)
+                return NULL;
+        chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
+        if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
+                return NULL;
+        return chan;
+}
+
 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 {
         struct nlattr *nl_modes = nla_nest_start(msg, attr);
@@ -1586,6 +1606,12 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
                         goto nla_put_failure;
+
+                if (dev->wiphy.max_ap_assoc_sta &&
+                    nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
+                                dev->wiphy.max_ap_assoc_sta))
+                        goto nla_put_failure;
+
                 state->split_start++;
                 break;
         case 11:
@@ -2035,10 +2061,12 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                 nla_for_each_nested(nl_txq_params,
                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
                                     rem_txq_params) {
-                        nla_parse(tb, NL80211_TXQ_ATTR_MAX,
-                                  nla_data(nl_txq_params),
-                                  nla_len(nl_txq_params),
-                                  txq_params_policy);
+                        result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
+                                           nla_data(nl_txq_params),
+                                           nla_len(nl_txq_params),
+                                           txq_params_policy);
+                        if (result)
+                                return result;
                         result = parse_txq_params(tb, &txq_params);
                         if (result)
                                 return result;
@@ -3259,7 +3287,7 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
         if (!err) {
                 wdev->preset_chandef = params.chandef;
                 wdev->beacon_interval = params.beacon_interval;
-                wdev->channel = params.chandef.chan;
+                wdev->chandef = params.chandef;
                 wdev->ssid_len = params.ssid_len;
                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
         }
@@ -3304,7 +3332,7 @@ static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
 
-        return cfg80211_stop_ap(rdev, dev);
+        return cfg80211_stop_ap(rdev, dev, false);
 }
 
 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
@@ -3902,8 +3930,8 @@ static struct net_device *get_vlan(struct genl_info *info,
         return ERR_PTR(ret);
 }
 
-static struct nla_policy
-nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
+static const struct nla_policy
+nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
 };
@@ -4590,6 +4618,7 @@ static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] =
         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
+        [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
 };
 
 static int parse_reg_rule(struct nlattr *tb[],
@@ -4625,6 +4654,10 @@ static int parse_reg_rule(struct nlattr *tb[],
                 power_rule->max_antenna_gain =
                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
 
+        if (tb[NL80211_ATTR_DFS_CAC_TIME])
+                reg_rule->dfs_cac_ms =
+                        nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
+
         return 0;
 }
 
@@ -5086,6 +5119,7 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
                 const struct ieee80211_reg_rule *reg_rule;
                 const struct ieee80211_freq_range *freq_range;
                 const struct ieee80211_power_rule *power_rule;
+                unsigned int max_bandwidth_khz;
 
                 reg_rule = &regdom->reg_rules[i];
                 freq_range = &reg_rule->freq_range;
@@ -5095,6 +5129,11 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
                 if (!nl_reg_rule)
                         goto nla_put_failure_rcu;
 
+                max_bandwidth_khz = freq_range->max_bandwidth_khz;
+                if (!max_bandwidth_khz)
+                        max_bandwidth_khz = reg_get_max_bandwidth(regdom,
+                                                                  reg_rule);
+
                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
                                 reg_rule->flags) ||
                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
@@ -5102,11 +5141,13 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
                                 freq_range->end_freq_khz) ||
                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
-                                freq_range->max_bandwidth_khz) ||
+                                max_bandwidth_khz) ||
                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
                                 power_rule->max_antenna_gain) ||
                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
-                                power_rule->max_eirp))
+                                power_rule->max_eirp) ||
+                    nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
+                                reg_rule->dfs_cac_ms))
                         goto nla_put_failure_rcu;
 
                 nla_nest_end(msg, nl_reg_rule);
@@ -5178,9 +5219,11 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
 
         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
                             rem_reg_rules) {
-                nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
-                          nla_data(nl_reg_rule), nla_len(nl_reg_rule),
-                          reg_rule_policy);
+                r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
+                              nla_data(nl_reg_rule), nla_len(nl_reg_rule),
+                              reg_rule_policy);
+                if (r)
+                        goto bad_reg;
                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
                 if (r)
                         goto bad_reg;
@@ -5443,6 +5486,7 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
         enum ieee80211_band band;
         size_t ie_len;
         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
+        s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
 
         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
             !rdev->ops->sched_scan_start)
@@ -5477,11 +5521,40 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
         if (n_ssids > wiphy->max_sched_scan_ssids)
                 return -EINVAL;
 
-        if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
+        /*
+         * First, count the number of 'real' matchsets. Due to an issue with
+         * the old implementation, matchsets containing only the RSSI attribute
+         * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
+         * RSSI for all matchsets, rather than their own matchset for reporting
+         * all APs with a strong RSSI. This is needed to be compatible with
+         * older userspace that treated a matchset with only the RSSI as the
+         * global RSSI for all other matchsets - if there are other matchsets.
+         */
+        if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
                 nla_for_each_nested(attr,
                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
-                                    tmp)
-                        n_match_sets++;
+                                    tmp) {
+                        struct nlattr *rssi;
+
+                        err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
+                                        nla_data(attr), nla_len(attr),
+                                        nl80211_match_policy);
+                        if (err)
+                                return err;
+                        /* add other standalone attributes here */
+                        if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
+                                n_match_sets++;
+                                continue;
+                        }
+                        rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
+                        if (rssi)
+                                default_match_rssi = nla_get_s32(rssi);
+                }
+        }
+
+        /* However, if there's no other matchset, add the RSSI one */
+        if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
+                n_match_sets = 1;
 
         if (n_match_sets > wiphy->max_match_sets)
                 return -EINVAL;
@@ -5602,11 +5675,22 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
                                     tmp) {
                         struct nlattr *ssid, *rssi;
 
-                        nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
-                                  nla_data(attr), nla_len(attr),
-                                  nl80211_match_policy);
+                        err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
+                                        nla_data(attr), nla_len(attr),
+                                        nl80211_match_policy);
+                        if (err)
+                                goto out_free;
                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
                         if (ssid) {
+                                if (WARN_ON(i >= n_match_sets)) {
+                                        /* this indicates a programming error,
+                                         * the loop above should have verified
+                                         * things properly
+                                         */
+                                        err = -EINVAL;
+                                        goto out_free;
+                                }
+
                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
                                         err = -EINVAL;
                                         goto out_free;
@@ -5615,19 +5699,32 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
                                        nla_data(ssid), nla_len(ssid));
                                 request->match_sets[i].ssid.ssid_len =
                                         nla_len(ssid);
+                                /* special attribute - old implemenation w/a */
+                                request->match_sets[i].rssi_thold =
+                                        default_match_rssi;
+                                rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
+                                if (rssi)
+                                        request->match_sets[i].rssi_thold =
+                                                nla_get_s32(rssi);
                         }
-                        rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
-                        if (rssi)
-                                request->rssi_thold = nla_get_u32(rssi);
-                        else
-                                request->rssi_thold =
-                                                   NL80211_SCAN_RSSI_THOLD_OFF;
                         i++;
                 }
+
+                /* there was no other matchset, so the RSSI one is alone */
+                if (i == 0)
+                        request->match_sets[0].rssi_thold = default_match_rssi;
+
+                request->min_rssi_thold = INT_MAX;
+                for (i = 0; i < n_match_sets; i++)
+                        request->min_rssi_thold =
+                                min(request->match_sets[i].rssi_thold,
+                                    request->min_rssi_thold);
+        } else {
+                request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
         }
 
-        if (info->attrs[NL80211_ATTR_IE]) {
-                request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+        if (ie_len) {
+                request->ie_len = ie_len;
                 memcpy((void *)request->ie,
                        nla_data(info->attrs[NL80211_ATTR_IE]),
                        request->ie_len);
@@ -5682,6 +5779,7 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_chan_def chandef;
         enum nl80211_dfs_regions dfs_region;
+        unsigned int cac_time_ms;
         int err;
 
         dfs_region = reg_get_dfs_region(wdev->wiphy);
@@ -5717,11 +5815,17 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
         if (err)
                 return err;
 
-        err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
+        cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
+        if (WARN_ON(!cac_time_ms))
+                cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
+
+        err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef,
+                                               cac_time_ms);
         if (!err) {
-                wdev->channel = chandef.chan;
+                wdev->chandef = chandef;
                 wdev->cac_started = true;
                 wdev->cac_start_time = jiffies;
+                wdev->cac_time_ms = cac_time_ms;
         }
         return err;
 }
@@ -5751,10 +5855,15 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
 
                 /* useless if AP is not running */
                 if (!wdev->beacon_interval)
-                        return -EINVAL;
+                        return -ENOTCONN;
                 break;
         case NL80211_IFTYPE_ADHOC:
+                if (!wdev->ssid_len)
+                        return -ENOTCONN;
+                break;
         case NL80211_IFTYPE_MESH_POINT:
+                if (!wdev->mesh_id_len)
+                        return -ENOTCONN;
                 break;
         default:
                 return -EOPNOTSUPP;
@@ -5822,17 +5931,22 @@ skip_beacons:
         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
                 return -EINVAL;
 
-        if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
-            dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO ||
-            dev->ieee80211_ptr->iftype == NL80211_IFTYPE_ADHOC) {
+        switch (dev->ieee80211_ptr->iftype) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
+        case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_MESH_POINT:
                 err = cfg80211_chandef_dfs_required(wdev->wiphy,
                                                     &params.chandef);
-                if (err < 0) {
+                if (err < 0)
                         return err;
-                } else if (err) {
+                if (err) {
                         radar_detect_width = BIT(params.chandef.width);
                         params.radar_required = true;
                 }
+                break;
+        default:
+                break;
         }
 
         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
@@ -6192,9 +6306,9 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
                 return -EOPNOTSUPP;
 
         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
-        chan = ieee80211_get_channel(&rdev->wiphy,
-                nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
-        if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
+        chan = nl80211_get_valid_chan(&rdev->wiphy,
+                                      info->attrs[NL80211_ATTR_WIPHY_FREQ]);
+        if (!chan)
                 return -EINVAL;
 
         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
@@ -6347,9 +6461,9 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
 
         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        chan = ieee80211_get_channel(&rdev->wiphy,
-                nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
-        if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
+        chan = nl80211_get_valid_chan(&rdev->wiphy,
+                                      info->attrs[NL80211_ATTR_WIPHY_FREQ]);
+        if (!chan)
                 return -EINVAL;
 
         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
@@ -6985,6 +7099,9 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
 
         if (info->attrs[NL80211_ATTR_MAC])
                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
+        else if (info->attrs[NL80211_ATTR_MAC_HINT])
+                connect.bssid_hint =
+                        nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
 
@@ -7003,11 +7120,14 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
         }
 
         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
-                connect.channel =
-                        ieee80211_get_channel(wiphy,
-                            nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
-                if (!connect.channel ||
-                    connect.channel->flags & IEEE80211_CHAN_DISABLED)
+                connect.channel = nl80211_get_valid_chan(
+                        wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
+                if (!connect.channel)
+                        return -EINVAL;
+        } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
+                connect.channel_hint = nl80211_get_valid_chan(
+                        wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
+                if (!connect.channel_hint)
                         return -EINVAL;
         }
 
@@ -7174,6 +7294,7 @@ static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
         u8 action_code, dialog_token;
+        u32 peer_capability = 0;
         u16 status_code;
         u8 *peer;
 
@@ -7192,9 +7313,12 @@ static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
+        if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
+                peer_capability =
+                        nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
 
         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
-                              dialog_token, status_code,
+                              dialog_token, status_code, peer_capability,
                               nla_data(info->attrs[NL80211_ATTR_IE]),
                               nla_len(info->attrs[NL80211_ATTR_IE]));
 }
@@ -7421,6 +7545,7 @@ static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
                                 .len = NL80211_MAX_SUPP_HT_RATES },
         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
+        [NL80211_TXRATE_GI] = { .type = NLA_U8 },
 };
 
 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
@@ -7467,16 +7592,19 @@ static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
          * directly to the enum ieee80211_band values used in cfg80211.
          */
         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
-        nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
-        {
+        nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
                 enum ieee80211_band band = nla_type(tx_rates);
+                int err;
+
                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
                         return -EINVAL;
                 sband = rdev->wiphy.bands[band];
                 if (sband == NULL)
                         return -EINVAL;
-                nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
-                          nla_len(tx_rates), nl80211_txattr_policy);
+                err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
+                                nla_len(tx_rates), nl80211_txattr_policy);
+                if (err)
+                        return err;
                 if (tb[NL80211_TXRATE_LEGACY]) {
                         mask.control[band].legacy = rateset_to_mask(
                                 sband,
@@ -7501,6 +7629,12 @@ static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
                                         mask.control[band].vht_mcs))
                                 return -EINVAL;
                 }
+                if (tb[NL80211_TXRATE_GI]) {
+                        mask.control[band].gi =
+                                nla_get_u8(tb[NL80211_TXRATE_GI]);
+                        if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
+                                return -EINVAL;
+                }
 
                 if (mask.control[band].legacy == 0) {
                         /* don't allow empty legacy rates if HT or VHT
@@ -7777,8 +7911,8 @@ static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
-static struct nla_policy
-nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
+static const struct nla_policy
+nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
@@ -11107,7 +11241,8 @@ void cfg80211_ch_switch_notify(struct net_device *dev,
                     wdev->iftype != NL80211_IFTYPE_MESH_POINT))
                 return;
 
-        wdev->channel = chandef->chan;
+        wdev->chandef = *chandef;
+        wdev->preset_chandef = *chandef;
         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
 }
 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
@@ -11621,6 +11756,35 @@ void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
 }
 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
 
+void nl80211_send_ap_stopped(struct wireless_dev *wdev)
+{
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
+        if (!hdr)
+                goto out;
+
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
+            nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
+                goto out;
+
+        genlmsg_end(msg, hdr);
+
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, GFP_KERNEL);
+        return;
+ out:
+        nlmsg_free(msg);
+}
+
 /* initialisation/exit functions */
 
 int nl80211_init(void)
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 75799746d845..1e6df9630f42 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -74,6 +74,8 @@ nl80211_radar_notify(struct cfg80211_registered_device *rdev,
                      enum nl80211_radar_event event,
                      struct net_device *netdev, gfp_t gfp);
 
+void nl80211_send_ap_stopped(struct wireless_dev *wdev);
+
 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev);
 
 #endif /* __NET_WIRELESS_NL80211_H */
diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
index c8e225947adb..74d97d33c938 100644
--- a/net/wireless/rdev-ops.h
+++ b/net/wireless/rdev-ops.h
@@ -769,13 +769,16 @@ static inline int rdev_set_rekey_data(struct cfg80211_registered_device *rdev,
 static inline int rdev_tdls_mgmt(struct cfg80211_registered_device *rdev,
                                  struct net_device *dev, u8 *peer,
                                  u8 action_code, u8 dialog_token,
-                                 u16 status_code, const u8 *buf, size_t len)
+                                 u16 status_code, u32 peer_capability,
+                                 const u8 *buf, size_t len)
 {
         int ret;
         trace_rdev_tdls_mgmt(&rdev->wiphy, dev, peer, action_code,
-                             dialog_token, status_code, buf, len);
+                             dialog_token, status_code, peer_capability,
+                             buf, len);
         ret = rdev->ops->tdls_mgmt(&rdev->wiphy, dev, peer, action_code,
-                                   dialog_token, status_code, buf, len);
+                                   dialog_token, status_code, peer_capability,
+                                   buf, len);
         trace_rdev_return_int(&rdev->wiphy, ret);
         return ret;
 }
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index f0541370e68e..f59aaac586f8 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -91,10 +91,6 @@ static struct regulatory_request __rcu *last_request =
 /* To trigger userspace events */
 static struct platform_device *reg_pdev;
 
-static struct device_type reg_device_type = {
-        .uevent = reg_device_uevent,
-};
-
 /*
  * Central wireless core regulatory domains, we only need two,
  * the current one and a world regulatory domain in case we have no
@@ -244,19 +240,21 @@ static char user_alpha2[2];
 module_param(ieee80211_regdom, charp, 0444);
 MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
 
-static void reg_kfree_last_request(void)
+static void reg_free_request(struct regulatory_request *lr)
 {
-        struct regulatory_request *lr;
-
-        lr = get_last_request();
-
         if (lr != &core_request_world && lr)
                 kfree_rcu(lr, rcu_head);
 }
 
 static void reg_update_last_request(struct regulatory_request *request)
 {
-        reg_kfree_last_request();
+        struct regulatory_request *lr;
+
+        lr = get_last_request();
+        if (lr == request)
+                return;
+
+        reg_free_request(lr);
         rcu_assign_pointer(last_request, request);
 }
 
@@ -487,11 +485,16 @@ static inline void reg_regdb_query(const char *alpha2) {}
 
 /*
  * This lets us keep regulatory code which is updated on a regulatory
- * basis in userspace. Country information is filled in by
- * reg_device_uevent
+ * basis in userspace.
  */
 static int call_crda(const char *alpha2)
 {
+        char country[12];
+        char *env[] = { country, NULL };
+
+        snprintf(country, sizeof(country), "COUNTRY=%c%c",
+                 alpha2[0], alpha2[1]);
+
         if (!is_world_regdom((char *) alpha2))
                 pr_info("Calling CRDA for country: %c%c\n",
                         alpha2[0], alpha2[1]);
@@ -501,7 +504,7 @@ static int call_crda(const char *alpha2)
         /* query internal regulatory database (if it exists) */
         reg_regdb_query(alpha2);
 
-        return kobject_uevent(&reg_pdev->dev.kobj, KOBJ_CHANGE);
+        return kobject_uevent_env(&reg_pdev->dev.kobj, KOBJ_CHANGE, env);
 }
 
 static enum reg_request_treatment
@@ -522,6 +525,71 @@ bool reg_is_valid_request(const char *alpha2)
         return alpha2_equal(lr->alpha2, alpha2);
 }
 
+static const struct ieee80211_regdomain *reg_get_regdomain(struct wiphy *wiphy)
+{
+        struct regulatory_request *lr = get_last_request();
+
+        /*
+         * Follow the driver's regulatory domain, if present, unless a country
+         * IE has been processed or a user wants to help complaince further
+         */
+        if (lr->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+            lr->initiator != NL80211_REGDOM_SET_BY_USER &&
+            wiphy->regd)
+                return get_wiphy_regdom(wiphy);
+
+        return get_cfg80211_regdom();
+}
+
+unsigned int reg_get_max_bandwidth(const struct ieee80211_regdomain *rd,
+                                   const struct ieee80211_reg_rule *rule)
+{
+        const struct ieee80211_freq_range *freq_range = &rule->freq_range;
+        const struct ieee80211_freq_range *freq_range_tmp;
+        const struct ieee80211_reg_rule *tmp;
+        u32 start_freq, end_freq, idx, no;
+
+        for (idx = 0; idx < rd->n_reg_rules; idx++)
+                if (rule == &rd->reg_rules[idx])
+                        break;
+
+        if (idx == rd->n_reg_rules)
+                return 0;
+
+        /* get start_freq */
+        no = idx;
+
+        while (no) {
+                tmp = &rd->reg_rules[--no];
+                freq_range_tmp = &tmp->freq_range;
+
+                if (freq_range_tmp->end_freq_khz < freq_range->start_freq_khz)
+                        break;
+
+                freq_range = freq_range_tmp;
+        }
+
+        start_freq = freq_range->start_freq_khz;
+
+        /* get end_freq */
+        freq_range = &rule->freq_range;
+        no = idx;
+
+        while (no < rd->n_reg_rules - 1) {
+                tmp = &rd->reg_rules[++no];
+                freq_range_tmp = &tmp->freq_range;
+
+                if (freq_range_tmp->start_freq_khz > freq_range->end_freq_khz)
+                        break;
+
+                freq_range = freq_range_tmp;
+        }
+
+        end_freq = freq_range->end_freq_khz;
+
+        return end_freq - start_freq;
+}
+
 /* Sanity check on a regulatory rule */
 static bool is_valid_reg_rule(const struct ieee80211_reg_rule *rule)
 {
@@ -630,7 +698,9 @@ reg_intersect_dfs_region(const enum nl80211_dfs_regions dfs_region1,
  * Helper for regdom_intersect(), this does the real
  * mathematical intersection fun
  */
-static int reg_rules_intersect(const struct ieee80211_reg_rule *rule1,
+static int reg_rules_intersect(const struct ieee80211_regdomain *rd1,
+                               const struct ieee80211_regdomain *rd2,
+                               const struct ieee80211_reg_rule *rule1,
                                const struct ieee80211_reg_rule *rule2,
                                struct ieee80211_reg_rule *intersected_rule)
 {
@@ -638,7 +708,7 @@ static int reg_rules_intersect(const struct ieee80211_reg_rule *rule1,
         struct ieee80211_freq_range *freq_range;
         const struct ieee80211_power_rule *power_rule1, *power_rule2;
         struct ieee80211_power_rule *power_rule;
-        u32 freq_diff;
+        u32 freq_diff, max_bandwidth1, max_bandwidth2;
 
         freq_range1 = &rule1->freq_range;
         freq_range2 = &rule2->freq_range;
@@ -652,8 +722,32 @@ static int reg_rules_intersect(const struct ieee80211_reg_rule *rule1,
                                          freq_range2->start_freq_khz);
         freq_range->end_freq_khz = min(freq_range1->end_freq_khz,
                                        freq_range2->end_freq_khz);
-        freq_range->max_bandwidth_khz = min(freq_range1->max_bandwidth_khz,
-                                            freq_range2->max_bandwidth_khz);
+
+        max_bandwidth1 = freq_range1->max_bandwidth_khz;
+        max_bandwidth2 = freq_range2->max_bandwidth_khz;
+
+        if (rule1->flags & NL80211_RRF_AUTO_BW)
+                max_bandwidth1 = reg_get_max_bandwidth(rd1, rule1);
+        if (rule2->flags & NL80211_RRF_AUTO_BW)
+                max_bandwidth2 = reg_get_max_bandwidth(rd2, rule2);
+
+        freq_range->max_bandwidth_khz = min(max_bandwidth1, max_bandwidth2);
+
+        intersected_rule->flags = rule1->flags | rule2->flags;
+
+        /*
+         * In case NL80211_RRF_AUTO_BW requested for both rules
+         * set AUTO_BW in intersected rule also. Next we will
+         * calculate BW correctly in handle_channel function.
+         * In other case remove AUTO_BW flag while we calculate
+         * maximum bandwidth correctly and auto calculation is
+         * not required.
+         */
+        if ((rule1->flags & NL80211_RRF_AUTO_BW) &&
+            (rule2->flags & NL80211_RRF_AUTO_BW))
+                intersected_rule->flags |= NL80211_RRF_AUTO_BW;
+        else
+                intersected_rule->flags &= ~NL80211_RRF_AUTO_BW;
 
         freq_diff = freq_range->end_freq_khz - freq_range->start_freq_khz;
         if (freq_range->max_bandwidth_khz > freq_diff)
@@ -664,7 +758,8 @@ static int reg_rules_intersect(const struct ieee80211_reg_rule *rule1,
         power_rule->max_antenna_gain = min(power_rule1->max_antenna_gain,
                 power_rule2->max_antenna_gain);
 
-        intersected_rule->flags = rule1->flags | rule2->flags;
+        intersected_rule->dfs_cac_ms = max(rule1->dfs_cac_ms,
+                                           rule2->dfs_cac_ms);
 
         if (!is_valid_reg_rule(intersected_rule))
                 return -EINVAL;
@@ -713,7 +808,8 @@ regdom_intersect(const struct ieee80211_regdomain *rd1,
                 rule1 = &rd1->reg_rules[x];
                 for (y = 0; y < rd2->n_reg_rules; y++) {
                         rule2 = &rd2->reg_rules[y];
-                        if (!reg_rules_intersect(rule1, rule2, &dummy_rule))
+                        if (!reg_rules_intersect(rd1, rd2, rule1, rule2,
+                                                 &dummy_rule))
                                 num_rules++;
                 }
         }
@@ -738,7 +834,8 @@ regdom_intersect(const struct ieee80211_regdomain *rd1,
                          * a memcpy()
                          */
                         intersected_rule = &rd->reg_rules[rule_idx];
-                        r = reg_rules_intersect(rule1, rule2, intersected_rule);
+                        r = reg_rules_intersect(rd1, rd2, rule1, rule2,
+                                                intersected_rule);
                         /*
                          * No need to memset here the intersected rule here as
                          * we're not using the stack anymore
@@ -821,18 +918,8 @@ const struct ieee80211_reg_rule *freq_reg_info(struct wiphy *wiphy,
                                                u32 center_freq)
 {
         const struct ieee80211_regdomain *regd;
-        struct regulatory_request *lr = get_last_request();
 
-        /*
-         * Follow the driver's regulatory domain, if present, unless a country
-         * IE has been processed or a user wants to help complaince further
-         */
-        if (lr->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
-            lr->initiator != NL80211_REGDOM_SET_BY_USER &&
-            wiphy->regd)
-                regd = get_wiphy_regdom(wiphy);
-        else
-                regd = get_cfg80211_regdom();
+        regd = reg_get_regdomain(wiphy);
 
         return freq_reg_info_regd(wiphy, center_freq, regd);
 }
@@ -857,31 +944,42 @@ const char *reg_initiator_name(enum nl80211_reg_initiator initiator)
 EXPORT_SYMBOL(reg_initiator_name);
 
 #ifdef CONFIG_CFG80211_REG_DEBUG
-static void chan_reg_rule_print_dbg(struct ieee80211_channel *chan,
+static void chan_reg_rule_print_dbg(const struct ieee80211_regdomain *regd,
+                                    struct ieee80211_channel *chan,
                                     const struct ieee80211_reg_rule *reg_rule)
 {
         const struct ieee80211_power_rule *power_rule;
         const struct ieee80211_freq_range *freq_range;
-        char max_antenna_gain[32];
+        char max_antenna_gain[32], bw[32];
 
         power_rule = &reg_rule->power_rule;
         freq_range = &reg_rule->freq_range;
 
         if (!power_rule->max_antenna_gain)
-                snprintf(max_antenna_gain, 32, "N/A");
+                snprintf(max_antenna_gain, sizeof(max_antenna_gain), "N/A");
         else
-                snprintf(max_antenna_gain, 32, "%d", power_rule->max_antenna_gain);
+                snprintf(max_antenna_gain, sizeof(max_antenna_gain), "%d",
+                         power_rule->max_antenna_gain);
+
+        if (reg_rule->flags & NL80211_RRF_AUTO_BW)
+                snprintf(bw, sizeof(bw), "%d KHz, %d KHz AUTO",
+                         freq_range->max_bandwidth_khz,
+                         reg_get_max_bandwidth(regd, reg_rule));
+        else
+                snprintf(bw, sizeof(bw), "%d KHz",
+                         freq_range->max_bandwidth_khz);
 
         REG_DBG_PRINT("Updating information on frequency %d MHz with regulatory rule:\n",
                       chan->center_freq);
 
-        REG_DBG_PRINT("%d KHz - %d KHz @ %d KHz), (%s mBi, %d mBm)\n",
+        REG_DBG_PRINT("%d KHz - %d KHz @ %s), (%s mBi, %d mBm)\n",
                       freq_range->start_freq_khz, freq_range->end_freq_khz,
-                      freq_range->max_bandwidth_khz, max_antenna_gain,
+                      bw, max_antenna_gain,
                       power_rule->max_eirp);
 }
 #else
-static void chan_reg_rule_print_dbg(struct ieee80211_channel *chan,
+static void chan_reg_rule_print_dbg(const struct ieee80211_regdomain *regd,
+                                    struct ieee80211_channel *chan,
                                     const struct ieee80211_reg_rule *reg_rule)
 {
         return;
@@ -903,6 +1001,8 @@ static void handle_channel(struct wiphy *wiphy,
         const struct ieee80211_freq_range *freq_range = NULL;
         struct wiphy *request_wiphy = NULL;
         struct regulatory_request *lr = get_last_request();
+        const struct ieee80211_regdomain *regd;
+        u32 max_bandwidth_khz;
 
         request_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
 
@@ -939,16 +1039,22 @@ static void handle_channel(struct wiphy *wiphy,
                 return;
         }
 
-        chan_reg_rule_print_dbg(chan, reg_rule);
+        regd = reg_get_regdomain(wiphy);
+        chan_reg_rule_print_dbg(regd, chan, reg_rule);
 
         power_rule = &reg_rule->power_rule;
         freq_range = &reg_rule->freq_range;
 
-        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(40))
+        max_bandwidth_khz = freq_range->max_bandwidth_khz;
+        /* Check if auto calculation requested */
+        if (reg_rule->flags & NL80211_RRF_AUTO_BW)
+                max_bandwidth_khz = reg_get_max_bandwidth(regd, reg_rule);
+
+        if (max_bandwidth_khz < MHZ_TO_KHZ(40))
                 bw_flags = IEEE80211_CHAN_NO_HT40;
-        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(80))
+        if (max_bandwidth_khz < MHZ_TO_KHZ(80))
                 bw_flags |= IEEE80211_CHAN_NO_80MHZ;
-        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(160))
+        if (max_bandwidth_khz < MHZ_TO_KHZ(160))
                 bw_flags |= IEEE80211_CHAN_NO_160MHZ;
 
         if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
@@ -977,6 +1083,14 @@ static void handle_channel(struct wiphy *wiphy,
                 min_t(int, chan->orig_mag,
                       MBI_TO_DBI(power_rule->max_antenna_gain));
         chan->max_reg_power = (int) MBM_TO_DBM(power_rule->max_eirp);
+
+        if (chan->flags & IEEE80211_CHAN_RADAR) {
+                if (reg_rule->dfs_cac_ms)
+                        chan->dfs_cac_ms = reg_rule->dfs_cac_ms;
+                else
+                        chan->dfs_cac_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
+        }
+
         if (chan->orig_mpwr) {
                 /*
                  * Devices that use REGULATORY_COUNTRY_IE_FOLLOW_POWER
@@ -1334,6 +1448,7 @@ static void handle_channel_custom(struct wiphy *wiphy,
         const struct ieee80211_reg_rule *reg_rule = NULL;
         const struct ieee80211_power_rule *power_rule = NULL;
         const struct ieee80211_freq_range *freq_range = NULL;
+        u32 max_bandwidth_khz;
 
         reg_rule = freq_reg_info_regd(wiphy, MHZ_TO_KHZ(chan->center_freq),
                                       regd);
@@ -1346,16 +1461,21 @@ static void handle_channel_custom(struct wiphy *wiphy,
                 return;
         }
 
-        chan_reg_rule_print_dbg(chan, reg_rule);
+        chan_reg_rule_print_dbg(regd, chan, reg_rule);
 
         power_rule = &reg_rule->power_rule;
         freq_range = &reg_rule->freq_range;
 
-        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(40))
+        max_bandwidth_khz = freq_range->max_bandwidth_khz;
+        /* Check if auto calculation requested */
+        if (reg_rule->flags & NL80211_RRF_AUTO_BW)
+                max_bandwidth_khz = reg_get_max_bandwidth(regd, reg_rule);
+
+        if (max_bandwidth_khz < MHZ_TO_KHZ(40))
                 bw_flags = IEEE80211_CHAN_NO_HT40;
-        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(80))
+        if (max_bandwidth_khz < MHZ_TO_KHZ(80))
                 bw_flags |= IEEE80211_CHAN_NO_80MHZ;
-        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(160))
+        if (max_bandwidth_khz < MHZ_TO_KHZ(160))
                 bw_flags |= IEEE80211_CHAN_NO_160MHZ;
 
         chan->flags |= map_regdom_flags(reg_rule->flags) | bw_flags;
@@ -1683,17 +1803,9 @@ static void reg_process_hint(struct regulatory_request *reg_request)
         struct wiphy *wiphy = NULL;
         enum reg_request_treatment treatment;
 
-        if (WARN_ON(!reg_request->alpha2))
-                return;
-
         if (reg_request->wiphy_idx != WIPHY_IDX_INVALID)
                 wiphy = wiphy_idx_to_wiphy(reg_request->wiphy_idx);
 
-        if (reg_request->initiator == NL80211_REGDOM_SET_BY_DRIVER && !wiphy) {
-                kfree(reg_request);
-                return;
-        }
-
         switch (reg_request->initiator) {
         case NL80211_REGDOM_SET_BY_CORE:
                 reg_process_hint_core(reg_request);
@@ -1703,23 +1815,33 @@ static void reg_process_hint(struct regulatory_request *reg_request)
                 if (treatment == REG_REQ_IGNORE ||
                     treatment == REG_REQ_ALREADY_SET)
                         return;
-                schedule_delayed_work(&reg_timeout, msecs_to_jiffies(3142));
+                queue_delayed_work(system_power_efficient_wq,
+                                   &reg_timeout, msecs_to_jiffies(3142));
                 return;
         case NL80211_REGDOM_SET_BY_DRIVER:
+                if (!wiphy)
+                        goto out_free;
                 treatment = reg_process_hint_driver(wiphy, reg_request);
                 break;
         case NL80211_REGDOM_SET_BY_COUNTRY_IE:
+                if (!wiphy)
+                        goto out_free;
                 treatment = reg_process_hint_country_ie(wiphy, reg_request);
                 break;
         default:
                 WARN(1, "invalid initiator %d\n", reg_request->initiator);
-                return;
+                goto out_free;
         }
 
         /* This is required so that the orig_* parameters are saved */
         if (treatment == REG_REQ_ALREADY_SET && wiphy &&
             wiphy->regulatory_flags & REGULATORY_STRICT_REG)
                 wiphy_update_regulatory(wiphy, reg_request->initiator);
+
+        return;
+
+out_free:
+        kfree(reg_request);
 }
 
 /*
@@ -2147,31 +2269,49 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
         const struct ieee80211_reg_rule *reg_rule = NULL;
         const struct ieee80211_freq_range *freq_range = NULL;
         const struct ieee80211_power_rule *power_rule = NULL;
+        char bw[32], cac_time[32];
 
-        pr_info("  (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)\n");
+        pr_info("  (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)\n");
 
         for (i = 0; i < rd->n_reg_rules; i++) {
                 reg_rule = &rd->reg_rules[i];
                 freq_range = &reg_rule->freq_range;
                 power_rule = &reg_rule->power_rule;
 
+                if (reg_rule->flags & NL80211_RRF_AUTO_BW)
+                        snprintf(bw, sizeof(bw), "%d KHz, %d KHz AUTO",
+                                 freq_range->max_bandwidth_khz,
+                                 reg_get_max_bandwidth(rd, reg_rule));
+                else
+                        snprintf(bw, sizeof(bw), "%d KHz",
+                                 freq_range->max_bandwidth_khz);
+
+                if (reg_rule->flags & NL80211_RRF_DFS)
+                        scnprintf(cac_time, sizeof(cac_time), "%u s",
+                                  reg_rule->dfs_cac_ms/1000);
+                else
+                        scnprintf(cac_time, sizeof(cac_time), "N/A");
+
+
                 /*
                  * There may not be documentation for max antenna gain
                  * in certain regions
                  */
                 if (power_rule->max_antenna_gain)
-                        pr_info("  (%d KHz - %d KHz @ %d KHz), (%d mBi, %d mBm)\n",
+                        pr_info("  (%d KHz - %d KHz @ %s), (%d mBi, %d mBm), (%s)\n",
                                 freq_range->start_freq_khz,
                                 freq_range->end_freq_khz,
-                                freq_range->max_bandwidth_khz,
+                                bw,
                                 power_rule->max_antenna_gain,
-                                power_rule->max_eirp);
+                                power_rule->max_eirp,
+                                cac_time);
                 else
-                        pr_info("  (%d KHz - %d KHz @ %d KHz), (N/A, %d mBm)\n",
+                        pr_info("  (%d KHz - %d KHz @ %s), (N/A, %d mBm), (%s)\n",
                                 freq_range->start_freq_khz,
                                 freq_range->end_freq_khz,
-                                freq_range->max_bandwidth_khz,
-                                power_rule->max_eirp);
+                                bw,
+                                power_rule->max_eirp,
+                                cac_time);
         }
 }
 
@@ -2244,9 +2384,6 @@ static int reg_set_rd_user(const struct ieee80211_regdomain *rd,
 {
         const struct ieee80211_regdomain *intersected_rd = NULL;
 
-        if (is_world_regdom(rd->alpha2))
-                return -EINVAL;
-
         if (!regdom_changes(rd->alpha2))
                 return -EALREADY;
 
@@ -2294,7 +2431,8 @@ static int reg_set_rd_driver(const struct ieee80211_regdomain *rd,
 
         request_wiphy = wiphy_idx_to_wiphy(driver_request->wiphy_idx);
         if (!request_wiphy) {
-                schedule_delayed_work(&reg_timeout, 0);
+                queue_delayed_work(system_power_efficient_wq,
+                                   &reg_timeout, 0);
                 return -ENODEV;
         }
 
@@ -2354,7 +2492,8 @@ static int reg_set_rd_country_ie(const struct ieee80211_regdomain *rd,
 
         request_wiphy = wiphy_idx_to_wiphy(country_ie_request->wiphy_idx);
         if (!request_wiphy) {
-                schedule_delayed_work(&reg_timeout, 0);
+                queue_delayed_work(system_power_efficient_wq,
+                                   &reg_timeout, 0);
                 return -ENODEV;
         }
 
@@ -2433,26 +2572,6 @@ int set_regdom(const struct ieee80211_regdomain *rd)
         return 0;
 }
 
-int reg_device_uevent(struct device *dev, struct kobj_uevent_env *env)
-{
-        struct regulatory_request *lr;
-        u8 alpha2[2];
-        bool add = false;
-
-        rcu_read_lock();
-        lr = get_last_request();
-        if (lr && !lr->processed) {
-                memcpy(alpha2, lr->alpha2, 2);
-                add = true;
-        }
-        rcu_read_unlock();
-
-        if (add)
-                return add_uevent_var(env, "COUNTRY=%c%c",
-                                      alpha2[0], alpha2[1]);
-        return 0;
-}
-
 void wiphy_regulatory_register(struct wiphy *wiphy)
 {
         struct regulatory_request *lr;
@@ -2503,8 +2622,6 @@ int __init regulatory_init(void)
         if (IS_ERR(reg_pdev))
                 return PTR_ERR(reg_pdev);
 
-        reg_pdev->dev.type = &reg_device_type;
-
         spin_lock_init(&reg_requests_lock);
         spin_lock_init(&reg_pending_beacons_lock);
 
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index 02bd8f4b0921..37c180df34b7 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -26,7 +26,6 @@ enum nl80211_dfs_regions reg_get_dfs_region(struct wiphy *wiphy);
 int regulatory_hint_user(const char *alpha2,
                          enum nl80211_user_reg_hint_type user_reg_hint_type);
 
-int reg_device_uevent(struct device *dev, struct kobj_uevent_env *env);
 void wiphy_regulatory_register(struct wiphy *wiphy);
 void wiphy_regulatory_deregister(struct wiphy *wiphy);
 
@@ -34,6 +33,8 @@ int __init regulatory_init(void);
 void regulatory_exit(void);
 
 int set_regdom(const struct ieee80211_regdomain *rd);
+unsigned int reg_get_max_bandwidth(const struct ieee80211_regdomain *rd,
+                                   const struct ieee80211_reg_rule *rule);
 
 bool reg_last_request_cell_base(void);
 
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index d1ed4aebbbb7..7d09a712cb1f 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -659,9 +659,6 @@ static bool cfg80211_combine_bsses(struct cfg80211_registered_device *dev,
                         continue;
                 if (ssidlen && ie[1] != ssidlen)
                         continue;
-                /* that would be odd ... */
-                if (bss->pub.beacon_ies)
-                        continue;
                 if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
                         continue;
                 if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
@@ -680,7 +677,8 @@ static bool cfg80211_combine_bsses(struct cfg80211_registered_device *dev,
 /* Returned bss is reference counted and must be cleaned up appropriately. */
 static struct cfg80211_internal_bss *
 cfg80211_bss_update(struct cfg80211_registered_device *dev,
-                    struct cfg80211_internal_bss *tmp)
+                    struct cfg80211_internal_bss *tmp,
+                    bool signal_valid)
 {
         struct cfg80211_internal_bss *found = NULL;
 
@@ -765,7 +763,12 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                 }
 
                 found->pub.beacon_interval = tmp->pub.beacon_interval;
-                found->pub.signal = tmp->pub.signal;
+                /*
+                 * don't update the signal if beacon was heard on
+                 * adjacent channel.
+                 */
+                if (signal_valid)
+                        found->pub.signal = tmp->pub.signal;
                 found->pub.capability = tmp->pub.capability;
                 found->ts = tmp->ts;
         } else {
@@ -869,13 +872,14 @@ cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
 /* Returned bss is reference counted and must be cleaned up appropriately. */
 struct cfg80211_bss*
 cfg80211_inform_bss_width(struct wiphy *wiphy,
-                          struct ieee80211_channel *channel,
+                          struct ieee80211_channel *rx_channel,
                           enum nl80211_bss_scan_width scan_width,
                           const u8 *bssid, u64 tsf, u16 capability,
                           u16 beacon_interval, const u8 *ie, size_t ielen,
                           s32 signal, gfp_t gfp)
 {
         struct cfg80211_bss_ies *ies;
+        struct ieee80211_channel *channel;
         struct cfg80211_internal_bss tmp = {}, *res;
 
         if (WARN_ON(!wiphy))
@@ -885,7 +889,7 @@ cfg80211_inform_bss_width(struct wiphy *wiphy,
                         (signal < 0 || signal > 100)))
                 return NULL;
 
-        channel = cfg80211_get_bss_channel(wiphy, ie, ielen, channel);
+        channel = cfg80211_get_bss_channel(wiphy, ie, ielen, rx_channel);
         if (!channel)
                 return NULL;
 
@@ -913,7 +917,8 @@ cfg80211_inform_bss_width(struct wiphy *wiphy,
         rcu_assign_pointer(tmp.pub.beacon_ies, ies);
         rcu_assign_pointer(tmp.pub.ies, ies);
 
-        res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp);
+        res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp,
+                                  rx_channel == channel);
         if (!res)
                 return NULL;
 
@@ -929,20 +934,21 @@ EXPORT_SYMBOL(cfg80211_inform_bss_width);
 /* Returned bss is reference counted and must be cleaned up appropriately. */
 struct cfg80211_bss *
 cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
-                                struct ieee80211_channel *channel,
+                                struct ieee80211_channel *rx_channel,
                                 enum nl80211_bss_scan_width scan_width,
                                 struct ieee80211_mgmt *mgmt, size_t len,
                                 s32 signal, gfp_t gfp)
 {
         struct cfg80211_internal_bss tmp = {}, *res;
         struct cfg80211_bss_ies *ies;
+        struct ieee80211_channel *channel;
         size_t ielen = len - offsetof(struct ieee80211_mgmt,
                                       u.probe_resp.variable);
 
         BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
                         offsetof(struct ieee80211_mgmt, u.beacon.variable));
 
-        trace_cfg80211_inform_bss_width_frame(wiphy, channel, scan_width, mgmt,
+        trace_cfg80211_inform_bss_width_frame(wiphy, rx_channel, scan_width, mgmt,
                                               len, signal);
 
         if (WARN_ON(!mgmt))
@@ -959,7 +965,7 @@ cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
                 return NULL;
 
         channel = cfg80211_get_bss_channel(wiphy, mgmt->u.beacon.variable,
-                                           ielen, channel);
+                                           ielen, rx_channel);
         if (!channel)
                 return NULL;
 
@@ -983,7 +989,8 @@ cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
         tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
         tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
 
-        res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp);
+        res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp,
+                                  rx_channel == channel);
         if (!res)
                 return NULL;
 
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index f04d4c32e96e..acdcb4a81817 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -64,7 +64,6 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
         int n_channels, err;
 
         ASSERT_RTNL();
-        ASSERT_RDEV_LOCK(rdev);
         ASSERT_WDEV_LOCK(wdev);
 
         if (rdev->scan_req || rdev->scan_msg)
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index fbcc23edee54..aabccf13e07b 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -1468,9 +1468,10 @@ TRACE_EVENT(rdev_sched_scan_start,
 TRACE_EVENT(rdev_tdls_mgmt,
         TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
                  u8 *peer, u8 action_code, u8 dialog_token,
-                 u16 status_code, const u8 *buf, size_t len),
+                 u16 status_code, u32 peer_capability,
+                 const u8 *buf, size_t len),
         TP_ARGS(wiphy, netdev, peer, action_code, dialog_token, status_code,
-                buf, len),
+                peer_capability, buf, len),
         TP_STRUCT__entry(
                 WIPHY_ENTRY
                 NETDEV_ENTRY
@@ -1478,6 +1479,7 @@ TRACE_EVENT(rdev_tdls_mgmt,
                 __field(u8, action_code)
                 __field(u8, dialog_token)
                 __field(u16, status_code)
+                __field(u32, peer_capability)
                 __dynamic_array(u8, buf, len)
         ),
         TP_fast_assign(
@@ -1487,13 +1489,15 @@ TRACE_EVENT(rdev_tdls_mgmt,
                 __entry->action_code = action_code;
                 __entry->dialog_token = dialog_token;
                 __entry->status_code = status_code;
+                __entry->peer_capability = peer_capability;
                 memcpy(__get_dynamic_array(buf), buf, len);
         ),
         TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", " MAC_PR_FMT ", action_code: %u, "
-                  "dialog_token: %u, status_code: %u, buf: %#.2x ",
+                  "dialog_token: %u, status_code: %u, peer_capability: %u buf: %#.2x ",
                   WIPHY_PR_ARG, NETDEV_PR_ARG, MAC_PR_ARG(peer),
                   __entry->action_code, __entry->dialog_token,
-                  __entry->status_code, ((u8 *)__get_dynamic_array(buf))[0])
+                  __entry->status_code, __entry->peer_capability,
+                  ((u8 *)__get_dynamic_array(buf))[0])
 );
 
 TRACE_EVENT(rdev_dump_survey,
@@ -2278,11 +2282,6 @@ DECLARE_EVENT_CLASS(cfg80211_rx_evt,
         TP_printk(NETDEV_PR_FMT ", " MAC_PR_FMT, NETDEV_PR_ARG, MAC_PR_ARG(addr))
 );
 
-DEFINE_EVENT(cfg80211_rx_evt, cfg80211_ibss_joined,
-        TP_PROTO(struct net_device *netdev, const u8 *addr),
-        TP_ARGS(netdev, addr)
-);
-
 DEFINE_EVENT(cfg80211_rx_evt, cfg80211_rx_spurious_frame,
         TP_PROTO(struct net_device *netdev, const u8 *addr),
         TP_ARGS(netdev, addr)
@@ -2293,6 +2292,24 @@ DEFINE_EVENT(cfg80211_rx_evt, cfg80211_rx_unexpected_4addr_frame,
         TP_ARGS(netdev, addr)
 );
 
+TRACE_EVENT(cfg80211_ibss_joined,
+        TP_PROTO(struct net_device *netdev, const u8 *bssid,
+                 struct ieee80211_channel *channel),
+        TP_ARGS(netdev, bssid, channel),
+        TP_STRUCT__entry(
+                NETDEV_ENTRY
+                MAC_ENTRY(bssid)
+                CHAN_ENTRY
+        ),
+        TP_fast_assign(
+                NETDEV_ASSIGN;
+                MAC_ASSIGN(bssid, bssid);
+                CHAN_ASSIGN(channel);
+        ),
+        TP_printk(NETDEV_PR_FMT ", bssid: " MAC_PR_FMT ", " CHAN_PR_FMT,
+                  NETDEV_PR_ARG, MAC_PR_ARG(bssid), CHAN_PR_ARG)
+);
+
 TRACE_EVENT(cfg80211_probe_status,
         TP_PROTO(struct net_device *netdev, const u8 *addr, u64 cookie,
                  bool acked),
diff --git a/net/wireless/util.c b/net/wireless/util.c
index d39c37104ae2..e5872ff2c27c 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -11,6 +11,7 @@
 #include <net/ip.h>
 #include <net/dsfield.h>
 #include <linux/if_vlan.h>
+#include <linux/mpls.h>
 #include "core.h"
 #include "rdev-ops.h"
 
@@ -717,6 +718,21 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
         case htons(ETH_P_IPV6):
                 dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & 0xfc;
                 break;
+        case htons(ETH_P_MPLS_UC):
+        case htons(ETH_P_MPLS_MC): {
+                struct mpls_label mpls_tmp, *mpls;
+
+                mpls = skb_header_pointer(skb, sizeof(struct ethhdr),
+                                          sizeof(*mpls), &mpls_tmp);
+                if (!mpls)
+                        return 0;
+
+                return (ntohl(mpls->entry) & MPLS_LS_TC_MASK)
+                        >> MPLS_LS_TC_SHIFT;
+        }
+        case htons(ETH_P_80221):
+                /* 802.21 is always network control traffic */
+                return 7;
         default:
                 return 0;
         }
@@ -820,7 +836,8 @@ void cfg80211_process_wdev_events(struct wireless_dev *wdev)
                                                 ev->dc.reason, true);
                         break;
                 case EVENT_IBSS_JOINED:
-                        __cfg80211_ibss_joined(wdev->netdev, ev->ij.bssid);
+                        __cfg80211_ibss_joined(wdev->netdev, ev->ij.bssid,
+                                               ev->ij.channel);
                         break;
                 }
                 wdev_unlock(wdev);
@@ -837,7 +854,6 @@ void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev)
         struct wireless_dev *wdev;
 
         ASSERT_RTNL();
-        ASSERT_RDEV_LOCK(rdev);
 
         list_for_each_entry(wdev, &rdev->wdev_list, list)
                 cfg80211_process_wdev_events(wdev);
@@ -850,7 +866,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
         int err;
         enum nl80211_iftype otype = dev->ieee80211_ptr->iftype;
 
-        ASSERT_RDEV_LOCK(rdev);
+        ASSERT_RTNL();
 
         /* don't support changing VLANs, you just re-create them */
         if (otype == NL80211_IFTYPE_AP_VLAN)
@@ -885,7 +901,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
 
                 switch (otype) {
                 case NL80211_IFTYPE_AP:
-                        cfg80211_stop_ap(rdev, dev);
+                        cfg80211_stop_ap(rdev, dev, true);
                         break;
                 case NL80211_IFTYPE_ADHOC:
                         cfg80211_leave_ibss(rdev, dev, false);
@@ -1268,7 +1284,6 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
         enum cfg80211_chan_mode chmode;
         int num_different_channels = 0;
         int total = 1;
-        bool radar_required = false;
         int i, j;
 
         ASSERT_RTNL();
@@ -1276,35 +1291,7 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
         if (WARN_ON(hweight32(radar_detect) > 1))
                 return -EINVAL;
 
-        switch (iftype) {
-        case NL80211_IFTYPE_ADHOC:
-        case NL80211_IFTYPE_AP:
-        case NL80211_IFTYPE_AP_VLAN:
-        case NL80211_IFTYPE_MESH_POINT:
-        case NL80211_IFTYPE_P2P_GO:
-        case NL80211_IFTYPE_WDS:
-                /* if the interface could potentially choose a DFS channel,
-                 * then mark DFS as required.
-                 */
-                if (!chan) {
-                        if (chanmode != CHAN_MODE_UNDEFINED && radar_detect)
-                                radar_required = true;
-                        break;
-                }
-                radar_required = !!(chan->flags & IEEE80211_CHAN_RADAR);
-                break;
-        case NL80211_IFTYPE_P2P_CLIENT:
-        case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_P2P_DEVICE:
-        case NL80211_IFTYPE_MONITOR:
-                break;
-        case NUM_NL80211_IFTYPES:
-        case NL80211_IFTYPE_UNSPECIFIED:
-        default:
-                return -EINVAL;
-        }
-
-        if (radar_required && !radar_detect)
+        if (WARN_ON(iftype >= NUM_NL80211_IFTYPES))
                 return -EINVAL;
 
         /* Always allow software iftypes */
@@ -1356,7 +1343,7 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                  */
                 mutex_lock_nested(&wdev_iter->mtx, 1);
                 __acquire(wdev_iter->mtx);
-                cfg80211_get_chan_state(wdev_iter, &ch, &chmode);
+                cfg80211_get_chan_state(wdev_iter, &ch, &chmode, &radar_detect);
                 wdev_unlock(wdev_iter);
 
                 switch (chmode) {
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index 14c9a2583ba0..86c331a65664 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -21,7 +21,7 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
         const u8 *prev_bssid = NULL;
         int err, i;
 
-        ASSERT_RDEV_LOCK(rdev);
+        ASSERT_RTNL();
         ASSERT_WDEV_LOCK(wdev);
 
         if (!netif_running(wdev->netdev))
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 6177479c7de9..5ad4418ef093 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1064,7 +1064,7 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
         x25_start_heartbeat(make);
 
         if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk, skb->len);
+                sk->sk_data_ready(sk);
         rc = 1;
         sock_put(sk);
 out:
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index d1b0dc79bb6f..7ac50098a375 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -79,7 +79,7 @@ static int x25_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more)
         skb_set_owner_r(skbn, sk);
         skb_queue_tail(&sk->sk_receive_queue, skbn);
         if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk, skbn->len);
+                sk->sk_data_ready(sk);
 
         return 0;
 }
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 6c7ac016ce3a..85d1d4764612 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -16,6 +16,81 @@
 
 static struct kmem_cache *secpath_cachep __read_mostly;
 
+static DEFINE_SPINLOCK(xfrm_input_afinfo_lock);
+static struct xfrm_input_afinfo __rcu *xfrm_input_afinfo[NPROTO];
+
+int xfrm_input_register_afinfo(struct xfrm_input_afinfo *afinfo)
+{
+        int err = 0;
+
+        if (unlikely(afinfo == NULL))
+                return -EINVAL;
+        if (unlikely(afinfo->family >= NPROTO))
+                return -EAFNOSUPPORT;
+        spin_lock_bh(&xfrm_input_afinfo_lock);
+        if (unlikely(xfrm_input_afinfo[afinfo->family] != NULL))
+                err = -ENOBUFS;
+        else
+                rcu_assign_pointer(xfrm_input_afinfo[afinfo->family], afinfo);
+        spin_unlock_bh(&xfrm_input_afinfo_lock);
+        return err;
+}
+EXPORT_SYMBOL(xfrm_input_register_afinfo);
+
+int xfrm_input_unregister_afinfo(struct xfrm_input_afinfo *afinfo)
+{
+        int err = 0;
+
+        if (unlikely(afinfo == NULL))
+                return -EINVAL;
+        if (unlikely(afinfo->family >= NPROTO))
+                return -EAFNOSUPPORT;
+        spin_lock_bh(&xfrm_input_afinfo_lock);
+        if (likely(xfrm_input_afinfo[afinfo->family] != NULL)) {
+                if (unlikely(xfrm_input_afinfo[afinfo->family] != afinfo))
+                        err = -EINVAL;
+                else
+                        RCU_INIT_POINTER(xfrm_input_afinfo[afinfo->family], NULL);
+        }
+        spin_unlock_bh(&xfrm_input_afinfo_lock);
+        synchronize_rcu();
+        return err;
+}
+EXPORT_SYMBOL(xfrm_input_unregister_afinfo);
+
+static struct xfrm_input_afinfo *xfrm_input_get_afinfo(unsigned int family)
+{
+        struct xfrm_input_afinfo *afinfo;
+
+        if (unlikely(family >= NPROTO))
+                return NULL;
+        rcu_read_lock();
+        afinfo = rcu_dereference(xfrm_input_afinfo[family]);
+        if (unlikely(!afinfo))
+                rcu_read_unlock();
+        return afinfo;
+}
+
+static void xfrm_input_put_afinfo(struct xfrm_input_afinfo *afinfo)
+{
+        rcu_read_unlock();
+}
+
+static int xfrm_rcv_cb(struct sk_buff *skb, unsigned int family, u8 protocol,
+                       int err)
+{
+        int ret;
+        struct xfrm_input_afinfo *afinfo = xfrm_input_get_afinfo(family);
+
+        if (!afinfo)
+                return -EAFNOSUPPORT;
+
+        ret = afinfo->callback(skb, protocol, err);
+        xfrm_input_put_afinfo(afinfo);
+
+        return ret;
+}
+
 void __secpath_destroy(struct sec_path *sp)
 {
         int i;
@@ -108,7 +183,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
         int err;
         __be32 seq;
         __be32 seq_hi;
-        struct xfrm_state *x;
+        struct xfrm_state *x = NULL;
         xfrm_address_t *daddr;
         struct xfrm_mode *inner_mode;
         unsigned int family;
@@ -120,9 +195,14 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
                 async = 1;
                 x = xfrm_input_state(skb);
                 seq = XFRM_SKB_CB(skb)->seq.input.low;
+                family = x->outer_mode->afinfo->family;
                 goto resume;
         }
 
+        daddr = (xfrm_address_t *)(skb_network_header(skb) +
+                                   XFRM_SPI_SKB_CB(skb)->daddroff);
+        family = XFRM_SPI_SKB_CB(skb)->family;
+
         /* Allocate new secpath or COW existing one. */
         if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {
                 struct sec_path *sp;
@@ -137,10 +217,6 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
                 skb->sp = sp;
         }
 
-        daddr = (xfrm_address_t *)(skb_network_header(skb) +
-                                   XFRM_SPI_SKB_CB(skb)->daddroff);
-        family = XFRM_SPI_SKB_CB(skb)->family;
-
         seq = 0;
         if (!spi && (err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0) {
                 XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);
@@ -162,6 +238,11 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
 
                 skb->sp->xvec[skb->sp->len++] = x;
 
+                if (xfrm_tunnel_check(skb, x, family)) {
+                        XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMODEERROR);
+                        goto drop;
+                }
+
                 spin_lock(&x->lock);
                 if (unlikely(x->km.state == XFRM_STATE_ACQ)) {
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR);
@@ -201,7 +282,6 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
 
                 if (nexthdr == -EINPROGRESS)
                         return 0;
-
 resume:
                 spin_lock(&x->lock);
                 if (nexthdr <= 0) {
@@ -263,6 +343,10 @@ resume:
                 }
         } while (!err);
 
+        err = xfrm_rcv_cb(skb, family, x->type->proto, 0);
+        if (err)
+                goto drop;
+
         nf_reset(skb);
 
         if (decaps) {
@@ -276,6 +360,7 @@ resume:
 drop_unlock:
         spin_unlock(&x->lock);
 drop:
+        xfrm_rcv_cb(skb, family, x && x->type ? x->type->proto : nexthdr, -1);
         kfree_skb(skb);
         return 0;
 }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 1d5c7bf29938..c08fbd11ceff 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -39,8 +39,6 @@
 #define XFRM_QUEUE_TMO_MAX ((unsigned)(60*HZ))
 #define XFRM_MAX_QUEUE_LEN      100
 
-static struct dst_entry *xfrm_policy_sk_bundles;
-
 static DEFINE_SPINLOCK(xfrm_policy_afinfo_lock);
 static struct xfrm_policy_afinfo __rcu *xfrm_policy_afinfo[NPROTO]
                                                 __read_mostly;
@@ -661,7 +659,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
                 hlist_add_head(&policy->bydst, chain);
         xfrm_pol_hold(policy);
         net->xfrm.policy_count[dir]++;
-        atomic_inc(&flow_cache_genid);
+        atomic_inc(&net->xfrm.flow_cache_genid);
 
         /* After previous checking, family can either be AF_INET or AF_INET6 */
         if (policy->family == AF_INET)
@@ -1844,7 +1842,7 @@ purge_queue:
         xfrm_pol_put(pol);
 }
 
-static int xdst_queue_output(struct sk_buff *skb)
+static int xdst_queue_output(struct sock *sk, struct sk_buff *skb)
 {
         unsigned long sched_next;
         struct dst_entry *dst = skb_dst(skb);
@@ -2109,13 +2107,6 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
                                 goto no_transform;
                         }
 
-                        dst_hold(&xdst->u.dst);
-
-                        spin_lock_bh(&net->xfrm.xfrm_policy_sk_bundle_lock);
-                        xdst->u.dst.next = xfrm_policy_sk_bundles;
-                        xfrm_policy_sk_bundles = &xdst->u.dst;
-                        spin_unlock_bh(&net->xfrm.xfrm_policy_sk_bundle_lock);
-
                         route = xdst->route;
                 }
         }
@@ -2549,33 +2540,15 @@ static struct dst_entry *xfrm_negative_advice(struct dst_entry *dst)
         return dst;
 }
 
-static void __xfrm_garbage_collect(struct net *net)
-{
-        struct dst_entry *head, *next;
-
-        spin_lock_bh(&net->xfrm.xfrm_policy_sk_bundle_lock);
-        head = xfrm_policy_sk_bundles;
-        xfrm_policy_sk_bundles = NULL;
-        spin_unlock_bh(&net->xfrm.xfrm_policy_sk_bundle_lock);
-
-        while (head) {
-                next = head->next;
-                dst_free(head);
-                head = next;
-        }
-}
-
 void xfrm_garbage_collect(struct net *net)
 {
-        flow_cache_flush();
-        __xfrm_garbage_collect(net);
+        flow_cache_flush(net);
 }
 EXPORT_SYMBOL(xfrm_garbage_collect);
 
 static void xfrm_garbage_collect_deferred(struct net *net)
 {
-        flow_cache_flush_deferred();
-        __xfrm_garbage_collect(net);
+        flow_cache_flush_deferred(net);
 }
 
 static void xfrm_init_pmtu(struct dst_entry *dst)
@@ -2940,15 +2913,19 @@ static int __net_init xfrm_net_init(struct net *net)
         rv = xfrm_sysctl_init(net);
         if (rv < 0)
                 goto out_sysctl;
+        rv = flow_cache_init(net);
+        if (rv < 0)
+                goto out;
 
         /* Initialize the per-net locks here */
         spin_lock_init(&net->xfrm.xfrm_state_lock);
         rwlock_init(&net->xfrm.xfrm_policy_lock);
-        spin_lock_init(&net->xfrm.xfrm_policy_sk_bundle_lock);
         mutex_init(&net->xfrm.xfrm_cfg_mutex);
 
         return 0;
 
+out:
+        xfrm_sysctl_fini(net);
 out_sysctl:
         xfrm_policy_fini(net);
 out_policy:
@@ -2961,6 +2938,7 @@ out_statistics:
 
 static void __net_exit xfrm_net_exit(struct net *net)
 {
+        flow_cache_fini(net);
         xfrm_sysctl_fini(net);
         xfrm_policy_fini(net);
         xfrm_state_fini(net);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 40f1b3e92e78..8e9c781a6bba 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -161,6 +161,7 @@ static DEFINE_SPINLOCK(xfrm_state_gc_lock);
 int __xfrm_state_delete(struct xfrm_state *x);
 
 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
+bool km_is_alive(const struct km_event *c);
 void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
 
 static DEFINE_SPINLOCK(xfrm_type_lock);
@@ -788,6 +789,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
         struct xfrm_state *best = NULL;
         u32 mark = pol->mark.v & pol->mark.m;
         unsigned short encap_family = tmpl->encap_family;
+        struct km_event c;
 
         to_put = NULL;
 
@@ -832,6 +834,17 @@ found:
                         error = -EEXIST;
                         goto out;
                 }
+
+                c.net = net;
+                /* If the KMs have no listeners (yet...), avoid allocating an SA
+                 * for each and every packet - garbage collection might not
+                 * handle the flood.
+                 */
+                if (!km_is_alive(&c)) {
+                        error = -ESRCH;
+                        goto out;
+                }
+
                 x = xfrm_state_alloc(net);
                 if (x == NULL) {
                         error = -ENOMEM;
@@ -1135,10 +1148,9 @@ out:
 EXPORT_SYMBOL(xfrm_state_add);
 
 #ifdef CONFIG_XFRM_MIGRATE
-static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
+static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig)
 {
         struct net *net = xs_net(orig);
-        int err = -ENOMEM;
         struct xfrm_state *x = xfrm_state_alloc(net);
         if (!x)
                 goto out;
@@ -1192,15 +1204,13 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
         }
 
         if (orig->replay_esn) {
-                err = xfrm_replay_clone(x, orig);
-                if (err)
+                if (xfrm_replay_clone(x, orig))
                         goto error;
         }
 
         memcpy(&x->mark, &orig->mark, sizeof(x->mark));
 
-        err = xfrm_init_state(x);
-        if (err)
+        if (xfrm_init_state(x) < 0)
                 goto error;
 
         x->props.flags = orig->props.flags;
@@ -1218,8 +1228,6 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
  error:
         xfrm_state_put(x);
 out:
-        if (errp)
-                *errp = err;
         return NULL;
 }
 
@@ -1274,9 +1282,8 @@ struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
                                       struct xfrm_migrate *m)
 {
         struct xfrm_state *xc;
-        int err;
 
-        xc = xfrm_state_clone(x, &err);
+        xc = xfrm_state_clone(x);
         if (!xc)
                 return NULL;
 
@@ -1289,7 +1296,7 @@ struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
                    state is to be updated as it is a part of triplet */
                 xfrm_state_insert(xc);
         } else {
-                if ((err = xfrm_state_add(xc)) < 0)
+                if (xfrm_state_add(xc) < 0)
                         goto error;
         }
 
@@ -1601,6 +1608,23 @@ unlock:
 }
 EXPORT_SYMBOL(xfrm_alloc_spi);
 
+static bool __xfrm_state_filter_match(struct xfrm_state *x,
+                                      struct xfrm_address_filter *filter)
+{
+        if (filter) {
+                if ((filter->family == AF_INET ||
+                     filter->family == AF_INET6) &&
+                    x->props.family != filter->family)
+                        return false;
+
+                return addr_match(&x->props.saddr, &filter->saddr,
+                                  filter->splen) &&
+                       addr_match(&x->id.daddr, &filter->daddr,
+                                  filter->dplen);
+        }
+        return true;
+}
+
 int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
                     int (*func)(struct xfrm_state *, int, void*),
                     void *data)
@@ -1623,6 +1647,8 @@ int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
                 state = container_of(x, struct xfrm_state, km);
                 if (!xfrm_id_proto_match(state->id.proto, walk->proto))
                         continue;
+                if (!__xfrm_state_filter_match(state, walk->filter))
+                        continue;
                 err = func(state, walk->seq, data);
                 if (err) {
                         list_move_tail(&walk->all, &x->all);
@@ -1641,17 +1667,21 @@ out:
 }
 EXPORT_SYMBOL(xfrm_state_walk);
 
-void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto)
+void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
+                          struct xfrm_address_filter *filter)
 {
         INIT_LIST_HEAD(&walk->all);
         walk->proto = proto;
         walk->state = XFRM_STATE_DEAD;
         walk->seq = 0;
+        walk->filter = filter;
 }
 EXPORT_SYMBOL(xfrm_state_walk_init);
 
 void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net)
 {
+        kfree(walk->filter);
+
         if (list_empty(&walk->all))
                 return;
 
@@ -1804,6 +1834,24 @@ int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address
 }
 EXPORT_SYMBOL(km_report);
 
+bool km_is_alive(const struct km_event *c)
+{
+        struct xfrm_mgr *km;
+        bool is_alive = false;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(km, &xfrm_km_list, list) {
+                if (km->is_alive && km->is_alive(c)) {
+                        is_alive = true;
+                        break;
+                }
+        }
+        rcu_read_unlock();
+
+        return is_alive;
+}
+EXPORT_SYMBOL(km_is_alive);
+
 int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
 {
         int err;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 2f7ddc3a59b4..8f131c10a6f3 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -137,7 +137,8 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
         if (!rt)
                 return 0;
 
-        if (p->id.proto != IPPROTO_ESP)
+        /* As only ESP and AH support ESN feature. */
+        if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH))
                 return -EINVAL;
 
         if (p->replay_window != 0)
@@ -881,6 +882,7 @@ static int xfrm_dump_sa_done(struct netlink_callback *cb)
         return 0;
 }
 
+static const struct nla_policy xfrma_policy[XFRMA_MAX+1];
 static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
@@ -896,8 +898,31 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
         info.nlmsg_flags = NLM_F_MULTI;
 
         if (!cb->args[0]) {
+                struct nlattr *attrs[XFRMA_MAX+1];
+                struct xfrm_address_filter *filter = NULL;
+                u8 proto = 0;
+                int err;
+
                 cb->args[0] = 1;
-                xfrm_state_walk_init(walk, 0);
+
+                err = nlmsg_parse(cb->nlh, 0, attrs, XFRMA_MAX,
+                                  xfrma_policy);
+                if (err < 0)
+                        return err;
+
+                if (attrs[XFRMA_ADDRESS_FILTER]) {
+                        filter = kmalloc(sizeof(*filter), GFP_KERNEL);
+                        if (filter == NULL)
+                                return -ENOMEM;
+
+                        memcpy(filter, nla_data(attrs[XFRMA_ADDRESS_FILTER]),
+                               sizeof(*filter));
+                }
+
+                if (attrs[XFRMA_PROTO])
+                        proto = nla_get_u8(attrs[XFRMA_PROTO]);
+
+                xfrm_state_walk_init(walk, proto, filter);
         }
 
         (void) xfrm_state_walk(net, walk, dump_one_state, &info);
@@ -2303,6 +2328,8 @@ static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
         [XFRMA_TFCPAD]          = { .type = NLA_U32 },
         [XFRMA_REPLAY_ESN_VAL]  = { .len = sizeof(struct xfrm_replay_state_esn) },
         [XFRMA_SA_EXTRA_FLAGS]  = { .type = NLA_U32 },
+        [XFRMA_PROTO]           = { .type = NLA_U8 },
+        [XFRMA_ADDRESS_FILTER]  = { .len = sizeof(struct xfrm_address_filter) },
 };
 
 static const struct xfrm_link {
@@ -2976,6 +3003,11 @@ static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
         return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MAPPING, GFP_ATOMIC);
 }
 
+static bool xfrm_is_alive(const struct km_event *c)
+{
+        return (bool)xfrm_acquire_is_on(c->net);
+}
+
 static struct xfrm_mgr netlink_mgr = {
         .id             = "netlink",
         .notify         = xfrm_send_state_notify,
@@ -2985,6 +3017,7 @@ static struct xfrm_mgr netlink_mgr = {
         .report         = xfrm_send_report,
         .migrate        = xfrm_send_migrate,
         .new_mapping    = xfrm_send_mapping,
+        .is_alive       = xfrm_is_alive,
 };
 
 static int __net_init xfrm_user_net_init(struct net *net)