Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1815 commits)
  mac80211: fix reorder buffer release
  iwmc3200wifi: Enable wimax core through module parameter
  iwmc3200wifi: Add wifi-wimax coexistence mode as a module parameter
  iwmc3200wifi: Coex table command does not expect a response
  iwmc3200wifi: Update wiwi priority table
  iwlwifi: driver version track kernel version
  iwlwifi: indicate uCode type when fail dump error/event log
  iwl3945: remove duplicated event logging code
  b43: fix two warnings
  ipw2100: fix rebooting hang with driver loaded
  cfg80211: indent regulatory messages with spaces
  iwmc3200wifi: fix NULL pointer dereference in pmkid update
  mac80211: Fix TX status reporting for injected data frames
  ath9k: enable 2GHz band only if the device supports it
  airo: Fix integer overflow warning
  rt2x00: Fix padding bug on L2PAD devices.
  WE: Fix set events not propagated
  b43legacy: avoid PPC fault during resume
  b43: avoid PPC fault during resume
  tcp: fix a timewait refcnt race
  ...

Fix up conflicts due to sysctl cleanups (dead sysctl_check code and
CTL_UNNUMBERED removed) in
	kernel/sysctl_check.c
	net/ipv4/sysctl_net_ipv4.c
	net/ipv6/addrconf.c
	net/sctp/sysctl.c

6 files changed, 463 insertions, 100 deletions

diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index f60c0c2aacba..526d0273991a 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -35,7 +35,6 @@
 
 /* Transport protocol registration */
 static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly;
-static DEFINE_SPINLOCK(proto_tab_lock);
 
 static struct phonet_protocol *phonet_proto_get(int protocol)
 {
@@ -44,11 +43,11 @@ static struct phonet_protocol *phonet_proto_get(int protocol)
         if (protocol >= PHONET_NPROTO)
                 return NULL;
 
-        spin_lock(&proto_tab_lock);
-        pp = proto_tab[protocol];
+        rcu_read_lock();
+        pp = rcu_dereference(proto_tab[protocol]);
         if (pp && !try_module_get(pp->prot->owner))
                 pp = NULL;
-        spin_unlock(&proto_tab_lock);
+        rcu_read_unlock();
 
         return pp;
 }
@@ -60,7 +59,8 @@ static inline void phonet_proto_put(struct phonet_protocol *pp)
 
 /* protocol family functions */
 
-static int pn_socket_create(struct net *net, struct socket *sock, int protocol)
+static int pn_socket_create(struct net *net, struct socket *sock, int protocol,
+                            int kern)
 {
         struct sock *sk;
         struct pn_sock *pn;
@@ -118,7 +118,7 @@ out:
         return err;
 }
 
-static struct net_proto_family phonet_proto_family = {
+static const struct net_proto_family phonet_proto_family = {
         .family = PF_PHONET,
         .create = pn_socket_create,
         .owner = THIS_MODULE,
@@ -190,9 +190,8 @@ static int pn_send(struct sk_buff *skb, struct net_device *dev,
         skb->priority = 0;
         skb->dev = dev;
 
-        if (pn_addr(src) == pn_addr(dst)) {
+        if (skb->pkt_type == PACKET_LOOPBACK) {
                 skb_reset_mac_header(skb);
-                skb->pkt_type = PACKET_LOOPBACK;
                 skb_orphan(skb);
                 if (irq)
                         netif_rx(skb);
@@ -222,6 +221,9 @@ static int pn_raw_send(const void *data, int len, struct net_device *dev,
         if (skb == NULL)
                 return -ENOMEM;
 
+        if (phonet_address_lookup(dev_net(dev), pn_addr(dst)) == 0)
+                skb->pkt_type = PACKET_LOOPBACK;
+
         skb_reserve(skb, MAX_PHONET_HEADER);
         __skb_put(skb, len);
         skb_copy_to_linear_data(skb, data, len);
@@ -235,6 +237,7 @@ static int pn_raw_send(const void *data, int len, struct net_device *dev,
 int pn_skb_send(struct sock *sk, struct sk_buff *skb,
                 const struct sockaddr_pn *target)
 {
+        struct net *net = sock_net(sk);
         struct net_device *dev;
         struct pn_sock *pn = pn_sk(sk);
         int err;
@@ -243,9 +246,13 @@ int pn_skb_send(struct sock *sk, struct sk_buff *skb,
 
         err = -EHOSTUNREACH;
         if (sk->sk_bound_dev_if)
-                dev = dev_get_by_index(sock_net(sk), sk->sk_bound_dev_if);
-        else
-                dev = phonet_device_get(sock_net(sk));
+                dev = dev_get_by_index(net, sk->sk_bound_dev_if);
+        else if (phonet_address_lookup(net, daddr) == 0) {
+                dev = phonet_device_get(net);
+                skb->pkt_type = PACKET_LOOPBACK;
+        } else
+                dev = phonet_route_output(net, daddr);
+
         if (!dev || !(dev->flags & IFF_UP))
                 goto drop;
 
@@ -369,6 +376,12 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
 
         pn_skb_get_dst_sockaddr(skb, &sa);
 
+        /* check if this is broadcasted */
+        if (pn_sockaddr_get_addr(&sa) == PNADDR_BROADCAST) {
+                pn_deliver_sock_broadcast(net, skb);
+                goto out;
+        }
+
         /* check if we are the destination */
         if (phonet_address_lookup(net, pn_sockaddr_get_addr(&sa)) == 0) {
                 /* Phonet packet input */
@@ -381,6 +394,38 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
                         send_obj_unreachable(skb);
                         send_reset_indications(skb);
                 }
+        } else if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
+                goto out; /* Race between address deletion and loopback */
+        else {
+                /* Phonet packet routing */
+                struct net_device *out_dev;
+
+                out_dev = phonet_route_output(net, pn_sockaddr_get_addr(&sa));
+                if (!out_dev) {
+                        LIMIT_NETDEBUG(KERN_WARNING"No Phonet route to %02X\n",
+                                        pn_sockaddr_get_addr(&sa));
+                        goto out;
+                }
+
+                __skb_push(skb, sizeof(struct phonethdr));
+                skb->dev = out_dev;
+                if (out_dev == dev) {
+                        LIMIT_NETDEBUG(KERN_ERR"Phonet loop to %02X on %s\n",
+                                        pn_sockaddr_get_addr(&sa), dev->name);
+                        goto out_dev;
+                }
+                /* Some drivers (e.g. TUN) do not allocate HW header space */
+                if (skb_cow_head(skb, out_dev->hard_header_len))
+                        goto out_dev;
+
+                if (dev_hard_header(skb, out_dev, ETH_P_PHONET, NULL, NULL,
+                                        skb->len) < 0)
+                        goto out_dev;
+                dev_queue_xmit(skb);
+                dev_put(out_dev);
+                return NET_RX_SUCCESS;
+out_dev:
+                dev_put(out_dev);
         }
 
 out:
@@ -393,6 +438,8 @@ static struct packet_type phonet_packet_type __read_mostly = {
         .func = phonet_rcv,
 };
 
+static DEFINE_MUTEX(proto_tab_lock);
+
 int __init_or_module phonet_proto_register(int protocol,
                                                 struct phonet_protocol *pp)
 {
@@ -405,12 +452,12 @@ int __init_or_module phonet_proto_register(int protocol,
         if (err)
                 return err;
 
-        spin_lock(&proto_tab_lock);
+        mutex_lock(&proto_tab_lock);
         if (proto_tab[protocol])
                 err = -EBUSY;
         else
-                proto_tab[protocol] = pp;
-        spin_unlock(&proto_tab_lock);
+                rcu_assign_pointer(proto_tab[protocol], pp);
+        mutex_unlock(&proto_tab_lock);
 
         return err;
 }
@@ -418,10 +465,11 @@ EXPORT_SYMBOL(phonet_proto_register);
 
 void phonet_proto_unregister(int protocol, struct phonet_protocol *pp)
 {
-        spin_lock(&proto_tab_lock);
+        mutex_lock(&proto_tab_lock);
         BUG_ON(proto_tab[protocol] != pp);
-        proto_tab[protocol] = NULL;
-        spin_unlock(&proto_tab_lock);
+        rcu_assign_pointer(proto_tab[protocol], NULL);
+        mutex_unlock(&proto_tab_lock);
+        synchronize_rcu();
         proto_unregister(pp->prot);
 }
 EXPORT_SYMBOL(phonet_proto_unregister);
@@ -435,6 +483,7 @@ static int __init phonet_init(void)
         if (err)
                 return err;
 
+        pn_sock_init();
         err = sock_register(&phonet_proto_family);
         if (err) {
                 printk(KERN_ALERT
diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
index ef5c75c372e4..67f072e94d00 100644
--- a/net/phonet/datagram.c
+++ b/net/phonet/datagram.c
@@ -159,11 +159,9 @@ out_nofree:
 static int pn_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 {
         int err = sock_queue_rcv_skb(sk, skb);
-        if (err < 0) {
+
+        if (err < 0)
                 kfree_skb(skb);
-                if (err == -ENOMEM)
-                        atomic_inc(&sk->sk_drops);
-        }
         return err ? NET_RX_DROP : NET_RX_SUCCESS;
 }
 
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 5f32d217535b..b6356f3832f6 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -360,8 +360,6 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
                         err = sock_queue_rcv_skb(sk, skb);
                         if (!err)
                                 return 0;
-                        if (err == -ENOMEM)
-                                atomic_inc(&sk->sk_drops);
                         break;
                 }
 
@@ -716,8 +714,8 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg)
                         return -EINVAL;
 
                 lock_sock(sk);
-                if (sock_flag(sk, SOCK_URGINLINE)
-                 && !skb_queue_empty(&pn->ctrlreq_queue))
+                if (sock_flag(sk, SOCK_URGINLINE) &&
+                    !skb_queue_empty(&pn->ctrlreq_queue))
                         answ = skb_peek(&pn->ctrlreq_queue)->len;
                 else if (!skb_queue_empty(&sk->sk_receive_queue))
                         answ = skb_peek(&sk->sk_receive_queue)->len;
@@ -845,7 +843,7 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
                         struct msghdr *msg, size_t len)
 {
         struct pep_sock *pn = pep_sk(sk);
-        struct sk_buff *skb = NULL;
+        struct sk_buff *skb;
         long timeo;
         int flags = msg->msg_flags;
         int err, done;
@@ -853,6 +851,16 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
         if (msg->msg_flags & MSG_OOB || !(msg->msg_flags & MSG_EOR))
                 return -EOPNOTSUPP;
 
+        skb = sock_alloc_send_skb(sk, MAX_PNPIPE_HEADER + len,
+                                        flags & MSG_DONTWAIT, &err);
+        if (!skb)
+                return -ENOBUFS;
+
+        skb_reserve(skb, MAX_PHONET_HEADER + 3);
+        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+        if (err < 0)
+                goto outfree;
+
         lock_sock(sk);
         timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
         if ((1 << sk->sk_state) & (TCPF_LISTEN|TCPF_CLOSE)) {
@@ -896,28 +904,13 @@ disabled:
                         goto disabled;
         }
 
-        if (!skb) {
-                skb = sock_alloc_send_skb(sk, MAX_PNPIPE_HEADER + len,
-                                                flags & MSG_DONTWAIT, &err);
-                if (skb == NULL)
-                        goto out;
-                skb_reserve(skb, MAX_PHONET_HEADER + 3);
-
-                if (sk->sk_state != TCP_ESTABLISHED ||
-                    !atomic_read(&pn->tx_credits))
-                        goto disabled; /* sock_alloc_send_skb might sleep */
-        }
-
-        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
-        if (err < 0)
-                goto out;
-
         err = pipe_skb_send(sk, skb);
         if (err >= 0)
                 err = len; /* success! */
         skb = NULL;
 out:
         release_sock(sk);
+outfree:
         kfree_skb(skb);
         return err;
 }
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 5f42f30dd168..bc4a33bf2d3d 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -33,11 +33,17 @@
 #include <net/netns/generic.h>
 #include <net/phonet/pn_dev.h>
 
+struct phonet_routes {
+        struct mutex            lock;
+        struct net_device       *table[64];
+};
+
 struct phonet_net {
         struct phonet_device_list pndevs;
+        struct phonet_routes routes;
 };
 
-int phonet_net_id;
+int phonet_net_id __read_mostly;
 
 struct phonet_device_list *phonet_device_list(struct net *net)
 {
@@ -55,7 +61,8 @@ static struct phonet_device *__phonet_device_alloc(struct net_device *dev)
         pnd->netdev = dev;
         bitmap_zero(pnd->addrs, 64);
 
-        list_add(&pnd->list, &pndevs->list);
+        BUG_ON(!mutex_is_locked(&pndevs->lock));
+        list_add_rcu(&pnd->list, &pndevs->list);
         return pnd;
 }
 
@@ -64,6 +71,7 @@ static struct phonet_device *__phonet_get(struct net_device *dev)
         struct phonet_device_list *pndevs = phonet_device_list(dev_net(dev));
         struct phonet_device *pnd;
 
+        BUG_ON(!mutex_is_locked(&pndevs->lock));
         list_for_each_entry(pnd, &pndevs->list, list) {
                 if (pnd->netdev == dev)
                         return pnd;
@@ -71,6 +79,18 @@ static struct phonet_device *__phonet_get(struct net_device *dev)
         return NULL;
 }
 
+static struct phonet_device *__phonet_get_rcu(struct net_device *dev)
+{
+        struct phonet_device_list *pndevs = phonet_device_list(dev_net(dev));
+        struct phonet_device *pnd;
+
+        list_for_each_entry_rcu(pnd, &pndevs->list, list) {
+                if (pnd->netdev == dev)
+                        return pnd;
+        }
+        return NULL;
+}
+
 static void phonet_device_destroy(struct net_device *dev)
 {
         struct phonet_device_list *pndevs = phonet_device_list(dev_net(dev));
@@ -78,11 +98,11 @@ static void phonet_device_destroy(struct net_device *dev)
 
         ASSERT_RTNL();
 
-        spin_lock_bh(&pndevs->lock);
+        mutex_lock(&pndevs->lock);
         pnd = __phonet_get(dev);
         if (pnd)
-                list_del(&pnd->list);
-        spin_unlock_bh(&pndevs->lock);
+                list_del_rcu(&pnd->list);
+        mutex_unlock(&pndevs->lock);
 
         if (pnd) {
                 u8 addr;
@@ -100,8 +120,8 @@ struct net_device *phonet_device_get(struct net *net)
         struct phonet_device *pnd;
         struct net_device *dev = NULL;
 
-        spin_lock_bh(&pndevs->lock);
-        list_for_each_entry(pnd, &pndevs->list, list) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(pnd, &pndevs->list, list) {
                 dev = pnd->netdev;
                 BUG_ON(!dev);
 
@@ -112,7 +132,7 @@ struct net_device *phonet_device_get(struct net *net)
         }
         if (dev)
                 dev_hold(dev);
-        spin_unlock_bh(&pndevs->lock);
+        rcu_read_unlock();
         return dev;
 }
 
@@ -122,7 +142,7 @@ int phonet_address_add(struct net_device *dev, u8 addr)
         struct phonet_device *pnd;
         int err = 0;
 
-        spin_lock_bh(&pndevs->lock);
+        mutex_lock(&pndevs->lock);
         /* Find or create Phonet-specific device data */
         pnd = __phonet_get(dev);
         if (pnd == NULL)
@@ -131,7 +151,7 @@ int phonet_address_add(struct net_device *dev, u8 addr)
                 err = -ENOMEM;
         else if (test_and_set_bit(addr >> 2, pnd->addrs))
                 err = -EEXIST;
-        spin_unlock_bh(&pndevs->lock);
+        mutex_unlock(&pndevs->lock);
         return err;
 }
 
@@ -141,36 +161,56 @@ int phonet_address_del(struct net_device *dev, u8 addr)
         struct phonet_device *pnd;
         int err = 0;
 
-        spin_lock_bh(&pndevs->lock);
+        mutex_lock(&pndevs->lock);
         pnd = __phonet_get(dev);
-        if (!pnd || !test_and_clear_bit(addr >> 2, pnd->addrs))
+        if (!pnd || !test_and_clear_bit(addr >> 2, pnd->addrs)) {
                 err = -EADDRNOTAVAIL;
-        else if (bitmap_empty(pnd->addrs, 64)) {
-                list_del(&pnd->list);
+                pnd = NULL;
+        } else if (bitmap_empty(pnd->addrs, 64))
+                list_del_rcu(&pnd->list);
+        else
+                pnd = NULL;
+        mutex_unlock(&pndevs->lock);
+
+        if (pnd) {
+                synchronize_rcu();
                 kfree(pnd);
         }
-        spin_unlock_bh(&pndevs->lock);
         return err;
 }
 
 /* Gets a source address toward a destination, through a interface. */
-u8 phonet_address_get(struct net_device *dev, u8 addr)
+u8 phonet_address_get(struct net_device *dev, u8 daddr)
 {
-        struct phonet_device_list *pndevs = phonet_device_list(dev_net(dev));
         struct phonet_device *pnd;
+        u8 saddr;
 
-        spin_lock_bh(&pndevs->lock);
-        pnd = __phonet_get(dev);
+        rcu_read_lock();
+        pnd = __phonet_get_rcu(dev);
         if (pnd) {
                 BUG_ON(bitmap_empty(pnd->addrs, 64));
 
                 /* Use same source address as destination, if possible */
-                if (!test_bit(addr >> 2, pnd->addrs))
-                        addr = find_first_bit(pnd->addrs, 64) << 2;
+                if (test_bit(daddr >> 2, pnd->addrs))
+                        saddr = daddr;
+                else
+                        saddr = find_first_bit(pnd->addrs, 64) << 2;
         } else
-                addr = PN_NO_ADDR;
-        spin_unlock_bh(&pndevs->lock);
-        return addr;
+                saddr = PN_NO_ADDR;
+        rcu_read_unlock();
+
+        if (saddr == PN_NO_ADDR) {
+                /* Fallback to another device */
+                struct net_device *def_dev;
+
+                def_dev = phonet_device_get(dev_net(dev));
+                if (def_dev) {
+                        if (def_dev != dev)
+                                saddr = phonet_address_get(def_dev, daddr);
+                        dev_put(def_dev);
+                }
+        }
+        return saddr;
 }
 
 int phonet_address_lookup(struct net *net, u8 addr)
@@ -179,8 +219,8 @@ int phonet_address_lookup(struct net *net, u8 addr)
         struct phonet_device *pnd;
         int err = -EADDRNOTAVAIL;
 
-        spin_lock_bh(&pndevs->lock);
-        list_for_each_entry(pnd, &pndevs->list, list) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(pnd, &pndevs->list, list) {
                 /* Don't allow unregistering devices! */
                 if ((pnd->netdev->reg_state != NETREG_REGISTERED) ||
                                 ((pnd->netdev->flags & IFF_UP)) != IFF_UP)
@@ -192,7 +232,7 @@ int phonet_address_lookup(struct net *net, u8 addr)
                 }
         }
 found:
-        spin_unlock_bh(&pndevs->lock);
+        rcu_read_unlock();
         return err;
 }
 
@@ -219,6 +259,32 @@ static int phonet_device_autoconf(struct net_device *dev)
         return 0;
 }
 
+static void phonet_route_autodel(struct net_device *dev)
+{
+        struct phonet_net *pnn = net_generic(dev_net(dev), phonet_net_id);
+        unsigned i;
+        DECLARE_BITMAP(deleted, 64);
+
+        /* Remove left-over Phonet routes */
+        bitmap_zero(deleted, 64);
+        mutex_lock(&pnn->routes.lock);
+        for (i = 0; i < 64; i++)
+                if (dev == pnn->routes.table[i]) {
+                        rcu_assign_pointer(pnn->routes.table[i], NULL);
+                        set_bit(i, deleted);
+                }
+        mutex_unlock(&pnn->routes.lock);
+
+        if (bitmap_empty(deleted, 64))
+                return; /* short-circuit RCU */
+        synchronize_rcu();
+        for (i = find_first_bit(deleted, 64); i < 64;
+                        i = find_next_bit(deleted, 64, i + 1)) {
+                rtm_phonet_notify(RTM_DELROUTE, dev, i);
+                dev_put(dev);
+        }
+}
+
 /* notify Phonet of device events */
 static int phonet_device_notify(struct notifier_block *me, unsigned long what,
                                 void *arg)
@@ -232,6 +298,7 @@ static int phonet_device_notify(struct notifier_block *me, unsigned long what,
                 break;
         case NETDEV_UNREGISTER:
                 phonet_device_destroy(dev);
+                phonet_route_autodel(dev);
                 break;
         }
         return 0;
@@ -246,18 +313,14 @@ static struct notifier_block phonet_device_notifier = {
 /* Per-namespace Phonet devices handling */
 static int phonet_init_net(struct net *net)
 {
-        struct phonet_net *pnn = kmalloc(sizeof(*pnn), GFP_KERNEL);
-        if (!pnn)
-                return -ENOMEM;
+        struct phonet_net *pnn = net_generic(net, phonet_net_id);
 
-        if (!proc_net_fops_create(net, "phonet", 0, &pn_sock_seq_fops)) {
-                kfree(pnn);
+        if (!proc_net_fops_create(net, "phonet", 0, &pn_sock_seq_fops))
                 return -ENOMEM;
-        }
 
         INIT_LIST_HEAD(&pnn->pndevs.list);
-        spin_lock_init(&pnn->pndevs.lock);
-        net_assign_generic(net, phonet_net_id, pnn);
+        mutex_init(&pnn->pndevs.lock);
+        mutex_init(&pnn->routes.lock);
         return 0;
 }
 
@@ -265,25 +328,35 @@ static void phonet_exit_net(struct net *net)
 {
         struct phonet_net *pnn = net_generic(net, phonet_net_id);
         struct net_device *dev;
+        unsigned i;
 
         rtnl_lock();
         for_each_netdev(net, dev)
                 phonet_device_destroy(dev);
+
+        for (i = 0; i < 64; i++) {
+                dev = pnn->routes.table[i];
+                if (dev) {
+                        rtm_phonet_notify(RTM_DELROUTE, dev, i);
+                        dev_put(dev);
+                }
+        }
         rtnl_unlock();
 
         proc_net_remove(net, "phonet");
-        kfree(pnn);
 }
 
 static struct pernet_operations phonet_net_ops = {
         .init = phonet_init_net,
         .exit = phonet_exit_net,
+        .id   = &phonet_net_id,
+        .size = sizeof(struct phonet_net),
 };
 
 /* Initialize Phonet devices list */
 int __init phonet_device_init(void)
 {
-        int err = register_pernet_gen_device(&phonet_net_id, &phonet_net_ops);
+        int err = register_pernet_device(&phonet_net_ops);
         if (err)
                 return err;
 
@@ -298,5 +371,75 @@ void phonet_device_exit(void)
 {
         rtnl_unregister_all(PF_PHONET);
         unregister_netdevice_notifier(&phonet_device_notifier);
-        unregister_pernet_gen_device(phonet_net_id, &phonet_net_ops);
+        unregister_pernet_device(&phonet_net_ops);
+}
+
+int phonet_route_add(struct net_device *dev, u8 daddr)
+{
+        struct phonet_net *pnn = net_generic(dev_net(dev), phonet_net_id);
+        struct phonet_routes *routes = &pnn->routes;
+        int err = -EEXIST;
+
+        daddr = daddr >> 2;
+        mutex_lock(&routes->lock);
+        if (routes->table[daddr] == NULL) {
+                rcu_assign_pointer(routes->table[daddr], dev);
+                dev_hold(dev);
+                err = 0;
+        }
+        mutex_unlock(&routes->lock);
+        return err;
+}
+
+int phonet_route_del(struct net_device *dev, u8 daddr)
+{
+        struct phonet_net *pnn = net_generic(dev_net(dev), phonet_net_id);
+        struct phonet_routes *routes = &pnn->routes;
+
+        daddr = daddr >> 2;
+        mutex_lock(&routes->lock);
+        if (dev == routes->table[daddr])
+                rcu_assign_pointer(routes->table[daddr], NULL);
+        else
+                dev = NULL;
+        mutex_unlock(&routes->lock);
+
+        if (!dev)
+                return -ENOENT;
+        synchronize_rcu();
+        dev_put(dev);
+        return 0;
+}
+
+struct net_device *phonet_route_get(struct net *net, u8 daddr)
+{
+        struct phonet_net *pnn = net_generic(net, phonet_net_id);
+        struct phonet_routes *routes = &pnn->routes;
+        struct net_device *dev;
+
+        ASSERT_RTNL(); /* no need to hold the device */
+
+        daddr >>= 2;
+        rcu_read_lock();
+        dev = rcu_dereference(routes->table[daddr]);
+        rcu_read_unlock();
+        return dev;
+}
+
+struct net_device *phonet_route_output(struct net *net, u8 daddr)
+{
+        struct phonet_net *pnn = net_generic(net, phonet_net_id);
+        struct phonet_routes *routes = &pnn->routes;
+        struct net_device *dev;
+
+        daddr >>= 2;
+        rcu_read_lock();
+        dev = rcu_dereference(routes->table[daddr]);
+        if (dev)
+                dev_hold(dev);
+        rcu_read_unlock();
+
+        if (!dev)
+                dev = phonet_device_get(net); /* Default route */
+        return dev;
 }
diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
index d21fd3576610..2e6c7eb8e76a 100644
--- a/net/phonet/pn_netlink.c
+++ b/net/phonet/pn_netlink.c
@@ -29,6 +29,8 @@
 #include <net/sock.h>
 #include <net/phonet/pn_dev.h>
 
+/* Device address handling */
+
 static int fill_addr(struct sk_buff *skb, struct net_device *dev, u8 addr,
                      u32 pid, u32 seq, int event);
 
@@ -51,8 +53,7 @@ void phonet_address_notify(int event, struct net_device *dev, u8 addr)
                     RTNLGRP_PHONET_IFADDR, NULL, GFP_KERNEL);
         return;
 errout:
-        if (err < 0)
-                rtnl_set_sk_err(dev_net(dev), RTNLGRP_PHONET_IFADDR, err);
+        rtnl_set_sk_err(dev_net(dev), RTNLGRP_PHONET_IFADDR, err);
 }
 
 static const struct nla_policy ifa_phonet_policy[IFA_MAX+1] = {
@@ -130,8 +131,8 @@ static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
         int addr_idx = 0, addr_start_idx = cb->args[1];
 
         pndevs = phonet_device_list(sock_net(skb->sk));
-        spin_lock_bh(&pndevs->lock);
-        list_for_each_entry(pnd, &pndevs->list, list) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(pnd, &pndevs->list, list) {
                 u8 addr;
 
                 if (dev_idx > dev_start_idx)
@@ -153,13 +154,137 @@ static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
         }
 
 out:
-        spin_unlock_bh(&pndevs->lock);
+        rcu_read_unlock();
         cb->args[0] = dev_idx;
         cb->args[1] = addr_idx;
 
         return skb->len;
 }
 
+/* Routes handling */
+
+static int fill_route(struct sk_buff *skb, struct net_device *dev, u8 dst,
+                        u32 pid, u32 seq, int event)
+{
+        struct rtmsg *rtm;
+        struct nlmsghdr *nlh;
+
+        nlh = nlmsg_put(skb, pid, seq, event, sizeof(*rtm), 0);
+        if (nlh == NULL)
+                return -EMSGSIZE;
+
+        rtm = nlmsg_data(nlh);
+        rtm->rtm_family = AF_PHONET;
+        rtm->rtm_dst_len = 6;
+        rtm->rtm_src_len = 0;
+        rtm->rtm_tos = 0;
+        rtm->rtm_table = RT_TABLE_MAIN;
+        rtm->rtm_protocol = RTPROT_STATIC;
+        rtm->rtm_scope = RT_SCOPE_UNIVERSE;
+        rtm->rtm_type = RTN_UNICAST;
+        rtm->rtm_flags = 0;
+        NLA_PUT_U8(skb, RTA_DST, dst);
+        NLA_PUT_U32(skb, RTA_OIF, dev->ifindex);
+        return nlmsg_end(skb, nlh);
+
+nla_put_failure:
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
+}
+
+void rtm_phonet_notify(int event, struct net_device *dev, u8 dst)
+{
+        struct sk_buff *skb;
+        int err = -ENOBUFS;
+
+        skb = nlmsg_new(NLMSG_ALIGN(sizeof(struct ifaddrmsg)) +
+                        nla_total_size(1) + nla_total_size(4), GFP_KERNEL);
+        if (skb == NULL)
+                goto errout;
+        err = fill_route(skb, dev, dst, 0, 0, event);
+        if (err < 0) {
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
+        rtnl_notify(skb, dev_net(dev), 0,
+                          RTNLGRP_PHONET_ROUTE, NULL, GFP_KERNEL);
+        return;
+errout:
+        rtnl_set_sk_err(dev_net(dev), RTNLGRP_PHONET_ROUTE, err);
+}
+
+static const struct nla_policy rtm_phonet_policy[RTA_MAX+1] = {
+        [RTA_DST] = { .type = NLA_U8 },
+        [RTA_OIF] = { .type = NLA_U32 },
+};
+
+static int route_doit(struct sk_buff *skb, struct nlmsghdr *nlh, void *attr)
+{
+        struct net *net = sock_net(skb->sk);
+        struct nlattr *tb[RTA_MAX+1];
+        struct net_device *dev;
+        struct rtmsg *rtm;
+        int err;
+        u8 dst;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        ASSERT_RTNL();
+
+        err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_phonet_policy);
+        if (err < 0)
+                return err;
+
+        rtm = nlmsg_data(nlh);
+        if (rtm->rtm_table != RT_TABLE_MAIN || rtm->rtm_type != RTN_UNICAST)
+                return -EINVAL;
+        if (tb[RTA_DST] == NULL || tb[RTA_OIF] == NULL)
+                return -EINVAL;
+        dst = nla_get_u8(tb[RTA_DST]);
+        if (dst & 3) /* Phonet addresses only have 6 high-order bits */
+                return -EINVAL;
+
+        dev = __dev_get_by_index(net, nla_get_u32(tb[RTA_OIF]));
+        if (dev == NULL)
+                return -ENODEV;
+
+        if (nlh->nlmsg_type == RTM_NEWROUTE)
+                err = phonet_route_add(dev, dst);
+        else
+                err = phonet_route_del(dev, dst);
+        if (!err)
+                rtm_phonet_notify(nlh->nlmsg_type, dev, dst);
+        return err;
+}
+
+static int route_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        struct net *net = sock_net(skb->sk);
+        u8 addr, addr_idx = 0, addr_start_idx = cb->args[0];
+
+        for (addr = 0; addr < 64; addr++) {
+                struct net_device *dev;
+
+                dev = phonet_route_get(net, addr << 2);
+                if (!dev)
+                        continue;
+
+                if (addr_idx++ < addr_start_idx)
+                        continue;
+                if (fill_route(skb, dev, addr << 2, NETLINK_CB(cb->skb).pid,
+                                cb->nlh->nlmsg_seq, RTM_NEWROUTE))
+                        goto out;
+        }
+
+out:
+        cb->args[0] = addr_idx;
+        cb->args[1] = 0;
+
+        return skb->len;
+}
+
 int __init phonet_netlink_register(void)
 {
         int err = __rtnl_register(PF_PHONET, RTM_NEWADDR, addr_doit, NULL);
@@ -169,5 +294,8 @@ int __init phonet_netlink_register(void)
         /* Further __rtnl_register() cannot fail */
         __rtnl_register(PF_PHONET, RTM_DELADDR, addr_doit, NULL);
         __rtnl_register(PF_PHONET, RTM_GETADDR, NULL, getaddr_dumpit);
+        __rtnl_register(PF_PHONET, RTM_NEWROUTE, route_doit, NULL);
+        __rtnl_register(PF_PHONET, RTM_DELROUTE, route_doit, NULL);
+        __rtnl_register(PF_PHONET, RTM_GETROUTE, NULL, route_dumpit);
         return 0;
 }
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index aa5b5a972bff..69c8b826a0ce 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -45,13 +45,28 @@ static int pn_socket_release(struct socket *sock)
         return 0;
 }
 
+#define PN_HASHSIZE     16
+#define PN_HASHMASK     (PN_HASHSIZE-1)
+
+
 static struct  {
-        struct hlist_head hlist;
+        struct hlist_head hlist[PN_HASHSIZE];
         spinlock_t lock;
-} pnsocks = {
-        .hlist = HLIST_HEAD_INIT,
-        .lock = __SPIN_LOCK_UNLOCKED(pnsocks.lock),
-};
+} pnsocks;
+
+void __init pn_sock_init(void)
+{
+        unsigned i;
+
+        for (i = 0; i < PN_HASHSIZE; i++)
+                INIT_HLIST_HEAD(pnsocks.hlist + i);
+        spin_lock_init(&pnsocks.lock);
+}
+
+static struct hlist_head *pn_hash_list(u16 obj)
+{
+        return pnsocks.hlist + (obj & PN_HASHMASK);
+}
 
 /*
  * Find address based on socket address, match only certain fields.
@@ -64,10 +79,11 @@ struct sock *pn_find_sock_by_sa(struct net *net, const struct sockaddr_pn *spn)
         struct sock *rval = NULL;
         u16 obj = pn_sockaddr_get_object(spn);
         u8 res = spn->spn_resource;
+        struct hlist_head *hlist = pn_hash_list(obj);
 
         spin_lock_bh(&pnsocks.lock);
 
-        sk_for_each(sknode, node, &pnsocks.hlist) {
+        sk_for_each(sknode, node, hlist) {
                 struct pn_sock *pn = pn_sk(sknode);
                 BUG_ON(!pn->sobject); /* unbound socket */
 
@@ -82,8 +98,8 @@ struct sock *pn_find_sock_by_sa(struct net *net, const struct sockaddr_pn *spn)
                         if (pn->resource != res)
                                 continue;
                 }
-                if (pn_addr(pn->sobject)
-                 && pn_addr(pn->sobject) != pn_addr(obj))
+                if (pn_addr(pn->sobject) &&
+                    pn_addr(pn->sobject) != pn_addr(obj))
                         continue;
 
                 rval = sknode;
@@ -94,13 +110,44 @@ struct sock *pn_find_sock_by_sa(struct net *net, const struct sockaddr_pn *spn)
         spin_unlock_bh(&pnsocks.lock);
 
         return rval;
+}
+
+/* Deliver a broadcast packet (only in bottom-half) */
+void pn_deliver_sock_broadcast(struct net *net, struct sk_buff *skb)
+{
+        struct hlist_head *hlist = pnsocks.hlist;
+        unsigned h;
+
+        spin_lock(&pnsocks.lock);
+        for (h = 0; h < PN_HASHSIZE; h++) {
+                struct hlist_node *node;
+                struct sock *sknode;
+
+                sk_for_each(sknode, node, hlist) {
+                        struct sk_buff *clone;
+
+                        if (!net_eq(sock_net(sknode), net))
+                                continue;
+                        if (!sock_flag(sknode, SOCK_BROADCAST))
+                                continue;
 
+                        clone = skb_clone(skb, GFP_ATOMIC);
+                        if (clone) {
+                                sock_hold(sknode);
+                                sk_receive_skb(sknode, clone, 0);
+                        }
+                }
+                hlist++;
+        }
+        spin_unlock(&pnsocks.lock);
 }
 
 void pn_sock_hash(struct sock *sk)
 {
+        struct hlist_head *hlist = pn_hash_list(pn_sk(sk)->sobject);
+
         spin_lock_bh(&pnsocks.lock);
-        sk_add_node(sk, &pnsocks.hlist);
+        sk_add_node(sk, hlist);
         spin_unlock_bh(&pnsocks.lock);
 }
 EXPORT_SYMBOL(pn_sock_hash);
@@ -416,15 +463,20 @@ EXPORT_SYMBOL(pn_sock_get_port);
 static struct sock *pn_sock_get_idx(struct seq_file *seq, loff_t pos)
 {
         struct net *net = seq_file_net(seq);
+        struct hlist_head *hlist = pnsocks.hlist;
         struct hlist_node *node;
         struct sock *sknode;
+        unsigned h;
 
-        sk_for_each(sknode, node, &pnsocks.hlist) {
-                if (!net_eq(net, sock_net(sknode)))
-                        continue;
-                if (!pos)
-                        return sknode;
-                pos--;
+        for (h = 0; h < PN_HASHSIZE; h++) {
+                sk_for_each(sknode, node, hlist) {
+                        if (!net_eq(net, sock_net(sknode)))
+                                continue;
+                        if (!pos)
+                                return sknode;
+                        pos--;
+                }
+                hlist++;
         }
         return NULL;
 }