Patched in Tegra support.

8 files changed, 680 insertions, 70 deletions

diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 88709882c46..a18e6c3d36e 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -71,7 +71,8 @@ static inline u16 llc_ui_next_link_no(int sap)
  */
 static inline __be16 llc_proto_type(u16 arphrd)
 {
-        return htons(ETH_P_802_2);
+        return arphrd == ARPHRD_IEEE802_TR ?
+                         htons(ETH_P_TR_802_2) : htons(ETH_P_802_2);
 }
 
 /**
@@ -160,7 +161,7 @@ static int llc_ui_create(struct net *net, struct socket *sock, int protocol,
         struct sock *sk;
         int rc = -ESOCKTNOSUPPORT;
 
-        if (!ns_capable(net->user_ns, CAP_NET_RAW))
+        if (!capable(CAP_NET_RAW))
                 return -EPERM;
 
         if (!net_eq(net, &init_net))
@@ -517,7 +518,7 @@ static int llc_ui_listen(struct socket *sock, int backlog)
         if (sock_flag(sk, SOCK_ZAPPED))
                 goto out;
         rc = 0;
-        if (!(unsigned int)backlog)     /* BSDism */
+        if (!(unsigned)backlog) /* BSDism */
                 backlog = 1;
         sk->sk_max_ack_backlog = backlog;
         if (sk->sk_state != TCP_LISTEN) {
@@ -712,7 +713,6 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
         struct sk_buff *skb = NULL;
         struct sock *sk = sock->sk;
         struct llc_sock *llc = llc_sk(sk);
-        unsigned long cpu_flags;
         size_t copied = 0;
         u32 peek_seq = 0;
         u32 *seq;
@@ -805,9 +805,10 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
                         sk_wait_data(sk, &timeo);
 
                 if ((flags & MSG_PEEK) && peek_seq != llc->copied_seq) {
-                        net_dbg_ratelimited("LLC(%s:%d): Application bug, race in MSG_PEEK\n",
-                                            current->comm,
-                                            task_pid_nr(current));
+                        if (net_ratelimit())
+                                printk(KERN_DEBUG "LLC(%s:%d): Application "
+                                                  "bug, race in MSG_PEEK.\n",
+                                       current->comm, task_pid_nr(current));
                         peek_seq = llc->copied_seq;
                 }
                 continue;
@@ -837,9 +838,7 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
                         goto copy_uaddr;
 
                 if (!(flags & MSG_PEEK)) {
-                        spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
-                        sk_eat_skb(sk, skb, false);
-                        spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
+                        sk_eat_skb(sk, skb, 0);
                         *seq = 0;
                 }
 
@@ -860,9 +859,7 @@ copy_uaddr:
                 llc_cmsg_rcv(msg, skb);
 
         if (!(flags & MSG_PEEK)) {
-                        spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
-                        sk_eat_skb(sk, skb, false);
-                        spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
+                        sk_eat_skb(sk, skb, 0);
                         *seq = 0;
         }
 
@@ -969,13 +966,14 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
         struct sockaddr_llc sllc;
         struct sock *sk = sock->sk;
         struct llc_sock *llc = llc_sk(sk);
-        int rc = -EBADF;
+        int rc = 0;
 
         memset(&sllc, 0, sizeof(sllc));
         lock_sock(sk);
         if (sock_flag(sk, SOCK_ZAPPED))
                 goto out;
         *uaddrlen = sizeof(sllc);
+        memset(uaddr, 0, *uaddrlen);
         if (peer) {
                 rc = -ENOTCONN;
                 if (sk->sk_state != TCP_ESTABLISHED)
@@ -1023,7 +1021,7 @@ static int llc_ui_ioctl(struct socket *sock, unsigned int cmd,
  *      @sock: Socket to set options on.
  *      @level: Socket level user is requesting operations on.
  *      @optname: Operation name.
- *      @optval: User provided operation data.
+ *      @optval User provided operation data.
  *      @optlen: Length of optval.
  *
  *      Set various connection specific parameters.
@@ -1205,7 +1203,7 @@ static int __init llc2_init(void)
         rc = llc_proc_init();
         if (rc != 0) {
                 printk(llc_proc_err_msg);
-                goto out_station;
+                goto out_unregister_llc_proto;
         }
         rc = llc_sysctl_init();
         if (rc) {
@@ -1225,8 +1223,7 @@ out_sysctl:
         llc_sysctl_exit();
 out_proc:
         llc_proc_exit();
-out_station:
-        llc_station_exit();
+out_unregister_llc_proto:
         proto_unregister(&llc_proto);
         goto out;
 }
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index 0d0d416dfab..ba137a6a224 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -828,7 +828,7 @@ void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb)
         else {
                 dprintk("%s: adding to backlog...\n", __func__);
                 llc_set_backlog_type(skb, LLC_PACKET);
-                if (sk_add_backlog(sk, skb, sk->sk_rcvbuf))
+                if (sk_add_backlog(sk, skb))
                         goto drop_unlock;
         }
 out:
diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index dd3e83328ad..90324211131 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -13,7 +13,6 @@
  */
 #include <linux/netdevice.h>
 #include <linux/slab.h>
-#include <linux/export.h>
 #include <net/net_namespace.h>
 #include <net/llc.h>
 #include <net/llc_pdu.h>
@@ -42,7 +41,6 @@ static void (*llc_type_handlers[2])(struct llc_sap *sap,
 void llc_add_pack(int type, void (*handler)(struct llc_sap *sap,
                                             struct sk_buff *skb))
 {
-        smp_wmb(); /* ensure initialisation is complete before it's called */
         if (type == LLC_DEST_SAP || type == LLC_DEST_CONN)
                 llc_type_handlers[type - 1] = handler;
 }
@@ -51,19 +49,11 @@ void llc_remove_pack(int type)
 {
         if (type == LLC_DEST_SAP || type == LLC_DEST_CONN)
                 llc_type_handlers[type - 1] = NULL;
-        synchronize_net();
 }
 
 void llc_set_station_handler(void (*handler)(struct sk_buff *skb))
 {
-        /* Ensure initialisation is complete before it's called */
-        if (handler)
-                smp_wmb();
-
         llc_station_handler = handler;
-
-        if (!handler)
-                synchronize_net();
 }
 
 /**
@@ -159,8 +149,6 @@ int llc_rcv(struct sk_buff *skb, struct net_device *dev,
         int dest;
         int (*rcv)(struct sk_buff *, struct net_device *,
                    struct packet_type *, struct net_device *);
-        void (*sta_handler)(struct sk_buff *skb);
-        void (*sap_handler)(struct llc_sap *sap, struct sk_buff *skb);
 
         if (!net_eq(dev_net(dev), &init_net))
                 goto drop;
@@ -193,8 +181,7 @@ int llc_rcv(struct sk_buff *skb, struct net_device *dev,
          */
         rcv = rcu_dereference(sap->rcv_func);
         dest = llc_pdu_type(skb);
-        sap_handler = dest ? ACCESS_ONCE(llc_type_handlers[dest - 1]) : NULL;
-        if (unlikely(!sap_handler)) {
+        if (unlikely(!dest || !llc_type_handlers[dest - 1])) {
                 if (rcv)
                         rcv(skb, dev, pt, orig_dev);
                 else
@@ -205,7 +192,7 @@ int llc_rcv(struct sk_buff *skb, struct net_device *dev,
                         if (cskb)
                                 rcv(cskb, dev, pt, orig_dev);
                 }
-                sap_handler(sap, skb);
+                llc_type_handlers[dest - 1](sap, skb);
         }
         llc_sap_put(sap);
 out:
@@ -214,10 +201,9 @@ drop:
         kfree_skb(skb);
         goto out;
 handle_station:
-        sta_handler = ACCESS_ONCE(llc_station_handler);
-        if (!sta_handler)
+        if (!llc_station_handler)
                 goto drop;
-        sta_handler(skb);
+        llc_station_handler(skb);
         goto out;
 }
 
diff --git a/net/llc/llc_output.c b/net/llc/llc_output.c
index 2dae8a5df23..b38a1079a98 100644
--- a/net/llc/llc_output.c
+++ b/net/llc/llc_output.c
@@ -14,9 +14,10 @@
  */
 
 #include <linux/if_arp.h>
+#include <linux/if_tr.h>
 #include <linux/netdevice.h>
+#include <linux/trdevice.h>
 #include <linux/skbuff.h>
-#include <linux/export.h>
 #include <net/llc.h>
 #include <net/llc_pdu.h>
 
@@ -35,6 +36,7 @@ int llc_mac_hdr_init(struct sk_buff *skb,
         int rc = -EINVAL;
 
         switch (skb->dev->type) {
+        case ARPHRD_IEEE802_TR:
         case ARPHRD_ETHER:
         case ARPHRD_LOOPBACK:
                 rc = dev_hard_header(skb, skb->dev, ETH_P_802_2, da, sa,
diff --git a/net/llc/llc_proc.c b/net/llc/llc_proc.c
index 7b4799cfbf8..7af1ff2d1f1 100644
--- a/net/llc/llc_proc.c
+++ b/net/llc/llc_proc.c
@@ -17,7 +17,6 @@
 #include <linux/proc_fs.h>
 #include <linux/errno.h>
 #include <linux/seq_file.h>
-#include <linux/export.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <net/llc.h>
@@ -151,7 +150,7 @@ static int llc_seq_socket_show(struct seq_file *seq, void *v)
                    sk_wmem_alloc_get(sk),
                    sk_rmem_alloc_get(sk) - llc->copied_seq,
                    sk->sk_state,
-                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sk)),
+                   sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_uid : -1,
                    llc->link);
 out:
         return 0;
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index 7c5073badc7..94e7fca75b8 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -31,6 +31,10 @@ static int llc_mac_header_len(unsigned short devtype)
         case ARPHRD_ETHER:
         case ARPHRD_LOOPBACK:
                 return sizeof(struct ethhdr);
+#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE)
+        case ARPHRD_IEEE802_TR:
+                return sizeof(struct trh_hdr);
+#endif
         }
         return 0;
 }
diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c
index 204a8351eff..cf4aea3ba30 100644
--- a/net/llc/llc_station.c
+++ b/net/llc/llc_station.c
@@ -25,26 +25,253 @@
 #include <net/llc_s_st.h>
 #include <net/llc_pdu.h>
 
+/**
+ * struct llc_station - LLC station component
+ *
+ * SAP and connection resource manager, one per adapter.
+ *
+ * @state - state of station
+ * @xid_r_count - XID response PDU counter
+ * @mac_sa - MAC source address
+ * @sap_list - list of related SAPs
+ * @ev_q - events entering state mach.
+ * @mac_pdu_q - PDUs ready to send to MAC
+ */
+struct llc_station {
+        u8                          state;
+        u8                          xid_r_count;
+        struct timer_list           ack_timer;
+        u8                          retry_count;
+        u8                          maximum_retry;
+        struct {
+                struct sk_buff_head list;
+                spinlock_t          lock;
+        } ev_q;
+        struct sk_buff_head         mac_pdu_q;
+};
+
+#define LLC_STATION_ACK_TIME (3 * HZ)
+
+int sysctl_llc_station_ack_timeout = LLC_STATION_ACK_TIME;
+
+/* Types of events (possible values in 'ev->type') */
+#define LLC_STATION_EV_TYPE_SIMPLE      1
+#define LLC_STATION_EV_TYPE_CONDITION   2
+#define LLC_STATION_EV_TYPE_PRIM        3
+#define LLC_STATION_EV_TYPE_PDU         4       /* command/response PDU */
+#define LLC_STATION_EV_TYPE_ACK_TMR     5
+#define LLC_STATION_EV_TYPE_RPT_STATUS  6
+
+/* Events */
+#define LLC_STATION_EV_ENABLE_WITH_DUP_ADDR_CHECK               1
+#define LLC_STATION_EV_ENABLE_WITHOUT_DUP_ADDR_CHECK            2
+#define LLC_STATION_EV_ACK_TMR_EXP_LT_RETRY_CNT_MAX_RETRY       3
+#define LLC_STATION_EV_ACK_TMR_EXP_EQ_RETRY_CNT_MAX_RETRY       4
+#define LLC_STATION_EV_RX_NULL_DSAP_XID_C                       5
+#define LLC_STATION_EV_RX_NULL_DSAP_0_XID_R_XID_R_CNT_EQ        6
+#define LLC_STATION_EV_RX_NULL_DSAP_1_XID_R_XID_R_CNT_EQ        7
+#define LLC_STATION_EV_RX_NULL_DSAP_TEST_C                      8
+#define LLC_STATION_EV_DISABLE_REQ                              9
+
+struct llc_station_state_ev {
+        u8               type;
+        u8               prim;
+        u8               prim_type;
+        u8               reason;
+        struct list_head node; /* node in station->ev_q.list */
+};
+
+static __inline__ struct llc_station_state_ev *
+                                        llc_station_ev(struct sk_buff *skb)
+{
+        return (struct llc_station_state_ev *)skb->cb;
+}
+
+typedef int (*llc_station_ev_t)(struct sk_buff *skb);
+
+#define LLC_STATION_STATE_DOWN          1       /* initial state */
+#define LLC_STATION_STATE_DUP_ADDR_CHK  2
+#define LLC_STATION_STATE_UP            3
+
+#define LLC_NBR_STATION_STATES          3       /* size of state table */
+
+typedef int (*llc_station_action_t)(struct sk_buff *skb);
+
+/* Station component state table structure */
+struct llc_station_state_trans {
+        llc_station_ev_t ev;
+        u8 next_state;
+        llc_station_action_t *ev_actions;
+};
+
+struct llc_station_state {
+        u8 curr_state;
+        struct llc_station_state_trans **transitions;
+};
+
+static struct llc_station llc_main_station;
+
+static int llc_stat_ev_enable_with_dup_addr_check(struct sk_buff *skb)
+{
+        struct llc_station_state_ev *ev = llc_station_ev(skb);
+
+        return ev->type == LLC_STATION_EV_TYPE_SIMPLE &&
+               ev->prim_type ==
+                              LLC_STATION_EV_ENABLE_WITH_DUP_ADDR_CHECK ? 0 : 1;
+}
+
+static int llc_stat_ev_enable_without_dup_addr_check(struct sk_buff *skb)
+{
+        struct llc_station_state_ev *ev = llc_station_ev(skb);
+
+        return ev->type == LLC_STATION_EV_TYPE_SIMPLE &&
+               ev->prim_type ==
+                        LLC_STATION_EV_ENABLE_WITHOUT_DUP_ADDR_CHECK ? 0 : 1;
+}
+
+static int llc_stat_ev_ack_tmr_exp_lt_retry_cnt_max_retry(struct sk_buff *skb)
+{
+        struct llc_station_state_ev *ev = llc_station_ev(skb);
+
+        return ev->type == LLC_STATION_EV_TYPE_ACK_TMR &&
+                llc_main_station.retry_count <
+                llc_main_station.maximum_retry ? 0 : 1;
+}
+
+static int llc_stat_ev_ack_tmr_exp_eq_retry_cnt_max_retry(struct sk_buff *skb)
+{
+        struct llc_station_state_ev *ev = llc_station_ev(skb);
+
+        return ev->type == LLC_STATION_EV_TYPE_ACK_TMR &&
+                llc_main_station.retry_count ==
+                llc_main_station.maximum_retry ? 0 : 1;
+}
+
 static int llc_stat_ev_rx_null_dsap_xid_c(struct sk_buff *skb)
 {
+        struct llc_station_state_ev *ev = llc_station_ev(skb);
         struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
 
-        return LLC_PDU_IS_CMD(pdu) &&                   /* command PDU */
+        return ev->type == LLC_STATION_EV_TYPE_PDU &&
+               LLC_PDU_IS_CMD(pdu) &&                   /* command PDU */
                LLC_PDU_TYPE_IS_U(pdu) &&                /* U type PDU */
                LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_XID &&
                !pdu->dsap ? 0 : 1;                      /* NULL DSAP value */
 }
 
+static int llc_stat_ev_rx_null_dsap_0_xid_r_xid_r_cnt_eq(struct sk_buff *skb)
+{
+        struct llc_station_state_ev *ev = llc_station_ev(skb);
+        struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
+
+        return ev->type == LLC_STATION_EV_TYPE_PDU &&
+               LLC_PDU_IS_RSP(pdu) &&                   /* response PDU */
+               LLC_PDU_TYPE_IS_U(pdu) &&                /* U type PDU */
+               LLC_U_PDU_RSP(pdu) == LLC_1_PDU_CMD_XID &&
+               !pdu->dsap &&                            /* NULL DSAP value */
+               !llc_main_station.xid_r_count ? 0 : 1;
+}
+
+static int llc_stat_ev_rx_null_dsap_1_xid_r_xid_r_cnt_eq(struct sk_buff *skb)
+{
+        struct llc_station_state_ev *ev = llc_station_ev(skb);
+        struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
+
+        return ev->type == LLC_STATION_EV_TYPE_PDU &&
+               LLC_PDU_IS_RSP(pdu) &&                   /* response PDU */
+               LLC_PDU_TYPE_IS_U(pdu) &&                /* U type PDU */
+               LLC_U_PDU_RSP(pdu) == LLC_1_PDU_CMD_XID &&
+               !pdu->dsap &&                            /* NULL DSAP value */
+               llc_main_station.xid_r_count == 1 ? 0 : 1;
+}
+
 static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb)
 {
+        struct llc_station_state_ev *ev = llc_station_ev(skb);
         struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
 
-        return LLC_PDU_IS_CMD(pdu) &&                   /* command PDU */
+        return ev->type == LLC_STATION_EV_TYPE_PDU &&
+               LLC_PDU_IS_CMD(pdu) &&                   /* command PDU */
                LLC_PDU_TYPE_IS_U(pdu) &&                /* U type PDU */
                LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_TEST &&
                !pdu->dsap ? 0 : 1;                      /* NULL DSAP */
 }
 
+static int llc_stat_ev_disable_req(struct sk_buff *skb)
+{
+        struct llc_station_state_ev *ev = llc_station_ev(skb);
+
+        return ev->type == LLC_STATION_EV_TYPE_PRIM &&
+               ev->prim == LLC_DISABLE_PRIM &&
+               ev->prim_type == LLC_PRIM_TYPE_REQ ? 0 : 1;
+}
+
+/**
+ *      llc_station_send_pdu - queues PDU to send
+ *      @skb: Address of the PDU
+ *
+ *      Queues a PDU to send to the MAC layer.
+ */
+static void llc_station_send_pdu(struct sk_buff *skb)
+{
+        skb_queue_tail(&llc_main_station.mac_pdu_q, skb);
+        while ((skb = skb_dequeue(&llc_main_station.mac_pdu_q)) != NULL)
+                if (dev_queue_xmit(skb))
+                        break;
+}
+
+static int llc_station_ac_start_ack_timer(struct sk_buff *skb)
+{
+        mod_timer(&llc_main_station.ack_timer,
+                  jiffies + sysctl_llc_station_ack_timeout);
+        return 0;
+}
+
+static int llc_station_ac_set_retry_cnt_0(struct sk_buff *skb)
+{
+        llc_main_station.retry_count = 0;
+        return 0;
+}
+
+static int llc_station_ac_inc_retry_cnt_by_1(struct sk_buff *skb)
+{
+        llc_main_station.retry_count++;
+        return 0;
+}
+
+static int llc_station_ac_set_xid_r_cnt_0(struct sk_buff *skb)
+{
+        llc_main_station.xid_r_count = 0;
+        return 0;
+}
+
+static int llc_station_ac_inc_xid_r_cnt_by_1(struct sk_buff *skb)
+{
+        llc_main_station.xid_r_count++;
+        return 0;
+}
+
+static int llc_station_ac_send_null_dsap_xid_c(struct sk_buff *skb)
+{
+        int rc = 1;
+        struct sk_buff *nskb = llc_alloc_frame(NULL, skb->dev, LLC_PDU_TYPE_U,
+                                               sizeof(struct llc_xid_info));
+
+        if (!nskb)
+                goto out;
+        llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, 0, 0, LLC_PDU_CMD);
+        llc_pdu_init_as_xid_cmd(nskb, LLC_XID_NULL_CLASS_2, 127);
+        rc = llc_mac_hdr_init(nskb, skb->dev->dev_addr, skb->dev->dev_addr);
+        if (unlikely(rc))
+                goto free;
+        llc_station_send_pdu(nskb);
+out:
+        return rc;
+free:
+        kfree_skb(skb);
+        goto out;
+}
+
 static int llc_station_ac_send_xid_r(struct sk_buff *skb)
 {
         u8 mac_da[ETH_ALEN], dsap;
@@ -62,11 +289,11 @@ static int llc_station_ac_send_xid_r(struct sk_buff *skb)
         rc = llc_mac_hdr_init(nskb, skb->dev->dev_addr, mac_da);
         if (unlikely(rc))
                 goto free;
-        dev_queue_xmit(nskb);
+        llc_station_send_pdu(nskb);
 out:
         return rc;
 free:
-        kfree_skb(nskb);
+        kfree_skb(skb);
         goto out;
 }
 
@@ -91,15 +318,361 @@ static int llc_station_ac_send_test_r(struct sk_buff *skb)
         rc = llc_mac_hdr_init(nskb, skb->dev->dev_addr, mac_da);
         if (unlikely(rc))
                 goto free;
-        dev_queue_xmit(nskb);
+        llc_station_send_pdu(nskb);
 out:
         return rc;
 free:
-        kfree_skb(nskb);
+        kfree_skb(skb);
         goto out;
 }
 
+static int llc_station_ac_report_status(struct sk_buff *skb)
+{
+        return 0;
+}
+
+/* COMMON STATION STATE transitions */
+
+/* dummy last-transition indicator; common to all state transition groups
+ * last entry for this state
+ * all members are zeros, .bss zeroes it
+ */
+static struct llc_station_state_trans llc_stat_state_trans_end;
+
+/* DOWN STATE transitions */
+
+/* state transition for LLC_STATION_EV_ENABLE_WITH_DUP_ADDR_CHECK event */
+static llc_station_action_t llc_stat_down_state_actions_1[] = {
+        [0] = llc_station_ac_start_ack_timer,
+        [1] = llc_station_ac_set_retry_cnt_0,
+        [2] = llc_station_ac_set_xid_r_cnt_0,
+        [3] = llc_station_ac_send_null_dsap_xid_c,
+        [4] = NULL,
+};
+
+static struct llc_station_state_trans llc_stat_down_state_trans_1 = {
+        .ev         = llc_stat_ev_enable_with_dup_addr_check,
+        .next_state = LLC_STATION_STATE_DUP_ADDR_CHK,
+        .ev_actions = llc_stat_down_state_actions_1,
+};
+
+/* state transition for LLC_STATION_EV_ENABLE_WITHOUT_DUP_ADDR_CHECK event */
+static llc_station_action_t llc_stat_down_state_actions_2[] = {
+        [0] = llc_station_ac_report_status,     /* STATION UP */
+        [1] = NULL,
+};
+
+static struct llc_station_state_trans llc_stat_down_state_trans_2 = {
+        .ev         = llc_stat_ev_enable_without_dup_addr_check,
+        .next_state = LLC_STATION_STATE_UP,
+        .ev_actions = llc_stat_down_state_actions_2,
+};
+
+/* array of pointers; one to each transition */
+static struct llc_station_state_trans *llc_stat_dwn_state_trans[] = {
+        [0] = &llc_stat_down_state_trans_1,
+        [1] = &llc_stat_down_state_trans_2,
+        [2] = &llc_stat_state_trans_end,
+};
+
+/* UP STATE transitions */
+/* state transition for LLC_STATION_EV_DISABLE_REQ event */
+static llc_station_action_t llc_stat_up_state_actions_1[] = {
+        [0] = llc_station_ac_report_status,     /* STATION DOWN */
+        [1] = NULL,
+};
+
+static struct llc_station_state_trans llc_stat_up_state_trans_1 = {
+        .ev         = llc_stat_ev_disable_req,
+        .next_state = LLC_STATION_STATE_DOWN,
+        .ev_actions = llc_stat_up_state_actions_1,
+};
+
+/* state transition for LLC_STATION_EV_RX_NULL_DSAP_XID_C event */
+static llc_station_action_t llc_stat_up_state_actions_2[] = {
+        [0] = llc_station_ac_send_xid_r,
+        [1] = NULL,
+};
+
+static struct llc_station_state_trans llc_stat_up_state_trans_2 = {
+        .ev         = llc_stat_ev_rx_null_dsap_xid_c,
+        .next_state = LLC_STATION_STATE_UP,
+        .ev_actions = llc_stat_up_state_actions_2,
+};
+
+/* state transition for LLC_STATION_EV_RX_NULL_DSAP_TEST_C event */
+static llc_station_action_t llc_stat_up_state_actions_3[] = {
+        [0] = llc_station_ac_send_test_r,
+        [1] = NULL,
+};
+
+static struct llc_station_state_trans llc_stat_up_state_trans_3 = {
+        .ev         = llc_stat_ev_rx_null_dsap_test_c,
+        .next_state = LLC_STATION_STATE_UP,
+        .ev_actions = llc_stat_up_state_actions_3,
+};
+
+/* array of pointers; one to each transition */
+static struct llc_station_state_trans *llc_stat_up_state_trans [] = {
+        [0] = &llc_stat_up_state_trans_1,
+        [1] = &llc_stat_up_state_trans_2,
+        [2] = &llc_stat_up_state_trans_3,
+        [3] = &llc_stat_state_trans_end,
+};
+
+/* DUP ADDR CHK STATE transitions */
+/* state transition for LLC_STATION_EV_RX_NULL_DSAP_0_XID_R_XID_R_CNT_EQ
+ * event
+ */
+static llc_station_action_t llc_stat_dupaddr_state_actions_1[] = {
+        [0] = llc_station_ac_inc_xid_r_cnt_by_1,
+        [1] = NULL,
+};
+
+static struct llc_station_state_trans llc_stat_dupaddr_state_trans_1 = {
+        .ev         = llc_stat_ev_rx_null_dsap_0_xid_r_xid_r_cnt_eq,
+        .next_state = LLC_STATION_STATE_DUP_ADDR_CHK,
+        .ev_actions = llc_stat_dupaddr_state_actions_1,
+};
+
+/* state transition for LLC_STATION_EV_RX_NULL_DSAP_1_XID_R_XID_R_CNT_EQ
+ * event
+ */
+static llc_station_action_t llc_stat_dupaddr_state_actions_2[] = {
+        [0] = llc_station_ac_report_status,     /* DUPLICATE ADDRESS FOUND */
+        [1] = NULL,
+};
+
+static struct llc_station_state_trans llc_stat_dupaddr_state_trans_2 = {
+        .ev         = llc_stat_ev_rx_null_dsap_1_xid_r_xid_r_cnt_eq,
+        .next_state = LLC_STATION_STATE_DOWN,
+        .ev_actions = llc_stat_dupaddr_state_actions_2,
+};
+
+/* state transition for LLC_STATION_EV_RX_NULL_DSAP_XID_C event */
+static llc_station_action_t llc_stat_dupaddr_state_actions_3[] = {
+        [0] = llc_station_ac_send_xid_r,
+        [1] = NULL,
+};
+
+static struct llc_station_state_trans llc_stat_dupaddr_state_trans_3 = {
+        .ev         = llc_stat_ev_rx_null_dsap_xid_c,
+        .next_state = LLC_STATION_STATE_DUP_ADDR_CHK,
+        .ev_actions = llc_stat_dupaddr_state_actions_3,
+};
+
+/* state transition for LLC_STATION_EV_ACK_TMR_EXP_LT_RETRY_CNT_MAX_RETRY
+ * event
+ */
+static llc_station_action_t llc_stat_dupaddr_state_actions_4[] = {
+        [0] = llc_station_ac_start_ack_timer,
+        [1] = llc_station_ac_inc_retry_cnt_by_1,
+        [2] = llc_station_ac_set_xid_r_cnt_0,
+        [3] = llc_station_ac_send_null_dsap_xid_c,
+        [4] = NULL,
+};
+
+static struct llc_station_state_trans llc_stat_dupaddr_state_trans_4 = {
+        .ev         = llc_stat_ev_ack_tmr_exp_lt_retry_cnt_max_retry,
+        .next_state = LLC_STATION_STATE_DUP_ADDR_CHK,
+        .ev_actions = llc_stat_dupaddr_state_actions_4,
+};
+
+/* state transition for LLC_STATION_EV_ACK_TMR_EXP_EQ_RETRY_CNT_MAX_RETRY
+ * event
+ */
+static llc_station_action_t llc_stat_dupaddr_state_actions_5[] = {
+        [0] = llc_station_ac_report_status,     /* STATION UP */
+        [1] = NULL,
+};
+
+static struct llc_station_state_trans llc_stat_dupaddr_state_trans_5 = {
+        .ev         = llc_stat_ev_ack_tmr_exp_eq_retry_cnt_max_retry,
+        .next_state = LLC_STATION_STATE_UP,
+        .ev_actions = llc_stat_dupaddr_state_actions_5,
+};
+
+/* state transition for LLC_STATION_EV_DISABLE_REQ event */
+static llc_station_action_t llc_stat_dupaddr_state_actions_6[] = {
+        [0] = llc_station_ac_report_status,     /* STATION DOWN */
+        [1] = NULL,
+};
+
+static struct llc_station_state_trans llc_stat_dupaddr_state_trans_6 = {
+        .ev         = llc_stat_ev_disable_req,
+        .next_state = LLC_STATION_STATE_DOWN,
+        .ev_actions = llc_stat_dupaddr_state_actions_6,
+};
+
+/* array of pointers; one to each transition */
+static struct llc_station_state_trans *llc_stat_dupaddr_state_trans[] = {
+        [0] = &llc_stat_dupaddr_state_trans_6,  /* Request */
+        [1] = &llc_stat_dupaddr_state_trans_4,  /* Timer */
+        [2] = &llc_stat_dupaddr_state_trans_5,
+        [3] = &llc_stat_dupaddr_state_trans_1,  /* Receive frame */
+        [4] = &llc_stat_dupaddr_state_trans_2,
+        [5] = &llc_stat_dupaddr_state_trans_3,
+        [6] = &llc_stat_state_trans_end,
+};
+
+static struct llc_station_state
+                        llc_station_state_table[LLC_NBR_STATION_STATES] = {
+        [LLC_STATION_STATE_DOWN - 1] = {
+                .curr_state  = LLC_STATION_STATE_DOWN,
+                .transitions = llc_stat_dwn_state_trans,
+        },
+        [LLC_STATION_STATE_DUP_ADDR_CHK - 1] = {
+                .curr_state  = LLC_STATION_STATE_DUP_ADDR_CHK,
+                .transitions = llc_stat_dupaddr_state_trans,
+        },
+        [LLC_STATION_STATE_UP - 1] = {
+                .curr_state  = LLC_STATION_STATE_UP,
+                .transitions = llc_stat_up_state_trans,
+        },
+};
+
 /**
+ *      llc_exec_station_trans_actions - executes actions for transition
+ *      @trans: Address of the transition
+ *      @skb: Address of the event that caused the transition
+ *
+ *      Executes actions of a transition of the station state machine. Returns
+ *      0 if all actions complete successfully, nonzero otherwise.
+ */
+static u16 llc_exec_station_trans_actions(struct llc_station_state_trans *trans,
+                                          struct sk_buff *skb)
+{
+        u16 rc = 0;
+        llc_station_action_t *next_action = trans->ev_actions;
+
+        for (; next_action && *next_action; next_action++)
+                if ((*next_action)(skb))
+                        rc = 1;
+        return rc;
+}
+
+/**
+ *      llc_find_station_trans - finds transition for this event
+ *      @skb: Address of the event
+ *
+ *      Search thru events of the current state of the station until list
+ *      exhausted or it's obvious that the event is not valid for the current
+ *      state. Returns the address of the transition if cound, %NULL otherwise.
+ */
+static struct llc_station_state_trans *
+                                llc_find_station_trans(struct sk_buff *skb)
+{
+        int i = 0;
+        struct llc_station_state_trans *rc = NULL;
+        struct llc_station_state_trans **next_trans;
+        struct llc_station_state *curr_state =
+                                &llc_station_state_table[llc_main_station.state - 1];
+
+        for (next_trans = curr_state->transitions; next_trans[i]->ev; i++)
+                if (!next_trans[i]->ev(skb)) {
+                        rc = next_trans[i];
+                        break;
+                }
+        return rc;
+}
+
+/**
+ *      llc_station_free_ev - frees an event
+ *      @skb: Address of the event
+ *
+ *      Frees an event.
+ */
+static void llc_station_free_ev(struct sk_buff *skb)
+{
+        struct llc_station_state_ev *ev = llc_station_ev(skb);
+
+        if (ev->type == LLC_STATION_EV_TYPE_PDU)
+                kfree_skb(skb);
+}
+
+/**
+ *      llc_station_next_state - processes event and goes to the next state
+ *      @skb: Address of the event
+ *
+ *      Processes an event, executes any transitions related to that event and
+ *      updates the state of the station.
+ */
+static u16 llc_station_next_state(struct sk_buff *skb)
+{
+        u16 rc = 1;
+        struct llc_station_state_trans *trans;
+
+        if (llc_main_station.state > LLC_NBR_STATION_STATES)
+                goto out;
+        trans = llc_find_station_trans(skb);
+        if (trans) {
+                /* got the state to which we next transition; perform the
+                 * actions associated with this transition before actually
+                 * transitioning to the next state
+                 */
+                rc = llc_exec_station_trans_actions(trans, skb);
+                if (!rc)
+                        /* transition station to next state if all actions
+                         * execute successfully; done; wait for next event
+                         */
+                        llc_main_station.state = trans->next_state;
+        } else
+                /* event not recognized in current state; re-queue it for
+                 * processing again at a later time; return failure
+                 */
+                rc = 0;
+out:
+        llc_station_free_ev(skb);
+        return rc;
+}
+
+/**
+ *      llc_station_service_events - service events in the queue
+ *
+ *      Get an event from the station event queue (if any); attempt to service
+ *      the event; if event serviced, get the next event (if any) on the event
+ *      queue; if event not service, re-queue the event on the event queue and
+ *      attempt to service the next event; when serviced all events in queue,
+ *      finished; if don't transition to different state, just service all
+ *      events once; if transition to new state, service all events again.
+ *      Caller must hold llc_main_station.ev_q.lock.
+ */
+static void llc_station_service_events(void)
+{
+        struct sk_buff *skb;
+
+        while ((skb = skb_dequeue(&llc_main_station.ev_q.list)) != NULL)
+                llc_station_next_state(skb);
+}
+
+/**
+ *      llc_station_state_process: queue event and try to process queue.
+ *      @skb: Address of the event
+ *
+ *      Queues an event (on the station event queue) for handling by the
+ *      station state machine and attempts to process any queued-up events.
+ */
+static void llc_station_state_process(struct sk_buff *skb)
+{
+        spin_lock_bh(&llc_main_station.ev_q.lock);
+        skb_queue_tail(&llc_main_station.ev_q.list, skb);
+        llc_station_service_events();
+        spin_unlock_bh(&llc_main_station.ev_q.lock);
+}
+
+static void llc_station_ack_tmr_cb(unsigned long timeout_data)
+{
+        struct sk_buff *skb = alloc_skb(0, GFP_ATOMIC);
+
+        if (skb) {
+                struct llc_station_state_ev *ev = llc_station_ev(skb);
+
+                ev->type = LLC_STATION_EV_TYPE_ACK_TMR;
+                llc_station_state_process(skb);
+        }
+}
+
+/*
  *      llc_station_rcv - send received pdu to the station state machine
  *      @skb: received frame.
  *
@@ -107,19 +680,43 @@ free:
  */
 static void llc_station_rcv(struct sk_buff *skb)
 {
-        if (llc_stat_ev_rx_null_dsap_xid_c(skb))
-                llc_station_ac_send_xid_r(skb);
-        else if (llc_stat_ev_rx_null_dsap_test_c(skb))
-                llc_station_ac_send_test_r(skb);
-        kfree_skb(skb);
+        struct llc_station_state_ev *ev = llc_station_ev(skb);
+
+        ev->type   = LLC_STATION_EV_TYPE_PDU;
+        ev->reason = 0;
+        llc_station_state_process(skb);
 }
 
-void __init llc_station_init(void)
+int __init llc_station_init(void)
 {
+        int rc = -ENOBUFS;
+        struct sk_buff *skb;
+        struct llc_station_state_ev *ev;
+
+        skb_queue_head_init(&llc_main_station.mac_pdu_q);
+        skb_queue_head_init(&llc_main_station.ev_q.list);
+        spin_lock_init(&llc_main_station.ev_q.lock);
+        setup_timer(&llc_main_station.ack_timer, llc_station_ack_tmr_cb,
+                        (unsigned long)&llc_main_station);
+        llc_main_station.ack_timer.expires  = jiffies +
+                                                sysctl_llc_station_ack_timeout;
+        skb = alloc_skb(0, GFP_ATOMIC);
+        if (!skb)
+                goto out;
+        rc = 0;
         llc_set_station_handler(llc_station_rcv);
+        ev = llc_station_ev(skb);
+        memset(ev, 0, sizeof(*ev));
+        llc_main_station.maximum_retry  = 1;
+        llc_main_station.state          = LLC_STATION_STATE_DOWN;
+        ev->type        = LLC_STATION_EV_TYPE_SIMPLE;
+        ev->prim_type   = LLC_STATION_EV_ENABLE_WITHOUT_DUP_ADDR_CHECK;
+        rc = llc_station_next_state(skb);
+out:
+        return rc;
 }
 
-void llc_station_exit(void)
+void __exit llc_station_exit(void)
 {
         llc_set_station_handler(NULL);
 }
diff --git a/net/llc/sysctl_net_llc.c b/net/llc/sysctl_net_llc.c
index 612a5ddaf93..e2ebe358626 100644
--- a/net/llc/sysctl_net_llc.c
+++ b/net/llc/sysctl_net_llc.c
@@ -7,7 +7,6 @@
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/sysctl.h>
-#include <net/net_namespace.h>
 #include <net/llc.h>
 
 #ifndef CONFIG_SYSCTL
@@ -47,32 +46,58 @@ static struct ctl_table llc2_timeout_table[] = {
 };
 
 static struct ctl_table llc_station_table[] = {
+        {
+                .procname       = "ack_timeout",
+                .data           = &sysctl_llc_station_ack_timeout,
+                .maxlen         = sizeof(long),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_jiffies,
+        },
         { },
 };
 
-static struct ctl_table_header *llc2_timeout_header;
-static struct ctl_table_header *llc_station_header;
+static struct ctl_table llc2_dir_timeout_table[] = {
+        {
+                .procname       = "timeout",
+                .mode           = 0555,
+                .child          = llc2_timeout_table,
+        },
+        { },
+};
+
+static struct ctl_table llc_table[] = {
+        {
+                .procname       = "llc2",
+                .mode           = 0555,
+                .child          = llc2_dir_timeout_table,
+        },
+        {
+                .procname       = "station",
+                .mode           = 0555,
+                .child          = llc_station_table,
+        },
+        { },
+};
+
+static struct ctl_path llc_path[] = {
+        { .procname = "net", },
+        { .procname = "llc", },
+        { }
+};
+
+static struct ctl_table_header *llc_table_header;
 
 int __init llc_sysctl_init(void)
 {
-        llc2_timeout_header = register_net_sysctl(&init_net, "net/llc/llc2/timeout", llc2_timeout_table);
-        llc_station_header = register_net_sysctl(&init_net, "net/llc/station", llc_station_table);
+        llc_table_header = register_sysctl_paths(llc_path, llc_table);
 
-        if (!llc2_timeout_header || !llc_station_header) {
-                llc_sysctl_exit();
-                return -ENOMEM;
-        }
-        return 0;
+        return llc_table_header ? 0 : -ENOMEM;
 }
 
 void llc_sysctl_exit(void)
 {
-        if (llc2_timeout_header) {
-                unregister_net_sysctl_table(llc2_timeout_header);
-                llc2_timeout_header = NULL;
-        }
-        if (llc_station_header) {
-                unregister_net_sysctl_table(llc_station_header);
-                llc_station_header = NULL;
+        if (llc_table_header) {
+                unregister_sysctl_table(llc_table_header);
+                llc_table_header = NULL;
         }
 }