201 files changed, 9144 insertions, 2047 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 917ecb93ea2..d265c526839 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -438,7 +438,7 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                 }
 
                 break;
-
+        case NETDEV_GOING_DOWN: // NETDEV_DOWN
         case NETDEV_DOWN:
                 /* Put all VLANs for this dev in the down state too.  */
                 for (i = 0; i < VLAN_N_VID; i++) {
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index fcc684678af..27263fb1564 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -171,6 +171,8 @@ struct sk_buff *vlan_untag(struct sk_buff *skb)
         if (unlikely(!skb))
                 goto err_free;
 
+        skb_reset_network_header(skb);
+        skb_reset_transport_header(skb);
         return skb;
 
 err_free:
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 6e82148edfc..d54845618c2 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -154,7 +154,7 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
                 skb = __vlan_hwaccel_put_tag(skb, vlan_tci);
         }
 
-        skb_set_dev(skb, vlan_dev_info(dev)->real_dev);
+        skb->dev = vlan_dev_info(dev)->real_dev;
         len = skb->len;
         ret = dev_queue_xmit(skb);
 
@@ -694,7 +694,7 @@ void vlan_setup(struct net_device *dev)
         ether_setup(dev);
 
         dev->priv_flags         |= IFF_802_1Q_VLAN;
-        dev->priv_flags         &= ~IFF_XMIT_DST_RELEASE;
+        dev->priv_flags         &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
         dev->tx_queue_len       = 0;
 
         dev->netdev_ops         = &vlan_netdev_ops;
diff --git a/net/9p/client.c b/net/9p/client.c
index 9e3b0e640da..5532710fbfe 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -280,7 +280,8 @@ struct p9_req_t *p9_tag_lookup(struct p9_client *c, u16 tag)
          * buffer to read the data into */
         tag++;
 
-        BUG_ON(tag >= c->max_tag);
+        if(tag >= c->max_tag)
+                return NULL;
 
         row = tag / P9_ROW_MAXTAG;
         col = tag % P9_ROW_MAXTAG;
@@ -821,8 +822,8 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
         if (err)
                 goto destroy_fidpool;
 
-        if ((clnt->msize+P9_IOHDRSZ) > clnt->trans_mod->maxsize)
-                clnt->msize = clnt->trans_mod->maxsize-P9_IOHDRSZ;
+        if (clnt->msize > clnt->trans_mod->maxsize)
+                clnt->msize = clnt->trans_mod->maxsize;
 
         err = p9_client_version(clnt);
         if (err)
@@ -1249,9 +1250,11 @@ int p9_client_clunk(struct p9_fid *fid)
         P9_DPRINTK(P9_DEBUG_9P, "<<< RCLUNK fid %d\n", fid->fid);
 
         p9_free_req(clnt, req);
-        p9_fid_destroy(fid);
-
 error:
+        /*
+         * Fid is not valid even after a failed clunk
+         */
+        p9_fid_destroy(fid);
         return err;
 }
 EXPORT_SYMBOL(p9_client_clunk);
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 244e7074218..e317583fcc7 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -263,7 +263,6 @@ p9_virtio_request(struct p9_client *client, struct p9_req_t *req)
 {
         int in, out, inp, outp;
         struct virtio_chan *chan = client->trans;
-        char *rdata = (char *)req->rc+sizeof(struct p9_fcall);
         unsigned long flags;
         size_t pdata_off = 0;
         struct trans_rpage_info *rpinfo = NULL;
@@ -346,7 +345,8 @@ req_retry_pinned:
                  * Arrange in such a way that server places header in the
                  * alloced memory and payload onto the user buffer.
                  */
-                inp = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, rdata, 11);
+                inp = pack_sg_list(chan->sg, out,
+                                   VIRTQUEUE_NUM, req->rc->sdata, 11);
                 /*
                  * Running executables in the filesystem may result in
                  * a read request with kernel buffer as opposed to user buffer.
@@ -366,8 +366,8 @@ req_retry_pinned:
                 }
                 in += inp;
         } else {
-                in = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, rdata,
-                                client->msize);
+                in = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM,
+                                  req->rc->sdata, req->rc->capacity);
         }
 
         err = virtqueue_add_buf(chan->vq, chan->sg, out, in, req->tc);
@@ -592,7 +592,14 @@ static struct p9_trans_module p9_virtio_trans = {
         .close = p9_virtio_close,
         .request = p9_virtio_request,
         .cancel = p9_virtio_cancel,
-        .maxsize = PAGE_SIZE*16,
+
+        /*
+         * We leave one entry for input and one entry for response
+         * headers. We also skip one more entry to accomodate, address
+         * that are not at page boundary, that can result in an extra
+         * page in zero copy.
+         */
+        .maxsize = PAGE_SIZE * (VIRTQUEUE_NUM - 3),
         .pref = P9_TRANS_PREF_PAYLOAD_SEP,
         .def = 0,
         .owner = THIS_MODULE,
diff --git a/net/Kconfig b/net/Kconfig
index 878151c772c..919cf9a8212 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -79,6 +79,20 @@ source "net/netlabel/Kconfig"
 
 endif # if INET
 
+config ANDROID_PARANOID_NETWORK
+        bool "Only allow certain groups to create sockets"
+        default y
+        help
+                none
+
+config NET_ACTIVITY_STATS
+        bool "Network activity statistics tracking"
+        default y
+        help
+         Network activity statistics are useful for tracking wireless
+         modem activity on 2G, 3G, 4G wireless networks. Counts number of
+         transmissions and groups them in specified time buckets.
+
 config NETWORK_SECMARK
         bool "Security Marking"
         help
@@ -217,7 +231,7 @@ source "net/dns_resolver/Kconfig"
 source "net/batman-adv/Kconfig"
 
 config RPS
-        boolean
+        boolean "RPS"
         depends on SMP && SYSFS && USE_GENERIC_SMP_HELPERS
         default y
 
diff --git a/net/Makefile b/net/Makefile
index a51d9465e62..54808aba6c1 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -68,3 +68,4 @@ obj-$(CONFIG_WIMAX)		+= wimax/
 obj-$(CONFIG_DNS_RESOLVER)      += dns_resolver/
 obj-$(CONFIG_CEPH_LIB)          += ceph/
 obj-$(CONFIG_BATMAN_ADV)        += batman-adv/
+obj-$(CONFIG_NET_ACTIVITY_STATS)                += activity_stats.o
diff --git a/net/activity_stats.c b/net/activity_stats.c
new file mode 100644
index 00000000000..8a3e9347006
--- /dev/null
+++ b/net/activity_stats.c
@@ -0,0 +1,115 @@
+/* net/activity_stats.c
+ *
+ * Copyright (C) 2010 Google, Inc.
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * Author: Mike Chan (mike@android.com)
+ */
+
+#include <linux/proc_fs.h>
+#include <linux/suspend.h>
+#include <net/net_namespace.h>
+
+/*
+ * Track transmission rates in buckets (power of 2).
+ * 1,2,4,8...512 seconds.
+ *
+ * Buckets represent the count of network transmissions at least
+ * N seconds apart, where N is 1 << bucket index.
+ */
+#define BUCKET_MAX 10
+
+/* Track network activity frequency */
+static unsigned long activity_stats[BUCKET_MAX];
+static ktime_t last_transmit;
+static ktime_t suspend_time;
+static DEFINE_SPINLOCK(activity_lock);
+
+void activity_stats_update(void)
+{
+        int i;
+        unsigned long flags;
+        ktime_t now;
+        s64 delta;
+
+        spin_lock_irqsave(&activity_lock, flags);
+        now = ktime_get();
+        delta = ktime_to_ns(ktime_sub(now, last_transmit));
+
+        for (i = BUCKET_MAX - 1; i >= 0; i--) {
+                /*
+                 * Check if the time delta between network activity is within the
+                 * minimum bucket range.
+                 */
+                if (delta < (1000000000ULL << i))
+                        continue;
+
+                activity_stats[i]++;
+                last_transmit = now;
+                break;
+        }
+        spin_unlock_irqrestore(&activity_lock, flags);
+}
+
+static int activity_stats_read_proc(char *page, char **start, off_t off,
+                                        int count, int *eof, void *data)
+{
+        int i;
+        int len;
+        char *p = page;
+
+        /* Only print if offset is 0, or we have enough buffer space */
+        if (off || count < (30 * BUCKET_MAX + 22))
+                return -ENOMEM;
+
+        len = snprintf(p, count, "Min Bucket(sec) Count\n");
+        count -= len;
+        p += len;
+
+        for (i = 0; i < BUCKET_MAX; i++) {
+                len = snprintf(p, count, "%15d %lu\n", 1 << i, activity_stats[i]);
+                count -= len;
+                p += len;
+        }
+        *eof = 1;
+
+        return p - page;
+}
+
+static int activity_stats_notifier(struct notifier_block *nb,
+                                        unsigned long event, void *dummy)
+{
+        switch (event) {
+                case PM_SUSPEND_PREPARE:
+                        suspend_time = ktime_get_real();
+                        break;
+
+                case PM_POST_SUSPEND:
+                        suspend_time = ktime_sub(ktime_get_real(), suspend_time);
+                        last_transmit = ktime_sub(last_transmit, suspend_time);
+        }
+
+        return 0;
+}
+
+static struct notifier_block activity_stats_notifier_block = {
+        .notifier_call = activity_stats_notifier,
+};
+
+static int  __init activity_stats_init(void)
+{
+        create_proc_read_entry("activity", S_IRUGO,
+                        init_net.proc_net_stat, activity_stats_read_proc, NULL);
+        return register_pm_notifier(&activity_stats_notifier_block);
+}
+
+subsys_initcall(activity_stats_init);
+
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 2252c2085da..d07223c834a 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -242,8 +242,6 @@ static int br2684_xmit_vcc(struct sk_buff *skb, struct net_device *dev,
                 if (brdev->payload == p_bridged) {
                         skb_push(skb, 2);
                         memset(skb->data, 0, 2);
-                } else { /* p_routed */
-                        skb_pull(skb, ETH_HLEN);
                 }
         }
         skb_debug(skb);
@@ -560,12 +558,13 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
         spin_unlock_irqrestore(&rq->lock, flags);
 
         skb_queue_walk_safe(&queue, skb, tmp) {
-                struct net_device *dev = skb->dev;
+                struct net_device *dev;
+
+                br2684_push(atmvcc, skb);
+                dev = skb->dev;
 
                 dev->stats.rx_bytes -= skb->len;
                 dev->stats.rx_packets--;
-
-                br2684_push(atmvcc, skb);
         }
 
         /* initialize netdev carrier state */
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 1d4be60e139..5889074e971 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -364,33 +364,37 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
                                    struct net_device *dev)
 {
         struct clip_priv *clip_priv = PRIV(dev);
+        struct dst_entry *dst = skb_dst(skb);
         struct atmarp_entry *entry;
+        struct neighbour *n;
         struct atm_vcc *vcc;
         int old;
         unsigned long flags;
 
         pr_debug("(skb %p)\n", skb);
-        if (!skb_dst(skb)) {
+        if (!dst) {
                 pr_err("skb_dst(skb) == NULL\n");
                 dev_kfree_skb(skb);
                 dev->stats.tx_dropped++;
                 return NETDEV_TX_OK;
         }
-        if (!skb_dst(skb)->neighbour) {
+        n = dst_get_neighbour(dst);
+        if (!n) {
 #if 0
-                skb_dst(skb)->neighbour = clip_find_neighbour(skb_dst(skb), 1);
-                if (!skb_dst(skb)->neighbour) {
+                n = clip_find_neighbour(skb_dst(skb), 1);
+                if (!n) {
                         dev_kfree_skb(skb);     /* lost that one */
                         dev->stats.tx_dropped++;
                         return 0;
                 }
+                dst_set_neighbour(dst, n);
 #endif
                 pr_err("NO NEIGHBOUR !\n");
                 dev_kfree_skb(skb);
                 dev->stats.tx_dropped++;
                 return NETDEV_TX_OK;
         }
-        entry = NEIGH2ENTRY(skb_dst(skb)->neighbour);
+        entry = NEIGH2ENTRY(n);
         if (!entry->vccs) {
                 if (time_after(jiffies, entry->expires)) {
                         /* should be resolved */
@@ -407,7 +411,7 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
         }
         pr_debug("neigh %p, vccs %p\n", entry, entry->vccs);
         ATM_SKB(skb)->vcc = vcc = entry->vccs->vcc;
-        pr_debug("using neighbour %p, vcc %p\n", skb_dst(skb)->neighbour, vcc);
+        pr_debug("using neighbour %p, vcc %p\n", n, vcc);
         if (entry->vccs->encap) {
                 void *here;
 
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index e7c69f4619e..b04a6ef4da9 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -2006,16 +2006,17 @@ static void __exit ax25_exit(void)
         proc_net_remove(&init_net, "ax25_route");
         proc_net_remove(&init_net, "ax25");
         proc_net_remove(&init_net, "ax25_calls");
-        ax25_rt_free();
-        ax25_uid_free();
-        ax25_dev_free();
 
-        ax25_unregister_sysctl();
         unregister_netdevice_notifier(&ax25_dev_notifier);
+        ax25_unregister_sysctl();
 
         dev_remove_pack(&ax25_packet_type);
 
         sock_unregister(PF_AX25);
         proto_unregister(&ax25_proto);
+
+        ax25_rt_free();
+        ax25_uid_free();
+        ax25_dev_free();
 }
 module_exit(ax25_exit);
diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig
index 6ae5ec50858..bfb3dc03c9d 100644
--- a/net/bluetooth/Kconfig
+++ b/net/bluetooth/Kconfig
@@ -6,6 +6,7 @@ menuconfig BT
         tristate "Bluetooth subsystem support"
         depends on NET && !S390
         depends on RFKILL || !RFKILL
+        select CRYPTO
         help
           Bluetooth is low-cost, low-power, short-range wireless technology.
           It was designed as a replacement for cables and other short-range
@@ -22,6 +23,7 @@ menuconfig BT
              BNEP Module (Bluetooth Network Encapsulation Protocol)
              CMTP Module (CAPI Message Transport Protocol)
              HIDP Module (Human Interface Device Protocol)
+             SMP Module (Security Manager Protocol)
 
           Say Y here to compile Bluetooth support into the kernel or say M to
           compile it as module (bluetooth).
@@ -36,11 +38,18 @@ if BT != n
 config BT_L2CAP
         bool "L2CAP protocol support"
         select CRC16
+        select CRYPTO
+        select CRYPTO_BLKCIPHER
+        select CRYPTO_AES
+        select CRYPTO_ECB
         help
           L2CAP (Logical Link Control and Adaptation Protocol) provides
           connection oriented and connection-less data transport.  L2CAP
           support is required for most Bluetooth applications.
 
+          Also included is support for SMP (Security Manager Protocol) which
+          is the security layer on top of LE (Low Energy) links.
+
 config BT_SCO
         bool "SCO links support"
         help
diff --git a/net/bluetooth/Makefile b/net/bluetooth/Makefile
index f04fe9a9d63..9b67f3d08fa 100644
--- a/net/bluetooth/Makefile
+++ b/net/bluetooth/Makefile
@@ -9,5 +9,5 @@ obj-$(CONFIG_BT_CMTP)	+= cmtp/
 obj-$(CONFIG_BT_HIDP)   += hidp/
 
 bluetooth-y := af_bluetooth.o hci_core.o hci_conn.o hci_event.o mgmt.o hci_sock.o hci_sysfs.o lib.o
-bluetooth-$(CONFIG_BT_L2CAP)    += l2cap_core.o l2cap_sock.o
+bluetooth-$(CONFIG_BT_L2CAP)    += l2cap_core.o l2cap_sock.o smp.o
 bluetooth-$(CONFIG_BT_SCO)      += sco.o
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 8add9b49991..7c73a10d7ed 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -40,6 +40,15 @@
 
 #include <net/bluetooth/bluetooth.h>
 
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
+#include <linux/android_aid.h>
+#endif
+
+#ifndef CONFIG_BT_SOCK_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
 #define VERSION "2.16"
 
 /* Bluetooth sockets */
@@ -125,11 +134,40 @@ int bt_sock_unregister(int proto)
 }
 EXPORT_SYMBOL(bt_sock_unregister);
 
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
+static inline int current_has_bt_admin(void)
+{
+        return (!current_euid() || in_egroup_p(AID_NET_BT_ADMIN));
+}
+
+static inline int current_has_bt(void)
+{
+        return (current_has_bt_admin() || in_egroup_p(AID_NET_BT));
+}
+# else
+static inline int current_has_bt_admin(void)
+{
+        return 1;
+}
+
+static inline int current_has_bt(void)
+{
+        return 1;
+}
+#endif
+
 static int bt_sock_create(struct net *net, struct socket *sock, int proto,
                           int kern)
 {
         int err;
 
+        if (proto == BTPROTO_RFCOMM || proto == BTPROTO_SCO ||
+                        proto == BTPROTO_L2CAP) {
+                if (!current_has_bt())
+                        return -EPERM;
+        } else if (!current_has_bt_admin())
+                return -EPERM;
+
         if (net != &init_net)
                 return -EAFNOSUPPORT;
 
@@ -494,9 +532,8 @@ int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
         BT_DBG("sk %p", sk);
 
         add_wait_queue(sk_sleep(sk), &wait);
+        set_current_state(TASK_INTERRUPTIBLE);
         while (sk->sk_state != state) {
-                set_current_state(TASK_INTERRUPTIBLE);
-
                 if (!timeo) {
                         err = -EINPROGRESS;
                         break;
@@ -510,12 +547,13 @@ int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
                 release_sock(sk);
                 timeo = schedule_timeout(timeo);
                 lock_sock(sk);
+                set_current_state(TASK_INTERRUPTIBLE);
 
                 err = sock_error(sk);
                 if (err)
                         break;
         }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
         remove_wait_queue(sk_sleep(sk), &wait);
         return err;
 }
diff --git a/net/bluetooth/bnep/bnep.h b/net/bluetooth/bnep/bnep.h
index 8e6c06158f8..e7ee5314f39 100644
--- a/net/bluetooth/bnep/bnep.h
+++ b/net/bluetooth/bnep/bnep.h
@@ -155,6 +155,7 @@ struct bnep_session {
         unsigned int  role;
         unsigned long state;
         unsigned long flags;
+        atomic_t      terminate;
         struct task_struct *task;
 
         struct ethhdr eh;
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index ca39fcf010c..d9edfe8bf9d 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -484,9 +484,11 @@ static int bnep_session(void *arg)
 
         init_waitqueue_entry(&wait, current);
         add_wait_queue(sk_sleep(sk), &wait);
-        while (!kthread_should_stop()) {
+        while (1) {
                 set_current_state(TASK_INTERRUPTIBLE);
 
+                if (atomic_read(&s->terminate))
+                        break;
                 /* RX */
                 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
                         skb_orphan(skb);
@@ -504,7 +506,7 @@ static int bnep_session(void *arg)
 
                 schedule();
         }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
         remove_wait_queue(sk_sleep(sk), &wait);
 
         /* Cleanup session */
@@ -640,9 +642,10 @@ int bnep_del_connection(struct bnep_conndel_req *req)
         down_read(&bnep_session_sem);
 
         s = __bnep_get_session(req->dst);
-        if (s)
-                kthread_stop(s->task);
-        else
+        if (s) {
+                atomic_inc(&s->terminate);
+                wake_up_process(s->task);
+        } else
                 err = -ENOENT;
 
         up_read(&bnep_session_sem);
diff --git a/net/bluetooth/bnep/netdev.c b/net/bluetooth/bnep/netdev.c
index 8c100c9dae2..d4f5dff7c95 100644
--- a/net/bluetooth/bnep/netdev.c
+++ b/net/bluetooth/bnep/netdev.c
@@ -231,6 +231,7 @@ void bnep_net_setup(struct net_device *dev)
         dev->addr_len = ETH_ALEN;
 
         ether_setup(dev);
+        dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         dev->netdev_ops = &bnep_netdev_ops;
 
         dev->watchdog_timeo  = HZ * 2;
diff --git a/net/bluetooth/cmtp/capi.c b/net/bluetooth/cmtp/capi.c
index 744233cba24..040f67b1297 100644
--- a/net/bluetooth/cmtp/capi.c
+++ b/net/bluetooth/cmtp/capi.c
@@ -326,7 +326,7 @@ void cmtp_recv_capimsg(struct cmtp_session *session, struct sk_buff *skb)
 {
         struct capi_ctr *ctrl = &session->ctrl;
         struct cmtp_application *application;
-        __u16 cmd, appl;
+        __u16 appl;
         __u32 contr;
 
         BT_DBG("session %p skb %p len %d", session, skb, skb->len);
@@ -344,7 +344,6 @@ void cmtp_recv_capimsg(struct cmtp_session *session, struct sk_buff *skb)
                 return;
         }
 
-        cmd = CAPICMD(CAPIMSG_COMMAND(skb->data), CAPIMSG_SUBCOMMAND(skb->data));
         appl = CAPIMSG_APPID(skb->data);
         contr = CAPIMSG_CONTROL(skb->data);
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index bcd158f40bb..33c4e0cd83b 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -53,11 +53,13 @@ static void hci_le_connect(struct hci_conn *conn)
         conn->state = BT_CONNECT;
         conn->out = 1;
         conn->link_mode |= HCI_LM_MASTER;
+        conn->sec_level = BT_SECURITY_LOW;
 
         memset(&cp, 0, sizeof(cp));
         cp.scan_interval = cpu_to_le16(0x0004);
         cp.scan_window = cpu_to_le16(0x0004);
         bacpy(&cp.peer_addr, &conn->dst);
+        cp.peer_addr_type = conn->dst_type;
         cp.conn_interval_min = cpu_to_le16(0x0008);
         cp.conn_interval_max = cpu_to_le16(0x0100);
         cp.supervision_timeout = cpu_to_le16(0x0064);
@@ -203,6 +205,55 @@ void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 }
 EXPORT_SYMBOL(hci_le_conn_update);
 
+void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
+                                                        __u8 ltk[16])
+{
+        struct hci_dev *hdev = conn->hdev;
+        struct hci_cp_le_start_enc cp;
+
+        BT_DBG("%p", conn);
+
+        memset(&cp, 0, sizeof(cp));
+
+        cp.handle = cpu_to_le16(conn->handle);
+        memcpy(cp.ltk, ltk, sizeof(cp.ltk));
+        cp.ediv = ediv;
+        memcpy(cp.rand, rand, sizeof(rand));
+
+        hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
+}
+EXPORT_SYMBOL(hci_le_start_enc);
+
+void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16])
+{
+        struct hci_dev *hdev = conn->hdev;
+        struct hci_cp_le_ltk_reply cp;
+
+        BT_DBG("%p", conn);
+
+        memset(&cp, 0, sizeof(cp));
+
+        cp.handle = cpu_to_le16(conn->handle);
+        memcpy(cp.ltk, ltk, sizeof(ltk));
+
+        hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
+}
+EXPORT_SYMBOL(hci_le_ltk_reply);
+
+void hci_le_ltk_neg_reply(struct hci_conn *conn)
+{
+        struct hci_dev *hdev = conn->hdev;
+        struct hci_cp_le_ltk_neg_reply cp;
+
+        BT_DBG("%p", conn);
+
+        memset(&cp, 0, sizeof(cp));
+
+        cp.handle = cpu_to_le16(conn->handle);
+
+        hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(cp), &cp);
+}
+
 /* Device _must_ be locked */
 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 {
@@ -282,7 +333,8 @@ static void hci_conn_auto_accept(unsigned long arg)
         hci_dev_unlock(hdev);
 }
 
-struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
+struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type,
+                                        __u16 pkt_type, bdaddr_t *dst)
 {
         struct hci_conn *conn;
 
@@ -310,14 +362,22 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
                 break;
         case SCO_LINK:
-                if (lmp_esco_capable(hdev))
-                        conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
-                                        (hdev->esco_type & EDR_ESCO_MASK);
-                else
-                        conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
-                break;
+                if (!pkt_type)
+                        pkt_type = SCO_ESCO_MASK;
         case ESCO_LINK:
-                conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
+                if (!pkt_type)
+                        pkt_type = ALL_ESCO_MASK;
+                if (lmp_esco_capable(hdev)) {
+                        /* HCI Setup Synchronous Connection Command uses
+                           reverse logic on the EDR_ESCO_MASK bits */
+                        conn->pkt_type = (pkt_type ^ EDR_ESCO_MASK) &
+                                        hdev->esco_type;
+                } else {
+                        /* Legacy HCI Add Sco Connection Command uses a
+                           shifted bitmask */
+                        conn->pkt_type = (pkt_type << 5) & hdev->pkt_type &
+                                        SCO_PTYPE_MASK;
+                }
                 break;
         }
 
@@ -441,7 +501,9 @@ EXPORT_SYMBOL(hci_get_route);
 
 /* Create SCO, ACL or LE connection.
  * Device _must_ be locked */
-struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
+struct hci_conn *hci_connect(struct hci_dev *hdev, int type,
+                                        __u16 pkt_type, bdaddr_t *dst,
+                                        __u8 sec_level, __u8 auth_type)
 {
         struct hci_conn *acl;
         struct hci_conn *sco;
@@ -450,14 +512,23 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 
         if (type == LE_LINK) {
+                struct adv_entry *entry;
+
                 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
                 if (le)
                         return ERR_PTR(-EBUSY);
-                le = hci_conn_add(hdev, LE_LINK, dst);
+
+                entry = hci_find_adv_entry(hdev, dst);
+                if (!entry)
+                        return ERR_PTR(-EHOSTUNREACH);
+
+                le = hci_conn_add(hdev, LE_LINK, 0, dst);
                 if (!le)
                         return ERR_PTR(-ENOMEM);
-                if (le->state == BT_OPEN)
-                        hci_le_connect(le);
+
+                le->dst_type = entry->bdaddr_type;
+
+                hci_le_connect(le);
 
                 hci_conn_hold(le);
 
@@ -466,7 +537,7 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
 
         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
         if (!acl) {
-                acl = hci_conn_add(hdev, ACL_LINK, dst);
+                acl = hci_conn_add(hdev, ACL_LINK, 0, dst);
                 if (!acl)
                         return NULL;
         }
@@ -485,7 +556,7 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
 
         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
         if (!sco) {
-                sco = hci_conn_add(hdev, type, dst);
+                sco = hci_conn_add(hdev, type, pkt_type, dst);
                 if (!sco) {
                         hci_conn_put(acl);
                         return NULL;
@@ -500,7 +571,7 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
         if (acl->state == BT_CONNECTED &&
                         (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
                 acl->power_save = 1;
-                hci_conn_enter_active_mode(acl);
+                hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 
                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->pend)) {
                         /* defer SCO setup until mode change completed */
@@ -548,9 +619,15 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 
         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
                 struct hci_cp_auth_requested cp;
+
+                /* encrypt must be pending if auth is also pending */
+                set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
+
                 cp.handle = cpu_to_le16(conn->handle);
                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
                                                         sizeof(cp), &cp);
+                if (conn->key_type != 0xff)
+                        set_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
         }
 
         return 0;
@@ -634,9 +711,7 @@ int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
         if (sec_level != BT_SECURITY_HIGH)
                 return 1; /* Accept if non-secure is required */
 
-        if (conn->key_type == HCI_LK_AUTH_COMBINATION ||
-                        (conn->key_type == HCI_LK_COMBINATION &&
-                        conn->pin_length == 16))
+        if (conn->sec_level == BT_SECURITY_HIGH)
                 return 1;
 
         return 0; /* Reject not secure link */
@@ -679,7 +754,7 @@ int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 EXPORT_SYMBOL(hci_conn_switch_role);
 
 /* Enter active mode */
-void hci_conn_enter_active_mode(struct hci_conn *conn)
+void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 {
         struct hci_dev *hdev = conn->hdev;
 
@@ -688,7 +763,10 @@ void hci_conn_enter_active_mode(struct hci_conn *conn)
         if (test_bit(HCI_RAW, &hdev->flags))
                 return;
 
-        if (conn->mode != HCI_CM_SNIFF || !conn->power_save)
+        if (conn->mode != HCI_CM_SNIFF)
+                goto timer;
+
+        if (!conn->power_save && !force_active)
                 goto timer;
 
         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
@@ -829,6 +907,15 @@ int hci_get_conn_list(void __user *arg)
                 (ci + n)->out   = c->out;
                 (ci + n)->state = c->state;
                 (ci + n)->link_mode = c->link_mode;
+                if (c->type == SCO_LINK) {
+                        (ci + n)->mtu = hdev->sco_mtu;
+                        (ci + n)->cnt = hdev->sco_cnt;
+                        (ci + n)->pkts = hdev->sco_pkts;
+                } else {
+                        (ci + n)->mtu = hdev->acl_mtu;
+                        (ci + n)->cnt = hdev->acl_cnt;
+                        (ci + n)->pkts = hdev->acl_pkts;
+                }
                 if (++n >= req.conn_num)
                         break;
         }
@@ -865,6 +952,15 @@ int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
                 ci.out   = conn->out;
                 ci.state = conn->state;
                 ci.link_mode = conn->link_mode;
+                if (req.type == SCO_LINK) {
+                        ci.mtu = hdev->sco_mtu;
+                        ci.cnt = hdev->sco_cnt;
+                        ci.pkts = hdev->sco_pkts;
+                } else {
+                        ci.mtu = hdev->acl_mtu;
+                        ci.cnt = hdev->acl_cnt;
+                        ci.pkts = hdev->acl_pkts;
+                }
         }
         hci_dev_unlock_bh(hdev);
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 815269b07f2..f38e633c754 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -42,6 +42,7 @@
 #include <linux/notifier.h>
 #include <linux/rfkill.h>
 #include <linux/timer.h>
+#include <linux/crypto.h>
 #include <net/sock.h>
 
 #include <asm/system.h>
@@ -145,7 +146,7 @@ static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev,
 
         switch (hdev->req_status) {
         case HCI_REQ_DONE:
-                err = -bt_err(hdev->req_result);
+                err = -bt_to_errno(hdev->req_result);
                 break;
 
         case HCI_REQ_CANCELED:
@@ -509,6 +510,11 @@ int hci_dev_open(__u16 dev)
 
         hci_req_lock(hdev);
 
+        if (test_bit(HCI_UNREGISTER, &hdev->flags)) {
+                ret = -ENODEV;
+                goto done;
+        }
+
         if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
                 ret = -ERFKILL;
                 goto done;
@@ -539,7 +545,7 @@ int hci_dev_open(__u16 dev)
                 ret = __hci_request(hdev, hci_init_req, 0,
                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 
-                if (lmp_le_capable(hdev))
+                if (lmp_host_le_capable(hdev))
                         ret = __hci_request(hdev, hci_le_init_req, 0,
                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 
@@ -1056,6 +1062,42 @@ static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
         return 0;
 }
 
+struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
+{
+        struct link_key *k;
+
+        list_for_each_entry(k, &hdev->link_keys, list) {
+                struct key_master_id *id;
+
+                if (k->type != HCI_LK_SMP_LTK)
+                        continue;
+
+                if (k->dlen != sizeof(*id))
+                        continue;
+
+                id = (void *) &k->data;
+                if (id->ediv == ediv &&
+                                (memcmp(rand, id->rand, sizeof(id->rand)) == 0))
+                        return k;
+        }
+
+        return NULL;
+}
+EXPORT_SYMBOL(hci_find_ltk);
+
+struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
+                                        bdaddr_t *bdaddr, u8 type)
+{
+        struct link_key *k;
+
+        list_for_each_entry(k, &hdev->link_keys, list)
+                if (k->type == type && bacmp(bdaddr, &k->bdaddr) == 0)
+                        return k;
+
+        return NULL;
+}
+EXPORT_SYMBOL(hci_find_link_key_type);
+
 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
                                 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
 {
@@ -1111,6 +1153,44 @@ int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
         return 0;
 }
 
+int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
+                        u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16])
+{
+        struct link_key *key, *old_key;
+        struct key_master_id *id;
+        u8 old_key_type;
+
+        BT_DBG("%s addr %s", hdev->name, batostr(bdaddr));
+
+        old_key = hci_find_link_key_type(hdev, bdaddr, HCI_LK_SMP_LTK);
+        if (old_key) {
+                key = old_key;
+                old_key_type = old_key->type;
+        } else {
+                key = kzalloc(sizeof(*key) + sizeof(*id), GFP_ATOMIC);
+                if (!key)
+                        return -ENOMEM;
+                list_add(&key->list, &hdev->link_keys);
+                old_key_type = 0xff;
+        }
+
+        key->dlen = sizeof(*id);
+
+        bacpy(&key->bdaddr, bdaddr);
+        memcpy(key->val, ltk, sizeof(key->val));
+        key->type = HCI_LK_SMP_LTK;
+        key->pin_len = key_size;
+
+        id = (void *) &key->data;
+        id->ediv = ediv;
+        memcpy(id->rand, rand, sizeof(id->rand));
+
+        if (new_key)
+                mgmt_new_key(hdev->id, key, old_key_type);
+
+        return 0;
+}
+
 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
 {
         struct link_key *key;
@@ -1134,7 +1214,6 @@ static void hci_cmd_timer(unsigned long arg)
 
         BT_ERR("%s command tx timeout", hdev->name);
         atomic_set(&hdev->cmd_cnt, 1);
-        clear_bit(HCI_RESET, &hdev->flags);
         tasklet_schedule(&hdev->cmd_task);
 }
 
@@ -1202,6 +1281,169 @@ int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
         return 0;
 }
 
+struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
+                                                bdaddr_t *bdaddr)
+{
+        struct list_head *p;
+
+        list_for_each(p, &hdev->blacklist) {
+                struct bdaddr_list *b;
+
+                b = list_entry(p, struct bdaddr_list, list);
+
+                if (bacmp(bdaddr, &b->bdaddr) == 0)
+                        return b;
+        }
+
+        return NULL;
+}
+
+int hci_blacklist_clear(struct hci_dev *hdev)
+{
+        struct list_head *p, *n;
+
+        list_for_each_safe(p, n, &hdev->blacklist) {
+                struct bdaddr_list *b;
+
+                b = list_entry(p, struct bdaddr_list, list);
+
+                list_del(p);
+                kfree(b);
+        }
+
+        return 0;
+}
+
+int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr)
+{
+        struct bdaddr_list *entry;
+        int err;
+
+        if (bacmp(bdaddr, BDADDR_ANY) == 0)
+                return -EBADF;
+
+        hci_dev_lock_bh(hdev);
+
+        if (hci_blacklist_lookup(hdev, bdaddr)) {
+                err = -EEXIST;
+                goto err;
+        }
+
+        entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
+        if (!entry) {
+                return -ENOMEM;
+                goto err;
+        }
+
+        bacpy(&entry->bdaddr, bdaddr);
+
+        list_add(&entry->list, &hdev->blacklist);
+
+        err = 0;
+
+err:
+        hci_dev_unlock_bh(hdev);
+        return err;
+}
+
+int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr)
+{
+        struct bdaddr_list *entry;
+        int err = 0;
+
+        hci_dev_lock_bh(hdev);
+
+        if (bacmp(bdaddr, BDADDR_ANY) == 0) {
+                hci_blacklist_clear(hdev);
+                goto done;
+        }
+
+        entry = hci_blacklist_lookup(hdev, bdaddr);
+        if (!entry) {
+                err = -ENOENT;
+                goto done;
+        }
+
+        list_del(&entry->list);
+        kfree(entry);
+
+done:
+        hci_dev_unlock_bh(hdev);
+        return err;
+}
+
+static void hci_clear_adv_cache(unsigned long arg)
+{
+        struct hci_dev *hdev = (void *) arg;
+
+        hci_dev_lock(hdev);
+
+        hci_adv_entries_clear(hdev);
+
+        hci_dev_unlock(hdev);
+}
+
+int hci_adv_entries_clear(struct hci_dev *hdev)
+{
+        struct adv_entry *entry, *tmp;
+
+        list_for_each_entry_safe(entry, tmp, &hdev->adv_entries, list) {
+                list_del(&entry->list);
+                kfree(entry);
+        }
+
+        BT_DBG("%s adv cache cleared", hdev->name);
+
+        return 0;
+}
+
+struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr)
+{
+        struct adv_entry *entry;
+
+        list_for_each_entry(entry, &hdev->adv_entries, list)
+                if (bacmp(bdaddr, &entry->bdaddr) == 0)
+                        return entry;
+
+        return NULL;
+}
+
+static inline int is_connectable_adv(u8 evt_type)
+{
+        if (evt_type == ADV_IND || evt_type == ADV_DIRECT_IND)
+                return 1;
+
+        return 0;
+}
+
+int hci_add_adv_entry(struct hci_dev *hdev,
+                                        struct hci_ev_le_advertising_info *ev)
+{
+        struct adv_entry *entry;
+
+        if (!is_connectable_adv(ev->evt_type))
+                return -EINVAL;
+
+        /* Only new entries should be added to adv_entries. So, if
+         * bdaddr was found, don't add it. */
+        if (hci_find_adv_entry(hdev, &ev->bdaddr))
+                return 0;
+
+        entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
+        if (!entry)
+                return -ENOMEM;
+
+        bacpy(&entry->bdaddr, &ev->bdaddr);
+        entry->bdaddr_type = ev->bdaddr_type;
+
+        list_add(&entry->list, &hdev->adv_entries);
+
+        BT_DBG("%s adv entry added: address %s type %u", hdev->name,
+                                batostr(&entry->bdaddr), entry->bdaddr_type);
+
+        return 0;
+}
+
 /* Register HCI device */
 int hci_register_dev(struct hci_dev *hdev)
 {
@@ -1268,6 +1510,10 @@ int hci_register_dev(struct hci_dev *hdev)
 
         INIT_LIST_HEAD(&hdev->remote_oob_data);
 
+        INIT_LIST_HEAD(&hdev->adv_entries);
+        setup_timer(&hdev->adv_timer, hci_clear_adv_cache,
+                                                (unsigned long) hdev);
+
         INIT_WORK(&hdev->power_on, hci_power_on);
         INIT_WORK(&hdev->power_off, hci_power_off);
         setup_timer(&hdev->off_timer, hci_auto_off, (unsigned long) hdev);
@@ -1282,6 +1528,11 @@ int hci_register_dev(struct hci_dev *hdev)
         if (!hdev->workqueue)
                 goto nomem;
 
+        hdev->tfm = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
+        if (IS_ERR(hdev->tfm))
+                BT_INFO("Failed to load transform for ecb(aes): %ld",
+                                                        PTR_ERR(hdev->tfm));
+
         hci_register_sysfs(hdev);
 
         hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
@@ -1317,6 +1568,8 @@ int hci_unregister_dev(struct hci_dev *hdev)
 
         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
 
+        set_bit(HCI_UNREGISTER, &hdev->flags);
+
         write_lock_bh(&hci_dev_list_lock);
         list_del(&hdev->list);
         write_unlock_bh(&hci_dev_list_lock);
@@ -1330,6 +1583,9 @@ int hci_unregister_dev(struct hci_dev *hdev)
                                         !test_bit(HCI_SETUP, &hdev->flags))
                 mgmt_index_removed(hdev->id);
 
+        if (!IS_ERR(hdev->tfm))
+                crypto_free_blkcipher(hdev->tfm);
+
         hci_notify(hdev, HCI_DEV_UNREG);
 
         if (hdev->rfkill) {
@@ -1340,6 +1596,7 @@ int hci_unregister_dev(struct hci_dev *hdev)
         hci_unregister_sysfs(hdev);
 
         hci_del_off_timer(hdev);
+        del_timer(&hdev->adv_timer);
 
         destroy_workqueue(hdev->workqueue);
 
@@ -1348,6 +1605,7 @@ int hci_unregister_dev(struct hci_dev *hdev)
         hci_uuids_clear(hdev);
         hci_link_keys_clear(hdev);
         hci_remote_oob_data_clear(hdev);
+        hci_adv_entries_clear(hdev);
         hci_dev_unlock_bh(hdev);
 
         __hci_dev_put(hdev);
@@ -1891,7 +2149,7 @@ static inline void hci_sched_acl(struct hci_dev *hdev)
                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
                         BT_DBG("skb %p len %d", skb, skb->len);
 
-                        hci_conn_enter_active_mode(conn);
+                        hci_conn_enter_active_mode(conn, bt_cb(skb)->force_active);
 
                         hci_send_frame(skb);
                         hdev->acl_last_tx = jiffies;
@@ -2030,7 +2288,7 @@ static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
         if (conn) {
                 register struct hci_proto *hp;
 
-                hci_conn_enter_active_mode(conn);
+                hci_conn_enter_active_mode(conn, bt_cb(skb)->force_active);
 
                 /* Send to upper protocol */
                 hp = hci_proto[HCI_PROTO_L2CAP];
@@ -2156,7 +2414,10 @@ static void hci_cmd_task(unsigned long arg)
                 if (hdev->sent_cmd) {
                         atomic_dec(&hdev->cmd_cnt);
                         hci_send_frame(skb);
-                        mod_timer(&hdev->cmd_timer,
+                        if (test_bit(HCI_RESET, &hdev->flags))
+                                del_timer(&hdev->cmd_timer);
+                        else
+                                mod_timer(&hdev->cmd_timer,
                                   jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
                 } else {
                         skb_queue_head(&hdev->cmd_q, skb);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 77930aa522e..5a7074a7b5b 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -45,6 +45,8 @@
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 
+static int enable_le;
+
 /* Handle HCI Event packets */
 
 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
@@ -56,8 +58,8 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
         if (status)
                 return;
 
-        if (test_bit(HCI_MGMT, &hdev->flags) &&
-                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+        if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
+                        test_bit(HCI_MGMT, &hdev->flags))
                 mgmt_discovering(hdev->id, 0);
 
         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
@@ -74,8 +76,8 @@ static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
         if (status)
                 return;
 
-        if (test_bit(HCI_MGMT, &hdev->flags) &&
-                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+        if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
+                                test_bit(HCI_MGMT, &hdev->flags))
                 mgmt_discovering(hdev->id, 0);
 
         hci_conn_check_pending(hdev);
@@ -525,6 +527,20 @@ static void hci_setup_event_mask(struct hci_dev *hdev)
         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 }
 
+static void hci_set_le_support(struct hci_dev *hdev)
+{
+        struct hci_cp_write_le_host_supported cp;
+
+        memset(&cp, 0, sizeof(cp));
+
+        if (enable_le) {
+                cp.le = 1;
+                cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
+        }
+
+        hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp), &cp);
+}
+
 static void hci_setup(struct hci_dev *hdev)
 {
         hci_setup_event_mask(hdev);
@@ -542,6 +558,17 @@ static void hci_setup(struct hci_dev *hdev)
 
         if (hdev->features[7] & LMP_INQ_TX_PWR)
                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
+
+        if (hdev->features[7] & LMP_EXTFEATURES) {
+                struct hci_cp_read_local_ext_features cp;
+
+                cp.page = 0x01;
+                hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES,
+                                                        sizeof(cp), &cp);
+        }
+
+        if (hdev->features[4] & LMP_LE)
+                hci_set_le_support(hdev);
 }
 
 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
@@ -658,6 +685,21 @@ static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb
                                         hdev->features[6], hdev->features[7]);
 }
 
+static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
+                                                        struct sk_buff *skb)
+{
+        struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (rp->status)
+                return;
+
+        memcpy(hdev->extfeatures, rp->features, 8);
+
+        hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
+}
+
 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
@@ -841,6 +883,72 @@ static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
                                                 rp->randomizer, rp->status);
 }
 
+static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
+                                        struct sk_buff *skb)
+{
+        struct hci_cp_le_set_scan_enable *cp;
+        __u8 status = *((__u8 *) skb->data);
+
+        BT_DBG("%s status 0x%x", hdev->name, status);
+
+        if (status)
+                return;
+
+        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
+        if (!cp)
+                return;
+
+        hci_dev_lock(hdev);
+
+        if (cp->enable == 0x01) {
+                del_timer(&hdev->adv_timer);
+                hci_adv_entries_clear(hdev);
+        } else if (cp->enable == 0x00) {
+                mod_timer(&hdev->adv_timer, jiffies + ADV_CLEAR_TIMEOUT);
+        }
+
+        hci_dev_unlock(hdev);
+}
+
+static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (rp->status)
+                return;
+
+        hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
+}
+
+static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (rp->status)
+                return;
+
+        hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
+}
+
+static inline void hci_cc_write_le_host_supported(struct hci_dev *hdev,
+                                                        struct sk_buff *skb)
+{
+        struct hci_cp_read_local_ext_features cp;
+        __u8 status = *((__u8 *) skb->data);
+
+        BT_DBG("%s status 0x%x", hdev->name, status);
+
+        if (status)
+                return;
+
+        cp.page = 0x01;
+        hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp), &cp);
+}
+
 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
 {
         BT_DBG("%s status 0x%x", hdev->name, status);
@@ -851,9 +959,8 @@ static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
                 return;
         }
 
-        if (test_bit(HCI_MGMT, &hdev->flags) &&
-                                        !test_and_set_bit(HCI_INQUIRY,
-                                                        &hdev->flags))
+        if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags) &&
+                                test_bit(HCI_MGMT, &hdev->flags))
                 mgmt_discovering(hdev->id, 1);
 }
 
@@ -885,7 +992,7 @@ static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
                 }
         } else {
                 if (!conn) {
-                        conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
+                        conn = hci_conn_add(hdev, ACL_LINK, 0, &cp->bdaddr);
                         if (conn) {
                                 conn->out = 1;
                                 conn->link_mode |= HCI_LM_MASTER;
@@ -1208,25 +1315,32 @@ static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
                 }
         } else {
                 if (!conn) {
-                        conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
-                        if (conn)
+                        conn = hci_conn_add(hdev, LE_LINK, 0, &cp->peer_addr);
+                        if (conn) {
+                                conn->dst_type = cp->peer_addr_type;
                                 conn->out = 1;
-                        else
+                        } else {
                                 BT_ERR("No memory for new connection");
+                        }
                 }
         }
 
         hci_dev_unlock(hdev);
 }
 
+static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
+{
+        BT_DBG("%s status 0x%x", hdev->name, status);
+}
+
 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
 
         BT_DBG("%s status %d", hdev->name, status);
 
-        if (test_bit(HCI_MGMT, &hdev->flags) &&
-                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+        if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
+                                test_bit(HCI_MGMT, &hdev->flags))
                 mgmt_discovering(hdev->id, 0);
 
         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
@@ -1348,6 +1462,15 @@ unlock:
         hci_conn_check_pending(hdev);
 }
 
+static inline bool is_sco_active(struct hci_dev *hdev)
+{
+        if (hci_conn_hash_lookup_state(hdev, SCO_LINK, BT_CONNECTED) ||
+                        (hci_conn_hash_lookup_state(hdev, ESCO_LINK,
+                                                    BT_CONNECTED)))
+                return true;
+        return false;
+}
+
 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_conn_request *ev = (void *) skb->data;
@@ -1372,7 +1495,8 @@ static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *sk
 
                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
                 if (!conn) {
-                        conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
+                        /* pkt_type not yet used for incoming connections */
+                        conn = hci_conn_add(hdev, ev->link_type, 0, &ev->bdaddr);
                         if (!conn) {
                                 BT_ERR("No memory for new connection");
                                 hci_dev_unlock(hdev);
@@ -1390,7 +1514,8 @@ static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *sk
 
                         bacpy(&cp.bdaddr, &ev->bdaddr);
 
-                        if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
+                        if (lmp_rswitch_capable(hdev) && ((mask & HCI_LM_MASTER)
+                                                || is_sco_active(hdev)))
                                 cp.role = 0x00; /* Become master */
                         else
                                 cp.role = 0x01; /* Remain slave */
@@ -1462,51 +1587,58 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
-        if (conn) {
-                if (!ev->status) {
+        if (!conn)
+                goto unlock;
+
+        if (!ev->status) {
+                if (!(conn->ssp_mode > 0 && hdev->ssp_mode > 0) &&
+                                test_bit(HCI_CONN_REAUTH_PEND,  &conn->pend)) {
+                        BT_INFO("re-auth of legacy device is not possible.");
+                } else {
                         conn->link_mode |= HCI_LM_AUTH;
                         conn->sec_level = conn->pending_sec_level;
-                } else {
-                        mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
                 }
+        } else {
+                mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
+        }
 
-                clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
+        clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
+        clear_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
 
-                if (conn->state == BT_CONFIG) {
-                        if (!ev->status && hdev->ssp_mode > 0 &&
-                                                        conn->ssp_mode > 0) {
-                                struct hci_cp_set_conn_encrypt cp;
-                                cp.handle  = ev->handle;
-                                cp.encrypt = 0x01;
-                                hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
-                                                        sizeof(cp), &cp);
-                        } else {
-                                conn->state = BT_CONNECTED;
-                                hci_proto_connect_cfm(conn, ev->status);
-                                hci_conn_put(conn);
-                        }
+        if (conn->state == BT_CONFIG) {
+                if (!ev->status && hdev->ssp_mode > 0 && conn->ssp_mode > 0) {
+                        struct hci_cp_set_conn_encrypt cp;
+                        cp.handle  = ev->handle;
+                        cp.encrypt = 0x01;
+                        hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
+                                                                        &cp);
                 } else {
-                        hci_auth_cfm(conn, ev->status);
-
-                        hci_conn_hold(conn);
-                        conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+                        conn->state = BT_CONNECTED;
+                        hci_proto_connect_cfm(conn, ev->status);
                         hci_conn_put(conn);
                 }
+        } else {
+                hci_auth_cfm(conn, ev->status);
 
-                if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
-                        if (!ev->status) {
-                                struct hci_cp_set_conn_encrypt cp;
-                                cp.handle  = ev->handle;
-                                cp.encrypt = 0x01;
-                                hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
-                                                        sizeof(cp), &cp);
-                        } else {
-                                clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
-                                hci_encrypt_cfm(conn, ev->status, 0x00);
-                        }
+                hci_conn_hold(conn);
+                conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+                hci_conn_put(conn);
+        }
+
+        if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
+                if (!ev->status) {
+                        struct hci_cp_set_conn_encrypt cp;
+                        cp.handle  = ev->handle;
+                        cp.encrypt = 0x01;
+                        hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
+                                                                        &cp);
+                } else {
+                        clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
+                        hci_encrypt_cfm(conn, ev->status, 0x00);
                 }
         }
 
+unlock:
         hci_dev_unlock(hdev);
 }
 
@@ -1557,6 +1689,7 @@ static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *
                                 /* Encryption implies authentication */
                                 conn->link_mode |= HCI_LM_AUTH;
                                 conn->link_mode |= HCI_LM_ENCRYPT;
+                                conn->sec_level = conn->pending_sec_level;
                         } else
                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
                 }
@@ -1760,6 +1893,10 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
                 hci_cc_read_local_features(hdev, skb);
                 break;
 
+        case HCI_OP_READ_LOCAL_EXT_FEATURES:
+                hci_cc_read_local_ext_features(hdev, skb);
+                break;
+
         case HCI_OP_READ_BUFFER_SIZE:
                 hci_cc_read_buffer_size(hdev, skb);
                 break;
@@ -1816,6 +1953,22 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
                 hci_cc_user_confirm_neg_reply(hdev, skb);
                 break;
 
+        case HCI_OP_LE_SET_SCAN_ENABLE:
+                hci_cc_le_set_scan_enable(hdev, skb);
+                break;
+
+        case HCI_OP_LE_LTK_REPLY:
+                hci_cc_le_ltk_reply(hdev, skb);
+                break;
+
+        case HCI_OP_LE_LTK_NEG_REPLY:
+                hci_cc_le_ltk_neg_reply(hdev, skb);
+                break;
+
+        case HCI_OP_WRITE_LE_HOST_SUPPORTED:
+                hci_cc_write_le_host_supported(hdev, skb);
+                break;
+
         default:
                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
                 break;
@@ -1894,6 +2047,10 @@ static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cs_le_create_conn(hdev, ev->status);
                 break;
 
+        case HCI_OP_LE_START_ENC:
+                hci_cs_le_start_enc(hdev, ev->status);
+                break;
+
         default:
                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
                 break;
@@ -2333,6 +2490,7 @@ static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_bu
                 hci_conn_add_sysfs(conn);
                 break;
 
+        case 0x10:      /* Connection Accept Timeout */
         case 0x11:      /* Unsupported Feature or Parameter Value */
         case 0x1c:      /* SCO interval rejected */
         case 0x1a:      /* Unsupported Remote Feature */
@@ -2652,12 +2810,14 @@ static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff
 
         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
         if (!conn) {
-                conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
+                conn = hci_conn_add(hdev, LE_LINK, 0, &ev->bdaddr);
                 if (!conn) {
                         BT_ERR("No memory for new connection");
                         hci_dev_unlock(hdev);
                         return;
                 }
+
+                conn->dst_type = ev->bdaddr_type;
         }
 
         if (ev->status) {
@@ -2670,6 +2830,7 @@ static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff
 
         mgmt_connected(hdev->id, &ev->bdaddr);
 
+        conn->sec_level = BT_SECURITY_LOW;
         conn->handle = __le16_to_cpu(ev->handle);
         conn->state = BT_CONNECTED;
 
@@ -2682,6 +2843,64 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
+static inline void hci_le_adv_report_evt(struct hci_dev *hdev,
+                                                struct sk_buff *skb)
+{
+        struct hci_ev_le_advertising_info *ev;
+        u8 num_reports;
+
+        num_reports = skb->data[0];
+        ev = (void *) &skb->data[1];
+
+        hci_dev_lock(hdev);
+
+        hci_add_adv_entry(hdev, ev);
+
+        while (--num_reports) {
+                ev = (void *) (ev->data + ev->length + 1);
+                hci_add_adv_entry(hdev, ev);
+        }
+
+        hci_dev_unlock(hdev);
+}
+
+static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
+                                                struct sk_buff *skb)
+{
+        struct hci_ev_le_ltk_req *ev = (void *) skb->data;
+        struct hci_cp_le_ltk_reply cp;
+        struct hci_cp_le_ltk_neg_reply neg;
+        struct hci_conn *conn;
+        struct link_key *ltk;
+
+        BT_DBG("%s handle %d", hdev->name, cpu_to_le16(ev->handle));
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
+        if (conn == NULL)
+                goto not_found;
+
+        ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
+        if (ltk == NULL)
+                goto not_found;
+
+        memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
+        cp.handle = cpu_to_le16(conn->handle);
+        conn->pin_length = ltk->pin_len;
+
+        hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
+
+        hci_dev_unlock(hdev);
+
+        return;
+
+not_found:
+        neg.handle = ev->handle;
+        hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
+        hci_dev_unlock(hdev);
+}
+
 static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_le_meta *le_ev = (void *) skb->data;
@@ -2693,6 +2912,14 @@ static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_le_conn_complete_evt(hdev, skb);
                 break;
 
+        case HCI_EV_LE_ADVERTISING_REPORT:
+                hci_le_adv_report_evt(hdev, skb);
+                break;
+
+        case HCI_EV_LE_LTK_REQ:
+                hci_le_ltk_request_evt(hdev, skb);
+                break;
+
         default:
                 break;
         }
@@ -2886,3 +3113,6 @@ void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
         hci_send_to_sock(hdev, skb, NULL);
         kfree_skb(skb);
 }
+
+module_param(enable_le, bool, 0444);
+MODULE_PARM_DESC(enable_le, "Enable LE support");
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 295e4a88fff..ff02cf5e77c 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -180,82 +180,24 @@ static int hci_sock_release(struct socket *sock)
         return 0;
 }
 
-struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
-{
-        struct list_head *p;
-
-        list_for_each(p, &hdev->blacklist) {
-                struct bdaddr_list *b;
-
-                b = list_entry(p, struct bdaddr_list, list);
-
-                if (bacmp(bdaddr, &b->bdaddr) == 0)
-                        return b;
-        }
-
-        return NULL;
-}
-
-static int hci_blacklist_add(struct hci_dev *hdev, void __user *arg)
+static int hci_sock_blacklist_add(struct hci_dev *hdev, void __user *arg)
 {
         bdaddr_t bdaddr;
-        struct bdaddr_list *entry;
 
         if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
                 return -EFAULT;
 
-        if (bacmp(&bdaddr, BDADDR_ANY) == 0)
-                return -EBADF;
-
-        if (hci_blacklist_lookup(hdev, &bdaddr))
-                return -EEXIST;
-
-        entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
-        if (!entry)
-                return -ENOMEM;
-
-        bacpy(&entry->bdaddr, &bdaddr);
-
-        list_add(&entry->list, &hdev->blacklist);
-
-        return 0;
-}
-
-int hci_blacklist_clear(struct hci_dev *hdev)
-{
-        struct list_head *p, *n;
-
-        list_for_each_safe(p, n, &hdev->blacklist) {
-                struct bdaddr_list *b;
-
-                b = list_entry(p, struct bdaddr_list, list);
-
-                list_del(p);
-                kfree(b);
-        }
-
-        return 0;
+        return hci_blacklist_add(hdev, &bdaddr);
 }
 
-static int hci_blacklist_del(struct hci_dev *hdev, void __user *arg)
+static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg)
 {
         bdaddr_t bdaddr;
-        struct bdaddr_list *entry;
 
         if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
                 return -EFAULT;
 
-        if (bacmp(&bdaddr, BDADDR_ANY) == 0)
-                return hci_blacklist_clear(hdev);
-
-        entry = hci_blacklist_lookup(hdev, &bdaddr);
-        if (!entry)
-                return -ENOENT;
-
-        list_del(&entry->list);
-        kfree(entry);
-
-        return 0;
+        return hci_blacklist_del(hdev, &bdaddr);
 }
 
 /* Ioctls that require bound socket */
@@ -290,12 +232,12 @@ static inline int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, unsign
         case HCIBLOCKADDR:
                 if (!capable(CAP_NET_ADMIN))
                         return -EACCES;
-                return hci_blacklist_add(hdev, (void __user *) arg);
+                return hci_sock_blacklist_add(hdev, (void __user *) arg);
 
         case HCIUNBLOCKADDR:
                 if (!capable(CAP_NET_ADMIN))
                         return -EACCES;
-                return hci_blacklist_del(hdev, (void __user *) arg);
+                return hci_sock_blacklist_del(hdev, (void __user *) arg);
 
         default:
                 if (hdev->ioctl)
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 43b4c2deb7c..fb68f344c34 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -764,6 +764,7 @@ static int hidp_session(void *arg)
 
         up_write(&hidp_session_sem);
 
+        kfree(session->rd_data);
         kfree(session);
         return 0;
 }
@@ -841,7 +842,8 @@ static int hidp_setup_input(struct hidp_session *session,
 
         err = input_register_device(input);
         if (err < 0) {
-                hci_conn_put_device(session->conn);
+                input_free_device(input);
+                session->input = NULL;
                 return err;
         }
 
@@ -1044,8 +1046,12 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
         }
 
         err = hid_add_device(session->hid);
-        if (err < 0)
-                goto err_add_device;
+        if (err < 0) {
+                atomic_inc(&session->terminate);
+                wake_up_process(session->task);
+                up_write(&hidp_session_sem);
+                return err;
+        }
 
         if (session->input) {
                 hidp_send_ctrl_message(session,
@@ -1059,12 +1065,6 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
         up_write(&hidp_session_sem);
         return 0;
 
-err_add_device:
-        hid_destroy_device(session->hid);
-        session->hid = NULL;
-        atomic_inc(&session->terminate);
-        wake_up_process(session->task);
-
 unlink:
         hidp_del_timer(session);
 
@@ -1090,7 +1090,6 @@ purge:
 failed:
         up_write(&hidp_session_sem);
 
-        input_free_device(session->input);
         kfree(session);
         return err;
 }
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 7705e26e699..5a0ce738751 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -54,26 +54,39 @@
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 #include <net/bluetooth/l2cap.h>
+#include <net/bluetooth/smp.h>
 
 int disable_ertm;
 
 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
 static u8 l2cap_fixed_chan[8] = { 0x02, };
 
-static struct workqueue_struct *_busy_wq;
-
-LIST_HEAD(chan_list);
-DEFINE_RWLOCK(chan_list_lock);
-
-static void l2cap_busy_work(struct work_struct *work);
+static LIST_HEAD(chan_list);
+static DEFINE_RWLOCK(chan_list_lock);
 
 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
                                 u8 code, u8 ident, u16 dlen, void *data);
+static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
+                                                                void *data);
 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
+static void l2cap_send_disconn_req(struct l2cap_conn *conn,
+                                struct l2cap_chan *chan, int err);
 
 static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb);
 
 /* ---- L2CAP channels ---- */
+
+static inline void chan_hold(struct l2cap_chan *c)
+{
+        atomic_inc(&c->refcnt);
+}
+
+static inline void chan_put(struct l2cap_chan *c)
+{
+        if (atomic_dec_and_test(&c->refcnt))
+                kfree(c);
+}
+
 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid)
 {
         struct l2cap_chan *c;
@@ -204,6 +217,62 @@ static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
         return 0;
 }
 
+static void l2cap_set_timer(struct l2cap_chan *chan, struct timer_list *timer, long timeout)
+{
+        BT_DBG("chan %p state %d timeout %ld", chan->sk, chan->state, timeout);
+
+        if (!mod_timer(timer, jiffies + msecs_to_jiffies(timeout)))
+                chan_hold(chan);
+}
+
+static void l2cap_clear_timer(struct l2cap_chan *chan, struct timer_list *timer)
+{
+        BT_DBG("chan %p state %d", chan, chan->state);
+
+        if (timer_pending(timer) && del_timer(timer))
+                chan_put(chan);
+}
+
+static void l2cap_state_change(struct l2cap_chan *chan, int state)
+{
+        chan->state = state;
+        chan->ops->state_change(chan->data, state);
+}
+
+static void l2cap_chan_timeout(unsigned long arg)
+{
+        struct l2cap_chan *chan = (struct l2cap_chan *) arg;
+        struct sock *sk = chan->sk;
+        int reason;
+
+        BT_DBG("chan %p state %d", chan, chan->state);
+
+        bh_lock_sock(sk);
+
+        if (sock_owned_by_user(sk)) {
+                /* sk is owned by user. Try again later */
+                __set_chan_timer(chan, HZ / 5);
+                bh_unlock_sock(sk);
+                chan_put(chan);
+                return;
+        }
+
+        if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
+                reason = ECONNREFUSED;
+        else if (chan->state == BT_CONNECT &&
+                                        chan->sec_level != BT_SECURITY_SDP)
+                reason = ECONNREFUSED;
+        else
+                reason = ETIMEDOUT;
+
+        l2cap_chan_close(chan, reason);
+
+        bh_unlock_sock(sk);
+
+        chan->ops->close(chan->data);
+        chan_put(chan);
+}
+
 struct l2cap_chan *l2cap_chan_create(struct sock *sk)
 {
         struct l2cap_chan *chan;
@@ -218,6 +287,12 @@ struct l2cap_chan *l2cap_chan_create(struct sock *sk)
         list_add(&chan->global_l, &chan_list);
         write_unlock_bh(&chan_list_lock);
 
+        setup_timer(&chan->chan_timer, l2cap_chan_timeout, (unsigned long) chan);
+
+        chan->state = BT_OPEN;
+
+        atomic_set(&chan->refcnt, 1);
+
         return chan;
 }
 
@@ -227,13 +302,11 @@ void l2cap_chan_destroy(struct l2cap_chan *chan)
         list_del(&chan->global_l);
         write_unlock_bh(&chan_list_lock);
 
-        kfree(chan);
+        chan_put(chan);
 }
 
 static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 {
-        struct sock *sk = chan->sk;
-
         BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
                         chan->psm, chan->dcid);
 
@@ -241,7 +314,7 @@ static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 
         chan->conn = conn;
 
-        if (sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM) {
+        if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
                 if (conn->hcon->type == LE_LINK) {
                         /* LE connection */
                         chan->omtu = L2CAP_LE_DEFAULT_MTU;
@@ -252,7 +325,7 @@ static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
                         chan->scid = l2cap_alloc_cid(conn);
                         chan->omtu = L2CAP_DEFAULT_MTU;
                 }
-        } else if (sk->sk_type == SOCK_DGRAM) {
+        } else if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
                 /* Connectionless socket */
                 chan->scid = L2CAP_CID_CONN_LESS;
                 chan->dcid = L2CAP_CID_CONN_LESS;
@@ -264,20 +337,20 @@ static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
                 chan->omtu = L2CAP_DEFAULT_MTU;
         }
 
-        sock_hold(sk);
+        chan_hold(chan);
 
         list_add(&chan->list, &conn->chan_l);
 }
 
 /* Delete channel.
  * Must be called on the locked socket. */
-void l2cap_chan_del(struct l2cap_chan *chan, int err)
+static void l2cap_chan_del(struct l2cap_chan *chan, int err)
 {
         struct sock *sk = chan->sk;
         struct l2cap_conn *conn = chan->conn;
         struct sock *parent = bt_sk(sk)->parent;
 
-        l2cap_sock_clear_timer(sk);
+        __clear_chan_timer(chan);
 
         BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
 
@@ -286,13 +359,13 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
                 write_lock_bh(&conn->chan_lock);
                 list_del(&chan->list);
                 write_unlock_bh(&conn->chan_lock);
-                __sock_put(sk);
+                chan_put(chan);
 
                 chan->conn = NULL;
                 hci_conn_put(conn->hcon);
         }
 
-        sk->sk_state = BT_CLOSED;
+        l2cap_state_change(chan, BT_CLOSED);
         sock_set_flag(sk, SOCK_ZAPPED);
 
         if (err)
@@ -304,8 +377,8 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
         } else
                 sk->sk_state_change(sk);
 
-        if (!(chan->conf_state & L2CAP_CONF_OUTPUT_DONE &&
-                        chan->conf_state & L2CAP_CONF_INPUT_DONE))
+        if (!(test_bit(CONF_OUTPUT_DONE, &chan->conf_state) &&
+                        test_bit(CONF_INPUT_DONE, &chan->conf_state)))
                 return;
 
         skb_queue_purge(&chan->tx_q);
@@ -313,12 +386,11 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
         if (chan->mode == L2CAP_MODE_ERTM) {
                 struct srej_list *l, *tmp;
 
-                del_timer(&chan->retrans_timer);
-                del_timer(&chan->monitor_timer);
-                del_timer(&chan->ack_timer);
+                __clear_retrans_timer(chan);
+                __clear_monitor_timer(chan);
+                __clear_ack_timer(chan);
 
                 skb_queue_purge(&chan->srej_q);
-                skb_queue_purge(&chan->busy_q);
 
                 list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
                         list_del(&l->list);
@@ -327,11 +399,86 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
         }
 }
 
-static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
+static void l2cap_chan_cleanup_listen(struct sock *parent)
 {
+        struct sock *sk;
+
+        BT_DBG("parent %p", parent);
+
+        /* Close not yet accepted channels */
+        while ((sk = bt_accept_dequeue(parent, NULL))) {
+                struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+                __clear_chan_timer(chan);
+                lock_sock(sk);
+                l2cap_chan_close(chan, ECONNRESET);
+                release_sock(sk);
+                chan->ops->close(chan->data);
+        }
+}
+
+void l2cap_chan_close(struct l2cap_chan *chan, int reason)
+{
+        struct l2cap_conn *conn = chan->conn;
         struct sock *sk = chan->sk;
 
-        if (sk->sk_type == SOCK_RAW) {
+        BT_DBG("chan %p state %d socket %p", chan, chan->state, sk->sk_socket);
+
+        switch (chan->state) {
+        case BT_LISTEN:
+                l2cap_chan_cleanup_listen(sk);
+
+                l2cap_state_change(chan, BT_CLOSED);
+                sock_set_flag(sk, SOCK_ZAPPED);
+                break;
+
+        case BT_CONNECTED:
+        case BT_CONFIG:
+                if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
+                                        conn->hcon->type == ACL_LINK) {
+                        __clear_chan_timer(chan);
+                        __set_chan_timer(chan, sk->sk_sndtimeo);
+                        l2cap_send_disconn_req(conn, chan, reason);
+                } else
+                        l2cap_chan_del(chan, reason);
+                break;
+
+        case BT_CONNECT2:
+                if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
+                                        conn->hcon->type == ACL_LINK) {
+                        struct l2cap_conn_rsp rsp;
+                        __u16 result;
+
+                        if (bt_sk(sk)->defer_setup)
+                                result = L2CAP_CR_SEC_BLOCK;
+                        else
+                                result = L2CAP_CR_BAD_PSM;
+                        l2cap_state_change(chan, BT_DISCONN);
+
+                        rsp.scid   = cpu_to_le16(chan->dcid);
+                        rsp.dcid   = cpu_to_le16(chan->scid);
+                        rsp.result = cpu_to_le16(result);
+                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
+                        l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
+                                                        sizeof(rsp), &rsp);
+                }
+
+                l2cap_chan_del(chan, reason);
+                break;
+
+        case BT_CONNECT:
+        case BT_DISCONN:
+                l2cap_chan_del(chan, reason);
+                break;
+
+        default:
+                sock_set_flag(sk, SOCK_ZAPPED);
+                break;
+        }
+}
+
+static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
+{
+        if (chan->chan_type == L2CAP_CHAN_RAW) {
                 switch (chan->sec_level) {
                 case BT_SECURITY_HIGH:
                         return HCI_AT_DEDICATED_BONDING_MITM;
@@ -371,7 +518,7 @@ static inline int l2cap_check_security(struct l2cap_chan *chan)
         return hci_conn_security(conn->hcon, chan->sec_level, auth_type);
 }
 
-u8 l2cap_get_ident(struct l2cap_conn *conn)
+static u8 l2cap_get_ident(struct l2cap_conn *conn)
 {
         u8 id;
 
@@ -393,7 +540,7 @@ u8 l2cap_get_ident(struct l2cap_conn *conn)
         return id;
 }
 
-void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
+static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
 {
         struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
         u8 flags;
@@ -408,6 +555,8 @@ void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *d
         else
                 flags = ACL_START;
 
+        bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
+
         hci_send_acl(conn->hcon, skb, flags);
 }
 
@@ -415,13 +564,11 @@ static inline void l2cap_send_sframe(struct l2cap_chan *chan, u16 control)
 {
         struct sk_buff *skb;
         struct l2cap_hdr *lh;
-        struct l2cap_pinfo *pi = l2cap_pi(chan->sk);
         struct l2cap_conn *conn = chan->conn;
-        struct sock *sk = (struct sock *)pi;
         int count, hlen = L2CAP_HDR_SIZE + 2;
         u8 flags;
 
-        if (sk->sk_state != BT_CONNECTED)
+        if (chan->state != BT_CONNECTED)
                 return;
 
         if (chan->fcs == L2CAP_FCS_CRC16)
@@ -432,15 +579,11 @@ static inline void l2cap_send_sframe(struct l2cap_chan *chan, u16 control)
         count = min_t(unsigned int, conn->mtu, hlen);
         control |= L2CAP_CTRL_FRAME_TYPE;
 
-        if (chan->conn_state & L2CAP_CONN_SEND_FBIT) {
+        if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
                 control |= L2CAP_CTRL_FINAL;
-                chan->conn_state &= ~L2CAP_CONN_SEND_FBIT;
-        }
 
-        if (chan->conn_state & L2CAP_CONN_SEND_PBIT) {
+        if (test_and_clear_bit(CONN_SEND_PBIT, &chan->conn_state))
                 control |= L2CAP_CTRL_POLL;
-                chan->conn_state &= ~L2CAP_CONN_SEND_PBIT;
-        }
 
         skb = bt_skb_alloc(count, GFP_ATOMIC);
         if (!skb)
@@ -461,14 +604,16 @@ static inline void l2cap_send_sframe(struct l2cap_chan *chan, u16 control)
         else
                 flags = ACL_START;
 
+        bt_cb(skb)->force_active = chan->force_active;
+
         hci_send_acl(chan->conn->hcon, skb, flags);
 }
 
 static inline void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, u16 control)
 {
-        if (chan->conn_state & L2CAP_CONN_LOCAL_BUSY) {
+        if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
                 control |= L2CAP_SUPER_RCV_NOT_READY;
-                chan->conn_state |= L2CAP_CONN_RNR_SENT;
+                set_bit(CONN_RNR_SENT, &chan->conn_state);
         } else
                 control |= L2CAP_SUPER_RCV_READY;
 
@@ -479,7 +624,7 @@ static inline void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, u16 control)
 
 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
 {
-        return !(chan->conf_state & L2CAP_CONF_CONNECT_PEND);
+        return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
 }
 
 static void l2cap_do_start(struct l2cap_chan *chan)
@@ -497,7 +642,7 @@ static void l2cap_do_start(struct l2cap_chan *chan)
                         req.psm  = chan->psm;
 
                         chan->ident = l2cap_get_ident(conn);
-                        chan->conf_state |= L2CAP_CONF_CONNECT_PEND;
+                        set_bit(CONF_CONNECT_PEND, &chan->conf_state);
 
                         l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ,
                                                         sizeof(req), &req);
@@ -533,7 +678,7 @@ static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
         }
 }
 
-void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err)
+static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err)
 {
         struct sock *sk;
         struct l2cap_disconn_req req;
@@ -544,9 +689,9 @@ void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, in
         sk = chan->sk;
 
         if (chan->mode == L2CAP_MODE_ERTM) {
-                del_timer(&chan->retrans_timer);
-                del_timer(&chan->monitor_timer);
-                del_timer(&chan->ack_timer);
+                __clear_retrans_timer(chan);
+                __clear_monitor_timer(chan);
+                __clear_ack_timer(chan);
         }
 
         req.dcid = cpu_to_le16(chan->dcid);
@@ -554,7 +699,7 @@ void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, in
         l2cap_send_cmd(conn, l2cap_get_ident(conn),
                         L2CAP_DISCONN_REQ, sizeof(req), &req);
 
-        sk->sk_state = BT_DISCONN;
+        l2cap_state_change(chan, BT_DISCONN);
         sk->sk_err = err;
 }
 
@@ -572,13 +717,12 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
 
                 bh_lock_sock(sk);
 
-                if (sk->sk_type != SOCK_SEQPACKET &&
-                                sk->sk_type != SOCK_STREAM) {
+                if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
                         bh_unlock_sock(sk);
                         continue;
                 }
 
-                if (sk->sk_state == BT_CONNECT) {
+                if (chan->state == BT_CONNECT) {
                         struct l2cap_conn_req req;
 
                         if (!l2cap_check_security(chan) ||
@@ -587,15 +731,14 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
                                 continue;
                         }
 
-                        if (!l2cap_mode_supported(chan->mode,
-                                        conn->feat_mask)
-                                        && chan->conf_state &
-                                        L2CAP_CONF_STATE2_DEVICE) {
-                                /* __l2cap_sock_close() calls list_del(chan)
+                        if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
+                                        && test_bit(CONF_STATE2_DEVICE,
+                                        &chan->conf_state)) {
+                                /* l2cap_chan_close() calls list_del(chan)
                                  * so release the lock */
-                                read_unlock_bh(&conn->chan_lock);
-                                 __l2cap_sock_close(sk, ECONNRESET);
-                                read_lock_bh(&conn->chan_lock);
+                                read_unlock(&conn->chan_lock);
+                                l2cap_chan_close(chan, ECONNRESET);
+                                read_lock(&conn->chan_lock);
                                 bh_unlock_sock(sk);
                                 continue;
                         }
@@ -604,12 +747,12 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
                         req.psm  = chan->psm;
 
                         chan->ident = l2cap_get_ident(conn);
-                        chan->conf_state |= L2CAP_CONF_CONNECT_PEND;
+                        set_bit(CONF_CONNECT_PEND, &chan->conf_state);
 
                         l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ,
                                                         sizeof(req), &req);
 
-                } else if (sk->sk_state == BT_CONNECT2) {
+                } else if (chan->state == BT_CONNECT2) {
                         struct l2cap_conn_rsp rsp;
                         char buf[128];
                         rsp.scid = cpu_to_le16(chan->dcid);
@@ -624,7 +767,7 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
                                                 parent->sk_data_ready(parent, 0);
 
                                 } else {
-                                        sk->sk_state = BT_CONFIG;
+                                        l2cap_state_change(chan, BT_CONFIG);
                                         rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
                                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
                                 }
@@ -636,13 +779,13 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
                         l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
                                                         sizeof(rsp), &rsp);
 
-                        if (chan->conf_state & L2CAP_CONF_REQ_SENT ||
+                        if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
                                         rsp.result != L2CAP_CR_SUCCESS) {
                                 bh_unlock_sock(sk);
                                 continue;
                         }
 
-                        chan->conf_state |= L2CAP_CONF_REQ_SENT;
+                        set_bit(CONF_REQ_SENT, &chan->conf_state);
                         l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
                                                 l2cap_build_conf_req(chan, buf), buf);
                         chan->num_conf_req++;
@@ -666,7 +809,7 @@ static struct l2cap_chan *l2cap_global_chan_by_scid(int state, __le16 cid, bdadd
         list_for_each_entry(c, &chan_list, global_l) {
                 struct sock *sk = c->sk;
 
-                if (state && sk->sk_state != state)
+                if (state && c->state != state)
                         continue;
 
                 if (c->scid == cid) {
@@ -710,24 +853,16 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)
                 goto clean;
         }
 
-        sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, GFP_ATOMIC);
-        if (!sk)
-                goto clean;
-
-        chan = l2cap_chan_create(sk);
-        if (!chan) {
-                l2cap_sock_kill(sk);
+        chan = pchan->ops->new_connection(pchan->data);
+        if (!chan)
                 goto clean;
-        }
 
-        l2cap_pi(sk)->chan = chan;
+        sk = chan->sk;
 
         write_lock_bh(&conn->chan_lock);
 
         hci_conn_hold(conn->hcon);
 
-        l2cap_sock_init(sk, parent);
-
         bacpy(&bt_sk(sk)->src, conn->src);
         bacpy(&bt_sk(sk)->dst, conn->dst);
 
@@ -735,9 +870,9 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)
 
         __l2cap_chan_add(conn, chan);
 
-        l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
+        __set_chan_timer(chan, sk->sk_sndtimeo);
 
-        sk->sk_state = BT_CONNECTED;
+        l2cap_state_change(chan, BT_CONNECTED);
         parent->sk_data_ready(parent, 0);
 
         write_unlock_bh(&conn->chan_lock);
@@ -746,6 +881,23 @@ clean:
         bh_unlock_sock(parent);
 }
 
+static void l2cap_chan_ready(struct sock *sk)
+{
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        struct sock *parent = bt_sk(sk)->parent;
+
+        BT_DBG("sk %p, parent %p", sk, parent);
+
+        chan->conf_state = 0;
+        __clear_chan_timer(chan);
+
+        l2cap_state_change(chan, BT_CONNECTED);
+        sk->sk_state_change(sk);
+
+        if (parent)
+                parent->sk_data_ready(parent, 0);
+}
+
 static void l2cap_conn_ready(struct l2cap_conn *conn)
 {
         struct l2cap_chan *chan;
@@ -763,17 +915,15 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
                 bh_lock_sock(sk);
 
                 if (conn->hcon->type == LE_LINK) {
-                        l2cap_sock_clear_timer(sk);
-                        sk->sk_state = BT_CONNECTED;
-                        sk->sk_state_change(sk);
-                }
+                        if (smp_conn_security(conn, chan->sec_level))
+                                l2cap_chan_ready(sk);
 
-                if (sk->sk_type != SOCK_SEQPACKET &&
-                                sk->sk_type != SOCK_STREAM) {
-                        l2cap_sock_clear_timer(sk);
-                        sk->sk_state = BT_CONNECTED;
+                } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
+                        __clear_chan_timer(chan);
+                        l2cap_state_change(chan, BT_CONNECTED);
                         sk->sk_state_change(sk);
-                } else if (sk->sk_state == BT_CONNECT)
+
+                } else if (chan->state == BT_CONNECT)
                         l2cap_do_start(chan);
 
                 bh_unlock_sock(sk);
@@ -811,6 +961,45 @@ static void l2cap_info_timeout(unsigned long arg)
         l2cap_conn_start(conn);
 }
 
+static void l2cap_conn_del(struct hci_conn *hcon, int err)
+{
+        struct l2cap_conn *conn = hcon->l2cap_data;
+        struct l2cap_chan *chan, *l;
+        struct sock *sk;
+
+        if (!conn)
+                return;
+
+        BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
+
+        kfree_skb(conn->rx_skb);
+
+        /* Kill channels */
+        list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
+                sk = chan->sk;
+                bh_lock_sock(sk);
+                l2cap_chan_del(chan, err);
+                bh_unlock_sock(sk);
+                chan->ops->close(chan->data);
+        }
+
+        if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
+                del_timer_sync(&conn->info_timer);
+
+        if (test_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend))
+                del_timer(&conn->security_timer);
+
+        hcon->l2cap_data = NULL;
+        kfree(conn);
+}
+
+static void security_timeout(unsigned long arg)
+{
+        struct l2cap_conn *conn = (void *) arg;
+
+        l2cap_conn_del(conn->hcon, ETIMEDOUT);
+}
+
 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
 {
         struct l2cap_conn *conn = hcon->l2cap_data;
@@ -842,7 +1031,10 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
 
         INIT_LIST_HEAD(&conn->chan_l);
 
-        if (hcon->type != LE_LINK)
+        if (hcon->type == LE_LINK)
+                setup_timer(&conn->security_timer, security_timeout,
+                                                (unsigned long) conn);
+        else
                 setup_timer(&conn->info_timer, l2cap_info_timeout,
                                                 (unsigned long) conn);
 
@@ -851,35 +1043,6 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
         return conn;
 }
 
-static void l2cap_conn_del(struct hci_conn *hcon, int err)
-{
-        struct l2cap_conn *conn = hcon->l2cap_data;
-        struct l2cap_chan *chan, *l;
-        struct sock *sk;
-
-        if (!conn)
-                return;
-
-        BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
-
-        kfree_skb(conn->rx_skb);
-
-        /* Kill channels */
-        list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
-                sk = chan->sk;
-                bh_lock_sock(sk);
-                l2cap_chan_del(chan, err);
-                bh_unlock_sock(sk);
-                l2cap_sock_kill(sk);
-        }
-
-        if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
-                del_timer_sync(&conn->info_timer);
-
-        hcon->l2cap_data = NULL;
-        kfree(conn);
-}
-
 static inline void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 {
         write_lock_bh(&conn->chan_lock);
@@ -901,7 +1064,7 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, bdaddr
         list_for_each_entry(c, &chan_list, global_l) {
                 struct sock *sk = c->sk;
 
-                if (state && sk->sk_state != state)
+                if (state && c->state != state)
                         continue;
 
                 if (c->psm == psm) {
@@ -945,10 +1108,10 @@ int l2cap_chan_connect(struct l2cap_chan *chan)
         auth_type = l2cap_get_auth_type(chan);
 
         if (chan->dcid == L2CAP_CID_LE_DATA)
-                hcon = hci_connect(hdev, LE_LINK, dst,
+                hcon = hci_connect(hdev, LE_LINK, 0, dst,
                                         chan->sec_level, auth_type);
         else
-                hcon = hci_connect(hdev, ACL_LINK, dst,
+                hcon = hci_connect(hdev, ACL_LINK, 0, dst,
                                         chan->sec_level, auth_type);
 
         if (IS_ERR(hcon)) {
@@ -968,15 +1131,14 @@ int l2cap_chan_connect(struct l2cap_chan *chan)
 
         l2cap_chan_add(conn, chan);
 
-        sk->sk_state = BT_CONNECT;
-        l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
+        l2cap_state_change(chan, BT_CONNECT);
+        __set_chan_timer(chan, sk->sk_sndtimeo);
 
         if (hcon->state == BT_CONNECTED) {
-                if (sk->sk_type != SOCK_SEQPACKET &&
-                                sk->sk_type != SOCK_STREAM) {
-                        l2cap_sock_clear_timer(sk);
+                if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
+                        __clear_chan_timer(chan);
                         if (l2cap_check_security(chan))
-                                sk->sk_state = BT_CONNECTED;
+                                l2cap_state_change(chan, BT_CONNECTED);
                 } else
                         l2cap_do_start(chan);
         }
@@ -997,9 +1159,8 @@ int __l2cap_wait_ack(struct sock *sk)
         int timeo = HZ/5;
 
         add_wait_queue(sk_sleep(sk), &wait);
-        while ((chan->unacked_frames > 0 && chan->conn)) {
-                set_current_state(TASK_INTERRUPTIBLE);
-
+        set_current_state(TASK_INTERRUPTIBLE);
+        while (chan->unacked_frames > 0 && chan->conn) {
                 if (!timeo)
                         timeo = HZ/5;
 
@@ -1011,6 +1172,7 @@ int __l2cap_wait_ack(struct sock *sk)
                 release_sock(sk);
                 timeo = schedule_timeout(timeo);
                 lock_sock(sk);
+                set_current_state(TASK_INTERRUPTIBLE);
 
                 err = sock_error(sk);
                 if (err)
@@ -1036,7 +1198,7 @@ static void l2cap_monitor_timeout(unsigned long arg)
         }
 
         chan->retry_count++;
-        __mod_monitor_timer();
+        __set_monitor_timer(chan);
 
         l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
         bh_unlock_sock(sk);
@@ -1051,9 +1213,9 @@ static void l2cap_retrans_timeout(unsigned long arg)
 
         bh_lock_sock(sk);
         chan->retry_count = 1;
-        __mod_monitor_timer();
+        __set_monitor_timer(chan);
 
-        chan->conn_state |= L2CAP_CONN_WAIT_F;
+        set_bit(CONN_WAIT_F, &chan->conn_state);
 
         l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
         bh_unlock_sock(sk);
@@ -1075,7 +1237,7 @@ static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
         }
 
         if (!chan->unacked_frames)
-                del_timer(&chan->retrans_timer);
+                __clear_retrans_timer(chan);
 }
 
 void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
@@ -1090,6 +1252,7 @@ void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
         else
                 flags = ACL_START;
 
+        bt_cb(skb)->force_active = chan->force_active;
         hci_send_acl(hcon, skb, flags);
 }
 
@@ -1143,10 +1306,8 @@ static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u8 tx_seq)
         control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
         control &= L2CAP_CTRL_SAR;
 
-        if (chan->conn_state & L2CAP_CONN_SEND_FBIT) {
+        if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
                 control |= L2CAP_CTRL_FINAL;
-                chan->conn_state &= ~L2CAP_CONN_SEND_FBIT;
-        }
 
         control |= (chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
                         | (tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
@@ -1164,11 +1325,10 @@ static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u8 tx_seq)
 int l2cap_ertm_send(struct l2cap_chan *chan)
 {
         struct sk_buff *skb, *tx_skb;
-        struct sock *sk = chan->sk;
         u16 control, fcs;
         int nsent = 0;
 
-        if (sk->sk_state != BT_CONNECTED)
+        if (chan->state != BT_CONNECTED)
                 return -ENOTCONN;
 
         while ((skb = chan->tx_send_head) && (!l2cap_tx_window_full(chan))) {
@@ -1186,10 +1346,9 @@ int l2cap_ertm_send(struct l2cap_chan *chan)
                 control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
                 control &= L2CAP_CTRL_SAR;
 
-                if (chan->conn_state & L2CAP_CONN_SEND_FBIT) {
+                if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
                         control |= L2CAP_CTRL_FINAL;
-                        chan->conn_state &= ~L2CAP_CONN_SEND_FBIT;
-                }
+
                 control |= (chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
                                 | (chan->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
                 put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
@@ -1202,7 +1361,7 @@ int l2cap_ertm_send(struct l2cap_chan *chan)
 
                 l2cap_do_send(chan, tx_skb);
 
-                __mod_retrans_timer();
+                __set_retrans_timer(chan);
 
                 bt_cb(skb)->tx_seq = chan->next_tx_seq;
                 chan->next_tx_seq = (chan->next_tx_seq + 1) % 64;
@@ -1241,9 +1400,9 @@ static void l2cap_send_ack(struct l2cap_chan *chan)
 
         control |= chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
 
-        if (chan->conn_state & L2CAP_CONN_LOCAL_BUSY) {
+        if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
                 control |= L2CAP_SUPER_RCV_NOT_READY;
-                chan->conn_state |= L2CAP_CONN_RNR_SENT;
+                set_bit(CONN_RNR_SENT, &chan->conn_state);
                 l2cap_send_sframe(chan, control);
                 return;
         }
@@ -1451,28 +1610,83 @@ int l2cap_sar_segment_sdu(struct l2cap_chan *chan, struct msghdr *msg, size_t le
         return size;
 }
 
-static void l2cap_chan_ready(struct sock *sk)
+int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
 {
-        struct sock *parent = bt_sk(sk)->parent;
-        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        struct sk_buff *skb;
+        u16 control;
+        int err;
 
-        BT_DBG("sk %p, parent %p", sk, parent);
+        /* Connectionless channel */
+        if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
+                skb = l2cap_create_connless_pdu(chan, msg, len);
+                if (IS_ERR(skb))
+                        return PTR_ERR(skb);
 
-        chan->conf_state = 0;
-        l2cap_sock_clear_timer(sk);
+                l2cap_do_send(chan, skb);
+                return len;
+        }
 
-        if (!parent) {
-                /* Outgoing channel.
-                 * Wake up socket sleeping on connect.
-                 */
-                sk->sk_state = BT_CONNECTED;
-                sk->sk_state_change(sk);
-        } else {
-                /* Incoming channel.
-                 * Wake up socket sleeping on accept.
-                 */
-                parent->sk_data_ready(parent, 0);
+        switch (chan->mode) {
+        case L2CAP_MODE_BASIC:
+                /* Check outgoing MTU */
+                if (len > chan->omtu)
+                        return -EMSGSIZE;
+
+                /* Create a basic PDU */
+                skb = l2cap_create_basic_pdu(chan, msg, len);
+                if (IS_ERR(skb))
+                        return PTR_ERR(skb);
+
+                l2cap_do_send(chan, skb);
+                err = len;
+                break;
+
+        case L2CAP_MODE_ERTM:
+        case L2CAP_MODE_STREAMING:
+                /* Entire SDU fits into one PDU */
+                if (len <= chan->remote_mps) {
+                        control = L2CAP_SDU_UNSEGMENTED;
+                        skb = l2cap_create_iframe_pdu(chan, msg, len, control,
+                                                                        0);
+                        if (IS_ERR(skb))
+                                return PTR_ERR(skb);
+
+                        __skb_queue_tail(&chan->tx_q, skb);
+
+                        if (chan->tx_send_head == NULL)
+                                chan->tx_send_head = skb;
+
+                } else {
+                        /* Segment SDU into multiples PDUs */
+                        err = l2cap_sar_segment_sdu(chan, msg, len);
+                        if (err < 0)
+                                return err;
+                }
+
+                if (chan->mode == L2CAP_MODE_STREAMING) {
+                        l2cap_streaming_send(chan);
+                        err = len;
+                        break;
+                }
+
+                if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
+                                test_bit(CONN_WAIT_F, &chan->conn_state)) {
+                        err = len;
+                        break;
+                }
+
+                err = l2cap_ertm_send(chan);
+                if (err >= 0)
+                        err = len;
+
+                break;
+
+        default:
+                BT_DBG("bad state %1.1x", chan->mode);
+                err = -EBADFD;
         }
+
+        return err;
 }
 
 /* Copy frame to all raw sockets on that connection */
@@ -1486,7 +1700,7 @@ static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
         read_lock(&conn->chan_lock);
         list_for_each_entry(chan, &conn->chan_l, list) {
                 struct sock *sk = chan->sk;
-                if (sk->sk_type != SOCK_RAW)
+                if (chan->chan_type != L2CAP_CHAN_RAW)
                         continue;
 
                 /* Don't send frame to the socket it came from */
@@ -1496,7 +1710,7 @@ static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
                 if (!nskb)
                         continue;
 
-                if (sock_queue_rcv_skb(sk, nskb))
+                if (chan->ops->recv(chan->data, nskb))
                         kfree_skb(nskb);
         }
         read_unlock(&conn->chan_lock);
@@ -1655,11 +1869,9 @@ static inline void l2cap_ertm_init(struct l2cap_chan *chan)
         setup_timer(&chan->ack_timer, l2cap_ack_timeout, (unsigned long) chan);
 
         skb_queue_head_init(&chan->srej_q);
-        skb_queue_head_init(&chan->busy_q);
 
         INIT_LIST_HEAD(&chan->srej_l);
 
-        INIT_WORK(&chan->busy_work, l2cap_busy_work);
 
         sk->sk_backlog_rcv = l2cap_ertm_data_rcv;
 }
@@ -1691,7 +1903,7 @@ static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
         switch (chan->mode) {
         case L2CAP_MODE_STREAMING:
         case L2CAP_MODE_ERTM:
-                if (chan->conf_state & L2CAP_CONF_STATE2_DEVICE)
+                if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
                         break;
 
                 /* fall through */
@@ -1738,7 +1950,7 @@ done:
                         break;
 
                 if (chan->fcs == L2CAP_FCS_NONE ||
-                                chan->conf_state & L2CAP_CONF_NO_FCS_RECV) {
+                                test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
                         chan->fcs = L2CAP_FCS_NONE;
                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
                 }
@@ -1761,7 +1973,7 @@ done:
                         break;
 
                 if (chan->fcs == L2CAP_FCS_NONE ||
-                                chan->conf_state & L2CAP_CONF_NO_FCS_RECV) {
+                                test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
                         chan->fcs = L2CAP_FCS_NONE;
                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
                 }
@@ -1813,7 +2025,7 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
 
                 case L2CAP_CONF_FCS:
                         if (val == L2CAP_FCS_NONE)
-                                chan->conf_state |= L2CAP_CONF_NO_FCS_RECV;
+                                set_bit(CONF_NO_FCS_RECV, &chan->conf_state);
 
                         break;
 
@@ -1833,7 +2045,7 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
         switch (chan->mode) {
         case L2CAP_MODE_STREAMING:
         case L2CAP_MODE_ERTM:
-                if (!(chan->conf_state & L2CAP_CONF_STATE2_DEVICE)) {
+                if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
                         chan->mode = l2cap_select_mode(rfc.mode,
                                         chan->conn->feat_mask);
                         break;
@@ -1866,14 +2078,14 @@ done:
                         result = L2CAP_CONF_UNACCEPT;
                 else {
                         chan->omtu = mtu;
-                        chan->conf_state |= L2CAP_CONF_MTU_DONE;
+                        set_bit(CONF_MTU_DONE, &chan->conf_state);
                 }
                 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
 
                 switch (rfc.mode) {
                 case L2CAP_MODE_BASIC:
                         chan->fcs = L2CAP_FCS_NONE;
-                        chan->conf_state |= L2CAP_CONF_MODE_DONE;
+                        set_bit(CONF_MODE_DONE, &chan->conf_state);
                         break;
 
                 case L2CAP_MODE_ERTM:
@@ -1890,7 +2102,7 @@ done:
                         rfc.monitor_timeout =
                                 le16_to_cpu(L2CAP_DEFAULT_MONITOR_TO);
 
-                        chan->conf_state |= L2CAP_CONF_MODE_DONE;
+                        set_bit(CONF_MODE_DONE, &chan->conf_state);
 
                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
                                         sizeof(rfc), (unsigned long) &rfc);
@@ -1903,7 +2115,7 @@ done:
 
                         chan->remote_mps = le16_to_cpu(rfc.max_pdu_size);
 
-                        chan->conf_state |= L2CAP_CONF_MODE_DONE;
+                        set_bit(CONF_MODE_DONE, &chan->conf_state);
 
                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
                                         sizeof(rfc), (unsigned long) &rfc);
@@ -1918,7 +2130,7 @@ done:
                 }
 
                 if (result == L2CAP_CONF_SUCCESS)
-                        chan->conf_state |= L2CAP_CONF_OUTPUT_DONE;
+                        set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
         }
         rsp->scid   = cpu_to_le16(chan->dcid);
         rsp->result = cpu_to_le16(result);
@@ -1960,7 +2172,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, voi
                         if (olen == sizeof(rfc))
                                 memcpy(&rfc, (void *)val, olen);
 
-                        if ((chan->conf_state & L2CAP_CONF_STATE2_DEVICE) &&
+                        if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
                                                         rfc.mode != chan->mode)
                                 return -ECONNREFUSED;
 
@@ -2022,10 +2234,9 @@ void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
         l2cap_send_cmd(conn, chan->ident,
                                 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 
-        if (chan->conf_state & L2CAP_CONF_REQ_SENT)
+        if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
                 return;
 
-        chan->conf_state |= L2CAP_CONF_REQ_SENT;
         l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
                         l2cap_build_conf_req(chan, buf), buf);
         chan->num_conf_req++;
@@ -2125,17 +2336,11 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
                 goto response;
         }
 
-        sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, GFP_ATOMIC);
-        if (!sk)
-                goto response;
-
-        chan = l2cap_chan_create(sk);
-        if (!chan) {
-                l2cap_sock_kill(sk);
+        chan = pchan->ops->new_connection(pchan->data);
+        if (!chan)
                 goto response;
-        }
 
-        l2cap_pi(sk)->chan = chan;
+        sk = chan->sk;
 
         write_lock_bh(&conn->chan_lock);
 
@@ -2143,13 +2348,12 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
         if (__l2cap_get_chan_by_dcid(conn, scid)) {
                 write_unlock_bh(&conn->chan_lock);
                 sock_set_flag(sk, SOCK_ZAPPED);
-                l2cap_sock_kill(sk);
+                chan->ops->close(chan->data);
                 goto response;
         }
 
         hci_conn_hold(conn->hcon);
 
-        l2cap_sock_init(sk, parent);
         bacpy(&bt_sk(sk)->src, conn->src);
         bacpy(&bt_sk(sk)->dst, conn->dst);
         chan->psm  = psm;
@@ -2161,29 +2365,29 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
 
         dcid = chan->scid;
 
-        l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
+        __set_chan_timer(chan, sk->sk_sndtimeo);
 
         chan->ident = cmd->ident;
 
         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
                 if (l2cap_check_security(chan)) {
                         if (bt_sk(sk)->defer_setup) {
-                                sk->sk_state = BT_CONNECT2;
+                                l2cap_state_change(chan, BT_CONNECT2);
                                 result = L2CAP_CR_PEND;
                                 status = L2CAP_CS_AUTHOR_PEND;
                                 parent->sk_data_ready(parent, 0);
                         } else {
-                                sk->sk_state = BT_CONFIG;
+                                l2cap_state_change(chan, BT_CONFIG);
                                 result = L2CAP_CR_SUCCESS;
                                 status = L2CAP_CS_NO_INFO;
                         }
                 } else {
-                        sk->sk_state = BT_CONNECT2;
+                        l2cap_state_change(chan, BT_CONNECT2);
                         result = L2CAP_CR_PEND;
                         status = L2CAP_CS_AUTHEN_PEND;
                 }
         } else {
-                sk->sk_state = BT_CONNECT2;
+                l2cap_state_change(chan, BT_CONNECT2);
                 result = L2CAP_CR_PEND;
                 status = L2CAP_CS_NO_INFO;
         }
@@ -2214,10 +2418,10 @@ sendresp:
                                         L2CAP_INFO_REQ, sizeof(info), &info);
         }
 
-        if (chan && !(chan->conf_state & L2CAP_CONF_REQ_SENT) &&
+        if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
                                 result == L2CAP_CR_SUCCESS) {
                 u8 buf[128];
-                chan->conf_state |= L2CAP_CONF_REQ_SENT;
+                set_bit(CONF_REQ_SENT, &chan->conf_state);
                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
                                         l2cap_build_conf_req(chan, buf), buf);
                 chan->num_conf_req++;
@@ -2255,31 +2459,29 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
 
         switch (result) {
         case L2CAP_CR_SUCCESS:
-                sk->sk_state = BT_CONFIG;
+                l2cap_state_change(chan, BT_CONFIG);
                 chan->ident = 0;
                 chan->dcid = dcid;
-                chan->conf_state &= ~L2CAP_CONF_CONNECT_PEND;
+                clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
 
-                if (chan->conf_state & L2CAP_CONF_REQ_SENT)
+                if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
                         break;
 
-                chan->conf_state |= L2CAP_CONF_REQ_SENT;
-
                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
                                         l2cap_build_conf_req(chan, req), req);
                 chan->num_conf_req++;
                 break;
 
         case L2CAP_CR_PEND:
-                chan->conf_state |= L2CAP_CONF_CONNECT_PEND;
+                set_bit(CONF_CONNECT_PEND, &chan->conf_state);
                 break;
 
         default:
                 /* don't delete l2cap channel if sk is owned by user */
                 if (sock_owned_by_user(sk)) {
-                        sk->sk_state = BT_DISCONN;
-                        l2cap_sock_clear_timer(sk);
-                        l2cap_sock_set_timer(sk, HZ / 5);
+                        l2cap_state_change(chan, BT_DISCONN);
+                        __clear_chan_timer(chan);
+                        __set_chan_timer(chan, HZ / 5);
                         break;
                 }
 
@@ -2293,14 +2495,12 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
 
 static inline void set_default_fcs(struct l2cap_chan *chan)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(chan->sk);
-
         /* FCS is enabled only in ERTM or streaming mode, if one or both
          * sides request it.
          */
         if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
                 chan->fcs = L2CAP_FCS_NONE;
-        else if (!(pi->chan->conf_state & L2CAP_CONF_NO_FCS_RECV))
+        else if (!test_bit(CONF_NO_FCS_RECV, &chan->conf_state))
                 chan->fcs = L2CAP_FCS_CRC16;
 }
 
@@ -2367,13 +2567,13 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         /* Reset config buffer. */
         chan->conf_len = 0;
 
-        if (!(chan->conf_state & L2CAP_CONF_OUTPUT_DONE))
+        if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
                 goto unlock;
 
-        if (chan->conf_state & L2CAP_CONF_INPUT_DONE) {
+        if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
                 set_default_fcs(chan);
 
-                sk->sk_state = BT_CONNECTED;
+                l2cap_state_change(chan, BT_CONNECTED);
 
                 chan->next_tx_seq = 0;
                 chan->expected_tx_seq = 0;
@@ -2385,9 +2585,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                 goto unlock;
         }
 
-        if (!(chan->conf_state & L2CAP_CONF_REQ_SENT)) {
+        if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
                 u8 buf[64];
-                chan->conf_state |= L2CAP_CONF_REQ_SENT;
                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
                                         l2cap_build_conf_req(chan, buf), buf);
                 chan->num_conf_req++;
@@ -2452,7 +2651,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 
         default:
                 sk->sk_err = ECONNRESET;
-                l2cap_sock_set_timer(sk, HZ * 5);
+                __set_chan_timer(chan, HZ * 5);
                 l2cap_send_disconn_req(conn, chan, ECONNRESET);
                 goto done;
         }
@@ -2460,12 +2659,12 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         if (flags & 0x01)
                 goto done;
 
-        chan->conf_state |= L2CAP_CONF_INPUT_DONE;
+        set_bit(CONF_INPUT_DONE, &chan->conf_state);
 
-        if (chan->conf_state & L2CAP_CONF_OUTPUT_DONE) {
+        if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
                 set_default_fcs(chan);
 
-                sk->sk_state = BT_CONNECTED;
+                l2cap_state_change(chan, BT_CONNECTED);
                 chan->next_tx_seq = 0;
                 chan->expected_tx_seq = 0;
                 skb_queue_head_init(&chan->tx_q);
@@ -2507,9 +2706,9 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd
 
         /* don't delete l2cap channel if sk is owned by user */
         if (sock_owned_by_user(sk)) {
-                sk->sk_state = BT_DISCONN;
-                l2cap_sock_clear_timer(sk);
-                l2cap_sock_set_timer(sk, HZ / 5);
+                l2cap_state_change(chan, BT_DISCONN);
+                __clear_chan_timer(chan);
+                __set_chan_timer(chan, HZ / 5);
                 bh_unlock_sock(sk);
                 return 0;
         }
@@ -2517,7 +2716,7 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd
         l2cap_chan_del(chan, ECONNRESET);
         bh_unlock_sock(sk);
 
-        l2cap_sock_kill(sk);
+        chan->ops->close(chan->data);
         return 0;
 }
 
@@ -2541,9 +2740,9 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd
 
         /* don't delete l2cap channel if sk is owned by user */
         if (sock_owned_by_user(sk)) {
-                sk->sk_state = BT_DISCONN;
-                l2cap_sock_clear_timer(sk);
-                l2cap_sock_set_timer(sk, HZ / 5);
+                l2cap_state_change(chan,BT_DISCONN);
+                __clear_chan_timer(chan);
+                __set_chan_timer(chan, HZ / 5);
                 bh_unlock_sock(sk);
                 return 0;
         }
@@ -2551,7 +2750,7 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd
         l2cap_chan_del(chan, 0);
         bh_unlock_sock(sk);
 
-        l2cap_sock_kill(sk);
+        chan->ops->close(chan->data);
         return 0;
 }
 
@@ -2859,18 +3058,18 @@ static inline void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
 
         control |= chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
 
-        if (chan->conn_state & L2CAP_CONN_LOCAL_BUSY) {
+        if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
                 control |= L2CAP_SUPER_RCV_NOT_READY;
                 l2cap_send_sframe(chan, control);
-                chan->conn_state |= L2CAP_CONN_RNR_SENT;
+                set_bit(CONN_RNR_SENT, &chan->conn_state);
         }
 
-        if (chan->conn_state & L2CAP_CONN_REMOTE_BUSY)
+        if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
                 l2cap_retransmit_frames(chan);
 
         l2cap_ertm_send(chan);
 
-        if (!(chan->conn_state & L2CAP_CONN_LOCAL_BUSY) &&
+        if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
                         chan->frames_sent == 0) {
                 control |= L2CAP_SUPER_RCV_READY;
                 l2cap_send_sframe(chan, control);
@@ -2926,17 +3125,13 @@ static int l2cap_ertm_reassembly_sdu(struct l2cap_chan *chan, struct sk_buff *sk
 
         switch (control & L2CAP_CTRL_SAR) {
         case L2CAP_SDU_UNSEGMENTED:
-                if (chan->conn_state & L2CAP_CONN_SAR_SDU)
+                if (test_bit(CONN_SAR_SDU, &chan->conn_state))
                         goto drop;
 
-                err = sock_queue_rcv_skb(chan->sk, skb);
-                if (!err)
-                        return err;
-
-                break;
+                return chan->ops->recv(chan->data, skb);
 
         case L2CAP_SDU_START:
-                if (chan->conn_state & L2CAP_CONN_SAR_SDU)
+                if (test_bit(CONN_SAR_SDU, &chan->conn_state))
                         goto drop;
 
                 chan->sdu_len = get_unaligned_le16(skb->data);
@@ -2955,12 +3150,12 @@ static int l2cap_ertm_reassembly_sdu(struct l2cap_chan *chan, struct sk_buff *sk
 
                 memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
 
-                chan->conn_state |= L2CAP_CONN_SAR_SDU;
+                set_bit(CONN_SAR_SDU, &chan->conn_state);
                 chan->partial_sdu_len = skb->len;
                 break;
 
         case L2CAP_SDU_CONTINUE:
-                if (!(chan->conn_state & L2CAP_CONN_SAR_SDU))
+                if (!test_bit(CONN_SAR_SDU, &chan->conn_state))
                         goto disconnect;
 
                 if (!chan->sdu)
@@ -2975,39 +3170,34 @@ static int l2cap_ertm_reassembly_sdu(struct l2cap_chan *chan, struct sk_buff *sk
                 break;
 
         case L2CAP_SDU_END:
-                if (!(chan->conn_state & L2CAP_CONN_SAR_SDU))
+                if (!test_bit(CONN_SAR_SDU, &chan->conn_state))
                         goto disconnect;
 
                 if (!chan->sdu)
                         goto disconnect;
 
-                if (!(chan->conn_state & L2CAP_CONN_SAR_RETRY)) {
-                        chan->partial_sdu_len += skb->len;
+                chan->partial_sdu_len += skb->len;
 
-                        if (chan->partial_sdu_len > chan->imtu)
-                                goto drop;
+                if (chan->partial_sdu_len > chan->imtu)
+                        goto drop;
 
-                        if (chan->partial_sdu_len != chan->sdu_len)
-                                goto drop;
+                if (chan->partial_sdu_len != chan->sdu_len)
+                        goto drop;
 
-                        memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
-                }
+                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
 
                 _skb = skb_clone(chan->sdu, GFP_ATOMIC);
                 if (!_skb) {
-                        chan->conn_state |= L2CAP_CONN_SAR_RETRY;
                         return -ENOMEM;
                 }
 
-                err = sock_queue_rcv_skb(chan->sk, _skb);
+                err = chan->ops->recv(chan->data, _skb);
                 if (err < 0) {
                         kfree_skb(_skb);
-                        chan->conn_state |= L2CAP_CONN_SAR_RETRY;
                         return err;
                 }
 
-                chan->conn_state &= ~L2CAP_CONN_SAR_RETRY;
-                chan->conn_state &= ~L2CAP_CONN_SAR_SDU;
+                clear_bit(CONN_SAR_SDU, &chan->conn_state);
 
                 kfree_skb(chan->sdu);
                 break;
@@ -3026,128 +3216,55 @@ disconnect:
         return 0;
 }
 
-static int l2cap_try_push_rx_skb(struct l2cap_chan *chan)
+static void l2cap_ertm_enter_local_busy(struct l2cap_chan *chan)
 {
-        struct sk_buff *skb;
         u16 control;
-        int err;
 
-        while ((skb = skb_dequeue(&chan->busy_q))) {
-                control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
-                err = l2cap_ertm_reassembly_sdu(chan, skb, control);
-                if (err < 0) {
-                        skb_queue_head(&chan->busy_q, skb);
-                        return -EBUSY;
-                }
-
-                chan->buffer_seq = (chan->buffer_seq + 1) % 64;
-        }
+        BT_DBG("chan %p, Enter local busy", chan);
 
-        if (!(chan->conn_state & L2CAP_CONN_RNR_SENT))
-                goto done;
+        set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
 
         control = chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
-        control |= L2CAP_SUPER_RCV_READY | L2CAP_CTRL_POLL;
+        control |= L2CAP_SUPER_RCV_NOT_READY;
         l2cap_send_sframe(chan, control);
-        chan->retry_count = 1;
-
-        del_timer(&chan->retrans_timer);
-        __mod_monitor_timer();
 
-        chan->conn_state |= L2CAP_CONN_WAIT_F;
+        set_bit(CONN_RNR_SENT, &chan->conn_state);
 
-done:
-        chan->conn_state &= ~L2CAP_CONN_LOCAL_BUSY;
-        chan->conn_state &= ~L2CAP_CONN_RNR_SENT;
-
-        BT_DBG("chan %p, Exit local busy", chan);
-
-        return 0;
+        __clear_ack_timer(chan);
 }
 
-static void l2cap_busy_work(struct work_struct *work)
+static void l2cap_ertm_exit_local_busy(struct l2cap_chan *chan)
 {
-        DECLARE_WAITQUEUE(wait, current);
-        struct l2cap_chan *chan =
-                container_of(work, struct l2cap_chan, busy_work);
-        struct sock *sk = chan->sk;
-        int n_tries = 0, timeo = HZ/5, err;
-        struct sk_buff *skb;
-
-        lock_sock(sk);
-
-        add_wait_queue(sk_sleep(sk), &wait);
-        while ((skb = skb_peek(&chan->busy_q))) {
-                set_current_state(TASK_INTERRUPTIBLE);
-
-                if (n_tries++ > L2CAP_LOCAL_BUSY_TRIES) {
-                        err = -EBUSY;
-                        l2cap_send_disconn_req(chan->conn, chan, EBUSY);
-                        break;
-                }
-
-                if (!timeo)
-                        timeo = HZ/5;
+        u16 control;
 
-                if (signal_pending(current)) {
-                        err = sock_intr_errno(timeo);
-                        break;
-                }
+        if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
+                goto done;
 
-                release_sock(sk);
-                timeo = schedule_timeout(timeo);
-                lock_sock(sk);
+        control = chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+        control |= L2CAP_SUPER_RCV_READY | L2CAP_CTRL_POLL;
+        l2cap_send_sframe(chan, control);
+        chan->retry_count = 1;
 
-                err = sock_error(sk);
-                if (err)
-                        break;
+        __clear_retrans_timer(chan);
+        __set_monitor_timer(chan);
 
-                if (l2cap_try_push_rx_skb(chan) == 0)
-                        break;
-        }
+        set_bit(CONN_WAIT_F, &chan->conn_state);
 
-        set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk_sleep(sk), &wait);
+done:
+        clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
+        clear_bit(CONN_RNR_SENT, &chan->conn_state);
 
-        release_sock(sk);
+        BT_DBG("chan %p, Exit local busy", chan);
 }
 
-static int l2cap_push_rx_skb(struct l2cap_chan *chan, struct sk_buff *skb, u16 control)
+void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
 {
-        int sctrl, err;
-
-        if (chan->conn_state & L2CAP_CONN_LOCAL_BUSY) {
-                bt_cb(skb)->sar = control >> L2CAP_CTRL_SAR_SHIFT;
-                __skb_queue_tail(&chan->busy_q, skb);
-                return l2cap_try_push_rx_skb(chan);
-
-
-        }
-
-        err = l2cap_ertm_reassembly_sdu(chan, skb, control);
-        if (err >= 0) {
-                chan->buffer_seq = (chan->buffer_seq + 1) % 64;
-                return err;
+        if (chan->mode == L2CAP_MODE_ERTM) {
+                if (busy)
+                        l2cap_ertm_enter_local_busy(chan);
+                else
+                        l2cap_ertm_exit_local_busy(chan);
         }
-
-        /* Busy Condition */
-        BT_DBG("chan %p, Enter local busy", chan);
-
-        chan->conn_state |= L2CAP_CONN_LOCAL_BUSY;
-        bt_cb(skb)->sar = control >> L2CAP_CTRL_SAR_SHIFT;
-        __skb_queue_tail(&chan->busy_q, skb);
-
-        sctrl = chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
-        sctrl |= L2CAP_SUPER_RCV_NOT_READY;
-        l2cap_send_sframe(chan, sctrl);
-
-        chan->conn_state |= L2CAP_CONN_RNR_SENT;
-
-        del_timer(&chan->ack_timer);
-
-        queue_work(_busy_wq, &chan->busy_work);
-
-        return err;
 }
 
 static int l2cap_streaming_reassembly_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u16 control)
@@ -3162,19 +3279,19 @@ static int l2cap_streaming_reassembly_sdu(struct l2cap_chan *chan, struct sk_buf
 
         switch (control & L2CAP_CTRL_SAR) {
         case L2CAP_SDU_UNSEGMENTED:
-                if (chan->conn_state & L2CAP_CONN_SAR_SDU) {
+                if (test_bit(CONN_SAR_SDU, &chan->conn_state)) {
                         kfree_skb(chan->sdu);
                         break;
                 }
 
-                err = sock_queue_rcv_skb(chan->sk, skb);
+                err = chan->ops->recv(chan->data, skb);
                 if (!err)
                         return 0;
 
                 break;
 
         case L2CAP_SDU_START:
-                if (chan->conn_state & L2CAP_CONN_SAR_SDU) {
+                if (test_bit(CONN_SAR_SDU, &chan->conn_state)) {
                         kfree_skb(chan->sdu);
                         break;
                 }
@@ -3195,13 +3312,13 @@ static int l2cap_streaming_reassembly_sdu(struct l2cap_chan *chan, struct sk_buf
 
                 memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
 
-                chan->conn_state |= L2CAP_CONN_SAR_SDU;
+                set_bit(CONN_SAR_SDU, &chan->conn_state);
                 chan->partial_sdu_len = skb->len;
                 err = 0;
                 break;
 
         case L2CAP_SDU_CONTINUE:
-                if (!(chan->conn_state & L2CAP_CONN_SAR_SDU))
+                if (!test_bit(CONN_SAR_SDU, &chan->conn_state))
                         break;
 
                 memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
@@ -3215,12 +3332,12 @@ static int l2cap_streaming_reassembly_sdu(struct l2cap_chan *chan, struct sk_buf
                 break;
 
         case L2CAP_SDU_END:
-                if (!(chan->conn_state & L2CAP_CONN_SAR_SDU))
+                if (!test_bit(CONN_SAR_SDU, &chan->conn_state))
                         break;
 
                 memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
 
-                chan->conn_state &= ~L2CAP_CONN_SAR_SDU;
+                clear_bit(CONN_SAR_SDU, &chan->conn_state);
                 chan->partial_sdu_len += skb->len;
 
                 if (chan->partial_sdu_len > chan->imtu)
@@ -3228,7 +3345,7 @@ static int l2cap_streaming_reassembly_sdu(struct l2cap_chan *chan, struct sk_buf
 
                 if (chan->partial_sdu_len == chan->sdu_len) {
                         _skb = skb_clone(chan->sdu, GFP_ATOMIC);
-                        err = sock_queue_rcv_skb(chan->sk, _skb);
+                        err = chan->ops->recv(chan->data, _skb);
                         if (err < 0)
                                 kfree_skb(_skb);
                 }
@@ -3248,13 +3365,22 @@ static void l2cap_check_srej_gap(struct l2cap_chan *chan, u8 tx_seq)
         struct sk_buff *skb;
         u16 control;
 
-        while ((skb = skb_peek(&chan->srej_q))) {
+        while ((skb = skb_peek(&chan->srej_q)) &&
+                        !test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
+                int err;
+
                 if (bt_cb(skb)->tx_seq != tx_seq)
                         break;
 
                 skb = skb_dequeue(&chan->srej_q);
                 control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
-                l2cap_ertm_reassembly_sdu(chan, skb, control);
+                err = l2cap_ertm_reassembly_sdu(chan, skb, control);
+
+                if (err < 0) {
+                        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                        break;
+                }
+
                 chan->buffer_seq_srej =
                         (chan->buffer_seq_srej + 1) % 64;
                 tx_seq = (tx_seq + 1) % 64;
@@ -3311,19 +3437,16 @@ static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u16 rx_cont
                                                         tx_seq, rx_control);
 
         if (L2CAP_CTRL_FINAL & rx_control &&
-                        chan->conn_state & L2CAP_CONN_WAIT_F) {
-                del_timer(&chan->monitor_timer);
+                        test_bit(CONN_WAIT_F, &chan->conn_state)) {
+                __clear_monitor_timer(chan);
                 if (chan->unacked_frames > 0)
-                        __mod_retrans_timer();
-                chan->conn_state &= ~L2CAP_CONN_WAIT_F;
+                        __set_retrans_timer(chan);
+                clear_bit(CONN_WAIT_F, &chan->conn_state);
         }
 
         chan->expected_ack_seq = req_seq;
         l2cap_drop_acked_frames(chan);
 
-        if (tx_seq == chan->expected_tx_seq)
-                goto expected;
-
         tx_seq_offset = (tx_seq - chan->buffer_seq) % 64;
         if (tx_seq_offset < 0)
                 tx_seq_offset += 64;
@@ -3334,10 +3457,13 @@ static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u16 rx_cont
                 goto drop;
         }
 
-        if (chan->conn_state == L2CAP_CONN_LOCAL_BUSY)
+        if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
                 goto drop;
 
-        if (chan->conn_state & L2CAP_CONN_SREJ_SENT) {
+        if (tx_seq == chan->expected_tx_seq)
+                goto expected;
+
+        if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
                 struct srej_list *first;
 
                 first = list_first_entry(&chan->srej_l,
@@ -3351,7 +3477,7 @@ static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u16 rx_cont
 
                         if (list_empty(&chan->srej_l)) {
                                 chan->buffer_seq = chan->buffer_seq_srej;
-                                chan->conn_state &= ~L2CAP_CONN_SREJ_SENT;
+                                clear_bit(CONN_SREJ_SENT, &chan->conn_state);
                                 l2cap_send_ack(chan);
                                 BT_DBG("chan %p, Exit SREJ_SENT", chan);
                         }
@@ -3380,7 +3506,7 @@ static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u16 rx_cont
                 if (tx_seq_offset < expected_tx_seq_offset)
                         goto drop;
 
-                chan->conn_state |= L2CAP_CONN_SREJ_SENT;
+                set_bit(CONN_SREJ_SENT, &chan->conn_state);
 
                 BT_DBG("chan %p, Enter SREJ", chan);
 
@@ -3388,39 +3514,39 @@ static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u16 rx_cont
                 chan->buffer_seq_srej = chan->buffer_seq;
 
                 __skb_queue_head_init(&chan->srej_q);
-                __skb_queue_head_init(&chan->busy_q);
                 l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
 
-                chan->conn_state |= L2CAP_CONN_SEND_PBIT;
+                set_bit(CONN_SEND_PBIT, &chan->conn_state);
 
                 l2cap_send_srejframe(chan, tx_seq);
 
-                del_timer(&chan->ack_timer);
+                __clear_ack_timer(chan);
         }
         return 0;
 
 expected:
         chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64;
 
-        if (chan->conn_state & L2CAP_CONN_SREJ_SENT) {
+        if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
                 bt_cb(skb)->tx_seq = tx_seq;
                 bt_cb(skb)->sar = sar;
                 __skb_queue_tail(&chan->srej_q, skb);
                 return 0;
         }
 
-        err = l2cap_push_rx_skb(chan, skb, rx_control);
-        if (err < 0)
-                return 0;
+        err = l2cap_ertm_reassembly_sdu(chan, skb, rx_control);
+        chan->buffer_seq = (chan->buffer_seq + 1) % 64;
+        if (err < 0) {
+                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                return err;
+        }
 
         if (rx_control & L2CAP_CTRL_FINAL) {
-                if (chan->conn_state & L2CAP_CONN_REJ_ACT)
-                        chan->conn_state &= ~L2CAP_CONN_REJ_ACT;
-                else
+                if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
                         l2cap_retransmit_frames(chan);
         }
 
-        __mod_ack_timer();
+        __set_ack_timer(chan);
 
         chan->num_acked = (chan->num_acked + 1) % num_to_ack;
         if (chan->num_acked == num_to_ack - 1)
@@ -3442,33 +3568,31 @@ static inline void l2cap_data_channel_rrframe(struct l2cap_chan *chan, u16 rx_co
         l2cap_drop_acked_frames(chan);
 
         if (rx_control & L2CAP_CTRL_POLL) {
-                chan->conn_state |= L2CAP_CONN_SEND_FBIT;
-                if (chan->conn_state & L2CAP_CONN_SREJ_SENT) {
-                        if ((chan->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                set_bit(CONN_SEND_FBIT, &chan->conn_state);
+                if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
+                        if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
                                         (chan->unacked_frames > 0))
-                                __mod_retrans_timer();
+                                __set_retrans_timer(chan);
 
-                        chan->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+                        clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
                         l2cap_send_srejtail(chan);
                 } else {
                         l2cap_send_i_or_rr_or_rnr(chan);
                 }
 
         } else if (rx_control & L2CAP_CTRL_FINAL) {
-                chan->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+                clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
 
-                if (chan->conn_state & L2CAP_CONN_REJ_ACT)
-                        chan->conn_state &= ~L2CAP_CONN_REJ_ACT;
-                else
+                if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
                         l2cap_retransmit_frames(chan);
 
         } else {
-                if ((chan->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
                                 (chan->unacked_frames > 0))
-                        __mod_retrans_timer();
+                        __set_retrans_timer(chan);
 
-                chan->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
-                if (chan->conn_state & L2CAP_CONN_SREJ_SENT)
+                clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
+                if (test_bit(CONN_SREJ_SENT, &chan->conn_state))
                         l2cap_send_ack(chan);
                 else
                         l2cap_ertm_send(chan);
@@ -3481,21 +3605,19 @@ static inline void l2cap_data_channel_rejframe(struct l2cap_chan *chan, u16 rx_c
 
         BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, tx_seq, rx_control);
 
-        chan->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+        clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
 
         chan->expected_ack_seq = tx_seq;
         l2cap_drop_acked_frames(chan);
 
         if (rx_control & L2CAP_CTRL_FINAL) {
-                if (chan->conn_state & L2CAP_CONN_REJ_ACT)
-                        chan->conn_state &= ~L2CAP_CONN_REJ_ACT;
-                else
+                if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
                         l2cap_retransmit_frames(chan);
         } else {
                 l2cap_retransmit_frames(chan);
 
-                if (chan->conn_state & L2CAP_CONN_WAIT_F)
-                        chan->conn_state |= L2CAP_CONN_REJ_ACT;
+                if (test_bit(CONN_WAIT_F, &chan->conn_state))
+                        set_bit(CONN_REJ_ACT, &chan->conn_state);
         }
 }
 static inline void l2cap_data_channel_srejframe(struct l2cap_chan *chan, u16 rx_control)
@@ -3504,32 +3626,32 @@ static inline void l2cap_data_channel_srejframe(struct l2cap_chan *chan, u16 rx_
 
         BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, tx_seq, rx_control);
 
-        chan->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+        clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
 
         if (rx_control & L2CAP_CTRL_POLL) {
                 chan->expected_ack_seq = tx_seq;
                 l2cap_drop_acked_frames(chan);
 
-                chan->conn_state |= L2CAP_CONN_SEND_FBIT;
+                set_bit(CONN_SEND_FBIT, &chan->conn_state);
                 l2cap_retransmit_one_frame(chan, tx_seq);
 
                 l2cap_ertm_send(chan);
 
-                if (chan->conn_state & L2CAP_CONN_WAIT_F) {
+                if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
                         chan->srej_save_reqseq = tx_seq;
-                        chan->conn_state |= L2CAP_CONN_SREJ_ACT;
+                        set_bit(CONN_SREJ_ACT, &chan->conn_state);
                 }
         } else if (rx_control & L2CAP_CTRL_FINAL) {
-                if ((chan->conn_state & L2CAP_CONN_SREJ_ACT) &&
+                if (test_bit(CONN_SREJ_ACT, &chan->conn_state) &&
                                 chan->srej_save_reqseq == tx_seq)
-                        chan->conn_state &= ~L2CAP_CONN_SREJ_ACT;
+                        clear_bit(CONN_SREJ_ACT, &chan->conn_state);
                 else
                         l2cap_retransmit_one_frame(chan, tx_seq);
         } else {
                 l2cap_retransmit_one_frame(chan, tx_seq);
-                if (chan->conn_state & L2CAP_CONN_WAIT_F) {
+                if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
                         chan->srej_save_reqseq = tx_seq;
-                        chan->conn_state |= L2CAP_CONN_SREJ_ACT;
+                        set_bit(CONN_SREJ_ACT, &chan->conn_state);
                 }
         }
 }
@@ -3540,15 +3662,15 @@ static inline void l2cap_data_channel_rnrframe(struct l2cap_chan *chan, u16 rx_c
 
         BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, tx_seq, rx_control);
 
-        chan->conn_state |= L2CAP_CONN_REMOTE_BUSY;
+        set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
         chan->expected_ack_seq = tx_seq;
         l2cap_drop_acked_frames(chan);
 
         if (rx_control & L2CAP_CTRL_POLL)
-                chan->conn_state |= L2CAP_CONN_SEND_FBIT;
+                set_bit(CONN_SEND_FBIT, &chan->conn_state);
 
-        if (!(chan->conn_state & L2CAP_CONN_SREJ_SENT)) {
-                del_timer(&chan->retrans_timer);
+        if (!test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
+                __clear_retrans_timer(chan);
                 if (rx_control & L2CAP_CTRL_POLL)
                         l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_FINAL);
                 return;
@@ -3565,11 +3687,11 @@ static inline int l2cap_data_channel_sframe(struct l2cap_chan *chan, u16 rx_cont
         BT_DBG("chan %p rx_control 0x%4.4x len %d", chan, rx_control, skb->len);
 
         if (L2CAP_CTRL_FINAL & rx_control &&
-                        chan->conn_state & L2CAP_CONN_WAIT_F) {
-                del_timer(&chan->monitor_timer);
+                        test_bit(CONN_WAIT_F, &chan->conn_state)) {
+                __clear_monitor_timer(chan);
                 if (chan->unacked_frames > 0)
-                        __mod_retrans_timer();
-                chan->conn_state &= ~L2CAP_CONN_WAIT_F;
+                        __set_retrans_timer(chan);
+                clear_bit(CONN_WAIT_F, &chan->conn_state);
         }
 
         switch (rx_control & L2CAP_CTRL_SUPERVISE) {
@@ -3668,7 +3790,6 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
 {
         struct l2cap_chan *chan;
         struct sock *sk = NULL;
-        struct l2cap_pinfo *pi;
         u16 control;
         u8 tx_seq;
         int len;
@@ -3680,11 +3801,10 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
         }
 
         sk = chan->sk;
-        pi = l2cap_pi(sk);
 
         BT_DBG("chan %p, len %d", chan, skb->len);
 
-        if (sk->sk_state != BT_CONNECTED)
+        if (chan->state != BT_CONNECTED)
                 goto drop;
 
         switch (chan->mode) {
@@ -3697,7 +3817,7 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
                 if (chan->imtu < skb->len)
                         goto drop;
 
-                if (!sock_queue_rcv_skb(sk, skb))
+                if (!chan->ops->recv(chan->data, skb))
                         goto done;
                 break;
 
@@ -3769,13 +3889,13 @@ static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, str
 
         BT_DBG("sk %p, len %d", sk, skb->len);
 
-        if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
+        if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
                 goto drop;
 
-        if (l2cap_pi(sk)->chan->imtu < skb->len)
+        if (chan->imtu < skb->len)
                 goto drop;
 
-        if (!sock_queue_rcv_skb(sk, skb))
+        if (!chan->ops->recv(chan->data, skb))
                 goto done;
 
 drop:
@@ -3802,13 +3922,13 @@ static inline int l2cap_att_channel(struct l2cap_conn *conn, __le16 cid, struct
 
         BT_DBG("sk %p, len %d", sk, skb->len);
 
-        if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
+        if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
                 goto drop;
 
-        if (l2cap_pi(sk)->chan->imtu < skb->len)
+        if (chan->imtu < skb->len)
                 goto drop;
 
-        if (!sock_queue_rcv_skb(sk, skb))
+        if (!chan->ops->recv(chan->data, skb))
                 goto done;
 
 drop:
@@ -3853,6 +3973,11 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
                 l2cap_att_channel(conn, cid, skb);
                 break;
 
+        case L2CAP_CID_SMP:
+                if (smp_sig_channel(conn, skb))
+                        l2cap_conn_del(conn->hcon, EACCES);
+                break;
+
         default:
                 l2cap_data_channel(conn, cid, skb);
                 break;
@@ -3876,7 +4001,7 @@ static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
         list_for_each_entry(c, &chan_list, global_l) {
                 struct sock *sk = c->sk;
 
-                if (sk->sk_state != BT_LISTEN)
+                if (c->state != BT_LISTEN)
                         continue;
 
                 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
@@ -3909,7 +4034,7 @@ static int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
                 if (conn)
                         l2cap_conn_ready(conn);
         } else
-                l2cap_conn_del(hcon, bt_err(status));
+                l2cap_conn_del(hcon, bt_to_errno(status));
 
         return 0;
 }
@@ -3920,7 +4045,7 @@ static int l2cap_disconn_ind(struct hci_conn *hcon)
 
         BT_DBG("hcon %p", hcon);
 
-        if (hcon->type != ACL_LINK || !conn)
+        if ((hcon->type != ACL_LINK && hcon->type != LE_LINK) || !conn)
                 return 0x13;
 
         return conn->disc_reason;
@@ -3933,27 +4058,25 @@ static int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
         if (!(hcon->type == ACL_LINK || hcon->type == LE_LINK))
                 return -EINVAL;
 
-        l2cap_conn_del(hcon, bt_err(reason));
+        l2cap_conn_del(hcon, bt_to_errno(reason));
 
         return 0;
 }
 
 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
 {
-        struct sock *sk = chan->sk;
-
-        if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM)
+        if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
                 return;
 
         if (encrypt == 0x00) {
                 if (chan->sec_level == BT_SECURITY_MEDIUM) {
-                        l2cap_sock_clear_timer(sk);
-                        l2cap_sock_set_timer(sk, HZ * 5);
+                        __clear_chan_timer(chan);
+                        __set_chan_timer(chan, HZ * 5);
                 } else if (chan->sec_level == BT_SECURITY_HIGH)
-                        __l2cap_sock_close(sk, ECONNREFUSED);
+                        l2cap_chan_close(chan, ECONNREFUSED);
         } else {
                 if (chan->sec_level == BT_SECURITY_MEDIUM)
-                        l2cap_sock_clear_timer(sk);
+                        __clear_chan_timer(chan);
         }
 }
 
@@ -3974,34 +4097,48 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
 
                 bh_lock_sock(sk);
 
-                if (chan->conf_state & L2CAP_CONF_CONNECT_PEND) {
+                BT_DBG("chan->scid %d", chan->scid);
+
+                if (chan->scid == L2CAP_CID_LE_DATA) {
+                        if (!status && encrypt) {
+                                chan->sec_level = hcon->sec_level;
+                                del_timer(&conn->security_timer);
+                                l2cap_chan_ready(sk);
+                                smp_distribute_keys(conn, 0);
+                        }
+
+                        bh_unlock_sock(sk);
+                        continue;
+                }
+
+                if (test_bit(CONF_CONNECT_PEND, &chan->conf_state)) {
                         bh_unlock_sock(sk);
                         continue;
                 }
 
-                if (!status && (sk->sk_state == BT_CONNECTED ||
-                                                sk->sk_state == BT_CONFIG)) {
+                if (!status && (chan->state == BT_CONNECTED ||
+                                                chan->state == BT_CONFIG)) {
                         l2cap_check_encryption(chan, encrypt);
                         bh_unlock_sock(sk);
                         continue;
                 }
 
-                if (sk->sk_state == BT_CONNECT) {
+                if (chan->state == BT_CONNECT) {
                         if (!status) {
                                 struct l2cap_conn_req req;
                                 req.scid = cpu_to_le16(chan->scid);
                                 req.psm  = chan->psm;
 
                                 chan->ident = l2cap_get_ident(conn);
-                                chan->conf_state |= L2CAP_CONF_CONNECT_PEND;
+                                set_bit(CONF_CONNECT_PEND, &chan->conf_state);
 
                                 l2cap_send_cmd(conn, chan->ident,
                                         L2CAP_CONN_REQ, sizeof(req), &req);
                         } else {
-                                l2cap_sock_clear_timer(sk);
-                                l2cap_sock_set_timer(sk, HZ / 10);
+                                __clear_chan_timer(chan);
+                                __set_chan_timer(chan, HZ / 10);
                         }
-                } else if (sk->sk_state == BT_CONNECT2) {
+                } else if (chan->state == BT_CONNECT2) {
                         struct l2cap_conn_rsp rsp;
                         __u16 res, stat;
 
@@ -4013,13 +4150,13 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                         if (parent)
                                                 parent->sk_data_ready(parent, 0);
                                 } else {
-                                        sk->sk_state = BT_CONFIG;
+                                        l2cap_state_change(chan, BT_CONFIG);
                                         res = L2CAP_CR_SUCCESS;
                                         stat = L2CAP_CS_NO_INFO;
                                 }
                         } else {
-                                sk->sk_state = BT_DISCONN;
-                                l2cap_sock_set_timer(sk, HZ / 10);
+                                l2cap_state_change(chan, BT_DISCONN);
+                                __set_chan_timer(chan, HZ / 10);
                                 res = L2CAP_CR_SEC_BLOCK;
                                 stat = L2CAP_CS_NO_INFO;
                         }
@@ -4163,7 +4300,7 @@ static int l2cap_debugfs_show(struct seq_file *f, void *p)
                 seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
                                         batostr(&bt_sk(sk)->src),
                                         batostr(&bt_sk(sk)->dst),
-                                        sk->sk_state, __le16_to_cpu(c->psm),
+                                        c->state, __le16_to_cpu(c->psm),
                                         c->scid, c->dcid, c->imtu, c->omtu,
                                         c->sec_level, c->mode);
         }
@@ -4206,12 +4343,6 @@ int __init l2cap_init(void)
         if (err < 0)
                 return err;
 
-        _busy_wq = create_singlethread_workqueue("l2cap");
-        if (!_busy_wq) {
-                err = -ENOMEM;
-                goto error;
-        }
-
         err = hci_register_proto(&l2cap_hci_proto);
         if (err < 0) {
                 BT_ERR("L2CAP protocol registration failed");
@@ -4229,7 +4360,6 @@ int __init l2cap_init(void)
         return 0;
 
 error:
-        destroy_workqueue(_busy_wq);
         l2cap_cleanup_sockets();
         return err;
 }
@@ -4238,9 +4368,6 @@ void l2cap_exit(void)
 {
         debugfs_remove(l2cap_debugfs);
 
-        flush_workqueue(_busy_wq);
-        destroy_workqueue(_busy_wq);
-
         if (hci_unregister_proto(&l2cap_hci_proto) < 0)
                 BT_ERR("L2CAP protocol unregistration failed");
 
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 8248303f44e..61f1f623091 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -29,54 +29,11 @@
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 #include <net/bluetooth/l2cap.h>
+#include <net/bluetooth/smp.h>
 
 static const struct proto_ops l2cap_sock_ops;
-
-/* ---- L2CAP timers ---- */
-static void l2cap_sock_timeout(unsigned long arg)
-{
-        struct sock *sk = (struct sock *) arg;
-        int reason;
-
-        BT_DBG("sock %p state %d", sk, sk->sk_state);
-
-        bh_lock_sock(sk);
-
-        if (sock_owned_by_user(sk)) {
-                /* sk is owned by user. Try again later */
-                l2cap_sock_set_timer(sk, HZ / 5);
-                bh_unlock_sock(sk);
-                sock_put(sk);
-                return;
-        }
-
-        if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONFIG)
-                reason = ECONNREFUSED;
-        else if (sk->sk_state == BT_CONNECT &&
-                        l2cap_pi(sk)->chan->sec_level != BT_SECURITY_SDP)
-                reason = ECONNREFUSED;
-        else
-                reason = ETIMEDOUT;
-
-        __l2cap_sock_close(sk, reason);
-
-        bh_unlock_sock(sk);
-
-        l2cap_sock_kill(sk);
-        sock_put(sk);
-}
-
-void l2cap_sock_set_timer(struct sock *sk, long timeout)
-{
-        BT_DBG("sk %p state %d timeout %ld", sk, sk->sk_state, timeout);
-        sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
-}
-
-void l2cap_sock_clear_timer(struct sock *sk)
-{
-        BT_DBG("sock %p state %d", sk, sk->sk_state);
-        sk_stop_timer(sk, &sk->sk_timer);
-}
+static void l2cap_sock_init(struct sock *sk, struct sock *parent);
+static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio);
 
 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
 {
@@ -133,6 +90,8 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
                 chan->sec_level = BT_SECURITY_SDP;
 
         bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
+
+        chan->state = BT_BOUND;
         sk->sk_state = BT_BOUND;
 
 done:
@@ -162,7 +121,7 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
 
         lock_sock(sk);
 
-        if ((sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM)
+        if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED
                         && !(la.l2_psm || la.l2_cid)) {
                 err = -EINVAL;
                 goto done;
@@ -204,8 +163,8 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
         }
 
         /* PSM must be odd and lsb of upper byte must be 0 */
-        if ((__le16_to_cpu(la.l2_psm) & 0x0101) != 0x0001 &&
-                                sk->sk_type != SOCK_RAW && !la.l2_cid) {
+        if ((__le16_to_cpu(la.l2_psm) & 0x0101) != 0x0001 && !la.l2_cid &&
+                                        chan->chan_type != L2CAP_CHAN_RAW) {
                 err = -EINVAL;
                 goto done;
         }
@@ -258,6 +217,8 @@ static int l2cap_sock_listen(struct socket *sock, int backlog)
 
         sk->sk_max_ack_backlog = backlog;
         sk->sk_ack_backlog = 0;
+
+        chan->state = BT_LISTEN;
         sk->sk_state = BT_LISTEN;
 
 done:
@@ -274,30 +235,26 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int fl
 
         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 
-        if (sk->sk_state != BT_LISTEN) {
-                err = -EBADFD;
-                goto done;
-        }
-
         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 
         BT_DBG("sk %p timeo %ld", sk, timeo);
 
         /* Wait for an incoming connection. (wake-one). */
         add_wait_queue_exclusive(sk_sleep(sk), &wait);
-        while (!(nsk = bt_accept_dequeue(sk, newsock))) {
+        while (1) {
                 set_current_state(TASK_INTERRUPTIBLE);
-                if (!timeo) {
-                        err = -EAGAIN;
+
+                if (sk->sk_state != BT_LISTEN) {
+                        err = -EBADFD;
                         break;
                 }
 
-                release_sock(sk);
-                timeo = schedule_timeout(timeo);
-                lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
+                nsk = bt_accept_dequeue(sk, newsock);
+                if (nsk)
+                        break;
 
-                if (sk->sk_state != BT_LISTEN) {
-                        err = -EBADFD;
+                if (!timeo) {
+                        err = -EAGAIN;
                         break;
                 }
 
@@ -305,8 +262,12 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int fl
                         err = sock_intr_errno(timeo);
                         break;
                 }
+
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
         }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
         remove_wait_queue(sk_sleep(sk), &wait);
 
         if (err)
@@ -437,6 +398,7 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
         struct sock *sk = sock->sk;
         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
         struct bt_security sec;
+        struct bt_power pwr;
         int len, err = 0;
 
         BT_DBG("sk %p", sk);
@@ -454,14 +416,18 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
 
         switch (optname) {
         case BT_SECURITY:
-                if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
-                                && sk->sk_type != SOCK_RAW) {
+                if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
+                                        chan->chan_type != L2CAP_CHAN_RAW) {
                         err = -EINVAL;
                         break;
                 }
 
+                memset(&sec, 0, sizeof(sec));
                 sec.level = chan->sec_level;
 
+                if (sk->sk_state == BT_CONNECTED)
+                        sec.key_size = chan->conn->hcon->enc_key_size;
+
                 len = min_t(unsigned int, len, sizeof(sec));
                 if (copy_to_user(optval, (char *) &sec, len))
                         err = -EFAULT;
@@ -485,6 +451,21 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
 
                 break;
 
+        case BT_POWER:
+                if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
+                                && sk->sk_type != SOCK_RAW) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                pwr.force_active = chan->force_active;
+
+                len = min_t(unsigned int, len, sizeof(pwr));
+                if (copy_to_user(optval, (char *) &pwr, len))
+                        err = -EFAULT;
+
+                break;
+
         default:
                 err = -ENOPROTOOPT;
                 break;
@@ -535,7 +516,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
                 chan->mode = opts.mode;
                 switch (chan->mode) {
                 case L2CAP_MODE_BASIC:
-                        chan->conf_state &= ~L2CAP_CONF_STATE2_DEVICE;
+                        clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
                         break;
                 case L2CAP_MODE_ERTM:
                 case L2CAP_MODE_STREAMING:
@@ -585,6 +566,8 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
         struct sock *sk = sock->sk;
         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
         struct bt_security sec;
+        struct bt_power pwr;
+        struct l2cap_conn *conn;
         int len, err = 0;
         u32 opt;
 
@@ -600,8 +583,8 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
 
         switch (optname) {
         case BT_SECURITY:
-                if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
-                                && sk->sk_type != SOCK_RAW) {
+                if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
+                                        chan->chan_type != L2CAP_CHAN_RAW) {
                         err = -EINVAL;
                         break;
                 }
@@ -621,6 +604,20 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
                 }
 
                 chan->sec_level = sec.level;
+
+                conn = chan->conn;
+                if (conn && chan->scid == L2CAP_CID_LE_DATA) {
+                        if (!conn->hcon->out) {
+                                err = -EINVAL;
+                                break;
+                        }
+
+                        if (smp_conn_security(conn, sec.level))
+                                break;
+
+                        err = 0;
+                        sk->sk_state = BT_CONFIG;
+                }
                 break;
 
         case BT_DEFER_SETUP:
@@ -661,6 +658,23 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
                 chan->flushable = opt;
                 break;
 
+        case BT_POWER:
+                if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
+                                        chan->chan_type != L2CAP_CHAN_RAW) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
+
+                len = min_t(unsigned int, sizeof(pwr), optlen);
+                if (copy_from_user((char *) &pwr, optval, len)) {
+                        err = -EFAULT;
+                        break;
+                }
+                chan->force_active = pwr.force_active;
+                break;
+
         default:
                 err = -ENOPROTOOPT;
                 break;
@@ -674,8 +688,6 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
 {
         struct sock *sk = sock->sk;
         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
-        struct sk_buff *skb;
-        u16 control;
         int err;
 
         BT_DBG("sock %p, sk %p", sock, sk);
@@ -690,87 +702,12 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
         lock_sock(sk);
 
         if (sk->sk_state != BT_CONNECTED) {
-                err = -ENOTCONN;
-                goto done;
-        }
-
-        /* Connectionless channel */
-        if (sk->sk_type == SOCK_DGRAM) {
-                skb = l2cap_create_connless_pdu(chan, msg, len);
-                if (IS_ERR(skb)) {
-                        err = PTR_ERR(skb);
-                } else {
-                        l2cap_do_send(chan, skb);
-                        err = len;
-                }
-                goto done;
+                release_sock(sk);
+                return -ENOTCONN;
         }
 
-        switch (chan->mode) {
-        case L2CAP_MODE_BASIC:
-                /* Check outgoing MTU */
-                if (len > chan->omtu) {
-                        err = -EMSGSIZE;
-                        goto done;
-                }
-
-                /* Create a basic PDU */
-                skb = l2cap_create_basic_pdu(chan, msg, len);
-                if (IS_ERR(skb)) {
-                        err = PTR_ERR(skb);
-                        goto done;
-                }
-
-                l2cap_do_send(chan, skb);
-                err = len;
-                break;
-
-        case L2CAP_MODE_ERTM:
-        case L2CAP_MODE_STREAMING:
-                /* Entire SDU fits into one PDU */
-                if (len <= chan->remote_mps) {
-                        control = L2CAP_SDU_UNSEGMENTED;
-                        skb = l2cap_create_iframe_pdu(chan, msg, len, control,
-                                                                        0);
-                        if (IS_ERR(skb)) {
-                                err = PTR_ERR(skb);
-                                goto done;
-                        }
-                        __skb_queue_tail(&chan->tx_q, skb);
-
-                        if (chan->tx_send_head == NULL)
-                                chan->tx_send_head = skb;
-
-                } else {
-                /* Segment SDU into multiples PDUs */
-                        err = l2cap_sar_segment_sdu(chan, msg, len);
-                        if (err < 0)
-                                goto done;
-                }
-
-                if (chan->mode == L2CAP_MODE_STREAMING) {
-                        l2cap_streaming_send(chan);
-                        err = len;
-                        break;
-                }
-
-                if ((chan->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
-                                (chan->conn_state & L2CAP_CONN_WAIT_F)) {
-                        err = len;
-                        break;
-                }
-                err = l2cap_ertm_send(chan);
-
-                if (err >= 0)
-                        err = len;
-                break;
-
-        default:
-                BT_DBG("bad state %1.1x", chan->mode);
-                err = -EBADFD;
-        }
+        err = l2cap_chan_send(chan, msg, len);
 
-done:
         release_sock(sk);
         return err;
 }
@@ -778,13 +715,15 @@ done:
 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags)
 {
         struct sock *sk = sock->sk;
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        int err;
 
         lock_sock(sk);
 
         if (sk->sk_state == BT_CONNECT2 && bt_sk(sk)->defer_setup) {
                 sk->sk_state = BT_CONFIG;
 
-                __l2cap_connect_rsp_defer(l2cap_pi(sk)->chan);
+                __l2cap_connect_rsp_defer(pi->chan);
                 release_sock(sk);
                 return 0;
         }
@@ -792,15 +731,43 @@ static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct ms
         release_sock(sk);
 
         if (sock->type == SOCK_STREAM)
-                return bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
+                err = bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
+        else
+                err = bt_sock_recvmsg(iocb, sock, msg, len, flags);
+
+        if (pi->chan->mode != L2CAP_MODE_ERTM)
+                return err;
+
+        /* Attempt to put pending rx data in the socket buffer */
+
+        lock_sock(sk);
+
+        if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
+                goto done;
+
+        if (pi->rx_busy_skb) {
+                if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
+                        pi->rx_busy_skb = NULL;
+                else
+                        goto done;
+        }
 
-        return bt_sock_recvmsg(iocb, sock, msg, len, flags);
+        /* Restore data flow when half of the receive buffer is
+         * available.  This avoids resending large numbers of
+         * frames.
+         */
+        if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
+                l2cap_chan_busy(pi->chan, 0);
+
+done:
+        release_sock(sk);
+        return err;
 }
 
 /* Kill socket (only if zapped and orphan)
  * Must be called on unlocked socket.
  */
-void l2cap_sock_kill(struct sock *sk)
+static void l2cap_sock_kill(struct sock *sk)
 {
         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
                 return;
@@ -814,87 +781,6 @@ void l2cap_sock_kill(struct sock *sk)
         sock_put(sk);
 }
 
-/* Must be called on unlocked socket. */
-static void l2cap_sock_close(struct sock *sk)
-{
-        l2cap_sock_clear_timer(sk);
-        lock_sock(sk);
-        __l2cap_sock_close(sk, ECONNRESET);
-        release_sock(sk);
-        l2cap_sock_kill(sk);
-}
-
-static void l2cap_sock_cleanup_listen(struct sock *parent)
-{
-        struct sock *sk;
-
-        BT_DBG("parent %p", parent);
-
-        /* Close not yet accepted channels */
-        while ((sk = bt_accept_dequeue(parent, NULL)))
-                l2cap_sock_close(sk);
-
-        parent->sk_state = BT_CLOSED;
-        sock_set_flag(parent, SOCK_ZAPPED);
-}
-
-void __l2cap_sock_close(struct sock *sk, int reason)
-{
-        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
-        struct l2cap_conn *conn = chan->conn;
-
-        BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
-
-        switch (sk->sk_state) {
-        case BT_LISTEN:
-                l2cap_sock_cleanup_listen(sk);
-                break;
-
-        case BT_CONNECTED:
-        case BT_CONFIG:
-                if ((sk->sk_type == SOCK_SEQPACKET ||
-                                        sk->sk_type == SOCK_STREAM) &&
-                                        conn->hcon->type == ACL_LINK) {
-                        l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
-                        l2cap_send_disconn_req(conn, chan, reason);
-                } else
-                        l2cap_chan_del(chan, reason);
-                break;
-
-        case BT_CONNECT2:
-                if ((sk->sk_type == SOCK_SEQPACKET ||
-                                        sk->sk_type == SOCK_STREAM) &&
-                                        conn->hcon->type == ACL_LINK) {
-                        struct l2cap_conn_rsp rsp;
-                        __u16 result;
-
-                        if (bt_sk(sk)->defer_setup)
-                                result = L2CAP_CR_SEC_BLOCK;
-                        else
-                                result = L2CAP_CR_BAD_PSM;
-
-                        rsp.scid   = cpu_to_le16(chan->dcid);
-                        rsp.dcid   = cpu_to_le16(chan->scid);
-                        rsp.result = cpu_to_le16(result);
-                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
-                        l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
-                                                        sizeof(rsp), &rsp);
-                }
-
-                l2cap_chan_del(chan, reason);
-                break;
-
-        case BT_CONNECT:
-        case BT_DISCONN:
-                l2cap_chan_del(chan, reason);
-                break;
-
-        default:
-                sock_set_flag(sk, SOCK_ZAPPED);
-                break;
-        }
-}
-
 static int l2cap_sock_shutdown(struct socket *sock, int how)
 {
         struct sock *sk = sock->sk;
@@ -912,8 +798,7 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
                         err = __l2cap_wait_ack(sk);
 
                 sk->sk_shutdown = SHUTDOWN_MASK;
-                l2cap_sock_clear_timer(sk);
-                __l2cap_sock_close(sk, 0);
+                l2cap_chan_close(chan, 0);
 
                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
                         err = bt_sock_wait_state(sk, BT_CLOSED,
@@ -944,15 +829,85 @@ static int l2cap_sock_release(struct socket *sock)
         return err;
 }
 
+static struct l2cap_chan *l2cap_sock_new_connection_cb(void *data)
+{
+        struct sock *sk, *parent = data;
+
+        sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
+                                                                GFP_ATOMIC);
+        if (!sk)
+                return NULL;
+
+        l2cap_sock_init(sk, parent);
+
+        return l2cap_pi(sk)->chan;
+}
+
+static int l2cap_sock_recv_cb(void *data, struct sk_buff *skb)
+{
+        int err;
+        struct sock *sk = data;
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+
+        if (pi->rx_busy_skb)
+                return -ENOMEM;
+
+        err = sock_queue_rcv_skb(sk, skb);
+
+        /* For ERTM, handle one skb that doesn't fit into the recv
+         * buffer.  This is important to do because the data frames
+         * have already been acked, so the skb cannot be discarded.
+         *
+         * Notify the l2cap core that the buffer is full, so the
+         * LOCAL_BUSY state is entered and no more frames are
+         * acked and reassembled until there is buffer space
+         * available.
+         */
+        if (err < 0 && pi->chan->mode == L2CAP_MODE_ERTM) {
+                pi->rx_busy_skb = skb;
+                l2cap_chan_busy(pi->chan, 1);
+                err = 0;
+        }
+
+        return err;
+}
+
+static void l2cap_sock_close_cb(void *data)
+{
+        struct sock *sk = data;
+
+        l2cap_sock_kill(sk);
+}
+
+static void l2cap_sock_state_change_cb(void *data, int state)
+{
+        struct sock *sk = data;
+
+        sk->sk_state = state;
+}
+
+static struct l2cap_ops l2cap_chan_ops = {
+        .name           = "L2CAP Socket Interface",
+        .new_connection = l2cap_sock_new_connection_cb,
+        .recv           = l2cap_sock_recv_cb,
+        .close          = l2cap_sock_close_cb,
+        .state_change   = l2cap_sock_state_change_cb,
+};
+
 static void l2cap_sock_destruct(struct sock *sk)
 {
         BT_DBG("sk %p", sk);
 
+        if (l2cap_pi(sk)->rx_busy_skb) {
+                kfree_skb(l2cap_pi(sk)->rx_busy_skb);
+                l2cap_pi(sk)->rx_busy_skb = NULL;
+        }
+
         skb_queue_purge(&sk->sk_receive_queue);
         skb_queue_purge(&sk->sk_write_queue);
 }
 
-void l2cap_sock_init(struct sock *sk, struct sock *parent)
+static void l2cap_sock_init(struct sock *sk, struct sock *parent)
 {
         struct l2cap_pinfo *pi = l2cap_pi(sk);
         struct l2cap_chan *chan = pi->chan;
@@ -965,6 +920,7 @@ void l2cap_sock_init(struct sock *sk, struct sock *parent)
                 sk->sk_type = parent->sk_type;
                 bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
 
+                chan->chan_type = pchan->chan_type;
                 chan->imtu = pchan->imtu;
                 chan->omtu = pchan->omtu;
                 chan->conf_state = pchan->conf_state;
@@ -976,12 +932,27 @@ void l2cap_sock_init(struct sock *sk, struct sock *parent)
                 chan->role_switch = pchan->role_switch;
                 chan->force_reliable = pchan->force_reliable;
                 chan->flushable = pchan->flushable;
+                chan->force_active = pchan->force_active;
         } else {
+
+                switch (sk->sk_type) {
+                case SOCK_RAW:
+                        chan->chan_type = L2CAP_CHAN_RAW;
+                        break;
+                case SOCK_DGRAM:
+                        chan->chan_type = L2CAP_CHAN_CONN_LESS;
+                        break;
+                case SOCK_SEQPACKET:
+                case SOCK_STREAM:
+                        chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
+                        break;
+                }
+
                 chan->imtu = L2CAP_DEFAULT_MTU;
                 chan->omtu = 0;
                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
                         chan->mode = L2CAP_MODE_ERTM;
-                        chan->conf_state |= L2CAP_CONF_STATE2_DEVICE;
+                        set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
                 } else {
                         chan->mode = L2CAP_MODE_BASIC;
                 }
@@ -992,10 +963,15 @@ void l2cap_sock_init(struct sock *sk, struct sock *parent)
                 chan->role_switch = 0;
                 chan->force_reliable = 0;
                 chan->flushable = BT_FLUSHABLE_OFF;
+                chan->force_active = BT_POWER_FORCE_ACTIVE_ON;
+
         }
 
         /* Default config options */
         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
+
+        chan->data = sk;
+        chan->ops = &l2cap_chan_ops;
 }
 
 static struct proto l2cap_proto = {
@@ -1004,9 +980,10 @@ static struct proto l2cap_proto = {
         .obj_size       = sizeof(struct l2cap_pinfo)
 };
 
-struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
+static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 {
         struct sock *sk;
+        struct l2cap_chan *chan;
 
         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
         if (!sk)
@@ -1016,14 +993,20 @@ struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, g
         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 
         sk->sk_destruct = l2cap_sock_destruct;
-        sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
+        sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
 
         sock_reset_flag(sk, SOCK_ZAPPED);
 
         sk->sk_protocol = proto;
         sk->sk_state = BT_OPEN;
 
-        setup_timer(&sk->sk_timer, l2cap_sock_timeout, (unsigned long) sk);
+        chan = l2cap_chan_create(sk);
+        if (!chan) {
+                l2cap_sock_kill(sk);
+                return NULL;
+        }
+
+        l2cap_pi(sk)->chan = chan;
 
         return sk;
 }
@@ -1032,7 +1015,6 @@ static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
                              int kern)
 {
         struct sock *sk;
-        struct l2cap_chan *chan;
 
         BT_DBG("sock %p", sock);
 
@@ -1051,14 +1033,6 @@ static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
         if (!sk)
                 return -ENOMEM;
 
-        chan = l2cap_chan_create(sk);
-        if (!chan) {
-                l2cap_sock_kill(sk);
-                return -ENOMEM;
-        }
-
-        l2cap_pi(sk)->chan = chan;
-
         l2cap_sock_init(sk, NULL);
         return 0;
 }
diff --git a/net/bluetooth/lib.c b/net/bluetooth/lib.c
index b826d1bf10d..86a6bed229d 100644
--- a/net/bluetooth/lib.c
+++ b/net/bluetooth/lib.c
@@ -59,7 +59,7 @@ char *batostr(bdaddr_t *ba)
 EXPORT_SYMBOL(batostr);
 
 /* Bluetooth error codes to Unix errno mapping */
-int bt_err(__u16 code)
+int bt_to_errno(__u16 code)
 {
         switch (code) {
         case 0:
@@ -149,4 +149,23 @@ int bt_err(__u16 code)
                 return ENOSYS;
         }
 }
-EXPORT_SYMBOL(bt_err);
+EXPORT_SYMBOL(bt_to_errno);
+
+int bt_printk(const char *level, const char *format, ...)
+{
+        struct va_format vaf;
+        va_list args;
+        int r;
+
+        va_start(args, format);
+
+        vaf.fmt = format;
+        vaf.va = &args;
+
+        r = printk("%sBluetooth: %pV\n", level, &vaf);
+
+        va_end(args);
+
+        return r;
+}
+EXPORT_SYMBOL(bt_printk);
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index dae382ce702..98327213d93 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -41,7 +41,7 @@ struct pending_cmd {
         void *user_data;
 };
 
-LIST_HEAD(cmd_list);
+static LIST_HEAD(cmd_list);
 
 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 {
@@ -179,7 +179,7 @@ static int read_controller_info(struct sock *sk, u16 index)
 
         hci_del_off_timer(hdev);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         set_bit(HCI_MGMT, &hdev->flags);
 
@@ -208,7 +208,7 @@ static int read_controller_info(struct sock *sk, u16 index)
 
         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
@@ -316,7 +316,7 @@ static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         up = test_bit(HCI_UP, &hdev->flags);
         if ((cp->val && up) || (!cp->val && !up)) {
@@ -343,7 +343,7 @@ static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
         err = 0;
 
 failed:
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
         return err;
 }
@@ -368,7 +368,7 @@ static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         if (!test_bit(HCI_UP, &hdev->flags)) {
                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENETDOWN);
@@ -403,7 +403,7 @@ static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
                 mgmt_pending_remove(cmd);
 
 failed:
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -429,7 +429,7 @@ static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         if (!test_bit(HCI_UP, &hdev->flags)) {
                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENETDOWN);
@@ -463,7 +463,7 @@ static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
                 mgmt_pending_remove(cmd);
 
 failed:
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -522,7 +522,7 @@ static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         if (cp->val)
                 set_bit(HCI_PAIRABLE, &hdev->flags);
@@ -538,7 +538,7 @@ static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
         err = mgmt_event(MGMT_EV_PAIRABLE, index, &ev, sizeof(ev), sk);
 
 failed:
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -739,7 +739,7 @@ static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
         if (!uuid) {
@@ -763,7 +763,7 @@ static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 
 failed:
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -788,7 +788,7 @@ static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
                 err = hci_uuids_clear(hdev);
@@ -823,7 +823,7 @@ static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 
 unlock:
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -847,7 +847,7 @@ static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         hdev->major_class = cp->major;
         hdev->minor_class = cp->minor;
@@ -857,7 +857,7 @@ static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
         if (err == 0)
                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
 
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -879,7 +879,7 @@ static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         BT_DBG("hci%u enable %d", index, cp->enable);
 
@@ -897,7 +897,7 @@ static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
                 err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
                                                                         0);
 
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -908,7 +908,7 @@ static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
         struct hci_dev *hdev;
         struct mgmt_cp_load_keys *cp;
         u16 key_count, expected_len;
-        int i;
+        int i, err;
 
         cp = (void *) data;
 
@@ -918,9 +918,9 @@ static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
         key_count = get_unaligned_le16(&cp->key_count);
 
         expected_len = sizeof(*cp) + key_count * sizeof(struct mgmt_key_info);
-        if (expected_len != len) {
-                BT_ERR("load_keys: expected %u bytes, got %u bytes",
-                                                        len, expected_len);
+        if (expected_len > len) {
+                BT_ERR("load_keys: expected at least %u bytes, got %u bytes",
+                                                        expected_len, len);
                 return -EINVAL;
         }
 
@@ -931,7 +931,7 @@ static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
                                                                 key_count);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         hci_link_keys_clear(hdev);
 
@@ -942,17 +942,36 @@ static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
         else
                 clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
 
-        for (i = 0; i < key_count; i++) {
-                struct mgmt_key_info *key = &cp->keys[i];
+        len -= sizeof(*cp);
+        i = 0;
+
+        while (i < len) {
+                struct mgmt_key_info *key = (void *) cp->keys + i;
+
+                i += sizeof(*key) + key->dlen;
+
+                if (key->type == HCI_LK_SMP_LTK) {
+                        struct key_master_id *id = (void *) key->data;
+
+                        if (key->dlen != sizeof(struct key_master_id))
+                                continue;
+
+                        hci_add_ltk(hdev, 0, &key->bdaddr, key->pin_len,
+                                                id->ediv, id->rand, key->val);
+
+                        continue;
+                }
 
                 hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
                                                                 key->pin_len);
         }
 
-        hci_dev_unlock(hdev);
+        err = cmd_complete(sk, index, MGMT_OP_LOAD_KEYS, NULL, 0);
+
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
-        return 0;
+        return err;
 }
 
 static int remove_key(struct sock *sk, u16 index, unsigned char *data, u16 len)
@@ -971,7 +990,7 @@ static int remove_key(struct sock *sk, u16 index, unsigned char *data, u16 len)
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEY, ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         err = hci_remove_link_key(hdev, &cp->bdaddr);
         if (err < 0) {
@@ -990,11 +1009,11 @@ static int remove_key(struct sock *sk, u16 index, unsigned char *data, u16 len)
 
                 put_unaligned_le16(conn->handle, &dc.handle);
                 dc.reason = 0x13; /* Remote User Terminated Connection */
-                err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, 0, NULL);
+                err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
         }
 
 unlock:
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -1020,7 +1039,7 @@ static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         if (!test_bit(HCI_UP, &hdev->flags)) {
                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENETDOWN);
@@ -1055,7 +1074,7 @@ static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
                 mgmt_pending_remove(cmd);
 
 failed:
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -1076,7 +1095,7 @@ static int get_connections(struct sock *sk, u16 index)
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS, ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         count = 0;
         list_for_each(p, &hdev->conn_hash.list) {
@@ -1092,8 +1111,6 @@ static int get_connections(struct sock *sk, u16 index)
 
         put_unaligned_le16(count, &rp->conn_count);
 
-        read_lock(&hci_dev_list_lock);
-
         i = 0;
         list_for_each(p, &hdev->conn_hash.list) {
                 struct hci_conn *c = list_entry(p, struct hci_conn, list);
@@ -1101,22 +1118,41 @@ static int get_connections(struct sock *sk, u16 index)
                 bacpy(&rp->conn[i++], &c->dst);
         }
 
-        read_unlock(&hci_dev_list_lock);
-
         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
 
 unlock:
         kfree(rp);
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
         return err;
 }
 
+static int send_pin_code_neg_reply(struct sock *sk, u16 index,
+                struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
+{
+        struct pending_cmd *cmd;
+        int err;
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, index, cp,
+                                                                sizeof(*cp));
+        if (!cmd)
+                return -ENOMEM;
+
+        err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
+                                                                &cp->bdaddr);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+        return err;
+}
+
 static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
                                                                         u16 len)
 {
         struct hci_dev *hdev;
+        struct hci_conn *conn;
         struct mgmt_cp_pin_code_reply *cp;
+        struct mgmt_cp_pin_code_neg_reply ncp;
         struct hci_cp_pin_code_reply reply;
         struct pending_cmd *cmd;
         int err;
@@ -1132,13 +1168,32 @@ static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         if (!test_bit(HCI_UP, &hdev->flags)) {
                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENETDOWN);
                 goto failed;
         }
 
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
+        if (!conn) {
+                err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENOTCONN);
+                goto failed;
+        }
+
+        if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
+                bacpy(&ncp.bdaddr, &cp->bdaddr);
+
+                BT_ERR("PIN code is not 16 bytes long");
+
+                err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
+                if (err >= 0)
+                        err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
+                                                                EINVAL);
+
+                goto failed;
+        }
+
         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, index, data, len);
         if (!cmd) {
                 err = -ENOMEM;
@@ -1147,14 +1202,14 @@ static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
 
         bacpy(&reply.bdaddr, &cp->bdaddr);
         reply.pin_len = cp->pin_len;
-        memcpy(reply.pin_code, cp->pin_code, 16);
+        memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
 
         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
         if (err < 0)
                 mgmt_pending_remove(cmd);
 
 failed:
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -1165,7 +1220,6 @@ static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
 {
         struct hci_dev *hdev;
         struct mgmt_cp_pin_code_neg_reply *cp;
-        struct pending_cmd *cmd;
         int err;
 
         BT_DBG("");
@@ -1181,7 +1235,7 @@ static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
                                                                         ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         if (!test_bit(HCI_UP, &hdev->flags)) {
                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
@@ -1189,20 +1243,10 @@ static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
                 goto failed;
         }
 
-        cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, index,
-                                                                data, len);
-        if (!cmd) {
-                err = -ENOMEM;
-                goto failed;
-        }
-
-        err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
-                                                                &cp->bdaddr);
-        if (err < 0)
-                mgmt_pending_remove(cmd);
+        err = send_pin_code_neg_reply(sk, index, hdev, cp);
 
 failed:
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -1225,14 +1269,14 @@ static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         hdev->io_capability = cp->io_capability;
 
         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
                                                         hdev->io_capability);
 
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
@@ -1318,7 +1362,7 @@ static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         if (cp->io_cap == 0x03) {
                 sec_level = BT_SECURITY_MEDIUM;
@@ -1328,7 +1372,7 @@ static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
         }
 
-        conn = hci_connect(hdev, ACL_LINK, &cp->bdaddr, sec_level, auth_type);
+        conn = hci_connect(hdev, ACL_LINK, 0, &cp->bdaddr, sec_level, auth_type);
         if (IS_ERR(conn)) {
                 err = PTR_ERR(conn);
                 goto unlock;
@@ -1360,7 +1404,7 @@ static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
         err = 0;
 
 unlock:
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -1392,7 +1436,7 @@ static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, mgmt_op, ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         if (!test_bit(HCI_UP, &hdev->flags)) {
                 err = cmd_status(sk, index, mgmt_op, ENETDOWN);
@@ -1410,7 +1454,7 @@ static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
                 mgmt_pending_remove(cmd);
 
 failed:
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -1434,7 +1478,7 @@ static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, index, data, len);
         if (!cmd) {
@@ -1449,7 +1493,7 @@ static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
                 mgmt_pending_remove(cmd);
 
 failed:
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -1468,7 +1512,7 @@ static int read_local_oob_data(struct sock *sk, u16 index)
                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
                                                                         ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         if (!test_bit(HCI_UP, &hdev->flags)) {
                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
@@ -1498,7 +1542,7 @@ static int read_local_oob_data(struct sock *sk, u16 index)
                 mgmt_pending_remove(cmd);
 
 unlock:
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -1522,7 +1566,7 @@ static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
                                                                         ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
                                                                 cp->randomizer);
@@ -1532,7 +1576,7 @@ static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
                                                                         0);
 
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -1556,7 +1600,7 @@ static int remove_remote_oob_data(struct sock *sk, u16 index,
                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
                                                                         ENODEV);
 
-        hci_dev_lock(hdev);
+        hci_dev_lock_bh(hdev);
 
         err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
         if (err < 0)
@@ -1566,7 +1610,7 @@ static int remove_remote_oob_data(struct sock *sk, u16 index,
                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
                                                                 NULL, 0);
 
-        hci_dev_unlock(hdev);
+        hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -1641,6 +1685,70 @@ failed:
         return err;
 }
 
+static int block_device(struct sock *sk, u16 index, unsigned char *data,
+                                                                u16 len)
+{
+        struct hci_dev *hdev;
+        struct mgmt_cp_block_device *cp;
+        int err;
+
+        BT_DBG("hci%u", index);
+
+        cp = (void *) data;
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
+                                                        EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
+                                                        ENODEV);
+
+        err = hci_blacklist_add(hdev, &cp->bdaddr);
+
+        if (err < 0)
+                err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE, -err);
+        else
+                err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
+                                                        NULL, 0);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
+                                                                u16 len)
+{
+        struct hci_dev *hdev;
+        struct mgmt_cp_unblock_device *cp;
+        int err;
+
+        BT_DBG("hci%u", index);
+
+        cp = (void *) data;
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
+                                                                EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
+                                                                ENODEV);
+
+        err = hci_blacklist_del(hdev, &cp->bdaddr);
+
+        if (err < 0)
+                err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE, -err);
+        else
+                err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
+                                                                NULL, 0);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
 {
         unsigned char *buf;
@@ -1755,6 +1863,12 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
         case MGMT_OP_STOP_DISCOVERY:
                 err = stop_discovery(sk, index);
                 break;
+        case MGMT_OP_BLOCK_DEVICE:
+                err = block_device(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_UNBLOCK_DEVICE:
+                err = unblock_device(sk, index, buf + sizeof(*hdr), len);
+                break;
         default:
                 BT_DBG("Unknown op %u", opcode);
                 err = cmd_status(sk, index, opcode, 0x01);
@@ -1863,17 +1977,28 @@ int mgmt_connectable(u16 index, u8 connectable)
 
 int mgmt_new_key(u16 index, struct link_key *key, u8 persistent)
 {
-        struct mgmt_ev_new_key ev;
+        struct mgmt_ev_new_key *ev;
+        int err, total;
 
-        memset(&ev, 0, sizeof(ev));
+        total = sizeof(struct mgmt_ev_new_key) + key->dlen;
+        ev = kzalloc(total, GFP_ATOMIC);
+        if (!ev)
+                return -ENOMEM;
 
-        ev.store_hint = persistent;
-        bacpy(&ev.key.bdaddr, &key->bdaddr);
-        ev.key.type = key->type;
-        memcpy(ev.key.val, key->val, 16);
-        ev.key.pin_len = key->pin_len;
+        bacpy(&ev->key.bdaddr, &key->bdaddr);
+        ev->key.type = key->type;
+        memcpy(ev->key.val, key->val, 16);
+        ev->key.pin_len = key->pin_len;
+        ev->key.dlen = key->dlen;
+        ev->store_hint = persistent;
 
-        return mgmt_event(MGMT_EV_NEW_KEY, index, &ev, sizeof(ev), NULL);
+        memcpy(ev->key.data, key->data, key->dlen);
+
+        err = mgmt_event(MGMT_EV_NEW_KEY, index, ev, total, NULL);
+
+        kfree(ev);
+
+        return err;
 }
 
 int mgmt_connected(u16 index, bdaddr_t *bdaddr)
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 5759bb7054f..c2486a53714 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -62,7 +62,6 @@ static DEFINE_MUTEX(rfcomm_mutex);
 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
 
-static unsigned long rfcomm_event;
 
 static LIST_HEAD(session_list);
 
@@ -120,7 +119,6 @@ static inline void rfcomm_schedule(void)
 {
         if (!rfcomm_thread)
                 return;
-        set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
         wake_up_process(rfcomm_thread);
 }
 
@@ -466,7 +464,6 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 
         switch (d->state) {
         case BT_CONNECT:
-        case BT_CONFIG:
                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
                         rfcomm_schedule();
@@ -2038,19 +2035,18 @@ static int rfcomm_run(void *unused)
 
         rfcomm_add_listener(BDADDR_ANY);
 
-        while (!kthread_should_stop()) {
+        while (1) {
                 set_current_state(TASK_INTERRUPTIBLE);
-                if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
-                        /* No pending events. Let's sleep.
-                         * Incoming connections and data will wake us up. */
-                        schedule();
-                }
-                set_current_state(TASK_RUNNING);
+
+                if (kthread_should_stop())
+                        break;
 
                 /* Process stuff */
-                clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
                 rfcomm_process_sessions();
+
+                schedule();
         }
+        __set_current_state(TASK_RUNNING);
 
         rfcomm_kill_listener();
 
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 1b10727ce52..b02f0d47ab8 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -485,11 +485,6 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
 
         lock_sock(sk);
 
-        if (sk->sk_state != BT_LISTEN) {
-                err = -EBADFD;
-                goto done;
-        }
-
         if (sk->sk_type != SOCK_STREAM) {
                 err = -EINVAL;
                 goto done;
@@ -501,19 +496,20 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
 
         /* Wait for an incoming connection. (wake-one). */
         add_wait_queue_exclusive(sk_sleep(sk), &wait);
-        while (!(nsk = bt_accept_dequeue(sk, newsock))) {
+        while (1) {
                 set_current_state(TASK_INTERRUPTIBLE);
-                if (!timeo) {
-                        err = -EAGAIN;
+
+                if (sk->sk_state != BT_LISTEN) {
+                        err = -EBADFD;
                         break;
                 }
 
-                release_sock(sk);
-                timeo = schedule_timeout(timeo);
-                lock_sock(sk);
+                nsk = bt_accept_dequeue(sk, newsock);
+                if (nsk)
+                        break;
 
-                if (sk->sk_state != BT_LISTEN) {
-                        err = -EBADFD;
+                if (!timeo) {
+                        err = -EAGAIN;
                         break;
                 }
 
@@ -521,8 +517,12 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
                         err = sock_intr_errno(timeo);
                         break;
                 }
+
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
         }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
         remove_wait_queue(sk_sleep(sk), &wait);
 
         if (err)
@@ -679,7 +679,8 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
 {
         struct sock *sk = sock->sk;
         struct bt_security sec;
-        int len, err = 0;
+        int err = 0;
+        size_t len;
         u32 opt;
 
         BT_DBG("sk %p", sk);
@@ -741,7 +742,6 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 {
         struct sock *sk = sock->sk;
-        struct sock *l2cap_sk;
         struct rfcomm_conninfo cinfo;
         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
         int len, err = 0;
@@ -786,7 +786,6 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
                         break;
                 }
 
-                l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
 
                 memset(&cinfo, 0, sizeof(cinfo));
                 cinfo.hci_handle = conn->hcon->handle;
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index cb4fb7837e5..d3d48b5b542 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -177,6 +177,7 @@ static int sco_connect(struct sock *sk)
 {
         bdaddr_t *src = &bt_sk(sk)->src;
         bdaddr_t *dst = &bt_sk(sk)->dst;
+        __u16 pkt_type = sco_pi(sk)->pkt_type;
         struct sco_conn *conn;
         struct hci_conn *hcon;
         struct hci_dev  *hdev;
@@ -192,10 +193,12 @@ static int sco_connect(struct sock *sk)
 
         if (lmp_esco_capable(hdev) && !disable_esco)
                 type = ESCO_LINK;
-        else
+        else {
                 type = SCO_LINK;
+                pkt_type &= SCO_ESCO_MASK;
+        }
 
-        hcon = hci_connect(hdev, type, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
+        hcon = hci_connect(hdev, type, pkt_type, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
         if (IS_ERR(hcon)) {
                 err = PTR_ERR(hcon);
                 goto done;
@@ -460,18 +463,22 @@ static int sco_sock_create(struct net *net, struct socket *sock, int protocol,
         return 0;
 }
 
-static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
 {
-        struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
+        struct sockaddr_sco sa;
         struct sock *sk = sock->sk;
-        bdaddr_t *src = &sa->sco_bdaddr;
-        int err = 0;
+        bdaddr_t *src = &sa.sco_bdaddr;
+        int len, err = 0;
 
-        BT_DBG("sk %p %s", sk, batostr(&sa->sco_bdaddr));
+        BT_DBG("sk %p %s", sk, batostr(&sa.sco_bdaddr));
 
         if (!addr || addr->sa_family != AF_BLUETOOTH)
                 return -EINVAL;
 
+        memset(&sa, 0, sizeof(sa));
+        len = min_t(unsigned int, sizeof(sa), alen);
+        memcpy(&sa, addr, len);
+
         lock_sock(sk);
 
         if (sk->sk_state != BT_OPEN) {
@@ -485,7 +492,8 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_le
                 err = -EADDRINUSE;
         } else {
                 /* Save source address */
-                bacpy(&bt_sk(sk)->src, &sa->sco_bdaddr);
+                bacpy(&bt_sk(sk)->src, &sa.sco_bdaddr);
+                sco_pi(sk)->pkt_type = sa.sco_pkt_type;
                 sk->sk_state = BT_BOUND;
         }
 
@@ -498,27 +506,34 @@ done:
 
 static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 {
-        struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
         struct sock *sk = sock->sk;
-        int err = 0;
-
+        struct sockaddr_sco sa;
+        int len, err = 0;
 
         BT_DBG("sk %p", sk);
 
-        if (alen < sizeof(struct sockaddr_sco) ||
-            addr->sa_family != AF_BLUETOOTH)
+        if (!addr || addr->sa_family != AF_BLUETOOTH)
                 return -EINVAL;
 
-        if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
-                return -EBADFD;
-
-        if (sk->sk_type != SOCK_SEQPACKET)
-                return -EINVAL;
+        memset(&sa, 0, sizeof(sa));
+        len = min_t(unsigned int, sizeof(sa), alen);
+        memcpy(&sa, addr, len);
 
         lock_sock(sk);
 
+        if (sk->sk_type != SOCK_SEQPACKET) {
+                err = -EINVAL;
+                goto done;
+        }
+
+        if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
+                err = -EBADFD;
+                goto done;
+        }
+
         /* Set destination address and psm */
-        bacpy(&bt_sk(sk)->dst, &sa->sco_bdaddr);
+        bacpy(&bt_sk(sk)->dst, &sa.sco_bdaddr);
+        sco_pi(sk)->pkt_type = sa.sco_pkt_type;
 
         err = sco_connect(sk);
         if (err)
@@ -564,30 +579,26 @@ static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flag
 
         lock_sock(sk);
 
-        if (sk->sk_state != BT_LISTEN) {
-                err = -EBADFD;
-                goto done;
-        }
-
         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 
         BT_DBG("sk %p timeo %ld", sk, timeo);
 
         /* Wait for an incoming connection. (wake-one). */
         add_wait_queue_exclusive(sk_sleep(sk), &wait);
-        while (!(ch = bt_accept_dequeue(sk, newsock))) {
+        while (1) {
                 set_current_state(TASK_INTERRUPTIBLE);
-                if (!timeo) {
-                        err = -EAGAIN;
+
+                if (sk->sk_state != BT_LISTEN) {
+                        err = -EBADFD;
                         break;
                 }
 
-                release_sock(sk);
-                timeo = schedule_timeout(timeo);
-                lock_sock(sk);
+                ch = bt_accept_dequeue(sk, newsock);
+                if (ch)
+                        break;
 
-                if (sk->sk_state != BT_LISTEN) {
-                        err = -EBADFD;
+                if (!timeo) {
+                        err = -EAGAIN;
                         break;
                 }
 
@@ -595,8 +606,12 @@ static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flag
                         err = sock_intr_errno(timeo);
                         break;
                 }
+
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
         }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
         remove_wait_queue(sk_sleep(sk), &wait);
 
         if (err)
@@ -625,6 +640,7 @@ static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, int *len
                 bacpy(&sa->sco_bdaddr, &bt_sk(sk)->dst);
         else
                 bacpy(&sa->sco_bdaddr, &bt_sk(sk)->src);
+        sa->sco_pkt_type = sco_pi(sk)->pkt_type;
 
         return 0;
 }
@@ -932,7 +948,7 @@ static int sco_connect_cfm(struct hci_conn *hcon, __u8 status)
                 if (conn)
                         sco_conn_ready(conn);
         } else
-                sco_conn_del(hcon, bt_err(status));
+                sco_conn_del(hcon, bt_to_errno(status));
 
         return 0;
 }
@@ -944,7 +960,7 @@ static int sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
         if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
                 return -EINVAL;
 
-        sco_conn_del(hcon, bt_err(reason));
+        sco_conn_del(hcon, bt_to_errno(reason));
 
         return 0;
 }
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
new file mode 100644
index 00000000000..391888b88a9
--- /dev/null
+++ b/net/bluetooth/smp.c
@@ -0,0 +1,702 @@
+/*
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
+   SOFTWARE IS DISCLAIMED.
+*/
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/l2cap.h>
+#include <net/bluetooth/smp.h>
+#include <linux/crypto.h>
+#include <linux/scatterlist.h>
+#include <crypto/b128ops.h>
+
+#define SMP_TIMEOUT 30000 /* 30 seconds */
+
+static inline void swap128(u8 src[16], u8 dst[16])
+{
+        int i;
+        for (i = 0; i < 16; i++)
+                dst[15 - i] = src[i];
+}
+
+static inline void swap56(u8 src[7], u8 dst[7])
+{
+        int i;
+        for (i = 0; i < 7; i++)
+                dst[6 - i] = src[i];
+}
+
+static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
+{
+        struct blkcipher_desc desc;
+        struct scatterlist sg;
+        int err, iv_len;
+        unsigned char iv[128];
+
+        if (tfm == NULL) {
+                BT_ERR("tfm %p", tfm);
+                return -EINVAL;
+        }
+
+        desc.tfm = tfm;
+        desc.flags = 0;
+
+        err = crypto_blkcipher_setkey(tfm, k, 16);
+        if (err) {
+                BT_ERR("cipher setkey failed: %d", err);
+                return err;
+        }
+
+        sg_init_one(&sg, r, 16);
+
+        iv_len = crypto_blkcipher_ivsize(tfm);
+        if (iv_len) {
+                memset(&iv, 0xff, iv_len);
+                crypto_blkcipher_set_iv(tfm, iv, iv_len);
+        }
+
+        err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
+        if (err)
+                BT_ERR("Encrypt data error %d", err);
+
+        return err;
+}
+
+static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
+                u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
+                u8 _rat, bdaddr_t *ra, u8 res[16])
+{
+        u8 p1[16], p2[16];
+        int err;
+
+        memset(p1, 0, 16);
+
+        /* p1 = pres || preq || _rat || _iat */
+        swap56(pres, p1);
+        swap56(preq, p1 + 7);
+        p1[14] = _rat;
+        p1[15] = _iat;
+
+        memset(p2, 0, 16);
+
+        /* p2 = padding || ia || ra */
+        baswap((bdaddr_t *) (p2 + 4), ia);
+        baswap((bdaddr_t *) (p2 + 10), ra);
+
+        /* res = r XOR p1 */
+        u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
+
+        /* res = e(k, res) */
+        err = smp_e(tfm, k, res);
+        if (err) {
+                BT_ERR("Encrypt data error");
+                return err;
+        }
+
+        /* res = res XOR p2 */
+        u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
+
+        /* res = e(k, res) */
+        err = smp_e(tfm, k, res);
+        if (err)
+                BT_ERR("Encrypt data error");
+
+        return err;
+}
+
+static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16],
+                        u8 r1[16], u8 r2[16], u8 _r[16])
+{
+        int err;
+
+        /* Just least significant octets from r1 and r2 are considered */
+        memcpy(_r, r1 + 8, 8);
+        memcpy(_r + 8, r2 + 8, 8);
+
+        err = smp_e(tfm, k, _r);
+        if (err)
+                BT_ERR("Encrypt data error");
+
+        return err;
+}
+
+static int smp_rand(u8 *buf)
+{
+        get_random_bytes(buf, 16);
+
+        return 0;
+}
+
+static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
+                                                u16 dlen, void *data)
+{
+        struct sk_buff *skb;
+        struct l2cap_hdr *lh;
+        int len;
+
+        len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
+
+        if (len > conn->mtu)
+                return NULL;
+
+        skb = bt_skb_alloc(len, GFP_ATOMIC);
+        if (!skb)
+                return NULL;
+
+        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
+        lh->len = cpu_to_le16(sizeof(code) + dlen);
+        lh->cid = cpu_to_le16(L2CAP_CID_SMP);
+
+        memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
+
+        memcpy(skb_put(skb, dlen), data, dlen);
+
+        return skb;
+}
+
+static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
+{
+        struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
+
+        BT_DBG("code 0x%2.2x", code);
+
+        if (!skb)
+                return;
+
+        hci_send_acl(conn->hcon, skb, 0);
+}
+
+static __u8 seclevel_to_authreq(__u8 level)
+{
+        switch (level) {
+        case BT_SECURITY_HIGH:
+                /* Right now we don't support bonding */
+                return SMP_AUTH_MITM;
+
+        default:
+                return SMP_AUTH_NONE;
+        }
+}
+
+static void build_pairing_cmd(struct l2cap_conn *conn,
+                                struct smp_cmd_pairing *req,
+                                struct smp_cmd_pairing *rsp,
+                                __u8 authreq)
+{
+        u8 dist_keys;
+
+        dist_keys = 0;
+        if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->flags)) {
+                dist_keys = SMP_DIST_ENC_KEY | SMP_DIST_ID_KEY | SMP_DIST_SIGN;
+                authreq |= SMP_AUTH_BONDING;
+        }
+
+        if (rsp == NULL) {
+                req->io_capability = conn->hcon->io_capability;
+                req->oob_flag = SMP_OOB_NOT_PRESENT;
+                req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
+                req->init_key_dist = dist_keys;
+                req->resp_key_dist = dist_keys;
+                req->auth_req = authreq;
+                return;
+        }
+
+        rsp->io_capability = conn->hcon->io_capability;
+        rsp->oob_flag = SMP_OOB_NOT_PRESENT;
+        rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
+        rsp->init_key_dist = req->init_key_dist & dist_keys;
+        rsp->resp_key_dist = req->resp_key_dist & dist_keys;
+        rsp->auth_req = authreq;
+}
+
+static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
+{
+        if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
+                        (max_key_size < SMP_MIN_ENC_KEY_SIZE))
+                return SMP_ENC_KEY_SIZE;
+
+        conn->smp_key_size = max_key_size;
+
+        return 0;
+}
+
+static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        struct smp_cmd_pairing rsp, *req = (void *) skb->data;
+        u8 key_size;
+
+        BT_DBG("conn %p", conn);
+
+        conn->preq[0] = SMP_CMD_PAIRING_REQ;
+        memcpy(&conn->preq[1], req, sizeof(*req));
+        skb_pull(skb, sizeof(*req));
+
+        if (req->oob_flag)
+                return SMP_OOB_NOT_AVAIL;
+
+        /* We didn't start the pairing, so no requirements */
+        build_pairing_cmd(conn, req, &rsp, SMP_AUTH_NONE);
+
+        key_size = min(req->max_key_size, rsp.max_key_size);
+        if (check_enc_key_size(conn, key_size))
+                return SMP_ENC_KEY_SIZE;
+
+        /* Just works */
+        memset(conn->tk, 0, sizeof(conn->tk));
+
+        conn->prsp[0] = SMP_CMD_PAIRING_RSP;
+        memcpy(&conn->prsp[1], &rsp, sizeof(rsp));
+
+        smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
+
+        mod_timer(&conn->security_timer, jiffies +
+                                        msecs_to_jiffies(SMP_TIMEOUT));
+
+        return 0;
+}
+
+static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
+        struct smp_cmd_pairing_confirm cp;
+        struct crypto_blkcipher *tfm = conn->hcon->hdev->tfm;
+        int ret;
+        u8 res[16], key_size;
+
+        BT_DBG("conn %p", conn);
+
+        skb_pull(skb, sizeof(*rsp));
+
+        req = (void *) &conn->preq[1];
+
+        key_size = min(req->max_key_size, rsp->max_key_size);
+        if (check_enc_key_size(conn, key_size))
+                return SMP_ENC_KEY_SIZE;
+
+        if (rsp->oob_flag)
+                return SMP_OOB_NOT_AVAIL;
+
+        /* Just works */
+        memset(conn->tk, 0, sizeof(conn->tk));
+
+        conn->prsp[0] = SMP_CMD_PAIRING_RSP;
+        memcpy(&conn->prsp[1], rsp, sizeof(*rsp));
+
+        ret = smp_rand(conn->prnd);
+        if (ret)
+                return SMP_UNSPECIFIED;
+
+        ret = smp_c1(tfm, conn->tk, conn->prnd, conn->preq, conn->prsp, 0,
+                        conn->src, conn->hcon->dst_type, conn->dst, res);
+        if (ret)
+                return SMP_UNSPECIFIED;
+
+        swap128(res, cp.confirm_val);
+
+        smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
+
+        return 0;
+}
+
+static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        struct crypto_blkcipher *tfm = conn->hcon->hdev->tfm;
+
+        BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
+
+        memcpy(conn->pcnf, skb->data, sizeof(conn->pcnf));
+        skb_pull(skb, sizeof(conn->pcnf));
+
+        if (conn->hcon->out) {
+                u8 random[16];
+
+                swap128(conn->prnd, random);
+                smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
+                                                                random);
+        } else {
+                struct smp_cmd_pairing_confirm cp;
+                int ret;
+                u8 res[16];
+
+                ret = smp_rand(conn->prnd);
+                if (ret)
+                        return SMP_UNSPECIFIED;
+
+                ret = smp_c1(tfm, conn->tk, conn->prnd, conn->preq, conn->prsp,
+                                                conn->hcon->dst_type, conn->dst,
+                                                0, conn->src, res);
+                if (ret)
+                        return SMP_CONFIRM_FAILED;
+
+                swap128(res, cp.confirm_val);
+
+                smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
+        }
+
+        mod_timer(&conn->security_timer, jiffies +
+                                        msecs_to_jiffies(SMP_TIMEOUT));
+
+        return 0;
+}
+
+static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        struct hci_conn *hcon = conn->hcon;
+        struct crypto_blkcipher *tfm = hcon->hdev->tfm;
+        int ret;
+        u8 key[16], res[16], random[16], confirm[16];
+
+        swap128(skb->data, random);
+        skb_pull(skb, sizeof(random));
+
+        if (conn->hcon->out)
+                ret = smp_c1(tfm, conn->tk, random, conn->preq, conn->prsp, 0,
+                                conn->src, conn->hcon->dst_type, conn->dst,
+                                res);
+        else
+                ret = smp_c1(tfm, conn->tk, random, conn->preq, conn->prsp,
+                                conn->hcon->dst_type, conn->dst, 0, conn->src,
+                                res);
+        if (ret)
+                return SMP_UNSPECIFIED;
+
+        BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
+
+        swap128(res, confirm);
+
+        if (memcmp(conn->pcnf, confirm, sizeof(conn->pcnf)) != 0) {
+                BT_ERR("Pairing failed (confirmation values mismatch)");
+                return SMP_CONFIRM_FAILED;
+        }
+
+        if (conn->hcon->out) {
+                u8 stk[16], rand[8];
+                __le16 ediv;
+
+                memset(rand, 0, sizeof(rand));
+                ediv = 0;
+
+                smp_s1(tfm, conn->tk, random, conn->prnd, key);
+                swap128(key, stk);
+
+                memset(stk + conn->smp_key_size, 0,
+                                SMP_MAX_ENC_KEY_SIZE - conn->smp_key_size);
+
+                hci_le_start_enc(hcon, ediv, rand, stk);
+                hcon->enc_key_size = conn->smp_key_size;
+        } else {
+                u8 stk[16], r[16], rand[8];
+                __le16 ediv;
+
+                memset(rand, 0, sizeof(rand));
+                ediv = 0;
+
+                swap128(conn->prnd, r);
+                smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
+
+                smp_s1(tfm, conn->tk, conn->prnd, random, key);
+                swap128(key, stk);
+
+                memset(stk + conn->smp_key_size, 0,
+                                SMP_MAX_ENC_KEY_SIZE - conn->smp_key_size);
+
+                hci_add_ltk(conn->hcon->hdev, 0, conn->dst, conn->smp_key_size,
+                                                        ediv, rand, stk);
+        }
+
+        return 0;
+}
+
+static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        struct smp_cmd_security_req *rp = (void *) skb->data;
+        struct smp_cmd_pairing cp;
+        struct hci_conn *hcon = conn->hcon;
+
+        BT_DBG("conn %p", conn);
+
+        if (test_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend))
+                return 0;
+
+        skb_pull(skb, sizeof(*rp));
+
+        memset(&cp, 0, sizeof(cp));
+        build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
+
+        conn->preq[0] = SMP_CMD_PAIRING_REQ;
+        memcpy(&conn->preq[1], &cp, sizeof(cp));
+
+        smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
+
+        mod_timer(&conn->security_timer, jiffies +
+                                        msecs_to_jiffies(SMP_TIMEOUT));
+
+        set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend);
+
+        return 0;
+}
+
+int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
+{
+        struct hci_conn *hcon = conn->hcon;
+        __u8 authreq;
+
+        BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
+
+        if (!lmp_host_le_capable(hcon->hdev))
+                return 1;
+
+        if (IS_ERR(hcon->hdev->tfm))
+                return 1;
+
+        if (test_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend))
+                return 0;
+
+        if (sec_level == BT_SECURITY_LOW)
+                return 1;
+
+        if (hcon->sec_level >= sec_level)
+                return 1;
+
+        authreq = seclevel_to_authreq(sec_level);
+
+        if (hcon->link_mode & HCI_LM_MASTER) {
+                struct smp_cmd_pairing cp;
+                struct link_key *key;
+
+                key = hci_find_link_key_type(hcon->hdev, conn->dst,
+                                                        HCI_LK_SMP_LTK);
+                if (key) {
+                        struct key_master_id *master = (void *) key->data;
+
+                        hci_le_start_enc(hcon, master->ediv, master->rand,
+                                                                key->val);
+                        hcon->enc_key_size = key->pin_len;
+
+                        goto done;
+                }
+
+                build_pairing_cmd(conn, &cp, NULL, authreq);
+                conn->preq[0] = SMP_CMD_PAIRING_REQ;
+                memcpy(&conn->preq[1], &cp, sizeof(cp));
+
+                mod_timer(&conn->security_timer, jiffies +
+                                        msecs_to_jiffies(SMP_TIMEOUT));
+
+                smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
+        } else {
+                struct smp_cmd_security_req cp;
+                cp.auth_req = authreq;
+                smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
+        }
+
+done:
+        hcon->pending_sec_level = sec_level;
+        set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend);
+
+        return 0;
+}
+
+static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        struct smp_cmd_encrypt_info *rp = (void *) skb->data;
+
+        skb_pull(skb, sizeof(*rp));
+
+        memcpy(conn->tk, rp->ltk, sizeof(conn->tk));
+
+        return 0;
+}
+
+static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        struct smp_cmd_master_ident *rp = (void *) skb->data;
+
+        skb_pull(skb, sizeof(*rp));
+
+        hci_add_ltk(conn->hcon->hdev, 1, conn->src, conn->smp_key_size,
+                                                rp->ediv, rp->rand, conn->tk);
+
+        smp_distribute_keys(conn, 1);
+
+        return 0;
+}
+
+int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        __u8 code = skb->data[0];
+        __u8 reason;
+        int err = 0;
+
+        if (!lmp_host_le_capable(conn->hcon->hdev)) {
+                err = -ENOTSUPP;
+                reason = SMP_PAIRING_NOTSUPP;
+                goto done;
+        }
+
+        if (IS_ERR(conn->hcon->hdev->tfm)) {
+                err = PTR_ERR(conn->hcon->hdev->tfm);
+                reason = SMP_PAIRING_NOTSUPP;
+                goto done;
+        }
+
+        skb_pull(skb, sizeof(code));
+
+        switch (code) {
+        case SMP_CMD_PAIRING_REQ:
+                reason = smp_cmd_pairing_req(conn, skb);
+                break;
+
+        case SMP_CMD_PAIRING_FAIL:
+                reason = 0;
+                err = -EPERM;
+                break;
+
+        case SMP_CMD_PAIRING_RSP:
+                reason = smp_cmd_pairing_rsp(conn, skb);
+                break;
+
+        case SMP_CMD_SECURITY_REQ:
+                reason = smp_cmd_security_req(conn, skb);
+                break;
+
+        case SMP_CMD_PAIRING_CONFIRM:
+                reason = smp_cmd_pairing_confirm(conn, skb);
+                break;
+
+        case SMP_CMD_PAIRING_RANDOM:
+                reason = smp_cmd_pairing_random(conn, skb);
+                break;
+
+        case SMP_CMD_ENCRYPT_INFO:
+                reason = smp_cmd_encrypt_info(conn, skb);
+                break;
+
+        case SMP_CMD_MASTER_IDENT:
+                reason = smp_cmd_master_ident(conn, skb);
+                break;
+
+        case SMP_CMD_IDENT_INFO:
+        case SMP_CMD_IDENT_ADDR_INFO:
+        case SMP_CMD_SIGN_INFO:
+                /* Just ignored */
+                reason = 0;
+                break;
+
+        default:
+                BT_DBG("Unknown command code 0x%2.2x", code);
+
+                reason = SMP_CMD_NOTSUPP;
+                err = -EOPNOTSUPP;
+                goto done;
+        }
+
+done:
+        if (reason)
+                smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
+                                                                &reason);
+
+        kfree_skb(skb);
+        return err;
+}
+
+int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
+{
+        struct smp_cmd_pairing *req, *rsp;
+        __u8 *keydist;
+
+        BT_DBG("conn %p force %d", conn, force);
+
+        if (IS_ERR(conn->hcon->hdev->tfm))
+                return PTR_ERR(conn->hcon->hdev->tfm);
+
+        rsp = (void *) &conn->prsp[1];
+
+        /* The responder sends its keys first */
+        if (!force && conn->hcon->out && (rsp->resp_key_dist & 0x07))
+                return 0;
+
+        req = (void *) &conn->preq[1];
+
+        if (conn->hcon->out) {
+                keydist = &rsp->init_key_dist;
+                *keydist &= req->init_key_dist;
+        } else {
+                keydist = &rsp->resp_key_dist;
+                *keydist &= req->resp_key_dist;
+        }
+
+
+        BT_DBG("keydist 0x%x", *keydist);
+
+        if (*keydist & SMP_DIST_ENC_KEY) {
+                struct smp_cmd_encrypt_info enc;
+                struct smp_cmd_master_ident ident;
+                __le16 ediv;
+
+                get_random_bytes(enc.ltk, sizeof(enc.ltk));
+                get_random_bytes(&ediv, sizeof(ediv));
+                get_random_bytes(ident.rand, sizeof(ident.rand));
+
+                smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
+
+                hci_add_ltk(conn->hcon->hdev, 1, conn->dst, conn->smp_key_size,
+                                                ediv, ident.rand, enc.ltk);
+
+                ident.ediv = cpu_to_le16(ediv);
+
+                smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
+
+                *keydist &= ~SMP_DIST_ENC_KEY;
+        }
+
+        if (*keydist & SMP_DIST_ID_KEY) {
+                struct smp_cmd_ident_addr_info addrinfo;
+                struct smp_cmd_ident_info idinfo;
+
+                /* Send a dummy key */
+                get_random_bytes(idinfo.irk, sizeof(idinfo.irk));
+
+                smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
+
+                /* Just public address */
+                memset(&addrinfo, 0, sizeof(addrinfo));
+                bacpy(&addrinfo.bdaddr, conn->src);
+
+                smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
+                                                                &addrinfo);
+
+                *keydist &= ~SMP_DIST_ID_KEY;
+        }
+
+        if (*keydist & SMP_DIST_SIGN) {
+                struct smp_cmd_sign_info sign;
+
+                /* Send a dummy key */
+                get_random_bytes(sign.csrk, sizeof(sign.csrk));
+
+                smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
+
+                *keydist &= ~SMP_DIST_SIGN;
+        }
+
+        return 0;
+}
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 32b8f9f7f79..dac6a214746 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -38,16 +38,17 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 #endif
 
-        u64_stats_update_begin(&brstats->syncp);
-        brstats->tx_packets++;
-        brstats->tx_bytes += skb->len;
-        u64_stats_update_end(&brstats->syncp);
-
         BR_INPUT_SKB_CB(skb)->brdev = dev;
 
         skb_reset_mac_header(skb);
         skb_pull(skb, ETH_HLEN);
 
+        u64_stats_update_begin(&brstats->syncp);
+        brstats->tx_packets++;
+        /* Exclude ETH_HLEN from byte stats for consistency with Rx chain */
+        brstats->tx_bytes += skb->len;
+        u64_stats_update_end(&brstats->syncp);
+
         rcu_read_lock();
         if (is_broadcast_ether_addr(dest))
                 br_flood_deliver(br, skb);
@@ -91,7 +92,6 @@ static int br_dev_open(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
 
-        netif_carrier_off(dev);
         netdev_update_features(dev);
         netif_start_queue(dev);
         br_stp_enable_bridge(br);
@@ -108,8 +108,6 @@ static int br_dev_stop(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
 
-        netif_carrier_off(dev);
-
         br_stp_disable_bridge(br);
         br_multicast_stop(br);
 
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 1bacca4cb67..eae6a4e9cbf 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -161,9 +161,10 @@ static void del_nbp(struct net_bridge_port *p)
         call_rcu(&p->rcu, destroy_nbp_rcu);
 }
 
-/* called with RTNL */
-static void del_br(struct net_bridge *br, struct list_head *head)
+/* Delete bridge device */
+void br_dev_delete(struct net_device *dev, struct list_head *head)
 {
+        struct net_bridge *br = netdev_priv(dev);
         struct net_bridge_port *p, *n;
 
         list_for_each_entry_safe(p, n, &br->port_list, list) {
@@ -231,6 +232,7 @@ static struct net_bridge_port *new_nbp(struct net_bridge *br,
 int br_add_bridge(struct net *net, const char *name)
 {
         struct net_device *dev;
+        int res;
 
         dev = alloc_netdev(sizeof(struct net_bridge), name,
                            br_dev_setup);
@@ -239,8 +241,12 @@ int br_add_bridge(struct net *net, const char *name)
                 return -ENOMEM;
 
         dev_net_set(dev, net);
+        dev->rtnl_link_ops = &br_link_ops;
 
-        return register_netdev(dev);
+        res = register_netdev(dev);
+        if (res)
+                free_netdev(dev);
+        return res;
 }
 
 int br_del_bridge(struct net *net, const char *name)
@@ -264,7 +270,7 @@ int br_del_bridge(struct net *net, const char *name)
         }
 
         else
-                del_br(netdev_priv(dev), NULL);
+                br_dev_delete(dev, NULL);
 
         rtnl_unlock();
         return ret;
@@ -441,7 +447,7 @@ void __net_exit br_net_exit(struct net *net)
         rtnl_lock();
         for_each_netdev(net, dev)
                 if (dev->priv_flags & IFF_EBRIDGE)
-                        del_br(netdev_priv(dev), &list);
+                        br_dev_delete(dev, &list);
 
         unregister_netdevice_many(&list);
         rtnl_unlock();
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 2d85ca7111d..e78269d798c 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -241,7 +241,6 @@ static void br_multicast_group_expired(unsigned long data)
         hlist_del_rcu(&mp->hlist[mdb->ver]);
         mdb->size--;
 
-        del_timer(&mp->query_timer);
         call_rcu_bh(&mp->rcu, br_multicast_free_group);
 
 out:
@@ -271,7 +270,6 @@ static void br_multicast_del_pg(struct net_bridge *br,
                 rcu_assign_pointer(*pp, p->next);
                 hlist_del_init(&p->mglist);
                 del_timer(&p->timer);
-                del_timer(&p->query_timer);
                 call_rcu_bh(&p->rcu, br_multicast_free_pg);
 
                 if (!mp->ports && !mp->mglist &&
@@ -446,8 +444,11 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
         ip6h->nexthdr = IPPROTO_HOPOPTS;
         ip6h->hop_limit = 1;
         ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
-        ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
-                           &ip6h->saddr);
+        if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
+                               &ip6h->saddr)) {
+                kfree_skb(skb);
+                return NULL;
+        }
         ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
 
         hopopt = (u8 *)(ip6h + 1);
@@ -504,74 +505,6 @@ static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
         return NULL;
 }
 
-static void br_multicast_send_group_query(struct net_bridge_mdb_entry *mp)
-{
-        struct net_bridge *br = mp->br;
-        struct sk_buff *skb;
-
-        skb = br_multicast_alloc_query(br, &mp->addr);
-        if (!skb)
-                goto timer;
-
-        netif_rx(skb);
-
-timer:
-        if (++mp->queries_sent < br->multicast_last_member_count)
-                mod_timer(&mp->query_timer,
-                          jiffies + br->multicast_last_member_interval);
-}
-
-static void br_multicast_group_query_expired(unsigned long data)
-{
-        struct net_bridge_mdb_entry *mp = (void *)data;
-        struct net_bridge *br = mp->br;
-
-        spin_lock(&br->multicast_lock);
-        if (!netif_running(br->dev) || !mp->mglist ||
-            mp->queries_sent >= br->multicast_last_member_count)
-                goto out;
-
-        br_multicast_send_group_query(mp);
-
-out:
-        spin_unlock(&br->multicast_lock);
-}
-
-static void br_multicast_send_port_group_query(struct net_bridge_port_group *pg)
-{
-        struct net_bridge_port *port = pg->port;
-        struct net_bridge *br = port->br;
-        struct sk_buff *skb;
-
-        skb = br_multicast_alloc_query(br, &pg->addr);
-        if (!skb)
-                goto timer;
-
-        br_deliver(port, skb);
-
-timer:
-        if (++pg->queries_sent < br->multicast_last_member_count)
-                mod_timer(&pg->query_timer,
-                          jiffies + br->multicast_last_member_interval);
-}
-
-static void br_multicast_port_group_query_expired(unsigned long data)
-{
-        struct net_bridge_port_group *pg = (void *)data;
-        struct net_bridge_port *port = pg->port;
-        struct net_bridge *br = port->br;
-
-        spin_lock(&br->multicast_lock);
-        if (!netif_running(br->dev) || hlist_unhashed(&pg->mglist) ||
-            pg->queries_sent >= br->multicast_last_member_count)
-                goto out;
-
-        br_multicast_send_port_group_query(pg);
-
-out:
-        spin_unlock(&br->multicast_lock);
-}
-
 static struct net_bridge_mdb_entry *br_multicast_get_group(
         struct net_bridge *br, struct net_bridge_port *port,
         struct br_ip *group, int hash)
@@ -687,8 +620,6 @@ rehash:
         mp->addr = *group;
         setup_timer(&mp->timer, br_multicast_group_expired,
                     (unsigned long)mp);
-        setup_timer(&mp->query_timer, br_multicast_group_query_expired,
-                    (unsigned long)mp);
 
         hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
         mdb->size++;
@@ -743,8 +674,6 @@ static int br_multicast_add_group(struct net_bridge *br,
         hlist_add_head(&p->mglist, &port->mglist);
         setup_timer(&p->timer, br_multicast_port_group_expired,
                     (unsigned long)p);
-        setup_timer(&p->query_timer, br_multicast_port_group_query_expired,
-                    (unsigned long)p);
 
         rcu_assign_pointer(*pp, p);
 
@@ -1288,9 +1217,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
                      time_after(mp->timer.expires, time) :
                      try_to_del_timer_sync(&mp->timer) >= 0)) {
                         mod_timer(&mp->timer, time);
-
-                        mp->queries_sent = 0;
-                        mod_timer(&mp->query_timer, now);
                 }
 
                 goto out;
@@ -1307,9 +1233,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
                      time_after(p->timer.expires, time) :
                      try_to_del_timer_sync(&p->timer) >= 0)) {
                         mod_timer(&p->timer, time);
-
-                        p->queries_sent = 0;
-                        mod_timer(&p->query_timer, now);
                 }
 
                 break;
@@ -1456,7 +1379,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
 {
         struct sk_buff *skb2;
         const struct ipv6hdr *ip6h;
-        struct icmp6hdr *icmp6h;
+        u8 icmp6_type;
         u8 nexthdr;
         unsigned len;
         int offset;
@@ -1502,9 +1425,9 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
         __skb_pull(skb2, offset);
         skb_reset_transport_header(skb2);
 
-        icmp6h = icmp6_hdr(skb2);
+        icmp6_type = icmp6_hdr(skb2)->icmp6_type;
 
-        switch (icmp6h->icmp6_type) {
+        switch (icmp6_type) {
         case ICMPV6_MGM_QUERY:
         case ICMPV6_MGM_REPORT:
         case ICMPV6_MGM_REDUCTION:
@@ -1520,16 +1443,23 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                 err = pskb_trim_rcsum(skb2, len);
                 if (err)
                         goto out;
+                err = -EINVAL;
         }
 
+        ip6h = ipv6_hdr(skb2);
+
         switch (skb2->ip_summed) {
         case CHECKSUM_COMPLETE:
-                if (!csum_fold(skb2->csum))
+                if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, skb2->len,
+                                        IPPROTO_ICMPV6, skb2->csum))
                         break;
                 /*FALLTHROUGH*/
         case CHECKSUM_NONE:
-                skb2->csum = 0;
-                if (skb_checksum_complete(skb2))
+                skb2->csum = ~csum_unfold(csum_ipv6_magic(&ip6h->saddr,
+                                                        &ip6h->daddr,
+                                                        skb2->len,
+                                                        IPPROTO_ICMPV6, 0));
+                if (__skb_checksum_complete(skb2))
                         goto out;
         }
 
@@ -1537,7 +1467,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
 
         BR_INPUT_SKB_CB(skb)->igmp = 1;
 
-        switch (icmp6h->icmp6_type) {
+        switch (icmp6_type) {
         case ICMPV6_MGM_REPORT:
             {
                 struct mld_msg *mld;
@@ -1668,7 +1598,6 @@ void br_multicast_stop(struct net_bridge *br)
                 hlist_for_each_entry_safe(mp, p, n, &mdb->mhash[i],
                                           hlist[ver]) {
                         del_timer(&mp->timer);
-                        del_timer(&mp->query_timer);
                         call_rcu_bh(&mp->rcu, br_multicast_free_group);
                 }
         }
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 56149ec36d7..3dc7f5446a9 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -343,24 +343,26 @@ static int br_nf_pre_routing_finish_ipv6(struct sk_buff *skb)
 static int br_nf_pre_routing_finish_bridge(struct sk_buff *skb)
 {
         struct nf_bridge_info *nf_bridge = skb->nf_bridge;
+        struct neighbour *neigh;
         struct dst_entry *dst;
 
         skb->dev = bridge_parent(skb->dev);
         if (!skb->dev)
                 goto free_skb;
         dst = skb_dst(skb);
+        neigh = dst_get_neighbour(dst);
         if (dst->hh) {
                 neigh_hh_bridge(dst->hh, skb);
                 skb->dev = nf_bridge->physindev;
                 return br_handle_frame_finish(skb);
-        } else if (dst->neighbour) {
+        } else if (neigh) {
                 /* the neighbour function below overwrites the complete
                  * MAC header, so we save the Ethernet source address and
                  * protocol number. */
                 skb_copy_from_linear_data_offset(skb, -(ETH_HLEN-ETH_ALEN), skb->nf_bridge->data, ETH_HLEN-ETH_ALEN);
                 /* tell br_dev_xmit to continue with forwarding */
                 nf_bridge->mask |= BRNF_BRIDGED_DNAT;
-                return dst->neighbour->output(skb);
+                return neigh->output(skb);
         }
 free_skb:
         kfree_skb(skb);
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index ffb0dc4cc0e..71861a9c400 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -203,11 +203,12 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[])
         return 0;
 }
 
-static struct rtnl_link_ops br_link_ops __read_mostly = {
+struct rtnl_link_ops br_link_ops __read_mostly = {
         .kind           = "bridge",
         .priv_size      = sizeof(struct net_bridge),
         .setup          = br_dev_setup,
         .validate       = br_validate,
+        .dellink        = br_dev_delete,
 };
 
 int __init br_netlink_init(void)
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 54578f274d8..7c1f3a09712 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -77,9 +77,7 @@ struct net_bridge_port_group {
         struct hlist_node               mglist;
         struct rcu_head                 rcu;
         struct timer_list               timer;
-        struct timer_list               query_timer;
         struct br_ip                    addr;
-        u32                             queries_sent;
 };
 
 struct net_bridge_mdb_entry
@@ -89,10 +87,8 @@ struct net_bridge_mdb_entry
         struct net_bridge_port_group __rcu *ports;
         struct rcu_head                 rcu;
         struct timer_list               timer;
-        struct timer_list               query_timer;
         struct br_ip                    addr;
         bool                            mglist;
-        u32                             queries_sent;
 };
 
 struct net_bridge_mdb_htable
@@ -124,6 +120,7 @@ struct net_bridge_port
         bridge_id                       designated_bridge;
         u32                             path_cost;
         u32                             designated_cost;
+        unsigned long                   designated_age;
 
         struct timer_list               forward_delay_timer;
         struct timer_list               hold_timer;
@@ -293,6 +290,7 @@ static inline int br_is_root_bridge(const struct net_bridge *br)
 
 /* br_device.c */
 extern void br_dev_setup(struct net_device *dev);
+extern void br_dev_delete(struct net_device *dev, struct list_head *list);
 extern netdev_tx_t br_dev_xmit(struct sk_buff *skb,
                                struct net_device *dev);
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -531,6 +529,7 @@ extern int (*br_fdb_test_addr_hook)(struct net_device *dev, unsigned char *addr)
 #endif
 
 /* br_netlink.c */
+extern struct rtnl_link_ops br_link_ops;
 extern int br_netlink_init(void);
 extern void br_netlink_fini(void);
 extern void br_ifinfo_notify(int event, struct net_bridge_port *port);
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index bb4383e84de..fcff6225154 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -164,8 +164,7 @@ void br_transmit_config(struct net_bridge_port *p)
         else {
                 struct net_bridge_port *root
                         = br_get_port(br, br->root_port);
-                bpdu.message_age = br->max_age
-                        - (root->message_age_timer.expires - jiffies)
+                bpdu.message_age = (jiffies - root->designated_age)
                         + MESSAGE_AGE_INCR;
         }
         bpdu.max_age = br->max_age;
@@ -189,6 +188,7 @@ static inline void br_record_config_information(struct net_bridge_port *p,
         p->designated_cost = bpdu->root_path_cost;
         p->designated_bridge = bpdu->bridge_id;
         p->designated_port = bpdu->port_id;
+        p->designated_age = jiffies + bpdu->message_age;
 
         mod_timer(&p->message_age_timer, jiffies
                   + (p->br->max_age - bpdu->message_age));
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 682c0fedf36..804e50f18a5 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -53,7 +53,6 @@ struct cfcnfg *get_cfcnfg(struct net *net)
         struct caif_net *caifn;
         BUG_ON(!net);
         caifn = net_generic(net, caif_net_id);
-        BUG_ON(!caifn);
         return caifn->cfg;
 }
 EXPORT_SYMBOL(get_cfcnfg);
@@ -63,7 +62,6 @@ static struct caif_device_entry_list *caif_device_list(struct net *net)
         struct caif_net *caifn;
         BUG_ON(!net);
         caifn = net_generic(net, caif_net_id);
-        BUG_ON(!caifn);
         return &caifn->caifdevs;
 }
 
@@ -92,7 +90,6 @@ static struct caif_device_entry *caif_device_alloc(struct net_device *dev)
         struct caif_device_entry *caifd;
 
         caifdevs = caif_device_list(dev_net(dev));
-        BUG_ON(!caifdevs);
 
         caifd = kzalloc(sizeof(*caifd), GFP_ATOMIC);
         if (!caifd)
@@ -108,7 +105,7 @@ static struct caif_device_entry *caif_get(struct net_device *dev)
         struct caif_device_entry_list *caifdevs =
             caif_device_list(dev_net(dev));
         struct caif_device_entry *caifd;
-        BUG_ON(!caifdevs);
+
         list_for_each_entry_rcu(caifd, &caifdevs->list, list) {
                 if (caifd->netdev == dev)
                         return caifd;
@@ -209,8 +206,7 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
         enum cfcnfg_phy_preference pref;
         enum cfcnfg_phy_type phy_type;
         struct cfcnfg *cfg;
-        struct caif_device_entry_list *caifdevs =
-            caif_device_list(dev_net(dev));
+        struct caif_device_entry_list *caifdevs;
 
         if (dev->type != ARPHRD_CAIF)
                 return 0;
@@ -219,6 +215,8 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
         if (cfg == NULL)
                 return 0;
 
+        caifdevs = caif_device_list(dev_net(dev));
+
         switch (what) {
         case NETDEV_REGISTER:
                 caifd = caif_device_alloc(dev);
@@ -348,7 +346,7 @@ static struct notifier_block caif_device_notifier = {
 static int caif_init_net(struct net *net)
 {
         struct caif_net *caifn = net_generic(net, caif_net_id);
-        BUG_ON(!caifn);
+
         INIT_LIST_HEAD(&caifn->caifdevs.list);
         mutex_init(&caifn->caifdevs.lock);
 
@@ -413,7 +411,7 @@ static int __init caif_device_init(void)
 {
         int result;
 
-        result = register_pernet_device(&caif_net_ops);
+        result = register_pernet_subsys(&caif_net_ops);
 
         if (result)
                 return result;
@@ -426,9 +424,9 @@ static int __init caif_device_init(void)
 
 static void __exit caif_device_exit(void)
 {
-        unregister_pernet_device(&caif_net_ops);
         unregister_netdevice_notifier(&caif_device_notifier);
         dev_remove_pack(&caif_packet_type);
+        unregister_pernet_subsys(&caif_net_ops);
 }
 
 module_init(caif_device_init);
diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
index 52fe33bee02..bca32d7c15c 100644
--- a/net/caif/cfcnfg.c
+++ b/net/caif/cfcnfg.c
@@ -313,7 +313,6 @@ int caif_connect_client(struct net *net, struct caif_connect_request *conn_req,
         int err;
         struct cfctrl_link_param param;
         struct cfcnfg *cfg = get_cfcnfg(net);
-        caif_assert(cfg != NULL);
 
         rcu_read_lock();
         err = caif_connect_req_to_link_param(cfg, conn_req, &param);
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 184a6572b67..c6cc66f7286 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -343,6 +343,18 @@ static void bcm_send_to_user(struct bcm_op *op, struct bcm_msg_head *head,
         }
 }
 
+static void bcm_tx_start_timer(struct bcm_op *op)
+{
+        if (op->kt_ival1.tv64 && op->count)
+                hrtimer_start(&op->timer,
+                              ktime_add(ktime_get(), op->kt_ival1),
+                              HRTIMER_MODE_ABS);
+        else if (op->kt_ival2.tv64)
+                hrtimer_start(&op->timer,
+                              ktime_add(ktime_get(), op->kt_ival2),
+                              HRTIMER_MODE_ABS);
+}
+
 static void bcm_tx_timeout_tsklet(unsigned long data)
 {
         struct bcm_op *op = (struct bcm_op *)data;
@@ -364,26 +376,12 @@ static void bcm_tx_timeout_tsklet(unsigned long data)
 
                         bcm_send_to_user(op, &msg_head, NULL, 0);
                 }
-        }
-
-        if (op->kt_ival1.tv64 && (op->count > 0)) {
-
-                /* send (next) frame */
                 bcm_can_tx(op);
-                hrtimer_start(&op->timer,
-                              ktime_add(ktime_get(), op->kt_ival1),
-                              HRTIMER_MODE_ABS);
 
-        } else {
-                if (op->kt_ival2.tv64) {
+        } else if (op->kt_ival2.tv64)
+                bcm_can_tx(op);
 
-                        /* send (next) frame */
-                        bcm_can_tx(op);
-                        hrtimer_start(&op->timer,
-                                      ktime_add(ktime_get(), op->kt_ival2),
-                                      HRTIMER_MODE_ABS);
-                }
-        }
+        bcm_tx_start_timer(op);
 }
 
 /*
@@ -963,23 +961,20 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                         hrtimer_cancel(&op->timer);
         }
 
-        if ((op->flags & STARTTIMER) &&
-            ((op->kt_ival1.tv64 && op->count) || op->kt_ival2.tv64)) {
-
+        if (op->flags & STARTTIMER) {
+                hrtimer_cancel(&op->timer);
                 /* spec: send can_frame when starting timer */
                 op->flags |= TX_ANNOUNCE;
-
-                if (op->kt_ival1.tv64 && (op->count > 0)) {
-                        /* op->count-- is done in bcm_tx_timeout_handler */
-                        hrtimer_start(&op->timer, op->kt_ival1,
-                                      HRTIMER_MODE_REL);
-                } else
-                        hrtimer_start(&op->timer, op->kt_ival2,
-                                      HRTIMER_MODE_REL);
         }
 
-        if (op->flags & TX_ANNOUNCE)
+        if (op->flags & TX_ANNOUNCE) {
                 bcm_can_tx(op);
+                if (op->count)
+                        op->count--;
+        }
+
+        if (op->flags & STARTTIMER)
+                bcm_tx_start_timer(op);
 
         return msg_head->nframes * CFSIZ + MHSIZ;
 }
diff --git a/net/core/Makefile b/net/core/Makefile
index 8a04dd22cf7..0d357b1c4e5 100644
--- a/net/core/Makefile
+++ b/net/core/Makefile
@@ -3,7 +3,7 @@
 #
 
 obj-y := sock.o request_sock.o skbuff.o iovec.o datagram.o stream.o scm.o \
-         gen_stats.o gen_estimator.o net_namespace.o
+         gen_stats.o gen_estimator.o net_namespace.o secure_seq.o
 
 obj-$(CONFIG_SYSCTL) += sysctl_net_core.o
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 9c58c1ec41a..8235b81a7db 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1163,6 +1163,7 @@ static int __dev_open(struct net_device *dev)
                 net_dmaengine_get();
                 dev_set_rx_mode(dev);
                 dev_activate(dev);
+                add_device_randomness(dev->dev_addr, dev->addr_len);
         }
 
         return ret;
@@ -1406,14 +1407,34 @@ EXPORT_SYMBOL(register_netdevice_notifier);
  *      register_netdevice_notifier(). The notifier is unlinked into the
  *      kernel structures and may then be reused. A negative errno code
  *      is returned on a failure.
+ *
+ *      After unregistering unregister and down device events are synthesized
+ *      for all devices on the device list to the removed notifier to remove
+ *      the need for special case cleanup code.
  */
 
 int unregister_netdevice_notifier(struct notifier_block *nb)
 {
+        struct net_device *dev;
+        struct net *net;
         int err;
 
         rtnl_lock();
         err = raw_notifier_chain_unregister(&netdev_chain, nb);
+        if (err)
+                goto unlock;
+
+        for_each_net(net) {
+                for_each_netdev(net, dev) {
+                        if (dev->flags & IFF_UP) {
+                                nb->notifier_call(nb, NETDEV_GOING_DOWN, dev);
+                                nb->notifier_call(nb, NETDEV_DOWN, dev);
+                        }
+                        nb->notifier_call(nb, NETDEV_UNREGISTER, dev);
+                        nb->notifier_call(nb, NETDEV_UNREGISTER_BATCH, dev);
+                }
+        }
+unlock:
         rtnl_unlock();
         return err;
 }
@@ -1513,10 +1534,14 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
-        skb_set_dev(skb, dev);
+        skb->dev = dev;
+        skb_dst_drop(skb);
         skb->tstamp.tv64 = 0;
         skb->pkt_type = PACKET_HOST;
         skb->protocol = eth_type_trans(skb, dev);
+        skb->mark = 0;
+        secpath_reset(skb);
+        nf_reset(skb);
         return netif_rx(skb);
 }
 EXPORT_SYMBOL_GPL(dev_forward_skb);
@@ -1771,36 +1796,6 @@ void netif_device_attach(struct net_device *dev)
 }
 EXPORT_SYMBOL(netif_device_attach);
 
-/**
- * skb_dev_set -- assign a new device to a buffer
- * @skb: buffer for the new device
- * @dev: network device
- *
- * If an skb is owned by a device already, we have to reset
- * all data private to the namespace a device belongs to
- * before assigning it a new device.
- */
-#ifdef CONFIG_NET_NS
-void skb_set_dev(struct sk_buff *skb, struct net_device *dev)
-{
-        skb_dst_drop(skb);
-        if (skb->dev && !net_eq(dev_net(skb->dev), dev_net(dev))) {
-                secpath_reset(skb);
-                nf_reset(skb);
-                skb_init_secmark(skb);
-                skb->mark = 0;
-                skb->priority = 0;
-                skb->nf_trace = 0;
-                skb->ipvs_property = 0;
-#ifdef CONFIG_NET_SCHED
-                skb->tc_index = 0;
-#endif
-        }
-        skb->dev = dev;
-}
-EXPORT_SYMBOL(skb_set_dev);
-#endif /* CONFIG_NET_NS */
-
 /*
  * Invalidate hardware checksum when packet is to be mangled, and
  * complete checksum manually on outgoing path.
@@ -3434,14 +3429,20 @@ static inline gro_result_t
 __napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
         struct sk_buff *p;
+        unsigned int maclen = skb->dev->hard_header_len;
 
         for (p = napi->gro_list; p; p = p->next) {
                 unsigned long diffs;
 
                 diffs = (unsigned long)p->dev ^ (unsigned long)skb->dev;
                 diffs |= p->vlan_tci ^ skb->vlan_tci;
-                diffs |= compare_ether_header(skb_mac_header(p),
-                                              skb_gro_mac_header(skb));
+                if (maclen == ETH_HLEN)
+                        diffs |= compare_ether_header(skb_mac_header(p),
+                                                      skb_gro_mac_header(skb));
+                else if (!diffs)
+                        diffs = memcmp(skb_mac_header(p),
+                                       skb_gro_mac_header(skb),
+                                       maclen);
                 NAPI_GRO_CB(p)->same_flow = !diffs;
                 NAPI_GRO_CB(p)->flush = 0;
         }
@@ -3498,7 +3499,8 @@ EXPORT_SYMBOL(napi_gro_receive);
 static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
 {
         __skb_pull(skb, skb_headlen(skb));
-        skb_reserve(skb, NET_IP_ALIGN - skb_headroom(skb));
+        /* restore the reserve we had after netdev_alloc_skb_ip_align() */
+        skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN - skb_headroom(skb));
         skb->vlan_tci = 0;
         skb->dev = napi->dev;
         skb->skb_iif = 0;
@@ -4729,6 +4731,7 @@ int dev_set_mac_address(struct net_device *dev, struct sockaddr *sa)
         err = ops->ndo_set_mac_address(dev, sa);
         if (!err)
                 call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
+        add_device_randomness(dev->dev_addr, dev->addr_len);
         return err;
 }
 EXPORT_SYMBOL(dev_set_mac_address);
@@ -5506,6 +5509,7 @@ int register_netdevice(struct net_device *dev)
         dev_init_scheduler(dev);
         dev_hold(dev);
         list_netdevice(dev);
+        add_device_randomness(dev->dev_addr, dev->addr_len);
 
         /* Notify protocols, that a new device appeared. */
         ret = call_netdevice_notifiers(NETDEV_REGISTER, dev);
@@ -6105,6 +6109,7 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
         */
         call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
         call_netdevice_notifiers(NETDEV_UNREGISTER_BATCH, dev);
+        rtmsg_ifinfo(RTM_DELLINK, dev, ~0U);
 
         /*
          *      Flush the unicast and multicast chains
diff --git a/net/core/dst.c b/net/core/dst.c
index 6135f367169..8246d47a218 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -171,7 +171,7 @@ void *dst_alloc(struct dst_ops *ops, struct net_device *dev,
         dst_init_metrics(dst, dst_default_metrics, true);
         dst->expires = 0UL;
         dst->path = dst;
-        dst->neighbour = NULL;
+        RCU_INIT_POINTER(dst->_neighbour, NULL);
         dst->hh = NULL;
 #ifdef CONFIG_XFRM
         dst->xfrm = NULL;
@@ -231,7 +231,7 @@ struct dst_entry *dst_destroy(struct dst_entry * dst)
         smp_rmb();
 
 again:
-        neigh = dst->neighbour;
+        neigh = rcu_dereference_protected(dst->_neighbour, 1);
         hh = dst->hh;
         child = dst->child;
 
@@ -240,7 +240,7 @@ again:
                 hh_cache_put(hh);
 
         if (neigh) {
-                dst->neighbour = NULL;
+                RCU_INIT_POINTER(dst->_neighbour, NULL);
                 neigh_release(neigh);
         }
 
@@ -367,14 +367,19 @@ static void dst_ifdown(struct dst_entry *dst, struct net_device *dev,
         if (!unregister) {
                 dst->input = dst->output = dst_discard;
         } else {
+                struct neighbour *neigh;
+
                 dst->dev = dev_net(dst->dev)->loopback_dev;
                 dev_hold(dst->dev);
                 dev_put(dev);
-                if (dst->neighbour && dst->neighbour->dev == dev) {
-                        dst->neighbour->dev = dst->dev;
+                rcu_read_lock();
+                neigh = dst_get_neighbour(dst);
+                if (neigh && neigh->dev == dev) {
+                        neigh->dev = dst->dev;
                         dev_hold(dst->dev);
                         dev_put(dev);
                 }
+                rcu_read_unlock();
         }
 }
 
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index fd14116ad7f..891b19f2c00 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1227,7 +1227,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
                 regs.len = reglen;
 
         regbuf = vzalloc(reglen);
-        if (!regbuf)
+        if (reglen && !regbuf)
                 return -ENOMEM;
 
         ops->get_regs(dev, &regs, regbuf);
@@ -1236,7 +1236,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
         if (copy_to_user(useraddr, &regs, sizeof(regs)))
                 goto out;
         useraddr += offsetof(struct ethtool_regs, data);
-        if (copy_to_user(useraddr, regbuf, regs.len))
+        if (regbuf && copy_to_user(useraddr, regbuf, regs.len))
                 goto out;
         ret = 0;
 
@@ -1964,6 +1964,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_GRXCSUM:
         case ETHTOOL_GTXCSUM:
         case ETHTOOL_GSG:
+        case ETHTOOL_GSSET_INFO:
         case ETHTOOL_GSTRINGS:
         case ETHTOOL_GTSO:
         case ETHTOOL_GPERMADDR:
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 008dc70b064..f39ef5c6084 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -384,8 +384,8 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
                  */
                 list_for_each_entry(r, &ops->rules_list, list) {
                         if (r->action == FR_ACT_GOTO &&
-                            r->target == rule->pref) {
-                                BUG_ON(rtnl_dereference(r->ctarget) != NULL);
+                            r->target == rule->pref &&
+                            rtnl_dereference(r->ctarget) == NULL) {
                                 rcu_assign_pointer(r->ctarget, rule);
                                 if (--ops->unresolved_rules == 0)
                                         break;
diff --git a/net/core/flow.c b/net/core/flow.c
index 990703b8863..a6bda2a514f 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -172,29 +172,26 @@ static void flow_new_hash_rnd(struct flow_cache *fc,
 
 static u32 flow_hash_code(struct flow_cache *fc,
                           struct flow_cache_percpu *fcp,
-                          const struct flowi *key)
+                          const struct flowi *key,
+                          size_t keysize)
 {
         const u32 *k = (const u32 *) key;
+        const u32 length = keysize * sizeof(flow_compare_t) / sizeof(u32);
 
-        return jhash2(k, (sizeof(*key) / sizeof(u32)), fcp->hash_rnd)
+        return jhash2(k, length, fcp->hash_rnd)
                 & (flow_cache_hash_size(fc) - 1);
 }
 
-typedef unsigned long flow_compare_t;
-
 /* I hear what you're saying, use memcmp.  But memcmp cannot make
- * important assumptions that we can here, such as alignment and
- * constant size.
+ * important assumptions that we can here, such as alignment.
  */
-static int flow_key_compare(const struct flowi *key1, const struct flowi *key2)
+static int flow_key_compare(const struct flowi *key1, const struct flowi *key2,
+                            size_t keysize)
 {
         const flow_compare_t *k1, *k1_lim, *k2;
-        const int n_elem = sizeof(struct flowi) / sizeof(flow_compare_t);
-
-        BUILD_BUG_ON(sizeof(struct flowi) % sizeof(flow_compare_t));
 
         k1 = (const flow_compare_t *) key1;
-        k1_lim = k1 + n_elem;
+        k1_lim = k1 + keysize;
 
         k2 = (const flow_compare_t *) key2;
 
@@ -215,6 +212,7 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
         struct flow_cache_entry *fle, *tfle;
         struct hlist_node *entry;
         struct flow_cache_object *flo;
+        size_t keysize;
         unsigned int hash;
 
         local_bh_disable();
@@ -222,6 +220,11 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
 
         fle = NULL;
         flo = NULL;
+
+        keysize = flow_key_size(family);
+        if (!keysize)
+                goto nocache;
+
         /* Packet really early in init?  Making flow_cache_init a
          * pre-smp initcall would solve this.  --RR */
         if (!fcp->hash_table)
@@ -230,11 +233,11 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
         if (fcp->hash_rnd_recalc)
                 flow_new_hash_rnd(fc, fcp);
 
-        hash = flow_hash_code(fc, fcp, key);
+        hash = flow_hash_code(fc, fcp, key, keysize);
         hlist_for_each_entry(tfle, entry, &fcp->hash_table[hash], u.hlist) {
                 if (tfle->family == family &&
                     tfle->dir == dir &&
-                    flow_key_compare(key, &tfle->key) == 0) {
+                    flow_key_compare(key, &tfle->key, keysize) == 0) {
                         fle = tfle;
                         break;
                 }
@@ -248,7 +251,7 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
                 if (fle) {
                         fle->family = family;
                         fle->dir = dir;
-                        memcpy(&fle->key, key, sizeof(*key));
+                        memcpy(&fle->key, key, keysize * sizeof(flow_compare_t));
                         fle->object = NULL;
                         hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
                         fcp->hash_count++;
diff --git a/net/core/link_watch.c b/net/core/link_watch.c
index a7b34213186..357bd4ee4ba 100644
--- a/net/core/link_watch.c
+++ b/net/core/link_watch.c
@@ -126,7 +126,7 @@ static void linkwatch_schedule_work(int urgent)
                 return;
 
         /* It's already running which is good enough. */
-        if (!cancel_delayed_work(&linkwatch_work))
+        if (!__cancel_delayed_work(&linkwatch_work))
                 return;
 
         /* Otherwise we reschedule it again for immediate execution. */
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 799f06e03a2..96bb0a33f86 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -823,6 +823,8 @@ next_elt:
                 write_unlock_bh(&tbl->lock);
                 cond_resched();
                 write_lock_bh(&tbl->lock);
+                nht = rcu_dereference_protected(tbl->nht,
+                                                lockdep_is_held(&tbl->lock));
         }
         /* Cycle through all hash buckets every base_reachable_time/2 ticks.
          * ARP entry timeouts range from 1/2 base_reachable_time to 3/2
@@ -1173,12 +1175,17 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
 
                 while (neigh->nud_state & NUD_VALID &&
                        (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
-                        struct neighbour *n1 = neigh;
+                        struct dst_entry *dst = skb_dst(skb);
+                        struct neighbour *n2, *n1 = neigh;
                         write_unlock_bh(&neigh->lock);
+
+                        rcu_read_lock();
                         /* On shaper/eql skb->dst->neighbour != neigh :( */
-                        if (skb_dst(skb) && skb_dst(skb)->neighbour)
-                                n1 = skb_dst(skb)->neighbour;
+                        if (dst && (n2 = dst_get_neighbour(dst)) != NULL)
+                                n1 = n2;
                         n1->output(skb);
+                        rcu_read_unlock();
+
                         write_lock_bh(&neigh->lock);
                 }
                 skb_queue_purge(&neigh->arp_queue);
@@ -1300,10 +1307,10 @@ EXPORT_SYMBOL(neigh_compat_output);
 int neigh_resolve_output(struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
-        struct neighbour *neigh;
+        struct neighbour *neigh = dst_get_neighbour(dst);
         int rc = 0;
 
-        if (!dst || !(neigh = dst->neighbour))
+        if (!dst)
                 goto discard;
 
         __skb_pull(skb, skb_network_offset(skb));
@@ -1333,7 +1340,7 @@ out:
         return rc;
 discard:
         NEIGH_PRINTK1("neigh_resolve_output: dst=%p neigh=%p\n",
-                      dst, dst ? dst->neighbour : NULL);
+                      dst, neigh);
 out_kfree_skb:
         rc = -EINVAL;
         kfree_skb(skb);
@@ -1347,7 +1354,7 @@ int neigh_connected_output(struct sk_buff *skb)
 {
         int err;
         struct dst_entry *dst = skb_dst(skb);
-        struct neighbour *neigh = dst->neighbour;
+        struct neighbour *neigh = dst_get_neighbour(dst);
         struct net_device *dev = neigh->dev;
         unsigned int seq;
 
@@ -1383,11 +1390,15 @@ static void neigh_proxy_process(unsigned long arg)
 
                 if (tdif <= 0) {
                         struct net_device *dev = skb->dev;
+
                         __skb_unlink(skb, &tbl->proxy_queue);
-                        if (tbl->proxy_redo && netif_running(dev))
+                        if (tbl->proxy_redo && netif_running(dev)) {
+                                rcu_read_lock();
                                 tbl->proxy_redo(skb);
-                        else
+                                rcu_read_unlock();
+                        } else {
                                 kfree_skb(skb);
+                        }
 
                         dev_put(dev);
                 } else if (!sched_next || tdif < sched_next)
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 33d2a1fba13..ec4eae35330 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -781,7 +781,7 @@ net_rx_queue_update_kobjects(struct net_device *net, int old_num, int new_num)
 #endif
 }
 
-#ifdef CONFIG_XPS
+#ifdef CONFIG_SYSFS
 /*
  * netdev_queue sysfs structures and functions.
  */
@@ -827,6 +827,23 @@ static const struct sysfs_ops netdev_queue_sysfs_ops = {
         .store = netdev_queue_attr_store,
 };
 
+static ssize_t show_trans_timeout(struct netdev_queue *queue,
+                                  struct netdev_queue_attribute *attribute,
+                                  char *buf)
+{
+        unsigned long trans_timeout;
+
+        spin_lock_irq(&queue->_xmit_lock);
+        trans_timeout = queue->trans_timeout;
+        spin_unlock_irq(&queue->_xmit_lock);
+
+        return sprintf(buf, "%lu", trans_timeout);
+}
+
+static struct netdev_queue_attribute queue_trans_timeout =
+        __ATTR(tx_timeout, S_IRUGO, show_trans_timeout, NULL);
+
+#ifdef CONFIG_XPS
 static inline unsigned int get_netdev_queue_index(struct netdev_queue *queue)
 {
         struct net_device *dev = queue->dev;
@@ -1021,12 +1038,17 @@ error:
 
 static struct netdev_queue_attribute xps_cpus_attribute =
     __ATTR(xps_cpus, S_IRUGO | S_IWUSR, show_xps_map, store_xps_map);
+#endif /* CONFIG_XPS */
 
 static struct attribute *netdev_queue_default_attrs[] = {
+        &queue_trans_timeout.attr,
+#ifdef CONFIG_XPS
         &xps_cpus_attribute.attr,
+#endif
         NULL
 };
 
+#ifdef CONFIG_XPS
 static void netdev_queue_release(struct kobject *kobj)
 {
         struct netdev_queue *queue = to_netdev_queue(kobj);
@@ -1077,10 +1099,13 @@ static void netdev_queue_release(struct kobject *kobj)
         memset(kobj, 0, sizeof(*kobj));
         dev_put(queue->dev);
 }
+#endif /* CONFIG_XPS */
 
 static struct kobj_type netdev_queue_ktype = {
         .sysfs_ops = &netdev_queue_sysfs_ops,
+#ifdef CONFIG_XPS
         .release = netdev_queue_release,
+#endif
         .default_attrs = netdev_queue_default_attrs,
 };
 
@@ -1103,12 +1128,12 @@ static int netdev_queue_add_kobject(struct net_device *net, int index)
 
         return error;
 }
-#endif /* CONFIG_XPS */
+#endif /* CONFIG_SYSFS */
 
 int
 netdev_queue_update_kobjects(struct net_device *net, int old_num, int new_num)
 {
-#ifdef CONFIG_XPS
+#ifdef CONFIG_SYSFS
         int i;
         int error = 0;
 
@@ -1126,14 +1151,14 @@ netdev_queue_update_kobjects(struct net_device *net, int old_num, int new_num)
         return error;
 #else
         return 0;
-#endif
+#endif /* CONFIG_SYSFS */
 }
 
 static int register_queue_kobjects(struct net_device *net)
 {
         int error = 0, txq = 0, rxq = 0, real_rx = 0, real_tx = 0;
 
-#if defined(CONFIG_RPS) || defined(CONFIG_XPS)
+#ifdef CONFIG_SYSFS
         net->queues_kset = kset_create_and_add("queues",
             NULL, &net->dev.kobj);
         if (!net->queues_kset)
@@ -1174,7 +1199,7 @@ static void remove_queue_kobjects(struct net_device *net)
 
         net_rx_queue_update_kobjects(net, real_rx, 0);
         netdev_queue_update_kobjects(net, real_tx, 0);
-#if defined(CONFIG_RPS) || defined(CONFIG_XPS)
+#ifdef CONFIG_SYSFS
         kset_unregister(net->queues_kset);
 #endif
 }
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index ea489db1bc2..2772ed11bec 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -29,6 +29,20 @@ EXPORT_SYMBOL(init_net);
 
 #define INITIAL_NET_GEN_PTRS    13 /* +1 for len +2 for rcu_head */
 
+static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
+
+static struct net_generic *net_alloc_generic(void)
+{
+        struct net_generic *ng;
+        size_t generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
+
+        ng = kzalloc(generic_size, GFP_KERNEL);
+        if (ng)
+                ng->len = max_gen_ptrs;
+
+        return ng;
+}
+
 static int net_assign_generic(struct net *net, int id, void *data)
 {
         struct net_generic *ng, *old_ng;
@@ -42,8 +56,7 @@ static int net_assign_generic(struct net *net, int id, void *data)
         if (old_ng->len >= id)
                 goto assign;
 
-        ng = kzalloc(sizeof(struct net_generic) +
-                        id * sizeof(void *), GFP_KERNEL);
+        ng = net_alloc_generic();
         if (ng == NULL)
                 return -ENOMEM;
 
@@ -58,7 +71,6 @@ static int net_assign_generic(struct net *net, int id, void *data)
          * the old copy for kfree after a grace period.
          */
 
-        ng->len = id;
         memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
 
         rcu_assign_pointer(net->gen, ng);
@@ -70,21 +82,29 @@ assign:
 
 static int ops_init(const struct pernet_operations *ops, struct net *net)
 {
-        int err;
+        int err = -ENOMEM;
+        void *data = NULL;
+
         if (ops->id && ops->size) {
-                void *data = kzalloc(ops->size, GFP_KERNEL);
+                data = kzalloc(ops->size, GFP_KERNEL);
                 if (!data)
-                        return -ENOMEM;
+                        goto out;
 
                 err = net_assign_generic(net, *ops->id, data);
-                if (err) {
-                        kfree(data);
-                        return err;
-                }
+                if (err)
+                        goto cleanup;
         }
+        err = 0;
         if (ops->init)
-                return ops->init(net);
-        return 0;
+                err = ops->init(net);
+        if (!err)
+                return 0;
+
+cleanup:
+        kfree(data);
+
+out:
+        return err;
 }
 
 static void ops_free(const struct pernet_operations *ops, struct net *net)
@@ -159,18 +179,6 @@ out_undo:
         goto out;
 }
 
-static struct net_generic *net_alloc_generic(void)
-{
-        struct net_generic *ng;
-        size_t generic_size = sizeof(struct net_generic) +
-                INITIAL_NET_GEN_PTRS * sizeof(void *);
-
-        ng = kzalloc(generic_size, GFP_KERNEL);
-        if (ng)
-                ng->len = INITIAL_NET_GEN_PTRS;
-
-        return ng;
-}
 
 #ifdef CONFIG_NET_NS
 static struct kmem_cache *net_cachep;
@@ -446,12 +454,7 @@ static void __unregister_pernet_operations(struct pernet_operations *ops)
 static int __register_pernet_operations(struct list_head *list,
                                         struct pernet_operations *ops)
 {
-        int err = 0;
-        err = ops_init(ops, &init_net);
-        if (err)
-                ops_free(ops, &init_net);
-        return err;
-        
+        return ops_init(ops, &init_net);
 }
 
 static void __unregister_pernet_operations(struct pernet_operations *ops)
@@ -481,6 +484,7 @@ again:
                         }
                         return error;
                 }
+                max_gen_ptrs = max_t(unsigned int, max_gen_ptrs, *ops->id);
         }
         error = __register_pernet_operations(list, ops);
         if (error) {
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 18d9cbda3a3..207a178f73b 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -193,7 +193,7 @@ void netpoll_poll_dev(struct net_device *dev)
 
         poll_napi(dev);
 
-        if (dev->priv_flags & IFF_SLAVE) {
+        if (dev->flags & IFF_SLAVE) {
                 if (dev->npinfo) {
                         struct net_device *bond_dev = dev->master;
                         struct sk_buff *skb;
@@ -357,22 +357,23 @@ EXPORT_SYMBOL(netpoll_send_skb_on_dev);
 
 void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
 {
-        int total_len, eth_len, ip_len, udp_len;
+        int total_len, ip_len, udp_len;
         struct sk_buff *skb;
         struct udphdr *udph;
         struct iphdr *iph;
         struct ethhdr *eth;
 
         udp_len = len + sizeof(*udph);
-        ip_len = eth_len = udp_len + sizeof(*iph);
-        total_len = eth_len + ETH_HLEN + NET_IP_ALIGN;
+        ip_len = udp_len + sizeof(*iph);
+        total_len = ip_len + LL_RESERVED_SPACE(np->dev);
 
-        skb = find_skb(np, total_len, total_len - len);
+        skb = find_skb(np, total_len + np->dev->needed_tailroom,
+                       total_len - len);
         if (!skb)
                 return;
 
         skb_copy_to_linear_data(skb, msg, len);
-        skb->len += len;
+        skb_put(skb, len);
 
         skb_push(skb, sizeof(*udph));
         skb_reset_transport_header(skb);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index f76079cd750..c0e0f7679e7 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -1070,7 +1070,9 @@ static ssize_t pktgen_if_write(struct file *file,
                 len = num_arg(&user_buffer[i], 10, &value);
                 if (len < 0)
                         return len;
-
+                if ((value > 0) &&
+                    (!(pkt_dev->odev->priv_flags & IFF_TX_SKB_SHARING)))
+                        return -ENOTSUPP;
                 i += len;
                 pkt_dev->clone_skb = value;
 
@@ -1930,7 +1932,7 @@ static int pktgen_device_event(struct notifier_block *unused,
 {
         struct net_device *dev = ptr;
 
-        if (!net_eq(dev_net(dev), &init_net))
+        if (!net_eq(dev_net(dev), &init_net) || pktgen_exiting)
                 return NOTIFY_DONE;
 
         /* It is OK that we do not hold the group lock right now,
@@ -3555,7 +3557,6 @@ static int pktgen_add_device(struct pktgen_thread *t, const char *ifname)
         pkt_dev->min_pkt_size = ETH_ZLEN;
         pkt_dev->max_pkt_size = ETH_ZLEN;
         pkt_dev->nfrags = 0;
-        pkt_dev->clone_skb = pg_clone_skb_d;
         pkt_dev->delay = pg_delay_d;
         pkt_dev->count = pg_count_d;
         pkt_dev->sofar = 0;
@@ -3563,7 +3564,6 @@ static int pktgen_add_device(struct pktgen_thread *t, const char *ifname)
         pkt_dev->udp_src_max = 9;
         pkt_dev->udp_dst_min = 9;
         pkt_dev->udp_dst_max = 9;
-
         pkt_dev->vlan_p = 0;
         pkt_dev->vlan_cfi = 0;
         pkt_dev->vlan_id = 0xffff;
@@ -3575,6 +3575,8 @@ static int pktgen_add_device(struct pktgen_thread *t, const char *ifname)
         err = pktgen_setup_dev(pkt_dev, ifname);
         if (err)
                 goto out1;
+        if (pkt_dev->odev->priv_flags & IFF_TX_SKB_SHARING)
+                pkt_dev->clone_skb = pg_clone_skb_d;
 
         pkt_dev->entry = proc_create_data(ifname, 0600, pg_proc_dir,
                                           &pktgen_if_fops, pkt_dev);
@@ -3753,12 +3755,18 @@ static void __exit pg_cleanup(void)
 {
         struct pktgen_thread *t;
         struct list_head *q, *n;
+        LIST_HEAD(list);
 
         /* Stop all interfaces & threads */
         pktgen_exiting = true;
 
-        list_for_each_safe(q, n, &pktgen_threads) {
+        mutex_lock(&pktgen_thread_lock);
+        list_splice_init(&pktgen_threads, &list);
+        mutex_unlock(&pktgen_thread_lock);
+
+        list_for_each_safe(q, n, &list) {
                 t = list_entry(q, struct pktgen_thread, th_list);
+                list_del(&t->th_list);
                 kthread_stop(t->tsk);
                 kfree(t);
         }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index abd936d8a71..ac49ad519ca 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -647,6 +647,12 @@ static void set_operstate(struct net_device *dev, unsigned char transition)
         }
 }
 
+static unsigned int rtnl_dev_get_flags(const struct net_device *dev)
+{
+        return (dev->flags & ~(IFF_PROMISC | IFF_ALLMULTI)) |
+               (dev->gflags & (IFF_PROMISC | IFF_ALLMULTI));
+}
+
 static unsigned int rtnl_dev_combine_flags(const struct net_device *dev,
                                            const struct ifinfomsg *ifm)
 {
@@ -655,7 +661,7 @@ static unsigned int rtnl_dev_combine_flags(const struct net_device *dev,
         /* bugwards compatibility: ifi_change == 0 is treated as ~0 */
         if (ifm->ifi_change)
                 flags = (flags & ifm->ifi_change) |
-                        (dev->flags & ~ifm->ifi_change);
+                        (rtnl_dev_get_flags(dev) & ~ifm->ifi_change);
 
         return flags;
 }
@@ -1298,6 +1304,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                         goto errout;
                 send_addr_notify = 1;
                 modified = 1;
+                add_device_randomness(dev->dev_addr, dev->addr_len);
         }
 
         if (tb[IFLA_MTU]) {
diff --git a/net/core/scm.c b/net/core/scm.c
index 4c1ef026d69..811b53fb330 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -192,7 +192,7 @@ int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
                                         goto error;
 
                                 cred->uid = cred->euid = p->creds.uid;
-                                cred->gid = cred->egid = p->creds.uid;
+                                cred->gid = cred->egid = p->creds.gid;
                                 put_cred(p->cred);
                                 p->cred = cred;
                         }
diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
new file mode 100644
index 00000000000..45329d7c9dd
--- /dev/null
+++ b/net/core/secure_seq.c
@@ -0,0 +1,184 @@
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/cryptohash.h>
+#include <linux/module.h>
+#include <linux/cache.h>
+#include <linux/random.h>
+#include <linux/hrtimer.h>
+#include <linux/ktime.h>
+#include <linux/string.h>
+
+#include <net/secure_seq.h>
+
+static u32 net_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned;
+
+static int __init net_secret_init(void)
+{
+        get_random_bytes(net_secret, sizeof(net_secret));
+        return 0;
+}
+late_initcall(net_secret_init);
+
+static u32 seq_scale(u32 seq)
+{
+        /*
+         *      As close as possible to RFC 793, which
+         *      suggests using a 250 kHz clock.
+         *      Further reading shows this assumes 2 Mb/s networks.
+         *      For 10 Mb/s Ethernet, a 1 MHz clock is appropriate.
+         *      For 10 Gb/s Ethernet, a 1 GHz clock should be ok, but
+         *      we also need to limit the resolution so that the u32 seq
+         *      overlaps less than one time per MSL (2 minutes).
+         *      Choosing a clock of 64 ns period is OK. (period of 274 s)
+         */
+        return seq + (ktime_to_ns(ktime_get_real()) >> 6);
+}
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+__u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
+                                   __be16 sport, __be16 dport)
+{
+        u32 secret[MD5_MESSAGE_BYTES / 4];
+        u32 hash[MD5_DIGEST_WORDS];
+        u32 i;
+
+        memcpy(hash, saddr, 16);
+        for (i = 0; i < 4; i++)
+                secret[i] = net_secret[i] + daddr[i];
+        secret[4] = net_secret[4] +
+                (((__force u16)sport << 16) + (__force u16)dport);
+        for (i = 5; i < MD5_MESSAGE_BYTES / 4; i++)
+                secret[i] = net_secret[i];
+
+        md5_transform(hash, secret);
+
+        return seq_scale(hash[0]);
+}
+EXPORT_SYMBOL(secure_tcpv6_sequence_number);
+
+u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
+                               __be16 dport)
+{
+        u32 secret[MD5_MESSAGE_BYTES / 4];
+        u32 hash[MD5_DIGEST_WORDS];
+        u32 i;
+
+        memcpy(hash, saddr, 16);
+        for (i = 0; i < 4; i++)
+                secret[i] = net_secret[i] + (__force u32) daddr[i];
+        secret[4] = net_secret[4] + (__force u32)dport;
+        for (i = 5; i < MD5_MESSAGE_BYTES / 4; i++)
+                secret[i] = net_secret[i];
+
+        md5_transform(hash, secret);
+
+        return hash[0];
+}
+#endif
+
+#ifdef CONFIG_INET
+__u32 secure_ip_id(__be32 daddr)
+{
+        u32 hash[MD5_DIGEST_WORDS];
+
+        hash[0] = (__force __u32) daddr;
+        hash[1] = net_secret[13];
+        hash[2] = net_secret[14];
+        hash[3] = net_secret[15];
+
+        md5_transform(hash, net_secret);
+
+        return hash[0];
+}
+
+__u32 secure_ipv6_id(const __be32 daddr[4])
+{
+        __u32 hash[4];
+
+        memcpy(hash, daddr, 16);
+        md5_transform(hash, net_secret);
+
+        return hash[0];
+}
+
+__u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
+                                 __be16 sport, __be16 dport)
+{
+        u32 hash[MD5_DIGEST_WORDS];
+
+        hash[0] = (__force u32)saddr;
+        hash[1] = (__force u32)daddr;
+        hash[2] = ((__force u16)sport << 16) + (__force u16)dport;
+        hash[3] = net_secret[15];
+
+        md5_transform(hash, net_secret);
+
+        return seq_scale(hash[0]);
+}
+
+u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport)
+{
+        u32 hash[MD5_DIGEST_WORDS];
+
+        hash[0] = (__force u32)saddr;
+        hash[1] = (__force u32)daddr;
+        hash[2] = (__force u32)dport ^ net_secret[14];
+        hash[3] = net_secret[15];
+
+        md5_transform(hash, net_secret);
+
+        return hash[0];
+}
+EXPORT_SYMBOL_GPL(secure_ipv4_port_ephemeral);
+#endif
+
+#if defined(CONFIG_IP_DCCP) || defined(CONFIG_IP_DCCP_MODULE)
+u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
+                                __be16 sport, __be16 dport)
+{
+        u32 hash[MD5_DIGEST_WORDS];
+        u64 seq;
+
+        hash[0] = (__force u32)saddr;
+        hash[1] = (__force u32)daddr;
+        hash[2] = ((__force u16)sport << 16) + (__force u16)dport;
+        hash[3] = net_secret[15];
+
+        md5_transform(hash, net_secret);
+
+        seq = hash[0] | (((u64)hash[1]) << 32);
+        seq += ktime_to_ns(ktime_get_real());
+        seq &= (1ull << 48) - 1;
+
+        return seq;
+}
+EXPORT_SYMBOL(secure_dccp_sequence_number);
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+u64 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr,
+                                  __be16 sport, __be16 dport)
+{
+        u32 secret[MD5_MESSAGE_BYTES / 4];
+        u32 hash[MD5_DIGEST_WORDS];
+        u64 seq;
+        u32 i;
+
+        memcpy(hash, saddr, 16);
+        for (i = 0; i < 4; i++)
+                secret[i] = net_secret[i] + daddr[i];
+        secret[4] = net_secret[4] +
+                (((__force u16)sport << 16) + (__force u16)dport);
+        for (i = 5; i < MD5_MESSAGE_BYTES / 4; i++)
+                secret[i] = net_secret[i];
+
+        md5_transform(hash, secret);
+
+        seq = hash[0] | (((u64)hash[1]) << 32);
+        seq += ktime_to_ns(ktime_get_real());
+        seq &= (1ull << 48) - 1;
+
+        return seq;
+}
+EXPORT_SYMBOL(secure_dccpv6_sequence_number);
+#endif
+#endif
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 46cbd28f40f..4821df84eba 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2985,6 +2985,8 @@ static void sock_rmem_free(struct sk_buff *skb)
  */
 int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
 {
+        int len = skb->len;
+
         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
             (unsigned)sk->sk_rcvbuf)
                 return -ENOMEM;
@@ -2999,7 +3001,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
 
         skb_queue_tail(&sk->sk_error_queue, skb);
         if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk, skb->len);
+                sk->sk_data_ready(sk, len);
         return 0;
 }
 EXPORT_SYMBOL(sock_queue_err_skb);
diff --git a/net/core/sock.c b/net/core/sock.c
index 6e819780c23..b4bb59a9245 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1257,6 +1257,7 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority)
                         /* It is still raw copy of parent, so invalidate
                          * destructor and make plain sk_free() */
                         newsk->sk_destruct = NULL;
+                        bh_unlock_sock(newsk);
                         sk_free(newsk);
                         newsk = NULL;
                         goto out;
@@ -1500,6 +1501,11 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
         gfp_t gfp_mask;
         long timeo;
         int err;
+        int npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
+
+        err = -EMSGSIZE;
+        if (npages > MAX_SKB_FRAGS)
+                goto failure;
 
         gfp_mask = sk->sk_allocation;
         if (gfp_mask & __GFP_WAIT)
@@ -1518,14 +1524,12 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
                 if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
                         skb = alloc_skb(header_len, gfp_mask);
                         if (skb) {
-                                int npages;
                                 int i;
 
                                 /* No pages, we're done... */
                                 if (!data_len)
                                         break;
 
-                                npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
                                 skb->truesize += data_len;
                                 skb_shinfo(skb)->nr_frags = npages;
                                 for (i = 0; i < npages; i++) {
diff --git a/net/core/timestamping.c b/net/core/timestamping.c
index 7e7ca375d43..97d036a6b89 100644
--- a/net/core/timestamping.c
+++ b/net/core/timestamping.c
@@ -57,9 +57,13 @@ void skb_clone_tx_timestamp(struct sk_buff *skb)
         case PTP_CLASS_V2_VLAN:
                 phydev = skb->dev->phydev;
                 if (likely(phydev->drv->txtstamp)) {
+                        if (!atomic_inc_not_zero(&sk->sk_refcnt))
+                                return;
                         clone = skb_clone(skb, GFP_ATOMIC);
-                        if (!clone)
+                        if (!clone) {
+                                sock_put(sk);
                                 return;
+                        }
                         clone->sk = sk;
                         phydev->drv->txtstamp(phydev, clone, type);
                 }
@@ -76,8 +80,11 @@ void skb_complete_tx_timestamp(struct sk_buff *skb,
         struct sock_exterr_skb *serr;
         int err;
 
-        if (!hwtstamps)
+        if (!hwtstamps) {
+                sock_put(sk);
+                kfree_skb(skb);
                 return;
+        }
 
         *skb_hwtstamps(skb) = *hwtstamps;
         serr = SKB_EXT_ERR(skb);
@@ -86,6 +93,7 @@ void skb_complete_tx_timestamp(struct sk_buff *skb,
         serr->ee.ee_origin = SO_EE_ORIGIN_TIMESTAMPING;
         skb->sk = NULL;
         err = sock_queue_err_skb(sk, skb);
+        sock_put(sk);
         if (err)
                 kfree_skb(skb);
 }
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 8c36adfd191..332639b56f4 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -26,6 +26,7 @@
 #include <net/timewait_sock.h>
 #include <net/tcp_states.h>
 #include <net/xfrm.h>
+#include <net/secure_seq.h>
 
 #include "ackvec.h"
 #include "ccid.h"
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 8dc4348774a..b74f76117dc 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -29,6 +29,7 @@
 #include <net/transp_v6.h>
 #include <net/ip6_checksum.h>
 #include <net/xfrm.h>
+#include <net/secure_seq.h>
 
 #include "dccp.h"
 #include "ipv6.h"
@@ -69,13 +70,7 @@ static inline void dccp_v6_send_check(struct sock *sk, struct sk_buff *skb)
         dh->dccph_checksum = dccp_v6_csum_finish(skb, &np->saddr, &np->daddr);
 }
 
-static inline __u32 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr,
-                                                  __be16 sport, __be16 dport   )
-{
-        return secure_tcpv6_sequence_number(saddr, daddr, sport, dport);
-}
-
-static inline __u32 dccp_v6_init_sequence(struct sk_buff *skb)
+static inline __u64 dccp_v6_init_sequence(struct sk_buff *skb)
 {
         return secure_dccpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
                                              ipv6_hdr(skb)->saddr.s6_addr32,
diff --git a/net/decnet/dn_neigh.c b/net/decnet/dn_neigh.c
index 602dade7e9a..9810610d26c 100644
--- a/net/decnet/dn_neigh.c
+++ b/net/decnet/dn_neigh.c
@@ -208,7 +208,7 @@ static int dn_neigh_output_packet(struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
         struct dn_route *rt = (struct dn_route *)dst;
-        struct neighbour *neigh = dst->neighbour;
+        struct neighbour *neigh = dst_get_neighbour(dst);
         struct net_device *dev = neigh->dev;
         char mac_addr[ETH_ALEN];
 
@@ -227,7 +227,7 @@ static int dn_neigh_output_packet(struct sk_buff *skb)
 static int dn_long_output(struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
-        struct neighbour *neigh = dst->neighbour;
+        struct neighbour *neigh = dst_get_neighbour(dst);
         struct net_device *dev = neigh->dev;
         int headroom = dev->hard_header_len + sizeof(struct dn_long_packet) + 3;
         unsigned char *data;
@@ -274,7 +274,7 @@ static int dn_long_output(struct sk_buff *skb)
 static int dn_short_output(struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
-        struct neighbour *neigh = dst->neighbour;
+        struct neighbour *neigh = dst_get_neighbour(dst);
         struct net_device *dev = neigh->dev;
         int headroom = dev->hard_header_len + sizeof(struct dn_short_packet) + 2;
         struct dn_short_packet *sp;
@@ -318,7 +318,7 @@ static int dn_short_output(struct sk_buff *skb)
 static int dn_phase3_output(struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
-        struct neighbour *neigh = dst->neighbour;
+        struct neighbour *neigh = dst_get_neighbour(dst);
         struct net_device *dev = neigh->dev;
         int headroom = dev->hard_header_len + sizeof(struct dn_short_packet) + 2;
         struct dn_short_packet *sp;
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 74544bc6fde..b91b60363c3 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -241,9 +241,11 @@ static int dn_dst_gc(struct dst_ops *ops)
  */
 static void dn_dst_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
+        struct neighbour *n = dst_get_neighbour(dst);
         u32 min_mtu = 230;
-        struct dn_dev *dn = dst->neighbour ?
-                            rcu_dereference_raw(dst->neighbour->dev->dn_ptr) : NULL;
+        struct dn_dev *dn;
+
+        dn = n ? rcu_dereference_raw(n->dev->dn_ptr) : NULL;
 
         if (dn && dn->use_long == 0)
                 min_mtu -= 6;
@@ -715,7 +717,7 @@ static int dn_output(struct sk_buff *skb)
 
         int err = -EINVAL;
 
-        if ((neigh = dst->neighbour) == NULL)
+        if ((neigh = dst_get_neighbour(dst)) == NULL)
                 goto error;
 
         skb->dev = dev;
@@ -750,7 +752,7 @@ static int dn_forward(struct sk_buff *skb)
         struct dst_entry *dst = skb_dst(skb);
         struct dn_dev *dn_db = rcu_dereference(dst->dev->dn_ptr);
         struct dn_route *rt;
-        struct neighbour *neigh = dst->neighbour;
+        struct neighbour *neigh = dst_get_neighbour(dst);
         int header_len;
 #ifdef CONFIG_NETFILTER
         struct net_device *dev = skb->dev;
@@ -833,11 +835,11 @@ static int dn_rt_set_next_hop(struct dn_route *rt, struct dn_fib_res *res)
         }
         rt->rt_type = res->type;
 
-        if (dev != NULL && rt->dst.neighbour == NULL) {
+        if (dev != NULL && dst_get_neighbour(&rt->dst) == NULL) {
                 n = __neigh_lookup_errno(&dn_neigh_table, &rt->rt_gateway, dev);
                 if (IS_ERR(n))
                         return PTR_ERR(n);
-                rt->dst.neighbour = n;
+                dst_set_neighbour(&rt->dst, n);
         }
 
         if (dst_metric(&rt->dst, RTAX_MTU) > rt->dst.dev->mtu)
@@ -1144,7 +1146,7 @@ make_route:
         rt->rt_dst_map    = fld.daddr;
         rt->rt_src_map    = fld.saddr;
 
-        rt->dst.neighbour = neigh;
+        dst_set_neighbour(&rt->dst, neigh);
         neigh = NULL;
 
         rt->dst.lastuse = jiffies;
@@ -1416,7 +1418,7 @@ make_route:
         rt->fld.flowidn_iif  = in_dev->ifindex;
         rt->fld.flowidn_mark = fld.flowidn_mark;
 
-        rt->dst.neighbour = neigh;
+        dst_set_neighbour(&rt->dst, neigh);
         rt->dst.lastuse = jiffies;
         rt->dst.output = dn_rt_bug;
         switch(res.type) {
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 44d2b42fda5..2780e9b2b1c 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -340,6 +340,7 @@ void ether_setup(struct net_device *dev)
         dev->addr_len           = ETH_ALEN;
         dev->tx_queue_len       = 1000; /* Ethernet wants good queues */
         dev->flags              = IFF_BROADCAST|IFF_MULTICAST;
+        dev->priv_flags         = IFF_TX_SKB_SHARING;
 
         memset(dev->broadcast, 0xFF, ETH_ALEN);
 
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index f2dc69cffb5..681084d76a9 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -14,6 +14,7 @@ obj-y     := route.o inetpeer.o protocol.o \
              inet_fragment.o ping.o
 
 obj-$(CONFIG_SYSCTL) += sysctl_net_ipv4.o
+obj-$(CONFIG_SYSFS) += sysfs_net_ipv4.o
 obj-$(CONFIG_PROC_FS) += proc.o
 obj-$(CONFIG_IP_MULTIPLE_TABLES) += fib_rules.o
 obj-$(CONFIG_IP_MROUTE) += ipmr.o
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index ef1528af7ab..4d60f12c7b6 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -118,6 +118,19 @@
 #include <linux/mroute.h>
 #endif
 
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
+#include <linux/android_aid.h>
+
+static inline int current_has_network(void)
+{
+        return in_egroup_p(AID_INET) || capable(CAP_NET_RAW);
+}
+#else
+static inline int current_has_network(void)
+{
+        return 1;
+}
+#endif
 
 /* The inetsw table contains everything that inet_create needs to
  * build a new socket.
@@ -258,6 +271,7 @@ static inline int inet_netns_ok(struct net *net, int protocol)
         return ipprot->netns_ok;
 }
 
+
 /*
  *      Create an inet socket.
  */
@@ -274,6 +288,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol,
         int try_loading_module = 0;
         int err;
 
+        if (!current_has_network())
+                return -EACCES;
+
         if (unlikely(!inet_ehash_secret))
                 if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
                         build_ehash_secret();
@@ -874,6 +891,7 @@ int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         case SIOCSIFPFLAGS:
         case SIOCGIFPFLAGS:
         case SIOCSIFFLAGS:
+        case SIOCKILLADDR:
                 err = devinet_ioctl(net, cmd, (void __user *)arg);
                 break;
         default:
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index c1f4154552f..36d14406261 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -136,8 +136,6 @@ static void ah_output_done(struct crypto_async_request *base, int err)
                 memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
         }
 
-        err = ah->nexthdr;
-
         kfree(AH_SKB_CB(skb)->tmp);
         xfrm_output_resume(skb, err);
 }
@@ -264,12 +262,12 @@ static void ah_input_done(struct crypto_async_request *base, int err)
         if (err)
                 goto out;
 
+        err = ah->nexthdr;
+
         skb->network_header += ah_hlen;
         memcpy(skb_network_header(skb), work_iph, ihl);
         __skb_pull(skb, ah_hlen + ihl);
         skb_set_transport_header(skb, -ihl);
-
-        err = ah->nexthdr;
 out:
         kfree(AH_SKB_CB(skb)->tmp);
         xfrm_input_resume(skb, err);
@@ -371,8 +369,6 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
                 if (err == -EINPROGRESS)
                         goto out;
 
-                if (err == -EBUSY)
-                        err = NET_XMIT_DROP;
                 goto out_free;
         }
 
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 1b74d3b6437..d8f852dbf66 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -518,26 +518,32 @@ EXPORT_SYMBOL(arp_find);
 
 /* END OF OBSOLETE FUNCTIONS */
 
+struct neighbour *__arp_bind_neighbour(struct dst_entry *dst, __be32 nexthop)
+{
+        struct net_device *dev = dst->dev;
+
+        if (dev->flags & (IFF_LOOPBACK | IFF_POINTOPOINT))
+                nexthop = 0;
+        return __neigh_lookup_errno(
+#if defined(CONFIG_ATM_CLIP) || defined(CONFIG_ATM_CLIP_MODULE)
+                dev->type == ARPHRD_ATM ?
+                clip_tbl_hook :
+#endif
+                &arp_tbl, &nexthop, dev);
+}
+
 int arp_bind_neighbour(struct dst_entry *dst)
 {
         struct net_device *dev = dst->dev;
-        struct neighbour *n = dst->neighbour;
+        struct neighbour *n = dst_get_neighbour(dst);
 
         if (dev == NULL)
                 return -EINVAL;
         if (n == NULL) {
-                __be32 nexthop = ((struct rtable *)dst)->rt_gateway;
-                if (dev->flags & (IFF_LOOPBACK | IFF_POINTOPOINT))
-                        nexthop = 0;
-                n = __neigh_lookup_errno(
-#if defined(CONFIG_ATM_CLIP) || defined(CONFIG_ATM_CLIP_MODULE)
-                                         dev->type == ARPHRD_ATM ?
-                                         clip_tbl_hook :
-#endif
-                                         &arp_tbl, &nexthop, dev);
+                n = __arp_bind_neighbour(dst, ((struct rtable *)dst)->rt_gateway);
                 if (IS_ERR(n))
                         return PTR_ERR(n);
-                dst->neighbour = n;
+                dst_set_neighbour(dst, n);
         }
         return 0;
 }
@@ -900,7 +906,8 @@ static int arp_process(struct sk_buff *skb)
                         if (addr_type == RTN_UNICAST  &&
                             (arp_fwd_proxy(in_dev, dev, rt) ||
                              arp_fwd_pvlan(in_dev, dev, rt, sip, tip) ||
-                             pneigh_lookup(&arp_tbl, net, &tip, dev, 0))) {
+                             (rt->dst.dev != dev &&
+                              pneigh_lookup(&arp_tbl, net, &tip, dev, 0)))) {
                                 n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
                                 if (n)
                                         neigh_release(n);
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 2b3c23c287c..062876b7730 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1725,8 +1725,10 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
                 case CIPSO_V4_TAG_LOCAL:
                         /* This is a non-standard tag that we only allow for
                          * local connections, so if the incoming interface is
-                         * not the loopback device drop the packet. */
-                        if (!(skb->dev->flags & IFF_LOOPBACK)) {
+                         * not the loopback device drop the packet. Further,
+                         * there is no legitimate reason for setting this from
+                         * userspace so reject it if skb is NULL. */
+                        if (skb == NULL || !(skb->dev->flags & IFF_LOOPBACK)) {
                                 err_offset = opt_iter;
                                 goto validate_return_locked;
                         }
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 0d4a184af16..c48323ad268 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -59,6 +59,7 @@
 
 #include <net/arp.h>
 #include <net/ip.h>
+#include <net/tcp.h>
 #include <net/route.h>
 #include <net/ip_fib.h>
 #include <net/rtnetlink.h>
@@ -735,6 +736,7 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         case SIOCSIFBRDADDR:    /* Set the broadcast address */
         case SIOCSIFDSTADDR:    /* Set the destination address */
         case SIOCSIFNETMASK:    /* Set the netmask for the interface */
+        case SIOCKILLADDR:      /* Nuke all sockets on this address */
                 ret = -EACCES;
                 if (!capable(CAP_NET_ADMIN))
                         goto out;
@@ -786,7 +788,8 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         }
 
         ret = -EADDRNOTAVAIL;
-        if (!ifa && cmd != SIOCSIFADDR && cmd != SIOCSIFFLAGS)
+        if (!ifa && cmd != SIOCSIFADDR && cmd != SIOCSIFFLAGS
+            && cmd != SIOCKILLADDR)
                 goto done;
 
         switch (cmd) {
@@ -912,6 +915,9 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                         inet_insert_ifa(ifa);
                 }
                 break;
+        case SIOCKILLADDR:      /* Nuke all connections on this address */
+                ret = tcp_nuke_addr(net, (struct sockaddr *) sin);
+                break;
         }
 done:
         rtnl_unlock();
@@ -1134,15 +1140,15 @@ static void inetdev_send_gratuitous_arp(struct net_device *dev,
                                         struct in_device *in_dev)
 
 {
-        struct in_ifaddr *ifa = in_dev->ifa_list;
-
-        if (!ifa)
-                return;
+        struct in_ifaddr *ifa;
 
-        arp_send(ARPOP_REQUEST, ETH_P_ARP,
-                 ifa->ifa_local, dev,
-                 ifa->ifa_local, NULL,
-                 dev->dev_addr, NULL);
+        for (ifa = in_dev->ifa_list; ifa;
+             ifa = ifa->ifa_next) {
+                arp_send(ARPOP_REQUEST, ETH_P_ARP,
+                         ifa->ifa_local, dev,
+                         ifa->ifa_local, NULL,
+                         dev->dev_addr, NULL);
+        }
 }
 
 /* Called only under RTNL semaphore */
@@ -1490,7 +1496,9 @@ static int devinet_conf_proc(ctl_table *ctl, int write,
                              void __user *buffer,
                              size_t *lenp, loff_t *ppos)
 {
+        int old_value = *(int *)ctl->data;
         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+        int new_value = *(int *)ctl->data;
 
         if (write) {
                 struct ipv4_devconf *cnf = ctl->extra1;
@@ -1501,6 +1509,9 @@ static int devinet_conf_proc(ctl_table *ctl, int write,
 
                 if (cnf == net->ipv4.devconf_dflt)
                         devinet_copy_dflt_conf(net, i);
+                if (i == IPV4_DEVCONF_ACCEPT_LOCAL - 1)
+                        if ((new_value == 0) && (old_value != 0))
+                                rt_cache_flush(net, 0);
         }
 
         return ret;
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index a5b413416da..530787bc199 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -457,28 +457,22 @@ static u32 esp4_get_mtu(struct xfrm_state *x, int mtu)
         struct esp_data *esp = x->data;
         u32 blksize = ALIGN(crypto_aead_blocksize(esp->aead), 4);
         u32 align = max_t(u32, blksize, esp->padlen);
-        u32 rem;
-
-        mtu -= x->props.header_len + crypto_aead_authsize(esp->aead);
-        rem = mtu & (align - 1);
-        mtu &= ~(align - 1);
+        unsigned int net_adj;
 
         switch (x->props.mode) {
-        case XFRM_MODE_TUNNEL:
-                break;
-        default:
         case XFRM_MODE_TRANSPORT:
-                /* The worst case */
-                mtu -= blksize - 4;
-                mtu += min_t(u32, blksize - 4, rem);
-                break;
         case XFRM_MODE_BEET:
-                /* The worst case. */
-                mtu += min_t(u32, IPV4_BEET_PHMAXLEN, rem);
+                net_adj = sizeof(struct iphdr);
                 break;
+        case XFRM_MODE_TUNNEL:
+                net_adj = 0;
+                break;
+        default:
+                BUG();
         }
 
-        return mtu - 2;
+        return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
+                 net_adj) & ~(align - 1)) + (net_adj - 2);
 }
 
 static void esp4_err(struct sk_buff *skb, u32 info)
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 33e2c35b74b..7e454ba8e85 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -142,6 +142,18 @@ const struct fib_prop fib_props[RTN_MAX + 1] = {
 };
 
 /* Release a nexthop info record */
+static void free_fib_info_rcu(struct rcu_head *head)
+{
+        struct fib_info *fi = container_of(head, struct fib_info, rcu);
+
+        change_nexthops(fi) {
+                if (nexthop_nh->nh_dev)
+                        dev_put(nexthop_nh->nh_dev);
+        } endfor_nexthops(fi);
+
+        release_net(fi->fib_net);
+        kfree(fi);
+}
 
 void free_fib_info(struct fib_info *fi)
 {
@@ -149,14 +161,8 @@ void free_fib_info(struct fib_info *fi)
                 pr_warning("Freeing alive fib_info %p\n", fi);
                 return;
         }
-        change_nexthops(fi) {
-                if (nexthop_nh->nh_dev)
-                        dev_put(nexthop_nh->nh_dev);
-                nexthop_nh->nh_dev = NULL;
-        } endfor_nexthops(fi);
         fib_info_cnt--;
-        release_net(fi->fib_net);
-        kfree_rcu(fi, rcu);
+        call_rcu(&fi->rcu, free_fib_info_rcu);
 }
 
 void fib_release_info(struct fib_info *fi)
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 58c25ea5a5c..0d884eb2b14 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1371,6 +1371,8 @@ static int check_leaf(struct fib_table *tb, struct trie *t, struct leaf *l,
 
                         if (fa->fa_tos && fa->fa_tos != flp->flowi4_tos)
                                 continue;
+                        if (fi->fib_dead)
+                                continue;
                         if (fa->fa_info->fib_scope < flp->flowi4_scope)
                                 continue;
                         fib_alias_accessed(fa);
diff --git a/net/ipv4/gre.c b/net/ipv4/gre.c
index c6933f2ea31..3e3f75d96be 100644
--- a/net/ipv4/gre.c
+++ b/net/ipv4/gre.c
@@ -15,6 +15,7 @@
 #include <linux/kmod.h>
 #include <linux/skbuff.h>
 #include <linux/in.h>
+#include <linux/ip.h>
 #include <linux/netdevice.h>
 #include <linux/version.h>
 #include <linux/spinlock.h>
@@ -97,27 +98,17 @@ drop:
 static void gre_err(struct sk_buff *skb, u32 info)
 {
         const struct gre_protocol *proto;
-        u8 ver;
-
-        if (!pskb_may_pull(skb, 12))
-                goto drop;
+        const struct iphdr *iph = (const struct iphdr *)skb->data;
+        u8 ver = skb->data[(iph->ihl<<2) + 1]&0x7f;
 
-        ver = skb->data[1]&0x7f;
         if (ver >= GREPROTO_MAX)
-                goto drop;
+                return;
 
         rcu_read_lock();
         proto = rcu_dereference(gre_proto[ver]);
-        if (!proto || !proto->err_handler)
-                goto drop_unlock;
-        proto->err_handler(skb, info);
-        rcu_read_unlock();
-        return;
-
-drop_unlock:
+        if (proto && proto->err_handler)
+                proto->err_handler(skb, info);
         rcu_read_unlock();
-drop:
-        kfree_skb(skb);
 }
 
 static const struct net_protocol net_gre_protocol = {
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 5395e45dcce..23ef31baa1a 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -380,6 +380,7 @@ static struct rtable *icmp_route_lookup(struct net *net,
                                         struct icmp_bxm *param)
 {
         struct rtable *rt, *rt2;
+        struct flowi4 fl4_dec;
         int err;
 
         memset(fl4, 0, sizeof(*fl4));
@@ -408,19 +409,19 @@ static struct rtable *icmp_route_lookup(struct net *net,
         } else
                 return rt;
 
-        err = xfrm_decode_session_reverse(skb_in, flowi4_to_flowi(fl4), AF_INET);
+        err = xfrm_decode_session_reverse(skb_in, flowi4_to_flowi(&fl4_dec), AF_INET);
         if (err)
                 goto relookup_failed;
 
-        if (inet_addr_type(net, fl4->saddr) == RTN_LOCAL) {
-                rt2 = __ip_route_output_key(net, fl4);
+        if (inet_addr_type(net, fl4_dec.saddr) == RTN_LOCAL) {
+                rt2 = __ip_route_output_key(net, &fl4_dec);
                 if (IS_ERR(rt2))
                         err = PTR_ERR(rt2);
         } else {
                 struct flowi4 fl4_2 = {};
                 unsigned long orefdst;
 
-                fl4_2.daddr = fl4->saddr;
+                fl4_2.daddr = fl4_dec.saddr;
                 rt2 = ip_route_output_key(net, &fl4_2);
                 if (IS_ERR(rt2)) {
                         err = PTR_ERR(rt2);
@@ -428,7 +429,7 @@ static struct rtable *icmp_route_lookup(struct net *net,
                 }
                 /* Ugh! */
                 orefdst = skb_in->_skb_refdst; /* save old refdst */
-                err = ip_route_input(skb_in, fl4->daddr, fl4->saddr,
+                err = ip_route_input(skb_in, fl4_dec.daddr, fl4_dec.saddr,
                                      RT_TOS(tos), rt2->dst.dev);
 
                 dst_release(&rt2->dst);
@@ -440,10 +441,11 @@ static struct rtable *icmp_route_lookup(struct net *net,
                 goto relookup_failed;
 
         rt2 = (struct rtable *) xfrm_lookup(net, &rt2->dst,
-                                            flowi4_to_flowi(fl4), NULL,
+                                            flowi4_to_flowi(&fl4_dec), NULL,
                                             XFRM_LOOKUP_ICMP);
         if (!IS_ERR(rt2)) {
                 dst_release(&rt->dst);
+                memcpy(fl4, &fl4_dec, sizeof(*fl4));
                 rt = rt2;
         } else if (PTR_ERR(rt2) == -EPERM) {
                 if (rt)
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index f1d27f6c935..e0d42dbb33f 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -767,7 +767,7 @@ static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
                         break;
                 for (i=0; i<nsrcs; i++) {
                         /* skip inactive filters */
-                        if (pmc->sfcount[MCAST_INCLUDE] ||
+                        if (psf->sf_count[MCAST_INCLUDE] ||
                             pmc->sfcount[MCAST_EXCLUDE] !=
                             psf->sf_count[MCAST_EXCLUDE])
                                 continue;
@@ -875,6 +875,8 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
                  * to be intended in a v3 query.
                  */
                 max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
+                if (!max_delay)
+                        max_delay = 1;  /* can't mod w/ 0 */
         } else { /* v3 */
                 if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
                         return;
@@ -1718,7 +1720,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
 
                 pmc->sfcount[sfmode]--;
                 for (j=0; j<i; j++)
-                        (void) ip_mc_del1_src(pmc, sfmode, &psfsrc[i]);
+                        (void) ip_mc_del1_src(pmc, sfmode, &psfsrc[j]);
         } else if (isexclude != (pmc->sfcount[MCAST_EXCLUDE] != 0)) {
 #ifdef CONFIG_IP_MULTICAST
                 struct ip_sf_list *psf;
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 3c0369a3a66..984ec656b03 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -21,6 +21,7 @@
 
 #include <net/inet_connection_sock.h>
 #include <net/inet_hashtables.h>
+#include <net/secure_seq.h>
 #include <net/ip.h>
 
 /*
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index ce616d92cc5..687764544af 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -19,6 +19,7 @@
 #include <linux/net.h>
 #include <net/ip.h>
 #include <net/inetpeer.h>
+#include <net/secure_seq.h>
 
 /*
  *  Theory of operations.
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 3b34d1c8627..29a07b6c716 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -84,7 +84,7 @@ int ip_forward(struct sk_buff *skb)
 
         rt = skb_rtable(skb);
 
-        if (opt->is_strictroute && ip_hdr(skb)->daddr != rt->rt_gateway)
+        if (opt->is_strictroute && opt->nexthop != rt->rt_gateway)
                 goto sr_failed;
 
         if (unlikely(skb->len > dst_mtu(&rt->dst) && !skb_is_gso(skb) &&
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 8871067560d..d7bb94c4834 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -731,9 +731,9 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                 }
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
                 else if (skb->protocol == htons(ETH_P_IPV6)) {
+                        struct neighbour *neigh = dst_get_neighbour(skb_dst(skb));
                         const struct in6_addr *addr6;
                         int addr_type;
-                        struct neighbour *neigh = skb_dst(skb)->neighbour;
 
                         if (neigh == NULL)
                                 goto tx_error;
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index ec93335901d..42dd1a90ede 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -568,11 +568,12 @@ void ip_forward_options(struct sk_buff *skb)
                      ) {
                         if (srrptr + 3 > srrspace)
                                 break;
-                        if (memcmp(&ip_hdr(skb)->daddr, &optptr[srrptr-1], 4) == 0)
+                        if (memcmp(&opt->nexthop, &optptr[srrptr-1], 4) == 0)
                                 break;
                 }
                 if (srrptr + 3 <= srrspace) {
                         opt->is_changed = 1;
+                        ip_hdr(skb)->daddr = opt->nexthop;
                         ip_rt_get_source(&optptr[srrptr-1], skb, rt);
                         optptr[2] = srrptr+4;
                 } else if (net_ratelimit())
@@ -640,6 +641,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
         }
         if (srrptr <= srrspace) {
                 opt->srr_is_hit = 1;
+                opt->nexthop = nexthop;
                 opt->is_changed = 1;
         }
         return 0;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 84f26e8e6c6..51a3eec2c70 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -182,6 +182,8 @@ static inline int ip_finish_output2(struct sk_buff *skb)
         struct rtable *rt = (struct rtable *)dst;
         struct net_device *dev = dst->dev;
         unsigned int hh_len = LL_RESERVED_SPACE(dev);
+        struct neighbour *neigh;
+        int res;
 
         if (rt->rt_type == RTN_MULTICAST) {
                 IP_UPD_PO_STATS(dev_net(dev), IPSTATS_MIB_OUTMCAST, skb->len);
@@ -203,10 +205,22 @@ static inline int ip_finish_output2(struct sk_buff *skb)
                 skb = skb2;
         }
 
-        if (dst->hh)
-                return neigh_hh_output(dst->hh, skb);
-        else if (dst->neighbour)
-                return dst->neighbour->output(skb);
+        rcu_read_lock();
+        if (dst->hh) {
+                int res = neigh_hh_output(dst->hh, skb);
+
+                rcu_read_unlock();
+                return res;
+        } else {
+                neigh = dst_get_neighbour(dst);
+                if (neigh) {
+                        res = neigh->output(skb);
+
+                        rcu_read_unlock();
+                        return res;
+                }
+                rcu_read_unlock();
+        }
 
         if (net_ratelimit())
                 printk(KERN_DEBUG "ip_finish_output2: No header cache and no neighbour!\n");
@@ -734,7 +748,7 @@ static inline int ip_ufo_append_data(struct sock *sk,
                         int getfrag(void *from, char *to, int offset, int len,
                                int odd, struct sk_buff *skb),
                         void *from, int length, int hh_len, int fragheaderlen,
-                        int transhdrlen, int mtu, unsigned int flags)
+                        int transhdrlen, int maxfraglen, unsigned int flags)
 {
         struct sk_buff *skb;
         int err;
@@ -767,7 +781,7 @@ static inline int ip_ufo_append_data(struct sock *sk,
                 skb->csum = 0;
 
                 /* specify the length of each IP datagram fragment */
-                skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
+                skb_shinfo(skb)->gso_size = maxfraglen - fragheaderlen;
                 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
                 __skb_queue_tail(queue, skb);
         }
@@ -831,7 +845,7 @@ static int __ip_append_data(struct sock *sk,
             (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) {
                 err = ip_ufo_append_data(sk, queue, getfrag, from, length,
                                          hh_len, fragheaderlen, transhdrlen,
-                                         mtu, flags);
+                                         maxfraglen, flags);
                 if (err)
                         goto error;
                 return 0;
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index ab7e5542c1c..7fbcabafa29 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -252,6 +252,10 @@ static int __init ic_open_devs(void)
                 }
         }
 
+        /* no point in waiting if we could not bring up at least one device */
+        if (!ic_first_dev)
+                goto have_carrier;
+
         /* wait for a carrier on at least one device */
         start = jiffies;
         while (jiffies - start < msecs_to_jiffies(CONF_CARRIER_TIMEOUT)) {
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 378b20b7ca6..6f06f7f39ea 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -285,6 +285,8 @@ static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
         if (register_netdevice(dev) < 0)
                 goto failed_free;
 
+        strcpy(nt->parms.name, dev->name);
+
         dev_hold(dev);
         ipip_tunnel_link(ipn, nt);
         return nt;
@@ -759,7 +761,6 @@ static int ipip_tunnel_init(struct net_device *dev)
         struct ip_tunnel *tunnel = netdev_priv(dev);
 
         tunnel->dev = dev;
-        strcpy(tunnel->parms.name, dev->name);
 
         memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
         memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
@@ -825,6 +826,7 @@ static void ipip_destroy_tunnels(struct ipip_net *ipn, struct list_head *head)
 static int __net_init ipip_init_net(struct net *net)
 {
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
+        struct ip_tunnel *t;
         int err;
 
         ipn->tunnels[0] = ipn->tunnels_wc;
@@ -848,6 +850,9 @@ static int __net_init ipip_init_net(struct net *net)
         if ((err = register_netdev(ipn->fb_tunnel_dev)))
                 goto err_reg_dev;
 
+        t = netdev_priv(ipn->fb_tunnel_dev);
+
+        strcpy(t->parms.name, ipn->fb_tunnel_dev->name);
         return 0;
 
 err_reg_dev:
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 30a7763c400..f81af8dd2de 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1796,7 +1796,7 @@ static struct mr_table *ipmr_rt_fib_lookup(struct net *net, struct sk_buff *skb)
         struct flowi4 fl4 = {
                 .daddr = iph->daddr,
                 .saddr = iph->saddr,
-                .flowi4_tos = iph->tos,
+                .flowi4_tos = RT_TOS(iph->tos),
                 .flowi4_oif = rt->rt_oif,
                 .flowi4_iif = rt->rt_iif,
                 .flowi4_mark = rt->rt_mark,
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 2e97e3ec1eb..929b27bdeb7 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -18,17 +18,15 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
         struct rtable *rt;
         struct flowi4 fl4 = {};
         __be32 saddr = iph->saddr;
-        __u8 flags = 0;
+        __u8 flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
         unsigned int hh_len;
 
-        if (!skb->sk && addr_type != RTN_LOCAL) {
-                if (addr_type == RTN_UNSPEC)
-                        addr_type = inet_addr_type(net, saddr);
-                if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
-                        flags |= FLOWI_FLAG_ANYSRC;
-                else
-                        saddr = 0;
-        }
+        if (addr_type == RTN_UNSPEC)
+                addr_type = inet_addr_type(net, saddr);
+        if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
+                flags |= FLOWI_FLAG_ANYSRC;
+        else
+                saddr = 0;
 
         /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
          * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
@@ -38,7 +36,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
         fl4.flowi4_tos = RT_TOS(iph->tos);
         fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
         fl4.flowi4_mark = skb->mark;
-        fl4.flowi4_flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : flags;
+        fl4.flowi4_flags = flags;
         rt = ip_route_output_key(net, &fl4);
         if (IS_ERR(rt))
                 return -1;
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 1dfc18a03fd..73b4e91a87e 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -113,6 +113,18 @@ config IP_NF_TARGET_REJECT
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config IP_NF_TARGET_REJECT_SKERR
+        bool "Force socket error when rejecting with icmp*"
+        depends on IP_NF_TARGET_REJECT
+        default n
+        help
+          This option enables turning a "--reject-with icmp*" into a matching
+          socket error also.
+          The REJECT target normally allows sending an ICMP message. But it
+          leaves the local socket unaware of any ingress rejects.
+
+          If unsure, say N.
+
 config IP_NF_TARGET_LOG
         tristate "LOG target support"
         default m if NETFILTER_ADVANCED=n
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index 51f13f8ec72..9dd754c7f2b 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -128,6 +128,14 @@ static void send_reset(struct sk_buff *oldskb, int hook)
 static inline void send_unreach(struct sk_buff *skb_in, int code)
 {
         icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
+#ifdef CONFIG_IP_NF_TARGET_REJECT_SKERR
+        if (skb_in->sk) {
+                skb_in->sk->sk_err = icmp_err_convert[code].errno;
+                skb_in->sk->sk_error_report(skb_in->sk);
+                pr_debug("ipt_REJECT: sk_err=%d for skb=%p sk=%p\n",
+                        skb_in->sk->sk_err, skb_in, skb_in->sk);
+        }
+#endif
 }
 
 static unsigned int
diff --git a/net/ipv4/netfilter/nf_nat_proto_common.c b/net/ipv4/netfilter/nf_nat_proto_common.c
index 3e61faf23a9..f52d41ea069 100644
--- a/net/ipv4/netfilter/nf_nat_proto_common.c
+++ b/net/ipv4/netfilter/nf_nat_proto_common.c
@@ -12,6 +12,7 @@
 #include <linux/ip.h>
 
 #include <linux/netfilter.h>
+#include <net/secure_seq.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_rule.h>
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index aa13ef10511..6b95f74a91d 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -91,6 +91,7 @@
 #include <linux/rcupdate.h>
 #include <linux/times.h>
 #include <linux/slab.h>
+#include <linux/prefetch.h>
 #include <net/dst.h>
 #include <net/net_namespace.h>
 #include <net/protocol.h>
@@ -108,6 +109,7 @@
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
 #endif
+#include <net/secure_seq.h>
 
 #define RT_FL_TOS(oldflp4) \
     ((u32)(oldflp4->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK)))
@@ -131,6 +133,9 @@ static int ip_rt_min_pmtu __read_mostly		= 512 + 20 + 20;
 static int ip_rt_min_advmss __read_mostly       = 256;
 static int rt_chain_length_max __read_mostly    = 20;
 
+static struct delayed_work expires_work;
+static unsigned long expires_ljiffies;
+
 /*
  *      Interface to generic destination cache.
  */
@@ -411,7 +416,13 @@ static int rt_cache_seq_show(struct seq_file *seq, void *v)
                            "HHUptod\tSpecDst");
         else {
                 struct rtable *r = v;
-                int len;
+                struct neighbour *n;
+                int len, HHUptod;
+
+                rcu_read_lock();
+                n = dst_get_neighbour(&r->dst);
+                HHUptod = (n && (n->nud_state & NUD_CONNECTED)) ? 1 : 0;
+                rcu_read_unlock();
 
                 seq_printf(seq, "%s\t%08X\t%08X\t%8X\t%d\t%u\t%d\t"
                               "%08X\t%d\t%u\t%u\t%02X\t%d\t%1d\t%08X%n",
@@ -426,8 +437,7 @@ static int rt_cache_seq_show(struct seq_file *seq, void *v)
                               dst_metric(&r->dst, RTAX_RTTVAR)),
                         r->rt_key_tos,
                         r->dst.hh ? atomic_read(&r->dst.hh->hh_refcnt) : -1,
-                        r->dst.hh ? (r->dst.hh->hh_output ==
-                                       dev_queue_xmit) : 0,
+                        HHUptod,
                         r->rt_spec_dst, &len);
 
                 seq_printf(seq, "%*s\n", 127 - len, "");
@@ -716,7 +726,7 @@ static inline bool compare_hash_inputs(const struct rtable *rt1,
 {
         return ((((__force u32)rt1->rt_key_dst ^ (__force u32)rt2->rt_key_dst) |
                 ((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
-                (rt1->rt_iif ^ rt2->rt_iif)) == 0);
+                (rt1->rt_route_iif ^ rt2->rt_route_iif)) == 0);
 }
 
 static inline int compare_keys(struct rtable *rt1, struct rtable *rt2)
@@ -725,8 +735,8 @@ static inline int compare_keys(struct rtable *rt1, struct rtable *rt2)
                 ((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
                 (rt1->rt_mark ^ rt2->rt_mark) |
                 (rt1->rt_key_tos ^ rt2->rt_key_tos) |
-                (rt1->rt_oif ^ rt2->rt_oif) |
-                (rt1->rt_iif ^ rt2->rt_iif)) == 0;
+                (rt1->rt_route_iif ^ rt2->rt_route_iif) |
+                (rt1->rt_oif ^ rt2->rt_oif)) == 0;
 }
 
 static inline int compare_netns(struct rtable *rt1, struct rtable *rt2)
@@ -820,6 +830,97 @@ static int has_noalias(const struct rtable *head, const struct rtable *rth)
         return ONE;
 }
 
+static void rt_check_expire(void)
+{
+        static unsigned int rover;
+        unsigned int i = rover, goal;
+        struct rtable *rth;
+        struct rtable __rcu **rthp;
+        unsigned long samples = 0;
+        unsigned long sum = 0, sum2 = 0;
+        unsigned long delta;
+        u64 mult;
+
+        delta = jiffies - expires_ljiffies;
+        expires_ljiffies = jiffies;
+        mult = ((u64)delta) << rt_hash_log;
+        if (ip_rt_gc_timeout > 1)
+                do_div(mult, ip_rt_gc_timeout);
+        goal = (unsigned int)mult;
+        if (goal > rt_hash_mask)
+                goal = rt_hash_mask + 1;
+        for (; goal > 0; goal--) {
+                unsigned long tmo = ip_rt_gc_timeout;
+                unsigned long length;
+
+                i = (i + 1) & rt_hash_mask;
+                rthp = &rt_hash_table[i].chain;
+
+                if (need_resched())
+                        cond_resched();
+
+                samples++;
+
+                if (rcu_dereference_raw(*rthp) == NULL)
+                        continue;
+                length = 0;
+                spin_lock_bh(rt_hash_lock_addr(i));
+                while ((rth = rcu_dereference_protected(*rthp,
+                                        lockdep_is_held(rt_hash_lock_addr(i)))) != NULL) {
+                        prefetch(rth->dst.rt_next);
+                        if (rt_is_expired(rth)) {
+                                *rthp = rth->dst.rt_next;
+                                rt_free(rth);
+                                continue;
+                        }
+                        if (rth->dst.expires) {
+                                /* Entry is expired even if it is in use */
+                                if (time_before_eq(jiffies, rth->dst.expires)) {
+nofree:
+                                        tmo >>= 1;
+                                        rthp = &rth->dst.rt_next;
+                                        /*
+                                         * We only count entries on
+                                         * a chain with equal hash inputs once
+                                         * so that entries for different QOS
+                                         * levels, and other non-hash input
+                                         * attributes don't unfairly skew
+                                         * the length computation
+                                         */
+                                        length += has_noalias(rt_hash_table[i].chain, rth);
+                                        continue;
+                                }
+                        } else if (!rt_may_expire(rth, tmo, ip_rt_gc_timeout))
+                                goto nofree;
+
+                        /* Cleanup aged off entries. */
+                        *rthp = rth->dst.rt_next;
+                        rt_free(rth);
+                }
+                spin_unlock_bh(rt_hash_lock_addr(i));
+                sum += length;
+                sum2 += length*length;
+        }
+        if (samples) {
+                unsigned long avg = sum / samples;
+                unsigned long sd = int_sqrt(sum2 / samples - avg*avg);
+                rt_chain_length_max = max_t(unsigned long,
+                                        ip_rt_gc_elasticity,
+                                        (avg + 4*sd) >> FRACT_BITS);
+        }
+        rover = i;
+}
+
+/*
+ * rt_worker_func() is run in process context.
+ * we call rt_check_expire() to scan part of the hash table
+ */
+static void rt_worker_func(struct work_struct *work)
+{
+        rt_check_expire();
+        schedule_delayed_work(&expires_work, ip_rt_gc_interval);
+}
+
 /*
  * Perturbation of rt_genid by a small quantity [1..256]
  * Using 8 bits of shuffling ensure we can call rt_cache_invalidate()
@@ -1268,11 +1369,41 @@ static void rt_del(unsigned hash, struct rtable *rt)
         spin_unlock_bh(rt_hash_lock_addr(hash));
 }
 
+static int check_peer_redir(struct dst_entry *dst, struct inet_peer *peer)
+{
+        struct rtable *rt = (struct rtable *) dst;
+        __be32 orig_gw = rt->rt_gateway;
+        struct neighbour *n, *old_n;
+
+        dst_confirm(&rt->dst);
+
+        rt->rt_gateway = peer->redirect_learned.a4;
+        n = __arp_bind_neighbour(&rt->dst, rt->rt_gateway);
+        if (IS_ERR(n))
+                return PTR_ERR(n);
+        old_n = xchg(&rt->dst._neighbour, n);
+        if (old_n)
+                neigh_release(old_n);
+        if (!n || !(n->nud_state & NUD_VALID)) {
+                if (n)
+                        neigh_event_send(n, NULL);
+                rt->rt_gateway = orig_gw;
+                return -EAGAIN;
+        } else {
+                rt->rt_flags |= RTCF_REDIRECTED;
+                call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, n);
+        }
+        return 0;
+}
+
 /* called in rcu_read_lock() section */
 void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                     __be32 saddr, struct net_device *dev)
 {
+        int s, i;
         struct in_device *in_dev = __in_dev_get_rcu(dev);
+        __be32 skeys[2] = { saddr, 0 };
+        int    ikeys[2] = { dev->ifindex, 0 };
         struct inet_peer *peer;
         struct net *net;
 
@@ -1295,13 +1426,43 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                         goto reject_redirect;
         }
 
-        peer = inet_getpeer_v4(daddr, 1);
-        if (peer) {
-                peer->redirect_learned.a4 = new_gw;
+        for (s = 0; s < 2; s++) {
+                for (i = 0; i < 2; i++) {
+                        unsigned int hash;
+                        struct rtable __rcu **rthp;
+                        struct rtable *rt;
 
-                inet_putpeer(peer);
+                        hash = rt_hash(daddr, skeys[s], ikeys[i], rt_genid(net));
 
-                atomic_inc(&__rt_peer_genid);
+                        rthp = &rt_hash_table[hash].chain;
+
+                        while ((rt = rcu_dereference(*rthp)) != NULL) {
+                                rthp = &rt->dst.rt_next;
+
+                                if (rt->rt_key_dst != daddr ||
+                                    rt->rt_key_src != skeys[s] ||
+                                    rt->rt_oif != ikeys[i] ||
+                                    rt_is_input_route(rt) ||
+                                    rt_is_expired(rt) ||
+                                    !net_eq(dev_net(rt->dst.dev), net) ||
+                                    rt->dst.error ||
+                                    rt->dst.dev != dev ||
+                                    rt->rt_gateway != old_gw)
+                                        continue;
+
+                                if (!rt->peer)
+                                        rt_bind_peer(rt, rt->rt_dst, 1);
+
+                                peer = rt->peer;
+                                if (peer) {
+                                        if (peer->redirect_learned.a4 != new_gw) {
+                                                peer->redirect_learned.a4 = new_gw;
+                                                atomic_inc(&__rt_peer_genid);
+                                        }
+                                        check_peer_redir(&rt->dst, peer);
+                                }
+                        }
+                }
         }
         return;
 
@@ -1588,31 +1749,6 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
         }
 }
 
-static int check_peer_redir(struct dst_entry *dst, struct inet_peer *peer)
-{
-        struct rtable *rt = (struct rtable *) dst;
-        __be32 orig_gw = rt->rt_gateway;
-
-        dst_confirm(&rt->dst);
-
-        neigh_release(rt->dst.neighbour);
-        rt->dst.neighbour = NULL;
-
-        rt->rt_gateway = peer->redirect_learned.a4;
-        if (arp_bind_neighbour(&rt->dst) ||
-            !(rt->dst.neighbour->nud_state & NUD_VALID)) {
-                if (rt->dst.neighbour)
-                        neigh_event_send(rt->dst.neighbour, NULL);
-                rt->rt_gateway = orig_gw;
-                return -EAGAIN;
-        } else {
-                rt->rt_flags |= RTCF_REDIRECTED;
-                call_netevent_notifiers(NETEVENT_NEIGH_UPDATE,
-                                        rt->dst.neighbour);
-        }
-        return 0;
-}
-
 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
 {
         struct rtable *rt = (struct rtable *) dst;
@@ -1703,7 +1839,7 @@ void ip_rt_get_source(u8 *addr, struct sk_buff *skb, struct rtable *rt)
                 memset(&fl4, 0, sizeof(fl4));
                 fl4.daddr = iph->daddr;
                 fl4.saddr = iph->saddr;
-                fl4.flowi4_tos = iph->tos;
+                fl4.flowi4_tos = RT_TOS(iph->tos);
                 fl4.flowi4_oif = rt->dst.dev->ifindex;
                 fl4.flowi4_iif = skb->dev->ifindex;
                 fl4.flowi4_mark = skb->mark;
@@ -2280,8 +2416,7 @@ int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,
              rth = rcu_dereference(rth->dst.rt_next)) {
                 if ((((__force u32)rth->rt_key_dst ^ (__force u32)daddr) |
                      ((__force u32)rth->rt_key_src ^ (__force u32)saddr) |
-                     (rth->rt_iif ^ iif) |
-                     rth->rt_oif |
+                     (rth->rt_route_iif ^ iif) |
                      (rth->rt_key_tos ^ tos)) == 0 &&
                     rth->rt_mark == skb->mark &&
                     net_eq(dev_net(rth->dst.dev), net) &&
@@ -3088,6 +3223,13 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
+                .procname       = "gc_interval",
+                .data           = &ip_rt_gc_interval,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_jiffies,
+        },
+        {
                 .procname       = "redirect_load",
                 .data           = &ip_rt_redirect_load,
                 .maxlen         = sizeof(int),
@@ -3297,6 +3439,11 @@ int __init ip_rt_init(void)
         devinet_init();
         ip_fib_init();
 
+        INIT_DELAYED_WORK_DEFERRABLE(&expires_work, rt_worker_func);
+        expires_ljiffies = jiffies;
+        schedule_delayed_work(&expires_work,
+                net_random() % ip_rt_gc_interval + ip_rt_gc_interval);
+
         if (ip_rt_proc_init())
                 printk(KERN_ERR "Unable to create route proc files\n");
 #ifdef CONFIG_XFRM
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 26461492a84..895f2157e13 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -276,7 +276,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         int mss;
         struct rtable *rt;
         __u8 rcv_wscale;
-        bool ecn_ok;
+        bool ecn_ok = false;
+        struct flowi4 fl4;
 
         if (!sysctl_tcp_syncookies || !th->ack || th->rst)
                 goto out;
@@ -344,20 +345,16 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
          * hasn't changed since we received the original syn, but I see
          * no easy way to do this.
          */
-        {
-                struct flowi4 fl4;
-
-                flowi4_init_output(&fl4, 0, sk->sk_mark, RT_CONN_FLAGS(sk),
-                                   RT_SCOPE_UNIVERSE, IPPROTO_TCP,
-                                   inet_sk_flowi_flags(sk),
-                                   (opt && opt->srr) ? opt->faddr : ireq->rmt_addr,
-                                   ireq->loc_addr, th->source, th->dest);
-                security_req_classify_flow(req, flowi4_to_flowi(&fl4));
-                rt = ip_route_output_key(sock_net(sk), &fl4);
-                if (IS_ERR(rt)) {
-                        reqsk_free(req);
-                        goto out;
-                }
+        flowi4_init_output(&fl4, 0, sk->sk_mark, RT_CONN_FLAGS(sk),
+                           RT_SCOPE_UNIVERSE, IPPROTO_TCP,
+                           inet_sk_flowi_flags(sk),
+                           (opt && opt->srr) ? opt->faddr : ireq->rmt_addr,
+                           ireq->loc_addr, th->source, th->dest);
+        security_req_classify_flow(req, flowi4_to_flowi(&fl4));
+        rt = ip_route_output_key(sock_net(sk), &fl4);
+        if (IS_ERR(rt)) {
+                reqsk_free(req);
+                goto out;
         }
 
         /* Try to redo what tcp_v4_send_synack did. */
@@ -371,5 +368,10 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         ireq->rcv_wscale  = rcv_wscale;
 
         ret = get_cookie_sock(sk, skb, req, &rt->dst);
+        /* ip_queue_xmit() depends on our flow being setup
+         * Normal sockets get it right from inet_csk_route_child_sock()
+         */
+        if (ret)
+                inet_sk(ret)->cork.fl.u.ip4 = fl4;
 out:    return ret;
 }
diff --git a/net/ipv4/sysfs_net_ipv4.c b/net/ipv4/sysfs_net_ipv4.c
new file mode 100644
index 00000000000..0cbbf10026a
--- /dev/null
+++ b/net/ipv4/sysfs_net_ipv4.c
@@ -0,0 +1,88 @@
+/*
+ * net/ipv4/sysfs_net_ipv4.c
+ *
+ * sysfs-based networking knobs (so we can, unlike with sysctl, control perms)
+ *
+ * Copyright (C) 2008 Google, Inc.
+ *
+ * Robert Love <rlove@google.com>
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/kobject.h>
+#include <linux/string.h>
+#include <linux/sysfs.h>
+#include <linux/init.h>
+#include <net/tcp.h>
+
+#define CREATE_IPV4_FILE(_name, _var) \
+static ssize_t _name##_show(struct kobject *kobj, \
+                            struct kobj_attribute *attr, char *buf) \
+{ \
+        return sprintf(buf, "%d\n", _var); \
+} \
+static ssize_t _name##_store(struct kobject *kobj, \
+                             struct kobj_attribute *attr, \
+                             const char *buf, size_t count) \
+{ \
+        int val, ret; \
+        ret = sscanf(buf, "%d", &val); \
+        if (ret != 1) \
+                return -EINVAL; \
+        if (val < 0) \
+                return -EINVAL; \
+        _var = val; \
+        return count; \
+} \
+static struct kobj_attribute _name##_attr = \
+        __ATTR(_name, 0644, _name##_show, _name##_store)
+
+CREATE_IPV4_FILE(tcp_wmem_min, sysctl_tcp_wmem[0]);
+CREATE_IPV4_FILE(tcp_wmem_def, sysctl_tcp_wmem[1]);
+CREATE_IPV4_FILE(tcp_wmem_max, sysctl_tcp_wmem[2]);
+
+CREATE_IPV4_FILE(tcp_rmem_min, sysctl_tcp_rmem[0]);
+CREATE_IPV4_FILE(tcp_rmem_def, sysctl_tcp_rmem[1]);
+CREATE_IPV4_FILE(tcp_rmem_max, sysctl_tcp_rmem[2]);
+
+static struct attribute *ipv4_attrs[] = {
+        &tcp_wmem_min_attr.attr,
+        &tcp_wmem_def_attr.attr,
+        &tcp_wmem_max_attr.attr,
+        &tcp_rmem_min_attr.attr,
+        &tcp_rmem_def_attr.attr,
+        &tcp_rmem_max_attr.attr,
+        NULL
+};
+
+static struct attribute_group ipv4_attr_group = {
+        .attrs = ipv4_attrs,
+};
+
+static __init int sysfs_ipv4_init(void)
+{
+        struct kobject *ipv4_kobject;
+        int ret;
+
+        ipv4_kobject = kobject_create_and_add("ipv4", kernel_kobj);
+        if (!ipv4_kobject)
+                return -ENOMEM;
+
+        ret = sysfs_create_group(ipv4_kobject, &ipv4_attr_group);
+        if (ret) {
+                kobject_put(ipv4_kobject);
+                return ret;
+        }
+
+        return 0;
+}
+
+subsys_initcall(sysfs_ipv4_init);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 46febcacb72..31741cf9bb6 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -266,11 +266,15 @@
 #include <linux/crypto.h>
 #include <linux/time.h>
 #include <linux/slab.h>
+#include <linux/uid_stat.h>
 
 #include <net/icmp.h>
 #include <net/tcp.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
+#include <net/ip6_route.h>
+#include <net/ipv6.h>
+#include <net/transp_v6.h>
 #include <net/netdma.h>
 #include <net/sock.h>
 
@@ -850,8 +854,7 @@ new_segment:
 wait_for_sndbuf:
                 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
-                if (copied)
-                        tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+                tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
 
                 if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
                         goto do_error;
@@ -860,7 +863,7 @@ wait_for_memory:
         }
 
 out:
-        if (copied)
+        if (copied && !(flags & MSG_SENDPAGE_NOTLAST))
                 tcp_push(sk, flags, mss_now, tp->nonagle);
         return copied;
 
@@ -1112,6 +1115,9 @@ out:
         if (copied)
                 tcp_push(sk, flags, mss_now, tp->nonagle);
         release_sock(sk);
+
+        if (copied > 0)
+                uid_stat_tcp_snd(current_uid(), copied);
         return copied;
 
 do_fault:
@@ -1388,8 +1394,11 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
         tcp_rcv_space_adjust(sk);
 
         /* Clean up data we have read: This will do ACK frames. */
-        if (copied > 0)
+        if (copied > 0) {
                 tcp_cleanup_rbuf(sk, copied);
+                uid_stat_tcp_rcv(current_uid(), copied);
+        }
+
         return copied;
 }
 EXPORT_SYMBOL(tcp_read_sock);
@@ -1771,6 +1780,9 @@ skip_copy:
         tcp_cleanup_rbuf(sk, copied);
 
         release_sock(sk);
+
+        if (copied > 0)
+                uid_stat_tcp_rcv(current_uid(), copied);
         return copied;
 
 out:
@@ -1779,6 +1791,8 @@ out:
 
 recv_urg:
         err = tcp_recv_urg(sk, msg, len, flags);
+        if (err > 0)
+                uid_stat_tcp_rcv(current_uid(), err);
         goto out;
 }
 EXPORT_SYMBOL(tcp_recvmsg);
@@ -2395,7 +2409,10 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 /* Cap the max timeout in ms TCP will retry/retrans
                  * before giving up and aborting (ETIMEDOUT) a connection.
                  */
-                icsk->icsk_user_timeout = msecs_to_jiffies(val);
+                if (val < 0)
+                        err = -EINVAL;
+                else
+                        icsk->icsk_user_timeout = msecs_to_jiffies(val);
                 break;
         default:
                 err = -ENOPROTOOPT;
@@ -3221,7 +3238,7 @@ void __init tcp_init(void)
 {
         struct sk_buff *skb = NULL;
         unsigned long limit;
-        int i, max_share, cnt;
+        int i, max_rshare, max_wshare, cnt;
         unsigned long jiffy = jiffies;
 
         BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb));
@@ -3285,15 +3302,16 @@ void __init tcp_init(void)
 
         /* Set per-socket limits to no more than 1/128 the pressure threshold */
         limit = ((unsigned long)sysctl_tcp_mem[1]) << (PAGE_SHIFT - 7);
-        max_share = min(4UL*1024*1024, limit);
+        max_wshare = min(4UL*1024*1024, limit);
+        max_rshare = min(6UL*1024*1024, limit);
 
         sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
         sysctl_tcp_wmem[1] = 16*1024;
-        sysctl_tcp_wmem[2] = max(64*1024, max_share);
+        sysctl_tcp_wmem[2] = max(64*1024, max_wshare);
 
         sysctl_tcp_rmem[0] = SK_MEM_QUANTUM;
         sysctl_tcp_rmem[1] = 87380;
-        sysctl_tcp_rmem[2] = max(87380, max_share);
+        sysctl_tcp_rmem[2] = max(87380, max_rshare);
 
         printk(KERN_INFO "TCP: Hash tables configured "
                "(established %u bind %u)\n",
@@ -3310,3 +3328,107 @@ void __init tcp_init(void)
         tcp_secret_retiring = &tcp_secret_two;
         tcp_secret_secondary = &tcp_secret_two;
 }
+
+static int tcp_is_local(struct net *net, __be32 addr) {
+        struct rtable *rt;
+        struct flowi4 fl4 = { .daddr = addr };
+        rt = ip_route_output_key(net, &fl4);
+        if (IS_ERR_OR_NULL(rt))
+                return 0;
+        return rt->dst.dev && (rt->dst.dev->flags & IFF_LOOPBACK);
+}
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static int tcp_is_local6(struct net *net, struct in6_addr *addr) {
+        struct rt6_info *rt6 = rt6_lookup(net, addr, addr, 0, 0);
+        return rt6 && rt6->rt6i_dev && (rt6->rt6i_dev->flags & IFF_LOOPBACK);
+}
+#endif
+
+/*
+ * tcp_nuke_addr - destroy all sockets on the given local address
+ * if local address is the unspecified address (0.0.0.0 or ::), destroy all
+ * sockets with local addresses that are not configured.
+ */
+int tcp_nuke_addr(struct net *net, struct sockaddr *addr)
+{
+        int family = addr->sa_family;
+        unsigned int bucket;
+
+        struct in_addr *in;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        struct in6_addr *in6;
+#endif
+        if (family == AF_INET) {
+                in = &((struct sockaddr_in *)addr)->sin_addr;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        } else if (family == AF_INET6) {
+                in6 = &((struct sockaddr_in6 *)addr)->sin6_addr;
+#endif
+        } else {
+                return -EAFNOSUPPORT;
+        }
+
+        for (bucket = 0; bucket < tcp_hashinfo.ehash_mask; bucket++) {
+                struct hlist_nulls_node *node;
+                struct sock *sk;
+                spinlock_t *lock = inet_ehash_lockp(&tcp_hashinfo, bucket);
+
+restart:
+                spin_lock_bh(lock);
+                sk_nulls_for_each(sk, node, &tcp_hashinfo.ehash[bucket].chain) {
+                        struct inet_sock *inet = inet_sk(sk);
+
+                        if (sysctl_ip_dynaddr && sk->sk_state == TCP_SYN_SENT)
+                                continue;
+                        if (sock_flag(sk, SOCK_DEAD))
+                                continue;
+
+                        if (family == AF_INET) {
+                                __be32 s4 = inet->inet_rcv_saddr;
+                                if (s4 == LOOPBACK4_IPV6)
+                                        continue;
+
+                                if (in->s_addr != s4 &&
+                                    !(in->s_addr == INADDR_ANY &&
+                                      !tcp_is_local(net, s4)))
+                                        continue;
+                        }
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+                        if (family == AF_INET6) {
+                                struct in6_addr *s6;
+                                if (!inet->pinet6)
+                                        continue;
+
+                                s6 = &inet->pinet6->rcv_saddr;
+                                if (ipv6_addr_type(s6) == IPV6_ADDR_MAPPED)
+                                        continue;
+
+                                if (!ipv6_addr_equal(in6, s6) &&
+                                    !(ipv6_addr_equal(in6, &in6addr_any) &&
+                                      !tcp_is_local6(net, s6)))
+                                continue;
+                        }
+#endif
+
+                        sock_hold(sk);
+                        spin_unlock_bh(lock);
+
+                        local_bh_disable();
+                        bh_lock_sock(sk);
+                        sk->sk_err = ETIMEDOUT;
+                        sk->sk_error_report(sk);
+
+                        tcp_done(sk);
+                        bh_unlock_sock(sk);
+                        local_bh_enable();
+                        sock_put(sk);
+
+                        goto restart;
+                }
+                spin_unlock_bh(lock);
+        }
+
+        return 0;
+}
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index bef9f04c22b..b76aa2d9624 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -83,7 +83,7 @@ int sysctl_tcp_ecn __read_mostly = 2;
 EXPORT_SYMBOL(sysctl_tcp_ecn);
 int sysctl_tcp_dsack __read_mostly = 1;
 int sysctl_tcp_app_win __read_mostly = 31;
-int sysctl_tcp_adv_win_scale __read_mostly = 2;
+int sysctl_tcp_adv_win_scale __read_mostly = 1;
 EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
 
 int sysctl_tcp_stdurg __read_mostly;
@@ -328,6 +328,7 @@ static void tcp_grow_window(struct sock *sk, struct sk_buff *skb)
                         incr = __tcp_grow_window(sk, skb);
 
                 if (incr) {
+                        incr = max_t(int, incr, 2 * skb->len);
                         tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr,
                                                tp->window_clamp);
                         inet_csk(sk)->icsk_ack.quick |= 1;
@@ -460,8 +461,11 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep)
                 if (!win_dep) {
                         m -= (new_sample >> 3);
                         new_sample += m;
-                } else if (m < new_sample)
-                        new_sample = m << 3;
+                } else {
+                        m <<= 3;
+                        if (m < new_sample)
+                                new_sample = m;
+                }
         } else {
                 /* No previous measure. */
                 new_sample = m << 3;
@@ -1115,7 +1119,7 @@ static int tcp_is_sackblock_valid(struct tcp_sock *tp, int is_dsack,
                 return 0;
 
         /* ...Then it's D-SACK, and must reside below snd_una completely */
-        if (!after(end_seq, tp->snd_una))
+        if (after(end_seq, tp->snd_una))
                 return 0;
 
         if (!before(start_seq, tp->undo_marker))
@@ -1289,25 +1293,26 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
         return in_sack;
 }
 
-static u8 tcp_sacktag_one(struct sk_buff *skb, struct sock *sk,
-                          struct tcp_sacktag_state *state,
+/* Mark the given newly-SACKed range as such, adjusting counters and hints. */
+static u8 tcp_sacktag_one(struct sock *sk,
+                          struct tcp_sacktag_state *state, u8 sacked,
+                          u32 start_seq, u32 end_seq,
                           int dup_sack, int pcount)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        u8 sacked = TCP_SKB_CB(skb)->sacked;
         int fack_count = state->fack_count;
 
         /* Account D-SACK for retransmitted packet. */
         if (dup_sack && (sacked & TCPCB_RETRANS)) {
                 if (tp->undo_marker && tp->undo_retrans &&
-                    after(TCP_SKB_CB(skb)->end_seq, tp->undo_marker))
+                    after(end_seq, tp->undo_marker))
                         tp->undo_retrans--;
                 if (sacked & TCPCB_SACKED_ACKED)
                         state->reord = min(fack_count, state->reord);
         }
 
         /* Nothing to do; acked frame is about to be dropped (was ACKed). */
-        if (!after(TCP_SKB_CB(skb)->end_seq, tp->snd_una))
+        if (!after(end_seq, tp->snd_una))
                 return sacked;
 
         if (!(sacked & TCPCB_SACKED_ACKED)) {
@@ -1326,13 +1331,13 @@ static u8 tcp_sacktag_one(struct sk_buff *skb, struct sock *sk,
                                 /* New sack for not retransmitted frame,
                                  * which was in hole. It is reordering.
                                  */
-                                if (before(TCP_SKB_CB(skb)->seq,
+                                if (before(start_seq,
                                            tcp_highest_sack_seq(tp)))
                                         state->reord = min(fack_count,
                                                            state->reord);
 
                                 /* SACK enhanced F-RTO (RFC4138; Appendix B) */
-                                if (!after(TCP_SKB_CB(skb)->end_seq, tp->frto_highmark))
+                                if (!after(end_seq, tp->frto_highmark))
                                         state->flag |= FLAG_ONLY_ORIG_SACKED;
                         }
 
@@ -1350,8 +1355,7 @@ static u8 tcp_sacktag_one(struct sk_buff *skb, struct sock *sk,
 
                 /* Lost marker hint past SACKed? Tweak RFC3517 cnt */
                 if (!tcp_is_fack(tp) && (tp->lost_skb_hint != NULL) &&
-                    before(TCP_SKB_CB(skb)->seq,
-                           TCP_SKB_CB(tp->lost_skb_hint)->seq))
+                    before(start_seq, TCP_SKB_CB(tp->lost_skb_hint)->seq))
                         tp->lost_cnt_hint += pcount;
 
                 if (fack_count > tp->fackets_out)
@@ -1370,6 +1374,9 @@ static u8 tcp_sacktag_one(struct sk_buff *skb, struct sock *sk,
         return sacked;
 }
 
+/* Shift newly-SACKed bytes from this skb to the immediately previous
+ * already-SACKed sk_buff. Mark the newly-SACKed bytes as such.
+ */
 static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                            struct tcp_sacktag_state *state,
                            unsigned int pcount, int shifted, int mss,
@@ -1377,12 +1384,21 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *prev = tcp_write_queue_prev(sk, skb);
+        u32 start_seq = TCP_SKB_CB(skb)->seq;   /* start of newly-SACKed */
+        u32 end_seq = start_seq + shifted;      /* end of newly-SACKed */
 
         BUG_ON(!pcount);
 
-        /* Tweak before seqno plays */
-        if (!tcp_is_fack(tp) && tcp_is_sack(tp) && tp->lost_skb_hint &&
-            !before(TCP_SKB_CB(tp->lost_skb_hint)->seq, TCP_SKB_CB(skb)->seq))
+        /* Adjust counters and hints for the newly sacked sequence
+         * range but discard the return value since prev is already
+         * marked. We must tag the range first because the seq
+         * advancement below implicitly advances
+         * tcp_highest_sack_seq() when skb is highest_sack.
+         */
+        tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
+                        start_seq, end_seq, dup_sack, pcount);
+
+        if (skb == tp->lost_skb_hint)
                 tp->lost_cnt_hint += pcount;
 
         TCP_SKB_CB(prev)->end_seq += shifted;
@@ -1408,9 +1424,6 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                 skb_shinfo(skb)->gso_type = 0;
         }
 
-        /* We discard results */
-        tcp_sacktag_one(skb, sk, state, dup_sack, pcount);
-
         /* Difference in this won't matter, both ACKed by the same cumul. ACK */
         TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS);
 
@@ -1558,6 +1571,10 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
                 }
         }
 
+        /* tcp_sacktag_one() won't SACK-tag ranges below snd_una */
+        if (!after(TCP_SKB_CB(skb)->seq + len, tp->snd_una))
+                goto fallback;
+
         if (!skb_shift(prev, skb, len))
                 goto fallback;
         if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss, dup_sack))
@@ -1648,10 +1665,14 @@ static struct sk_buff *tcp_sacktag_walk(struct sk_buff *skb, struct sock *sk,
                         break;
 
                 if (in_sack) {
-                        TCP_SKB_CB(skb)->sacked = tcp_sacktag_one(skb, sk,
-                                                                  state,
-                                                                  dup_sack,
-                                                                  tcp_skb_pcount(skb));
+                        TCP_SKB_CB(skb)->sacked =
+                                tcp_sacktag_one(sk,
+                                                state,
+                                                TCP_SKB_CB(skb)->sacked,
+                                                TCP_SKB_CB(skb)->seq,
+                                                TCP_SKB_CB(skb)->end_seq,
+                                                dup_sack,
+                                                tcp_skb_pcount(skb));
 
                         if (!before(TCP_SKB_CB(skb)->seq,
                                     tcp_highest_sack_seq(tp)))
@@ -2536,6 +2557,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
 
                 if (cnt > packets) {
                         if ((tcp_is_sack(tp) && !tcp_is_fack(tp)) ||
+                            (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) ||
                             (oldcnt >= packets))
                                 break;
 
@@ -5318,7 +5340,9 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                         if (tp->copied_seq == tp->rcv_nxt &&
                             len - tcp_header_len <= tp->ucopy.len) {
 #ifdef CONFIG_NET_DMA
-                                if (tcp_dma_try_early_copy(sk, skb, tcp_header_len)) {
+                                if (tp->ucopy.task == current &&
+                                    sock_owned_by_user(sk) &&
+                                    tcp_dma_try_early_copy(sk, skb, tcp_header_len)) {
                                         copied_early = 1;
                                         eaten = 1;
                                 }
@@ -5739,6 +5763,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                         goto discard;
 
                 if (th->syn) {
+                        if (th->fin)
+                                goto discard;
                         if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
                                 return 1;
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 708dc203b03..53a5af66c0b 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -72,6 +72,7 @@
 #include <net/timewait_sock.h>
 #include <net/xfrm.h>
 #include <net/netdma.h>
+#include <net/secure_seq.h>
 
 #include <linux/inet.h>
 #include <linux/ipv6.h>
@@ -629,7 +630,7 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
         arg.iov[0].iov_len  = sizeof(rep.th);
 
 #ifdef CONFIG_TCP_MD5SIG
-        key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->daddr) : NULL;
+        key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->saddr) : NULL;
         if (key) {
                 rep.opt[0] = htonl((TCPOPT_NOP << 24) |
                                    (TCPOPT_NOP << 16) |
@@ -649,6 +650,11 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
                                       arg.iov[0].iov_len, IPPROTO_TCP, 0);
         arg.csumoffset = offsetof(struct tcphdr, check) / 2;
         arg.flags = (sk && inet_sk(sk)->transparent) ? IP_REPLY_ARG_NOSRCCHECK : 0;
+        /* When socket is gone, all binding information is lost.
+         * routing might fail in this case. using iif for oif to
+         * make sure we can deliver it
+         */
+        arg.bound_dev_if = sk ? sk->sk_bound_dev_if : inet_iif(skb);
 
         net = dev_net(skb_dst(skb)->dev);
         ip_send_reply(net->ipv4.tcp_sock, skb, ip_hdr(skb)->saddr,
@@ -908,18 +914,21 @@ int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
                         }
                         sk_nocaps_add(sk, NETIF_F_GSO_MASK);
                 }
-                if (tcp_alloc_md5sig_pool(sk) == NULL) {
+
+                md5sig = tp->md5sig_info;
+                if (md5sig->entries4 == 0 &&
+                    tcp_alloc_md5sig_pool(sk) == NULL) {
                         kfree(newkey);
                         return -ENOMEM;
                 }
-                md5sig = tp->md5sig_info;
 
                 if (md5sig->alloced4 == md5sig->entries4) {
                         keys = kmalloc((sizeof(*keys) *
                                         (md5sig->entries4 + 1)), GFP_ATOMIC);
                         if (!keys) {
                                 kfree(newkey);
-                                tcp_free_md5sig_pool();
+                                if (md5sig->entries4 == 0)
+                                        tcp_free_md5sig_pool();
                                 return -ENOMEM;
                         }
 
@@ -963,6 +972,7 @@ int tcp_v4_md5_do_del(struct sock *sk, __be32 addr)
                                 kfree(tp->md5sig_info->keys4);
                                 tp->md5sig_info->keys4 = NULL;
                                 tp->md5sig_info->alloced4 = 0;
+                                tcp_free_md5sig_pool();
                         } else if (tp->md5sig_info->entries4 != i) {
                                 /* Need to do some manipulation */
                                 memmove(&tp->md5sig_info->keys4[i],
@@ -970,7 +980,6 @@ int tcp_v4_md5_do_del(struct sock *sk, __be32 addr)
                                         (tp->md5sig_info->entries4 - i) *
                                          sizeof(struct tcp4_md5sig_key));
                         }
-                        tcp_free_md5sig_pool();
                         return 0;
                 }
         }
@@ -1445,9 +1454,13 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
         newinet->inet_id = newtp->write_seq ^ jiffies;
 
-        if (!dst && (dst = inet_csk_route_child_sock(sk, newsk, req)) == NULL)
-                goto put_and_exit;
-
+        if (!dst) {
+                dst = inet_csk_route_child_sock(sk, newsk, req);
+                if (!dst)
+                        goto put_and_exit;
+        } else {
+                /* syncookie case : see end of cookie_v4_check() */
+        }
         sk_setup_caps(newsk, dst);
 
         tcp_mtup_init(newsk);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 882e0b0964d..faf257b9415 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1134,11 +1134,9 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
         sk_mem_uncharge(sk, len);
         sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
 
-        /* Any change of skb->len requires recalculation of tso
-         * factor and mss.
-         */
+        /* Any change of skb->len requires recalculation of tso factor. */
         if (tcp_skb_pcount(skb) > 1)
-                tcp_set_skb_tso_segs(sk, skb, tcp_current_mss(sk));
+                tcp_set_skb_tso_segs(sk, skb, tcp_skb_mss(skb));
 
         return 0;
 }
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index 63418185f52..e3db3f91511 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -110,10 +110,7 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb_push(skb, sizeof(*iph));
         skb_reset_network_header(skb);
-
-        memmove(skb->data - skb->mac_len, skb_mac_header(skb),
-                skb->mac_len);
-        skb_set_mac_header(skb, -skb->mac_len);
+        skb_mac_header_rebuild(skb);
 
         xfrm4_beet_make_header(skb);
 
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 534972e114a..ed4bf11ef9f 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -66,7 +66,6 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 
 static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
-        const unsigned char *old_mac;
         int err = -EINVAL;
 
         if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP)
@@ -84,10 +83,9 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!(x->props.flags & XFRM_STATE_NOECN))
                 ipip_ecn_decapsulate(skb);
 
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
         skb_reset_network_header(skb);
+        skb_mac_header_rebuild(skb);
+
         err = 0;
 
 out:
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 981e43eaf70..581fe0ab409 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -79,13 +79,13 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
         struct rtable *rt = (struct rtable *)xdst->route;
         const struct flowi4 *fl4 = &fl->u.ip4;
 
-        rt->rt_key_dst = fl4->daddr;
-        rt->rt_key_src = fl4->saddr;
-        rt->rt_key_tos = fl4->flowi4_tos;
-        rt->rt_route_iif = fl4->flowi4_iif;
-        rt->rt_iif = fl4->flowi4_iif;
-        rt->rt_oif = fl4->flowi4_oif;
-        rt->rt_mark = fl4->flowi4_mark;
+        xdst->u.rt.rt_key_dst = fl4->daddr;
+        xdst->u.rt.rt_key_src = fl4->saddr;
+        xdst->u.rt.rt_key_tos = fl4->flowi4_tos;
+        xdst->u.rt.rt_route_iif = fl4->flowi4_iif;
+        xdst->u.rt.rt_iif = fl4->flowi4_iif;
+        xdst->u.rt.rt_oif = fl4->flowi4_oif;
+        xdst->u.rt.rt_mark = fl4->flowi4_mark;
 
         xdst->u.dst.dev = dev;
         dev_hold(dev);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 498b927f68b..8a4bf719c25 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -433,6 +433,10 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
         /* Join all-node multicast group */
         ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
 
+        /* Join all-router multicast group if forwarding is set */
+        if (ndev->cnf.forwarding && dev && (dev->flags & IFF_MULTICAST))
+                ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
+
         return ndev;
 }
 
@@ -656,7 +660,7 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
          * layer address of our nexhop router
          */
 
-        if (rt->rt6i_nexthop == NULL)
+        if (dst_get_neighbour_raw(&rt->dst) == NULL)
                 ifa->flags &= ~IFA_F_OPTIMISTIC;
 
         ifa->idev = idev;
@@ -824,12 +828,13 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *i
 {
         struct inet6_dev *idev = ifp->idev;
         struct in6_addr addr, *tmpaddr;
-        unsigned long tmp_prefered_lft, tmp_valid_lft, tmp_cstamp, tmp_tstamp, age;
+        unsigned long tmp_prefered_lft, tmp_valid_lft, tmp_tstamp, age;
         unsigned long regen_advance;
         int tmp_plen;
         int ret = 0;
         int max_addresses;
         u32 addr_flags;
+        unsigned long now = jiffies;
 
         write_lock(&idev->lock);
         if (ift) {
@@ -874,7 +879,7 @@ retry:
                 goto out;
         }
         memcpy(&addr.s6_addr[8], idev->rndid, 8);
-        age = (jiffies - ifp->tstamp) / HZ;
+        age = (now - ifp->tstamp) / HZ;
         tmp_valid_lft = min_t(__u32,
                               ifp->valid_lft,
                               idev->cnf.temp_valid_lft + age);
@@ -884,7 +889,6 @@ retry:
                                  idev->cnf.max_desync_factor);
         tmp_plen = ifp->prefix_len;
         max_addresses = idev->cnf.max_addresses;
-        tmp_cstamp = ifp->cstamp;
         tmp_tstamp = ifp->tstamp;
         spin_unlock_bh(&ifp->lock);
 
@@ -929,7 +933,7 @@ retry:
         ift->ifpub = ifp;
         ift->valid_lft = tmp_valid_lft;
         ift->prefered_lft = tmp_prefered_lft;
-        ift->cstamp = tmp_cstamp;
+        ift->cstamp = now;
         ift->tstamp = tmp_tstamp;
         spin_unlock_bh(&ift->lock);
 
@@ -1988,25 +1992,50 @@ ok:
 #ifdef CONFIG_IPV6_PRIVACY
                         read_lock_bh(&in6_dev->lock);
                         /* update all temporary addresses in the list */
-                        list_for_each_entry(ift, &in6_dev->tempaddr_list, tmp_list) {
-                                /*
-                                 * When adjusting the lifetimes of an existing
-                                 * temporary address, only lower the lifetimes.
-                                 * Implementations must not increase the
-                                 * lifetimes of an existing temporary address
-                                 * when processing a Prefix Information Option.
-                                 */
+                        list_for_each_entry(ift, &in6_dev->tempaddr_list,
+                                            tmp_list) {
+                                int age, max_valid, max_prefered;
+
                                 if (ifp != ift->ifpub)
                                         continue;
 
+                                /*
+                                 * RFC 4941 section 3.3:
+                                 * If a received option will extend the lifetime
+                                 * of a public address, the lifetimes of
+                                 * temporary addresses should be extended,
+                                 * subject to the overall constraint that no
+                                 * temporary addresses should ever remain
+                                 * "valid" or "preferred" for a time longer than
+                                 * (TEMP_VALID_LIFETIME) or
+                                 * (TEMP_PREFERRED_LIFETIME - DESYNC_FACTOR),
+                                 * respectively.
+                                 */
+                                age = (now - ift->cstamp) / HZ;
+                                max_valid = in6_dev->cnf.temp_valid_lft - age;
+                                if (max_valid < 0)
+                                        max_valid = 0;
+
+                                max_prefered = in6_dev->cnf.temp_prefered_lft -
+                                               in6_dev->cnf.max_desync_factor -
+                                               age;
+                                if (max_prefered < 0)
+                                        max_prefered = 0;
+
+                                if (valid_lft > max_valid)
+                                        valid_lft = max_valid;
+
+                                if (prefered_lft > max_prefered)
+                                        prefered_lft = max_prefered;
+
                                 spin_lock(&ift->lock);
                                 flags = ift->flags;
-                                if (ift->valid_lft > valid_lft &&
-                                    ift->valid_lft - valid_lft > (jiffies - ift->tstamp) / HZ)
-                                        ift->valid_lft = valid_lft + (jiffies - ift->tstamp) / HZ;
-                                if (ift->prefered_lft > prefered_lft &&
-                                    ift->prefered_lft - prefered_lft > (jiffies - ift->tstamp) / HZ)
-                                        ift->prefered_lft = prefered_lft + (jiffies - ift->tstamp) / HZ;
+                                ift->valid_lft = valid_lft;
+                                ift->prefered_lft = prefered_lft;
+                                ift->tstamp = now;
+                                if (prefered_lft > 0)
+                                        ift->flags &= ~IFA_F_DEPRECATED;
+
                                 spin_unlock(&ift->lock);
                                 if (!(flags&IFA_F_TENTATIVE))
                                         ipv6_ifa_notify(0, ift);
@@ -2014,9 +2043,11 @@ ok:
 
                         if ((create || list_empty(&in6_dev->tempaddr_list)) && in6_dev->cnf.use_tempaddr > 0) {
                                 /*
-                                 * When a new public address is created as described in [ADDRCONF],
-                                 * also create a new temporary address. Also create a temporary
-                                 * address if it's enabled but no temporary address currently exists.
+                                 * When a new public address is created as
+                                 * described in [ADDRCONF], also create a new
+                                 * temporary address. Also create a temporary
+                                 * address if it's enabled but no temporary
+                                 * address currently exists.
                                  */
                                 read_unlock_bh(&in6_dev->lock);
                                 ipv6_create_tempaddr(ifp, NULL);
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3b5669a2582..7e8340ef5a2 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -63,6 +63,20 @@
 #include <asm/system.h>
 #include <linux/mroute6.h>
 
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
+#include <linux/android_aid.h>
+
+static inline int current_has_network(void)
+{
+        return in_egroup_p(AID_INET) || capable(CAP_NET_RAW);
+}
+#else
+static inline int current_has_network(void)
+{
+        return 1;
+}
+#endif
+
 MODULE_AUTHOR("Cast of dozens");
 MODULE_DESCRIPTION("IPv6 protocol stack for Linux");
 MODULE_LICENSE("GPL");
@@ -109,6 +123,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
         int try_loading_module = 0;
         int err;
 
+        if (!current_has_network())
+                return -EACCES;
+
         if (sock->type != SOCK_RAW &&
             sock->type != SOCK_DGRAM &&
             !inet_ehash_secret)
@@ -477,6 +494,21 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
 
 EXPORT_SYMBOL(inet6_getname);
 
+int inet6_killaddr_ioctl(struct net *net, void __user *arg) {
+        struct in6_ifreq ireq;
+        struct sockaddr_in6 sin6;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EACCES;
+
+        if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
+                return -EFAULT;
+
+        sin6.sin6_family = AF_INET6;
+        ipv6_addr_copy(&sin6.sin6_addr, &ireq.ifr6_addr);
+        return tcp_nuke_addr(net, (struct sockaddr *) &sin6);
+}
+
 int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         struct sock *sk = sock->sk;
@@ -501,6 +533,8 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 return addrconf_del_ifaddr(net, (void __user *) arg);
         case SIOCSIFDSTADDR:
                 return addrconf_set_dstaddr(net, (void __user *) arg);
+        case SIOCKILLADDR:
+                return inet6_killaddr_ioctl(net, (void __user *) arg);
         default:
                 if (!sk->sk_prot->ioctl)
                         return -ENOIOCTLCMD;
@@ -1078,6 +1112,8 @@ static int __init inet6_init(void)
                 goto out;
         }
 
+        initialize_hashidentrnd();
+
         err = proto_register(&tcpv6_prot, 1);
         if (err)
                 goto out;
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 2195ae65192..4c0f894d084 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -324,8 +324,6 @@ static void ah6_output_done(struct crypto_async_request *base, int err)
 #endif
         }
 
-        err = ah->nexthdr;
-
         kfree(AH_SKB_CB(skb)->tmp);
         xfrm_output_resume(skb, err);
 }
@@ -466,12 +464,12 @@ static void ah6_input_done(struct crypto_async_request *base, int err)
         if (err)
                 goto out;
 
+        err = ah->nexthdr;
+
         skb->network_header += ah_hlen;
         memcpy(skb_network_header(skb), work_iph, hdr_len);
         __skb_pull(skb, ah_hlen + hdr_len);
         skb_set_transport_header(skb, -hdr_len);
-
-        err = ah->nexthdr;
 out:
         kfree(AH_SKB_CB(skb)->tmp);
         xfrm_input_resume(skb, err);
@@ -583,8 +581,6 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
                 if (err == -EINPROGRESS)
                         goto out;
 
-                if (err == -EBUSY)
-                        err = NET_XMIT_DROP;
                 goto out_free;
         }
 
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 1ac7938dd9e..65dd5433f08 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -411,19 +411,15 @@ static u32 esp6_get_mtu(struct xfrm_state *x, int mtu)
         struct esp_data *esp = x->data;
         u32 blksize = ALIGN(crypto_aead_blocksize(esp->aead), 4);
         u32 align = max_t(u32, blksize, esp->padlen);
-        u32 rem;
+        unsigned int net_adj;
 
-        mtu -= x->props.header_len + crypto_aead_authsize(esp->aead);
-        rem = mtu & (align - 1);
-        mtu &= ~(align - 1);
-
-        if (x->props.mode != XFRM_MODE_TUNNEL) {
-                u32 padsize = ((blksize - 1) & 7) + 1;
-                mtu -= blksize - padsize;
-                mtu += min_t(u32, blksize - padsize, rem);
-        }
+        if (x->props.mode != XFRM_MODE_TUNNEL)
+                net_adj = sizeof(struct ipv6hdr);
+        else
+                net_adj = 0;
 
-        return mtu - 2;
+        return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
+                 net_adj) & ~(align - 1)) + (net_adj - 2);
 }
 
 static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index b5319723370..73f1a00a96a 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -20,6 +20,7 @@
 #include <net/inet_connection_sock.h>
 #include <net/inet_hashtables.h>
 #include <net/inet6_hashtables.h>
+#include <net/secure_seq.h>
 #include <net/ip.h>
 
 int __inet6_hash(struct sock *sk, struct inet_timewait_sock *tw)
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 4076a0b14b2..0f9b37a1c1d 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1455,7 +1455,7 @@ static int fib6_age(struct rt6_info *rt, void *arg)
                         RT6_TRACE("aging clone %p\n", rt);
                         return -1;
                 } else if ((rt->rt6i_flags & RTF_GATEWAY) &&
-                           (!(rt->rt6i_nexthop->flags & NTF_ROUTER))) {
+                           (!(dst_get_neighbour_raw(&rt->dst)->flags & NTF_ROUTER))) {
                         RT6_TRACE("purging route %p via non-router but gateway\n",
                                   rt);
                         return -1;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 9d4b165837d..ae9f6d43617 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -100,6 +100,8 @@ static int ip6_finish_output2(struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
         struct net_device *dev = dst->dev;
+        struct neighbour *neigh;
+        int res;
 
         skb->protocol = htons(ETH_P_IPV6);
         skb->dev = dev;
@@ -134,10 +136,22 @@ static int ip6_finish_output2(struct sk_buff *skb)
                                 skb->len);
         }
 
-        if (dst->hh)
-                return neigh_hh_output(dst->hh, skb);
-        else if (dst->neighbour)
-                return dst->neighbour->output(skb);
+        rcu_read_lock();
+        if (dst->hh) {
+                res = neigh_hh_output(dst->hh, skb);
+
+                rcu_read_unlock();
+                return res;
+        } else {
+                neigh = dst_get_neighbour(dst);
+                if (neigh) {
+                        res = neigh->output(skb);
+
+                        rcu_read_unlock();
+                        return res;
+                }
+                rcu_read_unlock();
+        }
 
         IP6_INC_STATS_BH(dev_net(dst->dev),
                          ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
@@ -385,6 +399,7 @@ int ip6_forward(struct sk_buff *skb)
         struct ipv6hdr *hdr = ipv6_hdr(skb);
         struct inet6_skb_parm *opt = IP6CB(skb);
         struct net *net = dev_net(dst->dev);
+        struct neighbour *n;
         u32 mtu;
 
         if (net->ipv6.devconf_all->forwarding == 0)
@@ -459,11 +474,10 @@ int ip6_forward(struct sk_buff *skb)
            send redirects to source routed frames.
            We don't send redirects to frames decapsulated from IPsec.
          */
-        if (skb->dev == dst->dev && dst->neighbour && opt->srcrt == 0 &&
-            !skb_sec_path(skb)) {
+        n = dst_get_neighbour(dst);
+        if (skb->dev == dst->dev && n && opt->srcrt == 0 && !skb_sec_path(skb)) {
                 struct in6_addr *target = NULL;
                 struct rt6_info *rt;
-                struct neighbour *n = dst->neighbour;
 
                 /*
                  *      incoming and outgoing devices are the same
@@ -596,6 +610,35 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
         return offset;
 }
 
+static u32 hashidentrnd __read_mostly;
+#define FID_HASH_SZ 16
+static u32 ipv6_fragmentation_id[FID_HASH_SZ];
+
+void __init initialize_hashidentrnd(void)
+{
+        get_random_bytes(&hashidentrnd, sizeof(hashidentrnd));
+}
+
+static u32 __ipv6_select_ident(const struct in6_addr *addr)
+{
+        u32 newid, oldid, hash = jhash2((u32 *)addr, 4, hashidentrnd);
+        u32 *pid = &ipv6_fragmentation_id[hash % FID_HASH_SZ];
+
+        do {
+                oldid = *pid;
+                newid = oldid + 1;
+                if (!(hash + newid))
+                        newid++;
+        } while (cmpxchg(pid, oldid, newid) != oldid);
+
+        return hash + newid;
+}
+
+void ipv6_select_ident(struct frag_hdr *fhdr, struct in6_addr *addr)
+{
+        fhdr->identification = htonl(__ipv6_select_ident(addr));
+}
+
 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 {
         struct sk_buff *frag;
@@ -680,7 +723,7 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                 skb_reset_network_header(skb);
                 memcpy(skb_network_header(skb), tmp_hdr, hlen);
 
-                ipv6_select_ident(fh);
+                ipv6_select_ident(fh, &rt->rt6i_dst.addr);
                 fh->nexthdr = nexthdr;
                 fh->reserved = 0;
                 fh->frag_off = htons(IP6_MF);
@@ -826,7 +869,7 @@ slow_path:
                 fh->nexthdr = nexthdr;
                 fh->reserved = 0;
                 if (!frag_id) {
-                        ipv6_select_ident(fh);
+                        ipv6_select_ident(fh, &rt->rt6i_dst.addr);
                         frag_id = fh->identification;
                 } else
                         fh->identification = frag_id;
@@ -920,8 +963,11 @@ out:
 static int ip6_dst_lookup_tail(struct sock *sk,
                                struct dst_entry **dst, struct flowi6 *fl6)
 {
-        int err;
         struct net *net = sock_net(sk);
+#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
+        struct neighbour *n;
+#endif
+        int err;
 
         if (*dst == NULL)
                 *dst = ip6_route_output(net, sk, fl6);
@@ -947,11 +993,14 @@ static int ip6_dst_lookup_tail(struct sock *sk,
          * dst entry and replace it instead with the
          * dst entry of the nexthop router
          */
-        if ((*dst)->neighbour && !((*dst)->neighbour->nud_state & NUD_VALID)) {
+        rcu_read_lock();
+        n = dst_get_neighbour(*dst);
+        if (n && !(n->nud_state & NUD_VALID)) {
                 struct inet6_ifaddr *ifp;
                 struct flowi6 fl_gw6;
                 int redirect;
 
+                rcu_read_unlock();
                 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
                                       (*dst)->dev, 1);
 
@@ -971,6 +1020,8 @@ static int ip6_dst_lookup_tail(struct sock *sk,
                         if ((err = (*dst)->error))
                                 goto out_err_release;
                 }
+        } else {
+                rcu_read_unlock();
         }
 #endif
 
@@ -1072,7 +1123,8 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                         int getfrag(void *from, char *to, int offset, int len,
                         int odd, struct sk_buff *skb),
                         void *from, int length, int hh_len, int fragheaderlen,
-                        int transhdrlen, int mtu,unsigned int flags)
+                        int transhdrlen, int mtu,unsigned int flags,
+                        struct rt6_info *rt)
 
 {
         struct sk_buff *skb;
@@ -1116,7 +1168,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                 skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
                                              sizeof(struct frag_hdr)) & ~7;
                 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
-                ipv6_select_ident(&fhdr);
+                ipv6_select_ident(&fhdr, &rt->rt6i_dst.addr);
                 skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
                 __skb_queue_tail(&sk->sk_write_queue, skb);
 
@@ -1142,6 +1194,29 @@ static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
         return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
 }
 
+static void ip6_append_data_mtu(int *mtu,
+                                int *maxfraglen,
+                                unsigned int fragheaderlen,
+                                struct sk_buff *skb,
+                                struct rt6_info *rt)
+{
+        if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
+                if (skb == NULL) {
+                        /* first fragment, reserve header_len */
+                        *mtu = *mtu - rt->dst.header_len;
+
+                } else {
+                        /*
+                         * this fragment is not first, the headers
+                         * space is regarded as data space.
+                         */
+                        *mtu = dst_mtu(rt->dst.path);
+                }
+                *maxfraglen = ((*mtu - fragheaderlen) & ~7)
+                              + fragheaderlen - sizeof(struct frag_hdr);
+        }
+}
+
 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         int offset, int len, int odd, struct sk_buff *skb),
         void *from, int length, int transhdrlen,
@@ -1151,7 +1226,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct inet_cork *cork;
-        struct sk_buff *skb;
+        struct sk_buff *skb, *skb_prev = NULL;
         unsigned int maxfraglen, fragheaderlen;
         int exthdrlen;
         int hh_len;
@@ -1208,8 +1283,12 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 inet->cork.fl.u.ip6 = *fl6;
                 np->cork.hop_limit = hlimit;
                 np->cork.tclass = tclass;
-                mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
-                      rt->dst.dev->mtu : dst_mtu(rt->dst.path);
+                if (rt->dst.flags & DST_XFRM_TUNNEL)
+                        mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
+                              rt->dst.dev->mtu : dst_mtu(&rt->dst);
+                else
+                        mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
+                              rt->dst.dev->mtu : dst_mtu(rt->dst.path);
                 if (np->frag_size < mtu) {
                         if (np->frag_size)
                                 mtu = np->frag_size;
@@ -1282,7 +1361,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
 
                         err = ip6_ufo_append_data(sk, getfrag, from, length,
                                                   hh_len, fragheaderlen,
-                                                  transhdrlen, mtu, flags);
+                                                  transhdrlen, mtu, flags, rt);
                         if (err)
                                 goto error;
                         return 0;
@@ -1304,38 +1383,43 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                         unsigned int fraglen;
                         unsigned int fraggap;
                         unsigned int alloclen;
-                        struct sk_buff *skb_prev;
 alloc_new_skb:
-                        skb_prev = skb;
-
                         /* There's no room in the current skb */
-                        if (skb_prev)
-                                fraggap = skb_prev->len - maxfraglen;
+                        if (skb)
+                                fraggap = skb->len - maxfraglen;
                         else
                                 fraggap = 0;
+                        /* update mtu and maxfraglen if necessary */
+                        if (skb == NULL || skb_prev == NULL)
+                                ip6_append_data_mtu(&mtu, &maxfraglen,
+                                                    fragheaderlen, skb, rt);
+
+                        skb_prev = skb;
 
                         /*
                          * If remaining data exceeds the mtu,
                          * we know we need more fragment(s).
                          */
                         datalen = length + fraggap;
-                        if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
-                                datalen = maxfraglen - fragheaderlen;
 
-                        fraglen = datalen + fragheaderlen;
+                        if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
+                                datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
                         if ((flags & MSG_MORE) &&
                             !(rt->dst.dev->features&NETIF_F_SG))
                                 alloclen = mtu;
                         else
                                 alloclen = datalen + fragheaderlen;
 
-                        /*
-                         * The last fragment gets additional space at tail.
-                         * Note: we overallocate on fragments with MSG_MODE
-                         * because we have no idea if we're the last one.
-                         */
-                        if (datalen == length + fraggap)
-                                alloclen += rt->dst.trailer_len;
+                        if (datalen != length + fraggap) {
+                                /*
+                                 * this is not the last fragment, the trailer
+                                 * space is regarded as data space.
+                                 */
+                                datalen += rt->dst.trailer_len;
+                        }
+
+                        alloclen += rt->dst.trailer_len;
+                        fraglen = datalen + fragheaderlen;
 
                         /*
                          * We just reserve space for fragment header.
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 36c2842a86b..848e494fa3c 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -289,6 +289,8 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct ip6_tnl_parm *p)
         if ((err = register_netdevice(dev)) < 0)
                 goto failed_free;
 
+        strcpy(t->parms.name, dev->name);
+
         dev_hold(dev);
         ip6_tnl_link(ip6n, t);
         return t;
@@ -1397,7 +1399,6 @@ ip6_tnl_dev_init_gen(struct net_device *dev)
         struct ip6_tnl *t = netdev_priv(dev);
 
         t->dev = dev;
-        strcpy(t->parms.name, dev->name);
         dev->tstats = alloc_percpu(struct pcpu_tstats);
         if (!dev->tstats)
                 return -ENOMEM;
@@ -1477,6 +1478,7 @@ static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
 static int __net_init ip6_tnl_init_net(struct net *net)
 {
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
+        struct ip6_tnl *t = NULL;
         int err;
 
         ip6n->tnls[0] = ip6n->tnls_wc;
@@ -1497,6 +1499,10 @@ static int __net_init ip6_tnl_init_net(struct net *net)
         err = register_netdev(ip6n->fb_tnl_dev);
         if (err < 0)
                 goto err_register;
+
+        t = netdev_priv(ip6n->fb_tnl_dev);
+
+        strcpy(t->parms.name, ip6n->fb_tnl_dev->name);
         return 0;
 
 err_register:
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 82a809901f8..86e3cc10fc2 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -696,8 +696,10 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb,
         int err;
 
         err = ip6mr_fib_lookup(net, &fl6, &mrt);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(skb);
                 return err;
+        }
 
         read_lock(&mrt_lock);
         dev->stats.tx_bytes += skb->len;
@@ -2051,8 +2053,10 @@ int ip6_mr_input(struct sk_buff *skb)
         int err;
 
         err = ip6mr_fib_lookup(net, &fl6, &mrt);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(skb);
                 return err;
+        }
 
         read_lock(&mrt_lock);
         cache = ip6mr_cache_find(mrt,
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 9cb191ecaba..147ede38ab4 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -913,7 +913,7 @@ static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt,
 }
 
 static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
-                    char __user *optval, int __user *optlen)
+                    char __user *optval, int __user *optlen, unsigned flags)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         int len;
@@ -962,7 +962,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
 
                 msg.msg_control = optval;
                 msg.msg_controllen = len;
-                msg.msg_flags = 0;
+                msg.msg_flags = flags;
 
                 lock_sock(sk);
                 skb = np->pktoptions;
@@ -1222,7 +1222,7 @@ int ipv6_getsockopt(struct sock *sk, int level, int optname,
         if(level != SOL_IPV6)
                 return -ENOPROTOOPT;
 
-        err = do_ipv6_getsockopt(sk, level, optname, optval, optlen);
+        err = do_ipv6_getsockopt(sk, level, optname, optval, optlen, 0);
 #ifdef CONFIG_NETFILTER
         /* we need to exclude all possible ENOPROTOOPTs except default case */
         if (err == -ENOPROTOOPT && optname != IPV6_2292PKTOPTIONS) {
@@ -1264,7 +1264,8 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname,
                 return compat_mc_getsockopt(sk, level, optname, optval, optlen,
                         ipv6_getsockopt);
 
-        err = do_ipv6_getsockopt(sk, level, optname, optval, optlen);
+        err = do_ipv6_getsockopt(sk, level, optname, optval, optlen,
+                                 MSG_CMSG_COMPAT);
 #ifdef CONFIG_NETFILTER
         /* we need to exclude all possible ENOPROTOOPTs except default case */
         if (err == -ENOPROTOOPT && optname != IPV6_2292PKTOPTIONS) {
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 3e6ebcdb477..f2d74ea19a7 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -257,7 +257,6 @@ static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net,
 
                 if (rt) {
                         dev = rt->rt6i_dev;
-                        dev_hold(dev);
                         dst_release(&rt->dst);
                 }
         } else
@@ -1059,7 +1058,7 @@ static int mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
                         break;
                 for (i=0; i<nsrcs; i++) {
                         /* skip inactive filters */
-                        if (pmc->mca_sfcount[MCAST_INCLUDE] ||
+                        if (psf->sf_count[MCAST_INCLUDE] ||
                             pmc->mca_sfcount[MCAST_EXCLUDE] !=
                             psf->sf_count[MCAST_EXCLUDE])
                                 continue;
@@ -2055,7 +2054,7 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
                 if (!delta)
                         pmc->mca_sfcount[sfmode]--;
                 for (j=0; j<i; j++)
-                        (void) ip6_mc_del1_src(pmc, sfmode, &psfsrc[i]);
+                        ip6_mc_del1_src(pmc, sfmode, &psfsrc[j]);
         } else if (isexclude != (pmc->mca_sfcount[MCAST_EXCLUDE] != 0)) {
                 struct ip6_sf_list *psf;
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 7596f071d30..10a8d411707 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1244,7 +1244,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
         rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
 
         if (rt)
-                neigh = rt->rt6i_nexthop;
+                neigh = dst_get_neighbour(&rt->dst);
 
         if (rt && lifetime == 0) {
                 neigh_clone(neigh);
@@ -1265,7 +1265,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
                         return;
                 }
 
-                neigh = rt->rt6i_nexthop;
+                neigh = dst_get_neighbour(&rt->dst);
                 if (neigh == NULL) {
                         ND_PRINTK0(KERN_ERR
                                    "ICMPv6 RA: %s() got default router without neighbour.\n",
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 448464844a2..5bbf5316920 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -174,6 +174,18 @@ config IP6_NF_TARGET_REJECT
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config IP6_NF_TARGET_REJECT_SKERR
+        bool "Force socket error when rejecting with icmp*"
+        depends on IP6_NF_TARGET_REJECT
+        default n
+        help
+          This option enables turning a "--reject-with icmp*" into a matching
+          socket error also.
+          The REJECT target normally allows sending an ICMP message. But it
+          leaves the local socket unaware of any ingress rejects.
+
+          If unsure, say N.
+
 config IP6_NF_MANGLE
         tristate "Packet mangling"
         default m if NETFILTER_ADVANCED=n
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 94874b0bdcd..14cb310064f 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -2292,16 +2292,15 @@ static void __exit ip6_tables_fini(void)
  * "No next header".
  *
  * If target header is found, its offset is set in *offset and return protocol
- * number. Otherwise, return -1.
+ * number. Otherwise, return -ENOENT or -EBADMSG.
  *
  * If the first fragment doesn't contain the final protocol header or
  * NEXTHDR_NONE it is considered invalid.
  *
  * Note that non-1st fragment is special case that "the protocol number
  * of last header" is "next header" field in Fragment header. In this case,
- * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
- * isn't NULL.
- *
+ * *offset is meaningless. If fragoff is not NULL, the fragment offset is
+ * stored in *fragoff; if it is NULL, return -EINVAL.
  */
 int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                   int target, unsigned short *fragoff)
@@ -2342,9 +2341,12 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                                 if (target < 0 &&
                                     ((!ipv6_ext_hdr(hp->nexthdr)) ||
                                      hp->nexthdr == NEXTHDR_NONE)) {
-                                        if (fragoff)
+                                        if (fragoff) {
                                                 *fragoff = _frag_off;
-                                        return hp->nexthdr;
+                                                return hp->nexthdr;
+                                        } else {
+                                                return -EINVAL;
+                                        }
                                 }
                                 return -ENOENT;
                         }
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index a5a4c5dd539..09d30498c92 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -177,6 +177,15 @@ send_unreach(struct net *net, struct sk_buff *skb_in, unsigned char code,
                 skb_in->dev = net->loopback_dev;
 
         icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0);
+#ifdef CONFIG_IP6_NF_TARGET_REJECT_SKERR
+        if (skb_in->sk) {
+                icmpv6_err_convert(ICMPV6_DEST_UNREACH, code,
+                                   &skb_in->sk->sk_err);
+                skb_in->sk->sk_error_report(skb_in->sk);
+                pr_debug("ip6t_REJECT: sk_err=%d for skb=%p sk=%p\n",
+                        skb_in->sk->sk_err, skb_in, skb_in->sk);
+        }
+#endif
 }
 
 static unsigned int
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 0ef1f086feb..7c5b4cb8838 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -356,7 +356,7 @@ out:
 #ifdef CONFIG_IPV6_ROUTER_PREF
 static void rt6_probe(struct rt6_info *rt)
 {
-        struct neighbour *neigh = rt ? rt->rt6i_nexthop : NULL;
+        struct neighbour *neigh;
         /*
          * Okay, this does not seem to be appropriate
          * for now, however, we need to check if it
@@ -365,8 +365,10 @@ static void rt6_probe(struct rt6_info *rt)
          * Router Reachability Probe MUST be rate-limited
          * to no more than one per minute.
          */
+        rcu_read_lock();
+        neigh = rt ? dst_get_neighbour(&rt->dst) : NULL;
         if (!neigh || (neigh->nud_state & NUD_VALID))
-                return;
+                goto out;
         read_lock_bh(&neigh->lock);
         if (!(neigh->nud_state & NUD_VALID) &&
             time_after(jiffies, neigh->updated + rt->rt6i_idev->cnf.rtr_probe_interval)) {
@@ -379,8 +381,11 @@ static void rt6_probe(struct rt6_info *rt)
                 target = (struct in6_addr *)&neigh->primary_key;
                 addrconf_addr_solict_mult(target, &mcaddr);
                 ndisc_send_ns(rt->rt6i_dev, NULL, target, &mcaddr, NULL);
-        } else
+        } else {
                 read_unlock_bh(&neigh->lock);
+        }
+out:
+        rcu_read_unlock();
 }
 #else
 static inline void rt6_probe(struct rt6_info *rt)
@@ -404,8 +409,11 @@ static inline int rt6_check_dev(struct rt6_info *rt, int oif)
 
 static inline int rt6_check_neigh(struct rt6_info *rt)
 {
-        struct neighbour *neigh = rt->rt6i_nexthop;
+        struct neighbour *neigh;
         int m;
+
+        rcu_read_lock();
+        neigh = dst_get_neighbour(&rt->dst);
         if (rt->rt6i_flags & RTF_NONEXTHOP ||
             !(rt->rt6i_flags & RTF_GATEWAY))
                 m = 1;
@@ -422,6 +430,7 @@ static inline int rt6_check_neigh(struct rt6_info *rt)
                 read_unlock_bh(&neigh->lock);
         } else
                 m = 0;
+        rcu_read_unlock();
         return m;
 }
 
@@ -745,8 +754,7 @@ static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort, const struct in6_add
                         dst_free(&rt->dst);
                         return NULL;
                 }
-                rt->rt6i_nexthop = neigh;
-
+                dst_set_neighbour(&rt->dst, neigh);
         }
 
         return rt;
@@ -760,7 +768,7 @@ static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort, const struct in6_a
                 rt->rt6i_dst.plen = 128;
                 rt->rt6i_flags |= RTF_CACHE;
                 rt->dst.flags |= DST_HOST;
-                rt->rt6i_nexthop = neigh_clone(ort->rt6i_nexthop);
+                dst_set_neighbour(&rt->dst, neigh_clone(dst_get_neighbour_raw(&ort->dst)));
         }
         return rt;
 }
@@ -794,7 +802,7 @@ restart:
         dst_hold(&rt->dst);
         read_unlock_bh(&table->tb6_lock);
 
-        if (!rt->rt6i_nexthop && !(rt->rt6i_flags & RTF_NONEXTHOP))
+        if (!dst_get_neighbour_raw(&rt->dst) && !(rt->rt6i_flags & RTF_NONEXTHOP))
                 nrt = rt6_alloc_cow(rt, &fl6->daddr, &fl6->saddr);
         else if (!(rt->dst.flags & DST_HOST))
                 nrt = rt6_alloc_clone(rt, &fl6->daddr);
@@ -1058,7 +1066,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
         }
 
         rt->rt6i_idev     = idev;
-        rt->rt6i_nexthop  = neigh;
+        dst_set_neighbour(&rt->dst, neigh);
         atomic_set(&rt->dst.__refcnt, 1);
         dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 255);
         rt->dst.output  = ip6_output;
@@ -1338,12 +1346,12 @@ int ip6_route_add(struct fib6_config *cfg)
                 rt->rt6i_prefsrc.plen = 0;
 
         if (cfg->fc_flags & (RTF_GATEWAY | RTF_NONEXTHOP)) {
-                rt->rt6i_nexthop = __neigh_lookup_errno(&nd_tbl, &rt->rt6i_gateway, dev);
-                if (IS_ERR(rt->rt6i_nexthop)) {
-                        err = PTR_ERR(rt->rt6i_nexthop);
-                        rt->rt6i_nexthop = NULL;
+                struct neighbour *neigh = __neigh_lookup_errno(&nd_tbl, &rt->rt6i_gateway, dev);
+                if (IS_ERR(neigh)) {
+                        err = PTR_ERR(neigh);
                         goto out;
                 }
+                dst_set_neighbour(&rt->dst, neigh);
         }
 
         rt->rt6i_flags = cfg->fc_flags;
@@ -1574,7 +1582,7 @@ void rt6_redirect(const struct in6_addr *dest, const struct in6_addr *src,
         dst_confirm(&rt->dst);
 
         /* Duplicate redirect: silently ignore. */
-        if (neigh == rt->dst.neighbour)
+        if (neigh == dst_get_neighbour_raw(&rt->dst))
                 goto out;
 
         nrt = ip6_rt_copy(rt);
@@ -1590,7 +1598,7 @@ void rt6_redirect(const struct in6_addr *dest, const struct in6_addr *src,
         nrt->dst.flags |= DST_HOST;
 
         ipv6_addr_copy(&nrt->rt6i_gateway, (struct in6_addr*)neigh->primary_key);
-        nrt->rt6i_nexthop = neigh_clone(neigh);
+        dst_set_neighbour(&nrt->dst, neigh_clone(neigh));
 
         if (ip6_ins_rt(nrt))
                 goto out;
@@ -1670,7 +1678,7 @@ again:
            1. It is connected route. Action: COW
            2. It is gatewayed route or NONEXTHOP route. Action: clone it.
          */
-        if (!rt->rt6i_nexthop && !(rt->rt6i_flags & RTF_NONEXTHOP))
+        if (!dst_get_neighbour_raw(&rt->dst) && !(rt->rt6i_flags & RTF_NONEXTHOP))
                 nrt = rt6_alloc_cow(rt, daddr, saddr);
         else
                 nrt = rt6_alloc_clone(rt, daddr);
@@ -2035,7 +2043,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
 
                 return ERR_CAST(neigh);
         }
-        rt->rt6i_nexthop = neigh;
+        dst_set_neighbour(&rt->dst, neigh);
 
         ipv6_addr_copy(&rt->rt6i_dst.addr, addr);
         rt->rt6i_dst.plen = 128;
@@ -2312,6 +2320,7 @@ static int rt6_fill_node(struct net *net,
         struct nlmsghdr *nlh;
         long expires;
         u32 table;
+        struct neighbour *n;
 
         if (prefix) {   /* user wants prefix routes only */
                 if (!(rt->rt6i_flags & RTF_PREFIX_RT)) {
@@ -2400,8 +2409,15 @@ static int rt6_fill_node(struct net *net,
         if (rtnetlink_put_metrics(skb, dst_metrics_ptr(&rt->dst)) < 0)
                 goto nla_put_failure;
 
-        if (rt->dst.neighbour)
-                NLA_PUT(skb, RTA_GATEWAY, 16, &rt->dst.neighbour->primary_key);
+        rcu_read_lock();
+        n = dst_get_neighbour(&rt->dst);
+        if (n) {
+                if (nla_put(skb, RTA_GATEWAY, 16, &n->primary_key) < 0) {
+                        rcu_read_unlock();
+                        goto nla_put_failure;
+                }
+        }
+        rcu_read_unlock();
 
         if (rt->dst.dev)
                 NLA_PUT_U32(skb, RTA_OIF, rt->rt6i_dev->ifindex);
@@ -2585,6 +2601,7 @@ struct rt6_proc_arg
 static int rt6_info_route(struct rt6_info *rt, void *p_arg)
 {
         struct seq_file *m = p_arg;
+        struct neighbour *n;
 
         seq_printf(m, "%pi6 %02x ", &rt->rt6i_dst.addr, rt->rt6i_dst.plen);
 
@@ -2593,12 +2610,14 @@ static int rt6_info_route(struct rt6_info *rt, void *p_arg)
 #else
         seq_puts(m, "00000000000000000000000000000000 00 ");
 #endif
-
-        if (rt->rt6i_nexthop) {
-                seq_printf(m, "%pi6", rt->rt6i_nexthop->primary_key);
+        rcu_read_lock();
+        n = dst_get_neighbour(&rt->dst);
+        if (n) {
+                seq_printf(m, "%pi6", n->primary_key);
         } else {
                 seq_puts(m, "00000000000000000000000000000000");
         }
+        rcu_read_unlock();
         seq_printf(m, " %08x %08x %08x %08x %8s\n",
                    rt->rt6i_metric, atomic_read(&rt->dst.__refcnt),
                    rt->dst.__use, rt->rt6i_flags,
@@ -2827,10 +2846,6 @@ static int __net_init ip6_route_net_init(struct net *net)
         net->ipv6.sysctl.ip6_rt_mtu_expires = 10*60*HZ;
         net->ipv6.sysctl.ip6_rt_min_advmss = IPV6_MIN_MTU - 20 - 40;
 
-#ifdef CONFIG_PROC_FS
-        proc_net_fops_create(net, "ipv6_route", 0, &ipv6_route_proc_fops);
-        proc_net_fops_create(net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
-#endif
         net->ipv6.ip6_rt_gc_expire = 30*HZ;
 
         ret = 0;
@@ -2851,10 +2866,6 @@ out_ip6_dst_ops:
 
 static void __net_exit ip6_route_net_exit(struct net *net)
 {
-#ifdef CONFIG_PROC_FS
-        proc_net_remove(net, "ipv6_route");
-        proc_net_remove(net, "rt6_stats");
-#endif
         kfree(net->ipv6.ip6_null_entry);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
         kfree(net->ipv6.ip6_prohibit_entry);
@@ -2863,11 +2874,33 @@ static void __net_exit ip6_route_net_exit(struct net *net)
         dst_entries_destroy(&net->ipv6.ip6_dst_ops);
 }
 
+static int __net_init ip6_route_net_init_late(struct net *net)
+{
+#ifdef CONFIG_PROC_FS
+        proc_net_fops_create(net, "ipv6_route", 0, &ipv6_route_proc_fops);
+        proc_net_fops_create(net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
+#endif
+        return 0;
+}
+
+static void __net_exit ip6_route_net_exit_late(struct net *net)
+{
+#ifdef CONFIG_PROC_FS
+        proc_net_remove(net, "ipv6_route");
+        proc_net_remove(net, "rt6_stats");
+#endif
+}
+
 static struct pernet_operations ip6_route_net_ops = {
         .init = ip6_route_net_init,
         .exit = ip6_route_net_exit,
 };
 
+static struct pernet_operations ip6_route_net_late_ops = {
+        .init = ip6_route_net_init_late,
+        .exit = ip6_route_net_exit_late,
+};
+
 static struct notifier_block ip6_route_dev_notifier = {
         .notifier_call = ip6_route_dev_notify,
         .priority = 0,
@@ -2917,19 +2950,25 @@ int __init ip6_route_init(void)
         if (ret)
                 goto xfrm6_init;
 
+        ret = register_pernet_subsys(&ip6_route_net_late_ops);
+        if (ret)
+                goto fib6_rules_init;
+
         ret = -ENOBUFS;
         if (__rtnl_register(PF_INET6, RTM_NEWROUTE, inet6_rtm_newroute, NULL) ||
             __rtnl_register(PF_INET6, RTM_DELROUTE, inet6_rtm_delroute, NULL) ||
             __rtnl_register(PF_INET6, RTM_GETROUTE, inet6_rtm_getroute, NULL))
-                goto fib6_rules_init;
+                goto out_register_late_subsys;
 
         ret = register_netdevice_notifier(&ip6_route_dev_notifier);
         if (ret)
-                goto fib6_rules_init;
+                goto out_register_late_subsys;
 
 out:
         return ret;
 
+out_register_late_subsys:
+        unregister_pernet_subsys(&ip6_route_net_late_ops);
 fib6_rules_init:
         fib6_rules_cleanup();
 xfrm6_init:
@@ -2948,6 +2987,7 @@ out_kmem_cache:
 void ip6_route_cleanup(void)
 {
         unregister_netdevice_notifier(&ip6_route_dev_notifier);
+        unregister_pernet_subsys(&ip6_route_net_late_ops);
         fib6_rules_cleanup();
         xfrm6_fini();
         fib6_gc_cleanup();
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 1cca5761aea..f56acd09659 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -263,6 +263,8 @@ static struct ip_tunnel *ipip6_tunnel_locate(struct net *net,
         if (register_netdevice(dev) < 0)
                 goto failed_free;
 
+        strcpy(nt->parms.name, dev->name);
+
         dev_hold(dev);
 
         ipip6_tunnel_link(sitn, nt);
@@ -677,7 +679,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 struct neighbour *neigh = NULL;
 
                 if (skb_dst(skb))
-                        neigh = skb_dst(skb)->neighbour;
+                        neigh = dst_get_neighbour(skb_dst(skb));
 
                 if (neigh == NULL) {
                         if (net_ratelimit())
@@ -702,7 +704,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 struct neighbour *neigh = NULL;
 
                 if (skb_dst(skb))
-                        neigh = skb_dst(skb)->neighbour;
+                        neigh = dst_get_neighbour(skb_dst(skb));
 
                 if (neigh == NULL) {
                         if (net_ratelimit())
@@ -1141,7 +1143,6 @@ static int ipip6_tunnel_init(struct net_device *dev)
         struct ip_tunnel *tunnel = netdev_priv(dev);
 
         tunnel->dev = dev;
-        strcpy(tunnel->parms.name, dev->name);
 
         memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
         memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
@@ -1204,6 +1205,7 @@ static void __net_exit sit_destroy_tunnels(struct sit_net *sitn, struct list_hea
 static int __net_init sit_init_net(struct net *net)
 {
         struct sit_net *sitn = net_generic(net, sit_net_id);
+        struct ip_tunnel *t;
         int err;
 
         sitn->tunnels[0] = sitn->tunnels_wc;
@@ -1228,6 +1230,9 @@ static int __net_init sit_init_net(struct net *net)
         if ((err = register_netdev(sitn->fb_tunnel_dev)))
                 goto err_reg_dev;
 
+        t = netdev_priv(sitn->fb_tunnel_dev);
+
+        strcpy(t->parms.name, sitn->fb_tunnel_dev->name);
         return 0;
 
 err_reg_dev:
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 8b9644a8b69..14b83395eed 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -165,7 +165,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         int mss;
         struct dst_entry *dst;
         __u8 rcv_wscale;
-        bool ecn_ok;
+        bool ecn_ok = false;
 
         if (!sysctl_tcp_syncookies || !th->ack || th->rst)
                 goto out;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 87551ca568c..848f9634bbd 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -61,6 +61,7 @@
 #include <net/timewait_sock.h>
 #include <net/netdma.h>
 #include <net/inet_common.h>
+#include <net/secure_seq.h>
 
 #include <asm/uaccess.h>
 
@@ -604,7 +605,8 @@ static int tcp_v6_md5_do_add(struct sock *sk, const struct in6_addr *peer,
                         }
                         sk_nocaps_add(sk, NETIF_F_GSO_MASK);
                 }
-                if (tcp_alloc_md5sig_pool(sk) == NULL) {
+                if (tp->md5sig_info->entries6 == 0 &&
+                        tcp_alloc_md5sig_pool(sk) == NULL) {
                         kfree(newkey);
                         return -ENOMEM;
                 }
@@ -613,8 +615,9 @@ static int tcp_v6_md5_do_add(struct sock *sk, const struct in6_addr *peer,
                                        (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
 
                         if (!keys) {
-                                tcp_free_md5sig_pool();
                                 kfree(newkey);
+                                if (tp->md5sig_info->entries6 == 0)
+                                        tcp_free_md5sig_pool();
                                 return -ENOMEM;
                         }
 
@@ -660,6 +663,7 @@ static int tcp_v6_md5_do_del(struct sock *sk, const struct in6_addr *peer)
                                 kfree(tp->md5sig_info->keys6);
                                 tp->md5sig_info->keys6 = NULL;
                                 tp->md5sig_info->alloced6 = 0;
+                                tcp_free_md5sig_pool();
                         } else {
                                 /* shrink the database */
                                 if (tp->md5sig_info->entries6 != i)
@@ -668,7 +672,6 @@ static int tcp_v6_md5_do_del(struct sock *sk, const struct in6_addr *peer)
                                                 (tp->md5sig_info->entries6 - i)
                                                 * sizeof (tp->md5sig_info->keys6[0]));
                         }
-                        tcp_free_md5sig_pool();
                         return 0;
                 }
         }
@@ -1093,7 +1096,7 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 
 #ifdef CONFIG_TCP_MD5SIG
         if (sk)
-                key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
+                key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr);
 #endif
 
         if (th->ack)
@@ -1406,6 +1409,8 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
 #endif
 
+                newnp->ipv6_ac_list = NULL;
+                newnp->ipv6_fl_list = NULL;
                 newnp->pktoptions  = NULL;
                 newnp->opt         = NULL;
                 newnp->mcast_oif   = inet6_iif(skb);
@@ -1470,6 +1475,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
            First: no IPv4 options.
          */
         newinet->inet_opt = NULL;
+        newnp->ipv6_ac_list = NULL;
         newnp->ipv6_fl_list = NULL;
 
         /* Clone RX bits */
@@ -1508,6 +1514,10 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         tcp_mtup_init(newsk);
         tcp_sync_mss(newsk, dst_mtu(dst));
         newtp->advmss = dst_metric_advmss(dst);
+        if (tcp_sk(sk)->rx_opt.user_mss &&
+            tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
+                newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
+
         tcp_initialize_rcv_mss(newsk);
 
         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 328985c4088..0d920c58de6 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1309,6 +1309,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features)
         u8 frag_hdr_sz = sizeof(struct frag_hdr);
         int offset;
         __wsum csum;
+        struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
 
         mss = skb_shinfo(skb)->gso_size;
         if (unlikely(skb->len <= mss))
@@ -1359,7 +1360,8 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features)
         fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
         fptr->nexthdr = nexthdr;
         fptr->reserved = 0;
-        ipv6_select_ident(fptr);
+        ipv6_select_ident(fptr,
+                          rt ? &rt->rt6i_dst.addr : &ipv6_hdr(skb)->daddr);
 
         /* Fragment the skb. ipv6 header and the remaining fields of the
          * fragment header are updated in ipv6_gso_segment()
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
index 3437d7d4eed..f37cba9e689 100644
--- a/net/ipv6/xfrm6_mode_beet.c
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -80,7 +80,6 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         struct ipv6hdr *ip6h;
-        const unsigned char *old_mac;
         int size = sizeof(struct ipv6hdr);
         int err;
 
@@ -90,10 +89,7 @@ static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 
         __skb_push(skb, size);
         skb_reset_network_header(skb);
-
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
+        skb_mac_header_rebuild(skb);
 
         xfrm6_beet_make_header(skb);
 
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 4d6edff0498..23ecd68a5e6 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -63,7 +63,6 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err = -EINVAL;
-        const unsigned char *old_mac;
 
         if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPV6)
                 goto out;
@@ -80,10 +79,9 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!(x->props.flags & XFRM_STATE_NOECN))
                 ipip6_ecn_decapsulate(skb);
 
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
         skb_reset_network_header(skb);
+        skb_mac_header_rebuild(skb);
+
         err = 0;
 
 out:
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index ed8a2335442..71c292e3e03 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1045,8 +1045,10 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
         headroom = NET_SKB_PAD + sizeof(struct iphdr) +
                 uhlen + hdr_len;
         old_headroom = skb_headroom(skb);
-        if (skb_cow_head(skb, headroom))
+        if (skb_cow_head(skb, headroom)) {
+                dev_kfree_skb(skb);
                 goto abort;
+        }
 
         new_headroom = skb_headroom(skb);
         skb_orphan(skb);
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index a8193f52c13..3c55f633928 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -103,7 +103,7 @@ static struct net_device_ops l2tp_eth_netdev_ops = {
 static void l2tp_eth_dev_setup(struct net_device *dev)
 {
         ether_setup(dev);
-
+        dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         dev->netdev_ops         = &l2tp_eth_netdev_ops;
         dev->destructor         = free_netdev;
 }
@@ -167,6 +167,7 @@ static void l2tp_eth_delete(struct l2tp_session *session)
                 if (dev) {
                         unregister_netdev(dev);
                         spriv->dev = NULL;
+                        module_put(THIS_MODULE);
                 }
         }
 }
@@ -254,6 +255,7 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p
         if (rc < 0)
                 goto out_del_dev;
 
+        __module_get(THIS_MODULE);
         /* Must be done after register_netdev() */
         strlcpy(session->ifname, dev->name, IFNAMSIZ);
 
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index b6466e71f5e..78bc442b2b6 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -251,9 +251,16 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct sockaddr_l2tpip *addr = (struct sockaddr_l2tpip *) uaddr;
-        int ret = -EINVAL;
+        int ret;
         int chk_addr_ret;
 
+        if (!sock_flag(sk, SOCK_ZAPPED))
+                return -EINVAL;
+        if (addr_len < sizeof(struct sockaddr_l2tpip))
+                return -EINVAL;
+        if (addr->l2tp_family != AF_INET)
+                return -EINVAL;
+
         ret = -EADDRINUSE;
         read_lock_bh(&l2tp_ip_lock);
         if (__l2tp_ip_bind_lookup(&init_net, addr->l2tp_addr.s_addr, sk->sk_bound_dev_if, addr->l2tp_conn_id))
@@ -283,6 +290,8 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         sk_del_node_init(sk);
         write_unlock_bh(&l2tp_ip_lock);
         ret = 0;
+        sock_reset_flag(sk, SOCK_ZAPPED);
+
 out:
         release_sock(sk);
 
@@ -303,13 +312,14 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
         __be32 saddr;
         int oif, rc;
 
-        rc = -EINVAL;
+        if (sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
+                return -EINVAL;
+
         if (addr_len < sizeof(*lsa))
-                goto out;
+                return -EINVAL;
 
-        rc = -EAFNOSUPPORT;
         if (lsa->l2tp_family != AF_INET)
-                goto out;
+                return -EAFNOSUPPORT;
 
         lock_sock(sk);
 
@@ -363,6 +373,14 @@ out:
         return rc;
 }
 
+static int l2tp_ip_disconnect(struct sock *sk, int flags)
+{
+        if (sock_flag(sk, SOCK_ZAPPED))
+                return 0;
+
+        return udp_disconnect(sk, flags);
+}
+
 static int l2tp_ip_getname(struct socket *sock, struct sockaddr *uaddr,
                            int *uaddr_len, int peer)
 {
@@ -393,11 +411,6 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb)
 {
         int rc;
 
-        if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
-                goto drop;
-
-        nf_reset(skb);
-
         /* Charge it to the socket, dropping if the queue is full. */
         rc = sock_queue_rcv_skb(sk, skb);
         if (rc < 0)
@@ -446,8 +459,9 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
 
                 daddr = lip->l2tp_addr.s_addr;
         } else {
+                rc = -EDESTADDRREQ;
                 if (sk->sk_state != TCP_ESTABLISHED)
-                        return -EDESTADDRREQ;
+                        goto out;
 
                 daddr = inet->inet_daddr;
                 connected = 1;
@@ -595,7 +609,7 @@ static struct proto l2tp_ip_prot = {
         .close             = l2tp_ip_close,
         .bind              = l2tp_ip_bind,
         .connect           = l2tp_ip_connect,
-        .disconnect        = udp_disconnect,
+        .disconnect        = l2tp_ip_disconnect,
         .ioctl             = udp_ioctl,
         .destroy           = l2tp_ip_destroy_sock,
         .setsockopt        = ip_setsockopt,
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 39a21d0c61c..13f9868e694 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -908,7 +908,7 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
                 goto end_put_sess;
         }
 
-        inet = inet_sk(sk);
+        inet = inet_sk(tunnel->sock);
         if (tunnel->version == 2) {
                 struct sockaddr_pppol2tp sp;
                 len = sizeof(sp);
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index dfd3a648a55..a18e6c3d36e 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -833,15 +833,15 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
                 copied += used;
                 len -= used;
 
+                /* For non stream protcols we get one packet per recvmsg call */
+                if (sk->sk_type != SOCK_STREAM)
+                        goto copy_uaddr;
+
                 if (!(flags & MSG_PEEK)) {
                         sk_eat_skb(sk, skb, 0);
                         *seq = 0;
                 }
 
-                /* For non stream protcols we get one packet per recvmsg call */
-                if (sk->sk_type != SOCK_STREAM)
-                        goto copy_uaddr;
-
                 /* Partial read */
                 if (used + offset < skb->len)
                         continue;
@@ -857,6 +857,12 @@ copy_uaddr:
         }
         if (llc_sk(sk)->cmsg_flags)
                 llc_cmsg_rcv(msg, skb);
+
+        if (!(flags & MSG_PEEK)) {
+                        sk_eat_skb(sk, skb, 0);
+                        *seq = 0;
+        }
+
         goto out;
 }
 
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 9c0d76cdca9..1a41b1423d2 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -48,6 +48,8 @@ static void ieee80211_free_tid_rx(struct rcu_head *h)
                 container_of(h, struct tid_ampdu_rx, rcu_head);
         int i;
 
+        del_timer_sync(&tid_rx->reorder_timer);
+
         for (i = 0; i < tid_rx->buf_size; i++)
                 dev_kfree_skb(tid_rx->reorder_buf[i]);
         kfree(tid_rx->reorder_buf);
@@ -87,7 +89,6 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                                      tid, 0, reason);
 
         del_timer_sync(&tid_rx->session_timer);
-        del_timer_sync(&tid_rx->reorder_timer);
 
         call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
 }
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index c8be8eff70d..b7f4f5c1f69 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -162,6 +162,12 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                 return -ENOENT;
         }
 
+        /* if we're already stopping ignore any new requests to stop */
+        if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
+                spin_unlock_bh(&sta->lock);
+                return -EALREADY;
+        }
+
         if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
                 /* not even started yet! */
                 ieee80211_assign_tid_tx(sta, tid, NULL);
@@ -170,6 +176,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                 return 0;
         }
 
+        set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
+
         spin_unlock_bh(&sta->lock);
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -177,8 +185,6 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                sta->sta.addr, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
-        set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
-
         del_timer_sync(&tid_tx->addba_resp_timer);
 
         /*
@@ -188,6 +194,20 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
          */
         clear_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
 
+        /*
+         * There might be a few packets being processed right now (on
+         * another CPU) that have already gotten past the aggregation
+         * check when it was still OPERATIONAL and consequently have
+         * IEEE80211_TX_CTL_AMPDU set. In that case, this code might
+         * call into the driver at the same time or even before the
+         * TX paths calls into it, which could confuse the driver.
+         *
+         * Wait for all currently running TX paths to finish before
+         * telling the driver. New packets will not go through since
+         * the aggregation session is no longer OPERATIONAL.
+         */
+        synchronize_net();
+
         tid_tx->stop_initiator = initiator;
         tid_tx->tx_stop = tx;
 
@@ -284,6 +304,38 @@ ieee80211_wake_queue_agg(struct ieee80211_local *local, int tid)
         __release(agg_queue);
 }
 
+/*
+ * splice packets from the STA's pending to the local pending,
+ * requires a call to ieee80211_agg_splice_finish later
+ */
+static void __acquires(agg_queue)
+ieee80211_agg_splice_packets(struct ieee80211_local *local,
+                             struct tid_ampdu_tx *tid_tx, u16 tid)
+{
+        int queue = ieee80211_ac_from_tid(tid);
+        unsigned long flags;
+
+        ieee80211_stop_queue_agg(local, tid);
+
+        if (WARN(!tid_tx, "TID %d gone but expected when splicing aggregates"
+                          " from the pending queue\n", tid))
+                return;
+
+        if (!skb_queue_empty(&tid_tx->pending)) {
+                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+                /* copy over remaining packets */
+                skb_queue_splice_tail_init(&tid_tx->pending,
+                                           &local->pending[queue]);
+                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+        }
+}
+
+static void __releases(agg_queue)
+ieee80211_agg_splice_finish(struct ieee80211_local *local, u16 tid)
+{
+        ieee80211_wake_queue_agg(local, tid);
+}
+
 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
 {
         struct tid_ampdu_tx *tid_tx;
@@ -295,19 +347,17 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
         /*
-         * While we're asking the driver about the aggregation,
-         * stop the AC queue so that we don't have to worry
-         * about frames that came in while we were doing that,
-         * which would require us to put them to the AC pending
-         * afterwards which just makes the code more complex.
+         * Start queuing up packets for this aggregation session.
+         * We're going to release them once the driver is OK with
+         * that.
          */
-        ieee80211_stop_queue_agg(local, tid);
-
         clear_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
 
         /*
-         * make sure no packets are being processed to get
-         * valid starting sequence number
+         * Make sure no packets are being processed. This ensures that
+         * we have a valid starting sequence number and that in-flight
+         * packets have been flushed out and no packets for this TID
+         * will go into the driver during the ampdu_action call.
          */
         synchronize_net();
 
@@ -321,17 +371,15 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
                                         " tid %d\n", tid);
 #endif
                 spin_lock_bh(&sta->lock);
+                ieee80211_agg_splice_packets(local, tid_tx, tid);
                 ieee80211_assign_tid_tx(sta, tid, NULL);
+                ieee80211_agg_splice_finish(local, tid);
                 spin_unlock_bh(&sta->lock);
 
-                ieee80211_wake_queue_agg(local, tid);
                 kfree_rcu(tid_tx, rcu_head);
                 return;
         }
 
-        /* we can take packets again now */
-        ieee80211_wake_queue_agg(local, tid);
-
         /* activate the timer for the recipient's addBA response */
         mod_timer(&tid_tx->addba_resp_timer, jiffies + ADDBA_RESP_INTERVAL);
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -451,38 +499,6 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
 }
 EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
 
-/*
- * splice packets from the STA's pending to the local pending,
- * requires a call to ieee80211_agg_splice_finish later
- */
-static void __acquires(agg_queue)
-ieee80211_agg_splice_packets(struct ieee80211_local *local,
-                             struct tid_ampdu_tx *tid_tx, u16 tid)
-{
-        int queue = ieee80211_ac_from_tid(tid);
-        unsigned long flags;
-
-        ieee80211_stop_queue_agg(local, tid);
-
-        if (WARN(!tid_tx, "TID %d gone but expected when splicing aggregates"
-                          " from the pending queue\n", tid))
-                return;
-
-        if (!skb_queue_empty(&tid_tx->pending)) {
-                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-                /* copy over remaining packets */
-                skb_queue_splice_tail_init(&tid_tx->pending,
-                                           &local->pending[queue]);
-                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
-        }
-}
-
-static void __releases(agg_queue)
-ieee80211_agg_splice_finish(struct ieee80211_local *local, u16 tid)
-{
-        ieee80211_wake_queue_agg(local, tid);
-}
-
 static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
                                          struct sta_info *sta, u16 tid)
 {
@@ -772,12 +788,27 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
                 goto out;
         }
 
-        del_timer(&tid_tx->addba_resp_timer);
+        del_timer_sync(&tid_tx->addba_resp_timer);
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "switched off addBA timer for tid %d\n", tid);
 #endif
 
+        /*
+         * addba_resp_timer may have fired before we got here, and
+         * caused WANT_STOP to be set. If the stop then was already
+         * processed further, STOPPING might be set.
+         */
+        if (test_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state) ||
+            test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG
+                       "got addBA resp for tid %d but we already gave up\n",
+                       tid);
+#endif
+                goto out;
+        }
+
         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
                         == WLAN_STATUS_SUCCESS) {
                 /*
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index be70c70d3f5..143a0064348 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1798,7 +1798,7 @@ ieee80211_offchan_tx_done(struct ieee80211_work *wk, struct sk_buff *skb)
          * so in that case userspace will have to deal with it.
          */
 
-        if (wk->offchan_tx.wait && wk->offchan_tx.frame)
+        if (wk->offchan_tx.wait && !wk->offchan_tx.status)
                 cfg80211_mgmt_tx_status(wk->sdata->dev,
                                         (unsigned long) wk->offchan_tx.frame,
                                         wk->ie, wk->ie_len, false, GFP_KERNEL);
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 090b0ec1e05..3fdac77b9cc 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -328,6 +328,7 @@ struct ieee80211_work {
                 struct {
                         struct sk_buff *frame;
                         u32 wait;
+                        bool status;
                 } offchan_tx;
         };
 
@@ -372,6 +373,7 @@ struct ieee80211_if_managed {
 
         unsigned long timers_running; /* used for quiesce/restart */
         bool powersave; /* powersave requested for this iface */
+        bool broken_ap; /* AP is broken -- turn off powersave */
         enum ieee80211_smps_mode req_smps, /* requested smps mode */
                                  ap_smps, /* smps mode AP thinks we're in */
                                  driver_smps_mode; /* smps mode request */
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index dee30aea9ab..65f3764c5aa 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -498,6 +498,18 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 ieee80211_configure_filter(local);
                 break;
         default:
+                mutex_lock(&local->mtx);
+                if (local->hw_roc_dev == sdata->dev &&
+                    local->hw_roc_channel) {
+                        /* ignore return value since this is racy */
+                        drv_cancel_remain_on_channel(local);
+                        ieee80211_queue_work(&local->hw, &local->hw_roc_done);
+                }
+                mutex_unlock(&local->mtx);
+
+                flush_work(&local->hw_roc_start);
+                flush_work(&local->hw_roc_done);
+
                 flush_work(&sdata->work);
                 /*
                  * When we get here, the interface is marked down.
@@ -699,6 +711,7 @@ static const struct net_device_ops ieee80211_monitorif_ops = {
 static void ieee80211_if_setup(struct net_device *dev)
 {
         ether_setup(dev);
+        dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         dev->netdev_ops = &ieee80211_dataif_ops;
         dev->destructor = free_netdev;
 }
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 866f269183c..1e36fb3318c 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -910,6 +910,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 wiphy_debug(local->hw.wiphy, "Failed to initialize wep: %d\n",
                             result);
 
+        ieee80211_led_init(local);
+
         rtnl_lock();
 
         result = ieee80211_init_rate_ctrl_alg(local,
@@ -931,8 +933,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         rtnl_unlock();
 
-        ieee80211_led_init(local);
-
         local->network_latency_notifier.notifier_call =
                 ieee80211_max_network_latency;
         result = pm_qos_add_notifier(PM_QOS_NETWORK_LATENCY,
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 29e9980c8e6..370aa94ead1 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -490,6 +490,7 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
 
         del_timer_sync(&sdata->u.mesh.housekeeping_timer);
         del_timer_sync(&sdata->u.mesh.mesh_path_root_timer);
+        del_timer_sync(&sdata->u.mesh.mesh_path_timer);
         /*
          * If the timer fired while we waited for it, it will have
          * requeued the work. Now the work will be running again
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index d595265d6c2..1563250a557 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -613,6 +613,9 @@ static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
         if (!mgd->powersave)
                 return false;
 
+        if (mgd->broken_ap)
+                return false;
+
         if (!mgd->associated)
                 return false;
 
@@ -1450,10 +1453,21 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
 
         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
-                printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
-                       "set\n", sdata->name, aid);
+                printk(KERN_DEBUG
+                       "%s: invalid AID value 0x%x; bits 15:14 not set\n",
+                       sdata->name, aid);
         aid &= ~(BIT(15) | BIT(14));
 
+        ifmgd->broken_ap = false;
+
+        if (aid == 0 || aid > IEEE80211_MAX_AID) {
+                printk(KERN_DEBUG
+                       "%s: invalid AID value %d (out of range), turn off PS\n",
+                       sdata->name, aid);
+                aid = 0;
+                ifmgd->broken_ap = true;
+        }
+
         pos = mgmt->u.assoc_resp.variable;
         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
 
@@ -2200,6 +2214,9 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
+        if (!ifmgd->associated)
+                return;
+
         if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running))
                 add_timer(&ifmgd->timer);
         if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 13427b194ce..c55eb9d8ea5 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -251,6 +251,22 @@ static void ieee80211_hw_roc_done(struct work_struct *work)
                 return;
         }
 
+        /* was never transmitted */
+        if (local->hw_roc_skb) {
+                u64 cookie;
+
+                cookie = local->hw_roc_cookie ^ 2;
+
+                cfg80211_mgmt_tx_status(local->hw_roc_dev, cookie,
+                                        local->hw_roc_skb->data,
+                                        local->hw_roc_skb->len, false,
+                                        GFP_KERNEL);
+
+                kfree_skb(local->hw_roc_skb);
+                local->hw_roc_skb = NULL;
+                local->hw_roc_skb_for_status = NULL;
+        }
+
         if (!local->hw_roc_for_tx)
                 cfg80211_remain_on_channel_expired(local->hw_roc_dev,
                                                    local->hw_roc_cookie,
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 3d5a2cb835c..816590b0d7f 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -314,7 +314,7 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
                 info->control.rates[i].idx = -1;
                 info->control.rates[i].flags = 0;
-                info->control.rates[i].count = 1;
+                info->control.rates[i].count = 0;
         }
 
         if (sdata->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 7fa8c6be7bf..667f5590576 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -140,8 +140,9 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         pos++;
 
         /* IEEE80211_RADIOTAP_RATE */
-        if (status->flag & RX_FLAG_HT) {
+        if (!rate || status->flag & RX_FLAG_HT) {
                 /*
+                 * Without rate information don't add it. If we have,
                  * MCS information is a separate field in radiotap,
                  * added below. The byte here is needed as padding
                  * for the channel though, so initialise it to 0.
@@ -162,12 +163,14 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         else if (status->flag & RX_FLAG_HT)
                 put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
                                    pos);
-        else if (rate->flags & IEEE80211_RATE_ERP_G)
+        else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
                 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
                                    pos);
-        else
+        else if (rate)
                 put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
                                    pos);
+        else
+                put_unaligned_le16(IEEE80211_CHAN_2GHZ, pos);
         pos += 2;
 
         /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
@@ -607,7 +610,7 @@ static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
         index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
                                                 tid_agg_rx->buf_size;
         if (!tid_agg_rx->reorder_buf[index] &&
-            tid_agg_rx->stored_mpdu_num > 1) {
+            tid_agg_rx->stored_mpdu_num) {
                 /*
                  * No buffers ready to be released, but check whether any
                  * frames in the reorder buffer have timed out.
@@ -2288,7 +2291,7 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
          * frames that we didn't handle, including returning unknown
          * ones. For all other modes we will return them to the sender,
          * setting the 0x80 bit in the action category, as required by
-         * 802.11-2007 7.3.1.11.
+         * 802.11-2012 9.24.4.
          * Newer versions of hostapd shall also use the management frame
          * registration mechanisms, but older ones still use cooked
          * monitor interfaces so push all frames there.
@@ -2298,6 +2301,9 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
              sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
                 return RX_DROP_MONITOR;
 
+        if (is_multicast_ether_addr(mgmt->da))
+                return RX_DROP_MONITOR;
+
         /* do not return rejected action frames */
         if (mgmt->u.action.category & 0x80)
                 return RX_DROP_UNUSABLE;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index b83870bf60f..3ff633e81b6 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -334,6 +334,7 @@ static int sta_info_finish_insert(struct sta_info *sta, bool async)
         ieee80211_sta_debugfs_add(sta);
         rate_control_add_sta_debugfs(sta);
 
+        memset(&sinfo, 0, sizeof(sinfo));
         sinfo.filled = 0;
         sinfo.generation = local->sta_generation;
         cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
@@ -669,7 +670,7 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
                 BUG_ON(!sdata->bss);
 
                 atomic_dec(&sdata->bss->num_sta_ps);
-                __sta_info_clear_tim_bit(sdata->bss, sta);
+                sta_info_clear_tim_bit(sta);
         }
 
         local->num_sta--;
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 1658efaa2e8..04cdbaf160b 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -336,7 +336,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                                 continue;
                         if (wk->offchan_tx.frame != skb)
                                 continue;
-                        wk->offchan_tx.frame = NULL;
+                        wk->offchan_tx.status = true;
                         break;
                 }
                 rcu_read_unlock();
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 3104c844b54..da878c14182 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1222,7 +1222,8 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
                 tx->sta = rcu_dereference(sdata->u.vlan.sta);
                 if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
                         return TX_DROP;
-        } else if (info->flags & IEEE80211_TX_CTL_INJECTED) {
+        } else if (info->flags & IEEE80211_TX_CTL_INJECTED ||
+                   tx->sdata->control_port_protocol == tx->skb->protocol) {
                 tx->sta = sta_info_get_bss(sdata, hdr->addr1);
         }
         if (!tx->sta)
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index d3fe2d23748..11d9d49f22d 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1047,6 +1047,8 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
         skb = ieee80211_probereq_get(&local->hw, &sdata->vif,
                                      ssid, ssid_len,
                                      buf, buf_len);
+        if (!skb)
+                goto out;
 
         if (dst) {
                 mgmt = (struct ieee80211_mgmt *) skb->data;
@@ -1055,6 +1057,8 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
         }
 
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+
+ out:
         kfree(buf);
 
         return skb;
@@ -1250,6 +1254,12 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 }
         }
 
+        /* add back keys */
+        list_for_each_entry(sdata, &local->interfaces, list)
+                if (ieee80211_sdata_running(sdata))
+                        ieee80211_enable_keys(sdata);
+
+ wake_up:
         /*
          * Clear the WLAN_STA_BLOCK_BA flag so new aggregation
          * sessions can be established after a resume.
@@ -1271,12 +1281,6 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 mutex_unlock(&local->sta_mtx);
         }
 
-        /* add back keys */
-        list_for_each_entry(sdata, &local->interfaces, list)
-                if (ieee80211_sdata_running(sdata))
-                        ieee80211_enable_keys(sdata);
-
- wake_up:
         ieee80211_wake_queues_by_reason(hw,
                         IEEE80211_QUEUE_STOP_REASON_SUSPEND);
 
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index d2e7f0e8667..52b758dbff5 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -553,7 +553,7 @@ ieee80211_offchannel_tx(struct ieee80211_work *wk)
                 /*
                  * After this, offchan_tx.frame remains but now is no
                  * longer a valid pointer -- we still need it as the
-                 * cookie for canceling this work.
+                 * cookie for canceling this work/status matching.
                  */
                 ieee80211_tx_skb(wk->sdata, wk->offchan_tx.frame);
 
@@ -1060,14 +1060,13 @@ static void ieee80211_work_work(struct work_struct *work)
                         continue;
                 if (wk->chan != local->tmp_channel)
                         continue;
-                if (ieee80211_work_ct_coexists(wk->chan_type,
-                                               local->tmp_channel_type))
+                if (!ieee80211_work_ct_coexists(wk->chan_type,
+                                                local->tmp_channel_type))
                         continue;
                 remain_off_channel = true;
         }
 
         if (!remain_off_channel && local->tmp_channel) {
-                bool on_oper_chan = ieee80211_cfg_on_oper_channel(local);
                 local->tmp_channel = NULL;
                 /* If tmp_channel wasn't operating channel, then
                  * we need to go back on-channel.
@@ -1077,7 +1076,7 @@ static void ieee80211_work_work(struct work_struct *work)
                  * we still need to do a hardware config.  Currently,
                  * we cannot be here while scanning, however.
                  */
-                if (ieee80211_cfg_on_oper_channel(local) && !on_oper_chan)
+                if (!ieee80211_cfg_on_oper_channel(local))
                         ieee80211_hw_config(local, 0);
 
                 /* At the least, we need to disable offchannel_ps,
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 8f6a302d2ac..aa1c40ab6a7 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -109,7 +109,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
                 if (status->flag & RX_FLAG_MMIC_ERROR)
                         goto mic_fail;
 
-                if (!(status->flag & RX_FLAG_IV_STRIPPED))
+                if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key)
                         goto update_iv;
 
                 return RX_CONTINUE;
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 32bff6d86cb..5bd5c612a9b 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -902,6 +902,8 @@ config NETFILTER_XT_MATCH_OWNER
         based on who created the socket: the user or group. It is also
         possible to check whether a socket actually exists.
 
+        Conflicts with '"quota, tag, uid" match'
+
 config NETFILTER_XT_MATCH_POLICY
         tristate 'IPsec "policy" match support'
         depends on XFRM
@@ -935,6 +937,22 @@ config NETFILTER_XT_MATCH_PKTTYPE
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config NETFILTER_XT_MATCH_QTAGUID
+        bool '"quota, tag, owner" match and stats support'
+        depends on NETFILTER_XT_MATCH_SOCKET
+        depends on NETFILTER_XT_MATCH_OWNER=n
+        help
+          This option replaces the `owner' match. In addition to matching
+          on uid, it keeps stats based on a tag assigned to a socket.
+          The full tag is comprised of a UID and an accounting tag.
+          The tags are assignable to sockets from user space (e.g. a download
+          manager can assign the socket to another UID for accounting).
+          Stats and control are done via /proc/net/xt_qtaguid/.
+          It replaces owner as it takes the same arguments, but should
+          really be recognized by the iptables tool.
+
+          If unsure, say `N'.
+
 config NETFILTER_XT_MATCH_QUOTA
         tristate '"quota" match support'
         depends on NETFILTER_ADVANCED
@@ -945,6 +963,30 @@ config NETFILTER_XT_MATCH_QUOTA
           If you want to compile it as a module, say M here and read
           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 
+config NETFILTER_XT_MATCH_QUOTA2
+        tristate '"quota2" match support'
+        depends on NETFILTER_ADVANCED
+        help
+          This option adds a `quota2' match, which allows to match on a
+          byte counter correctly and not per CPU.
+          It allows naming the quotas.
+          This is based on http://xtables-addons.git.sourceforge.net
+
+          If you want to compile it as a module, say M here and read
+          <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
+
+config NETFILTER_XT_MATCH_QUOTA2_LOG
+        bool '"quota2" Netfilter LOG support'
+        depends on NETFILTER_XT_MATCH_QUOTA2
+        depends on IP_NF_TARGET_ULOG=n    # not yes, not module, just no
+        default n
+        help
+          This option allows `quota2' to log ONCE when a quota limit
+          is passed. It logs via NETLINK using the NETLINK_NFLOG family.
+          It logs similarly to how ipt_ULOG would without data.
+
+          If unsure, say `N'.
+
 config NETFILTER_XT_MATCH_RATEEST
         tristate '"rateest" match support'
         depends on NETFILTER_ADVANCED
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 1a02853df86..6d917176c3b 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -95,7 +95,9 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_OWNER) += xt_owner.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_PHYSDEV) += xt_physdev.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_QTAGUID) += xt_qtaguid_print.o xt_qtaguid.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA) += xt_quota.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA2) += xt_quota2.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_RATEEST) += xt_rateest.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_RECENT) += xt_recent.o
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 24c28d238dc..0787bed0418 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -233,6 +233,7 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
         __be16 dport = 0;               /* destination port to forward */
         unsigned int flags;
         struct ip_vs_conn_param param;
+        const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
         union nf_inet_addr snet;        /* source network of the client,
                                            after masking */
 
@@ -268,7 +269,6 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
         {
                 int protocol = iph.protocol;
                 const union nf_inet_addr *vaddr = &iph.daddr;
-                const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
                 __be16 vport = 0;
 
                 if (dst_port == svc->port) {
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 699c79a5565..a178cb34584 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3771,6 +3771,7 @@ err_sock:
 void ip_vs_control_cleanup(void)
 {
         EnterFunction(2);
+        unregister_netdevice_notifier(&ip_vs_dst_notifier);
         ip_vs_genl_unregister();
         nf_unregister_sockopt(&ip_vs_sockopts);
         LeaveFunction(2);
diff --git a/net/netfilter/xt_qtaguid.c b/net/netfilter/xt_qtaguid.c
new file mode 100644
index 00000000000..08086d680c2
--- /dev/null
+++ b/net/netfilter/xt_qtaguid.c
@@ -0,0 +1,2785 @@
+/*
+ * Kernel iptables module to track stats for packets based on user tags.
+ *
+ * (C) 2011 Google, Inc
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * There are run-time debug flags enabled via the debug_mask module param, or
+ * via the DEFAULT_DEBUG_MASK. See xt_qtaguid_internal.h.
+ */
+#define DEBUG
+
+#include <linux/file.h>
+#include <linux/inetdevice.h>
+#include <linux/module.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_qtaguid.h>
+#include <linux/skbuff.h>
+#include <linux/workqueue.h>
+#include <net/addrconf.h>
+#include <net/sock.h>
+#include <net/tcp.h>
+#include <net/udp.h>
+
+#include <linux/netfilter/xt_socket.h>
+#include "xt_qtaguid_internal.h"
+#include "xt_qtaguid_print.h"
+
+/*
+ * We only use the xt_socket funcs within a similar context to avoid unexpected
+ * return values.
+ */
+#define XT_SOCKET_SUPPORTED_HOOKS \
+        ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_IN))
+
+
+static const char *module_procdirname = "xt_qtaguid";
+static struct proc_dir_entry *xt_qtaguid_procdir;
+
+static unsigned int proc_iface_perms = S_IRUGO;
+module_param_named(iface_perms, proc_iface_perms, uint, S_IRUGO | S_IWUSR);
+
+static struct proc_dir_entry *xt_qtaguid_stats_file;
+static unsigned int proc_stats_perms = S_IRUGO;
+module_param_named(stats_perms, proc_stats_perms, uint, S_IRUGO | S_IWUSR);
+
+static struct proc_dir_entry *xt_qtaguid_ctrl_file;
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
+static unsigned int proc_ctrl_perms = S_IRUGO | S_IWUGO;
+#else
+static unsigned int proc_ctrl_perms = S_IRUGO | S_IWUSR;
+#endif
+module_param_named(ctrl_perms, proc_ctrl_perms, uint, S_IRUGO | S_IWUSR);
+
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
+#include <linux/android_aid.h>
+static gid_t proc_stats_readall_gid = AID_NET_BW_STATS;
+static gid_t proc_ctrl_write_gid = AID_NET_BW_ACCT;
+#else
+/* 0 means, don't limit anybody */
+static gid_t proc_stats_readall_gid;
+static gid_t proc_ctrl_write_gid;
+#endif
+module_param_named(stats_readall_gid, proc_stats_readall_gid, uint,
+                   S_IRUGO | S_IWUSR);
+module_param_named(ctrl_write_gid, proc_ctrl_write_gid, uint,
+                   S_IRUGO | S_IWUSR);
+
+/*
+ * Limit the number of active tags (via socket tags) for a given UID.
+ * Multiple processes could share the UID.
+ */
+static int max_sock_tags = DEFAULT_MAX_SOCK_TAGS;
+module_param(max_sock_tags, int, S_IRUGO | S_IWUSR);
+
+/*
+ * After the kernel has initiallized this module, it is still possible
+ * to make it passive.
+ * Setting passive to Y:
+ *  - the iface stats handling will not act on notifications.
+ *  - iptables matches will never match.
+ *  - ctrl commands silently succeed.
+ *  - stats are always empty.
+ * This is mostly usefull when a bug is suspected.
+ */
+static bool module_passive;
+module_param_named(passive, module_passive, bool, S_IRUGO | S_IWUSR);
+
+/*
+ * Control how qtaguid data is tracked per proc/uid.
+ * Setting tag_tracking_passive to Y:
+ *  - don't create proc specific structs to track tags
+ *  - don't check that active tag stats exceed some limits.
+ *  - don't clean up socket tags on process exits.
+ * This is mostly usefull when a bug is suspected.
+ */
+static bool qtu_proc_handling_passive;
+module_param_named(tag_tracking_passive, qtu_proc_handling_passive, bool,
+                   S_IRUGO | S_IWUSR);
+
+#define QTU_DEV_NAME "xt_qtaguid"
+
+uint qtaguid_debug_mask = DEFAULT_DEBUG_MASK;
+module_param_named(debug_mask, qtaguid_debug_mask, uint, S_IRUGO | S_IWUSR);
+
+/*---------------------------------------------------------------------------*/
+static const char *iface_stat_procdirname = "iface_stat";
+static struct proc_dir_entry *iface_stat_procdir;
+static const char *iface_stat_all_procfilename = "iface_stat_all";
+static struct proc_dir_entry *iface_stat_all_procfile;
+
+/*
+ * Ordering of locks:
+ *  outer locks:
+ *    iface_stat_list_lock
+ *    sock_tag_list_lock
+ *  inner locks:
+ *    uid_tag_data_tree_lock
+ *    tag_counter_set_list_lock
+ * Notice how sock_tag_list_lock is held sometimes when uid_tag_data_tree_lock
+ * is acquired.
+ *
+ * Call tree with all lock holders as of 2011-09-25:
+ *
+ * iface_stat_all_proc_read()
+ *   iface_stat_list_lock
+ *     (struct iface_stat)
+ *
+ * qtaguid_ctrl_proc_read()
+ *   sock_tag_list_lock
+ *     (sock_tag_tree)
+ *     (struct proc_qtu_data->sock_tag_list)
+ *   prdebug_full_state()
+ *     sock_tag_list_lock
+ *       (sock_tag_tree)
+ *     uid_tag_data_tree_lock
+ *       (uid_tag_data_tree)
+ *       (proc_qtu_data_tree)
+ *     iface_stat_list_lock
+ *
+ * qtaguid_stats_proc_read()
+ *   iface_stat_list_lock
+ *     struct iface_stat->tag_stat_list_lock
+ *
+ * qtudev_open()
+ *   uid_tag_data_tree_lock
+ *
+ * qtudev_release()
+ *   sock_tag_data_list_lock
+ *     uid_tag_data_tree_lock
+ *   prdebug_full_state()
+ *     sock_tag_list_lock
+ *     uid_tag_data_tree_lock
+ *     iface_stat_list_lock
+ *
+ * iface_netdev_event_handler()
+ *   iface_stat_create()
+ *     iface_stat_list_lock
+ *   iface_stat_update()
+ *     iface_stat_list_lock
+ *
+ * iface_inetaddr_event_handler()
+ *   iface_stat_create()
+ *     iface_stat_list_lock
+ *   iface_stat_update()
+ *     iface_stat_list_lock
+ *
+ * iface_inet6addr_event_handler()
+ *   iface_stat_create_ipv6()
+ *     iface_stat_list_lock
+ *   iface_stat_update()
+ *     iface_stat_list_lock
+ *
+ * qtaguid_mt()
+ *   account_for_uid()
+ *     if_tag_stat_update()
+ *       get_sock_stat()
+ *         sock_tag_list_lock
+ *       struct iface_stat->tag_stat_list_lock
+ *         tag_stat_update()
+ *           get_active_counter_set()
+ *             tag_counter_set_list_lock
+ *         tag_stat_update()
+ *           get_active_counter_set()
+ *             tag_counter_set_list_lock
+ *
+ *
+ * qtaguid_ctrl_parse()
+ *   ctrl_cmd_delete()
+ *     sock_tag_list_lock
+ *     tag_counter_set_list_lock
+ *     iface_stat_list_lock
+ *       struct iface_stat->tag_stat_list_lock
+ *     uid_tag_data_tree_lock
+ *   ctrl_cmd_counter_set()
+ *     tag_counter_set_list_lock
+ *   ctrl_cmd_tag()
+ *     sock_tag_list_lock
+ *       (sock_tag_tree)
+ *       get_tag_ref()
+ *         uid_tag_data_tree_lock
+ *           (uid_tag_data_tree)
+ *       uid_tag_data_tree_lock
+ *         (proc_qtu_data_tree)
+ *   ctrl_cmd_untag()
+ *     sock_tag_list_lock
+ *     uid_tag_data_tree_lock
+ *
+ */
+static LIST_HEAD(iface_stat_list);
+static DEFINE_SPINLOCK(iface_stat_list_lock);
+
+static struct rb_root sock_tag_tree = RB_ROOT;
+static DEFINE_SPINLOCK(sock_tag_list_lock);
+
+static struct rb_root tag_counter_set_tree = RB_ROOT;
+static DEFINE_SPINLOCK(tag_counter_set_list_lock);
+
+static struct rb_root uid_tag_data_tree = RB_ROOT;
+static DEFINE_SPINLOCK(uid_tag_data_tree_lock);
+
+static struct rb_root proc_qtu_data_tree = RB_ROOT;
+/* No proc_qtu_data_tree_lock; use uid_tag_data_tree_lock */
+
+static struct qtaguid_event_counts qtu_events;
+/*----------------------------------------------*/
+static bool can_manipulate_uids(void)
+{
+        /* root pwnd */
+        return unlikely(!current_fsuid()) || unlikely(!proc_ctrl_write_gid)
+                || in_egroup_p(proc_ctrl_write_gid);
+}
+
+static bool can_impersonate_uid(uid_t uid)
+{
+        return uid == current_fsuid() || can_manipulate_uids();
+}
+
+static bool can_read_other_uid_stats(uid_t uid)
+{
+        /* root pwnd */
+        return unlikely(!current_fsuid()) || uid == current_fsuid()
+                || unlikely(!proc_stats_readall_gid)
+                || in_egroup_p(proc_stats_readall_gid);
+}
+
+static inline void dc_add_byte_packets(struct data_counters *counters, int set,
+                                  enum ifs_tx_rx direction,
+                                  enum ifs_proto ifs_proto,
+                                  int bytes,
+                                  int packets)
+{
+        counters->bpc[set][direction][ifs_proto].bytes += bytes;
+        counters->bpc[set][direction][ifs_proto].packets += packets;
+}
+
+static inline uint64_t dc_sum_bytes(struct data_counters *counters,
+                                    int set,
+                                    enum ifs_tx_rx direction)
+{
+        return counters->bpc[set][direction][IFS_TCP].bytes
+                + counters->bpc[set][direction][IFS_UDP].bytes
+                + counters->bpc[set][direction][IFS_PROTO_OTHER].bytes;
+}
+
+static inline uint64_t dc_sum_packets(struct data_counters *counters,
+                                      int set,
+                                      enum ifs_tx_rx direction)
+{
+        return counters->bpc[set][direction][IFS_TCP].packets
+                + counters->bpc[set][direction][IFS_UDP].packets
+                + counters->bpc[set][direction][IFS_PROTO_OTHER].packets;
+}
+
+static struct tag_node *tag_node_tree_search(struct rb_root *root, tag_t tag)
+{
+        struct rb_node *node = root->rb_node;
+
+        while (node) {
+                struct tag_node *data = rb_entry(node, struct tag_node, node);
+                int result;
+                RB_DEBUG("qtaguid: tag_node_tree_search(0x%llx): "
+                         " node=%p data=%p\n", tag, node, data);
+                result = tag_compare(tag, data->tag);
+                RB_DEBUG("qtaguid: tag_node_tree_search(0x%llx): "
+                         " data.tag=0x%llx (uid=%u) res=%d\n",
+                         tag, data->tag, get_uid_from_tag(data->tag), result);
+                if (result < 0)
+                        node = node->rb_left;
+                else if (result > 0)
+                        node = node->rb_right;
+                else
+                        return data;
+        }
+        return NULL;
+}
+
+static void tag_node_tree_insert(struct tag_node *data, struct rb_root *root)
+{
+        struct rb_node **new = &(root->rb_node), *parent = NULL;
+
+        /* Figure out where to put new node */
+        while (*new) {
+                struct tag_node *this = rb_entry(*new, struct tag_node,
+                                                 node);
+                int result = tag_compare(data->tag, this->tag);
+                RB_DEBUG("qtaguid: %s(): tag=0x%llx"
+                         " (uid=%u)\n", __func__,
+                         this->tag,
+                         get_uid_from_tag(this->tag));
+                parent = *new;
+                if (result < 0)
+                        new = &((*new)->rb_left);
+                else if (result > 0)
+                        new = &((*new)->rb_right);
+                else
+                        BUG();
+        }
+
+        /* Add new node and rebalance tree. */
+        rb_link_node(&data->node, parent, new);
+        rb_insert_color(&data->node, root);
+}
+
+static void tag_stat_tree_insert(struct tag_stat *data, struct rb_root *root)
+{
+        tag_node_tree_insert(&data->tn, root);
+}
+
+static struct tag_stat *tag_stat_tree_search(struct rb_root *root, tag_t tag)
+{
+        struct tag_node *node = tag_node_tree_search(root, tag);
+        if (!node)
+                return NULL;
+        return rb_entry(&node->node, struct tag_stat, tn.node);
+}
+
+static void tag_counter_set_tree_insert(struct tag_counter_set *data,
+                                        struct rb_root *root)
+{
+        tag_node_tree_insert(&data->tn, root);
+}
+
+static struct tag_counter_set *tag_counter_set_tree_search(struct rb_root *root,
+                                                           tag_t tag)
+{
+        struct tag_node *node = tag_node_tree_search(root, tag);
+        if (!node)
+                return NULL;
+        return rb_entry(&node->node, struct tag_counter_set, tn.node);
+
+}
+
+static void tag_ref_tree_insert(struct tag_ref *data, struct rb_root *root)
+{
+        tag_node_tree_insert(&data->tn, root);
+}
+
+static struct tag_ref *tag_ref_tree_search(struct rb_root *root, tag_t tag)
+{
+        struct tag_node *node = tag_node_tree_search(root, tag);
+        if (!node)
+                return NULL;
+        return rb_entry(&node->node, struct tag_ref, tn.node);
+}
+
+static struct sock_tag *sock_tag_tree_search(struct rb_root *root,
+                                             const struct sock *sk)
+{
+        struct rb_node *node = root->rb_node;
+
+        while (node) {
+                struct sock_tag *data = rb_entry(node, struct sock_tag,
+                                                 sock_node);
+                if (sk < data->sk)
+                        node = node->rb_left;
+                else if (sk > data->sk)
+                        node = node->rb_right;
+                else
+                        return data;
+        }
+        return NULL;
+}
+
+static void sock_tag_tree_insert(struct sock_tag *data, struct rb_root *root)
+{
+        struct rb_node **new = &(root->rb_node), *parent = NULL;
+
+        /* Figure out where to put new node */
+        while (*new) {
+                struct sock_tag *this = rb_entry(*new, struct sock_tag,
+                                                 sock_node);
+                parent = *new;
+                if (data->sk < this->sk)
+                        new = &((*new)->rb_left);
+                else if (data->sk > this->sk)
+                        new = &((*new)->rb_right);
+                else
+                        BUG();
+        }
+
+        /* Add new node and rebalance tree. */
+        rb_link_node(&data->sock_node, parent, new);
+        rb_insert_color(&data->sock_node, root);
+}
+
+static void sock_tag_tree_erase(struct rb_root *st_to_free_tree)
+{
+        struct rb_node *node;
+        struct sock_tag *st_entry;
+
+        node = rb_first(st_to_free_tree);
+        while (node) {
+                st_entry = rb_entry(node, struct sock_tag, sock_node);
+                node = rb_next(node);
+                CT_DEBUG("qtaguid: %s(): "
+                         "erase st: sk=%p tag=0x%llx (uid=%u)\n", __func__,
+                         st_entry->sk,
+                         st_entry->tag,
+                         get_uid_from_tag(st_entry->tag));
+                rb_erase(&st_entry->sock_node, st_to_free_tree);
+                sockfd_put(st_entry->socket);
+                kfree(st_entry);
+        }
+}
+
+static struct proc_qtu_data *proc_qtu_data_tree_search(struct rb_root *root,
+                                                       const pid_t pid)
+{
+        struct rb_node *node = root->rb_node;
+
+        while (node) {
+                struct proc_qtu_data *data = rb_entry(node,
+                                                      struct proc_qtu_data,
+                                                      node);
+                if (pid < data->pid)
+                        node = node->rb_left;
+                else if (pid > data->pid)
+                        node = node->rb_right;
+                else
+                        return data;
+        }
+        return NULL;
+}
+
+static void proc_qtu_data_tree_insert(struct proc_qtu_data *data,
+                                      struct rb_root *root)
+{
+        struct rb_node **new = &(root->rb_node), *parent = NULL;
+
+        /* Figure out where to put new node */
+        while (*new) {
+                struct proc_qtu_data *this = rb_entry(*new,
+                                                      struct proc_qtu_data,
+                                                      node);
+                parent = *new;
+                if (data->pid < this->pid)
+                        new = &((*new)->rb_left);
+                else if (data->pid > this->pid)
+                        new = &((*new)->rb_right);
+                else
+                        BUG();
+        }
+
+        /* Add new node and rebalance tree. */
+        rb_link_node(&data->node, parent, new);
+        rb_insert_color(&data->node, root);
+}
+
+static void uid_tag_data_tree_insert(struct uid_tag_data *data,
+                                     struct rb_root *root)
+{
+        struct rb_node **new = &(root->rb_node), *parent = NULL;
+
+        /* Figure out where to put new node */
+        while (*new) {
+                struct uid_tag_data *this = rb_entry(*new,
+                                                     struct uid_tag_data,
+                                                     node);
+                parent = *new;
+                if (data->uid < this->uid)
+                        new = &((*new)->rb_left);
+                else if (data->uid > this->uid)
+                        new = &((*new)->rb_right);
+                else
+                        BUG();
+        }
+
+        /* Add new node and rebalance tree. */
+        rb_link_node(&data->node, parent, new);
+        rb_insert_color(&data->node, root);
+}
+
+static struct uid_tag_data *uid_tag_data_tree_search(struct rb_root *root,
+                                                     uid_t uid)
+{
+        struct rb_node *node = root->rb_node;
+
+        while (node) {
+                struct uid_tag_data *data = rb_entry(node,
+                                                     struct uid_tag_data,
+                                                     node);
+                if (uid < data->uid)
+                        node = node->rb_left;
+                else if (uid > data->uid)
+                        node = node->rb_right;
+                else
+                        return data;
+        }
+        return NULL;
+}
+
+/*
+ * Allocates a new uid_tag_data struct if needed.
+ * Returns a pointer to the found or allocated uid_tag_data.
+ * Returns a PTR_ERR on failures, and lock is not held.
+ * If found is not NULL:
+ *   sets *found to true if not allocated.
+ *   sets *found to false if allocated.
+ */
+struct uid_tag_data *get_uid_data(uid_t uid, bool *found_res)
+{
+        struct uid_tag_data *utd_entry;
+
+        /* Look for top level uid_tag_data for the UID */
+        utd_entry = uid_tag_data_tree_search(&uid_tag_data_tree, uid);
+        DR_DEBUG("qtaguid: get_uid_data(%u) utd=%p\n", uid, utd_entry);
+
+        if (found_res)
+                *found_res = utd_entry;
+        if (utd_entry)
+                return utd_entry;
+
+        utd_entry = kzalloc(sizeof(*utd_entry), GFP_ATOMIC);
+        if (!utd_entry) {
+                pr_err("qtaguid: get_uid_data(%u): "
+                       "tag data alloc failed\n", uid);
+                return ERR_PTR(-ENOMEM);
+        }
+
+        utd_entry->uid = uid;
+        utd_entry->tag_ref_tree = RB_ROOT;
+        uid_tag_data_tree_insert(utd_entry, &uid_tag_data_tree);
+        DR_DEBUG("qtaguid: get_uid_data(%u) new utd=%p\n", uid, utd_entry);
+        return utd_entry;
+}
+
+/* Never returns NULL. Either PTR_ERR or a valid ptr. */
+static struct tag_ref *new_tag_ref(tag_t new_tag,
+                                   struct uid_tag_data *utd_entry)
+{
+        struct tag_ref *tr_entry;
+        int res;
+
+        if (utd_entry->num_active_tags + 1 > max_sock_tags) {
+                pr_info("qtaguid: new_tag_ref(0x%llx): "
+                        "tag ref alloc quota exceeded. max=%d\n",
+                        new_tag, max_sock_tags);
+                res = -EMFILE;
+                goto err_res;
+
+        }
+
+        tr_entry = kzalloc(sizeof(*tr_entry), GFP_ATOMIC);
+        if (!tr_entry) {
+                pr_err("qtaguid: new_tag_ref(0x%llx): "
+                       "tag ref alloc failed\n",
+                       new_tag);
+                res = -ENOMEM;
+                goto err_res;
+        }
+        tr_entry->tn.tag = new_tag;
+        /* tr_entry->num_sock_tags  handled by caller */
+        utd_entry->num_active_tags++;
+        tag_ref_tree_insert(tr_entry, &utd_entry->tag_ref_tree);
+        DR_DEBUG("qtaguid: new_tag_ref(0x%llx): "
+                 " inserted new tag ref %p\n",
+                 new_tag, tr_entry);
+        return tr_entry;
+
+err_res:
+        return ERR_PTR(res);
+}
+
+static struct tag_ref *lookup_tag_ref(tag_t full_tag,
+                                      struct uid_tag_data **utd_res)
+{
+        struct uid_tag_data *utd_entry;
+        struct tag_ref *tr_entry;
+        bool found_utd;
+        uid_t uid = get_uid_from_tag(full_tag);
+
+        DR_DEBUG("qtaguid: lookup_tag_ref(tag=0x%llx (uid=%u))\n",
+                 full_tag, uid);
+
+        utd_entry = get_uid_data(uid, &found_utd);
+        if (IS_ERR_OR_NULL(utd_entry)) {
+                if (utd_res)
+                        *utd_res = utd_entry;
+                return NULL;
+        }
+
+        tr_entry = tag_ref_tree_search(&utd_entry->tag_ref_tree, full_tag);
+        if (utd_res)
+                *utd_res = utd_entry;
+        DR_DEBUG("qtaguid: lookup_tag_ref(0x%llx) utd_entry=%p tr_entry=%p\n",
+                 full_tag, utd_entry, tr_entry);
+        return tr_entry;
+}
+
+/* Never returns NULL. Either PTR_ERR or a valid ptr. */
+static struct tag_ref *get_tag_ref(tag_t full_tag,
+                                   struct uid_tag_data **utd_res)
+{
+        struct uid_tag_data *utd_entry;
+        struct tag_ref *tr_entry;
+
+        DR_DEBUG("qtaguid: get_tag_ref(0x%llx)\n",
+                 full_tag);
+        spin_lock_bh(&uid_tag_data_tree_lock);
+        tr_entry = lookup_tag_ref(full_tag, &utd_entry);
+        BUG_ON(IS_ERR_OR_NULL(utd_entry));
+        if (!tr_entry)
+                tr_entry = new_tag_ref(full_tag, utd_entry);
+
+        spin_unlock_bh(&uid_tag_data_tree_lock);
+        if (utd_res)
+                *utd_res = utd_entry;
+        DR_DEBUG("qtaguid: get_tag_ref(0x%llx) utd=%p tr=%p\n",
+                 full_tag, utd_entry, tr_entry);
+        return tr_entry;
+}
+
+/* Checks and maybe frees the UID Tag Data entry */
+static void put_utd_entry(struct uid_tag_data *utd_entry)
+{
+        /* Are we done with the UID tag data entry? */
+        if (RB_EMPTY_ROOT(&utd_entry->tag_ref_tree) &&
+                !utd_entry->num_pqd) {
+                DR_DEBUG("qtaguid: %s(): "
+                         "erase utd_entry=%p uid=%u "
+                         "by pid=%u tgid=%u uid=%u\n", __func__,
+                         utd_entry, utd_entry->uid,
+                         current->pid, current->tgid, current_fsuid());
+                BUG_ON(utd_entry->num_active_tags);
+                rb_erase(&utd_entry->node, &uid_tag_data_tree);
+                kfree(utd_entry);
+        } else {
+                DR_DEBUG("qtaguid: %s(): "
+                         "utd_entry=%p still has %d tags %d proc_qtu_data\n",
+                         __func__, utd_entry, utd_entry->num_active_tags,
+                         utd_entry->num_pqd);
+                BUG_ON(!(utd_entry->num_active_tags ||
+                         utd_entry->num_pqd));
+        }
+}
+
+/*
+ * If no sock_tags are using this tag_ref,
+ * decrements refcount of utd_entry, removes tr_entry
+ * from utd_entry->tag_ref_tree and frees.
+ */
+static void free_tag_ref_from_utd_entry(struct tag_ref *tr_entry,
+                                        struct uid_tag_data *utd_entry)
+{
+        DR_DEBUG("qtaguid: %s(): %p tag=0x%llx (uid=%u)\n", __func__,
+                 tr_entry, tr_entry->tn.tag,
+                 get_uid_from_tag(tr_entry->tn.tag));
+        if (!tr_entry->num_sock_tags) {
+                BUG_ON(!utd_entry->num_active_tags);
+                utd_entry->num_active_tags--;
+                rb_erase(&tr_entry->tn.node, &utd_entry->tag_ref_tree);
+                DR_DEBUG("qtaguid: %s(): erased %p\n", __func__, tr_entry);
+                kfree(tr_entry);
+        }
+}
+
+static void put_tag_ref_tree(tag_t full_tag, struct uid_tag_data *utd_entry)
+{
+        struct rb_node *node;
+        struct tag_ref *tr_entry;
+        tag_t acct_tag;
+
+        DR_DEBUG("qtaguid: %s(tag=0x%llx (uid=%u))\n", __func__,
+                 full_tag, get_uid_from_tag(full_tag));
+        acct_tag = get_atag_from_tag(full_tag);
+        node = rb_first(&utd_entry->tag_ref_tree);
+        while (node) {
+                tr_entry = rb_entry(node, struct tag_ref, tn.node);
+                node = rb_next(node);
+                if (!acct_tag || tr_entry->tn.tag == full_tag)
+                        free_tag_ref_from_utd_entry(tr_entry, utd_entry);
+        }
+}
+
+static int read_proc_u64(char *page, char **start, off_t off,
+                        int count, int *eof, void *data)
+{
+        int len;
+        uint64_t value;
+        char *p = page;
+        uint64_t *iface_entry = data;
+
+        if (!data)
+                return 0;
+
+        value = *iface_entry;
+        p += sprintf(p, "%llu\n", value);
+        len = (p - page) - off;
+        *eof = (len <= count) ? 1 : 0;
+        *start = page + off;
+        return len;
+}
+
+static int read_proc_bool(char *page, char **start, off_t off,
+                        int count, int *eof, void *data)
+{
+        int len;
+        bool value;
+        char *p = page;
+        bool *bool_entry = data;
+
+        if (!data)
+                return 0;
+
+        value = *bool_entry;
+        p += sprintf(p, "%u\n", value);
+        len = (p - page) - off;
+        *eof = (len <= count) ? 1 : 0;
+        *start = page + off;
+        return len;
+}
+
+static int get_active_counter_set(tag_t tag)
+{
+        int active_set = 0;
+        struct tag_counter_set *tcs;
+
+        MT_DEBUG("qtaguid: get_active_counter_set(tag=0x%llx)"
+                 " (uid=%u)\n",
+                 tag, get_uid_from_tag(tag));
+        /* For now we only handle UID tags for active sets */
+        tag = get_utag_from_tag(tag);
+        spin_lock_bh(&tag_counter_set_list_lock);
+        tcs = tag_counter_set_tree_search(&tag_counter_set_tree, tag);
+        if (tcs)
+                active_set = tcs->active_set;
+        spin_unlock_bh(&tag_counter_set_list_lock);
+        return active_set;
+}
+
+/*
+ * Find the entry for tracking the specified interface.
+ * Caller must hold iface_stat_list_lock
+ */
+static struct iface_stat *get_iface_entry(const char *ifname)
+{
+        struct iface_stat *iface_entry;
+
+        /* Find the entry for tracking the specified tag within the interface */
+        if (ifname == NULL) {
+                pr_info("qtaguid: iface_stat: get() NULL device name\n");
+                return NULL;
+        }
+
+        /* Iterate over interfaces */
+        list_for_each_entry(iface_entry, &iface_stat_list, list) {
+                if (!strcmp(ifname, iface_entry->ifname))
+                        goto done;
+        }
+        iface_entry = NULL;
+done:
+        return iface_entry;
+}
+
+static int iface_stat_all_proc_read(char *page, char **num_items_returned,
+                                    off_t items_to_skip, int char_count,
+                                    int *eof, void *data)
+{
+        char *outp = page;
+        int item_index = 0;
+        int len;
+        struct iface_stat *iface_entry;
+        struct rtnl_link_stats64 dev_stats, *stats;
+        struct rtnl_link_stats64 no_dev_stats = {0};
+
+        if (unlikely(module_passive)) {
+                *eof = 1;
+                return 0;
+        }
+
+        CT_DEBUG("qtaguid:proc iface_stat_all "
+                 "page=%p *num_items_returned=%p off=%ld "
+                 "char_count=%d *eof=%d\n", page, *num_items_returned,
+                 items_to_skip, char_count, *eof);
+
+        if (*eof)
+                return 0;
+
+        /*
+         * This lock will prevent iface_stat_update() from changing active,
+         * and in turn prevent an interface from unregistering itself.
+         */
+        spin_lock_bh(&iface_stat_list_lock);
+        list_for_each_entry(iface_entry, &iface_stat_list, list) {
+                if (item_index++ < items_to_skip)
+                        continue;
+
+                if (iface_entry->active) {
+                        stats = dev_get_stats(iface_entry->net_dev,
+                                              &dev_stats);
+                } else {
+                        stats = &no_dev_stats;
+                }
+                len = snprintf(outp, char_count,
+                               "%s %d "
+                               "%llu %llu %llu %llu "
+                               "%llu %llu %llu %llu\n",
+                               iface_entry->ifname,
+                               iface_entry->active,
+                               iface_entry->totals[IFS_RX].bytes,
+                               iface_entry->totals[IFS_RX].packets,
+                               iface_entry->totals[IFS_TX].bytes,
+                               iface_entry->totals[IFS_TX].packets,
+                               stats->rx_bytes, stats->rx_packets,
+                               stats->tx_bytes, stats->tx_packets);
+                if (len >= char_count) {
+                        spin_unlock_bh(&iface_stat_list_lock);
+                        *outp = '\0';
+                        return outp - page;
+                }
+                outp += len;
+                char_count -= len;
+                (*num_items_returned)++;
+        }
+        spin_unlock_bh(&iface_stat_list_lock);
+
+        *eof = 1;
+        return outp - page;
+}
+
+static void iface_create_proc_worker(struct work_struct *work)
+{
+        struct proc_dir_entry *proc_entry;
+        struct iface_stat_work *isw = container_of(work, struct iface_stat_work,
+                                                   iface_work);
+        struct iface_stat *new_iface  = isw->iface_entry;
+
+        /* iface_entries are not deleted, so safe to manipulate. */
+        proc_entry = proc_mkdir(new_iface->ifname, iface_stat_procdir);
+        if (IS_ERR_OR_NULL(proc_entry)) {
+                pr_err("qtaguid: iface_stat: create_proc(): alloc failed.\n");
+                kfree(isw);
+                return;
+        }
+
+        new_iface->proc_ptr = proc_entry;
+
+        create_proc_read_entry("tx_bytes", proc_iface_perms, proc_entry,
+                        read_proc_u64, &new_iface->totals[IFS_TX].bytes);
+        create_proc_read_entry("rx_bytes", proc_iface_perms, proc_entry,
+                        read_proc_u64, &new_iface->totals[IFS_RX].bytes);
+        create_proc_read_entry("tx_packets", proc_iface_perms, proc_entry,
+                        read_proc_u64, &new_iface->totals[IFS_TX].packets);
+        create_proc_read_entry("rx_packets", proc_iface_perms, proc_entry,
+                        read_proc_u64, &new_iface->totals[IFS_RX].packets);
+        create_proc_read_entry("active", proc_iface_perms, proc_entry,
+                        read_proc_bool, &new_iface->active);
+
+        IF_DEBUG("qtaguid: iface_stat: create_proc(): done "
+                 "entry=%p dev=%s\n", new_iface, new_iface->ifname);
+        kfree(isw);
+}
+
+/*
+ * Will set the entry's active state, and
+ * update the net_dev accordingly also.
+ */
+static void _iface_stat_set_active(struct iface_stat *entry,
+                                   struct net_device *net_dev,
+                                   bool activate)
+{
+        if (activate) {
+                entry->net_dev = net_dev;
+                entry->active = true;
+                IF_DEBUG("qtaguid: %s(%s): "
+                         "enable tracking. rfcnt=%d\n", __func__,
+                         entry->ifname,
+                         percpu_read(*net_dev->pcpu_refcnt));
+        } else {
+                entry->active = false;
+                entry->net_dev = NULL;
+                IF_DEBUG("qtaguid: %s(%s): "
+                         "disable tracking. rfcnt=%d\n", __func__,
+                         entry->ifname,
+                         percpu_read(*net_dev->pcpu_refcnt));
+
+        }
+}
+
+/* Caller must hold iface_stat_list_lock */
+static struct iface_stat *iface_alloc(struct net_device *net_dev)
+{
+        struct iface_stat *new_iface;
+        struct iface_stat_work *isw;
+
+        new_iface = kzalloc(sizeof(*new_iface), GFP_ATOMIC);
+        if (new_iface == NULL) {
+                pr_err("qtaguid: iface_stat: create(%s): "
+                       "iface_stat alloc failed\n", net_dev->name);
+                return NULL;
+        }
+        new_iface->ifname = kstrdup(net_dev->name, GFP_ATOMIC);
+        if (new_iface->ifname == NULL) {
+                pr_err("qtaguid: iface_stat: create(%s): "
+                       "ifname alloc failed\n", net_dev->name);
+                kfree(new_iface);
+                return NULL;
+        }
+        spin_lock_init(&new_iface->tag_stat_list_lock);
+        new_iface->tag_stat_tree = RB_ROOT;
+        _iface_stat_set_active(new_iface, net_dev, true);
+
+        /*
+         * ipv6 notifier chains are atomic :(
+         * No create_proc_read_entry() for you!
+         */
+        isw = kmalloc(sizeof(*isw), GFP_ATOMIC);
+        if (!isw) {
+                pr_err("qtaguid: iface_stat: create(%s): "
+                       "work alloc failed\n", new_iface->ifname);
+                _iface_stat_set_active(new_iface, net_dev, false);
+                kfree(new_iface->ifname);
+                kfree(new_iface);
+                return NULL;
+        }
+        isw->iface_entry = new_iface;
+        INIT_WORK(&isw->iface_work, iface_create_proc_worker);
+        schedule_work(&isw->iface_work);
+        list_add(&new_iface->list, &iface_stat_list);
+        return new_iface;
+}
+
+static void iface_check_stats_reset_and_adjust(struct net_device *net_dev,
+                                               struct iface_stat *iface)
+{
+        struct rtnl_link_stats64 dev_stats, *stats;
+        bool stats_rewound;
+
+        stats = dev_get_stats(net_dev, &dev_stats);
+        /* No empty packets */
+        stats_rewound =
+                (stats->rx_bytes < iface->last_known[IFS_RX].bytes)
+                || (stats->tx_bytes < iface->last_known[IFS_TX].bytes);
+
+        IF_DEBUG("qtaguid: %s(%s): iface=%p netdev=%p "
+                 "bytes rx/tx=%llu/%llu "
+                 "active=%d last_known=%d "
+                 "stats_rewound=%d\n", __func__,
+                 net_dev ? net_dev->name : "?",
+                 iface, net_dev,
+                 stats->rx_bytes, stats->tx_bytes,
+                 iface->active, iface->last_known_valid, stats_rewound);
+
+        if (iface->active && iface->last_known_valid && stats_rewound) {
+                pr_warn_once("qtaguid: iface_stat: %s(%s): "
+                             "iface reset its stats unexpectedly\n", __func__,
+                             net_dev->name);
+
+                iface->totals[IFS_TX].bytes += iface->last_known[IFS_TX].bytes;
+                iface->totals[IFS_TX].packets +=
+                        iface->last_known[IFS_TX].packets;
+                iface->totals[IFS_RX].bytes += iface->last_known[IFS_RX].bytes;
+                iface->totals[IFS_RX].packets +=
+                        iface->last_known[IFS_RX].packets;
+                iface->last_known_valid = false;
+                IF_DEBUG("qtaguid: %s(%s): iface=%p "
+                         "used last known bytes rx/tx=%llu/%llu\n", __func__,
+                         iface->ifname, iface, iface->last_known[IFS_RX].bytes,
+                         iface->last_known[IFS_TX].bytes);
+        }
+}
+
+/*
+ * Create a new entry for tracking the specified interface.
+ * Do nothing if the entry already exists.
+ * Called when an interface is configured with a valid IP address.
+ */
+static void iface_stat_create(struct net_device *net_dev,
+                              struct in_ifaddr *ifa)
+{
+        struct in_device *in_dev = NULL;
+        const char *ifname;
+        struct iface_stat *entry;
+        __be32 ipaddr = 0;
+        struct iface_stat *new_iface;
+
+        IF_DEBUG("qtaguid: iface_stat: create(%s): ifa=%p netdev=%p\n",
+                 net_dev ? net_dev->name : "?",
+                 ifa, net_dev);
+        if (!net_dev) {
+                pr_err("qtaguid: iface_stat: create(): no net dev\n");
+                return;
+        }
+
+        ifname = net_dev->name;
+        if (!ifa) {
+                in_dev = in_dev_get(net_dev);
+                if (!in_dev) {
+                        pr_err("qtaguid: iface_stat: create(%s): no inet dev\n",
+                               ifname);
+                        return;
+                }
+                IF_DEBUG("qtaguid: iface_stat: create(%s): in_dev=%p\n",
+                         ifname, in_dev);
+                for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
+                        IF_DEBUG("qtaguid: iface_stat: create(%s): "
+                                 "ifa=%p ifa_label=%s\n",
+                                 ifname, ifa,
+                                 ifa->ifa_label ? ifa->ifa_label : "(null)");
+                        if (ifa->ifa_label && !strcmp(ifname, ifa->ifa_label))
+                                break;
+                }
+        }
+
+        if (!ifa) {
+                IF_DEBUG("qtaguid: iface_stat: create(%s): no matching IP\n",
+                         ifname);
+                goto done_put;
+        }
+        ipaddr = ifa->ifa_local;
+
+        spin_lock_bh(&iface_stat_list_lock);
+        entry = get_iface_entry(ifname);
+        if (entry != NULL) {
+                bool activate = !ipv4_is_loopback(ipaddr);
+                IF_DEBUG("qtaguid: iface_stat: create(%s): entry=%p\n",
+                         ifname, entry);
+                iface_check_stats_reset_and_adjust(net_dev, entry);
+                _iface_stat_set_active(entry, net_dev, activate);
+                IF_DEBUG("qtaguid: %s(%s): "
+                         "tracking now %d on ip=%pI4\n", __func__,
+                         entry->ifname, activate, &ipaddr);
+                goto done_unlock_put;
+        } else if (ipv4_is_loopback(ipaddr)) {
+                IF_DEBUG("qtaguid: iface_stat: create(%s): "
+                         "ignore loopback dev. ip=%pI4\n", ifname, &ipaddr);
+                goto done_unlock_put;
+        }
+
+        new_iface = iface_alloc(net_dev);
+        IF_DEBUG("qtaguid: iface_stat: create(%s): done "
+                 "entry=%p ip=%pI4\n", ifname, new_iface, &ipaddr);
+done_unlock_put:
+        spin_unlock_bh(&iface_stat_list_lock);
+done_put:
+        if (in_dev)
+                in_dev_put(in_dev);
+}
+
+static void iface_stat_create_ipv6(struct net_device *net_dev,
+                                   struct inet6_ifaddr *ifa)
+{
+        struct in_device *in_dev;
+        const char *ifname;
+        struct iface_stat *entry;
+        struct iface_stat *new_iface;
+        int addr_type;
+
+        IF_DEBUG("qtaguid: iface_stat: create6(): ifa=%p netdev=%p->name=%s\n",
+                 ifa, net_dev, net_dev ? net_dev->name : "");
+        if (!net_dev) {
+                pr_err("qtaguid: iface_stat: create6(): no net dev!\n");
+                return;
+        }
+        ifname = net_dev->name;
+
+        in_dev = in_dev_get(net_dev);
+        if (!in_dev) {
+                pr_err("qtaguid: iface_stat: create6(%s): no inet dev\n",
+                       ifname);
+                return;
+        }
+
+        IF_DEBUG("qtaguid: iface_stat: create6(%s): in_dev=%p\n",
+                 ifname, in_dev);
+
+        if (!ifa) {
+                IF_DEBUG("qtaguid: iface_stat: create6(%s): no matching IP\n",
+                         ifname);
+                goto done_put;
+        }
+        addr_type = ipv6_addr_type(&ifa->addr);
+
+        spin_lock_bh(&iface_stat_list_lock);
+        entry = get_iface_entry(ifname);
+        if (entry != NULL) {
+                bool activate = !(addr_type & IPV6_ADDR_LOOPBACK);
+                IF_DEBUG("qtaguid: %s(%s): entry=%p\n", __func__,
+                         ifname, entry);
+                iface_check_stats_reset_and_adjust(net_dev, entry);
+                _iface_stat_set_active(entry, net_dev, activate);
+                IF_DEBUG("qtaguid: %s(%s): "
+                         "tracking now %d on ip=%pI6c\n", __func__,
+                         entry->ifname, activate, &ifa->addr);
+                goto done_unlock_put;
+        } else if (addr_type & IPV6_ADDR_LOOPBACK) {
+                IF_DEBUG("qtaguid: %s(%s): "
+                         "ignore loopback dev. ip=%pI6c\n", __func__,
+                         ifname, &ifa->addr);
+                goto done_unlock_put;
+        }
+
+        new_iface = iface_alloc(net_dev);
+        IF_DEBUG("qtaguid: iface_stat: create6(%s): done "
+                 "entry=%p ip=%pI6c\n", ifname, new_iface, &ifa->addr);
+
+done_unlock_put:
+        spin_unlock_bh(&iface_stat_list_lock);
+done_put:
+        in_dev_put(in_dev);
+}
+
+static struct sock_tag *get_sock_stat_nl(const struct sock *sk)
+{
+        MT_DEBUG("qtaguid: get_sock_stat_nl(sk=%p)\n", sk);
+        return sock_tag_tree_search(&sock_tag_tree, sk);
+}
+
+static struct sock_tag *get_sock_stat(const struct sock *sk)
+{
+        struct sock_tag *sock_tag_entry;
+        MT_DEBUG("qtaguid: get_sock_stat(sk=%p)\n", sk);
+        if (!sk)
+                return NULL;
+        spin_lock_bh(&sock_tag_list_lock);
+        sock_tag_entry = get_sock_stat_nl(sk);
+        spin_unlock_bh(&sock_tag_list_lock);
+        return sock_tag_entry;
+}
+
+static void
+data_counters_update(struct data_counters *dc, int set,
+                     enum ifs_tx_rx direction, int proto, int bytes)
+{
+        switch (proto) {
+        case IPPROTO_TCP:
+                dc_add_byte_packets(dc, set, direction, IFS_TCP, bytes, 1);
+                break;
+        case IPPROTO_UDP:
+                dc_add_byte_packets(dc, set, direction, IFS_UDP, bytes, 1);
+                break;
+        case IPPROTO_IP:
+        default:
+                dc_add_byte_packets(dc, set, direction, IFS_PROTO_OTHER, bytes,
+                                    1);
+                break;
+        }
+}
+
+/*
+ * Update stats for the specified interface. Do nothing if the entry
+ * does not exist (when a device was never configured with an IP address).
+ * Called when an device is being unregistered.
+ */
+static void iface_stat_update(struct net_device *net_dev, bool stash_only)
+{
+        struct rtnl_link_stats64 dev_stats, *stats;
+        struct iface_stat *entry;
+
+        stats = dev_get_stats(net_dev, &dev_stats);
+        spin_lock_bh(&iface_stat_list_lock);
+        entry = get_iface_entry(net_dev->name);
+        if (entry == NULL) {
+                IF_DEBUG("qtaguid: iface_stat: update(%s): not tracked\n",
+                         net_dev->name);
+                spin_unlock_bh(&iface_stat_list_lock);
+                return;
+        }
+
+        IF_DEBUG("qtaguid: %s(%s): entry=%p\n", __func__,
+                 net_dev->name, entry);
+        if (!entry->active) {
+                IF_DEBUG("qtaguid: %s(%s): already disabled\n", __func__,
+                         net_dev->name);
+                spin_unlock_bh(&iface_stat_list_lock);
+                return;
+        }
+
+        if (stash_only) {
+                entry->last_known[IFS_TX].bytes = stats->tx_bytes;
+                entry->last_known[IFS_TX].packets = stats->tx_packets;
+                entry->last_known[IFS_RX].bytes = stats->rx_bytes;
+                entry->last_known[IFS_RX].packets = stats->rx_packets;
+                entry->last_known_valid = true;
+                IF_DEBUG("qtaguid: %s(%s): "
+                         "dev stats stashed rx/tx=%llu/%llu\n", __func__,
+                         net_dev->name, stats->rx_bytes, stats->tx_bytes);
+                spin_unlock_bh(&iface_stat_list_lock);
+                return;
+        }
+        entry->totals[IFS_TX].bytes += stats->tx_bytes;
+        entry->totals[IFS_TX].packets += stats->tx_packets;
+        entry->totals[IFS_RX].bytes += stats->rx_bytes;
+        entry->totals[IFS_RX].packets += stats->rx_packets;
+        /* We don't need the last_known[] anymore */
+        entry->last_known_valid = false;
+        _iface_stat_set_active(entry, net_dev, false);
+        IF_DEBUG("qtaguid: %s(%s): "
+                 "disable tracking. rx/tx=%llu/%llu\n", __func__,
+                 net_dev->name, stats->rx_bytes, stats->tx_bytes);
+        spin_unlock_bh(&iface_stat_list_lock);
+}
+
+static void tag_stat_update(struct tag_stat *tag_entry,
+                        enum ifs_tx_rx direction, int proto, int bytes)
+{
+        int active_set;
+        active_set = get_active_counter_set(tag_entry->tn.tag);
+        MT_DEBUG("qtaguid: tag_stat_update(tag=0x%llx (uid=%u) set=%d "
+                 "dir=%d proto=%d bytes=%d)\n",
+                 tag_entry->tn.tag, get_uid_from_tag(tag_entry->tn.tag),
+                 active_set, direction, proto, bytes);
+        data_counters_update(&tag_entry->counters, active_set, direction,
+                             proto, bytes);
+        if (tag_entry->parent_counters)
+                data_counters_update(tag_entry->parent_counters, active_set,
+                                     direction, proto, bytes);
+}
+
+/*
+ * Create a new entry for tracking the specified {acct_tag,uid_tag} within
+ * the interface.
+ * iface_entry->tag_stat_list_lock should be held.
+ */
+static struct tag_stat *create_if_tag_stat(struct iface_stat *iface_entry,
+                                           tag_t tag)
+{
+        struct tag_stat *new_tag_stat_entry = NULL;
+        IF_DEBUG("qtaguid: iface_stat: %s(): ife=%p tag=0x%llx"
+                 " (uid=%u)\n", __func__,
+                 iface_entry, tag, get_uid_from_tag(tag));
+        new_tag_stat_entry = kzalloc(sizeof(*new_tag_stat_entry), GFP_ATOMIC);
+        if (!new_tag_stat_entry) {
+                pr_err("qtaguid: iface_stat: tag stat alloc failed\n");
+                goto done;
+        }
+        new_tag_stat_entry->tn.tag = tag;
+        tag_stat_tree_insert(new_tag_stat_entry, &iface_entry->tag_stat_tree);
+done:
+        return new_tag_stat_entry;
+}
+
+static void if_tag_stat_update(const char *ifname, uid_t uid,
+                               const struct sock *sk, enum ifs_tx_rx direction,
+                               int proto, int bytes)
+{
+        struct tag_stat *tag_stat_entry;
+        tag_t tag, acct_tag;
+        tag_t uid_tag;
+        struct data_counters *uid_tag_counters;
+        struct sock_tag *sock_tag_entry;
+        struct iface_stat *iface_entry;
+        struct tag_stat *new_tag_stat;
+        MT_DEBUG("qtaguid: if_tag_stat_update(ifname=%s "
+                "uid=%u sk=%p dir=%d proto=%d bytes=%d)\n",
+                 ifname, uid, sk, direction, proto, bytes);
+
+
+        iface_entry = get_iface_entry(ifname);
+        if (!iface_entry) {
+                pr_err("qtaguid: iface_stat: stat_update() %s not found\n",
+                       ifname);
+                return;
+        }
+        /* It is ok to process data when an iface_entry is inactive */
+
+        MT_DEBUG("qtaguid: iface_stat: stat_update() dev=%s entry=%p\n",
+                 ifname, iface_entry);
+
+        /*
+         * Look for a tagged sock.
+         * It will have an acct_uid.
+         */
+        sock_tag_entry = get_sock_stat(sk);
+        if (sock_tag_entry) {
+                tag = sock_tag_entry->tag;
+                acct_tag = get_atag_from_tag(tag);
+                uid_tag = get_utag_from_tag(tag);
+        } else {
+                acct_tag = make_atag_from_value(0);
+                tag = combine_atag_with_uid(acct_tag, uid);
+                uid_tag = make_tag_from_uid(uid);
+        }
+        MT_DEBUG("qtaguid: iface_stat: stat_update(): "
+                 " looking for tag=0x%llx (uid=%u) in ife=%p\n",
+                 tag, get_uid_from_tag(tag), iface_entry);
+        /* Loop over tag list under this interface for {acct_tag,uid_tag} */
+        spin_lock_bh(&iface_entry->tag_stat_list_lock);
+
+        tag_stat_entry = tag_stat_tree_search(&iface_entry->tag_stat_tree,
+                                              tag);
+        if (tag_stat_entry) {
+                /*
+                 * Updating the {acct_tag, uid_tag} entry handles both stats:
+                 * {0, uid_tag} will also get updated.
+                 */
+                tag_stat_update(tag_stat_entry, direction, proto, bytes);
+                spin_unlock_bh(&iface_entry->tag_stat_list_lock);
+                return;
+        }
+
+        /* Loop over tag list under this interface for {0,uid_tag} */
+        tag_stat_entry = tag_stat_tree_search(&iface_entry->tag_stat_tree,
+                                              uid_tag);
+        if (!tag_stat_entry) {
+                /* Here: the base uid_tag did not exist */
+                /*
+                 * No parent counters. So
+                 *  - No {0, uid_tag} stats and no {acc_tag, uid_tag} stats.
+                 */
+                new_tag_stat = create_if_tag_stat(iface_entry, uid_tag);
+                uid_tag_counters = &new_tag_stat->counters;
+        } else {
+                uid_tag_counters = &tag_stat_entry->counters;
+        }
+
+        if (acct_tag) {
+                new_tag_stat = create_if_tag_stat(iface_entry, tag);
+                new_tag_stat->parent_counters = uid_tag_counters;
+        }
+        tag_stat_update(new_tag_stat, direction, proto, bytes);
+        spin_unlock_bh(&iface_entry->tag_stat_list_lock);
+}
+
+static int iface_netdev_event_handler(struct notifier_block *nb,
+                                      unsigned long event, void *ptr) {
+        struct net_device *dev = ptr;
+
+        if (unlikely(module_passive))
+                return NOTIFY_DONE;
+
+        IF_DEBUG("qtaguid: iface_stat: netdev_event(): "
+                 "ev=0x%lx/%s netdev=%p->name=%s\n",
+                 event, netdev_evt_str(event), dev, dev ? dev->name : "");
+
+        switch (event) {
+        case NETDEV_UP:
+                iface_stat_create(dev, NULL);
+                atomic64_inc(&qtu_events.iface_events);
+                break;
+        case NETDEV_DOWN:
+        case NETDEV_UNREGISTER:
+                iface_stat_update(dev, event == NETDEV_DOWN);
+                atomic64_inc(&qtu_events.iface_events);
+                break;
+        }
+        return NOTIFY_DONE;
+}
+
+static int iface_inet6addr_event_handler(struct notifier_block *nb,
+                                         unsigned long event, void *ptr)
+{
+        struct inet6_ifaddr *ifa = ptr;
+        struct net_device *dev;
+
+        if (unlikely(module_passive))
+                return NOTIFY_DONE;
+
+        IF_DEBUG("qtaguid: iface_stat: inet6addr_event(): "
+                 "ev=0x%lx/%s ifa=%p\n",
+                 event, netdev_evt_str(event), ifa);
+
+        switch (event) {
+        case NETDEV_UP:
+                BUG_ON(!ifa || !ifa->idev);
+                dev = (struct net_device *)ifa->idev->dev;
+                iface_stat_create_ipv6(dev, ifa);
+                atomic64_inc(&qtu_events.iface_events);
+                break;
+        case NETDEV_DOWN:
+        case NETDEV_UNREGISTER:
+                BUG_ON(!ifa || !ifa->idev);
+                dev = (struct net_device *)ifa->idev->dev;
+                iface_stat_update(dev, event == NETDEV_DOWN);
+                atomic64_inc(&qtu_events.iface_events);
+                break;
+        }
+        return NOTIFY_DONE;
+}
+
+static int iface_inetaddr_event_handler(struct notifier_block *nb,
+                                        unsigned long event, void *ptr)
+{
+        struct in_ifaddr *ifa = ptr;
+        struct net_device *dev;
+
+        if (unlikely(module_passive))
+                return NOTIFY_DONE;
+
+        IF_DEBUG("qtaguid: iface_stat: inetaddr_event(): "
+                 "ev=0x%lx/%s ifa=%p\n",
+                 event, netdev_evt_str(event), ifa);
+
+        switch (event) {
+        case NETDEV_UP:
+                BUG_ON(!ifa || !ifa->ifa_dev);
+                dev = ifa->ifa_dev->dev;
+                iface_stat_create(dev, ifa);
+                atomic64_inc(&qtu_events.iface_events);
+                break;
+        case NETDEV_DOWN:
+        case NETDEV_UNREGISTER:
+                BUG_ON(!ifa || !ifa->ifa_dev);
+                dev = ifa->ifa_dev->dev;
+                iface_stat_update(dev, event == NETDEV_DOWN);
+                atomic64_inc(&qtu_events.iface_events);
+                break;
+        }
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block iface_netdev_notifier_blk = {
+        .notifier_call = iface_netdev_event_handler,
+};
+
+static struct notifier_block iface_inetaddr_notifier_blk = {
+        .notifier_call = iface_inetaddr_event_handler,
+};
+
+static struct notifier_block iface_inet6addr_notifier_blk = {
+        .notifier_call = iface_inet6addr_event_handler,
+};
+
+static int __init iface_stat_init(struct proc_dir_entry *parent_procdir)
+{
+        int err;
+
+        iface_stat_procdir = proc_mkdir(iface_stat_procdirname, parent_procdir);
+        if (!iface_stat_procdir) {
+                pr_err("qtaguid: iface_stat: init failed to create proc entry\n");
+                err = -1;
+                goto err;
+        }
+
+        iface_stat_all_procfile = create_proc_entry(iface_stat_all_procfilename,
+                                                    proc_iface_perms,
+                                                    parent_procdir);
+        if (!iface_stat_all_procfile) {
+                pr_err("qtaguid: iface_stat: init "
+                       " failed to create stat_all proc entry\n");
+                err = -1;
+                goto err_zap_entry;
+        }
+        iface_stat_all_procfile->read_proc = iface_stat_all_proc_read;
+
+
+        err = register_netdevice_notifier(&iface_netdev_notifier_blk);
+        if (err) {
+                pr_err("qtaguid: iface_stat: init "
+                       "failed to register dev event handler\n");
+                goto err_zap_all_stats_entry;
+        }
+        err = register_inetaddr_notifier(&iface_inetaddr_notifier_blk);
+        if (err) {
+                pr_err("qtaguid: iface_stat: init "
+                       "failed to register ipv4 dev event handler\n");
+                goto err_unreg_nd;
+        }
+
+        err = register_inet6addr_notifier(&iface_inet6addr_notifier_blk);
+        if (err) {
+                pr_err("qtaguid: iface_stat: init "
+                       "failed to register ipv6 dev event handler\n");
+                goto err_unreg_ip4_addr;
+        }
+        return 0;
+
+err_unreg_ip4_addr:
+        unregister_inetaddr_notifier(&iface_inetaddr_notifier_blk);
+err_unreg_nd:
+        unregister_netdevice_notifier(&iface_netdev_notifier_blk);
+err_zap_all_stats_entry:
+        remove_proc_entry(iface_stat_all_procfilename, parent_procdir);
+err_zap_entry:
+        remove_proc_entry(iface_stat_procdirname, parent_procdir);
+err:
+        return err;
+}
+
+static struct sock *qtaguid_find_sk(const struct sk_buff *skb,
+                                    struct xt_action_param *par)
+{
+        struct sock *sk;
+        unsigned int hook_mask = (1 << par->hooknum);
+
+        MT_DEBUG("qtaguid: find_sk(skb=%p) hooknum=%d family=%d\n", skb,
+                 par->hooknum, par->family);
+
+        /*
+         * Let's not abuse the the xt_socket_get*_sk(), or else it will
+         * return garbage SKs.
+         */
+        if (!(hook_mask & XT_SOCKET_SUPPORTED_HOOKS))
+                return NULL;
+
+        switch (par->family) {
+        case NFPROTO_IPV6:
+                sk = xt_socket_get6_sk(skb, par);
+                break;
+        case NFPROTO_IPV4:
+                sk = xt_socket_get4_sk(skb, par);
+                break;
+        default:
+                return NULL;
+        }
+
+        /*
+         * Seems to be issues on the file ptr for TCP_TIME_WAIT SKs.
+         * http://kerneltrap.org/mailarchive/linux-netdev/2010/10/21/6287959
+         * Not fixed in 3.0-r3 :(
+         */
+        if (sk) {
+                MT_DEBUG("qtaguid: %p->sk_proto=%u "
+                         "->sk_state=%d\n", sk, sk->sk_protocol, sk->sk_state);
+                if (sk->sk_state  == TCP_TIME_WAIT) {
+                        xt_socket_put_sk(sk);
+                        sk = NULL;
+                }
+        }
+        return sk;
+}
+
+static void account_for_uid(const struct sk_buff *skb,
+                            const struct sock *alternate_sk, uid_t uid,
+                            struct xt_action_param *par)
+{
+        const struct net_device *el_dev;
+
+        if (!skb->dev) {
+                MT_DEBUG("qtaguid[%d]: no skb->dev\n", par->hooknum);
+                el_dev = par->in ? : par->out;
+        } else {
+                const struct net_device *other_dev;
+                el_dev = skb->dev;
+                other_dev = par->in ? : par->out;
+                if (el_dev != other_dev) {
+                        MT_DEBUG("qtaguid[%d]: skb->dev=%p %s vs "
+                                "par->(in/out)=%p %s\n",
+                                par->hooknum, el_dev, el_dev->name, other_dev,
+                                other_dev->name);
+                }
+        }
+
+        if (unlikely(!el_dev)) {
+                pr_info("qtaguid[%d]: no par->in/out?!!\n", par->hooknum);
+        } else if (unlikely(!el_dev->name)) {
+                pr_info("qtaguid[%d]: no dev->name?!!\n", par->hooknum);
+        } else {
+                MT_DEBUG("qtaguid[%d]: dev name=%s type=%d\n",
+                         par->hooknum,
+                         el_dev->name,
+                         el_dev->type);
+
+                if_tag_stat_update(el_dev->name, uid,
+                                skb->sk ? skb->sk : alternate_sk,
+                                par->in ? IFS_RX : IFS_TX,
+                                ip_hdr(skb)->protocol, skb->len);
+        }
+}
+
+static bool qtaguid_mt(const struct sk_buff *skb, struct xt_action_param *par)
+{
+        const struct xt_qtaguid_match_info *info = par->matchinfo;
+        const struct file *filp;
+        bool got_sock = false;
+        struct sock *sk;
+        uid_t sock_uid;
+        bool res;
+
+        if (unlikely(module_passive))
+                return (info->match ^ info->invert) == 0;
+
+        MT_DEBUG("qtaguid[%d]: entered skb=%p par->in=%p/out=%p fam=%d\n",
+                 par->hooknum, skb, par->in, par->out, par->family);
+
+        atomic64_inc(&qtu_events.match_calls);
+        if (skb == NULL) {
+                res = (info->match ^ info->invert) == 0;
+                goto ret_res;
+        }
+
+        sk = skb->sk;
+
+        if (sk == NULL) {
+                /*
+                 * A missing sk->sk_socket happens when packets are in-flight
+                 * and the matching socket is already closed and gone.
+                 */
+                sk = qtaguid_find_sk(skb, par);
+                /*
+                 * If we got the socket from the find_sk(), we will need to put
+                 * it back, as nf_tproxy_get_sock_v4() got it.
+                 */
+                got_sock = sk;
+                if (sk)
+                        atomic64_inc(&qtu_events.match_found_sk_in_ct);
+                else
+                        atomic64_inc(&qtu_events.match_found_no_sk_in_ct);
+        } else {
+                atomic64_inc(&qtu_events.match_found_sk);
+        }
+        MT_DEBUG("qtaguid[%d]: sk=%p got_sock=%d proto=%d\n",
+                par->hooknum, sk, got_sock, ip_hdr(skb)->protocol);
+        if (sk != NULL) {
+                MT_DEBUG("qtaguid[%d]: sk=%p->sk_socket=%p->file=%p\n",
+                        par->hooknum, sk, sk->sk_socket,
+                        sk->sk_socket ? sk->sk_socket->file : (void *)-1LL);
+                filp = sk->sk_socket ? sk->sk_socket->file : NULL;
+                MT_DEBUG("qtaguid[%d]: filp...uid=%u\n",
+                        par->hooknum, filp ? filp->f_cred->fsuid : -1);
+        }
+
+        if (sk == NULL || sk->sk_socket == NULL) {
+                /*
+                 * Here, the qtaguid_find_sk() using connection tracking
+                 * couldn't find the owner, so for now we just count them
+                 * against the system.
+                 */
+                /*
+                 * TODO: unhack how to force just accounting.
+                 * For now we only do iface stats when the uid-owner is not
+                 * requested.
+                 */
+                if (!(info->match & XT_QTAGUID_UID))
+                        account_for_uid(skb, sk, 0, par);
+                MT_DEBUG("qtaguid[%d]: leaving (sk?sk->sk_socket)=%p\n",
+                        par->hooknum,
+                        sk ? sk->sk_socket : NULL);
+                res = (info->match ^ info->invert) == 0;
+                atomic64_inc(&qtu_events.match_no_sk);
+                goto put_sock_ret_res;
+        } else if (info->match & info->invert & XT_QTAGUID_SOCKET) {
+                res = false;
+                goto put_sock_ret_res;
+        }
+        filp = sk->sk_socket->file;
+        if (filp == NULL) {
+                MT_DEBUG("qtaguid[%d]: leaving filp=NULL\n", par->hooknum);
+                account_for_uid(skb, sk, 0, par);
+                res = ((info->match ^ info->invert) &
+                        (XT_QTAGUID_UID | XT_QTAGUID_GID)) == 0;
+                atomic64_inc(&qtu_events.match_no_sk_file);
+                goto put_sock_ret_res;
+        }
+        sock_uid = filp->f_cred->fsuid;
+        /*
+         * TODO: unhack how to force just accounting.
+         * For now we only do iface stats when the uid-owner is not requested
+         */
+        if (!(info->match & XT_QTAGUID_UID))
+                account_for_uid(skb, sk, sock_uid, par);
+
+        /*
+         * The following two tests fail the match when:
+         *    id not in range AND no inverted condition requested
+         * or id     in range AND    inverted condition requested
+         * Thus (!a && b) || (a && !b) == a ^ b
+         */
+        if (info->match & XT_QTAGUID_UID)
+                if ((filp->f_cred->fsuid >= info->uid_min &&
+                     filp->f_cred->fsuid <= info->uid_max) ^
+                    !(info->invert & XT_QTAGUID_UID)) {
+                        MT_DEBUG("qtaguid[%d]: leaving uid not matching\n",
+                                 par->hooknum);
+                        res = false;
+                        goto put_sock_ret_res;
+                }
+        if (info->match & XT_QTAGUID_GID)
+                if ((filp->f_cred->fsgid >= info->gid_min &&
+                                filp->f_cred->fsgid <= info->gid_max) ^
+                        !(info->invert & XT_QTAGUID_GID)) {
+                        MT_DEBUG("qtaguid[%d]: leaving gid not matching\n",
+                                par->hooknum);
+                        res = false;
+                        goto put_sock_ret_res;
+                }
+
+        MT_DEBUG("qtaguid[%d]: leaving matched\n", par->hooknum);
+        res = true;
+
+put_sock_ret_res:
+        if (got_sock)
+                xt_socket_put_sk(sk);
+ret_res:
+        MT_DEBUG("qtaguid[%d]: left %d\n", par->hooknum, res);
+        return res;
+}
+
+#ifdef DDEBUG
+/* This function is not in xt_qtaguid_print.c because of locks visibility */
+static void prdebug_full_state(int indent_level, const char *fmt, ...)
+{
+        va_list args;
+        char *fmt_buff;
+        char *buff;
+
+        if (!unlikely(qtaguid_debug_mask & DDEBUG_MASK))
+                return;
+
+        fmt_buff = kasprintf(GFP_ATOMIC,
+                             "qtaguid: %s(): %s {\n", __func__, fmt);
+        BUG_ON(!fmt_buff);
+        va_start(args, fmt);
+        buff = kvasprintf(GFP_ATOMIC,
+                          fmt_buff, args);
+        BUG_ON(!buff);
+        pr_debug("%s", buff);
+        kfree(fmt_buff);
+        kfree(buff);
+        va_end(args);
+
+        spin_lock_bh(&sock_tag_list_lock);
+        prdebug_sock_tag_tree(indent_level, &sock_tag_tree);
+        spin_unlock_bh(&sock_tag_list_lock);
+
+        spin_lock_bh(&sock_tag_list_lock);
+        spin_lock_bh(&uid_tag_data_tree_lock);
+        prdebug_uid_tag_data_tree(indent_level, &uid_tag_data_tree);
+        prdebug_proc_qtu_data_tree(indent_level, &proc_qtu_data_tree);
+        spin_unlock_bh(&uid_tag_data_tree_lock);
+        spin_unlock_bh(&sock_tag_list_lock);
+
+        spin_lock_bh(&iface_stat_list_lock);
+        prdebug_iface_stat_list(indent_level, &iface_stat_list);
+        spin_unlock_bh(&iface_stat_list_lock);
+
+        pr_debug("qtaguid: %s(): }\n", __func__);
+}
+#else
+static void prdebug_full_state(int indent_level, const char *fmt, ...) {}
+#endif
+
+/*
+ * Procfs reader to get all active socket tags using style "1)" as described in
+ * fs/proc/generic.c
+ */
+static int qtaguid_ctrl_proc_read(char *page, char **num_items_returned,
+                                  off_t items_to_skip, int char_count, int *eof,
+                                  void *data)
+{
+        char *outp = page;
+        int len;
+        uid_t uid;
+        struct rb_node *node;
+        struct sock_tag *sock_tag_entry;
+        int item_index = 0;
+        int indent_level = 0;
+        long f_count;
+
+        if (unlikely(module_passive)) {
+                *eof = 1;
+                return 0;
+        }
+
+        if (*eof)
+                return 0;
+
+        CT_DEBUG("qtaguid: proc ctrl page=%p off=%ld char_count=%d *eof=%d\n",
+                page, items_to_skip, char_count, *eof);
+
+        spin_lock_bh(&sock_tag_list_lock);
+        for (node = rb_first(&sock_tag_tree);
+             node;
+             node = rb_next(node)) {
+                if (item_index++ < items_to_skip)
+                        continue;
+                sock_tag_entry = rb_entry(node, struct sock_tag, sock_node);
+                uid = get_uid_from_tag(sock_tag_entry->tag);
+                CT_DEBUG("qtaguid: proc_read(): sk=%p tag=0x%llx (uid=%u) "
+                         "pid=%u\n",
+                         sock_tag_entry->sk,
+                         sock_tag_entry->tag,
+                         uid,
+                         sock_tag_entry->pid
+                        );
+                f_count = atomic_long_read(
+                        &sock_tag_entry->socket->file->f_count);
+                len = snprintf(outp, char_count,
+                               "sock=%p tag=0x%llx (uid=%u) pid=%u "
+                               "f_count=%lu\n",
+                               sock_tag_entry->sk,
+                               sock_tag_entry->tag, uid,
+                               sock_tag_entry->pid, f_count);
+                if (len >= char_count) {
+                        spin_unlock_bh(&sock_tag_list_lock);
+                        *outp = '\0';
+                        return outp - page;
+                }
+                outp += len;
+                char_count -= len;
+                (*num_items_returned)++;
+        }
+        spin_unlock_bh(&sock_tag_list_lock);
+
+        if (item_index++ >= items_to_skip) {
+                len = snprintf(outp, char_count,
+                               "events: sockets_tagged=%llu "
+                               "sockets_untagged=%llu "
+                               "counter_set_changes=%llu "
+                               "delete_cmds=%llu "
+                               "iface_events=%llu "
+                               "match_calls=%llu "
+                               "match_found_sk=%llu "
+                               "match_found_sk_in_ct=%llu "
+                               "match_found_no_sk_in_ct=%llu "
+                               "match_no_sk=%llu "
+                               "match_no_sk_file=%llu\n",
+                               atomic64_read(&qtu_events.sockets_tagged),
+                               atomic64_read(&qtu_events.sockets_untagged),
+                               atomic64_read(&qtu_events.counter_set_changes),
+                               atomic64_read(&qtu_events.delete_cmds),
+                               atomic64_read(&qtu_events.iface_events),
+                               atomic64_read(&qtu_events.match_calls),
+                               atomic64_read(&qtu_events.match_found_sk),
+                               atomic64_read(&qtu_events.match_found_sk_in_ct),
+                               atomic64_read(
+                                       &qtu_events.match_found_no_sk_in_ct),
+                               atomic64_read(&qtu_events.match_no_sk),
+                               atomic64_read(&qtu_events.match_no_sk_file));
+                if (len >= char_count) {
+                        *outp = '\0';
+                        return outp - page;
+                }
+                outp += len;
+                char_count -= len;
+                (*num_items_returned)++;
+        }
+
+        /* Count the following as part of the last item_index */
+        if (item_index > items_to_skip) {
+                prdebug_full_state(indent_level, "proc ctrl");
+        }
+
+        *eof = 1;
+        return outp - page;
+}
+
+/*
+ * Delete socket tags, and stat tags associated with a given
+ * accouting tag and uid.
+ */
+static int ctrl_cmd_delete(const char *input)
+{
+        char cmd;
+        uid_t uid;
+        uid_t entry_uid;
+        tag_t acct_tag;
+        tag_t tag;
+        int res, argc;
+        struct iface_stat *iface_entry;
+        struct rb_node *node;
+        struct sock_tag *st_entry;
+        struct rb_root st_to_free_tree = RB_ROOT;
+        struct tag_stat *ts_entry;
+        struct tag_counter_set *tcs_entry;
+        struct tag_ref *tr_entry;
+        struct uid_tag_data *utd_entry;
+
+        argc = sscanf(input, "%c %llu %u", &cmd, &acct_tag, &uid);
+        CT_DEBUG("qtaguid: ctrl_delete(%s): argc=%d cmd=%c "
+                 "user_tag=0x%llx uid=%u\n", input, argc, cmd,
+                 acct_tag, uid);
+        if (argc < 2) {
+                res = -EINVAL;
+                goto err;
+        }
+        if (!valid_atag(acct_tag)) {
+                pr_info("qtaguid: ctrl_delete(%s): invalid tag\n", input);
+                res = -EINVAL;
+                goto err;
+        }
+        if (argc < 3) {
+                uid = current_fsuid();
+        } else if (!can_impersonate_uid(uid)) {
+                pr_info("qtaguid: ctrl_delete(%s): "
+                        "insufficient priv from pid=%u tgid=%u uid=%u\n",
+                        input, current->pid, current->tgid, current_fsuid());
+                res = -EPERM;
+                goto err;
+        }
+
+        tag = combine_atag_with_uid(acct_tag, uid);
+        CT_DEBUG("qtaguid: ctrl_delete(%s): "
+                 "looking for tag=0x%llx (uid=%u)\n",
+                 input, tag, uid);
+
+        /* Delete socket tags */
+        spin_lock_bh(&sock_tag_list_lock);
+        node = rb_first(&sock_tag_tree);
+        while (node) {
+                st_entry = rb_entry(node, struct sock_tag, sock_node);
+                entry_uid = get_uid_from_tag(st_entry->tag);
+                node = rb_next(node);
+                if (entry_uid != uid)
+                        continue;
+
+                CT_DEBUG("qtaguid: ctrl_delete(%s): st tag=0x%llx (uid=%u)\n",
+                         input, st_entry->tag, entry_uid);
+
+                if (!acct_tag || st_entry->tag == tag) {
+                        rb_erase(&st_entry->sock_node, &sock_tag_tree);
+                        /* Can't sockfd_put() within spinlock, do it later. */
+                        sock_tag_tree_insert(st_entry, &st_to_free_tree);
+                        tr_entry = lookup_tag_ref(st_entry->tag, NULL);
+                        BUG_ON(tr_entry->num_sock_tags <= 0);
+                        tr_entry->num_sock_tags--;
+                        /*
+                         * TODO: remove if, and start failing.
+                         * This is a hack to work around the fact that in some
+                         * places we have "if (IS_ERR_OR_NULL(pqd_entry))"
+                         * and are trying to work around apps
+                         * that didn't open the /dev/xt_qtaguid.
+                         */
+                        if (st_entry->list.next && st_entry->list.prev)
+                                list_del(&st_entry->list);
+                }
+        }
+        spin_unlock_bh(&sock_tag_list_lock);
+
+        sock_tag_tree_erase(&st_to_free_tree);
+
+        /* Delete tag counter-sets */
+        spin_lock_bh(&tag_counter_set_list_lock);
+        /* Counter sets are only on the uid tag, not full tag */
+        tcs_entry = tag_counter_set_tree_search(&tag_counter_set_tree, tag);
+        if (tcs_entry) {
+                CT_DEBUG("qtaguid: ctrl_delete(%s): "
+                         "erase tcs: tag=0x%llx (uid=%u) set=%d\n",
+                         input,
+                         tcs_entry->tn.tag,
+                         get_uid_from_tag(tcs_entry->tn.tag),
+                         tcs_entry->active_set);
+                rb_erase(&tcs_entry->tn.node, &tag_counter_set_tree);
+                kfree(tcs_entry);
+        }
+        spin_unlock_bh(&tag_counter_set_list_lock);
+
+        /*
+         * If acct_tag is 0, then all entries belonging to uid are
+         * erased.
+         */
+        spin_lock_bh(&iface_stat_list_lock);
+        list_for_each_entry(iface_entry, &iface_stat_list, list) {
+                spin_lock_bh(&iface_entry->tag_stat_list_lock);
+                node = rb_first(&iface_entry->tag_stat_tree);
+                while (node) {
+                        ts_entry = rb_entry(node, struct tag_stat, tn.node);
+                        entry_uid = get_uid_from_tag(ts_entry->tn.tag);
+                        node = rb_next(node);
+
+                        CT_DEBUG("qtaguid: ctrl_delete(%s): "
+                                 "ts tag=0x%llx (uid=%u)\n",
+                                 input, ts_entry->tn.tag, entry_uid);
+
+                        if (entry_uid != uid)
+                                continue;
+                        if (!acct_tag || ts_entry->tn.tag == tag) {
+                                CT_DEBUG("qtaguid: ctrl_delete(%s): "
+                                         "erase ts: %s 0x%llx %u\n",
+                                         input, iface_entry->ifname,
+                                         get_atag_from_tag(ts_entry->tn.tag),
+                                         entry_uid);
+                                rb_erase(&ts_entry->tn.node,
+                                         &iface_entry->tag_stat_tree);
+                                kfree(ts_entry);
+                        }
+                }
+                spin_unlock_bh(&iface_entry->tag_stat_list_lock);
+        }
+        spin_unlock_bh(&iface_stat_list_lock);
+
+        /* Cleanup the uid_tag_data */
+        spin_lock_bh(&uid_tag_data_tree_lock);
+        node = rb_first(&uid_tag_data_tree);
+        while (node) {
+                utd_entry = rb_entry(node, struct uid_tag_data, node);
+                entry_uid = utd_entry->uid;
+                node = rb_next(node);
+
+                CT_DEBUG("qtaguid: ctrl_delete(%s): "
+                         "utd uid=%u\n",
+                         input, entry_uid);
+
+                if (entry_uid != uid)
+                        continue;
+                /*
+                 * Go over the tag_refs, and those that don't have
+                 * sock_tags using them are freed.
+                 */
+                put_tag_ref_tree(tag, utd_entry);
+                put_utd_entry(utd_entry);
+        }
+        spin_unlock_bh(&uid_tag_data_tree_lock);
+
+        atomic64_inc(&qtu_events.delete_cmds);
+        res = 0;
+
+err:
+        return res;
+}
+
+static int ctrl_cmd_counter_set(const char *input)
+{
+        char cmd;
+        uid_t uid = 0;
+        tag_t tag;
+        int res, argc;
+        struct tag_counter_set *tcs;
+        int counter_set;
+
+        argc = sscanf(input, "%c %d %u", &cmd, &counter_set, &uid);
+        CT_DEBUG("qtaguid: ctrl_counterset(%s): argc=%d cmd=%c "
+                 "set=%d uid=%u\n", input, argc, cmd,
+                 counter_set, uid);
+        if (argc != 3) {
+                res = -EINVAL;
+                goto err;
+        }
+        if (counter_set < 0 || counter_set >= IFS_MAX_COUNTER_SETS) {
+                pr_info("qtaguid: ctrl_counterset(%s): invalid counter_set range\n",
+                        input);
+                res = -EINVAL;
+                goto err;
+        }
+        if (!can_manipulate_uids()) {
+                pr_info("qtaguid: ctrl_counterset(%s): "
+                        "insufficient priv from pid=%u tgid=%u uid=%u\n",
+                        input, current->pid, current->tgid, current_fsuid());
+                res = -EPERM;
+                goto err;
+        }
+
+        tag = make_tag_from_uid(uid);
+        spin_lock_bh(&tag_counter_set_list_lock);
+        tcs = tag_counter_set_tree_search(&tag_counter_set_tree, tag);
+        if (!tcs) {
+                tcs = kzalloc(sizeof(*tcs), GFP_ATOMIC);
+                if (!tcs) {
+                        spin_unlock_bh(&tag_counter_set_list_lock);
+                        pr_err("qtaguid: ctrl_counterset(%s): "
+                               "failed to alloc counter set\n",
+                               input);
+                        res = -ENOMEM;
+                        goto err;
+                }
+                tcs->tn.tag = tag;
+                tag_counter_set_tree_insert(tcs, &tag_counter_set_tree);
+                CT_DEBUG("qtaguid: ctrl_counterset(%s): added tcs tag=0x%llx "
+                         "(uid=%u) set=%d\n",
+                         input, tag, get_uid_from_tag(tag), counter_set);
+        }
+        tcs->active_set = counter_set;
+        spin_unlock_bh(&tag_counter_set_list_lock);
+        atomic64_inc(&qtu_events.counter_set_changes);
+        res = 0;
+
+err:
+        return res;
+}
+
+static int ctrl_cmd_tag(const char *input)
+{
+        char cmd;
+        int sock_fd = 0;
+        uid_t uid = 0;
+        tag_t acct_tag = make_atag_from_value(0);
+        tag_t full_tag;
+        struct socket *el_socket;
+        int res, argc;
+        struct sock_tag *sock_tag_entry;
+        struct tag_ref *tag_ref_entry;
+        struct uid_tag_data *uid_tag_data_entry;
+        struct proc_qtu_data *pqd_entry;
+
+        /* Unassigned args will get defaulted later. */
+        argc = sscanf(input, "%c %d %llu %u", &cmd, &sock_fd, &acct_tag, &uid);
+        CT_DEBUG("qtaguid: ctrl_tag(%s): argc=%d cmd=%c sock_fd=%d "
+                 "acct_tag=0x%llx uid=%u\n", input, argc, cmd, sock_fd,
+                 acct_tag, uid);
+        if (argc < 2) {
+                res = -EINVAL;
+                goto err;
+        }
+        el_socket = sockfd_lookup(sock_fd, &res);  /* This locks the file */
+        if (!el_socket) {
+                pr_info("qtaguid: ctrl_tag(%s): failed to lookup"
+                        " sock_fd=%d err=%d\n", input, sock_fd, res);
+                goto err;
+        }
+        CT_DEBUG("qtaguid: ctrl_tag(%s): socket->...->f_count=%ld ->sk=%p\n",
+                 input, atomic_long_read(&el_socket->file->f_count),
+                 el_socket->sk);
+        if (argc < 3) {
+                acct_tag = make_atag_from_value(0);
+        } else if (!valid_atag(acct_tag)) {
+                pr_info("qtaguid: ctrl_tag(%s): invalid tag\n", input);
+                res = -EINVAL;
+                goto err_put;
+        }
+        CT_DEBUG("qtaguid: ctrl_tag(%s): "
+                 "pid=%u tgid=%u uid=%u euid=%u fsuid=%u "
+                 "in_group=%d in_egroup=%d\n",
+                 input, current->pid, current->tgid, current_uid(),
+                 current_euid(), current_fsuid(),
+                 in_group_p(proc_ctrl_write_gid),
+                 in_egroup_p(proc_ctrl_write_gid));
+        if (argc < 4) {
+                uid = current_fsuid();
+        } else if (!can_impersonate_uid(uid)) {
+                pr_info("qtaguid: ctrl_tag(%s): "
+                        "insufficient priv from pid=%u tgid=%u uid=%u\n",
+                        input, current->pid, current->tgid, current_fsuid());
+                res = -EPERM;
+                goto err_put;
+        }
+        full_tag = combine_atag_with_uid(acct_tag, uid);
+
+        spin_lock_bh(&sock_tag_list_lock);
+        sock_tag_entry = get_sock_stat_nl(el_socket->sk);
+        tag_ref_entry = get_tag_ref(full_tag, &uid_tag_data_entry);
+        if (IS_ERR(tag_ref_entry)) {
+                res = PTR_ERR(tag_ref_entry);
+                spin_unlock_bh(&sock_tag_list_lock);
+                goto err_put;
+        }
+        tag_ref_entry->num_sock_tags++;
+        if (sock_tag_entry) {
+                struct tag_ref *prev_tag_ref_entry;
+
+                CT_DEBUG("qtaguid: ctrl_tag(%s): retag for sk=%p "
+                         "st@%p ...->f_count=%ld\n",
+                         input, el_socket->sk, sock_tag_entry,
+                         atomic_long_read(&el_socket->file->f_count));
+                /*
+                 * This is a re-tagging, so release the sock_fd that was
+                 * locked at the time of the 1st tagging.
+                 * There is still the ref from this call's sockfd_lookup() so
+                 * it can be done within the spinlock.
+                 */
+                sockfd_put(sock_tag_entry->socket);
+                prev_tag_ref_entry = lookup_tag_ref(sock_tag_entry->tag,
+                                                    &uid_tag_data_entry);
+                BUG_ON(IS_ERR_OR_NULL(prev_tag_ref_entry));
+                BUG_ON(prev_tag_ref_entry->num_sock_tags <= 0);
+                prev_tag_ref_entry->num_sock_tags--;
+                sock_tag_entry->tag = full_tag;
+        } else {
+                CT_DEBUG("qtaguid: ctrl_tag(%s): newtag for sk=%p\n",
+                         input, el_socket->sk);
+                sock_tag_entry = kzalloc(sizeof(*sock_tag_entry),
+                                         GFP_ATOMIC);
+                if (!sock_tag_entry) {
+                        pr_err("qtaguid: ctrl_tag(%s): "
+                               "socket tag alloc failed\n",
+                               input);
+                        spin_unlock_bh(&sock_tag_list_lock);
+                        res = -ENOMEM;
+                        goto err_tag_unref_put;
+                }
+                sock_tag_entry->sk = el_socket->sk;
+                sock_tag_entry->socket = el_socket;
+                sock_tag_entry->pid = current->tgid;
+                sock_tag_entry->tag = combine_atag_with_uid(acct_tag,
+                                                            uid);
+                spin_lock_bh(&uid_tag_data_tree_lock);
+                pqd_entry = proc_qtu_data_tree_search(
+                        &proc_qtu_data_tree, current->tgid);
+                /*
+                 * TODO: remove if, and start failing.
+                 * At first, we want to catch user-space code that is not
+                 * opening the /dev/xt_qtaguid.
+                 */
+                if (IS_ERR_OR_NULL(pqd_entry))
+                        pr_warn_once(
+                                "qtaguid: %s(): "
+                                "User space forgot to open /dev/xt_qtaguid? "
+                                "pid=%u tgid=%u uid=%u\n", __func__,
+                                current->pid, current->tgid,
+                                current_fsuid());
+                else
+                        list_add(&sock_tag_entry->list,
+                                 &pqd_entry->sock_tag_list);
+                spin_unlock_bh(&uid_tag_data_tree_lock);
+
+                sock_tag_tree_insert(sock_tag_entry, &sock_tag_tree);
+                atomic64_inc(&qtu_events.sockets_tagged);
+        }
+        spin_unlock_bh(&sock_tag_list_lock);
+        /* We keep the ref to the socket (file) until it is untagged */
+        CT_DEBUG("qtaguid: ctrl_tag(%s): done st@%p ...->f_count=%ld\n",
+                 input, sock_tag_entry,
+                 atomic_long_read(&el_socket->file->f_count));
+        return 0;
+
+err_tag_unref_put:
+        BUG_ON(tag_ref_entry->num_sock_tags <= 0);
+        tag_ref_entry->num_sock_tags--;
+        free_tag_ref_from_utd_entry(tag_ref_entry, uid_tag_data_entry);
+err_put:
+        CT_DEBUG("qtaguid: ctrl_tag(%s): done. ...->f_count=%ld\n",
+                 input, atomic_long_read(&el_socket->file->f_count) - 1);
+        /* Release the sock_fd that was grabbed by sockfd_lookup(). */
+        sockfd_put(el_socket);
+        return res;
+
+err:
+        CT_DEBUG("qtaguid: ctrl_tag(%s): done.\n", input);
+        return res;
+}
+
+static int ctrl_cmd_untag(const char *input)
+{
+        char cmd;
+        int sock_fd = 0;
+        struct socket *el_socket;
+        int res, argc;
+        struct sock_tag *sock_tag_entry;
+        struct tag_ref *tag_ref_entry;
+        struct uid_tag_data *utd_entry;
+        struct proc_qtu_data *pqd_entry;
+
+        argc = sscanf(input, "%c %d", &cmd, &sock_fd);
+        CT_DEBUG("qtaguid: ctrl_untag(%s): argc=%d cmd=%c sock_fd=%d\n",
+                 input, argc, cmd, sock_fd);
+        if (argc < 2) {
+                res = -EINVAL;
+                goto err;
+        }
+        el_socket = sockfd_lookup(sock_fd, &res);  /* This locks the file */
+        if (!el_socket) {
+                pr_info("qtaguid: ctrl_untag(%s): failed to lookup"
+                        " sock_fd=%d err=%d\n", input, sock_fd, res);
+                goto err;
+        }
+        CT_DEBUG("qtaguid: ctrl_untag(%s): socket->...->f_count=%ld ->sk=%p\n",
+                 input, atomic_long_read(&el_socket->file->f_count),
+                 el_socket->sk);
+        spin_lock_bh(&sock_tag_list_lock);
+        sock_tag_entry = get_sock_stat_nl(el_socket->sk);
+        if (!sock_tag_entry) {
+                spin_unlock_bh(&sock_tag_list_lock);
+                res = -EINVAL;
+                goto err_put;
+        }
+        /*
+         * The socket already belongs to the current process
+         * so it can do whatever it wants to it.
+         */
+        rb_erase(&sock_tag_entry->sock_node, &sock_tag_tree);
+
+        tag_ref_entry = lookup_tag_ref(sock_tag_entry->tag, &utd_entry);
+        BUG_ON(!tag_ref_entry);
+        BUG_ON(tag_ref_entry->num_sock_tags <= 0);
+        spin_lock_bh(&uid_tag_data_tree_lock);
+        pqd_entry = proc_qtu_data_tree_search(
+                &proc_qtu_data_tree, current->tgid);
+        /*
+         * TODO: remove if, and start failing.
+         * At first, we want to catch user-space code that is not
+         * opening the /dev/xt_qtaguid.
+         */
+        if (IS_ERR_OR_NULL(pqd_entry))
+                pr_warn_once("qtaguid: %s(): "
+                             "User space forgot to open /dev/xt_qtaguid? "
+                             "pid=%u tgid=%u uid=%u\n", __func__,
+                             current->pid, current->tgid, current_fsuid());
+        else
+                list_del(&sock_tag_entry->list);
+        spin_unlock_bh(&uid_tag_data_tree_lock);
+        /*
+         * We don't free tag_ref from the utd_entry here,
+         * only during a cmd_delete().
+         */
+        tag_ref_entry->num_sock_tags--;
+        spin_unlock_bh(&sock_tag_list_lock);
+        /*
+         * Release the sock_fd that was grabbed at tag time,
+         * and once more for the sockfd_lookup() here.
+         */
+        sockfd_put(sock_tag_entry->socket);
+        CT_DEBUG("qtaguid: ctrl_untag(%s): done. st@%p ...->f_count=%ld\n",
+                 input, sock_tag_entry,
+                 atomic_long_read(&el_socket->file->f_count) - 1);
+        sockfd_put(el_socket);
+
+        kfree(sock_tag_entry);
+        atomic64_inc(&qtu_events.sockets_untagged);
+
+        return 0;
+
+err_put:
+        CT_DEBUG("qtaguid: ctrl_untag(%s): done. socket->...->f_count=%ld\n",
+                 input, atomic_long_read(&el_socket->file->f_count) - 1);
+        /* Release the sock_fd that was grabbed by sockfd_lookup(). */
+        sockfd_put(el_socket);
+        return res;
+
+err:
+        CT_DEBUG("qtaguid: ctrl_untag(%s): done.\n", input);
+        return res;
+}
+
+static int qtaguid_ctrl_parse(const char *input, int count)
+{
+        char cmd;
+        int res;
+
+        cmd = input[0];
+        /* Collect params for commands */
+        switch (cmd) {
+        case 'd':
+                res = ctrl_cmd_delete(input);
+                break;
+
+        case 's':
+                res = ctrl_cmd_counter_set(input);
+                break;
+
+        case 't':
+                res = ctrl_cmd_tag(input);
+                break;
+
+        case 'u':
+                res = ctrl_cmd_untag(input);
+                break;
+
+        default:
+                res = -EINVAL;
+                goto err;
+        }
+        if (!res)
+                res = count;
+err:
+        CT_DEBUG("qtaguid: ctrl(%s): res=%d\n", input, res);
+        return res;
+}
+
+#define MAX_QTAGUID_CTRL_INPUT_LEN 255
+static int qtaguid_ctrl_proc_write(struct file *file, const char __user *buffer,
+                        unsigned long count, void *data)
+{
+        char input_buf[MAX_QTAGUID_CTRL_INPUT_LEN];
+
+        if (unlikely(module_passive))
+                return count;
+
+        if (count >= MAX_QTAGUID_CTRL_INPUT_LEN)
+                return -EINVAL;
+
+        if (copy_from_user(input_buf, buffer, count))
+                return -EFAULT;
+
+        input_buf[count] = '\0';
+        return qtaguid_ctrl_parse(input_buf, count);
+}
+
+struct proc_print_info {
+        char *outp;
+        char **num_items_returned;
+        struct iface_stat *iface_entry;
+        struct tag_stat *ts_entry;
+        int item_index;
+        int items_to_skip;
+        int char_count;
+};
+
+static int pp_stats_line(struct proc_print_info *ppi, int cnt_set)
+{
+        int len;
+        struct data_counters *cnts;
+
+        if (!ppi->item_index) {
+                if (ppi->item_index++ < ppi->items_to_skip)
+                        return 0;
+                len = snprintf(ppi->outp, ppi->char_count,
+                               "idx iface acct_tag_hex uid_tag_int cnt_set "
+                               "rx_bytes rx_packets "
+                               "tx_bytes tx_packets "
+                               "rx_tcp_bytes rx_tcp_packets "
+                               "rx_udp_bytes rx_udp_packets "
+                               "rx_other_bytes rx_other_packets "
+                               "tx_tcp_bytes tx_tcp_packets "
+                               "tx_udp_bytes tx_udp_packets "
+                               "tx_other_bytes tx_other_packets\n");
+        } else {
+                tag_t tag = ppi->ts_entry->tn.tag;
+                uid_t stat_uid = get_uid_from_tag(tag);
+
+                if (!can_read_other_uid_stats(stat_uid)) {
+                        CT_DEBUG("qtaguid: stats line: "
+                                 "%s 0x%llx %u: insufficient priv "
+                                 "from pid=%u tgid=%u uid=%u\n",
+                                 ppi->iface_entry->ifname,
+                                 get_atag_from_tag(tag), stat_uid,
+                                 current->pid, current->tgid, current_fsuid());
+                        return 0;
+                }
+                if (ppi->item_index++ < ppi->items_to_skip)
+                        return 0;
+                cnts = &ppi->ts_entry->counters;
+                len = snprintf(
+                        ppi->outp, ppi->char_count,
+                        "%d %s 0x%llx %u %u "
+                        "%llu %llu "
+                        "%llu %llu "
+                        "%llu %llu "
+                        "%llu %llu "
+                        "%llu %llu "
+                        "%llu %llu "
+                        "%llu %llu "
+                        "%llu %llu\n",
+                        ppi->item_index,
+                        ppi->iface_entry->ifname,
+                        get_atag_from_tag(tag),
+                        stat_uid,
+                        cnt_set,
+                        dc_sum_bytes(cnts, cnt_set, IFS_RX),
+                        dc_sum_packets(cnts, cnt_set, IFS_RX),
+                        dc_sum_bytes(cnts, cnt_set, IFS_TX),
+                        dc_sum_packets(cnts, cnt_set, IFS_TX),
+                        cnts->bpc[cnt_set][IFS_RX][IFS_TCP].bytes,
+                        cnts->bpc[cnt_set][IFS_RX][IFS_TCP].packets,
+                        cnts->bpc[cnt_set][IFS_RX][IFS_UDP].bytes,
+                        cnts->bpc[cnt_set][IFS_RX][IFS_UDP].packets,
+                        cnts->bpc[cnt_set][IFS_RX][IFS_PROTO_OTHER].bytes,
+                        cnts->bpc[cnt_set][IFS_RX][IFS_PROTO_OTHER].packets,
+                        cnts->bpc[cnt_set][IFS_TX][IFS_TCP].bytes,
+                        cnts->bpc[cnt_set][IFS_TX][IFS_TCP].packets,
+                        cnts->bpc[cnt_set][IFS_TX][IFS_UDP].bytes,
+                        cnts->bpc[cnt_set][IFS_TX][IFS_UDP].packets,
+                        cnts->bpc[cnt_set][IFS_TX][IFS_PROTO_OTHER].bytes,
+                        cnts->bpc[cnt_set][IFS_TX][IFS_PROTO_OTHER].packets);
+        }
+        return len;
+}
+
+static bool pp_sets(struct proc_print_info *ppi)
+{
+        int len;
+        int counter_set;
+        for (counter_set = 0; counter_set < IFS_MAX_COUNTER_SETS;
+             counter_set++) {
+                len = pp_stats_line(ppi, counter_set);
+                if (len >= ppi->char_count) {
+                        *ppi->outp = '\0';
+                        return false;
+                }
+                if (len) {
+                        ppi->outp += len;
+                        ppi->char_count -= len;
+                        (*ppi->num_items_returned)++;
+                }
+        }
+        return true;
+}
+
+/*
+ * Procfs reader to get all tag stats using style "1)" as described in
+ * fs/proc/generic.c
+ * Groups all protocols tx/rx bytes.
+ */
+static int qtaguid_stats_proc_read(char *page, char **num_items_returned,
+                                off_t items_to_skip, int char_count, int *eof,
+                                void *data)
+{
+        struct proc_print_info ppi;
+        int len;
+
+        ppi.outp = page;
+        ppi.item_index = 0;
+        ppi.char_count = char_count;
+        ppi.num_items_returned = num_items_returned;
+        ppi.items_to_skip = items_to_skip;
+
+        if (unlikely(module_passive)) {
+                len = pp_stats_line(&ppi, 0);
+                /* The header should always be shorter than the buffer. */
+                BUG_ON(len >= ppi.char_count);
+                (*num_items_returned)++;
+                *eof = 1;
+                return len;
+        }
+
+        CT_DEBUG("qtaguid:proc stats page=%p *num_items_returned=%p off=%ld "
+                "char_count=%d *eof=%d\n", page, *num_items_returned,
+                items_to_skip, char_count, *eof);
+
+        if (*eof)
+                return 0;
+
+        /* The idx is there to help debug when things go belly up. */
+        len = pp_stats_line(&ppi, 0);
+        /* Don't advance the outp unless the whole line was printed */
+        if (len >= ppi.char_count) {
+                *ppi.outp = '\0';
+                return ppi.outp - page;
+        }
+        if (len) {
+                ppi.outp += len;
+                ppi.char_count -= len;
+                (*num_items_returned)++;
+        }
+
+        spin_lock_bh(&iface_stat_list_lock);
+        list_for_each_entry(ppi.iface_entry, &iface_stat_list, list) {
+                struct rb_node *node;
+                spin_lock_bh(&ppi.iface_entry->tag_stat_list_lock);
+                for (node = rb_first(&ppi.iface_entry->tag_stat_tree);
+                     node;
+                     node = rb_next(node)) {
+                        ppi.ts_entry = rb_entry(node, struct tag_stat, tn.node);
+                        if (!pp_sets(&ppi)) {
+                                spin_unlock_bh(
+                                        &ppi.iface_entry->tag_stat_list_lock);
+                                spin_unlock_bh(&iface_stat_list_lock);
+                                return ppi.outp - page;
+                        }
+                }
+                spin_unlock_bh(&ppi.iface_entry->tag_stat_list_lock);
+        }
+        spin_unlock_bh(&iface_stat_list_lock);
+
+        *eof = 1;
+        return ppi.outp - page;
+}
+
+/*------------------------------------------*/
+static int qtudev_open(struct inode *inode, struct file *file)
+{
+        struct uid_tag_data *utd_entry;
+        struct proc_qtu_data  *pqd_entry;
+        struct proc_qtu_data  *new_pqd_entry;
+        int res;
+        bool utd_entry_found;
+
+        if (unlikely(qtu_proc_handling_passive))
+                return 0;
+
+        DR_DEBUG("qtaguid: qtudev_open(): pid=%u tgid=%u uid=%u\n",
+                 current->pid, current->tgid, current_fsuid());
+
+        spin_lock_bh(&uid_tag_data_tree_lock);
+
+        /* Look for existing uid data, or alloc one. */
+        utd_entry = get_uid_data(current_fsuid(), &utd_entry_found);
+        if (IS_ERR_OR_NULL(utd_entry)) {
+                res = PTR_ERR(utd_entry);
+                goto err;
+        }
+
+        /* Look for existing PID based proc_data */
+        pqd_entry = proc_qtu_data_tree_search(&proc_qtu_data_tree,
+                                              current->tgid);
+        if (pqd_entry) {
+                pr_err("qtaguid: qtudev_open(): %u/%u %u "
+                       "%s already opened\n",
+                       current->pid, current->tgid, current_fsuid(),
+                       QTU_DEV_NAME);
+                res = -EBUSY;
+                goto err_unlock_free_utd;
+        }
+
+        new_pqd_entry = kzalloc(sizeof(*new_pqd_entry), GFP_ATOMIC);
+        if (!new_pqd_entry) {
+                pr_err("qtaguid: qtudev_open(): %u/%u %u: "
+                       "proc data alloc failed\n",
+                       current->pid, current->tgid, current_fsuid());
+                res = -ENOMEM;
+                goto err_unlock_free_utd;
+        }
+        new_pqd_entry->pid = current->tgid;
+        INIT_LIST_HEAD(&new_pqd_entry->sock_tag_list);
+        new_pqd_entry->parent_tag_data = utd_entry;
+        utd_entry->num_pqd++;
+
+        proc_qtu_data_tree_insert(new_pqd_entry,
+                                  &proc_qtu_data_tree);
+
+        spin_unlock_bh(&uid_tag_data_tree_lock);
+        DR_DEBUG("qtaguid: tracking data for uid=%u in pqd=%p\n",
+                 current_fsuid(), new_pqd_entry);
+        file->private_data = new_pqd_entry;
+        return 0;
+
+err_unlock_free_utd:
+        if (!utd_entry_found) {
+                rb_erase(&utd_entry->node, &uid_tag_data_tree);
+                kfree(utd_entry);
+        }
+        spin_unlock_bh(&uid_tag_data_tree_lock);
+err:
+        return res;
+}
+
+static int qtudev_release(struct inode *inode, struct file *file)
+{
+        struct proc_qtu_data  *pqd_entry = file->private_data;
+        struct uid_tag_data  *utd_entry = pqd_entry->parent_tag_data;
+        struct sock_tag *st_entry;
+        struct rb_root st_to_free_tree = RB_ROOT;
+        struct list_head *entry, *next;
+        struct tag_ref *tr;
+
+        if (unlikely(qtu_proc_handling_passive))
+                return 0;
+
+        /*
+         * Do not trust the current->pid, it might just be a kworker cleaning
+         * up after a dead proc.
+         */
+        DR_DEBUG("qtaguid: qtudev_release(): "
+                 "pid=%u tgid=%u uid=%u "
+                 "pqd_entry=%p->pid=%u utd_entry=%p->active_tags=%d\n",
+                 current->pid, current->tgid, pqd_entry->parent_tag_data->uid,
+                 pqd_entry, pqd_entry->pid, utd_entry,
+                 utd_entry->num_active_tags);
+
+        spin_lock_bh(&sock_tag_list_lock);
+        spin_lock_bh(&uid_tag_data_tree_lock);
+
+        list_for_each_safe(entry, next, &pqd_entry->sock_tag_list) {
+                st_entry = list_entry(entry, struct sock_tag, list);
+                DR_DEBUG("qtaguid: %s(): "
+                         "erase sock_tag=%p->sk=%p pid=%u tgid=%u uid=%u\n",
+                         __func__,
+                         st_entry, st_entry->sk,
+                         current->pid, current->tgid,
+                         pqd_entry->parent_tag_data->uid);
+
+                utd_entry = uid_tag_data_tree_search(
+                        &uid_tag_data_tree,
+                        get_uid_from_tag(st_entry->tag));
+                BUG_ON(IS_ERR_OR_NULL(utd_entry));
+                DR_DEBUG("qtaguid: %s(): "
+                         "looking for tag=0x%llx in utd_entry=%p\n", __func__,
+                         st_entry->tag, utd_entry);
+                tr = tag_ref_tree_search(&utd_entry->tag_ref_tree,
+                                         st_entry->tag);
+                BUG_ON(!tr);
+                BUG_ON(tr->num_sock_tags <= 0);
+                tr->num_sock_tags--;
+                free_tag_ref_from_utd_entry(tr, utd_entry);
+
+                rb_erase(&st_entry->sock_node, &sock_tag_tree);
+                list_del(&st_entry->list);
+                /* Can't sockfd_put() within spinlock, do it later. */
+                sock_tag_tree_insert(st_entry, &st_to_free_tree);
+
+                /*
+                 * Try to free the utd_entry if no other proc_qtu_data is
+                 * using it (num_pqd is 0) and it doesn't have active tags
+                 * (num_active_tags is 0).
+                 */
+                put_utd_entry(utd_entry);
+        }
+
+        rb_erase(&pqd_entry->node, &proc_qtu_data_tree);
+        BUG_ON(pqd_entry->parent_tag_data->num_pqd < 1);
+        pqd_entry->parent_tag_data->num_pqd--;
+        put_utd_entry(pqd_entry->parent_tag_data);
+        kfree(pqd_entry);
+        file->private_data = NULL;
+
+        spin_unlock_bh(&uid_tag_data_tree_lock);
+        spin_unlock_bh(&sock_tag_list_lock);
+
+
+        sock_tag_tree_erase(&st_to_free_tree);
+
+        prdebug_full_state(0, "%s(): pid=%u tgid=%u", __func__,
+                           current->pid, current->tgid);
+        return 0;
+}
+
+/*------------------------------------------*/
+static const struct file_operations qtudev_fops = {
+        .owner = THIS_MODULE,
+        .open = qtudev_open,
+        .release = qtudev_release,
+};
+
+static struct miscdevice qtu_device = {
+        .minor = MISC_DYNAMIC_MINOR,
+        .name = QTU_DEV_NAME,
+        .fops = &qtudev_fops,
+        /* How sad it doesn't allow for defaults: .mode = S_IRUGO | S_IWUSR */
+};
+
+/*------------------------------------------*/
+static int __init qtaguid_proc_register(struct proc_dir_entry **res_procdir)
+{
+        int ret;
+        *res_procdir = proc_mkdir(module_procdirname, init_net.proc_net);
+        if (!*res_procdir) {
+                pr_err("qtaguid: failed to create proc/.../xt_qtaguid\n");
+                ret = -ENOMEM;
+                goto no_dir;
+        }
+
+        xt_qtaguid_ctrl_file = create_proc_entry("ctrl", proc_ctrl_perms,
+                                                *res_procdir);
+        if (!xt_qtaguid_ctrl_file) {
+                pr_err("qtaguid: failed to create xt_qtaguid/ctrl "
+                        " file\n");
+                ret = -ENOMEM;
+                goto no_ctrl_entry;
+        }
+        xt_qtaguid_ctrl_file->read_proc = qtaguid_ctrl_proc_read;
+        xt_qtaguid_ctrl_file->write_proc = qtaguid_ctrl_proc_write;
+
+        xt_qtaguid_stats_file = create_proc_entry("stats", proc_stats_perms,
+                                                *res_procdir);
+        if (!xt_qtaguid_stats_file) {
+                pr_err("qtaguid: failed to create xt_qtaguid/stats "
+                        "file\n");
+                ret = -ENOMEM;
+                goto no_stats_entry;
+        }
+        xt_qtaguid_stats_file->read_proc = qtaguid_stats_proc_read;
+        /*
+         * TODO: add support counter hacking
+         * xt_qtaguid_stats_file->write_proc = qtaguid_stats_proc_write;
+         */
+        return 0;
+
+no_stats_entry:
+        remove_proc_entry("ctrl", *res_procdir);
+no_ctrl_entry:
+        remove_proc_entry("xt_qtaguid", NULL);
+no_dir:
+        return ret;
+}
+
+static struct xt_match qtaguid_mt_reg __read_mostly = {
+        /*
+         * This module masquerades as the "owner" module so that iptables
+         * tools can deal with it.
+         */
+        .name       = "owner",
+        .revision   = 1,
+        .family     = NFPROTO_UNSPEC,
+        .match      = qtaguid_mt,
+        .matchsize  = sizeof(struct xt_qtaguid_match_info),
+        .me         = THIS_MODULE,
+};
+
+static int __init qtaguid_mt_init(void)
+{
+        if (qtaguid_proc_register(&xt_qtaguid_procdir)
+            || iface_stat_init(xt_qtaguid_procdir)
+            || xt_register_match(&qtaguid_mt_reg)
+            || misc_register(&qtu_device))
+                return -1;
+        return 0;
+}
+
+/*
+ * TODO: allow unloading of the module.
+ * For now stats are permanent.
+ * Kconfig forces'y/n' and never an 'm'.
+ */
+
+module_init(qtaguid_mt_init);
+MODULE_AUTHOR("jpa <jpa@google.com>");
+MODULE_DESCRIPTION("Xtables: socket owner+tag matching and associated stats");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("ipt_owner");
+MODULE_ALIAS("ip6t_owner");
+MODULE_ALIAS("ipt_qtaguid");
+MODULE_ALIAS("ip6t_qtaguid");
diff --git a/net/netfilter/xt_qtaguid_internal.h b/net/netfilter/xt_qtaguid_internal.h
new file mode 100644
index 00000000000..02479d6d317
--- /dev/null
+++ b/net/netfilter/xt_qtaguid_internal.h
@@ -0,0 +1,330 @@
+/*
+ * Kernel iptables module to track stats for packets based on user tags.
+ *
+ * (C) 2011 Google, Inc
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#ifndef __XT_QTAGUID_INTERNAL_H__
+#define __XT_QTAGUID_INTERNAL_H__
+
+#include <linux/types.h>
+#include <linux/rbtree.h>
+#include <linux/spinlock_types.h>
+#include <linux/workqueue.h>
+
+/* Iface handling */
+#define IDEBUG_MASK (1<<0)
+/* Iptable Matching. Per packet. */
+#define MDEBUG_MASK (1<<1)
+/* Red-black tree handling. Per packet. */
+#define RDEBUG_MASK (1<<2)
+/* procfs ctrl/stats handling */
+#define CDEBUG_MASK (1<<3)
+/* dev and resource tracking */
+#define DDEBUG_MASK (1<<4)
+
+/* E.g (IDEBUG_MASK | CDEBUG_MASK | DDEBUG_MASK) */
+#define DEFAULT_DEBUG_MASK 0
+
+/*
+ * (Un)Define these *DEBUG to compile out/in the pr_debug calls.
+ * All undef: text size ~ 0x3030; all def: ~ 0x4404.
+ */
+#define IDEBUG
+#define MDEBUG
+#define RDEBUG
+#define CDEBUG
+#define DDEBUG
+
+#define MSK_DEBUG(mask, ...) do {                           \
+                if (unlikely(qtaguid_debug_mask & (mask)))  \
+                        pr_debug(__VA_ARGS__);              \
+        } while (0)
+#ifdef IDEBUG
+#define IF_DEBUG(...) MSK_DEBUG(IDEBUG_MASK, __VA_ARGS__)
+#else
+#define IF_DEBUG(...) no_printk(__VA_ARGS__)
+#endif
+#ifdef MDEBUG
+#define MT_DEBUG(...) MSK_DEBUG(MDEBUG_MASK, __VA_ARGS__)
+#else
+#define MT_DEBUG(...) no_printk(__VA_ARGS__)
+#endif
+#ifdef RDEBUG
+#define RB_DEBUG(...) MSK_DEBUG(RDEBUG_MASK, __VA_ARGS__)
+#else
+#define RB_DEBUG(...) no_printk(__VA_ARGS__)
+#endif
+#ifdef CDEBUG
+#define CT_DEBUG(...) MSK_DEBUG(CDEBUG_MASK, __VA_ARGS__)
+#else
+#define CT_DEBUG(...) no_printk(__VA_ARGS__)
+#endif
+#ifdef DDEBUG
+#define DR_DEBUG(...) MSK_DEBUG(DDEBUG_MASK, __VA_ARGS__)
+#else
+#define DR_DEBUG(...) no_printk(__VA_ARGS__)
+#endif
+
+extern uint qtaguid_debug_mask;
+
+/*---------------------------------------------------------------------------*/
+/*
+ * Tags:
+ *
+ * They represent what the data usage counters will be tracked against.
+ * By default a tag is just based on the UID.
+ * The UID is used as the base for policing, and can not be ignored.
+ * So a tag will always at least represent a UID (uid_tag).
+ *
+ * A tag can be augmented with an "accounting tag" which is associated
+ * with a UID.
+ * User space can set the acct_tag portion of the tag which is then used
+ * with sockets: all data belonging to that socket will be counted against the
+ * tag. The policing is then based on the tag's uid_tag portion,
+ * and stats are collected for the acct_tag portion separately.
+ *
+ * There could be
+ * a:  {acct_tag=1, uid_tag=10003}
+ * b:  {acct_tag=2, uid_tag=10003}
+ * c:  {acct_tag=3, uid_tag=10003}
+ * d:  {acct_tag=0, uid_tag=10003}
+ * a, b, and c represent tags associated with specific sockets.
+ * d is for the totals for that uid, including all untagged traffic.
+ * Typically d is used with policing/quota rules.
+ *
+ * We want tag_t big enough to distinguish uid_t and acct_tag.
+ * It might become a struct if needed.
+ * Nothing should be using it as an int.
+ */
+typedef uint64_t tag_t;  /* Only used via accessors */
+
+#define TAG_UID_MASK 0xFFFFFFFFULL
+#define TAG_ACCT_MASK (~0xFFFFFFFFULL)
+
+static inline int tag_compare(tag_t t1, tag_t t2)
+{
+        return t1 < t2 ? -1 : t1 == t2 ? 0 : 1;
+}
+
+static inline tag_t combine_atag_with_uid(tag_t acct_tag, uid_t uid)
+{
+        return acct_tag | uid;
+}
+static inline tag_t make_tag_from_uid(uid_t uid)
+{
+        return uid;
+}
+static inline uid_t get_uid_from_tag(tag_t tag)
+{
+        return tag & TAG_UID_MASK;
+}
+static inline tag_t get_utag_from_tag(tag_t tag)
+{
+        return tag & TAG_UID_MASK;
+}
+static inline tag_t get_atag_from_tag(tag_t tag)
+{
+        return tag & TAG_ACCT_MASK;
+}
+
+static inline bool valid_atag(tag_t tag)
+{
+        return !(tag & TAG_UID_MASK);
+}
+static inline tag_t make_atag_from_value(uint32_t value)
+{
+        return (uint64_t)value << 32;
+}
+/*---------------------------------------------------------------------------*/
+
+/*
+ * Maximum number of socket tags that a UID is allowed to have active.
+ * Multiple processes belonging to the same UID contribute towards this limit.
+ * Special UIDs that can impersonate a UID also contribute (e.g. download
+ * manager, ...)
+ */
+#define DEFAULT_MAX_SOCK_TAGS 1024
+
+/*
+ * For now we only track 2 sets of counters.
+ * The default set is 0.
+ * Userspace can activate another set for a given uid being tracked.
+ */
+#define IFS_MAX_COUNTER_SETS 2
+
+enum ifs_tx_rx {
+        IFS_TX,
+        IFS_RX,
+        IFS_MAX_DIRECTIONS
+};
+
+/* For now, TCP, UDP, the rest */
+enum ifs_proto {
+        IFS_TCP,
+        IFS_UDP,
+        IFS_PROTO_OTHER,
+        IFS_MAX_PROTOS
+};
+
+struct byte_packet_counters {
+        uint64_t bytes;
+        uint64_t packets;
+};
+
+struct data_counters {
+        struct byte_packet_counters bpc[IFS_MAX_COUNTER_SETS][IFS_MAX_DIRECTIONS][IFS_MAX_PROTOS];
+};
+
+/* Generic X based nodes used as a base for rb_tree ops */
+struct tag_node {
+        struct rb_node node;
+        tag_t tag;
+};
+
+struct tag_stat {
+        struct tag_node tn;
+        struct data_counters counters;
+        /*
+         * If this tag is acct_tag based, we need to count against the
+         * matching parent uid_tag.
+         */
+        struct data_counters *parent_counters;
+};
+
+struct iface_stat {
+        struct list_head list;  /* in iface_stat_list */
+        char *ifname;
+        bool active;
+        /* net_dev is only valid for active iface_stat */
+        struct net_device *net_dev;
+
+        struct byte_packet_counters totals[IFS_MAX_DIRECTIONS];
+        /*
+         * We keep the last_known, because some devices reset their counters
+         * just before NETDEV_UP, while some will reset just before
+         * NETDEV_REGISTER (which is more normal).
+         * So now, if the device didn't do a NETDEV_UNREGISTER and we see
+         * its current dev stats smaller that what was previously known, we
+         * assume an UNREGISTER and just use the last_known.
+         */
+        struct byte_packet_counters last_known[IFS_MAX_DIRECTIONS];
+        /* last_known is usable when last_known_valid is true */
+        bool last_known_valid;
+
+        struct proc_dir_entry *proc_ptr;
+
+        struct rb_root tag_stat_tree;
+        spinlock_t tag_stat_list_lock;
+};
+
+/* This is needed to create proc_dir_entries from atomic context. */
+struct iface_stat_work {
+        struct work_struct iface_work;
+        struct iface_stat *iface_entry;
+};
+
+/*
+ * Track tag that this socket is transferring data for, and not necessarily
+ * the uid that owns the socket.
+ * This is the tag against which tag_stat.counters will be billed.
+ * These structs need to be looked up by sock and pid.
+ */
+struct sock_tag {
+        struct rb_node sock_node;
+        struct sock *sk;  /* Only used as a number, never dereferenced */
+        /* The socket is needed for sockfd_put() */
+        struct socket *socket;
+        /* Used to associate with a given pid */
+        struct list_head list;   /* in proc_qtu_data.sock_tag_list */
+        pid_t pid;
+
+        tag_t tag;
+};
+
+struct qtaguid_event_counts {
+        /* Various successful events */
+        atomic64_t sockets_tagged;
+        atomic64_t sockets_untagged;
+        atomic64_t counter_set_changes;
+        atomic64_t delete_cmds;
+        atomic64_t iface_events;  /* Number of NETDEV_* events handled */
+
+        atomic64_t match_calls;   /* Number of times iptables called mt */
+        /*
+         * match_found_sk_*: numbers related to the netfilter matching
+         * function finding a sock for the sk_buff.
+         * Total skbs processed is sum(match_found*).
+         */
+        atomic64_t match_found_sk;   /* An sk was already in the sk_buff. */
+        /* The connection tracker had or didn't have the sk. */
+        atomic64_t match_found_sk_in_ct;
+        atomic64_t match_found_no_sk_in_ct;
+        /*
+         * No sk could be found. No apparent owner. Could happen with
+         * unsolicited traffic.
+         */
+        atomic64_t match_no_sk;
+        /*
+         * The file ptr in the sk_socket wasn't there.
+         * This might happen for traffic while the socket is being closed.
+         */
+        atomic64_t match_no_sk_file;
+};
+
+/* Track the set active_set for the given tag. */
+struct tag_counter_set {
+        struct tag_node tn;
+        int active_set;
+};
+
+/*----------------------------------------------*/
+/*
+ * The qtu uid data is used to track resources that are created directly or
+ * indirectly by processes (uid tracked).
+ * It is shared by the processes with the same uid.
+ * Some of the resource will be counted to prevent further rogue allocations,
+ * some will need freeing once the owner process (uid) exits.
+ */
+struct uid_tag_data {
+        struct rb_node node;
+        uid_t uid;
+
+        /*
+         * For the uid, how many accounting tags have been set.
+         */
+        int num_active_tags;
+        /* Track the number of proc_qtu_data that reference it */
+        int num_pqd;
+        struct rb_root tag_ref_tree;
+        /* No tag_node_tree_lock; use uid_tag_data_tree_lock */
+};
+
+struct tag_ref {
+        struct tag_node tn;
+
+        /*
+         * This tracks the number of active sockets that have a tag on them
+         * which matches this tag_ref.tn.tag.
+         * A tag ref can live on after the sockets are untagged.
+         * A tag ref can only be removed during a tag delete command.
+         */
+        int num_sock_tags;
+};
+
+struct proc_qtu_data {
+        struct rb_node node;
+        pid_t pid;
+
+        struct uid_tag_data *parent_tag_data;
+
+        /* Tracks the sock_tags that need freeing upon this proc's death */
+        struct list_head sock_tag_list;
+        /* No spinlock_t sock_tag_list_lock; use the global one. */
+};
+
+/*----------------------------------------------*/
+#endif  /* ifndef __XT_QTAGUID_INTERNAL_H__ */
diff --git a/net/netfilter/xt_qtaguid_print.c b/net/netfilter/xt_qtaguid_print.c
new file mode 100644
index 00000000000..39176785c91
--- /dev/null
+++ b/net/netfilter/xt_qtaguid_print.c
@@ -0,0 +1,556 @@
+/*
+ * Pretty printing Support for iptables xt_qtaguid module.
+ *
+ * (C) 2011 Google, Inc
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * Most of the functions in this file just waste time if DEBUG is not defined.
+ * The matching xt_qtaguid_print.h will static inline empty funcs if the needed
+ * debug flags ore not defined.
+ * Those funcs that fail to allocate memory will panic as there is no need to
+ * hobble allong just pretending to do the requested work.
+ */
+
+#define DEBUG
+
+#include <linux/fs.h>
+#include <linux/gfp.h>
+#include <linux/net.h>
+#include <linux/rbtree.h>
+#include <linux/slab.h>
+#include <linux/spinlock_types.h>
+
+
+#include "xt_qtaguid_internal.h"
+#include "xt_qtaguid_print.h"
+
+#ifdef DDEBUG
+
+static void _bug_on_err_or_null(void *ptr)
+{
+        if (IS_ERR_OR_NULL(ptr)) {
+                pr_err("qtaguid: kmalloc failed\n");
+                BUG();
+        }
+}
+
+char *pp_tag_t(tag_t *tag)
+{
+        char *res;
+
+        if (!tag)
+                res = kasprintf(GFP_ATOMIC, "tag_t@null{}");
+        else
+                res = kasprintf(GFP_ATOMIC,
+                                "tag_t@%p{tag=0x%llx, uid=%u}",
+                                tag, *tag, get_uid_from_tag(*tag));
+        _bug_on_err_or_null(res);
+        return res;
+}
+
+char *pp_data_counters(struct data_counters *dc, bool showValues)
+{
+        char *res;
+
+        if (!dc)
+                res = kasprintf(GFP_ATOMIC, "data_counters@null{}");
+        else if (showValues)
+                res = kasprintf(
+                        GFP_ATOMIC, "data_counters@%p{"
+                        "set0{"
+                        "rx{"
+                        "tcp{b=%llu, p=%llu}, "
+                        "udp{b=%llu, p=%llu},"
+                        "other{b=%llu, p=%llu}}, "
+                        "tx{"
+                        "tcp{b=%llu, p=%llu}, "
+                        "udp{b=%llu, p=%llu},"
+                        "other{b=%llu, p=%llu}}}, "
+                        "set1{"
+                        "rx{"
+                        "tcp{b=%llu, p=%llu}, "
+                        "udp{b=%llu, p=%llu},"
+                        "other{b=%llu, p=%llu}}, "
+                        "tx{"
+                        "tcp{b=%llu, p=%llu}, "
+                        "udp{b=%llu, p=%llu},"
+                        "other{b=%llu, p=%llu}}}}",
+                        dc,
+                        dc->bpc[0][IFS_RX][IFS_TCP].bytes,
+                        dc->bpc[0][IFS_RX][IFS_TCP].packets,
+                        dc->bpc[0][IFS_RX][IFS_UDP].bytes,
+                        dc->bpc[0][IFS_RX][IFS_UDP].packets,
+                        dc->bpc[0][IFS_RX][IFS_PROTO_OTHER].bytes,
+                        dc->bpc[0][IFS_RX][IFS_PROTO_OTHER].packets,
+                        dc->bpc[0][IFS_TX][IFS_TCP].bytes,
+                        dc->bpc[0][IFS_TX][IFS_TCP].packets,
+                        dc->bpc[0][IFS_TX][IFS_UDP].bytes,
+                        dc->bpc[0][IFS_TX][IFS_UDP].packets,
+                        dc->bpc[0][IFS_TX][IFS_PROTO_OTHER].bytes,
+                        dc->bpc[0][IFS_TX][IFS_PROTO_OTHER].packets,
+                        dc->bpc[1][IFS_RX][IFS_TCP].bytes,
+                        dc->bpc[1][IFS_RX][IFS_TCP].packets,
+                        dc->bpc[1][IFS_RX][IFS_UDP].bytes,
+                        dc->bpc[1][IFS_RX][IFS_UDP].packets,
+                        dc->bpc[1][IFS_RX][IFS_PROTO_OTHER].bytes,
+                        dc->bpc[1][IFS_RX][IFS_PROTO_OTHER].packets,
+                        dc->bpc[1][IFS_TX][IFS_TCP].bytes,
+                        dc->bpc[1][IFS_TX][IFS_TCP].packets,
+                        dc->bpc[1][IFS_TX][IFS_UDP].bytes,
+                        dc->bpc[1][IFS_TX][IFS_UDP].packets,
+                        dc->bpc[1][IFS_TX][IFS_PROTO_OTHER].bytes,
+                        dc->bpc[1][IFS_TX][IFS_PROTO_OTHER].packets);
+        else
+                res = kasprintf(GFP_ATOMIC, "data_counters@%p{...}", dc);
+        _bug_on_err_or_null(res);
+        return res;
+}
+
+char *pp_tag_node(struct tag_node *tn)
+{
+        char *tag_str;
+        char *res;
+
+        if (!tn) {
+                res = kasprintf(GFP_ATOMIC, "tag_node@null{}");
+                _bug_on_err_or_null(res);
+                return res;
+        }
+        tag_str = pp_tag_t(&tn->tag);
+        res = kasprintf(GFP_ATOMIC,
+                        "tag_node@%p{tag=%s}",
+                        tn, tag_str);
+        _bug_on_err_or_null(res);
+        kfree(tag_str);
+        return res;
+}
+
+char *pp_tag_ref(struct tag_ref *tr)
+{
+        char *tn_str;
+        char *res;
+
+        if (!tr) {
+                res = kasprintf(GFP_ATOMIC, "tag_ref@null{}");
+                _bug_on_err_or_null(res);
+                return res;
+        }
+        tn_str = pp_tag_node(&tr->tn);
+        res = kasprintf(GFP_ATOMIC,
+                        "tag_ref@%p{%s, num_sock_tags=%d}",
+                        tr, tn_str, tr->num_sock_tags);
+        _bug_on_err_or_null(res);
+        kfree(tn_str);
+        return res;
+}
+
+char *pp_tag_stat(struct tag_stat *ts)
+{
+        char *tn_str;
+        char *counters_str;
+        char *parent_counters_str;
+        char *res;
+
+        if (!ts) {
+                res = kasprintf(GFP_ATOMIC, "tag_stat@null{}");
+                _bug_on_err_or_null(res);
+                return res;
+        }
+        tn_str = pp_tag_node(&ts->tn);
+        counters_str = pp_data_counters(&ts->counters, true);
+        parent_counters_str = pp_data_counters(ts->parent_counters, false);
+        res = kasprintf(GFP_ATOMIC,
+                        "tag_stat@%p{%s, counters=%s, parent_counters=%s}",
+                        ts, tn_str, counters_str, parent_counters_str);
+        _bug_on_err_or_null(res);
+        kfree(tn_str);
+        kfree(counters_str);
+        kfree(parent_counters_str);
+        return res;
+}
+
+char *pp_iface_stat(struct iface_stat *is)
+{
+        char *res;
+        if (!is)
+                res = kasprintf(GFP_ATOMIC, "iface_stat@null{}");
+        else
+                res = kasprintf(GFP_ATOMIC, "iface_stat@%p{"
+                                "list=list_head{...}, "
+                                "ifname=%s, "
+                                "total={rx={bytes=%llu, "
+                                "packets=%llu}, "
+                                "tx={bytes=%llu, "
+                                "packets=%llu}}, "
+                                "last_known_valid=%d, "
+                                "last_known={rx={bytes=%llu, "
+                                "packets=%llu}, "
+                                "tx={bytes=%llu, "
+                                "packets=%llu}}, "
+                                "active=%d, "
+                                "net_dev=%p, "
+                                "proc_ptr=%p, "
+                                "tag_stat_tree=rb_root{...}}",
+                                is,
+                                is->ifname,
+                                is->totals[IFS_RX].bytes,
+                                is->totals[IFS_RX].packets,
+                                is->totals[IFS_TX].bytes,
+                                is->totals[IFS_TX].packets,
+                                is->last_known_valid,
+                                is->last_known[IFS_RX].bytes,
+                                is->last_known[IFS_RX].packets,
+                                is->last_known[IFS_TX].bytes,
+                                is->last_known[IFS_TX].packets,
+                                is->active,
+                                is->net_dev,
+                                is->proc_ptr);
+        _bug_on_err_or_null(res);
+        return res;
+}
+
+char *pp_sock_tag(struct sock_tag *st)
+{
+        char *tag_str;
+        char *res;
+
+        if (!st) {
+                res = kasprintf(GFP_ATOMIC, "sock_tag@null{}");
+                _bug_on_err_or_null(res);
+                return res;
+        }
+        tag_str = pp_tag_t(&st->tag);
+        res = kasprintf(GFP_ATOMIC, "sock_tag@%p{"
+                        "sock_node=rb_node{...}, "
+                        "sk=%p socket=%p (f_count=%lu), list=list_head{...}, "
+                        "pid=%u, tag=%s}",
+                        st, st->sk, st->socket, atomic_long_read(
+                                &st->socket->file->f_count),
+                        st->pid, tag_str);
+        _bug_on_err_or_null(res);
+        kfree(tag_str);
+        return res;
+}
+
+char *pp_uid_tag_data(struct uid_tag_data *utd)
+{
+        char *res;
+
+        if (!utd)
+                res = kasprintf(GFP_ATOMIC, "uid_tag_data@null{}");
+        else
+                res = kasprintf(GFP_ATOMIC, "uid_tag_data@%p{"
+                                "uid=%u, num_active_acct_tags=%d, "
+                                "num_pqd=%d, "
+                                "tag_node_tree=rb_root{...}, "
+                                "proc_qtu_data_tree=rb_root{...}}",
+                                utd, utd->uid,
+                                utd->num_active_tags, utd->num_pqd);
+        _bug_on_err_or_null(res);
+        return res;
+}
+
+char *pp_proc_qtu_data(struct proc_qtu_data *pqd)
+{
+        char *parent_tag_data_str;
+        char *res;
+
+        if (!pqd) {
+                res = kasprintf(GFP_ATOMIC, "proc_qtu_data@null{}");
+                _bug_on_err_or_null(res);
+                return res;
+        }
+        parent_tag_data_str = pp_uid_tag_data(pqd->parent_tag_data);
+        res = kasprintf(GFP_ATOMIC, "proc_qtu_data@%p{"
+                        "node=rb_node{...}, pid=%u, "
+                        "parent_tag_data=%s, "
+                        "sock_tag_list=list_head{...}}",
+                        pqd, pqd->pid, parent_tag_data_str
+                );
+        _bug_on_err_or_null(res);
+        kfree(parent_tag_data_str);
+        return res;
+}
+
+/*------------------------------------------*/
+void prdebug_sock_tag_tree(int indent_level,
+                           struct rb_root *sock_tag_tree)
+{
+        struct rb_node *node;
+        struct sock_tag *sock_tag_entry;
+        char *str;
+
+        if (!unlikely(qtaguid_debug_mask & DDEBUG_MASK))
+                return;
+
+        if (RB_EMPTY_ROOT(sock_tag_tree)) {
+                str = "sock_tag_tree=rb_root{}";
+                pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+                return;
+        }
+
+        str = "sock_tag_tree=rb_root{";
+        pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+        indent_level++;
+        for (node = rb_first(sock_tag_tree);
+             node;
+             node = rb_next(node)) {
+                sock_tag_entry = rb_entry(node, struct sock_tag, sock_node);
+                str = pp_sock_tag(sock_tag_entry);
+                pr_debug("%*d: %s,\n", indent_level*2, indent_level, str);
+                kfree(str);
+        }
+        indent_level--;
+        str = "}";
+        pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+}
+
+void prdebug_sock_tag_list(int indent_level,
+                           struct list_head *sock_tag_list)
+{
+        struct sock_tag *sock_tag_entry;
+        char *str;
+
+        if (!unlikely(qtaguid_debug_mask & DDEBUG_MASK))
+                return;
+
+        if (list_empty(sock_tag_list)) {
+                str = "sock_tag_list=list_head{}";
+                pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+                return;
+        }
+
+        str = "sock_tag_list=list_head{";
+        pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+        indent_level++;
+        list_for_each_entry(sock_tag_entry, sock_tag_list, list) {
+                str = pp_sock_tag(sock_tag_entry);
+                pr_debug("%*d: %s,\n", indent_level*2, indent_level, str);
+                kfree(str);
+        }
+        indent_level--;
+        str = "}";
+        pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+}
+
+void prdebug_proc_qtu_data_tree(int indent_level,
+                                struct rb_root *proc_qtu_data_tree)
+{
+        char *str;
+        struct rb_node *node;
+        struct proc_qtu_data *proc_qtu_data_entry;
+
+        if (!unlikely(qtaguid_debug_mask & DDEBUG_MASK))
+                return;
+
+        if (RB_EMPTY_ROOT(proc_qtu_data_tree)) {
+                str = "proc_qtu_data_tree=rb_root{}";
+                pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+                return;
+        }
+
+        str = "proc_qtu_data_tree=rb_root{";
+        pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+        indent_level++;
+        for (node = rb_first(proc_qtu_data_tree);
+             node;
+             node = rb_next(node)) {
+                proc_qtu_data_entry = rb_entry(node,
+                                               struct proc_qtu_data,
+                                               node);
+                str = pp_proc_qtu_data(proc_qtu_data_entry);
+                pr_debug("%*d: %s,\n", indent_level*2, indent_level,
+                         str);
+                kfree(str);
+                indent_level++;
+                prdebug_sock_tag_list(indent_level,
+                                      &proc_qtu_data_entry->sock_tag_list);
+                indent_level--;
+
+        }
+        indent_level--;
+        str = "}";
+        pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+}
+
+void prdebug_tag_ref_tree(int indent_level, struct rb_root *tag_ref_tree)
+{
+        char *str;
+        struct rb_node *node;
+        struct tag_ref *tag_ref_entry;
+
+        if (!unlikely(qtaguid_debug_mask & DDEBUG_MASK))
+                return;
+
+        if (RB_EMPTY_ROOT(tag_ref_tree)) {
+                str = "tag_ref_tree{}";
+                pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+                return;
+        }
+
+        str = "tag_ref_tree{";
+        pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+        indent_level++;
+        for (node = rb_first(tag_ref_tree);
+             node;
+             node = rb_next(node)) {
+                tag_ref_entry = rb_entry(node,
+                                         struct tag_ref,
+                                         tn.node);
+                str = pp_tag_ref(tag_ref_entry);
+                pr_debug("%*d: %s,\n", indent_level*2, indent_level,
+                         str);
+                kfree(str);
+        }
+        indent_level--;
+        str = "}";
+        pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+}
+
+void prdebug_uid_tag_data_tree(int indent_level,
+                               struct rb_root *uid_tag_data_tree)
+{
+        char *str;
+        struct rb_node *node;
+        struct uid_tag_data *uid_tag_data_entry;
+
+        if (!unlikely(qtaguid_debug_mask & DDEBUG_MASK))
+                return;
+
+        if (RB_EMPTY_ROOT(uid_tag_data_tree)) {
+                str = "uid_tag_data_tree=rb_root{}";
+                pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+                return;
+        }
+
+        str = "uid_tag_data_tree=rb_root{";
+        pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+        indent_level++;
+        for (node = rb_first(uid_tag_data_tree);
+             node;
+             node = rb_next(node)) {
+                uid_tag_data_entry = rb_entry(node, struct uid_tag_data,
+                                              node);
+                str = pp_uid_tag_data(uid_tag_data_entry);
+                pr_debug("%*d: %s,\n", indent_level*2, indent_level, str);
+                kfree(str);
+                if (!RB_EMPTY_ROOT(&uid_tag_data_entry->tag_ref_tree)) {
+                        indent_level++;
+                        prdebug_tag_ref_tree(indent_level,
+                                             &uid_tag_data_entry->tag_ref_tree);
+                        indent_level--;
+                }
+        }
+        indent_level--;
+        str = "}";
+        pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+}
+
+void prdebug_tag_stat_tree(int indent_level,
+                                  struct rb_root *tag_stat_tree)
+{
+        char *str;
+        struct rb_node *node;
+        struct tag_stat *ts_entry;
+
+        if (!unlikely(qtaguid_debug_mask & DDEBUG_MASK))
+                return;
+
+        if (RB_EMPTY_ROOT(tag_stat_tree)) {
+                str = "tag_stat_tree{}";
+                pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+                return;
+        }
+
+        str = "tag_stat_tree{";
+        pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+        indent_level++;
+        for (node = rb_first(tag_stat_tree);
+             node;
+             node = rb_next(node)) {
+                ts_entry = rb_entry(node, struct tag_stat, tn.node);
+                str = pp_tag_stat(ts_entry);
+                pr_debug("%*d: %s\n", indent_level*2, indent_level,
+                         str);
+                kfree(str);
+        }
+        indent_level--;
+        str = "}";
+        pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+}
+
+void prdebug_iface_stat_list(int indent_level,
+                             struct list_head *iface_stat_list)
+{
+        char *str;
+        struct iface_stat *iface_entry;
+
+        if (!unlikely(qtaguid_debug_mask & DDEBUG_MASK))
+                return;
+
+        if (list_empty(iface_stat_list)) {
+                str = "iface_stat_list=list_head{}";
+                pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+                return;
+        }
+
+        str = "iface_stat_list=list_head{";
+        pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+        indent_level++;
+        list_for_each_entry(iface_entry, iface_stat_list, list) {
+                str = pp_iface_stat(iface_entry);
+                pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+                kfree(str);
+
+                spin_lock_bh(&iface_entry->tag_stat_list_lock);
+                if (!RB_EMPTY_ROOT(&iface_entry->tag_stat_tree)) {
+                        indent_level++;
+                        prdebug_tag_stat_tree(indent_level,
+                                              &iface_entry->tag_stat_tree);
+                        indent_level--;
+                }
+                spin_unlock_bh(&iface_entry->tag_stat_list_lock);
+        }
+        indent_level--;
+        str = "}";
+        pr_debug("%*d: %s\n", indent_level*2, indent_level, str);
+}
+
+#endif  /* ifdef DDEBUG */
+/*------------------------------------------*/
+static const char * const netdev_event_strings[] = {
+        "netdev_unknown",
+        "NETDEV_UP",
+        "NETDEV_DOWN",
+        "NETDEV_REBOOT",
+        "NETDEV_CHANGE",
+        "NETDEV_REGISTER",
+        "NETDEV_UNREGISTER",
+        "NETDEV_CHANGEMTU",
+        "NETDEV_CHANGEADDR",
+        "NETDEV_GOING_DOWN",
+        "NETDEV_CHANGENAME",
+        "NETDEV_FEAT_CHANGE",
+        "NETDEV_BONDING_FAILOVER",
+        "NETDEV_PRE_UP",
+        "NETDEV_PRE_TYPE_CHANGE",
+        "NETDEV_POST_TYPE_CHANGE",
+        "NETDEV_POST_INIT",
+        "NETDEV_UNREGISTER_BATCH",
+        "NETDEV_RELEASE",
+        "NETDEV_NOTIFY_PEERS",
+        "NETDEV_JOIN",
+};
+
+const char *netdev_evt_str(int netdev_event)
+{
+        if (netdev_event < 0
+            || netdev_event >= ARRAY_SIZE(netdev_event_strings))
+                return "bad event num";
+        return netdev_event_strings[netdev_event];
+}
diff --git a/net/netfilter/xt_qtaguid_print.h b/net/netfilter/xt_qtaguid_print.h
new file mode 100644
index 00000000000..b63871a0be5
--- /dev/null
+++ b/net/netfilter/xt_qtaguid_print.h
@@ -0,0 +1,120 @@
+/*
+ * Pretty printing Support for iptables xt_qtaguid module.
+ *
+ * (C) 2011 Google, Inc
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#ifndef __XT_QTAGUID_PRINT_H__
+#define __XT_QTAGUID_PRINT_H__
+
+#include "xt_qtaguid_internal.h"
+
+#ifdef DDEBUG
+
+char *pp_tag_t(tag_t *tag);
+char *pp_data_counters(struct data_counters *dc, bool showValues);
+char *pp_tag_node(struct tag_node *tn);
+char *pp_tag_ref(struct tag_ref *tr);
+char *pp_tag_stat(struct tag_stat *ts);
+char *pp_iface_stat(struct iface_stat *is);
+char *pp_sock_tag(struct sock_tag *st);
+char *pp_uid_tag_data(struct uid_tag_data *qtd);
+char *pp_proc_qtu_data(struct proc_qtu_data *pqd);
+
+/*------------------------------------------*/
+void prdebug_sock_tag_list(int indent_level,
+                           struct list_head *sock_tag_list);
+void prdebug_sock_tag_tree(int indent_level,
+                           struct rb_root *sock_tag_tree);
+void prdebug_proc_qtu_data_tree(int indent_level,
+                                struct rb_root *proc_qtu_data_tree);
+void prdebug_tag_ref_tree(int indent_level, struct rb_root *tag_ref_tree);
+void prdebug_uid_tag_data_tree(int indent_level,
+                               struct rb_root *uid_tag_data_tree);
+void prdebug_tag_stat_tree(int indent_level,
+                           struct rb_root *tag_stat_tree);
+void prdebug_iface_stat_list(int indent_level,
+                             struct list_head *iface_stat_list);
+
+#else
+
+/*------------------------------------------*/
+static inline char *pp_tag_t(tag_t *tag)
+{
+        return NULL;
+}
+static inline char *pp_data_counters(struct data_counters *dc, bool showValues)
+{
+        return NULL;
+}
+static inline char *pp_tag_node(struct tag_node *tn)
+{
+        return NULL;
+}
+static inline char *pp_tag_ref(struct tag_ref *tr)
+{
+        return NULL;
+}
+static inline char *pp_tag_stat(struct tag_stat *ts)
+{
+        return NULL;
+}
+static inline char *pp_iface_stat(struct iface_stat *is)
+{
+        return NULL;
+}
+static inline char *pp_sock_tag(struct sock_tag *st)
+{
+        return NULL;
+}
+static inline char *pp_uid_tag_data(struct uid_tag_data *qtd)
+{
+        return NULL;
+}
+static inline char *pp_proc_qtu_data(struct proc_qtu_data *pqd)
+{
+        return NULL;
+}
+
+/*------------------------------------------*/
+static inline
+void prdebug_sock_tag_list(int indent_level,
+                           struct list_head *sock_tag_list)
+{
+}
+static inline
+void prdebug_sock_tag_tree(int indent_level,
+                           struct rb_root *sock_tag_tree)
+{
+}
+static inline
+void prdebug_proc_qtu_data_tree(int indent_level,
+                                struct rb_root *proc_qtu_data_tree)
+{
+}
+static inline
+void prdebug_tag_ref_tree(int indent_level, struct rb_root *tag_ref_tree)
+{
+}
+static inline
+void prdebug_uid_tag_data_tree(int indent_level,
+                               struct rb_root *uid_tag_data_tree)
+{
+}
+static inline
+void prdebug_tag_stat_tree(int indent_level,
+                           struct rb_root *tag_stat_tree)
+{
+}
+static inline
+void prdebug_iface_stat_list(int indent_level,
+                             struct list_head *iface_stat_list)
+{
+}
+#endif
+/*------------------------------------------*/
+const char *netdev_evt_str(int netdev_event);
+#endif  /* ifndef __XT_QTAGUID_PRINT_H__ */
diff --git a/net/netfilter/xt_quota2.c b/net/netfilter/xt_quota2.c
new file mode 100644
index 00000000000..3c72bea2dd6
--- /dev/null
+++ b/net/netfilter/xt_quota2.c
@@ -0,0 +1,381 @@
+/*
+ * xt_quota2 - enhanced xt_quota that can count upwards and in packets
+ * as a minimal accounting match.
+ * by Jan Engelhardt <jengelh@medozas.de>, 2008
+ *
+ * Originally based on xt_quota.c:
+ *      netfilter module to enforce network quotas
+ *      Sam Johnston <samj@samj.net>
+ *
+ *      This program is free software; you can redistribute it and/or modify
+ *      it under the terms of the GNU General Public License; either
+ *      version 2 of the License, as published by the Free Software Foundation.
+ */
+#include <linux/list.h>
+#include <linux/proc_fs.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <asm/atomic.h>
+
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_quota2.h>
+#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
+#include <linux/netfilter_ipv4/ipt_ULOG.h>
+#endif
+
+/**
+ * @lock:       lock to protect quota writers from each other
+ */
+struct xt_quota_counter {
+        u_int64_t quota;
+        spinlock_t lock;
+        struct list_head list;
+        atomic_t ref;
+        char name[sizeof(((struct xt_quota_mtinfo2 *)NULL)->name)];
+        struct proc_dir_entry *procfs_entry;
+};
+
+#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
+/* Harald's favorite number +1 :D From ipt_ULOG.C */
+static int qlog_nl_event = 112;
+module_param_named(event_num, qlog_nl_event, uint, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(event_num,
+                 "Event number for NETLINK_NFLOG message. 0 disables log."
+                 "111 is what ipt_ULOG uses.");
+static struct sock *nflognl;
+#endif
+
+static LIST_HEAD(counter_list);
+static DEFINE_SPINLOCK(counter_list_lock);
+
+static struct proc_dir_entry *proc_xt_quota;
+static unsigned int quota_list_perms = S_IRUGO | S_IWUSR;
+static unsigned int quota_list_uid   = 0;
+static unsigned int quota_list_gid   = 0;
+module_param_named(perms, quota_list_perms, uint, S_IRUGO | S_IWUSR);
+module_param_named(uid, quota_list_uid, uint, S_IRUGO | S_IWUSR);
+module_param_named(gid, quota_list_gid, uint, S_IRUGO | S_IWUSR);
+
+
+#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
+static void quota2_log(unsigned int hooknum,
+                       const struct sk_buff *skb,
+                       const struct net_device *in,
+                       const struct net_device *out,
+                       const char *prefix)
+{
+        ulog_packet_msg_t *pm;
+        struct sk_buff *log_skb;
+        size_t size;
+        struct nlmsghdr *nlh;
+
+        if (!qlog_nl_event)
+                return;
+
+        size = NLMSG_SPACE(sizeof(*pm));
+        size = max(size, (size_t)NLMSG_GOODSIZE);
+        log_skb = alloc_skb(size, GFP_ATOMIC);
+        if (!log_skb) {
+                pr_err("xt_quota2: cannot alloc skb for logging\n");
+                return;
+        }
+
+        /* NLMSG_PUT() uses "goto nlmsg_failure" */
+        nlh = NLMSG_PUT(log_skb, /*pid*/0, /*seq*/0, qlog_nl_event,
+                        sizeof(*pm));
+        pm = NLMSG_DATA(nlh);
+        if (skb->tstamp.tv64 == 0)
+                __net_timestamp((struct sk_buff *)skb);
+        pm->data_len = 0;
+        pm->hook = hooknum;
+        if (prefix != NULL)
+                strlcpy(pm->prefix, prefix, sizeof(pm->prefix));
+        else
+                *(pm->prefix) = '\0';
+        if (in)
+                strlcpy(pm->indev_name, in->name, sizeof(pm->indev_name));
+        else
+                pm->indev_name[0] = '\0';
+
+        if (out)
+                strlcpy(pm->outdev_name, out->name, sizeof(pm->outdev_name));
+        else
+                pm->outdev_name[0] = '\0';
+
+        NETLINK_CB(log_skb).dst_group = 1;
+        pr_debug("throwing 1 packets to netlink group 1\n");
+        netlink_broadcast(nflognl, log_skb, 0, 1, GFP_ATOMIC);
+
+nlmsg_failure:  /* Used within NLMSG_PUT() */
+        pr_debug("xt_quota2: error during NLMSG_PUT\n");
+}
+#else
+static void quota2_log(unsigned int hooknum,
+                       const struct sk_buff *skb,
+                       const struct net_device *in,
+                       const struct net_device *out,
+                       const char *prefix)
+{
+}
+#endif  /* if+else CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG */
+
+static int quota_proc_read(char *page, char **start, off_t offset,
+                           int count, int *eof, void *data)
+{
+        struct xt_quota_counter *e = data;
+        int ret;
+
+        spin_lock_bh(&e->lock);
+        ret = snprintf(page, PAGE_SIZE, "%llu\n", e->quota);
+        spin_unlock_bh(&e->lock);
+        return ret;
+}
+
+static int quota_proc_write(struct file *file, const char __user *input,
+                            unsigned long size, void *data)
+{
+        struct xt_quota_counter *e = data;
+        char buf[sizeof("18446744073709551616")];
+
+        if (size > sizeof(buf))
+                size = sizeof(buf);
+        if (copy_from_user(buf, input, size) != 0)
+                return -EFAULT;
+        buf[sizeof(buf)-1] = '\0';
+
+        spin_lock_bh(&e->lock);
+        e->quota = simple_strtoull(buf, NULL, 0);
+        spin_unlock_bh(&e->lock);
+        return size;
+}
+
+static struct xt_quota_counter *
+q2_new_counter(const struct xt_quota_mtinfo2 *q, bool anon)
+{
+        struct xt_quota_counter *e;
+        unsigned int size;
+
+        /* Do not need all the procfs things for anonymous counters. */
+        size = anon ? offsetof(typeof(*e), list) : sizeof(*e);
+        e = kmalloc(size, GFP_KERNEL);
+        if (e == NULL)
+                return NULL;
+
+        e->quota = q->quota;
+        spin_lock_init(&e->lock);
+        if (!anon) {
+                INIT_LIST_HEAD(&e->list);
+                atomic_set(&e->ref, 1);
+                strlcpy(e->name, q->name, sizeof(e->name));
+        }
+        return e;
+}
+
+/**
+ * q2_get_counter - get ref to counter or create new
+ * @name:       name of counter
+ */
+static struct xt_quota_counter *
+q2_get_counter(const struct xt_quota_mtinfo2 *q)
+{
+        struct proc_dir_entry *p;
+        struct xt_quota_counter *e = NULL;
+        struct xt_quota_counter *new_e;
+
+        if (*q->name == '\0')
+                return q2_new_counter(q, true);
+
+        /* No need to hold a lock while getting a new counter */
+        new_e = q2_new_counter(q, false);
+        if (new_e == NULL)
+                goto out;
+
+        spin_lock_bh(&counter_list_lock);
+        list_for_each_entry(e, &counter_list, list)
+                if (strcmp(e->name, q->name) == 0) {
+                        atomic_inc(&e->ref);
+                        spin_unlock_bh(&counter_list_lock);
+                        kfree(new_e);
+                        pr_debug("xt_quota2: old counter name=%s", e->name);
+                        return e;
+                }
+        e = new_e;
+        pr_debug("xt_quota2: new_counter name=%s", e->name);
+        list_add_tail(&e->list, &counter_list);
+        /* The entry having a refcount of 1 is not directly destructible.
+         * This func has not yet returned the new entry, thus iptables
+         * has not references for destroying this entry.
+         * For another rule to try to destroy it, it would 1st need for this
+         * func* to be re-invoked, acquire a new ref for the same named quota.
+         * Nobody will access the e->procfs_entry either.
+         * So release the lock. */
+        spin_unlock_bh(&counter_list_lock);
+
+        /* create_proc_entry() is not spin_lock happy */
+        p = e->procfs_entry = create_proc_entry(e->name, quota_list_perms,
+                              proc_xt_quota);
+
+        if (IS_ERR_OR_NULL(p)) {
+                spin_lock_bh(&counter_list_lock);
+                list_del(&e->list);
+                spin_unlock_bh(&counter_list_lock);
+                goto out;
+        }
+        p->data         = e;
+        p->read_proc    = quota_proc_read;
+        p->write_proc   = quota_proc_write;
+        p->uid          = quota_list_uid;
+        p->gid          = quota_list_gid;
+        return e;
+
+ out:
+        kfree(e);
+        return NULL;
+}
+
+static int quota_mt2_check(const struct xt_mtchk_param *par)
+{
+        struct xt_quota_mtinfo2 *q = par->matchinfo;
+
+        pr_debug("xt_quota2: check() flags=0x%04x", q->flags);
+
+        if (q->flags & ~XT_QUOTA_MASK)
+                return -EINVAL;
+
+        q->name[sizeof(q->name)-1] = '\0';
+        if (*q->name == '.' || strchr(q->name, '/') != NULL) {
+                printk(KERN_ERR "xt_quota.3: illegal name\n");
+                return -EINVAL;
+        }
+
+        q->master = q2_get_counter(q);
+        if (q->master == NULL) {
+                printk(KERN_ERR "xt_quota.3: memory alloc failure\n");
+                return -ENOMEM;
+        }
+
+        return 0;
+}
+
+static void quota_mt2_destroy(const struct xt_mtdtor_param *par)
+{
+        struct xt_quota_mtinfo2 *q = par->matchinfo;
+        struct xt_quota_counter *e = q->master;
+
+        if (*q->name == '\0') {
+                kfree(e);
+                return;
+        }
+
+        spin_lock_bh(&counter_list_lock);
+        if (!atomic_dec_and_test(&e->ref)) {
+                spin_unlock_bh(&counter_list_lock);
+                return;
+        }
+
+        list_del(&e->list);
+        remove_proc_entry(e->name, proc_xt_quota);
+        spin_unlock_bh(&counter_list_lock);
+        kfree(e);
+}
+
+static bool
+quota_mt2(const struct sk_buff *skb, struct xt_action_param *par)
+{
+        struct xt_quota_mtinfo2 *q = (void *)par->matchinfo;
+        struct xt_quota_counter *e = q->master;
+        bool ret = q->flags & XT_QUOTA_INVERT;
+
+        spin_lock_bh(&e->lock);
+        if (q->flags & XT_QUOTA_GROW) {
+                /*
+                 * While no_change is pointless in "grow" mode, we will
+                 * implement it here simply to have a consistent behavior.
+                 */
+                if (!(q->flags & XT_QUOTA_NO_CHANGE)) {
+                        e->quota += (q->flags & XT_QUOTA_PACKET) ? 1 : skb->len;
+                }
+                ret = true;
+        } else {
+                if (e->quota >= skb->len) {
+                        if (!(q->flags & XT_QUOTA_NO_CHANGE))
+                                e->quota -= (q->flags & XT_QUOTA_PACKET) ? 1 : skb->len;
+                        ret = !ret;
+                } else {
+                        /* We are transitioning, log that fact. */
+                        if (e->quota) {
+                                quota2_log(par->hooknum,
+                                           skb,
+                                           par->in,
+                                           par->out,
+                                           q->name);
+                        }
+                        /* we do not allow even small packets from now on */
+                        e->quota = 0;
+                }
+        }
+        spin_unlock_bh(&e->lock);
+        return ret;
+}
+
+static struct xt_match quota_mt2_reg[] __read_mostly = {
+        {
+                .name       = "quota2",
+                .revision   = 3,
+                .family     = NFPROTO_IPV4,
+                .checkentry = quota_mt2_check,
+                .match      = quota_mt2,
+                .destroy    = quota_mt2_destroy,
+                .matchsize  = sizeof(struct xt_quota_mtinfo2),
+                .me         = THIS_MODULE,
+        },
+        {
+                .name       = "quota2",
+                .revision   = 3,
+                .family     = NFPROTO_IPV6,
+                .checkentry = quota_mt2_check,
+                .match      = quota_mt2,
+                .destroy    = quota_mt2_destroy,
+                .matchsize  = sizeof(struct xt_quota_mtinfo2),
+                .me         = THIS_MODULE,
+        },
+};
+
+static int __init quota_mt2_init(void)
+{
+        int ret;
+        pr_debug("xt_quota2: init()");
+
+#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
+        nflognl = netlink_kernel_create(&init_net,
+                                        NETLINK_NFLOG, 1, NULL,
+                                        NULL, THIS_MODULE);
+        if (!nflognl)
+                return -ENOMEM;
+#endif
+
+        proc_xt_quota = proc_mkdir("xt_quota", init_net.proc_net);
+        if (proc_xt_quota == NULL)
+                return -EACCES;
+
+        ret = xt_register_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
+        if (ret < 0)
+                remove_proc_entry("xt_quota", init_net.proc_net);
+        pr_debug("xt_quota2: init() %d", ret);
+        return ret;
+}
+
+static void __exit quota_mt2_exit(void)
+{
+        xt_unregister_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
+        remove_proc_entry("xt_quota", init_net.proc_net);
+}
+
+module_init(quota_mt2_init);
+module_exit(quota_mt2_exit);
+MODULE_DESCRIPTION("Xtables: countdown quota match; up counter");
+MODULE_AUTHOR("Sam Johnston <samj@samj.net>");
+MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("ipt_quota2");
+MODULE_ALIAS("ip6t_quota2");
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index fe39f7e913d..ddf5e0507f5 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -35,7 +35,7 @@
 #include <net/netfilter/nf_conntrack.h>
 #endif
 
-static void
+void
 xt_socket_put_sk(struct sock *sk)
 {
         if (sk->sk_state == TCP_TIME_WAIT)
@@ -43,6 +43,7 @@ xt_socket_put_sk(struct sock *sk)
         else
                 sock_put(sk);
 }
+EXPORT_SYMBOL(xt_socket_put_sk);
 
 static int
 extract_icmp4_fields(const struct sk_buff *skb,
@@ -101,9 +102,8 @@ extract_icmp4_fields(const struct sk_buff *skb,
         return 0;
 }
 
-static bool
-socket_match(const struct sk_buff *skb, struct xt_action_param *par,
-             const struct xt_socket_mtinfo1 *info)
+struct sock*
+xt_socket_get4_sk(const struct sk_buff *skb, struct xt_action_param *par)
 {
         const struct iphdr *iph = ip_hdr(skb);
         struct udphdr _hdr, *hp = NULL;
@@ -120,7 +120,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
                 hp = skb_header_pointer(skb, ip_hdrlen(skb),
                                         sizeof(_hdr), &_hdr);
                 if (hp == NULL)
-                        return false;
+                        return NULL;
 
                 protocol = iph->protocol;
                 saddr = iph->saddr;
@@ -131,9 +131,9 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
         } else if (iph->protocol == IPPROTO_ICMP) {
                 if (extract_icmp4_fields(skb, &protocol, &saddr, &daddr,
                                         &sport, &dport))
-                        return false;
+                        return NULL;
         } else {
-                return false;
+                return NULL;
         }
 
 #ifdef XT_SOCKET_HAVE_CONNTRACK
@@ -157,6 +157,23 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
 
         sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol,
                                    saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY);
+
+        pr_debug("proto %hhu %pI4:%hu -> %pI4:%hu (orig %pI4:%hu) sock %p\n",
+                 protocol, &saddr, ntohs(sport),
+                 &daddr, ntohs(dport),
+                 &iph->daddr, hp ? ntohs(hp->dest) : 0, sk);
+
+        return sk;
+}
+EXPORT_SYMBOL(xt_socket_get4_sk);
+
+static bool
+socket_match(const struct sk_buff *skb, struct xt_action_param *par,
+             const struct xt_socket_mtinfo1 *info)
+{
+        struct sock *sk;
+
+        sk = xt_socket_get4_sk(skb, par);
         if (sk != NULL) {
                 bool wildcard;
                 bool transparent = true;
@@ -179,11 +196,6 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
                         sk = NULL;
         }
 
-        pr_debug("proto %hhu %pI4:%hu -> %pI4:%hu (orig %pI4:%hu) sock %p\n",
-                 protocol, &saddr, ntohs(sport),
-                 &daddr, ntohs(dport),
-                 &iph->daddr, hp ? ntohs(hp->dest) : 0, sk);
-
         return (sk != NULL);
 }
 
@@ -253,8 +265,8 @@ extract_icmp6_fields(const struct sk_buff *skb,
         return 0;
 }
 
-static bool
-socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
+struct sock*
+xt_socket_get6_sk(const struct sk_buff *skb, struct xt_action_param *par)
 {
         struct ipv6hdr *iph = ipv6_hdr(skb);
         struct udphdr _hdr, *hp = NULL;
@@ -262,7 +274,6 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
         struct in6_addr *daddr, *saddr;
         __be16 dport, sport;
         int thoff, tproto;
-        const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
 
         tproto = ipv6_find_hdr(skb, &thoff, -1, NULL);
         if (tproto < 0) {
@@ -274,7 +285,7 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
                 hp = skb_header_pointer(skb, thoff,
                                         sizeof(_hdr), &_hdr);
                 if (hp == NULL)
-                        return false;
+                        return NULL;
 
                 saddr = &iph->saddr;
                 sport = hp->source;
@@ -284,13 +295,30 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
         } else if (tproto == IPPROTO_ICMPV6) {
                 if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr,
                                          &sport, &dport))
-                        return false;
+                        return NULL;
         } else {
-                return false;
+                return NULL;
         }
 
         sk = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto,
                                    saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY);
+        pr_debug("proto %hhd %pI6:%hu -> %pI6:%hu "
+                 "(orig %pI6:%hu) sock %p\n",
+                 tproto, saddr, ntohs(sport),
+                 daddr, ntohs(dport),
+                 &iph->daddr, hp ? ntohs(hp->dest) : 0, sk);
+        return sk;
+}
+EXPORT_SYMBOL(xt_socket_get6_sk);
+
+static bool
+socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
+{
+        struct sock *sk;
+        const struct xt_socket_mtinfo1 *info;
+
+        info = (struct xt_socket_mtinfo1 *) par->matchinfo;
+        sk = xt_socket_get6_sk(skb, par);
         if (sk != NULL) {
                 bool wildcard;
                 bool transparent = true;
@@ -313,12 +341,6 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
                         sk = NULL;
         }
 
-        pr_debug("proto %hhd %pI6:%hu -> %pI6:%hu "
-                 "(orig %pI6:%hu) sock %p\n",
-                 tproto, saddr, ntohs(sport),
-                 daddr, ntohs(dport),
-                 &iph->daddr, hp ? ntohs(hp->dest) : 0, sk);
-
         return (sk != NULL);
 }
 #endif
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 6ef64adf736..24bc620b539 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -830,12 +830,19 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
         return 0;
 }
 
-int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
+static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
 {
         int len = skb->len;
 
         skb_queue_tail(&sk->sk_receive_queue, skb);
         sk->sk_data_ready(sk, len);
+        return len;
+}
+
+int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
+{
+        int len = __netlink_sendskb(sk, skb);
+
         sock_put(sk);
         return len;
 }
@@ -960,8 +967,7 @@ static inline int netlink_broadcast_deliver(struct sock *sk,
         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
             !test_bit(0, &nlk->state)) {
                 skb_set_owner_r(skb, sk);
-                skb_queue_tail(&sk->sk_receive_queue, skb);
-                sk->sk_data_ready(sk, skb->len);
+                __netlink_sendskb(sk, skb);
                 return atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf;
         }
         return -1;
@@ -1682,10 +1688,8 @@ static int netlink_dump(struct sock *sk)
 
                 if (sk_filter(sk, skb))
                         kfree_skb(skb);
-                else {
-                        skb_queue_tail(&sk->sk_receive_queue, skb);
-                        sk->sk_data_ready(sk, skb->len);
-                }
+                else
+                        __netlink_sendskb(sk, skb);
                 return 0;
         }
 
@@ -1697,10 +1701,8 @@ static int netlink_dump(struct sock *sk)
 
         if (sk_filter(sk, skb))
                 kfree_skb(skb);
-        else {
-                skb_queue_tail(&sk->sk_receive_queue, skb);
-                sk->sk_data_ready(sk, skb->len);
-        }
+        else
+                __netlink_sendskb(sk, skb);
 
         if (cb->done)
                 cb->done(cb);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index c0c3cda1971..fafb96830e7 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -654,7 +654,10 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
         return 0;
 
 drop_n_acct:
-        po->stats.tp_drops = atomic_inc_return(&sk->sk_drops);
+        spin_lock(&sk->sk_receive_queue.lock);
+        po->stats.tp_drops++;
+        atomic_inc(&sk->sk_drops);
+        spin_unlock(&sk->sk_receive_queue.lock);
 
 drop_n_restore:
         if (skb_head != skb->data && skb_shared(skb)) {
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index f17fd841f94..d29a7fb3f61 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -1045,6 +1045,9 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
         int flags = msg->msg_flags;
         int err, done;
 
+        if (len > USHRT_MAX)
+                return -EMSGSIZE;
+
         if ((msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL|
                                 MSG_CMSG_COMPAT)) ||
                         !(msg->msg_flags & MSG_EOR))
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index bb6ad81b671..424ff622ab5 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -68,7 +68,6 @@ static int rds_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
         struct rds_sock *rs;
-        unsigned long flags;
 
         if (!sk)
                 goto out;
@@ -94,10 +93,10 @@ static int rds_release(struct socket *sock)
         rds_rdma_drop_keys(rs);
         rds_notify_queue_get(rs, NULL);
 
-        spin_lock_irqsave(&rds_sock_lock, flags);
+        spin_lock_bh(&rds_sock_lock);
         list_del_init(&rs->rs_item);
         rds_sock_count--;
-        spin_unlock_irqrestore(&rds_sock_lock, flags);
+        spin_unlock_bh(&rds_sock_lock);
 
         rds_trans_put(rs->rs_transport);
 
@@ -409,7 +408,6 @@ static const struct proto_ops rds_proto_ops = {
 
 static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
 {
-        unsigned long flags;
         struct rds_sock *rs;
 
         sock_init_data(sock, sk);
@@ -426,10 +424,10 @@ static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
         spin_lock_init(&rs->rs_rdma_lock);
         rs->rs_rdma_keys = RB_ROOT;
 
-        spin_lock_irqsave(&rds_sock_lock, flags);
+        spin_lock_bh(&rds_sock_lock);
         list_add_tail(&rs->rs_item, &rds_sock_list);
         rds_sock_count++;
-        spin_unlock_irqrestore(&rds_sock_lock, flags);
+        spin_unlock_bh(&rds_sock_lock);
 
         return 0;
 }
@@ -471,12 +469,11 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
 {
         struct rds_sock *rs;
         struct rds_incoming *inc;
-        unsigned long flags;
         unsigned int total = 0;
 
         len /= sizeof(struct rds_info_message);
 
-        spin_lock_irqsave(&rds_sock_lock, flags);
+        spin_lock_bh(&rds_sock_lock);
 
         list_for_each_entry(rs, &rds_sock_list, rs_item) {
                 read_lock(&rs->rs_recv_lock);
@@ -492,7 +489,7 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
                 read_unlock(&rs->rs_recv_lock);
         }
 
-        spin_unlock_irqrestore(&rds_sock_lock, flags);
+        spin_unlock_bh(&rds_sock_lock);
 
         lens->nr = total;
         lens->each = sizeof(struct rds_info_message);
@@ -504,11 +501,10 @@ static void rds_sock_info(struct socket *sock, unsigned int len,
 {
         struct rds_info_socket sinfo;
         struct rds_sock *rs;
-        unsigned long flags;
 
         len /= sizeof(struct rds_info_socket);
 
-        spin_lock_irqsave(&rds_sock_lock, flags);
+        spin_lock_bh(&rds_sock_lock);
 
         if (len < rds_sock_count)
                 goto out;
@@ -529,7 +525,7 @@ out:
         lens->nr = rds_sock_count;
         lens->each = sizeof(struct rds_info_socket);
 
-        spin_unlock_irqrestore(&rds_sock_lock, flags);
+        spin_unlock_bh(&rds_sock_lock);
 }
 
 static void rds_exit(void)
diff --git a/net/rds/send.c b/net/rds/send.c
index d58ae5f9339..c803341f284 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -932,7 +932,6 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         /* Mirror Linux UDP mirror of BSD error message compatibility */
         /* XXX: Perhaps MSG_MORE someday */
         if (msg->msg_flags & ~(MSG_DONTWAIT | MSG_CMSG_COMPAT)) {
-                printk(KERN_INFO "msg_flags 0x%08X\n", msg->msg_flags);
                 ret = -EOPNOTSUPP;
                 goto out;
         }
diff --git a/net/rfkill/Kconfig b/net/rfkill/Kconfig
index 78efe895b66..8e12c8a2b82 100644
--- a/net/rfkill/Kconfig
+++ b/net/rfkill/Kconfig
@@ -10,6 +10,11 @@ menuconfig RFKILL
           To compile this driver as a module, choose M here: the
           module will be called rfkill.
 
+config RFKILL_PM
+        bool "Power off on suspend"
+        depends on RFKILL && PM
+        default y
+
 # LED trigger support
 config RFKILL_LEDS
         bool
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index be90640a277..df2dae6b272 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -769,6 +769,7 @@ void rfkill_pause_polling(struct rfkill *rfkill)
 }
 EXPORT_SYMBOL(rfkill_pause_polling);
 
+#ifdef CONFIG_RFKILL_PM
 void rfkill_resume_polling(struct rfkill *rfkill)
 {
         BUG_ON(!rfkill);
@@ -803,14 +804,17 @@ static int rfkill_resume(struct device *dev)
 
         return 0;
 }
+#endif
 
 static struct class rfkill_class = {
         .name           = "rfkill",
         .dev_release    = rfkill_release,
         .dev_attrs      = rfkill_dev_attrs,
         .dev_uevent     = rfkill_dev_uevent,
+#ifdef CONFIG_RFKILL_PM
         .suspend        = rfkill_suspend,
         .resume         = rfkill_resume,
+#endif
 };
 
 bool rfkill_blocked(struct rfkill *rfkill)
diff --git a/net/rose/rose_dev.c b/net/rose/rose_dev.c
index 178ff4f73c8..2679507ad33 100644
--- a/net/rose/rose_dev.c
+++ b/net/rose/rose_dev.c
@@ -96,11 +96,11 @@ static int rose_set_mac_address(struct net_device *dev, void *addr)
         struct sockaddr *sa = addr;
         int err;
 
-        if (!memcpy(dev->dev_addr, sa->sa_data, dev->addr_len))
+        if (!memcmp(dev->dev_addr, sa->sa_data, dev->addr_len))
                 return 0;
 
         if (dev->flags & IFF_UP) {
-                err = rose_add_loopback_node((rose_address *)dev->dev_addr);
+                err = rose_add_loopback_node((rose_address *)sa->sa_data);
                 if (err)
                         return err;
 
diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
index 06afbaeb4c8..178ee83175a 100644
--- a/net/sched/sch_choke.c
+++ b/net/sched/sch_choke.c
@@ -225,8 +225,7 @@ struct choke_skb_cb {
 
 static inline struct choke_skb_cb *choke_skb_cb(const struct sk_buff *skb)
 {
-        BUILD_BUG_ON(sizeof(skb->cb) <
-                sizeof(struct qdisc_skb_cb) + sizeof(struct choke_skb_cb));
+        qdisc_cb_private_validate(skb, sizeof(struct choke_skb_cb));
         return (struct choke_skb_cb *)qdisc_skb_cb(skb)->data;
 }
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index b4c680900d7..06d8a8fec68 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -246,6 +246,7 @@ static void dev_watchdog(unsigned long arg)
                                     time_after(jiffies, (trans_start +
                                                          dev->watchdog_timeo))) {
                                         some_queue_timedout = 1;
+                                        txq->trans_timeout++;
                                         break;
                                 }
                         }
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index b9493a09a87..e1afe0c205f 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -385,7 +385,7 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp,
         struct gred_sched_data *q;
 
         if (table->tab[dp] == NULL) {
-                table->tab[dp] = kzalloc(sizeof(*q), GFP_KERNEL);
+                table->tab[dp] = kzalloc(sizeof(*q), GFP_ATOMIC);
                 if (table->tab[dp] == NULL)
                         return -ENOMEM;
         }
@@ -544,11 +544,8 @@ static int gred_dump(struct Qdisc *sch, struct sk_buff *skb)
                 opt.packets     = q->packetsin;
                 opt.bytesin     = q->bytesin;
 
-                if (gred_wred_mode(table)) {
-                        q->parms.qidlestart =
-                                table->tab[table->def]->parms.qidlestart;
-                        q->parms.qavg = table->tab[table->def]->parms.qavg;
-                }
+                if (gred_wred_mode(table))
+                        gred_load_wred_set(table, q);
 
                 opt.qave = red_calc_qavg(&q->parms, q->parms.qavg);
 
diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index ea17cbed29e..59b26b8ff4b 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -106,7 +106,7 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt)
         if (!netif_is_multiqueue(dev))
                 return -EOPNOTSUPP;
 
-        if (nla_len(opt) < sizeof(*qopt))
+        if (!opt || nla_len(opt) < sizeof(*qopt))
                 return -EINVAL;
 
         qopt = nla_data(opt);
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 69c35f6cd13..945f3dd6c6f 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -117,8 +117,7 @@ struct netem_skb_cb {
 
 static inline struct netem_skb_cb *netem_skb_cb(struct sk_buff *skb)
 {
-        BUILD_BUG_ON(sizeof(skb->cb) <
-                sizeof(struct qdisc_skb_cb) + sizeof(struct netem_skb_cb));
+        qdisc_cb_private_validate(skb, sizeof(struct netem_skb_cb));
         return (struct netem_skb_cb *)qdisc_skb_cb(skb)->data;
 }
 
@@ -351,10 +350,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) {
                 if (!(skb = skb_unshare(skb, GFP_ATOMIC)) ||
                     (skb->ip_summed == CHECKSUM_PARTIAL &&
-                     skb_checksum_help(skb))) {
-                        sch->qstats.drops++;
-                        return NET_XMIT_DROP;
-                }
+                     skb_checksum_help(skb)))
+                        return qdisc_drop(skb, sch);
 
                 skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() % 8);
         }
@@ -382,8 +379,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 q->counter = 0;
 
                 __skb_queue_head(&q->qdisc->q, skb);
-                q->qdisc->qstats.backlog += qdisc_pkt_len(skb);
-                q->qdisc->qstats.requeues++;
+                sch->qstats.backlog += qdisc_pkt_len(skb);
+                sch->qstats.requeues++;
                 ret = NET_XMIT_SUCCESS;
         }
 
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 2a318f2dc3e..b5d56a22b1d 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -112,7 +112,7 @@ static struct sk_buff *prio_dequeue(struct Qdisc *sch)
 
         for (prio = 0; prio < q->bands; prio++) {
                 struct Qdisc *qdisc = q->queues[prio];
-                struct sk_buff *skb = qdisc->dequeue(qdisc);
+                struct sk_buff *skb = qdisc_dequeue_peeked(qdisc);
                 if (skb) {
                         qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
index 0a833d0c1f6..e85b248773e 100644
--- a/net/sched/sch_sfb.c
+++ b/net/sched/sch_sfb.c
@@ -93,8 +93,7 @@ struct sfb_skb_cb {
 
 static inline struct sfb_skb_cb *sfb_skb_cb(const struct sk_buff *skb)
 {
-        BUILD_BUG_ON(sizeof(skb->cb) <
-                sizeof(struct qdisc_skb_cb) + sizeof(struct sfb_skb_cb));
+        qdisc_cb_private_validate(skb, sizeof(struct sfb_skb_cb));
         return (struct sfb_skb_cb *)qdisc_skb_cb(skb)->data;
 }
 
@@ -557,6 +556,8 @@ static int sfb_dump(struct Qdisc *sch, struct sk_buff *skb)
 
         sch->qstats.backlog = q->qdisc->qstats.backlog;
         opts = nla_nest_start(skb, TCA_OPTIONS);
+        if (opts == NULL)
+                goto nla_put_failure;
         NLA_PUT(skb, TCA_SFB_PARMS, sizeof(opt), &opt);
         return nla_nest_end(skb, opts);
 
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index b6ea6afa55b..69400e3c69d 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -410,7 +410,12 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         /* Return Congestion Notification only if we dropped a packet
          * from this flow.
          */
-        return (qlen != slot->qlen) ? NET_XMIT_CN : NET_XMIT_SUCCESS;
+        if (qlen != slot->qlen)
+                return NET_XMIT_CN;
+
+        /* As we dropped a packet, better let upper stack know this */
+        qdisc_tree_decrease_qlen(sch, 1);
+        return NET_XMIT_SUCCESS;
 }
 
 static struct sk_buff *
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 45cd30098e3..4f4c52c0eeb 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -225,11 +225,11 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt)
 
 
 static int
-__teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res, struct net_device *dev)
+__teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res,
+               struct net_device *dev, struct netdev_queue *txq,
+               struct neighbour *mn)
 {
-        struct netdev_queue *dev_queue = netdev_get_tx_queue(dev, 0);
-        struct teql_sched_data *q = qdisc_priv(dev_queue->qdisc);
-        struct neighbour *mn = skb_dst(skb)->neighbour;
+        struct teql_sched_data *q = qdisc_priv(txq->qdisc);
         struct neighbour *n = q->ncache;
 
         if (mn->tbl == NULL)
@@ -262,17 +262,26 @@ __teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res, struct net_device *
 }
 
 static inline int teql_resolve(struct sk_buff *skb,
-                               struct sk_buff *skb_res, struct net_device *dev)
+                               struct sk_buff *skb_res,
+                               struct net_device *dev,
+                               struct netdev_queue *txq)
 {
-        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
+        struct dst_entry *dst = skb_dst(skb);
+        struct neighbour *mn;
+        int res;
+
         if (txq->qdisc == &noop_qdisc)
                 return -ENODEV;
 
-        if (dev->header_ops == NULL ||
-            skb_dst(skb) == NULL ||
-            skb_dst(skb)->neighbour == NULL)
+        if (!dev->header_ops || !dst)
                 return 0;
-        return __teql_resolve(skb, skb_res, dev);
+
+        rcu_read_lock();
+        mn = dst_get_neighbour(dst);
+        res = mn ? __teql_resolve(skb, skb_res, dev, txq, mn) : 0;
+        rcu_read_unlock();
+
+        return res;
 }
 
 static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
@@ -307,7 +316,7 @@ restart:
                         continue;
                 }
 
-                switch (teql_resolve(skb, skb_res, slave)) {
+                switch (teql_resolve(skb, skb_res, slave, slave_txq)) {
                 case 0:
                         if (__netif_tx_trylock(slave_txq)) {
                                 unsigned int length = qdisc_pkt_len(skb);
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 4a62888f2e4..17a6e658a4c 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -173,7 +173,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
         asoc->timeouts[SCTP_EVENT_TIMEOUT_HEARTBEAT] = 0;
         asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] = asoc->sackdelay;
         asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] =
-                (unsigned long)sp->autoclose * HZ;
+                min_t(unsigned long, sp->autoclose, sctp_max_autoclose) * HZ;
 
         /* Initializes the timers */
         for (i = SCTP_EVENT_TIMEOUT_NONE; i < SCTP_NUM_TIMEOUT_TYPES; ++i)
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 741ed164883..cd9eded3bb0 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -737,15 +737,12 @@ static void __sctp_unhash_endpoint(struct sctp_endpoint *ep)
 
         epb = &ep->base;
 
-        if (hlist_unhashed(&epb->node))
-                return;
-
         epb->hashent = sctp_ep_hashfn(epb->bind_addr.port);
 
         head = &sctp_ep_hashtable[epb->hashent];
 
         sctp_write_lock(&head->lock);
-        __hlist_del(&epb->node);
+        hlist_del_init(&epb->node);
         sctp_write_unlock(&head->lock);
 }
 
@@ -826,7 +823,7 @@ static void __sctp_unhash_established(struct sctp_association *asoc)
         head = &sctp_assoc_hashtable[epb->hashent];
 
         sctp_write_lock(&head->lock);
-        __hlist_del(&epb->node);
+        hlist_del_init(&epb->node);
         sctp_write_unlock(&head->lock);
 }
 
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 08b3cead650..8fc4dcd294a 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -377,9 +377,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
          */
         skb_set_owner_w(nskb, sk);
 
-        /* The 'obsolete' field of dst is set to 2 when a dst is freed. */
-        if (!dst || (dst->obsolete > 1)) {
-                dst_release(dst);
+        if (!sctp_transport_dst_check(tp)) {
                 sctp_transport_route(tp, NULL, sctp_sk(sk));
                 if (asoc && (asoc->param_flags & SPP_PMTUD_ENABLE)) {
                         sctp_assoc_sync_pmtu(asoc);
@@ -697,13 +695,7 @@ static void sctp_packet_append_data(struct sctp_packet *packet,
         /* Keep track of how many bytes are in flight to the receiver. */
         asoc->outqueue.outstanding_bytes += datasize;
 
-        /* Update our view of the receiver's rwnd. Include sk_buff overhead
-         * while updating peer.rwnd so that it reduces the chances of a
-         * receiver running out of receive buffer space even when receive
-         * window is still open. This can happen when a sender is sending
-         * sending small messages.
-         */
-        datasize += sizeof(struct sk_buff);
+        /* Update our view of the receiver's rwnd. */
         if (datasize < rwnd)
                 rwnd -= datasize;
         else
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index d03682109b7..1f2938fbf9b 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -411,8 +411,7 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                                         chunk->transport->flight_size -=
                                                         sctp_data_size(chunk);
                                 q->outstanding_bytes -= sctp_data_size(chunk);
-                                q->asoc->peer.rwnd += (sctp_data_size(chunk) +
-                                                        sizeof(struct sk_buff));
+                                q->asoc->peer.rwnd += sctp_data_size(chunk);
                         }
                         continue;
                 }
@@ -432,8 +431,7 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                          * (Section 7.2.4)), add the data size of those
                          * chunks to the rwnd.
                          */
-                        q->asoc->peer.rwnd += (sctp_data_size(chunk) +
-                                                sizeof(struct sk_buff));
+                        q->asoc->peer.rwnd += sctp_data_size(chunk);
                         q->outstanding_bytes -= sctp_data_size(chunk);
                         if (chunk->transport)
                                 transport->flight_size -= sctp_data_size(chunk);
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 207175b2f40..946afd6045c 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1144,6 +1144,9 @@ SCTP_STATIC __init int sctp_init(void)
         sctp_max_instreams              = SCTP_DEFAULT_INSTREAMS;
         sctp_max_outstreams             = SCTP_DEFAULT_OUTSTREAMS;
 
+        /* Initialize maximum autoclose timeout. */
+        sctp_max_autoclose              = INT_MAX / HZ;
+
         /* Initialize handle used for association ids. */
         idr_init(&sctp_assocs_id);
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index d3ccf7973c5..b70a3ee6016 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1160,8 +1160,14 @@ out_free:
         SCTP_DEBUG_PRINTK("About to exit __sctp_connect() free asoc: %p"
                           " kaddrs: %p err: %d\n",
                           asoc, kaddrs, err);
-        if (asoc)
+        if (asoc) {
+                /* sctp_primitive_ASSOCIATE may have added this association
+                 * To the hash table, try to unhash it, just in case, its a noop
+                 * if it wasn't hashed so we're safe
+                 */
+                sctp_unhash_established(asoc);
                 sctp_association_free(asoc);
+        }
         return err;
 }
 
@@ -1871,8 +1877,10 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
         goto out_unlock;
 
 out_free:
-        if (new_asoc)
+        if (new_asoc) {
+                sctp_unhash_established(asoc);
                 sctp_association_free(asoc);
+        }
 out_unlock:
         sctp_release_sock(sk);
 
@@ -2129,8 +2137,6 @@ static int sctp_setsockopt_autoclose(struct sock *sk, char __user *optval,
                 return -EINVAL;
         if (copy_from_user(&sp->autoclose, optval, optlen))
                 return -EFAULT;
-        /* make sure it won't exceed MAX_SCHEDULE_TIMEOUT */
-        sp->autoclose = min_t(long, sp->autoclose, MAX_SCHEDULE_TIMEOUT / HZ);
 
         return 0;
 }
@@ -4011,9 +4017,10 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
 static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
                                   int __user *optlen)
 {
-        if (len < sizeof(struct sctp_event_subscribe))
+        if (len <= 0)
                 return -EINVAL;
-        len = sizeof(struct sctp_event_subscribe);
+        if (len > sizeof(struct sctp_event_subscribe))
+                len = sizeof(struct sctp_event_subscribe);
         if (put_user(len, optlen))
                 return -EFAULT;
         if (copy_to_user(optval, &sctp_sk(sk)->subscribe, len))
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 50cb57f0919..6752f489feb 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -53,6 +53,10 @@ static int sack_timer_min = 1;
 static int sack_timer_max = 500;
 static int addr_scope_max = 3; /* check sctp_scope_policy_t in include/net/sctp/constants.h for max entries */
 static int rwnd_scale_max = 16;
+static unsigned long max_autoclose_min = 0;
+static unsigned long max_autoclose_max =
+        (MAX_SCHEDULE_TIMEOUT / HZ > UINT_MAX)
+        ? UINT_MAX : MAX_SCHEDULE_TIMEOUT / HZ;
 
 extern long sysctl_sctp_mem[3];
 extern int sysctl_sctp_rmem[3];
@@ -251,6 +255,15 @@ static ctl_table sctp_table[] = {
                 .extra1         = &one,
                 .extra2         = &rwnd_scale_max,
         },
+        {
+                .procname       = "max_autoclose",
+                .data           = &sctp_max_autoclose,
+                .maxlen         = sizeof(unsigned long),
+                .mode           = 0644,
+                .proc_handler   = &proc_doulongvec_minmax,
+                .extra1         = &max_autoclose_min,
+                .extra2         = &max_autoclose_max,
+        },
 
         { /* sentinel */ }
 };
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 394c57ca2f5..8da4481ed30 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -226,23 +226,6 @@ void sctp_transport_pmtu(struct sctp_transport *transport, struct sock *sk)
                 transport->pathmtu = SCTP_DEFAULT_MAXSEGMENT;
 }
 
-/* this is a complete rip-off from __sk_dst_check
- * the cookie is always 0 since this is how it's used in the
- * pmtu code
- */
-static struct dst_entry *sctp_transport_dst_check(struct sctp_transport *t)
-{
-        struct dst_entry *dst = t->dst;
-
-        if (dst && dst->obsolete && dst->ops->check(dst, 0) == NULL) {
-                dst_release(t->dst);
-                t->dst = NULL;
-                return NULL;
-        }
-
-        return dst;
-}
-
 void sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu)
 {
         struct dst_entry *dst;
diff --git a/net/socket.c b/net/socket.c
index 02dc82db3d2..cf41afcc89b 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -791,9 +791,9 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
 
         sock = file->private_data;
 
-        flags = !(file->f_flags & O_NONBLOCK) ? 0 : MSG_DONTWAIT;
-        if (more)
-                flags |= MSG_MORE;
+        flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
+        /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
+        flags |= more;
 
         return kernel_sendpage(sock, page, offset, size, flags);
 }
@@ -1871,8 +1871,14 @@ SYSCALL_DEFINE2(shutdown, int, fd, int, how)
 #define COMPAT_NAMELEN(msg)     COMPAT_MSG(msg, msg_namelen)
 #define COMPAT_FLAGS(msg)       COMPAT_MSG(msg, msg_flags)
 
+struct used_address {
+        struct sockaddr_storage name;
+        unsigned int name_len;
+};
+
 static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
-                         struct msghdr *msg_sys, unsigned flags, int nosec)
+                         struct msghdr *msg_sys, unsigned flags,
+                         struct used_address *used_address)
 {
         struct compat_msghdr __user *msg_compat =
             (struct compat_msghdr __user *)msg;
@@ -1953,8 +1959,30 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
 
         if (sock->file->f_flags & O_NONBLOCK)
                 msg_sys->msg_flags |= MSG_DONTWAIT;
-        err = (nosec ? sock_sendmsg_nosec : sock_sendmsg)(sock, msg_sys,
-                                                          total_len);
+        /*
+         * If this is sendmmsg() and current destination address is same as
+         * previously succeeded address, omit asking LSM's decision.
+         * used_address->name_len is initialized to UINT_MAX so that the first
+         * destination address never matches.
+         */
+        if (used_address && msg_sys->msg_name &&
+            used_address->name_len == msg_sys->msg_namelen &&
+            !memcmp(&used_address->name, msg_sys->msg_name,
+                    used_address->name_len)) {
+                err = sock_sendmsg_nosec(sock, msg_sys, total_len);
+                goto out_freectl;
+        }
+        err = sock_sendmsg(sock, msg_sys, total_len);
+        /*
+         * If this is sendmmsg() and sending to current destination address was
+         * successful, remember it.
+         */
+        if (used_address && err >= 0) {
+                used_address->name_len = msg_sys->msg_namelen;
+                if (msg_sys->msg_name)
+                        memcpy(&used_address->name, msg_sys->msg_name,
+                               used_address->name_len);
+        }
 
 out_freectl:
         if (ctl_buf != ctl)
@@ -1979,7 +2007,7 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
         if (!sock)
                 goto out;
 
-        err = __sys_sendmsg(sock, msg, &msg_sys, flags, 0);
+        err = __sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
 
         fput_light(sock->file, fput_needed);
 out:
@@ -1998,6 +2026,10 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
         struct mmsghdr __user *entry;
         struct compat_mmsghdr __user *compat_entry;
         struct msghdr msg_sys;
+        struct used_address used_address;
+
+        if (vlen > UIO_MAXIOV)
+                vlen = UIO_MAXIOV;
 
         datagrams = 0;
 
@@ -2005,27 +2037,22 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
         if (!sock)
                 return err;
 
-        err = sock_error(sock->sk);
-        if (err)
-                goto out_put;
-
+        used_address.name_len = UINT_MAX;
         entry = mmsg;
         compat_entry = (struct compat_mmsghdr __user *)mmsg;
+        err = 0;
 
         while (datagrams < vlen) {
-                /*
-                 * No need to ask LSM for more than the first datagram.
-                 */
                 if (MSG_CMSG_COMPAT & flags) {
                         err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
-                                            &msg_sys, flags, datagrams);
+                                            &msg_sys, flags, &used_address);
                         if (err < 0)
                                 break;
                         err = __put_user(err, &compat_entry->msg_len);
                         ++compat_entry;
                 } else {
                         err = __sys_sendmsg(sock, (struct msghdr __user *)entry,
-                                            &msg_sys, flags, datagrams);
+                                            &msg_sys, flags, &used_address);
                         if (err < 0)
                                 break;
                         err = put_user(err, &entry->msg_len);
@@ -2037,29 +2064,11 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
                 ++datagrams;
         }
 
-out_put:
         fput_light(sock->file, fput_needed);
 
-        if (err == 0)
-                return datagrams;
-
-        if (datagrams != 0) {
-                /*
-                 * We may send less entries than requested (vlen) if the
-                 * sock is non blocking...
-                 */
-                if (err != -EAGAIN) {
-                        /*
-                         * ... or if sendmsg returns an error after we
-                         * send some datagrams, where we record the
-                         * error to return on the next call or if the
-                         * app asks about it using getsockopt(SO_ERROR).
-                         */
-                        sock->sk->sk_err = -err;
-                }
-
+        /* We only return an error if no datagrams were able to be sent */
+        if (datagrams != 0)
                 return datagrams;
-        }
 
         return err;
 }
diff --git a/net/sunrpc/auth_unix.c b/net/sunrpc/auth_unix.c
index 4cb70dc6e7a..e50502d8ceb 100644
--- a/net/sunrpc/auth_unix.c
+++ b/net/sunrpc/auth_unix.c
@@ -129,6 +129,9 @@ unx_match(struct auth_cred *acred, struct rpc_cred *rcred, int flags)
         for (i = 0; i < groups ; i++)
                 if (cred->uc_gids[i] != GROUP_AT(acred->group_info, i))
                         return 0;
+        if (groups < NFS_NGROUPS &&
+            cred->uc_gids[groups] != NOGROUP)
+                return 0;
         return 1;
 }
 
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 72ad836e4fe..4530a912b8b 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -828,6 +828,8 @@ static ssize_t cache_do_downcall(char *kaddr, const char __user *buf,
 {
         ssize_t ret;
 
+        if (count == 0)
+                return -EINVAL;
         if (copy_from_user(kaddr, buf, count))
                 return -EFAULT;
         kaddr[count] = '\0';
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index e45d2fbbe5a..bf0a7f64f00 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -193,7 +193,7 @@ static int rpcb_create_local_unix(void)
         if (IS_ERR(clnt)) {
                 dprintk("RPC:       failed to create AF_LOCAL rpcbind "
                                 "client (errno %ld).\n", PTR_ERR(clnt));
-                result = -PTR_ERR(clnt);
+                result = PTR_ERR(clnt);
                 goto out;
         }
 
@@ -242,7 +242,7 @@ static int rpcb_create_local_net(void)
         if (IS_ERR(clnt)) {
                 dprintk("RPC:       failed to create local rpcbind "
                                 "client (errno %ld).\n", PTR_ERR(clnt));
-                result = -PTR_ERR(clnt);
+                result = PTR_ERR(clnt);
                 goto out;
         }
 
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 4814e246a87..c57f97f44e6 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -480,14 +480,18 @@ EXPORT_SYMBOL_GPL(rpc_wake_up_next);
  */
 void rpc_wake_up(struct rpc_wait_queue *queue)
 {
-        struct rpc_task *task, *next;
         struct list_head *head;
 
         spin_lock_bh(&queue->lock);
         head = &queue->tasks[queue->maxpriority];
         for (;;) {
-                list_for_each_entry_safe(task, next, head, u.tk_wait.list)
+                while (!list_empty(head)) {
+                        struct rpc_task *task;
+                        task = list_first_entry(head,
+                                        struct rpc_task,
+                                        u.tk_wait.list);
                         rpc_wake_up_task_queue_locked(queue, task);
+                }
                 if (head == &queue->tasks[0])
                         break;
                 head--;
@@ -505,13 +509,16 @@ EXPORT_SYMBOL_GPL(rpc_wake_up);
  */
 void rpc_wake_up_status(struct rpc_wait_queue *queue, int status)
 {
-        struct rpc_task *task, *next;
         struct list_head *head;
 
         spin_lock_bh(&queue->lock);
         head = &queue->tasks[queue->maxpriority];
         for (;;) {
-                list_for_each_entry_safe(task, next, head, u.tk_wait.list) {
+                while (!list_empty(head)) {
+                        struct rpc_task *task;
+                        task = list_first_entry(head,
+                                        struct rpc_task,
+                                        u.tk_wait.list);
                         task->tk_status = status;
                         rpc_wake_up_task_queue_locked(queue, task);
                 }
@@ -706,7 +713,9 @@ void rpc_execute(struct rpc_task *task)
 
 static void rpc_async_schedule(struct work_struct *work)
 {
+        current->flags |= PF_FSTRANS;
         __rpc_execute(container_of(work, struct rpc_task, u.tk_work));
+        current->flags &= ~PF_FSTRANS;
 }
 
 /**
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 2b90292e950..54c59ab3b10 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -167,6 +167,7 @@ svc_pool_map_alloc_arrays(struct svc_pool_map *m, unsigned int maxpools)
 
 fail_free:
         kfree(m->to_pool);
+        m->to_pool = NULL;
 fail:
         return -ENOMEM;
 }
@@ -287,7 +288,9 @@ svc_pool_map_put(void)
         if (!--m->count) {
                 m->mode = SVC_POOL_DEFAULT;
                 kfree(m->to_pool);
+                m->to_pool = NULL;
                 kfree(m->pool_to);
+                m->pool_to = NULL;
                 m->npools = 0;
         }
 
@@ -472,17 +475,20 @@ svc_destroy(struct svc_serv *serv)
                 printk("svc_destroy: no threads for serv=%p!\n", serv);
 
         del_timer_sync(&serv->sv_temptimer);
-
-        svc_close_all(&serv->sv_tempsocks);
+        /*
+         * The set of xprts (contained in the sv_tempsocks and
+         * sv_permsocks lists) is now constant, since it is modified
+         * only by accepting new sockets (done by service threads in
+         * svc_recv) or aging old ones (done by sv_temptimer), or
+         * configuration changes (excluded by whatever locking the
+         * caller is using--nfsd_mutex in the case of nfsd).  So it's
+         * safe to traverse those lists and shut everything down:
+         */
+        svc_close_all(serv);
 
         if (serv->sv_shutdown)
                 serv->sv_shutdown(serv);
 
-        svc_close_all(&serv->sv_permsocks);
-
-        BUG_ON(!list_empty(&serv->sv_permsocks));
-        BUG_ON(!list_empty(&serv->sv_tempsocks));
-
         cache_clean_deferred(serv);
 
         if (svc_serv_is_pooled(serv))
@@ -1296,7 +1302,8 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
                                                 sizeof(req->rq_snd_buf));
                 return bc_send(req);
         } else {
-                /* Nothing to do to drop request */
+                /* drop request */
+                xprt_free_bc_request(req);
                 return 0;
         }
 }
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index ab86b7927f8..9d7ed0b48b5 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -901,13 +901,7 @@ void svc_delete_xprt(struct svc_xprt *xprt)
         spin_lock_bh(&serv->sv_lock);
         if (!test_and_set_bit(XPT_DETACHED, &xprt->xpt_flags))
                 list_del_init(&xprt->xpt_list);
-        /*
-         * We used to delete the transport from whichever list
-         * it's sk_xprt.xpt_ready node was on, but we don't actually
-         * need to.  This is because the only time we're called
-         * while still attached to a queue, the queue itself
-         * is about to be destroyed (in svc_destroy).
-         */
+        BUG_ON(!list_empty(&xprt->xpt_ready));
         if (test_bit(XPT_TEMP, &xprt->xpt_flags))
                 serv->sv_tmpcnt--;
         spin_unlock_bh(&serv->sv_lock);
@@ -935,22 +929,48 @@ void svc_close_xprt(struct svc_xprt *xprt)
 }
 EXPORT_SYMBOL_GPL(svc_close_xprt);
 
-void svc_close_all(struct list_head *xprt_list)
+static void svc_close_list(struct list_head *xprt_list)
 {
         struct svc_xprt *xprt;
+
+        list_for_each_entry(xprt, xprt_list, xpt_list) {
+                set_bit(XPT_CLOSE, &xprt->xpt_flags);
+                set_bit(XPT_BUSY, &xprt->xpt_flags);
+        }
+}
+
+void svc_close_all(struct svc_serv *serv)
+{
+        struct svc_pool *pool;
+        struct svc_xprt *xprt;
         struct svc_xprt *tmp;
+        int i;
+
+        svc_close_list(&serv->sv_tempsocks);
+        svc_close_list(&serv->sv_permsocks);
 
+        for (i = 0; i < serv->sv_nrpools; i++) {
+                pool = &serv->sv_pools[i];
+
+                spin_lock_bh(&pool->sp_lock);
+                while (!list_empty(&pool->sp_sockets)) {
+                        xprt = list_first_entry(&pool->sp_sockets, struct svc_xprt, xpt_ready);
+                        list_del_init(&xprt->xpt_ready);
+                }
+                spin_unlock_bh(&pool->sp_lock);
+        }
         /*
-         * The server is shutting down, and no more threads are running.
-         * svc_xprt_enqueue() might still be running, but at worst it
-         * will re-add the xprt to sp_sockets, which will soon get
-         * freed.  So we don't bother with any more locking, and don't
-         * leave the close to the (nonexistent) server threads:
+         * At this point the sp_sockets lists will stay empty, since
+         * svc_enqueue will not add new entries without taking the
+         * sp_lock and checking XPT_BUSY.
          */
-        list_for_each_entry_safe(xprt, tmp, xprt_list, xpt_list) {
-                set_bit(XPT_CLOSE, &xprt->xpt_flags);
+        list_for_each_entry_safe(xprt, tmp, &serv->sv_tempsocks, xpt_list)
                 svc_delete_xprt(xprt);
-        }
+        list_for_each_entry_safe(xprt, tmp, &serv->sv_permsocks, xpt_list)
+                svc_delete_xprt(xprt);
+
+        BUG_ON(!list_empty(&serv->sv_permsocks));
+        BUG_ON(!list_empty(&serv->sv_tempsocks));
 }
 
 /*
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 0867070bb5c..d0b5210d981 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -200,6 +200,7 @@ xprt_rdma_connect_worker(struct work_struct *work)
         int rc = 0;
 
         if (!xprt->shutdown) {
+                current->flags |= PF_FSTRANS;
                 xprt_clear_connected(xprt);
 
                 dprintk("RPC:       %s: %sconnect\n", __func__,
@@ -212,10 +213,10 @@ xprt_rdma_connect_worker(struct work_struct *work)
 
 out:
         xprt_wake_pending_tasks(xprt, rc);
-
 out_clear:
         dprintk("RPC:       %s: exit\n", __func__);
         xprt_clear_connecting(xprt);
+        current->flags &= ~PF_FSTRANS;
 }
 
 /*
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 72abb735893..554111f42b0 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -485,7 +485,7 @@ static int xs_nospace(struct rpc_task *task)
         struct rpc_rqst *req = task->tk_rqstp;
         struct rpc_xprt *xprt = req->rq_xprt;
         struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
-        int ret = 0;
+        int ret = -EAGAIN;
 
         dprintk("RPC: %5u xmit incomplete (%u left of %u)\n",
                         task->tk_pid, req->rq_slen - req->rq_bytes_sent,
@@ -497,7 +497,6 @@ static int xs_nospace(struct rpc_task *task)
         /* Don't race with disconnect */
         if (xprt_connected(xprt)) {
                 if (test_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags)) {
-                        ret = -EAGAIN;
                         /*
                          * Notify TCP that we're limited by the application
                          * window size
@@ -1883,6 +1882,8 @@ static void xs_local_setup_socket(struct work_struct *work)
         if (xprt->shutdown)
                 goto out;
 
+        current->flags |= PF_FSTRANS;
+
         clear_bit(XPRT_CONNECTION_ABORT, &xprt->state);
         status = __sock_create(xprt->xprt_net, AF_LOCAL,
                                         SOCK_STREAM, 0, &sock, 1);
@@ -1916,6 +1917,7 @@ static void xs_local_setup_socket(struct work_struct *work)
 out:
         xprt_clear_connecting(xprt);
         xprt_wake_pending_tasks(xprt, status);
+        current->flags &= ~PF_FSTRANS;
 }
 
 static void xs_udp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
@@ -1958,6 +1960,8 @@ static void xs_udp_setup_socket(struct work_struct *work)
         if (xprt->shutdown)
                 goto out;
 
+        current->flags |= PF_FSTRANS;
+
         /* Start by resetting any existing state */
         xs_reset_transport(transport);
         sock = xs_create_sock(xprt, transport,
@@ -1976,6 +1980,7 @@ static void xs_udp_setup_socket(struct work_struct *work)
 out:
         xprt_clear_connecting(xprt);
         xprt_wake_pending_tasks(xprt, status);
+        current->flags &= ~PF_FSTRANS;
 }
 
 /*
@@ -2101,6 +2106,8 @@ static void xs_tcp_setup_socket(struct work_struct *work)
         if (xprt->shutdown)
                 goto out;
 
+        current->flags |= PF_FSTRANS;
+
         if (!sock) {
                 clear_bit(XPRT_CONNECTION_ABORT, &xprt->state);
                 sock = xs_create_sock(xprt, transport,
@@ -2150,6 +2157,7 @@ static void xs_tcp_setup_socket(struct work_struct *work)
         case -EINPROGRESS:
         case -EALREADY:
                 xprt_clear_connecting(xprt);
+                current->flags &= ~PF_FSTRANS;
                 return;
         case -EINVAL:
                 /* Happens, for instance, if the user specified a link
@@ -2162,6 +2170,7 @@ out_eagain:
 out:
         xprt_clear_connecting(xprt);
         xprt_wake_pending_tasks(xprt, status);
+        current->flags &= ~PF_FSTRANS;
 }
 
 /**
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index 788a12c1eb5..2ab785064b7 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -602,36 +602,31 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
                  * successfully, add it to the interface list.
                  */
 
-                if (dev->name == NULL) {
-                        err = -EINVAL;
-                } else {
+#ifdef WANDEBUG
+                printk(KERN_INFO "%s: registering interface %s...\n",
+                       wanrouter_modname, dev->name);
+#endif
 
-                        #ifdef WANDEBUG
-                        printk(KERN_INFO "%s: registering interface %s...\n",
-                                wanrouter_modname, dev->name);
-                        #endif
-
-                        err = register_netdev(dev);
-                        if (!err) {
-                                struct net_device *slave = NULL;
-                                unsigned long smp_flags=0;
-
-                                lock_adapter_irq(&wandev->lock, &smp_flags);
-
-                                if (wandev->dev == NULL) {
-                                        wandev->dev = dev;
-                                } else {
-                                        for (slave=wandev->dev;
-                                             DEV_TO_SLAVE(slave);
-                                             slave = DEV_TO_SLAVE(slave))
-                                                DEV_TO_SLAVE(slave) = dev;
-                                }
-                                ++wandev->ndev;
-
-                                unlock_adapter_irq(&wandev->lock, &smp_flags);
-                                err = 0;        /* done !!! */
-                                goto out;
+                err = register_netdev(dev);
+                if (!err) {
+                        struct net_device *slave = NULL;
+                        unsigned long smp_flags=0;
+
+                        lock_adapter_irq(&wandev->lock, &smp_flags);
+
+                        if (wandev->dev == NULL) {
+                                wandev->dev = dev;
+                        } else {
+                                for (slave=wandev->dev;
+                                     DEV_TO_SLAVE(slave);
+                                     slave = DEV_TO_SLAVE(slave))
+                                        DEV_TO_SLAVE(slave) = dev;
                         }
+                        ++wandev->ndev;
+
+                        unlock_adapter_irq(&wandev->lock, &smp_flags);
+                        err = 0;        /* done !!! */
+                        goto out;
                 }
                 if (wandev->del_if)
                         wandev->del_if(wandev, dev);
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 1f1ef70f34f..8e2a668c923 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -159,3 +159,14 @@ config LIB80211_DEBUG
           from lib80211.
 
           If unsure, say N.
+
+config CFG80211_ALLOW_RECONNECT
+        bool "Allow reconnect while already connected"
+        depends on CFG80211
+        default n
+        help
+          cfg80211 stack doesn't allow to connect if you are already
+          connected. This option allows to make a connection in this case.
+
+          Select this option ONLY for wlan drivers that are specifically
+          built for such purposes.
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 880dbe2e6f9..498c760a1d2 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -959,6 +959,11 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                  */
                 synchronize_rcu();
                 INIT_LIST_HEAD(&wdev->list);
+                /*
+                 * Ensure that all events have been processed and
+                 * freed.
+                 */
+                cfg80211_process_wdev_events(wdev);
                 break;
         case NETDEV_PRE_UP:
                 if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
diff --git a/net/wireless/core.h b/net/wireless/core.h
index a570ff9214e..83516455a1d 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -426,6 +426,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                           struct net_device *dev, enum nl80211_iftype ntype,
                           u32 *flags, struct vif_params *params);
 void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev);
+void cfg80211_process_wdev_events(struct wireless_dev *wdev);
 
 int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                                   struct wireless_dev *wdev,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index cea338150d0..379ed3a1322 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -83,8 +83,8 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 
-        [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
-        [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
+        [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
+        [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 
         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
@@ -126,8 +126,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 
-        [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
-                                         .len = NL80211_HT_CAPABILITY_LEN },
+        [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 
         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
@@ -1182,6 +1181,11 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                         goto bad_res;
                 }
 
+                if (!netif_running(netdev)) {
+                        result = -ENETDOWN;
+                        goto bad_res;
+                }
+
                 nla_for_each_nested(nl_txq_params,
                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
                                     rem_txq_params) {
@@ -2209,6 +2213,10 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
         }
         nla_nest_end(msg, sinfoattr);
 
+        if (sinfo->assoc_req_ies)
+                NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
+                        sinfo->assoc_req_ies);
+
         return genlmsg_end(msg, hdr);
 
  nla_put_failure:
@@ -2236,6 +2244,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
         }
 
         while (1) {
+                memset(&sinfo, 0, sizeof(sinfo));
                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
                                              mac_addr, &sinfo);
                 if (err == -ENOENT)
@@ -4044,9 +4053,12 @@ static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
                 if (len % sizeof(u32))
                         return -EINVAL;
 
+                if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
+                        return -EINVAL;
+
                 memcpy(settings->akm_suites, data, len);
 
-                for (i = 0; i < settings->n_ciphers_pairwise; i++)
+                for (i = 0; i < settings->n_akm_suites; i++)
                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
                                 return -EINVAL;
         }
@@ -5430,7 +5442,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_get_key,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -5462,7 +5474,7 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
                 .doit = nl80211_addset_beacon,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -5470,7 +5482,7 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
                 .doit = nl80211_addset_beacon,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -5494,7 +5506,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_set_station,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -5510,7 +5522,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_del_station,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -5543,7 +5555,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_del_mpath,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -5551,7 +5563,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_set_bss,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -5577,7 +5589,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_get_mesh_config,
                 .policy = nl80211_policy,
                 /* can be retrieved by unprivileged users */
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -5709,7 +5721,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_setdel_pmksa,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -5717,7 +5729,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_setdel_pmksa,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -5725,7 +5737,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_flush_pmksa,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -5813,7 +5825,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_set_wds_peer,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 1ad0f39fe09..092775af035 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -57,8 +57,17 @@
 #define REG_DBG_PRINT(args...)
 #endif
 
+static struct regulatory_request core_request_world = {
+        .initiator = NL80211_REGDOM_SET_BY_CORE,
+        .alpha2[0] = '0',
+        .alpha2[1] = '0',
+        .intersect = false,
+        .processed = true,
+        .country_ie_env = ENVIRON_ANY,
+};
+
 /* Receipt of information from last regulatory request */
-static struct regulatory_request *last_request;
+static struct regulatory_request *last_request = &core_request_world;
 
 /* To trigger userspace events */
 static struct platform_device *reg_pdev;
@@ -150,7 +159,7 @@ static char user_alpha2[2];
 module_param(ieee80211_regdom, charp, 0444);
 MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
 
-static void reset_regdomains(void)
+static void reset_regdomains(bool full_reset)
 {
         /* avoid freeing static information or freeing something twice */
         if (cfg80211_regdomain == cfg80211_world_regdom)
@@ -165,6 +174,13 @@ static void reset_regdomains(void)
 
         cfg80211_world_regdom = &world_regdom;
         cfg80211_regdomain = NULL;
+
+        if (!full_reset)
+                return;
+
+        if (last_request != &core_request_world)
+                kfree(last_request);
+        last_request = &core_request_world;
 }
 
 /*
@@ -175,7 +191,7 @@ static void update_world_regdomain(const struct ieee80211_regdomain *rd)
 {
         BUG_ON(!last_request);
 
-        reset_regdomains();
+        reset_regdomains(false);
 
         cfg80211_world_regdom = rd;
         cfg80211_regdomain = rd;
@@ -363,7 +379,15 @@ static void reg_regdb_query(const char *alpha2)
 
         schedule_work(&reg_regdb_work);
 }
+
+/* Feel free to add any other sanity checks here */
+static void reg_regdb_size_check(void)
+{
+        /* We should ideally BUILD_BUG_ON() but then random builds would fail */
+        WARN_ONCE(!reg_regdb_size, "db.txt is empty, you should update it...");
+}
 #else
+static inline void reg_regdb_size_check(void) {}
 static inline void reg_regdb_query(const char *alpha2) {}
 #endif /* CONFIG_CFG80211_INTERNAL_REGDB */
 
@@ -852,6 +876,7 @@ static void handle_channel(struct wiphy *wiphy,
                 return;
         }
 
+        chan->beacon_found = false;
         chan->flags = flags | bw_flags | map_regdom_flags(reg_rule->flags);
         chan->max_antenna_gain = min(chan->orig_mag,
                 (int) MBI_TO_DBI(power_rule->max_antenna_gain));
@@ -1125,12 +1150,13 @@ void wiphy_update_regulatory(struct wiphy *wiphy,
         enum ieee80211_band band;
 
         if (ignore_reg_update(wiphy, initiator))
-                goto out;
+                return;
+
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 if (wiphy->bands[band])
                         handle_band(wiphy, band, initiator);
         }
-out:
+
         reg_process_beacons(wiphy);
         reg_process_ht_flags(wiphy);
         if (wiphy->reg_notifier)
@@ -1332,7 +1358,7 @@ static void reg_set_request_processed(void)
         spin_unlock(&reg_requests_lock);
 
         if (last_request->initiator == NL80211_REGDOM_SET_BY_USER)
-                cancel_delayed_work_sync(&reg_timeout);
+                cancel_delayed_work(&reg_timeout);
 
         if (need_more_processing)
                 schedule_work(&reg_work);
@@ -1394,7 +1420,8 @@ static int __regulatory_hint(struct wiphy *wiphy,
         }
 
 new_request:
-        kfree(last_request);
+        if (last_request != &core_request_world)
+                kfree(last_request);
 
         last_request = pending_request;
         last_request->intersect = intersect;
@@ -1564,9 +1591,6 @@ static int regulatory_hint_core(const char *alpha2)
 {
         struct regulatory_request *request;
 
-        kfree(last_request);
-        last_request = NULL;
-
         request = kzalloc(sizeof(struct regulatory_request),
                           GFP_KERNEL);
         if (!request)
@@ -1757,6 +1781,7 @@ static void restore_alpha2(char *alpha2, bool reset_user)
 static void restore_regulatory_settings(bool reset_user)
 {
         char alpha2[2];
+        char world_alpha2[2];
         struct reg_beacon *reg_beacon, *btmp;
         struct regulatory_request *reg_request, *tmp;
         LIST_HEAD(tmp_reg_req_list);
@@ -1764,7 +1789,7 @@ static void restore_regulatory_settings(bool reset_user)
         mutex_lock(&cfg80211_mutex);
         mutex_lock(&reg_mutex);
 
-        reset_regdomains();
+        reset_regdomains(true);
         restore_alpha2(alpha2, reset_user);
 
         /*
@@ -1807,11 +1832,13 @@ static void restore_regulatory_settings(bool reset_user)
 
         /* First restore to the basic regulatory settings */
         cfg80211_regdomain = cfg80211_world_regdom;
+        world_alpha2[0] = cfg80211_regdomain->alpha2[0];
+        world_alpha2[1] = cfg80211_regdomain->alpha2[1];
 
         mutex_unlock(&reg_mutex);
         mutex_unlock(&cfg80211_mutex);
 
-        regulatory_hint_core(cfg80211_regdomain->alpha2);
+        regulatory_hint_core(world_alpha2);
 
         /*
          * This restores the ieee80211_regdom module parameter
@@ -2024,12 +2051,18 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
         }
 
         request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
+        if (!request_wiphy &&
+            (last_request->initiator == NL80211_REGDOM_SET_BY_DRIVER ||
+             last_request->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE)) {
+                schedule_delayed_work(&reg_timeout, 0);
+                return -ENODEV;
+        }
 
         if (!last_request->intersect) {
                 int r;
 
                 if (last_request->initiator != NL80211_REGDOM_SET_BY_DRIVER) {
-                        reset_regdomains();
+                        reset_regdomains(false);
                         cfg80211_regdomain = rd;
                         return 0;
                 }
@@ -2050,7 +2083,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                 if (r)
                         return r;
 
-                reset_regdomains();
+                reset_regdomains(false);
                 cfg80211_regdomain = rd;
                 return 0;
         }
@@ -2075,7 +2108,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
 
                 rd = NULL;
 
-                reset_regdomains();
+                reset_regdomains(false);
                 cfg80211_regdomain = intersected_rd;
 
                 return 0;
@@ -2095,7 +2128,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
         kfree(rd);
         rd = NULL;
 
-        reset_regdomains();
+        reset_regdomains(false);
         cfg80211_regdomain = intersected_rd;
 
         return 0;
@@ -2203,6 +2236,8 @@ int __init regulatory_init(void)
         spin_lock_init(&reg_requests_lock);
         spin_lock_init(&reg_pending_beacons_lock);
 
+        reg_regdb_size_check();
+
         cfg80211_regdomain = cfg80211_world_regdom;
 
         user_alpha2[0] = '9';
@@ -2248,9 +2283,9 @@ void /* __init_or_exit */ regulatory_exit(void)
         mutex_lock(&cfg80211_mutex);
         mutex_lock(&reg_mutex);
 
-        reset_regdomains();
+        reset_regdomains(true);
 
-        kfree(last_request);
+        dev_set_uevent_suppress(&reg_pdev->dev, true);
 
         platform_device_unregister(reg_pdev);
 
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index ae0c2256ba3..cbbc92731ec 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -17,7 +17,7 @@
 #include "nl80211.h"
 #include "wext-compat.h"
 
-#define IEEE80211_SCAN_RESULT_EXPIRE    (15 * HZ)
+#define IEEE80211_SCAN_RESULT_EXPIRE    (3 * HZ)
 
 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
 {
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index b7b6ff8be55..cf4be21236b 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -659,8 +659,10 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
                     wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
                 return;
 
+#ifndef CONFIG_CFG80211_ALLOW_RECONNECT
         if (wdev->sme_state != CFG80211_SME_CONNECTED)
                 return;
+#endif
 
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
@@ -758,10 +760,14 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
 
         ASSERT_WDEV_LOCK(wdev);
 
+#ifndef CONFIG_CFG80211_ALLOW_RECONNECT
         if (wdev->sme_state != CFG80211_SME_IDLE)
                 return -EALREADY;
 
         if (WARN_ON(wdev->connect_keys)) {
+#else
+        if (wdev->connect_keys) {
+#endif
                 kfree(wdev->connect_keys);
                 wdev->connect_keys = NULL;
         }
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 4d7b83fbc32..18e22bef386 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -719,7 +719,7 @@ void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
         wdev->connect_keys = NULL;
 }
 
-static void cfg80211_process_wdev_events(struct wireless_dev *wdev)
+void cfg80211_process_wdev_events(struct wireless_dev *wdev)
 {
         struct cfg80211_event *ev;
         unsigned long flags;
@@ -807,7 +807,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
              ntype == NL80211_IFTYPE_P2P_CLIENT))
                 return -EBUSY;
 
-        if (ntype != otype) {
+        if (ntype != otype && netif_running(dev)) {
                 err = cfg80211_can_change_interface(rdev, dev->ieee80211_ptr,
                                                     ntype);
                 if (err)
@@ -937,6 +937,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                                   enum nl80211_iftype iftype)
 {
         struct wireless_dev *wdev_iter;
+        u32 used_iftypes = BIT(iftype);
         int num[NUM_NL80211_IFTYPES];
         int total = 1;
         int i, j;
@@ -970,12 +971,17 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
 
                 num[wdev_iter->iftype]++;
                 total++;
+                used_iftypes |= BIT(wdev_iter->iftype);
         }
         mutex_unlock(&rdev->devlist_mtx);
 
+        if (total == 1)
+                return 0;
+
         for (i = 0; i < rdev->wiphy.n_iface_combinations; i++) {
                 const struct ieee80211_iface_combination *c;
                 struct ieee80211_iface_limit *limits;
+                u32 all_iftypes = 0;
 
                 c = &rdev->wiphy.iface_combinations[i];
 
@@ -990,14 +996,28 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                         if (rdev->wiphy.software_iftypes & BIT(iftype))
                                 continue;
                         for (j = 0; j < c->n_limits; j++) {
-                                if (!(limits[j].types & iftype))
+                                all_iftypes |= limits[j].types;
+                                if (!(limits[j].types & BIT(iftype)))
                                         continue;
                                 if (limits[j].max < num[iftype])
                                         goto cont;
                                 limits[j].max -= num[iftype];
                         }
                 }
-                /* yay, it fits */
+
+                /*
+                 * Finally check that all iftypes that we're currently
+                 * using are actually part of this combination. If they
+                 * aren't then we can't use this combination and have
+                 * to continue to the next.
+                 */
+                if ((all_iftypes & used_iftypes) != used_iftypes)
+                        goto cont;
+
+                /*
+                 * This combination covered all interface types and
+                 * supported the requested numbers, so we're good.
+                 */
                 kfree(limits);
                 return 0;
  cont:
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 4680b1e4c79..373e14f21a1 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -295,7 +295,8 @@ static struct sock *x25_find_listener(struct x25_address *addr,
                          * Found a listening socket, now check the incoming
                          * call user data vs this sockets call user data
                          */
-                        if(skb->len > 0 && x25_sk(s)->cudmatchlength > 0) {
+                        if (x25_sk(s)->cudmatchlength > 0 &&
+                                skb->len >= x25_sk(s)->cudmatchlength) {
                                 if((memcmp(x25_sk(s)->calluserdata.cuddata,
                                         skb->data,
                                         x25_sk(s)->cudmatchlength)) == 0) {
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index 58064d9e565..791ab2e77f3 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -462,8 +462,8 @@ static struct xfrm_algo_desc ealg_list[] = {
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AESCTR,
                 .sadb_alg_ivlen = 8,
-                .sadb_alg_minbits = 128,
-                .sadb_alg_maxbits = 256
+                .sadb_alg_minbits = 160,
+                .sadb_alg_maxbits = 288
         }
 },
 };
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index a026b0ef244..54a0dc2e2f8 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -212,6 +212,11 @@ resume:
                 /* only the first xfrm gets the encap type */
                 encap_type = 0;
 
+                if (async && x->repl->check(x, skb, seq)) {
+                        XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR);
+                        goto drop_unlock;
+                }
+
                 x->repl->advance(x, seq);
 
                 x->curlft.bytes += skb->len;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 5ce74a38552..0c0e40e9cfc 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1497,7 +1497,7 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
                 goto free_dst;
 
         /* Copy neighbour for reachability confirmation */
-        dst0->neighbour = neigh_clone(dst->neighbour);
+        dst_set_neighbour(dst0, neigh_clone(dst_get_neighbour(dst)));
 
         xfrm_init_path((struct xfrm_dst *)dst0, dst, nfheader_len);
         xfrm_init_pmtu(dst_prev);
@@ -1917,6 +1917,9 @@ no_transform:
         }
 ok:
         xfrm_pols_put(pols, drop_pols);
+        if (dst && dst->xfrm &&
+            dst->xfrm->props.mode == XFRM_MODE_TUNNEL)
+                dst->flags |= DST_XFRM_TUNNEL;
         return dst;
 
 nopol:
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index b11ea692bd7..3235023eaf4 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -166,7 +166,7 @@ static void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
         }
 
         if (xfrm_aevent_is_on(xs_net(x)))
-                xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
+                x->repl->notify(x, XFRM_REPLAY_UPDATE);
 }
 
 static int xfrm_replay_overflow_bmp(struct xfrm_state *x, struct sk_buff *skb)
@@ -293,7 +293,7 @@ static void xfrm_replay_advance_bmp(struct xfrm_state *x, __be32 net_seq)
         }
 
         if (xfrm_aevent_is_on(xs_net(x)))
-                xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
+                x->repl->notify(x, XFRM_REPLAY_UPDATE);
 }
 
 static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
@@ -502,7 +502,7 @@ static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
         }
 
         if (xfrm_aevent_is_on(xs_net(x)))
-                xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
+                x->repl->notify(x, XFRM_REPLAY_UPDATE);
 }
 
 static struct xfrm_replay xfrm_replay_legacy = {