[MPTCP_PM_ATTR_SUBFLOWS]        = { .type       = NLA_U32,      },
        [MPTCP_PM_ATTR_TOKEN]           = { .type       = NLA_U32,      },
        [MPTCP_PM_ATTR_LOC_ID]          = { .type       = NLA_U8,       },
+       [MPTCP_PM_ATTR_ADDR_REMOTE]     =
+                                       NLA_POLICY_NESTED(mptcp_pm_addr_policy),
 };
 
 void mptcp_pm_nl_subflow_chk_stale(const struct mptcp_sock *msk, struct sock *ssk)
        return err;
 }
 
+int mptcp_pm_parse_addr(struct nlattr *attr, struct genl_info *info,
+                       struct mptcp_addr_info *addr)
+{
+       struct nlattr *tb[MPTCP_PM_ADDR_ATTR_MAX + 1];
+
+       memset(addr, 0, sizeof(*addr));
+
+       return mptcp_pm_parse_pm_addr_attr(tb, attr, info, addr, true);
+}
+
 int mptcp_pm_parse_entry(struct nlattr *attr, struct genl_info *info,
                         bool require_family,
                         struct mptcp_pm_addr_entry *entry)
                .doit   = mptcp_nl_cmd_remove,
                .flags  = GENL_ADMIN_PERM,
        },
+       {
+               .cmd    = MPTCP_PM_CMD_SUBFLOW_CREATE,
+               .doit   = mptcp_nl_cmd_sf_create,
+               .flags  = GENL_ADMIN_PERM,
+       },
+       {
+               .cmd    = MPTCP_PM_CMD_SUBFLOW_DESTROY,
+               .doit   = mptcp_nl_cmd_sf_destroy,
+               .flags  = GENL_ADMIN_PERM,
+       },
 };
 
 static struct genl_family mptcp_genl_family __ro_after_init = {
 
        sock_put((struct sock *)msk);
        return err;
 }
+
+int mptcp_nl_cmd_sf_create(struct sk_buff *skb, struct genl_info *info)
+{
+       struct nlattr *raddr = info->attrs[MPTCP_PM_ATTR_ADDR_REMOTE];
+       struct nlattr *token = info->attrs[MPTCP_PM_ATTR_TOKEN];
+       struct nlattr *laddr = info->attrs[MPTCP_PM_ATTR_ADDR];
+       struct mptcp_addr_info addr_r;
+       struct mptcp_addr_info addr_l;
+       struct mptcp_sock *msk;
+       int err = -EINVAL;
+       struct sock *sk;
+       u32 token_val;
+
+       if (!laddr || !raddr || !token) {
+               GENL_SET_ERR_MSG(info, "missing required inputs");
+               return err;
+       }
+
+       token_val = nla_get_u32(token);
+
+       msk = mptcp_token_get_sock(genl_info_net(info), token_val);
+       if (!msk) {
+               NL_SET_ERR_MSG_ATTR(info->extack, token, "invalid token");
+               return err;
+       }
+
+       if (!mptcp_pm_is_userspace(msk)) {
+               GENL_SET_ERR_MSG(info, "invalid request; userspace PM not selected");
+               goto create_err;
+       }
+
+       err = mptcp_pm_parse_addr(laddr, info, &addr_l);
+       if (err < 0) {
+               NL_SET_ERR_MSG_ATTR(info->extack, laddr, "error parsing local addr");
+               goto create_err;
+       }
+
+       if (addr_l.id == 0) {
+               NL_SET_ERR_MSG_ATTR(info->extack, laddr, "missing local addr id");
+               goto create_err;
+       }
+
+       err = mptcp_pm_parse_addr(raddr, info, &addr_r);
+       if (err < 0) {
+               NL_SET_ERR_MSG_ATTR(info->extack, raddr, "error parsing remote addr");
+               goto create_err;
+       }
+
+       sk = &msk->sk.icsk_inet.sk;
+       lock_sock(sk);
+
+       err = __mptcp_subflow_connect(sk, &addr_l, &addr_r);
+
+       release_sock(sk);
+
+ create_err:
+       sock_put((struct sock *)msk);
+       return err;
+}
+
+static struct sock *mptcp_nl_find_ssk(struct mptcp_sock *msk,
+                                     const struct mptcp_addr_info *local,
+                                     const struct mptcp_addr_info *remote)
+{
+       struct sock *sk = &msk->sk.icsk_inet.sk;
+       struct mptcp_subflow_context *subflow;
+       struct sock *found = NULL;
+
+       if (local->family != remote->family)
+               return NULL;
+
+       lock_sock(sk);
+
+       mptcp_for_each_subflow(msk, subflow) {
+               const struct inet_sock *issk;
+               struct sock *ssk;
+
+               ssk = mptcp_subflow_tcp_sock(subflow);
+
+               if (local->family != ssk->sk_family)
+                       continue;
+
+               issk = inet_sk(ssk);
+
+               switch (ssk->sk_family) {
+               case AF_INET:
+                       if (issk->inet_saddr != local->addr.s_addr ||
+                           issk->inet_daddr != remote->addr.s_addr)
+                               continue;
+                       break;
+#if IS_ENABLED(CONFIG_MPTCP_IPV6)
+               case AF_INET6: {
+                       const struct ipv6_pinfo *pinfo = inet6_sk(ssk);
+
+                       if (!ipv6_addr_equal(&local->addr6, &pinfo->saddr) ||
+                           !ipv6_addr_equal(&remote->addr6, &ssk->sk_v6_daddr))
+                               continue;
+                       break;
+               }
+#endif
+               default:
+                       continue;
+               }
+
+               if (issk->inet_sport == local->port &&
+                   issk->inet_dport == remote->port) {
+                       found = ssk;
+                       goto found;
+               }
+       }
+
+found:
+       release_sock(sk);
+
+       return found;
+}
+
+int mptcp_nl_cmd_sf_destroy(struct sk_buff *skb, struct genl_info *info)
+{
+       struct nlattr *raddr = info->attrs[MPTCP_PM_ATTR_ADDR_REMOTE];
+       struct nlattr *token = info->attrs[MPTCP_PM_ATTR_TOKEN];
+       struct nlattr *laddr = info->attrs[MPTCP_PM_ATTR_ADDR];
+       struct mptcp_addr_info addr_l;
+       struct mptcp_addr_info addr_r;
+       struct mptcp_sock *msk;
+       struct sock *sk, *ssk;
+       int err = -EINVAL;
+       u32 token_val;
+
+       if (!laddr || !raddr || !token) {
+               GENL_SET_ERR_MSG(info, "missing required inputs");
+               return err;
+       }
+
+       token_val = nla_get_u32(token);
+
+       msk = mptcp_token_get_sock(genl_info_net(info), token_val);
+       if (!msk) {
+               NL_SET_ERR_MSG_ATTR(info->extack, token, "invalid token");
+               return err;
+       }
+
+       if (!mptcp_pm_is_userspace(msk)) {
+               GENL_SET_ERR_MSG(info, "invalid request; userspace PM not selected");
+               goto destroy_err;
+       }
+
+       err = mptcp_pm_parse_addr(laddr, info, &addr_l);
+       if (err < 0) {
+               NL_SET_ERR_MSG_ATTR(info->extack, laddr, "error parsing local addr");
+               goto destroy_err;
+       }
+
+       err = mptcp_pm_parse_addr(raddr, info, &addr_r);
+       if (err < 0) {
+               NL_SET_ERR_MSG_ATTR(info->extack, raddr, "error parsing remote addr");
+               goto destroy_err;
+       }
+
+       if (addr_l.family != addr_r.family) {
+               GENL_SET_ERR_MSG(info, "address families do not match");
+               goto destroy_err;
+       }
+
+       if (!addr_l.port || !addr_r.port) {
+               GENL_SET_ERR_MSG(info, "missing local or remote port");
+               goto destroy_err;
+       }
+
+       sk = &msk->sk.icsk_inet.sk;
+       ssk = mptcp_nl_find_ssk(msk, &addr_l, &addr_r);
+       if (ssk) {
+               struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
+
+               mptcp_subflow_shutdown(sk, ssk, RCV_SHUTDOWN | SEND_SHUTDOWN);
+               mptcp_close_ssk(sk, ssk, subflow);
+               err = 0;
+       } else {
+               err = -ESRCH;
+       }
+
+ destroy_err:
+       sock_put((struct sock *)msk);
+       return err;
+}
 
 void __init mptcp_pm_init(void);
 void mptcp_pm_data_init(struct mptcp_sock *msk);
 void mptcp_pm_data_reset(struct mptcp_sock *msk);
+int mptcp_pm_parse_addr(struct nlattr *attr, struct genl_info *info,
+                       struct mptcp_addr_info *addr);
 int mptcp_pm_parse_entry(struct nlattr *attr, struct genl_info *info,
                         bool require_family,
                         struct mptcp_pm_addr_entry *entry);
 void mptcp_free_local_addr_list(struct mptcp_sock *msk);
 int mptcp_nl_cmd_announce(struct sk_buff *skb, struct genl_info *info);
 int mptcp_nl_cmd_remove(struct sk_buff *skb, struct genl_info *info);
+int mptcp_nl_cmd_sf_create(struct sk_buff *skb, struct genl_info *info);
+int mptcp_nl_cmd_sf_destroy(struct sk_buff *skb, struct genl_info *info);
 
 void mptcp_event(enum mptcp_event_type type, const struct mptcp_sock *msk,
                 const struct sock *ssk, gfp_t gfp);