Merge branch 'android-4.4@c71ad0f' into branch 'msm-4.4'

* refs/heads/tmp-c71ad0f:
  BACKPORT: arm64: dts: juno: fix cluster sleep state entry latency on all SoC versions
  staging: android: ashmem: lseek failed due to no FMODE_LSEEK.
  ANDROID: sdcardfs: update module info
  ANDROID: sdcardfs: use d_splice_alias
  ANDROID: sdcardfs: add read_iter/write_iter opeations
  ANDROID: sdcardfs: fix ->llseek to update upper and lower offset
  ANDROID: sdcardfs: copy lower inode attributes in ->ioctl
  ANDROID: sdcardfs: remove unnecessary call to do_munmap
  Merge 4.4.59 into android-4.4
  UPSTREAM: ipv6 addrconf: implement RFC7559 router solicitation backoff
  android: base-cfg: enable CONFIG_INET_DIAG_DESTROY
  ANDROID: android-base.cfg: add CONFIG_MODULES option
  ANDROID: android-base.cfg: add CONFIG_IKCONFIG option
  ANDROID: android-base.cfg: properly sort the file
  ANDROID: binder: add hwbinder,vndbinder to BINDER_DEVICES.
  ANDROID: sort android-recommended.cfg
  UPSTREAM: config/android: Remove CONFIG_IPV6_PRIVACY
  UPSTREAM: config: android: set SELinux as default security mode
  config: android: move device mapper options to recommended
  ANDROID: ARM64: Allow to choose appended kernel image
  UPSTREAM: arm64: vdso: constify vm_special_mapping used for aarch32 vectors page
  UPSTREAM: arm64: vdso: add __init section marker to alloc_vectors_page
  UPSTREAM: ARM: 8597/1: VDSO: put RO and RO after init objects into proper sections
  UPSTREAM: arm64: Add support for CLOCK_MONOTONIC_RAW in clock_gettime() vDSO
  UPSTREAM: arm64: Refactor vDSO time functions
  UPSTREAM: arm64: fix vdso-offsets.h dependency
  UPSTREAM: kbuild: drop FORCE from PHONY targets
  UPSTREAM: mm: add PHYS_PFN, use it in __phys_to_pfn()
  UPSTREAM: ARM: 8476/1: VDSO: use PTR_ERR_OR_ZERO for vma check
  Linux 4.4.58
  crypto: algif_hash - avoid zero-sized array
  fbcon: Fix vc attr at deinit
  serial: 8250_pci: Detach low-level driver during PCI error recovery
  ACPI / blacklist: Make Dell Latitude 3350 ethernet work
  ACPI / blacklist: add _REV quirks for Dell Precision 5520 and 3520
  uvcvideo: uvc_scan_fallback() for webcams with broken chain
  s390/zcrypt: Introduce CEX6 toleration
  block: allow WRITE_SAME commands with the SG_IO ioctl
  vfio/spapr: Postpone allocation of userspace version of TCE table
  PCI: Do any VF BAR updates before enabling the BARs
  PCI: Ignore BAR updates on virtual functions
  PCI: Update BARs using property bits appropriate for type
  PCI: Don't update VF BARs while VF memory space is enabled
  PCI: Decouple IORESOURCE_ROM_ENABLE and PCI_ROM_ADDRESS_ENABLE
  PCI: Add comments about ROM BAR updating
  PCI: Remove pci_resource_bar() and pci_iov_resource_bar()
  PCI: Separate VF BAR updates from standard BAR updates
  x86/hyperv: Handle unknown NMIs on one CPU when unknown_nmi_panic
  igb: add i211 to i210 PHY workaround
  igb: Workaround for igb i210 firmware issue
  xen: do not re-use pirq number cached in pci device msi msg data
  xfs: clear _XBF_PAGES from buffers when readahead page
  USB: usbtmc: add missing endpoint sanity check
  nl80211: fix dumpit error path RTNL deadlocks
  xfs: fix up xfs_swap_extent_forks inline extent handling
  xfs: don't allow di_size with high bit set
  libceph: don't set weight to IN when OSD is destroyed
  raid10: increment write counter after bio is split
  cpufreq: Restore policy min/max limits on CPU online
  ARM: dts: at91: sama5d2: add dma properties to UART nodes
  ARM: at91: pm: cpu_idle: switch DDR to power-down mode
  iommu/vt-d: Fix NULL pointer dereference in device_to_iommu
  xen/acpi: upload PM state from init-domain to Xen
  mmc: sdhci: Do not disable interrupts while waiting for clock
  ext4: mark inode dirty after converting inline directory
  parport: fix attempt to write duplicate procfiles
  iio: hid-sensor-trigger: Change get poll value function order to avoid sensor properties losing after resume from S3
  iio: adc: ti_am335x_adc: fix fifo overrun recovery
  mmc: ushc: fix NULL-deref at probe
  uwb: hwa-rc: fix NULL-deref at probe
  uwb: i1480-dfu: fix NULL-deref at probe
  usb: hub: Fix crash after failure to read BOS descriptor
  usb: musb: cppi41: don't check early-TX-interrupt for Isoch transfer
  USB: wusbcore: fix NULL-deref at probe
  USB: idmouse: fix NULL-deref at probe
  USB: lvtest: fix NULL-deref at probe
  USB: uss720: fix NULL-deref at probe
  usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk
  usb: gadget: f_uvc: Fix SuperSpeed companion descriptor's wBytesPerInterval
  ACM gadget: fix endianness in notifications
  USB: serial: qcserial: add Dell DW5811e
  USB: serial: option: add Quectel UC15, UC20, EC21, and EC25 modems
  ALSA: hda - Adding a group of pin definition to fix headset problem
  ALSA: ctxfi: Fix the incorrect check of dma_set_mask() call
  ALSA: seq: Fix racy cell insertions during snd_seq_pool_done()
  Input: sur40 - validate number of endpoints before using them
  Input: kbtab - validate number of endpoints before using them
  Input: cm109 - validate number of endpoints before using them
  Input: yealink - validate number of endpoints before using them
  Input: hanwang - validate number of endpoints before using them
  Input: ims-pcu - validate number of endpoints before using them
  Input: iforce - validate number of endpoints before using them
  Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000
  Input: elan_i2c - add ASUS EeeBook X205TA special touchpad fw
  tcp: initialize icsk_ack.lrcvtime at session start time
  socket, bpf: fix sk_filter use after free in sk_clone_lock
  ipv4: provide stronger user input validation in nl_fib_input()
  net: bcmgenet: remove bcmgenet_internal_phy_setup()
  net/mlx5e: Count LRO packets correctly
  net/mlx5: Increase number of max QPs in default profile
  net: unix: properly re-increment inflight counter of GC discarded candidates
  amd-xgbe: Fix jumbo MTU processing on newer hardware
  net: properly release sk_frag.page
  net: bcmgenet: Do not suspend PHY if Wake-on-LAN is enabled
  net/openvswitch: Set the ipv6 source tunnel key address attribute correctly
  Linux 4.4.57
  ext4: fix fencepost in s_first_meta_bg validation
  percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages
  gfs2: Avoid alignment hole in struct lm_lockname
  isdn/gigaset: fix NULL-deref at probe
  target: Fix VERIFY_16 handling in sbc_parse_cdb
  scsi: libiscsi: add lock around task lists to fix list corruption regression
  scsi: lpfc: Add shutdown method for kexec
  target/pscsi: Fix TYPE_TAPE + TYPE_MEDIMUM_CHANGER export
  md/raid1/10: fix potential deadlock
  powerpc/boot: Fix zImage TOC alignment
  cpufreq: Fix and clean up show_cpuinfo_cur_freq()
  perf/core: Fix event inheritance on fork()
  give up on gcc ilog2() constant optimizations
  kernek/fork.c: allocate idle task for a CPU always on its local node
  hv_netvsc: use skb_get_hash() instead of a homegrown implementation
  tpm_tis: Use devm_free_irq not free_irq
  drm/amdgpu: add missing irq.h include
  s390/pci: fix use after free in dma_init
  KVM: PPC: Book3S PR: Fix illegal opcode emulation
  xen/qspinlock: Don't kick CPU if IRQ is not initialized
  Drivers: hv: avoid vfree() on crash
  Drivers: hv: balloon: don't crash when memory is added in non-sorted order
  pinctrl: cherryview: Do not mask all interrupts in probe
  ACPI / video: skip evaluating _DOD when it does not exist
  cxlflash: Increase cmd_per_lun for better throughput
  crypto: mcryptd - Fix load failure
  crypto: cryptd - Assign statesize properly
  crypto: ghash-clmulni - Fix load failure
  USB: don't free bandwidth_mutex too early
  usb: core: hub: hub_port_init lock controller instead of bus
  ANDROID: sdcardfs: Fix style issues in macros
  ANDROID: sdcardfs: Use seq_puts over seq_printf
  ANDROID: sdcardfs: Use to kstrout
  ANDROID: sdcardfs: Use pr_[...] instead of printk
  ANDROID: sdcardfs: remove unneeded null check
  ANDROID: sdcardfs: Fix style issues with comments
  ANDROID: sdcardfs: Fix formatting
  ANDROID: sdcardfs: correct order of descriptors
  fix the deadlock in xt_qtaguid when enable DDEBUG
  net: ipv6: Add sysctl for minimum prefix len acceptable in RIOs.
  Linux 4.4.56
  futex: Add missing error handling to FUTEX_REQUEUE_PI
  futex: Fix potential use-after-free in FUTEX_REQUEUE_PI
  x86/perf: Fix CR4.PCE propagation to use active_mm instead of mm
  x86/kasan: Fix boot with KASAN=y and PROFILE_ANNOTATED_BRANCHES=y
  fscrypto: lock inode while setting encryption policy
  fscrypt: fix renaming and linking special files
  net sched actions: decrement module reference count after table flush.
  dccp: fix memory leak during tear-down of unsuccessful connection request
  dccp/tcp: fix routing redirect race
  bridge: drop netfilter fake rtable unconditionally
  ipv6: avoid write to a possibly cloned skb
  ipv6: make ECMP route replacement less greedy
  mpls: Send route delete notifications when router module is unloaded
  act_connmark: avoid crashing on malformed nlattrs with null parms
  uapi: fix linux/packet_diag.h userspace compilation error
  vrf: Fix use-after-free in vrf_xmit
  dccp: fix use-after-free in dccp_feat_activate_values
  net: fix socket refcounting in skb_complete_tx_timestamp()
  net: fix socket refcounting in skb_complete_wifi_ack()
  tcp: fix various issues for sockets morphing to listen state
  dccp: Unlock sock before calling sk_free()
  net: net_enable_timestamp() can be called from irq contexts
  net: don't call strlen() on the user buffer in packet_bind_spkt()
  l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv
  ipv4: mask tos for input route
  vti6: return GRE_KEY for vti6
  vxlan: correctly validate VXLAN ID against VXLAN_N_VID
  netlink: remove mmapped netlink support
  ANDROID: mmc: core: export emmc revision
  BACKPORT: mmc: core: Export device lifetime information through sysfs
  ANDROID: android-verity: do not compile as independent module
  ANDROID: sched: fix duplicate sched_group_energy const specifiers
  config: disable CONFIG_USELIB and CONFIG_FHANDLE
  ANDROID: power: align wakeup_sources format
  ANDROID: dm: android-verity: allow disable dm-verity for Treble VTS
  uid_sys_stats: change to use rt_mutex
  ANDROID: vfs: user permission2 in notify_change2
  ANDROID: sdcardfs: Fix gid issue
  ANDROID: sdcardfs: Use tabs instead of spaces in multiuser.h
  ANDROID: sdcardfs: Remove uninformative prints
  ANDROID: sdcardfs: move path_put outside of spinlock
  ANDROID: sdcardfs: Use case insensitive hash function
  ANDROID: sdcardfs: declare MODULE_ALIAS_FS
  ANDROID: sdcardfs: Get the blocksize from the lower fs
  ANDROID: sdcardfs: Use d_invalidate instead of drop_recurisve
  ANDROID: sdcardfs: Switch to internal case insensitive compare
  ANDROID: sdcardfs: Use spin_lock_nested
  ANDROID: sdcardfs: Replace get/put with d_lock
  ANDROID: sdcardfs: rate limit warning print
  ANDROID: sdcardfs: Fix case insensitive lookup
  ANDROID: uid_sys_stats: account for fsync syscalls
  ANDROID: sched: add a counter to track fsync
  ANDROID: uid_sys_stats: fix negative write bytes.
  ANDROID: uid_sys_stats: allow writing same state
  ANDROID: uid_sys_stats: rename uid_cputime.c to uid_sys_stats.c
  ANDROID: uid_cputime: add per-uid IO usage accounting
  DTB: Add EAS compatible Juno Energy model to 'juno.dts'
  arm64: dts: juno: Add idle-states to device tree
  ANDROID: Replace spaces by '_' for some android filesystem tracepoints.
  usb: gadget: f_accessory: Fix for UsbAccessory clean unbind.
  android: binder: move global binder state into context struct.
  android: binder: add padding to binder_fd_array_object.
  binder: use group leader instead of open thread
  nf: IDLETIMER: Use fullsock when querying uid
  nf: IDLETIMER: Fix use after free condition during work
  ANDROID: dm: android-verity: fix table_make_digest() error handling
  ANDROID: usb: gadget: function: Fix commenting style
  cpufreq: interactive governor drops bits in time calculation
  ANDROID: sdcardfs: support direct-IO (DIO) operations
  ANDROID: sdcardfs: implement vm_ops->page_mkwrite
  ANDROID: sdcardfs: Don't bother deleting freelist
  ANDROID: sdcardfs: Add missing path_put
  ANDROID: sdcardfs: Fix incorrect hash
  ANDROID: ext4 crypto: Disables zeroing on truncation when there's no key
  ANDROID: ext4: add a non-reversible key derivation method
  ANDROID: ext4: allow encrypting filenames using HEH algorithm
  ANDROID: arm64/crypto: add ARMv8-CE optimized poly_hash algorithm
  ANDROID: crypto: heh - factor out poly_hash algorithm
  ANDROID: crypto: heh - Add Hash-Encrypt-Hash (HEH) algorithm
  ANDROID: crypto: gf128mul - Add ble multiplication functions
  ANDROID: crypto: gf128mul - Refactor gf128 overflow macros and tables
  UPSTREAM: crypto: gf128mul - Zero memory when freeing multiplication table
  ANDROID: crypto: shash - Add crypto_grab_shash() and crypto_spawn_shash_alg()
  ANDROID: crypto: allow blkcipher walks over ablkcipher data
  UPSTREAM: arm/arm64: crypto: assure that ECB modes don't require an IV
  ANDROID: Refactor fs readpage/write tracepoints.
  ANDROID: export security_path_chown
  Squashfs: optimize reading uncompressed data
  Squashfs: implement .readpages()
  Squashfs: replace buffer_head with BIO
  Squashfs: refactor page_actor
  Squashfs: remove the FILE_CACHE option
  ANDROID: android-recommended.cfg: CONFIG_CPU_SW_DOMAIN_PAN=y
  FROMLIST: 9p: fix a potential acl leak
  BACKPORT: posix_acl: Clear SGID bit when setting file permissions
  UPSTREAM: udp: properly support MSG_PEEK with truncated buffers
  UPSTREAM: arm64: Allow hw watchpoint of length 3,5,6 and 7
  BACKPORT: arm64: hw_breakpoint: Handle inexact watchpoint addresses
  UPSTREAM: arm64: Allow hw watchpoint at varied offset from base address
  BACKPORT: hw_breakpoint: Allow watchpoint of length 3,5,6 and 7
  ANDROID: sdcardfs: Switch strcasecmp for internal call
  ANDROID: sdcardfs: switch to full_name_hash and qstr
  ANDROID: sdcardfs: Add GID Derivation to sdcardfs
  ANDROID: sdcardfs: Remove redundant operation
  ANDROID: sdcardfs: add support for user permission isolation
  ANDROID: sdcardfs: Refactor configfs interface
  ANDROID: sdcardfs: Allow non-owners to touch
  ANDROID: binder: fix format specifier for type binder_size_t
  ANDROID: fs: Export vfs_rmdir2
  ANDROID: fs: Export free_fs_struct and set_fs_pwd
  BACKPORT: Input: xpad - validate USB endpoint count during probe
  BACKPORT: Input: xpad - fix oops when attaching an unknown Xbox One gamepad
  ANDROID: mnt: remount should propagate to slaves of slaves
  ANDROID: sdcardfs: Switch ->d_inode to d_inode()
  ANDROID: sdcardfs: Fix locking issue with permision fix up
  ANDROID: sdcardfs: Change magic value
  ANDROID: sdcardfs: Use per mount permissions
  ANDROID: sdcardfs: Add gid and mask to private mount data
  ANDROID: sdcardfs: User new permission2 functions
  ANDROID: vfs: Add setattr2 for filesystems with per mount permissions
  ANDROID: vfs: Add permission2 for filesystems with per mount permissions
  ANDROID: vfs: Allow filesystems to access their private mount data
  ANDROID: mnt: Add filesystem private data to mount points
  ANDROID: sdcardfs: Move directory unlock before touch
  ANDROID: sdcardfs: fix external storage exporting incorrect uid
  ANDROID: sdcardfs: Added top to sdcardfs_inode_info
  ANDROID: sdcardfs: Switch package list to RCU
  ANDROID: sdcardfs: Fix locking for permission fix up
  ANDROID: sdcardfs: Check for other cases on path lookup
  ANDROID: sdcardfs: override umask on mkdir and create
  arm64: kernel: Fix build warning
  DEBUG: sched/fair: Fix sched_load_avg_cpu events for task_groups
  DEBUG: sched/fair: Fix missing sched_load_avg_cpu events
  UPSTREAM: l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind()
  UPSTREAM: packet: fix race condition in packet_set_ring
  UPSTREAM: netlink: Fix dump skb leak/double free
  UPSTREAM: net: avoid signed overflows for SO_{SND|RCV}BUFFORCE
  MIPS: Prevent "restoration" of MSA context in non-MSA kernels
  net: socket: don't set sk_uid to garbage value in ->setattr()
  ANDROID: configs: CONFIG_ARM64_SW_TTBR0_PAN=y
  UPSTREAM: arm64: Disable PAN on uaccess_enable()
  UPSTREAM: arm64: Enable CONFIG_ARM64_SW_TTBR0_PAN
  UPSTREAM: arm64: xen: Enable user access before a privcmd hvc call
  UPSTREAM: arm64: Handle faults caused by inadvertent user access with PAN enabled
  BACKPORT: arm64: Disable TTBR0_EL1 during normal kernel execution
  BACKPORT: arm64: Introduce uaccess_{disable,enable} functionality based on TTBR0_EL1
  BACKPORT: arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro
  BACKPORT: arm64: Factor out PAN enabling/disabling into separate uaccess_* macros
  UPSTREAM: arm64: alternative: add auto-nop infrastructure
  UPSTREAM: arm64: barriers: introduce nops and __nops macros for NOP sequences
  Revert "FROMLIST: arm64: Factor out PAN enabling/disabling into separate uaccess_* macros"
  Revert "FROMLIST: arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro"
  Revert "FROMLIST: arm64: Introduce uaccess_{disable,enable} functionality based on TTBR0_EL1"
  Revert "FROMLIST: arm64: Disable TTBR0_EL1 during normal kernel execution"
  Revert "FROMLIST: arm64: Handle faults caused by inadvertent user access with PAN enabled"
  Revert "FROMLIST: arm64: xen: Enable user access before a privcmd hvc call"
  Revert "FROMLIST: arm64: Enable CONFIG_ARM64_SW_TTBR0_PAN"
  ANDROID: sched/walt: fix build failure if FAIR_GROUP_SCHED=n
  ANDROID: trace: net: use %pK for kernel pointers
  ANDROID: android-base: Enable QUOTA related configs
  net: ipv4: Don't crash if passing a null sk to ip_rt_update_pmtu.
  net: inet: Support UID-based routing in IP protocols.
  net: core: add UID to flows, rules, and routes
  net: core: Add a UID field to struct sock.
  Revert "net: core: Support UID-based routing."
  UPSTREAM: efi/arm64: Don't apply MEMBLOCK_NOMAP to UEFI memory map mapping
  UPSTREAM: arm64: mm: always take dirty state from new pte in ptep_set_access_flags
  UPSTREAM: arm64: Implement pmdp_set_access_flags() for hardware AF/DBM
  UPSTREAM: arm64: Fix typo in the pmdp_huge_get_and_clear() definition
  UPSTREAM: arm64: enable CONFIG_DEBUG_RODATA by default
  goldfish: enable CONFIG_INET_DIAG_DESTROY
  sched/walt: kill {min,max}_capacity
  sched: fix wrong truncation of walt_avg
  build: fix build config kernel_dir
  ANDROID: dm verity: add minimum prefetch size
  build: add build server configs for goldfish
  usb: gadget: Fix compilation problem with tx_qlen field

Conflicts:
	android/configs/android-base.cfg
	arch/arm64/Makefile
	arch/arm64/include/asm/cpufeature.h
	arch/arm64/kernel/vdso/gettimeofday.S
	arch/arm64/mm/cache.S
	drivers/md/Kconfig
	drivers/misc/Makefile
	drivers/mmc/host/sdhci.c
	drivers/usb/core/hcd.c
	drivers/usb/gadget/function/u_ether.c
	fs/sdcardfs/derived_perm.c
	fs/sdcardfs/file.c
	fs/sdcardfs/inode.c
	fs/sdcardfs/lookup.c
	fs/sdcardfs/main.c
	fs/sdcardfs/multiuser.h
	fs/sdcardfs/packagelist.c
	fs/sdcardfs/sdcardfs.h
	fs/sdcardfs/super.c
	include/linux/mmc/card.h
	include/linux/mmc/mmc.h
	include/trace/events/android_fs.h
	include/trace/events/android_fs_template.h
	drivers/android/binder.c
	fs/exec.c
	fs/ext4/crypto_key.c
	fs/ext4/ext4.h
	fs/ext4/inline.c
	fs/ext4/inode.c
	fs/ext4/readpage.c
	fs/f2fs/data.c
	fs/f2fs/inline.c
	fs/mpage.c
	include/linux/dcache.h
	include/trace/events/sched.h
	include/uapi/linux/ipv6.h
	net/ipv4/tcp_ipv4.c
	net/netfilter/xt_IDLETIMER.c

Change-Id: Ie345db6a14869fe0aa794aef4b71b5d0d503690b
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>

1 files changed, 8 insertions, 743 deletions

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index f4dd706c6cd1..96fe1c103bf9 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -225,7 +225,7 @@ static int __netlink_deliver_tap_skb(struct sk_buff *skb,
 
 	dev_hold(dev);
 
-	if (netlink_skb_is_mmaped(skb) || is_vmalloc_addr(skb->head))
+	if (is_vmalloc_addr(skb->head))
 		nskb = netlink_to_full_skb(skb, GFP_ATOMIC);
 	else
 		nskb = skb_clone(skb, GFP_ATOMIC);
@@ -300,610 +300,8 @@ static void netlink_rcv_wake(struct sock *sk)
 		wake_up_interruptible(&nlk->wait);
 }
 
-#ifdef CONFIG_NETLINK_MMAP
-static bool netlink_rx_is_mmaped(struct sock *sk)
-{
-	return nlk_sk(sk)->rx_ring.pg_vec != NULL;
-}
-
-static bool netlink_tx_is_mmaped(struct sock *sk)
-{
-	return nlk_sk(sk)->tx_ring.pg_vec != NULL;
-}
-
-static __pure struct page *pgvec_to_page(const void *addr)
-{
-	if (is_vmalloc_addr(addr))
-		return vmalloc_to_page(addr);
-	else
-		return virt_to_page(addr);
-}
-
-static void free_pg_vec(void **pg_vec, unsigned int order, unsigned int len)
-{
-	unsigned int i;
-
-	for (i = 0; i < len; i++) {
-		if (pg_vec[i] != NULL) {
-			if (is_vmalloc_addr(pg_vec[i]))
-				vfree(pg_vec[i]);
-			else
-				free_pages((unsigned long)pg_vec[i], order);
-		}
-	}
-	kfree(pg_vec);
-}
-
-static void *alloc_one_pg_vec_page(unsigned long order)
-{
-	void *buffer;
-	gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP | __GFP_ZERO |
-			  __GFP_NOWARN | __GFP_NORETRY;
-
-	buffer = (void *)__get_free_pages(gfp_flags, order);
-	if (buffer != NULL)
-		return buffer;
-
-	buffer = vzalloc((1 << order) * PAGE_SIZE);
-	if (buffer != NULL)
-		return buffer;
-
-	gfp_flags &= ~__GFP_NORETRY;
-	return (void *)__get_free_pages(gfp_flags, order);
-}
-
-static void **alloc_pg_vec(struct netlink_sock *nlk,
-			   struct nl_mmap_req *req, unsigned int order)
-{
-	unsigned int block_nr = req->nm_block_nr;
-	unsigned int i;
-	void **pg_vec;
-
-	pg_vec = kcalloc(block_nr, sizeof(void *), GFP_KERNEL);
-	if (pg_vec == NULL)
-		return NULL;
-
-	for (i = 0; i < block_nr; i++) {
-		pg_vec[i] = alloc_one_pg_vec_page(order);
-		if (pg_vec[i] == NULL)
-			goto err1;
-	}
-
-	return pg_vec;
-err1:
-	free_pg_vec(pg_vec, order, block_nr);
-	return NULL;
-}
-
-
-static void
-__netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, bool tx_ring, void **pg_vec,
-		   unsigned int order)
-{
-	struct netlink_sock *nlk = nlk_sk(sk);
-	struct sk_buff_head *queue;
-	struct netlink_ring *ring;
-
-	queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
-	ring  = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
-
-	spin_lock_bh(&queue->lock);
-
-	ring->frame_max		= req->nm_frame_nr - 1;
-	ring->head		= 0;
-	ring->frame_size	= req->nm_frame_size;
-	ring->pg_vec_pages	= req->nm_block_size / PAGE_SIZE;
-
-	swap(ring->pg_vec_len, req->nm_block_nr);
-	swap(ring->pg_vec_order, order);
-	swap(ring->pg_vec, pg_vec);
-
-	__skb_queue_purge(queue);
-	spin_unlock_bh(&queue->lock);
-
-	WARN_ON(atomic_read(&nlk->mapped));
-
-	if (pg_vec)
-		free_pg_vec(pg_vec, order, req->nm_block_nr);
-}
-
-static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req,
-			    bool tx_ring)
-{
-	struct netlink_sock *nlk = nlk_sk(sk);
-	struct netlink_ring *ring;
-	void **pg_vec = NULL;
-	unsigned int order = 0;
-
-	ring  = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
-
-	if (atomic_read(&nlk->mapped))
-		return -EBUSY;
-	if (atomic_read(&ring->pending))
-		return -EBUSY;
-
-	if (req->nm_block_nr) {
-		if (ring->pg_vec != NULL)
-			return -EBUSY;
-
-		if ((int)req->nm_block_size <= 0)
-			return -EINVAL;
-		if (!PAGE_ALIGNED(req->nm_block_size))
-			return -EINVAL;
-		if (req->nm_frame_size < NL_MMAP_HDRLEN)
-			return -EINVAL;
-		if (!IS_ALIGNED(req->nm_frame_size, NL_MMAP_MSG_ALIGNMENT))
-			return -EINVAL;
-
-		ring->frames_per_block = req->nm_block_size /
-					 req->nm_frame_size;
-		if (ring->frames_per_block == 0)
-			return -EINVAL;
-		if (ring->frames_per_block * req->nm_block_nr !=
-		    req->nm_frame_nr)
-			return -EINVAL;
-
-		order = get_order(req->nm_block_size);
-		pg_vec = alloc_pg_vec(nlk, req, order);
-		if (pg_vec == NULL)
-			return -ENOMEM;
-	} else {
-		if (req->nm_frame_nr)
-			return -EINVAL;
-	}
-
-	mutex_lock(&nlk->pg_vec_lock);
-	if (atomic_read(&nlk->mapped) == 0) {
-		__netlink_set_ring(sk, req, tx_ring, pg_vec, order);
-		mutex_unlock(&nlk->pg_vec_lock);
-		return 0;
-	}
-
-	mutex_unlock(&nlk->pg_vec_lock);
-
-	if (pg_vec)
-		free_pg_vec(pg_vec, order, req->nm_block_nr);
-
-	return -EBUSY;
-}
-
-static void netlink_mm_open(struct vm_area_struct *vma)
-{
-	struct file *file = vma->vm_file;
-	struct socket *sock = file->private_data;
-	struct sock *sk = sock->sk;
-
-	if (sk)
-		atomic_inc(&nlk_sk(sk)->mapped);
-}
-
-static void netlink_mm_close(struct vm_area_struct *vma)
-{
-	struct file *file = vma->vm_file;
-	struct socket *sock = file->private_data;
-	struct sock *sk = sock->sk;
-
-	if (sk)
-		atomic_dec(&nlk_sk(sk)->mapped);
-}
-
-static const struct vm_operations_struct netlink_mmap_ops = {
-	.open	= netlink_mm_open,
-	.close	= netlink_mm_close,
-};
-
-static int netlink_mmap(struct file *file, struct socket *sock,
-			struct vm_area_struct *vma)
-{
-	struct sock *sk = sock->sk;
-	struct netlink_sock *nlk = nlk_sk(sk);
-	struct netlink_ring *ring;
-	unsigned long start, size, expected;
-	unsigned int i;
-	int err = -EINVAL;
-
-	if (vma->vm_pgoff)
-		return -EINVAL;
-
-	mutex_lock(&nlk->pg_vec_lock);
-
-	expected = 0;
-	for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) {
-		if (ring->pg_vec == NULL)
-			continue;
-		expected += ring->pg_vec_len * ring->pg_vec_pages * PAGE_SIZE;
-	}
-
-	if (expected == 0)
-		goto out;
-
-	size = vma->vm_end - vma->vm_start;
-	if (size != expected)
-		goto out;
-
-	start = vma->vm_start;
-	for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) {
-		if (ring->pg_vec == NULL)
-			continue;
-
-		for (i = 0; i < ring->pg_vec_len; i++) {
-			struct page *page;
-			void *kaddr = ring->pg_vec[i];
-			unsigned int pg_num;
-
-			for (pg_num = 0; pg_num < ring->pg_vec_pages; pg_num++) {
-				page = pgvec_to_page(kaddr);
-				err = vm_insert_page(vma, start, page);
-				if (err < 0)
-					goto out;
-				start += PAGE_SIZE;
-				kaddr += PAGE_SIZE;
-			}
-		}
-	}
-
-	atomic_inc(&nlk->mapped);
-	vma->vm_ops = &netlink_mmap_ops;
-	err = 0;
-out:
-	mutex_unlock(&nlk->pg_vec_lock);
-	return err;
-}
-
-static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len)
-{
-#if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1
-	struct page *p_start, *p_end;
-
-	/* First page is flushed through netlink_{get,set}_status */
-	p_start = pgvec_to_page(hdr + PAGE_SIZE);
-	p_end   = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1);
-	while (p_start <= p_end) {
-		flush_dcache_page(p_start);
-		p_start++;
-	}
-#endif
-}
-
-static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr)
-{
-	smp_rmb();
-	flush_dcache_page(pgvec_to_page(hdr));
-	return hdr->nm_status;
-}
-
-static void netlink_set_status(struct nl_mmap_hdr *hdr,
-			       enum nl_mmap_status status)
-{
-	smp_mb();
-	hdr->nm_status = status;
-	flush_dcache_page(pgvec_to_page(hdr));
-}
-
-static struct nl_mmap_hdr *
-__netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos)
-{
-	unsigned int pg_vec_pos, frame_off;
-
-	pg_vec_pos = pos / ring->frames_per_block;
-	frame_off  = pos % ring->frames_per_block;
-
-	return ring->pg_vec[pg_vec_pos] + (frame_off * ring->frame_size);
-}
-
-static struct nl_mmap_hdr *
-netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos,
-		     enum nl_mmap_status status)
-{
-	struct nl_mmap_hdr *hdr;
-
-	hdr = __netlink_lookup_frame(ring, pos);
-	if (netlink_get_status(hdr) != status)
-		return NULL;
-
-	return hdr;
-}
-
-static struct nl_mmap_hdr *
-netlink_current_frame(const struct netlink_ring *ring,
-		      enum nl_mmap_status status)
-{
-	return netlink_lookup_frame(ring, ring->head, status);
-}
-
-static void netlink_increment_head(struct netlink_ring *ring)
-{
-	ring->head = ring->head != ring->frame_max ? ring->head + 1 : 0;
-}
-
-static void netlink_forward_ring(struct netlink_ring *ring)
-{
-	unsigned int head = ring->head;
-	const struct nl_mmap_hdr *hdr;
-
-	do {
-		hdr = __netlink_lookup_frame(ring, ring->head);
-		if (hdr->nm_status == NL_MMAP_STATUS_UNUSED)
-			break;
-		if (hdr->nm_status != NL_MMAP_STATUS_SKIP)
-			break;
-		netlink_increment_head(ring);
-	} while (ring->head != head);
-}
-
-static bool netlink_has_valid_frame(struct netlink_ring *ring)
-{
-	unsigned int head = ring->head, pos = head;
-	const struct nl_mmap_hdr *hdr;
-
-	do {
-		hdr = __netlink_lookup_frame(ring, pos);
-		if (hdr->nm_status == NL_MMAP_STATUS_VALID)
-			return true;
-		pos = pos != 0 ? pos - 1 : ring->frame_max;
-	} while (pos != head);
-
-	return false;
-}
-
-static bool netlink_dump_space(struct netlink_sock *nlk)
-{
-	struct netlink_ring *ring = &nlk->rx_ring;
-	struct nl_mmap_hdr *hdr;
-	unsigned int n;
-
-	hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
-	if (hdr == NULL)
-		return false;
-
-	n = ring->head + ring->frame_max / 2;
-	if (n > ring->frame_max)
-		n -= ring->frame_max;
-
-	hdr = __netlink_lookup_frame(ring, n);
-
-	return hdr->nm_status == NL_MMAP_STATUS_UNUSED;
-}
-
-static unsigned int netlink_poll(struct file *file, struct socket *sock,
-				 poll_table *wait)
-{
-	struct sock *sk = sock->sk;
-	struct netlink_sock *nlk = nlk_sk(sk);
-	unsigned int mask;
-	int err;
-
-	if (nlk->rx_ring.pg_vec != NULL) {
-		/* Memory mapped sockets don't call recvmsg(), so flow control
-		 * for dumps is performed here. A dump is allowed to continue
-		 * if at least half the ring is unused.
-		 */
-		while (nlk->cb_running && netlink_dump_space(nlk)) {
-			err = netlink_dump(sk);
-			if (err < 0) {
-				sk->sk_err = -err;
-				sk->sk_error_report(sk);
-				break;
-			}
-		}
-		netlink_rcv_wake(sk);
-	}
-
-	mask = datagram_poll(file, sock, wait);
-
-	/* We could already have received frames in the normal receive
-	 * queue, that will show up as NL_MMAP_STATUS_COPY in the ring,
-	 * so if mask contains pollin/etc already, there's no point
-	 * walking the ring.
-	 */
-	if ((mask & (POLLIN | POLLRDNORM)) != (POLLIN | POLLRDNORM)) {
-		spin_lock_bh(&sk->sk_receive_queue.lock);
-		if (nlk->rx_ring.pg_vec) {
-			if (netlink_has_valid_frame(&nlk->rx_ring))
-				mask |= POLLIN | POLLRDNORM;
-		}
-		spin_unlock_bh(&sk->sk_receive_queue.lock);
-	}
-
-	spin_lock_bh(&sk->sk_write_queue.lock);
-	if (nlk->tx_ring.pg_vec) {
-		if (netlink_current_frame(&nlk->tx_ring, NL_MMAP_STATUS_UNUSED))
-			mask |= POLLOUT | POLLWRNORM;
-	}
-	spin_unlock_bh(&sk->sk_write_queue.lock);
-
-	return mask;
-}
-
-static struct nl_mmap_hdr *netlink_mmap_hdr(struct sk_buff *skb)
-{
-	return (struct nl_mmap_hdr *)(skb->head - NL_MMAP_HDRLEN);
-}
-
-static void netlink_ring_setup_skb(struct sk_buff *skb, struct sock *sk,
-				   struct netlink_ring *ring,
-				   struct nl_mmap_hdr *hdr)
-{
-	unsigned int size;
-	void *data;
-
-	size = ring->frame_size - NL_MMAP_HDRLEN;
-	data = (void *)hdr + NL_MMAP_HDRLEN;
-
-	skb->head	= data;
-	skb->data	= data;
-	skb_reset_tail_pointer(skb);
-	skb->end	= skb->tail + size;
-	skb->len	= 0;
-
-	skb->destructor	= netlink_skb_destructor;
-	NETLINK_CB(skb).flags |= NETLINK_SKB_MMAPED;
-	NETLINK_CB(skb).sk = sk;
-}
-
-static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
-				u32 dst_portid, u32 dst_group,
-				struct scm_cookie *scm)
-{
-	struct netlink_sock *nlk = nlk_sk(sk);
-	struct netlink_ring *ring;
-	struct nl_mmap_hdr *hdr;
-	struct sk_buff *skb;
-	unsigned int maxlen;
-	int err = 0, len = 0;
-
-	mutex_lock(&nlk->pg_vec_lock);
-
-	ring   = &nlk->tx_ring;
-	maxlen = ring->frame_size - NL_MMAP_HDRLEN;
-
-	do {
-		unsigned int nm_len;
-
-		hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID);
-		if (hdr == NULL) {
-			if (!(msg->msg_flags & MSG_DONTWAIT) &&
-			    atomic_read(&nlk->tx_ring.pending))
-				schedule();
-			continue;
-		}
-
-		nm_len = ACCESS_ONCE(hdr->nm_len);
-		if (nm_len > maxlen) {
-			err = -EINVAL;
-			goto out;
-		}
-
-		netlink_frame_flush_dcache(hdr, nm_len);
-
-		skb = alloc_skb(nm_len, GFP_KERNEL);
-		if (skb == NULL) {
-			err = -ENOBUFS;
-			goto out;
-		}
-		__skb_put(skb, nm_len);
-		memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len);
-		netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
-
-		netlink_increment_head(ring);
-
-		NETLINK_CB(skb).portid	  = nlk->portid;
-		NETLINK_CB(skb).dst_group = dst_group;
-		NETLINK_CB(skb).creds	  = scm->creds;
-
-		err = security_netlink_send(sk, skb);
-		if (err) {
-			kfree_skb(skb);
-			goto out;
-		}
-
-		if (unlikely(dst_group)) {
-			atomic_inc(&skb->users);
-			netlink_broadcast(sk, skb, dst_portid, dst_group,
-					  GFP_KERNEL);
-		}
-		err = netlink_unicast(sk, skb, dst_portid,
-				      msg->msg_flags & MSG_DONTWAIT);
-		if (err < 0)
-			goto out;
-		len += err;
-
-	} while (hdr != NULL ||
-		 (!(msg->msg_flags & MSG_DONTWAIT) &&
-		  atomic_read(&nlk->tx_ring.pending)));
-
-	if (len > 0)
-		err = len;
-out:
-	mutex_unlock(&nlk->pg_vec_lock);
-	return err;
-}
-
-static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb)
-{
-	struct nl_mmap_hdr *hdr;
-
-	hdr = netlink_mmap_hdr(skb);
-	hdr->nm_len	= skb->len;
-	hdr->nm_group	= NETLINK_CB(skb).dst_group;
-	hdr->nm_pid	= NETLINK_CB(skb).creds.pid;
-	hdr->nm_uid	= from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
-	hdr->nm_gid	= from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
-	netlink_frame_flush_dcache(hdr, hdr->nm_len);
-	netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
-
-	NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED;
-	kfree_skb(skb);
-}
-
-static void netlink_ring_set_copied(struct sock *sk, struct sk_buff *skb)
-{
-	struct netlink_sock *nlk = nlk_sk(sk);
-	struct netlink_ring *ring = &nlk->rx_ring;
-	struct nl_mmap_hdr *hdr;
-
-	spin_lock_bh(&sk->sk_receive_queue.lock);
-	hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
-	if (hdr == NULL) {
-		spin_unlock_bh(&sk->sk_receive_queue.lock);
-		kfree_skb(skb);
-		netlink_overrun(sk);
-		return;
-	}
-	netlink_increment_head(ring);
-	__skb_queue_tail(&sk->sk_receive_queue, skb);
-	spin_unlock_bh(&sk->sk_receive_queue.lock);
-
-	hdr->nm_len	= skb->len;
-	hdr->nm_group	= NETLINK_CB(skb).dst_group;
-	hdr->nm_pid	= NETLINK_CB(skb).creds.pid;
-	hdr->nm_uid	= from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
-	hdr->nm_gid	= from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
-	netlink_set_status(hdr, NL_MMAP_STATUS_COPY);
-}
-
-#else /* CONFIG_NETLINK_MMAP */
-#define netlink_rx_is_mmaped(sk)	false
-#define netlink_tx_is_mmaped(sk)	false
-#define netlink_mmap			sock_no_mmap
-#define netlink_poll			datagram_poll
-#define netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group, scm)	0
-#endif /* CONFIG_NETLINK_MMAP */
-
 static void netlink_skb_destructor(struct sk_buff *skb)
 {
-#ifdef CONFIG_NETLINK_MMAP
-	struct nl_mmap_hdr *hdr;
-	struct netlink_ring *ring;
-	struct sock *sk;
-
-	/* If a packet from the kernel to userspace was freed because of an
-	 * error without being delivered to userspace, the kernel must reset
-	 * the status. In the direction userspace to kernel, the status is
-	 * always reset here after the packet was processed and freed.
-	 */
-	if (netlink_skb_is_mmaped(skb)) {
-		hdr = netlink_mmap_hdr(skb);
-		sk = NETLINK_CB(skb).sk;
-
-		if (NETLINK_CB(skb).flags & NETLINK_SKB_TX) {
-			netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
-			ring = &nlk_sk(sk)->tx_ring;
-		} else {
-			if (!(NETLINK_CB(skb).flags & NETLINK_SKB_DELIVERED)) {
-				hdr->nm_len = 0;
-				netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
-			}
-			ring = &nlk_sk(sk)->rx_ring;
-		}
-
-		WARN_ON(atomic_read(&ring->pending) == 0);
-		atomic_dec(&ring->pending);
-		sock_put(sk);
-
-		skb->head = NULL;
-	}
-#endif
 	if (is_vmalloc_addr(skb->head)) {
 		if (!skb->cloned ||
 		    !atomic_dec_return(&(skb_shinfo(skb)->dataref)))
@@ -927,18 +325,6 @@ static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
 static void netlink_sock_destruct(struct sock *sk)
 {
 	skb_queue_purge(&sk->sk_receive_queue);
-#ifdef CONFIG_NETLINK_MMAP
-	if (1) {
-		struct nl_mmap_req req;
-
-		memset(&req, 0, sizeof(req));
-		if (nlk->rx_ring.pg_vec)
-			__netlink_set_ring(sk, &req, false, NULL, 0);
-		memset(&req, 0, sizeof(req));
-		if (nlk->tx_ring.pg_vec)
-			__netlink_set_ring(sk, &req, true, NULL, 0);
-	}
-#endif /* CONFIG_NETLINK_MMAP */
 
 	if (!sock_flag(sk, SOCK_DEAD)) {
 		printk(KERN_ERR "Freeing alive netlink socket %p\n", sk);
@@ -1185,9 +571,6 @@ static int __netlink_create(struct net *net, struct socket *sock,
 		mutex_init(nlk->cb_mutex);
 	}
 	init_waitqueue_head(&nlk->wait);
-#ifdef CONFIG_NETLINK_MMAP
-	mutex_init(&nlk->pg_vec_lock);
-#endif
 
 	sock_set_flag(sk, SOCK_RCU_FREE);
 	sk->sk_destruct = netlink_sock_destruct;
@@ -1725,8 +1108,7 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
 	nlk = nlk_sk(sk);
 
 	if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
-	     test_bit(NETLINK_S_CONGESTED, &nlk->state)) &&
-	    !netlink_skb_is_mmaped(skb)) {
+	     test_bit(NETLINK_S_CONGESTED, &nlk->state))) {
 		DECLARE_WAITQUEUE(wait, current);
 		if (!*timeo) {
 			if (!ssk || netlink_is_kernel(ssk))
@@ -1764,14 +1146,7 @@ static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
 
 	netlink_deliver_tap(skb);
 
-#ifdef CONFIG_NETLINK_MMAP
-	if (netlink_skb_is_mmaped(skb))
-		netlink_queue_mmaped_skb(sk, skb);
-	else if (netlink_rx_is_mmaped(sk))
-		netlink_ring_set_copied(sk, skb);
-	else
-#endif /* CONFIG_NETLINK_MMAP */
-		skb_queue_tail(&sk->sk_receive_queue, skb);
+	skb_queue_tail(&sk->sk_receive_queue, skb);
 	sk->sk_data_ready(sk);
 	return len;
 }
@@ -1795,9 +1170,6 @@ static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation)
 	int delta;
 
 	WARN_ON(skb->sk != NULL);
-	if (netlink_skb_is_mmaped(skb))
-		return skb;
-
 	delta = skb->end - skb->tail;
 	if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize)
 		return skb;
@@ -1877,71 +1249,6 @@ struct sk_buff *__netlink_alloc_skb(struct sock *ssk, unsigned int size,
 				    unsigned int ldiff, u32 dst_portid,
 				    gfp_t gfp_mask)
 {
-#ifdef CONFIG_NETLINK_MMAP
-	unsigned int maxlen, linear_size;
-	struct sock *sk = NULL;
-	struct sk_buff *skb;
-	struct netlink_ring *ring;
-	struct nl_mmap_hdr *hdr;
-
-	sk = netlink_getsockbyportid(ssk, dst_portid);
-	if (IS_ERR(sk))
-		goto out;
-
-	ring = &nlk_sk(sk)->rx_ring;
-	/* fast-path without atomic ops for common case: non-mmaped receiver */
-	if (ring->pg_vec == NULL)
-		goto out_put;
-
-	/* We need to account the full linear size needed as a ring
-	 * slot cannot have non-linear parts.
-	 */
-	linear_size = size + ldiff;
-	if (ring->frame_size - NL_MMAP_HDRLEN < linear_size)
-		goto out_put;
-
-	skb = alloc_skb_head(gfp_mask);
-	if (skb == NULL)
-		goto err1;
-
-	spin_lock_bh(&sk->sk_receive_queue.lock);
-	/* check again under lock */
-	if (ring->pg_vec == NULL)
-		goto out_free;
-
-	/* check again under lock */
-	maxlen = ring->frame_size - NL_MMAP_HDRLEN;
-	if (maxlen < linear_size)
-		goto out_free;
-
-	netlink_forward_ring(ring);
-	hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
-	if (hdr == NULL)
-		goto err2;
-
-	netlink_ring_setup_skb(skb, sk, ring, hdr);
-	netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
-	atomic_inc(&ring->pending);
-	netlink_increment_head(ring);
-
-	spin_unlock_bh(&sk->sk_receive_queue.lock);
-	return skb;
-
-err2:
-	kfree_skb(skb);
-	spin_unlock_bh(&sk->sk_receive_queue.lock);
-	netlink_overrun(sk);
-err1:
-	sock_put(sk);
-	return NULL;
-
-out_free:
-	kfree_skb(skb);
-	spin_unlock_bh(&sk->sk_receive_queue.lock);
-out_put:
-	sock_put(sk);
-out:
-#endif
 	return alloc_skb(size, gfp_mask);
 }
 EXPORT_SYMBOL_GPL(__netlink_alloc_skb);
@@ -2222,8 +1529,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
 	if (level != SOL_NETLINK)
 		return -ENOPROTOOPT;
 
-	if (optname != NETLINK_RX_RING && optname != NETLINK_TX_RING &&
-	    optlen >= sizeof(int) &&
+	if (optlen >= sizeof(int) &&
 	    get_user(val, (unsigned int __user *)optval))
 		return -EFAULT;
 
@@ -2276,25 +1582,6 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
 		}
 		err = 0;
 		break;
-#ifdef CONFIG_NETLINK_MMAP
-	case NETLINK_RX_RING:
-	case NETLINK_TX_RING: {
-		struct nl_mmap_req req;
-
-		/* Rings might consume more memory than queue limits, require
-		 * CAP_NET_ADMIN.
-		 */
-		if (!capable(CAP_NET_ADMIN))
-			return -EPERM;
-		if (optlen < sizeof(req))
-			return -EINVAL;
-		if (copy_from_user(&req, optval, sizeof(req)))
-			return -EFAULT;
-		err = netlink_set_ring(sk, &req,
-				       optname == NETLINK_TX_RING);
-		break;
-	}
-#endif /* CONFIG_NETLINK_MMAP */
 	case NETLINK_LISTEN_ALL_NSID:
 		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_BROADCAST))
 			return -EPERM;
@@ -2464,18 +1751,6 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 		smp_rmb();
 	}
 
-	/* It's a really convoluted way for userland to ask for mmaped
-	 * sendmsg(), but that's what we've got...
-	 */
-	if (netlink_tx_is_mmaped(sk) &&
-	    iter_is_iovec(&msg->msg_iter) &&
-	    msg->msg_iter.nr_segs == 1 &&
-	    msg->msg_iter.iov->iov_base == NULL) {
-		err = netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group,
-					   &scm);
-		goto out;
-	}
-
 	err = -EMSGSIZE;
 	if (len > sk->sk_sndbuf - 32)
 		goto out;
@@ -2792,8 +2067,7 @@ static int netlink_dump(struct sock *sk)
 		goto errout_skb;
 	}
 
-	if (!netlink_rx_is_mmaped(sk) &&
-	    atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
+	if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
 		goto errout_skb;
 
 	/* NLMSG_GOODSIZE is small to avoid high order allocations being
@@ -2882,16 +2156,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
 	struct netlink_sock *nlk;
 	int ret;
 
-	/* Memory mapped dump requests need to be copied to avoid looping
-	 * on the pending state in netlink_mmap_sendmsg() while the CB hold
-	 * a reference to the skb.
-	 */
-	if (netlink_skb_is_mmaped(skb)) {
-		skb = skb_copy(skb, GFP_KERNEL);
-		if (skb == NULL)
-			return -ENOBUFS;
-	} else
-		atomic_inc(&skb->users);
+	atomic_inc(&skb->users);
 
 	sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid);
 	if (sk == NULL) {
@@ -3235,7 +2500,7 @@ static const struct proto_ops netlink_ops = {
 	.socketpair =	sock_no_socketpair,
 	.accept =	sock_no_accept,
 	.getname =	netlink_getname,
-	.poll =		netlink_poll,
+	.poll =		datagram_poll,
 	.ioctl =	sock_no_ioctl,
 	.listen =	sock_no_listen,
 	.shutdown =	sock_no_shutdown,
@@ -3243,7 +2508,7 @@ static const struct proto_ops netlink_ops = {
 	.getsockopt =	netlink_getsockopt,
 	.sendmsg =	netlink_sendmsg,
 	.recvmsg =	netlink_recvmsg,
-	.mmap =		netlink_mmap,
+	.mmap =		sock_no_mmap,
 	.sendpage =	sock_no_sendpage,
 };