diff --git a/Makefile b/Makefile
index b9c1f94..1dd605d 100755
--- a/Makefile
+++ b/Makefile
@@ -26,21 +26,44 @@
 	 frontends/ecm_front_end_ipv4.o \
 	 frontends/ecm_front_end_ipv6.o \
 	 frontends/ecm_front_end_common.o \
-	 frontends/nss/ecm_nss_ipv4.o \
-	 frontends/nss/ecm_nss_ported_ipv4.o \
 	 ecm_db.o \
 	 ecm_classifier_default.o \
-	 frontends/nss/ecm_nss_conntrack_notifier.o \
 	 ecm_interface.o \
 	 ecm_init.o
 
 # #############################################################################
+# Define ECM_FRONT_END_NSS_ENABLE=y in order to select
+# nss as ECM's front end.
+# #############################################################################
+ifeq ($(ECM_FRONT_END_NSS_ENABLE),)
+ECM_FRONT_END_NSS_ENABLE=y
+endif
+ecm-$(ECM_FRONT_END_NSS_ENABLE) += frontends/nss/ecm_nss_ipv4.o
+ecm-$(ECM_FRONT_END_NSS_ENABLE) += frontends/nss/ecm_nss_ported_ipv4.o
+ecm-$(ECM_FRONT_END_NSS_ENABLE) += frontends/nss/ecm_nss_conntrack_notifier.o
+ccflags-$(ECM_FRONT_END_NSS_ENABLE) += -DECM_FRONT_END_NSS_ENABLE
+
+# #############################################################################
+# Define ECM_FRONT_END_SFE_ENABLE=y in order to select
+# sfe as ECM's front end.
+# #############################################################################
+ifeq ($(ECM_FRONT_END_SFE_ENABLE),)
+ECM_FRONT_END_SFE_ENABLE=y
+endif
+ecm-$(ECM_FRONT_END_SFE_ENABLE) += frontends/sfe/ecm_sfe_ipv4.o
+ecm-$(ECM_FRONT_END_SFE_ENABLE) += frontends/sfe/ecm_sfe_ported_ipv4.o
+ecm-$(ECM_FRONT_END_SFE_ENABLE) += frontends/sfe/ecm_sfe_conntrack_notifier.o
+ccflags-$(ECM_FRONT_END_SFE_ENABLE) += -DECM_FRONT_END_SFE_ENABLE
+
+# #############################################################################
 # Define ECM_INTERFACE_BOND_ENABLE=y in order to enable
 # Bonding / Link Aggregation support.
 # #############################################################################
+ifeq ($(ECM_FRONT_END_NSS_ENABLE), y)
 ifneq ($(findstring 3.4, $(KERNELVERSION)),)
 ECM_INTERFACE_BOND_ENABLE=y
 endif
+endif
 ecm-$(ECM_INTERFACE_BOND_ENABLE) += frontends/nss/ecm_nss_bond_notifier.o
 ccflags-$(ECM_INTERFACE_BOND_ENABLE) += -DECM_INTERFACE_BOND_ENABLE
 
@@ -68,9 +91,11 @@
 # #############################################################################
 # Define ECM_MULTICAST_ENABLE=y in order to enable support for ECM Multicast
 # #############################################################################
+ifeq ($(ECM_FRONT_END_NSS_ENABLE), y)
 ifneq ($(findstring 3.4, $(KERNELVERSION)),)
 ECM_MULTICAST_ENABLE=y
 endif
+endif
 ecm-$(ECM_MULTICAST_ENABLE) += frontends/nss/ecm_nss_multicast_ipv4.o
 ecm-$(ECM_MULTICAST_ENABLE) += frontends/nss/ecm_nss_multicast_ipv6.o
 ccflags-$(ECM_MULTICAST_ENABLE) += -DECM_MULTICAST_ENABLE
@@ -91,8 +116,14 @@
 # Define ECM_IPV6_ENABLE=y in order to enable IPv6 support in the ECM.
 # #############################################################################
 ECM_IPV6_ENABLE=y
+ifeq ($(ECM_FRONT_END_NSS_ENABLE), y)
 ecm-$(ECM_IPV6_ENABLE) += frontends/nss/ecm_nss_ipv6.o
 ecm-$(ECM_IPV6_ENABLE) += frontends/nss/ecm_nss_ported_ipv6.o
+endif
+ifeq ($(ECM_FRONT_END_SFE_ENABLE), y)
+ecm-$(ECM_IPV6_ENABLE) += frontends/sfe/ecm_sfe_ipv6.o
+ecm-$(ECM_IPV6_ENABLE) += frontends/sfe/ecm_sfe_ported_ipv6.o
+endif
 ccflags-$(ECM_IPV6_ENABLE) += -DECM_IPV6_ENABLE
 
 # #############################################################################
@@ -132,8 +163,14 @@
 # Define ECM_NON_PORTED_SUPPORT_ENABLE=y in order to enable non-ported protocol.
 # #############################################################################
 ECM_NON_PORTED_SUPPORT_ENABLE=y
+ifeq ($(ECM_FRONT_END_NSS_ENABLE), y)
 ecm-$(ECM_NON_PORTED_SUPPORT_ENABLE) += frontends/nss/ecm_nss_non_ported_ipv4.o
 ecm-$(ECM_NON_PORTED_SUPPORT_ENABLE) += frontends/nss/ecm_nss_non_ported_ipv6.o
+endif
+ifeq ($(ECM_FRONT_END_SFE_ENABLE), y)
+ecm-$(ECM_NON_PORTED_SUPPORT_ENABLE) += frontends/sfe/ecm_sfe_non_ported_ipv4.o
+ecm-$(ECM_NON_PORTED_SUPPORT_ENABLE) += frontends/sfe/ecm_sfe_non_ported_ipv6.o
+endif
 ccflags-$(ECM_NON_PORTED_SUPPORT_ENABLE) += -DECM_NON_PORTED_SUPPORT_ENABLE
 
 # #############################################################################
@@ -201,6 +238,12 @@
 ccflags-y += -DECM_NSS_PORTED_IPV6_DEBUG_LEVEL=1
 ccflags-y += -DECM_NSS_NON_PORTED_IPV6_DEBUG_LEVEL=1
 ccflags-y += -DECM_NSS_MULTICAST_IPV6_DEBUG_LEVEL=1
+ccflags-y += -DECM_SFE_IPV4_DEBUG_LEVEL=1
+ccflags-y += -DECM_SFE_PORTED_IPV4_DEBUG_LEVEL=1
+ccflags-y += -DECM_SFE_NON_PORTED_IPV4_DEBUG_LEVEL=1
+ccflags-y += -DECM_SFE_IPV6_DEBUG_LEVEL=1
+ccflags-y += -DECM_SFE_PORTED_IPV6_DEBUG_LEVEL=1
+ccflags-y += -DECM_SFE_NON_PORTED_IPV6_DEBUG_LEVEL=1
 ccflags-y += -DECM_CONNTRACK_NOTIFIER_DEBUG_LEVEL=1
 ccflags-y += -DECM_TRACKER_DEBUG_LEVEL=1
 ccflags-y += -DECM_TRACKER_DATAGRAM_DEBUG_LEVEL=1
@@ -211,7 +254,7 @@
 ccflags-y += -DECM_STATE_DEBUG_LEVEL=1
 ccflags-y += -DECM_OPENWRT_SUPPORT=1
 
-ccflags-y += -I$(obj)/ -I$(obj)/frontends/include -I$(obj)/frontends/nss
+ccflags-y += -I$(obj)/ -I$(obj)/frontends/include -I$(obj)/frontends/nss -I$(obj)/frontends/sfe
 
 obj ?= .
 
diff --git a/ecm_classifier_nl.c b/ecm_classifier_nl.c
index cebfd71..fa5f5f5 100644
--- a/ecm_classifier_nl.c
+++ b/ecm_classifier_nl.c
@@ -1307,7 +1307,7 @@
 #ifdef ECM_DB_CTA_TRACK_ENABLE
 		ecm_db_connection_regenerate_by_assignment_type(ECM_CLASSIFIER_TYPE_NL);
 #else
-		ecm_db_classifier_generation_change();
+		ecm_db_regeneration_needed();
 #endif
 	}
 	return 0;
diff --git a/ecm_classifier_pcc.c b/ecm_classifier_pcc.c
index 884bd21..de27104 100644
--- a/ecm_classifier_pcc.c
+++ b/ecm_classifier_pcc.c
@@ -150,9 +150,9 @@
 	spin_unlock_bh(&ecm_classifier_pcc_lock);
 
 	/*
-	 * Force a re-generation of all connections
+	 * Flag a re-generation of all connections is needed
 	 */
-	ecm_db_classifier_generation_change();
+	ecm_db_regeneration_needed();
 	return 0;
 }
 EXPORT_SYMBOL(ecm_classifier_pcc_register);
@@ -189,9 +189,9 @@
 	module_put(reg->this_module);
 
 	/*
-	 * Force a re-generation of all connections
+	 * Flag a re-generation of all connections is needed
 	 */
-	ecm_db_classifier_generation_change();
+	ecm_db_regeneration_needed();
 }
 EXPORT_SYMBOL(ecm_classifier_pcc_unregister_begin);
 
@@ -545,9 +545,9 @@
 	module_put(reg->this_module);
 
 	/*
-	 * Force a re-generation of all connections
+	 * Flag a re-generation of all connections is needed
 	 */
-	ecm_db_classifier_generation_change();
+	ecm_db_regeneration_needed();
 }
 
 /*
diff --git a/ecm_db.c b/ecm_db.c
index 7d96665..60d4f82 100644
--- a/ecm_db.c
+++ b/ecm_db.c
@@ -680,8 +680,10 @@
 	/*
 	 * Destination Multicast interfaces list
 	 */
-	struct ecm_db_iface_instance *to_mcast_interfaces[ECM_DB_MULTICAST_IF_MAX][ECM_DB_IFACE_HEIRARCHY_MAX];
-								/* The outermost to innnermost interfaces this connection is using in the to path */
+	struct ecm_db_iface_instance *to_mcast_interfaces;
+								/* The outermost to innnermost interfaces this connection is using in multicast path.
+								 * The size of the buffer allocated for the to_mcast_interfaces heirarchies is as large as
+								 * sizeof(struct ecm_db_iface_instance *) * ECM_DB_MULTICAST_IF_MAX * ECM_DB_IFACE_HEIRARCHY_MAX. */
 	int32_t to_mcast_interface_first[ECM_DB_MULTICAST_IF_MAX];
 								/* The indexes of the first interfaces in the destinaiton interface list */
 	struct ecm_db_multicast_tuple_instance *ti; 		/* Multicast Connection instance */
@@ -725,8 +727,31 @@
 								 */
 #endif
 
-	uint16_t classifier_generation;				/* Used to detect when a re-evaluation of this connection is necessary */
-	uint32_t generations;					/* Tracks how many times re-generation was seen for this connection */
+	/*
+	 * Re-generation.
+	 * When system or classifier state changes, affected connections may need to have their state re-generated.
+	 * This ensures that a connection does not continue to operate on stale state which could affect the sanity of acceleration rules.
+	 * A connection needs to be re-generated when its regen_required is > 0.
+	 * When a re-generation is completed successfully the counter is decremented.
+	 * The counter ensures that any further changes of state while re-generation is under way is not missed.
+	 * While a connection needs re-generation (regen_required > 0), acceleration should not be permitted.
+	 * It may not always be practical to flag individual connections for re-generation (time consuming with large numbers of connections).
+	 * The "generation" is a numerical counter comparison against the global "ecm_db_connection_generation".
+	 * This ecm_db_connection_generation can be incremented causing a numerical difference between the connections counter and this global.
+	 * This is enough to flag that a re-generation is needed.
+	 * Further, it is possible that re-generation may be required DURING a rule construction.  Since constructing a rule
+	 * can require lengthy non-atomic processes there needs to be a way to ensure that changes during construction of a rule are caught.
+	 * The regen_occurances is a counter that is incremented whenever regen_required is also incremented.
+	 * However it is never decremented.  This permits the caller to obtain this count before a non-atomic procedure and then afterwards.
+	 * If there is any change in the counter value there is a change of generation!  And the operation should be aborted.
+	 */
+	bool regen_in_progress;					/* The connection is under regeneration right now and is used to provide atomic re-generation in SMP */
+	uint16_t regen_required;				/* The connection needs to be re-generated when > 0 */
+	uint16_t regen_occurances;				/* Total number of regens required */
+	uint16_t generation;					/* Used to detect when a re-evaluation of this connection is necessary by comparing with ecm_db_connection_generation */
+	uint32_t regen_success;					/* Tracks how many times re-generation was successfully completed */
+	uint32_t regen_fail;					/* Tracks how many times re-generation failed */
+
 	struct ecm_front_end_connection_instance *feci;		/* Front end instance specific to this connection */
 
 	ecm_db_connection_defunct_callback_t defunct;		/* Callback to be called when connection has become defunct */
@@ -824,9 +849,10 @@
 static DEFINE_SPINLOCK(ecm_db_lock);					/* Protect the table from SMP access. */
 
 /*
- * Connection validity
+ * Connection state validity
+ * This counter is incremented whenever a general change is detected which requires re-generation of state for ALL connections.
  */
-static uint16_t ecm_db_classifier_generation = 0;		/* Generation counter to detect out of date connections that should be reclassified */
+static uint16_t ecm_db_connection_generation = 0;		/* Generation counter to detect when all connection state is considered stale and all must be re-generated */
 
 /*
  * Debugfs dentry object.
@@ -1748,84 +1774,189 @@
 EXPORT_SYMBOL(ecm_db_connection_iface_type_get);
 
 /*
- * ecm_db_connection_classifier_generation_changed()
- *	Returns true if the classifier generation has changed for this connection.
- *
- * NOTE: The generation index will be reset on return from this call so action any true result immediately.
+ * ecm_db_connection_regeneration_occurrances_get()
+ *	Get the number of regeneration occurrances that have occurred since the connection was created.
  */
-bool ecm_db_connection_classifier_generation_changed(struct ecm_db_connection_instance *ci)
+uint16_t ecm_db_connection_regeneration_occurrances_get(struct ecm_db_connection_instance *ci)
+{
+	uint16_t occurances;
+	DEBUG_CHECK_MAGIC(ci, ECM_DB_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", ci);
+
+	spin_lock_bh(&ecm_db_lock);
+	occurances = ci->regen_occurances;
+	spin_unlock_bh(&ecm_db_lock);
+	return occurances;
+}
+EXPORT_SYMBOL(ecm_db_connection_regeneration_occurrances_get);
+
+/*
+ * ecm_db_conection_regeneration_completed()
+ *	Re-generation was completed successfully
+ */
+void ecm_db_conection_regeneration_completed(struct ecm_db_connection_instance *ci)
 {
 	DEBUG_CHECK_MAGIC(ci, ECM_DB_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", ci);
 
 	spin_lock_bh(&ecm_db_lock);
-	if (ci->classifier_generation == ecm_db_classifier_generation) {
+
+	DEBUG_ASSERT(ci->regen_in_progress, "%p: Bad call", ci);
+	DEBUG_ASSERT(ci->regen_required > 0, "%p: Bad call", ci);
+
+	/*
+	 * Decrement the required counter by 1.
+	 * This may mean that regeneration is still required due to another change occuring _during_ re-generation.
+	 */
+	ci->regen_required--;
+	ci->regen_in_progress = false;
+	ci->regen_success++;
+	spin_unlock_bh(&ecm_db_lock);
+}
+EXPORT_SYMBOL(ecm_db_conection_regeneration_completed);
+
+/*
+ * ecm_db_conection_regeneration_failed()
+ *	Re-generation failed
+ */
+void ecm_db_conection_regeneration_failed(struct ecm_db_connection_instance *ci)
+{
+	DEBUG_CHECK_MAGIC(ci, ECM_DB_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", ci);
+
+	spin_lock_bh(&ecm_db_lock);
+
+	DEBUG_ASSERT(ci->regen_in_progress, "%p: Bad call", ci);
+	DEBUG_ASSERT(ci->regen_required > 0, "%p: Bad call", ci);
+
+	/*
+	 * Re-generation is no longer in progress BUT we leave the regen
+	 * counter as it is so as to indicate re-generation is still needed
+	 */
+	ci->regen_in_progress = false;
+	ci->regen_fail++;
+	spin_unlock_bh(&ecm_db_lock);
+}
+EXPORT_SYMBOL(ecm_db_conection_regeneration_failed);
+
+/*
+ * ecm_db_connection_regeneration_required_check()
+ *	Returns true if the connection needs to be re-generated.
+ *
+ * If re-generation is needed this will mark the connection to indicate that re-generation is needed AND in progress.
+ * If the return code is TRUE the caller MUST handle the re-generation.
+ * Upon re-generation completion you must call ecm_db_conection_regeneration_completed() or ecm_db_conection_regeneration_failed().
+ */
+bool ecm_db_connection_regeneration_required_check(struct ecm_db_connection_instance *ci)
+{
+	DEBUG_CHECK_MAGIC(ci, ECM_DB_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", ci);
+
+	/*
+	 * Check the global generation counter for changes
+	 */
+	spin_lock_bh(&ecm_db_lock);
+	if (ci->generation != ecm_db_connection_generation) {
+		/*
+		 * Re-generation is needed
+		 */
+		ci->regen_occurances++;
+		ci->regen_required++;
+
+		/*
+		 * Record that we have seen this change
+		 */
+		ci->generation = ecm_db_connection_generation;
+	}
+
+	/*
+	 * If re-generation is in progress then something is handling re-generation already
+	 * so we tell the caller that it cannot handle re-generation.
+	 */
+	if (ci->regen_in_progress) {
 		spin_unlock_bh(&ecm_db_lock);
 		return false;
 	}
-	ci->generations++;
-	ci->classifier_generation = ecm_db_classifier_generation;
+
+	/*
+	 * Is re-generation required?
+	 */
+	if (ci->regen_required == 0) {
+		spin_unlock_bh(&ecm_db_lock);
+		return false;
+	}
+
+	/*
+	 * Flag that re-generation is in progress and tell the caller to handle re-generation
+	 */
+	ci->regen_in_progress = true;
 	spin_unlock_bh(&ecm_db_lock);
 	return true;
 }
-EXPORT_SYMBOL(ecm_db_connection_classifier_generation_changed);
+EXPORT_SYMBOL(ecm_db_connection_regeneration_required_check);
 
 /*
- * ecm_db_connection_classifier_peek_generation_changed()
- *	Returns true if the classifier generation has changed for this connection.
+ * ecm_db_connection_regeneration_required_peek()
+ *	Returns true if the connection needs to be regenerated.
  *
- * NOTE: The generation index will NOT be reset on return from this call.
+ * NOTE: The caller MUST NOT handle re-generation, the caller may use this indication
+ * to determine the sanity of the connection state and whether acceleration is permitted.
  */
-bool ecm_db_connection_classifier_peek_generation_changed(struct ecm_db_connection_instance *ci)
+bool ecm_db_connection_regeneration_required_peek(struct ecm_db_connection_instance *ci)
 {
 	DEBUG_CHECK_MAGIC(ci, ECM_DB_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", ci);
 
 	spin_lock_bh(&ecm_db_lock);
-	if (ci->classifier_generation == ecm_db_classifier_generation) {
+
+	/*
+	 * Check the global generation counter for changes (record any change now)
+	 */
+	if (ci->generation != ecm_db_connection_generation) {
+		/*
+		 * Re-generation is needed, flag the connection as needing re-generation now.
+		 */
+		ci->regen_occurances++;
+		ci->regen_required++;
+
+		/*
+		 * Record that we have seen this change
+		 */
+		ci->generation = ecm_db_connection_generation;
+	}
+	if (ci->regen_required == 0) {
 		spin_unlock_bh(&ecm_db_lock);
 		return false;
 	}
 	spin_unlock_bh(&ecm_db_lock);
 	return true;
 }
-EXPORT_SYMBOL(ecm_db_connection_classifier_peek_generation_changed);
+EXPORT_SYMBOL(ecm_db_connection_regeneration_required_peek);
 
 /*
- * _ecm_db_connection_classifier_generation_change()
- *	Cause a specific connection to be re-generated
+ * ecm_db_connection_regeneration_needed()
+ *	Cause a specific connection to require re-generation
+ *
+ * NOTE: This only flags that re-generation is needed.
+ * The connection will typically be re-generated when ecm_db_connection_regeneration_required_check() is invoked.
  */
-static void _ecm_db_connection_classifier_generation_change(struct ecm_db_connection_instance *ci)
-{
-	ci->classifier_generation = ecm_db_classifier_generation - 1;
-}
-
-/*
- * ecm_db_connection_classifier_generation_change()
- *	Cause a specific connection to be re-generated
- */
-void ecm_db_connection_classifier_generation_change(struct ecm_db_connection_instance *ci)
+void ecm_db_connection_regeneration_needed(struct ecm_db_connection_instance *ci)
 {
 	DEBUG_CHECK_MAGIC(ci, ECM_DB_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", ci);
 
 	spin_lock_bh(&ecm_db_lock);
-	_ecm_db_connection_classifier_generation_change(ci);
+	ci->regen_occurances++;
+	ci->regen_required++;
 	spin_unlock_bh(&ecm_db_lock);
 }
-EXPORT_SYMBOL(ecm_db_connection_classifier_generation_change);
+EXPORT_SYMBOL(ecm_db_connection_regeneration_needed);
 
 /*
- * ecm_db_classifier_generation_change()
- *	Bump the generation index to cause a re-classification of connections
- *
- * NOTE: Any connections that see activity after a call to this could be put back to undetermined qos state
- * and driven back through the classifiers.
+ * ecm_db_regeneration_needed()
+ *	Bump the global generation index to cause a re-generation of all connections state.
  */
-void ecm_db_classifier_generation_change(void)
+void ecm_db_regeneration_needed(void)
 {
 	spin_lock_bh(&ecm_db_lock);
-	ecm_db_classifier_generation++;
+	ecm_db_connection_generation++;
 	spin_unlock_bh(&ecm_db_lock);
 }
-EXPORT_SYMBOL(ecm_db_classifier_generation_change);
+EXPORT_SYMBOL(ecm_db_regeneration_needed);
 
 /*
  * ecm_db_connection_direction_get()
@@ -2940,7 +3071,11 @@
 	if (ci->to_nat_node) {
 		ecm_db_node_deref(ci->to_nat_node);
 	}
-
+#ifdef ECM_MULTICAST_ENABLE
+	if (ci->ti) {
+		ecm_db_multicast_tuple_instance_deref(ci->ti);
+	}
+#endif
 	/*
 	 * Remove references to the interfaces in our heirarchy lists
 	 */
@@ -5740,7 +5875,7 @@
 		struct ecm_db_connection_instance *cin;
 
 		DEBUG_TRACE("%p: Re-generate: %d\n", ci, ca_type);
-		ecm_db_connection_classifier_generation_change(ci);
+		ecm_db_connection_regeneration_needed(ci);
 
 		cin = ecm_db_connection_by_classifier_type_assignment_get_and_ref_next(ci, ca_type);
 		ecm_db_connection_by_classifier_type_assignment_deref(ci, ca_type);
@@ -5882,11 +6017,14 @@
  *	Reset the 'to' interfaces heirarchy with a new set of destination interfaces for
  *	the multicast connection
  */
-void ecm_db_multicast_connection_to_interfaces_reset(struct ecm_db_connection_instance *ci, struct ecm_db_iface_instance *interfaces, int32_t *new_first)
+int ecm_db_multicast_connection_to_interfaces_reset(struct ecm_db_connection_instance *ci, struct ecm_db_iface_instance *interfaces, int32_t *new_first)
 {
 	struct ecm_db_iface_instance *ii_temp;
 	struct ecm_db_iface_instance *ii_single;
 	struct ecm_db_iface_instance **ifaces;
+	struct ecm_db_iface_instance *ii_db;
+	struct ecm_db_iface_instance *ii_db_single;
+	struct ecm_db_iface_instance **ifaces_db;
 	int32_t *nf_p;
 	int32_t heirarchy_index;
 	int32_t i;
@@ -5898,6 +6036,12 @@
 	 */
 	ecm_db_multicast_connection_to_interfaces_clear(ci);
 
+	ci->to_mcast_interfaces = (struct ecm_db_iface_instance *)kzalloc(ECM_DB_TO_MCAST_INTERFACES_SIZE, GFP_ATOMIC | __GFP_NOWARN);
+	if (!ci->to_mcast_interfaces) {
+		DEBUG_WARN("%p: Memory is not available for to_mcast_interfaces\n", ci);
+		return -1;
+	}
+
 	/*
 	 * Iterate the to interface list and add the new interface hierarchies
 	 */
@@ -5918,8 +6062,13 @@
 			 */
 			ii_single = ecm_db_multicast_if_instance_get_at_index(ii_temp, i);
 			ifaces = (struct ecm_db_iface_instance **)ii_single;
-			ci->to_mcast_interfaces[heirarchy_index][i] = *ifaces;
-			_ecm_db_iface_ref(ci->to_mcast_interfaces[heirarchy_index][i]);
+
+			ii_db = ecm_db_multicast_if_heirarchy_get(ci->to_mcast_interfaces, heirarchy_index);
+			ii_db_single = ecm_db_multicast_if_instance_get_at_index(ii_db, i);
+			ifaces_db = (struct ecm_db_iface_instance **)ii_db_single;
+
+			*ifaces_db = *ifaces;
+			_ecm_db_iface_ref(*ifaces_db);
 		}
 	}
 
@@ -5934,6 +6083,7 @@
 	ci->to_mcast_interfaces_set = true;
 	spin_unlock_bh(&ecm_db_lock);
 
+	return 0;
 }
 EXPORT_SYMBOL(ecm_db_multicast_connection_to_interfaces_reset);
 
@@ -5949,6 +6099,9 @@
 	struct ecm_db_iface_instance *ii_temp;
 	struct ecm_db_iface_instance *ii_single;
 	struct ecm_db_iface_instance **ifaces;
+	struct ecm_db_iface_instance *ii_db;
+	struct ecm_db_iface_instance *ii_db_single;
+	struct ecm_db_iface_instance **ifaces_db;
 	int32_t *join_first;
 	int32_t *join_idx;
 	int heirarchy_index;
@@ -5990,8 +6143,11 @@
 			 */
 			ii_single = ecm_db_multicast_if_instance_get_at_index(ii_temp, i);
 			ifaces = (struct ecm_db_iface_instance **)ii_single;
-			ci->to_mcast_interfaces[heirarchy_index][i] = *ifaces;
-			_ecm_db_iface_ref(ci->to_mcast_interfaces[heirarchy_index][i]);
+			ii_db = ecm_db_multicast_if_heirarchy_get(ci->to_mcast_interfaces, heirarchy_index);
+			ii_db_single = ecm_db_multicast_if_instance_get_at_index(ii_db, i);
+			ifaces_db = (struct ecm_db_iface_instance **)ii_db_single;
+			*ifaces_db = *ifaces;
+			_ecm_db_iface_ref(*ifaces_db);
 		}
 		if_index++;
 	}
@@ -6759,9 +6915,9 @@
 	mapping_nat_to->nat_to++;
 
 	/*
-	 * Set the generation number
+	 * Set the generation number to match global
 	 */
-	ci->classifier_generation = ecm_db_classifier_generation;
+	ci->generation = ecm_db_connection_generation;
 
 	spin_unlock_bh(&ecm_db_lock);
 
@@ -7661,7 +7817,13 @@
 	int ip_version;
 	int protocol;
 	bool is_routed;
-	uint32_t generations;
+	uint32_t regen_success;
+	uint32_t regen_fail;
+	uint16_t regen_required;
+	uint16_t regen_occurances;
+	bool regen_in_progress;
+	uint16_t generation;
+	uint16_t global_generation;
 	uint32_t time_added;
 	uint32_t serial;
 	uint64_t from_data_total;
@@ -7696,6 +7858,15 @@
 			expires_in = 0;
 		}
 	}
+
+	regen_success = ci->regen_success;
+	regen_fail = ci->regen_fail;
+	regen_required = ci->regen_required;
+	regen_occurances = ci->regen_occurances;
+	regen_in_progress = ci->regen_in_progress;
+	generation = ci->generation;
+	global_generation = ecm_db_connection_generation;
+
 	spin_unlock_bh(&ecm_db_lock);
 
 	/*
@@ -7730,7 +7901,6 @@
 	ip_version = ci->ip_version;
 	protocol = ci->protocol;
 	is_routed = ci->is_routed;
-	generations = ci->generations;
 	time_added = ci->time_added;
 	serial = ci->serial;
 	ecm_db_connection_data_stats_get(ci, &from_data_total, &to_data_total,
@@ -7821,7 +7991,22 @@
 		return result;
 	}
 
-	if ((result = ecm_state_write(sfi, "generations", "%u", generations))) {
+	if ((result = ecm_state_write(sfi, "regen_success", "%u", regen_success))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "regen_fail", "%u", regen_fail))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "regen_required", "%u", regen_required))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "regen_occurances", "%u", regen_occurances))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "regen_in_progress", "%u", regen_in_progress))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "generation", "%u/%u", generation, global_generation))) {
 		return result;
 	}
 
@@ -10073,18 +10258,21 @@
 		return refs;
 	}
 
-	if (!ti->prev) {
-		DEBUG_ASSERT(ecm_db_multicast_tuple_instance_table[ti->hash_index] == ti, "%p: hash table bad\n", ti);
-		ecm_db_multicast_tuple_instance_table[ti->hash_index] = ti->next;
-	} else {
-		ti->prev->next = ti->next;
+	if (ti->flags & ECM_DB_MULTICAST_TUPLE_INSTANCE_FLAGS_INSERTED) {
+
+		if (!ti->prev) {
+			DEBUG_ASSERT(ecm_db_multicast_tuple_instance_table[ti->hash_index] == ti, "%p: hash table bad\n", ti);
+			ecm_db_multicast_tuple_instance_table[ti->hash_index] = ti->next;
+		} else {
+			ti->prev->next = ti->next;
+		}
+
+		if (ti->next) {
+			ti->next->prev = ti->prev;
+		}
 	}
 
-	if (ti->next) {
-		ti->next->prev = ti->prev;
-	}
 	spin_unlock_bh(&ecm_db_lock);
-
 	DEBUG_CLEAR_MAGIC(ti);
 	kfree(ti);
 
@@ -10094,15 +10282,23 @@
 
 /*
  * ecm_db_multicast_tuple_instance_add()
- * 	Add the connection into the table when a connection is added
+ * 	Add the tuple instance into the hash table. Also, attach the tuple instance
+ * 	with connection instance.
+ *
  * 	Note: This function takes a reference count and caller has to also call
  * 	ecm_db_multicast_tuple_instance_deref() after this function.
  */
-void ecm_db_multicast_tuple_instance_add(struct ecm_db_multicast_tuple_instance *ti)
+void ecm_db_multicast_tuple_instance_add(struct ecm_db_multicast_tuple_instance *ti, struct ecm_db_connection_instance *ci)
 {
 	DEBUG_CHECK_MAGIC(ti, ECM_DB_MULTICAST_INSTANCE_MAGIC, "%p: magic failed", ti);
 
 	spin_lock_bh(&ecm_db_lock);
+	DEBUG_ASSERT(!(ti->flags & ECM_DB_MULTICAST_TUPLE_INSTANCE_FLAGS_INSERTED), "%p: inserted\n", ti);
+
+	/*
+	 * Attach the multicast tuple instance with the connection instance
+	 */
+	ci->ti = ti;
 
 	/*
 	 * Take a local reference to ti
@@ -10114,6 +10310,8 @@
 	}
 
 	ecm_db_multicast_tuple_instance_table[ti->hash_index] = ti;
+
+	ti->flags |= ECM_DB_MULTICAST_TUPLE_INSTANCE_FLAGS_INSERTED;
 	spin_unlock_bh(&ecm_db_lock);
 
 }
@@ -10247,7 +10445,9 @@
 	struct ecm_db_iface_instance *heirarchy_temp;
 	struct ecm_db_iface_instance *ii_single;
 	struct ecm_db_iface_instance **ifaces;
-	struct ecm_db_iface_instance *ii;
+	struct ecm_db_iface_instance *ii_db;
+	struct ecm_db_iface_instance *ii_db_single;
+	struct ecm_db_iface_instance **ifaces_db;
 	int32_t *ii_first_base;
 	int32_t *ii_first;
 	int32_t heirarchy_index;
@@ -10286,12 +10486,18 @@
 		}
 
 		for (ii_index = ci->to_mcast_interface_first[heirarchy_index]; ii_index < ECM_DB_IFACE_HEIRARCHY_MAX; ++ii_index) {
+			ii_db = ecm_db_multicast_if_heirarchy_get(ci->to_mcast_interfaces, heirarchy_index);
+			ii_db_single = ecm_db_multicast_if_instance_get_at_index(ii_db, ii_index);
+			ifaces_db = (struct ecm_db_iface_instance **)ii_db_single;
 
-			ii = ci->to_mcast_interfaces[heirarchy_index][ii_index];
-			_ecm_db_iface_ref(ii);
+			/*
+			 * Take a reference count
+			 */
+			_ecm_db_iface_ref(*ifaces_db);
+
 			ii_single = ecm_db_multicast_if_instance_get_at_index(heirarchy_temp, ii_index);
 			ifaces = (struct ecm_db_iface_instance **)ii_single;
-			*ifaces = ii;
+			*ifaces = *ifaces_db;
 		}
 
 		ii_first = ecm_db_multicast_if_first_get_at_index(ii_first_base, heirarchy_index);
@@ -10329,9 +10535,7 @@
 static void  _ecm_db_multicast_connection_to_interfaces_set_clear(struct ecm_db_connection_instance *ci)
 {
 	DEBUG_CHECK_MAGIC(ci, ECM_DB_CONNECTION_INSTANCE_MAGIC, "%p: magic failed\n", ci);
-	spin_lock_bh(&ecm_db_lock);
 	ci->to_mcast_interfaces_set = false;
-	spin_unlock_bh(&ecm_db_lock);
 }
 
 /*
@@ -10402,8 +10606,8 @@
 void ecm_db_multicast_connection_to_interfaces_clear_at_index(struct ecm_db_connection_instance *ci, uint32_t index)
 {
 	struct ecm_db_iface_instance *discard[ECM_DB_IFACE_HEIRARCHY_MAX];
+	struct ecm_db_iface_instance *ifaces_db_single;
 	int32_t discard_first;
-	int32_t i;
 
 	DEBUG_CHECK_MAGIC(ci, ECM_DB_CONNECTION_INSTANCE_MAGIC, "%p: magic failed\n", ci);
 
@@ -10418,9 +10622,8 @@
 		return;
 	}
 
-	for (i = ci->to_mcast_interface_first[index]; i < ECM_DB_IFACE_HEIRARCHY_MAX; ++i) {
-		discard[i] = ci->to_mcast_interfaces[index][i];
-	}
+	ifaces_db_single = ecm_db_multicast_if_heirarchy_get(ci->to_mcast_interfaces, index);
+	ecm_db_multicast_copy_if_heirarchy(discard, ifaces_db_single);
 
 	discard_first = ci->to_mcast_interface_first[index];
 	ci->to_mcast_interface_first[index] = ECM_DB_IFACE_HEIRARCHY_MAX;
@@ -10449,10 +10652,21 @@
 	int heirarchy_index;
 	DEBUG_CHECK_MAGIC(ci, ECM_DB_CONNECTION_INSTANCE_MAGIC, "%p: magic failed\n", ci);
 
+	spin_lock_bh(&ecm_db_lock);
+	if (!ci->to_mcast_interfaces) {
+		spin_unlock_bh(&ecm_db_lock);
+		return;
+	}
+
 	_ecm_db_multicast_connection_to_interfaces_set_clear(ci);
+	spin_unlock_bh(&ecm_db_lock);
+
 	for (heirarchy_index = 0; heirarchy_index < ECM_DB_MULTICAST_IF_MAX; heirarchy_index++) {
 		ecm_db_multicast_connection_to_interfaces_clear_at_index(ci, heirarchy_index);
 	}
+
+	kfree(ci->to_mcast_interfaces);
+	ci->to_mcast_interfaces = NULL;
 }
 EXPORT_SYMBOL(ecm_db_multicast_connection_to_interfaces_clear);
 #endif
diff --git a/ecm_db.h b/ecm_db.h
index 08d7d04..e23dc10 100644
--- a/ecm_db.h
+++ b/ecm_db.h
@@ -71,12 +71,13 @@
 
 void ecm_db_connection_data_stats_get(struct ecm_db_connection_instance *ci, uint64_t *from_data_total, uint64_t *to_data_total, uint64_t *from_packet_total, uint64_t *to_packet_total, uint64_t *from_data_total_dropped, uint64_t *to_data_total_dropped, uint64_t *from_packet_total_dropped, uint64_t *to_packet_total_dropped);
 
-void ecm_db_classifier_generation_change(void);
-
-void ecm_db_connection_classifier_generation_change(struct ecm_db_connection_instance *ci);
-bool ecm_db_connection_classifier_generation_changed(struct ecm_db_connection_instance *ci);
-bool ecm_db_connection_classifier_peek_generation_changed(struct ecm_db_connection_instance *ci);
-
+uint16_t ecm_db_connection_regeneration_occurrances_get(struct ecm_db_connection_instance *ci);
+void ecm_db_conection_regeneration_completed(struct ecm_db_connection_instance *ci);
+void ecm_db_conection_regeneration_failed(struct ecm_db_connection_instance *ci);
+bool ecm_db_connection_regeneration_required_check(struct ecm_db_connection_instance *ci);
+bool ecm_db_connection_regeneration_required_peek(struct ecm_db_connection_instance *ci);
+void ecm_db_connection_regeneration_needed(struct ecm_db_connection_instance *ci);
+void ecm_db_regeneration_needed(void);
 #ifdef ECM_DB_CTA_TRACK_ENABLE
 void ecm_db_connection_regenerate_by_assignment_type(ecm_classifier_type_t ca_type);
 void ecm_db_connection_make_defunct_by_assignment_type(ecm_classifier_type_t ca_type);
@@ -327,7 +328,7 @@
 #ifdef ECM_MULTICAST_ENABLE
 struct ecm_db_multicast_tuple_instance *ecm_db_multicast_tuple_instance_alloc(ip_addr_t origin, ip_addr_t group, uint16_t src_port, uint16_t dst_port);
 int ecm_db_multicast_tuple_instance_deref(struct ecm_db_multicast_tuple_instance *ti);
-void ecm_db_multicast_tuple_instance_add(struct ecm_db_multicast_tuple_instance *ti);
+void ecm_db_multicast_tuple_instance_add(struct ecm_db_multicast_tuple_instance *ti, struct ecm_db_connection_instance *ci);
 struct ecm_db_multicast_tuple_instance *ecm_db_multicast_tuple_instance_find_and_ref(ip_addr_t origin, ip_addr_t group);
 struct ecm_db_multicast_tuple_instance *ecm_db_multicast_tuple_instance_get_and_ref_first(ip_addr_t group);
 struct ecm_db_multicast_tuple_instance *ecm_db_multicast_tuple_instance_get_and_ref_next(struct ecm_db_multicast_tuple_instance *ti);
@@ -341,7 +342,7 @@
 void ecm_db_multicast_connection_to_interfaces_deref_all(struct ecm_db_iface_instance *interfaces, int32_t *ifaces_first);
 void ecm_db_multicast_connection_to_interfaces_clear(struct ecm_db_connection_instance *ci);
 int32_t ecm_db_multicast_connection_to_interfaces_get_and_ref_all(struct ecm_db_connection_instance *ci, struct ecm_db_iface_instance **interfaces, int32_t **to_ifaces_first);
-void ecm_db_multicast_connection_to_interfaces_reset(struct ecm_db_connection_instance *ci, struct ecm_db_iface_instance *interfaces, int32_t *new_first);
+int ecm_db_multicast_connection_to_interfaces_reset(struct ecm_db_connection_instance *ci, struct ecm_db_iface_instance *interfaces, int32_t *new_first);
 void ecm_db_multicast_connection_to_interfaces_update(struct ecm_db_connection_instance *ci, struct ecm_db_iface_instance *interfaces, int32_t *new_first, int *join_valid_idx);
 void ecm_db_multicast_connection_data_totals_update(struct ecm_db_connection_instance *ci, bool is_from, uint64_t size, uint64_t packets);
 void ecm_db_multicast_connection_to_interfaces_clear_at_index(struct ecm_db_connection_instance *ci, uint32_t index);
diff --git a/ecm_db_types.h b/ecm_db_types.h
index 0869c52..9cacee6 100644
--- a/ecm_db_types.h
+++ b/ecm_db_types.h
@@ -146,6 +146,11 @@
 struct ecm_db_multicast_tuple_instance;
 
 /*
+ * Need to set this flag when Multicast is attached to ci and added to tuple hash table
+ */
+#define ECM_DB_MULTICAST_TUPLE_INSTANCE_FLAGS_INSERTED 0x1
+
+/*
  *  This flag is used to find out whether a bridge device is present or not in a
  *  multicast destination interface list, struct ecm_db_multicast_connection_instance
  *  flags field use this flag.
diff --git a/ecm_init.c b/ecm_init.c
index e564f9d..0fbaef9 100644
--- a/ecm_init.c
+++ b/ecm_init.c
@@ -38,6 +38,7 @@
 #include "ecm_tracker.h"
 #include "ecm_classifier.h"
 #include "ecm_front_end_types.h"
+#include "ecm_db.h"
 #include "ecm_front_end_ipv4.h"
 #ifdef ECM_IPV6_ENABLE
 #include "ecm_front_end_ipv6.h"
@@ -88,15 +89,6 @@
 {
 	int ret;
 
-	/*
-	 * Run only for IPQ8064 platform, if the device tree is used.
-	 */
-#ifdef CONFIG_OF
-	if (!of_machine_is_compatible("qcom,ipq8064")) {
-		DEBUG_WARN("Not compatible platform for ECM\n");
-		return 0;
-	}
-#endif
 	printk(KERN_INFO "ECM init\n");
 
 	ecm_dentry = debugfs_create_dir("ecm", NULL);
@@ -232,17 +224,6 @@
 {
 	printk(KERN_INFO "ECM exit\n");
 
-	/*
-	 * If the platform is not IPQ8064 and device tree is enabled,
-	 * this means ECM started but none of the features are used.
-	 * So, just return here.
-	 */
-#ifdef CONFIG_OF
-	if (!of_machine_is_compatible("qcom,ipq8064")) {
-		return;
-	}
-#endif
-
 	/* call stop on anything that requires a prepare-to-exit signal */
 	DEBUG_INFO("stop conntrack notifier\n");
 	ecm_front_end_conntrack_notifier_stop(1);
diff --git a/ecm_interface.c b/ecm_interface.c
index afd9c6d..62d0596 100644
--- a/ecm_interface.c
+++ b/ecm_interface.c
@@ -703,6 +703,56 @@
 }
 EXPORT_SYMBOL(ecm_interface_send_arp_request);
 
+/*
+ * ecm_interface_ipv4_neigh_get()
+ * 	Returns neighbour reference for a given IP address which must be released when you are done with it.
+ *
+ * Returns NULL on fail.
+ */
+struct neighbour *ecm_interface_ipv4_neigh_get(ip_addr_t addr)
+{
+	struct neighbour *neigh;
+	struct rtable *rt;
+	struct dst_entry *dst;
+	__be32 ipv4_addr;
+
+	ECM_IP_ADDR_TO_NIN4_ADDR(ipv4_addr, addr);
+	rt = ip_route_output(&init_net, ipv4_addr, 0, 0, 0);
+	if (IS_ERR(rt)) {
+		return NULL;
+	}
+	dst = (struct dst_entry *)rt;
+	neigh = dst_neigh_lookup(dst, &ipv4_addr);
+	ip_rt_put(rt);
+	return neigh;
+}
+
+#ifdef ECM_IPV6_ENABLE
+/*
+ * ecm_interface_ipv6_neigh_get()
+ * 	Returns neighbour reference for a given IP address which must be released when you are done with it.
+ *
+ * Returns NULL on fail.
+ */
+struct neighbour *ecm_interface_ipv6_neigh_get(ip_addr_t addr)
+{
+	struct neighbour *neigh;
+	struct rt6_info *rt;
+	struct dst_entry *dst;
+	struct in6_addr ipv6_addr;
+
+	ECM_IP_ADDR_TO_NIN6_ADDR(ipv6_addr, addr);
+	rt = rt6_lookup(&init_net, &ipv6_addr, NULL, 0, 0);
+	if (!rt) {
+		return NULL;
+	}
+	dst = (struct dst_entry *)rt;
+	neigh = dst_neigh_lookup(dst, &ipv6_addr);
+	dst_release(dst);
+	return neigh;
+}
+#endif
+
 #ifdef ECM_INTERFACE_PPP_ENABLE
 /*
  * ecm_interface_skip_l2tp_pptp()
@@ -2921,7 +2971,7 @@
  *	Given an interface list, walk the interfaces and update the stats for certain types.
  */
 static void ecm_interface_list_stats_update(int iface_list_first, struct ecm_db_iface_instance *iface_list[], uint8_t *mac_addr,
-						uint32_t tx_packets, uint32_t tx_bytes, uint32_t rx_packets, uint32_t rx_bytes)
+					bool is_mcast_flow, uint32_t tx_packets, uint32_t tx_bytes, uint32_t rx_packets, uint32_t rx_bytes)
 {
 	int list_index;
 
@@ -2946,14 +2996,16 @@
 		}
 		DEBUG_TRACE("found dev: %p (%s)\n", dev, dev->name);
 
-		/*
-		 * Refresh the bridge forward table entry if the port is a bridge port
-		 * Note: A bridge port can be of different interface type, e.g VLAN, ethernet.
-		 * This check, therefore, should be performed for all interface types.
-		 */
-		if (is_valid_ether_addr(mac_addr) && ecm_front_end_is_bridge_port(dev) && rx_packets) {
-			DEBUG_TRACE("Update bridge fdb entry for mac: %pM\n", mac_addr);
-			br_refresh_fdb_entry(dev, mac_addr);
+		if (likely(!is_mcast_flow)) {
+			/*
+			 * Refresh the bridge forward table entry if the port is a bridge port
+			 * Note: A bridge port can be of different interface type, e.g VLAN, ethernet.
+			 * This check, therefore, should be performed for all interface types.
+			 */
+			if (is_valid_ether_addr(mac_addr) && ecm_front_end_is_bridge_port(dev) && rx_packets) {
+				DEBUG_TRACE("Update bridge fdb entry for mac: %pM\n", mac_addr);
+				br_refresh_fdb_entry(dev, mac_addr);
+			}
 		}
 
 		switch (ii_type) {
@@ -3020,7 +3072,7 @@
 	DEBUG_INFO("%p: Update from interface stats\n", ci);
 	from_ifaces_first = ecm_db_connection_from_interfaces_get_and_ref(ci, from_ifaces);
 	ecm_db_connection_from_node_address_get(ci, mac_addr);
-	ecm_interface_list_stats_update(from_ifaces_first, from_ifaces, mac_addr, from_tx_packets, from_tx_bytes, from_rx_packets, from_rx_bytes);
+	ecm_interface_list_stats_update(from_ifaces_first, from_ifaces, mac_addr, false, from_tx_packets, from_tx_bytes, from_rx_packets, from_rx_bytes);
 	ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
 
 	/*
@@ -3031,89 +3083,13 @@
 	DEBUG_INFO("%p: Update to interface stats\n", ci);
 	to_ifaces_first = ecm_db_connection_to_interfaces_get_and_ref(ci, to_ifaces);
 	ecm_db_connection_to_node_address_get(ci, mac_addr);
-	ecm_interface_list_stats_update(to_ifaces_first, to_ifaces, mac_addr, to_tx_packets, to_tx_bytes, to_rx_packets, to_rx_bytes);
+	ecm_interface_list_stats_update(to_ifaces_first, to_ifaces, mac_addr, false, to_tx_packets, to_tx_bytes, to_rx_packets, to_rx_bytes);
 	ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
 }
 EXPORT_SYMBOL(ecm_interface_stats_update);
 
 #ifdef ECM_MULTICAST_ENABLE
 /*
- * ecm_interface_multicast_list_stats_update()
- *	Given a destination interface list for a multicast connection, walk the interfaces and update
- *	the stats for certain types.
- *
- *	TODO: For next merge change this function to use this for both unicast list_stats_update and
- *	      multicast list_stats_update. This would save repetition of same code again.
- */
-static void ecm_interface_multicast_list_stats_update(int iface_list_first, struct ecm_db_iface_instance *iface_list, uint32_t tx_packets,
-					       uint32_t tx_bytes, uint32_t rx_packets, uint32_t rx_bytes)
-{
-	struct ecm_db_iface_instance **ifaces;
-	struct ecm_db_iface_instance *ii_temp;
-	int list_index;
-
-	for (list_index = iface_list_first; (list_index < ECM_DB_IFACE_HEIRARCHY_MAX); list_index++) {
-		struct ecm_db_iface_instance *ii;
-		struct net_device *dev;
-		char *ii_name;
-		ecm_db_iface_type_t ii_type;
-
-		ii_temp = ecm_db_multicast_if_instance_get_at_index(iface_list, list_index);
-		ifaces = (struct ecm_db_iface_instance **)ii_temp;
-		ii = *ifaces;
-		ii_type = ecm_db_connection_iface_type_get(ii);
-		ii_name = ecm_db_interface_type_to_string(ii_type);
-		DEBUG_TRACE("list_index: %d, ii: %p, type: %d (%s)\n", list_index, ii, ii_type, ii_name);
-
-		/*
-		 * Locate real device in system
-		 */
-		dev = dev_get_by_index(&init_net, ecm_db_iface_interface_identifier_get(ii));
-		if (!dev) {
-			DEBUG_WARN("Could not locate interface\n");
-			continue;
-		}
-		DEBUG_TRACE("found dev: %p (%s)\n", dev, dev->name);
-
-		switch (ii_type) {
-			struct rtnl_link_stats64 stats;
-
-#ifdef ECM_INTERFACE_VLAN_ENABLE
-			case ECM_DB_IFACE_TYPE_VLAN:
-				DEBUG_INFO("VLAN\n");
-				stats.rx_packets = rx_packets;
-				stats.rx_bytes = rx_bytes;
-				stats.tx_packets = tx_packets;
-				stats.tx_bytes = tx_bytes;
-				__vlan_dev_update_accel_stats(dev, &stats);
-				break;
-#endif
-			case ECM_DB_IFACE_TYPE_BRIDGE:
-				DEBUG_INFO("BRIDGE\n");
-				stats.rx_packets = rx_packets;
-				stats.rx_bytes = rx_bytes;
-				stats.tx_packets = tx_packets;
-				stats.tx_bytes = tx_bytes;
-				br_dev_update_stats(dev, &stats);
-				break;
-#ifdef ECM_INTERFACE_PPP_ENABLE
-			case ECM_DB_IFACE_TYPE_PPPOE:
-				DEBUG_INFO("PPPOE\n");
-				ppp_update_stats(dev, rx_packets, rx_bytes, tx_packets, tx_bytes);
-				break;
-#endif
-			default:
-				/*
-				 * TODO: Extend it accordingly
-				 */
-				break;
-		}
-
-		dev_put(dev);
-	}
-}
-
-/*
  * ecm_interface_multicast_stats_update()
  *	Using the interface lists for the given connection, update the interface statistics for each.
  *
@@ -3125,6 +3101,7 @@
 				   uint32_t to_rx_packets, uint32_t to_rx_bytes)
 {
 	struct ecm_db_iface_instance *from_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX];
+	struct ecm_db_iface_instance *to_list_single[ECM_DB_IFACE_HEIRARCHY_MAX];
 	struct ecm_db_iface_instance *to_ifaces;
 	struct ecm_db_iface_instance *ii_temp;
 	int from_ifaces_first;
@@ -3141,7 +3118,7 @@
 	DEBUG_INFO("%p: Update from interface stats\n", ci);
 	from_ifaces_first = ecm_db_connection_from_interfaces_get_and_ref(ci, from_ifaces);
 	ecm_db_connection_from_node_address_get(ci, mac_addr);
-	ecm_interface_list_stats_update(from_ifaces_first, from_ifaces, mac_addr, from_tx_packets, from_tx_bytes, from_rx_packets, from_rx_bytes);
+	ecm_interface_list_stats_update(from_ifaces_first, from_ifaces, mac_addr, false, from_tx_packets, from_tx_bytes, from_rx_packets, from_rx_bytes);
 	ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
 
 	/*
@@ -3164,7 +3141,8 @@
 	for (if_index = 0; if_index < ECM_DB_MULTICAST_IF_MAX; if_index++) {
 		if (to_ifaces_first[if_index] < ECM_DB_IFACE_HEIRARCHY_MAX) {
 			ii_temp = ecm_db_multicast_if_heirarchy_get(to_ifaces, if_index);
-			ecm_interface_multicast_list_stats_update(to_ifaces_first[if_index], ii_temp, to_tx_packets, to_tx_bytes, to_rx_packets, to_rx_bytes);
+			ecm_db_multicast_copy_if_heirarchy(to_list_single, ii_temp);
+			ecm_interface_list_stats_update(to_ifaces_first[if_index], to_list_single, mac_addr, true, to_tx_packets, to_tx_bytes, to_rx_packets, to_rx_bytes);
 		}
 	}
 
@@ -3188,7 +3166,7 @@
 	 * Re-generation occurs when we next see traffic OR an acceleration engine sync for this connection.
 	 * Refer to front end protocol specific process() functions.
 	 */
-	ecm_db_connection_classifier_generation_change(ci);
+	ecm_db_connection_regeneration_needed(ci);
 
 	/*
 	 * If the connection is accelerated then force deceleration.
@@ -3220,7 +3198,7 @@
 	/*
 	 * An interface has changed, re-generate the connections to ensure all state is updated.
 	 */
-	ecm_db_classifier_generation_change();
+	ecm_db_regeneration_needed();
 #else
 	/*
 	 * Iterate the connections of this interface and cause each one to be re-generated.
@@ -3235,7 +3213,7 @@
 		cin = ecm_db_connection_iface_from_get_and_ref_next(ci);
 
 		DEBUG_TRACE("%p: Regenerate: %p", ii, ci);
-		ecm_interface_regenerate_connection(ci);
+		ecm_db_connection_regeneration_needed(ci);
 		ecm_db_connection_deref(ci);
 		ci = cin;
 	}
@@ -3247,7 +3225,7 @@
 		cin = ecm_db_connection_iface_to_get_and_ref_next(ci);
 
 		DEBUG_TRACE("%p: Regenerate: %p", ii, ci);
-		ecm_interface_regenerate_connection(ci);
+		ecm_db_connection_regeneration_needed(ci);
 		ecm_db_connection_deref(ci);
 		ci = cin;
 	}
@@ -3259,7 +3237,7 @@
 		cin = ecm_db_connection_iface_nat_from_get_and_ref_next(ci);
 
 		DEBUG_TRACE("%p: Regenerate: %p", ii, ci);
-		ecm_interface_regenerate_connection(ci);
+		ecm_db_connection_regeneration_needed(ci);
 		ecm_db_connection_deref(ci);
 		ci = cin;
 	}
@@ -3271,7 +3249,7 @@
 		cin = ecm_db_connection_iface_nat_to_get_and_ref_next(ci);
 
 		DEBUG_TRACE("%p: Regenerate: %p", ii, ci);
-		ecm_interface_regenerate_connection(ci);
+		ecm_db_connection_regeneration_needed(ci);
 		ecm_db_connection_deref(ci);
 		ci = cin;
 	}
diff --git a/ecm_interface.h b/ecm_interface.h
index e72ddf3..c6d33b3 100644
--- a/ecm_interface.h
+++ b/ecm_interface.h
@@ -46,6 +46,10 @@
 void ecm_interface_send_neighbour_solicitation(struct net_device *dev, ip_addr_t addr);
 #endif
 void ecm_interface_send_arp_request(struct net_device *dest_dev, ip_addr_t dest_addr, bool on_link, ip_addr_t gw_addr);
+struct neighbour *ecm_interface_ipv4_neigh_get(ip_addr_t addr);
+#ifdef ECM_IPV6_ENABLE
+struct neighbour *ecm_interface_ipv6_neigh_get(ip_addr_t addr);
+#endif
 bool ecm_interface_skip_l2tp_pptp(struct sk_buff *skb, const struct net_device *out);
 struct ecm_db_iface_instance *ecm_interface_establish_and_ref(struct ecm_front_end_connection_instance *feci, struct net_device *dev);
 
diff --git a/ecm_types.h b/ecm_types.h
index 66103dc..b5f3221 100644
--- a/ecm_types.h
+++ b/ecm_types.h
@@ -149,13 +149,6 @@
 		__ECM_IP_ADDR_COPY_NO_CHECK(d,s); \
 	}
 
-#define ECM_LINUX6_TO_IP_ADDR(d,s) \
-	{ \
-		ecm_type_check_ecm_ip_addr(d); \
-		ecm_type_check_ae_ipv6(&s); \
-		__ECM_IP_ADDR_COPY_NO_CHECK(d,s); \
-	}
-
 /*
  * This macro converts from Linux IPv6 address (network order) to ECM ip_addr_t
  */
diff --git a/frontends/ecm_front_end_common.c b/frontends/ecm_front_end_common.c
index 9408ced..6b0480b 100644
--- a/frontends/ecm_front_end_common.c
+++ b/frontends/ecm_front_end_common.c
@@ -61,10 +61,13 @@
 	 * Check the other platforms and use the correct APIs for those platforms.
 	 */
 	if (!of_machine_is_compatible("qcom,ipq8064")) {
-		return;
+		ecm_sfe_conntrack_notifier_stop(num);
+	} else {
+		ecm_nss_conntrack_notifier_stop(num);
 	}
-#endif
+#else
 	ecm_nss_conntrack_notifier_stop(num);
+#endif
 }
 
 /*
@@ -82,10 +85,13 @@
 	 * Check the other platforms and use the correct APIs for those platforms.
 	 */
 	if (!of_machine_is_compatible("qcom,ipq8064")) {
-		return -1;
+		return ecm_sfe_conntrack_notifier_init(dentry);
+	} else {
+		return ecm_nss_conntrack_notifier_init(dentry);
 	}
-#endif
+#else
 	return ecm_nss_conntrack_notifier_init(dentry);
+#endif
 }
 
 /*
@@ -103,10 +109,13 @@
 	 * Check the other platforms and use the correct APIs for those platforms.
 	 */
 	if (!of_machine_is_compatible("qcom,ipq8064")) {
-		return;
+		ecm_sfe_conntrack_notifier_exit();
+	} else {
+		ecm_nss_conntrack_notifier_exit();
 	}
-#endif
+#else
 	ecm_nss_conntrack_notifier_exit();
+#endif
 }
 
 #ifdef ECM_INTERFACE_BOND_ENABLE
@@ -147,7 +156,7 @@
 	 * Check the other platforms and use the correct APIs for those platforms.
 	 */
 	if (!of_machine_is_compatible("qcom,ipq8064")) {
-		return -1;
+		return 0;
 	}
 #endif
 	return ecm_nss_bond_notifier_init(dentry);
diff --git a/frontends/ecm_front_end_ipv4.c b/frontends/ecm_front_end_ipv4.c
index 0eac1b7..0f37d42 100644
--- a/frontends/ecm_front_end_ipv4.c
+++ b/frontends/ecm_front_end_ipv4.c
@@ -60,10 +60,13 @@
 	 * Check the other platforms and use the correct APIs for those platforms.
 	 */
 	if (!of_machine_is_compatible("qcom,ipq8064")) {
-		return;
+		ecm_sfe_ipv4_stop(num);
+	} else {
+		ecm_nss_ipv4_stop(num);
 	}
-#endif
+#else
 	ecm_nss_ipv4_stop(num);
+#endif
 
 }
 
@@ -81,11 +84,13 @@
 	 * Check the other platforms and use the correct APIs for those platforms.
 	 */
 	if (!of_machine_is_compatible("qcom,ipq8064")) {
-		return -1;
+		return ecm_sfe_ipv4_init(dentry);
+	} else {
+		return ecm_nss_ipv4_init(dentry);
 	}
-#endif
+#else
 	return ecm_nss_ipv4_init(dentry);
-
+#endif
 }
 
 /*
@@ -102,9 +107,12 @@
 	 * Check the other platforms and use the correct APIs for those platforms.
 	 */
 	if (!of_machine_is_compatible("qcom,ipq8064")) {
-		return;
+		ecm_sfe_ipv4_exit();
+	} else {
+		ecm_nss_ipv4_exit();
 	}
-#endif
+#else
 	ecm_nss_ipv4_exit();
+#endif
 }
 
diff --git a/frontends/ecm_front_end_ipv6.c b/frontends/ecm_front_end_ipv6.c
index 2a2a6fd..2388e9c 100644
--- a/frontends/ecm_front_end_ipv6.c
+++ b/frontends/ecm_front_end_ipv6.c
@@ -60,11 +60,13 @@
 	 * Check the other platforms and use the correct APIs for those platforms.
 	 */
 	if (!of_machine_is_compatible("qcom,ipq8064")) {
-		return;
+		ecm_sfe_ipv6_stop(num);
+	} else {
+		ecm_nss_ipv6_stop(num);
 	}
-#endif
+#else
 	ecm_nss_ipv6_stop(num);
-
+#endif
 }
 
 /*
@@ -81,11 +83,13 @@
 	 * Check the other platforms and use the correct APIs for those platforms.
 	 */
 	if (!of_machine_is_compatible("qcom,ipq8064")) {
-		return -1;
+		return ecm_sfe_ipv6_init(dentry);
+	} else {
+		return ecm_nss_ipv6_init(dentry);
 	}
-#endif
+#else
 	return ecm_nss_ipv6_init(dentry);
-
+#endif
 }
 
 /*
@@ -102,9 +106,12 @@
 	 * Check the other platforms and use the correct APIs for those platforms.
 	 */
 	if (!of_machine_is_compatible("qcom,ipq8064")) {
-		return;
+		ecm_sfe_ipv6_exit();
+	} else {
+		ecm_nss_ipv6_exit();
 	}
-#endif
+#else
 	ecm_nss_ipv6_exit();
+#endif
 }
 
diff --git a/frontends/include/ecm_front_end_common.h b/frontends/include/ecm_front_end_common.h
index 0da2d09..1ca8641 100644
--- a/frontends/include/ecm_front_end_common.h
+++ b/frontends/include/ecm_front_end_common.h
@@ -15,8 +15,90 @@
  */
 
 #include <linux/if_pppox.h>
+
+#ifdef ECM_FRONT_END_NSS_ENABLE
 #include "ecm_nss_conntrack_notifier.h"
+#else
+static inline void ecm_nss_conntrack_notifier_stop(int num)
+{
+	/*
+	 * Just return if nss front end is not enabled
+	 */
+	return;
+}
+
+static inline int ecm_nss_conntrack_notifier_init(struct dentry *dentry)
+{
+	/*
+	 * Just return if nss front end is not enabled
+	 */
+	return 0;
+}
+
+static inline void ecm_nss_conntrack_notifier_exit(void)
+{
+	/*
+	 * Just return if nss front end is not enabled
+	 */
+	return;
+}
+#endif
+
+#ifdef ECM_FRONT_END_SFE_ENABLE
+#include "ecm_sfe_conntrack_notifier.h"
+#else
+static inline void ecm_sfe_conntrack_notifier_stop(int num)
+{
+	/*
+	 * Just return if sfe front end is not enabled
+	 */
+	return;
+}
+
+static inline int ecm_sfe_conntrack_notifier_init(struct dentry *dentry)
+{
+	/*
+	 * Just return if sfe front end is not enabled
+	 */
+	return 0;
+}
+
+static inline void ecm_sfe_conntrack_notifier_exit(void)
+{
+	/*
+	 * Just return if sfe front end is not enabled
+	 */
+	return;
+}
+#endif
+
+#ifdef ECM_FRONT_END_NSS_ENABLE
 #include "ecm_nss_bond_notifier.h"
+#else
+static inline void ecm_nss_bond_notifier_stop(int num)
+{
+	/*
+	 * Just return if nss front end is not enabled
+	 */
+	return;
+}
+
+static inline int ecm_nss_bond_notifier_init(struct dentry *dentry)
+{
+	/*
+	 * Just return if nss front end is not enabled
+	 */
+	return 0;
+}
+
+static inline void ecm_nss_bond_notifier_exit(void)
+{
+	/*
+	 * Just return if nss front end is not enabled
+	 */
+	return;
+}
+#endif
 
 /*
  * ecm_front_end_l2_encap_header_len()
diff --git a/frontends/include/ecm_front_end_ipv4.h b/frontends/include/ecm_front_end_ipv4.h
index 6993e8b..b68b055 100644
--- a/frontends/include/ecm_front_end_ipv4.h
+++ b/frontends/include/ecm_front_end_ipv4.h
@@ -14,7 +14,61 @@
  **************************************************************************
  */
 
+#ifdef ECM_FRONT_END_NSS_ENABLE
 #include "ecm_nss_ipv4.h"
+#else
+static inline int ecm_nss_ipv4_init(struct dentry *dentry)
+{
+	/*
+	 * Just return if nss front end is not enabled
+	 */
+	return 0;
+}
+
+static inline void ecm_nss_ipv4_stop(int num)
+{
+	/*
+	 * Just return if nss front end is not enabled
+	 */
+	return;
+}
+
+static inline void ecm_nss_ipv4_exit(void)
+{
+	/*
+	 * Just return if nss front end is not enabled
+	 */
+	return;
+}
+#endif
+
+#ifdef ECM_FRONT_END_SFE_ENABLE
+#include "ecm_sfe_ipv4.h"
+#else
+static inline int ecm_sfe_ipv4_init(struct dentry *dentry)
+{
+	/*
+	 * Just return if sfe front end is not enabled
+	 */
+	return 0;
+}
+
+static inline void ecm_sfe_ipv4_stop(int num)
+{
+	/*
+	 * Just return if sfe front end is not enabled
+	 */
+	return;
+}
+
+static inline void ecm_sfe_ipv4_exit(void)
+{
+	/*
+	 * Just return if sfe front end is not enabled
+	 */
+	return;
+}
+#endif
 
 /*
  * IPv4 rule sync reasons.
diff --git a/frontends/include/ecm_front_end_ipv6.h b/frontends/include/ecm_front_end_ipv6.h
index 5b20a3c..321a12d 100644
--- a/frontends/include/ecm_front_end_ipv6.h
+++ b/frontends/include/ecm_front_end_ipv6.h
@@ -14,10 +14,64 @@
  **************************************************************************
  */
 
+#ifdef ECM_FRONT_END_NSS_ENABLE
 #include "ecm_nss_ipv6.h"
+#else
+static inline int ecm_nss_ipv6_init(struct dentry *dentry)
+{
+	/*
+	 * Just return if nss front end is not enabled
+	 */
+	return 0;
+}
+
+static inline void ecm_nss_ipv6_stop(int num)
+{
+	/*
+	 * Just return if nss front end is not enabled
+	 */
+	return;
+}
+
+static inline void ecm_nss_ipv6_exit(void)
+{
+	/*
+	 * Just return if nss front end is not enabled
+	 */
+	return;
+}
+#endif
+
+#ifdef ECM_FRONT_END_SFE_ENABLE
+#include "ecm_sfe_ipv6.h"
+#else
+static inline int ecm_sfe_ipv6_init(struct dentry *dentry)
+{
+	/*
+	 * Just return if sfe front end is not enabled
+	 */
+	return 0;
+}
+
+static inline void ecm_sfe_ipv6_stop(int num)
+{
+	/*
+	 * Just return if sfe front end is not enabled
+	 */
+	return;
+}
+
+static inline void ecm_sfe_ipv6_exit(void)
+{
+	/*
+	 * Just return if sfe front end is not enabled
+	 */
+	return;
+}
+#endif
 
 /*
- * IPv4 rule sync reasons.
+ * IPv6 rule sync reasons.
  */
 enum ecm_front_end_ipv6_rule_sync_reason {
 	ECM_FRONT_END_IPV6_RULE_SYNC_REASON_STATS = 0,	/* Sync is to synchronize stats */
diff --git a/frontends/nss/ecm_nss_ipv4.c b/frontends/nss/ecm_nss_ipv4.c
index fddbb6e..2df44b6 100644
--- a/frontends/nss/ecm_nss_ipv4.c
+++ b/frontends/nss/ecm_nss_ipv4.c
@@ -654,7 +654,7 @@
  * It also involves the possible triggering of classifier re-evaluation but only if all currently assigned
  * classifiers permit this operation.
  */
-bool ecm_nss_ipv4_connection_regenerate(struct ecm_db_connection_instance *ci, ecm_tracker_sender_type_t sender,
+void ecm_nss_ipv4_connection_regenerate(struct ecm_db_connection_instance *ci, ecm_tracker_sender_type_t sender,
 							struct net_device *out_dev, struct net_device *out_dev_nat,
 							struct net_device *in_dev, struct net_device *in_dev_nat)
 {
@@ -786,17 +786,25 @@
 		}
 	}
 
+	/*
+	 * Re-generation of state is successful.
+	 */
+	ecm_db_conection_regeneration_completed(ci);
+
+	/*
+	 * Now we action any classifier re-classify
+	 */
 	if (!reclassify_allowed) {
 		/*
 		 * Regeneration came to a successful conclusion even though reclassification was denied
 		 */
-		DEBUG_WARN("%p: re-gen denied\n", ci);\
+		DEBUG_WARN("%p: re-classify denied\n", ci);
 
 		/*
 		 * Release the assignments
 		 */
 		ecm_db_connection_assignments_release(assignment_count, assignments);
-		return true;
+		return;
 	}
 
 	/*
@@ -809,7 +817,7 @@
 		 */
 		DEBUG_WARN("%p: Regeneration: reclassify failed\n", ci);
 		ecm_db_connection_assignments_release(assignment_count, assignments);
-		return false;
+		return;
 	}
 	DEBUG_INFO("%p: reclassify success\n", ci);
 
@@ -817,12 +825,12 @@
 	 * Release the assignments
 	 */
 	ecm_db_connection_assignments_release(assignment_count, assignments);
-	return true;
+	return;
 
 ecm_ipv4_retry_regen:
 	feci->deref(feci);
-	ecm_db_connection_classifier_generation_change(ci);
-	return false;
+	ecm_db_conection_regeneration_failed(ci);
+	return;
 }
 
 /*
@@ -1533,30 +1541,6 @@
 }
 
 /*
- * ecm_nss_ipv4_neigh_get()
- * 	Returns neighbour reference for a given IP address which must be released when you are done with it.
- *
- * Returns NULL on fail.
- */
-static struct neighbour *ecm_nss_ipv4_neigh_get(ip_addr_t addr)
-{
-	struct neighbour *neigh;
-	struct rtable *rt;
-	struct dst_entry *dst;
-	__be32 ipv4_addr;
-
-	ECM_IP_ADDR_TO_NIN4_ADDR(ipv4_addr, addr);
-	rt = ip_route_output(&init_net, ipv4_addr, 0, 0, 0);
-	if (IS_ERR(rt)) {
-		return NULL;
-	}
-	dst = (struct dst_entry *)rt;
-	neigh = dst_neigh_lookup(dst, &ipv4_addr);
-	ip_rt_put(rt);
-	return neigh;
-}
-
-/*
  * ecm_nss_ipv4_process_one_conn_sync_msg()
  *	Process one connection sync message.
  */
@@ -1746,7 +1730,7 @@
 		/*
 		 * Update the neighbour entry for source IP address
 		 */
-		neigh = ecm_nss_ipv4_neigh_get(flow_ip);
+		neigh = ecm_interface_ipv4_neigh_get(flow_ip);
 		if (!neigh) {
 			DEBUG_WARN("Neighbour entry for %pI4h not found\n", &sync->flow_ip);
 		} else {
@@ -1760,7 +1744,7 @@
 		 * Update the neighbour entry for destination IP address
 		 */
 		if (!ecm_ip_addr_is_multicast(return_ip)) {
-			neigh = ecm_nss_ipv4_neigh_get(return_ip);
+			neigh = ecm_interface_ipv4_neigh_get(return_ip);
 			if (!neigh) {
 				DEBUG_WARN("Neighbour entry for %pI4h not found\n", &sync->return_ip);
 			} else {
@@ -1773,7 +1757,7 @@
 		/*
 		 * Update the neighbour entry for destination IP address
 		 */
-		neigh = ecm_nss_ipv4_neigh_get(return_ip);
+		neigh = ecm_interface_ipv4_neigh_get(return_ip);
 		if (!neigh) {
 			DEBUG_WARN("Neighbour entry for %pI4h not found\n", &sync->return_ip);
 		} else {
@@ -1787,7 +1771,7 @@
 	/*
 	 * If connection should be re-generated then we need to force a deceleration
 	 */
-	if (unlikely(ecm_db_connection_classifier_peek_generation_changed(ci))) {
+	if (unlikely(ecm_db_connection_regeneration_required_peek(ci))) {
 		DEBUG_TRACE("%p: Connection generation changing, terminating acceleration", ci);
 		feci->decelerate(feci);
 	}
diff --git a/frontends/nss/ecm_nss_ipv4.h b/frontends/nss/ecm_nss_ipv4.h
index f06062c..41983ad 100644
--- a/frontends/nss/ecm_nss_ipv4.h
+++ b/frontends/nss/ecm_nss_ipv4.h
@@ -58,10 +58,19 @@
  */
 static inline bool ecm_nss_ipv4_accel_pending_set(struct ecm_front_end_connection_instance *feci)
 {
-	/*
-	 * Can this connection be accelerated at all?
-	 */
 	DEBUG_INFO("%p: Accel conn: %p\n", feci, feci->ci);
+
+	/*
+	 * If re-generation is required then we cannot permit acceleration
+	 */
+	if (ecm_db_connection_regeneration_required_peek(feci->ci)) {
+		DEBUG_TRACE("%p: accel %p failed - regen required\n", feci, feci->ci);
+		return false;
+	}
+
+	/*
+	 * Is connection acceleration permanently failed?
+	 */
 	spin_lock_bh(&feci->lock);
 	if (ECM_FRONT_END_ACCELERATION_FAILED(feci->accel_mode)) {
 		spin_unlock_bh(&feci->lock);
@@ -159,7 +168,7 @@
 extern void ecm_nss_ipv4_decel_done_time_update(struct ecm_front_end_connection_instance *feci);
 extern struct ecm_classifier_instance *ecm_nss_ipv4_assign_classifier(struct ecm_db_connection_instance *ci, ecm_classifier_type_t type);
 extern bool ecm_nss_ipv4_reclassify(struct ecm_db_connection_instance *ci, int assignment_count, struct ecm_classifier_instance *assignments[]);
-extern bool ecm_nss_ipv4_connection_regenerate(struct ecm_db_connection_instance *ci, ecm_tracker_sender_type_t sender,
+extern void ecm_nss_ipv4_connection_regenerate(struct ecm_db_connection_instance *ci, ecm_tracker_sender_type_t sender,
 							struct net_device *out_dev, struct net_device *out_dev_nat,
 							struct net_device *in_dev, struct net_device *in_dev_nat);
 extern struct ecm_db_node_instance *ecm_nss_ipv4_node_establish_and_ref(struct ecm_front_end_connection_instance *feci,
diff --git a/frontends/nss/ecm_nss_ipv6.c b/frontends/nss/ecm_nss_ipv6.c
index 2528bb1..146dca0 100644
--- a/frontends/nss/ecm_nss_ipv6.c
+++ b/frontends/nss/ecm_nss_ipv6.c
@@ -659,7 +659,7 @@
  * It also involves the possible triggering of classifier re-evaluation but only if all currently assigned
  * classifiers permit this operation.
  */
-bool ecm_nss_ipv6_connection_regenerate(struct ecm_db_connection_instance *ci, ecm_tracker_sender_type_t sender,
+void ecm_nss_ipv6_connection_regenerate(struct ecm_db_connection_instance *ci, ecm_tracker_sender_type_t sender,
 							struct net_device *out_dev, struct net_device *in_dev)
 {
 	int i;
@@ -756,17 +756,22 @@
 		}
 	}
 
+	/*
+	 * Re-generation of state is successful.
+	 */
+	ecm_db_conection_regeneration_completed(ci);
+
 	if (!reclassify_allowed) {
 		/*
 		 * Regeneration came to a successful conclusion even though reclassification was denied
 		 */
-		DEBUG_WARN("%p: re-gen denied\n", ci);\
+		DEBUG_WARN("%p: re-classify denied\n", ci);
 
 		/*
 		 * Release the assignments
 		 */
 		ecm_db_connection_assignments_release(assignment_count, assignments);
-		return true;
+		return;
 	}
 
 	/*
@@ -777,9 +782,9 @@
 		/*
 		 * We could not set up the classifiers to reclassify, it is safer to fail out and try again next time
 		 */
-		DEBUG_WARN("%p: Regeneration failed\n", ci);
+		DEBUG_WARN("%p: Regeneration: reclassify failed\n", ci);
 		ecm_db_connection_assignments_release(assignment_count, assignments);
-		return false;
+		return;
 	}
 	DEBUG_INFO("%p: reclassify success\n", ci);
 
@@ -787,12 +792,12 @@
 	 * Release the assignments
 	 */
 	ecm_db_connection_assignments_release(assignment_count, assignments);
-	return true;
+	return;
 
 ecm_ipv6_retry_regen:
 	feci->deref(feci);
-	ecm_db_connection_classifier_generation_change(ci);
-	return false;
+	ecm_db_conection_regeneration_failed(ci);
+	return;
 }
 
 /*
@@ -1267,30 +1272,6 @@
 }
 
 /*
- * ecm_nss_ipv6_neigh_get()
- * 	Returns neighbour reference for a given IP address which must be released when you are done with it.
- *
- * Returns NULL on fail.
- */
-static struct neighbour *ecm_nss_ipv6_neigh_get(ip_addr_t addr)
-{
-	struct neighbour *neigh;
-	struct rt6_info *rt;
-	struct dst_entry *dst;
-	struct in6_addr ipv6_addr;
-
-	ECM_IP_ADDR_TO_NIN6_ADDR(ipv6_addr, addr);
-	rt = rt6_lookup(&init_net, &ipv6_addr, NULL, 0, 0);
-	if (!rt) {
-		return NULL;
-	}
-	dst = (struct dst_entry *)rt;
-	neigh = dst_neigh_lookup(dst, &ipv6_addr);
-	dst_release(dst);
-	return neigh;
-}
-
-/*
  * ecm_nss_ipv6_process_one_conn_sync_msg()
  *	Process one connection sync message.
  */
@@ -1468,7 +1449,7 @@
 		/*
 		 * Update the neighbour entry for source IP address
 		 */
-		neigh = ecm_nss_ipv6_neigh_get(flow_ip);
+		neigh = ecm_interface_ipv6_neigh_get(flow_ip);
 		if (!neigh) {
 			DEBUG_WARN("Neighbour entry for " ECM_IP_ADDR_OCTAL_FMT " not found\n", ECM_IP_ADDR_TO_OCTAL(flow_ip));
 		} else {
@@ -1482,7 +1463,7 @@
 		 * Update the neighbour entry for destination IP address
 		 */
 		if (!ecm_ip_addr_is_multicast(return_ip)) {
-			neigh = ecm_nss_ipv6_neigh_get(return_ip);
+			neigh = ecm_interface_ipv6_neigh_get(return_ip);
 			if (!neigh) {
 				DEBUG_WARN("Neighbour entry for " ECM_IP_ADDR_OCTAL_FMT " not found\n", ECM_IP_ADDR_TO_OCTAL(return_ip));
 			} else {
@@ -1495,7 +1476,7 @@
 		/*
 		 * Update the neighbour entry for destination IP address
 		 */
-		neigh = ecm_nss_ipv6_neigh_get(return_ip);
+		neigh = ecm_interface_ipv6_neigh_get(return_ip);
 		if (!neigh) {
 			DEBUG_WARN("Neighbour entry for " ECM_IP_ADDR_OCTAL_FMT " not found\n", ECM_IP_ADDR_TO_OCTAL(return_ip));
 		} else {
@@ -1509,7 +1490,7 @@
 	/*
 	 * If connection should be re-generated then we need to force a deceleration
 	 */
-	if (unlikely(ecm_db_connection_classifier_peek_generation_changed(ci))) {
+	if (unlikely(ecm_db_connection_regeneration_required_peek(ci))) {
 		DEBUG_TRACE("%p: Connection generation changing, terminating acceleration", ci);
 		feci->decelerate(feci);
 	}
diff --git a/frontends/nss/ecm_nss_ipv6.h b/frontends/nss/ecm_nss_ipv6.h
index b421619..35663d5 100644
--- a/frontends/nss/ecm_nss_ipv6.h
+++ b/frontends/nss/ecm_nss_ipv6.h
@@ -58,10 +58,19 @@
  */
 static inline bool ecm_nss_ipv6_accel_pending_set(struct ecm_front_end_connection_instance *feci)
 {
-	/*
-	 * Can this connection be accelerated at all?
-	 */
 	DEBUG_INFO("%p: Accel conn: %p\n", feci, feci->ci);
+
+	/*
+	 * If re-generation is required then we cannot permit acceleration
+	 */
+	if (ecm_db_connection_regeneration_required_peek(feci->ci)) {
+		DEBUG_TRACE("%p: accel %p failed - regen required\n", feci, feci->ci);
+		return false;
+	}
+
+	/*
+	 * Is connection acceleration permanently failed?
+	 */
 	spin_lock_bh(&feci->lock);
 	if (ECM_FRONT_END_ACCELERATION_FAILED(feci->accel_mode)) {
 		spin_unlock_bh(&feci->lock);
@@ -159,7 +168,7 @@
 extern void ecm_nss_ipv6_decel_done_time_update(struct ecm_front_end_connection_instance *feci);
 extern struct ecm_classifier_instance *ecm_nss_ipv6_assign_classifier(struct ecm_db_connection_instance *ci, ecm_classifier_type_t type);
 extern bool ecm_nss_ipv6_reclassify(struct ecm_db_connection_instance *ci, int assignment_count, struct ecm_classifier_instance *assignments[]);
-extern bool ecm_nss_ipv6_connection_regenerate(struct ecm_db_connection_instance *ci, ecm_tracker_sender_type_t sender,
+extern void ecm_nss_ipv6_connection_regenerate(struct ecm_db_connection_instance *ci, ecm_tracker_sender_type_t sender,
 							struct net_device *out_dev, struct net_device *in_dev);
 extern struct ecm_db_node_instance *ecm_nss_ipv6_node_establish_and_ref(struct ecm_front_end_connection_instance *feci,
 							struct net_device *dev, ip_addr_t addr,
diff --git a/frontends/nss/ecm_nss_multicast_ipv4.c b/frontends/nss/ecm_nss_multicast_ipv4.c
index efd67ac..92d1e9b 100644
--- a/frontends/nss/ecm_nss_multicast_ipv4.c
+++ b/frontends/nss/ecm_nss_multicast_ipv4.c
@@ -385,9 +385,10 @@
  * 	and sends a 'multicast update' command to NSS to inform about these interface state changes.
  */
 static int ecm_nss_multicast_ipv4_connection_update_accelerate(struct ecm_front_end_connection_instance *feci,
-							       struct ecm_multicast_if_update *rp, bool is_br_flow)
+							       struct ecm_multicast_if_update *rp)
 {
 	struct ecm_nss_multicast_ipv4_connection_instance *nmci = (struct ecm_nss_multicast_ipv4_connection_instance *)feci;
+	uint16_t regen_occurrances;
 	struct ecm_db_iface_instance *to_ifaces;
 	struct ecm_db_iface_instance *ii_temp;
 	struct ecm_db_iface_instance *ii_single;
@@ -397,6 +398,8 @@
 	struct nss_ipv4_mc_rule_create_msg *create;
 	struct nss_ipv4_msg *nim;
 	ip_addr_t addr;
+	ecm_db_iface_type_t from_iface_type = ECM_DB_IFACE_TYPE_COUNT;
+	ecm_db_iface_type_t to_iface_type = ECM_DB_IFACE_TYPE_COUNT;
 	int32_t *to_ifaces_first;
 	int32_t *to_ii_first;
 	int32_t vif;
@@ -409,12 +412,21 @@
 	nss_tx_status_t nss_tx_status;
 	int32_t list_index;
 	int32_t to_mtu = 0;
+	int from_iface_bridge_identifier = 0;
+	int to_iface_bridge_identifier = 0;
 	int32_t interface_type_counts[ECM_DB_IFACE_TYPE_COUNT];
 	bool rule_invalid;
 	uint8_t dest_mac[ETH_ALEN];
 
 	DEBUG_INFO("%p: Accel conn: %p\n", nmci, feci->ci);
 
+	/*
+	 * Get the re-generation occurrance counter of the connection.
+	 * We compare it again at the end - to ensure that the rule construction has seen no generation
+	 * changes during rule creation.
+	 */
+	regen_occurrances = ecm_db_connection_regeneration_occurrances_get(feci->ci);
+
 	nim = (struct nss_ipv4_msg *)vzalloc(sizeof(struct nss_ipv4_msg));
 	if (!nim) {
 		return -1;
@@ -467,6 +479,9 @@
         }
 
 	create->src_interface_num = from_nss_iface_id;
+	from_nss_iface = from_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX - 1];
+	from_iface_type = ecm_db_connection_iface_type_get(from_nss_iface);
+	from_iface_bridge_identifier = ecm_db_iface_interface_identifier_get(from_nss_iface);
 	ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
 
 	/*
@@ -499,6 +514,7 @@
 		 * We have an update for this interface. Construct the interface information
 		 */
 		to_nss_iface_id = -1;
+		to_iface_type = ECM_DB_IFACE_TYPE_COUNT;
 		memset(interface_type_counts, 0, sizeof(interface_type_counts));
 		to_ii_first = ecm_db_multicast_if_first_get_at_index(to_ifaces_first, vif);
 
@@ -538,6 +554,8 @@
 					break;
 				}
 				ecm_db_iface_bridge_address_get(ii, to_nss_iface_address);
+				to_iface_type = ECM_DB_IFACE_TYPE_BRIDGE;
+				to_iface_bridge_identifier = ecm_db_iface_interface_identifier_get(ii);
 				DEBUG_TRACE("%p: Bridge - mac: %pM\n", nmci, to_nss_iface_address);
 				break;
 			case ECM_DB_IFACE_TYPE_ETHERNET:
@@ -639,8 +657,8 @@
 		 * Is this a valid interface?
 		 */
 		if (to_nss_iface_id != -1) {
+			bool is_bridge;
 			create->if_rule[valid_vif_idx].if_num = to_nss_iface_id;
-			memcpy(create->if_rule[valid_vif_idx].if_mac, to_nss_iface_address, ETH_ALEN);
 			create->if_rule[valid_vif_idx].if_mtu = to_mtu;
 			if (rp->if_join_idx[vif]) {
 				/*
@@ -654,13 +672,21 @@
 				create->if_rule[valid_vif_idx].rule_flags |= NSS_IPV4_MC_RULE_CREATE_IF_FLAG_LEAVE;
 			}
 
+			is_bridge = !ecm_db_connection_is_routed_get(feci->ci);
+
 			/*
 			 * Do not set the ROUTED flag for pure bridged interfaces
 			 */
-			if (is_br_flow) {
+			if (((from_iface_type == ECM_DB_IFACE_TYPE_BRIDGE &&
+				to_iface_type == ECM_DB_IFACE_TYPE_BRIDGE) || is_bridge) &&
+				(to_iface_bridge_identifier == from_iface_bridge_identifier)) {
+				uint8_t from_nss_iface_address[ETH_ALEN];
+				ecm_db_connection_from_node_address_get(feci->ci, (uint8_t *)from_nss_iface_address);
+				memcpy(create->if_rule[valid_vif_idx].if_mac, from_nss_iface_address, ETH_ALEN);
 				create->if_rule[valid_vif_idx].rule_flags |= NSS_IPV4_MC_RULE_CREATE_IF_FLAG_BRIDGE_FLOW;
 			} else {
 				create->if_rule[valid_vif_idx].rule_flags |= NSS_IPV4_MC_RULE_CREATE_IF_FLAG_ROUTED_FLOW;
+				memcpy(create->if_rule[valid_vif_idx].if_mac, to_nss_iface_address, ETH_ALEN);
 			}
 
 			valid_vif_idx++;
@@ -737,6 +763,20 @@
 	}
 
 	/*
+	 * Now that the rule has been constructed we re-compare the generation occurrance counter.
+	 * If there has been a change then we abort because the rule may have been created using
+	 * unstable data - especially if another thread has begun regeneration of the connection state.
+	 * NOTE: This does not prevent a regen from being flagged immediately after this line of code either,
+	 * or while the acceleration rule is in flight to the nss.
+	 * This is only to check for consistency of rule state - not that the state is stale.
+	 */
+	if (regen_occurrances != ecm_db_connection_regeneration_occurrances_get(feci->ci)) {
+		DEBUG_INFO("%p: connection:%p regen occurred - aborting accel rule.\n", feci, feci->ci);
+		vfree(nim);
+		return -1;
+	}
+
+	/*
 	 * Ref the connection before issuing an NSS rule
 	 * This ensures that when the NSS responds to the command - which may even be immediately -
 	 * the callback function can trust the correct ref was taken for its purpose.
@@ -797,6 +837,7 @@
 									struct ecm_classifier_process_response *pr)
 {
 	struct ecm_nss_multicast_ipv4_connection_instance *nmci = (struct ecm_nss_multicast_ipv4_connection_instance *)feci;
+	uint16_t regen_occurrances;
 	struct ecm_db_iface_instance *to_ifaces;
 	struct ecm_db_iface_instance *ii_temp;
 	struct ecm_db_iface_instance *ii_single;
@@ -807,6 +848,8 @@
 	struct nss_ipv4_mc_rule_create_msg *create;
 	struct nss_ipv4_msg *nim;
 	struct ecm_classifier_instance *assignments[ECM_CLASSIFIER_TYPES];
+	ecm_db_iface_type_t from_iface_type = ECM_DB_IFACE_TYPE_COUNT;
+	ecm_db_iface_type_t to_iface_type = ECM_DB_IFACE_TYPE_COUNT;
 	int32_t *to_ifaces_first;
 	int32_t *to_ii_first;
 	int32_t from_ifaces_first;
@@ -816,6 +859,8 @@
 	int32_t from_nat_ifaces_identifier = 0;
 	uint8_t to_nss_iface_address[ETH_ALEN];
 	ip_addr_t addr;
+	int from_iface_bridge_identifier = 0;
+	int to_iface_bridge_identifier = 0;
 	int aci_index;
 	int vif;
 	int ret;
@@ -831,6 +876,13 @@
 	DEBUG_CHECK_MAGIC(nmci, ECM_NSS_MULTICAST_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nmci);
 
 	/*
+	 * Get the re-generation occurrance counter of the connection.
+	 * We compare it again at the end - to ensure that the rule construction has seen no generation
+	 * changes during rule creation.
+	 */
+	regen_occurrances = ecm_db_connection_regeneration_occurrances_get(feci->ci);
+
+	/*
 	 * Can this connection be accelerated at all?
 	 */
 	if (!ecm_nss_ipv4_accel_pending_set(feci)) {
@@ -900,6 +952,11 @@
 #ifdef ECM_INTERFACE_PPP_ENABLE
 			struct ecm_db_interface_info_pppoe pppoe_info;
 #endif
+		case ECM_DB_IFACE_TYPE_BRIDGE:
+			DEBUG_TRACE("%p: Bridge\n", nmci);
+			from_iface_type = ECM_DB_IFACE_TYPE_BRIDGE;
+			from_iface_bridge_identifier = ecm_db_iface_interface_identifier_get(ii);
+			break;
 		case ECM_DB_IFACE_TYPE_VLAN:
 #ifdef ECM_INTERFACE_VLAN_ENABLE
 			DEBUG_TRACE("%p: VLAN\n", nmci);
@@ -973,6 +1030,7 @@
 		int32_t to_mtu = 0;
 
 		to_nss_iface_id = -1;
+		to_iface_type = ECM_DB_IFACE_TYPE_COUNT;
 
 		create->if_rule[vif].egress_vlan_tag[0] = ECM_NSS_CONNMGR_VLAN_ID_NOT_CONFIGURED;
 		create->if_rule[vif].egress_vlan_tag[1] = ECM_NSS_CONNMGR_VLAN_ID_NOT_CONFIGURED;
@@ -1032,6 +1090,8 @@
 					break;
 				}
 				ecm_db_iface_bridge_address_get(ii, to_nss_iface_address);
+				to_iface_type = ECM_DB_IFACE_TYPE_BRIDGE;
+				to_iface_bridge_identifier = ecm_db_iface_interface_identifier_get(ii);
 				DEBUG_TRACE("%p: Bridge - mac: %pM\n", nmci, to_nss_iface_address);
 				break;
 			case ECM_DB_IFACE_TYPE_ETHERNET:
@@ -1144,6 +1204,7 @@
 		 */
 		if (to_nss_iface_id != -1) {
 			uint32_t xlate_src_ip, src_ip;
+			bool is_bridge;
 			ecm_db_connection_from_address_nat_get(feci->ci, addr);
 			ECM_IP_ADDR_TO_HIN4_ADDR(xlate_src_ip, addr);
 			ecm_db_connection_from_address_get(feci->ci, addr);
@@ -1163,9 +1224,24 @@
 			}
 			create->if_rule[valid_vif_idx].rule_flags |= NSS_IPV4_MC_RULE_CREATE_IF_FLAG_JOIN;
 			create->if_rule[valid_vif_idx].if_num = to_nss_iface_id;
-			memcpy(create->if_rule[valid_vif_idx].if_mac, to_nss_iface_address, ETH_ALEN);
 			create->if_rule[valid_vif_idx].if_mtu = to_mtu;
-			create->if_rule[valid_vif_idx].rule_flags |= NSS_IPV4_MC_RULE_CREATE_IF_FLAG_ROUTED_FLOW;
+			is_bridge = !ecm_db_connection_is_routed_get(feci->ci);
+
+			/*
+			 * Identify if the destination interface blongs to pure bridge or routed flow.
+			 */
+			if (((from_iface_type == ECM_DB_IFACE_TYPE_BRIDGE &&
+				to_iface_type == ECM_DB_IFACE_TYPE_BRIDGE) || is_bridge) &&
+				(from_iface_bridge_identifier == to_iface_bridge_identifier)) {
+				uint8_t from_nss_iface_address[ETH_ALEN];
+				ecm_db_connection_from_node_address_get(feci->ci, (uint8_t *)from_nss_iface_address);
+				memcpy(create->if_rule[valid_vif_idx].if_mac, from_nss_iface_address, ETH_ALEN);
+				create->if_rule[valid_vif_idx].rule_flags |= NSS_IPV4_MC_RULE_CREATE_IF_FLAG_BRIDGE_FLOW;
+			} else {
+				memcpy(create->if_rule[valid_vif_idx].if_mac, to_nss_iface_address, ETH_ALEN);
+				create->if_rule[valid_vif_idx].rule_flags |= NSS_IPV4_MC_RULE_CREATE_IF_FLAG_ROUTED_FLOW;
+			}
+
 			valid_vif_idx++;
 		}
 	}
@@ -1274,6 +1350,23 @@
 	}
 
 	/*
+	 * Now that the rule has been constructed we re-compare the generation occurrance counter.
+	 * If there has been a change then we abort because the rule may have been created using
+	 * unstable data - especially if another thread has begun regeneration of the connection state.
+	 * NOTE: This does not prevent a regen from being flagged immediately after this line of code either,
+	 * or while the acceleration rule is in flight to the nss.
+	 * This is only to check for consistency of rule state - not that the state is stale.
+	 * Remember that the connection is marked as "accel pending state" so if a regen is flagged immediately
+	 * after this check passes, the connection will be decelerated and refreshed very quickly.
+	 */
+	if (regen_occurrances != ecm_db_connection_regeneration_occurrances_get(feci->ci)) {
+		DEBUG_INFO("%p: connection:%p regen occurred - aborting accel rule.\n", feci, feci->ci);
+		ecm_nss_ipv4_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_DECEL);
+		kfree(nim);
+		return;
+	}
+
+	/*
 	 * Ref the connection before issuing an NSS rule
 	 * This ensures that when the NSS responds to the command - which may even be immediately -
 	 * the callback function can trust the correct ref was taken for its purpose.
@@ -1456,7 +1549,6 @@
 	struct ecm_nss_multicast_ipv4_connection_instance *nmci = (struct ecm_nss_multicast_ipv4_connection_instance *)feci;
 	struct nss_ipv4_msg nim;
 	struct nss_ipv4_rule_destroy_msg *nirdm;
-	struct ecm_db_multicast_tuple_instance *tuple_instance;
 	ip_addr_t src_addr;
 	ip_addr_t group_addr;
 	nss_tx_status_t nss_tx_status;
@@ -1534,25 +1626,9 @@
 			&nirdm->tuple.return_ip, nirdm->tuple.return_ident);
 
 	/*
-	 * Right place to free the tuple_instance and multicast
-	 * destination interfaces list.
+	 * Right place to free multicast destination interfaces list.
 	 */
-	spin_lock_bh(&ecm_nss_ipv4_lock);
-	tuple_instance = ecm_db_multicast_tuple_instance_find_and_ref(src_addr, group_addr);
-	if (tuple_instance) {
-		ecm_db_multicast_connection_to_interfaces_clear(feci->ci);
-
-		/*
-		 * Free the local reference of tuple_instance
-		 */
-		ecm_db_multicast_tuple_instance_deref(tuple_instance);
-
-		/*
-		 * Release the tuple instance
-		 */
-		ecm_db_multicast_tuple_instance_deref(tuple_instance);
-	}
-	spin_unlock_bh(&ecm_nss_ipv4_lock);
+	ecm_db_multicast_connection_to_interfaces_clear(feci->ci);
 
 	/*
 	 * Take a ref to the feci->ci so that it will persist until we get a response from the NSS.
@@ -1938,7 +2014,7 @@
 							struct nf_conntrack_tuple *orig_tuple, struct nf_conntrack_tuple *reply_tuple)
 {
 	int vif, if_cnt;
-	uint32_t dst_dev[MAXVIFS];
+	uint32_t dst_dev[ECM_DB_MULTICAST_IF_MAX];
 	struct udphdr *udp_hdr;
 	struct udphdr udp_hdr_buff;
 	int src_port;
@@ -1977,6 +2053,17 @@
 	}
 
 	/*
+	 * Return if source dev is any tunnel type
+	 * TODO: Add support for multicast over tunnels
+	 */
+	if (in_dev->type == ECM_ARPHRD_IPSEC_TUNNEL_TYPE ||
+	    in_dev->type == ARPHRD_SIT ||
+	    in_dev->type == ARPHRD_TUNNEL6) {
+		DEBUG_TRACE("Net device: %p is TUNNEL type: %d\n", in_dev, in_dev->type);
+		return NF_ACCEPT;
+	}
+
+	/*
 	 * Now extract information, if we have conntrack then use that (which would already be in the tuples)
 	 */
 	if (unlikely(!ct)) {
@@ -2123,6 +2210,7 @@
 		int32_t from_nat_list_first;
 		int32_t *to_list_first;
 		int32_t *to_first;
+		int ret;
 		uint8_t dest_mac_addr[ETH_ALEN];
 
 		DEBUG_TRACE("New UDP connection from " ECM_IP_ADDR_DOT_FMT ":%u to " ECM_IP_ADDR_DOT_FMT ":%u\n", ECM_IP_ADDR_TO_DOT(ip_src_addr), \
@@ -2163,6 +2251,16 @@
 		}
 
 		/*
+		 * Create a tuple instance
+		 */
+		tuple_instance = ecm_db_multicast_tuple_instance_alloc(ip_src_addr, ip_dest_addr, src_port, dest_port);
+		if (!tuple_instance) {
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to allocate tuple instance\n");
+			return NF_ACCEPT;
+		}
+
+		/*
 		 * Create Destination MAC address using IP multicast destination address
 		 */
 		ecm_translate_multicast_mac(ip_dest_addr, dest_mac_addr);
@@ -2176,6 +2274,7 @@
 		if (from_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			DEBUG_WARN("Failed to obtain 'from' heirarchy list\n");
 			return NF_ACCEPT;
 		}
@@ -2188,6 +2287,7 @@
 			DEBUG_WARN("%p: Failed to establish source node\n", nci);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			return NF_ACCEPT;
 		}
 
@@ -2198,6 +2298,7 @@
 			ecm_db_node_deref(src_ni);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			return NF_ACCEPT;
 		}
 
@@ -2208,6 +2309,7 @@
 			ecm_db_node_deref(src_ni);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			return NF_ACCEPT;
 		}
 
@@ -2219,6 +2321,8 @@
 			ecm_db_node_deref(src_ni);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
+			kfree(to_list);
 			return NF_ACCEPT;
 		}
 
@@ -2239,12 +2343,31 @@
 			ecm_db_mapping_deref(src_mi);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
-			DEBUG_WARN("%p: Failed to obtain mutlicast 'to' heirarchy list\n", nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			kfree(to_list);
 			kfree(to_list_first);
+			DEBUG_WARN("%p: Failed to obtain mutlicast 'to' heirarchy list\n", nci);
 			return NF_ACCEPT;
 		}
-		ecm_db_multicast_connection_to_interfaces_reset(nci, to_list, to_list_first);
+		ret = ecm_db_multicast_connection_to_interfaces_reset(nci, to_list, to_list_first);
+		if (ret < 0) {
+			for (vif = 0; vif < ECM_DB_MULTICAST_IF_MAX; vif++) {
+				to_list_single = ecm_db_multicast_if_heirarchy_get(to_list, vif);
+				ecm_db_multicast_copy_if_heirarchy(to_list_temp, to_list_single);
+				to_first = ecm_db_multicast_if_first_get_at_index(to_list_first, vif);
+				ecm_db_connection_interfaces_deref(to_list_temp, *to_first);
+			}
+
+			feci->deref(feci);
+			ecm_db_node_deref(src_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
+			kfree(to_list);
+			kfree(to_list_first);
+			DEBUG_WARN("%p: Failed to obtain mutlicast 'to' heirarchy list\n", nci);
+			return NF_ACCEPT;
+		}
 
 		DEBUG_TRACE("%p: Create destination node\n", nci);
 		ecm_db_multicast_copy_if_heirarchy(to_list_temp, to_list);
@@ -2265,6 +2388,7 @@
 			ecm_db_mapping_deref(src_mi);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			kfree(to_list);
 			kfree(to_list_first);
 			DEBUG_WARN("Failed to establish destination node\n");
@@ -2286,6 +2410,7 @@
 			ecm_db_mapping_deref(src_mi);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			kfree(to_list);
 			kfree(to_list_first);
 			DEBUG_WARN("Failed to establish dst mapping\n");
@@ -2308,6 +2433,7 @@
 			ecm_db_mapping_deref(src_mi);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			kfree(to_list);
 			kfree(to_list_first);
 			DEBUG_WARN("Failed to obtain 'from NAT' heirarchy list\n");
@@ -2331,6 +2457,7 @@
 			ecm_db_mapping_deref(src_mi);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			kfree(to_list);
 			kfree(to_list_first);
 			DEBUG_WARN("Failed to obtain 'from NAT' node\n");
@@ -2355,6 +2482,7 @@
 			ecm_db_mapping_deref(src_mi);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			kfree(to_list);
 			kfree(to_list_first);
 			DEBUG_WARN("Failed to establish from nat mapping\n");
@@ -2381,6 +2509,7 @@
 			ecm_db_mapping_deref(src_mi);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			kfree(to_list);
 			kfree(to_list_first);
 			DEBUG_WARN("Failed to allocate default classifier\n");
@@ -2413,6 +2542,7 @@
 				ecm_db_mapping_deref(src_mi);
 				feci->deref(feci);
 				ecm_db_connection_deref(nci);
+				ecm_db_multicast_tuple_instance_deref(tuple_instance);
 				kfree(to_list);
 				kfree(to_list_first);
 				DEBUG_WARN("Failed to allocate classifiers assignments\n");
@@ -2480,6 +2610,17 @@
 		feci->deref(feci);
 		kfree(to_list);
 		kfree(to_list_first);
+
+		/*
+		 * Add the tuple instance and attach it with connection instance
+		 */
+		ecm_db_multicast_tuple_instance_add(tuple_instance, ci);
+		if (br_dev_found_in_mfc) {
+			ecm_db_multicast_tuple_instance_flags_set(tuple_instance, ECM_DB_MULTICAST_CONNECTION_BRIDGE_DEV_SET_FLAG);
+		}
+
+		ecm_db_multicast_tuple_instance_deref(tuple_instance);
+
 	} else {
 		bool is_dest_interface_list_empty;
 
@@ -2497,6 +2638,7 @@
 			int32_t *to_list_first;
 			int32_t *to_first;
 			int32_t i, interface_idx_cnt;
+			int ret;
 			struct ecm_front_end_connection_instance *feci;
 
 			to_list = (struct ecm_db_iface_instance *)kzalloc(ECM_DB_TO_MCAST_INTERFACES_SIZE, GFP_ATOMIC | __GFP_NOWARN);
@@ -2533,7 +2675,7 @@
 				return NF_ACCEPT;
 			}
 
-			ecm_db_multicast_connection_to_interfaces_reset(ci, to_list, to_list_first);
+			ret = ecm_db_multicast_connection_to_interfaces_reset(ci, to_list, to_list_first);
 
 			/*
 			 * De-ref the destination interface list
@@ -2546,6 +2688,15 @@
 			}
 			kfree(to_list);
 			kfree(to_list_first);
+
+			/*
+			 * If ret is less than zero than connection reset could not find memory for
+			 * to_mcast_interfaces. Deref the CI and retrun.
+			 */
+			if (ret < 0) {
+				ecm_db_connection_deref(ci);
+				return NF_ACCEPT;
+			}
 		}
 	}
 
@@ -2570,10 +2721,12 @@
 	/*
 	 * Do we need to action generation change?
 	 */
-	if (unlikely(ecm_db_connection_classifier_generation_changed(ci))) {
+	if (unlikely(ecm_db_connection_regeneration_required_check(ci))) {
 		/*
 		 * TODO: Will add support for multicast connection re-generation here.
 		 */
+		DEBUG_WARN("%p: TODO: Handle multicast re-generation\n", ci);
+		ecm_db_conection_regeneration_failed(ci);
 		ecm_db_connection_deref(ci);
 		return NF_ACCEPT;
 	}
@@ -2726,26 +2879,6 @@
 	} else {
 		goto done;
 	}
-
-	/*
-	 * Check if the 'mc port info' entry is present already for the connection. If not
-	 * than create one.
-	 */
-	tuple_instance = ecm_db_multicast_tuple_instance_find_and_ref(ip_src_addr, ip_dest_addr);
-	if (!tuple_instance) {
-		tuple_instance = ecm_db_multicast_tuple_instance_alloc(ip_src_addr, ip_dest_addr, src_port, dest_port);
-		if (!tuple_instance) {
-			goto done;
-		}
-		if (br_dev_found_in_mfc) {
-			ecm_db_multicast_tuple_instance_flags_set(tuple_instance, ECM_DB_MULTICAST_CONNECTION_BRIDGE_DEV_SET_FLAG);
-		}
-		ecm_db_multicast_tuple_instance_add(tuple_instance);
-	    	ecm_db_multicast_tuple_instance_deref(tuple_instance);
-	} else {
-	    ecm_db_multicast_tuple_instance_deref(tuple_instance);
-	}
-
 done:
 	ecm_db_connection_deref(ci);
 	return NF_ACCEPT;
@@ -2804,7 +2937,7 @@
 	ip_addr_t src_ip;
 	int32_t to_list_first[ECM_DB_MULTICAST_IF_MAX];
 	int i, ret;
-	uint32_t mc_dst_dev[4];
+	uint32_t mc_dst_dev[ECM_DB_MULTICAST_IF_MAX];
 	uint32_t if_cnt;
 	int32_t if_num;
 	uint32_t mc_flags = 0;
@@ -2825,8 +2958,6 @@
 		return;
 	}
 
-	spin_lock_bh(&ecm_nss_ipv4_lock);
-
 	while (tuple_instance) {
 		/*
 		 * We now have a 5-tuple which has been accelerated. Query the MCS bridge to receive a list
@@ -2853,9 +2984,12 @@
 
 		/*
 		 * Query bridge snooper for the destination list when given the group and source
+		 * if, 	if_num < 0   mc_bridge_ipv4_get_if has encountered with some error, return immediately
+		 * 	if_num = 0  All slaves has left the group. Deacel the flow.
+		 * 	if_num > 0   An interface leave/Join the group. Process the leave/join interface request.
 		 */
 		if_num = mc_bridge_ipv4_get_if(brdev, htonl(src_ip[0]), htonl(dest_ip[0]), mc_max_dst, mc_dst_dev);
-		if (if_num <= 0) {
+		if (if_num < 0) {
 			DEBUG_TRACE("No valid bridge slaves for the group/source\n");
 			/*
 			 * This may a valid case when all the interface has left a multicast group.
@@ -2885,7 +3019,35 @@
 
 		DEBUG_TRACE("MCS-cb: src_ip = 0x%x, dest_ip = 0x%x, Num if = %d\n", src_ip[0], dest_ip[0], if_num);
 
+		/*
+		 * All bridge slaves has left the group. If flow is pure bridge, Deacel the connection and return.
+		 * If flow is routed, let MFC callback handle this.
+		 */
+		if (if_num == 0) {
+			bool is_routed;
+
+			is_routed = ecm_db_connection_is_routed_get(ci);
+
+			/*
+			 * If there are no routed interfaces, then decelerate. Else
+			 * we let MFC update callback handle this
+			 */
+			if (!is_routed) {
+				/*
+				 * Decelerate the flow
+				 */
+				feci = ecm_db_connection_front_end_get_and_ref(ci);
+				feci->decelerate(feci);
+				feci->deref(feci);
+			}
+
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
+			ecm_db_connection_deref(ci);
+			return;
+		}
+
 		memset(&mc_update, 0, sizeof(mc_update));
+		spin_lock_bh(&ecm_nss_ipv4_lock);
 
 		/*
 		 * Find out changes to the destination interfaces heirarchy
@@ -2899,6 +3061,7 @@
 			 * No updates to this multicast flow. Move on to the next
 			 * flow for the same group
 			 */
+			spin_unlock_bh(&ecm_nss_ipv4_lock);
 			tuple_instance_next = ecm_db_multicast_tuple_instance_get_and_ref_next(tuple_instance);
 			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			tuple_instance = tuple_instance_next;
@@ -2906,6 +3069,7 @@
 			continue;
 		}
 
+		spin_unlock_bh(&ecm_nss_ipv4_lock);
 		DEBUG_TRACE("BRIDGE UPDATE callback ===> leave_cnt %d, join_cnt %d\n", mc_update.if_leave_cnt, mc_update.if_join_cnt);
 
 		feci = ecm_db_connection_front_end_get_and_ref(ci);
@@ -2916,7 +3080,6 @@
 		if (mc_update.if_join_cnt > 0) {
 			to_list = (struct ecm_db_iface_instance *)kzalloc(ECM_DB_TO_MCAST_INTERFACES_SIZE, GFP_ATOMIC | __GFP_NOWARN);
 			if (!to_list) {
-				spin_unlock_bh(&ecm_nss_ipv4_lock);
 				feci->deref(feci);
 				ecm_db_multicast_tuple_instance_deref(tuple_instance);
 				ecm_db_connection_deref(ci);
@@ -2973,20 +3136,17 @@
 		if ((feci->accel_mode <= ECM_FRONT_END_ACCELERATION_MODE_FAIL_DENIED) ||
 				(feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_ACCEL)) {
 			DEBUG_TRACE("%p: Ignoring wrong mode accel for conn: %p\n", feci, feci->ci);
-			spin_unlock_bh(&ecm_nss_ipv4_lock);
 			feci->deref(feci);
 			ecm_db_connection_deref(ci);
 			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			return;
 		}
 
-		spin_unlock_bh(&ecm_nss_ipv4_lock);
-
 		/*
 		 * Update the new rules in FW. If returns error decelerate the connection
 		 * and flush all ECM rules.
 		 */
-		ret = ecm_nss_multicast_ipv4_connection_update_accelerate(feci, &mc_update, true);
+		ret = ecm_nss_multicast_ipv4_connection_update_accelerate(feci, &mc_update);
 		if (ret < 0) {
 			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			feci->decelerate(feci);
@@ -2996,7 +3156,6 @@
 		}
 
 		feci->deref(feci);
-		spin_lock_bh(&ecm_nss_ipv4_lock);
 
 		/*
 		 * Release the interfaces that may have left the connection
@@ -3023,7 +3182,6 @@
 		tuple_instance = tuple_instance_next;
 	}
 
-	spin_unlock_bh(&ecm_nss_ipv4_lock);
 	return;
 }
 
@@ -3078,11 +3236,7 @@
 	 * Get the DB connection instance using the tuple_instance
 	 */
 	ci = ecm_db_multicast_connection_find_and_ref(tuple_instance);
-	if (!ci) {
-		DEBUG_TRACE("%p: Bad connection instance for routed mcast flow\n", tuple_instance);
-		ecm_db_multicast_tuple_instance_deref(tuple_instance);
-		return;
-	}
+	DEBUG_ASSERT(ci, "%p: Bad connection instance for routed mcast flow\n", tuple_instance);
 
 	DEBUG_TRACE("%p: Multicast conn\n", ci);
 
@@ -3130,6 +3284,8 @@
 			ecm_db_multicast_tuple_instance_flags_set(tuple_instance, ~ECM_DB_MULTICAST_CONNECTION_BRIDGE_DEV_SET_FLAG);
 		}
 
+		spin_unlock_bh(&ecm_nss_ipv4_lock);
+
 		DEBUG_TRACE("%p: MFC update callback leave_cnt %d, join_cnt %d\n", ci, mc_update.if_leave_cnt, mc_update.if_join_cnt);
 
 		feci = ecm_db_connection_front_end_get_and_ref(ci);
@@ -3140,7 +3296,6 @@
 		if (mc_update.if_join_cnt > 0) {
 			to_list = (struct ecm_db_iface_instance *)kzalloc(ECM_DB_TO_MCAST_INTERFACES_SIZE, GFP_ATOMIC | __GFP_NOWARN);
 			if (!to_list) {
-				spin_unlock_bh(&ecm_nss_ipv4_lock);
 				ecm_db_multicast_tuple_instance_deref(tuple_instance);
 				feci->deref(feci);
 				ecm_db_connection_deref(ci);
@@ -3162,7 +3317,6 @@
 			vif_cnt = ecm_interface_multicast_heirarchy_construct_routed(feci, to_list, NULL, src_ip, dest_ip, mc_update.if_join_cnt, mc_update.join_dev, to_list_first);
 			if (vif_cnt == 0) {
 				DEBUG_WARN("Failed to obtain 'to_mcast_update' heirarchy list\n");
-				spin_unlock_bh(&ecm_nss_ipv4_lock);
 				ecm_db_multicast_tuple_instance_deref(tuple_instance);
 				feci->deref(feci);
 				ecm_db_connection_deref(ci);
@@ -3196,20 +3350,17 @@
 		if ((feci->accel_mode <= ECM_FRONT_END_ACCELERATION_MODE_FAIL_DENIED) ||
 				(feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_ACCEL)) {
 			DEBUG_TRACE("%p: Ignoring wrong mode accel for conn: %p\n", feci, feci->ci);
-			spin_unlock_bh(&ecm_nss_ipv4_lock);
 			feci->deref(feci);
 			ecm_db_connection_deref(ci);
 			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			return;
 		}
 
-		spin_unlock_bh(&ecm_nss_ipv4_lock);
-
 		/*
 		 * Update the new rules in FW. If returns error decelerate the connection
 		 * and flush all ECM rules.
 		 */
-		ret = ecm_nss_multicast_ipv4_connection_update_accelerate(feci, &mc_update, false);
+		ret = ecm_nss_multicast_ipv4_connection_update_accelerate(feci, &mc_update);
 		if (ret < 0) {
 			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			feci->decelerate(feci);
@@ -3219,7 +3370,6 @@
 		}
 
 		feci->deref(feci);
-		spin_lock_bh(&ecm_nss_ipv4_lock);
 
 		/*
 		 * Release the interfaces that may have left the connection
@@ -3240,7 +3390,6 @@
 			}
 		}
 
-		spin_unlock_bh(&ecm_nss_ipv4_lock);
 		ecm_db_multicast_tuple_instance_deref(tuple_instance);
 		ecm_db_connection_deref(ci);
 		break;
diff --git a/frontends/nss/ecm_nss_multicast_ipv6.c b/frontends/nss/ecm_nss_multicast_ipv6.c
index 9918366..60778e5 100644
--- a/frontends/nss/ecm_nss_multicast_ipv6.c
+++ b/frontends/nss/ecm_nss_multicast_ipv6.c
@@ -397,9 +397,10 @@
  * 	and sends a 'multicast update' command to NSS to inform about these interface state changes.
  */
 static int ecm_nss_multicast_ipv6_connection_update_accelerate(struct ecm_front_end_connection_instance *feci,
-							       struct ecm_multicast_if_update *rp, bool is_br_flow)
+							       struct ecm_multicast_if_update *rp)
 {
 	struct ecm_nss_multicast_ipv6_connection_instance *nmci = (struct ecm_nss_multicast_ipv6_connection_instance *)feci;
+	uint16_t regen_occurrances;
 	struct ecm_db_iface_instance *to_ifaces;
 	struct ecm_db_iface_instance *ii_temp;
 	struct ecm_db_iface_instance *ii_single;
@@ -411,6 +412,8 @@
 	struct nss_ipv6_msg *nim;
 	struct nss_ipv6_mc_rule_create_msg *create;
 	ip_addr_t addr;
+	ecm_db_iface_type_t from_iface_type = ECM_DB_IFACE_TYPE_COUNT;
+	ecm_db_iface_type_t to_iface_type = ECM_DB_IFACE_TYPE_COUNT;
 	int32_t ret, vif;
 	int32_t valid_vif_idx = 0;
 	int32_t from_ifaces_first;
@@ -423,9 +426,18 @@
 	int32_t interface_type_counts[ECM_DB_IFACE_TYPE_COUNT];
 	bool rule_invalid;
 	uint8_t dest_mac[ETH_ALEN];
+	int from_iface_identifier = 0;
+	int to_iface_bridge_identifier = 0;
 
 	DEBUG_INFO("%p: UPDATE Accel conn: %p\n", nmci, feci->ci);
 
+	/*
+	 * Get the re-generation occurrance counter of the connection.
+	 * We compare it again at the end - to ensure that the rule construction has seen no generation
+	 * changes during rule creation.
+	 */
+	regen_occurrances = ecm_db_connection_regeneration_occurrances_get(feci->ci);
+
 	nim = (struct nss_ipv6_msg *)vzalloc(sizeof(struct nss_ipv6_msg));
 	if (!nim) {
 		return -1;
@@ -473,7 +485,9 @@
         }
 
 	create->src_interface_num = from_nss_iface_id;
-
+	from_nss_iface = from_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX - 1];
+	from_iface_type = ecm_db_connection_iface_type_get(from_nss_iface);
+	from_iface_identifier = ecm_db_iface_interface_identifier_get(from_nss_iface);
 	ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
 
 	/*
@@ -505,6 +519,7 @@
 		 * We have an update for this interface. Construct the interface information
 		 */
 		to_nss_iface_id = -1;
+		to_iface_type = ECM_DB_IFACE_TYPE_COUNT;
 		memset(interface_type_counts, 0, sizeof(interface_type_counts));
 		to_ii_first = ecm_db_multicast_if_first_get_at_index(to_ifaces_first, vif);
 
@@ -544,6 +559,8 @@
 				}
 
 				ecm_db_iface_bridge_address_get(ii, to_nss_iface_address);
+				to_iface_type = ECM_DB_IFACE_TYPE_BRIDGE;
+				to_iface_bridge_identifier = ecm_db_iface_interface_identifier_get(ii);
 				DEBUG_TRACE("%p: Bridge - mac: %pM\n", nmci, to_nss_iface_address);
 				break;
 			case ECM_DB_IFACE_TYPE_ETHERNET:
@@ -648,8 +665,8 @@
 		 * Is this a valid interface?
 		 */
 		if (to_nss_iface_id != -1) {
+			bool is_bridge;
 			create->if_rule[valid_vif_idx].if_num = to_nss_iface_id;
-			memcpy(create->if_rule[valid_vif_idx].if_mac, to_nss_iface_address, ETH_ALEN);
 			create->if_rule[valid_vif_idx].if_mtu = to_mtu;
 			if (rp->if_join_idx[vif]) {
 
@@ -665,12 +682,20 @@
 				create->if_rule[valid_vif_idx].rule_flags |= NSS_IPV6_MC_RULE_CREATE_IF_FLAG_LEAVE;
 			}
 
+			is_bridge = !ecm_db_connection_is_routed_get(feci->ci);
+
 			/*
-			 * TODO: Do not set the ROUTED flag for pure bridged interfaces
+			 * Do not set the ROUTED flag for pure bridged interfaces
 			 */
-			if (is_br_flow) {
+			if (((from_iface_type == ECM_DB_IFACE_TYPE_BRIDGE &&
+				to_iface_type == ECM_DB_IFACE_TYPE_BRIDGE) || is_bridge) &&
+				(to_iface_bridge_identifier == from_iface_identifier)) {
+				uint8_t from_nss_iface_address[ETH_ALEN];
+				ecm_db_connection_from_node_address_get(feci->ci, (uint8_t *)from_nss_iface_address);
+				memcpy(create->if_rule[valid_vif_idx].if_mac, from_nss_iface_address, ETH_ALEN);
 				create->if_rule[valid_vif_idx].rule_flags |= NSS_IPV6_MC_RULE_CREATE_IF_FLAG_BRIDGE_FLOW;
 			} else {
+				memcpy(create->if_rule[valid_vif_idx].if_mac, to_nss_iface_address, ETH_ALEN);
 				create->if_rule[valid_vif_idx].rule_flags |= NSS_IPV6_MC_RULE_CREATE_IF_FLAG_ROUTED_FLOW;
 			}
 
@@ -749,6 +774,20 @@
 	}
 
 	/*
+	 * Now that the rule has been constructed we re-compare the generation occurrance counter.
+	 * If there has been a change then we abort because the rule may have been created using
+	 * unstable data - especially if another thread has begun regeneration of the connection state.
+	 * NOTE: This does not prevent a regen from being flagged immediately after this line of code either,
+	 * or while the acceleration rule is in flight to the nss.
+	 * This is only to check for consistency of rule state - not that the state is stale.
+	 */
+	if (regen_occurrances != ecm_db_connection_regeneration_occurrances_get(feci->ci)) {
+		DEBUG_INFO("%p: connection:%p regen occurred - aborting accel rule.\n", feci, feci->ci);
+		vfree(nim);
+		return -1;
+	}
+
+	/*
 	 * Ref the connection before issuing an NSS rule
 	 * This ensures that when the NSS responds to the command - which may even be immediately -
 	 * the callback function can trust the correct ref was taken for its purpose.
@@ -809,6 +848,7 @@
 									struct ecm_classifier_process_response *pr)
 {
 	struct ecm_nss_multicast_ipv6_connection_instance *nmci = (struct ecm_nss_multicast_ipv6_connection_instance *)feci;
+	uint16_t regen_occurrances;
 	struct ecm_db_iface_instance *from_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX];
 	struct ecm_db_iface_instance *from_nss_iface;
 	int32_t from_ifaces_first;
@@ -817,6 +857,8 @@
 	struct ecm_db_iface_instance *ii_single;
 	struct ecm_db_iface_instance **ifaces;
 	struct nss_ipv6_msg *nim;
+	ecm_db_iface_type_t from_iface_type = ECM_DB_IFACE_TYPE_COUNT;
+	ecm_db_iface_type_t to_iface_type = ECM_DB_IFACE_TYPE_COUNT;
 	int32_t *to_ifaces_first;
 	int32_t *to_ii_first;
 	int32_t from_nss_iface_id;
@@ -828,6 +870,8 @@
 	int aci_index;
 	int32_t vif, ret;
 	int assignment_count;
+	int from_iface_identifier = 0;
+	int to_iface_bridge_identifier = 0;
 	nss_tx_status_t nss_tx_status;
 	int32_t list_index;
 	int32_t valid_vif_idx = 0;
@@ -839,6 +883,13 @@
 	DEBUG_CHECK_MAGIC(nmci, ECM_NSS_MULTICAST_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nmci);
 
 	/*
+	 * Get the re-generation occurrance counter of the connection.
+	 * We compare it again at the end - to ensure that the rule construction has seen no generation
+	 * changes during rule creation.
+	 */
+	regen_occurrances = ecm_db_connection_regeneration_occurrances_get(feci->ci);
+
+	/*
 	 * Can this connection be accelerated at all?
 	 */
 	if (!ecm_nss_ipv6_accel_pending_set(feci)) {
@@ -906,6 +957,11 @@
 #ifdef ECM_INTERFACE_VLAN_ENABLE
 			struct ecm_db_interface_info_vlan vlan_info;
 #endif
+		case ECM_DB_IFACE_TYPE_BRIDGE:
+			DEBUG_TRACE("%p: Bridge\n", nmci);
+			from_iface_type = ECM_DB_IFACE_TYPE_BRIDGE;
+			from_iface_identifier = ecm_db_iface_interface_identifier_get(ii);
+			break;
 		case ECM_DB_IFACE_TYPE_VLAN:
 #ifdef ECM_INTERFACE_VLAN_ENABLE
 			DEBUG_TRACE("%p: VLAN\n", nmci);
@@ -951,6 +1007,7 @@
 	for (vif = 0; vif < ECM_DB_MULTICAST_IF_MAX; vif++) {
 		int32_t to_mtu = 0;
 		to_nss_iface_id = -1;
+		to_iface_type = ECM_DB_IFACE_TYPE_COUNT;
 
 #ifdef ECM_INTERFACE_VLAN_ENABLE
 		create->if_rule[vif].egress_vlan_tag[0] = ECM_NSS_CONNMGR_VLAN_ID_NOT_CONFIGURED;
@@ -1003,6 +1060,8 @@
 					break;
 				}
 				ecm_db_iface_bridge_address_get(ii, to_nss_iface_address);
+				to_iface_type = ECM_DB_IFACE_TYPE_BRIDGE;
+				to_iface_bridge_identifier = ecm_db_iface_interface_identifier_get(ii);
 				DEBUG_TRACE("%p: Bridge - mac: %pM\n", nmci, to_nss_iface_address);
 				break;
 			case ECM_DB_IFACE_TYPE_ETHERNET:
@@ -1116,11 +1175,28 @@
 		 * interface list.
 		 */
 		if (to_nss_iface_id != -1) {
+			bool is_bridge;
 			create->if_rule[valid_vif_idx].rule_flags |= NSS_IPV6_MC_RULE_CREATE_IF_FLAG_JOIN;
 			create->if_rule[valid_vif_idx].if_num = to_nss_iface_id;
-			memcpy(create->if_rule[valid_vif_idx].if_mac, to_nss_iface_address, ETH_ALEN);
 			create->if_rule[valid_vif_idx].if_mtu = to_mtu;
-			create->if_rule[valid_vif_idx].rule_flags |= NSS_IPV6_MC_RULE_CREATE_IF_FLAG_ROUTED_FLOW;
+
+			is_bridge = !ecm_db_connection_is_routed_get(feci->ci);
+
+			/*
+			 * Identify if the destination interface blongs to pure bridge or routed flow.
+			 */
+			if (((from_iface_type == ECM_DB_IFACE_TYPE_BRIDGE &&
+				to_iface_type == ECM_DB_IFACE_TYPE_BRIDGE) || is_bridge) &&
+				(from_iface_identifier == to_iface_bridge_identifier)) {
+				uint8_t from_nss_iface_address[ETH_ALEN];
+				ecm_db_connection_from_node_address_get(feci->ci, (uint8_t *)from_nss_iface_address);
+				memcpy(create->if_rule[valid_vif_idx].if_mac, from_nss_iface_address, ETH_ALEN);
+				create->if_rule[valid_vif_idx].rule_flags |= NSS_IPV6_MC_RULE_CREATE_IF_FLAG_BRIDGE_FLOW;
+			} else {
+				memcpy(create->if_rule[valid_vif_idx].if_mac, to_nss_iface_address, ETH_ALEN);
+				create->if_rule[valid_vif_idx].rule_flags |= NSS_IPV6_MC_RULE_CREATE_IF_FLAG_ROUTED_FLOW;
+			}
+
 			valid_vif_idx++;
 		}
 	}
@@ -1224,6 +1300,23 @@
 	}
 
 	/*
+	 * Now that the rule has been constructed we re-compare the generation occurrance counter.
+	 * If there has been a change then we abort because the rule may have been created using
+	 * unstable data - especially if another thread has begun regeneration of the connection state.
+	 * NOTE: This does not prevent a regen from being flagged immediately after this line of code either,
+	 * or while the acceleration rule is in flight to the nss.
+	 * This is only to check for consistency of rule state - not that the state is stale.
+	 * Remember that the connection is marked as "accel pending state" so if a regen is flagged immediately
+	 * after this check passes, the connection will be decelerated and refreshed very quickly.
+	 */
+	if (regen_occurrances != ecm_db_connection_regeneration_occurrances_get(feci->ci)) {
+		DEBUG_INFO("%p: connection:%p regen occurred - aborting accel rule.\n", feci, feci->ci);
+		ecm_nss_ipv6_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_DECEL);
+		kfree(nim);
+		return;
+	}
+
+	/*
 	 * Ref the connection before issuing an NSS rule
 	 * This ensures that when the NSS responds to the command - which may even be immediately -
 	 * the callback function can trust the correct ref was taken for its purpose.
@@ -1410,7 +1503,6 @@
 	struct ecm_nss_multicast_ipv6_connection_instance *nmci = (struct ecm_nss_multicast_ipv6_connection_instance *)feci;
 	struct nss_ipv6_msg nim;
 	struct nss_ipv6_rule_destroy_msg *nirdm;
-	struct ecm_db_multicast_tuple_instance *tuple_instance;
 	ip_addr_t src_ip;
 	ip_addr_t dest_ip;
 	nss_tx_status_t nss_tx_status;
@@ -1488,25 +1580,9 @@
 
 
 	/*
-	 * Right place to free the tuple_instance and multicast
-	 * destination interfaces list.
+	 * Right place to free the multicast destination interfaces list.
 	 */
-	spin_lock_bh(&ecm_nss_ipv6_lock);
-	tuple_instance = ecm_db_multicast_tuple_instance_find_and_ref(src_ip, dest_ip);
-	if (tuple_instance) {
-		ecm_db_multicast_connection_to_interfaces_clear(feci->ci);
-
-		/*
-		 * Free the local reference of tuple_instance
-		 */
-		ecm_db_multicast_tuple_instance_deref(tuple_instance);
-
-		/*
-		 * Release the tuple instance here.
-		 */
-		ecm_db_multicast_tuple_instance_deref(tuple_instance);
-	}
-	spin_unlock_bh(&ecm_nss_ipv6_lock);
+	ecm_db_multicast_connection_to_interfaces_clear(feci->ci);
 
 	/*
 	 * Take a ref to the feci->ci so that it will persist until we get a response from the NSS.
@@ -1939,6 +2015,16 @@
 	}
 
 	/*
+	 * Return if source dev is any tunnel type
+	 */
+	if (in_dev->type == ECM_ARPHRD_IPSEC_TUNNEL_TYPE ||
+	    in_dev->type == ARPHRD_SIT ||
+	    in_dev->type == ARPHRD_TUNNEL6) {
+		DEBUG_TRACE("Net device: %p is TUNNEL type: %d\n", in_dev, in_dev->type);
+		return NF_ACCEPT;
+	}
+
+	/*
 	 * Now extract information, if we have conntrack then use that (which would already be in the tuples)
 	 */
 	if (unlikely(!ct)) {
@@ -2001,7 +2087,7 @@
 			 */
 			mc_if_cnt = mc_bridge_ipv6_get_if(out_dev->master, &origin6, &group6, ECM_DB_MULTICAST_IF_MAX, mc_dest_if);
 			if (mc_if_cnt <= 0) {
-				DEBUG_WARN("Not found a valid MFC if count %d\n", mc_if_cnt);
+				DEBUG_WARN("Not found a valid MCS if count %d\n", mc_if_cnt);
 				return NF_ACCEPT;
 			}
 		}
@@ -2046,6 +2132,7 @@
 		int32_t from_list_first;
 		int32_t interface_idx_cnt = 0;
 		int vif;
+		int ret;
 		char dest_mac_addr[6];
 
 		DEBUG_TRACE("New UDP connection from " ECM_IP_ADDR_OCTAL_FMT ":%u to " ECM_IP_ADDR_OCTAL_FMT ":%u\n",
@@ -2086,6 +2173,15 @@
 		}
 
 		/*
+		 * Create a tuple instance
+		 */
+		tuple_instance = ecm_db_multicast_tuple_instance_alloc(ip_src_addr, ip_dest_addr, src_port, dest_port);
+		if (!tuple_instance) {
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to allocate tuple instance\n");
+			return NF_ACCEPT;
+		}
+		/*
 		 * Create Destination MAC address using IP multicast destination address
 		 */
 		ecm_translate_multicast_mac(ip_dest_addr, dest_mac_addr);
@@ -2101,6 +2197,7 @@
 		if (from_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			DEBUG_WARN("Failed to obtain 'from' heirarchy list\n");
 			return NF_ACCEPT;
 		}
@@ -2112,6 +2209,7 @@
 		if (!src_ni) {
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			DEBUG_WARN("Failed to establish source node\n");
 			return NF_ACCEPT;
 		}
@@ -2122,6 +2220,7 @@
 			ecm_db_node_deref(src_ni);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			DEBUG_WARN("Failed to establish src mapping\n");
 			return NF_ACCEPT;
 		}
@@ -2134,6 +2233,7 @@
 			ecm_db_node_deref(src_ni);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			return NF_ACCEPT;
 		}
 
@@ -2144,6 +2244,8 @@
 			ecm_db_node_deref(src_ni);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
+			kfree(to_list);
 			return NF_ACCEPT;
 		}
 
@@ -2169,7 +2271,25 @@
 			return NF_ACCEPT;
 		}
 
-		ecm_db_multicast_connection_to_interfaces_reset(nci, to_list, to_list_first);
+		ret = ecm_db_multicast_connection_to_interfaces_reset(nci, to_list, to_list_first);
+		if (ret < 0) {
+			for (vif = 0; vif < ECM_DB_MULTICAST_IF_MAX; vif++) {
+				to_list_single = ecm_db_multicast_if_heirarchy_get(to_list, vif);
+				ecm_db_multicast_copy_if_heirarchy(to_list_temp, to_list_single);
+				to_first = ecm_db_multicast_if_first_get_at_index(to_list_first, vif);
+				ecm_db_connection_interfaces_deref(to_list_temp, *to_first);
+			}
+
+			feci->deref(feci);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
+			kfree(to_list);
+			kfree(to_list_first);
+			DEBUG_WARN("Failed to obtain 'to' heirarchy list\n");
+			return NF_ACCEPT;
+		}
 
 		/*
 		 * De-ref the destination interface list
@@ -2195,6 +2315,7 @@
 			ecm_db_node_deref(src_ni);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			kfree(to_list);
 			kfree(to_list_first);
 			DEBUG_WARN("Failed to establish dest node\n");
@@ -2215,6 +2336,7 @@
 			ecm_db_node_deref(src_ni);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			kfree(to_list);
 			kfree(to_list_first);
 			DEBUG_WARN("Failed to establish dest mapping\n");
@@ -2238,6 +2360,7 @@
 			ecm_db_node_deref(src_ni);
 			feci->deref(feci);
 			ecm_db_connection_deref(nci);
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			kfree(to_list);
 			kfree(to_list_first);
 			DEBUG_WARN("Failed to allocate default classifier\n");
@@ -2267,6 +2390,7 @@
 				ecm_db_node_deref(src_ni);
 				feci->deref(feci);
 				ecm_db_connection_deref(nci);
+				ecm_db_multicast_tuple_instance_deref(tuple_instance);
 				kfree(to_list);
 				kfree(to_list_first);
 				DEBUG_WARN("Failed to allocate classifiers assignments\n");
@@ -2338,6 +2462,16 @@
 		feci->deref(feci);
 		kfree(to_list);
 		kfree(to_list_first);
+
+		/*
+		 * Add the tuple instance and attach it with connection instance
+		 */
+		ecm_db_multicast_tuple_instance_add(tuple_instance, ci);
+		if (br_dev_found_in_mfc) {
+			ecm_db_multicast_tuple_instance_flags_set(tuple_instance, ECM_DB_MULTICAST_CONNECTION_BRIDGE_DEV_SET_FLAG);
+		}
+
+		ecm_db_multicast_tuple_instance_deref(tuple_instance);
 	} else {
 		bool is_dest_interface_list_empty;
 
@@ -2355,6 +2489,7 @@
 			int32_t *to_list_first;
 			int32_t *to_first;
 			int32_t i, interface_idx_cnt;
+			int ret;
 			struct ecm_front_end_connection_instance *feci;
 
 			to_list = (struct ecm_db_iface_instance *)kzalloc(ECM_DB_TO_MCAST_INTERFACES_SIZE, GFP_ATOMIC | __GFP_NOWARN);
@@ -2388,7 +2523,7 @@
 				return NF_ACCEPT;
 			}
 
-			ecm_db_multicast_connection_to_interfaces_reset(ci, to_list, to_list_first);
+			ret = ecm_db_multicast_connection_to_interfaces_reset(ci, to_list, to_list_first);
 
 			/*
 			 * De-ref the destination interface list
@@ -2402,6 +2537,15 @@
 
 			kfree(to_list);
 			kfree(to_list_first);
+
+			/*
+			 * If ret is less than zero than connection reset could not find memory for
+			 * to_mcast_interfaces. Deref the CI and retrun.
+			 */
+			if (ret < 0) {
+				ecm_db_connection_deref(ci);
+				return NF_ACCEPT;
+			}
 		}
 	}
 
@@ -2426,11 +2570,12 @@
 	/*
 	 * Do we need to action generation change?
 	 */
-	if (unlikely(ecm_db_connection_classifier_generation_changed(ci))) {
-
+	if (unlikely(ecm_db_connection_regeneration_required_check(ci))) {
 		/*
 		 * TODO: Will add support for multicast connection re-generation here.
 		 */
+		DEBUG_WARN("%p: TODO: Handle multicast re-generation\n", ci);
+		ecm_db_conection_regeneration_failed(ci);
 		ecm_db_connection_deref(ci);
 		return NF_ACCEPT;
 	}
@@ -2591,28 +2736,6 @@
 	} else {
 		goto done;
 	}
-
-	/*
-	 * Check if the 'mc port info' entry is present already for the connection. If not
-	 * than create one.
-	 */
-	tuple_instance = ecm_db_multicast_tuple_instance_find_and_ref(ip_src_addr, ip_dest_addr);
-	if (!tuple_instance) {
-		tuple_instance = ecm_db_multicast_tuple_instance_alloc(ip_src_addr, ip_dest_addr, src_port, dest_port);
-		if (!tuple_instance) {
-			ecm_db_connection_deref(ci);
-			return NF_ACCEPT;
-		}
-		if(br_dev_found_in_mfc) {
-			ecm_db_multicast_tuple_instance_flags_set(tuple_instance, ECM_DB_MULTICAST_CONNECTION_BRIDGE_DEV_SET_FLAG);
-		}
-
-		ecm_db_multicast_tuple_instance_add(tuple_instance);
-		ecm_db_multicast_tuple_instance_deref(tuple_instance);
-
-	} else {
-	    ecm_db_multicast_tuple_instance_deref(tuple_instance);
-	}
 done:
 	ecm_db_connection_deref(ci);
 	return NF_ACCEPT;
@@ -2674,8 +2797,6 @@
 		return;
 	}
 
-	spin_lock_bh(&ecm_nss_ipv6_lock);
-
 	while (tuple_instance) {
 		/*
 		 * We now have a 5-tuple which has been accelerated. Query the MCS bridge to receive a list
@@ -2703,9 +2824,12 @@
 
 		/*
 		 * Query bridge snooper for the destination list when given the group and source
+		 * if, 	if_num < 0   mc_bridge_ipv4_get_if has encountered with some error, return immediately
+		 * 	if_num = 0  All slaves has left the group. Deacel the flow.
+		 * 	if_num > 0   An interface leave/Join the group. Process the leave/join interface request.
 		 */
 		if_num = mc_bridge_ipv6_get_if (brdev, &origin6, &group6, mc_max_dst, mc_dst_dev);
-		if (if_num <= 0) {
+		if (if_num < 0) {
 			DEBUG_TRACE("No valid bridge slaves for the group/source\n");
 
 			/*
@@ -2735,11 +2859,39 @@
 			continue;
 		}
 
+		/*
+		 * All bridge slaves has left the group. If flow is pure bridge, Deacel the connection and return.
+		 * If flow is routed, let MFC callback handle this.
+		 */
+		if (if_num == 0) {
+			bool is_routed;
+
+			is_routed = ecm_db_connection_is_routed_get(ci);
+
+			/*
+			 * If there are no routed interfaces, then decelerate. Else
+			 * we let MFC update callback handle this
+			 */
+			if (!is_routed) {
+				/*
+				 * Decelerate the flow
+				 */
+				feci = ecm_db_connection_front_end_get_and_ref(ci);
+				feci->decelerate(feci);
+				feci->deref(feci);
+			}
+
+			ecm_db_multicast_tuple_instance_deref(tuple_instance);
+			ecm_db_connection_deref(ci);
+			return;
+		}
+
 		feci = ecm_db_connection_front_end_get_and_ref(ci);
 
 		DEBUG_TRACE("MCS-cb: src_ip = 0x%x, dest_ip = 0x%x, Num if = %d\n", src_ip[0], dest_ip[0], if_num);
 
 		memset(&mc_sync, 0, sizeof(mc_sync));
+		spin_lock_bh(&ecm_nss_ipv6_lock);
 
 		/*
 		 * Find out changes to the destination interfaces heirarchy
@@ -2754,6 +2906,7 @@
 			 * No updates to this multicast flow. Move on to the next
 			 * flow for the same group
 			 */
+			spin_unlock_bh(&ecm_nss_ipv6_lock);
 			tuple_instance_next = ecm_db_multicast_tuple_instance_get_and_ref_next(tuple_instance);
 			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			tuple_instance = tuple_instance_next;
@@ -2761,6 +2914,7 @@
 			continue;
 		}
 
+		spin_unlock_bh(&ecm_nss_ipv6_lock);
 		DEBUG_TRACE("BRIDGE UPDATE callback ===> leave_cnt %d, join_cnt %d\n", mc_sync.if_leave_cnt, mc_sync.if_join_cnt);
 
 		/*
@@ -2769,7 +2923,6 @@
 		if (mc_sync.if_join_cnt > 0) {
 			to_list = (struct ecm_db_iface_instance *)kzalloc(ECM_DB_TO_MCAST_INTERFACES_SIZE, GFP_ATOMIC | __GFP_NOWARN);
 			if (!to_list) {
-				spin_unlock_bh(&ecm_nss_ipv6_lock);
 				feci->deref(feci);
 				ecm_db_connection_deref(ci);
 				ecm_db_multicast_tuple_instance_deref(tuple_instance);
@@ -2825,15 +2978,13 @@
 		if ((feci->accel_mode <= ECM_FRONT_END_ACCELERATION_MODE_FAIL_DENIED) ||
 				(feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_ACCEL)) {
 			DEBUG_TRACE("%p: Ignoring wrong mode accel for conn: %p\n", feci, feci->ci);
-			spin_unlock_bh(&ecm_nss_ipv6_lock);
 			feci->deref(feci);
 			ecm_db_connection_deref(ci);
 			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			return;
 		}
 
-		spin_unlock_bh(&ecm_nss_ipv6_lock);
-		ret = ecm_nss_multicast_ipv6_connection_update_accelerate(feci, &mc_sync, true);
+		ret = ecm_nss_multicast_ipv6_connection_update_accelerate(feci, &mc_sync);
 		if (ret < 0) {
 			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			feci->decelerate(feci);
@@ -2843,7 +2994,6 @@
 		}
 
 		feci->deref(feci);
-		spin_lock_bh(&ecm_nss_ipv6_lock);
 
 		/*
 		 * Release the interfaces that may have left the connection
@@ -2872,7 +3022,6 @@
 		tuple_instance = tuple_instance_next;
 	}
 
-	spin_unlock_bh(&ecm_nss_ipv6_lock);
 	return;
 }
 
@@ -2931,11 +3080,7 @@
 	 * Get the DB connection instance using the tuple_instance
 	 */
 	ci = ecm_db_multicast_connection_find_and_ref(tuple_instance);
-	if (!ci) {
-		DEBUG_TRACE("%p: Bad connection instance for routed mcast flow\n", tuple_instance);
-		ecm_db_multicast_tuple_instance_deref(tuple_instance);
-		return;
-	}
+	DEBUG_ASSERT(ci, "%p: Bad connection instance for routed mcast flow\n", tuple_instance);
 
 	DEBUG_TRACE("%p: Multicast conn\n", ci);
 
@@ -2984,6 +3129,7 @@
 			ecm_db_multicast_tuple_instance_flags_set(tuple_instance, ~ECM_DB_MULTICAST_CONNECTION_BRIDGE_DEV_SET_FLAG);
 		}
 
+		spin_unlock_bh(&ecm_nss_ipv6_lock);
 		DEBUG_TRACE("%p: MFC update callback ===> leave_cnt %d, join_cnt %d\n", ci, mc_sync.if_leave_cnt, mc_sync.if_join_cnt);
 
 		feci = ecm_db_connection_front_end_get_and_ref(ci);
@@ -2994,7 +3140,6 @@
 		if (mc_sync.if_join_cnt > 0) {
 			to_list = (struct ecm_db_iface_instance *)kzalloc(ECM_DB_TO_MCAST_INTERFACES_SIZE, GFP_ATOMIC | __GFP_NOWARN);
 			if (!to_list) {
-				spin_unlock_bh(&ecm_nss_ipv6_lock);
 				feci->deref(feci);
 				ecm_db_multicast_tuple_instance_deref(tuple_instance);
 				ecm_db_connection_deref(ci);
@@ -3016,7 +3161,6 @@
 			vif_cnt = ecm_interface_multicast_heirarchy_construct_routed(feci, to_list, NULL, src_ip, dest_ip, mc_sync.if_join_cnt, mc_sync.join_dev, to_list_first);
 			if (vif_cnt == 0) {
 				DEBUG_WARN("Failed to obtain 'to_mcast_update' heirarchy list\n");
-				spin_unlock_bh(&ecm_nss_ipv6_lock);
 				feci->deref(feci);
 				ecm_db_multicast_tuple_instance_deref(tuple_instance);
 				ecm_db_connection_deref(ci);
@@ -3049,20 +3193,17 @@
 		if ((feci->accel_mode <= ECM_FRONT_END_ACCELERATION_MODE_FAIL_DENIED) ||
 				(feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_ACCEL)) {
 			DEBUG_TRACE("%p: Ignoring wrong mode accel for conn: %p\n", feci, feci->ci);
-			spin_unlock_bh(&ecm_nss_ipv6_lock);
 			feci->deref(feci);
 			ecm_db_connection_deref(ci);
 			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			return;
 		}
 
-		spin_unlock_bh(&ecm_nss_ipv6_lock);
-
 		/*
 		 * Update the new rules in FW. If returns error decelerate the connection
 		 * and flush all ECM rules.
 		 */
-		ret = ecm_nss_multicast_ipv6_connection_update_accelerate(feci, &mc_sync, false);
+		ret = ecm_nss_multicast_ipv6_connection_update_accelerate(feci, &mc_sync);
 		if (ret < 0) {
 			ecm_db_multicast_tuple_instance_deref(tuple_instance);
 			feci->decelerate(feci);
@@ -3072,7 +3213,6 @@
 		}
 
 		feci->deref(feci);
-		spin_lock_bh(&ecm_nss_ipv6_lock);
 
 		/*
 		 * Release the interfaces that may have left the connection
@@ -3094,7 +3234,7 @@
 				mc_sync.if_leave_cnt--;
 			}
 		}
-		spin_unlock_bh(&ecm_nss_ipv6_lock);
+
 		ecm_db_multicast_tuple_instance_deref(tuple_instance);
 		ecm_db_connection_deref(ci);
 		break;
diff --git a/frontends/nss/ecm_nss_non_ported_ipv4.c b/frontends/nss/ecm_nss_non_ported_ipv4.c
index f0134b8..a1ca0f9 100644
--- a/frontends/nss/ecm_nss_non_ported_ipv4.c
+++ b/frontends/nss/ecm_nss_non_ported_ipv4.c
@@ -374,6 +374,7 @@
 									struct ecm_classifier_process_response *pr)
 {
 	struct ecm_nss_non_ported_ipv4_connection_instance *nnpci = (struct ecm_nss_non_ported_ipv4_connection_instance *)feci;
+	uint16_t regen_occurrances;
 	int protocol;
 	int32_t from_ifaces_first;
 	int32_t to_ifaces_first;
@@ -402,6 +403,13 @@
 	DEBUG_CHECK_MAGIC(nnpci, ECM_NSS_NON_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
 
 	/*
+	 * Get the re-generation occurrance counter of the connection.
+	 * We compare it again at the end - to ensure that the rule construction has seen no generation
+	 * changes during rule creation.
+	 */
+	regen_occurrances = ecm_db_connection_regeneration_occurrances_get(feci->ci);
+
+	/*
 	 * For non-ported protocols we only support IPv6 in 4 or ESP
 	 */
 	protocol = ecm_db_connection_protocol_get(feci->ci);
@@ -1028,6 +1036,22 @@
 			nircm->dscp_rule.return_dscp);
 
 	/*
+	 * Now that the rule has been constructed we re-compare the generation occurrance counter.
+	 * If there has been a change then we abort because the rule may have been created using
+	 * unstable data - especially if another thread has begun regeneration of the connection state.
+	 * NOTE: This does not prevent a regen from being flagged immediately after this line of code either,
+	 * or while the acceleration rule is in flight to the nss.
+	 * This is only to check for consistency of rule state - not that the state is stale.
+	 * Remember that the connection is marked as "accel pending state" so if a regen is flagged immediately
+	 * after this check passes, the connection will be decelerated and refreshed very quickly.
+	 */
+	if (regen_occurrances != ecm_db_connection_regeneration_occurrances_get(feci->ci)) {
+		DEBUG_INFO("%p: connection:%p regen occurred - aborting accel rule.\n", feci, feci->ci);
+		ecm_nss_ipv4_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_DECEL);
+		return;
+	}
+
+	/*
 	 * Ref the connection before issuing an NSS rule
 	 * This ensures that when the NSS responds to the command - which may even be immediately -
 	 * the callback function can trust the correct ref was taken for its purpose.
@@ -2127,12 +2151,8 @@
 	/*
 	 * Do we need to action generation change?
 	 */
-	if (unlikely(ecm_db_connection_classifier_generation_changed(ci))) {
-		if (!ecm_nss_ipv4_connection_regenerate(ci, sender, out_dev, out_dev_nat, in_dev, in_dev_nat)) {
-			DEBUG_WARN("%p: Re-generation failed\n", ci);
-			ecm_db_connection_deref(ci);
-			return NF_ACCEPT;
-		}
+	if (unlikely(ecm_db_connection_regeneration_required_check(ci))) {
+		ecm_nss_ipv4_connection_regenerate(ci, sender, out_dev, out_dev_nat, in_dev, in_dev_nat);
 	}
 
 	/*
diff --git a/frontends/nss/ecm_nss_non_ported_ipv6.c b/frontends/nss/ecm_nss_non_ported_ipv6.c
index 938946b..50f1b03 100644
--- a/frontends/nss/ecm_nss_non_ported_ipv6.c
+++ b/frontends/nss/ecm_nss_non_ported_ipv6.c
@@ -311,6 +311,7 @@
 									struct ecm_classifier_process_response *pr, bool is_l2_encap)
 {
 	struct ecm_nss_non_ported_ipv6_connection_instance *nnpci = (struct ecm_nss_non_ported_ipv6_connection_instance *)feci;
+	uint16_t regen_occurrances;
 	int protocol;
 	int32_t from_ifaces_first;
 	int32_t to_ifaces_first;
@@ -338,6 +339,13 @@
 	DEBUG_CHECK_MAGIC(nnpci, ECM_NSS_NON_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
 
 	/*
+	 * Get the re-generation occurrance counter of the connection.
+	 * We compare it again at the end - to ensure that the rule construction has seen no generation
+	 * changes during rule creation.
+	 */
+	regen_occurrances = ecm_db_connection_regeneration_occurrances_get(feci->ci);
+
+	/*
 	 * For non-ported protocols we only support IPv6 in 4 or ESP
 	 */
 	protocol = ecm_db_connection_protocol_get(feci->ci);
@@ -914,6 +922,22 @@
 			nircm->dscp_rule.return_dscp);
 
 	/*
+	 * Now that the rule has been constructed we re-compare the generation occurrance counter.
+	 * If there has been a change then we abort because the rule may have been created using
+	 * unstable data - especially if another thread has begun regeneration of the connection state.
+	 * NOTE: This does not prevent a regen from being flagged immediately after this line of code either,
+	 * or while the acceleration rule is in flight to the nss.
+	 * This is only to check for consistency of rule state - not that the state is stale.
+	 * Remember that the connection is marked as "accel pending state" so if a regen is flagged immediately
+	 * after this check passes, the connection will be decelerated and refreshed very quickly.
+	 */
+	if (regen_occurrances != ecm_db_connection_regeneration_occurrances_get(feci->ci)) {
+		DEBUG_INFO("%p: connection:%p regen occurred - aborting accel rule.\n", feci, feci->ci);
+		ecm_nss_ipv6_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_DECEL);
+		return;
+	}
+
+	/*
 	 * Ref the connection before issuing an NSS rule
 	 * This ensures that when the NSS responds to the command - which may even be immediately -
 	 * the callback function can trust the correct ref was taken for its purpose.
@@ -1889,12 +1913,8 @@
 	/*
 	 * Do we need to action generation change?
 	 */
-	if (unlikely(ecm_db_connection_classifier_generation_changed(ci))) {
-		if (!ecm_nss_ipv6_connection_regenerate(ci, sender, out_dev, in_dev)) {
-			DEBUG_WARN("%p: Re-generation failed\n", ci);
-			ecm_db_connection_deref(ci);
-			return NF_ACCEPT;
-		}
+	if (unlikely(ecm_db_connection_regeneration_required_check(ci))) {
+		ecm_nss_ipv6_connection_regenerate(ci, sender, out_dev, in_dev);
 	}
 
 	/*
diff --git a/frontends/nss/ecm_nss_ported_ipv4.c b/frontends/nss/ecm_nss_ported_ipv4.c
index 9f700d4..29cf1d8 100644
--- a/frontends/nss/ecm_nss_ported_ipv4.c
+++ b/frontends/nss/ecm_nss_ported_ipv4.c
@@ -311,15 +311,13 @@
 /*
  * ecm_nss_ported_ipv4_connection_accelerate()
  *	Accelerate a connection
- *
- * GGG TODO Refactor this function into a single function that np, udp and tcp
- * can all use and reduce the amount of code!
  */
 static void ecm_nss_ported_ipv4_connection_accelerate(struct ecm_front_end_connection_instance *feci,
 									struct ecm_classifier_process_response *pr, bool is_l2_encap,
 									struct nf_conn *ct)
 {
 	struct ecm_nss_ported_ipv4_connection_instance *npci = (struct ecm_nss_ported_ipv4_connection_instance *)feci;
+	uint16_t regen_occurrances;
 	int protocol;
 	int32_t from_ifaces_first;
 	int32_t to_ifaces_first;
@@ -348,6 +346,13 @@
 	DEBUG_CHECK_MAGIC(npci, ECM_NSS_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
 
 	/*
+	 * Get the re-generation occurrance counter of the connection.
+	 * We compare it again at the end - to ensure that the rule construction has seen no generation
+	 * changes during rule creation.
+	 */
+	regen_occurrances = ecm_db_connection_regeneration_occurrances_get(feci->ci);
+
+	/*
 	 * Test if acceleration is permitted
 	 */
 	if (!ecm_nss_ipv4_accel_pending_set(feci)) {
@@ -1050,6 +1055,22 @@
 	}
 
 	/*
+	 * Now that the rule has been constructed we re-compare the generation occurrance counter.
+	 * If there has been a change then we abort because the rule may have been created using
+	 * unstable data - especially if another thread has begun regeneration of the connection state.
+	 * NOTE: This does not prevent a regen from being flagged immediately after this line of code either,
+	 * or while the acceleration rule is in flight to the nss.
+	 * This is only to check for consistency of rule state - not that the state is stale.
+	 * Remember that the connection is marked as "accel pending state" so if a regen is flagged immediately
+	 * after this check passes, the connection will be decelerated and refreshed very quickly.
+	 */
+	if (regen_occurrances != ecm_db_connection_regeneration_occurrances_get(feci->ci)) {
+		DEBUG_INFO("%p: connection:%p regen occurred - aborting accel rule.\n", feci, feci->ci);
+		ecm_nss_ipv4_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_DECEL);
+		return;
+	}
+
+	/*
 	 * Ref the connection before issuing an NSS rule
 	 * This ensures that when the NSS responds to the command - which may even be immediately -
 	 * the callback function can trust the correct ref was taken for its purpose.
@@ -2270,12 +2291,8 @@
 	/*
 	 * Do we need to action generation change?
 	 */
-	if (unlikely(ecm_db_connection_classifier_generation_changed(ci))) {
-		if (!ecm_nss_ipv4_connection_regenerate(ci, sender, out_dev, out_dev_nat, in_dev, in_dev_nat)) {
-			DEBUG_WARN("%p: Re-generation failed\n", ci);
-			ecm_db_connection_deref(ci);
-			return NF_ACCEPT;
-		}
+	if (unlikely(ecm_db_connection_regeneration_required_check(ci))) {
+		ecm_nss_ipv4_connection_regenerate(ci, sender, out_dev, out_dev_nat, in_dev, in_dev_nat);
 	}
 
 	/*
diff --git a/frontends/nss/ecm_nss_ported_ipv6.c b/frontends/nss/ecm_nss_ported_ipv6.c
index 27fc412..e9d0518 100644
--- a/frontends/nss/ecm_nss_ported_ipv6.c
+++ b/frontends/nss/ecm_nss_ported_ipv6.c
@@ -317,15 +317,13 @@
 /*
  * ecm_nss_ported_ipv6_connection_accelerate()
  *	Accelerate a connection
- *
- * GGG TODO Refactor this function into a single function that np, udp and tcp
- * can all use and reduce the amount of code!
  */
 static void ecm_nss_ported_ipv6_connection_accelerate(struct ecm_front_end_connection_instance *feci,
 									struct ecm_classifier_process_response *pr,
 									struct nf_conn *ct, bool is_l2_encap)
 {
 	struct ecm_nss_ported_ipv6_connection_instance *npci = (struct ecm_nss_ported_ipv6_connection_instance *)feci;
+	uint16_t regen_occurrances;
 	int protocol;
 	int32_t from_ifaces_first;
 	int32_t to_ifaces_first;
@@ -353,6 +351,13 @@
 	DEBUG_CHECK_MAGIC(npci, ECM_NSS_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
 
 	/*
+	 * Get the re-generation occurrance counter of the connection.
+	 * We compare it again at the end - to ensure that the rule construction has seen no generation
+	 * changes during rule creation.
+	 */
+	regen_occurrances = ecm_db_connection_regeneration_occurrances_get(feci->ci);
+
+	/*
 	 * Test if acceleration is permitted
 	 */
 	if (!ecm_nss_ipv6_accel_pending_set(feci)) {
@@ -989,6 +994,22 @@
 	}
 
 	/*
+	 * Now that the rule has been constructed we re-compare the generation occurrance counter.
+	 * If there has been a change then we abort because the rule may have been created using
+	 * unstable data - especially if another thread has begun regeneration of the connection state.
+	 * NOTE: This does not prevent a regen from being flagged immediately after this line of code either,
+	 * or while the acceleration rule is in flight to the nss.
+	 * This is only to check for consistency of rule state - not that the state is stale.
+	 * Remember that the connection is marked as "accel pending state" so if a regen is flagged immediately
+	 * after this check passes, the connection will be decelerated and refreshed very quickly.
+	 */
+	if (regen_occurrances != ecm_db_connection_regeneration_occurrances_get(feci->ci)) {
+		DEBUG_INFO("%p: connection:%p regen occurred - aborting accel rule.\n", feci, feci->ci);
+		ecm_nss_ipv6_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_DECEL);
+		return;
+	}
+
+	/*
 	 * Ref the connection before issuing an NSS rule
 	 * This ensures that when the NSS responds to the command - which may even be immediately -
 	 * the callback function can trust the correct ref was taken for its purpose.
@@ -2077,12 +2098,8 @@
 	/*
 	 * Do we need to action generation change?
 	 */
-	if (unlikely(ecm_db_connection_classifier_generation_changed(ci))) {
-		if (!ecm_nss_ipv6_connection_regenerate(ci, sender, out_dev, in_dev)) {
-			DEBUG_WARN("%p: Re-generation failed\n", ci);
-			ecm_db_connection_deref(ci);
-			return NF_ACCEPT;
-		}
+	if (unlikely(ecm_db_connection_regeneration_required_check(ci))) {
+		ecm_nss_ipv6_connection_regenerate(ci, sender, out_dev, in_dev);
 	}
 
 	/*
diff --git a/frontends/sfe/ecm_sfe_common.h b/frontends/sfe/ecm_sfe_common.h
new file mode 100644
index 0000000..f3a2131
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_common.h
@@ -0,0 +1,58 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015, The Linux Foundation.  All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+/*
+ * This macro converts ECM ip_addr_t to SFE IPv6 address
+ */
+#define ECM_IP_ADDR_TO_SFE_IPV6_ADDR(sfe6, ipaddrt) \
+	{ \
+		ecm_type_check_ae_ipv6(sfe6); \
+		ecm_type_check_ecm_ip_addr(ipaddrt); \
+		sfe6[0] = htonl(ipaddrt[3]); \
+		sfe6[1] = htonl(ipaddrt[2]); \
+		sfe6[2] = htonl(ipaddrt[1]); \
+		sfe6[3] = htonl(ipaddrt[0]); \
+	}
+
+/*
+ * This macro converts SFE IPv6 address to ECM ip_addr_t
+ */
+#define ECM_SFE_IPV6_ADDR_TO_IP_ADDR(ipaddrt, sfe6) \
+	{ \
+		ecm_type_check_ecm_ip_addr(ipaddrt); \
+		ecm_type_check_ae_ipv6(sfe6); \
+		ipaddrt[0] = ntohl(sfe6[3]); \
+		ipaddrt[1] = ntohl(sfe6[2]); \
+		ipaddrt[2] = ntohl(sfe6[1]); \
+		ipaddrt[3] = ntohl(sfe6[0]); \
+	}
+
+/*
+ * ecm_sfe_common_get_interface_number_by_dev()
+ *	Returns the acceleration engine interface number based on the net_device object.
+ */
+static inline int32_t ecm_sfe_common_get_interface_number_by_dev(struct net_device *dev)
+{
+	/*
+	 * sfe_interface_num for all IPsec tunnels will always be the one specific to acceleration engine.
+	 */
+	if (dev->type == ECM_ARPHRD_IPSEC_TUNNEL_TYPE) {
+		return SFE_SPECIAL_INTERFACE_IPSEC;
+	}
+
+	return dev->ifindex;
+}
+
diff --git a/frontends/sfe/ecm_sfe_conntrack_notifier.c b/frontends/sfe/ecm_sfe_conntrack_notifier.c
new file mode 100644
index 0000000..39d1f38
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_conntrack_notifier.c
@@ -0,0 +1,237 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+/*
+ * ecm_sfe_conntrack_notifier.c
+ * 	Conntrack notifier functionality.
+ */
+
+#include <linux/version.h>
+#include <linux/types.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/icmp.h>
+#include <linux/kthread.h>
+#include <linux/debugfs.h>
+#include <linux/pkt_sched.h>
+#include <linux/string.h>
+#include <net/route.h>
+#include <net/ip.h>
+#include <net/tcp.h>
+#include <asm/unaligned.h>
+#include <asm/uaccess.h>	/* for put_user */
+#include <net/ipv6.h>
+#include <linux/inet.h>
+#include <linux/in.h>
+#include <linux/udp.h>
+#include <linux/tcp.h>
+
+#include <linux/inetdevice.h>
+#include <linux/if_arp.h>
+#include <linux/netfilter_ipv4.h>
+#include <linux/netfilter_bridge.h>
+#include <linux/if_bridge.h>
+#include <net/arp.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_acct.h>
+#include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_l4proto.h>
+#include <net/netfilter/nf_conntrack_l3proto.h>
+#include <net/netfilter/nf_conntrack_zones.h>
+#include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
+#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
+
+/*
+ * Debug output levels
+ * 0 = OFF
+ * 1 = ASSERTS / ERRORS
+ * 2 = 1 + WARN
+ * 3 = 2 + INFO
+ * 4 = 3 + TRACE
+ */
+#define DEBUG_LEVEL ECM_CONNTRACK_NOTIFIER_DEBUG_LEVEL
+
+#include <sfe_drv.h>
+
+#include "ecm_types.h"
+#include "ecm_db_types.h"
+#include "ecm_state.h"
+#include "ecm_tracker.h"
+#include "ecm_classifier.h"
+#include "ecm_front_end_types.h"
+#include "ecm_tracker_udp.h"
+#include "ecm_tracker_tcp.h"
+#include "ecm_tracker_datagram.h"
+#include "ecm_db.h"
+#include "ecm_sfe_ipv4.h"
+#ifdef ECM_IPV6_ENABLE
+#include "ecm_sfe_ipv6.h"
+#endif
+
+/*
+ * Locking of the classifier - concurrency control
+ */
+static DEFINE_SPINLOCK(ecm_sfe_conntrack_notifier_lock);				/* Protect against SMP access between netfilter, events and private threaded function. */
+
+/*
+ * Debugfs dentry object.
+ */
+static struct dentry *ecm_sfe_conntrack_notifier_dentry;
+
+/*
+ * General operational control
+ */
+static int ecm_sfe_conntrack_notifier_stopped = 0;				/* When non-zero further traffic will not be processed */
+
+#ifdef CONFIG_NF_CONNTRACK_EVENTS
+/*
+ * ecm_sfe_conntrack_event()
+ *	Callback event invoked when conntrack connection state changes, currently we handle destroy events to quickly release state
+ */
+#ifdef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
+static int ecm_sfe_conntrack_event(struct notifier_block *this, unsigned long events, void *ptr)
+#else
+static int ecm_sfe_conntrack_event(unsigned int events, struct nf_ct_event *item)
+#endif
+{
+#ifdef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
+	struct nf_ct_event *item = (struct nf_ct_event *)ptr;
+#endif
+	struct nf_conn *ct = item->ct;
+
+	/*
+	 * If operations have stopped then do not process event
+	 */
+	spin_lock_bh(&ecm_sfe_conntrack_notifier_lock);
+	if (unlikely(ecm_sfe_conntrack_notifier_stopped)) {
+		DEBUG_WARN("Ignoring event - stopped\n");
+		spin_unlock_bh(&ecm_sfe_conntrack_notifier_lock);
+		return NOTIFY_DONE;
+	}
+	spin_unlock_bh(&ecm_sfe_conntrack_notifier_lock);
+
+	if (!ct) {
+		DEBUG_WARN("Error: no ct\n");
+		return NOTIFY_DONE;
+	}
+
+	/*
+	 * Special untracked connection is not monitored
+	 */
+	if (ct == &nf_conntrack_untracked) {
+		DEBUG_TRACE("Fake connection event - ignoring\n");
+		return NOTIFY_DONE;
+	}
+
+	/*
+	 * Only interested if this is IPv4 or IPv6.
+	 */
+	if (nf_ct_l3num(ct) == AF_INET) {
+		return ecm_sfe_ipv4_conntrack_event(events, ct);
+	}
+#ifdef ECM_IPV6_ENABLE
+	if (nf_ct_l3num(ct) == AF_INET6) {
+		return ecm_sfe_ipv6_conntrack_event(events, ct);
+	}
+#endif
+	return NOTIFY_DONE;
+}
+
+#ifdef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
+/*
+ * struct notifier_block ecm_sfe_conntrack_notifier
+ *	Netfilter conntrack event system to monitor connection tracking changes
+ */
+static struct notifier_block ecm_sfe_conntrack_notifier = {
+	.notifier_call	= ecm_sfe_conntrack_event,
+};
+#else
+/*
+ * struct nf_ct_event_notifier ecm_sfe_conntrack_notifier
+ *	Netfilter conntrack event system to monitor connection tracking changes
+ */
+static struct nf_ct_event_notifier ecm_sfe_conntrack_notifier = {
+	.fcn	= ecm_sfe_conntrack_event,
+};
+#endif
+#endif
+
+/*
+ * ecm_sfe_conntrack_notifier_stop()
+ */
+void ecm_sfe_conntrack_notifier_stop(int num)
+{
+	ecm_sfe_conntrack_notifier_stopped = num;
+}
+EXPORT_SYMBOL(ecm_sfe_conntrack_notifier_stop);
+
+/*
+ * ecm_sfe_conntrack_notifier_init()
+ */
+int ecm_sfe_conntrack_notifier_init(struct dentry *dentry)
+{
+	int result;
+	DEBUG_INFO("ECM Conntrack Notifier init\n");
+
+	ecm_sfe_conntrack_notifier_dentry = debugfs_create_dir("ecm_sfe_conntrack_notifier", dentry);
+	if (!ecm_sfe_conntrack_notifier_dentry) {
+		DEBUG_ERROR("Failed to create ecm conntrack notifier directory in debugfs\n");
+		return -1;
+	}
+
+	if (!debugfs_create_u32("stop", S_IRUGO | S_IWUSR, ecm_sfe_conntrack_notifier_dentry,
+					(u32 *)&ecm_sfe_conntrack_notifier_stopped)) {
+		DEBUG_ERROR("Failed to create ecm conntrack notifier stopped file in debugfs\n");
+		debugfs_remove_recursive(ecm_sfe_conntrack_notifier_dentry);
+		return -1;
+	}
+
+#ifdef CONFIG_NF_CONNTRACK_EVENTS
+	/*
+	 * Eventing subsystem is available so we register a notifier hook to get fast notifications of expired connections
+	 */
+	result = nf_conntrack_register_notifier(&init_net, &ecm_sfe_conntrack_notifier);
+	if (result < 0) {
+		DEBUG_ERROR("Can't register nf notifier hook.\n");
+		debugfs_remove_recursive(ecm_sfe_conntrack_notifier_dentry);
+		return result;
+	}
+#endif
+
+	return 0;
+}
+EXPORT_SYMBOL(ecm_sfe_conntrack_notifier_init);
+
+/*
+ * ecm_sfe_conntrack_notifier_exit()
+ */
+void ecm_sfe_conntrack_notifier_exit(void)
+{
+	DEBUG_INFO("ECM Conntrack Notifier exit\n");
+#ifdef CONFIG_NF_CONNTRACK_EVENTS
+	nf_conntrack_unregister_notifier(&init_net, &ecm_sfe_conntrack_notifier);
+#endif
+	/*
+	 * Remove the debugfs files recursively.
+	 */
+	if (ecm_sfe_conntrack_notifier_dentry) {
+		debugfs_remove_recursive(ecm_sfe_conntrack_notifier_dentry);
+	}
+}
+EXPORT_SYMBOL(ecm_sfe_conntrack_notifier_exit);
diff --git a/frontends/sfe/ecm_sfe_conntrack_notifier.h b/frontends/sfe/ecm_sfe_conntrack_notifier.h
new file mode 100644
index 0000000..8be6686
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_conntrack_notifier.h
@@ -0,0 +1,19 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+extern void ecm_sfe_conntrack_notifier_stop(int num);
+extern int ecm_sfe_conntrack_notifier_init(struct dentry *dentry);
+extern void ecm_sfe_conntrack_notifier_exit(void);
diff --git a/frontends/sfe/ecm_sfe_ipv4.c b/frontends/sfe/ecm_sfe_ipv4.c
new file mode 100644
index 0000000..128244f
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_ipv4.c
@@ -0,0 +1,2367 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015 The Linux Foundation.  All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+#include <linux/version.h>
+#include <linux/types.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/icmp.h>
+#include <linux/kthread.h>
+#include <linux/debugfs.h>
+#include <linux/pkt_sched.h>
+#include <linux/string.h>
+#include <net/route.h>
+#include <net/ip.h>
+#include <net/tcp.h>
+#include <asm/unaligned.h>
+#include <asm/uaccess.h>	/* for put_user */
+#include <net/ipv6.h>
+#include <linux/inet.h>
+#include <linux/in.h>
+#include <linux/udp.h>
+#include <linux/tcp.h>
+#include <linux/ppp_defs.h>
+#include <linux/mroute.h>
+
+#include <linux/inetdevice.h>
+#include <linux/if_arp.h>
+#include <linux/netfilter_ipv4.h>
+#include <linux/netfilter_bridge.h>
+#include <linux/if_bridge.h>
+#include <net/arp.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_acct.h>
+#include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_l4proto.h>
+#include <net/netfilter/nf_conntrack_l3proto.h>
+#include <net/netfilter/nf_conntrack_zones.h>
+#include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
+#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+#include <linux/../../net/8021q/vlan.h>
+#include <linux/if_vlan.h>
+#endif
+
+/*
+ * Debug output levels
+ * 0 = OFF
+ * 1 = ASSERTS / ERRORS
+ * 2 = 1 + WARN
+ * 3 = 2 + INFO
+ * 4 = 3 + TRACE
+ */
+#define DEBUG_LEVEL ECM_SFE_IPV4_DEBUG_LEVEL
+
+#include <sfe_drv.h>
+
+#include "ecm_types.h"
+#include "ecm_db_types.h"
+#include "ecm_state.h"
+#include "ecm_tracker.h"
+#include "ecm_classifier.h"
+#include "ecm_front_end_types.h"
+#include "ecm_tracker_datagram.h"
+#include "ecm_tracker_udp.h"
+#include "ecm_tracker_tcp.h"
+#include "ecm_db.h"
+#include "ecm_classifier_default.h"
+#ifdef ECM_CLASSIFIER_NL_ENABLE
+#include "ecm_classifier_nl.h"
+#endif
+#ifdef ECM_CLASSIFIER_HYFI_ENABLE
+#include "ecm_classifier_hyfi.h"
+#endif
+#ifdef ECM_CLASSIFIER_DSCP_ENABLE
+#include "ecm_classifier_dscp.h"
+#endif
+#ifdef ECM_CLASSIFIER_PCC_ENABLE
+#include "ecm_classifier_pcc.h"
+#endif
+#include "ecm_interface.h"
+#include "ecm_sfe_ipv4.h"
+#include "ecm_sfe_ported_ipv4.h"
+#ifdef ECM_MULTICAST_ENABLE
+#include "ecm_sfe_multicast_ipv4.h"
+#endif
+#ifdef ECM_NON_PORTED_SUPPORT_ENABLE
+#include "ecm_sfe_non_ported_ipv4.h"
+#endif
+
+#include "ecm_front_end_common.h"
+
+int ecm_sfe_ipv4_no_action_limit_default = 250;		/* Default no-action limit. */
+int ecm_sfe_ipv4_driver_fail_limit_default = 250;		/* Default driver fail limit. */
+int ecm_sfe_ipv4_nack_limit_default = 250;			/* Default nack limit. */
+int ecm_sfe_ipv4_accelerated_count = 0;			/* Total offloads */
+int ecm_sfe_ipv4_pending_accel_count = 0;			/* Total pending offloads issued to the SFE / awaiting completion */
+int ecm_sfe_ipv4_pending_decel_count = 0;			/* Total pending deceleration requests issued to the SFE / awaiting completion */
+
+/*
+ * Limiting the acceleration of connections.
+ *
+ * By default there is no acceleration limiting.
+ * This means that when ECM has more connections (that can be accelerated) than the acceleration
+ * engine will allow the ECM will continue to try to accelerate.
+ * In this scenario the acceleration engine will begin removal of existing rules to make way for new ones.
+ * When the accel_limit_mode is set to FIXED ECM will not permit more rules to be issued than the engine will allow.
+ */
+uint32_t ecm_sfe_ipv4_accel_limit_mode = ECM_FRONT_END_ACCEL_LIMIT_MODE_UNLIMITED;
+
+/*
+ * Locking of the classifier - concurrency control for file global parameters.
+ * NOTE: It is safe to take this lock WHILE HOLDING a feci->lock.  The reverse is NOT SAFE.
+ */
+DEFINE_SPINLOCK(ecm_sfe_ipv4_lock);			/* Protect against SMP access between netfilter, events and private threaded function. */
+
+/*
+ * Management thread control
+ */
+bool ecm_sfe_ipv4_terminate_pending = false;		/* True when the user has signalled we should quit */
+
+/*
+ * SFE driver linkage
+ */
+struct sfe_drv_ctx_instance *ecm_sfe_ipv4_drv_mgr = NULL;
+
+static unsigned long ecm_sfe_ipv4_accel_cmd_time_avg_samples = 0;	/* Sum of time taken for the set of accel command samples, used to compute average time for an accel command to complete */
+static unsigned long ecm_sfe_ipv4_accel_cmd_time_avg_set = 1;	/* How many samples in the set */
+static unsigned long ecm_sfe_ipv4_decel_cmd_time_avg_samples = 0;	/* Sum of time taken for the set of accel command samples, used to compute average time for an accel command to complete */
+static unsigned long ecm_sfe_ipv4_decel_cmd_time_avg_set = 1;	/* How many samples in the set */
+
+/*
+ * Debugfs dentry object.
+ */
+static struct dentry *ecm_sfe_ipv4_dentry;
+
+/*
+ * General operational control
+ */
+static int ecm_sfe_ipv4_stopped = 0;			/* When non-zero further traffic will not be processed */
+
+/*
+ * ecm_sfe_ipv4_node_establish_and_ref()
+ *	Returns a reference to a node, possibly creating one if necessary.
+ *
+ * The given_node_addr will be used if provided.
+ *
+ * Returns NULL on failure.
+ */
+struct ecm_db_node_instance *ecm_sfe_ipv4_node_establish_and_ref(struct ecm_front_end_connection_instance *feci,
+							struct net_device *dev, ip_addr_t addr,
+							struct ecm_db_iface_instance *interface_list[], int32_t interface_list_first,
+							uint8_t *given_node_addr)
+{
+	struct ecm_db_node_instance *ni;
+	struct ecm_db_node_instance *nni;
+	struct ecm_db_iface_instance *ii;
+	int i;
+	bool done;
+	uint8_t node_addr[ETH_ALEN];
+
+	DEBUG_INFO("Establish node for " ECM_IP_ADDR_DOT_FMT "\n", ECM_IP_ADDR_TO_DOT(addr));
+
+	/*
+	 * The node is the datalink address, typically a MAC address.
+	 * However the node address to use is not always obvious and depends on the interfaces involved.
+	 * For example if the interface is PPPoE then we use the MAC of the PPPoE server as we cannot use normal ARP resolution.
+	 * Not all hosts have a node address, where there is none, a suitable alternative should be located and is typically based on 'addr'
+	 * or some other datalink session information.
+	 * It should be, at a minimum, something that ties the host with the interface.
+	 *
+	 * Iterate from 'inner' to 'outer' interfaces - discover what the node is.
+	 */
+	memset(node_addr, 0, ETH_ALEN);
+	done = false;
+	if (given_node_addr) {
+		memcpy(node_addr, given_node_addr, ETH_ALEN);
+		done = true;
+		DEBUG_TRACE("Using given node address: %pM\n", node_addr);
+	}
+	for (i = ECM_DB_IFACE_HEIRARCHY_MAX - 1; (!done) && (i >= interface_list_first); i--) {
+		ecm_db_iface_type_t type;
+		ip_addr_t gw_addr = ECM_IP_ADDR_NULL;
+		bool on_link = false;
+#ifdef ECM_INTERFACE_PPP_ENABLE
+		struct ecm_db_interface_info_pppoe pppoe_info;
+#endif
+		type = ecm_db_connection_iface_type_get(interface_list[i]);
+		DEBUG_INFO("Lookup node address, interface @ %d is type: %d\n", i, type);
+
+		switch (type) {
+
+		case ECM_DB_IFACE_TYPE_PPPOE:
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			/*
+			 * Node address is the address of the remote PPPoE server
+			 */
+			ecm_db_iface_pppoe_session_info_get(interface_list[i], &pppoe_info);
+			memcpy(node_addr, pppoe_info.remote_mac, ETH_ALEN);
+			done = true;
+			break;
+#else
+			DEBUG_TRACE("PPPoE interface unsupported\n");
+			return NULL;
+#endif
+
+		case ECM_DB_IFACE_TYPE_SIT:
+		case ECM_DB_IFACE_TYPE_TUNIPIP6:
+			done = true;
+			break;
+
+		case ECM_DB_IFACE_TYPE_VLAN:
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			/*
+			 * VLAN handled same along with ethernet, lag, bridge etc.
+			 */
+#else
+			DEBUG_TRACE("VLAN interface unsupported\n");
+			return NULL;
+#endif
+		case ECM_DB_IFACE_TYPE_ETHERNET:
+		case ECM_DB_IFACE_TYPE_LAG:
+		case ECM_DB_IFACE_TYPE_BRIDGE:
+		case ECM_DB_IFACE_TYPE_IPSEC_TUNNEL:
+			if (!ecm_interface_mac_addr_get(addr, node_addr, &on_link, gw_addr)) {
+				DEBUG_TRACE("failed to obtain node address for host " ECM_IP_ADDR_DOT_FMT "\n", ECM_IP_ADDR_TO_DOT(addr));
+				ecm_interface_send_arp_request(dev, addr, on_link, gw_addr);
+
+				/*
+				 * Unable to get node address at this time.
+				 */
+				return NULL;
+			}
+
+			if (is_multicast_ether_addr(node_addr)) {
+				DEBUG_TRACE("multicast node address for host " ECM_IP_ADDR_DOT_FMT ", node_addr: %pM\n", ECM_IP_ADDR_TO_DOT(addr), node_addr);
+				return NULL;
+			}
+
+			/*
+			 * Because we are iterating from inner to outer interface, this interface is the
+			 * innermost one that has a node address - take this one.
+			 */
+			done = true;
+			break;
+		default:
+			/*
+			 * Don't know how to handle these.
+			 * Just copy some part of the address for now, but keep iterating the interface list
+			 * in the hope something recognisable will be seen!
+			 * GGG TODO We really need to roll out support for all interface types we can deal with ASAP :-(
+			 */
+			memcpy(node_addr, (uint8_t *)addr, ETH_ALEN);
+		}
+	}
+	if (!done) {
+		DEBUG_INFO("Failed to establish node for " ECM_IP_ADDR_DOT_FMT "\n", ECM_IP_ADDR_TO_DOT(addr));
+		return NULL;
+	}
+
+	/*
+	 * Locate the node
+	 */
+	ni = ecm_db_node_find_and_ref(node_addr);
+	if (ni) {
+		DEBUG_TRACE("%p: node established\n", ni);
+		return ni;
+	}
+
+	/*
+	 * No node - establish iface
+	 */
+	ii = ecm_interface_establish_and_ref(feci, dev);
+	if (!ii) {
+		DEBUG_WARN("Failed to establish iface\n");
+		return NULL;
+	}
+
+	/*
+	 * No node - create one
+	 */
+	nni = ecm_db_node_alloc();
+	if (!nni) {
+		DEBUG_WARN("Failed to establish node\n");
+		ecm_db_iface_deref(ii);
+		return NULL;
+	}
+
+	/*
+	 * Add node into the database, atomically to avoid races creating the same thing
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	ni = ecm_db_node_find_and_ref(node_addr);
+	if (ni) {
+		spin_unlock_bh(&ecm_sfe_ipv4_lock);
+		ecm_db_node_deref(nni);
+		ecm_db_iface_deref(ii);
+		return ni;
+	}
+
+	ecm_db_node_add(nni, ii, node_addr, NULL, nni);
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	/*
+	 * Don't need iface instance now
+	 */
+	ecm_db_iface_deref(ii);
+
+	DEBUG_TRACE("%p: node established\n", nni);
+	return nni;
+}
+
+/*
+ * ecm_sfe_ipv4_host_establish_and_ref()
+ *	Returns a reference to a host, possibly creating one if necessary.
+ *
+ * Returns NULL on failure.
+ */
+struct ecm_db_host_instance *ecm_sfe_ipv4_host_establish_and_ref(ip_addr_t addr)
+{
+	struct ecm_db_host_instance *hi;
+	struct ecm_db_host_instance *nhi;
+
+	DEBUG_INFO("Establish host for " ECM_IP_ADDR_DOT_FMT "\n", ECM_IP_ADDR_TO_DOT(addr));
+
+	/*
+	 * Locate the host
+	 */
+	hi = ecm_db_host_find_and_ref(addr);
+	if (hi) {
+		DEBUG_TRACE("%p: host established\n", hi);
+		return hi;
+	}
+
+	/*
+	 * No host - create one
+	 */
+	nhi = ecm_db_host_alloc();
+	if (!nhi) {
+		DEBUG_WARN("Failed to establish host\n");
+		return NULL;
+	}
+
+	/*
+	 * Add host into the database, atomically to avoid races creating the same thing
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	hi = ecm_db_host_find_and_ref(addr);
+	if (hi) {
+		spin_unlock_bh(&ecm_sfe_ipv4_lock);
+		ecm_db_host_deref(nhi);
+		return hi;
+	}
+
+	ecm_db_host_add(nhi, addr, true, NULL, nhi);
+
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	DEBUG_TRACE("%p: host established\n", nhi);
+	return nhi;
+}
+
+/*
+ * ecm_sfe_ipv4_mapping_establish_and_ref()
+ *	Returns a reference to a mapping, possibly creating one if necessary.
+ *
+ * Returns NULL on failure.
+ */
+struct ecm_db_mapping_instance *ecm_sfe_ipv4_mapping_establish_and_ref(ip_addr_t addr, int port)
+{
+	struct ecm_db_mapping_instance *mi;
+	struct ecm_db_mapping_instance *nmi;
+	struct ecm_db_host_instance *hi;
+
+	DEBUG_INFO("Establish mapping for " ECM_IP_ADDR_DOT_FMT ":%d\n", ECM_IP_ADDR_TO_DOT(addr), port);
+
+	/*
+	 * Locate the mapping
+	 */
+	mi = ecm_db_mapping_find_and_ref(addr, port);
+	if (mi) {
+		DEBUG_TRACE("%p: mapping established\n", mi);
+		return mi;
+	}
+
+	/*
+	 * No mapping - establish host existence
+	 */
+	hi = ecm_sfe_ipv4_host_establish_and_ref(addr);
+	if (!hi) {
+		DEBUG_WARN("Failed to establish host\n");
+		return NULL;
+	}
+
+	/*
+	 * Create mapping instance
+	 */
+	nmi = ecm_db_mapping_alloc();
+	if (!nmi) {
+		ecm_db_host_deref(hi);
+		DEBUG_WARN("Failed to establish mapping\n");
+		return NULL;
+	}
+
+	/*
+	 * Add mapping into the database, atomically to avoid races creating the same thing
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	mi = ecm_db_mapping_find_and_ref(addr, port);
+	if (mi) {
+		spin_unlock_bh(&ecm_sfe_ipv4_lock);
+		ecm_db_mapping_deref(nmi);
+		ecm_db_host_deref(hi);
+		return mi;
+	}
+
+	ecm_db_mapping_add(nmi, hi, port, NULL, nmi);
+
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	/*
+	 * Don't need the host instance now - the mapping maintains a reference to it now.
+	 */
+	ecm_db_host_deref(hi);
+
+	/*
+	 * Return the mapping instance
+	 */
+	DEBUG_INFO("%p: mapping established\n", nmi);
+	return nmi;
+}
+
+/*
+ * ecm_sfe_ipv4_accel_done_time_update()
+ *	Record how long the command took to complete, updating average samples
+ */
+void ecm_sfe_ipv4_accel_done_time_update(struct ecm_front_end_connection_instance *feci)
+{
+	unsigned long delta;
+
+	/*
+	 * How long did it take the command to complete?
+	 */
+	spin_lock_bh(&feci->lock);
+	feci->stats.cmd_time_completed = jiffies;
+	delta = feci->stats.cmd_time_completed - feci->stats.cmd_time_begun;
+	spin_unlock_bh(&feci->lock);
+
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	ecm_sfe_ipv4_accel_cmd_time_avg_samples += delta;
+	ecm_sfe_ipv4_accel_cmd_time_avg_set++;
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+}
+
+/*
+ * ecm_sfe_ipv4_deccel_done_time_update()
+ *	Record how long the command took to complete, updating average samples
+ */
+void ecm_sfe_ipv4_decel_done_time_update(struct ecm_front_end_connection_instance *feci)
+{
+	unsigned long delta;
+
+	/*
+	 * How long did it take the command to complete?
+	 */
+	spin_lock_bh(&feci->lock);
+	feci->stats.cmd_time_completed = jiffies;
+	delta = feci->stats.cmd_time_completed - feci->stats.cmd_time_begun;
+	spin_unlock_bh(&feci->lock);
+
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	ecm_sfe_ipv4_decel_cmd_time_avg_samples += delta;
+	ecm_sfe_ipv4_decel_cmd_time_avg_set++;
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+}
+
+/*
+ * ecm_sfe_ipv4_assign_classifier()
+ *	Instantiate and assign classifier of type upon the connection, also returning it if it could be allocated.
+ */
+struct ecm_classifier_instance *ecm_sfe_ipv4_assign_classifier(struct ecm_db_connection_instance *ci, ecm_classifier_type_t type)
+{
+	DEBUG_TRACE("%p: Assign classifier of type: %d\n", ci, type);
+	DEBUG_ASSERT(type != ECM_CLASSIFIER_TYPE_DEFAULT, "Must never need to instantiate default type in this way");
+
+#ifdef ECM_CLASSIFIER_PCC_ENABLE
+	if (type == ECM_CLASSIFIER_TYPE_PCC) {
+		struct ecm_classifier_pcc_instance *pcci;
+		pcci = ecm_classifier_pcc_instance_alloc(ci);
+		if (!pcci) {
+			DEBUG_TRACE("%p: Failed to create Parental Controls classifier\n", ci);
+			return NULL;
+		}
+		DEBUG_TRACE("%p: Created Parental Controls classifier: %p\n", ci, pcci);
+		ecm_db_connection_classifier_assign(ci, (struct ecm_classifier_instance *)pcci);
+		return (struct ecm_classifier_instance *)pcci;
+	}
+#endif
+
+#ifdef ECM_CLASSIFIER_NL_ENABLE
+	if (type == ECM_CLASSIFIER_TYPE_NL) {
+		struct ecm_classifier_nl_instance *cnli;
+		cnli = ecm_classifier_nl_instance_alloc(ci);
+		if (!cnli) {
+			DEBUG_TRACE("%p: Failed to create Netlink classifier\n", ci);
+			return NULL;
+		}
+		DEBUG_TRACE("%p: Created Netlink classifier: %p\n", ci, cnli);
+		ecm_db_connection_classifier_assign(ci, (struct ecm_classifier_instance *)cnli);
+		return (struct ecm_classifier_instance *)cnli;
+	}
+#endif
+
+#ifdef ECM_CLASSIFIER_DSCP_ENABLE
+	if (type == ECM_CLASSIFIER_TYPE_DSCP) {
+		struct ecm_classifier_dscp_instance *cdscpi;
+		cdscpi = ecm_classifier_dscp_instance_alloc(ci);
+		if (!cdscpi) {
+			DEBUG_TRACE("%p: Failed to create DSCP classifier\n", ci);
+			return NULL;
+		}
+		DEBUG_TRACE("%p: Created DSCP classifier: %p\n", ci, cdscpi);
+		ecm_db_connection_classifier_assign(ci, (struct ecm_classifier_instance *)cdscpi);
+		return (struct ecm_classifier_instance *)cdscpi;
+	}
+#endif
+
+#ifdef ECM_CLASSIFIER_HYFI_ENABLE
+	if (type == ECM_CLASSIFIER_TYPE_HYFI) {
+		struct ecm_classifier_hyfi_instance *chfi;
+		chfi = ecm_classifier_hyfi_instance_alloc(ci);
+		if (!chfi) {
+			DEBUG_TRACE("%p: Failed to create HyFi classifier\n", ci);
+			return NULL;
+		}
+		DEBUG_TRACE("%p: Created HyFi classifier: %p\n", ci, chfi);
+		ecm_db_connection_classifier_assign(ci, (struct ecm_classifier_instance *)chfi);
+		return (struct ecm_classifier_instance *)chfi;
+	}
+#endif
+
+	// GGG TODO Add other classifier types.
+	DEBUG_ASSERT(NULL, "%p: Unsupported type: %d\n", ci, type);
+	return NULL;
+}
+
+/*
+ * ecm_sfe_ipv4_reclassify()
+ *	Signal reclassify upon the assigned classifiers.
+ *
+ * Classifiers that unassigned themselves we TRY to re-instantiate them.
+ * Returns false if the function is not able to instantiate all missing classifiers.
+ * This function does not release and references to classifiers in the assignments[].
+ */
+bool ecm_sfe_ipv4_reclassify(struct ecm_db_connection_instance *ci, int assignment_count, struct ecm_classifier_instance *assignments[])
+{
+	ecm_classifier_type_t classifier_type;
+	int i;
+	bool full_reclassification = true;
+
+	/*
+	 * assignment_count will always be <= the number of classifier types available
+	 */
+	for (i = 0, classifier_type = ECM_CLASSIFIER_TYPE_DEFAULT; i < assignment_count; ++i, ++classifier_type) {
+		ecm_classifier_type_t aci_type;
+		struct ecm_classifier_instance *aci;
+
+		aci = assignments[i];
+		aci_type = aci->type_get(aci);
+		DEBUG_TRACE("%p: Reclassify: %d\n", ci, aci_type);
+		aci->reclassify(aci);
+
+		/*
+		 * If the connection has a full complement of assigned classifiers then these will match 1:1 with the classifier_type (all in same order).
+		 * If not, we have to create the missing ones.
+		 */
+		if (aci_type == classifier_type) {
+			continue;
+		}
+
+		/*
+		 * Need to instantiate the missing classifier types until we get to the same type as aci_type then we are back in sync to continue reclassification
+		 */
+		while (classifier_type != aci_type) {
+			struct ecm_classifier_instance *naci;
+			DEBUG_TRACE("%p: Instantiate missing type: %d\n", ci, classifier_type);
+			DEBUG_ASSERT(classifier_type < ECM_CLASSIFIER_TYPES, "Algorithm bad");
+
+			naci = ecm_sfe_ipv4_assign_classifier(ci, classifier_type);
+			if (!naci) {
+				full_reclassification = false;
+			} else {
+				naci->deref(naci);
+			}
+
+			classifier_type++;
+		}
+	}
+
+	/*
+	 * Add missing types
+	 */
+	for (; classifier_type < ECM_CLASSIFIER_TYPES; ++classifier_type) {
+		struct ecm_classifier_instance *naci;
+		DEBUG_TRACE("%p: Instantiate missing type: %d\n", ci, classifier_type);
+
+		naci = ecm_sfe_ipv4_assign_classifier(ci, classifier_type);
+		if (!naci) {
+			full_reclassification = false;
+		} else {
+			naci->deref(naci);
+		}
+	}
+
+	DEBUG_TRACE("%p: reclassify done: %u\n", ci, full_reclassification);
+	return full_reclassification;
+}
+
+/*
+ * ecm_sfe_ipv4_connection_regenerate()
+ *	Re-generate a connection.
+ *
+ * Re-generating a connection involves re-evaluating the interface lists in case interface heirarchies have changed.
+ * It also involves the possible triggering of classifier re-evaluation but only if all currently assigned
+ * classifiers permit this operation.
+ */
+void ecm_sfe_ipv4_connection_regenerate(struct ecm_db_connection_instance *ci, ecm_tracker_sender_type_t sender,
+							struct net_device *out_dev, struct net_device *out_dev_nat,
+							struct net_device *in_dev, struct net_device *in_dev_nat)
+{
+	int i;
+	bool reclassify_allowed;
+	int32_t to_list_first;
+	struct ecm_db_iface_instance *to_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+	int32_t to_nat_list_first;
+	struct ecm_db_iface_instance *to_nat_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+	int32_t from_list_first;
+	struct ecm_db_iface_instance *from_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+	int32_t from_nat_list_first;
+	struct ecm_db_iface_instance *from_nat_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+	ip_addr_t ip_src_addr;
+	ip_addr_t ip_dest_addr;
+	ip_addr_t ip_src_addr_nat;
+	ip_addr_t ip_dest_addr_nat;
+	int protocol;
+	bool is_routed;
+	uint8_t src_node_addr[ETH_ALEN];
+	uint8_t dest_node_addr[ETH_ALEN];
+	uint8_t src_node_addr_nat[ETH_ALEN];
+	uint8_t dest_node_addr_nat[ETH_ALEN];
+	int assignment_count;
+	struct ecm_classifier_instance *assignments[ECM_CLASSIFIER_TYPES];
+	struct ecm_front_end_connection_instance *feci;
+
+	DEBUG_INFO("%p: re-gen needed\n", ci);
+
+	/*
+	 * We may need to swap the devices around depending on who the sender of the packet that triggered the re-gen is
+	 */
+	if (sender == ECM_TRACKER_SENDER_TYPE_DEST) {
+		struct net_device *tmp_dev;
+
+		/*
+		 * This is a packet sent by the destination of the connection, i.e. it is a packet issued by the 'from' side of the connection.
+		 */
+		DEBUG_TRACE("%p: Re-gen swap devs\n", ci);
+		tmp_dev = out_dev;
+		out_dev = in_dev;
+		in_dev = tmp_dev;
+
+		tmp_dev = out_dev_nat;
+		out_dev_nat = in_dev_nat;
+		in_dev_nat = tmp_dev;
+	}
+
+	/*
+	 * Update the interface lists - these may have changed, e.g. LAG path change etc.
+	 * NOTE: We never have to change the usual mapping->host->node_iface arrangements for each side of the connection (to/from sides)
+	 * This is because if these interfaces change then the connection is dead anyway.
+	 * But a LAG slave might change the heirarchy the connection is using but the LAG master is still sane.
+	 * If any of the new interface heirarchies cannot be created then simply set empty-lists as this will deny
+	 * acceleration and ensure that a bad rule cannot be created.
+	 * IMPORTANT: The 'sender' defines who has sent the packet that triggered this re-generation
+	 */
+	protocol = ecm_db_connection_protocol_get(ci);
+
+	is_routed = ecm_db_connection_is_routed_get(ci);
+
+	ecm_db_connection_from_address_get(ci, ip_src_addr);
+	ecm_db_connection_from_address_nat_get(ci, ip_src_addr_nat);
+
+	ecm_db_connection_to_address_get(ci, ip_dest_addr);
+	ecm_db_connection_to_address_nat_get(ci, ip_dest_addr_nat);
+
+	ecm_db_connection_from_node_address_get(ci, src_node_addr);
+	ecm_db_connection_from_nat_node_address_get(ci, src_node_addr_nat);
+
+	ecm_db_connection_to_node_address_get(ci, dest_node_addr);
+	ecm_db_connection_to_nat_node_address_get(ci, dest_node_addr_nat);
+
+	feci = ecm_db_connection_front_end_get_and_ref(ci);
+
+	DEBUG_TRACE("%p: Update the 'from' interface heirarchy list\n", ci);
+	from_list_first = ecm_interface_heirarchy_construct(feci, from_list, ip_dest_addr, ip_src_addr, 4, protocol, in_dev, is_routed, in_dev, src_node_addr, dest_node_addr);
+	if (from_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+		goto ecm_ipv4_retry_regen;
+	}
+
+	ecm_db_connection_from_interfaces_reset(ci, from_list, from_list_first);
+	ecm_db_connection_interfaces_deref(from_list, from_list_first);
+
+	DEBUG_TRACE("%p: Update the 'from NAT' interface heirarchy list\n", ci);
+	from_nat_list_first = ecm_interface_heirarchy_construct(feci, from_nat_list, ip_dest_addr, ip_src_addr_nat, 4, protocol, in_dev_nat, is_routed, in_dev_nat, src_node_addr_nat, dest_node_addr_nat);
+	if (from_nat_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+		goto ecm_ipv4_retry_regen;
+	}
+
+	ecm_db_connection_from_nat_interfaces_reset(ci, from_nat_list, from_nat_list_first);
+	ecm_db_connection_interfaces_deref(from_nat_list, from_nat_list_first);
+
+	DEBUG_TRACE("%p: Update the 'to' interface heirarchy list\n", ci);
+	to_list_first = ecm_interface_heirarchy_construct(feci, to_list, ip_src_addr, ip_dest_addr, 4, protocol, out_dev, is_routed, in_dev, dest_node_addr, src_node_addr);
+	if (to_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+		goto ecm_ipv4_retry_regen;
+	}
+
+	ecm_db_connection_to_interfaces_reset(ci, to_list, to_list_first);
+	ecm_db_connection_interfaces_deref(to_list, to_list_first);
+
+	DEBUG_TRACE("%p: Update the 'to NAT' interface heirarchy list\n", ci);
+	to_nat_list_first = ecm_interface_heirarchy_construct(feci, to_nat_list, ip_src_addr, ip_dest_addr_nat, 4, protocol, out_dev_nat, is_routed, in_dev, dest_node_addr_nat, src_node_addr_nat);
+	if (to_nat_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+		goto ecm_ipv4_retry_regen;
+	}
+
+	feci->deref(feci);
+	ecm_db_connection_to_nat_interfaces_reset(ci, to_nat_list, to_nat_list_first);
+	ecm_db_connection_interfaces_deref(to_nat_list, to_nat_list_first);
+
+	/*
+	 * Get list of assigned classifiers to reclassify.
+	 * Remember: This also includes our default classifier too.
+	 */
+	assignment_count = ecm_db_connection_classifier_assignments_get_and_ref(ci, assignments);
+
+	/*
+	 * All of the assigned classifiers must permit reclassification.
+	 */
+	reclassify_allowed = true;
+	for (i = 0; i < assignment_count; ++i) {
+		DEBUG_TRACE("%p: Calling to reclassify: %p, type: %d\n", ci, assignments[i], assignments[i]->type_get(assignments[i]));
+		if (!assignments[i]->reclassify_allowed(assignments[i])) {
+			DEBUG_TRACE("%p: reclassify denied: %p, by type: %d\n", ci, assignments[i], assignments[i]->type_get(assignments[i]));
+			reclassify_allowed = false;
+			break;
+		}
+	}
+
+	/*
+	 * Re-generation of state is successful.
+	 */
+	ecm_db_conection_regeneration_completed(ci);
+
+	/*
+	 * Now we action any classifier re-classify
+	 */
+	if (!reclassify_allowed) {
+		/*
+		 * Regeneration came to a successful conclusion even though reclassification was denied
+		 */
+		DEBUG_WARN("%p: re-classify denied\n", ci);
+
+		/*
+		 * Release the assignments
+		 */
+		ecm_db_connection_assignments_release(assignment_count, assignments);
+		return;
+	}
+
+	/*
+	 * Reclassify
+	 */
+	DEBUG_INFO("%p: reclassify\n", ci);
+	if (!ecm_sfe_ipv4_reclassify(ci, assignment_count, assignments)) {
+		/*
+		 * We could not set up the classifiers to reclassify, it is safer to fail out and try again next time
+		 */
+		DEBUG_WARN("%p: Regeneration: reclassify failed\n", ci);
+		ecm_db_connection_assignments_release(assignment_count, assignments);
+		return;
+	}
+	DEBUG_INFO("%p: reclassify success\n", ci);
+
+	/*
+	 * Release the assignments
+	 */
+	ecm_db_connection_assignments_release(assignment_count, assignments);
+	return;
+
+ecm_ipv4_retry_regen:
+	feci->deref(feci);
+	ecm_db_conection_regeneration_failed(ci);
+	return;
+}
+
+/*
+ * ecm_sfe_ipv4_ip_process()
+ *	Process IP datagram skb
+ */
+static unsigned int ecm_sfe_ipv4_ip_process(struct net_device *out_dev, struct net_device *in_dev,
+							uint8_t *src_node_addr, uint8_t *dest_node_addr,
+							bool can_accel, bool is_routed, bool is_l2_encap, struct sk_buff *skb)
+{
+	struct ecm_tracker_ip_header ip_hdr;
+        struct nf_conn *ct;
+        enum ip_conntrack_info ctinfo;
+	struct nf_conntrack_tuple orig_tuple;
+	struct nf_conntrack_tuple reply_tuple;
+	ecm_db_direction_t ecm_dir;
+	ecm_tracker_sender_type_t sender;
+	ip_addr_t ip_src_addr;
+	ip_addr_t ip_dest_addr;
+	ip_addr_t ip_src_addr_nat;
+	ip_addr_t ip_dest_addr_nat;
+	struct net_device *out_dev_nat;
+	struct net_device *in_dev_nat;
+	uint8_t *src_node_addr_nat;
+	uint8_t *dest_node_addr_nat;
+
+	/*
+	 * Obtain the IP header from the skb
+	 */
+	if (!ecm_tracker_ip_check_header_and_read(&ip_hdr, skb)) {
+		DEBUG_WARN("Invalid ip header in skb %p\n", skb);
+		return NF_ACCEPT;
+	}
+
+	if (ip_hdr.fragmented) {
+		DEBUG_TRACE("skb %p is fragmented\n", skb);
+		return NF_ACCEPT;
+	}
+
+	/*
+	 * Extract information, if we have conntrack then use that info as far as we can.
+	 */
+        ct = nf_ct_get(skb, &ctinfo);
+	if (unlikely(!ct)) {
+		DEBUG_TRACE("%p: no ct\n", skb);
+		ECM_IP_ADDR_TO_NIN4_ADDR(orig_tuple.src.u3.ip, ip_hdr.src_addr);
+		ECM_IP_ADDR_TO_NIN4_ADDR(orig_tuple.dst.u3.ip, ip_hdr.dest_addr);
+		orig_tuple.dst.protonum = ip_hdr.protocol;
+		reply_tuple.src.u3.ip = orig_tuple.dst.u3.ip;
+		reply_tuple.dst.u3.ip = orig_tuple.src.u3.ip;
+		sender = ECM_TRACKER_SENDER_TYPE_SRC;
+	} else {
+		if (unlikely(ct == &nf_conntrack_untracked)) {
+			DEBUG_TRACE("%p: ct: untracked\n", skb);
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * If the conntrack connection is using a helper (i.e. Application Layer Gateway)
+		 * then acceleration is denied (connection needs assistance from HLOS to function)
+		 */
+		if (nfct_help(ct)) {
+			DEBUG_TRACE("%p: Connection has helper\n", ct);
+			can_accel = false;
+		}
+
+		/*
+		 * Extract conntrack connection information
+		 */
+		DEBUG_TRACE("%p: ct: %p, ctinfo: %x\n", skb, ct, ctinfo);
+		orig_tuple = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+		reply_tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+		if (IP_CT_DIR_ORIGINAL == CTINFO2DIR(ctinfo)) {
+			sender = ECM_TRACKER_SENDER_TYPE_SRC;
+		} else {
+			sender = ECM_TRACKER_SENDER_TYPE_DEST;
+		}
+
+		/*
+		 * Is this a related connection?
+		 */
+		if ((ctinfo == IP_CT_RELATED) || (ctinfo == IP_CT_RELATED_REPLY)) {
+			/*
+			 * ct is related to the packet at hand.
+			 * We can use the IP src/dest information and the direction information.
+			 * We cannot use the protocol information from the ct (typically the packet at hand is ICMP error that is related to the ct we have here).
+			 */
+			orig_tuple.dst.protonum = ip_hdr.protocol;
+			DEBUG_TRACE("%p: related ct, actual protocol: %u\n", skb, orig_tuple.dst.protonum);
+		}
+	}
+
+#ifdef ECM_MULTICAST_ENABLE
+	/*
+	 * Check for a multicast Destination address here.
+	 */
+	ECM_NIN4_ADDR_TO_IP_ADDR(ip_dest_addr, orig_tuple.dst.u3.ip);
+	if (ecm_ip_addr_is_multicast(ip_dest_addr)) {
+		DEBUG_TRACE("Multicast, Processing: %p\n", skb);
+		return ecm_sfe_multicast_ipv4_connection_process(out_dev,
+				in_dev,
+				src_node_addr,
+				dest_node_addr,
+				can_accel, is_routed, skb,
+				&ip_hdr,
+				ct, sender,
+				&orig_tuple, &reply_tuple);
+	}
+#endif
+
+	/*
+	 * Work out if this packet involves NAT or not.
+	 * If it does involve NAT then work out if this is an ingressing or egressing packet.
+	 */
+	if (orig_tuple.src.u3.ip != reply_tuple.dst.u3.ip) {
+		/*
+		 * Egressing NAT
+		 */
+		ecm_dir = ECM_DB_DIRECTION_EGRESS_NAT;
+	} else if (orig_tuple.dst.u3.ip != reply_tuple.src.u3.ip) {
+		/*
+		 * Ingressing NAT
+		 */
+		ecm_dir = ECM_DB_DIRECTION_INGRESS_NAT;
+	} else if (is_routed) {
+		/*
+		 * Non-NAT
+		 */
+		ecm_dir = ECM_DB_DIRECTION_NON_NAT;
+	} else {
+		/*
+		 * Bridged
+		 */
+		ecm_dir = ECM_DB_DIRECTION_BRIDGED;
+	}
+
+	DEBUG_TRACE("IP Packet ORIGINAL src: %pI4 ORIGINAL dst: %pI4 protocol: %u, sender: %d ecm_dir: %d\n", &orig_tuple.src.u3.ip, &orig_tuple.dst.u3.ip, orig_tuple.dst.protonum, sender, ecm_dir);
+
+	/*
+	 * Get IP addressing information.  This same logic is applied when extracting port information too.
+	 * This is tricky to do as what we are after is src and destination addressing that is non-nat but we also need the nat information too.
+	 * INGRESS connections have their conntrack information reversed!
+	 * We have to keep in mind the connection direction AND the packet direction in order to be able to work out what is what.
+	 *
+	 * ip_src_addr and ip_dest_addr MUST always be the NON-NAT endpoint addresses and reflect PACKET direction and not connection direction 'dir'.
+	 *
+	 * Examples 1 through 4 cater for NAT and NON-NAT in the INGRESS or EGRESS cases.
+	 *
+	 * Example 1:
+	 * An 'original' direction packet to an egress connection from br-lan:192.168.0.133:12345 to eth0:80.132.221.34:80 via NAT'ing router mapping eth0:10.10.10.30:33333 looks like:
+	 *	orig_tuple->src == 192.168.0.133:12345		This becomes ip_src_addr
+	 *	orig_tuple->dst == 80.132.221.34:80		This becomes ip_dest_addr
+	 *	reply_tuple->src == 80.132.221.34:80		This becomes ip_dest_addr_nat
+	 *	reply_tuple->dest == 10.10.10.30:33333		This becomes ip_src_addr_nat
+	 *
+	 *	in_dev would be br-lan - i.e. the device of ip_src_addr
+	 *	out_dev would be eth0 - i.e. the device of ip_dest_addr
+	 *	in_dev_nat would be eth0 - i.e. out_dev, the device of ip_src_addr_nat
+	 *	out_dev_nat would be eth0 - i.e. out_dev, the device of ip_dest_addr_nat
+	 *
+	 *	From a Node address perspective we are at position X in the following topology:
+	 *	LAN_PC======BR-LAN___ETH0====X====WAN_PC
+	 *
+	 *	src_node_addr refers to node address of of ip_src_addr_nat
+	 *	src_node_addr_nat is set to src_node_addr
+	 *	src_node_addr is then set to NULL as there is no node address available here for ip_src_addr
+	 *
+	 *	dest_node_addr refers to node address of ip_dest_addr
+	 *	dest_node_addr_nat is the node of ip_dest_addr_nat which is the same as dest_node_addr
+	 *
+	 * Example 2:
+	 * However an 'original' direction packet to an ingress connection from eth0:80.132.221.34:3321 to a LAN host (e.g. via DMZ) br-lan@192.168.0.133:12345 via NAT'ing router mapping eth0:10.10.10.30:12345 looks like:
+	 *	orig_tuple->src == 80.132.221.34:3321		This becomes ip_src_addr
+	 *	orig_tuple->dst == 10.10.10.30:12345		This becomes ip_dest_addr_nat
+	 *	reply_tuple->src == 192.168.0.133:12345		This becomes ip_dest_addr
+	 *	reply_tuple->dest == 80.132.221.34:3321		This becomes ip_src_addr_nat
+	 *
+	 *	in_dev would be eth0 - i.e. the device of ip_src_addr
+	 *	out_dev would be br-lan - i.e. the device of ip_dest_addr
+	 *	in_dev_nat would be eth0 - i.e. in_dev, the device of ip_src_addr_nat
+	 *	out_dev_nat would be eth0 - i.e. in_dev, the device of ip_dest_addr_nat
+	 *
+	 *	From a Node address perspective we are at position X in the following topology:
+	 *	LAN_PC===X===BR-LAN___ETH0========WAN_PC
+	 *
+	 *	src_node_addr refers to node address of br-lan which is not useful
+	 *	src_node_addr_nat AND src_node_addr become NULL
+	 *
+	 *	dest_node_addr refers to node address of ip_dest_addr
+	 *	dest_node_addr_nat is set to NULL
+	 *
+	 * When dealing with reply packets this confuses things even more.  Reply packets to the above two examples are as follows:
+	 *
+	 * Example 3:
+	 * A 'reply' direction packet to the egress connection above:
+	 *	orig_tuple->src == 192.168.0.133:12345		This becomes ip_dest_addr
+	 *	orig_tuple->dst == 80.132.221.34:80		This becomes ip_src_addr
+	 *	reply_tuple->src == 80.132.221.34:80		This becomes ip_src_addr_nat
+	 *	reply_tuple->dest == 10.10.10.30:33333		This becomes ip_dest_addr_nat
+	 *
+	 *	in_dev would be eth0 - i.e. the device of ip_src_addr
+	 *	out_dev would be br-lan - i.e. the device of ip_dest_addr
+	 *	in_dev_nat would be eth0 - i.e. in_dev, the device of ip_src_addr_nat
+	 *	out_dev_nat would be eth0 - i.e. in_dev, the device of ip_dest_addr_nat
+	 *
+	 *	From a Node address perspective we are at position X in the following topology:
+	 *	LAN_PC===X===BR-LAN___ETH0========WAN_PC
+	 *
+	 *	src_node_addr refers to node address of br-lan which is not useful
+	 *	src_node_addr_nat AND src_node_addr become NULL
+	 *
+	 *	dest_node_addr refers to node address of ip_dest_addr
+	 *	dest_node_addr_nat is set to NULL
+	 *
+	 * Example 4:
+	 * A 'reply' direction packet to the ingress connection above:
+	 *	orig_tuple->src == 80.132.221.34:3321		This becomes ip_dest_addr
+	 *	orig_tuple->dst == 10.10.10.30:12345		This becomes ip_src_addr_nat
+	 *	reply_tuple->src == 192.168.0.133:12345		This becomes ip_src_addr
+	 *	reply_tuple->dest == 80.132.221.34:3321		This becomes ip_dest_addr_nat
+	 *
+	 *	in_dev would be br-lan - i.e. the device of ip_src_addr
+	 *	out_dev would be eth0 - i.e. the device of ip_dest_addr
+	 *	in_dev_nat would be eth0 - i.e. out_dev, the device of ip_src_addr_nat
+	 *	out_dev_nat would be eth0 - i.e. out_dev, the device of ip_dest_addr_nat
+	 *
+	 *	From a Node address perspective we are at position X in the following topology:
+	 *	LAN_PC======BR-LAN___ETH0====X====WAN_PC
+	 *
+	 *	src_node_addr refers to node address of ip_src_addr_nat
+	 *	src_node_addr_nat is set to src_node_addr
+	 *	src_node_addr becomes NULL
+	 *
+	 *	dest_node_addr refers to node address of ip_dest_addr
+	 *	dest_node_addr_nat is set to dest_node_addr also.
+	 *
+	 * The following examples are for BRIDGED cases:
+	 *
+	 * Example 5:
+	 * An 'original' direction packet to an bridged connection from eth1:192.168.0.133:12345 to eth2:192.168.0.244:80 looks like:
+	 *	orig_tuple->src == 192.168.0.133:12345		This becomes ip_src_addr
+	 *	orig_tuple->dst == 192.168.0.244:80		This becomes ip_dest_addr
+	 *	reply_tuple->src == 192.168.0.244:80		This becomes ip_dest_addr_nat
+	 *	reply_tuple->dest == 192.168.0.133:12345	This becomes ip_src_addr_nat
+	 *
+	 *	in_dev would be eth1 - i.e. the device of ip_src_addr
+	 *	out_dev would be eth2 - i.e. the device of ip_dest_addr
+	 *	in_dev_nat would be eth1 - i.e. in_dev, the device of ip_src_addr_nat
+	 *	out_dev_nat would be eth2 - i.e. out_dev, the device of ip_dest_addr_nat
+	 *
+	 *	From a Node address perspective we are at position X in the following topology:
+	 *	LAN PC======ETH1___ETH2====X====LAN PC
+	 *
+	 *	src_node_addr refers to node address of ip_src_addr
+	 *	src_node_addr_nat is set to src_node_addr
+	 *
+	 *	dest_node_addr refers to node address of ip_dest_addr
+	 *	dest_node_addr_nat is set to dest_node_addr
+	 *
+	 * Example 6:
+	 * An 'reply' direction packet to the bridged connection above:
+	 *	orig_tuple->src == 192.168.0.133:12345		This becomes ip_dest_addr
+	 *	orig_tuple->dst == 192.168.0.244:80		This becomes ip_src_addr
+	 *	reply_tuple->src == 192.168.0.244:80		This becomes ip_src_addr_nat
+	 *	reply_tuple->dest == 192.168.0.133:12345	This becomes ip_dest_addr_nat
+	 *
+	 *	in_dev would be eth2 - i.e. the device of ip_src_addr
+	 *	out_dev would be eth1 - i.e. the device of ip_dest_addr
+	 *	in_dev_nat would be eth2 - i.e. in_dev, the device of ip_src_addr_nat
+	 *	out_dev_nat would be eth1 - i.e. out_dev, the device of ip_dest_addr_nat
+	 *
+	 *	From a Node address perspective we are at position X in the following topology:
+	 *	LAN PC===X===ETH1___ETH2========LAN PC
+	 *
+	 *	src_node_addr refers to node address of ip_src_addr
+	 *	src_node_addr_nat is set to src_node_addr
+	 *
+	 *	dest_node_addr refers to node address of ip_dest_addr
+	 *	dest_node_addr_nat is set to dest_node_addr
+	 */
+	if (sender == ECM_TRACKER_SENDER_TYPE_SRC) {
+		if ((ecm_dir == ECM_DB_DIRECTION_EGRESS_NAT) || (ecm_dir == ECM_DB_DIRECTION_NON_NAT)) {
+			/*
+			 * Example 1
+			 */
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_src_addr, orig_tuple.src.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_dest_addr, orig_tuple.dst.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_dest_addr_nat, reply_tuple.src.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_src_addr_nat, reply_tuple.dst.u3.ip);
+
+			in_dev_nat = out_dev;
+			out_dev_nat = out_dev;
+
+			src_node_addr_nat = src_node_addr;
+			src_node_addr = NULL;
+
+			dest_node_addr_nat = dest_node_addr;
+		} else if (ecm_dir == ECM_DB_DIRECTION_INGRESS_NAT) {
+			/*
+			 * Example 2
+			 */
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_src_addr, orig_tuple.src.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_dest_addr_nat, orig_tuple.dst.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_dest_addr, reply_tuple.src.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_src_addr_nat, reply_tuple.dst.u3.ip);
+
+			in_dev_nat = in_dev;
+			out_dev_nat = in_dev;
+
+			src_node_addr = NULL;
+			src_node_addr_nat = NULL;
+
+			dest_node_addr_nat = NULL;
+		} else if (ecm_dir == ECM_DB_DIRECTION_BRIDGED) {
+			/*
+			 * Example 5
+			 */
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_src_addr, orig_tuple.src.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_dest_addr, orig_tuple.dst.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_dest_addr_nat, reply_tuple.src.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_src_addr_nat, reply_tuple.dst.u3.ip);
+
+			in_dev_nat = in_dev;
+			out_dev_nat = out_dev;
+
+			src_node_addr_nat = src_node_addr;
+
+			dest_node_addr_nat = dest_node_addr;
+		} else {
+			DEBUG_ASSERT(false, "Unhandled ecm_dir: %d\n", ecm_dir);
+		}
+	} else {
+		if ((ecm_dir == ECM_DB_DIRECTION_EGRESS_NAT) || (ecm_dir == ECM_DB_DIRECTION_NON_NAT)) {
+			/*
+			 * Example 3
+			 */
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_dest_addr, orig_tuple.src.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_src_addr, orig_tuple.dst.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_src_addr_nat, reply_tuple.src.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_dest_addr_nat, reply_tuple.dst.u3.ip);
+
+			in_dev_nat  = in_dev;
+			out_dev_nat = in_dev;
+
+			src_node_addr = NULL;
+			src_node_addr_nat = NULL;
+
+			dest_node_addr_nat = NULL;
+		} else if (ecm_dir == ECM_DB_DIRECTION_INGRESS_NAT) {
+			/*
+			 * Example 4
+			 */
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_dest_addr, orig_tuple.src.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_src_addr_nat, orig_tuple.dst.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_src_addr, reply_tuple.src.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_dest_addr_nat, reply_tuple.dst.u3.ip);
+
+			in_dev_nat = out_dev;
+			out_dev_nat = out_dev;
+
+			src_node_addr_nat = src_node_addr;
+			src_node_addr = NULL;
+
+			dest_node_addr_nat = dest_node_addr;
+		} else if (ecm_dir == ECM_DB_DIRECTION_BRIDGED) {
+			/*
+			 * Example 6
+			 */
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_dest_addr, orig_tuple.src.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_src_addr, orig_tuple.dst.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_src_addr_nat, reply_tuple.src.u3.ip);
+			ECM_NIN4_ADDR_TO_IP_ADDR(ip_dest_addr_nat, reply_tuple.dst.u3.ip);
+
+			in_dev_nat  = in_dev;
+			out_dev_nat = out_dev;
+
+			src_node_addr_nat = src_node_addr;
+
+			dest_node_addr_nat = dest_node_addr;
+		} else {
+			DEBUG_ASSERT(false, "Unhandled ecm_dir: %d\n", ecm_dir);
+		}
+	}
+
+	/*
+	 * Non-unicast source or destination packets are ignored
+	 * NOTE: Only need to check the non-nat src/dest addresses here.
+	 */
+	if (unlikely(ecm_ip_addr_is_non_unicast(ip_dest_addr))) {
+		DEBUG_TRACE("skb %p non-unicast daddr " ECM_IP_ADDR_DOT_FMT "\n", skb, ECM_IP_ADDR_TO_DOT(ip_dest_addr));
+		return NF_ACCEPT;
+	}
+	if (unlikely(ecm_ip_addr_is_non_unicast(ip_src_addr))) {
+		DEBUG_TRACE("skb %p non-unicast saddr " ECM_IP_ADDR_DOT_FMT "\n", skb, ECM_IP_ADDR_TO_DOT(ip_src_addr));
+		return NF_ACCEPT;
+	}
+
+	/*
+	 * Process IP specific protocol
+	 * TCP and UDP are the most likliest protocols.
+	 */
+	if (likely(orig_tuple.dst.protonum == IPPROTO_TCP) || likely(orig_tuple.dst.protonum == IPPROTO_UDP)) {
+		return ecm_sfe_ported_ipv4_process(out_dev, out_dev_nat,
+				in_dev, in_dev_nat,
+				src_node_addr, src_node_addr_nat,
+				dest_node_addr, dest_node_addr_nat,
+				can_accel, is_routed, is_l2_encap, skb,
+				&ip_hdr,
+				ct, sender, ecm_dir,
+				&orig_tuple, &reply_tuple,
+				ip_src_addr, ip_dest_addr, ip_src_addr_nat, ip_dest_addr_nat);
+	}
+#ifdef ECM_NON_PORTED_SUPPORT_ENABLE
+	return ecm_sfe_non_ported_ipv4_process(out_dev, out_dev_nat,
+				in_dev, in_dev_nat,
+				src_node_addr, src_node_addr_nat,
+				dest_node_addr, dest_node_addr_nat,
+				can_accel, is_routed, is_l2_encap, skb,
+				&ip_hdr,
+				ct, sender, ecm_dir,
+				&orig_tuple, &reply_tuple,
+				ip_src_addr, ip_dest_addr, ip_src_addr_nat, ip_dest_addr_nat);
+#else
+	return NF_ACCEPT;
+#endif
+}
+
+/*
+ * ecm_sfe_ipv4_post_routing_hook()
+ *	Called for IP packets that are going out to interfaces after IP routing stage.
+ */
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3,6,0))
+static unsigned int ecm_sfe_ipv4_post_routing_hook(unsigned int hooknum,
+				struct sk_buff *skb,
+				const struct net_device *in_unused,
+				const struct net_device *out,
+				int (*okfn)(struct sk_buff *))
+#else
+static unsigned int ecm_sfe_ipv4_post_routing_hook(const struct nf_hook_ops *ops,
+				struct sk_buff *skb,
+				const struct net_device *in_unused,
+				const struct net_device *out,
+				int (*okfn)(struct sk_buff *))
+#endif
+{
+	struct net_device *in;
+	bool can_accel = true;
+	unsigned int result;
+
+	DEBUG_TRACE("%p: Routing: %s\n", out, out->name);
+
+	/*
+	 * If operations have stopped then do not process packets
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	if (unlikely(ecm_sfe_ipv4_stopped)) {
+		spin_unlock_bh(&ecm_sfe_ipv4_lock);
+		DEBUG_TRACE("Front end stopped\n");
+		return NF_ACCEPT;
+	}
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	/*
+	 * Don't process broadcast or multicast
+	 */
+	if (skb->pkt_type == PACKET_BROADCAST) {
+		DEBUG_TRACE("Broadcast, ignoring: %p\n", skb);
+		return NF_ACCEPT;
+	}
+
+#ifndef ECM_MULTICAST_ENABLE
+	if (skb->pkt_type == PACKET_MULTICAST) {
+		DEBUG_TRACE("Multicast, ignoring: %p\n", skb);
+		return NF_ACCEPT;
+	}
+#endif
+
+#ifdef ECM_INTERFACE_PPP_ENABLE
+	/*
+	 * skip l2tp/pptp because we don't accelerate them
+	 */
+	if (ecm_interface_skip_l2tp_pptp(skb, out)) {
+		return NF_ACCEPT;
+	}
+#endif
+
+	/*
+	 * Identify interface from where this packet came
+	 */
+	in = dev_get_by_index(&init_net, skb->skb_iif);
+	if (unlikely(!in)) {
+		/*
+		 * Locally sourced packets are not processed in ECM.
+		 */
+		return NF_ACCEPT;
+	}
+
+	DEBUG_TRACE("Post routing process skb %p, out: %p (%s), in: %p (%s)\n", skb, out, out->name, in, in->name);
+	result = ecm_sfe_ipv4_ip_process((struct net_device *)out, in, NULL, NULL,
+							can_accel, true, false, skb);
+	dev_put(in);
+	return result;
+}
+
+/*
+ * ecm_sfe_ipv4_pppoe_bridge_process()
+ *	Called for PPPoE session packets that are going
+ *	out to one of the bridge physical interfaces.
+ */
+static unsigned int ecm_sfe_ipv4_pppoe_bridge_process(struct net_device *out,
+						     struct net_device *in,
+						     struct ethhdr *skb_eth_hdr,
+						     bool can_accel,
+						     struct sk_buff *skb)
+{
+	unsigned int result = NF_ACCEPT;
+	struct pppoe_hdr *ph = pppoe_hdr(skb);
+	uint16_t ppp_proto = *(uint16_t *)ph->tag;
+	uint32_t encap_header_len = 0;
+
+	ppp_proto = ntohs(ppp_proto);
+	if (ppp_proto != PPP_IP) {
+		return NF_ACCEPT;
+	}
+
+	encap_header_len = ecm_front_end_l2_encap_header_len(skb);
+	ecm_front_end_pull_l2_encap_header(skb, encap_header_len);
+	skb->protocol = htons(ETH_P_IP);
+
+	result = ecm_sfe_ipv4_ip_process(out, in, skb_eth_hdr->h_source,
+					 skb_eth_hdr->h_dest, can_accel,
+					 false, true, skb);
+
+	ecm_front_end_push_l2_encap_header(skb, encap_header_len);
+	skb->protocol = htons(ETH_P_PPP_SES);
+
+	return result;
+}
+
+/*
+ * ecm_sfe_ipv4_bridge_post_routing_hook()
+ *	Called for packets that are going out to one of the bridge physical interfaces.
+ *
+ * These may have come from another bridged interface or from a non-bridged interface.
+ * Conntrack information may be available or not if this skb is bridged.
+ */
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3,6,0))
+static unsigned int ecm_sfe_ipv4_bridge_post_routing_hook(unsigned int hooknum,
+					struct sk_buff *skb,
+					const struct net_device *in_unused,
+					const struct net_device *out,
+					int (*okfn)(struct sk_buff *))
+#else
+static unsigned int ecm_sfe_ipv4_bridge_post_routing_hook(const struct nf_hook_ops *ops,
+					struct sk_buff *skb,
+					const struct net_device *in_unused,
+					const struct net_device *out,
+					int (*okfn)(struct sk_buff *))
+#endif
+{
+	struct ethhdr *skb_eth_hdr;
+	uint16_t eth_type;
+	struct net_device *bridge;
+	struct net_device *in;
+	bool can_accel = true;
+	unsigned int result;
+
+	DEBUG_TRACE("%p: Bridge: %s\n", out, out->name);
+
+	/*
+	 * If operations have stopped then do not process packets
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	if (unlikely(ecm_sfe_ipv4_stopped)) {
+		spin_unlock_bh(&ecm_sfe_ipv4_lock);
+		DEBUG_TRACE("Front end stopped\n");
+		return NF_ACCEPT;
+	}
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	/*
+	 * Don't process broadcast or multicast
+	 */
+	if (skb->pkt_type == PACKET_BROADCAST) {
+		DEBUG_TRACE("Broadcast, ignoring: %p\n", skb);
+		return NF_ACCEPT;
+	}
+
+#ifndef ECM_MULTICAST_ENABLE
+	if (skb->pkt_type == PACKET_MULTICAST) {
+		DEBUG_TRACE("Multicast, ignoring: %p\n", skb);
+		return NF_ACCEPT;
+	}
+#endif
+
+#ifdef ECM_INTERFACE_PPP_ENABLE
+	/*
+	 * skip l2tp/pptp because we don't accelerate them
+	 */
+	if (ecm_interface_skip_l2tp_pptp(skb, out)) {
+		return NF_ACCEPT;
+	}
+#endif
+
+	/*
+	 * Check packet is an IP Ethernet packet
+	 */
+	skb_eth_hdr = eth_hdr(skb);
+	if (!skb_eth_hdr) {
+		DEBUG_TRACE("%p: Not Eth\n", skb);
+		return NF_ACCEPT;
+	}
+	eth_type = ntohs(skb_eth_hdr->h_proto);
+	if (unlikely((eth_type != 0x0800) && (eth_type != ETH_P_PPP_SES))) {
+		DEBUG_TRACE("%p: Not IP/PPPoE session\n", skb);
+		return NF_ACCEPT;
+	}
+
+	/*
+	 * Identify interface from where this packet came.
+	 * There are three scenarios to consider here:
+	 * 1. Packet came from a local source.
+	 *	Ignore - local is not handled.
+	 * 2. Packet came from a routed path.
+	 *	Ignore - it was handled in INET post routing.
+	 * 3. Packet is bridged from another port.
+	 *	Process.
+	 *
+	 * Begin by identifying case 1.
+	 * NOTE: We are given 'out' (which we implicitly know is a bridge port) so out interface's master is the 'bridge'.
+	 */
+	bridge = ecm_interface_get_and_hold_dev_master((struct net_device *)out);
+	DEBUG_ASSERT(bridge, "Expected bridge\n");
+	in = dev_get_by_index(&init_net, skb->skb_iif);
+	if  (!in) {
+		/*
+		 * Case 1.
+		 */
+		DEBUG_TRACE("Local traffic: %p, ignoring traffic to bridge: %p (%s) \n", skb, bridge, bridge->name);
+		dev_put(bridge);
+		return NF_ACCEPT;
+	}
+	dev_put(in);
+
+	/*
+	 * Case 2:
+	 *	For routed packets the skb will have the src mac matching the bridge mac.
+	 * Case 3:
+	 *	If the packet was not local (case 1) or routed (case 2) then we process.
+	 */
+	in = br_port_dev_get(bridge, skb_eth_hdr->h_source);
+	if (!in) {
+		DEBUG_TRACE("skb: %p, no in device for bridge: %p (%s)\n", skb, bridge, bridge->name);
+		dev_put(bridge);
+		return NF_ACCEPT;
+	}
+	if (in == out) {
+		DEBUG_TRACE("skb: %p, bridge: %p (%s), port bounce on %p (%s)\n", skb, bridge, bridge->name, out, out->name);
+		dev_put(in);
+		dev_put(bridge);
+		return NF_ACCEPT;
+	}
+	if (!ecm_mac_addr_equal(skb_eth_hdr->h_source, bridge->dev_addr)) {
+		/*
+		 * Case 2: Routed trafffic would be handled by the INET post routing.
+		 */
+		DEBUG_TRACE("skb: %p, Ignoring routed packet to bridge: %p (%s)\n", skb, bridge, bridge->name);
+		dev_put(in);
+		dev_put(bridge);
+		return NF_ACCEPT;
+	}
+
+	if (!is_multicast_ether_addr(skb_eth_hdr->h_dest)) {
+		/*
+		 * Process the packet, if we have this mac address in the fdb table.
+		 * TODO: For the kernel versions later than 3.6.x, the API needs vlan id.
+		 * 	 For now, we are passing 0, but this needs to be handled later.
+		 */
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3,6,0))
+		if (!br_fdb_has_entry((struct net_device *)out, skb_eth_hdr->h_dest)) {
+#else
+		if (!br_fdb_has_entry((struct net_device *)out, skb_eth_hdr->h_dest, 0)) {
+#endif
+			DEBUG_WARN("skb: %p, No fdb entry for this mac address %pM in the bridge: %p (%s)\n",
+					skb, skb_eth_hdr->h_dest, bridge, bridge->name);
+			dev_put(in);
+			dev_put(bridge);
+			return NF_ACCEPT;
+		}
+	}
+	DEBUG_TRACE("Bridge process skb: %p, bridge: %p (%s), In: %p (%s), Out: %p (%s)\n",
+			skb, bridge, bridge->name, in, in->name, out, out->name);
+
+	if (unlikely(eth_type != 0x0800)) {
+		result = ecm_sfe_ipv4_pppoe_bridge_process((struct net_device *)out, in, skb_eth_hdr, can_accel, skb);
+		dev_put(in);
+		dev_put(bridge);
+		return result;
+	}
+
+	result = ecm_sfe_ipv4_ip_process((struct net_device *)out, in,
+				skb_eth_hdr->h_source, skb_eth_hdr->h_dest, can_accel, false, false, skb);
+
+
+	dev_put(in);
+	dev_put(bridge);
+	return result;
+}
+
+/*
+ * ecm_sfe_ipv4_stats_sync_callback()
+ *	Callback handler from the sfe driver.
+ */
+static void ecm_sfe_ipv4_stats_sync_callback(void *app_data, struct sfe_ipv4_msg *nim)
+{
+	struct sfe_ipv4_conn_sync *sync;
+	struct nf_conntrack_tuple_hash *h;
+	struct nf_conntrack_tuple tuple;
+	struct nf_conn *ct;
+	struct nf_conn_counter *acct;
+	struct ecm_db_connection_instance *ci;
+	struct ecm_front_end_connection_instance *feci;
+	struct neighbour *neigh;
+	ip_addr_t flow_ip;
+	ip_addr_t return_ip_xlate;
+	ip_addr_t return_ip;
+	struct ecm_classifier_instance *assignments[ECM_CLASSIFIER_TYPES];
+	int aci_index;
+	int assignment_count;
+	struct ecm_classifier_rule_sync class_sync;
+
+	/*
+	 * Only respond to sync messages
+	 */
+	if (nim->cm.type != SFE_RX_CONN_STATS_SYNC_MSG) {
+		DEBUG_TRACE("Ignoring nim: %p - not sync: %d", nim, nim->cm.type);
+		return;
+	}
+	sync = &nim->msg.conn_stats;
+
+	/*
+	 * Look up ecm connection with a view to synchronising the connection, classifier and data tracker.
+	 * Note that we use _xlate versions for destination - for egressing connections this would be the wan IP address,
+	 * but for ingressing this would be the LAN side (non-nat'ed) address and is what we need for lookup of our connection.
+	 */
+	DEBUG_INFO("%p: SFE Sync, lookup connection using\n"
+			"Protocol: %d\n" \
+			"src_addr: %pI4n:%d\n" \
+			"dest_addr: %pI4n:%d\n",
+			sync,
+			(int)sync->protocol,
+			&sync->flow_ip, (int)sync->flow_ident,
+			&sync->return_ip_xlate, (int)sync->return_ident_xlate);
+
+	ECM_NIN4_ADDR_TO_IP_ADDR(flow_ip, sync->flow_ip);
+	ECM_NIN4_ADDR_TO_IP_ADDR(return_ip_xlate, sync->return_ip_xlate);
+	ECM_NIN4_ADDR_TO_IP_ADDR(return_ip, sync->return_ip);
+
+#ifdef ECM_MULTICAST_ENABLE
+	/*
+	 * Check for multicast flow
+	 */
+	if (ecm_ip_addr_is_multicast(return_ip)) {
+		ci = ecm_db_connection_find_and_ref(flow_ip, return_ip, sync->protocol, (int)ntohs(sync->flow_ident), (int)ntohs(sync->return_ident));
+	} else {
+		ci = ecm_db_connection_find_and_ref(flow_ip, return_ip_xlate, sync->protocol, (int)ntohs(sync->flow_ident), (int)ntohs(sync->return_ident_xlate));
+	}
+#else
+	ci = ecm_db_connection_find_and_ref(flow_ip, return_ip_xlate, sync->protocol, (int)ntohs(sync->flow_ident), (int)ntohs(sync->return_ident_xlate));
+#endif
+	if (!ci) {
+		DEBUG_TRACE("%p: SFE Sync: no connection\n", sync);
+		goto sync_conntrack;
+	}
+	DEBUG_TRACE("%p: Sync conn %p\n", sync, ci);
+
+	/*
+	 * Keep connection alive and updated
+	 */
+	if (!ecm_db_connection_defunct_timer_touch(ci)) {
+		ecm_db_connection_deref(ci);
+		goto sync_conntrack;
+	}
+
+	/*
+	 * Get the front end instance
+	 */
+	feci = ecm_db_connection_front_end_get_and_ref(ci);
+
+	if (sync->flow_tx_packet_count || sync->return_tx_packet_count) {
+		DEBUG_TRACE("%p: flow_rx_packet_count: %u, flow_rx_byte_count: %u, return_rx_packet_count: %u, return_rx_byte_count: %u\n",
+				ci, sync->flow_rx_packet_count, sync->flow_rx_byte_count, sync->return_rx_packet_count, sync->return_rx_byte_count);
+#ifdef ECM_MULTICAST_ENABLE
+		if (ecm_ip_addr_is_multicast(return_ip)) {
+			/*
+			 * The amount of data *sent* by the ECM multicast connection 'from' side is the amount the SFE has *received* in the 'flow' direction.
+			 */
+			ecm_db_multicast_connection_data_totals_update(ci, true, sync->flow_rx_byte_count, sync->flow_rx_packet_count);
+			ecm_db_multicast_connection_data_totals_update(ci, false, sync->return_rx_byte_count, sync->return_rx_packet_count);
+			ecm_db_multicast_connection_interface_heirarchy_stats_update(ci, sync->flow_rx_byte_count, sync->flow_rx_packet_count);
+
+			/*
+			 * As packets have been accelerated we have seen some action.
+			 */
+			feci->action_seen(feci);
+
+			/*
+			 * Update IP multicast routing cache stats
+			 */
+			ipmr_mfc_stats_update(&init_net, htonl(flow_ip[0]), htonl(return_ip[0]), sync->flow_rx_packet_count,
+										 sync->flow_rx_byte_count, sync->flow_rx_packet_count, sync->flow_rx_byte_count);
+		} else {
+			/*
+			 * The amount of data *sent* by the ECM connection 'from' side is the amount the SFE has *received* in the 'flow' direction.
+			 */
+			ecm_db_connection_data_totals_update(ci, true, sync->flow_rx_byte_count, sync->flow_rx_packet_count);
+
+			/*
+			 * The amount of data *sent* by the ECM connection 'to' side is the amount the SFE has *received* in the 'return' direction.
+			 */
+			ecm_db_connection_data_totals_update(ci, false, sync->return_rx_byte_count, sync->return_rx_packet_count);
+
+			/*
+			 * As packets have been accelerated we have seen some action.
+			 */
+			feci->action_seen(feci);
+
+		}
+
+#else
+		/*
+		 * The amount of data *sent* by the ECM connection 'from' side is the amount the SFE has *received* in the 'flow' direction.
+		 */
+		ecm_db_connection_data_totals_update(ci, true, sync->flow_rx_byte_count, sync->flow_rx_packet_count);
+
+		/*
+		 * The amount of data *sent* by the ECM connection 'to' side is the amount the SFE has *received* in the 'return' direction.
+		 */
+		ecm_db_connection_data_totals_update(ci, false, sync->return_rx_byte_count, sync->return_rx_packet_count);
+
+		/*
+		 * As packets have been accelerated we have seen some action.
+		 */
+		feci->action_seen(feci);
+
+#endif
+	}
+
+	/*
+	 * Copy the sync data to the classifier sync structure to
+	 * update the classifiers' stats.
+	 */
+	class_sync.flow_tx_packet_count = sync->flow_tx_packet_count;
+	class_sync.return_tx_packet_count = sync->return_tx_packet_count;
+	class_sync.reason = sync->reason;
+
+	/*
+	 * Sync assigned classifiers
+	 */
+	assignment_count = ecm_db_connection_classifier_assignments_get_and_ref(ci, assignments);
+	for (aci_index = 0; aci_index < assignment_count; ++aci_index) {
+		struct ecm_classifier_instance *aci;
+		aci = assignments[aci_index];
+		DEBUG_TRACE("%p: sync to: %p, type: %d\n", feci, aci, aci->type_get(aci));
+		aci->sync_to_v4(aci, &class_sync);
+	}
+	ecm_db_connection_assignments_release(assignment_count, assignments);
+
+	switch(sync->reason) {
+	case SFE_RULE_SYNC_REASON_DESTROY:
+		/*
+		 * This is the final sync from the SFE for a connection whose acceleration was
+		 * terminated by the ecm.
+		 * NOTE: We take no action here since that is performed by the destroy message ack.
+		 */
+		DEBUG_INFO("%p: ECM initiated final sync seen: %d\n", ci, sync->reason);
+		break;
+	case SFE_RULE_SYNC_REASON_FLUSH:
+	case SFE_RULE_SYNC_REASON_EVICT:
+		/*
+		 * SFE has ended acceleration without instruction from the ECM.
+		 */
+		DEBUG_INFO("%p: SFE Initiated final sync seen: %d cause:%d\n", ci, sync->reason, sync->cause);
+
+		/*
+		 * SFE Decelerated the connection
+		 */
+		feci->accel_ceased(feci);
+		break;
+	default:
+
+		/*
+		 * Update the neighbour entry for source IP address
+		 */
+		neigh = ecm_interface_ipv4_neigh_get(flow_ip);
+		if (!neigh) {
+			DEBUG_WARN("Neighbour entry for %pI4n not found\n", &sync->flow_ip);
+		} else {
+			DEBUG_TRACE("Neighbour entry for %pI4n update: %p\n", &sync->flow_ip, neigh);
+			neigh_update(neigh, NULL, neigh->nud_state, NEIGH_UPDATE_F_WEAK_OVERRIDE);
+			neigh_release(neigh);
+		}
+
+#ifdef ECM_MULTICAST_ENABLE
+		/*
+		 * Update the neighbour entry for destination IP address
+		 */
+		if (!ecm_ip_addr_is_multicast(return_ip)) {
+			neigh = ecm_interface_ipv4_neigh_get(return_ip);
+			if (!neigh) {
+				DEBUG_WARN("Neighbour entry for %pI4n not found\n", &sync->return_ip);
+			} else {
+				DEBUG_TRACE("Neighbour entry for %pI4n update: %p\n", &sync->return_ip, neigh);
+				neigh_update(neigh, NULL, neigh->nud_state, NEIGH_UPDATE_F_WEAK_OVERRIDE);
+				neigh_release(neigh);
+			}
+		}
+#else
+		/*
+		 * Update the neighbour entry for destination IP address
+		 */
+		neigh = ecm_interface_ipv4_neigh_get(return_ip);
+		if (!neigh) {
+			DEBUG_WARN("Neighbour entry for %pI4n not found\n", &sync->return_ip);
+		} else {
+			DEBUG_TRACE("Neighbour entry for %pI4n update: %p\n", &sync->return_ip, neigh);
+			neigh_update(neigh, NULL, neigh->nud_state, NEIGH_UPDATE_F_WEAK_OVERRIDE);
+			neigh_release(neigh);
+		}
+#endif
+	}
+
+	/*
+	 * If connection should be re-generated then we need to force a deceleration
+	 */
+	if (unlikely(ecm_db_connection_regeneration_required_peek(ci))) {
+		DEBUG_TRACE("%p: Connection generation changing, terminating acceleration", ci);
+		feci->decelerate(feci);
+	}
+
+	feci->deref(feci);
+	ecm_db_connection_deref(ci);
+
+sync_conntrack:
+	;
+
+	/*
+	 * Create a tuple so as to be able to look up a conntrack connection
+	 */
+	memset(&tuple, 0, sizeof(tuple));
+	tuple.src.u3.ip = sync->flow_ip;
+	tuple.src.u.all = sync->flow_ident;
+	tuple.src.l3num = AF_INET;
+
+	tuple.dst.u3.ip = sync->return_ip;
+	tuple.dst.dir = IP_CT_DIR_ORIGINAL;
+	tuple.dst.protonum = (uint8_t)sync->protocol;
+	tuple.dst.u.all = sync->return_ident;
+
+	DEBUG_TRACE("Conntrack sync, lookup conntrack connection using\n"
+			"Protocol: %d\n"
+			"src_addr: %pI4:%d\n"
+			"dest_addr: %pI4:%d\n",
+			(int)tuple.dst.protonum,
+			&tuple.src.u3.ip, (int)tuple.src.u.all,
+			&tuple.dst.u3.ip, (int)tuple.dst.u.all);
+
+	/*
+	 * Look up conntrack connection
+	 */
+	h = nf_conntrack_find_get(&init_net, NF_CT_DEFAULT_ZONE, &tuple);
+	if (!h) {
+		DEBUG_WARN("%p: SFE Sync: no conntrack connection\n", sync);
+		return;
+	}
+
+	ct = nf_ct_tuplehash_to_ctrack(h);
+	NF_CT_ASSERT(ct->timeout.data == (unsigned long)ct);
+	DEBUG_TRACE("%p: SFE Sync: conntrack connection\n", ct);
+
+	/*
+	 * Only update if this is not a fixed timeout
+	 */
+	if (!test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status)) {
+		unsigned long int delta_jiffies;
+
+		/*
+		 * Convert ms ticks from the SFE to jiffies.  We know that inc_ticks is small
+		 * and we expect HZ to be small too so we can multiply without worrying about
+		 * wrap-around problems.  We add a rounding constant to ensure that the different
+		 * time bases don't cause truncation errors.
+		 */
+		DEBUG_ASSERT(HZ <= 100000, "Bad HZ\n");
+		delta_jiffies = ((sync->inc_ticks * HZ) + (MSEC_PER_SEC / 2)) / MSEC_PER_SEC;
+
+		spin_lock_bh(&ct->lock);
+		ct->timeout.expires += delta_jiffies;
+		spin_unlock_bh(&ct->lock);
+	}
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3,6,0))
+	acct = nf_conn_acct_find(ct);
+#else
+	acct = nf_conn_acct_find(ct)->counter;
+#endif
+	if (acct) {
+		spin_lock_bh(&ct->lock);
+		atomic64_add(sync->flow_rx_packet_count, &acct[IP_CT_DIR_ORIGINAL].packets);
+		atomic64_add(sync->flow_rx_byte_count, &acct[IP_CT_DIR_ORIGINAL].bytes);
+
+		atomic64_add(sync->return_rx_packet_count, &acct[IP_CT_DIR_REPLY].packets);
+		atomic64_add(sync->return_rx_byte_count, &acct[IP_CT_DIR_REPLY].bytes);
+		spin_unlock_bh(&ct->lock);
+	}
+
+	switch (sync->protocol) {
+	case IPPROTO_TCP:
+		spin_lock_bh(&ct->lock);
+		if (ct->proto.tcp.seen[0].td_maxwin < sync->flow_max_window) {
+			ct->proto.tcp.seen[0].td_maxwin = sync->flow_max_window;
+		}
+		if ((int32_t)(ct->proto.tcp.seen[0].td_end - sync->flow_end) < 0) {
+			ct->proto.tcp.seen[0].td_end = sync->flow_end;
+		}
+		if ((int32_t)(ct->proto.tcp.seen[0].td_maxend - sync->flow_max_end) < 0) {
+			ct->proto.tcp.seen[0].td_maxend = sync->flow_max_end;
+		}
+		if (ct->proto.tcp.seen[1].td_maxwin < sync->return_max_window) {
+			ct->proto.tcp.seen[1].td_maxwin = sync->return_max_window;
+		}
+		if ((int32_t)(ct->proto.tcp.seen[1].td_end - sync->return_end) < 0) {
+			ct->proto.tcp.seen[1].td_end = sync->return_end;
+		}
+		if ((int32_t)(ct->proto.tcp.seen[1].td_maxend - sync->return_max_end) < 0) {
+			ct->proto.tcp.seen[1].td_maxend = sync->return_max_end;
+		}
+		spin_unlock_bh(&ct->lock);
+		break;
+	}
+
+	/*
+	 * Release connection
+	 */
+	nf_ct_put(ct);
+}
+
+/*
+ * struct nf_hook_ops ecm_sfe_ipv4_netfilter_hooks[]
+ *	Hooks into netfilter packet monitoring points.
+ */
+static struct nf_hook_ops ecm_sfe_ipv4_netfilter_hooks[] __read_mostly = {
+	/*
+	 * Post routing hook is used to monitor packets going to interfaces that are NOT bridged in some way, e.g. packets to the WAN.
+	 */
+	{
+		.hook           = ecm_sfe_ipv4_post_routing_hook,
+		.owner          = THIS_MODULE,
+		.pf             = PF_INET,
+		.hooknum        = NF_INET_POST_ROUTING,
+		.priority       = NF_IP_PRI_NAT_SRC + 1,
+	},
+
+	/*
+	 * The bridge post routing hook monitors packets going to interfaces that are part of a bridge arrangement.
+	 * For example Wireles LAN (WLAN) and Wired LAN (LAN).
+	 */
+	{
+		.hook		= ecm_sfe_ipv4_bridge_post_routing_hook,
+		.owner		= THIS_MODULE,
+		.pf		= PF_BRIDGE,
+		.hooknum	= NF_BR_POST_ROUTING,
+		.priority	= NF_BR_PRI_FILTER_OTHER,
+	},
+};
+
+/*
+ * ecm_sfe_ipv4_connection_from_ct_get_and_ref()
+ *	Return, if any, a connection given a ct
+ */
+static struct ecm_db_connection_instance *ecm_sfe_ipv4_connection_from_ct_get_and_ref(struct nf_conn *ct)
+{
+	struct nf_conntrack_tuple orig_tuple;
+	struct nf_conntrack_tuple reply_tuple;
+	ip_addr_t host1_addr;
+	ip_addr_t host2_addr;
+	int host1_port;
+	int host2_port;
+	int protocol;
+
+	/*
+	 * Look up the associated connection for this conntrack connection
+	 */
+	orig_tuple = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+	reply_tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+	ECM_NIN4_ADDR_TO_IP_ADDR(host1_addr, orig_tuple.src.u3.ip);
+	ECM_NIN4_ADDR_TO_IP_ADDR(host2_addr, reply_tuple.src.u3.ip);
+	protocol = orig_tuple.dst.protonum;
+	if (protocol == IPPROTO_TCP) {
+		host1_port = ntohs(orig_tuple.src.u.tcp.port);
+		host2_port = ntohs(reply_tuple.src.u.tcp.port);
+	} else if (protocol == IPPROTO_UDP) {
+		host1_port = ntohs(orig_tuple.src.u.udp.port);
+		host2_port = ntohs(reply_tuple.src.u.udp.port);
+	} else if ((protocol == IPPROTO_IPV6) || (protocol == IPPROTO_ESP)) {
+		host1_port = 0;
+		host2_port = 0;
+	} else {
+		host1_port = -protocol;
+		host2_port = -protocol;
+	}
+
+	DEBUG_TRACE("%p: lookup src: " ECM_IP_ADDR_DOT_FMT ":%d, "
+		    "dest: " ECM_IP_ADDR_DOT_FMT ":%d, "
+		    "protocol %d\n",
+		    ct,
+		    ECM_IP_ADDR_TO_DOT(host1_addr),
+		    host1_port,
+		    ECM_IP_ADDR_TO_DOT(host2_addr),
+		    host2_port,
+		    protocol);
+
+	return ecm_db_connection_find_and_ref(host1_addr,
+					      host2_addr,
+					      protocol,
+					      host1_port,
+					      host2_port);
+}
+
+/*
+ * ecm_sfe_ipv4_conntrack_event_destroy()
+ *	Handles conntrack destroy events
+ */
+static void ecm_sfe_ipv4_conntrack_event_destroy(struct nf_conn *ct)
+{
+	struct ecm_db_connection_instance *ci;
+	struct ecm_front_end_connection_instance *feci;
+
+	DEBUG_INFO("Destroy event for ct: %p\n", ct);
+
+	ci = ecm_sfe_ipv4_connection_from_ct_get_and_ref(ct);
+	if (!ci) {
+		DEBUG_TRACE("%p: not found\n", ct);
+		return;
+	}
+	DEBUG_INFO("%p: Connection defunct %p\n", ct, ci);
+
+	/*
+	 * If this connection is accelerated then we need to issue a destroy command
+	 */
+	feci = ecm_db_connection_front_end_get_and_ref(ci);
+	feci->decelerate(feci);
+	feci->deref(feci);
+
+	/*
+	 * Force destruction of the connection my making it defunct
+	 */
+	ecm_db_connection_make_defunct(ci);
+	ecm_db_connection_deref(ci);
+}
+
+/*
+ * ecm_sfe_ipv4_conntrack_event_mark()
+ *	Handles conntrack mark events
+ */
+static void ecm_sfe_ipv4_conntrack_event_mark(struct nf_conn *ct)
+{
+	struct ecm_db_connection_instance *ci;
+	struct ecm_classifier_instance *__attribute__((unused))cls;
+
+	DEBUG_INFO("Mark event for ct: %p\n", ct);
+
+	/*
+	 * Ignore transitions to zero
+	 */
+	if (ct->mark == 0) {
+		return;
+	}
+
+	ci = ecm_sfe_ipv4_connection_from_ct_get_and_ref(ct);
+	if (!ci) {
+		DEBUG_TRACE("%p: not found\n", ct);
+		return;
+	}
+
+#ifdef ECM_CLASSIFIER_NL_ENABLE
+	/*
+	 * As of now, only the Netlink classifier is interested in conmark changes
+	 * GGG TODO Add a classifier method to propagate this information to any and all types of classifier.
+	 */
+	cls = ecm_db_connection_assigned_classifier_find_and_ref(ci, ECM_CLASSIFIER_TYPE_NL);
+	if (cls) {
+		ecm_classifier_nl_process_mark((struct ecm_classifier_nl_instance *)cls, ct->mark);
+		cls->deref(cls);
+	}
+#endif
+
+	/*
+	 * All done
+	 */
+	ecm_db_connection_deref(ci);
+}
+
+/*
+ * ecm_sfe_ipv4_conntrack_event()
+ *	Callback event invoked when conntrack connection state changes, currently we handle destroy events to quickly release state
+ */
+int ecm_sfe_ipv4_conntrack_event(unsigned long events, struct nf_conn *ct)
+{
+	/*
+	 * If operations have stopped then do not process event
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	if (unlikely(ecm_sfe_ipv4_stopped)) {
+		DEBUG_WARN("Ignoring event - stopped\n");
+		spin_unlock_bh(&ecm_sfe_ipv4_lock);
+		return NOTIFY_DONE;
+	}
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	if (!ct) {
+		DEBUG_WARN("Error: no ct\n");
+		return NOTIFY_DONE;
+	}
+
+	/*
+	 * handle destroy events
+	 */
+	if (events & (1 << IPCT_DESTROY)) {
+		DEBUG_TRACE("%p: Event is destroy\n", ct);
+		ecm_sfe_ipv4_conntrack_event_destroy(ct);
+	}
+
+	/*
+	 * handle mark change events
+	 */
+	if (events & (1 << IPCT_MARK)) {
+		DEBUG_TRACE("%p: Event is mark\n", ct);
+		ecm_sfe_ipv4_conntrack_event_mark(ct);
+	}
+
+	return NOTIFY_DONE;
+}
+EXPORT_SYMBOL(ecm_sfe_ipv4_conntrack_event);
+
+void ecm_sfe_ipv4_stop(int num)
+{
+	ecm_sfe_ipv4_stopped = num;
+}
+EXPORT_SYMBOL(ecm_sfe_ipv4_stop);
+
+/*
+ * ecm_sfe_ipv4_get_accel_limit_mode()
+ */
+static int ecm_sfe_ipv4_get_accel_limit_mode(void *data, u64 *val)
+{
+	*val = ecm_sfe_ipv4_accel_limit_mode;
+
+	return 0;
+}
+
+/*
+ * ecm_sfe_ipv4_set_accel_limit_mode()
+ */
+static int ecm_sfe_ipv4_set_accel_limit_mode(void *data, u64 val)
+{
+	DEBUG_TRACE("ecm_sfe_ipv4_accel_limit_mode = %x\n", (int)val);
+
+	/*
+	 * Check that only valid bits are set.
+	 * It's fine for no bits to be set as that suggests no modes are wanted.
+	 */
+	if (val && (val ^ (ECM_FRONT_END_ACCEL_LIMIT_MODE_FIXED | ECM_FRONT_END_ACCEL_LIMIT_MODE_UNLIMITED))) {
+		DEBUG_WARN("ecm_sfe_ipv4_accel_limit_mode = %x bad\n", (int)val);
+		return -EINVAL;
+	}
+
+	ecm_sfe_ipv4_accel_limit_mode = (int)val;
+
+	return 0;
+}
+
+/*
+ * Debugfs attribute for accel limit mode.
+ */
+DEFINE_SIMPLE_ATTRIBUTE(ecm_sfe_ipv4_accel_limit_mode_fops, ecm_sfe_ipv4_get_accel_limit_mode, ecm_sfe_ipv4_set_accel_limit_mode, "%llu\n");
+
+/*
+ * ecm_sfe_ipv4_get_accel_cmd_avg_millis()
+ */
+static ssize_t ecm_sfe_ipv4_get_accel_cmd_avg_millis(struct file *file,
+								char __user *user_buf,
+								size_t sz, loff_t *ppos)
+{
+	unsigned long set;
+	unsigned long samples;
+	unsigned long avg;
+	char *buf;
+	int ret;
+
+	buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+	if (!buf) {
+		return -ENOMEM;
+	}
+
+	/*
+	 * Operate under our locks.
+	 * Compute the average of the samples taken and seed the next set of samples with the result of this one.
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	samples = ecm_sfe_ipv4_accel_cmd_time_avg_samples;
+	set = ecm_sfe_ipv4_accel_cmd_time_avg_set;
+	ecm_sfe_ipv4_accel_cmd_time_avg_samples /= ecm_sfe_ipv4_accel_cmd_time_avg_set;
+	ecm_sfe_ipv4_accel_cmd_time_avg_set = 1;
+	avg = ecm_sfe_ipv4_accel_cmd_time_avg_samples;
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	/*
+	 * Convert average jiffies to milliseconds
+	 */
+	avg *= 1000;
+	avg /= HZ;
+
+	ret = snprintf(buf, (ssize_t)PAGE_SIZE, "avg=%lu\tsamples=%lu\tset_size=%lu\n", avg, samples, set);
+	if (ret < 0) {
+		kfree(buf);
+		return -EFAULT;
+	}
+
+	ret = simple_read_from_buffer(user_buf, sz, ppos, buf, ret);
+	kfree(buf);
+	return ret;
+}
+
+/*
+ * File operations for accel command average time.
+ */
+static struct file_operations ecm_sfe_ipv4_accel_cmd_avg_millis_fops = {
+	.read = ecm_sfe_ipv4_get_accel_cmd_avg_millis,
+};
+
+/*
+ * ecm_sfe_ipv4_get_decel_average_millis()
+ */
+static ssize_t ecm_sfe_ipv4_get_decel_cmd_avg_millis(struct file *file,
+								char __user *user_buf,
+								size_t sz, loff_t *ppos)
+{
+	unsigned long set;
+	unsigned long samples;
+	unsigned long avg;
+	char *buf;
+	int ret;
+
+	buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+	if (!buf) {
+		return -ENOMEM;
+	}
+
+	/*
+	 * Operate under our locks.
+	 * Compute the average of the samples taken and seed the next set of samples with the result of this one.
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	samples = ecm_sfe_ipv4_decel_cmd_time_avg_samples;
+	set = ecm_sfe_ipv4_decel_cmd_time_avg_set;
+	ecm_sfe_ipv4_decel_cmd_time_avg_samples /= ecm_sfe_ipv4_decel_cmd_time_avg_set;
+	ecm_sfe_ipv4_decel_cmd_time_avg_set = 1;
+	avg = ecm_sfe_ipv4_decel_cmd_time_avg_samples;
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	/*
+	 * Convert average jiffies to milliseconds
+	 */
+	avg *= 1000;
+	avg /= HZ;
+
+	ret = snprintf(buf, (ssize_t)PAGE_SIZE, "avg=%lu\tsamples=%lu\tset_size=%lu\n", avg, samples, set);
+	if (ret < 0) {
+		kfree(buf);
+		return -EFAULT;
+	}
+
+	ret = simple_read_from_buffer(user_buf, sz, ppos, buf, ret);
+	kfree(buf);
+	return ret;
+}
+
+/*
+ * File operations for decel command average time.
+ */
+static struct file_operations ecm_sfe_ipv4_decel_cmd_avg_millis_fops = {
+	.read = ecm_sfe_ipv4_get_decel_cmd_avg_millis,
+};
+
+/*
+ * ecm_sfe_ipv4_init()
+ */
+int ecm_sfe_ipv4_init(struct dentry *dentry)
+{
+	int result = -1;
+
+	DEBUG_INFO("ECM SFE IPv4 init\n");
+
+	ecm_sfe_ipv4_dentry = debugfs_create_dir("ecm_sfe_ipv4", dentry);
+	if (!ecm_sfe_ipv4_dentry) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv4 directory in debugfs\n");
+		return result;
+	}
+
+	if (!debugfs_create_u32("stop", S_IRUGO | S_IWUSR, ecm_sfe_ipv4_dentry,
+					(u32 *)&ecm_sfe_ipv4_stopped)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv4 stop file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_u32("no_action_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv4_dentry,
+					(u32 *)&ecm_sfe_ipv4_no_action_limit_default)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv4 no_action_limit_default file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_u32("driver_fail_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv4_dentry,
+					(u32 *)&ecm_sfe_ipv4_driver_fail_limit_default)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv4 driver_fail_limit_default file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_u32("nack_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv4_dentry,
+					(u32 *)&ecm_sfe_ipv4_nack_limit_default)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv4 nack_limit_default file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_u32("accelerated_count", S_IRUGO, ecm_sfe_ipv4_dentry,
+					(u32 *)&ecm_sfe_ipv4_accelerated_count)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv4 accelerated_count file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_u32("pending_accel_count", S_IRUGO, ecm_sfe_ipv4_dentry,
+					(u32 *)&ecm_sfe_ipv4_pending_accel_count)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv4 pending_accel_count file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_u32("pending_decel_count", S_IRUGO, ecm_sfe_ipv4_dentry,
+					(u32 *)&ecm_sfe_ipv4_pending_decel_count)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv4 pending_decel_count file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_file("accel_limit_mode", S_IRUGO | S_IWUSR, ecm_sfe_ipv4_dentry,
+					NULL, &ecm_sfe_ipv4_accel_limit_mode_fops)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv4 accel_limit_mode file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_file("accel_cmd_avg_millis", S_IRUGO, ecm_sfe_ipv4_dentry,
+					NULL, &ecm_sfe_ipv4_accel_cmd_avg_millis_fops)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv4 accel_cmd_avg_millis file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_file("decel_cmd_avg_millis", S_IRUGO, ecm_sfe_ipv4_dentry,
+					NULL, &ecm_sfe_ipv4_decel_cmd_avg_millis_fops)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv4 decel_cmd_avg_millis file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!ecm_sfe_ported_ipv4_debugfs_init(ecm_sfe_ipv4_dentry)) {
+		DEBUG_ERROR("Failed to create ecm ported files in debugfs\n");
+		goto task_cleanup;
+	}
+
+#ifdef ECM_NON_PORTED_SUPPORT_ENABLE
+	if (!ecm_sfe_non_ported_ipv4_debugfs_init(ecm_sfe_ipv4_dentry)) {
+		DEBUG_ERROR("Failed to create ecm non-ported files in debugfs\n");
+		goto task_cleanup;
+	}
+#endif
+
+#ifdef ECM_MULTICAST_ENABLE
+	if (!ecm_sfe_multicast_ipv4_debugfs_init(ecm_sfe_ipv4_dentry)) {
+		DEBUG_ERROR("Failed to create ecm multicast files in debugfs\n");
+		goto task_cleanup;
+	}
+#endif
+
+	/*
+	 * Register netfilter hooks
+	 */
+	result = nf_register_hooks(ecm_sfe_ipv4_netfilter_hooks, ARRAY_SIZE(ecm_sfe_ipv4_netfilter_hooks));
+	if (result < 0) {
+		DEBUG_ERROR("Can't register netfilter hooks.\n");
+		goto task_cleanup;
+	}
+
+#ifdef ECM_MULTICAST_ENABLE
+	ecm_sfe_multicast_ipv4_init();
+#endif
+
+	/*
+	 * Register this module with the simulated sfe driver
+	 */
+	ecm_sfe_ipv4_drv_mgr = sfe_drv_ipv4_notify_register(ecm_sfe_ipv4_stats_sync_callback, NULL);
+
+	return 0;
+
+task_cleanup:
+
+	debugfs_remove_recursive(ecm_sfe_ipv4_dentry);
+	return result;
+}
+EXPORT_SYMBOL(ecm_sfe_ipv4_init);
+
+/*
+ * ecm_sfe_ipv4_exit()
+ */
+void ecm_sfe_ipv4_exit(void)
+{
+	DEBUG_INFO("ECM SFE IPv4 Module exit\n");
+
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	ecm_sfe_ipv4_terminate_pending = true;
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	/*
+	 * Stop the network stack hooks
+	 */
+	nf_unregister_hooks(ecm_sfe_ipv4_netfilter_hooks,
+			    ARRAY_SIZE(ecm_sfe_ipv4_netfilter_hooks));
+
+	/*
+	 * Unregister from the simulated sfe driver
+	 */
+	sfe_drv_ipv4_notify_unregister();
+
+	/*
+	 * Remove the debugfs files recursively.
+	 */
+	if (ecm_sfe_ipv4_dentry) {
+		debugfs_remove_recursive(ecm_sfe_ipv4_dentry);
+	}
+
+#ifdef ECM_MULTICAST_ENABLE
+	ecm_sfe_multicast_ipv4_exit();
+#endif
+}
+EXPORT_SYMBOL(ecm_sfe_ipv4_exit);
diff --git a/frontends/sfe/ecm_sfe_ipv4.h b/frontends/sfe/ecm_sfe_ipv4.h
new file mode 100644
index 0000000..54e1259
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_ipv4.h
@@ -0,0 +1,182 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015 The Linux Foundation.  All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+#include <sfe_drv.h>
+
+extern int ecm_sfe_ipv4_no_action_limit_default;		/* Default no-action limit. */
+extern int ecm_sfe_ipv4_driver_fail_limit_default;		/* Default driver fail limit. */
+extern int ecm_sfe_ipv4_nack_limit_default;			/* Default nack limit. */
+extern int ecm_sfe_ipv4_accelerated_count;			/* Total offloads */
+extern int ecm_sfe_ipv4_pending_accel_count;			/* Total pending offloads issued to the SFE / awaiting completion */
+extern int ecm_sfe_ipv4_pending_decel_count;			/* Total pending deceleration requests issued to the SFE / awaiting completion */
+
+/*
+ * Limiting the acceleration of connections.
+ *
+ * By default there is no acceleration limiting.
+ * This means that when ECM has more connections (that can be accelerated) than the acceleration
+ * engine will allow the ECM will continue to try to accelerate.
+ * In this scenario the acceleration engine will begin removal of existing rules to make way for new ones.
+ * When the accel_limit_mode is set to FIXED ECM will not permit more rules to be issued than the engine will allow.
+ */
+extern uint32_t ecm_sfe_ipv4_accel_limit_mode;
+
+/*
+ * Locking of the classifier - concurrency control for file global parameters.
+ * NOTE: It is safe to take this lock WHILE HOLDING a feci->lock.  The reverse is NOT SAFE.
+ */
+extern spinlock_t ecm_sfe_ipv4_lock;			/* Protect against SMP access between netfilter, events and private threaded function. */
+
+/*
+ * Management thread control
+ */
+extern bool ecm_sfe_ipv4_terminate_pending;		/* True when the user has signalled we should quit */
+
+/*
+ * sfe driver linkage
+ */
+extern struct sfe_drv_ctx_instance *ecm_sfe_ipv4_drv_mgr;
+
+/*
+ * ecm_sfe_ipv4_accel_pending_set()
+ *	Set pending acceleration for the connection object.
+ *
+ * Return false if the acceleration is not permitted or is already in progress.
+ */
+static inline bool ecm_sfe_ipv4_accel_pending_set(struct ecm_front_end_connection_instance *feci)
+{
+	DEBUG_INFO("%p: Accel conn: %p\n", feci, feci->ci);
+
+	/*
+	 * If re-generation is required then we cannot permit acceleration
+	 */
+	if (ecm_db_connection_regeneration_required_peek(feci->ci)) {
+		DEBUG_TRACE("%p: accel %p failed - regen required\n", feci, feci->ci);
+		return false;
+	}
+
+	/*
+	 * Is connection acceleration permanently failed?
+	 */
+	spin_lock_bh(&feci->lock);
+	if (ECM_FRONT_END_ACCELERATION_FAILED(feci->accel_mode)) {
+		spin_unlock_bh(&feci->lock);
+		DEBUG_TRACE("%p: accel %p failed\n", feci, feci->ci);
+		return false;
+	}
+
+	/*
+	 * If acceleration mode is anything other than "not accelerated" then ignore.
+	 */
+	if (feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_DECEL) {
+		spin_unlock_bh(&feci->lock);
+		DEBUG_TRACE("%p: Ignoring wrong mode accel for conn: %p\n", feci, feci->ci);
+		return false;
+	}
+
+	/*
+	 * Do we have a fixed upper limit for acceleration?
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	if (ecm_sfe_ipv4_accel_limit_mode & ECM_FRONT_END_ACCEL_LIMIT_MODE_FIXED) {
+		if ((ecm_sfe_ipv4_pending_accel_count + ecm_sfe_ipv4_accelerated_count) >= sfe_drv_ipv4_max_conn_count()) {
+			spin_unlock_bh(&ecm_sfe_ipv4_lock);
+			spin_unlock_bh(&feci->lock);
+			DEBUG_INFO("%p: Accel limit reached, accel denied: %p\n", feci, feci->ci);
+			return false;
+		}
+	}
+
+	/*
+	 * Okay to accelerate
+	 */
+	ecm_sfe_ipv4_pending_accel_count++;
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	/*
+	 * Okay connection can be set to pending acceleration
+	 */
+	feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING;
+	spin_unlock_bh(&feci->lock);
+	return true;
+}
+
+/*
+ * _ecm_sfe_ipv4_accel_pending_clear()
+ *	Clear pending acceleration for the connection object, setting it to the desired state.
+ *
+ * Returns true if "decelerate was pending".
+ *
+ * The feci->lock AND ecm_sfe_ipv4_lock must be held on entry.
+ */
+static inline bool _ecm_sfe_ipv4_accel_pending_clear(struct ecm_front_end_connection_instance *feci, ecm_front_end_acceleration_mode_t mode)
+{
+	bool decel_pending;
+
+	/*
+	 * Set the mode away from its accel pending state.
+	 */
+	DEBUG_ASSERT(feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING, "%p: Accel mode unexpected: %d\n", feci, feci->accel_mode);
+	feci->accel_mode = mode;
+
+	/*
+	 * Clear decelerate pending flag.
+	 * This flag is only set when we are ACCEL_PENDING -
+	 * and we are moving from that to the given mode anyway.
+	 */
+	decel_pending = feci->stats.decelerate_pending;
+	feci->stats.decelerate_pending = false;
+
+	/*
+	 * Decrement pending counter
+	 */
+	ecm_sfe_ipv4_pending_accel_count--;
+	DEBUG_ASSERT(ecm_sfe_ipv4_pending_accel_count >= 0, "Accel pending underflow\n");
+	return decel_pending;
+}
+
+/*
+ * ecm_sfe_ipv4_accel_pending_clear()
+ *	Clear pending acceleration for the connection object, setting it to the desired state.
+ */
+static inline bool ecm_sfe_ipv4_accel_pending_clear(struct ecm_front_end_connection_instance *feci, ecm_front_end_acceleration_mode_t mode)
+{
+	bool decel_pending;
+	spin_lock_bh(&feci->lock);
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	decel_pending = _ecm_sfe_ipv4_accel_pending_clear(feci, mode);
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+	spin_unlock_bh(&feci->lock);
+	return decel_pending;
+}
+
+extern int ecm_sfe_ipv4_conntrack_event(unsigned long events, struct nf_conn *ct);
+extern void ecm_sfe_ipv4_accel_done_time_update(struct ecm_front_end_connection_instance *feci);
+extern void ecm_sfe_ipv4_decel_done_time_update(struct ecm_front_end_connection_instance *feci);
+extern struct ecm_classifier_instance *ecm_sfe_ipv4_assign_classifier(struct ecm_db_connection_instance *ci, ecm_classifier_type_t type);
+extern bool ecm_sfe_ipv4_reclassify(struct ecm_db_connection_instance *ci, int assignment_count, struct ecm_classifier_instance *assignments[]);
+extern void ecm_sfe_ipv4_connection_regenerate(struct ecm_db_connection_instance *ci, ecm_tracker_sender_type_t sender,
+							struct net_device *out_dev, struct net_device *out_dev_nat,
+							struct net_device *in_dev, struct net_device *in_dev_nat);
+extern struct ecm_db_node_instance *ecm_sfe_ipv4_node_establish_and_ref(struct ecm_front_end_connection_instance *feci,
+							struct net_device *dev, ip_addr_t addr,
+							struct ecm_db_iface_instance *interface_list[], int32_t interface_list_first,
+							uint8_t *given_node_addr);
+extern struct ecm_db_host_instance *ecm_sfe_ipv4_host_establish_and_ref(ip_addr_t addr);
+extern struct ecm_db_mapping_instance *ecm_sfe_ipv4_mapping_establish_and_ref(ip_addr_t addr, int port);
+extern int ecm_sfe_ipv4_init(struct dentry *dentry);
+extern void ecm_sfe_ipv4_stop(int);
+extern void ecm_sfe_ipv4_exit(void);
diff --git a/frontends/sfe/ecm_sfe_ipv6.c b/frontends/sfe/ecm_sfe_ipv6.c
new file mode 100644
index 0000000..5d2cf17
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_ipv6.c
@@ -0,0 +1,2079 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015 The Linux Foundation.  All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+#include <linux/version.h>
+#include <linux/types.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/icmp.h>
+#include <linux/debugfs.h>
+#include <linux/kthread.h>
+#include <linux/pkt_sched.h>
+#include <linux/string.h>
+#include <net/ip6_route.h>
+#include <net/ip6_fib.h>
+#include <net/addrconf.h>
+#include <net/ipv6.h>
+#include <net/tcp.h>
+#include <asm/unaligned.h>
+#include <asm/uaccess.h>	/* for put_user */
+#include <net/ipv6.h>
+#include <linux/inet.h>
+#include <linux/in6.h>
+#include <linux/udp.h>
+#include <linux/tcp.h>
+#include <linux/ppp_defs.h>
+#include <linux/mroute6.h>
+#include <linux/vmalloc.h>
+
+#include <linux/inetdevice.h>
+#include <linux/if_arp.h>
+#include <linux/netfilter_ipv6.h>
+#include <linux/netfilter_bridge.h>
+#include <linux/if_bridge.h>
+#include <net/arp.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_acct.h>
+#include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_l4proto.h>
+#include <net/netfilter/nf_conntrack_l3proto.h>
+#include <net/netfilter/nf_conntrack_zones.h>
+#include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
+#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+#include <linux/../../net/8021q/vlan.h>
+#include <linux/if_vlan.h>
+#endif
+
+/*
+ * Debug output levels
+ * 0 = OFF
+ * 1 = ASSERTS / ERRORS
+ * 2 = 1 + WARN
+ * 3 = 2 + INFO
+ * 4 = 3 + TRACE
+ */
+#define DEBUG_LEVEL ECM_SFE_IPV6_DEBUG_LEVEL
+
+#include <sfe_drv.h>
+
+#include "ecm_types.h"
+#include "ecm_db_types.h"
+#include "ecm_state.h"
+#include "ecm_tracker.h"
+#include "ecm_classifier.h"
+#include "ecm_front_end_types.h"
+#include "ecm_tracker_datagram.h"
+#include "ecm_tracker_udp.h"
+#include "ecm_tracker_tcp.h"
+#include "ecm_db.h"
+#include "ecm_classifier_default.h"
+#ifdef ECM_CLASSIFIER_NL_ENABLE
+#include "ecm_classifier_nl.h"
+#endif
+#ifdef ECM_CLASSIFIER_HYFI_ENABLE
+#include "ecm_classifier_hyfi.h"
+#endif
+#ifdef ECM_CLASSIFIER_DSCP_ENABLE
+#include "ecm_classifier_dscp.h"
+#endif
+#ifdef ECM_CLASSIFIER_PCC_ENABLE
+#include "ecm_classifier_pcc.h"
+#endif
+#include "ecm_interface.h"
+#include "ecm_sfe_ipv6.h"
+#include "ecm_sfe_common.h"
+#include "ecm_sfe_ported_ipv6.h"
+#ifdef ECM_MULTICAST_ENABLE
+#include "ecm_sfe_multicast_ipv6.h"
+#endif
+#ifdef ECM_NON_PORTED_SUPPORT_ENABLE
+#include "ecm_sfe_non_ported_ipv6.h"
+#endif
+
+#include "ecm_front_end_common.h"
+
+int ecm_sfe_ipv6_no_action_limit_default = 250;		/* Default no-action limit. */
+int ecm_sfe_ipv6_driver_fail_limit_default = 250;		/* Default driver fail limit. */
+int ecm_sfe_ipv6_nack_limit_default = 250;			/* Default nack limit. */
+int ecm_sfe_ipv6_accelerated_count = 0;			/* Total offloads */
+int ecm_sfe_ipv6_pending_accel_count = 0;			/* Total pending offloads issued to the SFE / awaiting completion */
+int ecm_sfe_ipv6_pending_decel_count = 0;			/* Total pending deceleration requests issued to the SFE / awaiting completion */
+
+/*
+ * Limiting the acceleration of connections.
+ *
+ * By default there is no acceleration limiting.
+ * This means that when ECM has more connections (that can be accelerated) than the acceleration
+ * engine will allow the ECM will continue to try to accelerate.
+ * In this scenario the acceleration engine will begin removal of existing rules to make way for new ones.
+ * When the accel_limit_mode is set to FIXED ECM will not permit more rules to be issued than the engine will allow.
+ */
+uint32_t ecm_sfe_ipv6_accel_limit_mode = ECM_FRONT_END_ACCEL_LIMIT_MODE_UNLIMITED;
+
+/*
+ * Locking of the classifier - concurrency control for file global parameters.
+ * NOTE: It is safe to take this lock WHILE HOLDING a feci->lock.  The reverse is NOT SAFE.
+ */
+DEFINE_SPINLOCK(ecm_sfe_ipv6_lock);			/* Protect against SMP access between netfilter, events and private threaded function. */
+
+/*
+ * Management thread control
+ */
+bool ecm_sfe_ipv6_terminate_pending = false;		/* True when the user has signalled we should quit */
+
+/*
+ * SFE driver linkage
+ */
+struct sfe_drv_ctx_instance *ecm_sfe_ipv6_drv_mgr = NULL;
+
+static unsigned long ecm_sfe_ipv6_accel_cmd_time_avg_samples = 0;	/* Sum of time taken for the set of accel command samples, used to compute average time for an accel command to complete */
+static unsigned long ecm_sfe_ipv6_accel_cmd_time_avg_set = 1;	/* How many samples in the set */
+static unsigned long ecm_sfe_ipv6_decel_cmd_time_avg_samples = 0;	/* Sum of time taken for the set of accel command samples, used to compute average time for an accel command to complete */
+static unsigned long ecm_sfe_ipv6_decel_cmd_time_avg_set = 1;	/* How many samples in the set */
+
+/*
+ * Debugfs dentry object.
+ */
+static struct dentry *ecm_sfe_ipv6_dentry;
+
+/*
+ * General operational control
+ */
+static int ecm_sfe_ipv6_stopped = 0;			/* When non-zero further traffic will not be processed */
+
+/*
+ * ecm_sfe_ipv6_node_establish_and_ref()
+ *	Returns a reference to a node, possibly creating one if necessary.
+ *
+ * The given_node_addr will be used if provided.
+ *
+ * Returns NULL on failure.
+ */
+struct ecm_db_node_instance *ecm_sfe_ipv6_node_establish_and_ref(struct ecm_front_end_connection_instance *feci,
+							struct net_device *dev, ip_addr_t addr,
+							struct ecm_db_iface_instance *interface_list[], int32_t interface_list_first,
+							uint8_t *given_node_addr)
+{
+	struct ecm_db_node_instance *ni;
+	struct ecm_db_node_instance *nni;
+	struct ecm_db_iface_instance *ii;
+	int i;
+	bool done;
+	uint8_t node_addr[ETH_ALEN];
+
+	DEBUG_INFO("Establish node for " ECM_IP_ADDR_OCTAL_FMT "\n", ECM_IP_ADDR_TO_OCTAL(addr));
+
+	/*
+	 * The node is the datalink address, typically a MAC address.
+	 * However the node address to use is not always obvious and depends on the interfaces involved.
+	 * For example if the interface is PPPoE then we use the MAC of the PPPoE server as we cannot use normal ARP resolution.
+	 * Not all hosts have a node address, where there is none, a suitable alternative should be located and is typically based on 'addr'
+	 * or some other datalink session information.
+	 * It should be, at a minimum, something that ties the host with the interface.
+	 *
+	 * Iterate from 'inner' to 'outer' interfaces - discover what the node is.
+	 */
+	memset(node_addr, 0, ETH_ALEN);
+	done = false;
+	if (given_node_addr) {
+		memcpy(node_addr, given_node_addr, ETH_ALEN);
+		done = true;
+		DEBUG_TRACE("Using given node address: %pM\n", node_addr);
+	}
+	for (i = ECM_DB_IFACE_HEIRARCHY_MAX - 1; (!done) && (i >= interface_list_first); i--) {
+		ecm_db_iface_type_t type;
+		ip_addr_t gw_addr = ECM_IP_ADDR_NULL;
+		bool on_link = false;
+#ifdef ECM_INTERFACE_PPP_ENABLE
+		struct ecm_db_interface_info_pppoe pppoe_info;
+#endif
+		type = ecm_db_connection_iface_type_get(interface_list[i]);
+		DEBUG_INFO("Lookup node address, interface @ %d is type: %d\n", i, type);
+
+		switch (type) {
+
+		case ECM_DB_IFACE_TYPE_PPPOE:
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			/*
+			 * Node address is the address of the remote PPPoE server
+			 */
+			ecm_db_iface_pppoe_session_info_get(interface_list[i], &pppoe_info);
+			memcpy(node_addr, pppoe_info.remote_mac, ETH_ALEN);
+			done = true;
+			break;
+#else
+			DEBUG_TRACE("PPPoE interface unsupported\n");
+			return NULL;
+#endif
+
+		case ECM_DB_IFACE_TYPE_SIT:
+		case ECM_DB_IFACE_TYPE_TUNIPIP6:
+			done = true;
+			break;
+
+		case ECM_DB_IFACE_TYPE_VLAN:
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			/*
+			 * VLAN handled same along with bridge etc.
+			 */
+#else
+			DEBUG_TRACE("VLAN interface unsupported\n");
+			return NULL;
+#endif
+		case ECM_DB_IFACE_TYPE_ETHERNET:
+		case ECM_DB_IFACE_TYPE_LAG:
+		case ECM_DB_IFACE_TYPE_BRIDGE:
+			if (!ecm_interface_mac_addr_get(addr, node_addr, &on_link, gw_addr)) {
+				DEBUG_TRACE("Failed to obtain mac for host " ECM_IP_ADDR_OCTAL_FMT "\n", ECM_IP_ADDR_TO_OCTAL(addr));
+				if (ecm_front_end_is_bridge_port(dev)) {
+					struct net_device *master;
+					master = ecm_interface_get_and_hold_dev_master(dev);
+					DEBUG_ASSERT(master, "Expected a master\n");
+					ecm_interface_send_neighbour_solicitation(master, addr);
+					dev_put(master);
+				} else {
+					ecm_interface_send_neighbour_solicitation(dev, addr);
+				}
+				return NULL;
+			}
+			if (is_multicast_ether_addr(node_addr)) {
+				DEBUG_TRACE("multicast node address for host " ECM_IP_ADDR_OCTAL_FMT ", node_addr: %pM\n", ECM_IP_ADDR_TO_OCTAL(addr), node_addr);
+				return NULL;
+			}
+
+			done = true;
+			break;
+		default:
+			/*
+			 * Don't know how to handle these.
+			 * Just copy some part of the address for now, but keep iterating the interface list
+			 * in the hope something recognisable will be seen!
+			 * GGG TODO We really need to roll out support for all interface types we can deal with ASAP :-(
+			 */
+			memcpy(node_addr, (uint8_t *)addr, ETH_ALEN);
+		}
+	}
+	if (!done) {
+		DEBUG_INFO("Failed to establish node for " ECM_IP_ADDR_OCTAL_FMT "\n", ECM_IP_ADDR_TO_OCTAL(addr));
+		return NULL;
+	}
+
+	/*
+	 * Locate the node
+	 */
+	ni = ecm_db_node_find_and_ref(node_addr);
+	if (ni) {
+		DEBUG_TRACE("%p: node established\n", ni);
+		return ni;
+	}
+
+	/*
+	 * No node - establish iface
+	 */
+	ii = ecm_interface_establish_and_ref(feci, dev);
+	if (!ii) {
+		DEBUG_WARN("Failed to establish iface\n");
+		return NULL;
+	}
+
+	/*
+	 * No node - create one
+	 */
+	nni = ecm_db_node_alloc();
+	if (!nni) {
+		DEBUG_WARN("Failed to establish node\n");
+		ecm_db_iface_deref(ii);
+		return NULL;
+	}
+
+	/*
+	 * Add node into the database, atomically to avoid races creating the same thing
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	ni = ecm_db_node_find_and_ref(node_addr);
+	if (ni) {
+		spin_unlock_bh(&ecm_sfe_ipv6_lock);
+		ecm_db_node_deref(nni);
+		ecm_db_iface_deref(ii);
+		return ni;
+	}
+
+	ecm_db_node_add(nni, ii, node_addr, NULL, nni);
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	/*
+	 * Don't need iface instance now
+	 */
+	ecm_db_iface_deref(ii);
+
+	DEBUG_TRACE("%p: node established\n", nni);
+	return nni;
+}
+
+/*
+ * ecm_sfe_ipv6_host_establish_and_ref()
+ *	Returns a reference to a host, possibly creating one if necessary.
+ *
+ * Returns NULL on failure.
+ */
+struct ecm_db_host_instance *ecm_sfe_ipv6_host_establish_and_ref(ip_addr_t addr)
+{
+	struct ecm_db_host_instance *hi;
+	struct ecm_db_host_instance *nhi;
+
+	DEBUG_INFO("Establish host for " ECM_IP_ADDR_OCTAL_FMT "\n", ECM_IP_ADDR_TO_OCTAL(addr));
+
+	/*
+	 * Locate the host
+	 */
+	hi = ecm_db_host_find_and_ref(addr);
+	if (hi) {
+		DEBUG_TRACE("%p: host established\n", hi);
+		return hi;
+	}
+
+	/*
+	 * No host - create one
+	 */
+	nhi = ecm_db_host_alloc();
+	if (!nhi) {
+		DEBUG_WARN("Failed to establish host\n");
+		return NULL;
+	}
+
+	/*
+	 * Add host into the database, atomically to avoid races creating the same thing
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	hi = ecm_db_host_find_and_ref(addr);
+	if (hi) {
+		spin_unlock_bh(&ecm_sfe_ipv6_lock);
+		ecm_db_host_deref(nhi);
+		return hi;
+	}
+
+	ecm_db_host_add(nhi, addr, true, NULL, nhi);
+
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	DEBUG_TRACE("%p: host established\n", nhi);
+	return nhi;
+}
+
+/*
+ * ecm_sfe_ipv6_mapping_establish_and_ref()
+ *	Returns a reference to a mapping, possibly creating one if necessary.
+ *
+ * Returns NULL on failure.
+ */
+struct ecm_db_mapping_instance *ecm_sfe_ipv6_mapping_establish_and_ref(ip_addr_t addr, int port)
+{
+	struct ecm_db_mapping_instance *mi;
+	struct ecm_db_mapping_instance *nmi;
+	struct ecm_db_host_instance *hi;
+
+	DEBUG_INFO("Establish mapping for " ECM_IP_ADDR_OCTAL_FMT ":%u\n", ECM_IP_ADDR_TO_OCTAL(addr), port);
+
+	/*
+	 * Locate the mapping
+	 */
+	mi = ecm_db_mapping_find_and_ref(addr, port);
+	if (mi) {
+		DEBUG_TRACE("%p: mapping established\n", mi);
+		return mi;
+	}
+
+	/*
+	 * No mapping - establish host existence
+	 */
+	hi = ecm_sfe_ipv6_host_establish_and_ref(addr);
+	if (!hi) {
+		DEBUG_WARN("Failed to establish host\n");
+		return NULL;
+	}
+
+	/*
+	 * Create mapping instance
+	 */
+	nmi = ecm_db_mapping_alloc();
+	if (!nmi) {
+		ecm_db_host_deref(hi);
+		DEBUG_WARN("Failed to establish mapping\n");
+		return NULL;
+	}
+
+	/*
+	 * Add mapping into the database, atomically to avoid races creating the same thing
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	mi = ecm_db_mapping_find_and_ref(addr, port);
+	if (mi) {
+		spin_unlock_bh(&ecm_sfe_ipv6_lock);
+		ecm_db_mapping_deref(nmi);
+		ecm_db_host_deref(hi);
+		return mi;
+	}
+
+	ecm_db_mapping_add(nmi, hi, port, NULL, nmi);
+
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	/*
+	 * Don't need the host instance now - the mapping maintains a reference to it now.
+	 */
+	ecm_db_host_deref(hi);
+
+	/*
+	 * Return the mapping instance
+	 */
+	DEBUG_INFO("%p: mapping established\n", nmi);
+	return nmi;
+}
+
+/*
+ * ecm_sfe_ipv6_accel_done_time_update()
+ *	Record how long the command took to complete, updating average samples
+ */
+void ecm_sfe_ipv6_accel_done_time_update(struct ecm_front_end_connection_instance *feci)
+{
+	unsigned long delta;
+
+	/*
+	 * How long did it take the command to complete?
+	 */
+	spin_lock_bh(&feci->lock);
+	feci->stats.cmd_time_completed = jiffies;
+	delta = feci->stats.cmd_time_completed - feci->stats.cmd_time_begun;
+	spin_unlock_bh(&feci->lock);
+
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	ecm_sfe_ipv6_accel_cmd_time_avg_samples += delta;
+	ecm_sfe_ipv6_accel_cmd_time_avg_set++;
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+}
+
+/*
+ * ecm_sfe_ipv6_deccel_done_time_update()
+ *	Record how long the command took to complete, updating average samples
+ */
+void ecm_sfe_ipv6_decel_done_time_update(struct ecm_front_end_connection_instance *feci)
+{
+	unsigned long delta;
+
+	/*
+	 * How long did it take the command to complete?
+	 */
+	spin_lock_bh(&feci->lock);
+	feci->stats.cmd_time_completed = jiffies;
+	delta = feci->stats.cmd_time_completed - feci->stats.cmd_time_begun;
+	spin_unlock_bh(&feci->lock);
+
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	ecm_sfe_ipv6_decel_cmd_time_avg_samples += delta;
+	ecm_sfe_ipv6_decel_cmd_time_avg_set++;
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+}
+
+/*
+ * ecm_sfe_ipv6_assign_classifier()
+ *	Instantiate and assign classifier of type upon the connection, also returning it if it could be allocated.
+ */
+struct ecm_classifier_instance *ecm_sfe_ipv6_assign_classifier(struct ecm_db_connection_instance *ci, ecm_classifier_type_t type)
+{
+	DEBUG_TRACE("%p: Assign classifier of type: %d\n", ci, type);
+	DEBUG_ASSERT(type != ECM_CLASSIFIER_TYPE_DEFAULT, "Must never need to instantiate default type in this way");
+
+#ifdef ECM_CLASSIFIER_PCC_ENABLE
+	if (type == ECM_CLASSIFIER_TYPE_PCC) {
+		struct ecm_classifier_pcc_instance *pcci;
+		pcci = ecm_classifier_pcc_instance_alloc(ci);
+		if (!pcci) {
+			DEBUG_TRACE("%p: Failed to create Parental Controls classifier\n", ci);
+			return NULL;
+		}
+		DEBUG_TRACE("%p: Created Parental Controls classifier: %p\n", ci, pcci);
+		ecm_db_connection_classifier_assign(ci, (struct ecm_classifier_instance *)pcci);
+		return (struct ecm_classifier_instance *)pcci;
+	}
+#endif
+
+#ifdef ECM_CLASSIFIER_NL_ENABLE
+	if (type == ECM_CLASSIFIER_TYPE_NL) {
+		struct ecm_classifier_nl_instance *cnli;
+		cnli = ecm_classifier_nl_instance_alloc(ci);
+		if (!cnli) {
+			DEBUG_TRACE("%p: Failed to create Netlink classifier\n", ci);
+			return NULL;
+		}
+		DEBUG_TRACE("%p: Created Netlink classifier: %p\n", ci, cnli);
+		ecm_db_connection_classifier_assign(ci, (struct ecm_classifier_instance *)cnli);
+		return (struct ecm_classifier_instance *)cnli;
+	}
+#endif
+
+#ifdef ECM_CLASSIFIER_DSCP_ENABLE
+	if (type == ECM_CLASSIFIER_TYPE_DSCP) {
+		struct ecm_classifier_dscp_instance *cdscpi;
+		cdscpi = ecm_classifier_dscp_instance_alloc(ci);
+		if (!cdscpi) {
+			DEBUG_TRACE("%p: Failed to create DSCP classifier\n", ci);
+			return NULL;
+		}
+		DEBUG_TRACE("%p: Created DSCP classifier: %p\n", ci, cdscpi);
+		ecm_db_connection_classifier_assign(ci, (struct ecm_classifier_instance *)cdscpi);
+		return (struct ecm_classifier_instance *)cdscpi;
+	}
+#endif
+
+#ifdef ECM_CLASSIFIER_HYFI_ENABLE
+	if (type == ECM_CLASSIFIER_TYPE_HYFI) {
+		struct ecm_classifier_hyfi_instance *chfi;
+		chfi = ecm_classifier_hyfi_instance_alloc(ci);
+		if (!chfi) {
+			DEBUG_TRACE("%p: Failed to create HyFi classifier\n", ci);
+			return NULL;
+		}
+		DEBUG_TRACE("%p: Created HyFi classifier: %p\n", ci, chfi);
+		ecm_db_connection_classifier_assign(ci, (struct ecm_classifier_instance *)chfi);
+		return (struct ecm_classifier_instance *)chfi;
+	}
+#endif
+
+	// GGG TODO Add other classifier types.
+	DEBUG_ASSERT(NULL, "%p: Unsupported type: %d\n", ci, type);
+	return NULL;
+}
+
+/*
+ * ecm_sfe_ipv6_reclassify()
+ *	Signal reclassify upon the assigned classifiers.
+ *
+ * Classifiers that unassigned themselves we TRY to re-instantiate them.
+ * Returns false if the function is not able to instantiate all missing classifiers.
+ * This function does not release and references to classifiers in the assignments[].
+ */
+bool ecm_sfe_ipv6_reclassify(struct ecm_db_connection_instance *ci, int assignment_count, struct ecm_classifier_instance *assignments[])
+{
+	ecm_classifier_type_t classifier_type;
+	int i;
+	bool full_reclassification = true;
+
+	/*
+	 * assignment_count will always be <= the number of classifier types available
+	 */
+	for (i = 0, classifier_type = ECM_CLASSIFIER_TYPE_DEFAULT; i < assignment_count; ++i, ++classifier_type) {
+		ecm_classifier_type_t aci_type;
+		struct ecm_classifier_instance *aci;
+
+		aci = assignments[i];
+		aci_type = aci->type_get(aci);
+		DEBUG_TRACE("%p: Reclassify: %d\n", ci, aci_type);
+		aci->reclassify(aci);
+
+		/*
+		 * If the connection has a full complement of assigned classifiers then these will match 1:1 with the classifier_type (all in same order).
+		 * If not, we have to create the missing ones.
+		 */
+		if (aci_type == classifier_type) {
+			continue;
+		}
+
+		/*
+		 * Need to instantiate the missing classifier types until we get to the same type as aci_type then we are back in sync to continue reclassification
+		 */
+		while (classifier_type != aci_type) {
+			struct ecm_classifier_instance *naci;
+			DEBUG_TRACE("%p: Instantiate missing type: %d\n", ci, classifier_type);
+			DEBUG_ASSERT(classifier_type < ECM_CLASSIFIER_TYPES, "Algorithm bad");
+
+			naci = ecm_sfe_ipv6_assign_classifier(ci, classifier_type);
+			if (!naci) {
+				full_reclassification = false;
+			} else {
+				naci->deref(naci);
+			}
+
+			classifier_type++;
+		}
+	}
+
+	/*
+	 * Add missing types
+	 */
+	for (; classifier_type < ECM_CLASSIFIER_TYPES; ++classifier_type) {
+		struct ecm_classifier_instance *naci;
+		DEBUG_TRACE("%p: Instantiate missing type: %d\n", ci, classifier_type);
+
+		naci = ecm_sfe_ipv6_assign_classifier(ci, classifier_type);
+		if (!naci) {
+			full_reclassification = false;
+		} else {
+			naci->deref(naci);
+		}
+	}
+
+	DEBUG_TRACE("%p: reclassify done: %u\n", ci, full_reclassification);
+	return full_reclassification;
+}
+
+/*
+ * ecm_sfe_ipv6_connection_regenerate()
+ *	Re-generate a connection.
+ *
+ * Re-generating a connection involves re-evaluating the interface lists in case interface heirarchies have changed.
+ * It also involves the possible triggering of classifier re-evaluation but only if all currently assigned
+ * classifiers permit this operation.
+ */
+void ecm_sfe_ipv6_connection_regenerate(struct ecm_db_connection_instance *ci, ecm_tracker_sender_type_t sender,
+							struct net_device *out_dev, struct net_device *in_dev)
+{
+	int i;
+	bool reclassify_allowed;
+	int32_t to_list_first;
+	struct ecm_db_iface_instance *to_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+	int32_t from_list_first;
+	struct ecm_db_iface_instance *from_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+	ip_addr_t ip_src_addr;
+	ip_addr_t ip_dest_addr;
+	int protocol;
+	bool is_routed;
+	uint8_t src_node_addr[ETH_ALEN];
+	uint8_t dest_node_addr[ETH_ALEN];
+	int assignment_count;
+	struct ecm_classifier_instance *assignments[ECM_CLASSIFIER_TYPES];
+	struct ecm_front_end_connection_instance *feci;
+
+	DEBUG_INFO("%p: re-gen needed\n", ci);
+
+	/*
+	 * We may need to swap the devices around depending on who the sender of the packet that triggered the re-gen is
+	 */
+	if (sender == ECM_TRACKER_SENDER_TYPE_DEST) {
+		struct net_device *tmp_dev;
+
+		/*
+		 * This is a packet sent by the destination of the connection, i.e. it is a packet issued by the 'from' side of the connection.
+		 */
+		DEBUG_TRACE("%p: Re-gen swap devs\n", ci);
+		tmp_dev = out_dev;
+		out_dev = in_dev;
+		in_dev = tmp_dev;
+	}
+
+	/*
+	 * Update the interface lists - these may have changed, e.g. LAG path change etc.
+	 * NOTE: We never have to change the usual mapping->host->node_iface arrangements for each side of the connection (to/from sides)
+	 * This is because if these interfaces change then the connection is dead anyway.
+	 * But a LAG slave might change the heirarchy the connection is using but the LAG master is still sane.
+	 * If any of the new interface heirarchies cannot be created then simply set empty-lists as this will deny
+	 * acceleration and ensure that a bad rule cannot be created.
+	 * IMPORTANT: The 'sender' defines who has sent the packet that triggered this re-generation
+	 */
+	protocol = ecm_db_connection_protocol_get(ci);
+
+	is_routed = ecm_db_connection_is_routed_get(ci);
+
+	ecm_db_connection_from_address_get(ci, ip_src_addr);
+
+	ecm_db_connection_to_address_get(ci, ip_dest_addr);
+
+	ecm_db_connection_from_node_address_get(ci, src_node_addr);
+
+	ecm_db_connection_to_node_address_get(ci, dest_node_addr);
+
+	feci = ecm_db_connection_front_end_get_and_ref(ci);
+
+	DEBUG_TRACE("%p: Update the 'from' interface heirarchy list\n", ci);
+	from_list_first = ecm_interface_heirarchy_construct(feci, from_list, ip_dest_addr, ip_src_addr, 6, protocol, in_dev, is_routed, in_dev, src_node_addr, dest_node_addr);
+	if (from_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+		goto ecm_ipv6_retry_regen;
+	}
+
+	ecm_db_connection_from_interfaces_reset(ci, from_list, from_list_first);
+	ecm_db_connection_interfaces_deref(from_list, from_list_first);
+
+	DEBUG_TRACE("%p: Update the 'to' interface heirarchy list\n", ci);
+	to_list_first = ecm_interface_heirarchy_construct(feci, to_list, ip_src_addr, ip_dest_addr, 6, protocol, out_dev, is_routed, in_dev, dest_node_addr, src_node_addr);
+	if (to_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+		goto ecm_ipv6_retry_regen;
+	}
+
+	feci->deref(feci);
+	ecm_db_connection_to_interfaces_reset(ci, to_list, to_list_first);
+	ecm_db_connection_interfaces_deref(to_list, to_list_first);
+
+	/*
+	 * Get list of assigned classifiers to reclassify.
+	 * Remember: This also includes our default classifier too.
+	 */
+	assignment_count = ecm_db_connection_classifier_assignments_get_and_ref(ci, assignments);
+
+	/*
+	 * All of the assigned classifiers must permit reclassification.
+	 */
+	reclassify_allowed = true;
+	for (i = 0; i < assignment_count; ++i) {
+		DEBUG_TRACE("%p: Calling to reclassify: %p, type: %d\n", ci, assignments[i], assignments[i]->type_get(assignments[i]));
+		if (!assignments[i]->reclassify_allowed(assignments[i])) {
+			DEBUG_TRACE("%p: reclassify denied: %p, by type: %d\n", ci, assignments[i], assignments[i]->type_get(assignments[i]));
+			reclassify_allowed = false;
+			break;
+		}
+	}
+
+	/*
+	 * Re-generation of state is successful.
+	 */
+	ecm_db_conection_regeneration_completed(ci);
+
+	if (!reclassify_allowed) {
+		/*
+		 * Regeneration came to a successful conclusion even though reclassification was denied
+		 */
+		DEBUG_WARN("%p: re-classify denied\n", ci);
+
+		/*
+		 * Release the assignments
+		 */
+		ecm_db_connection_assignments_release(assignment_count, assignments);
+		return;
+	}
+
+	/*
+	 * Reclassify
+	 */
+	DEBUG_INFO("%p: reclassify\n", ci);
+	if (!ecm_sfe_ipv6_reclassify(ci, assignment_count, assignments)) {
+		/*
+		 * We could not set up the classifiers to reclassify, it is safer to fail out and try again next time
+		 */
+		DEBUG_WARN("%p: Regeneration: reclassify failed\n", ci);
+		ecm_db_connection_assignments_release(assignment_count, assignments);
+		return;
+	}
+	DEBUG_INFO("%p: reclassify success\n", ci);
+
+	/*
+	 * Release the assignments
+	 */
+	ecm_db_connection_assignments_release(assignment_count, assignments);
+	return;
+
+ecm_ipv6_retry_regen:
+	feci->deref(feci);
+	ecm_db_conection_regeneration_failed(ci);
+	return;
+}
+
+/*
+ * ecm_sfe_ipv6_ip_process()
+ *	Process IP datagram skb
+ */
+static unsigned int ecm_sfe_ipv6_ip_process(struct net_device *out_dev, struct net_device *in_dev,
+							uint8_t *src_node_addr, uint8_t *dest_node_addr,
+							bool can_accel, bool is_routed, bool is_l2_encap,
+							struct sk_buff *skb)
+{
+	struct ecm_tracker_ip_header ip_hdr;
+        struct nf_conn *ct;
+        enum ip_conntrack_info ctinfo;
+	struct nf_conntrack_tuple orig_tuple;
+	struct nf_conntrack_tuple reply_tuple;
+	ecm_tracker_sender_type_t sender;
+	ecm_db_direction_t ecm_dir = ECM_DB_DIRECTION_EGRESS_NAT;
+	ip_addr_t ip_src_addr;
+	ip_addr_t ip_dest_addr;
+
+	/*
+	 * Obtain the IP header from the skb
+	 */
+	if (!ecm_tracker_ip_check_header_and_read(&ip_hdr, skb)) {
+		DEBUG_WARN("Invalid ip header in skb %p\n", skb);
+		return NF_ACCEPT;
+	}
+
+	if (ip_hdr.fragmented) {
+		DEBUG_TRACE("skb %p is fragmented\n", skb);
+		return NF_ACCEPT;
+	}
+
+	/*
+	 * Extract information, if we have conntrack then use that info as far as we can.
+	 */
+        ct = nf_ct_get(skb, &ctinfo);
+	if (unlikely(!ct)) {
+		DEBUG_TRACE("%p: no ct\n", skb);
+		ECM_IP_ADDR_TO_NIN6_ADDR(orig_tuple.src.u3.in6, ip_hdr.src_addr);
+		ECM_IP_ADDR_TO_NIN6_ADDR(orig_tuple.dst.u3.in6, ip_hdr.dest_addr);
+		orig_tuple.dst.protonum = ip_hdr.protocol;
+		ECM_IP_ADDR_TO_NIN6_ADDR(reply_tuple.src.u3.in6, ip_hdr.dest_addr);
+		ECM_IP_ADDR_TO_NIN6_ADDR(reply_tuple.dst.u3.in6, ip_hdr.src_addr);
+		sender = ECM_TRACKER_SENDER_TYPE_SRC;
+	} else {
+		if (unlikely(ct == &nf_conntrack_untracked)) {
+			DEBUG_TRACE("%p: ct: untracked\n", skb);
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * If the conntrack connection is using a helper (i.e. Application Layer Gateway)
+		 * then acceleration is denied (connection needs assistance from HLOS to function)
+		 */
+		if (nfct_help(ct)) {
+			DEBUG_TRACE("%p: Connection has helper\n", ct);
+			can_accel = false;
+		}
+
+		/*
+		 * Extract conntrack connection information
+		 */
+		DEBUG_TRACE("%p: ct: %p, ctinfo: %x\n", skb, ct, ctinfo);
+		orig_tuple = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+		reply_tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+		if (IP_CT_DIR_ORIGINAL == CTINFO2DIR(ctinfo)) {
+			sender = ECM_TRACKER_SENDER_TYPE_SRC;
+		} else {
+			sender = ECM_TRACKER_SENDER_TYPE_DEST;
+		}
+
+		/*
+		 * Is this a related connection?
+		 */
+		if ((ctinfo == IP_CT_RELATED) || (ctinfo == IP_CT_RELATED_REPLY)) {
+			/*
+			 * ct is related to the packet at hand.
+			 * We can use the IP src/dest information and the direction information.
+			 * We cannot use the protocol information from the ct (typically the packet at hand is ICMP error that is related to the ct we have here).
+			 */
+			orig_tuple.dst.protonum = ip_hdr.protocol;
+			DEBUG_TRACE("%p: related ct, actual protocol: %u\n", skb, orig_tuple.dst.protonum);
+		}
+	}
+
+#ifdef ECM_MULTICAST_ENABLE
+	/*
+	 * Check for a multicast Destination address here.
+	 */
+	ECM_NIN6_ADDR_TO_IP_ADDR(ip_dest_addr, orig_tuple.dst.u3.in6);
+	if (ecm_ip_addr_is_multicast(ip_dest_addr)) {
+		DEBUG_TRACE("skb %p multicast daddr " ECM_IP_ADDR_OCTAL_FMT "\n", skb, ECM_IP_ADDR_TO_OCTAL(ip_dest_addr));
+
+		return ecm_sfe_multicast_ipv6_connection_process(out_dev,
+				in_dev,
+				src_node_addr,
+				dest_node_addr,
+				can_accel, is_routed, skb,
+				&ip_hdr,
+				ct, sender,
+				&orig_tuple, &reply_tuple);
+	}
+#endif
+	/*
+	 * Work out if this packet involves routing or not.
+	 */
+	if (is_routed) {
+		/*
+		 * Non-NAT only supported for IPv6
+		 */
+		ecm_dir = ECM_DB_DIRECTION_NON_NAT;
+	} else {
+		/*
+		 * Bridged
+		 */
+		ecm_dir = ECM_DB_DIRECTION_BRIDGED;
+	}
+
+	if (sender == ECM_TRACKER_SENDER_TYPE_SRC) {
+		if (ecm_dir == ECM_DB_DIRECTION_NON_NAT) {
+			ECM_NIN6_ADDR_TO_IP_ADDR(ip_src_addr, orig_tuple.src.u3.in6);
+			ECM_NIN6_ADDR_TO_IP_ADDR(ip_dest_addr, orig_tuple.dst.u3.in6);
+
+			src_node_addr = NULL;
+		} else if (ecm_dir == ECM_DB_DIRECTION_BRIDGED) {
+			ECM_NIN6_ADDR_TO_IP_ADDR(ip_src_addr, orig_tuple.src.u3.in6);
+			ECM_NIN6_ADDR_TO_IP_ADDR(ip_dest_addr, orig_tuple.dst.u3.in6);
+		} else {
+			DEBUG_ASSERT(false, "Unhandled ecm_dir: %d\n", ecm_dir);
+		}
+	} else {
+		if (ecm_dir == ECM_DB_DIRECTION_NON_NAT) {
+			ECM_NIN6_ADDR_TO_IP_ADDR(ip_dest_addr, orig_tuple.src.u3.in6);
+			ECM_NIN6_ADDR_TO_IP_ADDR(ip_src_addr, orig_tuple.dst.u3.in6);
+
+			src_node_addr = NULL;
+		} else if (ecm_dir == ECM_DB_DIRECTION_BRIDGED) {
+			ECM_NIN6_ADDR_TO_IP_ADDR(ip_dest_addr, orig_tuple.src.u3.in6);
+			ECM_NIN6_ADDR_TO_IP_ADDR(ip_src_addr, orig_tuple.dst.u3.in6);
+		} else {
+			DEBUG_ASSERT(false, "Unhandled ecm_dir: %d\n", ecm_dir);
+		}
+	}
+
+	DEBUG_TRACE("IP Packet src: " ECM_IP_ADDR_OCTAL_FMT "dst: " ECM_IP_ADDR_OCTAL_FMT " protocol: %u, sender: %d ecm_dir: %d\n",
+				ECM_IP_ADDR_TO_OCTAL(ip_src_addr),
+				ECM_IP_ADDR_TO_OCTAL(ip_dest_addr),
+				orig_tuple.dst.protonum, sender, ecm_dir);
+
+	/*
+	 * Non-unicast source or destination packets are ignored
+	 * NOTE: Only need to check the non-nat src/dest addresses here.
+	 */
+	if (unlikely(ecm_ip_addr_is_non_unicast(ip_dest_addr))) {
+		DEBUG_TRACE("skb %p non-unicast daddr " ECM_IP_ADDR_OCTAL_FMT "\n", skb, ECM_IP_ADDR_TO_OCTAL(ip_dest_addr));
+		return NF_ACCEPT;
+	}
+	if (unlikely(ecm_ip_addr_is_non_unicast(ip_src_addr))) {
+		DEBUG_TRACE("skb %p non-unicast saddr " ECM_IP_ADDR_OCTAL_FMT "\n", skb, ECM_IP_ADDR_TO_OCTAL(ip_src_addr));
+		return NF_ACCEPT;
+	}
+
+	/*
+	 * Process IP specific protocol
+	 * TCP and UDP are the most likliest protocols.
+	 */
+	if (likely(orig_tuple.dst.protonum == IPPROTO_TCP) || likely(orig_tuple.dst.protonum == IPPROTO_UDP)) {
+		return ecm_sfe_ported_ipv6_process(out_dev, in_dev,
+				src_node_addr,
+				dest_node_addr,
+				can_accel, is_routed, is_l2_encap, skb,
+				&ip_hdr,
+				ct, sender, ecm_dir,
+				&orig_tuple, &reply_tuple,
+				ip_src_addr, ip_dest_addr);
+	}
+#ifdef ECM_NON_PORTED_SUPPORT_ENABLE
+	return ecm_sfe_non_ported_ipv6_process(out_dev, in_dev,
+				src_node_addr,
+				dest_node_addr,
+				can_accel, is_routed, is_l2_encap, skb,
+				&ip_hdr,
+				ct, sender, ecm_dir,
+				&orig_tuple, &reply_tuple,
+				ip_src_addr, ip_dest_addr);
+#else
+	return NF_ACCEPT;
+#endif
+}
+
+/*
+ * ecm_sfe_ipv6_post_routing_hook()
+ *	Called for IP packets that are going out to interfaces after IP routing stage.
+ */
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3,6,0))
+static unsigned int ecm_sfe_ipv6_post_routing_hook(unsigned int hooknum,
+				struct sk_buff *skb,
+				const struct net_device *in_unused,
+				const struct net_device *out,
+				int (*okfn)(struct sk_buff *))
+#else
+static unsigned int ecm_sfe_ipv6_post_routing_hook(const struct nf_hook_ops *ops,
+				struct sk_buff *skb,
+				const struct net_device *in_unused,
+				const struct net_device *out,
+				int (*okfn)(struct sk_buff *))
+#endif
+{
+	struct net_device *in;
+	bool can_accel = true;
+	unsigned int result;
+
+	DEBUG_TRACE("%p: Routing: %s\n", out, out->name);
+
+	/*
+	 * If operations have stopped then do not process packets
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	if (unlikely(ecm_sfe_ipv6_stopped)) {
+		spin_unlock_bh(&ecm_sfe_ipv6_lock);
+		DEBUG_TRACE("Front end stopped\n");
+		return NF_ACCEPT;
+	}
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	/*
+	 * Don't process broadcast or multicast
+	 */
+	if (skb->pkt_type == PACKET_BROADCAST) {
+		DEBUG_TRACE("Broadcast, ignoring: %p\n", skb);
+		return NF_ACCEPT;
+	}
+
+#ifndef ECM_MULTICAST_ENABLE
+	if (skb->pkt_type == PACKET_MULTICAST) {
+		DEBUG_TRACE("Multicast, ignoring: %p\n", skb);
+		return NF_ACCEPT;
+	}
+#endif
+
+#ifdef ECM_INTERFACE_PPP_ENABLE
+	/*
+	 * skip l2tp/pptp because we don't accelerate them
+	 */
+	if (ecm_interface_skip_l2tp_pptp(skb, out)) {
+		return NF_ACCEPT;
+	}
+#endif
+
+	/*
+	 * Identify interface from where this packet came
+	 */
+	in = dev_get_by_index(&init_net, skb->skb_iif);
+	if (unlikely(!in)) {
+		/*
+		 * Locally sourced packets are not processed in ECM.
+		 */
+		return NF_ACCEPT;
+	}
+
+	DEBUG_TRACE("Post routing process skb %p, out: %p, in: %p\n", skb, out, in);
+	result = ecm_sfe_ipv6_ip_process((struct net_device *)out, in, NULL, NULL, can_accel, true, false, skb);
+	dev_put(in);
+	return result;
+}
+
+/*
+ * ecm_sfe_ipv6_pppoe_bridge_process()
+ *	Called for PPPoE session packets that are going
+ *	out to one of the bridge physical interfaces.
+ */
+static unsigned int ecm_sfe_ipv6_pppoe_bridge_process(struct net_device *out,
+						     struct net_device *in,
+						     struct ethhdr *skb_eth_hdr,
+						     bool can_accel,
+						     struct sk_buff *skb)
+{
+	unsigned int result = NF_ACCEPT;
+	struct pppoe_hdr *ph = pppoe_hdr(skb);
+	uint16_t ppp_proto = *(uint16_t *)ph->tag;
+	uint32_t encap_header_len = 0;
+
+	ppp_proto = ntohs(ppp_proto);
+	if (ppp_proto != PPP_IPV6) {
+		return NF_ACCEPT;
+	}
+
+	encap_header_len = ecm_front_end_l2_encap_header_len(skb);
+	ecm_front_end_pull_l2_encap_header(skb, encap_header_len);
+	skb->protocol = htons(ETH_P_IPV6);
+
+	result = ecm_sfe_ipv6_ip_process(out, in, skb_eth_hdr->h_source,
+					 skb_eth_hdr->h_dest, can_accel,
+					 false, true, skb);
+
+	 ecm_front_end_push_l2_encap_header(skb, encap_header_len);
+	skb->protocol = htons(ETH_P_PPP_SES);
+
+	return result;
+}
+
+/*
+ * ecm_sfe_ipv6_bridge_post_routing_hook()
+ *	Called for packets that are going out to one of the bridge physical interfaces.
+ *
+ * These may have come from another bridged interface or from a non-bridged interface.
+ * Conntrack information may be available or not if this skb is bridged.
+ */
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3,6,0))
+static unsigned int ecm_sfe_ipv6_bridge_post_routing_hook(unsigned int hooknum,
+					struct sk_buff *skb,
+					const struct net_device *in_unused,
+					const struct net_device *out,
+					int (*okfn)(struct sk_buff *))
+#else
+static unsigned int ecm_sfe_ipv6_bridge_post_routing_hook(const struct nf_hook_ops *ops,
+					struct sk_buff *skb,
+					const struct net_device *in_unused,
+					const struct net_device *out,
+					int (*okfn)(struct sk_buff *))
+#endif
+{
+	struct ethhdr *skb_eth_hdr;
+	uint16_t eth_type;
+	struct net_device *bridge;
+	struct net_device *in;
+	bool can_accel = true;
+	unsigned int result;
+
+	DEBUG_TRACE("%p: Bridge: %s\n", out, out->name);
+
+	/*
+	 * If operations have stopped then do not process packets
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	if (unlikely(ecm_sfe_ipv6_stopped)) {
+		spin_unlock_bh(&ecm_sfe_ipv6_lock);
+		DEBUG_TRACE("Front end stopped\n");
+		return NF_ACCEPT;
+	}
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	/*
+	 * Don't process broadcast or multicast
+	 */
+	if (skb->pkt_type == PACKET_BROADCAST) {
+		DEBUG_TRACE("Broadcast, ignoring: %p\n", skb);
+		return NF_ACCEPT;
+	}
+
+#ifndef ECM_MULTICAST_ENABLE
+	if (skb->pkt_type == PACKET_MULTICAST) {
+		DEBUG_TRACE("Multicast, ignoring: %p\n", skb);
+		return NF_ACCEPT;
+	}
+#endif
+
+#ifdef ECM_INTERFACE_PPP_ENABLE
+	/*
+	 * skip l2tp/pptp because we don't accelerate them
+	 */
+	if (ecm_interface_skip_l2tp_pptp(skb, out)) {
+		return NF_ACCEPT;
+	}
+#endif
+
+	/*
+	 * Check packet is an IP Ethernet packet
+	 */
+	skb_eth_hdr = eth_hdr(skb);
+	if (!skb_eth_hdr) {
+		DEBUG_TRACE("%p: Not Eth\n", skb);
+		return NF_ACCEPT;
+	}
+	eth_type = ntohs(skb_eth_hdr->h_proto);
+	if (unlikely((eth_type != 0x86DD) && (eth_type != ETH_P_PPP_SES))) {
+		DEBUG_TRACE("%p: Not IP/PPPoE session\n", skb);
+		return NF_ACCEPT;
+	}
+
+	/*
+	 * Identify interface from where this packet came.
+	 * There are three scenarios to consider here:
+	 * 1. Packet came from a local source.
+	 *	Ignore - local is not handled.
+	 * 2. Packet came from a routed path.
+	 *	Ignore - it was handled in INET post routing.
+	 * 3. Packet is bridged from another port.
+	 *	Process.
+	 *
+	 * Begin by identifying case 1.
+	 * NOTE: We are given 'out' (which we implicitly know is a bridge port) so out interface's master is the 'bridge'.
+	 */
+	bridge = ecm_interface_get_and_hold_dev_master((struct net_device *)out);
+	DEBUG_ASSERT(bridge, "Expected bridge\n");
+	in = dev_get_by_index(&init_net, skb->skb_iif);
+	if  (!in) {
+		/*
+		 * Case 1.
+		 */
+		DEBUG_TRACE("Local traffic: %p, ignoring traffic to bridge: %p (%s) \n", skb, bridge, bridge->name);
+		dev_put(bridge);
+		return NF_ACCEPT;
+	}
+	dev_put(in);
+
+	/*
+	 * Case 2:
+	 *	For routed packets the skb will have the src mac matching the bridge mac.
+	 * Case 3:
+	 *	If the packet was not local (case 1) or routed (case 2) then we process.
+	 */
+	in = br_port_dev_get(bridge, skb_eth_hdr->h_source);
+	if (!in) {
+		DEBUG_TRACE("skb: %p, no in device for bridge: %p (%s)\n", skb, bridge, bridge->name);
+		dev_put(bridge);
+		return NF_ACCEPT;
+	}
+	if (in == out) {
+		DEBUG_TRACE("skb: %p, bridge: %p (%s), port bounce on %p (%s)\n", skb, bridge, bridge->name, out, out->name);
+		dev_put(in);
+		dev_put(bridge);
+		return NF_ACCEPT;
+	}
+	if (!ecm_mac_addr_equal(skb_eth_hdr->h_source, bridge->dev_addr)) {
+		/*
+		 * Case 2: Routed trafffic would be handled by the INET post routing.
+		 */
+		DEBUG_TRACE("skb: %p, Ignoring routed packet to bridge: %p (%s)\n", skb, bridge, bridge->name);
+		dev_put(in);
+		dev_put(bridge);
+		return NF_ACCEPT;
+	}
+
+	if (!is_multicast_ether_addr(skb_eth_hdr->h_dest)) {
+		/*
+		 * Process the packet, if we have this mac address in the fdb table.
+		 * TODO: For the kernel versions later than 3.6.x, the API needs vlan id.
+		 * 	 For now, we are passing 0, but this needs to be handled later.
+		 */
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3,6,0))
+		if (!br_fdb_has_entry((struct net_device *)out, skb_eth_hdr->h_dest)) {
+#else
+		if (!br_fdb_has_entry((struct net_device *)out, skb_eth_hdr->h_dest, 0)) {
+#endif
+			DEBUG_WARN("skb: %p, No fdb entry for this mac address %pM in the bridge: %p (%s)\n",
+					skb, skb_eth_hdr->h_dest, bridge, bridge->name);
+			dev_put(in);
+			dev_put(bridge);
+			return NF_ACCEPT;
+		}
+	}
+
+	DEBUG_TRACE("Bridge process skb: %p, bridge: %p (%s), In: %p (%s), Out: %p (%s)\n",
+			skb, bridge, bridge->name, in, in->name, out, out->name);
+
+	if (unlikely(eth_type != 0x86DD)) {
+		result = ecm_sfe_ipv6_pppoe_bridge_process((struct net_device *)out, in, skb_eth_hdr, can_accel, skb);
+		dev_put(in);
+		dev_put(bridge);
+		return result;
+	}
+
+	result = ecm_sfe_ipv6_ip_process((struct net_device *)out, in,
+							skb_eth_hdr->h_source, skb_eth_hdr->h_dest, can_accel, false, false, skb);
+
+	dev_put(in);
+	dev_put(bridge);
+	return result;
+}
+
+/*
+ * ecm_sfe_ipv6_stats_sync_callback()
+ *	Callback handler from the sfe driver.
+ */
+static void ecm_sfe_ipv6_stats_sync_callback(void *app_data, struct sfe_ipv6_msg *nim)
+{
+	struct sfe_ipv6_conn_sync *sync;
+	struct nf_conntrack_tuple_hash *h;
+	struct nf_conntrack_tuple tuple;
+	struct nf_conn *ct;
+	struct nf_conn_counter *acct;
+	struct ecm_db_connection_instance *ci;
+	struct ecm_front_end_connection_instance *feci;
+	struct neighbour *neigh;
+	struct ecm_classifier_instance *assignments[ECM_CLASSIFIER_TYPES];
+	int aci_index;
+	int assignment_count;
+	ip_addr_t flow_ip;
+	ip_addr_t return_ip;
+	struct in6_addr group6 __attribute__((unused));
+	struct in6_addr origin6 __attribute__((unused));
+	struct ecm_classifier_rule_sync class_sync;
+
+	/*
+	 * Only respond to sync messages
+	 */
+	if (nim->cm.type != SFE_RX_CONN_STATS_SYNC_MSG) {
+		DEBUG_TRACE("Ignoring nim: %p - not sync: %d", nim, nim->cm.type);
+		return;
+	}
+	sync = &nim->msg.conn_stats;
+
+	ECM_SFE_IPV6_ADDR_TO_IP_ADDR(flow_ip, sync->flow_ip);
+	ECM_SFE_IPV6_ADDR_TO_IP_ADDR(return_ip, sync->return_ip);
+
+	/*
+	 * Look up ecm connection with a view to synchronising the connection, classifier and data tracker.
+	 * Note that we use _xlate versions for destination - for egressing connections this would be the wan IP address,
+	 * but for ingressing this would be the LAN side (non-nat'ed) address and is what we need for lookup of our connection.
+	 */
+	DEBUG_INFO("%p: SFE Sync, lookup connection using\n" \
+			"Protocol: %d\n" \
+			"src_addr: " ECM_IP_ADDR_OCTAL_FMT ":%d\n" \
+			"dest_addr: " ECM_IP_ADDR_OCTAL_FMT ":%d\n",
+			sync,
+			(int)sync->protocol,
+			ECM_IP_ADDR_TO_OCTAL(flow_ip), (int)sync->flow_ident,
+			ECM_IP_ADDR_TO_OCTAL(return_ip), (int)sync->return_ident);
+
+	ci = ecm_db_connection_find_and_ref(flow_ip, return_ip, sync->protocol, (int)ntohs(sync->flow_ident), (int)ntohs(sync->return_ident));
+	if (!ci) {
+		DEBUG_TRACE("%p: SFE Sync: no connection\n", sync);
+		goto sync_conntrack;
+	}
+	DEBUG_TRACE("%p: Sync conn %p\n", sync, ci);
+
+	/*
+	 * Keep connection alive and updated
+	 */
+	if (!ecm_db_connection_defunct_timer_touch(ci)) {
+		ecm_db_connection_deref(ci);
+		goto sync_conntrack;
+	}
+
+	/*
+	 * Get the front end instance
+	 */
+	feci = ecm_db_connection_front_end_get_and_ref(ci);
+
+	if (sync->flow_tx_packet_count || sync->return_tx_packet_count) {
+		DEBUG_TRACE("%p: flow_tx_packet_count: %u, flow_tx_byte_count: %u, return_tx_packet_count: %u, , return_tx_byte_count: %u\n",
+				ci, sync->flow_tx_packet_count, sync->flow_tx_byte_count, sync->return_tx_packet_count, sync->return_tx_byte_count);
+#ifdef ECM_MULTICAST_ENABLE
+		if (ecm_ip_addr_is_multicast(return_ip)) {
+			/*
+			 * The amount of data *sent* by the ECM multicast connection 'from' side is the amount the SFE has *received* in the 'flow' direction.
+			 */
+			ecm_db_multicast_connection_data_totals_update(ci, true, sync->flow_rx_byte_count, sync->flow_rx_packet_count);
+			ecm_db_multicast_connection_data_totals_update(ci, true, sync->return_rx_byte_count, sync->return_rx_packet_count);
+			ecm_db_multicast_connection_interface_heirarchy_stats_update(ci, sync->flow_rx_byte_count, sync->flow_rx_packet_count);
+
+			ECM_IP_ADDR_TO_NIN6_ADDR(origin6, flow_ip);
+			ECM_IP_ADDR_TO_NIN6_ADDR(group6, return_ip);
+
+			/*
+			 * Update IP multicast routing cache stats
+			 */
+			ip6mr_mfc_stats_update(&init_net, &origin6, &group6, sync->flow_rx_packet_count,
+								 sync->flow_rx_byte_count, sync->flow_rx_packet_count, sync->flow_rx_byte_count);
+		} else {
+
+			/*
+			 * The amount of data *sent* by the ECM connection 'from' side is the amount the SFE has *received* in the 'flow' direction.
+			 */
+			ecm_db_connection_data_totals_update(ci, true, sync->flow_rx_byte_count, sync->flow_rx_packet_count);
+
+			/*
+			 * The amount of data *sent* by the ECM connection 'to' side is the amount the SFE has *received* in the 'return' direction.
+			 */
+			ecm_db_connection_data_totals_update(ci, false, sync->return_rx_byte_count, sync->return_rx_packet_count);
+
+		}
+
+		/*
+		 * As packets have been accelerated we have seen some action.
+		 */
+		feci->action_seen(feci);
+#else
+		/*
+		 * The amount of data *sent* by the ECM connection 'from' side is the amount the SFE has *received* in the 'flow' direction.
+		 */
+		ecm_db_connection_data_totals_update(ci, true, sync->flow_rx_byte_count, sync->flow_rx_packet_count);
+
+		/*
+		 * The amount of data *sent* by the ECM connection 'to' side is the amount the SFE has *received* in the 'return' direction.
+		 */
+		ecm_db_connection_data_totals_update(ci, false, sync->return_rx_byte_count, sync->return_rx_packet_count);
+
+		/*
+		 * As packets have been accelerated we have seen some action.
+		 */
+		feci->action_seen(feci);
+
+#endif
+	}
+
+	/*
+	 * Copy the sync data to the classifier sync structure to
+	 * update the classifiers' stats.
+	 */
+	class_sync.flow_tx_packet_count = sync->flow_tx_packet_count;
+	class_sync.return_tx_packet_count = sync->return_tx_packet_count;
+	class_sync.reason = sync->reason;
+
+	/*
+	 * Sync assigned classifiers
+	 */
+	assignment_count = ecm_db_connection_classifier_assignments_get_and_ref(ci, assignments);
+	for (aci_index = 0; aci_index < assignment_count; ++aci_index) {
+		struct ecm_classifier_instance *aci;
+		aci = assignments[aci_index];
+		DEBUG_TRACE("%p: sync to: %p, type: %d\n", feci, aci, aci->type_get(aci));
+		aci->sync_to_v6(aci, &class_sync);
+	}
+	ecm_db_connection_assignments_release(assignment_count, assignments);
+
+	switch(sync->reason) {
+	case SFE_RULE_SYNC_REASON_DESTROY:
+		/*
+		 * This is the final sync from the SFE for a connection whose acceleration was
+		 * terminated by the ecm.
+		 * NOTE: We take no action here since that is performed by the destroy message ack.
+		 */
+		DEBUG_INFO("%p: ECM initiated final sync seen: %d\n", ci, sync->reason);
+		break;
+	case SFE_RULE_SYNC_REASON_FLUSH:
+	case SFE_RULE_SYNC_REASON_EVICT:
+		/*
+		 * SFE has ended acceleration without instruction from the ECM.
+		 */
+		DEBUG_INFO("%p: SFE Initiated final sync seen: %d\n", ci, sync->reason);
+
+		/*
+		 * SFE Decelerated the connection
+		 */
+		feci->accel_ceased(feci);
+		break;
+	default:
+
+		/*
+		 * Update the neighbour entry for source IP address
+		 */
+		neigh = ecm_interface_ipv6_neigh_get(flow_ip);
+		if (!neigh) {
+			DEBUG_WARN("Neighbour entry for " ECM_IP_ADDR_OCTAL_FMT " not found\n", ECM_IP_ADDR_TO_OCTAL(flow_ip));
+		} else {
+			DEBUG_TRACE("Neighbour entry for " ECM_IP_ADDR_OCTAL_FMT " update: %p\n", ECM_IP_ADDR_TO_OCTAL(flow_ip), neigh);
+			neigh_update(neigh, NULL, neigh->nud_state, NEIGH_UPDATE_F_WEAK_OVERRIDE);
+			neigh_release(neigh);
+		}
+
+#ifdef ECM_MULTICAST_ENABLE
+		/*
+		 * Update the neighbour entry for destination IP address
+		 */
+		if (!ecm_ip_addr_is_multicast(return_ip)) {
+			neigh = ecm_interface_ipv6_neigh_get(return_ip);
+			if (!neigh) {
+				DEBUG_WARN("Neighbour entry for " ECM_IP_ADDR_OCTAL_FMT " not found\n", ECM_IP_ADDR_TO_OCTAL(return_ip));
+			} else {
+				DEBUG_TRACE("Neighbour entry for " ECM_IP_ADDR_OCTAL_FMT " update: %p\n", ECM_IP_ADDR_TO_OCTAL(return_ip), neigh);
+				neigh_update(neigh, NULL, neigh->nud_state, NEIGH_UPDATE_F_WEAK_OVERRIDE);
+				neigh_release(neigh);
+			}
+		}
+#else
+		/*
+		 * Update the neighbour entry for destination IP address
+		 */
+		neigh = ecm_interface_ipv6_neigh_get(return_ip);
+		if (!neigh) {
+			DEBUG_WARN("Neighbour entry for " ECM_IP_ADDR_OCTAL_FMT " not found\n", ECM_IP_ADDR_TO_OCTAL(return_ip));
+		} else {
+			DEBUG_TRACE("Neighbour entry for " ECM_IP_ADDR_OCTAL_FMT " update: %p\n", ECM_IP_ADDR_TO_OCTAL(return_ip), neigh);
+			neigh_update(neigh, NULL, neigh->nud_state, NEIGH_UPDATE_F_WEAK_OVERRIDE);
+			neigh_release(neigh);
+		}
+#endif
+	}
+
+	/*
+	 * If connection should be re-generated then we need to force a deceleration
+	 */
+	if (unlikely(ecm_db_connection_regeneration_required_peek(ci))) {
+		DEBUG_TRACE("%p: Connection generation changing, terminating acceleration", ci);
+		feci->decelerate(feci);
+	}
+
+	feci->deref(feci);
+	ecm_db_connection_deref(ci);
+
+sync_conntrack:
+	;
+
+	/*
+	 * Create a tuple so as to be able to look up a conntrack connection
+	 */
+	memset(&tuple, 0, sizeof(tuple));
+	ECM_IP_ADDR_TO_NIN6_ADDR(tuple.src.u3.in6, flow_ip);
+	tuple.src.u.all = sync->flow_ident;
+	tuple.src.l3num = AF_INET6;
+
+	ECM_IP_ADDR_TO_NIN6_ADDR(tuple.dst.u3.in6, return_ip);
+	tuple.dst.dir = IP_CT_DIR_ORIGINAL;
+	tuple.dst.protonum = (uint8_t)sync->protocol;
+	tuple.dst.u.all = sync->return_ident;
+
+	DEBUG_TRACE("Conntrack sync, lookup conntrack connection using\n"
+			"Protocol: %d\n"
+			"src_addr: " ECM_IP_ADDR_OCTAL_FMT ":%d\n"
+			"dest_addr: " ECM_IP_ADDR_OCTAL_FMT ":%d\n",
+			(int)tuple.dst.protonum,
+			ECM_IP_ADDR_TO_OCTAL(flow_ip), (int)tuple.src.u.all,
+			ECM_IP_ADDR_TO_OCTAL(return_ip), (int)tuple.dst.u.all);
+
+	/*
+	 * Look up conntrack connection
+	 */
+	h = nf_conntrack_find_get(&init_net, NF_CT_DEFAULT_ZONE, &tuple);
+	if (!h) {
+		DEBUG_WARN("%p: SFE Sync: no conntrack connection\n", sync);
+		return;
+	}
+
+	ct = nf_ct_tuplehash_to_ctrack(h);
+	NF_CT_ASSERT(ct->timeout.data == (unsigned long)ct);
+	DEBUG_TRACE("%p: SFE Sync: conntrack connection\n", ct);
+
+	/*
+	 * Only update if this is not a fixed timeout
+	 */
+	if (!test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status)) {
+		unsigned long int delta_jiffies;
+
+		/*
+		 * Convert ms ticks from the SFE to jiffies.  We know that inc_ticks is small
+		 * and we expect HZ to be small too so we can multiply without worrying about
+		 * wrap-around problems.  We add a rounding constant to ensure that the different
+		 * time bases don't cause truncation errors.
+		 */
+		DEBUG_ASSERT(HZ <= 100000, "Bad HZ\n");
+		delta_jiffies = ((sync->inc_ticks * HZ) + (MSEC_PER_SEC / 2)) / MSEC_PER_SEC;
+
+		spin_lock_bh(&ct->lock);
+		ct->timeout.expires += delta_jiffies;
+		spin_unlock_bh(&ct->lock);
+	}
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3,6,0))
+	acct = nf_conn_acct_find(ct);
+#else
+	acct = nf_conn_acct_find(ct)->counter;
+#endif
+	if (acct) {
+		spin_lock_bh(&ct->lock);
+		atomic64_add(sync->flow_rx_packet_count, &acct[IP_CT_DIR_ORIGINAL].packets);
+		atomic64_add(sync->flow_rx_byte_count, &acct[IP_CT_DIR_ORIGINAL].bytes);
+
+		atomic64_add(sync->return_rx_packet_count, &acct[IP_CT_DIR_REPLY].packets);
+		atomic64_add(sync->return_rx_byte_count, &acct[IP_CT_DIR_REPLY].bytes);
+		spin_unlock_bh(&ct->lock);
+	}
+
+	switch (sync->protocol) {
+	case IPPROTO_TCP:
+		spin_lock_bh(&ct->lock);
+		if (ct->proto.tcp.seen[0].td_maxwin < sync->flow_max_window) {
+			ct->proto.tcp.seen[0].td_maxwin = sync->flow_max_window;
+		}
+		if ((int32_t)(ct->proto.tcp.seen[0].td_end - sync->flow_end) < 0) {
+			ct->proto.tcp.seen[0].td_end = sync->flow_end;
+		}
+		if ((int32_t)(ct->proto.tcp.seen[0].td_maxend - sync->flow_max_end) < 0) {
+			ct->proto.tcp.seen[0].td_maxend = sync->flow_max_end;
+		}
+		if (ct->proto.tcp.seen[1].td_maxwin < sync->return_max_window) {
+			ct->proto.tcp.seen[1].td_maxwin = sync->return_max_window;
+		}
+		if ((int32_t)(ct->proto.tcp.seen[1].td_end - sync->return_end) < 0) {
+			ct->proto.tcp.seen[1].td_end = sync->return_end;
+		}
+		if ((int32_t)(ct->proto.tcp.seen[1].td_maxend - sync->return_max_end) < 0) {
+			ct->proto.tcp.seen[1].td_maxend = sync->return_max_end;
+		}
+		spin_unlock_bh(&ct->lock);
+		break;
+	}
+
+	/*
+	 * Release connection
+	 */
+	nf_ct_put(ct);
+}
+
+/*
+ * struct nf_hook_ops ecm_sfe_ipv6_netfilter_hooks[]
+ *	Hooks into netfilter packet monitoring points.
+ */
+static struct nf_hook_ops ecm_sfe_ipv6_netfilter_hooks[] __read_mostly = {
+	/*
+	 * Post routing hook is used to monitor packets going to interfaces that are NOT bridged in some way, e.g. packets to the WAN.
+	 */
+	{
+		.hook           = ecm_sfe_ipv6_post_routing_hook,
+		.owner          = THIS_MODULE,
+		.pf             = PF_INET6,
+		.hooknum        = NF_INET_POST_ROUTING,
+		.priority       = NF_IP6_PRI_NAT_SRC + 1,
+	},
+
+	/*
+	 * The bridge post routing hook monitors packets going to interfaces that are part of a bridge arrangement.
+	 * For example Wireles LAN (WLAN) and Wired LAN (LAN).
+	 */
+	{
+		.hook		= ecm_sfe_ipv6_bridge_post_routing_hook,
+		.owner		= THIS_MODULE,
+		.pf		= PF_BRIDGE,
+		.hooknum	= NF_BR_POST_ROUTING,
+		.priority	= NF_BR_PRI_FILTER_OTHER,
+	},
+};
+
+/*
+ * ecm_sfe_ipv6_connection_from_ct_get_and_ref()
+ *	Return, if any, a connection given a ct
+ */
+static struct ecm_db_connection_instance *ecm_sfe_ipv6_connection_from_ct_get_and_ref(struct nf_conn *ct)
+{
+	struct nf_conntrack_tuple orig_tuple;
+	struct nf_conntrack_tuple reply_tuple;
+	ip_addr_t host1_addr;
+	ip_addr_t host2_addr;
+	int host1_port;
+	int host2_port;
+	int protocol;
+
+	/*
+	 * Look up the associated connection for this conntrack connection
+	 */
+	orig_tuple = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+	reply_tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+	ECM_NIN6_ADDR_TO_IP_ADDR(host1_addr, orig_tuple.src.u3.in6);
+	ECM_NIN6_ADDR_TO_IP_ADDR(host2_addr, reply_tuple.src.u3.in6);
+	protocol = orig_tuple.dst.protonum;
+	if (protocol == IPPROTO_TCP) {
+		host1_port = ntohs(orig_tuple.src.u.tcp.port);
+		host2_port = ntohs(reply_tuple.src.u.tcp.port);
+	} else if (protocol == IPPROTO_UDP) {
+		host1_port = ntohs(orig_tuple.src.u.udp.port);
+		host2_port = ntohs(reply_tuple.src.u.udp.port);
+	} else if ((protocol == IPPROTO_IPIP)) {
+		host1_port = 0;
+		host2_port = 0;
+	} else {
+		host1_port = -protocol;
+		host2_port = -protocol;
+	}
+
+	DEBUG_TRACE("%p: lookup src: " ECM_IP_ADDR_OCTAL_FMT ":%d, "
+		    "dest: " ECM_IP_ADDR_OCTAL_FMT ":%d, "
+		    "protocol %d\n",
+		    ct,
+		    ECM_IP_ADDR_TO_OCTAL(host1_addr),
+		    host1_port,
+		    ECM_IP_ADDR_TO_OCTAL(host2_addr),
+		    host2_port,
+		    protocol);
+
+	return ecm_db_connection_find_and_ref(host1_addr,
+					      host2_addr,
+					      protocol,
+					      host1_port,
+					      host2_port);
+}
+
+/*
+ * ecm_sfe_ipv6_conntrack_event_destroy()
+ *	Handles conntrack destroy events
+ */
+static void ecm_sfe_ipv6_conntrack_event_destroy(struct nf_conn *ct)
+{
+	struct ecm_db_connection_instance *ci;
+	struct ecm_front_end_connection_instance *feci;
+
+	DEBUG_INFO("Destroy event for ct: %p\n", ct);
+
+	ci = ecm_sfe_ipv6_connection_from_ct_get_and_ref(ct);
+	if (!ci) {
+		DEBUG_TRACE("%p: not found\n", ct);
+		return;
+	}
+	DEBUG_INFO("%p: Connection defunct %p\n", ct, ci);
+
+	/*
+	 * If this connection is accelerated then we need to issue a destroy command
+	 */
+	feci = ecm_db_connection_front_end_get_and_ref(ci);
+	feci->decelerate(feci);
+	feci->deref(feci);
+
+	/*
+	 * Force destruction of the connection my making it defunct
+	 */
+	ecm_db_connection_make_defunct(ci);
+	ecm_db_connection_deref(ci);
+}
+
+/*
+ * ecm_sfe_ipv6_conntrack_event_mark()
+ *	Handles conntrack mark events
+ */
+static void ecm_sfe_ipv6_conntrack_event_mark(struct nf_conn *ct)
+{
+	struct ecm_db_connection_instance *ci;
+	struct ecm_classifier_instance *__attribute__((unused))cls;
+
+	DEBUG_INFO("Mark event for ct: %p\n", ct);
+
+	/*
+	 * Ignore transitions to zero
+	 */
+	if (ct->mark == 0) {
+		return;
+	}
+
+	ci = ecm_sfe_ipv6_connection_from_ct_get_and_ref(ct);
+	if (!ci) {
+		DEBUG_TRACE("%p: not found\n", ct);
+		return;
+	}
+
+#ifdef ECM_CLASSIFIER_NL_ENABLE
+	/*
+	 * As of now, only the Netlink classifier is interested in conmark changes
+	 * GGG TODO Add a classifier method to propagate this information to any and all types of classifier.
+	 */
+	cls = ecm_db_connection_assigned_classifier_find_and_ref(ci, ECM_CLASSIFIER_TYPE_NL);
+	if (cls) {
+		ecm_classifier_nl_process_mark((struct ecm_classifier_nl_instance *)cls, ct->mark);
+		cls->deref(cls);
+	}
+#endif
+	/*
+	 * All done
+	 */
+	ecm_db_connection_deref(ci);
+}
+
+/*
+ * ecm_sfe_ipv6_conntrack_event()
+ *	Callback event invoked when conntrack connection state changes, currently we handle destroy events to quickly release state
+ */
+int ecm_sfe_ipv6_conntrack_event(unsigned long events, struct nf_conn *ct)
+{
+	/*
+	 * If operations have stopped then do not process event
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	if (unlikely(ecm_sfe_ipv6_stopped)) {
+		DEBUG_WARN("Ignoring event - stopped\n");
+		spin_unlock_bh(&ecm_sfe_ipv6_lock);
+		return NOTIFY_DONE;
+	}
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	if (!ct) {
+		DEBUG_WARN("Error: no ct\n");
+		return NOTIFY_DONE;
+	}
+
+	/*
+	 * handle destroy events
+	 */
+	if (events & (1 << IPCT_DESTROY)) {
+		DEBUG_TRACE("%p: Event is destroy\n", ct);
+		ecm_sfe_ipv6_conntrack_event_destroy(ct);
+	}
+
+	/*
+	 * handle mark change events
+	 */
+	if (events & (1 << IPCT_MARK)) {
+		DEBUG_TRACE("%p: Event is mark\n", ct);
+		ecm_sfe_ipv6_conntrack_event_mark(ct);
+	}
+
+	return NOTIFY_DONE;
+}
+EXPORT_SYMBOL(ecm_sfe_ipv6_conntrack_event);
+
+void ecm_sfe_ipv6_stop(int num)
+{
+	ecm_sfe_ipv6_stopped = num;
+}
+EXPORT_SYMBOL(ecm_sfe_ipv6_stop);
+
+/*
+ * ecm_sfe_ipv6_get_accel_limit_mode()
+ */
+static int ecm_sfe_ipv6_get_accel_limit_mode(void *data, u64 *val)
+{
+	*val = ecm_sfe_ipv6_accel_limit_mode;
+
+	return 0;
+}
+
+/*
+ * ecm_sfe_ipv6_set_accel_limit_mode()
+ */
+static int ecm_sfe_ipv6_set_accel_limit_mode(void *data, u64 val)
+{
+	DEBUG_TRACE("ecm_sfe_ipv6_accel_limit_mode = %x\n", (int)val);
+
+	/*
+	 * Check that only valid bits are set.
+	 * It's fine for no bits to be set as that suggests no modes are wanted.
+	 */
+	if (val && (val ^ (ECM_FRONT_END_ACCEL_LIMIT_MODE_FIXED | ECM_FRONT_END_ACCEL_LIMIT_MODE_UNLIMITED))) {
+		DEBUG_WARN("ecm_sfe_ipv6_accel_limit_mode = %x bad\n", (int)val);
+		return -EINVAL;
+	}
+
+	ecm_sfe_ipv6_accel_limit_mode = (int)val;
+
+	return 0;
+}
+
+/*
+ * Debugfs attribute for accel limit mode.
+ */
+DEFINE_SIMPLE_ATTRIBUTE(ecm_sfe_ipv6_accel_limit_mode_fops, ecm_sfe_ipv6_get_accel_limit_mode, ecm_sfe_ipv6_set_accel_limit_mode, "%llu\n");
+
+/*
+ * ecm_sfe_ipv6_get_accel_cmd_average_millis()
+ */
+static ssize_t ecm_sfe_ipv6_get_accel_cmd_avg_millis(struct file *file,
+								char __user *user_buf,
+								size_t sz, loff_t *ppos)
+{
+	unsigned long set;
+	unsigned long samples;
+	unsigned long avg;
+	char *buf;
+	int ret;
+
+	buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+	if (!buf) {
+		return -ENOMEM;
+	}
+
+	/*
+	 * Operate under our locks.
+	 * Compute the average of the samples taken and seed the next set of samples with the result of this one.
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	samples = ecm_sfe_ipv6_accel_cmd_time_avg_samples;
+	set = ecm_sfe_ipv6_accel_cmd_time_avg_set;
+	ecm_sfe_ipv6_accel_cmd_time_avg_samples /= ecm_sfe_ipv6_accel_cmd_time_avg_set;
+	ecm_sfe_ipv6_accel_cmd_time_avg_set = 1;
+	avg = ecm_sfe_ipv6_accel_cmd_time_avg_samples;
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	/*
+	 * Convert average jiffies to milliseconds
+	 */
+	avg *= 1000;
+	avg /= HZ;
+
+	ret = snprintf(buf, (ssize_t)PAGE_SIZE, "avg=%lu\tsamples=%lu\tset_size=%lu\n", avg, samples, set);
+	if (ret < 0) {
+		kfree(buf);
+		return -EFAULT;
+	}
+
+	ret = simple_read_from_buffer(user_buf, sz, ppos, buf, ret);
+	kfree(buf);
+	return ret;
+}
+
+/*
+ * File operations for accel command average time.
+ */
+static struct file_operations ecm_sfe_ipv6_accel_cmd_avg_millis_fops = {
+	.read = ecm_sfe_ipv6_get_accel_cmd_avg_millis,
+};
+
+/*
+ * ecm_sfe_ipv6_get_decel_cmd_average_millis()
+ */
+static ssize_t ecm_sfe_ipv6_get_decel_cmd_avg_millis(struct file *file,
+								char __user *user_buf,
+								size_t sz, loff_t *ppos)
+{
+	unsigned long set;
+	unsigned long samples;
+	unsigned long avg;
+	char *buf;
+	int ret;
+
+	buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+	if (!buf) {
+		return -ENOMEM;
+	}
+
+	/*
+	 * Operate under our locks.
+	 * Compute the average of the samples taken and seed the next set of samples with the result of this one.
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	samples = ecm_sfe_ipv6_decel_cmd_time_avg_samples;
+	set = ecm_sfe_ipv6_decel_cmd_time_avg_set;
+	ecm_sfe_ipv6_decel_cmd_time_avg_samples /= ecm_sfe_ipv6_decel_cmd_time_avg_set;
+	ecm_sfe_ipv6_decel_cmd_time_avg_set = 1;
+	avg = ecm_sfe_ipv6_decel_cmd_time_avg_samples;
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	/*
+	 * Convert average jiffies to milliseconds
+	 */
+	avg *= 1000;
+	avg /= HZ;
+
+	ret = snprintf(buf, (ssize_t)PAGE_SIZE, "avg=%lu\tsamples=%lu\tset_size=%lu\n", avg, samples, set);
+	if (ret < 0) {
+		kfree(buf);
+		return -EFAULT;
+	}
+
+	ret = simple_read_from_buffer(user_buf, sz, ppos, buf, ret);
+	kfree(buf);
+	return ret;
+}
+
+/*
+ * File operations for decel command average time.
+ */
+static struct file_operations ecm_sfe_ipv6_decel_cmd_avg_millis_fops = {
+	.read = ecm_sfe_ipv6_get_decel_cmd_avg_millis,
+};
+
+/*
+ * ecm_sfe_ipv6_init()
+ */
+int ecm_sfe_ipv6_init(struct dentry *dentry)
+{
+	int result = -1;
+
+	DEBUG_INFO("ECM SFE IPv6 init\n");
+
+	ecm_sfe_ipv6_dentry = debugfs_create_dir("ecm_sfe_ipv6", dentry);
+	if (!ecm_sfe_ipv6_dentry) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv6 directory in debugfs\n");
+		return result;
+	}
+
+	if (!debugfs_create_u32("stop", S_IRUGO | S_IWUSR, ecm_sfe_ipv6_dentry,
+					(u32 *)&ecm_sfe_ipv6_stopped)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv6 stop file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_u32("no_action_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv6_dentry,
+					(u32 *)&ecm_sfe_ipv6_no_action_limit_default)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv6 no_action_limit_default file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_u32("driver_fail_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv6_dentry,
+					(u32 *)&ecm_sfe_ipv6_driver_fail_limit_default)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv6 driver_fail_limit_default file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_u32("nack_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv6_dentry,
+					(u32 *)&ecm_sfe_ipv6_nack_limit_default)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv6 nack_limit_default file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_u32("accelerated_count", S_IRUGO, ecm_sfe_ipv6_dentry,
+					(u32 *)&ecm_sfe_ipv6_accelerated_count)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv6 accelerated_count file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_u32("pending_accel_count", S_IRUGO, ecm_sfe_ipv6_dentry,
+					(u32 *)&ecm_sfe_ipv6_pending_accel_count)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv6 pending_accel_count file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_u32("pending_decel_count", S_IRUGO, ecm_sfe_ipv6_dentry,
+					(u32 *)&ecm_sfe_ipv6_pending_decel_count)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv6 pending_decel_count file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_file("accel_limit_mode", S_IRUGO | S_IWUSR, ecm_sfe_ipv6_dentry,
+					NULL, &ecm_sfe_ipv6_accel_limit_mode_fops)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv6 accel_limit_mode file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_file("accel_cmd_avg_millis", S_IRUGO, ecm_sfe_ipv6_dentry,
+					NULL, &ecm_sfe_ipv6_accel_cmd_avg_millis_fops)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv6 accel_cmd_avg_millis file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!debugfs_create_file("decel_cmd_avg_millis", S_IRUGO, ecm_sfe_ipv6_dentry,
+					NULL, &ecm_sfe_ipv6_decel_cmd_avg_millis_fops)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv6 decel_cmd_avg_millis file in debugfs\n");
+		goto task_cleanup;
+	}
+
+	if (!ecm_sfe_ported_ipv6_debugfs_init(ecm_sfe_ipv6_dentry)) {
+		DEBUG_ERROR("Failed to create ecm ported files in debugfs\n");
+		goto task_cleanup;
+	}
+
+#ifdef ECM_NON_PORTED_SUPPORT_ENABLE
+	if (!ecm_sfe_non_ported_ipv6_debugfs_init(ecm_sfe_ipv6_dentry)) {
+		DEBUG_ERROR("Failed to create ecm non-ported files in debugfs\n");
+		goto task_cleanup;
+	}
+#endif
+
+#ifdef ECM_MULTICAST_ENABLE
+	if (!ecm_sfe_multicast_ipv6_debugfs_init(ecm_sfe_ipv6_dentry)) {
+		DEBUG_ERROR("Failed to create ecm multicast files in debugfs\n");
+		goto task_cleanup;
+	}
+#endif
+
+	/*
+	 * Register netfilter hooks
+	 */
+	result = nf_register_hooks(ecm_sfe_ipv6_netfilter_hooks, ARRAY_SIZE(ecm_sfe_ipv6_netfilter_hooks));
+	if (result < 0) {
+		DEBUG_ERROR("Can't register netfilter hooks.\n");
+		goto task_cleanup;
+	}
+
+#ifdef ECM_MULTICAST_ENABLE
+	ecm_sfe_multicast_ipv6_init();
+#endif
+
+	/*
+	 * Register this module with the Linux SFE Network driver
+	 */
+	ecm_sfe_ipv6_drv_mgr = sfe_drv_ipv6_notify_register(ecm_sfe_ipv6_stats_sync_callback, NULL);
+
+	return 0;
+
+task_cleanup:
+
+	debugfs_remove_recursive(ecm_sfe_ipv6_dentry);
+	return result;
+}
+EXPORT_SYMBOL(ecm_sfe_ipv6_init);
+
+/*
+ * ecm_sfe_ipv6_exit()
+ */
+void ecm_sfe_ipv6_exit(void)
+{
+	DEBUG_INFO("ECM SFE IPv6 Module exit\n");
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	ecm_sfe_ipv6_terminate_pending = true;
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	/*
+	 * Stop the network stack hooks
+	 */
+	nf_unregister_hooks(ecm_sfe_ipv6_netfilter_hooks,
+			    ARRAY_SIZE(ecm_sfe_ipv6_netfilter_hooks));
+
+	/*
+	 * Unregister from the Linux SFE Network driver
+	 */
+	sfe_drv_ipv6_notify_unregister();
+
+	/*
+	 * Remove the debugfs files recursively.
+	 */
+	if (ecm_sfe_ipv6_dentry) {
+		debugfs_remove_recursive(ecm_sfe_ipv6_dentry);
+	}
+
+#ifdef ECM_MULTICAST_ENABLE
+	ecm_sfe_multicast_ipv6_exit();
+#endif
+}
+EXPORT_SYMBOL(ecm_sfe_ipv6_exit);
diff --git a/frontends/sfe/ecm_sfe_ipv6.h b/frontends/sfe/ecm_sfe_ipv6.h
new file mode 100644
index 0000000..05ed372
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_ipv6.h
@@ -0,0 +1,181 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015 The Linux Foundation.  All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+#include <sfe_drv.h>
+
+extern int ecm_sfe_ipv6_no_action_limit_default;		/* Default no-action limit. */
+extern int ecm_sfe_ipv6_driver_fail_limit_default;		/* Default driver fail limit. */
+extern int ecm_sfe_ipv6_nack_limit_default;			/* Default nack limit. */
+extern int ecm_sfe_ipv6_accelerated_count;			/* Total offloads */
+extern int ecm_sfe_ipv6_pending_accel_count;			/* Total pending offloads issued to the SFE / awaiting completion */
+extern int ecm_sfe_ipv6_pending_decel_count;			/* Total pending deceleration requests issued to the SFE / awaiting completion */
+
+/*
+ * Limiting the acceleration of connections.
+ *
+ * By default there is no acceleration limiting.
+ * This means that when ECM has more connections (that can be accelerated) than the acceleration
+ * engine will allow the ECM will continue to try to accelerate.
+ * In this scenario the acceleration engine will begin removal of existing rules to make way for new ones.
+ * When the accel_limit_mode is set to FIXED ECM will not permit more rules to be issued than the engine will allow.
+ */
+extern uint32_t ecm_sfe_ipv6_accel_limit_mode;
+
+/*
+ * Locking of the classifier - concurrency control for file global parameters.
+ * NOTE: It is safe to take this lock WHILE HOLDING a feci->lock.  The reverse is NOT SAFE.
+ */
+extern spinlock_t ecm_sfe_ipv6_lock;			/* Protect against SMP access between netfilter, events and private threaded function. */
+
+/*
+ * Management thread control
+ */
+extern bool ecm_sfe_ipv6_terminate_pending;		/* True when the user has signalled we should quit */
+
+/*
+ * SFE driver linkage
+ */
+extern struct sfe_drv_ctx_instance *ecm_sfe_ipv6_drv_mgr;
+
+/*
+ * ecm_sfe_ipv6_accel_pending_set()
+ *	Set pending acceleration for the connection object.
+ *
+ * Return false if the acceleration is not permitted or is already in progress.
+ */
+static inline bool ecm_sfe_ipv6_accel_pending_set(struct ecm_front_end_connection_instance *feci)
+{
+	DEBUG_INFO("%p: Accel conn: %p\n", feci, feci->ci);
+
+	/*
+	 * If re-generation is required then we cannot permit acceleration
+	 */
+	if (ecm_db_connection_regeneration_required_peek(feci->ci)) {
+		DEBUG_TRACE("%p: accel %p failed - regen required\n", feci, feci->ci);
+		return false;
+	}
+
+	/*
+	 * Is connection acceleration permanently failed?
+	 */
+	spin_lock_bh(&feci->lock);
+	if (ECM_FRONT_END_ACCELERATION_FAILED(feci->accel_mode)) {
+		spin_unlock_bh(&feci->lock);
+		DEBUG_TRACE("%p: accel %p failed\n", feci, feci->ci);
+		return false;
+	}
+
+	/*
+	 * If acceleration mode is anything other than "not accelerated" then ignore.
+	 */
+	if (feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_DECEL) {
+		spin_unlock_bh(&feci->lock);
+		DEBUG_TRACE("%p: Ignoring wrong mode accel for conn: %p\n", feci, feci->ci);
+		return false;
+	}
+
+	/*
+	 * Do we have a fixed upper limit for acceleration?
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	if (ecm_sfe_ipv6_accel_limit_mode & ECM_FRONT_END_ACCEL_LIMIT_MODE_FIXED) {
+		if ((ecm_sfe_ipv6_pending_accel_count + ecm_sfe_ipv6_accelerated_count) >= sfe_drv_ipv6_max_conn_count()) {
+			spin_unlock_bh(&ecm_sfe_ipv6_lock);
+			spin_unlock_bh(&feci->lock);
+			DEBUG_INFO("%p: Accel limit reached, accel denied: %p\n", feci, feci->ci);
+			return false;
+		}
+	}
+
+	/*
+	 * Okay to accelerate
+	 */
+	ecm_sfe_ipv6_pending_accel_count++;
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	/*
+	 * Okay connection can be set to pending acceleration
+	 */
+	feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING;
+	spin_unlock_bh(&feci->lock);
+	return true;
+}
+
+/*
+ * _ecm_sfe_ipv6_accel_pending_clear()
+ *	Clear pending acceleration for the connection object, setting it to the desired state.
+ *
+ * Returns true if "decelerate was pending".
+ *
+ * The feci->lock AND ecm_sfe_ipv6_lock must be held on entry.
+ */
+static inline bool _ecm_sfe_ipv6_accel_pending_clear(struct ecm_front_end_connection_instance *feci, ecm_front_end_acceleration_mode_t mode)
+{
+	bool decel_pending;
+
+	/*
+	 * Set the mode away from its accel pending state.
+	 */
+	DEBUG_ASSERT(feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING, "%p: Accel mode unexpected: %d\n", feci, feci->accel_mode);
+	feci->accel_mode = mode;
+
+	/*
+	 * Clear decelerate pending flag.
+	 * This flag is only set when we are ACCEL_PENDING -
+	 * and we are moving from that to the given mode anyway.
+	 */
+	decel_pending = feci->stats.decelerate_pending;
+	feci->stats.decelerate_pending = false;
+
+	/*
+	 * Decrement pending counter
+	 */
+	ecm_sfe_ipv6_pending_accel_count--;
+	DEBUG_ASSERT(ecm_sfe_ipv6_pending_accel_count >= 0, "Accel pending underflow\n");
+	return decel_pending;
+}
+
+/*
+ * ecm_sfe_ipv6_accel_pending_clear()
+ *	Clear pending acceleration for the connection object, setting it to the desired state.
+ */
+static inline bool ecm_sfe_ipv6_accel_pending_clear(struct ecm_front_end_connection_instance *feci, ecm_front_end_acceleration_mode_t mode)
+{
+	bool decel_pending;
+	spin_lock_bh(&feci->lock);
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	decel_pending = _ecm_sfe_ipv6_accel_pending_clear(feci, mode);
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+	spin_unlock_bh(&feci->lock);
+	return decel_pending;
+}
+
+extern int ecm_sfe_ipv6_conntrack_event(unsigned long events, struct nf_conn *ct);
+extern void ecm_sfe_ipv6_accel_done_time_update(struct ecm_front_end_connection_instance *feci);
+extern void ecm_sfe_ipv6_decel_done_time_update(struct ecm_front_end_connection_instance *feci);
+extern struct ecm_classifier_instance *ecm_sfe_ipv6_assign_classifier(struct ecm_db_connection_instance *ci, ecm_classifier_type_t type);
+extern bool ecm_sfe_ipv6_reclassify(struct ecm_db_connection_instance *ci, int assignment_count, struct ecm_classifier_instance *assignments[]);
+extern void ecm_sfe_ipv6_connection_regenerate(struct ecm_db_connection_instance *ci, ecm_tracker_sender_type_t sender,
+							struct net_device *out_dev, struct net_device *in_dev);
+extern struct ecm_db_node_instance *ecm_sfe_ipv6_node_establish_and_ref(struct ecm_front_end_connection_instance *feci,
+							struct net_device *dev, ip_addr_t addr,
+							struct ecm_db_iface_instance *interface_list[], int32_t interface_list_first,
+							uint8_t *given_node_addr);
+extern struct ecm_db_host_instance *ecm_sfe_ipv6_host_establish_and_ref(ip_addr_t addr);
+extern struct ecm_db_mapping_instance *ecm_sfe_ipv6_mapping_establish_and_ref(ip_addr_t addr, int port);
+extern int ecm_sfe_ipv6_init(struct dentry *dentry);
+extern void ecm_sfe_ipv6_stop(int);
+extern void ecm_sfe_ipv6_exit(void);
diff --git a/frontends/sfe/ecm_sfe_multicast_ipv4.h b/frontends/sfe/ecm_sfe_multicast_ipv4.h
new file mode 100644
index 0000000..e0d2490
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_multicast_ipv4.h
@@ -0,0 +1,70 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015, The Linux Foundation.  All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+/*
+ * ecm_sfe_multicast_ipv4_connection_process()
+ *	Process a UDP multicast flow
+ */
+static inline unsigned int ecm_sfe_multicast_ipv4_connection_process(struct net_device *out_dev,
+							struct net_device *in_dev,
+							uint8_t *src_node_addr,
+							uint8_t *dest_node_addr,
+							bool can_accel, bool is_routed, struct sk_buff *skb,
+							struct ecm_tracker_ip_header *iph,
+							struct nf_conn *ct, ecm_tracker_sender_type_t sender,
+							struct nf_conntrack_tuple *orig_tuple, struct nf_conntrack_tuple *reply_tuple)
+{
+	/*
+	 * Now sfe don't support multicast, just return
+	 */
+	return NF_ACCEPT;
+}
+
+/*
+ * ecm_sfe_multicast_ipv4_debugfs_init()
+ *	create debugfs for ecm sfe ipv4 multicast
+ */
+static inline bool ecm_sfe_multicast_ipv4_debugfs_init(struct dentry *dentry)
+{
+	/*
+	 * Now sfe don't support multicast, just return
+	 */
+	return true;
+}
+
+/*
+ * ecm_sfe_multicast_ipv4_init()
+ * 	Register the callbacks for MCS snooper and MFC update
+ */
+static inline void ecm_sfe_multicast_ipv4_init(void)
+{
+	/*
+	 * Now sfe don't support multicast, just return
+	 */
+	return;
+}
+
+/*
+ * ecm_sfe_multicast_ipv4_exit()
+ * 	De-register the callbacks for MCS snooper and MFC update
+ */
+static inline void ecm_sfe_multicast_ipv4_exit(void)
+{
+	/*
+	 * Now sfe don't support multicast, just return
+	 */
+	return;
+}
diff --git a/frontends/sfe/ecm_sfe_multicast_ipv6.h b/frontends/sfe/ecm_sfe_multicast_ipv6.h
new file mode 100644
index 0000000..275be08
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_multicast_ipv6.h
@@ -0,0 +1,70 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015, The Linux Foundation.  All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+/*
+ * ecm_sfe_multicast_ipv6_connection_process()
+ *	Process a UDP multicast flow
+ */
+static inline unsigned int ecm_sfe_multicast_ipv6_connection_process(struct net_device *out_dev,
+							struct net_device *in_dev,
+							uint8_t *src_node_addr,
+							uint8_t *dest_node_addr,
+							bool can_accel, bool is_routed, struct sk_buff *skb,
+							struct ecm_tracker_ip_header *iph,
+							struct nf_conn *ct, ecm_tracker_sender_type_t sender,
+							struct nf_conntrack_tuple *orig_tuple, struct nf_conntrack_tuple *reply_tuple)
+{
+	/*
+	 * Now sfe don't support multicast, just return
+	 */
+	return NF_ACCEPT;
+}
+
+/*
+ * ecm_sfe_multicast_ipv6_debugfs_init()
+ *	create debugfs for ecm sfe ipv4 multicast
+ */
+static inline bool ecm_sfe_multicast_ipv6_debugfs_init(struct dentry *dentry)
+{
+	/*
+	 * Now sfe don't support multicast, just return
+	 */
+	return true;
+}
+
+/*
+ * ecm_sfe_multicast_ipv6_init()
+ * 	Register the callbacks for MCS snooper and MFC update
+ */
+static inline void ecm_sfe_multicast_ipv6_init(void)
+{
+	/*
+	 * Now sfe don't support multicast, just return
+	 */
+	return;
+}
+
+/*
+ * ecm_sfe_multicast_ipv6_exit()
+ * 	De-register the callbacks for MCS snooper and MFC update
+ */
+static inline void ecm_sfe_multicast_ipv6_exit(void)
+{
+	/*
+	 * Now sfe don't support multicast, just return
+	 */
+	return;
+}
diff --git a/frontends/sfe/ecm_sfe_non_ported_ipv4.c b/frontends/sfe/ecm_sfe_non_ported_ipv4.c
new file mode 100644
index 0000000..a911657
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_non_ported_ipv4.c
@@ -0,0 +1,2357 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015 The Linux Foundation.  All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+#include <linux/version.h>
+#include <linux/types.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/icmp.h>
+#include <linux/kthread.h>
+#include <linux/debugfs.h>
+#include <linux/pkt_sched.h>
+#include <linux/string.h>
+#include <net/route.h>
+#include <net/ip.h>
+#include <net/tcp.h>
+#include <asm/unaligned.h>
+#include <asm/uaccess.h>	/* for put_user */
+#include <net/ipv6.h>
+#include <linux/inet.h>
+#include <linux/in.h>
+#include <linux/udp.h>
+#include <linux/tcp.h>
+
+#include <linux/inetdevice.h>
+#include <linux/if_arp.h>
+#include <linux/netfilter_ipv4.h>
+#include <linux/netfilter_bridge.h>
+#include <linux/if_bridge.h>
+#include <net/arp.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_acct.h>
+#include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_l4proto.h>
+#include <net/netfilter/nf_conntrack_l3proto.h>
+#include <net/netfilter/nf_conntrack_zones.h>
+#include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
+#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+#include <linux/../../net/8021q/vlan.h>
+#include <linux/if_vlan.h>
+#endif
+
+/*
+ * Debug output levels
+ * 0 = OFF
+ * 1 = ASSERTS / ERRORS
+ * 2 = 1 + WARN
+ * 3 = 2 + INFO
+ * 4 = 3 + TRACE
+ */
+#define DEBUG_LEVEL ECM_SFE_NON_PORTED_IPV4_DEBUG_LEVEL
+
+#include <sfe_drv.h>
+
+#include "ecm_types.h"
+#include "ecm_db_types.h"
+#include "ecm_state.h"
+#include "ecm_tracker.h"
+#include "ecm_classifier.h"
+#include "ecm_front_end_types.h"
+#include "ecm_tracker_datagram.h"
+#include "ecm_tracker_udp.h"
+#include "ecm_tracker_tcp.h"
+#include "ecm_db.h"
+#include "ecm_classifier_default.h"
+#include "ecm_interface.h"
+#include "ecm_sfe_non_ported_ipv4.h"
+#include "ecm_sfe_ipv4.h"
+#include "ecm_sfe_common.h"
+
+/*
+ * Magic number
+ */
+#define ECM_SFE_NON_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC 0xEE78
+
+/*
+ * struct ecm_sfe_non_ported_ipv4_connection_instance
+ *	A connection specific front end instance for Non-Ported connections
+ */
+struct ecm_sfe_non_ported_ipv4_connection_instance {
+	struct ecm_front_end_connection_instance base;		/* Base class */
+#if (DEBUG_LEVEL > 0)
+	uint16_t magic;
+#endif
+};
+
+static int ecm_sfe_non_ported_ipv4_accelerated_count = 0;		/* Number of Non-Ported connections currently offloaded */
+
+#ifdef ECM_INTERFACE_SIT_ENABLE
+#ifdef CONFIG_IPV6_SIT_6RD
+/*
+ * ecm_sfe_non_ported_ipv4_sit_set_peer()
+ *	It will set the tunnel's peer when the tunnel is a remote any tunnel.
+ */
+static void ecm_sfe_non_ported_ipv4_sit_set_peer(struct ecm_sfe_non_ported_ipv4_connection_instance *nnpci, struct sk_buff *skb)
+{
+	struct sfe_tun6rd_msg tun6rdmsg;
+	struct sfe_tun6rd_set_peer_msg *tun6rdpeer;
+	struct ecm_db_iface_instance *from_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX];
+	struct ecm_db_iface_instance *from_sfe_iface;
+	int32_t from_ifaces_first;
+	const struct ipv6hdr *iph6;
+	uint16_t interface_number;
+	ecm_db_iface_type_t ii_type;
+	ip_addr_t addr;
+	sfe_tx_status_t sfe_tx_status;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+	from_ifaces_first = ecm_db_connection_from_interfaces_get_and_ref(nnpci->base.ci, from_ifaces);
+	if (from_ifaces_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+		DEBUG_WARN("%p: Accel attempt failed - no interfaces in from_interfaces list!\n", nnpci);
+		return;
+	}
+
+	from_sfe_iface = from_ifaces[from_ifaces_first];
+	ii_type = ecm_db_connection_iface_type_get(from_sfe_iface);
+
+	/*
+	 * We handle SIT tunnel only here
+	 */
+	if (ii_type != ECM_DB_IFACE_TYPE_SIT) {
+		DEBUG_WARN("%p: This interface is not the sit tunnel\n", nnpci);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		return;
+	}
+
+	/*
+	 * We catch these packets in the tunnel which destination ip address is null
+	 */
+	if (!ecm_db_iface_sit_daddr_is_null(from_sfe_iface)) {
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		return;
+	}
+	ecm_db_connection_to_address_get(nnpci->base.ci, addr);
+
+	interface_number = ecm_db_iface_ae_interface_identifier_get(from_sfe_iface);
+	sfe_tun6rd_msg_init(&tun6rdmsg, interface_number, SFE_TUN6RD_ADD_UPDATE_PEER,
+			sizeof(struct sfe_tun6rd_set_peer_msg), NULL, NULL);
+
+	tun6rdpeer = &tun6rdmsg.msg.peer;
+	ECM_IP_ADDR_TO_NIN4_ADDR(tun6rdpeer->dest, addr);
+	iph6 = (struct ipv6hdr *)skb_transport_header(skb);
+	memcpy(tun6rdpeer->ipv6_address,&iph6->daddr, sizeof(struct  in6_addr));
+
+	sfe_tx_status = sfe_tun6rd_tx(ecm_sfe_ipv4_drv_mgr, &tun6rdmsg);
+	if (sfe_tx_status != SFE_TX_SUCCESS) {
+		/*
+		 * Nothing to do when faild to xmit the message.
+		 */
+		DEBUG_WARN("SIT Accelerate set rule failed\n");
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		return;
+	}
+	DEBUG_TRACE("%p: SIT[%d] set peer\n"
+		   "ipv4 destination address:%x\n"
+		   "ipv6 destination address::"ECM_IP_ADDR_OCTAL_FMT"\n",
+		nnpci, interface_number, tun6rdpeer->dest, ECM_IP_ADDR_TO_OCTAL(tun6rdpeer->ipv6_address));
+
+	ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+}
+#endif
+#endif
+
+/*
+ * ecm_sfe_non_ported_ipv4_connection_callback()
+ *	Callback for handling create ack/nack calls.
+ */
+static void ecm_sfe_non_ported_ipv4_connection_callback(void *app_data, struct sfe_ipv4_msg *nim)
+{
+	struct sfe_ipv4_rule_create_msg *__attribute__((unused))nircm = &nim->msg.rule_create;
+	uint32_t serial = (uint32_t)app_data;
+	struct ecm_db_connection_instance *ci;
+	struct ecm_front_end_connection_instance *feci;
+	struct ecm_sfe_non_ported_ipv4_connection_instance *nnpci;
+	ecm_front_end_acceleration_mode_t result_mode;
+
+	/*
+	 * Is this a response to a create message?
+	 */
+	if (nim->cm.type != SFE_TX_CREATE_RULE_MSG) {
+		DEBUG_ERROR("%p: non_ported create callback with improper type: %d, serial: %u\n", nim, nim->cm.type, serial);
+		return;
+	}
+
+	/*
+	 * Look up ecm connection so that we can update the status.
+	 */
+	ci = ecm_db_connection_serial_find_and_ref(serial);
+	if (!ci) {
+		DEBUG_TRACE("%p: create callback, connection not found, serial: %u\n", nim, serial);
+		return;
+	}
+
+	/*
+	 * Release ref held for this ack/nack response.
+	 * NOTE: It's okay to do this here, ci won't go away, because the ci is held as
+	 * a result of the ecm_db_connection_serial_find_and_ref()
+	 */
+	ecm_db_connection_deref(ci);
+
+	/*
+	 * Get the front end instance
+	 */
+	feci = ecm_db_connection_front_end_get_and_ref(ci);
+	nnpci = (struct ecm_sfe_non_ported_ipv4_connection_instance *)feci;
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	/*
+	 * Record command duration
+	 */
+	ecm_sfe_ipv4_accel_done_time_update(feci);
+
+	/*
+	 * Dump some useful trace information.
+	 */
+	DEBUG_TRACE("%p: accelerate response for connection: %p, serial: %u\n", nnpci, feci->ci, serial);
+	DEBUG_TRACE("%p: rule_flags: %x, valid_flags: %x\n", nnpci, nircm->rule_flags, nircm->valid_flags);
+	DEBUG_TRACE("%p: flow_ip: %pI4n:%d\n", nnpci, &nircm->tuple.flow_ip, nircm->tuple.flow_ident);
+	DEBUG_TRACE("%p: return_ip: %pI4n:%d\n", nnpci, &nircm->tuple.return_ip, nircm->tuple.return_ident);
+	DEBUG_TRACE("%p: protocol: %d\n", nnpci, nircm->tuple.protocol);
+
+	/*
+	 * Handle the creation result code.
+	 */
+	DEBUG_TRACE("%p: response: %d\n", nnpci, nim->cm.response);
+	if (nim->cm.response != SFE_CMN_RESPONSE_ACK) {
+		/*
+		 * Creation command failed (specific reason ignored).
+		 */
+		DEBUG_TRACE("%p: accel nack: %d\n", nnpci, nim->cm.error);
+		spin_lock_bh(&feci->lock);
+		DEBUG_ASSERT(feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING, "%p: Unexpected mode: %d\n", ci, feci->accel_mode);
+		feci->stats.ae_nack++;
+		feci->stats.ae_nack_total++;
+		if (feci->stats.ae_nack >= feci->stats.ae_nack_limit) {
+			/*
+			 * Too many SFE rejections
+			 */
+			result_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_ACCEL_ENGINE;
+		} else {
+			/*
+			 * Revert to decelerated
+			 */
+			result_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL;
+		}
+
+		/*
+		 * If connection is now defunct then set mode to ensure no further accel attempts occur
+		 */
+		if (feci->is_defunct) {
+			result_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DEFUNCT;
+		}
+
+		spin_lock_bh(&ecm_sfe_ipv4_lock);
+		_ecm_sfe_ipv4_accel_pending_clear(feci, result_mode);
+		spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+		spin_unlock_bh(&feci->lock);
+
+		/*
+		 * Release the connection.
+		 */
+		feci->deref(feci);
+		ecm_db_connection_deref(ci);
+		return;
+	}
+
+	spin_lock_bh(&feci->lock);
+	DEBUG_ASSERT(feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING, "%p: Unexpected mode: %d\n", ci, feci->accel_mode);
+
+	/*
+	 * If a flush occured before we got the ACK then our acceleration was effectively cancelled on us
+	 * GGG TODO This is a workaround for a SFE message OOO quirk, this should eventually be removed.
+	 */
+	if (feci->stats.flush_happened) {
+		feci->stats.flush_happened = false;
+
+		/*
+		 * Increment the no-action counter.  Our connection was decelerated on us with no action occurring.
+		 */
+		feci->stats.no_action_seen++;
+
+		spin_lock_bh(&ecm_sfe_ipv4_lock);
+		_ecm_sfe_ipv4_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_DECEL);
+		spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+		spin_unlock_bh(&feci->lock);
+
+		/*
+		 * Release the connection.
+		 */
+		feci->deref(feci);
+		ecm_db_connection_deref(ci);
+		return;
+	}
+
+	/*
+	 * Create succeeded
+	 */
+
+	/*
+	 * Clear any nack count
+	 */
+	feci->stats.ae_nack = 0;
+
+	/*
+	 * Clear the "accelerate pending" state and move to "accelerated" state bumping
+	 * the accelerated counters to match our new state.
+	 *
+	 * Decelerate may have been attempted while we were "pending accel" and
+	 * this function will return true if that was the case.
+	 * If decelerate was pending then we need to begin deceleration :-(
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+
+	ecm_sfe_non_ported_ipv4_accelerated_count++;	/* Protocol specific counter */
+	ecm_sfe_ipv4_accelerated_count++;		/* General running counter */
+
+	if (!_ecm_sfe_ipv4_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_ACCEL)) {
+		/*
+		 * Increment the no-action counter, this is reset if offload action is seen
+		 */
+		feci->stats.no_action_seen++;
+
+		spin_unlock_bh(&ecm_sfe_ipv4_lock);
+		spin_unlock_bh(&feci->lock);
+
+		/*
+		 * Release the connection.
+		 */
+		feci->deref(feci);
+		ecm_db_connection_deref(ci);
+		return;
+	}
+
+	DEBUG_INFO("%p: Decelerate was pending\n", ci);
+
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+	spin_unlock_bh(&feci->lock);
+
+	feci->decelerate(feci);
+
+	/*
+	 * Release the connection.
+	 */
+	feci->deref(feci);
+	ecm_db_connection_deref(ci);
+}
+
+/*
+ * ecm_sfe_non_ported_ipv4_connection_accelerate()
+ *	Accelerate a connection
+ *
+ * GGG TODO Refactor this function into a single function that np, udp and tcp
+ * can all use and reduce the amount of code!
+ */
+static void ecm_sfe_non_ported_ipv4_connection_accelerate(struct ecm_front_end_connection_instance *feci, bool is_l2_encap,
+									struct ecm_classifier_process_response *pr)
+{
+	struct ecm_sfe_non_ported_ipv4_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv4_connection_instance *)feci;
+	uint16_t regen_occurrances;
+	int protocol;
+	int32_t from_ifaces_first;
+	int32_t to_ifaces_first;
+	struct ecm_db_iface_instance *from_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX];
+	struct ecm_db_iface_instance *to_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX];
+	struct ecm_db_iface_instance *from_sfe_iface;
+	struct ecm_db_iface_instance *to_sfe_iface;
+	int32_t from_sfe_iface_id;
+	int32_t to_sfe_iface_id;
+	uint8_t from_sfe_iface_address[ETH_ALEN];
+	uint8_t to_sfe_iface_address[ETH_ALEN];
+	ip_addr_t addr;
+	struct sfe_ipv4_msg nim;
+	struct sfe_ipv4_rule_create_msg *nircm;
+	struct ecm_classifier_instance *assignments[ECM_CLASSIFIER_TYPES];
+	int aci_index;
+	int assignment_count;
+	sfe_tx_status_t sfe_tx_status;
+	int32_t list_index;
+	int32_t interface_type_counts[ECM_DB_IFACE_TYPE_COUNT];
+	bool rule_invalid;
+	uint8_t dest_mac_xlate[ETH_ALEN];
+	ecm_db_direction_t ecm_dir;
+	ecm_front_end_acceleration_mode_t result_mode;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	/*
+	 * Get the re-generation occurrance counter of the connection.
+	 * We compare it again at the end - to ensure that the rule construction has seen no generation
+	 * changes during rule creation.
+	 */
+	regen_occurrances = ecm_db_connection_regeneration_occurrances_get(feci->ci);
+
+	/*
+	 * For non-ported protocols we only support IPv6 in 4 or ESP
+	 */
+	protocol = ecm_db_connection_protocol_get(feci->ci);
+	if ((protocol != IPPROTO_IPV6) && (protocol != IPPROTO_ESP)) {
+		spin_lock_bh(&feci->lock);
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_RULE;
+		spin_unlock_bh(&feci->lock);
+		DEBUG_TRACE("%p: unsupported protocol: %d\n", nnpci, protocol);
+		return;
+	}
+
+	/*
+	 * Test if acceleration is permitted
+	 */
+	if (!ecm_sfe_ipv4_accel_pending_set(feci)) {
+		DEBUG_TRACE("%p: Acceleration not permitted: %p\n", feci, feci->ci);
+		return;
+	}
+
+	/*
+	 * Okay construct an accel command.
+	 * Initialise creation structure.
+	 * NOTE: We leverage the app_data void pointer to be our 32 bit connection serial number.
+	 * When we get it back we re-cast it to a uint32 and do a faster connection lookup.
+	 */
+	memset(&nim, 0, sizeof(struct sfe_ipv4_msg));
+	sfe_ipv4_msg_init(&nim, SFE_SPECIAL_INTERFACE_IPV4, SFE_TX_CREATE_RULE_MSG,
+			sizeof(struct sfe_ipv4_rule_create_msg),
+			ecm_sfe_non_ported_ipv4_connection_callback,
+			(void *)ecm_db_connection_serial_get(feci->ci));
+
+	nircm = &nim.msg.rule_create;
+	nircm->valid_flags = 0;
+	nircm->rule_flags = 0;
+
+	/*
+	 * Initialize VLAN tag information
+	 */
+	nircm->vlan_primary_rule.ingress_vlan_tag = SFE_VLAN_ID_NOT_CONFIGURED;
+	nircm->vlan_primary_rule.egress_vlan_tag = SFE_VLAN_ID_NOT_CONFIGURED;
+	nircm->vlan_secondary_rule.ingress_vlan_tag = SFE_VLAN_ID_NOT_CONFIGURED;
+	nircm->vlan_secondary_rule.egress_vlan_tag = SFE_VLAN_ID_NOT_CONFIGURED;
+
+	/*
+	 * Get the interface lists of the connection, we must have at least one interface in the list to continue
+	 */
+	from_ifaces_first = ecm_db_connection_from_interfaces_get_and_ref(feci->ci, from_ifaces);
+	if (from_ifaces_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+		DEBUG_WARN("%p: Accel attempt failed - no interfaces in from_interfaces list!\n", nnpci);
+		goto non_ported_accel_bad_rule;
+	}
+
+	to_ifaces_first = ecm_db_connection_to_interfaces_get_and_ref(feci->ci, to_ifaces);
+	if (to_ifaces_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+		DEBUG_WARN("%p: Accel attempt failed - no interfaces in to_interfaces list!\n", nnpci);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		goto non_ported_accel_bad_rule;
+	}
+
+	/*
+	 * First interface in each must be a known sfe interface
+	 */
+	from_sfe_iface = from_ifaces[from_ifaces_first];
+	to_sfe_iface = to_ifaces[to_ifaces_first];
+	from_sfe_iface_id = ecm_db_iface_ae_interface_identifier_get(from_sfe_iface);
+	to_sfe_iface_id = ecm_db_iface_ae_interface_identifier_get(to_sfe_iface);
+	if ((from_sfe_iface_id < 0) || (to_sfe_iface_id < 0)) {
+		DEBUG_TRACE("%p: from_sfe_iface_id: %d, to_sfe_iface_id: %d\n", nnpci, from_sfe_iface_id, to_sfe_iface_id);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
+		goto non_ported_accel_bad_rule;
+	}
+
+	/*
+	 * New rule being created
+	 */
+	nircm->valid_flags |= SFE_RULE_CREATE_CONN_VALID;
+
+	/*
+	 * Set interface numbers involved in accelerating this connection.
+	 * These are the outer facing addresses from the heirarchy interface lists we got above.
+	 * These may be overridden later if we detect special interface types e.g. ipsec.
+	 */
+	nircm->conn_rule.flow_interface_num = from_sfe_iface_id;
+	nircm->conn_rule.return_interface_num = to_sfe_iface_id;
+
+	/*
+	 * Set interface numbers involved in accelerating this connection.
+	 * These are the inner facing addresses from the heirarchy interface lists we got above.
+	 */
+	nim.msg.rule_create.conn_rule.flow_top_interface_num = ecm_db_iface_interface_identifier_get(from_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX-1]);
+	nim.msg.rule_create.conn_rule.return_top_interface_num = ecm_db_iface_interface_identifier_get(to_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX-1]);
+
+	/*
+	 * We know that each outward facing interface is known to the SFE and so this connection could be accelerated.
+	 * However the lists may also specify other interesting details that must be included in the creation command,
+	 * for example, ethernet MAC, VLAN tagging or PPPoE session information.
+	 * We get this information by walking from the outer to the innermost interface for each list and examine the interface types.
+	 *
+	 * Start with the 'from' (src) side.
+	 * NOTE: The lists may contain a complex heirarchy of similar type of interface e.g. multiple vlans or tunnels within tunnels.
+	 * This SFE cannot handle that - there is no way to describe this in the rule - if we see multiple types that would conflict we have to abort.
+	 */
+	DEBUG_TRACE("%p: Examine from/src heirarchy list\n", nnpci);
+	memset(interface_type_counts, 0, sizeof(interface_type_counts));
+	rule_invalid = false;
+	for (list_index = from_ifaces_first; !rule_invalid && (list_index < ECM_DB_IFACE_HEIRARCHY_MAX); list_index++) {
+		struct ecm_db_iface_instance *ii;
+		ecm_db_iface_type_t ii_type;
+		char *ii_name;
+
+		ii = from_ifaces[list_index];
+		ii_type = ecm_db_connection_iface_type_get(ii);
+		ii_name = ecm_db_interface_type_to_string(ii_type);
+		DEBUG_TRACE("%p: list_index: %d, ii: %p, type: %d (%s)\n", nnpci, list_index, ii, ii_type, ii_name);
+
+		/*
+		 * Extract information from this interface type if it is applicable to the rule.
+		 * Conflicting information may cause accel to be unsupported.
+		 */
+		switch (ii_type) {
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			struct ecm_db_interface_info_pppoe pppoe_info;
+#endif
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			struct ecm_db_interface_info_vlan vlan_info;
+			uint32_t vlan_value = 0;
+			struct net_device *vlan_in_dev = NULL;
+#endif
+		case ECM_DB_IFACE_TYPE_BRIDGE:
+			DEBUG_TRACE("%p: Bridge\n", nnpci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Cannot cascade bridges
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: Bridge - ignore additional\n", nnpci);
+				break;
+			}
+			ecm_db_iface_bridge_address_get(ii, from_sfe_iface_address);
+			DEBUG_TRACE("%p: Bridge - mac: %pM\n", nnpci, from_sfe_iface_address);
+			break;
+		case ECM_DB_IFACE_TYPE_ETHERNET:
+			DEBUG_TRACE("%p: Ethernet\n", nnpci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Ignore additional mac addresses, these are usually as a result of address propagation
+				 * from bridges down to ports etc.
+				 */
+				DEBUG_TRACE("%p: Ethernet - ignore additional\n", nnpci);
+				break;
+			}
+
+			/*
+			 * Can only handle one MAC, the first outermost mac.
+			 */
+			ecm_db_iface_ethernet_address_get(ii, from_sfe_iface_address);
+			DEBUG_TRACE("%p: Ethernet - mac: %pM\n", nnpci, from_sfe_iface_address);
+			break;
+		case ECM_DB_IFACE_TYPE_PPPOE:
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			/*
+			 * More than one PPPoE in the list is not valid!
+			 */
+			if (interface_type_counts[ii_type] != 0) {
+				DEBUG_TRACE("%p: PPPoE - additional unsupported\n", nnpci);
+				rule_invalid = true;
+				break;
+			}
+
+			/*
+			 * Copy pppoe session info to the creation structure.
+			 */
+			ecm_db_iface_pppoe_session_info_get(ii, &pppoe_info);
+
+			nircm->pppoe_rule.flow_pppoe_session_id = pppoe_info.pppoe_session_id;
+			memcpy(nircm->pppoe_rule.flow_pppoe_remote_mac, pppoe_info.remote_mac, ETH_ALEN);
+			nircm->valid_flags |= SFE_RULE_CREATE_PPPOE_VALID;
+
+			DEBUG_TRACE("%p: PPPoE - session: %x, mac: %pM\n", nnpci,
+					nircm->pppoe_rule.flow_pppoe_session_id,
+					nircm->pppoe_rule.flow_pppoe_remote_mac);
+#else
+			rule_invalid = true;
+#endif
+			break;
+		case ECM_DB_IFACE_TYPE_VLAN:
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			DEBUG_TRACE("%p: VLAN\n", nnpci);
+			if (interface_type_counts[ii_type] > 1) {
+				/*
+				 * Can only support two vlans
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: VLAN - additional unsupported\n", nnpci);
+				break;
+			}
+			ecm_db_iface_vlan_info_get(ii, &vlan_info);
+			vlan_value = ((vlan_info.vlan_tpid << 16) | vlan_info.vlan_tag);
+
+			/*
+			 * Look up the vlan device and incorporate the vlan priority into the vlan_value
+			 */
+			vlan_in_dev = dev_get_by_index(&init_net, ecm_db_iface_interface_identifier_get(ii));
+			if (vlan_in_dev) {
+				vlan_value |= vlan_dev_get_egress_prio(vlan_in_dev, pr->return_qos_tag);
+				dev_put(vlan_in_dev);
+				vlan_in_dev = NULL;
+			}
+
+			/*
+			 * Primary or secondary (QinQ) VLAN?
+			 */
+			if (interface_type_counts[ii_type] == 0) {
+				nircm->vlan_primary_rule.ingress_vlan_tag = vlan_value;
+			} else {
+				nircm->vlan_secondary_rule.ingress_vlan_tag = vlan_value;
+			}
+			nircm->valid_flags |= SFE_RULE_CREATE_VLAN_VALID;
+
+			/*
+			 * If we have not yet got an ethernet mac then take this one (very unlikely as mac should have been propagated to the slave (outer) device
+			 */
+			if (interface_type_counts[ECM_DB_IFACE_TYPE_ETHERNET] == 0) {
+				memcpy(from_sfe_iface_address, vlan_info.address, ETH_ALEN);
+				interface_type_counts[ECM_DB_IFACE_TYPE_ETHERNET]++;
+				DEBUG_TRACE("%p: VLAN use mac: %pM\n", nnpci, from_sfe_iface_address);
+			}
+			DEBUG_TRACE("%p: vlan tag: %x\n", nnpci, vlan_value);
+#else
+			rule_invalid = true;
+			DEBUG_TRACE("%p: VLAN - unsupported\n", nnpci);
+#endif
+			break;
+		case ECM_DB_IFACE_TYPE_IPSEC_TUNNEL:
+#ifdef ECM_INTERFACE_IPSEC_ENABLE
+			DEBUG_TRACE("%p: IPSEC\n", nnpci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Can only support one ipsec
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: IPSEC - additional unsupported\n", nnpci);
+				break;
+			}
+			nircm->conn_rule.flow_interface_num = SFE_SPECIAL_INTERFACE_IPSEC;
+#else
+			rule_invalid = true;
+			DEBUG_TRACE("%p: IPSEC - unsupported\n", nnpci);
+#endif
+			break;
+		default:
+			DEBUG_TRACE("%p: Ignoring: %d (%s)\n", nnpci, ii_type, ii_name);
+		}
+
+		/*
+		 * Seen an interface of this type
+		 */
+		interface_type_counts[ii_type]++;
+	}
+	if (rule_invalid) {
+		DEBUG_WARN("%p: from/src Rule invalid\n", nnpci);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
+		goto non_ported_accel_bad_rule;
+	}
+
+	/*
+	 * Now examine the TO / DEST heirarchy list to construct the destination part of the rule
+	 */
+	DEBUG_TRACE("%p: Examine to/dest heirarchy list\n", nnpci);
+	memset(interface_type_counts, 0, sizeof(interface_type_counts));
+	rule_invalid = false;
+	for (list_index = to_ifaces_first; !rule_invalid && (list_index < ECM_DB_IFACE_HEIRARCHY_MAX); list_index++) {
+		struct ecm_db_iface_instance *ii;
+		ecm_db_iface_type_t ii_type;
+		char *ii_name;
+
+		ii = to_ifaces[list_index];
+		ii_type = ecm_db_connection_iface_type_get(ii);
+		ii_name = ecm_db_interface_type_to_string(ii_type);
+		DEBUG_TRACE("%p: list_index: %d, ii: %p, type: %d (%s)\n", nnpci, list_index, ii, ii_type, ii_name);
+
+		/*
+		 * Extract information from this interface type if it is applicable to the rule.
+		 * Conflicting information may cause accel to be unsupported.
+		 */
+		switch (ii_type) {
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			struct ecm_db_interface_info_pppoe pppoe_info;
+#endif
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			struct ecm_db_interface_info_vlan vlan_info;
+			uint32_t vlan_value = 0;
+			struct net_device *vlan_out_dev = NULL;
+#endif
+		case ECM_DB_IFACE_TYPE_BRIDGE:
+			DEBUG_TRACE("%p: Bridge\n", nnpci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Cannot cascade bridges
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: Bridge - ignore additional\n", nnpci);
+				break;
+			}
+			ecm_db_iface_bridge_address_get(ii, to_sfe_iface_address);
+			DEBUG_TRACE("%p: Bridge - mac: %pM\n", nnpci, to_sfe_iface_address);
+			break;
+		case ECM_DB_IFACE_TYPE_ETHERNET:
+			DEBUG_TRACE("%p: Ethernet\n", nnpci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Ignore additional mac addresses, these are usually as a result of address propagation
+				 * from bridges down to ports etc.
+				 */
+				DEBUG_TRACE("%p: Ethernet - ignore additional\n", nnpci);
+				break;
+			}
+
+			/*
+			 * Can only handle one MAC, the first outermost mac.
+			 */
+			ecm_db_iface_ethernet_address_get(ii, to_sfe_iface_address);
+			DEBUG_TRACE("%p: Ethernet - mac: %pM\n", nnpci, to_sfe_iface_address);
+			break;
+		case ECM_DB_IFACE_TYPE_PPPOE:
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			/*
+			 * More than one PPPoE in the list is not valid!
+			 */
+			if (interface_type_counts[ii_type] != 0) {
+				DEBUG_TRACE("%p: PPPoE - additional unsupported\n", nnpci);
+				rule_invalid = true;
+				break;
+			}
+
+			/*
+			 * Copy pppoe session info to the creation structure.
+			 */
+			ecm_db_iface_pppoe_session_info_get(ii, &pppoe_info);
+			nircm->pppoe_rule.return_pppoe_session_id = pppoe_info.pppoe_session_id;
+			memcpy(nircm->pppoe_rule.return_pppoe_remote_mac, pppoe_info.remote_mac, ETH_ALEN);
+			nircm->valid_flags |= SFE_RULE_CREATE_PPPOE_VALID;
+
+			DEBUG_TRACE("%p: PPPoE - session: %x, mac: %pM\n", nnpci,
+				    nircm->pppoe_rule.return_pppoe_session_id,
+				    nircm->pppoe_rule.return_pppoe_remote_mac);
+#else
+			rule_invalid = true;
+#endif
+			break;
+		case ECM_DB_IFACE_TYPE_VLAN:
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			DEBUG_TRACE("%p: VLAN\n", nnpci);
+			if (interface_type_counts[ii_type] > 1) {
+				/*
+				 * Can only support two vlans
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: VLAN - additional unsupported\n", nnpci);
+				break;
+			}
+			ecm_db_iface_vlan_info_get(ii, &vlan_info);
+			vlan_value = ((vlan_info.vlan_tpid << 16) | vlan_info.vlan_tag);
+
+			/*
+			 * Look up the vlan device and incorporate the vlan priority into the vlan_value
+			 */
+			vlan_out_dev = dev_get_by_index(&init_net, ecm_db_iface_interface_identifier_get(ii));
+			if (vlan_out_dev) {
+				vlan_value |= vlan_dev_get_egress_prio(vlan_out_dev, pr->flow_qos_tag);
+				dev_put(vlan_out_dev);
+				vlan_out_dev = NULL;
+			}
+
+			/*
+			 * Primary or secondary (QinQ) VLAN?
+			 */
+			if (interface_type_counts[ii_type] == 0) {
+				nircm->vlan_primary_rule.egress_vlan_tag = vlan_value;
+			} else {
+				nircm->vlan_secondary_rule.egress_vlan_tag = vlan_value;
+			}
+			nircm->valid_flags |= SFE_RULE_CREATE_VLAN_VALID;
+
+			/*
+			 * If we have not yet got an ethernet mac then take this one (very unlikely as mac should have been propagated to the slave (outer) device
+			 */
+			if (interface_type_counts[ECM_DB_IFACE_TYPE_ETHERNET] == 0) {
+				memcpy(to_sfe_iface_address, vlan_info.address, ETH_ALEN);
+				interface_type_counts[ECM_DB_IFACE_TYPE_ETHERNET]++;
+				DEBUG_TRACE("%p: VLAN use mac: %pM\n", nnpci, to_sfe_iface_address);
+			}
+			DEBUG_TRACE("%p: vlan tag: %x\n", nnpci, vlan_value);
+#else
+			rule_invalid = true;
+			DEBUG_TRACE("%p: VLAN - unsupported\n", nnpci);
+#endif
+			break;
+		case ECM_DB_IFACE_TYPE_IPSEC_TUNNEL:
+#ifdef ECM_INTERFACE_IPSEC_ENABLE
+			DEBUG_TRACE("%p: IPSEC\n", nnpci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Can only support one ipsec
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: IPSEC - additional unsupported\n", nnpci);
+				break;
+			}
+			nircm->conn_rule.return_interface_num = SFE_SPECIAL_INTERFACE_IPSEC;
+#else
+			rule_invalid = true;
+			DEBUG_TRACE("%p: IPSEC - unsupported\n", nnpci);
+#endif
+			break;
+		default:
+			DEBUG_TRACE("%p: Ignoring: %d (%s)\n", nnpci, ii_type, ii_name);
+		}
+
+		/*
+		 * Seen an interface of this type
+		 */
+		interface_type_counts[ii_type]++;
+	}
+	if (rule_invalid) {
+		DEBUG_WARN("%p: to/dest Rule invalid\n", nnpci);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
+		goto non_ported_accel_bad_rule;
+	}
+
+	/*
+	 * Routed or bridged?
+	 */
+	if (ecm_db_connection_is_routed_get(feci->ci)) {
+		nircm->rule_flags |= SFE_RULE_CREATE_FLAG_ROUTED;
+	} else {
+		nircm->rule_flags |= SFE_RULE_CREATE_FLAG_BRIDGE_FLOW;
+		if (is_l2_encap) {
+			nircm->rule_flags |= SFE_RULE_CREATE_FLAG_L2_ENCAP;
+		}
+	}
+
+	/*
+	 * Set up the flow and return qos tags
+	 */
+	nircm->qos_rule.flow_qos_tag = (uint32_t)pr->flow_qos_tag;
+	nircm->qos_rule.return_qos_tag = (uint32_t)pr->return_qos_tag;
+	nircm->valid_flags |= SFE_RULE_CREATE_QOS_VALID;
+
+#ifdef ECM_CLASSIFIER_DSCP_ENABLE
+	/*
+	 * DSCP information?
+	 */
+	if (pr->process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DSCP) {
+		nircm->dscp_rule.flow_dscp = pr->flow_dscp;
+		nircm->dscp_rule.return_dscp = pr->return_dscp;
+		nircm->rule_flags |= SFE_RULE_CREATE_FLAG_DSCP_MARKING;
+		nircm->valid_flags |= SFE_RULE_CREATE_DSCP_MARKING_VALID;
+	}
+#endif
+	/*
+	 * Set protocol
+	 */
+	nircm->tuple.protocol = (int32_t)protocol;
+
+	/*
+	 * The flow_ip is where the connection established from
+	 */
+	ecm_db_connection_from_address_get(feci->ci, addr);
+	ECM_IP_ADDR_TO_NIN4_ADDR(nircm->tuple.flow_ip, addr);
+
+	/*
+	 * The return_ip is where the connection is established to, however, in the case of ingress
+	 * the return_ip would be the routers WAN IP - i.e. the NAT'ed version.
+	 * Getting the NAT'ed version here works for ingress or egress packets, for egress
+	 * the NAT'ed version would be the same as the normal address
+	 */
+	ecm_db_connection_to_address_nat_get(feci->ci, addr);
+	ECM_IP_ADDR_TO_NIN4_ADDR(nircm->tuple.return_ip, addr);
+
+	/*
+	 * When the packet is forwarded to the next interface get the address the source IP of the
+	 * packet should be translated to.  For egress this is the NAT'ed from address.
+	 * This also works for ingress as the NAT'ed version of the WAN host would be the same as non-NAT'ed
+	 */
+	ecm_db_connection_from_address_nat_get(feci->ci, addr);
+	ECM_IP_ADDR_TO_NIN4_ADDR(nircm->conn_rule.flow_ip_xlate, addr);
+
+	/*
+	 * The destination address is what the destination IP is translated to as it is forwarded to the next interface.
+	 * For egress this would yield the normal wan host and for ingress this would correctly NAT back to the LAN host
+	 */
+	ecm_db_connection_to_address_get(feci->ci, addr);
+	ECM_IP_ADDR_TO_NIN4_ADDR(nircm->conn_rule.return_ip_xlate, addr);
+
+	/*
+	 * Same approach as above for port information
+	 */
+	nircm->tuple.flow_ident = htons(ecm_db_connection_from_port_get(feci->ci));
+	nircm->tuple.return_ident = htons(ecm_db_connection_to_port_nat_get(feci->ci));
+	nircm->conn_rule.flow_ident_xlate = htons(ecm_db_connection_from_port_nat_get(feci->ci));
+	nircm->conn_rule.return_ident_xlate = htons(ecm_db_connection_to_port_get(feci->ci));
+
+	/*
+	 * Get mac addresses.
+	 * The src_mac is the mac address of the node that established the connection.
+	 * This will work whether the from_node is LAN (egress) or WAN (ingress).
+	 */
+	ecm_db_connection_from_node_address_get(feci->ci, (uint8_t *)nircm->conn_rule.flow_mac);
+
+	/*
+	 * The dest_mac is more complex.  For egress it is the node address of the 'to' side of the connection.
+	 * For ingress it is the node adress of the NAT'ed 'to' IP.
+	 * Essentially it is the MAC of node associated with create.dest_ip and this is "to nat" side.
+	 */
+	ecm_db_connection_to_nat_node_address_get(feci->ci, (uint8_t *)nircm->conn_rule.return_mac);
+
+	/*
+	 * The dest_mac_xlate is the mac address to replace the pkt.dst_mac when a packet is sent to->from
+	 * For bridged connections this does not change.
+	 * For routed connections this is the mac of the 'to' node side of the connection.
+	 */
+	if (ecm_db_connection_is_routed_get(feci->ci)) {
+		ecm_db_connection_to_node_address_get(feci->ci, dest_mac_xlate);
+	} else {
+		/*
+		 * Bridge flows preserve the MAC addressing
+		 */
+		memcpy(dest_mac_xlate, (uint8_t *)nircm->conn_rule.return_mac, ETH_ALEN);
+	}
+
+	/*
+	 * Refer to the Example 2 and 3 in ecm_sfe_ipv4_ip_process() function for egress
+	 * and ingress NAT'ed cases. In these cases, the destination node is the one which has the
+	 * ip_dest_addr. So, above we get the mac address of this host and use that mac address
+	 * for the destination node address in NAT'ed cases.
+	 */
+	ecm_dir = ecm_db_connection_direction_get(feci->ci);
+	if ((ecm_dir == ECM_DB_DIRECTION_INGRESS_NAT) || (ecm_dir == ECM_DB_DIRECTION_EGRESS_NAT)) {
+		memcpy(nircm->conn_rule.return_mac, dest_mac_xlate, ETH_ALEN);
+	}
+
+	/*
+	 * Get MTU information
+	 */
+	nircm->conn_rule.flow_mtu = (uint32_t)ecm_db_connection_from_iface_mtu_get(feci->ci);
+	nircm->conn_rule.return_mtu = (uint32_t)ecm_db_connection_to_iface_mtu_get(feci->ci);
+
+	/*
+	 * Sync our creation command from the assigned classifiers to get specific additional creation rules.
+	 * NOTE: These are called in ascending order of priority and so the last classifier (highest) shall
+	 * override any preceding classifiers.
+	 * This also gives the classifiers a chance to see that acceleration is being attempted.
+	 */
+	assignment_count = ecm_db_connection_classifier_assignments_get_and_ref(feci->ci, assignments);
+	for (aci_index = 0; aci_index < assignment_count; ++aci_index) {
+		struct ecm_classifier_instance *aci;
+		struct ecm_classifier_rule_create ecrc;
+		/*
+		 * NOTE: The current classifiers do not sync anything to the underlying accel engines.
+		 * In the future, if any of the classifiers wants to pass any parameter, these parameters
+		 * should be received via this object and copied to the accel engine's create object (nircm).
+		*/
+		aci = assignments[aci_index];
+		DEBUG_TRACE("%p: sync from: %p, type: %d\n", nnpci, aci, aci->type_get(aci));
+		aci->sync_from_v4(aci, &ecrc);
+	}
+	ecm_db_connection_assignments_release(assignment_count, assignments);
+
+	/*
+	 * Release the interface lists
+	 */
+	ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+	ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
+
+	DEBUG_INFO("%p: Non-Ported Accelerate connection %p\n"
+			"Protocol: %d\n"
+			"from_mtu: %u\n"
+			"to_mtu: %u\n"
+			"from_ip: %pI4n:%d\n"
+			"to_ip: %pI4n:%d\n"
+			"from_ip_xlate: %pI4n:%d\n"
+			"to_ip_xlate: %pI4n:%d\n"
+			"from_mac: %pM\n"
+			"to_mac: %pM\n"
+			"src_iface_num: %u\n"
+			"dest_iface_num: %u\n"
+			"ingress_inner_vlan_tag: %u\n"
+			"egress_inner_vlan_tag: %u\n"
+			"ingress_outer_vlan_tag: %u\n"
+			"egress_outer_vlan_tag: %u\n"
+			"rule_flags: %x\n"
+			"valid_flags: %x\n"
+			"return_pppoe_session_id: %u\n"
+			"return_pppoe_remote_mac: %pM\n"
+			"flow_pppoe_session_id: %u\n"
+			"flow_pppoe_remote_mac: %pM\n"
+			"flow_qos_tag: %x (%u)\n"
+			"return_qos_tag: %x (%u)\n"
+			"flow_dscp: %x\n"
+			"return_dscp: %x\n",
+			nnpci,
+			feci->ci,
+			nircm->tuple.protocol,
+			nircm->conn_rule.flow_mtu,
+			nircm->conn_rule.return_mtu,
+			&nircm->tuple.flow_ip, nircm->tuple.flow_ident,
+			&nircm->tuple.return_ip, nircm->tuple.return_ident,
+			&nircm->conn_rule.flow_ip_xlate, nircm->conn_rule.flow_ident_xlate,
+			&nircm->conn_rule.return_ip_xlate, nircm->conn_rule.return_ident_xlate,
+			nircm->conn_rule.flow_mac,
+			nircm->conn_rule.return_mac,
+			nircm->conn_rule.flow_interface_num,
+			nircm->conn_rule.return_interface_num,
+			nircm->vlan_primary_rule.ingress_vlan_tag,
+			nircm->vlan_primary_rule.egress_vlan_tag,
+			nircm->vlan_secondary_rule.ingress_vlan_tag,
+			nircm->vlan_secondary_rule.egress_vlan_tag,
+			nircm->rule_flags,
+			nircm->valid_flags,
+			nircm->pppoe_rule.return_pppoe_session_id,
+			nircm->pppoe_rule.return_pppoe_remote_mac,
+			nircm->pppoe_rule.flow_pppoe_session_id,
+			nircm->pppoe_rule.flow_pppoe_remote_mac,
+			nircm->qos_rule.flow_qos_tag, nircm->qos_rule.flow_qos_tag,
+			nircm->qos_rule.return_qos_tag, nircm->qos_rule.return_qos_tag,
+			nircm->dscp_rule.flow_dscp,
+			nircm->dscp_rule.return_dscp);
+
+	/*
+	 * Now that the rule has been constructed we re-compare the generation occurrance counter.
+	 * If there has been a change then we abort because the rule may have been created using
+	 * unstable data - especially if another thread has begun regeneration of the connection state.
+	 * NOTE: This does not prevent a regen from being flagged immediately after this line of code either,
+	 * or while the acceleration rule is in flight to the nss.
+	 * This is only to check for consistency of rule state - not that the state is stale.
+	 * Remember that the connection is marked as "accel pending state" so if a regen is flagged immediately
+	 * after this check passes, the connection will be decelerated and refreshed very quickly.
+	 */
+	if (regen_occurrances != ecm_db_connection_regeneration_occurrances_get(feci->ci)) {
+		DEBUG_INFO("%p: connection:%p regen occurred - aborting accel rule.\n", feci, feci->ci);
+		ecm_sfe_ipv4_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_DECEL);
+		return;
+	}
+
+	/*
+	 * Ref the connection before issuing an SFE rule
+	 * This ensures that when the SFE responds to the command - which may even be immediately -
+	 * the callback function can trust the correct ref was taken for its purpose.
+	 * NOTE: remember that this will also implicitly hold the feci.
+	 */
+	ecm_db_connection_ref(feci->ci);
+
+	/*
+	 * We are about to issue the command, record the time of transmission
+	 */
+	spin_lock_bh(&feci->lock);
+	feci->stats.cmd_time_begun = jiffies;
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Call the rule create function
+	 */
+	sfe_tx_status = sfe_drv_ipv4_tx(ecm_sfe_ipv4_drv_mgr, &nim);
+	if (sfe_tx_status == SFE_TX_SUCCESS) {
+		/*
+		 * Reset the driver_fail count - transmission was okay here.
+		 */
+		spin_lock_bh(&feci->lock);
+		feci->stats.driver_fail = 0;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * Release that ref!
+	 */
+	ecm_db_connection_deref(feci->ci);
+
+	/*
+	 * TX failed
+	 */
+	spin_lock_bh(&feci->lock);
+	DEBUG_ASSERT(feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING, "%p: Accel mode unexpected: %d\n", nnpci, feci->accel_mode);
+	feci->stats.driver_fail_total++;
+	feci->stats.driver_fail++;
+	if (feci->stats.driver_fail >= feci->stats.driver_fail_limit) {
+		DEBUG_WARN("%p: Accel failed - driver fail limit\n", nnpci);
+		result_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DRIVER;
+	} else {
+		result_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL;
+	}
+
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	_ecm_sfe_ipv4_accel_pending_clear(feci, result_mode);
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	spin_unlock_bh(&feci->lock);
+	return;
+
+non_ported_accel_bad_rule:
+	;
+
+	/*
+	 * Jump to here when rule data is bad and an offload command cannot be constructed
+	 */
+	DEBUG_WARN("%p: Accel failed - bad rule\n", nnpci);
+	ecm_sfe_ipv4_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_FAIL_RULE);
+}
+
+/*
+ * ecm_sfe_non_ported_ipv4_connection_destroy_callback()
+ *	Callback for handling destroy ack/nack calls.
+ */
+static void ecm_sfe_non_ported_ipv4_connection_destroy_callback(void *app_data, struct sfe_ipv4_msg *nim)
+{
+	struct sfe_ipv4_rule_destroy_msg *__attribute__((unused))nirdm = &nim->msg.rule_destroy;
+	uint32_t serial = (uint32_t)app_data;
+	struct ecm_db_connection_instance *ci;
+	struct ecm_front_end_connection_instance *feci;
+	struct ecm_sfe_non_ported_ipv4_connection_instance *nnpci;
+
+	/*
+	 * Is this a response to a destroy message?
+	 */
+	if (nim->cm.type != SFE_TX_DESTROY_RULE_MSG) {
+		DEBUG_ERROR("%p: non-ported destroy callback with improper type: %d\n", nim, nim->cm.type);
+		return;
+	}
+
+	/*
+	 * Look up ecm connection so that we can update the status.
+	 */
+	ci = ecm_db_connection_serial_find_and_ref(serial);
+	if (!ci) {
+		DEBUG_TRACE("%p: destroy callback, connection not found, serial: %u\n", nim, serial);
+		return;
+	}
+
+	/*
+	 * Release ref held for this ack/nack response.
+	 * NOTE: It's okay to do this here, ci won't go away, because the ci is held as
+	 * a result of the ecm_db_connection_serial_find_and_ref()
+	 */
+	ecm_db_connection_deref(ci);
+
+	/*
+	 * Get the front end instance
+	 */
+	feci = ecm_db_connection_front_end_get_and_ref(ci);
+	nnpci = (struct ecm_sfe_non_ported_ipv4_connection_instance *)feci;
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	/*
+	 * Record command duration
+	 */
+	ecm_sfe_ipv4_decel_done_time_update(feci);
+
+	/*
+	 * Dump some useful trace information.
+	 */
+	DEBUG_TRACE("%p: decelerate response for connection: %p\n", nnpci, feci->ci);
+	DEBUG_TRACE("%p: flow_ip: %pI4n:%d\n", nnpci, &nirdm->tuple.flow_ip, nirdm->tuple.flow_ident);
+	DEBUG_TRACE("%p: return_ip: %pI4n:%d\n", nnpci, &nirdm->tuple.return_ip, nirdm->tuple.return_ident);
+	DEBUG_TRACE("%p: protocol: %d\n", nnpci, nirdm->tuple.protocol);
+
+	/*
+	 * Drop decel pending counter
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	ecm_sfe_ipv4_pending_decel_count--;
+	DEBUG_ASSERT(ecm_sfe_ipv4_pending_decel_count >= 0, "Bad decel pending counter\n");
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	spin_lock_bh(&feci->lock);
+
+	/*
+	 * If decel is not still pending then it's possible that the SFE ended acceleration by some other reason e.g. flush
+	 * In which case we cannot rely on the response we get here.
+	 */
+	if (feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_DECEL_PENDING) {
+		spin_unlock_bh(&feci->lock);
+
+		/*
+		 * Release the connections.
+		 */
+		feci->deref(feci);
+		ecm_db_connection_deref(ci);
+		return;
+	}
+
+	DEBUG_TRACE("%p: response: %d\n", nnpci, nim->cm.response);
+	if (nim->cm.response != SFE_CMN_RESPONSE_ACK) {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DECEL;
+	} else {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL;
+	}
+
+	/*
+	 * If connection became defunct then set mode so that no further accel/decel attempts occur.
+	 */
+	if (feci->is_defunct) {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DEFUNCT;
+	}
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Non-Ported acceleration ends
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	ecm_sfe_non_ported_ipv4_accelerated_count--;	/* Protocol specific counter */
+	DEBUG_ASSERT(ecm_sfe_non_ported_ipv4_accelerated_count >= 0, "Bad non-ported accel counter\n");
+	ecm_sfe_ipv4_accelerated_count--;		/* General running counter */
+	DEBUG_ASSERT(ecm_sfe_ipv4_accelerated_count >= 0, "Bad accel counter\n");
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	/*
+	 * Release the connections.
+	 */
+	feci->deref(feci);
+	ecm_db_connection_deref(ci);
+}
+
+/*
+ * ecm_sfe_non_ported_ipv4_connection_decelerate()
+ *	Decelerate a connection
+ */
+static void ecm_sfe_non_ported_ipv4_connection_decelerate(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_non_ported_ipv4_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv4_connection_instance *)feci;
+	struct sfe_ipv4_msg nim;
+	struct sfe_ipv4_rule_destroy_msg *nirdm;
+	ip_addr_t addr;
+	sfe_tx_status_t sfe_tx_status;
+	int protocol;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	/*
+	 * For non-ported protocols we only support IPv6 in 4 or ESP
+	 */
+	protocol = ecm_db_connection_protocol_get(feci->ci);
+	if ((protocol != IPPROTO_IPV6) && (protocol != IPPROTO_ESP)) {
+		DEBUG_TRACE("%p: unsupported protocol: %d\n", nnpci, protocol);
+		return;
+	}
+
+	/*
+	 * If decelerate is in error or already pending then ignore
+	 */
+	spin_lock_bh(&feci->lock);
+	if (feci->stats.decelerate_pending) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If acceleration is pending then we cannot decelerate right now or we will race with it
+	 * Set a decelerate pending flag that will be actioned when the acceleration command is complete.
+	 */
+	if (feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING) {
+		feci->stats.decelerate_pending = true;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * Can only decelerate if accelerated
+	 * NOTE: This will also deny accel when the connection is in fail condition too.
+	 */
+	if (feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_ACCEL) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * Initiate deceleration
+	 */
+	feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL_PENDING;
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Increment the decel pending counter
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	ecm_sfe_ipv4_pending_decel_count++;
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	/*
+	 * Prepare deceleration message
+	 */
+	sfe_ipv4_msg_init(&nim, SFE_SPECIAL_INTERFACE_IPV4, SFE_TX_DESTROY_RULE_MSG,
+			sizeof(struct sfe_ipv4_rule_destroy_msg),
+			ecm_sfe_non_ported_ipv4_connection_destroy_callback,
+			(void *)ecm_db_connection_serial_get(feci->ci));
+
+	nirdm = &nim.msg.rule_destroy;
+	nirdm->tuple.protocol = (int32_t)protocol;
+
+	/*
+	 * Get addressing information
+	 */
+	ecm_db_connection_from_address_get(feci->ci, addr);
+	ECM_IP_ADDR_TO_NIN4_ADDR(nirdm->tuple.flow_ip, addr);
+	ecm_db_connection_to_address_nat_get(feci->ci, addr);
+	ECM_IP_ADDR_TO_NIN4_ADDR(nirdm->tuple.return_ip, addr);
+	nirdm->tuple.flow_ident = htons(ecm_db_connection_from_port_get(feci->ci));
+	nirdm->tuple.return_ident = htons(ecm_db_connection_to_port_nat_get(feci->ci));
+
+	DEBUG_INFO("%p: Non-Ported Connection %p decelerate\n"
+			"protocol: %d\n"
+			"src_ip: %pI4:%d\n"
+			"dest_ip: %pI4:%d\n",
+			nnpci, feci->ci, protocol,
+			&nirdm->tuple.flow_ip, nirdm->tuple.flow_ident,
+			&nirdm->tuple.return_ip, nirdm->tuple.return_ident);
+
+	/*
+	 * Take a ref to the feci->ci so that it will persist until we get a response from the SFE.
+	 * NOTE: This will implicitly hold the feci too.
+	 */
+	ecm_db_connection_ref(feci->ci);
+
+	/*
+	 * We are about to issue the command, record the time of transmission
+	 */
+	spin_lock_bh(&feci->lock);
+	feci->stats.cmd_time_begun = jiffies;
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Destroy the SFE connection cache entry.
+	 */
+	sfe_tx_status = sfe_drv_ipv4_tx(ecm_sfe_ipv4_drv_mgr, &nim);
+	if (sfe_tx_status == SFE_TX_SUCCESS) {
+		/*
+		 * Reset the driver_fail count - transmission was okay here.
+		 */
+		spin_lock_bh(&feci->lock);
+		feci->stats.driver_fail = 0;			/* Reset */
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * Release the ref take, SFE driver did not accept our command.
+	 */
+	ecm_db_connection_deref(feci->ci);
+
+	/*
+	 * TX failed
+	 */
+	spin_lock_bh(&feci->lock);
+	feci->stats.driver_fail_total++;
+	feci->stats.driver_fail++;
+	if (feci->stats.driver_fail >= feci->stats.driver_fail_limit) {
+		DEBUG_WARN("%p: Decel failed - driver fail limit\n", nnpci);
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DRIVER;
+	}
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Could not send the request, decrement the decel pending counter
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	ecm_sfe_ipv4_pending_decel_count--;
+	DEBUG_ASSERT(ecm_sfe_ipv4_pending_decel_count >= 0, "Bad decel pending counter\n");
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+}
+
+/*
+ * ecm_sfe_non_ported_ipv4_connection_defunct_callback()
+ *	Callback to be called when a non-ported connection has become defunct.
+ */
+static void ecm_sfe_non_ported_ipv4_connection_defunct_callback(void *arg)
+{
+	struct ecm_front_end_connection_instance *feci = (struct ecm_front_end_connection_instance *)arg;
+	struct ecm_sfe_non_ported_ipv4_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv4_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	spin_lock_bh(&feci->lock);
+
+	/*
+	 * If connection has already become defunct, do nothing.
+	 */
+	if (feci->is_defunct) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+	feci->is_defunct = true;
+
+	/*
+	 * If the connection is already in one of the fail modes, do nothing, keep the current accel_mode.
+	 */
+	if (ECM_FRONT_END_ACCELERATION_FAILED(feci->accel_mode)) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If the connection is decel then ensure it will not attempt accel while defunct.
+	 */
+	if (feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_DECEL) {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DEFUNCT;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If the connection is decel pending then decel operation is in progress anyway.
+	 */
+	if (feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_DECEL_PENDING) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If none of the cases matched above, this means the connection is in one of the
+	 * accel modes (accel or accel_pending) so we force a deceleration.
+	 * NOTE: If the mode is accel pending then the decel will be actioned when that is completed.
+	 */
+	spin_unlock_bh(&feci->lock);
+	ecm_sfe_non_ported_ipv4_connection_decelerate(feci);
+}
+
+/*
+ * ecm_sfe_non_ported_ipv4_connection_accel_state_get()
+ *	Get acceleration state
+ */
+static ecm_front_end_acceleration_mode_t ecm_sfe_non_ported_ipv4_connection_accel_state_get(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_non_ported_ipv4_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv4_connection_instance *)feci;
+	ecm_front_end_acceleration_mode_t state;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+	spin_lock_bh(&feci->lock);
+	state = feci->accel_mode;
+	spin_unlock_bh(&feci->lock);
+	return state;
+}
+
+/*
+ * ecm_sfe_non_ported_ipv4_connection_action_seen()
+ *	Acceleration action / activity has been seen for this connection.
+ *
+ * NOTE: Call the action_seen() method when the SFE has demonstrated that it has offloaded some data for a connection.
+ */
+static void ecm_sfe_non_ported_ipv4_connection_action_seen(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_non_ported_ipv4_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv4_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+	DEBUG_INFO("%p: Action seen\n", nnpci);
+	spin_lock_bh(&feci->lock);
+	feci->stats.no_action_seen = 0;
+	spin_unlock_bh(&feci->lock);
+}
+
+/*
+ * ecm_sfe_non_ported_ipv4_connection_accel_ceased()
+ *	SFE has indicated that acceleration has stopped.
+ *
+ * NOTE: This is called in response to an SFE self-initiated termination of acceleration.
+ * This must NOT be called because the ECM terminated the acceleration.
+ */
+static void ecm_sfe_non_ported_ipv4_connection_accel_ceased(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_non_ported_ipv4_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv4_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	DEBUG_INFO("%p: accel ceased\n", nnpci);
+
+	spin_lock_bh(&feci->lock);
+
+	/*
+	 * If we are in accel-pending state then the SFE has issued a flush out-of-order
+	 * with the ACK/NACK we are actually waiting for.
+	 * To work around this we record a "flush has already happened" and will action it when we finally get that ACK/NACK.
+	 * GGG TODO This should eventually be removed when the SFE honours messaging sequence.
+	 */
+	if (feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING) {
+		feci->stats.flush_happened = true;
+		feci->stats.flush_happened_total++;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If connection is no longer accelerated by the time we get here just ignore the command
+	 */
+	if (feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_ACCEL) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If the no_action_seen counter was not reset then acceleration ended without any offload action
+	 */
+	if (feci->stats.no_action_seen) {
+		feci->stats.no_action_seen_total++;
+	}
+
+	/*
+	 * If the no_action_seen indicates successive cessations of acceleration without any offload action occuring
+	 * then we fail out this connection
+	 */
+	if (feci->stats.no_action_seen >= feci->stats.no_action_seen_limit) {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_NO_ACTION;
+	} else {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL;
+	}
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Non-Ported acceleration ends
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	ecm_sfe_non_ported_ipv4_accelerated_count--;	/* Protocol specific counter */
+	DEBUG_ASSERT(ecm_sfe_non_ported_ipv4_accelerated_count >= 0, "Bad non-ported accel counter\n");
+	ecm_sfe_ipv4_accelerated_count--;		/* General running counter */
+	DEBUG_ASSERT(ecm_sfe_ipv4_accelerated_count >= 0, "Bad accel counter\n");
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+}
+
+/*
+ * ecm_sfe_non_ported_ipv4_connection_ref()
+ *	Ref a connection front end instance
+ */
+static void ecm_sfe_non_ported_ipv4_connection_ref(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_non_ported_ipv4_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv4_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+	spin_lock_bh(&feci->lock);
+	feci->refs++;
+	DEBUG_TRACE("%p: nnpci ref %d\n", nnpci, feci->refs);
+	DEBUG_ASSERT(feci->refs > 0, "%p: ref wrap\n", nnpci);
+	spin_unlock_bh(&feci->lock);
+}
+
+/*
+ * ecm_sfe_non_ported_ipv4_connection_deref()
+ *	Deref a connection front end instance
+ */
+static int ecm_sfe_non_ported_ipv4_connection_deref(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_non_ported_ipv4_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv4_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	spin_lock_bh(&feci->lock);
+	feci->refs--;
+	DEBUG_ASSERT(feci->refs >= 0, "%p: ref wrap\n", nnpci);
+
+	if (feci->refs > 0) {
+		int refs = feci->refs;
+		spin_unlock_bh(&feci->lock);
+		DEBUG_TRACE("%p: nnpci deref %d\n", nnpci, refs);
+		return refs;
+	}
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * We can now destroy the instance
+	 */
+	DEBUG_TRACE("%p: nnpci final\n", nnpci);
+	DEBUG_CLEAR_MAGIC(nnpci);
+	kfree(nnpci);
+
+	return 0;
+}
+
+#ifdef ECM_STATE_OUTPUT_ENABLE
+/*
+ * ecm_sfe_non_ported_ipv4_connection_state_get()
+ *	Return the state of this Non ported front end instance
+ */
+static int ecm_sfe_non_ported_ipv4_connection_state_get(struct ecm_front_end_connection_instance *feci, struct ecm_state_file_instance *sfi)
+{
+	int result;
+	bool can_accel;
+	ecm_front_end_acceleration_mode_t accel_mode;
+	struct ecm_front_end_connection_mode_stats stats;
+	struct ecm_sfe_non_ported_ipv4_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv4_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	spin_lock_bh(&feci->lock);
+	can_accel = feci->can_accel;
+	accel_mode = feci->accel_mode;
+	memcpy(&stats, &feci->stats, sizeof(struct ecm_front_end_connection_mode_stats));
+	spin_unlock_bh(&feci->lock);
+
+	if ((result = ecm_state_prefix_add(sfi, "front_end_v4.non_ported"))) {
+		return result;
+	}
+
+	if ((result = ecm_state_write(sfi, "can_accel", "%d", can_accel))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "accel_mode", "%d", accel_mode))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "decelerate_pending", "%d", stats.decelerate_pending))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "flush_happened_total", "%d", stats.flush_happened_total))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "no_action_seen_total", "%d", stats.no_action_seen_total))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "no_action_seen", "%d", stats.no_action_seen))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "no_action_seen_limit", "%d", stats.no_action_seen_limit))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "driver_fail_total", "%d", stats.driver_fail_total))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "driver_fail", "%d", stats.driver_fail))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "driver_fail_limit", "%d", stats.driver_fail_limit))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "ae_nack_total", "%d", stats.ae_nack_total))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "ae_nack", "%d", stats.ae_nack))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "ae_nack_limit", "%d", stats.ae_nack_limit))) {
+		return result;
+	}
+
+ 	return ecm_state_prefix_remove(sfi);
+}
+#endif
+
+/*
+ * ecm_sfe_non_ported_ipv4_connection_instance_alloc()
+ *	Create a front end instance specific for non-ported connection
+ */
+static struct ecm_sfe_non_ported_ipv4_connection_instance *ecm_sfe_non_ported_ipv4_connection_instance_alloc(
+								struct ecm_db_connection_instance *ci,
+								bool can_accel)
+{
+	struct ecm_sfe_non_ported_ipv4_connection_instance *nnpci;
+	struct ecm_front_end_connection_instance *feci;
+
+	nnpci = (struct ecm_sfe_non_ported_ipv4_connection_instance *)kzalloc(sizeof(struct ecm_sfe_non_ported_ipv4_connection_instance), GFP_ATOMIC | __GFP_NOWARN);
+	if (!nnpci) {
+		DEBUG_WARN("Non-Ported Front end alloc failed\n");
+		return NULL;
+	}
+
+	/*
+	 * Refs is 1 for the creator of the connection
+	 */
+	feci = (struct ecm_front_end_connection_instance *)nnpci;
+	feci->refs = 1;
+	DEBUG_SET_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC);
+	spin_lock_init(&feci->lock);
+
+	feci->can_accel = can_accel;
+	feci->accel_mode = (can_accel)? ECM_FRONT_END_ACCELERATION_MODE_DECEL : ECM_FRONT_END_ACCELERATION_MODE_FAIL_DENIED;
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	feci->stats.no_action_seen_limit = ecm_sfe_ipv4_no_action_limit_default;
+	feci->stats.driver_fail_limit = ecm_sfe_ipv4_driver_fail_limit_default;
+	feci->stats.ae_nack_limit = ecm_sfe_ipv4_nack_limit_default;
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	/*
+	 * Copy reference to connection - no need to ref ci as ci maintains a ref to this instance instead (this instance persists for as long as ci does)
+	 */
+	feci->ci = ci;
+
+	/*
+	 * Populate the methods and callbacks
+	 */
+	feci->ref = ecm_sfe_non_ported_ipv4_connection_ref;
+	feci->deref = ecm_sfe_non_ported_ipv4_connection_deref;
+	feci->decelerate = ecm_sfe_non_ported_ipv4_connection_decelerate;
+	feci->accel_state_get = ecm_sfe_non_ported_ipv4_connection_accel_state_get;
+	feci->action_seen = ecm_sfe_non_ported_ipv4_connection_action_seen;
+	feci->accel_ceased = ecm_sfe_non_ported_ipv4_connection_accel_ceased;
+#ifdef ECM_STATE_OUTPUT_ENABLE
+	feci->state_get = ecm_sfe_non_ported_ipv4_connection_state_get;
+#endif
+	feci->ae_interface_number_by_dev_get = ecm_sfe_common_get_interface_number_by_dev;
+
+	return nnpci;
+}
+
+/*
+ * ecm_sfe_non_ported_ipv4_process()
+ *	Process a protocol that does not have port based identifiers
+ */
+unsigned int ecm_sfe_non_ported_ipv4_process(struct net_device *out_dev, struct net_device *out_dev_nat,
+							struct net_device *in_dev, struct net_device *in_dev_nat,
+							uint8_t *src_node_addr, uint8_t *src_node_addr_nat,
+							uint8_t *dest_node_addr, uint8_t *dest_node_addr_nat,
+							bool can_accel, bool is_routed, bool is_l2_encap, struct sk_buff *skb,
+							struct ecm_tracker_ip_header *ip_hdr,
+							struct nf_conn *ct, ecm_tracker_sender_type_t sender, ecm_db_direction_t ecm_dir,
+							struct nf_conntrack_tuple *orig_tuple, struct nf_conntrack_tuple *reply_tuple,
+							ip_addr_t ip_src_addr, ip_addr_t ip_dest_addr, ip_addr_t ip_src_addr_nat, ip_addr_t ip_dest_addr_nat)
+{
+	struct ecm_db_connection_instance *ci;
+	int protocol;
+	int src_port;
+	int src_port_nat;
+	int dest_port;
+	int dest_port_nat;
+	ip_addr_t match_addr;
+	struct ecm_classifier_instance *assignments[ECM_CLASSIFIER_TYPES];
+	int aci_index;
+	int assignment_count;
+	ecm_db_timer_group_t ci_orig_timer_group;
+	struct ecm_classifier_process_response prevalent_pr;
+
+	DEBUG_TRACE("Non-ported protocol src: " ECM_IP_ADDR_DOT_FMT ", dest: " ECM_IP_ADDR_DOT_FMT "\n",
+				ECM_IP_ADDR_TO_DOT(ip_src_addr), ECM_IP_ADDR_TO_DOT(ip_dest_addr));
+
+	/*
+	 * Look up a connection.
+	 */
+	protocol = (int)orig_tuple->dst.protonum;
+	if ((protocol == IPPROTO_IPV6) || (protocol == IPPROTO_ESP)) {
+		src_port = 0;
+		src_port_nat = 0;
+		dest_port = 0;
+		dest_port_nat = 0;
+	} else {
+		/*
+		 * Do not accelerate the non-ported connections except the ones we handle.
+		 */
+		can_accel = false;
+
+		/*
+		 * port numbers are just the negative protocol number equivalents for now.
+		 * GGG They could eventually be used as protocol specific identifiers such as icmp id's etc.
+		 */
+		src_port = -protocol;
+		src_port_nat = -protocol;
+		dest_port = -protocol;
+		dest_port_nat = -protocol;
+	}
+	ci = ecm_db_connection_find_and_ref(ip_src_addr, ip_dest_addr, protocol, src_port, dest_port);
+
+	/*
+	 * If there is no existing connection then create a new one.
+	 */
+	if (unlikely(!ci)) {
+		struct ecm_db_mapping_instance *src_mi;
+		struct ecm_db_mapping_instance *dest_mi;
+		struct ecm_db_mapping_instance *src_nat_mi;
+		struct ecm_db_mapping_instance *dest_nat_mi;
+		struct ecm_db_node_instance *src_ni;
+		struct ecm_db_node_instance *dest_ni;
+		struct ecm_db_node_instance *src_nat_ni;
+		struct ecm_db_node_instance *dest_nat_ni;
+		struct ecm_classifier_default_instance *dci;
+		struct ecm_front_end_connection_instance *feci;
+		struct ecm_db_connection_instance *nci;
+		ecm_classifier_type_t classifier_type;
+		int32_t to_list_first;
+		struct ecm_db_iface_instance *to_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+		int32_t to_nat_list_first;
+		struct ecm_db_iface_instance *to_nat_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+		int32_t from_list_first;
+		struct ecm_db_iface_instance *from_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+		int32_t from_nat_list_first;
+		struct ecm_db_iface_instance *from_nat_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+
+		DEBUG_INFO("New connection from " ECM_IP_ADDR_DOT_FMT " to " ECM_IP_ADDR_DOT_FMT "\n",
+					ECM_IP_ADDR_TO_DOT(ip_src_addr), ECM_IP_ADDR_TO_DOT(ip_dest_addr));
+
+		/*
+		 * Before we attempt to create the connection are we being terminated?
+		 */
+		spin_lock_bh(&ecm_sfe_ipv4_lock);
+		if (ecm_sfe_ipv4_terminate_pending) {
+			spin_unlock_bh(&ecm_sfe_ipv4_lock);
+			DEBUG_WARN("Terminating\n");
+
+			/*
+			 * As we are terminating we just allow the packet to pass - it's no longer our concern
+			 */
+			return NF_ACCEPT;
+		}
+		spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+		/*
+		 * Does this connection have a conntrack entry?
+		 */
+		if (ct) {
+			unsigned int conn_count;
+
+			/*
+			 * If we have exceeded the connection limit (according to conntrack) then abort
+			 * NOTE: Conntrack, when at its limit, will destroy a connection to make way for a new.
+			 * Conntrack won't exceed its limit but ECM can due to it needing to hold connections while
+			 * acceleration commands are in-flight.
+			 * This means that ECM can 'fall behind' somewhat with the connection state wrt conntrack connection state.
+			 * This is not seen as an issue since conntrack will have issued us with a destroy event for the flushed connection(s)
+			 * and we will eventually catch up.
+			 * Since ECM is capable of handling connections mid-flow ECM will pick up where it can.
+			 */
+			conn_count = (unsigned int)ecm_db_connection_count_get();
+			if (conn_count >= nf_conntrack_max) {
+				DEBUG_WARN("ECM Connection count limit reached: db: %u, ct: %u\n", conn_count, nf_conntrack_max);
+				return NF_ACCEPT;
+			}
+		}
+
+		/*
+		 * Now allocate the new connection
+		 */
+		nci = ecm_db_connection_alloc();
+		if (!nci) {
+			DEBUG_WARN("Failed to allocate connection\n");
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Connection must have a front end instance associated with it
+		 */
+		feci = (struct ecm_front_end_connection_instance *)ecm_sfe_non_ported_ipv4_connection_instance_alloc(nci, can_accel);
+		if (!feci) {
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to allocate front end\n");
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Get the src and destination mappings.
+		 * For this we also need the interface lists which we also set upon the new connection while we are at it.
+		 * GGG TODO rework terms of "src/dest" - these need to be named consistently as from/to as per database terms.
+		 * GGG TODO The empty list checks should not be needed, mapping_establish_and_ref() should fail out if there is no list anyway.
+		 */
+		DEBUG_TRACE("%p: Create the 'from' interface heirarchy list\n", nci);
+		from_list_first = ecm_interface_heirarchy_construct(feci, from_list, ip_dest_addr, ip_src_addr, 4, protocol, in_dev, is_routed, in_dev, src_node_addr, dest_node_addr);
+		if (from_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to obtain 'from' heirarchy list\n");
+			return NF_ACCEPT;
+		}
+		ecm_db_connection_from_interfaces_reset(nci, from_list, from_list_first);
+
+		DEBUG_TRACE("%p: Create source node\n", nci);
+		src_ni = ecm_sfe_ipv4_node_establish_and_ref(feci, in_dev, ip_src_addr, from_list, from_list_first, src_node_addr);
+		ecm_db_connection_interfaces_deref(from_list, from_list_first);
+		if (!src_ni) {
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish source node\n");
+			return NF_ACCEPT;
+		}
+
+		DEBUG_TRACE("%p: Create source mapping\n", nci);
+		src_mi = ecm_sfe_ipv4_mapping_establish_and_ref(ip_src_addr, src_port);
+		if (!src_mi) {
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish src mapping\n");
+			return NF_ACCEPT;
+		}
+
+		DEBUG_TRACE("%p: Create the 'to' interface heirarchy list\n", nci);
+		to_list_first = ecm_interface_heirarchy_construct(feci, to_list, ip_src_addr, ip_dest_addr, 4, protocol, out_dev, is_routed, in_dev, dest_node_addr, src_node_addr);
+		if (to_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to obtain 'to' heirarchy list\n");
+			return NF_ACCEPT;
+		}
+		ecm_db_connection_to_interfaces_reset(nci, to_list, to_list_first);
+
+		DEBUG_TRACE("%p: Create dest node\n", nci);
+		dest_ni = ecm_sfe_ipv4_node_establish_and_ref(feci, out_dev, ip_dest_addr, to_list, to_list_first, dest_node_addr);
+		ecm_db_connection_interfaces_deref(to_list, to_list_first);
+		if (!dest_ni) {
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish dest node\n");
+			return NF_ACCEPT;
+		}
+
+		DEBUG_TRACE("%p: Create dest mapping\n", nci);
+		dest_mi = ecm_sfe_ipv4_mapping_establish_and_ref(ip_dest_addr, dest_port);
+		if (!dest_mi) {
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish dest mapping\n");
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Get the src and destination NAT mappings
+		 * For this we also need the interface lists which we also set upon the new connection while we are at it.
+		 * GGG TODO rework terms of "src/dest" - these need to be named consistently as from/to as per database terms.
+		 * GGG TODO The empty list checks should not be needed, mapping_establish_and_ref() should fail out if there is no list anyway.
+		 */
+
+		/*
+		 * NOTE: For SIT tunnels use the in_dev instead of in_dev_nat
+		 */
+		DEBUG_TRACE("%p: Create the 'from NAT' interface heirarchy list\n", nci);
+		if ((protocol == IPPROTO_IPV6) || (protocol == IPPROTO_ESP)) {
+			from_nat_list_first = ecm_interface_heirarchy_construct(feci, from_nat_list, ip_dest_addr, ip_src_addr_nat, 4, protocol, in_dev, is_routed, in_dev, src_node_addr_nat, dest_node_addr_nat);
+		} else {
+			from_nat_list_first = ecm_interface_heirarchy_construct(feci, from_nat_list, ip_dest_addr, ip_src_addr_nat, 4, protocol, in_dev_nat, is_routed, in_dev, src_node_addr_nat, dest_node_addr_nat);
+		}
+
+		if (from_nat_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+			ecm_db_mapping_deref(dest_mi);
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to obtain 'from NAT' heirarchy list\n");
+			return NF_ACCEPT;
+		}
+		ecm_db_connection_from_nat_interfaces_reset(nci, from_nat_list, from_nat_list_first);
+
+		DEBUG_TRACE("%p: Create source nat node\n", nci);
+		src_nat_ni = ecm_sfe_ipv4_node_establish_and_ref(feci, in_dev_nat, ip_src_addr_nat, from_nat_list, from_nat_list_first, src_node_addr_nat);
+		ecm_db_connection_interfaces_deref(from_nat_list, from_nat_list_first);
+		if (!src_nat_ni) {
+			ecm_db_mapping_deref(dest_mi);
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish source nat node\n");
+			return NF_ACCEPT;
+		}
+
+		src_nat_mi = ecm_sfe_ipv4_mapping_establish_and_ref(ip_src_addr_nat, src_port_nat);
+		if (!src_nat_mi) {
+			ecm_db_node_deref(src_nat_ni);
+			ecm_db_mapping_deref(dest_mi);
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish src nat mapping\n");
+			return NF_ACCEPT;
+		}
+
+		DEBUG_TRACE("%p: Create the 'to NAT' interface heirarchy list\n", nci);
+		to_nat_list_first = ecm_interface_heirarchy_construct(feci, to_nat_list, ip_src_addr, ip_dest_addr_nat, 4, protocol, out_dev_nat, is_routed, in_dev, dest_node_addr_nat, src_node_addr_nat);
+		if (to_nat_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+			ecm_db_mapping_deref(src_nat_mi);
+			ecm_db_node_deref(src_nat_ni);
+			ecm_db_mapping_deref(dest_mi);
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to obtain 'to NAT' heirarchy list\n");
+			return NF_ACCEPT;
+		}
+		ecm_db_connection_to_nat_interfaces_reset(nci, to_nat_list, to_nat_list_first);
+
+		DEBUG_TRACE("%p: Create dest nat node\n", nci);
+		dest_nat_ni = ecm_sfe_ipv4_node_establish_and_ref(feci, out_dev_nat, ip_dest_addr_nat, to_nat_list, to_nat_list_first, dest_node_addr_nat);
+		ecm_db_connection_interfaces_deref(to_nat_list, to_nat_list_first);
+		if (!dest_nat_ni) {
+			ecm_db_mapping_deref(src_nat_mi);
+			ecm_db_node_deref(src_nat_ni);
+			ecm_db_mapping_deref(dest_mi);
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish dest nat node\n");
+			return NF_ACCEPT;
+		}
+
+		dest_nat_mi = ecm_sfe_ipv4_mapping_establish_and_ref(ip_dest_addr_nat, dest_port_nat);
+		if (!dest_nat_mi) {
+			ecm_db_node_deref(dest_nat_ni);
+			ecm_db_mapping_deref(src_nat_mi);
+			ecm_db_node_deref(src_nat_ni);
+			ecm_db_mapping_deref(dest_mi);
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish dest mapping\n");
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Every connection also needs a default classifier
+		 */
+		dci = ecm_classifier_default_instance_alloc(nci, protocol, ecm_dir, src_port, dest_port);
+		if (!dci) {
+			feci->deref(feci);
+			ecm_db_mapping_deref(dest_nat_mi);
+			ecm_db_node_deref(dest_nat_ni);
+			ecm_db_mapping_deref(src_nat_mi);
+			ecm_db_node_deref(src_nat_ni);
+			ecm_db_mapping_deref(dest_mi);
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to allocate default classifier\n");
+			return NF_ACCEPT;
+		}
+		ecm_db_connection_classifier_assign(nci, (struct ecm_classifier_instance *)dci);
+
+		/*
+		 * Every connection starts with a full complement of classifiers assigned.
+		 * NOTE: Default classifier is a special case considered previously
+		 */
+		for (classifier_type = ECM_CLASSIFIER_TYPE_DEFAULT + 1; classifier_type < ECM_CLASSIFIER_TYPES; ++classifier_type) {
+			struct ecm_classifier_instance *aci = ecm_sfe_ipv4_assign_classifier(nci, classifier_type);
+			if (aci) {
+				aci->deref(aci);
+			} else {
+				dci->base.deref((struct ecm_classifier_instance *)dci);
+				feci->deref(feci);
+				ecm_db_mapping_deref(dest_nat_mi);
+				ecm_db_node_deref(dest_nat_ni);
+				ecm_db_mapping_deref(src_nat_mi);
+				ecm_db_node_deref(src_nat_ni);
+				ecm_db_mapping_deref(dest_mi);
+				ecm_db_node_deref(dest_ni);
+				ecm_db_mapping_deref(src_mi);
+				ecm_db_node_deref(src_ni);
+				feci->deref(feci);
+				ecm_db_connection_deref(nci);
+				DEBUG_WARN("Failed to allocate classifiers assignments\n");
+				return NF_ACCEPT;
+			}
+		}
+
+		/*
+		 * Now add the connection into the database.
+		 * NOTE: In an SMP situation such as ours there is a possibility that more than one packet for the same
+		 * connection is being processed simultaneously.
+		 * We *could* end up creating more than one connection instance for the same actual connection.
+		 * To guard against this we now perform a mutex'd lookup of the connection + add once more - another cpu may have created it before us.
+		 */
+		spin_lock_bh(&ecm_sfe_ipv4_lock);
+		ci = ecm_db_connection_find_and_ref(ip_src_addr, ip_dest_addr, protocol, src_port, dest_port);
+		if (ci) {
+			/*
+			 * Another cpu created the same connection before us - use the one we just found
+			 */
+			spin_unlock_bh(&ecm_sfe_ipv4_lock);
+			ecm_db_connection_deref(nci);
+		} else {
+			struct ecm_tracker_instance *ti;
+			ecm_db_timer_group_t tg;
+			ecm_tracker_sender_state_t src_state;
+			ecm_tracker_sender_state_t dest_state;
+			ecm_tracker_connection_state_t state;
+
+			/*
+			 * Ask tracker for timer group to set the connection to initially.
+			 */
+			ti = dci->tracker_get_and_ref(dci);
+			ti->state_get(ti, &src_state, &dest_state, &state, &tg);
+			ti->deref(ti);
+
+			/*
+			 * Add the new connection we created into the database
+			 * NOTE: assign to a short timer group for now - it is the assigned classifiers responsibility to do this
+			 */
+			ecm_db_connection_add(nci, feci, src_mi, dest_mi, src_nat_mi, dest_nat_mi,
+					src_ni, dest_ni, src_nat_ni, dest_nat_ni,
+					4, protocol, ecm_dir,
+					NULL /* final callback */,
+					ecm_sfe_non_ported_ipv4_connection_defunct_callback,
+					tg, is_routed, nci);
+
+			spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+			ci = nci;
+			DEBUG_INFO("%p: New Non-ported protocol %d connection created\n", ci, protocol);
+		}
+
+		/*
+		 * No longer need referenecs to the objects we created
+		 */
+		dci->base.deref((struct ecm_classifier_instance *)dci);
+		ecm_db_mapping_deref(dest_nat_mi);
+		ecm_db_node_deref(dest_nat_ni);
+		ecm_db_mapping_deref(src_nat_mi);
+		ecm_db_node_deref(src_nat_ni);
+		ecm_db_mapping_deref(dest_mi);
+		ecm_db_node_deref(dest_ni);
+		ecm_db_mapping_deref(src_mi);
+		ecm_db_node_deref(src_ni);
+		feci->deref(feci);
+	}
+
+	/*
+	 * Keep connection alive as we have seen activity
+	 */
+	if (!ecm_db_connection_defunct_timer_touch(ci)) {
+		ecm_db_connection_deref(ci);
+		return NF_ACCEPT;
+	}
+
+	/*
+	 * Identify which side of the connection is sending.
+	 * NOTE: This may be different than what sender is at the moment
+	 * given the connection we have located.
+	 */
+	ecm_db_connection_from_address_get(ci, match_addr);
+	if (ECM_IP_ADDR_MATCH(ip_src_addr, match_addr)) {
+		sender = ECM_TRACKER_SENDER_TYPE_SRC;
+	} else {
+		sender = ECM_TRACKER_SENDER_TYPE_DEST;
+	}
+
+	/*
+	 * Do we need to action generation change?
+	 */
+	if (unlikely(ecm_db_connection_regeneration_required_check(ci))) {
+		ecm_sfe_ipv4_connection_regenerate(ci, sender, out_dev, out_dev_nat, in_dev, in_dev_nat);
+	}
+
+	/*
+	 * Iterate the assignments and call to process!
+	 * Policy implemented:
+	 * 1. Classifiers that say they are not relevant are unassigned and not actioned further.
+	 * 2. Any drop command from any classifier is honoured.
+	 * 3. Accel is never allowed for non-ported type connections.
+	 * 4. Only the highest priority classifier, that actions it, will have its qos tag honoured.
+	 * 5. Only the highest priority classifier, that actions it, will have its timer group honoured.
+	 */
+	DEBUG_TRACE("%p: process begin, skb: %p\n", ci, skb);
+	prevalent_pr.process_actions = 0;
+	prevalent_pr.drop = false;
+	prevalent_pr.flow_qos_tag = skb->priority;
+	prevalent_pr.return_qos_tag = skb->priority;
+	prevalent_pr.accel_mode = ECM_CLASSIFIER_ACCELERATION_MODE_ACCEL;
+	prevalent_pr.timer_group = ci_orig_timer_group = ecm_db_connection_timer_group_get(ci);
+
+	assignment_count = ecm_db_connection_classifier_assignments_get_and_ref(ci, assignments);
+	for (aci_index = 0; aci_index < assignment_count; ++aci_index) {
+		struct ecm_classifier_process_response aci_pr;
+		struct ecm_classifier_instance *aci;
+
+		aci = assignments[aci_index];
+		DEBUG_TRACE("%p: process: %p, type: %d\n", ci, aci, aci->type_get(aci));
+		aci->process(aci, sender, ip_hdr, skb, &aci_pr);
+		DEBUG_TRACE("%p: aci_pr: process actions: %x, became relevant: %u, relevance: %d, drop: %d, "
+				"flow_qos_tag: %u, return_qos_tag: %u, accel_mode: %x, timer_group: %d\n",
+				ci, aci_pr.process_actions, aci_pr.became_relevant, aci_pr.relevance, aci_pr.drop,
+				aci_pr.flow_qos_tag, aci_pr.return_qos_tag, aci_pr.accel_mode, aci_pr.timer_group);
+
+		if (aci_pr.relevance == ECM_CLASSIFIER_RELEVANCE_NO) {
+			ecm_classifier_type_t aci_type;
+
+			/*
+			 * This classifier can be unassigned - PROVIDED it is not the default classifier
+			 */
+			aci_type = aci->type_get(aci);
+			if (aci_type == ECM_CLASSIFIER_TYPE_DEFAULT) {
+				continue;
+			}
+
+			DEBUG_INFO("%p: Classifier not relevant, unassign: %d", ci, aci_type);
+			ecm_db_connection_classifier_unassign(ci, aci);
+			continue;
+		}
+
+		/*
+		 * Yes or Maybe relevant.
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DROP) {
+			/*
+			 * Drop command from any classifier is actioned.
+			 */
+			DEBUG_TRACE("%p: wants drop: %p, type: %d, skb: %p\n", ci, aci, aci->type_get(aci), skb);
+			prevalent_pr.drop |= aci_pr.drop;
+		}
+
+		/*
+		 * Accel mode permission
+		 */
+		if (aci_pr.relevance == ECM_CLASSIFIER_RELEVANCE_MAYBE) {
+			/*
+			 * Classifier not sure of its relevance - cannot accel yet
+			 */
+			DEBUG_TRACE("%p: accel denied by maybe: %p, type: %d\n", ci, aci, aci->type_get(aci));
+			prevalent_pr.accel_mode = ECM_CLASSIFIER_ACCELERATION_MODE_NO;
+		} else {
+			if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_ACCEL_MODE) {
+				if (aci_pr.accel_mode == ECM_CLASSIFIER_ACCELERATION_MODE_NO) {
+					DEBUG_TRACE("%p: accel denied: %p, type: %d\n", ci, aci, aci->type_get(aci));
+					prevalent_pr.accel_mode = ECM_CLASSIFIER_ACCELERATION_MODE_NO;
+				}
+				/* else yes or don't care about accel */
+			}
+		}
+
+		/*
+		 * Timer group (the last classifier i.e. the highest priority one) will 'win'
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_TIMER_GROUP) {
+			DEBUG_TRACE("%p: timer group: %p, type: %d, group: %d\n", ci, aci, aci->type_get(aci), aci_pr.timer_group);
+			prevalent_pr.timer_group = aci_pr.timer_group;
+		}
+
+		/*
+		 * Qos tag (the last classifier i.e. the highest priority one) will 'win'
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_QOS_TAG) {
+			DEBUG_TRACE("%p: aci: %p, type: %d, flow qos tag: %u, return qos tag: %u\n",
+					ci, aci, aci->type_get(aci), aci_pr.flow_qos_tag, aci_pr.return_qos_tag);
+			prevalent_pr.flow_qos_tag = aci_pr.flow_qos_tag;
+			prevalent_pr.return_qos_tag = aci_pr.return_qos_tag;
+		}
+
+#ifdef ECM_CLASSIFIER_DSCP_ENABLE
+		/*
+		 * If any classifier denied DSCP remarking then that overrides every classifier
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DSCP_DENY) {
+			DEBUG_TRACE("%p: aci: %p, type: %d, DSCP remark denied\n",
+					ci, aci, aci->type_get(aci));
+			prevalent_pr.process_actions |= ECM_CLASSIFIER_PROCESS_ACTION_DSCP_DENY;
+			prevalent_pr.process_actions &= ~ECM_CLASSIFIER_PROCESS_ACTION_DSCP;
+		}
+
+		/*
+		 * DSCP remark action, but only if it has not been denied by any classifier
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DSCP) {
+			if (!(prevalent_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DSCP_DENY)) {
+				DEBUG_TRACE("%p: aci: %p, type: %d, DSCP remark wanted, flow_dscp: %u, return dscp: %u\n",
+						ci, aci, aci->type_get(aci), aci_pr.flow_dscp, aci_pr.return_dscp);
+				prevalent_pr.process_actions |= ECM_CLASSIFIER_PROCESS_ACTION_DSCP;
+				prevalent_pr.flow_dscp = aci_pr.flow_dscp;
+				prevalent_pr.return_dscp = aci_pr.return_dscp;
+			}
+		}
+#endif
+	}
+	ecm_db_connection_assignments_release(assignment_count, assignments);
+
+	/*
+	 * Change timer group?
+	 */
+	if (ci_orig_timer_group != prevalent_pr.timer_group) {
+		DEBUG_TRACE("%p: change timer group from: %d to: %d\n", ci, ci_orig_timer_group, prevalent_pr.timer_group);
+		ecm_db_connection_defunct_timer_reset(ci, prevalent_pr.timer_group);
+	}
+
+	/*
+	 * Drop?
+	 */
+	if (prevalent_pr.drop) {
+		DEBUG_TRACE("%p: drop: %p\n", ci, skb);
+		ecm_db_connection_data_totals_update_dropped(ci, (sender == ECM_TRACKER_SENDER_TYPE_SRC)? true : false, skb->len, 1);
+		ecm_db_connection_deref(ci);
+		return NF_ACCEPT;
+	}
+	ecm_db_connection_data_totals_update(ci, (sender == ECM_TRACKER_SENDER_TYPE_SRC)? true : false, skb->len, 1);
+
+	/*
+	 * Assign qos tag
+	 * GGG TODO Should we use sender to identify whether to use flow or return qos tag?
+	 */
+	skb->priority = prevalent_pr.flow_qos_tag;
+	DEBUG_TRACE("%p: skb priority: %u\n", ci, skb->priority);
+
+#ifdef ECM_INTERFACE_SIT_ENABLE
+#ifdef CONFIG_IPV6_SIT_6RD
+	/*
+	 * SIT tunnel acceleration needs create a rule to the sfe firmware if the
+	 *	tunnel's dest ip address is empty,it will get dest ip and the embedded ipv6's dest ip
+	 *	address in the packet and send them to the sfe firmware to accelerate the
+	 *	traffic on the tun6rd interface.
+	 */
+	if (protocol == IPPROTO_IPV6
+			&& prevalent_pr.accel_mode == ECM_CLASSIFIER_ACCELERATION_MODE_ACCEL) {
+		struct ecm_front_end_connection_instance *feci;
+		DEBUG_TRACE("%p: accel\n", ci);
+		feci = ecm_db_connection_front_end_get_and_ref(ci);
+		ecm_sfe_non_ported_ipv4_sit_set_peer((struct ecm_sfe_non_ported_ipv4_connection_instance *)feci, skb);
+		feci->deref(feci);
+	}
+#endif
+#endif
+	/*
+	 * Accelerate?
+	 */
+	if (prevalent_pr.accel_mode == ECM_CLASSIFIER_ACCELERATION_MODE_ACCEL) {
+		struct ecm_front_end_connection_instance *feci;
+		DEBUG_TRACE("%p: accel\n", ci);
+		feci = ecm_db_connection_front_end_get_and_ref(ci);
+		ecm_sfe_non_ported_ipv4_connection_accelerate(feci, is_l2_encap, &prevalent_pr);
+		feci->deref(feci);
+	}
+	ecm_db_connection_deref(ci);
+
+	return NF_ACCEPT;
+}
+
+/*
+ * ecm_sfe_non_ported_ipv4_debugfs_init()
+ */
+bool ecm_sfe_non_ported_ipv4_debugfs_init(struct dentry *dentry)
+{
+	if (!debugfs_create_u32("non_ported_accelerated_count", S_IRUGO, dentry,
+					(u32 *)&ecm_sfe_non_ported_ipv4_accelerated_count)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv4 non_ported_accelerated_count file in debugfs\n");
+		return false;
+	}
+
+	return true;
+}
diff --git a/frontends/sfe/ecm_sfe_non_ported_ipv4.h b/frontends/sfe/ecm_sfe_non_ported_ipv4.h
new file mode 100644
index 0000000..1f1c1f4
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_non_ported_ipv4.h
@@ -0,0 +1,27 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015, The Linux Foundation.  All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+extern unsigned int ecm_sfe_non_ported_ipv4_process(struct net_device *out_dev, struct net_device *out_dev_nat,
+							struct net_device *in_dev, struct net_device *in_dev_nat,
+							uint8_t *src_node_addr, uint8_t *src_node_addr_nat,
+							uint8_t *dest_node_addr, uint8_t *dest_node_addr_nat,
+							bool can_accel, bool is_routed, bool is_l2_encap, struct sk_buff *skb,
+							struct ecm_tracker_ip_header *ip_hdr,
+							struct nf_conn *ct, ecm_tracker_sender_type_t sender, ecm_db_direction_t ecm_dir,
+							struct nf_conntrack_tuple *orig_tuple, struct nf_conntrack_tuple *reply_tuple,
+							ip_addr_t ip_src_addr, ip_addr_t ip_dest_addr, ip_addr_t ip_src_addr_nat, ip_addr_t ip_dest_addr_nat);
+extern bool ecm_sfe_non_ported_ipv4_debugfs_init(struct dentry *dentry);
+
diff --git a/frontends/sfe/ecm_sfe_non_ported_ipv6.c b/frontends/sfe/ecm_sfe_non_ported_ipv6.c
new file mode 100644
index 0000000..30c3164
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_non_ported_ipv6.c
@@ -0,0 +1,2101 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015 The Linux Foundation.  All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+#include <linux/version.h>
+#include <linux/types.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/icmp.h>
+#include <linux/debugfs.h>
+#include <linux/kthread.h>
+#include <linux/pkt_sched.h>
+#include <linux/string.h>
+#include <net/ip6_route.h>
+#include <net/ip6_fib.h>
+#include <net/addrconf.h>
+#include <net/ipv6.h>
+#include <net/tcp.h>
+#include <asm/unaligned.h>
+#include <asm/uaccess.h>	/* for put_user */
+#include <net/ipv6.h>
+#include <linux/inet.h>
+#include <linux/in6.h>
+#include <linux/udp.h>
+#include <linux/tcp.h>
+#include <linux/inetdevice.h>
+#include <linux/if_arp.h>
+#include <linux/netfilter_ipv6.h>
+#include <linux/netfilter_bridge.h>
+#include <linux/if_bridge.h>
+#include <net/arp.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_acct.h>
+#include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_l4proto.h>
+#include <net/netfilter/nf_conntrack_l3proto.h>
+#include <net/netfilter/nf_conntrack_zones.h>
+#include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
+#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+#include <linux/../../net/8021q/vlan.h>
+#include <linux/if_vlan.h>
+#endif
+
+/*
+ * Debug output levels
+ * 0 = OFF
+ * 1 = ASSERTS / ERRORS
+ * 2 = 1 + WARN
+ * 3 = 2 + INFO
+ * 4 = 3 + TRACE
+ */
+#define DEBUG_LEVEL ECM_SFE_NON_PORTED_IPV6_DEBUG_LEVEL
+
+#include <sfe_drv.h>
+
+#include "ecm_types.h"
+#include "ecm_db_types.h"
+#include "ecm_state.h"
+#include "ecm_tracker.h"
+#include "ecm_classifier.h"
+#include "ecm_front_end_types.h"
+#include "ecm_tracker_datagram.h"
+#include "ecm_tracker_udp.h"
+#include "ecm_tracker_tcp.h"
+#include "ecm_db.h"
+#include "ecm_classifier_default.h"
+#include "ecm_interface.h"
+#include "ecm_sfe_non_ported_ipv6.h"
+#include "ecm_sfe_ipv6.h"
+#include "ecm_sfe_common.h"
+
+/*
+ * Magic numbers
+ */
+#define ECM_SFE_NON_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC 0xECBC
+
+/*
+ * struct ecm_sfe_non_ported_ipv6_connection_instance
+ *	A connection specific front end instance for Non-Ported connections
+ */
+struct ecm_sfe_non_ported_ipv6_connection_instance {
+	struct ecm_front_end_connection_instance base;		/* Base class */
+#if (DEBUG_LEVEL > 0)
+	uint16_t magic;
+#endif
+};
+
+static int ecm_sfe_non_ported_ipv6_accelerated_count = 0;		/* Number of Non-Ported connections currently offloaded */
+
+/*
+ * ecm_sfe_non_ported_ipv6_connection_callback()
+ *	Callback for handling create ack/nack calls.
+ */
+static void ecm_sfe_non_ported_ipv6_connection_callback(void *app_data, struct sfe_ipv6_msg *nim)
+{
+	struct sfe_ipv6_rule_create_msg *nircm = &nim->msg.rule_create;
+	uint32_t serial = (uint32_t)app_data;
+	struct ecm_db_connection_instance *ci;
+	struct ecm_front_end_connection_instance *feci;
+	struct ecm_sfe_non_ported_ipv6_connection_instance *nnpci;
+	ip_addr_t flow_ip;
+	ip_addr_t return_ip;
+	ecm_front_end_acceleration_mode_t result_mode;
+
+	/*
+	 * Is this a response to a create message?
+	 */
+	if (nim->cm.type != SFE_TX_CREATE_RULE_MSG) {
+		DEBUG_ERROR("%p: non_ported create callback with improper type: %d, serial: %u\n", nim, nim->cm.type, serial);
+		return;
+	}
+
+	/*
+	 * Look up ecm connection so that we can update the status.
+	 */
+	ci = ecm_db_connection_serial_find_and_ref(serial);
+	if (!ci) {
+		DEBUG_TRACE("%p: create callback, connection not found, serial: %u\n", nim, serial);
+		return;
+	}
+
+	/*
+	 * Release ref held for this ack/nack response.
+	 * NOTE: It's okay to do this here, ci won't go away, because the ci is held as
+	 * a result of the ecm_db_connection_serial_find_and_ref()
+	 */
+	ecm_db_connection_deref(ci);
+
+	/*
+	 * Get the front end instance
+	 */
+	feci = ecm_db_connection_front_end_get_and_ref(ci);
+	nnpci = (struct ecm_sfe_non_ported_ipv6_connection_instance *)feci;
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	ECM_SFE_IPV6_ADDR_TO_IP_ADDR(flow_ip, nircm->tuple.flow_ip);
+	ECM_SFE_IPV6_ADDR_TO_IP_ADDR(return_ip, nircm->tuple.return_ip);
+
+	/*
+	 * Record command duration
+	 */
+	ecm_sfe_ipv6_accel_done_time_update(feci);
+
+	/*
+	 * Dump some useful trace information.
+	 */
+	DEBUG_TRACE("%p: accelerate response for connection: %p, serial: %u\n", nnpci, feci->ci, serial);
+	DEBUG_TRACE("%p: rule_flags: %x, valid_flags: %x\n", nnpci, nircm->rule_flags, nircm->valid_flags);
+	DEBUG_TRACE("%p: flow_ip: " ECM_IP_ADDR_OCTAL_FMT ":%d\n", nnpci, ECM_IP_ADDR_TO_OCTAL(flow_ip), nircm->tuple.flow_ident);
+	DEBUG_TRACE("%p: return_ip: " ECM_IP_ADDR_OCTAL_FMT ":%d\n", nnpci, ECM_IP_ADDR_TO_OCTAL(return_ip), nircm->tuple.return_ident);
+	DEBUG_TRACE("%p: protocol: %d\n", nnpci, nircm->tuple.protocol);
+
+	/*
+	 * Handle the creation result code.
+	 */
+	DEBUG_TRACE("%p: response: %d\n", nnpci, nim->cm.response);
+	if (nim->cm.response != SFE_CMN_RESPONSE_ACK) {
+		/*
+		 * Creation command failed (specific reason ignored).
+		 */
+		DEBUG_TRACE("%p: accel nack: %d\n", nnpci, nim->cm.error);
+		spin_lock_bh(&feci->lock);
+		DEBUG_ASSERT(feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING, "%p: Unexpected mode: %d\n", ci, feci->accel_mode);
+		feci->stats.ae_nack++;
+		feci->stats.ae_nack_total++;
+		if (feci->stats.ae_nack >= feci->stats.ae_nack_limit) {
+			/*
+			 * Too many SFE rejections
+			 */
+			result_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_ACCEL_ENGINE;
+		} else {
+			/*
+			 * Revert to decelerated
+			 */
+			result_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL;
+		}
+
+		/*
+		 * TODO: Why is this differnt than IPv4?
+		 * Clear any decelerate pending flag since we aren't accelerated anyway we can just clear this whether it is set or not
+		 */
+		feci->stats.decelerate_pending = false;
+
+		/*
+		 * If connection is now defunct then set mode to ensure no further accel attempts occur
+		 */
+		if (feci->is_defunct) {
+			result_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DEFUNCT;
+		}
+
+		spin_lock_bh(&ecm_sfe_ipv6_lock);
+		_ecm_sfe_ipv6_accel_pending_clear(feci, result_mode);
+		spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+		spin_unlock_bh(&feci->lock);
+
+		/*
+		 * Release the connection.
+		 */
+		feci->deref(feci);
+		ecm_db_connection_deref(ci);
+		return;
+	}
+
+	spin_lock_bh(&feci->lock);
+	DEBUG_ASSERT(feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING, "%p: Unexpected mode: %d\n", ci, feci->accel_mode);
+
+	/*
+	 * If a flush occured before we got the ACK then our acceleration was effectively cancelled on us
+	 * GGG TODO This is a workaround for a SFE message OOO quirk, this should eventually be removed.
+	 */
+	if (feci->stats.flush_happened) {
+		feci->stats.flush_happened = false;
+
+		/*
+		 * Increment the no-action counter.  Our connectin was decelerated on us with no action occurring.
+		 */
+		feci->stats.no_action_seen++;
+
+		spin_lock_bh(&ecm_sfe_ipv6_lock);
+		_ecm_sfe_ipv6_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_DECEL);
+		spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+		spin_unlock_bh(&feci->lock);
+
+		/*
+		 * Release the connection.
+		 */
+		feci->deref(feci);
+		ecm_db_connection_deref(ci);
+		return;
+	}
+
+	/*
+	 * Create succeeded
+	 */
+
+	/*
+	 * Clear any nack count
+	 */
+	feci->stats.ae_nack = 0;
+
+	/*
+	 * Clear the "accelerate pending" state and move to "accelerated" state bumping
+	 * the accelerated counters to match our new state.
+	 *
+	 * Decelerate may have been attempted while we were "pending accel" and
+	 * this function will return true if that was the case.
+	 * If decelerate was pending then we need to begin deceleration :-(
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+
+	ecm_sfe_non_ported_ipv6_accelerated_count++;	/* Protocol specific counter */
+	ecm_sfe_ipv6_accelerated_count++;				/* General running counter */
+
+	if (!_ecm_sfe_ipv6_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_ACCEL)) {
+		/*
+		 * Increment the no-action counter, this is reset if offload action is seen
+		 */
+		feci->stats.no_action_seen++;
+
+		spin_unlock_bh(&ecm_sfe_ipv6_lock);
+		spin_unlock_bh(&feci->lock);
+
+		/*
+		 * Release the connection.
+		 */
+		feci->deref(feci);
+		ecm_db_connection_deref(ci);
+		return;
+	}
+
+	DEBUG_INFO("%p: Decelerate was pending\n", ci);
+
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+	spin_unlock_bh(&feci->lock);
+
+	feci->decelerate(feci);
+
+	/*
+	 * Release the connection.
+	 */
+	feci->deref(feci);
+	ecm_db_connection_deref(ci);
+}
+
+/*
+ * ecm_sfe_non_ported_ipv6_connection_accelerate()
+ *	Accelerate a connection
+ *
+ * GGG TODO Refactor this function into a single function that np, udp and tcp
+ * can all use and reduce the amount of code!
+ */
+static void ecm_sfe_non_ported_ipv6_connection_accelerate(struct ecm_front_end_connection_instance *feci,
+									struct ecm_classifier_process_response *pr, bool is_l2_encap)
+{
+	struct ecm_sfe_non_ported_ipv6_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv6_connection_instance *)feci;
+	uint16_t regen_occurrances;
+	int protocol;
+	int32_t from_ifaces_first;
+	int32_t to_ifaces_first;
+	struct ecm_db_iface_instance *from_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX];
+	struct ecm_db_iface_instance *to_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX];
+	struct ecm_db_iface_instance *from_sfe_iface;
+	struct ecm_db_iface_instance *to_sfe_iface;
+	int32_t from_sfe_iface_id;
+	int32_t to_sfe_iface_id;
+	uint8_t from_sfe_iface_address[ETH_ALEN];
+	uint8_t to_sfe_iface_address[ETH_ALEN];
+	struct sfe_ipv6_msg nim;
+	struct sfe_ipv6_rule_create_msg *nircm;
+	struct ecm_classifier_instance *assignments[ECM_CLASSIFIER_TYPES];
+	int aci_index;
+	int assignment_count;
+	sfe_tx_status_t sfe_tx_status;
+	int32_t list_index;
+	int32_t interface_type_counts[ECM_DB_IFACE_TYPE_COUNT];
+	bool rule_invalid;
+	ip_addr_t src_ip;
+	ip_addr_t dest_ip;
+	ecm_front_end_acceleration_mode_t result_mode;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	/*
+	 * Get the re-generation occurrance counter of the connection.
+	 * We compare it again at the end - to ensure that the rule construction has seen no generation
+	 * changes during rule creation.
+	 */
+	regen_occurrances = ecm_db_connection_regeneration_occurrances_get(feci->ci);
+
+	/*
+	 * For non-ported protocols we only support IPv6 in 4 or ESP
+	 */
+	protocol = ecm_db_connection_protocol_get(feci->ci);
+	if ((protocol != IPPROTO_IPIP) && (protocol != IPPROTO_ESP)) {
+		spin_lock_bh(&feci->lock);
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_RULE;
+		spin_unlock_bh(&feci->lock);
+		DEBUG_TRACE("%p: unsupported protocol: %d\n", nnpci, protocol);
+		return;
+	}
+
+	/*
+	 * Test if acceleration is permitted
+	 */
+	if (!ecm_sfe_ipv6_accel_pending_set(feci)) {
+		DEBUG_TRACE("%p: Acceleration not permitted: %p\n", feci, feci->ci);
+		return;
+	}
+
+	/*
+	 * Okay construct an accel command.
+	 * Initialise creation structure.
+	 * NOTE: We leverage the app_data void pointer to be our 32 bit connection serial number.
+	 * When we get it back we re-cast it to a uint32 and do a faster connection lookup.
+	 */
+	memset(&nim, 0, sizeof(struct sfe_ipv6_msg));
+	sfe_ipv6_msg_init(&nim, SFE_SPECIAL_INTERFACE_IPV6, SFE_TX_CREATE_RULE_MSG,
+			sizeof(struct sfe_ipv6_rule_create_msg),
+			ecm_sfe_non_ported_ipv6_connection_callback,
+			(void *)ecm_db_connection_serial_get(feci->ci));
+
+	nircm = &nim.msg.rule_create;
+	nircm->valid_flags = 0;
+	nircm->rule_flags = 0;
+
+	/*
+	 * Initialize VLAN tag information
+	 */
+	nircm->vlan_primary_rule.ingress_vlan_tag = SFE_VLAN_ID_NOT_CONFIGURED;
+	nircm->vlan_primary_rule.egress_vlan_tag = SFE_VLAN_ID_NOT_CONFIGURED;
+	nircm->vlan_secondary_rule.ingress_vlan_tag = SFE_VLAN_ID_NOT_CONFIGURED;
+	nircm->vlan_secondary_rule.egress_vlan_tag = SFE_VLAN_ID_NOT_CONFIGURED;
+
+	/*
+	 * Get the interface lists of the connection, we must have at least one interface in the list to continue
+	 */
+	from_ifaces_first = ecm_db_connection_from_interfaces_get_and_ref(feci->ci, from_ifaces);
+	if (from_ifaces_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+		DEBUG_WARN("%p: Accel attempt failed - no interfaces in from_interfaces list!\n", nnpci);
+		goto non_ported_accel_bad_rule;
+	}
+
+	to_ifaces_first = ecm_db_connection_to_interfaces_get_and_ref(feci->ci, to_ifaces);
+	if (to_ifaces_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+		DEBUG_WARN("%p: Accel attempt failed - no interfaces in to_interfaces list!\n", nnpci);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		goto non_ported_accel_bad_rule;
+	}
+
+	/*
+	 * First interface in each must be a known sfe interface
+	 */
+	from_sfe_iface = from_ifaces[from_ifaces_first];
+	to_sfe_iface = to_ifaces[to_ifaces_first];
+	from_sfe_iface_id = ecm_db_iface_ae_interface_identifier_get(from_sfe_iface);
+	to_sfe_iface_id = ecm_db_iface_ae_interface_identifier_get(to_sfe_iface);
+	if ((from_sfe_iface_id < 0) || (to_sfe_iface_id < 0)) {
+		DEBUG_TRACE("%p: from_sfe_iface_id: %d, to_sfe_iface_id: %d\n", nnpci, from_sfe_iface_id, to_sfe_iface_id);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
+		goto non_ported_accel_bad_rule;
+	}
+
+	/*
+	 * New rule being created
+	 */
+	nircm->valid_flags |= SFE_RULE_CREATE_CONN_VALID;
+
+	/*
+	 * Set interface numbers involved in accelerating this connection.
+	 * These are the outer facing addresses from the heirarchy interface lists we got above.
+	 * These may be overridden later if we detect special interface types e.g. ipsec.
+	 */
+	nircm->conn_rule.flow_interface_num = from_sfe_iface_id;
+	nircm->conn_rule.return_interface_num = to_sfe_iface_id;
+
+	/*
+	 * Set interface numbers involved in accelerating this connection.
+	 * These are the inner facing addresses from the heirarchy interface lists we got above.
+	 */
+	nim.msg.rule_create.conn_rule.flow_top_interface_num = ecm_db_iface_interface_identifier_get(from_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX-1]);
+	nim.msg.rule_create.conn_rule.return_top_interface_num = ecm_db_iface_interface_identifier_get(to_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX-1]);
+
+	/*
+	 * We know that each outward facing interface is known to the SFE and so this connection could be accelerated.
+	 * However the lists may also specify other interesting details that must be included in the creation command,
+	 * for example, ethernet MAC, VLAN tagging or PPPoE session information.
+	 * We get this information by walking from the outer to the innermost interface for each list and examine the interface types.
+	 *
+	 * Start with the 'from' (src) side.
+	 * NOTE: The lists may contain a complex heirarchy of similar type of interface e.g. multiple vlans or tunnels within tunnels.
+	 * This SFE cannot handle that - there is no way to describe this in the rule - if we see multiple types that would conflict we have to abort.
+	 */
+	DEBUG_TRACE("%p: Examine from/src heirarchy list\n", nnpci);
+	memset(interface_type_counts, 0, sizeof(interface_type_counts));
+	rule_invalid = false;
+	for (list_index = from_ifaces_first; !rule_invalid && (list_index < ECM_DB_IFACE_HEIRARCHY_MAX); list_index++) {
+		struct ecm_db_iface_instance *ii;
+		ecm_db_iface_type_t ii_type;
+		char *ii_name;
+
+		ii = from_ifaces[list_index];
+		ii_type = ecm_db_connection_iface_type_get(ii);
+		ii_name = ecm_db_interface_type_to_string(ii_type);
+		DEBUG_TRACE("%p: list_index: %d, ii: %p, type: %d (%s)\n", nnpci, list_index, ii, ii_type, ii_name);
+
+		/*
+		 * Extract information from this interface type if it is applicable to the rule.
+		 * Conflicting information may cause accel to be unsupported.
+		 */
+		switch (ii_type) {
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			struct ecm_db_interface_info_pppoe pppoe_info;
+#endif
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			struct ecm_db_interface_info_vlan vlan_info;
+			uint32_t vlan_value = 0;
+			struct net_device *vlan_in_dev = NULL;
+#endif
+
+		case ECM_DB_IFACE_TYPE_BRIDGE:
+			DEBUG_TRACE("%p: Bridge\n", nnpci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Cannot cascade bridges
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: Bridge - ignore additional\n", nnpci);
+				break;
+			}
+			ecm_db_iface_bridge_address_get(ii, from_sfe_iface_address);
+			DEBUG_TRACE("%p: Bridge - mac: %pM\n", nnpci, from_sfe_iface_address);
+			break;
+		case ECM_DB_IFACE_TYPE_ETHERNET:
+			DEBUG_TRACE("%p: Ethernet\n", nnpci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Ignore additional mac addresses, these are usually as a result of address propagation
+				 * from bridges down to ports etc.
+				 */
+				DEBUG_TRACE("%p: Ethernet - ignore additional\n", nnpci);
+				break;
+			}
+
+			/*
+			 * Can only handle one MAC, the first outermost mac.
+			 */
+			ecm_db_iface_ethernet_address_get(ii, from_sfe_iface_address);
+			DEBUG_TRACE("%p: Ethernet - mac: %pM\n", nnpci, from_sfe_iface_address);
+			break;
+		case ECM_DB_IFACE_TYPE_PPPOE:
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			/*
+			 * More than one PPPoE in the list is not valid!
+			 */
+			if (interface_type_counts[ii_type] != 0) {
+				DEBUG_TRACE("%p: PPPoE - additional unsupported\n", nnpci);
+				rule_invalid = true;
+				break;
+			}
+
+			/*
+			 * Copy pppoe session info to the creation structure.
+			 */
+			ecm_db_iface_pppoe_session_info_get(ii, &pppoe_info);
+
+			nircm->pppoe_rule.flow_pppoe_session_id = pppoe_info.pppoe_session_id;
+			memcpy(nircm->pppoe_rule.flow_pppoe_remote_mac, pppoe_info.remote_mac, ETH_ALEN);
+			nircm->valid_flags |= SFE_RULE_CREATE_PPPOE_VALID;
+
+			DEBUG_TRACE("%p: PPPoE - session: %x, mac: %pM\n", nnpci,
+					nircm->pppoe_rule.flow_pppoe_session_id,
+					nircm->pppoe_rule.flow_pppoe_remote_mac);
+#else
+			rule_invalid = true;
+#endif
+			break;
+		case ECM_DB_IFACE_TYPE_VLAN:
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			DEBUG_TRACE("%p: VLAN\n", nnpci);
+			if (interface_type_counts[ii_type] > 1) {
+				/*
+				 * Can only support two vlans
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: VLAN - additional unsupported\n", nnpci);
+				break;
+			}
+			ecm_db_iface_vlan_info_get(ii, &vlan_info);
+			vlan_value = ((vlan_info.vlan_tpid << 16) | vlan_info.vlan_tag);
+
+			/*
+			 * Look up the vlan device and incorporate the vlan priority into the vlan_value
+			 */
+			vlan_in_dev = dev_get_by_index(&init_net, ecm_db_iface_interface_identifier_get(ii));
+			if (vlan_in_dev) {
+				vlan_value |= vlan_dev_get_egress_prio(vlan_in_dev, pr->return_qos_tag);
+				dev_put(vlan_in_dev);
+				vlan_in_dev = NULL;
+			}
+
+			/*
+			 * Primary or secondary (QinQ) VLAN?
+			 */
+			if (interface_type_counts[ii_type] == 0) {
+				nircm->vlan_primary_rule.ingress_vlan_tag = vlan_value;
+			} else {
+				nircm->vlan_secondary_rule.ingress_vlan_tag = vlan_value;
+			}
+			nircm->valid_flags |= SFE_RULE_CREATE_VLAN_VALID;
+
+			/*
+			 * If we have not yet got an ethernet mac then take this one (very unlikely as mac should have been propagated to the slave (outer) device
+			 */
+			if (interface_type_counts[ECM_DB_IFACE_TYPE_ETHERNET] == 0) {
+				memcpy(from_sfe_iface_address, vlan_info.address, ETH_ALEN);
+				interface_type_counts[ECM_DB_IFACE_TYPE_ETHERNET]++;
+				DEBUG_TRACE("%p: VLAN use mac: %pM\n", nnpci, from_sfe_iface_address);
+			}
+			DEBUG_TRACE("%p: vlan tag: %x\n", nnpci, vlan_value);
+#else
+			rule_invalid = true;
+			DEBUG_TRACE("%p: VLAN - unsupported\n", nnpci);
+#endif
+			break;
+		case ECM_DB_IFACE_TYPE_IPSEC_TUNNEL:
+#ifdef ECM_INTERFACE_IPSEC_ENABLE
+			DEBUG_TRACE("%p: IPSEC\n", nnpci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Can only support one ipsec
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: IPSEC - additional unsupported\n", nnpci);
+				break;
+			}
+			nircm->conn_rule.flow_interface_num = SFE_SPECIAL_INTERFACE_IPSEC;
+#else
+			rule_invalid = true;
+			DEBUG_TRACE("%p: IPSEC - unsupported\n", nnpci);
+#endif
+			break;
+		default:
+			DEBUG_TRACE("%p: Ignoring: %d (%s)\n", nnpci, ii_type, ii_name);
+		}
+
+		/*
+		 * Seen an interface of this type
+		 */
+		interface_type_counts[ii_type]++;
+	}
+	if (rule_invalid) {
+		DEBUG_WARN("%p: from/src Rule invalid\n", nnpci);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
+		goto non_ported_accel_bad_rule;
+	}
+
+	/*
+	 * Now examine the TO / DEST heirarchy list to construct the destination part of the rule
+	 */
+	DEBUG_TRACE("%p: Examine to/dest heirarchy list\n", nnpci);
+	memset(interface_type_counts, 0, sizeof(interface_type_counts));
+	rule_invalid = false;
+	for (list_index = to_ifaces_first; !rule_invalid && (list_index < ECM_DB_IFACE_HEIRARCHY_MAX); list_index++) {
+		struct ecm_db_iface_instance *ii;
+		ecm_db_iface_type_t ii_type;
+		char *ii_name;
+
+		ii = to_ifaces[list_index];
+		ii_type = ecm_db_connection_iface_type_get(ii);
+		ii_name = ecm_db_interface_type_to_string(ii_type);
+		DEBUG_TRACE("%p: list_index: %d, ii: %p, type: %d (%s)\n", nnpci, list_index, ii, ii_type, ii_name);
+
+		/*
+		 * Extract information from this interface type if it is applicable to the rule.
+		 * Conflicting information may cause accel to be unsupported.
+		 */
+		switch (ii_type) {
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			struct ecm_db_interface_info_pppoe pppoe_info;
+#endif
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			struct ecm_db_interface_info_vlan vlan_info;
+			uint32_t vlan_value = 0;
+			struct net_device *vlan_out_dev = NULL;
+#endif
+		case ECM_DB_IFACE_TYPE_BRIDGE:
+			DEBUG_TRACE("%p: Bridge\n", nnpci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Cannot cascade bridges
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: Bridge - ignore additional\n", nnpci);
+				break;
+			}
+			ecm_db_iface_bridge_address_get(ii, to_sfe_iface_address);
+			DEBUG_TRACE("%p: Bridge - mac: %pM\n", nnpci, to_sfe_iface_address);
+			break;
+		case ECM_DB_IFACE_TYPE_ETHERNET:
+			DEBUG_TRACE("%p: Ethernet\n", nnpci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Ignore additional mac addresses, these are usually as a result of address propagation
+				 * from bridges down to ports etc.
+				 */
+				DEBUG_TRACE("%p: Ethernet - ignore additional\n", nnpci);
+				break;
+			}
+
+			/*
+			 * Can only handle one MAC, the first outermost mac.
+			 */
+			ecm_db_iface_ethernet_address_get(ii, to_sfe_iface_address);
+			DEBUG_TRACE("%p: Ethernet - mac: %pM\n", nnpci, to_sfe_iface_address);
+			break;
+		case ECM_DB_IFACE_TYPE_PPPOE:
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			/*
+			 * More than one PPPoE in the list is not valid!
+			 */
+			if (interface_type_counts[ii_type] != 0) {
+				DEBUG_TRACE("%p: PPPoE - additional unsupported\n", nnpci);
+				rule_invalid = true;
+				break;
+			}
+
+			/*
+			 * Copy pppoe session info to the creation structure.
+			 */
+			ecm_db_iface_pppoe_session_info_get(ii, &pppoe_info);
+			nircm->pppoe_rule.return_pppoe_session_id = pppoe_info.pppoe_session_id;
+			memcpy(nircm->pppoe_rule.return_pppoe_remote_mac, pppoe_info.remote_mac, ETH_ALEN);
+			nircm->valid_flags |= SFE_RULE_CREATE_PPPOE_VALID;
+
+			DEBUG_TRACE("%p: PPPoE - session: %x, mac: %pM\n", nnpci,
+				    nircm->pppoe_rule.return_pppoe_session_id,
+				    nircm->pppoe_rule.return_pppoe_remote_mac);
+#else
+			rule_invalid = true;
+#endif
+			break;
+		case ECM_DB_IFACE_TYPE_VLAN:
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			DEBUG_TRACE("%p: VLAN\n", nnpci);
+			if (interface_type_counts[ii_type] > 1) {
+				/*
+				 * Can only support two vlans
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: VLAN - additional unsupported\n", nnpci);
+				break;
+			}
+			ecm_db_iface_vlan_info_get(ii, &vlan_info);
+			vlan_value = ((vlan_info.vlan_tpid << 16) | vlan_info.vlan_tag);
+
+			/*
+			 * Look up the vlan device and incorporate the vlan priority into the vlan_value
+			 */
+			vlan_out_dev = dev_get_by_index(&init_net, ecm_db_iface_interface_identifier_get(ii));
+			if (vlan_out_dev) {
+				vlan_value |= vlan_dev_get_egress_prio(vlan_out_dev, pr->flow_qos_tag);
+				dev_put(vlan_out_dev);
+				vlan_out_dev = NULL;
+			}
+
+			/*
+			 * Primary or secondary (QinQ) VLAN?
+			 */
+			if (interface_type_counts[ii_type] == 0) {
+				nircm->vlan_primary_rule.egress_vlan_tag = vlan_value;
+			} else {
+				nircm->vlan_secondary_rule.egress_vlan_tag = vlan_value;
+			}
+			nircm->valid_flags |= SFE_RULE_CREATE_VLAN_VALID;
+
+			/*
+			 * If we have not yet got an ethernet mac then take this one (very unlikely as mac should have been propagated to the slave (outer) device
+			 */
+			if (interface_type_counts[ECM_DB_IFACE_TYPE_ETHERNET] == 0) {
+				memcpy(to_sfe_iface_address, vlan_info.address, ETH_ALEN);
+				interface_type_counts[ECM_DB_IFACE_TYPE_ETHERNET]++;
+				DEBUG_TRACE("%p: VLAN use mac: %pM\n", nnpci, to_sfe_iface_address);
+			}
+			DEBUG_TRACE("%p: vlan tag: %x\n", nnpci, vlan_value);
+#else
+			rule_invalid = true;
+			DEBUG_TRACE("%p: VLAN - unsupported\n", nnpci);
+#endif
+			break;
+		case ECM_DB_IFACE_TYPE_IPSEC_TUNNEL:
+#ifdef ECM_INTERFACE_IPSEC_ENABLE
+			DEBUG_TRACE("%p: IPSEC\n", nnpci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Can only support one ipsec
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: IPSEC - additional unsupported\n", nnpci);
+				break;
+			}
+			nircm->conn_rule.return_interface_num = SFE_SPECIAL_INTERFACE_IPSEC;
+#else
+			rule_invalid = true;
+			DEBUG_TRACE("%p: IPSEC - unsupported\n", nnpci);
+#endif
+			break;
+		default:
+			DEBUG_TRACE("%p: Ignoring: %d (%s)\n", nnpci, ii_type, ii_name);
+		}
+
+		/*
+		 * Seen an interface of this type
+		 */
+		interface_type_counts[ii_type]++;
+	}
+	if (rule_invalid) {
+		DEBUG_WARN("%p: to/dest Rule invalid\n", nnpci);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
+		goto non_ported_accel_bad_rule;
+	}
+
+	/*
+	 * Routed or bridged?
+	 */
+	if (ecm_db_connection_is_routed_get(feci->ci)) {
+		nircm->rule_flags |= SFE_RULE_CREATE_FLAG_ROUTED;
+	} else {
+		nircm->rule_flags |= SFE_RULE_CREATE_FLAG_BRIDGE_FLOW;
+		if (is_l2_encap) {
+			nircm->rule_flags |= SFE_RULE_CREATE_FLAG_L2_ENCAP;
+		}
+	}
+
+	/*
+	 * Set up the flow and return qos tags
+	 */
+	nircm->qos_rule.flow_qos_tag = (uint32_t)pr->flow_qos_tag;
+	nircm->qos_rule.return_qos_tag = (uint32_t)pr->return_qos_tag;
+	nircm->valid_flags |= SFE_RULE_CREATE_QOS_VALID;
+
+#ifdef ECM_CLASSIFIER_DSCP_ENABLE
+	/*
+	 * DSCP information?
+	 */
+	if (pr->process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DSCP) {
+		nircm->dscp_rule.flow_dscp = pr->flow_dscp;
+		nircm->dscp_rule.return_dscp = pr->return_dscp;
+		nircm->rule_flags |= SFE_RULE_CREATE_FLAG_DSCP_MARKING;
+		nircm->valid_flags |= SFE_RULE_CREATE_DSCP_MARKING_VALID;
+	}
+#endif
+	/*
+	 * Set protocol
+	 */
+	nircm->tuple.protocol = (int32_t)protocol;
+
+	/*
+	 * The flow_ip is where the connection established from
+	 */
+	ecm_db_connection_from_address_get(feci->ci, src_ip);
+	ECM_IP_ADDR_TO_SFE_IPV6_ADDR(nircm->tuple.flow_ip, src_ip);
+
+	/*
+	 * The return_ip is where the connection is established to
+	 */
+	ecm_db_connection_to_address_get(feci->ci, dest_ip);
+	ECM_IP_ADDR_TO_SFE_IPV6_ADDR(nircm->tuple.return_ip, dest_ip);
+
+	/*
+	 * Same approach as above for port information
+	 */
+	nircm->tuple.flow_ident = htons(ecm_db_connection_from_port_get(feci->ci));
+	nircm->tuple.return_ident = htons(ecm_db_connection_to_port_nat_get(feci->ci));
+
+	/*
+	 * Get mac addresses.
+	 * The src_mac is the mac address of the node that established the connection.
+	 * This will work whether the from_node is LAN (egress) or WAN (ingress).
+	 */
+	ecm_db_connection_from_node_address_get(feci->ci, (uint8_t *)nircm->conn_rule.flow_mac);
+
+	/*
+	 * The dest_mac is the mac address of the node that the connection is esatblished to.
+	 */
+	ecm_db_connection_to_nat_node_address_get(feci->ci, (uint8_t *)nircm->conn_rule.return_mac);
+
+	/*
+	 * Get MTU information
+	 */
+	nircm->conn_rule.flow_mtu = (uint32_t)ecm_db_connection_from_iface_mtu_get(feci->ci);
+	nircm->conn_rule.return_mtu = (uint32_t)ecm_db_connection_to_iface_mtu_get(feci->ci);
+
+	/*
+	 * Sync our creation command from the assigned classifiers to get specific additional creation rules.
+	 * NOTE: These are called in ascending order of priority and so the last classifier (highest) shall
+	 * override any preceding classifiers.
+	 * This also gives the classifiers a chance to see that acceleration is being attempted.
+	 */
+	assignment_count = ecm_db_connection_classifier_assignments_get_and_ref(feci->ci, assignments);
+	for (aci_index = 0; aci_index < assignment_count; ++aci_index) {
+		struct ecm_classifier_instance *aci;
+		struct ecm_classifier_rule_create ecrc;
+		/*
+		 * NOTE: The current classifiers do not sync anything to the underlying accel engines.
+		 * In the future, if any of the classifiers wants to pass any parameter, these parameters
+		 * should be received via this object and copied to the accel engine's create object (nircm).
+		*/
+		aci = assignments[aci_index];
+		DEBUG_TRACE("%p: sync from: %p, type: %d\n", nnpci, aci, aci->type_get(aci));
+		aci->sync_from_v6(aci, &ecrc);
+	}
+	ecm_db_connection_assignments_release(assignment_count, assignments);
+
+	/*
+	 * Release the interface lists
+	 */
+	ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+	ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
+
+	DEBUG_INFO("%p: NON_PORTED Accelerate connection %p\n"
+			"Protocol: %d\n"
+			"from_mtu: %u\n"
+			"to_mtu: %u\n"
+			"from_ip: " ECM_IP_ADDR_OCTAL_FMT ":%d\n"
+			"to_ip: " ECM_IP_ADDR_OCTAL_FMT ":%d\n"
+			"from_mac: %pM\n"
+			"to_mac: %pM\n"
+			"src_iface_num: %u\n"
+			"dest_iface_num: %u\n"
+			"ingress_inner_vlan_tag: %u\n"
+			"egress_inner_vlan_tag: %u\n"
+			"ingress_outer_vlan_tag: %u\n"
+			"egress_outer_vlan_tag: %u\n"
+			"rule_flags: %x\n"
+			"valid_flags: %x\n"
+			"return_pppoe_session_id: %u\n"
+			"return_pppoe_remote_mac: %pM\n"
+			"flow_pppoe_session_id: %u\n"
+			"flow_pppoe_remote_mac: %pM\n"
+			"flow_qos_tag: %x (%u)\n"
+			"return_qos_tag: %x (%u)\n"
+			"flow_dscp: %x\n"
+			"return_dscp: %x\n",
+			nnpci,
+			feci->ci,
+			nircm->tuple.protocol,
+			nircm->conn_rule.flow_mtu,
+			nircm->conn_rule.return_mtu,
+			ECM_IP_ADDR_TO_OCTAL(src_ip), nircm->tuple.flow_ident,
+			ECM_IP_ADDR_TO_OCTAL(dest_ip), nircm->tuple.return_ident,
+			nircm->conn_rule.flow_mac,
+			nircm->conn_rule.return_mac,
+			nircm->conn_rule.flow_interface_num,
+			nircm->conn_rule.return_interface_num,
+			nircm->vlan_primary_rule.ingress_vlan_tag,
+			nircm->vlan_primary_rule.egress_vlan_tag,
+			nircm->vlan_secondary_rule.ingress_vlan_tag,
+			nircm->vlan_secondary_rule.egress_vlan_tag,
+			nircm->rule_flags,
+			nircm->valid_flags,
+			nircm->pppoe_rule.return_pppoe_session_id,
+			nircm->pppoe_rule.return_pppoe_remote_mac,
+			nircm->pppoe_rule.flow_pppoe_session_id,
+			nircm->pppoe_rule.flow_pppoe_remote_mac,
+			nircm->qos_rule.flow_qos_tag, nircm->qos_rule.flow_qos_tag,
+			nircm->qos_rule.return_qos_tag, nircm->qos_rule.return_qos_tag,
+			nircm->dscp_rule.flow_dscp,
+			nircm->dscp_rule.return_dscp);
+
+	/*
+	 * Now that the rule has been constructed we re-compare the generation occurrance counter.
+	 * If there has been a change then we abort because the rule may have been created using
+	 * unstable data - especially if another thread has begun regeneration of the connection state.
+	 * NOTE: This does not prevent a regen from being flagged immediately after this line of code either,
+	 * or while the acceleration rule is in flight to the nss.
+	 * This is only to check for consistency of rule state - not that the state is stale.
+	 * Remember that the connection is marked as "accel pending state" so if a regen is flagged immediately
+	 * after this check passes, the connection will be decelerated and refreshed very quickly.
+	 */
+	if (regen_occurrances != ecm_db_connection_regeneration_occurrances_get(feci->ci)) {
+		DEBUG_INFO("%p: connection:%p regen occurred - aborting accel rule.\n", feci, feci->ci);
+		ecm_sfe_ipv6_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_DECEL);
+		return;
+	}
+
+	/*
+	 * Ref the connection before issuing an SFE rule
+	 * This ensures that when the SFE responds to the command - which may even be immediately -
+	 * the callback function can trust the correct ref was taken for its purpose.
+	 * NOTE: remember that this will also implicitly hold the feci.
+	 */
+	ecm_db_connection_ref(feci->ci);
+
+	/*
+	 * We are about to issue the command, record the time of transmission
+	 */
+	spin_lock_bh(&feci->lock);
+	feci->stats.cmd_time_begun = jiffies;
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Call the rule create function
+	 */
+	sfe_tx_status = sfe_drv_ipv6_tx(ecm_sfe_ipv6_drv_mgr, &nim);
+	if (sfe_tx_status == SFE_TX_SUCCESS) {
+		/*
+		 * Reset the driver_fail count - transmission was okay here.
+		 */
+		spin_lock_bh(&feci->lock);
+		feci->stats.driver_fail = 0;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * Release that ref!
+	 */
+	ecm_db_connection_deref(feci->ci);
+
+	/*
+	 * TX failed
+	 */
+	spin_lock_bh(&feci->lock);
+	DEBUG_ASSERT(feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING, "%p: Accel mode unexpected: %d\n", nnpci, feci->accel_mode);
+	feci->stats.driver_fail_total++;
+	feci->stats.driver_fail++;
+	if (feci->stats.driver_fail >= feci->stats.driver_fail_limit) {
+		DEBUG_WARN("%p: Accel failed - driver fail limit\n", nnpci);
+		result_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DRIVER;
+	} else {
+		result_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL;
+	}
+
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	_ecm_sfe_ipv6_accel_pending_clear(feci, result_mode);
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	spin_unlock_bh(&feci->lock);
+	return;
+
+non_ported_accel_bad_rule:
+	;
+
+	/*
+	 * Jump to here when rule data is bad and an offload command cannot be constructed
+	 */
+	DEBUG_WARN("%p: Accel failed - bad rule\n", nnpci);
+	ecm_sfe_ipv6_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_FAIL_RULE);
+}
+
+/*
+ * ecm_sfe_non_ported_ipv6_connection_destroy_callback()
+ *	Callback for handling destroy ack/nack calls.
+ */
+static void ecm_sfe_non_ported_ipv6_connection_destroy_callback(void *app_data, struct sfe_ipv6_msg *nim)
+{
+	struct sfe_ipv6_rule_destroy_msg *nirdm = &nim->msg.rule_destroy;
+	uint32_t serial = (uint32_t)app_data;
+	struct ecm_db_connection_instance *ci;
+	struct ecm_front_end_connection_instance *feci;
+	struct ecm_sfe_non_ported_ipv6_connection_instance *nnpci;
+	ip_addr_t flow_ip;
+	ip_addr_t return_ip;
+
+	/*
+	 * Is this a response to a destroy message?
+	 */
+	if (nim->cm.type != SFE_TX_DESTROY_RULE_MSG) {
+		DEBUG_ERROR("%p: non_ported destroy callback with improper type: %d\n", nim, nim->cm.type);
+		return;
+	}
+
+	/*
+	 * Look up ecm connection so that we can update the status.
+	 */
+	ci = ecm_db_connection_serial_find_and_ref(serial);
+	if (!ci) {
+		DEBUG_TRACE("%p: destroy callback, connection not found, serial: %u\n", nim, serial);
+		return;
+	}
+
+	/*
+	 * Release ref held for this ack/nack response.
+	 * NOTE: It's okay to do this here, ci won't go away, because the ci is held as
+	 * a result of the ecm_db_connection_serial_find_and_ref()
+	 */
+	ecm_db_connection_deref(ci);
+
+	/*
+	 * Get the front end instance
+	 */
+	feci = ecm_db_connection_front_end_get_and_ref(ci);
+	nnpci = (struct ecm_sfe_non_ported_ipv6_connection_instance *)feci;
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	ECM_SFE_IPV6_ADDR_TO_IP_ADDR(flow_ip, nirdm->tuple.flow_ip);
+	ECM_SFE_IPV6_ADDR_TO_IP_ADDR(return_ip, nirdm->tuple.return_ip);
+
+	/*
+	 * Record command duration
+	 */
+	ecm_sfe_ipv6_decel_done_time_update(feci);
+
+	/*
+	 * Dump some useful trace information.
+	 */
+	DEBUG_TRACE("%p: decelerate response for connection: %p\n", nnpci, feci->ci);
+	DEBUG_TRACE("%p: flow_ip: " ECM_IP_ADDR_OCTAL_FMT ":%d\n", nnpci, ECM_IP_ADDR_TO_OCTAL(flow_ip), nirdm->tuple.flow_ident);
+	DEBUG_TRACE("%p: return_ip: " ECM_IP_ADDR_OCTAL_FMT ":%d\n", nnpci, ECM_IP_ADDR_TO_OCTAL(return_ip), nirdm->tuple.return_ident);
+	DEBUG_TRACE("%p: protocol: %d\n", nnpci, nirdm->tuple.protocol);
+
+	/*
+	 * Drop decel pending counter
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	ecm_sfe_ipv6_pending_decel_count--;
+	DEBUG_ASSERT(ecm_sfe_ipv6_pending_decel_count >= 0, "Bad decel pending counter\n");
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	spin_lock_bh(&feci->lock);
+
+	/*
+	 * If decel is not still pending then it's possible that the SFE ended acceleration by some other reason e.g. flush
+	 * In which case we cannot rely on the response we get here.
+	 */
+	if (feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_DECEL_PENDING) {
+		spin_unlock_bh(&feci->lock);
+
+		/*
+		 * Release the connections.
+		 */
+		feci->deref(feci);
+		ecm_db_connection_deref(ci);
+		return;
+	}
+
+	DEBUG_TRACE("%p: response: %d\n", nnpci, nim->cm.response);
+	if (nim->cm.response != SFE_CMN_RESPONSE_ACK) {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DECEL;
+	} else {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL;
+	}
+
+	/*
+	 * If connection became defunct then set mode so that no further accel/decel attempts occur.
+	 */
+	if (feci->is_defunct) {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DEFUNCT;
+	}
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * NON_PORTED acceleration ends
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	ecm_sfe_non_ported_ipv6_accelerated_count--;	/* Protocol specific counter */
+	DEBUG_ASSERT(ecm_sfe_non_ported_ipv6_accelerated_count >= 0, "Bad non_ported accel counter\n");
+	ecm_sfe_ipv6_accelerated_count--;		/* General running counter */
+	DEBUG_ASSERT(ecm_sfe_ipv6_accelerated_count >= 0, "Bad accel counter\n");
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	/*
+	 * Release the connections.
+	 */
+	feci->deref(feci);
+	ecm_db_connection_deref(ci);
+}
+
+/*
+ * ecm_sfe_non_ported_ipv6_connection_decelerate()
+ *	Decelerate a connection
+ */
+static void ecm_sfe_non_ported_ipv6_connection_decelerate(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_non_ported_ipv6_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv6_connection_instance *)feci;
+	struct sfe_ipv6_msg nim;
+	struct sfe_ipv6_rule_destroy_msg *nirdm;
+	ip_addr_t src_ip;
+	ip_addr_t dest_ip;
+	sfe_tx_status_t sfe_tx_status;
+	int protocol;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	/*
+	 * For non-ported protocols we only support IPIP.
+	 */
+	protocol = ecm_db_connection_protocol_get(feci->ci);
+	if ((protocol != IPPROTO_IPIP)) {
+		DEBUG_TRACE("%p: unsupported protocol: %d\n", nnpci, protocol);
+		return;
+	}
+
+	/*
+	 * If decelerate is in error or already pending then ignore
+	 */
+	spin_lock_bh(&feci->lock);
+	if (feci->stats.decelerate_pending) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If acceleration is pending then we cannot decelerate right now or we will race with it
+	 * Set a decelerate pending flag that will be actioned when the acceleration command is complete.
+	 */
+	if (feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING) {
+		feci->stats.decelerate_pending = true;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * Can only decelerate if accelerated
+	 * NOTE: This will also deny accel when the connection is in fail condition too.
+	 */
+	if (feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_ACCEL) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * Initiate deceleration
+	 */
+	feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL_PENDING;
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Increment the decel pending counter
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	ecm_sfe_ipv6_pending_decel_count++;
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	/*
+	 * Prepare deceleration message
+	 */
+	sfe_ipv6_msg_init(&nim, SFE_SPECIAL_INTERFACE_IPV6, SFE_TX_DESTROY_RULE_MSG,
+			sizeof(struct sfe_ipv6_rule_destroy_msg),
+			ecm_sfe_non_ported_ipv6_connection_destroy_callback,
+			(void *)ecm_db_connection_serial_get(feci->ci));
+
+	nirdm = &nim.msg.rule_destroy;
+	nirdm->tuple.protocol = (int32_t)protocol;
+
+	/*
+	 * Get addressing information
+	 */
+	ecm_db_connection_from_address_get(feci->ci, src_ip);
+	ECM_IP_ADDR_TO_SFE_IPV6_ADDR(nirdm->tuple.flow_ip, src_ip);
+	ecm_db_connection_to_address_nat_get(feci->ci, dest_ip);
+	ECM_IP_ADDR_TO_SFE_IPV6_ADDR(nirdm->tuple.return_ip, dest_ip);
+	nirdm->tuple.flow_ident = htons(ecm_db_connection_from_port_get(feci->ci));
+	nirdm->tuple.return_ident = htons(ecm_db_connection_to_port_nat_get(feci->ci));
+
+	DEBUG_INFO("%p: NON_PORTED Connection %p decelerate\n"
+			"src_ip: " ECM_IP_ADDR_OCTAL_FMT ":%d\n"
+			"dest_ip: " ECM_IP_ADDR_OCTAL_FMT ":%d\n",
+			nnpci, feci->ci,
+			ECM_IP_ADDR_TO_OCTAL(src_ip), nirdm->tuple.flow_ident,
+			ECM_IP_ADDR_TO_OCTAL(dest_ip), nirdm->tuple.return_ident);
+
+	/*
+	 * Take a ref to the feci->ci so that it will persist until we get a response from the SFE.
+	 * NOTE: This will implicitly hold the feci too.
+	 */
+	ecm_db_connection_ref(feci->ci);
+
+	/*
+	 * We are about to issue the command, record the time of transmission
+	 */
+	spin_lock_bh(&feci->lock);
+	feci->stats.cmd_time_begun = jiffies;
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Destroy the SFE connection cache entry.
+	 */
+	sfe_tx_status = sfe_drv_ipv6_tx(ecm_sfe_ipv6_drv_mgr, &nim);
+	if (sfe_tx_status == SFE_TX_SUCCESS) {
+		/*
+		 * Reset the driver_fail count - transmission was okay here.
+		 */
+		spin_lock_bh(&feci->lock);
+		feci->stats.driver_fail = 0;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * Release the ref take, SFE driver did not accept our command.
+	 */
+	ecm_db_connection_deref(feci->ci);
+
+	/*
+	 * TX failed
+	 */
+	spin_lock_bh(&feci->lock);
+	feci->stats.driver_fail_total++;
+	feci->stats.driver_fail++;
+	if (feci->stats.driver_fail >= feci->stats.driver_fail_limit) {
+		DEBUG_WARN("%p: Decel failed - driver fail limit\n", nnpci);
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DRIVER;
+	}
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Could not send the request, decrement the decel pending counter
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	ecm_sfe_ipv6_pending_decel_count--;
+	DEBUG_ASSERT(ecm_sfe_ipv6_pending_decel_count >= 0, "Bad decel pending counter\n");
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+}
+
+/*
+ * ecm_sfe_non_ported_ipv6_connection_defunct_callback()
+ *	Callback to be called when a non-ported connection has become defunct.
+ */
+static void ecm_sfe_non_ported_ipv6_connection_defunct_callback(void *arg)
+{
+	struct ecm_front_end_connection_instance *feci = (struct ecm_front_end_connection_instance *)arg;
+	struct ecm_sfe_non_ported_ipv6_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv6_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	spin_lock_bh(&feci->lock);
+
+	/*
+	 * If connection has already become defunct, do nothing.
+	 */
+	if (feci->is_defunct) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+	feci->is_defunct = true;
+
+	/*
+	 * If the connection is already in one of the fail modes, do nothing, keep the current accel_mode.
+	 */
+	if (ECM_FRONT_END_ACCELERATION_FAILED(feci->accel_mode)) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If the connection is decel then ensure it will not attempt accel while defunct.
+	 */
+	if (feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_DECEL) {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DEFUNCT;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If the connection is decel pending then decel operation is in progress anyway.
+	 */
+	if (feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_DECEL_PENDING) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If none of the cases matched above, this means the connection is in one of the
+	 * accel modes (accel or accel_pending) so we force a deceleration.
+	 * NOTE: If the mode is accel pending then the decel will be actioned when that is completed.
+	 */
+	spin_unlock_bh(&feci->lock);
+	ecm_sfe_non_ported_ipv6_connection_decelerate(feci);
+}
+
+/*
+ * ecm_sfe_non_ported_ipv6_connection_accel_state_get()
+ *	Get acceleration state
+ */
+static ecm_front_end_acceleration_mode_t ecm_sfe_non_ported_ipv6_connection_accel_state_get(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_non_ported_ipv6_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv6_connection_instance *)feci;
+	ecm_front_end_acceleration_mode_t state;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+	spin_lock_bh(&feci->lock);
+	state = feci->accel_mode;
+	spin_unlock_bh(&feci->lock);
+	return state;
+}
+
+/*
+ * ecm_sfe_non_ported_ipv6_connection_action_seen()
+ *	Acceleration action / activity has been seen for this connection.
+ *
+ * NOTE: Call the action_seen() method when the SFE has demonstrated that it has offloaded some data for a connection.
+ */
+static void ecm_sfe_non_ported_ipv6_connection_action_seen(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_non_ported_ipv6_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv6_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	DEBUG_INFO("%p: Action seen\n", nnpci);
+	spin_lock_bh(&feci->lock);
+	feci->stats.no_action_seen = 0;
+	spin_unlock_bh(&feci->lock);
+}
+
+/*
+ * ecm_sfe_non_ported_ipv6_connection_accel_ceased()
+ *	SFE has indicated that acceleration has stopped.
+ *
+ * NOTE: This is called in response to an SFE self-initiated termination of acceleration.
+ * This must NOT be called because the ECM terminated the acceleration.
+ */
+static void ecm_sfe_non_ported_ipv6_connection_accel_ceased(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_non_ported_ipv6_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv6_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	DEBUG_INFO("%p: accel ceased\n", nnpci);
+
+	spin_lock_bh(&feci->lock);
+
+	/*
+	 * If we are in accel-pending state then the SFE has issued a flush out-of-order
+	 * with the ACK/NACK we are actually waiting for.
+	 * To work around this we record a "flush has already happened" and will action it when we finally get that ACK/NACK.
+	 * GGG TODO This should eventually be removed when the SFE honours messaging sequence.
+	 */
+	if (feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING) {
+		feci->stats.flush_happened = true;
+		feci->stats.flush_happened_total++;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If connection is no longer accelerated by the time we get here just ignore the command
+	 */
+	if (feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_ACCEL) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If the no_action_seen counter was not reset then acceleration ended without any offload action
+	 */
+	if (feci->stats.no_action_seen) {
+		feci->stats.no_action_seen_total++;
+	}
+
+	/*
+	 * If the no_action_seen indicates successive cessations of acceleration without any offload action occuring
+	 * then we fail out this connection
+	 */
+	if (feci->stats.no_action_seen >= feci->stats.no_action_seen_limit) {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_NO_ACTION;
+	} else {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL;
+	}
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Non-Ported acceleration ends
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	ecm_sfe_non_ported_ipv6_accelerated_count--;	/* Protocol specific counter */
+	DEBUG_ASSERT(ecm_sfe_non_ported_ipv6_accelerated_count >= 0, "Bad non-ported accel counter\n");
+	ecm_sfe_ipv6_accelerated_count--;		/* General running counter */
+	DEBUG_ASSERT(ecm_sfe_ipv6_accelerated_count >= 0, "Bad accel counter\n");
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+}
+
+/*
+ * ecm_sfe_non_ported_ipv6_connection_ref()
+ *	Ref a connection front end instance
+ */
+static void ecm_sfe_non_ported_ipv6_connection_ref(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_non_ported_ipv6_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv6_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+	spin_lock_bh(&feci->lock);
+	feci->refs++;
+	DEBUG_TRACE("%p: nnpci ref %d\n", nnpci, feci->refs);
+	DEBUG_ASSERT(feci->refs > 0, "%p: ref wrap\n", nnpci);
+	spin_unlock_bh(&feci->lock);
+}
+
+/*
+ * ecm_sfe_non_ported_ipv6_connection_deref()
+ *	Deref a connection front end instance
+ */
+static int ecm_sfe_non_ported_ipv6_connection_deref(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_non_ported_ipv6_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv6_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	spin_lock_bh(&feci->lock);
+	feci->refs--;
+	DEBUG_ASSERT(feci->refs >= 0, "%p: ref wrap\n", nnpci);
+
+	if (feci->refs > 0) {
+		int refs = feci->refs;
+		spin_unlock_bh(&feci->lock);
+		DEBUG_TRACE("%p: nnpci deref %d\n", nnpci, refs);
+		return refs;
+	}
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * We can now destroy the instance
+	 */
+	DEBUG_TRACE("%p: nnpci final\n", nnpci);
+	DEBUG_CLEAR_MAGIC(nnpci);
+	kfree(nnpci);
+
+	return 0;
+}
+
+#ifdef ECM_STATE_OUTPUT_ENABLE
+/*
+ * ecm_sfe_non_ported_ipv6_connection_state_get()
+ *	Return the state of this Non ported front end instance
+ */
+static int ecm_sfe_non_ported_ipv6_connection_state_get(struct ecm_front_end_connection_instance *feci, struct ecm_state_file_instance *sfi)
+{
+	int result;
+	bool can_accel;
+	ecm_front_end_acceleration_mode_t accel_mode;
+	struct ecm_front_end_connection_mode_stats stats;
+	struct ecm_sfe_non_ported_ipv6_connection_instance *nnpci = (struct ecm_sfe_non_ported_ipv6_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", nnpci);
+
+	spin_lock_bh(&feci->lock);
+	can_accel = feci->can_accel;
+	accel_mode = feci->accel_mode;
+	memcpy(&stats, &feci->stats, sizeof(struct ecm_front_end_connection_mode_stats));
+	spin_unlock_bh(&feci->lock);
+
+	if ((result = ecm_state_prefix_add(sfi, "front_end_v6.non_ported"))) {
+		return result;
+	}
+
+	if ((result = ecm_state_write(sfi, "can_accel", "%d", can_accel))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "accel_mode", "%d", accel_mode))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "decelerate_pending", "%d", stats.decelerate_pending))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "flush_happened_total", "%d", stats.flush_happened_total))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "no_action_seen_total", "%d", stats.no_action_seen_total))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "no_action_seen", "%d", stats.no_action_seen))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "no_action_seen_limit", "%d", stats.no_action_seen_limit))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "driver_fail_total", "%d", stats.driver_fail_total))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "driver_fail", "%d", stats.driver_fail))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "driver_fail_limit", "%d", stats.driver_fail_limit))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "ae_nack_total", "%d", stats.ae_nack_total))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "ae_nack", "%d", stats.ae_nack))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "ae_nack_limit", "%d", stats.ae_nack_limit))) {
+		return result;
+	}
+
+ 	return ecm_state_prefix_remove(sfi);
+}
+#endif
+
+/*
+ * ecm_sfe_non_ported_ipv6_connection_instance_alloc()
+ *	Create a front end instance specific for non-ported connection
+ */
+static struct ecm_sfe_non_ported_ipv6_connection_instance *ecm_sfe_non_ported_ipv6_connection_instance_alloc(
+								struct ecm_db_connection_instance *ci,
+								bool can_accel)
+{
+	struct ecm_sfe_non_ported_ipv6_connection_instance *nnpci;
+	struct ecm_front_end_connection_instance *feci;
+
+	nnpci = (struct ecm_sfe_non_ported_ipv6_connection_instance *)kzalloc(sizeof(struct ecm_sfe_non_ported_ipv6_connection_instance), GFP_ATOMIC | __GFP_NOWARN);
+	if (!nnpci) {
+		DEBUG_WARN("Non-Ported Front end alloc failed\n");
+		return NULL;
+	}
+
+	/*
+	 * Refs is 1 for the creator of the connection
+	 */
+	feci = (struct ecm_front_end_connection_instance *)nnpci;
+	feci->refs = 1;
+	DEBUG_SET_MAGIC(nnpci, ECM_SFE_NON_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC);
+	spin_lock_init(&feci->lock);
+
+	feci->can_accel = can_accel;
+	feci->accel_mode = (can_accel) ? ECM_FRONT_END_ACCELERATION_MODE_DECEL : ECM_FRONT_END_ACCELERATION_MODE_FAIL_DENIED;
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	feci->stats.no_action_seen_limit = ecm_sfe_ipv6_no_action_limit_default;
+	feci->stats.driver_fail_limit = ecm_sfe_ipv6_driver_fail_limit_default;
+	feci->stats.ae_nack_limit = ecm_sfe_ipv6_nack_limit_default;
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	/*
+	 * Copy reference to connection - no need to ref ci as ci maintains a ref to this instance instead (this instance persists for as long as ci does)
+	 */
+	feci->ci = ci;
+
+	/*
+	 * Populate the methods and callbacks
+	 */
+	feci->ref = ecm_sfe_non_ported_ipv6_connection_ref;
+	feci->deref = ecm_sfe_non_ported_ipv6_connection_deref;
+	feci->decelerate = ecm_sfe_non_ported_ipv6_connection_decelerate;
+	feci->accel_state_get = ecm_sfe_non_ported_ipv6_connection_accel_state_get;
+	feci->action_seen = ecm_sfe_non_ported_ipv6_connection_action_seen;
+	feci->accel_ceased = ecm_sfe_non_ported_ipv6_connection_accel_ceased;
+#ifdef ECM_STATE_OUTPUT_ENABLE
+	feci->state_get = ecm_sfe_non_ported_ipv6_connection_state_get;
+#endif
+	feci->ae_interface_number_by_dev_get = ecm_sfe_common_get_interface_number_by_dev;
+
+	return nnpci;
+}
+
+/*
+ * ecm_sfe_non_ported_ipv6_process()
+ *	Process a protocol that does not have port based identifiers
+ */
+unsigned int ecm_sfe_non_ported_ipv6_process(struct net_device *out_dev,
+							struct net_device *in_dev,
+							uint8_t *src_node_addr,
+							uint8_t *dest_node_addr,
+							bool can_accel, bool is_routed, bool is_l2_encap, struct sk_buff *skb,
+							struct ecm_tracker_ip_header *ip_hdr,
+							struct nf_conn *ct, ecm_tracker_sender_type_t sender, ecm_db_direction_t ecm_dir,
+							struct nf_conntrack_tuple *orig_tuple, struct nf_conntrack_tuple *reply_tuple,
+							ip_addr_t ip_src_addr, ip_addr_t ip_dest_addr)
+{
+	struct ecm_db_connection_instance *ci;
+	int protocol;
+	int src_port;
+	int dest_port;
+	ip_addr_t match_addr;
+	struct ecm_classifier_instance *assignments[ECM_CLASSIFIER_TYPES];
+	int aci_index;
+	int assignment_count;
+	ecm_db_timer_group_t ci_orig_timer_group;
+	struct ecm_classifier_process_response prevalent_pr;
+
+	DEBUG_TRACE("Non-ported protocol src: " ECM_IP_ADDR_OCTAL_FMT ", dest: " ECM_IP_ADDR_OCTAL_FMT "\n",
+				ECM_IP_ADDR_TO_OCTAL(ip_src_addr), ECM_IP_ADDR_TO_OCTAL(ip_dest_addr));
+
+	/*
+	 * Look up a connection.
+	 */
+	protocol = (int)orig_tuple->dst.protonum;
+	if ((protocol == IPPROTO_IPIP)) {
+		src_port = 0;
+		dest_port = 0;
+	} else {
+		/*
+		 * Do not accelerate the non-ported connections except the ones we handle.
+		 */
+		can_accel = false;
+
+		/*
+		 * port numbers are just the negative protocol number equivalents for now.
+		 * GGG They could eventually be used as protocol specific identifiers such as icmp id's etc.
+		 */
+		src_port = -protocol;
+		dest_port = -protocol;
+	}
+	ci = ecm_db_connection_find_and_ref(ip_src_addr, ip_dest_addr, protocol, src_port, dest_port);
+
+	/*
+	 * If there is no existing connection then create a new one.
+	 */
+	if (unlikely(!ci)) {
+		struct ecm_db_mapping_instance *src_mi;
+		struct ecm_db_mapping_instance *dest_mi;
+		struct ecm_db_node_instance *src_ni;
+		struct ecm_db_node_instance *dest_ni;
+		struct ecm_classifier_default_instance *dci;
+		struct ecm_front_end_connection_instance *feci;
+		struct ecm_db_connection_instance *nci;
+		ecm_classifier_type_t classifier_type;
+		int32_t to_list_first;
+		struct ecm_db_iface_instance *to_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+		int32_t from_list_first;
+		struct ecm_db_iface_instance *from_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+
+		DEBUG_INFO("New connection from " ECM_IP_ADDR_OCTAL_FMT " to " ECM_IP_ADDR_OCTAL_FMT "\n", ECM_IP_ADDR_TO_OCTAL(ip_src_addr), ECM_IP_ADDR_TO_OCTAL(ip_dest_addr));
+
+		/*
+		 * Before we attempt to create the connection are we being terminated?
+		 */
+		spin_lock_bh(&ecm_sfe_ipv6_lock);
+		if (ecm_sfe_ipv6_terminate_pending) {
+			spin_unlock_bh(&ecm_sfe_ipv6_lock);
+			DEBUG_WARN("Terminating\n");
+
+			/*
+			 * As we are terminating we just allow the packet to pass - it's no longer our concern
+			 */
+			return NF_ACCEPT;
+		}
+		spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+		/*
+		 * Does this connection have a conntrack entry?
+		 */
+		if (ct) {
+			unsigned int conn_count;
+
+			/*
+			 * If we have exceeded the connection limit (according to conntrack) then abort
+			 * NOTE: Conntrack, when at its limit, will destroy a connection to make way for a new.
+			 * Conntrack won't exceed its limit but ECM can due to it needing to hold connections while
+			 * acceleration commands are in-flight.
+			 * This means that ECM can 'fall behind' somewhat with the connection state wrt conntrack connection state.
+			 * This is not seen as an issue since conntrack will have issued us with a destroy event for the flushed connection(s)
+			 * and we will eventually catch up.
+			 * Since ECM is capable of handling connections mid-flow ECM will pick up where it can.
+			 */
+			conn_count = (unsigned int)ecm_db_connection_count_get();
+			if (conn_count >= nf_conntrack_max) {
+				DEBUG_WARN("ECM Connection count limit reached: db: %u, ct: %u\n", conn_count, nf_conntrack_max);
+				return NF_ACCEPT;
+			}
+		}
+
+		/*
+		 * Now allocate the new connection
+		 */
+		nci = ecm_db_connection_alloc();
+		if (!nci) {
+			DEBUG_WARN("Failed to allocate connection\n");
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Connection must have a front end instance associated with it
+		 */
+		feci = (struct ecm_front_end_connection_instance *)ecm_sfe_non_ported_ipv6_connection_instance_alloc(nci, can_accel);
+		if (!feci) {
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to allocate front end\n");
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Get the src and destination mappings
+		 * For this we also need the interface lists which we also set upon the new connection while we are at it.
+		 * GGG TODO rework terms of "src/dest" - these need to be named consistently as from/to as per database terms.
+		 * GGG TODO The empty list checks should not be needed, mapping_establish_and_ref() should fail out if there is no list anyway.
+		 */
+		DEBUG_TRACE("%p: Create the 'from' interface heirarchy list\n", nci);
+		from_list_first = ecm_interface_heirarchy_construct(feci, from_list, ip_dest_addr, ip_src_addr, 6, protocol, in_dev, is_routed, in_dev, src_node_addr, dest_node_addr);
+		if (from_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to obtain 'from' heirarchy list\n");
+			return NF_ACCEPT;
+		}
+		ecm_db_connection_from_interfaces_reset(nci, from_list, from_list_first);
+
+		DEBUG_TRACE("%p: Create source node\n", nci);
+		src_ni = ecm_sfe_ipv6_node_establish_and_ref(feci, in_dev, ip_src_addr, from_list, from_list_first, src_node_addr);
+		ecm_db_connection_interfaces_deref(from_list, from_list_first);
+		if (!src_ni) {
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish source node\n");
+			return NF_ACCEPT;
+		}
+
+		DEBUG_TRACE("%p: Create source mapping\n", nci);
+		src_mi = ecm_sfe_ipv6_mapping_establish_and_ref(ip_src_addr, src_port);
+		if (!src_mi) {
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish src mapping\n");
+			return NF_ACCEPT;
+		}
+
+		DEBUG_TRACE("%p: Create the 'to' interface heirarchy list\n", nci);
+		to_list_first = ecm_interface_heirarchy_construct(feci, to_list, ip_src_addr, ip_dest_addr, 6, protocol, out_dev, is_routed, in_dev, dest_node_addr, src_node_addr);
+		if (to_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to obtain 'to' heirarchy list\n");
+			return NF_ACCEPT;
+		}
+		ecm_db_connection_to_interfaces_reset(nci, to_list, to_list_first);
+
+		DEBUG_TRACE("%p: Create dest node\n", nci);
+		dest_ni = ecm_sfe_ipv6_node_establish_and_ref(feci, out_dev, ip_dest_addr, to_list, to_list_first, dest_node_addr);
+		ecm_db_connection_interfaces_deref(to_list, to_list_first);
+		if (!dest_ni) {
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish dest node\n");
+			return NF_ACCEPT;
+		}
+
+		DEBUG_TRACE("%p: Create dest mapping\n", nci);
+		dest_mi = ecm_sfe_ipv6_mapping_establish_and_ref(ip_dest_addr, dest_port);
+		if (!dest_mi) {
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish dest mapping\n");
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Every connection also needs a default classifier
+		 */
+		dci = ecm_classifier_default_instance_alloc(nci, protocol, ecm_dir, src_port, dest_port);
+		if (!dci) {
+			feci->deref(feci);
+			ecm_db_mapping_deref(dest_mi);
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to allocate default classifier\n");
+			return NF_ACCEPT;
+		}
+		ecm_db_connection_classifier_assign(nci, (struct ecm_classifier_instance *)dci);
+
+		/*
+		 * Every connection starts with a full complement of classifiers assigned.
+		 * NOTE: Default classifier is a special case considered previously
+		 */
+		for (classifier_type = ECM_CLASSIFIER_TYPE_DEFAULT + 1; classifier_type < ECM_CLASSIFIER_TYPES; ++classifier_type) {
+			struct ecm_classifier_instance *aci = ecm_sfe_ipv6_assign_classifier(nci, classifier_type);
+			if (aci) {
+				aci->deref(aci);
+			} else {
+				dci->base.deref((struct ecm_classifier_instance *)dci);
+				ecm_db_mapping_deref(dest_mi);
+				ecm_db_node_deref(dest_ni);
+				ecm_db_mapping_deref(src_mi);
+				ecm_db_node_deref(src_ni);
+				feci->deref(feci);
+				ecm_db_connection_deref(nci);
+				DEBUG_WARN("Failed to allocate classifiers assignments\n");
+				return NF_ACCEPT;
+			}
+		}
+
+		/*
+		 * Now add the connection into the database.
+		 * NOTE: In an SMP situation such as ours there is a possibility that more than one packet for the same
+		 * connection is being processed simultaneously.
+		 * We *could* end up creating more than one connection instance for the same actual connection.
+		 * To guard against this we now perform a mutex'd lookup of the connection + add once more - another cpu may have created it before us.
+		 */
+		spin_lock_bh(&ecm_sfe_ipv6_lock);
+		ci = ecm_db_connection_find_and_ref(ip_src_addr, ip_dest_addr, protocol, src_port, dest_port);
+		if (ci) {
+			/*
+			 * Another cpu created the same connection before us - use the one we just found
+			 */
+			spin_unlock_bh(&ecm_sfe_ipv6_lock);
+			ecm_db_connection_deref(nci);
+		} else {
+			struct ecm_tracker_instance *ti;
+			ecm_db_timer_group_t tg;
+			ecm_tracker_sender_state_t src_state;
+			ecm_tracker_sender_state_t dest_state;
+			ecm_tracker_connection_state_t state;
+
+			/*
+			 * Ask tracker for timer group to set the connection to initially.
+			 */
+			ti = dci->tracker_get_and_ref(dci);
+			ti->state_get(ti, &src_state, &dest_state, &state, &tg);
+			ti->deref(ti);
+
+			/*
+			 * Add the new connection we created into the database
+			 * NOTE: assign to a short timer group for now - it is the assigned classifiers responsibility to do this
+			 */
+			ecm_db_connection_add(nci, feci, src_mi, dest_mi, src_mi, dest_mi,
+					src_ni, dest_ni, src_ni, dest_ni,
+					6, protocol, ecm_dir,
+					NULL /* final callback */,
+					ecm_sfe_non_ported_ipv6_connection_defunct_callback,
+					tg, is_routed, nci);
+
+			spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+			ci = nci;
+			DEBUG_INFO("%p: New Non-ported protocol %d connection created\n", ci, protocol);
+		}
+
+		/*
+		 * No longer need referenecs to the objects we created
+		 */
+		dci->base.deref((struct ecm_classifier_instance *)dci);
+		ecm_db_mapping_deref(dest_mi);
+		ecm_db_node_deref(dest_ni);
+		ecm_db_mapping_deref(src_mi);
+		ecm_db_node_deref(src_ni);
+		feci->deref(feci);
+	}
+
+	/*
+	 * Keep connection alive as we have seen activity
+	 */
+	if (!ecm_db_connection_defunct_timer_touch(ci)) {
+		ecm_db_connection_deref(ci);
+		return NF_ACCEPT;
+	}
+
+	/*
+	 * Identify which side of the connection is sending
+	 * NOTE: This may be different than what sender is at the moment
+	 * given the connection we have located.
+	 */
+	ecm_db_connection_from_address_get(ci, match_addr);
+	if (ECM_IP_ADDR_MATCH(ip_src_addr, match_addr)) {
+		sender = ECM_TRACKER_SENDER_TYPE_SRC;
+	} else {
+		sender = ECM_TRACKER_SENDER_TYPE_DEST;
+	}
+
+	/*
+	 * Do we need to action generation change?
+	 */
+	if (unlikely(ecm_db_connection_regeneration_required_check(ci))) {
+		ecm_sfe_ipv6_connection_regenerate(ci, sender, out_dev, in_dev);
+	}
+
+	/*
+	 * Iterate the assignments and call to process!
+	 * Policy implemented:
+	 * 1. Classifiers that say they are not relevant are unassigned and not actioned further.
+	 * 2. Any drop command from any classifier is honoured.
+	 * 3. Accel is never allowed for non-ported type connections.
+	 * 4. Only the highest priority classifier, that actions it, will have its qos tag honoured.
+	 * 5. Only the highest priority classifier, that actions it, will have its timer group honoured.
+	 */
+	DEBUG_TRACE("%p: process begin, skb: %p\n", ci, skb);
+	prevalent_pr.process_actions = 0;
+	prevalent_pr.drop = false;
+	prevalent_pr.flow_qos_tag = skb->priority;
+	prevalent_pr.return_qos_tag = skb->priority;
+	prevalent_pr.accel_mode = ECM_CLASSIFIER_ACCELERATION_MODE_ACCEL;
+	prevalent_pr.timer_group = ci_orig_timer_group = ecm_db_connection_timer_group_get(ci);
+
+	assignment_count = ecm_db_connection_classifier_assignments_get_and_ref(ci, assignments);
+	for (aci_index = 0; aci_index < assignment_count; ++aci_index) {
+		struct ecm_classifier_process_response aci_pr;
+		struct ecm_classifier_instance *aci;
+
+		aci = assignments[aci_index];
+		DEBUG_TRACE("%p: process: %p, type: %d\n", ci, aci, aci->type_get(aci));
+		aci->process(aci, sender, ip_hdr, skb, &aci_pr);
+		DEBUG_TRACE("%p: aci_pr: process actions: %x, became relevant: %u, relevance: %d, drop: %d, "
+				"flow_qos_tag: %u, return_qos_tag: %u, accel_mode: %x, timer_group: %d\n",
+				ci, aci_pr.process_actions, aci_pr.became_relevant, aci_pr.relevance, aci_pr.drop,
+				aci_pr.flow_qos_tag, aci_pr.return_qos_tag, aci_pr.accel_mode, aci_pr.timer_group);
+
+		if (aci_pr.relevance == ECM_CLASSIFIER_RELEVANCE_NO) {
+			ecm_classifier_type_t aci_type;
+
+			/*
+			 * This classifier can be unassigned - PROVIDED it is not the default classifier
+			 */
+			aci_type = aci->type_get(aci);
+			if (aci_type == ECM_CLASSIFIER_TYPE_DEFAULT) {
+				continue;
+			}
+
+			DEBUG_INFO("%p: Classifier not relevant, unassign: %d", ci, aci_type);
+			ecm_db_connection_classifier_unassign(ci, aci);
+			continue;
+		}
+
+		/*
+		 * Yes or Maybe relevant.
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DROP) {
+			/*
+			 * Drop command from any classifier is actioned.
+			 */
+			DEBUG_TRACE("%p: wants drop: %p, type: %d, skb: %p\n", ci, aci, aci->type_get(aci), skb);
+			prevalent_pr.drop |= aci_pr.drop;
+		}
+
+		/*
+		 * Accel mode permission
+		 */
+		if (aci_pr.relevance == ECM_CLASSIFIER_RELEVANCE_MAYBE) {
+			/*
+			 * Classifier not sure of its relevance - cannot accel yet
+			 */
+			DEBUG_TRACE("%p: accel denied by maybe: %p, type: %d\n", ci, aci, aci->type_get(aci));
+			prevalent_pr.accel_mode = ECM_CLASSIFIER_ACCELERATION_MODE_NO;
+		} else {
+			if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_ACCEL_MODE) {
+				if (aci_pr.accel_mode == ECM_CLASSIFIER_ACCELERATION_MODE_NO) {
+					DEBUG_TRACE("%p: accel denied: %p, type: %d\n", ci, aci, aci->type_get(aci));
+					prevalent_pr.accel_mode = ECM_CLASSIFIER_ACCELERATION_MODE_NO;
+				}
+				/* else yes or don't care about accel */
+			}
+		}
+
+		/*
+		 * Timer group (the last classifier i.e. the highest priority one) will 'win'
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_TIMER_GROUP) {
+			DEBUG_TRACE("%p: timer group: %p, type: %d, group: %d\n", ci, aci, aci->type_get(aci), aci_pr.timer_group);
+			prevalent_pr.timer_group = aci_pr.timer_group;
+		}
+
+		/*
+		 * Qos tag (the last classifier i.e. the highest priority one) will 'win'
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_QOS_TAG) {
+			DEBUG_TRACE("%p: aci: %p, type: %d, flow qos tag: %u, return qos tag: %u\n",
+					ci, aci, aci->type_get(aci), aci_pr.flow_qos_tag, aci_pr.return_qos_tag);
+			prevalent_pr.flow_qos_tag = aci_pr.flow_qos_tag;
+			prevalent_pr.return_qos_tag = aci_pr.return_qos_tag;
+		}
+
+#ifdef ECM_CLASSIFIER_DSCP_ENABLE
+		/*
+		 * If any classifier denied DSCP remarking then that overrides every classifier
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DSCP_DENY) {
+			DEBUG_TRACE("%p: aci: %p, type: %d, DSCP remark denied\n",
+					ci, aci, aci->type_get(aci));
+			prevalent_pr.process_actions |= ECM_CLASSIFIER_PROCESS_ACTION_DSCP_DENY;
+			prevalent_pr.process_actions &= ~ECM_CLASSIFIER_PROCESS_ACTION_DSCP;
+		}
+
+		/*
+		 * DSCP remark action, but only if it has not been denied by any classifier
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DSCP) {
+			if (!(prevalent_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DSCP_DENY)) {
+				DEBUG_TRACE("%p: aci: %p, type: %d, DSCP remark wanted, flow_dscp: %u, return dscp: %u\n",
+						ci, aci, aci->type_get(aci), aci_pr.flow_dscp, aci_pr.return_dscp);
+				prevalent_pr.process_actions |= ECM_CLASSIFIER_PROCESS_ACTION_DSCP;
+				prevalent_pr.flow_dscp = aci_pr.flow_dscp;
+				prevalent_pr.return_dscp = aci_pr.return_dscp;
+			}
+		}
+#endif
+	}
+	ecm_db_connection_assignments_release(assignment_count, assignments);
+
+	/*
+	 * Change timer group?
+	 */
+	if (ci_orig_timer_group != prevalent_pr.timer_group) {
+		DEBUG_TRACE("%p: change timer group from: %d to: %d\n", ci, ci_orig_timer_group, prevalent_pr.timer_group);
+		ecm_db_connection_defunct_timer_reset(ci, prevalent_pr.timer_group);
+	}
+
+	/*
+	 * Drop?
+	 */
+	if (prevalent_pr.drop) {
+		DEBUG_TRACE("%p: drop: %p\n", ci, skb);
+		ecm_db_connection_data_totals_update_dropped(ci, (sender == ECM_TRACKER_SENDER_TYPE_SRC)? true : false, skb->len, 1);
+		ecm_db_connection_deref(ci);
+		return NF_ACCEPT;
+	}
+	ecm_db_connection_data_totals_update(ci, (sender == ECM_TRACKER_SENDER_TYPE_SRC)? true : false, skb->len, 1);
+
+	/*
+	 * Assign qos tag
+	 * GGG TODO Should we use sender to identify whether to use flow or return qos tag?
+	 */
+	skb->priority = prevalent_pr.flow_qos_tag;
+	DEBUG_TRACE("%p: skb priority: %u\n", ci, skb->priority);
+
+	/*
+	 * Accelerate?
+	 */
+	if (prevalent_pr.accel_mode == ECM_CLASSIFIER_ACCELERATION_MODE_ACCEL) {
+		struct ecm_front_end_connection_instance *feci;
+		DEBUG_TRACE("%p: accel\n", ci);
+		feci = ecm_db_connection_front_end_get_and_ref(ci);
+		ecm_sfe_non_ported_ipv6_connection_accelerate(feci, &prevalent_pr, is_l2_encap);
+		feci->deref(feci);
+	}
+	ecm_db_connection_deref(ci);
+
+	return NF_ACCEPT;
+}
+
+/*
+ * ecm_sfe_non_ported_ipv6_debugfs_init()
+ */
+bool ecm_sfe_non_ported_ipv6_debugfs_init(struct dentry *dentry)
+{
+	if (!debugfs_create_u32("non_ported_accelerated_count", S_IRUGO, dentry,
+					(u32 *)&ecm_sfe_non_ported_ipv6_accelerated_count)) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv6 non_ported_accelerated_count file in debugfs\n");
+		return false;
+	}
+
+	return true;
+}
diff --git a/frontends/sfe/ecm_sfe_non_ported_ipv6.h b/frontends/sfe/ecm_sfe_non_ported_ipv6.h
new file mode 100644
index 0000000..77e6372
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_non_ported_ipv6.h
@@ -0,0 +1,27 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015, The Linux Foundation.  All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+extern unsigned int ecm_sfe_non_ported_ipv6_process(struct net_device *out_dev,
+							struct net_device *in_dev,
+							uint8_t *src_node_addr,
+							uint8_t *dest_node_addr,
+							bool can_accel, bool is_routed, bool is_l2_encap, struct sk_buff *skb,
+							struct ecm_tracker_ip_header *ip_hdr,
+							struct nf_conn *ct, ecm_tracker_sender_type_t sender, ecm_db_direction_t ecm_dir,
+							struct nf_conntrack_tuple *orig_tuple, struct nf_conntrack_tuple *reply_tuple,
+							ip_addr_t ip_src_addr, ip_addr_t ip_dest_addr);
+extern bool ecm_sfe_non_ported_ipv6_debugfs_init(struct dentry *dentry);
+
diff --git a/frontends/sfe/ecm_sfe_ported_ipv4.c b/frontends/sfe/ecm_sfe_ported_ipv4.c
new file mode 100644
index 0000000..bf333a3
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_ported_ipv4.c
@@ -0,0 +1,2478 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015 The Linux Foundation.  All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+#include <linux/version.h>
+#include <linux/types.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/icmp.h>
+#include <linux/kthread.h>
+#include <linux/pkt_sched.h>
+#include <linux/debugfs.h>
+#include <linux/string.h>
+#include <net/route.h>
+#include <net/ip.h>
+#include <net/tcp.h>
+#include <asm/unaligned.h>
+#include <asm/uaccess.h>	/* for put_user */
+#include <net/ipv6.h>
+#include <linux/inet.h>
+#include <linux/in.h>
+#include <linux/udp.h>
+#include <linux/tcp.h>
+
+#include <linux/inetdevice.h>
+#include <linux/if_arp.h>
+#include <linux/netfilter_ipv4.h>
+#include <linux/netfilter_bridge.h>
+#include <linux/if_bridge.h>
+#include <net/arp.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_acct.h>
+#include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_l4proto.h>
+#include <net/netfilter/nf_conntrack_l3proto.h>
+#include <net/netfilter/nf_conntrack_zones.h>
+#include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
+#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+#include <linux/../../net/8021q/vlan.h>
+#include <linux/if_vlan.h>
+#endif
+
+/*
+ * Debug output levels
+ * 0 = OFF
+ * 1 = ASSERTS / ERRORS
+ * 2 = 1 + WARN
+ * 3 = 2 + INFO
+ * 4 = 3 + TRACE
+ */
+#define DEBUG_LEVEL ECM_SFE_PORTED_IPV4_DEBUG_LEVEL
+
+#include <sfe_drv.h>
+
+#include "ecm_types.h"
+#include "ecm_db_types.h"
+#include "ecm_state.h"
+#include "ecm_tracker.h"
+#include "ecm_classifier.h"
+#include "ecm_front_end_types.h"
+#include "ecm_tracker_datagram.h"
+#include "ecm_tracker_udp.h"
+#include "ecm_tracker_tcp.h"
+#include "ecm_db.h"
+#include "ecm_classifier_default.h"
+#include "ecm_interface.h"
+#include "ecm_sfe_ported_ipv4.h"
+#include "ecm_sfe_ipv4.h"
+#include "ecm_sfe_common.h"
+
+/*
+ * Magic numbers
+ */
+#define ECM_SFE_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC 0xED56
+
+/*
+ * Protocol type that ported file supports.
+ */
+enum ecm_sfe_ported_ipv4_proto_types {
+	ECM_SFE_PORTED_IPV4_PROTO_TCP = 0,
+	ECM_SFE_PORTED_IPV4_PROTO_UDP,
+	ECM_SFE_PORTED_IPV4_PROTO_MAX
+
+};
+
+/*
+ * struct ecm_sfe_ipv4_ported_connection_instance
+ *	A connection specific front end instance for PORTED connections
+ */
+struct ecm_sfe_ported_ipv4_connection_instance {
+	struct ecm_front_end_connection_instance base;		/* Base class */
+	uint8_t ported_accelerated_count_index;			/* Index value of accelerated count array (UDP or TCP) */
+#if (DEBUG_LEVEL > 0)
+	uint16_t magic;
+#endif
+};
+
+static int ecm_sfe_ported_ipv4_accelerated_count[ECM_SFE_PORTED_IPV4_PROTO_MAX] = {0};
+						/* Array of Number of TCP and UDP connections currently offloaded */
+
+/*
+ * Expose what should be a static flag in the TCP connection tracker.
+ */
+#ifdef ECM_OPENWRT_SUPPORT
+extern int nf_ct_tcp_no_window_check;
+#endif
+extern int nf_ct_tcp_be_liberal;
+
+/*
+ * ecm_sfe_ported_ipv4_connection_callback()
+ *	Callback for handling create ack/nack calls.
+ */
+static void ecm_sfe_ported_ipv4_connection_callback(void *app_data, struct sfe_ipv4_msg *nim)
+{
+	struct sfe_ipv4_rule_create_msg * __attribute__((unused)) nircm = &nim->msg.rule_create;
+	uint32_t serial = (uint32_t)app_data;
+	struct ecm_db_connection_instance *ci;
+	struct ecm_front_end_connection_instance *feci;
+	struct ecm_sfe_ported_ipv4_connection_instance *npci;
+	ecm_front_end_acceleration_mode_t result_mode;
+
+	/*
+	 * Is this a response to a create message?
+	 */
+	if (nim->cm.type != SFE_TX_CREATE_RULE_MSG) {
+		DEBUG_ERROR("%p: ported create callback with improper type: %d, serial: %u\n", nim, nim->cm.type, serial);
+		return;
+	}
+
+	/*
+	 * Look up ecm connection so that we can update the status.
+	 */
+	ci = ecm_db_connection_serial_find_and_ref(serial);
+	if (!ci) {
+		DEBUG_TRACE("%p: create callback, connection not found, serial: %u\n", nim, serial);
+		return;
+	}
+
+	/*
+	 * Release ref held for this ack/nack response.
+	 * NOTE: It's okay to do this here, ci won't go away, because the ci is held as
+	 * a result of the ecm_db_connection_serial_find_and_ref()
+	 */
+	ecm_db_connection_deref(ci);
+
+	/*
+	 * Get the front end instance
+	 */
+	feci = ecm_db_connection_front_end_get_and_ref(ci);
+	npci = (struct ecm_sfe_ported_ipv4_connection_instance *)feci;
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+
+	/*
+	 * Record command duration
+	 */
+	ecm_sfe_ipv4_accel_done_time_update(feci);
+
+	/*
+	 * Dump some useful trace information.
+	 */
+	DEBUG_TRACE("%p: accelerate response for connection: %p, serial: %u\n", npci, feci->ci, serial);
+	DEBUG_TRACE("%p: rule_flags: %x, valid_flags: %x\n", npci, nircm->rule_flags, nircm->valid_flags);
+	DEBUG_TRACE("%p: flow_ip: %pI4n:%d\n", npci, &nircm->tuple.flow_ip, nircm->tuple.flow_ident);
+	DEBUG_TRACE("%p: return_ip: %pI4n:%d\n", npci, &nircm->tuple.return_ip, nircm->tuple.return_ident);
+	DEBUG_TRACE("%p: protocol: %d\n", npci, nircm->tuple.protocol);
+
+	/*
+	 * Handle the creation result code.
+	 */
+	DEBUG_TRACE("%p: response: %d\n", npci, nim->cm.response);
+	if (nim->cm.response != SFE_CMN_RESPONSE_ACK) {
+		/*
+		 * Creation command failed (specific reason ignored).
+		 */
+		DEBUG_TRACE("%p: accel nack: %d\n", npci, nim->cm.error);
+		spin_lock_bh(&feci->lock);
+		DEBUG_ASSERT(feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING, "%p: Unexpected mode: %d\n", ci, feci->accel_mode);
+		feci->stats.ae_nack++;
+		feci->stats.ae_nack_total++;
+		if (feci->stats.ae_nack >= feci->stats.ae_nack_limit) {
+			/*
+			 * Too many SFE rejections
+			 */
+			result_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_ACCEL_ENGINE;
+		} else {
+			/*
+			 * Revert to decelerated
+			 */
+			result_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL;
+		}
+
+		/*
+		 * If connection is now defunct then set mode to ensure no further accel attempts occur
+		 */
+		if (feci->is_defunct) {
+			result_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DEFUNCT;
+		}
+
+		spin_lock_bh(&ecm_sfe_ipv4_lock);
+		_ecm_sfe_ipv4_accel_pending_clear(feci, result_mode);
+		spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+		spin_unlock_bh(&feci->lock);
+
+		/*
+		 * Release the connection.
+		 */
+		feci->deref(feci);
+		ecm_db_connection_deref(ci);
+		return;
+	}
+
+	spin_lock_bh(&feci->lock);
+	DEBUG_ASSERT(feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING, "%p: Unexpected mode: %d\n", ci, feci->accel_mode);
+
+	/*
+	 * If a flush occured before we got the ACK then our acceleration was effectively cancelled on us
+	 * GGG TODO This is a workaround for a SFE message OOO quirk, this should eventually be removed.
+	 */
+	if (feci->stats.flush_happened) {
+		feci->stats.flush_happened = false;
+
+		/*
+		 * Increment the no-action counter.  Our connection was decelerated on us with no action occurring.
+		 */
+		feci->stats.no_action_seen++;
+
+		spin_lock_bh(&ecm_sfe_ipv4_lock);
+		_ecm_sfe_ipv4_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_DECEL);
+		spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+		spin_unlock_bh(&feci->lock);
+
+		/*
+		 * Release the connection.
+		 */
+		feci->deref(feci);
+		ecm_db_connection_deref(ci);
+		return;
+	}
+
+	/*
+	 * Create succeeded
+	 */
+
+	/*
+	 * Clear any nack count
+	 */
+	feci->stats.ae_nack = 0;
+
+	/*
+	 * Clear the "accelerate pending" state and move to "accelerated" state bumping
+	 * the accelerated counters to match our new state.
+	 *
+	 * Decelerate may have been attempted while we were "pending accel" and
+	 * this function will return true if that was the case.
+	 * If decelerate was pending then we need to begin deceleration :-(
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+
+	ecm_sfe_ported_ipv4_accelerated_count[npci->ported_accelerated_count_index]++;	/* Protocol specific counter */
+	ecm_sfe_ipv4_accelerated_count++;		/* General running counter */
+
+	if (!_ecm_sfe_ipv4_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_ACCEL)) {
+		/*
+		 * Increment the no-action counter, this is reset if offload action is seen
+		 */
+		feci->stats.no_action_seen++;
+
+		spin_unlock_bh(&ecm_sfe_ipv4_lock);
+		spin_unlock_bh(&feci->lock);
+
+		/*
+		 * Release the connection.
+		 */
+		feci->deref(feci);
+		ecm_db_connection_deref(ci);
+		return;
+	}
+
+	DEBUG_INFO("%p: Decelerate was pending\n", ci);
+
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+	spin_unlock_bh(&feci->lock);
+
+	feci->decelerate(feci);
+
+	/*
+	 * Release the connection.
+	 */
+	feci->deref(feci);
+	ecm_db_connection_deref(ci);
+}
+
+/*
+ * ecm_sfe_ported_ipv4_connection_accelerate()
+ *	Accelerate a connection
+ */
+static void ecm_sfe_ported_ipv4_connection_accelerate(struct ecm_front_end_connection_instance *feci,
+									struct ecm_classifier_process_response *pr, bool is_l2_encap,
+									struct nf_conn *ct)
+{
+	struct ecm_sfe_ported_ipv4_connection_instance *npci = (struct ecm_sfe_ported_ipv4_connection_instance *)feci;
+	uint16_t regen_occurrances;
+	int protocol;
+	int32_t from_ifaces_first;
+	int32_t to_ifaces_first;
+	struct ecm_db_iface_instance *from_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX];
+	struct ecm_db_iface_instance *to_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX];
+	struct ecm_db_iface_instance *from_sfe_iface;
+	struct ecm_db_iface_instance *to_sfe_iface;
+	int32_t from_sfe_iface_id;
+	int32_t to_sfe_iface_id;
+	uint8_t from_sfe_iface_address[ETH_ALEN];
+	uint8_t to_sfe_iface_address[ETH_ALEN];
+	ip_addr_t addr;
+	struct sfe_ipv4_msg nim;
+	struct sfe_ipv4_rule_create_msg *nircm;
+	struct ecm_classifier_instance *assignments[ECM_CLASSIFIER_TYPES];
+	int aci_index;
+	int assignment_count;
+	sfe_tx_status_t sfe_tx_status;
+	int32_t list_index;
+	int32_t interface_type_counts[ECM_DB_IFACE_TYPE_COUNT];
+	bool rule_invalid;
+	uint8_t dest_mac_xlate[ETH_ALEN];
+	ecm_db_direction_t ecm_dir;
+	ecm_front_end_acceleration_mode_t result_mode;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+
+	/*
+	 * Get the re-generation occurrance counter of the connection.
+	 * We compare it again at the end - to ensure that the rule construction has seen no generation
+	 * changes during rule creation.
+	 */
+	regen_occurrances = ecm_db_connection_regeneration_occurrances_get(feci->ci);
+
+	/*
+	 * Test if acceleration is permitted
+	 */
+	if (!ecm_sfe_ipv4_accel_pending_set(feci)) {
+		DEBUG_TRACE("%p: Acceleration not permitted: %p\n", feci, feci->ci);
+		return;
+	}
+
+	/*
+	 * Okay construct an accel command.
+	 * Initialise creation structure.
+	 * NOTE: We leverage the app_data void pointer to be our 32 bit connection serial number.
+	 * When we get it back we re-cast it to a uint32 and do a faster connection lookup.
+	 */
+	memset(&nim, 0, sizeof(struct sfe_ipv4_msg));
+	sfe_ipv4_msg_init(&nim, SFE_SPECIAL_INTERFACE_IPV4, SFE_TX_CREATE_RULE_MSG,
+			sizeof(struct sfe_ipv4_rule_create_msg),
+			ecm_sfe_ported_ipv4_connection_callback,
+			(void *)ecm_db_connection_serial_get(feci->ci));
+
+	nircm = &nim.msg.rule_create;
+	nircm->valid_flags = 0;
+	nircm->rule_flags = 0;
+
+	/*
+	 * Initialize VLAN tag information
+	 */
+	nircm->vlan_primary_rule.ingress_vlan_tag = SFE_VLAN_ID_NOT_CONFIGURED;
+	nircm->vlan_primary_rule.egress_vlan_tag = SFE_VLAN_ID_NOT_CONFIGURED;
+	nircm->vlan_secondary_rule.ingress_vlan_tag = SFE_VLAN_ID_NOT_CONFIGURED;
+	nircm->vlan_secondary_rule.egress_vlan_tag = SFE_VLAN_ID_NOT_CONFIGURED;
+
+	/*
+	 * Get the interface lists of the connection, we must have at least one interface in the list to continue
+	 */
+	from_ifaces_first = ecm_db_connection_from_interfaces_get_and_ref(feci->ci, from_ifaces);
+	if (from_ifaces_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+		DEBUG_WARN("%p: Accel attempt failed - no interfaces in from_interfaces list!\n", feci);
+		goto ported_accel_bad_rule;
+	}
+
+	to_ifaces_first = ecm_db_connection_to_interfaces_get_and_ref(feci->ci, to_ifaces);
+	if (to_ifaces_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+		DEBUG_WARN("%p: Accel attempt failed - no interfaces in to_interfaces list!\n", npci);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		goto ported_accel_bad_rule;
+	}
+
+	/*
+	 * First interface in each must be a known sfe interface
+	 */
+	from_sfe_iface = from_ifaces[from_ifaces_first];
+	to_sfe_iface = to_ifaces[to_ifaces_first];
+	from_sfe_iface_id = ecm_db_iface_ae_interface_identifier_get(from_sfe_iface);
+	to_sfe_iface_id = ecm_db_iface_ae_interface_identifier_get(to_sfe_iface);
+	if ((from_sfe_iface_id < 0) || (to_sfe_iface_id < 0)) {
+		DEBUG_TRACE("%p: from_sfe_iface_id: %d, to_sfe_iface_id: %d\n", npci, from_sfe_iface_id, to_sfe_iface_id);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
+		goto ported_accel_bad_rule;
+	}
+
+	/*
+	 * New rule being created
+	 */
+	nircm->valid_flags |= SFE_RULE_CREATE_CONN_VALID;
+
+	/*
+	 * Set interface numbers involved in accelerating this connection.
+	 * These are the outer facing addresses from the heirarchy interface lists we got above.
+	 * These may be overridden later if we detect special interface types e.g. ipsec.
+	 */
+	nircm->conn_rule.flow_interface_num = from_sfe_iface_id;
+	nircm->conn_rule.return_interface_num = to_sfe_iface_id;
+
+	/*
+	 * Set interface numbers involved in accelerating this connection.
+	 * These are the inner facing addresses from the heirarchy interface lists we got above.
+	 */
+	nim.msg.rule_create.conn_rule.flow_top_interface_num = ecm_db_iface_interface_identifier_get(from_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX-1]);
+	nim.msg.rule_create.conn_rule.return_top_interface_num = ecm_db_iface_interface_identifier_get(to_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX-1]);
+
+	/*
+	 * We know that each outward facing interface is known to the SFE and so this connection could be accelerated.
+	 * However the lists may also specify other interesting details that must be included in the creation command,
+	 * for example, ethernet MAC, VLAN tagging or PPPoE session information.
+	 * We get this information by walking from the outer to the innermost interface for each list and examine the interface types.
+	 *
+	 * Start with the 'from' (src) side.
+	 * NOTE: The lists may contain a complex heirarchy of similar type of interface e.g. multiple vlans or tunnels within tunnels.
+	 * This SFE cannot handle that - there is no way to describe this in the rule - if we see multiple types that would conflict we have to abort.
+	 */
+	DEBUG_TRACE("%p: Examine from/src heirarchy list\n", npci);
+	memset(interface_type_counts, 0, sizeof(interface_type_counts));
+	rule_invalid = false;
+	for (list_index = from_ifaces_first; !rule_invalid && (list_index < ECM_DB_IFACE_HEIRARCHY_MAX); list_index++) {
+		struct ecm_db_iface_instance *ii;
+		ecm_db_iface_type_t ii_type;
+		char *ii_name;
+
+		ii = from_ifaces[list_index];
+		ii_type = ecm_db_connection_iface_type_get(ii);
+		ii_name = ecm_db_interface_type_to_string(ii_type);
+		DEBUG_TRACE("%p: list_index: %d, ii: %p, type: %d (%s)\n", npci, list_index, ii, ii_type, ii_name);
+
+		/*
+		 * Extract information from this interface type if it is applicable to the rule.
+		 * Conflicting information may cause accel to be unsupported.
+		 */
+		switch (ii_type) {
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			struct ecm_db_interface_info_pppoe pppoe_info;
+#endif
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			struct ecm_db_interface_info_vlan vlan_info;
+			uint32_t vlan_value = 0;
+			struct net_device *vlan_in_dev = NULL;
+#endif
+		case ECM_DB_IFACE_TYPE_BRIDGE:
+			DEBUG_TRACE("%p: Bridge\n", npci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Cannot cascade bridges
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: Bridge - ignore additional\n", npci);
+				break;
+			}
+			ecm_db_iface_bridge_address_get(ii, from_sfe_iface_address);
+			DEBUG_TRACE("%p: Bridge - mac: %pM\n", npci, from_sfe_iface_address);
+			break;
+		case ECM_DB_IFACE_TYPE_ETHERNET:
+			DEBUG_TRACE("%p: Ethernet\n", npci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Ignore additional mac addresses, these are usually as a result of address propagation
+				 * from bridges down to ports etc.
+				 */
+				DEBUG_TRACE("%p: Ethernet - ignore additional\n", npci);
+				break;
+			}
+
+			/*
+			 * Can only handle one MAC, the first outermost mac.
+			 */
+			ecm_db_iface_ethernet_address_get(ii, from_sfe_iface_address);
+			DEBUG_TRACE("%p: Ethernet - mac: %pM\n", npci, from_sfe_iface_address);
+			break;
+		case ECM_DB_IFACE_TYPE_PPPOE:
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			/*
+			 * More than one PPPoE in the list is not valid!
+			 */
+			if (interface_type_counts[ii_type] != 0) {
+				DEBUG_TRACE("%p: PPPoE - additional unsupported\n", npci);
+				rule_invalid = true;
+				break;
+			}
+
+			/*
+			 * Copy pppoe session info to the creation structure.
+			 */
+			ecm_db_iface_pppoe_session_info_get(ii, &pppoe_info);
+
+			nircm->pppoe_rule.flow_pppoe_session_id = pppoe_info.pppoe_session_id;
+			memcpy(nircm->pppoe_rule.flow_pppoe_remote_mac, pppoe_info.remote_mac, ETH_ALEN);
+			nircm->valid_flags |= SFE_RULE_CREATE_PPPOE_VALID;
+
+			DEBUG_TRACE("%p: PPPoE - session: %x, mac: %pM\n", npci,
+					nircm->pppoe_rule.flow_pppoe_session_id,
+					nircm->pppoe_rule.flow_pppoe_remote_mac);
+#else
+			rule_invalid = true;
+#endif
+			break;
+		case ECM_DB_IFACE_TYPE_VLAN:
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			DEBUG_TRACE("%p: VLAN\n", npci);
+			if (interface_type_counts[ii_type] > 1) {
+				/*
+				 * Can only support two vlans
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: VLAN - additional unsupported\n", npci);
+				break;
+			}
+			ecm_db_iface_vlan_info_get(ii, &vlan_info);
+			vlan_value = ((vlan_info.vlan_tpid << 16) | vlan_info.vlan_tag);
+
+			/*
+			 * Look up the vlan device and incorporate the vlan priority into the vlan_value
+			 */
+			vlan_in_dev = dev_get_by_index(&init_net, ecm_db_iface_interface_identifier_get(ii));
+			if (vlan_in_dev) {
+				vlan_value |= vlan_dev_get_egress_prio(vlan_in_dev, pr->return_qos_tag);
+				dev_put(vlan_in_dev);
+				vlan_in_dev = NULL;
+			}
+
+			/*
+			 * Primary or secondary (QinQ) VLAN?
+			 */
+			if (interface_type_counts[ii_type] == 0) {
+				nircm->vlan_primary_rule.ingress_vlan_tag = vlan_value;
+			} else {
+				nircm->vlan_secondary_rule.ingress_vlan_tag = vlan_value;
+			}
+			nircm->valid_flags |= SFE_RULE_CREATE_VLAN_VALID;
+
+			/*
+			 * If we have not yet got an ethernet mac then take this one (very unlikely as mac should have been propagated to the slave (outer) device
+			 */
+			if (interface_type_counts[ECM_DB_IFACE_TYPE_ETHERNET] == 0) {
+				memcpy(from_sfe_iface_address, vlan_info.address, ETH_ALEN);
+				interface_type_counts[ECM_DB_IFACE_TYPE_ETHERNET]++;
+				DEBUG_TRACE("%p: VLAN use mac: %pM\n", npci, from_sfe_iface_address);
+			}
+			DEBUG_TRACE("%p: vlan tag: %x\n", npci, vlan_value);
+#else
+			rule_invalid = true;
+			DEBUG_TRACE("%p: VLAN - unsupported\n", npci);
+#endif
+			break;
+		case ECM_DB_IFACE_TYPE_IPSEC_TUNNEL:
+#ifdef ECM_INTERFACE_IPSEC_ENABLE
+			DEBUG_TRACE("%p: IPSEC\n", npci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Can only support one ipsec
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: IPSEC - additional unsupported\n", npci);
+				break;
+			}
+			nircm->conn_rule.flow_interface_num = SFE_SPECIAL_INTERFACE_IPSEC;
+#else
+			rule_invalid = true;
+			DEBUG_TRACE("%p: IPSEC - unsupported\n", npci);
+#endif
+			break;
+		default:
+			DEBUG_TRACE("%p: Ignoring: %d (%s)\n", npci, ii_type, ii_name);
+		}
+
+		/*
+		 * Seen an interface of this type
+		 */
+		interface_type_counts[ii_type]++;
+	}
+	if (rule_invalid) {
+		DEBUG_WARN("%p: from/src Rule invalid\n", npci);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
+		goto ported_accel_bad_rule;
+	}
+
+	/*
+	 * Now examine the TO / DEST heirarchy list to construct the destination part of the rule
+	 */
+	DEBUG_TRACE("%p: Examine to/dest heirarchy list\n", npci);
+	memset(interface_type_counts, 0, sizeof(interface_type_counts));
+	rule_invalid = false;
+	for (list_index = to_ifaces_first; !rule_invalid && (list_index < ECM_DB_IFACE_HEIRARCHY_MAX); list_index++) {
+		struct ecm_db_iface_instance *ii;
+		ecm_db_iface_type_t ii_type;
+		char *ii_name;
+
+		ii = to_ifaces[list_index];
+		ii_type = ecm_db_connection_iface_type_get(ii);
+		ii_name = ecm_db_interface_type_to_string(ii_type);
+		DEBUG_TRACE("%p: list_index: %d, ii: %p, type: %d (%s)\n", npci, list_index, ii, ii_type, ii_name);
+
+		/*
+		 * Extract information from this interface type if it is applicable to the rule.
+		 * Conflicting information may cause accel to be unsupported.
+		 */
+		switch (ii_type) {
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			struct ecm_db_interface_info_pppoe pppoe_info;
+#endif
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			struct ecm_db_interface_info_vlan vlan_info;
+			uint32_t vlan_value = 0;
+			struct net_device *vlan_out_dev = NULL;
+#endif
+		case ECM_DB_IFACE_TYPE_BRIDGE:
+			DEBUG_TRACE("%p: Bridge\n", npci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Cannot cascade bridges
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: Bridge - ignore additional\n", npci);
+				break;
+			}
+			ecm_db_iface_bridge_address_get(ii, to_sfe_iface_address);
+			DEBUG_TRACE("%p: Bridge - mac: %pM\n", npci, to_sfe_iface_address);
+			break;
+		case ECM_DB_IFACE_TYPE_ETHERNET:
+			DEBUG_TRACE("%p: Ethernet\n", npci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Ignore additional mac addresses, these are usually as a result of address propagation
+				 * from bridges down to ports etc.
+				 */
+				DEBUG_TRACE("%p: Ethernet - ignore additional\n", npci);
+				break;
+			}
+
+			/*
+			 * Can only handle one MAC, the first outermost mac.
+			 */
+			ecm_db_iface_ethernet_address_get(ii, to_sfe_iface_address);
+			DEBUG_TRACE("%p: Ethernet - mac: %pM\n", npci, to_sfe_iface_address);
+			break;
+		case ECM_DB_IFACE_TYPE_PPPOE:
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			/*
+			 * More than one PPPoE in the list is not valid!
+			 */
+			if (interface_type_counts[ii_type] != 0) {
+				DEBUG_TRACE("%p: PPPoE - additional unsupported\n", npci);
+				rule_invalid = true;
+				break;
+			}
+
+			/*
+			 * Copy pppoe session info to the creation structure.
+			 */
+			ecm_db_iface_pppoe_session_info_get(ii, &pppoe_info);
+			nircm->pppoe_rule.return_pppoe_session_id = pppoe_info.pppoe_session_id;
+			memcpy(nircm->pppoe_rule.return_pppoe_remote_mac, pppoe_info.remote_mac, ETH_ALEN);
+			nircm->valid_flags |= SFE_RULE_CREATE_PPPOE_VALID;
+
+			DEBUG_TRACE("%p: PPPoE - session: %x, mac: %pM\n", npci,
+				    nircm->pppoe_rule.return_pppoe_session_id,
+				    nircm->pppoe_rule.return_pppoe_remote_mac);
+#else
+			rule_invalid = true;
+#endif
+			break;
+		case ECM_DB_IFACE_TYPE_VLAN:
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			DEBUG_TRACE("%p: VLAN\n", npci);
+			if (interface_type_counts[ii_type] > 1) {
+				/*
+				 * Can only support two vlans
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: VLAN - additional unsupported\n", npci);
+				break;
+			}
+			ecm_db_iface_vlan_info_get(ii, &vlan_info);
+			vlan_value = ((vlan_info.vlan_tpid << 16) | vlan_info.vlan_tag);
+
+			/*
+			 * Look up the vlan device and incorporate the vlan priority into the vlan_value
+			 */
+			vlan_out_dev = dev_get_by_index(&init_net, ecm_db_iface_interface_identifier_get(ii));
+			if (vlan_out_dev) {
+				vlan_value |= vlan_dev_get_egress_prio(vlan_out_dev, pr->flow_qos_tag);
+				dev_put(vlan_out_dev);
+				vlan_out_dev = NULL;
+			}
+
+			/*
+			 * Primary or secondary (QinQ) VLAN?
+			 */
+			if (interface_type_counts[ii_type] == 0) {
+				nircm->vlan_primary_rule.egress_vlan_tag = vlan_value;
+			} else {
+				nircm->vlan_secondary_rule.egress_vlan_tag = vlan_value;
+			}
+			nircm->valid_flags |= SFE_RULE_CREATE_VLAN_VALID;
+
+			/*
+			 * If we have not yet got an ethernet mac then take this one (very unlikely as mac should have been propagated to the slave (outer) device
+			 */
+			if (interface_type_counts[ECM_DB_IFACE_TYPE_ETHERNET] == 0) {
+				memcpy(to_sfe_iface_address, vlan_info.address, ETH_ALEN);
+				interface_type_counts[ECM_DB_IFACE_TYPE_ETHERNET]++;
+				DEBUG_TRACE("%p: VLAN use mac: %pM\n", npci, to_sfe_iface_address);
+			}
+			DEBUG_TRACE("%p: vlan tag: %x\n", npci, vlan_value);
+#else
+			rule_invalid = true;
+			DEBUG_TRACE("%p: VLAN - unsupported\n", npci);
+#endif
+			break;
+		case ECM_DB_IFACE_TYPE_IPSEC_TUNNEL:
+#ifdef ECM_INTERFACE_IPSEC_ENABLE
+			DEBUG_TRACE("%p: IPSEC\n", npci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Can only support one ipsec
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: IPSEC - additional unsupported\n", npci);
+				break;
+			}
+			nircm->conn_rule.return_interface_num = SFE_SPECIAL_INTERFACE_IPSEC;
+#else
+			rule_invalid = true;
+			DEBUG_TRACE("%p: IPSEC - unsupported\n", npci);
+#endif
+			break;
+		default:
+			DEBUG_TRACE("%p: Ignoring: %d (%s)\n", npci, ii_type, ii_name);
+		}
+
+		/*
+		 * Seen an interface of this type
+		 */
+		interface_type_counts[ii_type]++;
+	}
+	if (rule_invalid) {
+		DEBUG_WARN("%p: from/src Rule invalid\n", npci);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
+		goto ported_accel_bad_rule;
+	}
+
+	/*
+	 * Routed or bridged?
+	 */
+	if (ecm_db_connection_is_routed_get(feci->ci)) {
+		nircm->rule_flags |= SFE_RULE_CREATE_FLAG_ROUTED;
+	} else {
+		nircm->rule_flags |= SFE_RULE_CREATE_FLAG_BRIDGE_FLOW;
+		if (is_l2_encap) {
+			nircm->rule_flags |= SFE_RULE_CREATE_FLAG_L2_ENCAP;
+		}
+	}
+
+	/*
+	 * Set up the flow and return qos tags
+	 */
+	nircm->qos_rule.flow_qos_tag = (uint32_t)pr->flow_qos_tag;
+	nircm->qos_rule.return_qos_tag = (uint32_t)pr->return_qos_tag;
+	nircm->valid_flags |= SFE_RULE_CREATE_QOS_VALID;
+
+#ifdef ECM_CLASSIFIER_DSCP_ENABLE
+	/*
+	 * DSCP information?
+	 */
+	if (pr->process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DSCP) {
+		nircm->dscp_rule.flow_dscp = pr->flow_dscp;
+		nircm->dscp_rule.return_dscp = pr->return_dscp;
+		nircm->rule_flags |= SFE_RULE_CREATE_FLAG_DSCP_MARKING;
+		nircm->valid_flags |= SFE_RULE_CREATE_DSCP_MARKING_VALID;
+	}
+#endif
+	protocol = ecm_db_connection_protocol_get(feci->ci);
+
+	/*
+	 * Set protocol
+	 */
+	nircm->tuple.protocol = (int32_t)protocol;
+
+	/*
+	 * The flow_ip is where the connection established from
+	 */
+	ecm_db_connection_from_address_get(feci->ci, addr);
+	ECM_IP_ADDR_TO_NIN4_ADDR(nircm->tuple.flow_ip, addr);
+
+	/*
+	 * The return_ip is where the connection is established to, however, in the case of ingress
+	 * the return_ip would be the routers WAN IP - i.e. the NAT'ed version.
+	 * Getting the NAT'ed version here works for ingress or egress packets, for egress
+	 * the NAT'ed version would be the same as the normal address
+	 */
+	ecm_db_connection_to_address_nat_get(feci->ci, addr);
+	ECM_IP_ADDR_TO_NIN4_ADDR(nircm->tuple.return_ip, addr);
+
+	/*
+	 * When the packet is forwarded to the next interface get the address the source IP of the
+	 * packet should be translated to.  For egress this is the NAT'ed from address.
+	 * This also works for ingress as the NAT'ed version of the WAN host would be the same as non-NAT'ed
+	 */
+	ecm_db_connection_from_address_nat_get(feci->ci, addr);
+	ECM_IP_ADDR_TO_NIN4_ADDR(nircm->conn_rule.flow_ip_xlate, addr);
+
+	/*
+	 * The destination address is what the destination IP is translated to as it is forwarded to the next interface.
+	 * For egress this would yield the normal wan host and for ingress this would correctly NAT back to the LAN host
+	 */
+	ecm_db_connection_to_address_get(feci->ci, addr);
+	ECM_IP_ADDR_TO_NIN4_ADDR(nircm->conn_rule.return_ip_xlate, addr);
+
+	/*
+	 * Same approach as above for port information
+	 */
+	nircm->tuple.flow_ident = htons(ecm_db_connection_from_port_get(feci->ci));
+	nircm->tuple.return_ident = htons(ecm_db_connection_to_port_nat_get(feci->ci));
+	nircm->conn_rule.flow_ident_xlate = htons(ecm_db_connection_from_port_nat_get(feci->ci));
+	nircm->conn_rule.return_ident_xlate = htons(ecm_db_connection_to_port_get(feci->ci));
+
+	/*
+	 * Get mac addresses.
+	 * The src_mac is the mac address of the node that established the connection.
+	 * This will work whether the from_node is LAN (egress) or WAN (ingress).
+	 */
+	ecm_db_connection_from_node_address_get(feci->ci, (uint8_t *)nircm->conn_rule.flow_mac);
+
+	/*
+	 * The dest_mac is more complex.  For egress it is the node address of the 'to' side of the connection.
+	 * For ingress it is the node adress of the NAT'ed 'to' IP.
+	 * Essentially it is the MAC of node associated with create.dest_ip and this is "to nat" side.
+	 */
+	ecm_db_connection_to_nat_node_address_get(feci->ci, (uint8_t *)nircm->conn_rule.return_mac);
+
+	/*
+	 * The dest_mac_xlate is the mac address to replace the pkt.dst_mac when a packet is sent to->from
+	 * For bridged connections this does not change.
+	 * For routed connections this is the mac of the 'to' node side of the connection.
+	 */
+	if (ecm_db_connection_is_routed_get(feci->ci)) {
+		ecm_db_connection_to_node_address_get(feci->ci, dest_mac_xlate);
+	} else {
+		/*
+		 * Bridge flows preserve the MAC addressing
+		 */
+		memcpy(dest_mac_xlate, (uint8_t *)nircm->conn_rule.return_mac, ETH_ALEN);
+	}
+
+	/*
+	 * Refer to the Example 2 and 3 in ecm_sfe_ipv4_ip_process() function for egress
+	 * and ingress NAT'ed cases. In these cases, the destination node is the one which has the
+	 * ip_dest_addr. So, above we get the mac address of this host and use that mac address
+	 * for the destination node address in NAT'ed cases.
+	 */
+	ecm_dir = ecm_db_connection_direction_get(feci->ci);
+	if ((ecm_dir == ECM_DB_DIRECTION_INGRESS_NAT) || (ecm_dir == ECM_DB_DIRECTION_EGRESS_NAT)) {
+		memcpy(nircm->conn_rule.return_mac, dest_mac_xlate, ETH_ALEN);
+	}
+
+	/*
+	 * Get MTU information
+	 */
+	nircm->conn_rule.flow_mtu = (uint32_t)ecm_db_connection_from_iface_mtu_get(feci->ci);
+	nircm->conn_rule.return_mtu = (uint32_t)ecm_db_connection_to_iface_mtu_get(feci->ci);
+
+	if (protocol == IPPROTO_TCP) {
+		/*
+		 * Need window scaling and remarking information if available
+		 * Start by looking up the conntrack connection
+		 */
+		if (!ct) {
+			/*
+			 * No conntrack so no need to check window sequence space
+			 */
+			DEBUG_TRACE("%p: TCP Accel no ct from conn %p to get window data\n", npci, feci->ci);
+			nircm->rule_flags |= SFE_RULE_CREATE_FLAG_NO_SEQ_CHECK;
+		} else {
+			spin_lock_bh(&ct->lock);
+			DEBUG_TRACE("%p: TCP Accel Get window data from ct %p for conn %p\n", npci, ct, feci->ci);
+
+			nircm->tcp_rule.flow_window_scale = ct->proto.tcp.seen[0].td_scale;
+			nircm->tcp_rule.flow_max_window = ct->proto.tcp.seen[0].td_maxwin;
+			nircm->tcp_rule.flow_end = ct->proto.tcp.seen[0].td_end;
+			nircm->tcp_rule.flow_max_end = ct->proto.tcp.seen[0].td_maxend;
+			nircm->tcp_rule.return_window_scale = ct->proto.tcp.seen[1].td_scale;
+			nircm->tcp_rule.return_max_window = ct->proto.tcp.seen[1].td_maxwin;
+			nircm->tcp_rule.return_end = ct->proto.tcp.seen[1].td_end;
+			nircm->tcp_rule.return_max_end = ct->proto.tcp.seen[1].td_maxend;
+#ifdef ECM_OPENWRT_SUPPORT
+			if (nf_ct_tcp_be_liberal || nf_ct_tcp_no_window_check
+#else
+			if (nf_ct_tcp_be_liberal
+#endif
+					|| (ct->proto.tcp.seen[0].flags & IP_CT_TCP_FLAG_BE_LIBERAL)
+					|| (ct->proto.tcp.seen[1].flags & IP_CT_TCP_FLAG_BE_LIBERAL)) {
+				nircm->rule_flags |= SFE_RULE_CREATE_FLAG_NO_SEQ_CHECK;
+			}
+			spin_unlock_bh(&ct->lock);
+		}
+
+		nircm->valid_flags |= SFE_RULE_CREATE_TCP_VALID;
+	}
+
+	/*
+	 * Sync our creation command from the assigned classifiers to get specific additional creation rules.
+	 * NOTE: These are called in ascending order of priority and so the last classifier (highest) shall
+	 * override any preceding classifiers.
+	 * This also gives the classifiers a chance to see that acceleration is being attempted.
+	 */
+	assignment_count = ecm_db_connection_classifier_assignments_get_and_ref(feci->ci, assignments);
+	for (aci_index = 0; aci_index < assignment_count; ++aci_index) {
+		struct ecm_classifier_instance *aci;
+		struct ecm_classifier_rule_create ecrc;
+		/*
+		 * NOTE: The current classifiers do not sync anything to the underlying accel engines.
+		 * In the future, if any of the classifiers wants to pass any parameter, these parameters
+		 * should be received via this object and copied to the accel engine's create object (nircm).
+		*/
+		aci = assignments[aci_index];
+		DEBUG_TRACE("%p: sync from: %p, type: %d\n", npci, aci, aci->type_get(aci));
+		aci->sync_from_v4(aci, &ecrc);
+	}
+	ecm_db_connection_assignments_release(assignment_count, assignments);
+
+	/*
+	 * Release the interface lists
+	 */
+	ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+	ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
+
+	DEBUG_INFO("%p: Ported Accelerate connection %p\n"
+			"Protocol: %d\n"
+			"from_mtu: %u\n"
+			"to_mtu: %u\n"
+			"from_ip: %pI4n:%d\n"
+			"to_ip: %pI4n:%d\n"
+			"from_ip_xlate: %pI4n:%d\n"
+			"to_ip_xlate: %pI4n:%d\n"
+			"from_mac: %pM\n"
+			"to_mac: %pM\n"
+			"src_iface_num: %u\n"
+			"dest_iface_num: %u\n"
+			"ingress_inner_vlan_tag: %u\n"
+			"egress_inner_vlan_tag: %u\n"
+			"ingress_outer_vlan_tag: %u\n"
+			"egress_outer_vlan_tag: %u\n"
+			"rule_flags: %x\n"
+			"valid_flags: %x\n"
+			"return_pppoe_session_id: %u\n"
+			"return_pppoe_remote_mac: %pM\n"
+			"flow_pppoe_session_id: %u\n"
+			"flow_pppoe_remote_mac: %pM\n"
+			"flow_qos_tag: %x (%u)\n"
+			"return_qos_tag: %x (%u)\n"
+			"flow_window_scale: %u\n"
+			"flow_max_window: %u\n"
+			"flow_end: %u\n"
+			"flow_max_end: %u\n"
+			"return_window_scale: %u\n"
+			"return_max_window: %u\n"
+			"return_end: %u\n"
+			"return_max_end: %u\n"
+			"flow_dscp: %x\n"
+			"return_dscp: %x\n",
+			npci,
+			feci->ci,
+			nircm->tuple.protocol,
+			nircm->conn_rule.flow_mtu,
+			nircm->conn_rule.return_mtu,
+			&nircm->tuple.flow_ip, nircm->tuple.flow_ident,
+			&nircm->tuple.return_ip, nircm->tuple.return_ident,
+			&nircm->conn_rule.flow_ip_xlate, nircm->conn_rule.flow_ident_xlate,
+			&nircm->conn_rule.return_ip_xlate, nircm->conn_rule.return_ident_xlate,
+			nircm->conn_rule.flow_mac,
+			nircm->conn_rule.return_mac,
+			nircm->conn_rule.flow_interface_num,
+			nircm->conn_rule.return_interface_num,
+			nircm->vlan_primary_rule.ingress_vlan_tag,
+			nircm->vlan_primary_rule.egress_vlan_tag,
+			nircm->vlan_secondary_rule.ingress_vlan_tag,
+			nircm->vlan_secondary_rule.egress_vlan_tag,
+			nircm->rule_flags,
+			nircm->valid_flags,
+			nircm->pppoe_rule.return_pppoe_session_id,
+			nircm->pppoe_rule.return_pppoe_remote_mac,
+			nircm->pppoe_rule.flow_pppoe_session_id,
+			nircm->pppoe_rule.flow_pppoe_remote_mac,
+			nircm->qos_rule.flow_qos_tag, nircm->qos_rule.flow_qos_tag,
+			nircm->qos_rule.return_qos_tag, nircm->qos_rule.return_qos_tag,
+			nircm->tcp_rule.flow_window_scale,
+			nircm->tcp_rule.flow_max_window,
+			nircm->tcp_rule.flow_end,
+			nircm->tcp_rule.flow_max_end,
+			nircm->tcp_rule.return_window_scale,
+			nircm->tcp_rule.return_max_window,
+			nircm->tcp_rule.return_end,
+			nircm->tcp_rule.return_max_end,
+			nircm->dscp_rule.flow_dscp,
+			nircm->dscp_rule.return_dscp);
+
+	if (protocol == IPPROTO_TCP) {
+
+		DEBUG_INFO("flow_window_scale: %u\n"
+			"flow_max_window: %u\n"
+			"flow_end: %u\n"
+			"flow_max_end: %u\n"
+			"return_window_scale: %u\n"
+			"return_max_window: %u\n"
+			"return_end: %u\n"
+			"return_max_end: %u\n",
+			nircm->tcp_rule.flow_window_scale,
+			nircm->tcp_rule.flow_max_window,
+			nircm->tcp_rule.flow_end,
+			nircm->tcp_rule.flow_max_end,
+			nircm->tcp_rule.return_window_scale,
+			nircm->tcp_rule.return_max_window,
+			nircm->tcp_rule.return_end,
+			nircm->tcp_rule.return_max_end);
+	}
+
+	/*
+	 * Now that the rule has been constructed we re-compare the generation occurrance counter.
+	 * If there has been a change then we abort because the rule may have been created using
+	 * unstable data - especially if another thread has begun regeneration of the connection state.
+	 * NOTE: This does not prevent a regen from being flagged immediately after this line of code either,
+	 * or while the acceleration rule is in flight to the nss.
+	 * This is only to check for consistency of rule state - not that the state is stale.
+	 * Remember that the connection is marked as "accel pending state" so if a regen is flagged immediately
+	 * after this check passes, the connection will be decelerated and refreshed very quickly.
+	 */
+	if (regen_occurrances != ecm_db_connection_regeneration_occurrances_get(feci->ci)) {
+		DEBUG_INFO("%p: connection:%p regen occurred - aborting accel rule.\n", feci, feci->ci);
+		ecm_sfe_ipv4_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_DECEL);
+		return;
+	}
+
+	/*
+	 * Ref the connection before issuing an SFE rule
+	 * This ensures that when the SFE responds to the command - which may even be immediately -
+	 * the callback function can trust the correct ref was taken for its purpose.
+	 * NOTE: remember that this will also implicitly hold the feci.
+	 */
+	ecm_db_connection_ref(feci->ci);
+
+	/*
+	 * We are about to issue the command, record the time of transmission
+	 */
+	spin_lock_bh(&feci->lock);
+	feci->stats.cmd_time_begun = jiffies;
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Call the rule create function
+	 */
+	sfe_tx_status = sfe_drv_ipv4_tx(ecm_sfe_ipv4_drv_mgr, &nim);
+	if (sfe_tx_status == SFE_TX_SUCCESS) {
+		/*
+		 * Reset the driver_fail count - transmission was okay here.
+		 */
+		spin_lock_bh(&feci->lock);
+		feci->stats.driver_fail = 0;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * Release that ref!
+	 */
+	ecm_db_connection_deref(feci->ci);
+
+	/*
+	 * TX failed
+	 */
+	spin_lock_bh(&feci->lock);
+	DEBUG_ASSERT(feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING, "%p: Accel mode unexpected: %d\n", feci, feci->accel_mode);
+	feci->stats.driver_fail_total++;
+	feci->stats.driver_fail++;
+	if (feci->stats.driver_fail >= feci->stats.driver_fail_limit) {
+		DEBUG_WARN("%p: Accel failed - driver fail limit\n", npci);
+		result_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DRIVER;
+	} else {
+		result_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL;
+	}
+
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	_ecm_sfe_ipv4_accel_pending_clear(feci, result_mode);
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	spin_unlock_bh(&feci->lock);
+	return;
+
+ported_accel_bad_rule:
+	;
+
+	/*
+	 * Jump to here when rule data is bad and an offload command cannot be constructed
+	 */
+	DEBUG_WARN("%p: Accel failed - bad rule\n", npci);
+	ecm_sfe_ipv4_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_FAIL_RULE);
+}
+
+/*
+ * ecm_sfe_ported_ipv4_connection_destroy_callback()
+ *	Callback for handling destroy ack/nack calls.
+ */
+static void ecm_sfe_ported_ipv4_connection_destroy_callback(void *app_data, struct sfe_ipv4_msg *nim)
+{
+	struct sfe_ipv4_rule_destroy_msg * __attribute__((unused))nirdm = &nim->msg.rule_destroy;
+	uint32_t serial = (uint32_t)app_data;
+	struct ecm_db_connection_instance *ci;
+	struct ecm_front_end_connection_instance *feci;
+	struct ecm_sfe_ported_ipv4_connection_instance *npci;
+
+	/*
+	 * Is this a response to a destroy message?
+	 */
+	if (nim->cm.type != SFE_TX_DESTROY_RULE_MSG) {
+		DEBUG_ERROR("%p: ported destroy callback with improper type: %d\n", nim, nim->cm.type);
+		return;
+	}
+
+	/*
+	 * Look up ecm connection so that we can update the status.
+	 */
+	ci = ecm_db_connection_serial_find_and_ref(serial);
+	if (!ci) {
+		DEBUG_TRACE("%p: destroy callback, connection not found, serial: %u\n", nim, serial);
+		return;
+	}
+
+	/*
+	 * Release ref held for this ack/nack response.
+	 * NOTE: It's okay to do this here, ci won't go away, because the ci is held as
+	 * a result of the ecm_db_connection_serial_find_and_ref()
+	 */
+	ecm_db_connection_deref(ci);
+
+	/*
+	 * Get the front end instance
+	 */
+	feci = ecm_db_connection_front_end_get_and_ref(ci);
+	npci = (struct ecm_sfe_ported_ipv4_connection_instance *)feci;
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+
+	/*
+	 * Record command duration
+	 */
+	ecm_sfe_ipv4_decel_done_time_update(feci);
+
+	/*
+	 * Dump some useful trace information.
+	 */
+	DEBUG_TRACE("%p: decelerate response for connection: %p\n", npci, feci->ci);
+	DEBUG_TRACE("%p: flow_ip: %pI4n:%d\n", npci, &nirdm->tuple.flow_ip, nirdm->tuple.flow_ident);
+	DEBUG_TRACE("%p: return_ip: %pI4n:%d\n", npci, &nirdm->tuple.return_ip, nirdm->tuple.return_ident);
+	DEBUG_TRACE("%p: protocol: %d\n", npci, nirdm->tuple.protocol);
+
+	/*
+	 * Drop decel pending counter
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	ecm_sfe_ipv4_pending_decel_count--;
+	DEBUG_ASSERT(ecm_sfe_ipv4_pending_decel_count >= 0, "Bad decel pending counter\n");
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	spin_lock_bh(&feci->lock);
+
+	/*
+	 * If decel is not still pending then it's possible that the SFE ended acceleration by some other reason e.g. flush
+	 * In which case we cannot rely on the response we get here.
+	 */
+	if (feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_DECEL_PENDING) {
+		spin_unlock_bh(&feci->lock);
+
+		/*
+		 * Release the connections.
+		 */
+		feci->deref(feci);
+		ecm_db_connection_deref(ci);
+		return;
+	}
+
+	DEBUG_TRACE("%p: response: %d\n", npci, nim->cm.response);
+	if (nim->cm.response != SFE_CMN_RESPONSE_ACK) {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DECEL;
+	} else {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL;
+	}
+
+	/*
+	 * If connection became defunct then set mode so that no further accel/decel attempts occur.
+	 */
+	if (feci->is_defunct) {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DEFUNCT;
+	}
+
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Ported acceleration ends
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	ecm_sfe_ported_ipv4_accelerated_count[npci->ported_accelerated_count_index]--;	/* Protocol specific counter */
+	DEBUG_ASSERT(ecm_sfe_ported_ipv4_accelerated_count[npci->ported_accelerated_count_index] >= 0, "Bad udp accel counter\n");
+	ecm_sfe_ipv4_accelerated_count--;		/* General running counter */
+	DEBUG_ASSERT(ecm_sfe_ipv4_accelerated_count >= 0, "Bad accel counter\n");
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	/*
+	 * Release the connections.
+	 */
+	feci->deref(feci);
+	ecm_db_connection_deref(ci);
+}
+
+/*
+ * ecm_sfe_ported_ipv4_connection_decelerate()
+ *	Decelerate a connection
+ */
+static void ecm_sfe_ported_ipv4_connection_decelerate(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_ported_ipv4_connection_instance *npci = (struct ecm_sfe_ported_ipv4_connection_instance *)feci;
+	struct sfe_ipv4_msg nim;
+	struct sfe_ipv4_rule_destroy_msg *nirdm;
+	ip_addr_t addr;
+	sfe_tx_status_t sfe_tx_status;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+
+	/*
+	 * If decelerate is in error or already pending then ignore
+	 */
+	spin_lock_bh(&feci->lock);
+	if (feci->stats.decelerate_pending) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If acceleration is pending then we cannot decelerate right now or we will race with it
+	 * Set a decelerate pending flag that will be actioned when the acceleration command is complete.
+	 */
+	if (feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING) {
+		feci->stats.decelerate_pending = true;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * Can only decelerate if accelerated
+	 * NOTE: This will also deny accel when the connection is in fail condition too.
+	 */
+	if (feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_ACCEL) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * Initiate deceleration
+	 */
+	feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL_PENDING;
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Increment the decel pending counter
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	ecm_sfe_ipv4_pending_decel_count++;
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	/*
+	 * Prepare deceleration message
+	 */
+	sfe_ipv4_msg_init(&nim, SFE_SPECIAL_INTERFACE_IPV4, SFE_TX_DESTROY_RULE_MSG,
+			sizeof(struct sfe_ipv4_rule_destroy_msg),
+			ecm_sfe_ported_ipv4_connection_destroy_callback,
+			(void *)ecm_db_connection_serial_get(feci->ci));
+
+	nirdm = &nim.msg.rule_destroy;
+	nirdm->tuple.protocol = (int32_t)ecm_db_connection_protocol_get(feci->ci);
+
+	/*
+	 * Get addressing information
+	 */
+	ecm_db_connection_from_address_get(feci->ci, addr);
+	ECM_IP_ADDR_TO_NIN4_ADDR(nirdm->tuple.flow_ip, addr);
+	ecm_db_connection_to_address_nat_get(feci->ci, addr);
+	ECM_IP_ADDR_TO_NIN4_ADDR(nirdm->tuple.return_ip, addr);
+	nirdm->tuple.flow_ident = htons(ecm_db_connection_from_port_get(feci->ci));
+	nirdm->tuple.return_ident = htons(ecm_db_connection_to_port_nat_get(feci->ci));
+
+	DEBUG_INFO("%p: Ported Connection %p decelerate\n"
+			"protocol: %d\n"
+			"src_ip: %pI4:%d\n"
+			"dest_ip: %pI4:%d\n",
+			npci, feci->ci, nirdm->tuple.protocol,
+			&nirdm->tuple.flow_ip, nirdm->tuple.flow_ident,
+			&nirdm->tuple.return_ip, nirdm->tuple.return_ident);
+
+	/*
+	 * Take a ref to the feci->ci so that it will persist until we get a response from the SFE.
+	 * NOTE: This will implicitly hold the feci too.
+	 */
+	ecm_db_connection_ref(feci->ci);
+
+	/*
+	 * We are about to issue the command, record the time of transmission
+	 */
+	spin_lock_bh(&feci->lock);
+	feci->stats.cmd_time_begun = jiffies;
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Destroy the SFE connection cache entry.
+	 */
+	sfe_tx_status = sfe_drv_ipv4_tx(ecm_sfe_ipv4_drv_mgr, &nim);
+	if (sfe_tx_status == SFE_TX_SUCCESS) {
+		/*
+		 * Reset the driver_fail count - transmission was okay here.
+		 */
+		spin_lock_bh(&feci->lock);
+		feci->stats.driver_fail = 0;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * Release the ref take, SFE driver did not accept our command.
+	 */
+	ecm_db_connection_deref(feci->ci);
+
+	/*
+	 * TX failed
+	 */
+	spin_lock_bh(&feci->lock);
+	feci->stats.driver_fail_total++;
+	feci->stats.driver_fail++;
+	if (feci->stats.driver_fail >= feci->stats.driver_fail_limit) {
+		DEBUG_WARN("%p: Decel failed - driver fail limit\n", npci);
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DRIVER;
+	}
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Could not send the request, decrement the decel pending counter
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	ecm_sfe_ipv4_pending_decel_count--;
+	DEBUG_ASSERT(ecm_sfe_ipv4_pending_decel_count >= 0, "Bad decel pending counter\n");
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+}
+
+/*
+ * ecm_sfe_ported_ipv4_connection_defunct_callback()
+ *	Callback to be called when a ported connection has become defunct.
+ */
+static void ecm_sfe_ported_ipv4_connection_defunct_callback(void *arg)
+{
+	struct ecm_front_end_connection_instance *feci = (struct ecm_front_end_connection_instance *)arg;
+	struct ecm_sfe_ported_ipv4_connection_instance *npci = (struct ecm_sfe_ported_ipv4_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+
+	spin_lock_bh(&feci->lock);
+
+	/*
+	 * If connection has already become defunct, do nothing.
+	 */
+	if (feci->is_defunct) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+	feci->is_defunct = true;
+
+	/*
+	 * If the connection is already in one of the fail modes, do nothing, keep the current accel_mode.
+	 */
+	if (ECM_FRONT_END_ACCELERATION_FAILED(feci->accel_mode)) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If the connection is decel then ensure it will not attempt accel while defunct.
+	 */
+	if (feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_DECEL) {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DEFUNCT;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If the connection is decel pending then decel operation is in progress anyway.
+	 */
+	if (feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_DECEL_PENDING) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If none of the cases matched above, this means the connection is in one of the
+	 * accel modes (accel or accel_pending) so we force a deceleration.
+	 * NOTE: If the mode is accel pending then the decel will be actioned when that is completed.
+	 */
+	spin_unlock_bh(&feci->lock);
+	ecm_sfe_ported_ipv4_connection_decelerate(feci);
+}
+
+/*
+ * ecm_sfe_ported_ipv4_connection_accel_state_get()
+ *	Get acceleration state
+ */
+static ecm_front_end_acceleration_mode_t ecm_sfe_ported_ipv4_connection_accel_state_get(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_ported_ipv4_connection_instance *npci = (struct ecm_sfe_ported_ipv4_connection_instance *)feci;
+	ecm_front_end_acceleration_mode_t state;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+	spin_lock_bh(&feci->lock);
+	state = feci->accel_mode;
+	spin_unlock_bh(&feci->lock);
+	return state;
+}
+
+/*
+ * ecm_sfe_ported_ipv4_connection_action_seen()
+ *	Acceleration action / activity has been seen for this connection.
+ *
+ * NOTE: Call the action_seen() method when the SFE has demonstrated that it has offloaded some data for a connection.
+ */
+static void ecm_sfe_ported_ipv4_connection_action_seen(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_ported_ipv4_connection_instance *npci = (struct ecm_sfe_ported_ipv4_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+	DEBUG_INFO("%p: Action seen\n", npci);
+	spin_lock_bh(&feci->lock);
+	feci->stats.no_action_seen = 0;
+	spin_unlock_bh(&feci->lock);
+}
+
+/*
+ * ecm_sfe_ported_ipv4_connection_accel_ceased()
+ *	SFE has indicated that acceleration has stopped.
+ *
+ * NOTE: This is called in response to an SFE self-initiated termination of acceleration.
+ * This must NOT be called because the ECM terminated the acceleration.
+ */
+static void ecm_sfe_ported_ipv4_connection_accel_ceased(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_ported_ipv4_connection_instance *npci = (struct ecm_sfe_ported_ipv4_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+	DEBUG_INFO("%p: accel ceased\n", npci);
+
+	spin_lock_bh(&feci->lock);
+
+	/*
+	 * If we are in accel-pending state then the SFE has issued a flush out-of-order
+	 * with the ACK/NACK we are actually waiting for.
+	 * To work around this we record a "flush has already happened" and will action it when we finally get that ACK/NACK.
+	 * GGG TODO This should eventually be removed when the SFE honours messaging sequence.
+	 */
+	if (feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING) {
+		feci->stats.flush_happened = true;
+		feci->stats.flush_happened_total++;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If connection is no longer accelerated by the time we get here just ignore the command
+	 */
+	if (feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_ACCEL) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If the no_action_seen counter was not reset then acceleration ended without any offload action
+	 */
+	if (feci->stats.no_action_seen) {
+		feci->stats.no_action_seen_total++;
+	}
+
+	/*
+	 * If the no_action_seen indicates successive cessations of acceleration without any offload action occuring
+	 * then we fail out this connection
+	 */
+	if (feci->stats.no_action_seen >= feci->stats.no_action_seen_limit) {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_NO_ACTION;
+	} else {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL;
+	}
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Ported acceleration ends
+	 */
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	ecm_sfe_ported_ipv4_accelerated_count[npci->ported_accelerated_count_index]--;	/* Protocol specific counter */
+	DEBUG_ASSERT(ecm_sfe_ported_ipv4_accelerated_count[npci->ported_accelerated_count_index] >= 0, "Bad ported accel counter\n");
+	ecm_sfe_ipv4_accelerated_count--;		/* General running counter */
+	DEBUG_ASSERT(ecm_sfe_ipv4_accelerated_count >= 0, "Bad accel counter\n");
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+}
+
+/*
+ * ecm_sfe_ported_ipv4_connection_ref()
+ *	Ref a connection front end instance
+ */
+static void ecm_sfe_ported_ipv4_connection_ref(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_ported_ipv4_connection_instance *npci = (struct ecm_sfe_ported_ipv4_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+	spin_lock_bh(&feci->lock);
+	feci->refs++;
+	DEBUG_TRACE("%p: npci ref %d\n", feci, feci->refs);
+	DEBUG_ASSERT(feci->refs > 0, "%p: ref wrap\n", feci);
+	spin_unlock_bh(&feci->lock);
+}
+
+/*
+ * ecm_sfe_ported_ipv4_connection_deref()
+ *	Deref a connection front end instance
+ */
+static int ecm_sfe_ported_ipv4_connection_deref(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_ported_ipv4_connection_instance *npci = (struct ecm_sfe_ported_ipv4_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+
+	spin_lock_bh(&feci->lock);
+	feci->refs--;
+	DEBUG_ASSERT(feci->refs >= 0, "%p: ref wrap\n", feci);
+
+	if (feci->refs > 0) {
+		int refs = feci->refs;
+		spin_unlock_bh(&feci->lock);
+		DEBUG_TRACE("%p: npci deref %d\n", npci, refs);
+		return refs;
+	}
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * We can now destroy the instance
+	 */
+	DEBUG_TRACE("%p: npci final\n", npci);
+	DEBUG_CLEAR_MAGIC(npci);
+	kfree(npci);
+	return 0;
+}
+
+#ifdef ECM_STATE_OUTPUT_ENABLE
+/*
+ * ecm_sfe_ported_ipv4_connection_state_get()
+ *	Return state of this ported front end instance
+ */
+static int ecm_sfe_ported_ipv4_connection_state_get(struct ecm_front_end_connection_instance *feci, struct ecm_state_file_instance *sfi)
+{
+	int result;
+	bool can_accel;
+	ecm_front_end_acceleration_mode_t accel_mode;
+	struct ecm_front_end_connection_mode_stats stats;
+	struct ecm_sfe_ported_ipv4_connection_instance *npci = (struct ecm_sfe_ported_ipv4_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+
+	spin_lock_bh(&feci->lock);
+	can_accel = feci->can_accel;
+	accel_mode = feci->accel_mode;
+	memcpy(&stats, &feci->stats, sizeof(struct ecm_front_end_connection_mode_stats));
+	spin_unlock_bh(&feci->lock);
+
+	if ((result = ecm_state_prefix_add(sfi, "front_end_v4.ported"))) {
+		return result;
+	}
+
+	if ((result = ecm_state_write(sfi, "can_accel", "%d", can_accel))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "accel_mode", "%d", accel_mode))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "decelerate_pending", "%d", stats.decelerate_pending))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "flush_happened_total", "%d", stats.flush_happened_total))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "no_action_seen_total", "%d", stats.no_action_seen_total))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "no_action_seen", "%d", stats.no_action_seen))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "no_action_seen_limit", "%d", stats.no_action_seen_limit))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "driver_fail_total", "%d", stats.driver_fail_total))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "driver_fail", "%d", stats.driver_fail))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "driver_fail_limit", "%d", stats.driver_fail_limit))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "ae_nack_total", "%d", stats.ae_nack_total))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "ae_nack", "%d", stats.ae_nack))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "ae_nack_limit", "%d", stats.ae_nack_limit))) {
+		return result;
+	}
+
+ 	return ecm_state_prefix_remove(sfi);
+}
+#endif
+
+/*
+ * ecm_sfe_ported_ipv4_connection_instance_alloc()
+ *	Create a front end instance specific for ported connection
+ */
+static struct ecm_sfe_ported_ipv4_connection_instance *ecm_sfe_ported_ipv4_connection_instance_alloc(
+								struct ecm_db_connection_instance *ci,
+								int protocol,
+								bool can_accel)
+{
+	struct ecm_sfe_ported_ipv4_connection_instance *npci;
+	struct ecm_front_end_connection_instance *feci;
+
+	npci = (struct ecm_sfe_ported_ipv4_connection_instance *)kzalloc(sizeof(struct ecm_sfe_ported_ipv4_connection_instance), GFP_ATOMIC | __GFP_NOWARN);
+	if (!npci) {
+		DEBUG_WARN("Ported Front end alloc failed\n");
+		return NULL;
+	}
+
+	/*
+	 * Refs is 1 for the creator of the connection
+	 */
+	feci = (struct ecm_front_end_connection_instance *)npci;
+	feci->refs = 1;
+	DEBUG_SET_MAGIC(npci, ECM_SFE_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC);
+	spin_lock_init(&feci->lock);
+
+	feci->can_accel = can_accel;
+	feci->accel_mode = (can_accel)? ECM_FRONT_END_ACCELERATION_MODE_DECEL : ECM_FRONT_END_ACCELERATION_MODE_FAIL_DENIED;
+	spin_lock_bh(&ecm_sfe_ipv4_lock);
+	feci->stats.no_action_seen_limit = ecm_sfe_ipv4_no_action_limit_default;
+	feci->stats.driver_fail_limit = ecm_sfe_ipv4_driver_fail_limit_default;
+	feci->stats.ae_nack_limit = ecm_sfe_ipv4_nack_limit_default;
+	spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+	/*
+	 * Copy reference to connection - no need to ref ci as ci maintains a ref to this instance instead (this instance persists for as long as ci does)
+	 */
+	feci->ci = ci;
+
+	/*
+	 * Populate the methods and callbacks
+	 */
+	feci->ref = ecm_sfe_ported_ipv4_connection_ref;
+	feci->deref = ecm_sfe_ported_ipv4_connection_deref;
+	feci->decelerate = ecm_sfe_ported_ipv4_connection_decelerate;
+	feci->accel_state_get = ecm_sfe_ported_ipv4_connection_accel_state_get;
+	feci->action_seen = ecm_sfe_ported_ipv4_connection_action_seen;
+	feci->accel_ceased = ecm_sfe_ported_ipv4_connection_accel_ceased;
+#ifdef ECM_STATE_OUTPUT_ENABLE
+	feci->state_get = ecm_sfe_ported_ipv4_connection_state_get;
+#endif
+	feci->ae_interface_number_by_dev_get = ecm_sfe_common_get_interface_number_by_dev;
+
+	if (protocol == IPPROTO_TCP) {
+		npci->ported_accelerated_count_index = ECM_SFE_PORTED_IPV4_PROTO_TCP;
+	} else if (protocol == IPPROTO_UDP) {
+		npci->ported_accelerated_count_index = ECM_SFE_PORTED_IPV4_PROTO_UDP;
+	} else {
+		DEBUG_WARN("%p: Wrong protocol: %d\n", npci, protocol);
+		DEBUG_CLEAR_MAGIC(npci);
+		kfree(npci);
+		return NULL;
+	}
+
+	return npci;
+}
+
+/*
+ * ecm_sfe_ported_ipv4_process()
+ *	Process a ported packet
+ */
+unsigned int ecm_sfe_ported_ipv4_process(struct net_device *out_dev, struct net_device *out_dev_nat,
+							struct net_device *in_dev, struct net_device *in_dev_nat,
+							uint8_t *src_node_addr, uint8_t *src_node_addr_nat,
+							uint8_t *dest_node_addr, uint8_t *dest_node_addr_nat,
+							bool can_accel, bool is_routed, bool is_l2_encap, struct sk_buff *skb,
+							struct ecm_tracker_ip_header *iph,
+							struct nf_conn *ct, ecm_tracker_sender_type_t sender, ecm_db_direction_t ecm_dir,
+							struct nf_conntrack_tuple *orig_tuple, struct nf_conntrack_tuple *reply_tuple,
+							ip_addr_t ip_src_addr, ip_addr_t ip_dest_addr,
+							ip_addr_t ip_src_addr_nat, ip_addr_t ip_dest_addr_nat)
+{
+	struct tcphdr *tcp_hdr;
+	struct tcphdr tcp_hdr_buff;
+	struct udphdr *udp_hdr;
+	struct udphdr udp_hdr_buff;
+	int src_port;
+	int src_port_nat;
+	int dest_port;
+	int dest_port_nat;
+	struct ecm_db_connection_instance *ci;
+	ip_addr_t match_addr;
+	struct ecm_classifier_instance *assignments[ECM_CLASSIFIER_TYPES];
+	int aci_index;
+	int assignment_count;
+	ecm_db_timer_group_t ci_orig_timer_group;
+	struct ecm_classifier_process_response prevalent_pr;
+	int protocol = (int)orig_tuple->dst.protonum;
+
+	if (protocol == IPPROTO_TCP) {
+		/*
+		 * Extract TCP header to obtain port information
+		 */
+		tcp_hdr = ecm_tracker_tcp_check_header_and_read(skb, iph, &tcp_hdr_buff);
+		if (unlikely(!tcp_hdr)) {
+			DEBUG_WARN("TCP packet header %p\n", skb);
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Now extract information, if we have conntrack then use that (which would already be in the tuples)
+		 */
+		if (unlikely(!ct)) {
+			orig_tuple->src.u.tcp.port = tcp_hdr->source;
+			orig_tuple->dst.u.tcp.port = tcp_hdr->dest;
+			reply_tuple->src.u.tcp.port = tcp_hdr->dest;
+			reply_tuple->dst.u.tcp.port = tcp_hdr->source;
+		}
+
+		/*
+		 * Extract transport port information
+		 * Refer to the ecm_sfe_ipv4_process() for information on how we extract this information.
+		 */
+		if (sender == ECM_TRACKER_SENDER_TYPE_SRC) {
+			if ((ecm_dir == ECM_DB_DIRECTION_EGRESS_NAT) || (ecm_dir == ECM_DB_DIRECTION_NON_NAT)) {
+				src_port = ntohs(orig_tuple->src.u.tcp.port);
+				dest_port = ntohs(orig_tuple->dst.u.tcp.port);
+				dest_port_nat = ntohs(reply_tuple->src.u.tcp.port);
+				src_port_nat = ntohs(reply_tuple->dst.u.tcp.port);
+			} else if (ecm_dir == ECM_DB_DIRECTION_INGRESS_NAT) {
+				src_port = ntohs(orig_tuple->src.u.tcp.port);
+				dest_port_nat = ntohs(orig_tuple->dst.u.tcp.port);
+				dest_port = ntohs(reply_tuple->src.u.tcp.port);
+				src_port_nat = ntohs(reply_tuple->dst.u.tcp.port);
+			} else if (ecm_dir == ECM_DB_DIRECTION_BRIDGED) {
+				src_port = ntohs(orig_tuple->src.u.tcp.port);
+				dest_port = ntohs(orig_tuple->dst.u.tcp.port);
+				dest_port_nat = ntohs(reply_tuple->src.u.tcp.port);
+				src_port_nat = ntohs(reply_tuple->dst.u.tcp.port);
+			} else {
+				DEBUG_ASSERT(false, "Unhandled ecm_dir: %d\n", ecm_dir);
+			}
+		} else {
+			if ((ecm_dir == ECM_DB_DIRECTION_EGRESS_NAT) || (ecm_dir == ECM_DB_DIRECTION_NON_NAT)) {
+				dest_port = ntohs(orig_tuple->src.u.tcp.port);
+				src_port = ntohs(orig_tuple->dst.u.tcp.port);
+				src_port_nat = ntohs(reply_tuple->src.u.tcp.port);
+				dest_port_nat = ntohs(reply_tuple->dst.u.tcp.port);
+			} else if (ecm_dir == ECM_DB_DIRECTION_INGRESS_NAT) {
+				dest_port = ntohs(orig_tuple->src.u.tcp.port);
+				src_port_nat = ntohs(orig_tuple->dst.u.tcp.port);
+				src_port = ntohs(reply_tuple->src.u.tcp.port);
+				dest_port_nat = ntohs(reply_tuple->dst.u.tcp.port);
+			} else if (ecm_dir == ECM_DB_DIRECTION_BRIDGED) {
+				dest_port = ntohs(orig_tuple->src.u.tcp.port);
+				src_port = ntohs(orig_tuple->dst.u.tcp.port);
+				src_port_nat = ntohs(reply_tuple->src.u.tcp.port);
+				dest_port_nat = ntohs(reply_tuple->dst.u.tcp.port);
+			} else {
+				DEBUG_ASSERT(false, "Unhandled ecm_dir: %d\n", ecm_dir);
+			}
+		}
+
+		DEBUG_TRACE("TCP src: " ECM_IP_ADDR_DOT_FMT "(" ECM_IP_ADDR_DOT_FMT "):%d(%d), dest: " ECM_IP_ADDR_DOT_FMT "(" ECM_IP_ADDR_DOT_FMT "):%d(%d), dir %d\n",
+				ECM_IP_ADDR_TO_DOT(ip_src_addr), ECM_IP_ADDR_TO_DOT(ip_src_addr_nat), src_port, src_port_nat, ECM_IP_ADDR_TO_DOT(ip_dest_addr),
+				ECM_IP_ADDR_TO_DOT(ip_dest_addr_nat), dest_port, dest_port_nat, ecm_dir);
+	} else if (protocol == IPPROTO_UDP) {
+		/*
+		 * Extract UDP header to obtain port information
+		 */
+		udp_hdr = ecm_tracker_udp_check_header_and_read(skb, iph, &udp_hdr_buff);
+		if (unlikely(!udp_hdr)) {
+			DEBUG_WARN("Invalid UDP header in skb %p\n", skb);
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Now extract information, if we have conntrack then use that (which would already be in the tuples)
+		 */
+		if (unlikely(!ct)) {
+			orig_tuple->src.u.udp.port = udp_hdr->source;
+			orig_tuple->dst.u.udp.port = udp_hdr->dest;
+			reply_tuple->src.u.udp.port = udp_hdr->dest;
+			reply_tuple->dst.u.udp.port = udp_hdr->source;
+		}
+
+		/*
+		 * Extract transport port information
+		 * Refer to the ecm_sfe_ipv4_process() for information on how we extract this information.
+		 */
+		if (sender == ECM_TRACKER_SENDER_TYPE_SRC) {
+			if ((ecm_dir == ECM_DB_DIRECTION_EGRESS_NAT) || (ecm_dir == ECM_DB_DIRECTION_NON_NAT)) {
+				src_port = ntohs(orig_tuple->src.u.udp.port);
+				dest_port = ntohs(orig_tuple->dst.u.udp.port);
+				dest_port_nat = ntohs(reply_tuple->src.u.udp.port);
+				src_port_nat = ntohs(reply_tuple->dst.u.udp.port);
+			} else if (ecm_dir == ECM_DB_DIRECTION_INGRESS_NAT) {
+				src_port = ntohs(orig_tuple->src.u.udp.port);
+				dest_port_nat = ntohs(orig_tuple->dst.u.udp.port);
+				dest_port = ntohs(reply_tuple->src.u.udp.port);
+				src_port_nat = ntohs(reply_tuple->dst.u.udp.port);
+			} else if (ecm_dir == ECM_DB_DIRECTION_BRIDGED) {
+				src_port = ntohs(orig_tuple->src.u.udp.port);
+				dest_port = ntohs(orig_tuple->dst.u.udp.port);
+				dest_port_nat = ntohs(reply_tuple->src.u.udp.port);
+				src_port_nat = ntohs(reply_tuple->dst.u.udp.port);
+			} else {
+				DEBUG_ASSERT(false, "Unhandled ecm_dir: %d\n", ecm_dir);
+			}
+		} else {
+			if ((ecm_dir == ECM_DB_DIRECTION_EGRESS_NAT) || (ecm_dir == ECM_DB_DIRECTION_NON_NAT)) {
+				dest_port = ntohs(orig_tuple->src.u.udp.port);
+				src_port = ntohs(orig_tuple->dst.u.udp.port);
+				src_port_nat = ntohs(reply_tuple->src.u.udp.port);
+				dest_port_nat = ntohs(reply_tuple->dst.u.udp.port);
+			} else if (ecm_dir == ECM_DB_DIRECTION_INGRESS_NAT) {
+				dest_port = ntohs(orig_tuple->src.u.udp.port);
+				src_port_nat = ntohs(orig_tuple->dst.u.udp.port);
+				src_port = ntohs(reply_tuple->src.u.udp.port);
+				dest_port_nat = ntohs(reply_tuple->dst.u.udp.port);
+			} else if (ecm_dir == ECM_DB_DIRECTION_BRIDGED) {
+				dest_port = ntohs(orig_tuple->src.u.udp.port);
+				src_port = ntohs(orig_tuple->dst.u.udp.port);
+				src_port_nat = ntohs(reply_tuple->src.u.udp.port);
+				dest_port_nat = ntohs(reply_tuple->dst.u.udp.port);
+			} else {
+				DEBUG_ASSERT(false, "Unhandled ecm_dir: %d\n", ecm_dir);
+			}
+		}
+		DEBUG_TRACE("UDP src: " ECM_IP_ADDR_DOT_FMT ":%d, dest: " ECM_IP_ADDR_DOT_FMT ":%d, dir %d\n",
+				ECM_IP_ADDR_TO_DOT(ip_src_addr), src_port, ECM_IP_ADDR_TO_DOT(ip_dest_addr), dest_port, ecm_dir);
+	} else {
+		DEBUG_WARN("Wrong protocol: %d\n", protocol);
+		return NF_ACCEPT;
+	}
+
+	/*
+	 * Look up a connection
+	 */
+	ci = ecm_db_connection_find_and_ref(ip_src_addr, ip_dest_addr, protocol, src_port, dest_port);
+
+	/*
+	 * If there is no existing connection then create a new one.
+	 */
+	if (unlikely(!ci)) {
+		struct ecm_db_mapping_instance *src_mi;
+		struct ecm_db_mapping_instance *dest_mi;
+		struct ecm_db_mapping_instance *src_nat_mi;
+		struct ecm_db_mapping_instance *dest_nat_mi;
+		struct ecm_db_node_instance *src_ni;
+		struct ecm_db_node_instance *dest_ni;
+		struct ecm_db_node_instance *src_nat_ni;
+		struct ecm_db_node_instance *dest_nat_ni;
+		struct ecm_classifier_default_instance *dci;
+		struct ecm_db_connection_instance *nci;
+		ecm_classifier_type_t classifier_type;
+		struct ecm_front_end_connection_instance *feci;
+		int32_t to_list_first;
+		struct ecm_db_iface_instance *to_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+		int32_t to_nat_list_first;
+		struct ecm_db_iface_instance *to_nat_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+		int32_t from_list_first;
+		struct ecm_db_iface_instance *from_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+		int32_t from_nat_list_first;
+		struct ecm_db_iface_instance *from_nat_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+
+		DEBUG_INFO("New ported connection from " ECM_IP_ADDR_DOT_FMT ":%u to " ECM_IP_ADDR_DOT_FMT ":%u protocol: %d\n",
+				ECM_IP_ADDR_TO_DOT(ip_src_addr), src_port, ECM_IP_ADDR_TO_DOT(ip_dest_addr), dest_port, protocol);
+
+		/*
+		 * Before we attempt to create the connection are we being terminated?
+		 */
+		spin_lock_bh(&ecm_sfe_ipv4_lock);
+		if (ecm_sfe_ipv4_terminate_pending) {
+			spin_unlock_bh(&ecm_sfe_ipv4_lock);
+			DEBUG_WARN("Terminating\n");
+
+			/*
+			 * As we are terminating we just allow the packet to pass - it's no longer our concern
+			 */
+			return NF_ACCEPT;
+		}
+		spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+		/*
+		 * Does this connection have a conntrack entry?
+		 */
+		if (ct) {
+			unsigned int conn_count;
+
+			/*
+			 * If we have exceeded the connection limit (according to conntrack) then abort
+			 * NOTE: Conntrack, when at its limit, will destroy a connection to make way for a new.
+			 * Conntrack won't exceed its limit but ECM can due to it needing to hold connections while
+			 * acceleration commands are in-flight.
+			 * This means that ECM can 'fall behind' somewhat with the connection state wrt conntrack connection state.
+			 * This is not seen as an issue since conntrack will have issued us with a destroy event for the flushed connection(s)
+			 * and we will eventually catch up.
+			 * Since ECM is capable of handling connections mid-flow ECM will pick up where it can.
+			 */
+			conn_count = (unsigned int)ecm_db_connection_count_get();
+			if (conn_count >= nf_conntrack_max) {
+				DEBUG_WARN("ECM Connection count limit reached: db: %u, ct: %u\n", conn_count, nf_conntrack_max);
+				return NF_ACCEPT;
+			}
+
+			if (protocol == IPPROTO_TCP) {
+				/*
+				 * No point in establishing a connection for one that is closing
+				 */
+				spin_lock_bh(&ct->lock);
+				if (ct->proto.tcp.state >= TCP_CONNTRACK_FIN_WAIT && ct->proto.tcp.state <= TCP_CONNTRACK_CLOSE) {
+					spin_unlock_bh(&ct->lock);
+					DEBUG_TRACE("%p: Connection in termination state %#X\n", ct, ct->proto.tcp.state);
+					return NF_ACCEPT;
+				}
+				spin_unlock_bh(&ct->lock);
+			}
+		}
+
+		/*
+		 * Now allocate the new connection
+		 */
+		nci = ecm_db_connection_alloc();
+		if (!nci) {
+			DEBUG_WARN("Failed to allocate connection\n");
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Connection must have a front end instance associated with it
+		 */
+		feci = (struct ecm_front_end_connection_instance *)ecm_sfe_ported_ipv4_connection_instance_alloc(nci, protocol, can_accel);
+		if (!feci) {
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to allocate front end\n");
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Get the src and destination mappings.
+		 * For this we also need the interface lists which we also set upon the new connection while we are at it.
+		 * GGG TODO rework terms of "src/dest" - these need to be named consistently as from/to as per database terms.
+		 * GGG TODO The empty list checks should not be needed, mapping_establish_and_ref() should fail out if there is no list anyway.
+		 */
+		DEBUG_TRACE("%p: Create the 'from' interface heirarchy list\n", nci);
+		from_list_first = ecm_interface_heirarchy_construct(feci, from_list, ip_dest_addr, ip_src_addr, 4, protocol, in_dev, is_routed, in_dev, src_node_addr, dest_node_addr);
+		if (from_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to obtain 'from' heirarchy list\n");
+			return NF_ACCEPT;
+		}
+		ecm_db_connection_from_interfaces_reset(nci, from_list, from_list_first);
+
+		DEBUG_TRACE("%p: Create source node\n", nci);
+		src_ni = ecm_sfe_ipv4_node_establish_and_ref(feci, in_dev, ip_src_addr, from_list, from_list_first, src_node_addr);
+		ecm_db_connection_interfaces_deref(from_list, from_list_first);
+		if (!src_ni) {
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish source node\n");
+			return NF_ACCEPT;
+		}
+
+		DEBUG_TRACE("%p: Create source mapping\n", nci);
+		src_mi = ecm_sfe_ipv4_mapping_establish_and_ref(ip_src_addr, src_port);
+		if (!src_mi) {
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish src mapping\n");
+			return NF_ACCEPT;
+		}
+
+		DEBUG_TRACE("%p: Create the 'to' interface heirarchy list\n", nci);
+		to_list_first = ecm_interface_heirarchy_construct(feci, to_list, ip_src_addr, ip_dest_addr, 4, protocol, out_dev, is_routed, in_dev, dest_node_addr, src_node_addr);
+		if (to_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to obtain 'to' heirarchy list\n");
+			return NF_ACCEPT;
+		}
+		ecm_db_connection_to_interfaces_reset(nci, to_list, to_list_first);
+
+		DEBUG_TRACE("%p: Create dest node\n", nci);
+		dest_ni = ecm_sfe_ipv4_node_establish_and_ref(feci, out_dev, ip_dest_addr, to_list, to_list_first, dest_node_addr);
+		ecm_db_connection_interfaces_deref(to_list, to_list_first);
+		if (!dest_ni) {
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish dest node\n");
+			return NF_ACCEPT;
+		}
+
+		DEBUG_TRACE("%p: Create dest mapping\n", nci);
+		dest_mi = ecm_sfe_ipv4_mapping_establish_and_ref(ip_dest_addr, dest_port);
+		if (!dest_mi) {
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish dest mapping\n");
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Get the src and destination NAT mappings
+		 * For this we also need the interface lists which we also set upon the new connection while we are at it.
+		 * GGG TODO rework terms of "src/dest" - these need to be named consistently as from/to as per database terms.
+		 * GGG TODO The empty list checks should not be needed, mapping_establish_and_ref() should fail out if there is no list anyway.
+		 */
+		DEBUG_TRACE("%p: Create the 'from NAT' interface heirarchy list\n", nci);
+		from_nat_list_first = ecm_interface_heirarchy_construct(feci, from_nat_list, ip_dest_addr, ip_src_addr_nat, 4, protocol, in_dev_nat, is_routed, in_dev_nat, src_node_addr_nat, dest_node_addr_nat);
+		if (from_nat_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+			ecm_db_mapping_deref(dest_mi);
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to obtain 'from NAT' heirarchy list\n");
+			return NF_ACCEPT;
+		}
+		ecm_db_connection_from_nat_interfaces_reset(nci, from_nat_list, from_nat_list_first);
+
+		DEBUG_TRACE("%p: Create source nat node\n", nci);
+		src_nat_ni = ecm_sfe_ipv4_node_establish_and_ref(feci, in_dev_nat, ip_src_addr_nat, from_nat_list, from_nat_list_first, src_node_addr_nat);
+		ecm_db_connection_interfaces_deref(from_nat_list, from_nat_list_first);
+		if (!src_nat_ni) {
+			ecm_db_mapping_deref(dest_mi);
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish source nat node\n");
+			return NF_ACCEPT;
+		}
+
+		src_nat_mi = ecm_sfe_ipv4_mapping_establish_and_ref(ip_src_addr_nat, src_port_nat);
+		if (!src_nat_mi) {
+			ecm_db_node_deref(src_nat_ni);
+			ecm_db_mapping_deref(dest_mi);
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish src nat mapping\n");
+			return NF_ACCEPT;
+		}
+
+		DEBUG_TRACE("%p: Create the 'to NAT' interface heirarchy list\n", nci);
+		to_nat_list_first = ecm_interface_heirarchy_construct(feci, to_nat_list, ip_src_addr, ip_dest_addr_nat, 4, protocol, out_dev_nat, is_routed, in_dev, dest_node_addr_nat, src_node_addr_nat);
+		if (to_nat_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+			ecm_db_mapping_deref(src_nat_mi);
+			ecm_db_node_deref(src_nat_ni);
+			ecm_db_mapping_deref(dest_mi);
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to obtain 'to NAT' heirarchy list\n");
+			return NF_ACCEPT;
+		}
+		ecm_db_connection_to_nat_interfaces_reset(nci, to_nat_list, to_nat_list_first);
+
+		DEBUG_TRACE("%p: Create dest nat node\n", nci);
+		dest_nat_ni = ecm_sfe_ipv4_node_establish_and_ref(feci, out_dev_nat, ip_dest_addr_nat, to_nat_list, to_nat_list_first, dest_node_addr_nat);
+		ecm_db_connection_interfaces_deref(to_nat_list, to_nat_list_first);
+		if (!dest_nat_ni) {
+			ecm_db_mapping_deref(src_nat_mi);
+			ecm_db_node_deref(src_nat_ni);
+			ecm_db_mapping_deref(dest_mi);
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish dest nat node\n");
+			return NF_ACCEPT;
+		}
+
+		dest_nat_mi = ecm_sfe_ipv4_mapping_establish_and_ref(ip_dest_addr_nat, dest_port_nat);
+		if (!dest_nat_mi) {
+			ecm_db_node_deref(dest_nat_ni);
+			ecm_db_mapping_deref(src_nat_mi);
+			ecm_db_node_deref(src_nat_ni);
+			ecm_db_mapping_deref(dest_mi);
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish dest mapping\n");
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Every connection also needs a default classifier which is considered 'special' to be assigned
+		 */
+		dci = ecm_classifier_default_instance_alloc(nci, protocol, ecm_dir, src_port, dest_port);
+		if (!dci) {
+			ecm_db_mapping_deref(dest_nat_mi);
+			ecm_db_node_deref(dest_nat_ni);
+			ecm_db_mapping_deref(src_nat_mi);
+			ecm_db_node_deref(src_nat_ni);
+			ecm_db_mapping_deref(dest_mi);
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to allocate default classifier\n");
+			return NF_ACCEPT;
+		}
+		ecm_db_connection_classifier_assign(nci, (struct ecm_classifier_instance *)dci);
+
+		/*
+		 * Every connection starts with a full complement of classifiers assigned.
+		 * NOTE: Default classifier is a special case considered previously
+		 */
+		for (classifier_type = ECM_CLASSIFIER_TYPE_DEFAULT + 1; classifier_type < ECM_CLASSIFIER_TYPES; ++classifier_type) {
+			struct ecm_classifier_instance *aci = ecm_sfe_ipv4_assign_classifier(nci, classifier_type);
+			if (aci) {
+				aci->deref(aci);
+			} else {
+				dci->base.deref((struct ecm_classifier_instance *)dci);
+				ecm_db_mapping_deref(dest_nat_mi);
+				ecm_db_node_deref(dest_nat_ni);
+				ecm_db_mapping_deref(src_nat_mi);
+				ecm_db_node_deref(src_nat_ni);
+				ecm_db_mapping_deref(dest_mi);
+				ecm_db_node_deref(dest_ni);
+				ecm_db_mapping_deref(src_mi);
+				ecm_db_node_deref(src_ni);
+				feci->deref(feci);
+				ecm_db_connection_deref(nci);
+				DEBUG_WARN("Failed to allocate classifiers assignments\n");
+				return NF_ACCEPT;
+			}
+		}
+
+		/*
+		 * Now add the connection into the database.
+		 * NOTE: In an SMP situation such as ours there is a possibility that more than one packet for the same
+		 * connection is being processed simultaneously.
+		 * We *could* end up creating more than one connection instance for the same actual connection.
+		 * To guard against this we now perform a mutex'd lookup of the connection + add once more - another cpu may have created it before us.
+		 */
+		spin_lock_bh(&ecm_sfe_ipv4_lock);
+		ci = ecm_db_connection_find_and_ref(ip_src_addr, ip_dest_addr, protocol, src_port, dest_port);
+		if (ci) {
+			/*
+			 * Another cpu created the same connection before us - use the one we just found
+			 */
+			spin_unlock_bh(&ecm_sfe_ipv4_lock);
+			ecm_db_connection_deref(nci);
+		} else {
+			ecm_db_timer_group_t tg;
+			ecm_tracker_sender_state_t src_state;
+			ecm_tracker_sender_state_t dest_state;
+			ecm_tracker_connection_state_t state;
+			struct ecm_tracker_instance *ti;
+
+			/*
+			 * Ask tracker for timer group to set the connection to initially.
+			 */
+			ti = dci->tracker_get_and_ref(dci);
+			ti->state_get(ti, &src_state, &dest_state, &state, &tg);
+			ti->deref(ti);
+
+			/*
+			 * Add the new connection we created into the database
+			 * NOTE: assign to a short timer group for now - it is the assigned classifiers responsibility to do this
+			 */
+			ecm_db_connection_add(nci, feci, src_mi, dest_mi, src_nat_mi, dest_nat_mi,
+					src_ni, dest_ni, src_nat_ni, dest_nat_ni,
+					4, protocol, ecm_dir,
+					NULL /* final callback */,
+					ecm_sfe_ported_ipv4_connection_defunct_callback,
+					tg, is_routed, nci);
+
+			spin_unlock_bh(&ecm_sfe_ipv4_lock);
+
+			ci = nci;
+			DEBUG_INFO("%p: New ported connection created\n", ci);
+		}
+
+		/*
+		 * No longer need referenecs to the objects we created
+		 */
+		dci->base.deref((struct ecm_classifier_instance *)dci);
+		ecm_db_mapping_deref(dest_nat_mi);
+		ecm_db_node_deref(dest_nat_ni);
+		ecm_db_mapping_deref(src_nat_mi);
+		ecm_db_node_deref(src_nat_ni);
+		ecm_db_mapping_deref(dest_mi);
+		ecm_db_node_deref(dest_ni);
+		ecm_db_mapping_deref(src_mi);
+		ecm_db_node_deref(src_ni);
+		feci->deref(feci);
+	}
+
+	/*
+	 * Keep connection alive as we have seen activity
+	 */
+	if (!ecm_db_connection_defunct_timer_touch(ci)) {
+		ecm_db_connection_deref(ci);
+		return NF_ACCEPT;
+	}
+
+	/*
+	 * Identify which side of the connection is sending.
+	 * NOTE: This may be different than what sender is at the moment
+	 * given the connection we have located.
+	 */
+	ecm_db_connection_from_address_get(ci, match_addr);
+	if (ECM_IP_ADDR_MATCH(ip_src_addr, match_addr)) {
+		sender = ECM_TRACKER_SENDER_TYPE_SRC;
+	} else {
+		sender = ECM_TRACKER_SENDER_TYPE_DEST;
+	}
+
+	/*
+	 * Do we need to action generation change?
+	 */
+	if (unlikely(ecm_db_connection_regeneration_required_check(ci))) {
+		ecm_sfe_ipv4_connection_regenerate(ci, sender, out_dev, out_dev_nat, in_dev, in_dev_nat);
+	}
+
+	/*
+	 * Iterate the assignments and call to process!
+	 * Policy implemented:
+	 * 1. Classifiers that say they are not relevant are unassigned and not actioned further.
+	 * 2. Any drop command from any classifier is honoured.
+	 * 3. All classifiers must action acceleration for accel to be honoured, any classifiers not sure of their relevance will stop acceleration.
+	 * 4. Only the highest priority classifier, that actions it, will have its qos tag honoured.
+	 * 5. Only the highest priority classifier, that actions it, will have its timer group honoured.
+	 */
+	DEBUG_TRACE("%p: process begin, skb: %p\n", ci, skb);
+	prevalent_pr.process_actions = 0;
+	prevalent_pr.drop = false;
+	prevalent_pr.flow_qos_tag = skb->priority;
+	prevalent_pr.return_qos_tag = skb->priority;
+	prevalent_pr.accel_mode = ECM_CLASSIFIER_ACCELERATION_MODE_ACCEL;
+	prevalent_pr.timer_group = ci_orig_timer_group = ecm_db_connection_timer_group_get(ci);
+
+	assignment_count = ecm_db_connection_classifier_assignments_get_and_ref(ci, assignments);
+	for (aci_index = 0; aci_index < assignment_count; ++aci_index) {
+		struct ecm_classifier_process_response aci_pr;
+		struct ecm_classifier_instance *aci;
+
+		aci = assignments[aci_index];
+		DEBUG_TRACE("%p: process: %p, type: %d\n", ci, aci, aci->type_get(aci));
+		aci->process(aci, sender, iph, skb, &aci_pr);
+		DEBUG_TRACE("%p: aci_pr: process actions: %x, became relevant: %u, relevance: %d, drop: %d, "
+				"flow_qos_tag: %u, return_qos_tag: %u, accel_mode: %x, timer_group: %d\n",
+				ci, aci_pr.process_actions, aci_pr.became_relevant, aci_pr.relevance, aci_pr.drop,
+				aci_pr.flow_qos_tag, aci_pr.return_qos_tag, aci_pr.accel_mode, aci_pr.timer_group);
+
+		if (aci_pr.relevance == ECM_CLASSIFIER_RELEVANCE_NO) {
+			ecm_classifier_type_t aci_type;
+
+			/*
+			 * This classifier can be unassigned - PROVIDED it is not the default classifier
+			 */
+			aci_type = aci->type_get(aci);
+			if (aci_type == ECM_CLASSIFIER_TYPE_DEFAULT) {
+				continue;
+			}
+
+			DEBUG_INFO("%p: Classifier not relevant, unassign: %d", ci, aci_type);
+			ecm_db_connection_classifier_unassign(ci, aci);
+			continue;
+		}
+
+		/*
+		 * Yes or Maybe relevant.
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DROP) {
+			/*
+			 * Drop command from any classifier is actioned.
+			 */
+			DEBUG_TRACE("%p: wants drop: %p, type: %d, skb: %p\n", ci, aci, aci->type_get(aci), skb);
+			prevalent_pr.drop |= aci_pr.drop;
+		}
+
+		/*
+		 * Accel mode permission
+		 */
+		if (aci_pr.relevance == ECM_CLASSIFIER_RELEVANCE_MAYBE) {
+			/*
+			 * Classifier not sure of its relevance - cannot accel yet
+			 */
+			DEBUG_TRACE("%p: accel denied by maybe: %p, type: %d\n", ci, aci, aci->type_get(aci));
+			prevalent_pr.accel_mode = ECM_CLASSIFIER_ACCELERATION_MODE_NO;
+		} else {
+			if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_ACCEL_MODE) {
+				if (aci_pr.accel_mode == ECM_CLASSIFIER_ACCELERATION_MODE_NO) {
+					DEBUG_TRACE("%p: accel denied: %p, type: %d\n", ci, aci, aci->type_get(aci));
+					prevalent_pr.accel_mode = ECM_CLASSIFIER_ACCELERATION_MODE_NO;
+				}
+				/* else yes or don't care about accel */
+			}
+		}
+
+		/*
+		 * Timer group (the last classifier i.e. the highest priority one) will 'win'
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_TIMER_GROUP) {
+			DEBUG_TRACE("%p: timer group: %p, type: %d, group: %d\n", ci, aci, aci->type_get(aci), aci_pr.timer_group);
+			prevalent_pr.timer_group = aci_pr.timer_group;
+		}
+
+		/*
+		 * Qos tag (the last classifier i.e. the highest priority one) will 'win'
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_QOS_TAG) {
+			DEBUG_TRACE("%p: aci: %p, type: %d, flow qos tag: %u, return qos tag: %u\n",
+					ci, aci, aci->type_get(aci), aci_pr.flow_qos_tag, aci_pr.return_qos_tag);
+			prevalent_pr.flow_qos_tag = aci_pr.flow_qos_tag;
+			prevalent_pr.return_qos_tag = aci_pr.return_qos_tag;
+		}
+
+#ifdef ECM_CLASSIFIER_DSCP_ENABLE
+		/*
+		 * If any classifier denied DSCP remarking then that overrides every classifier
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DSCP_DENY) {
+			DEBUG_TRACE("%p: aci: %p, type: %d, DSCP remark denied\n",
+					ci, aci, aci->type_get(aci));
+			prevalent_pr.process_actions |= ECM_CLASSIFIER_PROCESS_ACTION_DSCP_DENY;
+			prevalent_pr.process_actions &= ~ECM_CLASSIFIER_PROCESS_ACTION_DSCP;
+		}
+
+		/*
+		 * DSCP remark action, but only if it has not been denied by any classifier
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DSCP) {
+			if (!(prevalent_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DSCP_DENY)) {
+				DEBUG_TRACE("%p: aci: %p, type: %d, DSCP remark wanted, flow_dscp: %u, return dscp: %u\n",
+						ci, aci, aci->type_get(aci), aci_pr.flow_dscp, aci_pr.return_dscp);
+				prevalent_pr.process_actions |= ECM_CLASSIFIER_PROCESS_ACTION_DSCP;
+				prevalent_pr.flow_dscp = aci_pr.flow_dscp;
+				prevalent_pr.return_dscp = aci_pr.return_dscp;
+			}
+		}
+#endif
+	}
+	ecm_db_connection_assignments_release(assignment_count, assignments);
+
+	/*
+	 * Change timer group?
+	 */
+	if (ci_orig_timer_group != prevalent_pr.timer_group) {
+		DEBUG_TRACE("%p: change timer group from: %d to: %d\n", ci, ci_orig_timer_group, prevalent_pr.timer_group);
+		ecm_db_connection_defunct_timer_reset(ci, prevalent_pr.timer_group);
+	}
+
+	/*
+	 * Drop?
+	 */
+	if (prevalent_pr.drop) {
+		DEBUG_TRACE("%p: drop: %p\n", ci, skb);
+		ecm_db_connection_data_totals_update_dropped(ci, (sender == ECM_TRACKER_SENDER_TYPE_SRC)? true : false, skb->len, 1);
+		ecm_db_connection_deref(ci);
+		return NF_ACCEPT;
+	}
+	ecm_db_connection_data_totals_update(ci, (sender == ECM_TRACKER_SENDER_TYPE_SRC)? true : false, skb->len, 1);
+
+	/*
+	 * Assign qos tag
+	 * GGG TODO Should we use sender to identify whether to use flow or return qos tag?
+	 */
+	skb->priority = prevalent_pr.flow_qos_tag;
+	DEBUG_TRACE("%p: skb priority: %u\n", ci, skb->priority);
+
+	/*
+	 * Accelerate?
+	 */
+	if (prevalent_pr.accel_mode == ECM_CLASSIFIER_ACCELERATION_MODE_ACCEL) {
+		struct ecm_front_end_connection_instance *feci;
+		DEBUG_TRACE("%p: accel\n", ci);
+		feci = ecm_db_connection_front_end_get_and_ref(ci);
+		ecm_sfe_ported_ipv4_connection_accelerate(feci, &prevalent_pr, is_l2_encap, ct);
+		feci->deref(feci);
+	}
+	ecm_db_connection_deref(ci);
+
+	return NF_ACCEPT;
+}
+
+/*
+ * ecm_sfe_ported_ipv4_debugfs_init()
+ */
+bool ecm_sfe_ported_ipv4_debugfs_init(struct dentry *dentry)
+{
+	struct dentry *udp_dentry;
+
+	udp_dentry = debugfs_create_u32("udp_accelerated_count", S_IRUGO, dentry,
+						&ecm_sfe_ported_ipv4_accelerated_count[ECM_SFE_PORTED_IPV4_PROTO_UDP]);
+	if (!udp_dentry) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv4 udp_accelerated_count file in debugfs\n");
+		return false;
+	}
+
+	if (!debugfs_create_u32("tcp_accelerated_count", S_IRUGO, dentry,
+					&ecm_sfe_ported_ipv4_accelerated_count[ECM_SFE_PORTED_IPV4_PROTO_TCP])) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv4 tcp_accelerated_count file in debugfs\n");
+		debugfs_remove(udp_dentry);
+		return false;
+	}
+
+	return true;
+}
+
diff --git a/frontends/sfe/ecm_sfe_ported_ipv4.h b/frontends/sfe/ecm_sfe_ported_ipv4.h
new file mode 100644
index 0000000..006e30d
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_ported_ipv4.h
@@ -0,0 +1,28 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015, The Linux Foundation.  All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+extern unsigned int ecm_sfe_ported_ipv4_process(struct net_device *out_dev, struct net_device *out_dev_nat,
+							struct net_device *in_dev, struct net_device *in_dev_nat,
+							uint8_t *src_node_addr, uint8_t *src_node_addr_nat,
+							uint8_t *dest_node_addr, uint8_t *dest_node_addr_nat,
+							bool can_accel, bool is_routed, bool is_l2_encap, struct sk_buff *skb,
+							struct ecm_tracker_ip_header *iph,
+							struct nf_conn *ct, ecm_tracker_sender_type_t sender, ecm_db_direction_t ecm_dir,
+							struct nf_conntrack_tuple *orig_tuple, struct nf_conntrack_tuple *reply_tuple,
+							ip_addr_t ip_src_addr, ip_addr_t ip_dest_addr, ip_addr_t ip_src_addr_nat,
+							ip_addr_t ip_dest_addr_nat);
+extern bool ecm_sfe_ported_ipv4_debugfs_init(struct dentry *dentry);
+
diff --git a/frontends/sfe/ecm_sfe_ported_ipv6.c b/frontends/sfe/ecm_sfe_ported_ipv6.c
new file mode 100644
index 0000000..db17e99
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_ported_ipv6.c
@@ -0,0 +1,2285 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015 The Linux Foundation.  All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+#include <linux/version.h>
+#include <linux/types.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/icmp.h>
+#include <linux/debugfs.h>
+#include <linux/kthread.h>
+#include <linux/pkt_sched.h>
+#include <linux/string.h>
+#include <net/ip6_route.h>
+#include <net/ip6_fib.h>
+#include <net/addrconf.h>
+#include <net/ipv6.h>
+#include <net/tcp.h>
+#include <asm/unaligned.h>
+#include <asm/uaccess.h>	/* for put_user */
+#include <net/ipv6.h>
+#include <linux/inet.h>
+#include <linux/in6.h>
+#include <linux/udp.h>
+#include <linux/tcp.h>
+#include <linux/inetdevice.h>
+#include <linux/if_arp.h>
+#include <linux/netfilter_ipv6.h>
+#include <linux/netfilter_bridge.h>
+#include <linux/if_bridge.h>
+#include <net/arp.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_acct.h>
+#include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_l4proto.h>
+#include <net/netfilter/nf_conntrack_l3proto.h>
+#include <net/netfilter/nf_conntrack_zones.h>
+#include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
+#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+#include <linux/../../net/8021q/vlan.h>
+#include <linux/if_vlan.h>
+#endif
+
+/*
+ * Debug output levels
+ * 0 = OFF
+ * 1 = ASSERTS / ERRORS
+ * 2 = 1 + WARN
+ * 3 = 2 + INFO
+ * 4 = 3 + TRACE
+ */
+#define DEBUG_LEVEL ECM_SFE_PORTED_IPV6_DEBUG_LEVEL
+
+#include <sfe_drv.h>
+
+#include "ecm_types.h"
+#include "ecm_db_types.h"
+#include "ecm_state.h"
+#include "ecm_tracker.h"
+#include "ecm_classifier.h"
+#include "ecm_front_end_types.h"
+#include "ecm_tracker_datagram.h"
+#include "ecm_tracker_udp.h"
+#include "ecm_tracker_tcp.h"
+#include "ecm_db.h"
+#include "ecm_classifier_default.h"
+#include "ecm_interface.h"
+#include "ecm_sfe_ported_ipv6.h"
+#include "ecm_sfe_ipv6.h"
+#include "ecm_sfe_common.h"
+
+/*
+ * Magic numbers
+ */
+#define ECM_SFE_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC 0xEB9A
+
+/*
+ * Protocol type that ported file supports.
+ */
+enum ecm_sfe_ported_ipv6_proto_types {
+	ECM_SFE_PORTED_IPV6_PROTO_TCP = 0,
+	ECM_SFE_PORTED_IPV6_PROTO_UDP,
+	ECM_SFE_PORTED_IPV6_PROTO_MAX
+
+};
+
+/*
+ * struct ecm_sfe_ipv6_ported_connection_instance
+ *	A connection specific front end instance for PORTED connections
+ */
+struct ecm_sfe_ported_ipv6_connection_instance {
+	struct ecm_front_end_connection_instance base;		/* Base class */
+	uint8_t ported_accelerated_count_index;			/* Index value of accelerated count array (UDP or TCP) */
+#if (DEBUG_LEVEL > 0)
+	uint16_t magic;
+#endif
+};
+
+static int ecm_sfe_ported_ipv6_accelerated_count[ECM_SFE_PORTED_IPV6_PROTO_MAX] = {0};
+						/* Array of Number of TCP and UDP connections currently offloaded */
+
+/*
+ * Expose what should be a static flag in the TCP connection tracker.
+ */
+#ifdef ECM_OPENWRT_SUPPORT
+extern int nf_ct_tcp_no_window_check;
+#endif
+extern int nf_ct_tcp_be_liberal;
+
+/*
+ * ecm_sfe_ported_ipv6_connection_callback()
+ *	Callback for handling create ack/nack calls.
+ */
+static void ecm_sfe_ported_ipv6_connection_callback(void *app_data, struct sfe_ipv6_msg *nim)
+{
+	struct sfe_ipv6_rule_create_msg *nircm = &nim->msg.rule_create;
+	uint32_t serial = (uint32_t)app_data;
+	struct ecm_db_connection_instance *ci;
+	struct ecm_front_end_connection_instance *feci;
+	struct ecm_sfe_ported_ipv6_connection_instance *npci;
+	ip_addr_t flow_ip;
+	ip_addr_t return_ip;
+	ecm_front_end_acceleration_mode_t result_mode;
+
+	/*
+	 * Is this a response to a create message?
+	 */
+	if (nim->cm.type != SFE_TX_CREATE_RULE_MSG) {
+		DEBUG_ERROR("%p: ported create callback with improper type: %d, serial: %u\n", nim, nim->cm.type, serial);
+		return;
+	}
+
+	/*
+	 * Look up ecm connection so that we can update the status.
+	 */
+	ci = ecm_db_connection_serial_find_and_ref(serial);
+	if (!ci) {
+		DEBUG_TRACE("%p: create callback, connection not found, serial: %u\n", nim, serial);
+		return;
+	}
+
+	/*
+	 * Release ref held for this ack/nack response.
+	 * NOTE: It's okay to do this here, ci won't go away, because the ci is held as
+	 * a result of the ecm_db_connection_serial_find_and_ref()
+	 */
+	ecm_db_connection_deref(ci);
+
+	/*
+	 * Get the front end instance
+	 */
+	feci = ecm_db_connection_front_end_get_and_ref(ci);
+	npci = (struct ecm_sfe_ported_ipv6_connection_instance *)feci;
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+
+	ECM_SFE_IPV6_ADDR_TO_IP_ADDR(flow_ip, nircm->tuple.flow_ip);
+	ECM_SFE_IPV6_ADDR_TO_IP_ADDR(return_ip, nircm->tuple.return_ip);
+
+	/*
+	 * Record command duration
+	 */
+	ecm_sfe_ipv6_accel_done_time_update(feci);
+
+	/*
+	 * Dump some useful trace information.
+	 */
+	DEBUG_TRACE("%p: accelerate response for connection: %p, serial: %u\n", npci, feci->ci, serial);
+	DEBUG_TRACE("%p: rule_flags: %x, valid_flags: %x\n", npci, nircm->rule_flags, nircm->valid_flags);
+	DEBUG_TRACE("%p: flow_ip: " ECM_IP_ADDR_OCTAL_FMT ":%d\n", npci, ECM_IP_ADDR_TO_OCTAL(flow_ip), nircm->tuple.flow_ident);
+	DEBUG_TRACE("%p: return_ip: " ECM_IP_ADDR_OCTAL_FMT ":%d\n", npci, ECM_IP_ADDR_TO_OCTAL(return_ip), nircm->tuple.return_ident);
+	DEBUG_TRACE("%p: protocol: %d\n", npci, nircm->tuple.protocol);
+
+	/*
+	 * Handle the creation result code.
+	 */
+	DEBUG_TRACE("%p: response: %d\n", npci, nim->cm.response);
+	if (nim->cm.response != SFE_CMN_RESPONSE_ACK) {
+		/*
+		 * Creation command failed (specific reason ignored).
+		 */
+		DEBUG_TRACE("%p: accel nack: %d\n", npci, nim->cm.error);
+		spin_lock_bh(&feci->lock);
+		DEBUG_ASSERT(feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING, "%p: Unexpected mode: %d\n", ci, feci->accel_mode);
+		feci->stats.ae_nack++;
+		feci->stats.ae_nack_total++;
+		if (feci->stats.ae_nack >= feci->stats.ae_nack_limit) {
+			/*
+			 * Too many SFE rejections
+			 */
+			result_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_ACCEL_ENGINE;
+		} else {
+			/*
+			 * Revert to decelerated
+			 */
+			result_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL;
+		}
+
+		/*
+		 * If connection is now defunct then set mode to ensure no further accel attempts occur
+		 */
+		if (feci->is_defunct) {
+			result_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DEFUNCT;
+		}
+
+		spin_lock_bh(&ecm_sfe_ipv6_lock);
+		_ecm_sfe_ipv6_accel_pending_clear(feci, result_mode);
+		spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+		spin_unlock_bh(&feci->lock);
+
+		/*
+		 * Release the connection.
+		 */
+		feci->deref(feci);
+		ecm_db_connection_deref(ci);
+		return;
+	}
+
+	spin_lock_bh(&feci->lock);
+	DEBUG_ASSERT(feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING, "%p: Unexpected mode: %d\n", ci, feci->accel_mode);
+
+	/*
+	 * If a flush occured before we got the ACK then our acceleration was effectively cancelled on us
+	 * GGG TODO This is a workaround for a SFE message OOO quirk, this should eventually be removed.
+	 */
+	if (feci->stats.flush_happened) {
+		feci->stats.flush_happened = false;
+
+		/*
+		 * Increment the no-action counter.  Our connection was decelerated on us with no action occurring.
+		 */
+		feci->stats.no_action_seen++;
+
+		spin_lock_bh(&ecm_sfe_ipv6_lock);
+		_ecm_sfe_ipv6_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_DECEL);
+		spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+		spin_unlock_bh(&feci->lock);
+
+		/*
+		 * Release the connection.
+		 */
+		feci->deref(feci);
+		ecm_db_connection_deref(ci);
+		return;
+	}
+
+	/*
+	 * Create succeeded
+	 */
+
+	/*
+	 * Clear any nack count
+	 */
+	feci->stats.ae_nack = 0;
+
+	/*
+	 * Clear the "accelerate pending" state and move to "accelerated" state bumping
+	 * the accelerated counters to match our new state.
+	 *
+	 * Decelerate may have been attempted while we were "pending accel" and
+	 * this function will return true if that was the case.
+	 * If decelerate was pending then we need to begin deceleration :-(
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+
+	ecm_sfe_ported_ipv6_accelerated_count[npci->ported_accelerated_count_index]++;	/* Protocol specific counter */
+	ecm_sfe_ipv6_accelerated_count++;		/* General running counter */
+
+	if (!_ecm_sfe_ipv6_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_ACCEL)) {
+		/*
+		 * Increment the no-action counter, this is reset if offload action is seen
+		 */
+		feci->stats.no_action_seen++;
+
+		spin_unlock_bh(&ecm_sfe_ipv6_lock);
+		spin_unlock_bh(&feci->lock);
+
+		/*
+		 * Release the connection.
+		 */
+		feci->deref(feci);
+		ecm_db_connection_deref(ci);
+		return;
+	}
+
+	DEBUG_INFO("%p: Decelerate was pending\n", ci);
+
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+	spin_unlock_bh(&feci->lock);
+
+	feci->decelerate(feci);
+
+	/*
+	 * Release the connection.
+	 */
+	feci->deref(feci);
+	ecm_db_connection_deref(ci);
+}
+
+/*
+ * ecm_sfe_ported_ipv6_connection_accelerate()
+ *	Accelerate a connection
+ */
+static void ecm_sfe_ported_ipv6_connection_accelerate(struct ecm_front_end_connection_instance *feci,
+									struct ecm_classifier_process_response *pr,
+									struct nf_conn *ct, bool is_l2_encap)
+{
+	struct ecm_sfe_ported_ipv6_connection_instance *npci = (struct ecm_sfe_ported_ipv6_connection_instance *)feci;
+	uint16_t regen_occurrances;
+	int protocol;
+	int32_t from_ifaces_first;
+	int32_t to_ifaces_first;
+	struct ecm_db_iface_instance *from_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX];
+	struct ecm_db_iface_instance *to_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX];
+	struct ecm_db_iface_instance *from_sfe_iface;
+	struct ecm_db_iface_instance *to_sfe_iface;
+	int32_t from_sfe_iface_id;
+	int32_t to_sfe_iface_id;
+	uint8_t from_sfe_iface_address[ETH_ALEN];
+	uint8_t to_sfe_iface_address[ETH_ALEN];
+	struct sfe_ipv6_msg nim;
+	struct sfe_ipv6_rule_create_msg *nircm;
+	struct ecm_classifier_instance *assignments[ECM_CLASSIFIER_TYPES];
+	int aci_index;
+	int assignment_count;
+	sfe_tx_status_t sfe_tx_status;
+	int32_t list_index;
+	int32_t interface_type_counts[ECM_DB_IFACE_TYPE_COUNT];
+	bool rule_invalid;
+	ip_addr_t src_ip;
+	ip_addr_t dest_ip;
+	ecm_front_end_acceleration_mode_t result_mode;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+
+	/*
+	 * Get the re-generation occurrance counter of the connection.
+	 * We compare it again at the end - to ensure that the rule construction has seen no generation
+	 * changes during rule creation.
+	 */
+	regen_occurrances = ecm_db_connection_regeneration_occurrances_get(feci->ci);
+
+	/*
+	 * Test if acceleration is permitted
+	 */
+	if (!ecm_sfe_ipv6_accel_pending_set(feci)) {
+		DEBUG_TRACE("%p: Acceleration not permitted: %p\n", feci, feci->ci);
+		return;
+	}
+
+	/*
+	 * Okay construct an accel command.
+	 * Initialise creation structure.
+	 * NOTE: We leverage the app_data void pointer to be our 32 bit connection serial number.
+	 * When we get it back we re-cast it to a uint32 and do a faster connection lookup.
+	 */
+	memset(&nim, 0, sizeof(struct sfe_ipv6_msg));
+	sfe_ipv6_msg_init(&nim, SFE_SPECIAL_INTERFACE_IPV6, SFE_TX_CREATE_RULE_MSG,
+			sizeof(struct sfe_ipv6_rule_create_msg),
+			ecm_sfe_ported_ipv6_connection_callback,
+			(void *)ecm_db_connection_serial_get(feci->ci));
+
+	nircm = &nim.msg.rule_create;
+	nircm->valid_flags = 0;
+	nircm->rule_flags = 0;
+
+	/*
+	 * Initialize VLAN tag information
+	 */
+	nircm->vlan_primary_rule.ingress_vlan_tag = SFE_VLAN_ID_NOT_CONFIGURED;
+	nircm->vlan_primary_rule.egress_vlan_tag = SFE_VLAN_ID_NOT_CONFIGURED;
+	nircm->vlan_secondary_rule.ingress_vlan_tag = SFE_VLAN_ID_NOT_CONFIGURED;
+	nircm->vlan_secondary_rule.egress_vlan_tag = SFE_VLAN_ID_NOT_CONFIGURED;
+
+	/*
+	 * Get the interface lists of the connection, we must have at least one interface in the list to continue
+	 */
+	from_ifaces_first = ecm_db_connection_from_interfaces_get_and_ref(feci->ci, from_ifaces);
+	if (from_ifaces_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+		DEBUG_WARN("%p: Accel attempt failed - no interfaces in from_interfaces list!\n", npci);
+		goto ported_accel_bad_rule;
+	}
+
+	to_ifaces_first = ecm_db_connection_to_interfaces_get_and_ref(feci->ci, to_ifaces);
+	if (to_ifaces_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+		DEBUG_WARN("%p: Accel attempt failed - no interfaces in to_interfaces list!\n", npci);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		goto ported_accel_bad_rule;
+	}
+
+	/*
+	 * First interface in each must be a known sfe interface
+	 */
+	from_sfe_iface = from_ifaces[from_ifaces_first];
+	to_sfe_iface = to_ifaces[to_ifaces_first];
+	from_sfe_iface_id = ecm_db_iface_ae_interface_identifier_get(from_sfe_iface);
+	to_sfe_iface_id = ecm_db_iface_ae_interface_identifier_get(to_sfe_iface);
+	if ((from_sfe_iface_id < 0) || (to_sfe_iface_id < 0)) {
+		DEBUG_TRACE("%p: from_sfe_iface_id: %d, to_sfe_iface_id: %d\n", npci, from_sfe_iface_id, to_sfe_iface_id);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
+		goto ported_accel_bad_rule;
+	}
+
+	/*
+	 * New rule being created
+	 */
+	nircm->valid_flags |= SFE_RULE_CREATE_CONN_VALID;
+
+	/*
+	 * Set interface numbers involved in accelerating this connection.
+	 * These are the outer facing addresses from the heirarchy interface lists we got above.
+	 * These may be overridden later if we detect special interface types e.g. ipsec.
+	 */
+	nircm->conn_rule.flow_interface_num = from_sfe_iface_id;
+	nircm->conn_rule.return_interface_num = to_sfe_iface_id;
+
+	/*
+	 * Set interface numbers involved in accelerating this connection.
+	 * These are the inner facing addresses from the heirarchy interface lists we got above.
+	 */
+	nim.msg.rule_create.conn_rule.flow_top_interface_num = ecm_db_iface_interface_identifier_get(from_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX-1]);
+	nim.msg.rule_create.conn_rule.return_top_interface_num = ecm_db_iface_interface_identifier_get(to_ifaces[ECM_DB_IFACE_HEIRARCHY_MAX-1]);
+
+	/*
+	 * We know that each outward facing interface is known to the SFE and so this connection could be accelerated.
+	 * However the lists may also specify other interesting details that must be included in the creation command,
+	 * for example, ethernet MAC, VLAN tagging or PPPoE session information.
+	 * We get this information by walking from the outer to the innermost interface for each list and examine the interface types.
+	 *
+	 * Start with the 'from' (src) side.
+	 * NOTE: The lists may contain a complex heirarchy of similar type of interface e.g. multiple vlans or tunnels within tunnels.
+	 * This SFE cannot handle that - there is no way to describe this in the rule - if we see multiple types that would conflict we have to abort.
+	 */
+	DEBUG_TRACE("%p: Examine from/src heirarchy list\n", npci);
+	memset(interface_type_counts, 0, sizeof(interface_type_counts));
+	rule_invalid = false;
+	for (list_index = from_ifaces_first; !rule_invalid && (list_index < ECM_DB_IFACE_HEIRARCHY_MAX); list_index++) {
+		struct ecm_db_iface_instance *ii;
+		ecm_db_iface_type_t ii_type;
+		char *ii_name;
+
+		ii = from_ifaces[list_index];
+		ii_type = ecm_db_connection_iface_type_get(ii);
+		ii_name = ecm_db_interface_type_to_string(ii_type);
+		DEBUG_TRACE("%p: list_index: %d, ii: %p, type: %d (%s)\n", npci, list_index, ii, ii_type, ii_name);
+
+		/*
+		 * Extract information from this interface type if it is applicable to the rule.
+		 * Conflicting information may cause accel to be unsupported.
+		 */
+		switch (ii_type) {
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			struct ecm_db_interface_info_pppoe pppoe_info;
+#endif
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			struct ecm_db_interface_info_vlan vlan_info;
+			uint32_t vlan_value = 0;
+			struct net_device *vlan_in_dev = NULL;
+#endif
+		case ECM_DB_IFACE_TYPE_BRIDGE:
+			DEBUG_TRACE("%p: Bridge\n", npci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Cannot cascade bridges
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: Bridge - ignore additional\n", npci);
+				break;
+			}
+			ecm_db_iface_bridge_address_get(ii, from_sfe_iface_address);
+			DEBUG_TRACE("%p: Bridge - mac: %pM\n", npci, from_sfe_iface_address);
+			break;
+		case ECM_DB_IFACE_TYPE_ETHERNET:
+			DEBUG_TRACE("%p: Ethernet\n", npci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Ignore additional mac addresses, these are usually as a result of address propagation
+				 * from bridges down to ports etc.
+				 */
+				DEBUG_TRACE("%p: Ethernet - ignore additional\n", npci);
+				break;
+			}
+
+			/*
+			 * Can only handle one MAC, the first outermost mac.
+			 */
+			ecm_db_iface_ethernet_address_get(ii, from_sfe_iface_address);
+			DEBUG_TRACE("%p: Ethernet - mac: %pM\n", npci, from_sfe_iface_address);
+			break;
+		case ECM_DB_IFACE_TYPE_PPPOE:
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			/*
+			 * More than one PPPoE in the list is not valid!
+			 */
+			if (interface_type_counts[ii_type] != 0) {
+				DEBUG_TRACE("%p: PPPoE - additional unsupported\n", npci);
+				rule_invalid = true;
+				break;
+			}
+
+			/*
+			 * Copy pppoe session info to the creation structure.
+			 */
+			ecm_db_iface_pppoe_session_info_get(ii, &pppoe_info);
+
+			nircm->pppoe_rule.flow_pppoe_session_id = pppoe_info.pppoe_session_id;
+			memcpy(nircm->pppoe_rule.flow_pppoe_remote_mac, pppoe_info.remote_mac, ETH_ALEN);
+			nircm->valid_flags |= SFE_RULE_CREATE_PPPOE_VALID;
+
+			DEBUG_TRACE("%p: PPPoE - session: %x, mac: %pM\n", npci,
+					nircm->pppoe_rule.flow_pppoe_session_id,
+					nircm->pppoe_rule.flow_pppoe_remote_mac);
+#else
+			rule_invalid = true;
+#endif
+			break;
+		case ECM_DB_IFACE_TYPE_VLAN:
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			DEBUG_TRACE("%p: VLAN\n", npci);
+			if (interface_type_counts[ii_type] > 1) {
+				/*
+				 * Can only support two vlans
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: VLAN - additional unsupported\n", npci);
+				break;
+			}
+			ecm_db_iface_vlan_info_get(ii, &vlan_info);
+			vlan_value = ((vlan_info.vlan_tpid << 16) | vlan_info.vlan_tag);
+
+			/*
+			 * Look up the vlan device and incorporate the vlan priority into the vlan_value
+			 */
+			vlan_in_dev = dev_get_by_index(&init_net, ecm_db_iface_interface_identifier_get(ii));
+			if (vlan_in_dev) {
+				vlan_value |= vlan_dev_get_egress_prio(vlan_in_dev, pr->return_qos_tag);
+				dev_put(vlan_in_dev);
+				vlan_in_dev = NULL;
+			}
+
+			/*
+			 * Primary or secondary (QinQ) VLAN?
+			 */
+			if (interface_type_counts[ii_type] == 0) {
+				nircm->vlan_primary_rule.ingress_vlan_tag = vlan_value;
+			} else {
+				nircm->vlan_secondary_rule.ingress_vlan_tag = vlan_value;
+			}
+			nircm->valid_flags |= SFE_RULE_CREATE_VLAN_VALID;
+
+			/*
+			 * If we have not yet got an ethernet mac then take this one (very unlikely as mac should have been propagated to the slave (outer) device
+			 */
+			if (interface_type_counts[ECM_DB_IFACE_TYPE_ETHERNET] == 0) {
+				memcpy(from_sfe_iface_address, vlan_info.address, ETH_ALEN);
+				interface_type_counts[ECM_DB_IFACE_TYPE_ETHERNET]++;
+				DEBUG_TRACE("%p: VLAN use mac: %pM\n", npci, from_sfe_iface_address);
+			}
+			DEBUG_TRACE("%p: vlan tag: %x\n", npci, vlan_value);
+#else
+			rule_invalid = true;
+			DEBUG_TRACE("%p: VLAN - unsupported\n", npci);
+#endif
+			break;
+		case ECM_DB_IFACE_TYPE_IPSEC_TUNNEL:
+#ifdef ECM_INTERFACE_IPSEC_ENABLE
+			DEBUG_TRACE("%p: IPSEC\n", npci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Can only support one ipsec
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: IPSEC - additional unsupported\n", npci);
+				break;
+			}
+			nircm->conn_rule.flow_interface_num = SFE_SPECIAL_INTERFACE_IPSEC;
+#else
+			rule_invalid = true;
+			DEBUG_TRACE("%p: IPSEC - unsupported\n", npci);
+#endif
+			break;
+		default:
+			DEBUG_TRACE("%p: Ignoring: %d (%s)\n", npci, ii_type, ii_name);
+		}
+
+		/*
+		 * Seen an interface of this type
+		 */
+		interface_type_counts[ii_type]++;
+	}
+	if (rule_invalid) {
+		DEBUG_WARN("%p: from/src Rule invalid\n", npci);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
+		goto ported_accel_bad_rule;
+	}
+
+	/*
+	 * Now examine the TO / DEST heirarchy list to construct the destination part of the rule
+	 */
+	DEBUG_TRACE("%p: Examine to/dest heirarchy list\n", npci);
+	memset(interface_type_counts, 0, sizeof(interface_type_counts));
+	rule_invalid = false;
+	for (list_index = to_ifaces_first; !rule_invalid && (list_index < ECM_DB_IFACE_HEIRARCHY_MAX); list_index++) {
+		struct ecm_db_iface_instance *ii;
+		ecm_db_iface_type_t ii_type;
+		char *ii_name;
+
+		ii = to_ifaces[list_index];
+		ii_type = ecm_db_connection_iface_type_get(ii);
+		ii_name = ecm_db_interface_type_to_string(ii_type);
+		DEBUG_TRACE("%p: list_index: %d, ii: %p, type: %d (%s)\n", npci, list_index, ii, ii_type, ii_name);
+
+		/*
+		 * Extract information from this interface type if it is applicable to the rule.
+		 * Conflicting information may cause accel to be unsupported.
+		 */
+		switch (ii_type) {
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			struct ecm_db_interface_info_pppoe pppoe_info;
+#endif
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			struct ecm_db_interface_info_vlan vlan_info;
+			uint32_t vlan_value = 0;
+			struct net_device *vlan_out_dev = NULL;
+#endif
+		case ECM_DB_IFACE_TYPE_BRIDGE:
+			DEBUG_TRACE("%p: Bridge\n", npci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Cannot cascade bridges
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: Bridge - ignore additional\n", npci);
+				break;
+			}
+			ecm_db_iface_bridge_address_get(ii, to_sfe_iface_address);
+			DEBUG_TRACE("%p: Bridge - mac: %pM\n", npci, to_sfe_iface_address);
+			break;
+		case ECM_DB_IFACE_TYPE_ETHERNET:
+			DEBUG_TRACE("%p: Ethernet\n", npci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Ignore additional mac addresses, these are usually as a result of address propagation
+				 * from bridges down to ports etc.
+				 */
+				DEBUG_TRACE("%p: Ethernet - ignore additional\n", npci);
+				break;
+			}
+
+			/*
+			 * Can only handle one MAC, the first outermost mac.
+			 */
+			ecm_db_iface_ethernet_address_get(ii, to_sfe_iface_address);
+			DEBUG_TRACE("%p: Ethernet - mac: %pM\n", npci, to_sfe_iface_address);
+			break;
+		case ECM_DB_IFACE_TYPE_PPPOE:
+#ifdef ECM_INTERFACE_PPP_ENABLE
+			/*
+			 * More than one PPPoE in the list is not valid!
+			 */
+			if (interface_type_counts[ii_type] != 0) {
+				DEBUG_TRACE("%p: PPPoE - additional unsupported\n", npci);
+				rule_invalid = true;
+				break;
+			}
+
+			/*
+			 * Copy pppoe session info to the creation structure.
+			 */
+			ecm_db_iface_pppoe_session_info_get(ii, &pppoe_info);
+			nircm->pppoe_rule.return_pppoe_session_id = pppoe_info.pppoe_session_id;
+			memcpy(nircm->pppoe_rule.return_pppoe_remote_mac, pppoe_info.remote_mac, ETH_ALEN);
+			nircm->valid_flags |= SFE_RULE_CREATE_PPPOE_VALID;
+
+			DEBUG_TRACE("%p: PPPoE - session: %x, mac: %pM\n", npci,
+				    nircm->pppoe_rule.return_pppoe_session_id,
+				    nircm->pppoe_rule.return_pppoe_remote_mac);
+#else
+			rule_invalid = true;
+#endif
+			break;
+		case ECM_DB_IFACE_TYPE_VLAN:
+#ifdef ECM_INTERFACE_VLAN_ENABLE
+			DEBUG_TRACE("%p: VLAN\n", npci);
+			if (interface_type_counts[ii_type] > 1) {
+				/*
+				 * Can only support two vlans
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: VLAN - additional unsupported\n", npci);
+				break;
+			}
+			ecm_db_iface_vlan_info_get(ii, &vlan_info);
+			vlan_value = ((vlan_info.vlan_tpid << 16) | vlan_info.vlan_tag);
+
+			/*
+			 * Look up the vlan device and incorporate the vlan priority into the vlan_value
+			 */
+			vlan_out_dev = dev_get_by_index(&init_net, ecm_db_iface_interface_identifier_get(ii));
+			if (vlan_out_dev) {
+				vlan_value |= vlan_dev_get_egress_prio(vlan_out_dev, pr->flow_qos_tag);
+				dev_put(vlan_out_dev);
+				vlan_out_dev = NULL;
+			}
+
+			/*
+			 * Primary or secondary (QinQ) VLAN?
+			 */
+			if (interface_type_counts[ii_type] == 0) {
+				nircm->vlan_primary_rule.egress_vlan_tag = vlan_value;
+			} else {
+				nircm->vlan_secondary_rule.egress_vlan_tag = vlan_value;
+			}
+			nircm->valid_flags |= SFE_RULE_CREATE_VLAN_VALID;
+
+			/*
+			 * If we have not yet got an ethernet mac then take this one (very unlikely as mac should have been propagated to the slave (outer) device
+			 */
+			if (interface_type_counts[ECM_DB_IFACE_TYPE_ETHERNET] == 0) {
+				memcpy(to_sfe_iface_address, vlan_info.address, ETH_ALEN);
+				interface_type_counts[ECM_DB_IFACE_TYPE_ETHERNET]++;
+				DEBUG_TRACE("%p: VLAN use mac: %pM\n", npci, to_sfe_iface_address);
+			}
+			DEBUG_TRACE("%p: vlan tag: %x\n", npci, vlan_value);
+#else
+			rule_invalid = true;
+			DEBUG_TRACE("%p: VLAN - unsupported\n", npci);
+#endif
+			break;
+		case ECM_DB_IFACE_TYPE_IPSEC_TUNNEL:
+#ifdef ECM_INTERFACE_IPSEC_ENABLE
+			DEBUG_TRACE("%p: IPSEC\n", npci);
+			if (interface_type_counts[ii_type] != 0) {
+				/*
+				 * Can only support one ipsec
+				 */
+				rule_invalid = true;
+				DEBUG_TRACE("%p: IPSEC - additional unsupported\n", npci);
+				break;
+			}
+			nircm->conn_rule.return_interface_num = SFE_SPECIAL_INTERFACE_IPSEC;
+#else
+			rule_invalid = true;
+			DEBUG_TRACE("%p: IPSEC - unsupported\n", npci);
+#endif
+			break;
+		default:
+			DEBUG_TRACE("%p: Ignoring: %d (%s)\n", npci, ii_type, ii_name);
+		}
+
+		/*
+		 * Seen an interface of this type
+		 */
+		interface_type_counts[ii_type]++;
+	}
+	if (rule_invalid) {
+		DEBUG_WARN("%p: from/src Rule invalid\n", npci);
+		ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+		ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
+		goto ported_accel_bad_rule;
+	}
+
+	/*
+	 * Routed or bridged?
+	 */
+	if (ecm_db_connection_is_routed_get(feci->ci)) {
+		nircm->rule_flags |= SFE_RULE_CREATE_FLAG_ROUTED;
+	} else {
+		nircm->rule_flags |= SFE_RULE_CREATE_FLAG_BRIDGE_FLOW;
+		if (is_l2_encap) {
+			nircm->rule_flags |= SFE_RULE_CREATE_FLAG_L2_ENCAP;
+		}
+	}
+
+	/*
+	 * Set up the flow and return qos tags
+	 */
+	nircm->qos_rule.flow_qos_tag = (uint32_t)pr->flow_qos_tag;
+	nircm->qos_rule.return_qos_tag = (uint32_t)pr->return_qos_tag;
+	nircm->valid_flags |= SFE_RULE_CREATE_QOS_VALID;
+
+#ifdef ECM_CLASSIFIER_DSCP_ENABLE
+	/*
+	 * DSCP information?
+	 */
+	if (pr->process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DSCP) {
+		nircm->dscp_rule.flow_dscp = pr->flow_dscp;
+		nircm->dscp_rule.return_dscp = pr->return_dscp;
+		nircm->rule_flags |= SFE_RULE_CREATE_FLAG_DSCP_MARKING;
+		nircm->valid_flags |= SFE_RULE_CREATE_DSCP_MARKING_VALID;
+	}
+#endif
+	protocol = ecm_db_connection_protocol_get(feci->ci);
+
+	/*
+	 * Set protocol
+	 */
+	nircm->tuple.protocol = (int32_t)protocol;
+
+	/*
+	 * The flow_ip is where the connection established from
+	 */
+	ecm_db_connection_from_address_get(feci->ci, src_ip);
+	ECM_IP_ADDR_TO_SFE_IPV6_ADDR(nircm->tuple.flow_ip, src_ip);
+
+	/*
+	 * The dest_ip is where the connection is established to
+	 */
+	ecm_db_connection_to_address_get(feci->ci, dest_ip);
+	ECM_IP_ADDR_TO_SFE_IPV6_ADDR(nircm->tuple.return_ip, dest_ip);
+
+	/*
+	 * Same approach as above for port information
+	 */
+	nircm->tuple.flow_ident = htons(ecm_db_connection_from_port_get(feci->ci));
+	nircm->tuple.return_ident = htons(ecm_db_connection_to_port_get(feci->ci));
+
+	/*
+	 * Get mac addresses.
+	 * The src_mac is the mac address of the node that established the connection.
+	 * This will work whether the from_node is LAN (egress) or WAN (ingress).
+	 */
+	ecm_db_connection_from_node_address_get(feci->ci, (uint8_t *)nircm->conn_rule.flow_mac);
+
+	/*
+	 * The dest_mac is more complex.  For egress it is the node address of the 'to' side of the connection.
+	 * For ingress it is the node adress of the NAT'ed 'to' IP.
+	 * Essentially it is the MAC of node associated with create.dest_ip and this is "to nat" side.
+	 */
+	ecm_db_connection_to_node_address_get(feci->ci, (uint8_t *)nircm->conn_rule.return_mac);
+
+	/*
+	 * Get MTU information
+	 */
+	nircm->conn_rule.flow_mtu = (uint32_t)ecm_db_connection_from_iface_mtu_get(feci->ci);
+	nircm->conn_rule.return_mtu = (uint32_t)ecm_db_connection_to_iface_mtu_get(feci->ci);
+
+	if (protocol == IPPROTO_TCP) {
+		/*
+		 * Need window scaling information from conntrack if available
+		 * Start by looking up the conntrack connection
+		 */
+		if (!ct) {
+			/*
+			 * No conntrack so no need to check window sequence space
+			 */
+			DEBUG_TRACE("%p: TCP Accel no ct from conn %p to get window data\n", npci, feci->ci);
+			nircm->rule_flags |= SFE_RULE_CREATE_FLAG_NO_SEQ_CHECK;
+		} else {
+			spin_lock_bh(&ct->lock);
+			DEBUG_TRACE("%p: TCP Accel Get window data from ct %p for conn %p\n", npci, ct, feci->ci);
+
+			nircm->tcp_rule.flow_window_scale = ct->proto.tcp.seen[0].td_scale;
+			nircm->tcp_rule.flow_max_window = ct->proto.tcp.seen[0].td_maxwin;
+			nircm->tcp_rule.flow_end = ct->proto.tcp.seen[0].td_end;
+			nircm->tcp_rule.flow_max_end = ct->proto.tcp.seen[0].td_maxend;
+			nircm->tcp_rule.return_window_scale = ct->proto.tcp.seen[1].td_scale;
+			nircm->tcp_rule.return_max_window = ct->proto.tcp.seen[1].td_maxwin;
+			nircm->tcp_rule.return_end = ct->proto.tcp.seen[1].td_end;
+			nircm->tcp_rule.return_max_end = ct->proto.tcp.seen[1].td_maxend;
+#ifdef ECM_OPENWRT_SUPPORT
+			if (nf_ct_tcp_be_liberal || nf_ct_tcp_no_window_check
+#else
+			if (nf_ct_tcp_be_liberal
+#endif
+					|| (ct->proto.tcp.seen[0].flags & IP_CT_TCP_FLAG_BE_LIBERAL)
+					|| (ct->proto.tcp.seen[1].flags & IP_CT_TCP_FLAG_BE_LIBERAL)) {
+				nircm->rule_flags |= SFE_RULE_CREATE_FLAG_NO_SEQ_CHECK;
+			}
+			spin_unlock_bh(&ct->lock);
+		}
+
+		nircm->valid_flags |= SFE_RULE_CREATE_TCP_VALID;
+	}
+
+	/*
+	 * Sync our creation command from the assigned classifiers to get specific additional creation rules.
+	 * NOTE: These are called in ascending order of priority and so the last classifier (highest) shall
+	 * override any preceding classifiers.
+	 * This also gives the classifiers a chance to see that acceleration is being attempted.
+	 */
+	assignment_count = ecm_db_connection_classifier_assignments_get_and_ref(feci->ci, assignments);
+	for (aci_index = 0; aci_index < assignment_count; ++aci_index) {
+		struct ecm_classifier_instance *aci;
+		struct ecm_classifier_rule_create ecrc;
+		/*
+		 * NOTE: The current classifiers do not sync anything to the underlying accel engines.
+		 * In the future, if any of the classifiers wants to pass any parameter, these parameters
+		 * should be received via this object and copied to the accel engine's create object (nircm).
+		*/
+		aci = assignments[aci_index];
+		DEBUG_TRACE("%p: sync from: %p, type: %d\n", npci, aci, aci->type_get(aci));
+		aci->sync_from_v6(aci, &ecrc);
+	}
+	ecm_db_connection_assignments_release(assignment_count, assignments);
+
+	/*
+	 * Release the interface lists
+	 */
+	ecm_db_connection_interfaces_deref(from_ifaces, from_ifaces_first);
+	ecm_db_connection_interfaces_deref(to_ifaces, to_ifaces_first);
+
+	DEBUG_INFO("%p: Ported Accelerate connection %p\n"
+			"Protocol: %d\n"
+			"from_mtu: %u\n"
+			"to_mtu: %u\n"
+			"from_ip: " ECM_IP_ADDR_OCTAL_FMT ":%d\n"
+			"to_ip: " ECM_IP_ADDR_OCTAL_FMT ":%d\n"
+			"from_mac: %pM\n"
+			"to_mac: %pM\n"
+			"src_iface_num: %u\n"
+			"dest_iface_num: %u\n"
+			"ingress_inner_vlan_tag: %u\n"
+			"egress_inner_vlan_tag: %u\n"
+			"ingress_outer_vlan_tag: %u\n"
+			"egress_outer_vlan_tag: %u\n"
+			"rule_flags: %x\n"
+			"valid_flags: %x\n"
+			"return_pppoe_session_id: %u\n"
+			"return_pppoe_remote_mac: %pM\n"
+			"flow_pppoe_session_id: %u\n"
+			"flow_pppoe_remote_mac: %pM\n"
+			"flow_qos_tag: %x (%u)\n"
+			"return_qos_tag: %x (%u)\n"
+			"flow_dscp: %x\n"
+			"return_dscp: %x\n",
+			npci,
+			feci->ci,
+			nircm->tuple.protocol,
+			nircm->conn_rule.flow_mtu,
+			nircm->conn_rule.return_mtu,
+			ECM_IP_ADDR_TO_OCTAL(src_ip), nircm->tuple.flow_ident,
+			ECM_IP_ADDR_TO_OCTAL(dest_ip), nircm->tuple.return_ident,
+			nircm->conn_rule.flow_mac,
+			nircm->conn_rule.return_mac,
+			nircm->conn_rule.flow_interface_num,
+			nircm->conn_rule.return_interface_num,
+			nircm->vlan_primary_rule.ingress_vlan_tag,
+			nircm->vlan_primary_rule.egress_vlan_tag,
+			nircm->vlan_secondary_rule.ingress_vlan_tag,
+			nircm->vlan_secondary_rule.egress_vlan_tag,
+			nircm->rule_flags,
+			nircm->valid_flags,
+			nircm->pppoe_rule.return_pppoe_session_id,
+			nircm->pppoe_rule.return_pppoe_remote_mac,
+			nircm->pppoe_rule.flow_pppoe_session_id,
+			nircm->pppoe_rule.flow_pppoe_remote_mac,
+			nircm->qos_rule.flow_qos_tag, nircm->qos_rule.flow_qos_tag,
+			nircm->qos_rule.return_qos_tag, nircm->qos_rule.return_qos_tag,
+			nircm->dscp_rule.flow_dscp,
+			nircm->dscp_rule.return_dscp);
+
+	if (protocol == IPPROTO_TCP) {
+		DEBUG_INFO("flow_window_scale: %u\n"
+			"flow_max_window: %u\n"
+			"flow_end: %u\n"
+			"flow_max_end: %u\n"
+			"return_window_scale: %u\n"
+			"return_max_window: %u\n"
+			"return_end: %u\n"
+			"return_max_end: %u\n",
+			nircm->tcp_rule.flow_window_scale,
+			nircm->tcp_rule.flow_max_window,
+			nircm->tcp_rule.flow_end,
+			nircm->tcp_rule.flow_max_end,
+			nircm->tcp_rule.return_window_scale,
+			nircm->tcp_rule.return_max_window,
+			nircm->tcp_rule.return_end,
+			nircm->tcp_rule.return_max_end);
+	}
+
+	/*
+	 * Now that the rule has been constructed we re-compare the generation occurrance counter.
+	 * If there has been a change then we abort because the rule may have been created using
+	 * unstable data - especially if another thread has begun regeneration of the connection state.
+	 * NOTE: This does not prevent a regen from being flagged immediately after this line of code either,
+	 * or while the acceleration rule is in flight to the nss.
+	 * This is only to check for consistency of rule state - not that the state is stale.
+	 * Remember that the connection is marked as "accel pending state" so if a regen is flagged immediately
+	 * after this check passes, the connection will be decelerated and refreshed very quickly.
+	 */
+	if (regen_occurrances != ecm_db_connection_regeneration_occurrances_get(feci->ci)) {
+		DEBUG_INFO("%p: connection:%p regen occurred - aborting accel rule.\n", feci, feci->ci);
+		ecm_sfe_ipv6_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_DECEL);
+		return;
+	}
+
+	/*
+	 * Ref the connection before issuing an SFE rule
+	 * This ensures that when the SFE responds to the command - which may even be immediately -
+	 * the callback function can trust the correct ref was taken for its purpose.
+	 * NOTE: remember that this will also implicitly hold the feci.
+	 */
+	ecm_db_connection_ref(feci->ci);
+
+	/*
+	 * We are about to issue the command, record the time of transmission
+	 */
+	spin_lock_bh(&feci->lock);
+	feci->stats.cmd_time_begun = jiffies;
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Call the rule create function
+	 */
+	sfe_tx_status = sfe_drv_ipv6_tx(ecm_sfe_ipv6_drv_mgr, &nim);
+	if (sfe_tx_status == SFE_TX_SUCCESS) {
+		/*
+		 * Reset the driver_fail count - transmission was okay here.
+		 */
+		spin_lock_bh(&feci->lock);
+		feci->stats.driver_fail = 0;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * Release that ref!
+	 */
+	ecm_db_connection_deref(feci->ci);
+
+	/*
+	 * TX failed
+	 */
+	spin_lock_bh(&feci->lock);
+	DEBUG_ASSERT(feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING, "%p: Accel mode unexpected: %d\n", npci, feci->accel_mode);
+	feci->stats.driver_fail_total++;
+	feci->stats.driver_fail++;
+	if (feci->stats.driver_fail >= feci->stats.driver_fail_limit) {
+		DEBUG_WARN("%p: Accel failed - driver fail limit\n", npci);
+		result_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DRIVER;
+	} else {
+		result_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL;
+	}
+
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	_ecm_sfe_ipv6_accel_pending_clear(feci, result_mode);
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	spin_unlock_bh(&feci->lock);
+	return;
+
+ported_accel_bad_rule:
+	;
+
+	/*
+	 * Jump to here when rule data is bad and an offload command cannot be constructed
+	 */
+	DEBUG_WARN("%p: Accel failed - bad rule\n", npci);
+	ecm_sfe_ipv6_accel_pending_clear(feci, ECM_FRONT_END_ACCELERATION_MODE_FAIL_RULE);
+}
+
+/*
+ * ecm_sfe_ported_ipv6_connection_destroy_callback()
+ *	Callback for handling destroy ack/nack calls.
+ */
+static void ecm_sfe_ported_ipv6_connection_destroy_callback(void *app_data, struct sfe_ipv6_msg *nim)
+{
+	struct sfe_ipv6_rule_destroy_msg *nirdm = &nim->msg.rule_destroy;
+	uint32_t serial = (uint32_t)app_data;
+	struct ecm_db_connection_instance *ci;
+	struct ecm_front_end_connection_instance *feci;
+	struct ecm_sfe_ported_ipv6_connection_instance *npci;
+	ip_addr_t flow_ip;
+	ip_addr_t return_ip;
+
+	/*
+	 * Is this a response to a destroy message?
+	 */
+	if (nim->cm.type != SFE_TX_DESTROY_RULE_MSG) {
+		DEBUG_ERROR("%p: ported destroy callback with improper type: %d\n", nim, nim->cm.type);
+		return;
+	}
+
+	/*
+	 * Look up ecm connection so that we can update the status.
+	 */
+	ci = ecm_db_connection_serial_find_and_ref(serial);
+	if (!ci) {
+		DEBUG_TRACE("%p: destroy callback, connection not found, serial: %u\n", nim, serial);
+		return;
+	}
+
+	/*
+	 * Release ref held for this ack/nack response.
+	 * NOTE: It's okay to do this here, ci won't go away, because the ci is held as
+	 * a result of the ecm_db_connection_serial_find_and_ref()
+	 */
+	ecm_db_connection_deref(ci);
+
+	/*
+	 * Get the front end instance
+	 */
+	feci = ecm_db_connection_front_end_get_and_ref(ci);
+	npci = (struct ecm_sfe_ported_ipv6_connection_instance *)feci;
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+
+	ECM_SFE_IPV6_ADDR_TO_IP_ADDR(flow_ip, nirdm->tuple.flow_ip);
+	ECM_SFE_IPV6_ADDR_TO_IP_ADDR(return_ip, nirdm->tuple.return_ip);
+
+	/*
+	 * Record command duration
+	 */
+	ecm_sfe_ipv6_decel_done_time_update(feci);
+
+	/*
+	 * Dump some useful trace information.
+	 */
+	DEBUG_TRACE("%p: decelerate response for connection: %p\n", npci, feci->ci);
+	DEBUG_TRACE("%p: flow_ip: " ECM_IP_ADDR_OCTAL_FMT ":%d\n", npci, ECM_IP_ADDR_TO_OCTAL(flow_ip), nirdm->tuple.flow_ident);
+	DEBUG_TRACE("%p: return_ip: " ECM_IP_ADDR_OCTAL_FMT ":%d\n", npci, ECM_IP_ADDR_TO_OCTAL(return_ip), nirdm->tuple.return_ident);
+	DEBUG_TRACE("%p: protocol: %d\n", npci, nirdm->tuple.protocol);
+
+	/*
+	 * Drop decel pending counter
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	ecm_sfe_ipv6_pending_decel_count--;
+	DEBUG_ASSERT(ecm_sfe_ipv6_pending_decel_count >= 0, "Bad decel pending counter\n");
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	spin_lock_bh(&feci->lock);
+
+	/*
+	 * If decel is not still pending then it's possible that the SFE ended acceleration by some other reason e.g. flush
+	 * In which case we cannot rely on the response we get here.
+	 */
+	if (feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_DECEL_PENDING) {
+		spin_unlock_bh(&feci->lock);
+
+		/*
+		 * Release the connections.
+		 */
+		feci->deref(feci);
+		ecm_db_connection_deref(ci);
+		return;
+	}
+
+	DEBUG_TRACE("%p: response: %d\n", npci, nim->cm.response);
+	if (nim->cm.response != SFE_CMN_RESPONSE_ACK) {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DECEL;
+	} else {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL;
+	}
+
+	/*
+	 * If connection became defunct then set mode so that no further accel/decel attempts occur.
+	 */
+	if (feci->is_defunct) {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DEFUNCT;
+	}
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Ported acceleration ends
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	ecm_sfe_ported_ipv6_accelerated_count[npci->ported_accelerated_count_index]--;	/* Protocol specific counter */
+	DEBUG_ASSERT(ecm_sfe_ported_ipv6_accelerated_count[npci->ported_accelerated_count_index] >= 0, "Bad udp accel counter\n");
+	ecm_sfe_ipv6_accelerated_count--;		/* General running counter */
+	DEBUG_ASSERT(ecm_sfe_ipv6_accelerated_count >= 0, "Bad accel counter\n");
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	/*
+	 * Release the connections.
+	 */
+	feci->deref(feci);
+	ecm_db_connection_deref(ci);
+}
+
+/*
+ * ecm_sfe_ported_ipv6_connection_decelerate()
+ *	Decelerate a connection
+ */
+static void ecm_sfe_ported_ipv6_connection_decelerate(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_ported_ipv6_connection_instance *npci = (struct ecm_sfe_ported_ipv6_connection_instance *)feci;
+	struct sfe_ipv6_msg nim;
+	struct sfe_ipv6_rule_destroy_msg *nirdm;
+	ip_addr_t src_ip;
+	ip_addr_t dest_ip;
+	sfe_tx_status_t sfe_tx_status;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+
+	/*
+	 * If decelerate is in error or already pending then ignore
+	 */
+	spin_lock_bh(&feci->lock);
+	if (feci->stats.decelerate_pending) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If acceleration is pending then we cannot decelerate right now or we will race with it
+	 * Set a decelerate pending flag that will be actioned when the acceleration command is complete.
+	 */
+	if (feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING) {
+		feci->stats.decelerate_pending = true;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * Can only decelerate if accelerated
+	 * NOTE: This will also deny accel when the connection is in fail condition too.
+	 */
+	if (feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_ACCEL) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * Initiate deceleration
+	 */
+	feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL_PENDING;
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Increment the decel pending counter
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	ecm_sfe_ipv6_pending_decel_count++;
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	/*
+	 * Prepare deceleration message
+	 */
+	sfe_ipv6_msg_init(&nim, SFE_SPECIAL_INTERFACE_IPV6, SFE_TX_DESTROY_RULE_MSG,
+			sizeof(struct sfe_ipv6_rule_destroy_msg),
+			ecm_sfe_ported_ipv6_connection_destroy_callback,
+			(void *)ecm_db_connection_serial_get(feci->ci));
+
+	nirdm = &nim.msg.rule_destroy;
+	nirdm->tuple.protocol = (int32_t)ecm_db_connection_protocol_get(feci->ci);;
+
+	/*
+	 * Get addressing information
+	 */
+	ecm_db_connection_from_address_get(feci->ci, src_ip);
+	ECM_IP_ADDR_TO_SFE_IPV6_ADDR(nirdm->tuple.flow_ip, src_ip);
+	ecm_db_connection_to_address_get(feci->ci, dest_ip);
+	ECM_IP_ADDR_TO_SFE_IPV6_ADDR(nirdm->tuple.return_ip, dest_ip);
+	nirdm->tuple.flow_ident = htons(ecm_db_connection_from_port_get(feci->ci));
+	nirdm->tuple.return_ident = htons(ecm_db_connection_to_port_get(feci->ci));
+
+	DEBUG_INFO("%p: Ported Connection %p decelerate\n"
+			"protocol: %d\n"
+			"src_ip: " ECM_IP_ADDR_OCTAL_FMT ":%d\n"
+			"dest_ip: " ECM_IP_ADDR_OCTAL_FMT ":%d\n",
+			npci, feci->ci, nirdm->tuple.protocol,
+			ECM_IP_ADDR_TO_OCTAL(src_ip), nirdm->tuple.flow_ident,
+			ECM_IP_ADDR_TO_OCTAL(dest_ip), nirdm->tuple.return_ident);
+
+	/*
+	 * Take a ref to the feci->ci so that it will persist until we get a response from the SFE.
+	 * NOTE: This will implicitly hold the feci too.
+	 */
+	ecm_db_connection_ref(feci->ci);
+
+	/*
+	 * We are about to issue the command, record the time of transmission
+	 */
+	spin_lock_bh(&feci->lock);
+	feci->stats.cmd_time_begun = jiffies;
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Destroy the SFE connection cache entry.
+	 */
+	sfe_tx_status = sfe_drv_ipv6_tx(ecm_sfe_ipv6_drv_mgr, &nim);
+	if (sfe_tx_status == SFE_TX_SUCCESS) {
+		/*
+		 * Reset the driver_fail count - transmission was okay here.
+		 */
+		spin_lock_bh(&feci->lock);
+		feci->stats.driver_fail = 0;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * Release the ref take, SFE driver did not accept our command.
+	 */
+	ecm_db_connection_deref(feci->ci);
+
+	/*
+	 * TX failed
+	 */
+	spin_lock_bh(&feci->lock);
+	feci->stats.driver_fail_total++;
+	feci->stats.driver_fail++;
+	if (feci->stats.driver_fail >= feci->stats.driver_fail_limit) {
+		DEBUG_WARN("%p: Decel failed - driver fail limit\n", npci);
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DRIVER;
+	}
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Could not send the request, decrement the decel pending counter
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	ecm_sfe_ipv6_pending_decel_count--;
+	DEBUG_ASSERT(ecm_sfe_ipv6_pending_decel_count >= 0, "Bad decel pending counter\n");
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+}
+
+/*
+ * ecm_sfe_ported_ipv6_connection_defunct_callback()
+ *	Callback to be called when a ported connection has become defunct.
+ */
+static void ecm_sfe_ported_ipv6_connection_defunct_callback(void *arg)
+{
+	struct ecm_front_end_connection_instance *feci = (struct ecm_front_end_connection_instance *)arg;
+	struct ecm_sfe_ported_ipv6_connection_instance *npci = (struct ecm_sfe_ported_ipv6_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+
+	spin_lock_bh(&feci->lock);
+
+	/*
+	 * If connection has already become defunct, do nothing.
+	 */
+	if (feci->is_defunct) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+	feci->is_defunct = true;
+
+	/*
+	 * If the connection is already in one of the fail modes, do nothing, keep the current accel_mode.
+	 */
+	if (ECM_FRONT_END_ACCELERATION_FAILED(feci->accel_mode)) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If the connection is decel then ensure it will not attempt accel while defunct.
+	 */
+	if (feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_DECEL) {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_DEFUNCT;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If the connection is decel pending then decel operation is in progress anyway.
+	 */
+	if (feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_DECEL_PENDING) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If none of the cases matched above, this means the connection is in one of the
+	 * accel modes (accel or accel_pending) so we force a deceleration.
+	 * NOTE: If the mode is accel pending then the decel will be actioned when that is completed.
+	 */
+	spin_unlock_bh(&feci->lock);
+	ecm_sfe_ported_ipv6_connection_decelerate(feci);
+}
+
+/*
+ * ecm_sfe_ported_ipv6_connection_accel_state_get()
+ *	Get acceleration state
+ */
+static ecm_front_end_acceleration_mode_t ecm_sfe_ported_ipv6_connection_accel_state_get(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_ported_ipv6_connection_instance *npci = (struct ecm_sfe_ported_ipv6_connection_instance *)feci;
+	ecm_front_end_acceleration_mode_t state;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+	spin_lock_bh(&feci->lock);
+	state = feci->accel_mode;
+	spin_unlock_bh(&feci->lock);
+	return state;
+}
+
+/*
+ * ecm_sfe_ported_ipv6_connection_action_seen()
+ *	Acceleration action / activity has been seen for this connection.
+ *
+ * NOTE: Call the action_seen() method when the SFE has demonstrated that it has offloaded some data for a connection.
+ */
+static void ecm_sfe_ported_ipv6_connection_action_seen(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_ported_ipv6_connection_instance *npci = (struct ecm_sfe_ported_ipv6_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+	DEBUG_INFO("%p: Action seen\n", npci);
+	spin_lock_bh(&feci->lock);
+	feci->stats.no_action_seen = 0;
+	spin_unlock_bh(&feci->lock);
+}
+
+/*
+ * ecm_sfe_ported_ipv6_connection_accel_ceased()
+ *	SFE has indicated that acceleration has stopped.
+ *
+ * NOTE: This is called in response to an SFE self-initiated termination of acceleration.
+ * This must NOT be called because the ECM terminated the acceleration.
+ */
+static void ecm_sfe_ported_ipv6_connection_accel_ceased(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_ported_ipv6_connection_instance *npci = (struct ecm_sfe_ported_ipv6_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+	DEBUG_INFO("%p: accel ceased\n", npci);
+
+	spin_lock_bh(&feci->lock);
+
+	/*
+	 * If we are in accel-pending state then the SFE has issued a flush out-of-order
+	 * with the ACK/NACK we are actually waiting for.
+	 * To work around this we record a "flush has already happened" and will action it when we finally get that ACK/NACK.
+	 * GGG TODO This should eventually be removed when the SFE honours messaging sequence.
+	 */
+	if (feci->accel_mode == ECM_FRONT_END_ACCELERATION_MODE_ACCEL_PENDING) {
+		feci->stats.flush_happened = true;
+		feci->stats.flush_happened_total++;
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If connection is no longer accelerated by the time we get here just ignore the command
+	 */
+	if (feci->accel_mode != ECM_FRONT_END_ACCELERATION_MODE_ACCEL) {
+		spin_unlock_bh(&feci->lock);
+		return;
+	}
+
+	/*
+	 * If the no_action_seen counter was not reset then acceleration ended without any offload action
+	 */
+	if (feci->stats.no_action_seen) {
+		feci->stats.no_action_seen_total++;
+	}
+
+	/*
+	 * If the no_action_seen indicates successive cessations of acceleration without any offload action occuring
+	 * then we fail out this connection
+	 */
+	if (feci->stats.no_action_seen >= feci->stats.no_action_seen_limit) {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_FAIL_NO_ACTION;
+	} else {
+		feci->accel_mode = ECM_FRONT_END_ACCELERATION_MODE_DECEL;
+	}
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * Ported acceleration ends
+	 */
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	ecm_sfe_ported_ipv6_accelerated_count[npci->ported_accelerated_count_index]--;	/* Protocol specific counter */
+	DEBUG_ASSERT(ecm_sfe_ported_ipv6_accelerated_count[npci->ported_accelerated_count_index] >= 0, "Bad ported accel counter\n");
+	ecm_sfe_ipv6_accelerated_count--;		/* General running counter */
+	DEBUG_ASSERT(ecm_sfe_ipv6_accelerated_count >= 0, "Bad accel counter\n");
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+}
+
+/*
+ * ecm_sfe_ported_ipv6_connection_ref()
+ *	Ref a connection front end instance
+ */
+static void ecm_sfe_ported_ipv6_connection_ref(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_ported_ipv6_connection_instance *npci = (struct ecm_sfe_ported_ipv6_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+	spin_lock_bh(&feci->lock);
+	feci->refs++;
+	DEBUG_TRACE("%p: npci ref %d\n", npci, feci->refs);
+	DEBUG_ASSERT(feci->refs > 0, "%p: ref wrap\n", npci);
+	spin_unlock_bh(&feci->lock);
+}
+
+/*
+ * ecm_sfe_ported_ipv6_connection_deref()
+ *	Deref a connection front end instance
+ */
+static int ecm_sfe_ported_ipv6_connection_deref(struct ecm_front_end_connection_instance *feci)
+{
+	struct ecm_sfe_ported_ipv6_connection_instance *npci = (struct ecm_sfe_ported_ipv6_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+
+	spin_lock_bh(&feci->lock);
+	feci->refs--;
+	DEBUG_ASSERT(feci->refs >= 0, "%p: ref wrap\n", npci);
+
+	if (feci->refs > 0) {
+		int refs = feci->refs;
+		spin_unlock_bh(&feci->lock);
+		DEBUG_TRACE("%p: npci deref %d\n", npci, refs);
+		return refs;
+	}
+	spin_unlock_bh(&feci->lock);
+
+	/*
+	 * We can now destroy the instance
+	 */
+	DEBUG_TRACE("%p: npci final\n", npci);
+	DEBUG_CLEAR_MAGIC(npci);
+	kfree(npci);
+
+	return 0;
+}
+
+#ifdef ECM_STATE_OUTPUT_ENABLE
+/*
+ * ecm_sfe_ported_ipv6_connection_state_get()
+ *	Return the state of this ported front end instance
+ */
+static int ecm_sfe_ported_ipv6_connection_state_get(struct ecm_front_end_connection_instance *feci, struct ecm_state_file_instance *sfi)
+{
+	int result;
+	bool can_accel;
+	ecm_front_end_acceleration_mode_t accel_mode;
+	struct ecm_front_end_connection_mode_stats stats;
+	struct ecm_sfe_ported_ipv6_connection_instance *npci = (struct ecm_sfe_ported_ipv6_connection_instance *)feci;
+
+	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%p: magic failed", npci);
+
+	spin_lock_bh(&feci->lock);
+	can_accel = feci->can_accel;
+	accel_mode = feci->accel_mode;
+	memcpy(&stats, &feci->stats, sizeof(struct ecm_front_end_connection_mode_stats));
+	spin_unlock_bh(&feci->lock);
+
+	if ((result = ecm_state_prefix_add(sfi, "front_end_v6.ported"))) {
+		return result;
+	}
+
+	if ((result = ecm_state_write(sfi, "can_accel", "%d", can_accel))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "accel_mode", "%d", accel_mode))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "decelerate_pending", "%d", stats.decelerate_pending))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "flush_happened_total", "%d", stats.flush_happened_total))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "no_action_seen_total", "%d", stats.no_action_seen_total))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "no_action_seen", "%d", stats.no_action_seen))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "no_action_seen_limit", "%d", stats.no_action_seen_limit))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "driver_fail_total", "%d", stats.driver_fail_total))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "driver_fail", "%d", stats.driver_fail))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "driver_fail_limit", "%d", stats.driver_fail_limit))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "ae_nack_total", "%d", stats.ae_nack_total))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "ae_nack", "%d", stats.ae_nack))) {
+		return result;
+	}
+	if ((result = ecm_state_write(sfi, "ae_nack_limit", "%d", stats.ae_nack_limit))) {
+		return result;
+	}
+
+ 	return ecm_state_prefix_remove(sfi);
+}
+#endif
+
+/*
+ * ecm_sfe_ported_ipv6_connection_instance_alloc()
+ *	Create a front end instance specific for ported connection
+ */
+static struct ecm_sfe_ported_ipv6_connection_instance *ecm_sfe_ported_ipv6_connection_instance_alloc(
+								struct ecm_db_connection_instance *ci,
+								int protocol,
+								bool can_accel)
+{
+	struct ecm_sfe_ported_ipv6_connection_instance *npci;
+	struct ecm_front_end_connection_instance *feci;
+
+	npci = (struct ecm_sfe_ported_ipv6_connection_instance *)kzalloc(sizeof(struct ecm_sfe_ported_ipv6_connection_instance), GFP_ATOMIC | __GFP_NOWARN);
+	if (!npci) {
+		DEBUG_WARN("Ported Front end alloc failed\n");
+		return NULL;
+	}
+
+	/*
+	 * Refs is 1 for the creator of the connection
+	 */
+	feci = (struct ecm_front_end_connection_instance *)npci;
+	feci->refs = 1;
+	DEBUG_SET_MAGIC(npci, ECM_SFE_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC);
+	spin_lock_init(&feci->lock);
+
+	feci->can_accel = can_accel;
+	feci->accel_mode = (can_accel) ? ECM_FRONT_END_ACCELERATION_MODE_DECEL : ECM_FRONT_END_ACCELERATION_MODE_FAIL_DENIED;
+	spin_lock_bh(&ecm_sfe_ipv6_lock);
+	feci->stats.no_action_seen_limit = ecm_sfe_ipv6_no_action_limit_default;
+	feci->stats.driver_fail_limit = ecm_sfe_ipv6_driver_fail_limit_default;
+	feci->stats.ae_nack_limit = ecm_sfe_ipv6_nack_limit_default;
+	spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+	/*
+	 * Copy reference to connection - no need to ref ci as ci maintains a ref to this instance instead (this instance persists for as long as ci does)
+	 */
+	feci->ci = ci;
+
+	/*
+	 * Populate the methods and callbacks
+	 */
+	feci->ref = ecm_sfe_ported_ipv6_connection_ref;
+	feci->deref = ecm_sfe_ported_ipv6_connection_deref;
+	feci->decelerate = ecm_sfe_ported_ipv6_connection_decelerate;
+	feci->accel_state_get = ecm_sfe_ported_ipv6_connection_accel_state_get;
+	feci->action_seen = ecm_sfe_ported_ipv6_connection_action_seen;
+	feci->accel_ceased = ecm_sfe_ported_ipv6_connection_accel_ceased;
+#ifdef ECM_STATE_OUTPUT_ENABLE
+	feci->state_get = ecm_sfe_ported_ipv6_connection_state_get;
+#endif
+	feci->ae_interface_number_by_dev_get = ecm_sfe_common_get_interface_number_by_dev;
+
+	if (protocol == IPPROTO_TCP) {
+		npci->ported_accelerated_count_index = ECM_SFE_PORTED_IPV6_PROTO_TCP;
+	} else if (protocol == IPPROTO_UDP) {
+		npci->ported_accelerated_count_index = ECM_SFE_PORTED_IPV6_PROTO_UDP;
+	} else {
+		DEBUG_WARN("%p: Wrong protocol: %d\n", npci, protocol);
+		DEBUG_CLEAR_MAGIC(npci);
+		kfree(npci);
+		return NULL;
+	}
+
+	return npci;
+}
+
+/*
+ * ecm_sfe_ported_ipv6_process()
+ *	Process a ported packet
+ */
+unsigned int ecm_sfe_ported_ipv6_process(struct net_device *out_dev,
+							struct net_device *in_dev,
+							uint8_t *src_node_addr,
+							uint8_t *dest_node_addr,
+							bool can_accel,  bool is_routed, bool is_l2_encap, struct sk_buff *skb,
+							struct ecm_tracker_ip_header *iph,
+							struct nf_conn *ct, ecm_tracker_sender_type_t sender, ecm_db_direction_t ecm_dir,
+							struct nf_conntrack_tuple *orig_tuple, struct nf_conntrack_tuple *reply_tuple,
+							ip_addr_t ip_src_addr, ip_addr_t ip_dest_addr)
+{
+	struct tcphdr *tcp_hdr;
+	struct tcphdr tcp_hdr_buff;
+	struct udphdr *udp_hdr;
+	struct udphdr udp_hdr_buff;
+	int src_port;
+	int dest_port;
+	struct ecm_db_connection_instance *ci;
+	ip_addr_t match_addr;
+	struct ecm_classifier_instance *assignments[ECM_CLASSIFIER_TYPES];
+	int aci_index;
+	int assignment_count;
+	ecm_db_timer_group_t ci_orig_timer_group;
+	struct ecm_classifier_process_response prevalent_pr;
+	int protocol = (int)orig_tuple->dst.protonum;
+
+	if (protocol == IPPROTO_TCP) {
+		/*
+		 * Extract TCP header to obtain port information
+		 */
+		tcp_hdr = ecm_tracker_tcp_check_header_and_read(skb, iph, &tcp_hdr_buff);
+		if (unlikely(!tcp_hdr)) {
+			DEBUG_WARN("TCP packet header %p\n", skb);
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Now extract information, if we have conntrack then use that (which would already be in the tuples)
+		 */
+		if (unlikely(!ct)) {
+			orig_tuple->src.u.tcp.port = tcp_hdr->source;
+			orig_tuple->dst.u.tcp.port = tcp_hdr->dest;
+			reply_tuple->src.u.tcp.port = tcp_hdr->dest;
+			reply_tuple->dst.u.tcp.port = tcp_hdr->source;
+		}
+
+		/*
+		 * Extract transport port information
+		 * Refer to the ecm_sfe_ipv6_process() for information on how we extract this information.
+		 */
+		if (sender == ECM_TRACKER_SENDER_TYPE_SRC) {
+			switch(ecm_dir) {
+			case ECM_DB_DIRECTION_NON_NAT:
+			case ECM_DB_DIRECTION_BRIDGED:
+				src_port = ntohs(orig_tuple->src.u.tcp.port);
+				dest_port = ntohs(orig_tuple->dst.u.tcp.port);
+				break;
+			default:
+				DEBUG_ASSERT(false, "Unhandled ecm_dir: %d\n", ecm_dir);
+			}
+		} else {
+			switch(ecm_dir) {
+			case ECM_DB_DIRECTION_NON_NAT:
+			case ECM_DB_DIRECTION_BRIDGED:
+				dest_port = ntohs(orig_tuple->src.u.tcp.port);
+				src_port = ntohs(orig_tuple->dst.u.tcp.port);
+				break;
+			default:
+				DEBUG_ASSERT(false, "Unhandled ecm_dir: %d\n", ecm_dir);
+			}
+		}
+
+		DEBUG_TRACE("TCP src: " ECM_IP_ADDR_OCTAL_FMT ":%d, dest: " ECM_IP_ADDR_OCTAL_FMT ":%d, dir %d\n",
+				ECM_IP_ADDR_TO_OCTAL(ip_src_addr), src_port, ECM_IP_ADDR_TO_OCTAL(ip_dest_addr), dest_port, ecm_dir);
+	} else if (protocol == IPPROTO_UDP) {
+		/*
+		 * Extract UDP header to obtain port information
+		 */
+		udp_hdr = ecm_tracker_udp_check_header_and_read(skb, iph, &udp_hdr_buff);
+		if (unlikely(!udp_hdr)) {
+			DEBUG_WARN("Invalid UDP header in skb %p\n", skb);
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Deny acceleration for L2TP-over-UDP tunnel
+		 */
+		if (skb->sk) {
+			if(skb->sk->sk_protocol == IPPROTO_UDP) {
+				struct udp_sock *usk = udp_sk(skb->sk);
+				if (usk) {
+					if (unlikely(usk->encap_type == UDP_ENCAP_L2TPINUDP)) {
+						DEBUG_TRACE("Skip packets for L2TP tunnel in skb %p\n", skb);
+						can_accel = false;
+					}
+				}
+			}
+		}
+
+		/*
+		 * Now extract information, if we have conntrack then use that (which would already be in the tuples)
+		 */
+		if (unlikely(!ct)) {
+			orig_tuple->src.u.udp.port = udp_hdr->source;
+			orig_tuple->dst.u.udp.port = udp_hdr->dest;
+			reply_tuple->src.u.udp.port = udp_hdr->dest;
+			reply_tuple->dst.u.udp.port = udp_hdr->source;
+		}
+
+		/*
+		 * Extract transport port information
+		 * Refer to the ecm_sfe_ipv6_process() for information on how we extract this information.
+		 */
+		if (sender == ECM_TRACKER_SENDER_TYPE_SRC) {
+			switch(ecm_dir) {
+			case ECM_DB_DIRECTION_NON_NAT:
+			case ECM_DB_DIRECTION_BRIDGED:
+				src_port = ntohs(orig_tuple->src.u.udp.port);
+				dest_port = ntohs(orig_tuple->dst.u.udp.port);
+				break;
+			default:
+				DEBUG_ASSERT(false, "Unhandled ecm_dir: %d\n", ecm_dir);
+			}
+		} else {
+			switch(ecm_dir) {
+			case ECM_DB_DIRECTION_NON_NAT:
+			case ECM_DB_DIRECTION_BRIDGED:
+				dest_port = ntohs(orig_tuple->src.u.udp.port);
+				src_port = ntohs(orig_tuple->dst.u.udp.port);
+				break;
+			default:
+				DEBUG_ASSERT(false, "Unhandled ecm_dir: %d\n", ecm_dir);
+			}
+		}
+		DEBUG_TRACE("UDP src: " ECM_IP_ADDR_OCTAL_FMT ":%d, dest: " ECM_IP_ADDR_OCTAL_FMT ":%d, dir %d\n",
+				ECM_IP_ADDR_TO_OCTAL(ip_src_addr), src_port, ECM_IP_ADDR_TO_OCTAL(ip_dest_addr), dest_port, ecm_dir);
+	} else {
+		DEBUG_WARN("Wrong protocol: %d\n", protocol);
+		return NF_ACCEPT;
+	}
+
+	/*
+	 * Look up a connection
+	 */
+	ci = ecm_db_connection_find_and_ref(ip_src_addr, ip_dest_addr, protocol, src_port, dest_port);
+
+	/*
+	 * If there is no existing connection then create a new one.
+	 */
+	if (unlikely(!ci)) {
+		struct ecm_db_mapping_instance *src_mi;
+		struct ecm_db_mapping_instance *dest_mi;
+		struct ecm_db_node_instance *src_ni;
+		struct ecm_db_node_instance *dest_ni;
+		struct ecm_classifier_default_instance *dci;
+		struct ecm_db_connection_instance *nci;
+		ecm_classifier_type_t classifier_type;
+		struct ecm_front_end_connection_instance *feci;
+		int32_t to_list_first;
+		struct ecm_db_iface_instance *to_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+		int32_t from_list_first;
+		struct ecm_db_iface_instance *from_list[ECM_DB_IFACE_HEIRARCHY_MAX];
+
+		DEBUG_INFO("New Ported connection from " ECM_IP_ADDR_OCTAL_FMT ":%u to " ECM_IP_ADDR_OCTAL_FMT ":%u\n",
+				ECM_IP_ADDR_TO_OCTAL(ip_src_addr), src_port, ECM_IP_ADDR_TO_OCTAL(ip_dest_addr), dest_port);
+
+		/*
+		 * Before we attempt to create the connection are we being terminated?
+		 */
+		spin_lock_bh(&ecm_sfe_ipv6_lock);
+		if (ecm_sfe_ipv6_terminate_pending) {
+			spin_unlock_bh(&ecm_sfe_ipv6_lock);
+			DEBUG_WARN("Terminating\n");
+
+			/*
+			 * As we are terminating we just allow the packet to pass - it's no longer our concern
+			 */
+			return NF_ACCEPT;
+		}
+		spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+		/*
+		 * Does this connection have a conntrack entry?
+		 */
+		if (ct) {
+			unsigned int conn_count;
+
+			/*
+			 * If we have exceeded the connection limit (according to conntrack) then abort
+			 * NOTE: Conntrack, when at its limit, will destroy a connection to make way for a new.
+			 * Conntrack won't exceed its limit but ECM can due to it needing to hold connections while
+			 * acceleration commands are in-flight.
+			 * This means that ECM can 'fall behind' somewhat with the connection state wrt conntrack connection state.
+			 * This is not seen as an issue since conntrack will have issued us with a destroy event for the flushed connection(s)
+			 * and we will eventually catch up.
+			 * Since ECM is capable of handling connections mid-flow ECM will pick up where it can.
+			 */
+			conn_count = (unsigned int)ecm_db_connection_count_get();
+			if (conn_count >= nf_conntrack_max) {
+				DEBUG_WARN("ECM Connection count limit reached: db: %u, ct: %u\n", conn_count, nf_conntrack_max);
+				return NF_ACCEPT;
+			}
+
+			if (protocol == IPPROTO_TCP) {
+				/*
+				 * No point in establishing a connection for one that is closing
+				 */
+				spin_lock_bh(&ct->lock);
+				if (ct->proto.tcp.state >= TCP_CONNTRACK_FIN_WAIT && ct->proto.tcp.state <= TCP_CONNTRACK_CLOSE) {
+					spin_unlock_bh(&ct->lock);
+					DEBUG_TRACE("%p: Connection in termination state %#X\n", ct, ct->proto.tcp.state);
+					return NF_ACCEPT;
+				}
+				spin_unlock_bh(&ct->lock);
+			}
+		}
+
+		/*
+		 * Now allocate the new connection
+		 */
+		nci = ecm_db_connection_alloc();
+		if (!nci) {
+			DEBUG_WARN("Failed to allocate connection\n");
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Connection must have a front end instance associated with it
+		 */
+		feci = (struct ecm_front_end_connection_instance *)ecm_sfe_ported_ipv6_connection_instance_alloc(nci, protocol, can_accel);
+		if (!feci) {
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to allocate front end\n");
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Get the src and destination mappings
+		 * For this we also need the interface lists which we also set upon the new connection while we are at it.
+		 * GGG TODO rework terms of "src/dest" - these need to be named consistently as from/to as per database terms.
+		 * GGG TODO The empty list checks should not be needed, mapping_establish_and_ref() should fail out if there is no list anyway.
+		 */
+		DEBUG_TRACE("%p: Create the 'from' interface heirarchy list\n", nci);
+		from_list_first = ecm_interface_heirarchy_construct(feci, from_list, ip_dest_addr, ip_src_addr, 6, protocol, in_dev, is_routed, in_dev, src_node_addr, dest_node_addr);
+		if (from_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to obtain 'from' heirarchy list\n");
+			return NF_ACCEPT;
+		}
+		ecm_db_connection_from_interfaces_reset(nci, from_list, from_list_first);
+
+		DEBUG_TRACE("%p: Create source node\n", nci);
+		src_ni = ecm_sfe_ipv6_node_establish_and_ref(feci, in_dev, ip_src_addr, from_list, from_list_first, src_node_addr);
+		ecm_db_connection_interfaces_deref(from_list, from_list_first);
+		if (!src_ni) {
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish source node\n");
+			return NF_ACCEPT;
+		}
+
+		DEBUG_TRACE("%p: Create source mapping\n", nci);
+		src_mi = ecm_sfe_ipv6_mapping_establish_and_ref(ip_src_addr, src_port);
+		if (!src_mi) {
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish src mapping\n");
+			return NF_ACCEPT;
+		}
+
+		DEBUG_TRACE("%p: Create the 'to' interface heirarchy list\n", nci);
+		to_list_first = ecm_interface_heirarchy_construct(feci, to_list, ip_src_addr, ip_dest_addr, 6, protocol, out_dev, is_routed, in_dev, dest_node_addr, src_node_addr);
+		if (to_list_first == ECM_DB_IFACE_HEIRARCHY_MAX) {
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to obtain 'to' heirarchy list\n");
+			return NF_ACCEPT;
+		}
+		ecm_db_connection_to_interfaces_reset(nci, to_list, to_list_first);
+
+		DEBUG_TRACE("%p: Create dest node\n", nci);
+		dest_ni = ecm_sfe_ipv6_node_establish_and_ref(feci, out_dev, ip_dest_addr, to_list, to_list_first, dest_node_addr);
+		ecm_db_connection_interfaces_deref(to_list, to_list_first);
+		if (!dest_ni) {
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish dest node\n");
+			return NF_ACCEPT;
+		}
+
+		DEBUG_TRACE("%p: Create dest mapping\n", nci);
+		dest_mi = ecm_sfe_ipv6_mapping_establish_and_ref(ip_dest_addr, dest_port);
+		if (!dest_mi) {
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to establish dest mapping\n");
+			return NF_ACCEPT;
+		}
+
+		/*
+		 * Every connection also needs a default classifier which is considered 'special'
+		 */
+		dci = ecm_classifier_default_instance_alloc(nci, protocol, ecm_dir, src_port, dest_port);
+		if (!dci) {
+			ecm_db_mapping_deref(dest_mi);
+			ecm_db_node_deref(dest_ni);
+			ecm_db_mapping_deref(src_mi);
+			ecm_db_node_deref(src_ni);
+			feci->deref(feci);
+			ecm_db_connection_deref(nci);
+			DEBUG_WARN("Failed to allocate default classifier\n");
+			return NF_ACCEPT;
+		}
+		ecm_db_connection_classifier_assign(nci, (struct ecm_classifier_instance *)dci);
+
+		/*
+		 * Every connection starts with a full complement of classifiers assigned.
+		 * NOTE: Default classifier is a special case considered previously
+		 */
+		for (classifier_type = ECM_CLASSIFIER_TYPE_DEFAULT + 1; classifier_type < ECM_CLASSIFIER_TYPES; ++classifier_type) {
+			struct ecm_classifier_instance *aci = ecm_sfe_ipv6_assign_classifier(nci, classifier_type);
+			if (aci) {
+				aci->deref(aci);
+			} else {
+				dci->base.deref((struct ecm_classifier_instance *)dci);
+				feci->deref(feci);
+				ecm_db_mapping_deref(dest_mi);
+				ecm_db_node_deref(dest_ni);
+				ecm_db_mapping_deref(src_mi);
+				ecm_db_node_deref(src_ni);
+				feci->deref(feci);
+				ecm_db_connection_deref(nci);
+				DEBUG_WARN("Failed to allocate classifiers assignments\n");
+				return NF_ACCEPT;
+			}
+		}
+
+		/*
+		 * Now add the connection into the database.
+		 * NOTE: In an SMP situation such as ours there is a possibility that more than one packet for the same
+		 * connection is being processed simultaneously.
+		 * We *could* end up creating more than one connection instance for the same actual connection.
+		 * To guard against this we now perform a mutex'd lookup of the connection + add once more - another cpu may have created it before us.
+		 */
+		spin_lock_bh(&ecm_sfe_ipv6_lock);
+		ci = ecm_db_connection_find_and_ref(ip_src_addr, ip_dest_addr, protocol, src_port, dest_port);
+		if (ci) {
+			/*
+			 * Another cpu created the same connection before us - use the one we just found
+			 */
+			spin_unlock_bh(&ecm_sfe_ipv6_lock);
+			ecm_db_connection_deref(nci);
+		} else {
+			ecm_db_timer_group_t tg;
+			ecm_tracker_sender_state_t src_state;
+			ecm_tracker_sender_state_t dest_state;
+			ecm_tracker_connection_state_t state;
+			struct ecm_tracker_instance *ti;
+
+			/*
+			 * Ask tracker for timer group to set the connection to initially.
+			 */
+			ti = dci->tracker_get_and_ref(dci);
+			ti->state_get(ti, &src_state, &dest_state, &state, &tg);
+			ti->deref(ti);
+
+			/*
+			 * Add the new connection we created into the database
+			 * NOTE: assign to a short timer group for now - it is the assigned classifiers responsibility to do this
+			 */
+			ecm_db_connection_add(nci, feci, src_mi, dest_mi, src_mi, dest_mi,
+					src_ni, dest_ni, src_ni, dest_ni,
+					6, protocol, ecm_dir,
+					NULL /* final callback */,
+					ecm_sfe_ported_ipv6_connection_defunct_callback,
+					tg, is_routed, nci);
+
+			spin_unlock_bh(&ecm_sfe_ipv6_lock);
+
+			ci = nci;
+			DEBUG_INFO("%p: New ported connection created\n", ci);
+		}
+
+		/*
+		 * No longer need referenecs to the objects we created
+		 */
+		dci->base.deref((struct ecm_classifier_instance *)dci);
+		ecm_db_mapping_deref(dest_mi);
+		ecm_db_node_deref(dest_ni);
+		ecm_db_mapping_deref(src_mi);
+		ecm_db_node_deref(src_ni);
+		feci->deref(feci);
+	}
+
+	/*
+	 * Keep connection alive as we have seen activity
+	 */
+	if (!ecm_db_connection_defunct_timer_touch(ci)) {
+		ecm_db_connection_deref(ci);
+		return NF_ACCEPT;
+	}
+
+	/*
+	 * Identify which side of the connection is sending
+	 * NOTE: This may be different than what sender is at the moment
+	 * given the connection we have located.
+	 */
+	ecm_db_connection_from_address_get(ci, match_addr);
+	if (ECM_IP_ADDR_MATCH(ip_src_addr, match_addr)) {
+		sender = ECM_TRACKER_SENDER_TYPE_SRC;
+	} else {
+		sender = ECM_TRACKER_SENDER_TYPE_DEST;
+	}
+
+	/*
+	 * Do we need to action generation change?
+	 */
+	if (unlikely(ecm_db_connection_regeneration_required_check(ci))) {
+		ecm_sfe_ipv6_connection_regenerate(ci, sender, out_dev, in_dev);
+	}
+
+	/*
+	 * Iterate the assignments and call to process!
+	 * Policy implemented:
+	 * 1. Classifiers that say they are not relevant are unassigned and not actioned further.
+	 * 2. Any drop command from any classifier is honoured.
+	 * 3. All classifiers must action acceleration for accel to be honoured, any classifiers not sure of their relevance will stop acceleration.
+	 * 4. Only the highest priority classifier, that actions it, will have its qos tag honoured.
+	 * 5. Only the highest priority classifier, that actions it, will have its timer group honoured.
+	 */
+	DEBUG_TRACE("%p: process begin, skb: %p\n", ci, skb);
+	prevalent_pr.process_actions = 0;
+	prevalent_pr.drop = false;
+	prevalent_pr.flow_qos_tag = skb->priority;
+	prevalent_pr.return_qos_tag = skb->priority;
+	prevalent_pr.accel_mode = ECM_CLASSIFIER_ACCELERATION_MODE_ACCEL;
+	prevalent_pr.timer_group = ci_orig_timer_group = ecm_db_connection_timer_group_get(ci);
+
+	assignment_count = ecm_db_connection_classifier_assignments_get_and_ref(ci, assignments);
+	for (aci_index = 0; aci_index < assignment_count; ++aci_index) {
+		struct ecm_classifier_process_response aci_pr;
+		struct ecm_classifier_instance *aci;
+
+		aci = assignments[aci_index];
+		DEBUG_TRACE("%p: process: %p, type: %d\n", ci, aci, aci->type_get(aci));
+		aci->process(aci, sender, iph, skb, &aci_pr);
+		DEBUG_TRACE("%p: aci_pr: process actions: %x, became relevant: %u, relevance: %d, drop: %d, "
+				"flow_qos_tag: %u, return_qos_tag: %u, accel_mode: %x, timer_group: %d\n",
+				ci, aci_pr.process_actions, aci_pr.became_relevant, aci_pr.relevance, aci_pr.drop,
+				aci_pr.flow_qos_tag, aci_pr.return_qos_tag, aci_pr.accel_mode, aci_pr.timer_group);
+
+		if (aci_pr.relevance == ECM_CLASSIFIER_RELEVANCE_NO) {
+			ecm_classifier_type_t aci_type;
+
+			/*
+			 * This classifier can be unassigned - PROVIDED it is not the default classifier
+			 */
+			aci_type = aci->type_get(aci);
+			if (aci_type == ECM_CLASSIFIER_TYPE_DEFAULT) {
+				continue;
+			}
+
+			DEBUG_INFO("%p: Classifier not relevant, unassign: %d", ci, aci_type);
+			ecm_db_connection_classifier_unassign(ci, aci);
+			continue;
+		}
+
+		/*
+		 * Yes or Maybe relevant.
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DROP) {
+			/*
+			 * Drop command from any classifier is actioned.
+			 */
+			DEBUG_TRACE("%p: wants drop: %p, type: %d, skb: %p\n", ci, aci, aci->type_get(aci), skb);
+			prevalent_pr.drop |= aci_pr.drop;
+		}
+
+		/*
+		 * Accel mode permission
+		 */
+		if (aci_pr.relevance == ECM_CLASSIFIER_RELEVANCE_MAYBE) {
+			/*
+			 * Classifier not sure of its relevance - cannot accel yet
+			 */
+			DEBUG_TRACE("%p: accel denied by maybe: %p, type: %d\n", ci, aci, aci->type_get(aci));
+			prevalent_pr.accel_mode = ECM_CLASSIFIER_ACCELERATION_MODE_NO;
+		} else {
+			if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_ACCEL_MODE) {
+				if (aci_pr.accel_mode == ECM_CLASSIFIER_ACCELERATION_MODE_NO) {
+					DEBUG_TRACE("%p: accel denied: %p, type: %d\n", ci, aci, aci->type_get(aci));
+					prevalent_pr.accel_mode = ECM_CLASSIFIER_ACCELERATION_MODE_NO;
+				}
+				/* else yes or don't care about accel */
+			}
+		}
+
+		/*
+		 * Timer group (the last classifier i.e. the highest priority one) will 'win'
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_TIMER_GROUP) {
+			DEBUG_TRACE("%p: timer group: %p, type: %d, group: %d\n", ci, aci, aci->type_get(aci), aci_pr.timer_group);
+			prevalent_pr.timer_group = aci_pr.timer_group;
+		}
+
+		/*
+		 * Qos tag (the last classifier i.e. the highest priority one) will 'win'
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_QOS_TAG) {
+			DEBUG_TRACE("%p: aci: %p, type: %d, flow qos tag: %u, return qos tag: %u\n",
+					ci, aci, aci->type_get(aci), aci_pr.flow_qos_tag, aci_pr.return_qos_tag);
+			prevalent_pr.flow_qos_tag = aci_pr.flow_qos_tag;
+			prevalent_pr.return_qos_tag = aci_pr.return_qos_tag;
+		}
+
+#ifdef ECM_CLASSIFIER_DSCP_ENABLE
+		/*
+		 * If any classifier denied DSCP remarking then that overrides every classifier
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DSCP_DENY) {
+			DEBUG_TRACE("%p: aci: %p, type: %d, DSCP remark denied\n",
+					ci, aci, aci->type_get(aci));
+			prevalent_pr.process_actions |= ECM_CLASSIFIER_PROCESS_ACTION_DSCP_DENY;
+			prevalent_pr.process_actions &= ~ECM_CLASSIFIER_PROCESS_ACTION_DSCP;
+		}
+
+		/*
+		 * DSCP remark action, but only if it has not been denied by any classifier
+		 */
+		if (aci_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DSCP) {
+			if (!(prevalent_pr.process_actions & ECM_CLASSIFIER_PROCESS_ACTION_DSCP_DENY)) {
+				DEBUG_TRACE("%p: aci: %p, type: %d, DSCP remark wanted, flow_dscp: %u, return dscp: %u\n",
+						ci, aci, aci->type_get(aci), aci_pr.flow_dscp, aci_pr.return_dscp);
+				prevalent_pr.process_actions |= ECM_CLASSIFIER_PROCESS_ACTION_DSCP;
+				prevalent_pr.flow_dscp = aci_pr.flow_dscp;
+				prevalent_pr.return_dscp = aci_pr.return_dscp;
+			}
+		}
+#endif
+	}
+	ecm_db_connection_assignments_release(assignment_count, assignments);
+
+	/*
+	 * Change timer group?
+	 */
+	if (ci_orig_timer_group != prevalent_pr.timer_group) {
+		DEBUG_TRACE("%p: change timer group from: %d to: %d\n", ci, ci_orig_timer_group, prevalent_pr.timer_group);
+		ecm_db_connection_defunct_timer_reset(ci, prevalent_pr.timer_group);
+	}
+
+	/*
+	 * Drop?
+	 */
+	if (prevalent_pr.drop) {
+		DEBUG_TRACE("%p: drop: %p\n", ci, skb);
+		ecm_db_connection_data_totals_update_dropped(ci, (sender == ECM_TRACKER_SENDER_TYPE_SRC)? true : false, skb->len, 1);
+		ecm_db_connection_deref(ci);
+		return NF_ACCEPT;
+	}
+	ecm_db_connection_data_totals_update(ci, (sender == ECM_TRACKER_SENDER_TYPE_SRC)? true : false, skb->len, 1);
+
+	/*
+	 * Assign qos tag
+	 * GGG TODO Should we use sender to identify whether to use flow or return qos tag?
+	 */
+	skb->priority = prevalent_pr.flow_qos_tag;
+	DEBUG_TRACE("%p: skb priority: %u\n", ci, skb->priority);
+
+	/*
+	 * Accelerate?
+	 */
+	if (prevalent_pr.accel_mode == ECM_CLASSIFIER_ACCELERATION_MODE_ACCEL) {
+		struct ecm_front_end_connection_instance *feci;
+		DEBUG_TRACE("%p: accel\n", ci);
+		feci = ecm_db_connection_front_end_get_and_ref(ci);
+		ecm_sfe_ported_ipv6_connection_accelerate(feci, &prevalent_pr, ct, is_l2_encap);
+		feci->deref(feci);
+	}
+	ecm_db_connection_deref(ci);
+
+	return NF_ACCEPT;
+}
+
+/*
+ * ecm_sfe_ported_ipv6_debugfs_init()
+ */
+bool ecm_sfe_ported_ipv6_debugfs_init(struct dentry *dentry)
+{
+	struct dentry *udp_dentry;
+
+	udp_dentry = debugfs_create_u32("udp_accelerated_count", S_IRUGO, dentry,
+						&ecm_sfe_ported_ipv6_accelerated_count[ECM_SFE_PORTED_IPV6_PROTO_UDP]);
+	if (!udp_dentry) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv6 udp_accelerated_count file in debugfs\n");
+		return false;
+	}
+
+	if (!debugfs_create_u32("tcp_accelerated_count", S_IRUGO, dentry,
+					&ecm_sfe_ported_ipv6_accelerated_count[ECM_SFE_PORTED_IPV6_PROTO_TCP])) {
+		DEBUG_ERROR("Failed to create ecm sfe ipv6 tcp_accelerated_count file in debugfs\n");
+		debugfs_remove(udp_dentry);
+		return false;
+	}
+
+	return true;
+}
+
diff --git a/frontends/sfe/ecm_sfe_ported_ipv6.h b/frontends/sfe/ecm_sfe_ported_ipv6.h
new file mode 100644
index 0000000..f79d9ea
--- /dev/null
+++ b/frontends/sfe/ecm_sfe_ported_ipv6.h
@@ -0,0 +1,27 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2015, The Linux Foundation.  All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+extern unsigned int ecm_sfe_ported_ipv6_process(struct net_device *out_dev,
+							struct net_device *in_dev,
+							uint8_t *src_node_addr,
+							uint8_t *dest_node_addr,
+							bool can_accel, bool is_routed, bool is_l2_encap, struct sk_buff *skb,
+							struct ecm_tracker_ip_header *iph,
+							struct nf_conn *ct, ecm_tracker_sender_type_t sender, ecm_db_direction_t ecm_dir,
+							struct nf_conntrack_tuple *orig_tuple, struct nf_conntrack_tuple *reply_tuple,
+							ip_addr_t ip_src_addr, ip_addr_t ip_dest_addr);
+extern bool ecm_sfe_ported_ipv6_debugfs_init(struct dentry *dentry);
+