Merge tag 'v3.5-rc1'

Linux 3.5-rc1

Conflicts:
	net/ceph/messenger.c

720 files changed, 35664 insertions, 22882 deletions

diff --git a/net/802/Makefile b/net/802/Makefile
index 7893d679910c..a30d6e385aed 100644
--- a/net/802/Makefile
+++ b/net/802/Makefile
@@ -4,7 +4,6 @@
 
 # Check the p8022 selections against net/core/Makefile.
 obj-$(CONFIG_LLC)       += p8022.o psnap.o
-obj-$(CONFIG_TR)        += p8022.o psnap.o tr.o
 obj-$(CONFIG_NET_FC)    +=                 fc.o
 obj-$(CONFIG_FDDI)      +=                 fddi.o
 obj-$(CONFIG_HIPPI)     +=                 hippi.o
diff --git a/net/802/fc.c b/net/802/fc.c
index bd345f3d29f8..05eea6b98bb8 100644
--- a/net/802/fc.c
+++ b/net/802/fc.c
@@ -11,7 +11,6 @@
  */
 
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
@@ -36,7 +35,7 @@
 
 static int fc_header(struct sk_buff *skb, struct net_device *dev,
                      unsigned short type,
-                     const void *daddr, const void *saddr, unsigned len)
+                     const void *daddr, const void *saddr, unsigned int len)
 {
         struct fch_hdr *fch;
         int hdr_len;
diff --git a/net/802/fddi.c b/net/802/fddi.c
index 94b3ad08f39a..9cda40661e0d 100644
--- a/net/802/fddi.c
+++ b/net/802/fddi.c
@@ -27,7 +27,6 @@
  */
 
 #include <linux/module.h>
-#include <asm/system.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
@@ -52,7 +51,7 @@
 
 static int fddi_header(struct sk_buff *skb, struct net_device *dev,
                        unsigned short type,
-                       const void *daddr, const void *saddr, unsigned len)
+                       const void *daddr, const void *saddr, unsigned int len)
 {
         int hl = FDDI_K_SNAP_HLEN;
         struct fddihdr *fddi;
diff --git a/net/802/garp.c b/net/802/garp.c
index 8e21b6db3981..8456f5d98b85 100644
--- a/net/802/garp.c
+++ b/net/802/garp.c
@@ -157,9 +157,9 @@ static struct garp_attr *garp_attr_lookup(const struct garp_applicant *app,
         while (parent) {
                 attr = rb_entry(parent, struct garp_attr, node);
                 d = garp_attr_cmp(attr, data, len, type);
-                if (d < 0)
+                if (d > 0)
                         parent = parent->rb_left;
-                else if (d > 0)
+                else if (d < 0)
                         parent = parent->rb_right;
                 else
                         return attr;
@@ -167,7 +167,8 @@ static struct garp_attr *garp_attr_lookup(const struct garp_applicant *app,
         return NULL;
 }
 
-static void garp_attr_insert(struct garp_applicant *app, struct garp_attr *new)
+static struct garp_attr *garp_attr_create(struct garp_applicant *app,
+                                          const void *data, u8 len, u8 type)
 {
         struct rb_node *parent = NULL, **p = &app->gid.rb_node;
         struct garp_attr *attr;
@@ -176,21 +177,16 @@ static void garp_attr_insert(struct garp_applicant *app, struct garp_attr *new)
         while (*p) {
                 parent = *p;
                 attr = rb_entry(parent, struct garp_attr, node);
-                d = garp_attr_cmp(attr, new->data, new->dlen, new->type);
-                if (d < 0)
+                d = garp_attr_cmp(attr, data, len, type);
+                if (d > 0)
                         p = &parent->rb_left;
-                else if (d > 0)
+                else if (d < 0)
                         p = &parent->rb_right;
+                else {
+                        /* The attribute already exists; re-use it. */
+                        return attr;
+                }
         }
-        rb_link_node(&new->node, parent, p);
-        rb_insert_color(&new->node, &app->gid);
-}
-
-static struct garp_attr *garp_attr_create(struct garp_applicant *app,
-                                          const void *data, u8 len, u8 type)
-{
-        struct garp_attr *attr;
-
         attr = kmalloc(sizeof(*attr) + len, GFP_ATOMIC);
         if (!attr)
                 return attr;
@@ -198,7 +194,9 @@ static struct garp_attr *garp_attr_create(struct garp_applicant *app,
         attr->type  = type;
         attr->dlen  = len;
         memcpy(attr->data, data, len);
-        garp_attr_insert(app, attr);
+
+        rb_link_node(&attr->node, parent, p);
+        rb_insert_color(&attr->node, &app->gid);
         return attr;
 }
 
diff --git a/net/802/hippi.c b/net/802/hippi.c
index 91aca8780fd0..51a1f530417d 100644
--- a/net/802/hippi.c
+++ b/net/802/hippi.c
@@ -35,7 +35,6 @@
 #include <net/arp.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 
 /*
  * Create the HIPPI MAC header for an arbitrary protocol layer
@@ -46,7 +45,7 @@
 
 static int hippi_header(struct sk_buff *skb, struct net_device *dev,
                         unsigned short type,
-                        const void *daddr, const void *saddr, unsigned len)
+                        const void *daddr, const void *saddr, unsigned int len)
 {
         struct hippi_hdr *hip = (struct hippi_hdr *)skb_push(skb, HIPPI_HLEN);
         struct hippi_cb *hcb = (struct hippi_cb *) skb->cb;
diff --git a/net/802/p8022.c b/net/802/p8022.c
index 7f353c4f437a..0bda8de7df51 100644
--- a/net/802/p8022.c
+++ b/net/802/p8022.c
@@ -1,6 +1,5 @@
 /*
- *      NET3:   Support for 802.2 demultiplexing off Ethernet (Token ring
- *              is kept separate see p8022tr.c)
+ *      NET3:   Support for 802.2 demultiplexing off Ethernet
  *              This program is free software; you can redistribute it and/or
  *              modify it under the terms of the GNU General Public License
  *              as published by the Free Software Foundation; either version
diff --git a/net/802/stp.c b/net/802/stp.c
index 15540b7323cd..2c40ba0ec116 100644
--- a/net/802/stp.c
+++ b/net/802/stp.c
@@ -46,7 +46,7 @@ static int stp_pdu_rcv(struct sk_buff *skb, struct net_device *dev,
                 proto = rcu_dereference(garp_protos[eh->h_dest[5] -
                                                     GARP_ADDR_MIN]);
                 if (proto &&
-                    compare_ether_addr(eh->h_dest, proto->group_address))
+                    !ether_addr_equal(eh->h_dest, proto->group_address))
                         goto err;
         } else
                 proto = rcu_dereference(stp_proto);
diff --git a/net/802/tr.c b/net/802/tr.c
deleted file mode 100644
index 5e20cf8a074b..000000000000
--- a/net/802/tr.c
+++ /dev/null
@@ -1,677 +0,0 @@
-/*
- * NET3:        Token ring device handling subroutines
- *
- *              This program is free software; you can redistribute it and/or
- *              modify it under the terms of the GNU General Public License
- *              as published by the Free Software Foundation; either version
- *              2 of the License, or (at your option) any later version.
- *
- * Fixes:       3 Feb 97 Paul Norton <pnorton@cts.com> Minor routing fixes.
- *              Added rif table to /proc/net/tr_rif and rif timeout to
- *              /proc/sys/net/token-ring/rif_timeout.
- *              22 Jun 98 Paul Norton <p.norton@computer.org> Rearranged
- *              tr_header and tr_type_trans to handle passing IPX SNAP and
- *              802.2 through the correct layers. Eliminated tr_reformat.
- *
- */
-
-#include <asm/uaccess.h>
-#include <asm/system.h>
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/jiffies.h>
-#include <linux/string.h>
-#include <linux/mm.h>
-#include <linux/socket.h>
-#include <linux/in.h>
-#include <linux/inet.h>
-#include <linux/netdevice.h>
-#include <linux/trdevice.h>
-#include <linux/skbuff.h>
-#include <linux/errno.h>
-#include <linux/timer.h>
-#include <linux/net.h>
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#include <linux/init.h>
-#include <linux/sysctl.h>
-#include <linux/slab.h>
-#include <net/arp.h>
-#include <net/net_namespace.h>
-
-static void tr_add_rif_info(struct trh_hdr *trh, struct net_device *dev);
-static void rif_check_expire(unsigned long dummy);
-
-#define TR_SR_DEBUG 0
-
-/*
- *      Each RIF entry we learn is kept this way
- */
-
-struct rif_cache {
-        unsigned char addr[TR_ALEN];
-        int iface;
-        __be16 rcf;
-        __be16 rseg[8];
-        struct rif_cache *next;
-        unsigned long last_used;
-        unsigned char local_ring;
-};
-
-#define RIF_TABLE_SIZE 32
-
-/*
- *      We hash the RIF cache 32 ways. We do after all have to look it
- *      up a lot.
- */
-
-static struct rif_cache *rif_table[RIF_TABLE_SIZE];
-
-static DEFINE_SPINLOCK(rif_lock);
-
-
-/*
- *      Garbage disposal timer.
- */
-
-static struct timer_list rif_timer;
-
-static int sysctl_tr_rif_timeout = 60*10*HZ;
-
-static inline unsigned long rif_hash(const unsigned char *addr)
-{
-        unsigned long x;
-
-        x = addr[0];
-        x = (x << 2) ^ addr[1];
-        x = (x << 2) ^ addr[2];
-        x = (x << 2) ^ addr[3];
-        x = (x << 2) ^ addr[4];
-        x = (x << 2) ^ addr[5];
-
-        x ^= x >> 8;
-
-        return x & (RIF_TABLE_SIZE - 1);
-}
-
-/*
- *      Put the headers on a token ring packet. Token ring source routing
- *      makes this a little more exciting than on ethernet.
- */
-
-static int tr_header(struct sk_buff *skb, struct net_device *dev,
-                     unsigned short type,
-                     const void *daddr, const void *saddr, unsigned len)
-{
-        struct trh_hdr *trh;
-        int hdr_len;
-
-        /*
-         * Add the 802.2 SNAP header if IP as the IPv4/IPv6 code calls
-         * dev->hard_header directly.
-         */
-        if (type == ETH_P_IP || type == ETH_P_IPV6 || type == ETH_P_ARP)
-        {
-                struct trllc *trllc;
-
-                hdr_len = sizeof(struct trh_hdr) + sizeof(struct trllc);
-                trh = (struct trh_hdr *)skb_push(skb, hdr_len);
-                trllc = (struct trllc *)(trh+1);
-                trllc->dsap = trllc->ssap = EXTENDED_SAP;
-                trllc->llc = UI_CMD;
-                trllc->protid[0] = trllc->protid[1] = trllc->protid[2] = 0x00;
-                trllc->ethertype = htons(type);
-        }
-        else
-        {
-                hdr_len = sizeof(struct trh_hdr);
-                trh = (struct trh_hdr *)skb_push(skb, hdr_len);
-        }
-
-        trh->ac=AC;
-        trh->fc=LLC_FRAME;
-
-        if(saddr)
-                memcpy(trh->saddr,saddr,dev->addr_len);
-        else
-                memcpy(trh->saddr,dev->dev_addr,dev->addr_len);
-
-        /*
-         *      Build the destination and then source route the frame
-         */
-
-        if(daddr)
-        {
-                memcpy(trh->daddr,daddr,dev->addr_len);
-                tr_source_route(skb, trh, dev);
-                return hdr_len;
-        }
-
-        return -hdr_len;
-}
-
-/*
- *      A neighbour discovery of some species (eg arp) has completed. We
- *      can now send the packet.
- */
-
-static int tr_rebuild_header(struct sk_buff *skb)
-{
-        struct trh_hdr *trh=(struct trh_hdr *)skb->data;
-        struct trllc *trllc=(struct trllc *)(skb->data+sizeof(struct trh_hdr));
-        struct net_device *dev = skb->dev;
-
-        /*
-         *      FIXME: We don't yet support IPv6 over token rings
-         */
-
-        if(trllc->ethertype != htons(ETH_P_IP)) {
-                printk("tr_rebuild_header: Don't know how to resolve type %04X addresses ?\n", ntohs(trllc->ethertype));
-                return 0;
-        }
-
-#ifdef CONFIG_INET
-        if(arp_find(trh->daddr, skb)) {
-                        return 1;
-        }
-        else
-#endif
-        {
-                tr_source_route(skb,trh,dev);
-                return 0;
-        }
-}
-
-/*
- *      Some of this is a bit hackish. We intercept RIF information
- *      used for source routing. We also grab IP directly and don't feed
- *      it via SNAP.
- */
-
-__be16 tr_type_trans(struct sk_buff *skb, struct net_device *dev)
-{
-
-        struct trh_hdr *trh;
-        struct trllc *trllc;
-        unsigned riflen=0;
-
-        skb->dev = dev;
-        skb_reset_mac_header(skb);
-        trh = tr_hdr(skb);
-
-        if(trh->saddr[0] & TR_RII)
-                riflen = (ntohs(trh->rcf) & TR_RCF_LEN_MASK) >> 8;
-
-        trllc = (struct trllc *)(skb->data+sizeof(struct trh_hdr)-TR_MAXRIFLEN+riflen);
-
-        skb_pull(skb,sizeof(struct trh_hdr)-TR_MAXRIFLEN+riflen);
-
-        if(*trh->daddr & 0x80)
-        {
-                if(!memcmp(trh->daddr,dev->broadcast,TR_ALEN))
-                        skb->pkt_type=PACKET_BROADCAST;
-                else
-                        skb->pkt_type=PACKET_MULTICAST;
-        }
-        else if ( (trh->daddr[0] & 0x01) && (trh->daddr[1] & 0x00) && (trh->daddr[2] & 0x5E))
-        {
-                skb->pkt_type=PACKET_MULTICAST;
-        }
-        else if(dev->flags & IFF_PROMISC)
-        {
-                if(memcmp(trh->daddr, dev->dev_addr, TR_ALEN))
-                        skb->pkt_type=PACKET_OTHERHOST;
-        }
-
-        if ((skb->pkt_type != PACKET_BROADCAST) &&
-            (skb->pkt_type != PACKET_MULTICAST))
-                tr_add_rif_info(trh,dev) ;
-
-        /*
-         * Strip the SNAP header from ARP packets since we don't
-         * pass them through to the 802.2/SNAP layers.
-         */
-
-        if (trllc->dsap == EXTENDED_SAP &&
-            (trllc->ethertype == htons(ETH_P_IP) ||
-             trllc->ethertype == htons(ETH_P_IPV6) ||
-             trllc->ethertype == htons(ETH_P_ARP)))
-        {
-                skb_pull(skb, sizeof(struct trllc));
-                return trllc->ethertype;
-        }
-
-        return htons(ETH_P_TR_802_2);
-}
-
-/*
- *      We try to do source routing...
- */
-
-void tr_source_route(struct sk_buff *skb,struct trh_hdr *trh,
-                     struct net_device *dev)
-{
-        int slack;
-        unsigned int hash;
-        struct rif_cache *entry;
-        unsigned char *olddata;
-        unsigned long flags;
-        static const unsigned char mcast_func_addr[]
-                = {0xC0,0x00,0x00,0x04,0x00,0x00};
-
-        spin_lock_irqsave(&rif_lock, flags);
-
-        /*
-         *      Broadcasts are single route as stated in RFC 1042
-         */
-        if( (!memcmp(&(trh->daddr[0]),&(dev->broadcast[0]),TR_ALEN)) ||
-            (!memcmp(&(trh->daddr[0]),&(mcast_func_addr[0]), TR_ALEN))  )
-        {
-                trh->rcf=htons((((sizeof(trh->rcf)) << 8) & TR_RCF_LEN_MASK)
-                               | TR_RCF_FRAME2K | TR_RCF_LIMITED_BROADCAST);
-                trh->saddr[0]|=TR_RII;
-        }
-        else
-        {
-                hash = rif_hash(trh->daddr);
-                /*
-                 *      Walk the hash table and look for an entry
-                 */
-                for(entry=rif_table[hash];entry && memcmp(&(entry->addr[0]),&(trh->daddr[0]),TR_ALEN);entry=entry->next);
-
-                /*
-                 *      If we found an entry we can route the frame.
-                 */
-                if(entry)
-                {
-#if TR_SR_DEBUG
-printk("source routing for %pM\n", trh->daddr);
-#endif
-                        if(!entry->local_ring && (ntohs(entry->rcf) & TR_RCF_LEN_MASK) >> 8)
-                        {
-                                trh->rcf=entry->rcf;
-                                memcpy(&trh->rseg[0],&entry->rseg[0],8*sizeof(unsigned short));
-                                trh->rcf^=htons(TR_RCF_DIR_BIT);
-                                trh->rcf&=htons(0x1fff);        /* Issam Chehab <ichehab@madge1.demon.co.uk> */
-
-                                trh->saddr[0]|=TR_RII;
-#if TR_SR_DEBUG
-                                printk("entry found with rcf %04x\n", entry->rcf);
-                        }
-                        else
-                        {
-                                printk("entry found but without rcf length, local=%02x\n", entry->local_ring);
-#endif
-                        }
-                        entry->last_used=jiffies;
-                }
-                else
-                {
-                        /*
-                         *      Without the information we simply have to shout
-                         *      on the wire. The replies should rapidly clean this
-                         *      situation up.
-                         */
-                        trh->rcf=htons((((sizeof(trh->rcf)) << 8) & TR_RCF_LEN_MASK)
-                                       | TR_RCF_FRAME2K | TR_RCF_LIMITED_BROADCAST);
-                        trh->saddr[0]|=TR_RII;
-#if TR_SR_DEBUG
-                        printk("no entry in rif table found - broadcasting frame\n");
-#endif
-                }
-        }
-
-        /* Compress the RIF here so we don't have to do it in the driver(s) */
-        if (!(trh->saddr[0] & 0x80))
-                slack = 18;
-        else
-                slack = 18 - ((ntohs(trh->rcf) & TR_RCF_LEN_MASK)>>8);
-        olddata = skb->data;
-        spin_unlock_irqrestore(&rif_lock, flags);
-
-        skb_pull(skb, slack);
-        memmove(skb->data, olddata, sizeof(struct trh_hdr) - slack);
-}
-
-/*
- *      We have learned some new RIF information for our source
- *      routing.
- */
-
-static void tr_add_rif_info(struct trh_hdr *trh, struct net_device *dev)
-{
-        unsigned int hash, rii_p = 0;
-        unsigned long flags;
-        struct rif_cache *entry;
-        unsigned char saddr0;
-
-        spin_lock_irqsave(&rif_lock, flags);
-        saddr0 = trh->saddr[0];
-
-        /*
-         *      Firstly see if the entry exists
-         */
-
-        if(trh->saddr[0] & TR_RII)
-        {
-                trh->saddr[0]&=0x7f;
-                if (((ntohs(trh->rcf) & TR_RCF_LEN_MASK) >> 8) > 2)
-                {
-                        rii_p = 1;
-                }
-        }
-
-        hash = rif_hash(trh->saddr);
-        for(entry=rif_table[hash];entry && memcmp(&(entry->addr[0]),&(trh->saddr[0]),TR_ALEN);entry=entry->next);
-
-        if(entry==NULL)
-        {
-#if TR_SR_DEBUG
-                printk("adding rif_entry: addr:%pM rcf:%04X\n",
-                       trh->saddr, ntohs(trh->rcf));
-#endif
-                /*
-                 *      Allocate our new entry. A failure to allocate loses
-                 *      use the information. This is harmless.
-                 *
-                 *      FIXME: We ought to keep some kind of cache size
-                 *      limiting and adjust the timers to suit.
-                 */
-                entry=kmalloc(sizeof(struct rif_cache),GFP_ATOMIC);
-
-                if(!entry)
-                {
-                        printk(KERN_DEBUG "tr.c: Couldn't malloc rif cache entry !\n");
-                        spin_unlock_irqrestore(&rif_lock, flags);
-                        return;
-                }
-
-                memcpy(&(entry->addr[0]),&(trh->saddr[0]),TR_ALEN);
-                entry->iface = dev->ifindex;
-                entry->next=rif_table[hash];
-                entry->last_used=jiffies;
-                rif_table[hash]=entry;
-
-                if (rii_p)
-                {
-                        entry->rcf = trh->rcf & htons((unsigned short)~TR_RCF_BROADCAST_MASK);
-                        memcpy(&(entry->rseg[0]),&(trh->rseg[0]),8*sizeof(unsigned short));
-                        entry->local_ring = 0;
-                }
-                else
-                {
-                        entry->local_ring = 1;
-                }
-        }
-        else    /* Y. Tahara added */
-        {
-                /*
-                 *      Update existing entries
-                 */
-                if (!entry->local_ring)
-                    if (entry->rcf != (trh->rcf & htons((unsigned short)~TR_RCF_BROADCAST_MASK)) &&
-                         !(trh->rcf & htons(TR_RCF_BROADCAST_MASK)))
-                    {
-#if TR_SR_DEBUG
-printk("updating rif_entry: addr:%pM rcf:%04X\n",
-                trh->saddr, ntohs(trh->rcf));
-#endif
-                            entry->rcf = trh->rcf & htons((unsigned short)~TR_RCF_BROADCAST_MASK);
-                            memcpy(&(entry->rseg[0]),&(trh->rseg[0]),8*sizeof(unsigned short));
-                    }
-                entry->last_used=jiffies;
-        }
-        trh->saddr[0]=saddr0; /* put the routing indicator back for tcpdump */
-        spin_unlock_irqrestore(&rif_lock, flags);
-}
-
-/*
- *      Scan the cache with a timer and see what we need to throw out.
- */
-
-static void rif_check_expire(unsigned long dummy)
-{
-        int i;
-        unsigned long flags, next_interval = jiffies + sysctl_tr_rif_timeout/2;
-
-        spin_lock_irqsave(&rif_lock, flags);
-
-        for(i =0; i < RIF_TABLE_SIZE; i++) {
-                struct rif_cache *entry, **pentry;
-
-                pentry = rif_table+i;
-                while((entry=*pentry) != NULL) {
-                        unsigned long expires
-                                = entry->last_used + sysctl_tr_rif_timeout;
-
-                        if (time_before_eq(expires, jiffies)) {
-                                *pentry = entry->next;
-                                kfree(entry);
-                        } else {
-                                pentry = &entry->next;
-
-                                if (time_before(expires, next_interval))
-                                        next_interval = expires;
-                        }
-                }
-        }
-
-        spin_unlock_irqrestore(&rif_lock, flags);
-
-        mod_timer(&rif_timer, next_interval);
-
-}
-
-/*
- *      Generate the /proc/net information for the token ring RIF
- *      routing.
- */
-
-#ifdef CONFIG_PROC_FS
-
-static struct rif_cache *rif_get_idx(loff_t pos)
-{
-        int i;
-        struct rif_cache *entry;
-        loff_t off = 0;
-
-        for(i = 0; i < RIF_TABLE_SIZE; i++)
-                for(entry = rif_table[i]; entry; entry = entry->next) {
-                        if (off == pos)
-                                return entry;
-                        ++off;
-                }
-
-        return NULL;
-}
-
-static void *rif_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(&rif_lock)
-{
-        spin_lock_irq(&rif_lock);
-
-        return *pos ? rif_get_idx(*pos - 1) : SEQ_START_TOKEN;
-}
-
-static void *rif_seq_next(struct seq_file *seq, void *v, loff_t *pos)
-{
-        int i;
-        struct rif_cache *ent = v;
-
-        ++*pos;
-
-        if (v == SEQ_START_TOKEN) {
-                i = -1;
-                goto scan;
-        }
-
-        if (ent->next)
-                return ent->next;
-
-        i = rif_hash(ent->addr);
- scan:
-        while (++i < RIF_TABLE_SIZE) {
-                if ((ent = rif_table[i]) != NULL)
-                        return ent;
-        }
-        return NULL;
-}
-
-static void rif_seq_stop(struct seq_file *seq, void *v)
-        __releases(&rif_lock)
-{
-        spin_unlock_irq(&rif_lock);
-}
-
-static int rif_seq_show(struct seq_file *seq, void *v)
-{
-        int j, rcf_len, segment, brdgnmb;
-        struct rif_cache *entry = v;
-
-        if (v == SEQ_START_TOKEN)
-                seq_puts(seq,
-                     "if     TR address       TTL   rcf   routing segments\n");
-        else {
-                struct net_device *dev = dev_get_by_index(&init_net, entry->iface);
-                long ttl = (long) (entry->last_used + sysctl_tr_rif_timeout)
-                                - (long) jiffies;
-
-                seq_printf(seq, "%s %pM %7li ",
-                           dev?dev->name:"?",
-                           entry->addr,
-                           ttl/HZ);
-
-                        if (entry->local_ring)
-                                seq_puts(seq, "local\n");
-                        else {
-
-                                seq_printf(seq, "%04X", ntohs(entry->rcf));
-                                rcf_len = ((ntohs(entry->rcf) & TR_RCF_LEN_MASK)>>8)-2;
-                                if (rcf_len)
-                                        rcf_len >>= 1;
-                                for(j = 1; j < rcf_len; j++) {
-                                        if(j==1) {
-                                                segment=ntohs(entry->rseg[j-1])>>4;
-                                                seq_printf(seq,"  %03X",segment);
-                                        }
-
-                                        segment=ntohs(entry->rseg[j])>>4;
-                                        brdgnmb=ntohs(entry->rseg[j-1])&0x00f;
-                                        seq_printf(seq,"-%01X-%03X",brdgnmb,segment);
-                                }
-                                seq_putc(seq, '\n');
-                        }
-
-                if (dev)
-                        dev_put(dev);
-                }
-        return 0;
-}
-
-
-static const struct seq_operations rif_seq_ops = {
-        .start = rif_seq_start,
-        .next  = rif_seq_next,
-        .stop  = rif_seq_stop,
-        .show  = rif_seq_show,
-};
-
-static int rif_seq_open(struct inode *inode, struct file *file)
-{
-        return seq_open(file, &rif_seq_ops);
-}
-
-static const struct file_operations rif_seq_fops = {
-        .owner   = THIS_MODULE,
-        .open    = rif_seq_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = seq_release,
-};
-
-#endif
-
-static const struct header_ops tr_header_ops = {
-        .create = tr_header,
-        .rebuild= tr_rebuild_header,
-};
-
-static void tr_setup(struct net_device *dev)
-{
-        /*
-         *      Configure and register
-         */
-
-        dev->header_ops = &tr_header_ops;
-
-        dev->type               = ARPHRD_IEEE802_TR;
-        dev->hard_header_len    = TR_HLEN;
-        dev->mtu                = 2000;
-        dev->addr_len           = TR_ALEN;
-        dev->tx_queue_len       = 100;  /* Long queues on tr */
-
-        memset(dev->broadcast,0xFF, TR_ALEN);
-
-        /* New-style flags. */
-        dev->flags              = IFF_BROADCAST | IFF_MULTICAST ;
-}
-
-/**
- * alloc_trdev - Register token ring device
- * @sizeof_priv: Size of additional driver-private structure to be allocated
- *      for this token ring device
- *
- * Fill in the fields of the device structure with token ring-generic values.
- *
- * Constructs a new net device, complete with a private data area of
- * size @sizeof_priv.  A 32-byte (not bit) alignment is enforced for
- * this private data area.
- */
-struct net_device *alloc_trdev(int sizeof_priv)
-{
-        return alloc_netdev(sizeof_priv, "tr%d", tr_setup);
-}
-
-#ifdef CONFIG_SYSCTL
-static struct ctl_table tr_table[] = {
-        {
-                .procname       = "rif_timeout",
-                .data           = &sysctl_tr_rif_timeout,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        { },
-};
-
-static __initdata struct ctl_path tr_path[] = {
-        { .procname = "net", },
-        { .procname = "token-ring", },
-        { }
-};
-#endif
-
-/*
- *      Called during bootup.  We don't actually have to initialise
- *      too much for this.
- */
-
-static int __init rif_init(void)
-{
-        rif_timer.expires  = jiffies + sysctl_tr_rif_timeout;
-        setup_timer(&rif_timer, rif_check_expire, 0);
-        add_timer(&rif_timer);
-#ifdef CONFIG_SYSCTL
-        register_sysctl_paths(tr_path, tr_table);
-#endif
-        proc_net_fops_create(&init_net, "tr_rif", S_IRUGO, &rif_seq_fops);
-        return 0;
-}
-
-module_init(rif_init);
-
-EXPORT_SYMBOL(tr_type_trans);
-EXPORT_SYMBOL(alloc_trdev);
-
-MODULE_LICENSE("GPL");
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index efea35b02e7f..6089f0cf23b4 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -266,19 +266,19 @@ static void vlan_sync_address(struct net_device *dev,
         struct vlan_dev_priv *vlan = vlan_dev_priv(vlandev);
 
         /* May be called without an actual change */
-        if (!compare_ether_addr(vlan->real_dev_addr, dev->dev_addr))
+        if (ether_addr_equal(vlan->real_dev_addr, dev->dev_addr))
                 return;
 
         /* vlan address was different from the old address and is equal to
          * the new address */
-        if (compare_ether_addr(vlandev->dev_addr, vlan->real_dev_addr) &&
-            !compare_ether_addr(vlandev->dev_addr, dev->dev_addr))
+        if (!ether_addr_equal(vlandev->dev_addr, vlan->real_dev_addr) &&
+            ether_addr_equal(vlandev->dev_addr, dev->dev_addr))
                 dev_uc_del(dev, vlandev->dev_addr);
 
         /* vlan address was equal to the old address and is different from
          * the new address */
-        if (!compare_ether_addr(vlandev->dev_addr, vlan->real_dev_addr) &&
-            compare_ether_addr(vlandev->dev_addr, dev->dev_addr))
+        if (ether_addr_equal(vlandev->dev_addr, vlan->real_dev_addr) &&
+            !ether_addr_equal(vlandev->dev_addr, dev->dev_addr))
                 dev_uc_add(dev, vlandev->dev_addr);
 
         memcpy(vlan->real_dev_addr, dev->dev_addr, ETH_ALEN);
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 4d39d802be2c..8ca533c95de0 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -31,8 +31,7 @@ bool vlan_do_receive(struct sk_buff **skbp, bool last_handler)
                 /* Our lower layer thinks this is not local, let's make sure.
                  * This allows the VLAN to have a different MAC than the
                  * underlying device, and still route correctly. */
-                if (!compare_ether_addr(eth_hdr(skb)->h_dest,
-                                        vlan_dev->dev_addr))
+                if (ether_addr_equal(eth_hdr(skb)->h_dest, vlan_dev->dev_addr))
                         skb->pkt_type = PACKET_HOST;
         }
 
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 9988d4abb372..da1bc9c3cf38 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -157,7 +157,7 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
                 skb = __vlan_hwaccel_put_tag(skb, vlan_tci);
         }
 
-        skb_set_dev(skb, vlan_dev_priv(dev)->real_dev);
+        skb->dev = vlan_dev_priv(dev)->real_dev;
         len = skb->len;
         if (netpoll_tx_running(dev))
                 return skb->dev->netdev_ops->ndo_start_xmit(skb, skb->dev);
@@ -277,7 +277,7 @@ static int vlan_dev_open(struct net_device *dev)
             !(vlan->flags & VLAN_FLAG_LOOSE_BINDING))
                 return -ENETDOWN;
 
-        if (compare_ether_addr(dev->dev_addr, real_dev->dev_addr)) {
+        if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr)) {
                 err = dev_uc_add(real_dev, dev->dev_addr);
                 if (err < 0)
                         goto out;
@@ -307,7 +307,7 @@ clear_allmulti:
         if (dev->flags & IFF_ALLMULTI)
                 dev_set_allmulti(real_dev, -1);
 del_unicast:
-        if (compare_ether_addr(dev->dev_addr, real_dev->dev_addr))
+        if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr))
                 dev_uc_del(real_dev, dev->dev_addr);
 out:
         netif_carrier_off(dev);
@@ -326,7 +326,7 @@ static int vlan_dev_stop(struct net_device *dev)
         if (dev->flags & IFF_PROMISC)
                 dev_set_promiscuity(real_dev, -1);
 
-        if (compare_ether_addr(dev->dev_addr, real_dev->dev_addr))
+        if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr))
                 dev_uc_del(real_dev, dev->dev_addr);
 
         netif_carrier_off(dev);
@@ -345,13 +345,13 @@ static int vlan_dev_set_mac_address(struct net_device *dev, void *p)
         if (!(dev->flags & IFF_UP))
                 goto out;
 
-        if (compare_ether_addr(addr->sa_data, real_dev->dev_addr)) {
+        if (!ether_addr_equal(addr->sa_data, real_dev->dev_addr)) {
                 err = dev_uc_add(real_dev, addr->sa_data);
                 if (err < 0)
                         return err;
         }
 
-        if (compare_ether_addr(dev->dev_addr, real_dev->dev_addr))
+        if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr))
                 dev_uc_del(real_dev, dev->dev_addr);
 
 out:
diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
index 50711368ad6a..708c80ea1874 100644
--- a/net/8021q/vlan_netlink.c
+++ b/net/8021q/vlan_netlink.c
@@ -166,11 +166,13 @@ static int vlan_fill_info(struct sk_buff *skb, const struct net_device *dev)
         struct nlattr *nest;
         unsigned int i;
 
-        NLA_PUT_U16(skb, IFLA_VLAN_ID, vlan_dev_priv(dev)->vlan_id);
+        if (nla_put_u16(skb, IFLA_VLAN_ID, vlan_dev_priv(dev)->vlan_id))
+                goto nla_put_failure;
         if (vlan->flags) {
                 f.flags = vlan->flags;
                 f.mask  = ~0;
-                NLA_PUT(skb, IFLA_VLAN_FLAGS, sizeof(f), &f);
+                if (nla_put(skb, IFLA_VLAN_FLAGS, sizeof(f), &f))
+                        goto nla_put_failure;
         }
         if (vlan->nr_ingress_mappings) {
                 nest = nla_nest_start(skb, IFLA_VLAN_INGRESS_QOS);
@@ -183,8 +185,9 @@ static int vlan_fill_info(struct sk_buff *skb, const struct net_device *dev)
 
                         m.from = i;
                         m.to   = vlan->ingress_priority_map[i];
-                        NLA_PUT(skb, IFLA_VLAN_QOS_MAPPING,
-                                sizeof(m), &m);
+                        if (nla_put(skb, IFLA_VLAN_QOS_MAPPING,
+                                    sizeof(m), &m))
+                                goto nla_put_failure;
                 }
                 nla_nest_end(skb, nest);
         }
@@ -202,8 +205,9 @@ static int vlan_fill_info(struct sk_buff *skb, const struct net_device *dev)
 
                                 m.from = pm->priority;
                                 m.to   = (pm->vlan_qos >> 13) & 0x7;
-                                NLA_PUT(skb, IFLA_VLAN_QOS_MAPPING,
-                                        sizeof(m), &m);
+                                if (nla_put(skb, IFLA_VLAN_QOS_MAPPING,
+                                            sizeof(m), &m))
+                                        goto nla_put_failure;
                         }
                 }
                 nla_nest_end(skb, nest);
diff --git a/net/9p/client.c b/net/9p/client.c
index 776618cd2be5..a170893d70e0 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -740,10 +740,18 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...)
                         c->status = Disconnected;
                 goto reterr;
         }
+again:
         /* Wait for the response */
         err = wait_event_interruptible(*req->wq,
                                        req->status >= REQ_STATUS_RCVD);
 
+        if ((err == -ERESTARTSYS) && (c->status == Connected)
+                                  && (type == P9_TFLUSH)) {
+                sigpending = 1;
+                clear_thread_flag(TIF_SIGPENDING);
+                goto again;
+        }
+
         if (req->status == REQ_STATUS_ERROR) {
                 p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err);
                 err = req->t_err;
@@ -1420,6 +1428,7 @@ int p9_client_clunk(struct p9_fid *fid)
         int err;
         struct p9_client *clnt;
         struct p9_req_t *req;
+        int retries = 0;
 
         if (!fid) {
                 pr_warn("%s (%d): Trying to clunk with NULL fid\n",
@@ -1428,7 +1437,9 @@ int p9_client_clunk(struct p9_fid *fid)
                 return 0;
         }
 
-        p9_debug(P9_DEBUG_9P, ">>> TCLUNK fid %d\n", fid->fid);
+again:
+        p9_debug(P9_DEBUG_9P, ">>> TCLUNK fid %d (try %d)\n", fid->fid,
+                                                                retries);
         err = 0;
         clnt = fid->clnt;
 
@@ -1444,8 +1455,14 @@ int p9_client_clunk(struct p9_fid *fid)
 error:
         /*
          * Fid is not valid even after a failed clunk
+         * If interrupted, retry once then give up and
+         * leak fid until umount.
          */
-        p9_fid_destroy(fid);
+        if (err == -ERESTARTSYS) {
+                if (retries++ == 0)
+                        goto again;
+        } else
+                p9_fid_destroy(fid);
         return err;
 }
 EXPORT_SYMBOL(p9_client_clunk);
@@ -1470,7 +1487,10 @@ int p9_client_remove(struct p9_fid *fid)
 
         p9_free_req(clnt, req);
 error:
-        p9_fid_destroy(fid);
+        if (err == -ERESTARTSYS)
+                p9_client_clunk(fid);
+        else
+                p9_fid_destroy(fid);
         return err;
 }
 EXPORT_SYMBOL(p9_client_remove);
@@ -1510,7 +1530,7 @@ p9_client_read(struct p9_fid *fid, char *data, char __user *udata, u64 offset,
 
 
         p9_debug(P9_DEBUG_9P, ">>> TREAD fid %d offset %llu %d\n",
-                   fid->fid, (long long unsigned) offset, count);
+                   fid->fid, (unsigned long long) offset, count);
         err = 0;
         clnt = fid->clnt;
 
@@ -1585,7 +1605,7 @@ p9_client_write(struct p9_fid *fid, char *data, const char __user *udata,
         struct p9_req_t *req;
 
         p9_debug(P9_DEBUG_9P, ">>> TWRITE fid %d offset %llu count %d\n",
-                                fid->fid, (long long unsigned) offset, count);
+                                fid->fid, (unsigned long long) offset, count);
         err = 0;
         clnt = fid->clnt;
 
@@ -2020,7 +2040,7 @@ int p9_client_readdir(struct p9_fid *fid, char *data, u32 count, u64 offset)
         char *dataptr;
 
         p9_debug(P9_DEBUG_9P, ">>> TREADDIR fid %d offset %llu count %d\n",
-                                fid->fid, (long long unsigned) offset, count);
+                                fid->fid, (unsigned long long) offset, count);
 
         err = 0;
         clnt = fid->clnt;
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index fccae26fa674..6449bae15702 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -513,7 +513,7 @@ error:
         clear_bit(Wworksched, &m->wsched);
 }
 
-static int p9_pollwake(wait_queue_t *wait, unsigned mode, int sync, void *key)
+static int p9_pollwake(wait_queue_t *wait, unsigned int mode, int sync, void *key)
 {
         struct p9_poll_wait *pwait =
                 container_of(wait, struct p9_poll_wait, wait);
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 3d432068f627..5af18d11b518 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -615,7 +615,8 @@ static void p9_virtio_remove(struct virtio_device *vdev)
 {
         struct virtio_chan *chan = vdev->priv;
 
-        BUG_ON(chan->inuse);
+        if (chan->inuse)
+                p9_virtio_close(chan->client);
         vdev->config->del_vqs(vdev);
 
         mutex_lock(&virtio_9p_lock);
diff --git a/net/Kconfig b/net/Kconfig
index e07272d0bb2d..245831bec09a 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -207,10 +207,10 @@ source "net/ipx/Kconfig"
 source "drivers/net/appletalk/Kconfig"
 source "net/x25/Kconfig"
 source "net/lapb/Kconfig"
-source "net/econet/Kconfig"
 source "net/wanrouter/Kconfig"
 source "net/phonet/Kconfig"
 source "net/ieee802154/Kconfig"
+source "net/mac802154/Kconfig"
 source "net/sched/Kconfig"
 source "net/dcb/Kconfig"
 source "net/dns_resolver/Kconfig"
@@ -246,9 +246,6 @@ config BQL
         select DQL
         default y
 
-config HAVE_BPF_JIT
-        bool
-
 config BPF_JIT
         bool "enable BPF Just In Time compiler"
         depends on HAVE_BPF_JIT
@@ -295,7 +292,7 @@ config NET_TCPPROBE
         module will be called tcp_probe.
 
 config NET_DROP_MONITOR
-        boolean "Network packet drop alerting service"
+        tristate "Network packet drop alerting service"
         depends on INET && EXPERIMENTAL && TRACEPOINTS
         ---help---
         This feature provides an alerting service to userspace in the
@@ -340,3 +337,7 @@ source "net/nfc/Kconfig"
 
 
 endif   # if NET
+
+# Used by archs to tell that they support BPF_JIT
+config HAVE_BPF_JIT
+        bool
diff --git a/net/Makefile b/net/Makefile
index ad432fa4d934..4f4ee083064c 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -40,7 +40,6 @@ obj-$(CONFIG_AF_RXRPC)		+= rxrpc/
 obj-$(CONFIG_ATM)               += atm/
 obj-$(CONFIG_L2TP)              += l2tp/
 obj-$(CONFIG_DECNET)            += decnet/
-obj-$(CONFIG_ECONET)            += econet/
 obj-$(CONFIG_PHONET)            += phonet/
 ifneq ($(CONFIG_VLAN_8021Q),)
 obj-y                           += 8021q/
@@ -60,6 +59,7 @@ ifneq ($(CONFIG_DCB),)
 obj-y                           += dcb/
 endif
 obj-$(CONFIG_IEEE802154)        += ieee802154/
+obj-$(CONFIG_MAC802154)         += mac802154/
 
 ifeq ($(CONFIG_NET),y)
 obj-$(CONFIG_SYSCTL)            += sysctl_net.o
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index bfa9ab93eda5..0301b328cf0f 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -63,7 +63,7 @@
 #include <net/tcp_states.h>
 #include <net/route.h>
 #include <linux/atalk.h>
-#include "../core/kmap_skb.h"
+#include <linux/highmem.h>
 
 struct datalink_proto *ddp_dl, *aarp_dl;
 static const struct proto_ops atalk_dgram_ops;
@@ -960,10 +960,10 @@ static unsigned long atalk_sum_skb(const struct sk_buff *skb, int offset,
 
                         if (copy > len)
                                 copy = len;
-                        vaddr = kmap_skb_frag(frag);
+                        vaddr = kmap_atomic(skb_frag_page(frag));
                         sum = atalk_sum_partial(vaddr + frag->page_offset +
                                                   offset - start, copy, sum);
-                        kunmap_skb_frag(vaddr);
+                        kunmap_atomic(vaddr);
 
                         if (!(len -= copy))
                                 return sum;
diff --git a/net/appletalk/sysctl_net_atalk.c b/net/appletalk/sysctl_net_atalk.c
index 04e9c0da7aa9..ebb864361f7a 100644
--- a/net/appletalk/sysctl_net_atalk.c
+++ b/net/appletalk/sysctl_net_atalk.c
@@ -42,20 +42,14 @@ static struct ctl_table atalk_table[] = {
         { },
 };
 
-static struct ctl_path atalk_path[] = {
-        { .procname = "net", },
-        { .procname = "appletalk", },
-        { }
-};
-
 static struct ctl_table_header *atalk_table_header;
 
 void atalk_register_sysctl(void)
 {
-        atalk_table_header = register_sysctl_paths(atalk_path, atalk_table);
+        atalk_table_header = register_net_sysctl(&init_net, "net/appletalk", atalk_table);
 }
 
 void atalk_unregister_sysctl(void)
 {
-        unregister_sysctl_table(atalk_table_header);
+        unregister_net_sysctl_table(atalk_table_header);
 }
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 353fccf1cde3..4819d31533e0 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -73,7 +73,7 @@ struct br2684_vcc {
 #ifdef CONFIG_ATM_BR2684_IPFILTER
         struct br2684_filter filter;
 #endif /* CONFIG_ATM_BR2684_IPFILTER */
-        unsigned copies_needed, copies_failed;
+        unsigned int copies_needed, copies_failed;
 };
 
 struct br2684_dev {
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 127fe70a1baa..8ae3a7879335 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -37,7 +37,6 @@
 #include <linux/param.h> /* for HZ */
 #include <linux/uaccess.h>
 #include <asm/byteorder.h> /* for htons etc. */
-#include <asm/system.h> /* save/restore_flags */
 #include <linux/atomic.h>
 
 #include "common.h"
@@ -330,6 +329,8 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
         struct atmarp_entry *entry;
         struct neighbour *n;
         struct atm_vcc *vcc;
+        struct rtable *rt;
+        __be32 *daddr;
         int old;
         unsigned long flags;
 
@@ -340,7 +341,12 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
                 dev->stats.tx_dropped++;
                 return NETDEV_TX_OK;
         }
-        n = dst_get_neighbour_noref(dst);
+        rt = (struct rtable *) dst;
+        if (rt->rt_gateway)
+                daddr = &rt->rt_gateway;
+        else
+                daddr = &ip_hdr(skb)->daddr;
+        n = dst_neigh_lookup(dst, daddr);
         if (!n) {
                 pr_err("NO NEIGHBOUR !\n");
                 dev_kfree_skb(skb);
@@ -360,7 +366,7 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
                         dev_kfree_skb(skb);
                         dev->stats.tx_dropped++;
                 }
-                return NETDEV_TX_OK;
+                goto out_release_neigh;
         }
         pr_debug("neigh %p, vccs %p\n", entry, entry->vccs);
         ATM_SKB(skb)->vcc = vcc = entry->vccs->vcc;
@@ -379,14 +385,14 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
         old = xchg(&entry->vccs->xoff, 1);      /* assume XOFF ... */
         if (old) {
                 pr_warning("XOFF->XOFF transition\n");
-                return NETDEV_TX_OK;
+                goto out_release_neigh;
         }
         dev->stats.tx_packets++;
         dev->stats.tx_bytes += skb->len;
         vcc->send(vcc, skb);
         if (atm_may_send(vcc, 0)) {
                 entry->vccs->xoff = 0;
-                return NETDEV_TX_OK;
+                goto out_release_neigh;
         }
         spin_lock_irqsave(&clip_priv->xoff_lock, flags);
         netif_stop_queue(dev);  /* XOFF -> throttle immediately */
@@ -398,6 +404,8 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
            of the brief netif_stop_queue. If this isn't true or if it
            changes, use netif_wake_queue instead. */
         spin_unlock_irqrestore(&clip_priv->xoff_lock, flags);
+out_release_neigh:
+        neigh_release(n);
         return NETDEV_TX_OK;
 }
 
diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c
index 62dc8bfe6fe7..bbd3b639992e 100644
--- a/net/atm/ioctl.c
+++ b/net/atm/ioctl.c
@@ -97,9 +97,8 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd,
                         error = sock_get_timestampns(sk, argp);
                 goto done;
         case ATM_SETSC:
-                if (net_ratelimit())
-                        pr_warning("ATM_SETSC is obsolete; used by %s:%d\n",
-                                   current->comm, task_pid_nr(current));
+                net_warn_ratelimited("ATM_SETSC is obsolete; used by %s:%d\n",
+                                     current->comm, task_pid_nr(current));
                 error = 0;
                 goto done;
         case ATMSIGD_CTRL:
@@ -123,8 +122,7 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd,
                    work for 32-bit userspace. TBH I don't really want
                    to think about it at all. dwmw2. */
                 if (compat) {
-                        if (net_ratelimit())
-                                pr_warning("32-bit task cannot be atmsigd\n");
+                        net_warn_ratelimited("32-bit task cannot be atmsigd\n");
                         error = -EINVAL;
                         goto done;
                 }
diff --git a/net/atm/lec.c b/net/atm/lec.c
index f1964caa0f83..a7d172105c99 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -26,11 +26,6 @@
 #include <linux/spinlock.h>
 #include <linux/seq_file.h>
 
-/* TokenRing if needed */
-#ifdef CONFIG_TR
-#include <linux/trdevice.h>
-#endif
-
 /* And atm device */
 #include <linux/atmdev.h>
 #include <linux/atmlec.h>
@@ -163,50 +158,6 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
 #endif /* defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE) */
 
 /*
- * Modelled after tr_type_trans
- * All multicast and ARE or STE frames go to BUS.
- * Non source routed frames go by destination address.
- * Last hop source routed frames go by destination address.
- * Not last hop source routed frames go by _next_ route descriptor.
- * Returns pointer to destination MAC address or fills in rdesc
- * and returns NULL.
- */
-#ifdef CONFIG_TR
-static unsigned char *get_tr_dst(unsigned char *packet, unsigned char *rdesc)
-{
-        struct trh_hdr *trh;
-        unsigned int riflen, num_rdsc;
-
-        trh = (struct trh_hdr *)packet;
-        if (trh->daddr[0] & (uint8_t) 0x80)
-                return bus_mac; /* multicast */
-
-        if (trh->saddr[0] & TR_RII) {
-                riflen = (ntohs(trh->rcf) & TR_RCF_LEN_MASK) >> 8;
-                if ((ntohs(trh->rcf) >> 13) != 0)
-                        return bus_mac; /* ARE or STE */
-        } else
-                return trh->daddr;      /* not source routed */
-
-        if (riflen < 6)
-                return trh->daddr;      /* last hop, source routed */
-
-        /* riflen is 6 or more, packet has more than one route descriptor */
-        num_rdsc = (riflen / 2) - 1;
-        memset(rdesc, 0, ETH_ALEN);
-        /* offset 4 comes from LAN destination field in LE control frames */
-        if (trh->rcf & htons((uint16_t) TR_RCF_DIR_BIT))
-                memcpy(&rdesc[4], &trh->rseg[num_rdsc - 2], sizeof(__be16));
-        else {
-                memcpy(&rdesc[4], &trh->rseg[1], sizeof(__be16));
-                rdesc[5] = ((ntohs(trh->rseg[0]) & 0x000f) | (rdesc[5] & 0xf0));
-        }
-
-        return NULL;
-}
-#endif /* CONFIG_TR */
-
-/*
  * Open/initialize the netdevice. This is called (in the current kernel)
  * sometime after booting when the 'ifconfig' program is run.
  *
@@ -257,9 +208,6 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
         struct lec_arp_table *entry;
         unsigned char *dst;
         int min_frame_size;
-#ifdef CONFIG_TR
-        unsigned char rdesc[ETH_ALEN];  /* Token Ring route descriptor */
-#endif
         int is_rdesc;
 
         pr_debug("called\n");
@@ -290,24 +238,10 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
         }
         skb_push(skb, 2);
 
-        /* Put le header to place, works for TokenRing too */
+        /* Put le header to place */
         lec_h = (struct lecdatahdr_8023 *)skb->data;
         lec_h->le_header = htons(priv->lecid);
 
-#ifdef CONFIG_TR
-        /*
-         * Ugly. Use this to realign Token Ring packets for
-         * e.g. PCA-200E driver.
-         */
-        if (priv->is_trdev) {
-                skb2 = skb_realloc_headroom(skb, LEC_HEADER_LEN);
-                kfree_skb(skb);
-                if (skb2 == NULL)
-                        return NETDEV_TX_OK;
-                skb = skb2;
-        }
-#endif
-
 #if DUMP_PACKETS >= 2
 #define MAX_DUMP_SKB 99
 #elif DUMP_PACKETS >= 1
@@ -321,12 +255,7 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
 #endif /* DUMP_PACKETS >= 1 */
 
         /* Minimum ethernet-frame size */
-#ifdef CONFIG_TR
-        if (priv->is_trdev)
-                min_frame_size = LEC_MINIMUM_8025_SIZE;
-        else
-#endif
-                min_frame_size = LEC_MINIMUM_8023_SIZE;
+        min_frame_size = LEC_MINIMUM_8023_SIZE;
         if (skb->len < min_frame_size) {
                 if ((skb->len + skb_tailroom(skb)) < min_frame_size) {
                         skb2 = skb_copy_expand(skb, 0,
@@ -345,15 +274,6 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
         /* Send to right vcc */
         is_rdesc = 0;
         dst = lec_h->h_dest;
-#ifdef CONFIG_TR
-        if (priv->is_trdev) {
-                dst = get_tr_dst(skb->data + 2, rdesc);
-                if (dst == NULL) {
-                        dst = rdesc;
-                        is_rdesc = 1;
-                }
-        }
-#endif
         entry = NULL;
         vcc = lec_arp_resolve(priv, dst, is_rdesc, &entry);
         pr_debug("%s:vcc:%p vcc_flags:%lx, entry:%p\n",
@@ -710,12 +630,7 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
                         dev_kfree_skb(skb);
                         return;
                 }
-#ifdef CONFIG_TR
-                if (priv->is_trdev)
-                        dst = ((struct lecdatahdr_8025 *)skb->data)->h_dest;
-                else
-#endif
-                        dst = ((struct lecdatahdr_8023 *)skb->data)->h_dest;
+                dst = ((struct lecdatahdr_8023 *)skb->data)->h_dest;
 
                 /*
                  * If this is a Data Direct VCC, and the VCC does not match
@@ -723,16 +638,7 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
                  */
                 spin_lock_irqsave(&priv->lec_arp_lock, flags);
                 if (lec_is_data_direct(vcc)) {
-#ifdef CONFIG_TR
-                        if (priv->is_trdev)
-                                src =
-                                    ((struct lecdatahdr_8025 *)skb->data)->
-                                    h_source;
-                        else
-#endif
-                                src =
-                                    ((struct lecdatahdr_8023 *)skb->data)->
-                                    h_source;
+                        src = ((struct lecdatahdr_8023 *)skb->data)->h_source;
                         entry = lec_arp_find(priv, src);
                         if (entry && entry->vcc != vcc) {
                                 lec_arp_remove(priv, entry);
@@ -750,12 +656,7 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
                 if (!hlist_empty(&priv->lec_arp_empty_ones))
                         lec_arp_check_empties(priv, vcc, skb);
                 skb_pull(skb, 2);       /* skip lec_id */
-#ifdef CONFIG_TR
-                if (priv->is_trdev)
-                        skb->protocol = tr_type_trans(skb, dev);
-                else
-#endif
-                        skb->protocol = eth_type_trans(skb, dev);
+                skb->protocol = eth_type_trans(skb, dev);
                 dev->stats.rx_packets++;
                 dev->stats.rx_bytes += skb->len;
                 memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));
@@ -827,27 +728,13 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
                 i = 0;
         else
                 i = arg;
-#ifdef CONFIG_TR
         if (arg >= MAX_LEC_ITF)
                 return -EINVAL;
-#else                           /* Reserve the top NUM_TR_DEVS for TR */
-        if (arg >= (MAX_LEC_ITF - NUM_TR_DEVS))
-                return -EINVAL;
-#endif
         if (!dev_lec[i]) {
-                int is_trdev, size;
-
-                is_trdev = 0;
-                if (i >= (MAX_LEC_ITF - NUM_TR_DEVS))
-                        is_trdev = 1;
+                int size;
 
                 size = sizeof(struct lec_priv);
-#ifdef CONFIG_TR
-                if (is_trdev)
-                        dev_lec[i] = alloc_trdev(size);
-                else
-#endif
-                        dev_lec[i] = alloc_etherdev(size);
+                dev_lec[i] = alloc_etherdev(size);
                 if (!dev_lec[i])
                         return -ENOMEM;
                 dev_lec[i]->netdev_ops = &lec_netdev_ops;
@@ -858,7 +745,6 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
                 }
 
                 priv = netdev_priv(dev_lec[i]);
-                priv->is_trdev = is_trdev;
         } else {
                 priv = netdev_priv(dev_lec[i]);
                 if (priv->lecd)
@@ -1255,7 +1141,7 @@ static int lane2_associate_req(struct net_device *dev, const u8 *lan_dst,
         struct sk_buff *skb;
         struct lec_priv *priv = netdev_priv(dev);
 
-        if (compare_ether_addr(lan_dst, dev->dev_addr))
+        if (!ether_addr_equal(lan_dst, dev->dev_addr))
                 return 0;       /* not our mac address */
 
         kfree(priv->tlvs);      /* NULL if there was no previous association */
@@ -1662,7 +1548,7 @@ static struct lec_arp_table *lec_arp_find(struct lec_priv *priv,
 
         head = &priv->lec_arp_tables[HASH(mac_addr[ETH_ALEN - 1])];
         hlist_for_each_entry(entry, node, head, next) {
-                if (!compare_ether_addr(mac_addr, entry->mac_addr))
+                if (ether_addr_equal(mac_addr, entry->mac_addr))
                         return entry;
         }
         return NULL;
@@ -1849,7 +1735,7 @@ static struct atm_vcc *lec_arp_resolve(struct lec_priv *priv,
                 case 1:
                         return priv->mcast_vcc;
                 case 2: /* LANE2 wants arp for multicast addresses */
-                        if (!compare_ether_addr(mac_to_find, bus_mac))
+                        if (ether_addr_equal(mac_to_find, bus_mac))
                                 return priv->mcast_vcc;
                         break;
                 default:
@@ -2372,15 +2258,7 @@ lec_arp_check_empties(struct lec_priv *priv,
         struct hlist_node *node, *next;
         struct lec_arp_table *entry, *tmp;
         struct lecdatahdr_8023 *hdr = (struct lecdatahdr_8023 *)skb->data;
-        unsigned char *src;
-#ifdef CONFIG_TR
-        struct lecdatahdr_8025 *tr_hdr = (struct lecdatahdr_8025 *)skb->data;
-
-        if (priv->is_trdev)
-                src = tr_hdr->h_source;
-        else
-#endif
-                src = hdr->h_source;
+        unsigned char *src = hdr->h_source;
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         hlist_for_each_entry_safe(entry, node, next,
diff --git a/net/atm/lec.h b/net/atm/lec.h
index dfc071966463..a86aff9a3c04 100644
--- a/net/atm/lec.h
+++ b/net/atm/lec.h
@@ -55,11 +55,11 @@ struct lane2_ops {
  * frames.
  *
  * 1. Dix Ethernet EtherType frames encoded by placing EtherType
- *    field in h_type field. Data follows immediatelly after header.
+ *    field in h_type field. Data follows immediately after header.
  * 2. LLC Data frames whose total length, including LLC field and data,
  *    but not padding required to meet the minimum data frame length,
  *    is less than 1536(0x0600) MUST be encoded by placing that length
- *    in the h_type field. The LLC field follows header immediatelly.
+ *    in the h_type field. The LLC field follows header immediately.
  * 3. LLC data frames longer than this maximum MUST be encoded by placing
  *    the value 0 in the h_type field.
  *
@@ -142,7 +142,6 @@ struct lec_priv {
         int itfnum;                             /* e.g. 2 for lec2, 5 for lec5 */
         struct lane2_ops *lane2_ops;            /* can be NULL for LANE v1 */
         int is_proxy;                           /* bridge between ATM and Ethernet */
-        int is_trdev;                           /* Device type, 0 = Ethernet, 1 = TokenRing */
 };
 
 struct lec_vcc_priv {
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index aa972409f093..d4cc1be5c364 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -592,8 +592,7 @@ static netdev_tx_t mpc_send_packet(struct sk_buff *skb,
                 goto non_ip;
 
         while (i < mpc->number_of_mps_macs) {
-                if (!compare_ether_addr(eth->h_dest,
-                                        (mpc->mps_macs + i*ETH_ALEN)))
+                if (ether_addr_equal(eth->h_dest, mpc->mps_macs + i * ETH_ALEN))
                         if (send_via_shortcut(skb, mpc) == 0) /* try shortcut */
                                 return NETDEV_TX_OK;
                 i++;
diff --git a/net/atm/mpoa_proc.c b/net/atm/mpoa_proc.c
index 53e500292271..5bdd300db0f7 100644
--- a/net/atm/mpoa_proc.c
+++ b/net/atm/mpoa_proc.c
@@ -207,7 +207,7 @@ static ssize_t proc_mpc_write(struct file *file, const char __user *buff,
                               size_t nbytes, loff_t *ppos)
 {
         char *page, *p;
-        unsigned len;
+        unsigned int len;
 
         if (nbytes == 0)
                 return 0;
diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c
index df35d9a3b5fe..ce1e59fdae7b 100644
--- a/net/atm/pppoatm.c
+++ b/net/atm/pppoatm.c
@@ -44,7 +44,7 @@
 #include <linux/atmdev.h>
 #include <linux/capability.h>
 #include <linux/ppp_defs.h>
-#include <linux/if_ppp.h>
+#include <linux/ppp-ioctl.h>
 #include <linux/ppp_channel.h>
 #include <linux/atmppp.h>
 
@@ -62,12 +62,25 @@ struct pppoatm_vcc {
         void (*old_pop)(struct atm_vcc *, struct sk_buff *);
                                         /* keep old push/pop for detaching */
         enum pppoatm_encaps encaps;
+        atomic_t inflight;
+        unsigned long blocked;
         int flags;                      /* SC_COMP_PROT - compress protocol */
         struct ppp_channel chan;        /* interface to generic ppp layer */
         struct tasklet_struct wakeup_tasklet;
 };
 
 /*
+ * We want to allow two packets in the queue. The one that's currently in
+ * flight, and *one* queued up ready for the ATM device to send immediately
+ * from its TX done IRQ. We want to be able to use atomic_inc_not_zero(), so
+ * inflight == -2 represents an empty queue, -1 one packet, and zero means
+ * there are two packets in the queue.
+ */
+#define NONE_INFLIGHT -2
+
+#define BLOCKED 0
+
+/*
  * Header used for LLC Encapsulated PPP (4 bytes) followed by the LCP protocol
  * ID (0xC021) used in autodetection
  */
@@ -102,16 +115,30 @@ static void pppoatm_wakeup_sender(unsigned long arg)
 static void pppoatm_pop(struct atm_vcc *atmvcc, struct sk_buff *skb)
 {
         struct pppoatm_vcc *pvcc = atmvcc_to_pvcc(atmvcc);
+
         pvcc->old_pop(atmvcc, skb);
+        atomic_dec(&pvcc->inflight);
+
         /*
-         * We don't really always want to do this since it's
-         * really inefficient - it would be much better if we could
-         * test if we had actually throttled the generic layer.
-         * Unfortunately then there would be a nasty SMP race where
-         * we could clear that flag just as we refuse another packet.
-         * For now we do the safe thing.
+         * We always used to run the wakeup tasklet unconditionally here, for
+         * fear of race conditions where we clear the BLOCKED flag just as we
+         * refuse another packet in pppoatm_send(). This was quite inefficient.
+         *
+         * In fact it's OK. The PPP core will only ever call pppoatm_send()
+         * while holding the channel->downl lock. And ppp_output_wakeup() as
+         * called by the tasklet will *also* grab that lock. So even if another
+         * CPU is in pppoatm_send() right now, the tasklet isn't going to race
+         * with it. The wakeup *will* happen after the other CPU is safely out
+         * of pppoatm_send() again.
+         *
+         * So if the CPU in pppoatm_send() has already set the BLOCKED bit and
+         * it about to return, that's fine. We trigger a wakeup which will
+         * happen later. And if the CPU in pppoatm_send() *hasn't* set the
+         * BLOCKED bit yet, that's fine too because of the double check in
+         * pppoatm_may_send() which is commented there.
          */
-        tasklet_schedule(&pvcc->wakeup_tasklet);
+        if (test_and_clear_bit(BLOCKED, &pvcc->blocked))
+                tasklet_schedule(&pvcc->wakeup_tasklet);
 }
 
 /*
@@ -184,6 +211,51 @@ error:
         ppp_input_error(&pvcc->chan, 0);
 }
 
+static inline int pppoatm_may_send(struct pppoatm_vcc *pvcc, int size)
+{
+        /*
+         * It's not clear that we need to bother with using atm_may_send()
+         * to check we don't exceed sk->sk_sndbuf. If userspace sets a
+         * value of sk_sndbuf which is lower than the MTU, we're going to
+         * block for ever. But the code always did that before we introduced
+         * the packet count limit, so...
+         */
+        if (atm_may_send(pvcc->atmvcc, size) &&
+            atomic_inc_not_zero_hint(&pvcc->inflight, NONE_INFLIGHT))
+                return 1;
+
+        /*
+         * We use test_and_set_bit() rather than set_bit() here because
+         * we need to ensure there's a memory barrier after it. The bit
+         * *must* be set before we do the atomic_inc() on pvcc->inflight.
+         * There's no smp_mb__after_set_bit(), so it's this or abuse
+         * smp_mb__after_clear_bit().
+         */
+        test_and_set_bit(BLOCKED, &pvcc->blocked);
+
+        /*
+         * We may have raced with pppoatm_pop(). If it ran for the
+         * last packet in the queue, *just* before we set the BLOCKED
+         * bit, then it might never run again and the channel could
+         * remain permanently blocked. Cope with that race by checking
+         * *again*. If it did run in that window, we'll have space on
+         * the queue now and can return success. It's harmless to leave
+         * the BLOCKED flag set, since it's only used as a trigger to
+         * run the wakeup tasklet. Another wakeup will never hurt.
+         * If pppoatm_pop() is running but hasn't got as far as making
+         * space on the queue yet, then it hasn't checked the BLOCKED
+         * flag yet either, so we're safe in that case too. It'll issue
+         * an "immediate" wakeup... where "immediate" actually involves
+         * taking the PPP channel's ->downl lock, which is held by the
+         * code path that calls pppoatm_send(), and is thus going to
+         * wait for us to finish.
+         */
+        if (atm_may_send(pvcc->atmvcc, size) &&
+            atomic_inc_not_zero(&pvcc->inflight))
+                return 1;
+
+        return 0;
+}
 /*
  * Called by the ppp_generic.c to send a packet - returns true if packet
  * was accepted.  If we return false, then it's our job to call
@@ -207,7 +279,7 @@ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
                         struct sk_buff *n;
                         n = skb_realloc_headroom(skb, LLC_LEN);
                         if (n != NULL &&
-                            !atm_may_send(pvcc->atmvcc, n->truesize)) {
+                            !pppoatm_may_send(pvcc, n->truesize)) {
                                 kfree_skb(n);
                                 goto nospace;
                         }
@@ -215,12 +287,12 @@ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
                         skb = n;
                         if (skb == NULL)
                                 return DROP_PACKET;
-                } else if (!atm_may_send(pvcc->atmvcc, skb->truesize))
+                } else if (!pppoatm_may_send(pvcc, skb->truesize))
                         goto nospace;
                 memcpy(skb_push(skb, LLC_LEN), pppllc, LLC_LEN);
                 break;
         case e_vc:
-                if (!atm_may_send(pvcc->atmvcc, skb->truesize))
+                if (!pppoatm_may_send(pvcc, skb->truesize))
                         goto nospace;
                 break;
         case e_autodetect:
@@ -285,6 +357,9 @@ static int pppoatm_assign_vcc(struct atm_vcc *atmvcc, void __user *arg)
         if (pvcc == NULL)
                 return -ENOMEM;
         pvcc->atmvcc = atmvcc;
+
+        /* Maximum is zero, so that we can use atomic_inc_not_zero() */
+        atomic_set(&pvcc->inflight, NONE_INFLIGHT);
         pvcc->old_push = atmvcc->push;
         pvcc->old_pop = atmvcc->pop;
         pvcc->encaps = (enum pppoatm_encaps) be.encaps;
diff --git a/net/atm/signaling.c b/net/atm/signaling.c
index 509c8ac02b63..86767ca908a3 100644
--- a/net/atm/signaling.c
+++ b/net/atm/signaling.c
@@ -166,7 +166,7 @@ void sigd_enq2(struct atm_vcc *vcc, enum atmsvc_msg_type type,
 {
         struct sk_buff *skb;
         struct atmsvc_msg *msg;
-        static unsigned session = 0;
+        static unsigned int session = 0;
 
         pr_debug("%d (0x%p)\n", (int)type, vcc);
         while (!(skb = alloc_skb(sizeof(struct atmsvc_msg), GFP_KERNEL)))
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 3cd0a0dc91cb..051f7abae66d 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -33,7 +33,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/termios.h>      /* For TIOCINQ/OUTQ */
 #include <linux/mm.h>
@@ -1991,7 +1990,6 @@ static int __init ax25_init(void)
         sock_register(&ax25_family_ops);
         dev_add_pack(&ax25_packet_type);
         register_netdevice_notifier(&ax25_dev_notifier);
-        ax25_register_sysctl();
 
         proc_net_fops_create(&init_net, "ax25_route", S_IRUGO, &ax25_route_fops);
         proc_net_fops_create(&init_net, "ax25", S_IRUGO, &ax25_info_fops);
@@ -2012,16 +2010,16 @@ static void __exit ax25_exit(void)
         proc_net_remove(&init_net, "ax25_route");
         proc_net_remove(&init_net, "ax25");
         proc_net_remove(&init_net, "ax25_calls");
-        ax25_rt_free();
-        ax25_uid_free();
-        ax25_dev_free();
 
-        ax25_unregister_sysctl();
         unregister_netdevice_notifier(&ax25_dev_notifier);
 
         dev_remove_pack(&ax25_packet_type);
 
         sock_unregister(PF_AX25);
         proto_unregister(&ax25_proto);
+
+        ax25_rt_free();
+        ax25_uid_free();
+        ax25_dev_free();
 }
 module_exit(ax25_exit);
diff --git a/net/ax25/ax25_addr.c b/net/ax25/ax25_addr.c
index 7e7964dd987b..9162409559cf 100644
--- a/net/ax25/ax25_addr.c
+++ b/net/ax25/ax25_addr.c
@@ -22,7 +22,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c
index c1cb982f6e86..3d106767b272 100644
--- a/net/ax25/ax25_dev.c
+++ b/net/ax25/ax25_dev.c
@@ -24,7 +24,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
@@ -60,8 +59,6 @@ void ax25_dev_device_up(struct net_device *dev)
                 return;
         }
 
-        ax25_unregister_sysctl();
-
         dev->ax25_ptr     = ax25_dev;
         ax25_dev->dev     = dev;
         dev_hold(dev);
@@ -91,7 +88,7 @@ void ax25_dev_device_up(struct net_device *dev)
         ax25_dev_list  = ax25_dev;
         spin_unlock_bh(&ax25_dev_lock);
 
-        ax25_register_sysctl();
+        ax25_register_dev_sysctl(ax25_dev);
 }
 
 void ax25_dev_device_down(struct net_device *dev)
@@ -101,7 +98,7 @@ void ax25_dev_device_down(struct net_device *dev)
         if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
                 return;
 
-        ax25_unregister_sysctl();
+        ax25_unregister_dev_sysctl(ax25_dev);
 
         spin_lock_bh(&ax25_dev_lock);
 
@@ -121,7 +118,6 @@ void ax25_dev_device_down(struct net_device *dev)
                 spin_unlock_bh(&ax25_dev_lock);
                 dev_put(dev);
                 kfree(ax25_dev);
-                ax25_register_sysctl();
                 return;
         }
 
@@ -131,7 +127,6 @@ void ax25_dev_device_down(struct net_device *dev)
                         spin_unlock_bh(&ax25_dev_lock);
                         dev_put(dev);
                         kfree(ax25_dev);
-                        ax25_register_sysctl();
                         return;
                 }
 
@@ -139,8 +134,6 @@ void ax25_dev_device_down(struct net_device *dev)
         }
         spin_unlock_bh(&ax25_dev_lock);
         dev->ax25_ptr = NULL;
-
-        ax25_register_sysctl();
 }
 
 int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd)
diff --git a/net/ax25/ax25_ds_in.c b/net/ax25/ax25_ds_in.c
index 8273b1200eee..9bd31e88aeca 100644
--- a/net/ax25/ax25_ds_in.c
+++ b/net/ax25/ax25_ds_in.c
@@ -23,7 +23,6 @@
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/ax25/ax25_ds_subr.c b/net/ax25/ax25_ds_subr.c
index 85816e612dc0..5ea7fd3e2af9 100644
--- a/net/ax25/ax25_ds_subr.c
+++ b/net/ax25/ax25_ds_subr.c
@@ -24,7 +24,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/ax25/ax25_ds_timer.c b/net/ax25/ax25_ds_timer.c
index c7d81436213d..993c439b4f71 100644
--- a/net/ax25/ax25_ds_timer.c
+++ b/net/ax25/ax25_ds_timer.c
@@ -25,7 +25,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/ax25/ax25_iface.c b/net/ax25/ax25_iface.c
index 60b545e2822a..7d5f24b82cc8 100644
--- a/net/ax25/ax25_iface.c
+++ b/net/ax25/ax25_iface.c
@@ -24,7 +24,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c
index 9bb776541203..96f4cab3a2f9 100644
--- a/net/ax25/ax25_in.c
+++ b/net/ax25/ax25_in.c
@@ -27,7 +27,6 @@
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c
index cf0c47a26530..67de6b33f2c3 100644
--- a/net/ax25/ax25_ip.c
+++ b/net/ax25/ax25_ip.c
@@ -24,7 +24,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/termios.h>      /* For TIOCINQ/OUTQ */
 #include <linux/mm.h>
@@ -49,7 +48,7 @@
 
 int ax25_hard_header(struct sk_buff *skb, struct net_device *dev,
                      unsigned short type, const void *daddr,
-                     const void *saddr, unsigned len)
+                     const void *saddr, unsigned int len)
 {
         unsigned char *buff;
 
@@ -220,7 +219,7 @@ put:
 
 int ax25_hard_header(struct sk_buff *skb, struct net_device *dev,
                      unsigned short type, const void *daddr,
-                     const void *saddr, unsigned len)
+                     const void *saddr, unsigned int len)
 {
         return -AX25_HEADER_LEN;
 }
diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c
index 37507d806f65..be8a25e0db65 100644
--- a/net/ax25/ax25_out.c
+++ b/net/ax25/ax25_out.c
@@ -27,7 +27,6 @@
 #include <linux/netfilter.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
index 87fddab22e0f..a65588040b9e 100644
--- a/net/ax25/ax25_route.c
+++ b/net/ax25/ax25_route.c
@@ -32,7 +32,6 @@
 #include <linux/spinlock.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/ax25/ax25_std_in.c b/net/ax25/ax25_std_in.c
index a8eef88d8652..3fbf8f7b2cf4 100644
--- a/net/ax25/ax25_std_in.c
+++ b/net/ax25/ax25_std_in.c
@@ -30,7 +30,6 @@
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/ax25/ax25_std_subr.c b/net/ax25/ax25_std_subr.c
index 277f81bb979a..8b66a41e538f 100644
--- a/net/ax25/ax25_std_subr.c
+++ b/net/ax25/ax25_std_subr.c
@@ -21,7 +21,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/ax25/ax25_std_timer.c b/net/ax25/ax25_std_timer.c
index 96e4b9273250..004467c9e6e1 100644
--- a/net/ax25/ax25_std_timer.c
+++ b/net/ax25/ax25_std_timer.c
@@ -25,7 +25,6 @@
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
index c6715ee4ab8f..1997538a5d23 100644
--- a/net/ax25/ax25_subr.c
+++ b/net/ax25/ax25_subr.c
@@ -26,7 +26,6 @@
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/ax25/ax25_timer.c b/net/ax25/ax25_timer.c
index db29ea71e80a..c3cffa79bafb 100644
--- a/net/ax25/ax25_timer.c
+++ b/net/ax25/ax25_timer.c
@@ -29,7 +29,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/ax25/ax25_uid.c b/net/ax25/ax25_uid.c
index 4c83137b5954..e3c579ba6325 100644
--- a/net/ax25/ax25_uid.c
+++ b/net/ax25/ax25_uid.c
@@ -26,7 +26,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
index ebe0ef3f1d83..d5744b752511 100644
--- a/net/ax25/sysctl_net_ax25.c
+++ b/net/ax25/sysctl_net_ax25.c
@@ -29,17 +29,6 @@ static int min_proto[1],		max_proto[] = { AX25_PROTO_MAX };
 static int min_ds_timeout[1],           max_ds_timeout[] = {65535000};
 #endif
 
-static struct ctl_table_header *ax25_table_header;
-
-static ctl_table *ax25_table;
-static int ax25_table_size;
-
-static struct ctl_path ax25_path[] = {
-        { .procname = "net", },
-        { .procname = "ax25", },
-        { }
-};
-
 static const ctl_table ax25_param_table[] = {
         {
                 .procname       = "ip_default_mode",
@@ -159,52 +148,37 @@ static const ctl_table ax25_param_table[] = {
         { }     /* that's all, folks! */
 };
 
-void ax25_register_sysctl(void)
+int ax25_register_dev_sysctl(ax25_dev *ax25_dev)
 {
-        ax25_dev *ax25_dev;
-        int n, k;
-
-        spin_lock_bh(&ax25_dev_lock);
-        for (ax25_table_size = sizeof(ctl_table), ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next)
-                ax25_table_size += sizeof(ctl_table);
-
-        if ((ax25_table = kzalloc(ax25_table_size, GFP_ATOMIC)) == NULL) {
-                spin_unlock_bh(&ax25_dev_lock);
-                return;
-        }
-
-        for (n = 0, ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next) {
-                struct ctl_table *child = kmemdup(ax25_param_table,
-                                                  sizeof(ax25_param_table),
-                                                  GFP_ATOMIC);
-                if (!child) {
-                        while (n--)
-                                kfree(ax25_table[n].child);
-                        kfree(ax25_table);
-                        spin_unlock_bh(&ax25_dev_lock);
-                        return;
-                }
-                ax25_table[n].child = ax25_dev->systable = child;
-                ax25_table[n].procname     = ax25_dev->dev->name;
-                ax25_table[n].mode         = 0555;
-
-
-                for (k = 0; k < AX25_MAX_VALUES; k++)
-                        child[k].data = &ax25_dev->values[k];
-
-                n++;
+        char path[sizeof("net/ax25/") + IFNAMSIZ];
+        int k;
+        struct ctl_table *table;
+
+        table = kmemdup(ax25_param_table, sizeof(ax25_param_table), GFP_KERNEL);
+        if (!table)
+                return -ENOMEM;
+
+        for (k = 0; k < AX25_MAX_VALUES; k++)
+                table[k].data = &ax25_dev->values[k];
+
+        snprintf(path, sizeof(path), "net/ax25/%s", ax25_dev->dev->name);
+        ax25_dev->sysheader = register_net_sysctl(&init_net, path, table);
+        if (!ax25_dev->sysheader) {
+                kfree(table);
+                return -ENOMEM;
         }
-        spin_unlock_bh(&ax25_dev_lock);
-
-        ax25_table_header = register_sysctl_paths(ax25_path, ax25_table);
+        return 0;
 }
 
-void ax25_unregister_sysctl(void)
+void ax25_unregister_dev_sysctl(ax25_dev *ax25_dev)
 {
-        ctl_table *p;
-        unregister_sysctl_table(ax25_table_header);
-
-        for (p = ax25_table; p->procname; p++)
-                kfree(p->child);
-        kfree(ax25_table);
+        struct ctl_table_header *header = ax25_dev->sysheader;
+        struct ctl_table *table;
+
+        if (header) {
+                ax25_dev->sysheader = NULL;
+                table = header->ctl_table_arg;
+                unregister_net_sysctl_table(header);
+                kfree(table);
+        }
 }
diff --git a/net/batman-adv/Kconfig b/net/batman-adv/Kconfig
index 2b68d068eaf3..53f5244e28f8 100644
--- a/net/batman-adv/Kconfig
+++ b/net/batman-adv/Kconfig
@@ -7,19 +7,28 @@ config BATMAN_ADV
         depends on NET
         select CRC16
         default n
-        ---help---
+        help
+          B.A.T.M.A.N. (better approach to mobile ad-hoc networking) is
+          a routing protocol for multi-hop ad-hoc mesh networks. The
+          networks may be wired or wireless. See
+          http://www.open-mesh.org/ for more information and user space
+          tools.
 
-        B.A.T.M.A.N. (better approach to mobile ad-hoc networking) is
-        a routing protocol for multi-hop ad-hoc mesh networks. The
-        networks may be wired or wireless. See
-        http://www.open-mesh.org/ for more information and user space
-        tools.
+config BATMAN_ADV_BLA
+        bool "Bridge Loop Avoidance"
+        depends on BATMAN_ADV && INET
+        default y
+        help
+          This option enables BLA (Bridge Loop Avoidance), a mechanism
+          to avoid Ethernet frames looping when mesh nodes are connected
+          to both the same LAN and the same mesh. If you will never use
+          more than one mesh node in the same LAN, you can safely remove
+          this feature and save some space.
 
 config BATMAN_ADV_DEBUG
         bool "B.A.T.M.A.N. debugging"
-        depends on BATMAN_ADV != n
-        ---help---
-
+        depends on BATMAN_ADV
+        help
           This is an option for use by developers; most people should
           say N here. This enables compilation of support for
           outputting debugging information to the kernel log. The
diff --git a/net/batman-adv/Makefile b/net/batman-adv/Makefile
index ce6861166499..6d5c1940667d 100644
--- a/net/batman-adv/Makefile
+++ b/net/batman-adv/Makefile
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+# Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
 #
 # Marek Lindner, Simon Wunderlich
 #
@@ -23,6 +23,7 @@ batman-adv-y += bat_debugfs.o
 batman-adv-y += bat_iv_ogm.o
 batman-adv-y += bat_sysfs.o
 batman-adv-y += bitarray.o
+batman-adv-$(CONFIG_BATMAN_ADV_BLA) += bridge_loop_avoidance.o
 batman-adv-y += gateway_client.o
 batman-adv-y += gateway_common.o
 batman-adv-y += hard-interface.o
diff --git a/net/batman-adv/bat_ogm.h b/net/batman-adv/bat_algo.h
index 69329c107e28..9852a688ba43 100644
--- a/net/batman-adv/bat_ogm.h
+++ b/net/batman-adv/bat_algo.h
@@ -1,7 +1,7 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2011-2012 B.A.T.M.A.N. contributors:
  *
- * Marek Lindner, Simon Wunderlich
+ * Marek Lindner
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of version 2 of the GNU General Public
@@ -19,17 +19,9 @@
  *
  */
 
-#ifndef _NET_BATMAN_ADV_OGM_H_
-#define _NET_BATMAN_ADV_OGM_H_
+#ifndef _NET_BATMAN_ADV_BAT_ALGO_H_
+#define _NET_BATMAN_ADV_BAT_ALGO_H_
 
-#include "main.h"
+int bat_iv_init(void);
 
-void bat_ogm_init(struct hard_iface *hard_iface);
-void bat_ogm_init_primary(struct hard_iface *hard_iface);
-void bat_ogm_update_mac(struct hard_iface *hard_iface);
-void bat_ogm_schedule(struct hard_iface *hard_iface, int tt_num_changes);
-void bat_ogm_emit(struct forw_packet *forw_packet);
-void bat_ogm_receive(const struct ethhdr *ethhdr, unsigned char *packet_buff,
-                     int packet_len, struct hard_iface *if_incoming);
-
-#endif /* _NET_BATMAN_ADV_OGM_H_ */
+#endif /* _NET_BATMAN_ADV_BAT_ALGO_H_ */
diff --git a/net/batman-adv/bat_debugfs.c b/net/batman-adv/bat_debugfs.c
index d0af9bf69e46..3b588f86d770 100644
--- a/net/batman-adv/bat_debugfs.c
+++ b/net/batman-adv/bat_debugfs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2010-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner
  *
@@ -32,6 +32,7 @@
 #include "soft-interface.h"
 #include "vis.h"
 #include "icmp_socket.h"
+#include "bridge_loop_avoidance.h"
 
 static struct dentry *bat_debugfs;
 
@@ -82,8 +83,8 @@ int debug_log(struct bat_priv *bat_priv, const char *fmt, ...)
 
         va_start(args, fmt);
         vscnprintf(tmp_log_buf, sizeof(tmp_log_buf), fmt, args);
-        fdebug_log(bat_priv->debug_log, "[%10lu] %s",
-                   (jiffies / HZ), tmp_log_buf);
+        fdebug_log(bat_priv->debug_log, "[%10u] %s",
+                   jiffies_to_msecs(jiffies), tmp_log_buf);
         va_end(args);
 
         return 0;
@@ -221,6 +222,11 @@ static void debug_log_cleanup(struct bat_priv *bat_priv)
 }
 #endif
 
+static int bat_algorithms_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, bat_algo_seq_print_text, NULL);
+}
+
 static int originators_open(struct inode *inode, struct file *file)
 {
         struct net_device *net_dev = (struct net_device *)inode->i_private;
@@ -233,17 +239,19 @@ static int gateways_open(struct inode *inode, struct file *file)
         return single_open(file, gw_client_seq_print_text, net_dev);
 }
 
-static int softif_neigh_open(struct inode *inode, struct file *file)
+static int transtable_global_open(struct inode *inode, struct file *file)
 {
         struct net_device *net_dev = (struct net_device *)inode->i_private;
-        return single_open(file, softif_neigh_seq_print_text, net_dev);
+        return single_open(file, tt_global_seq_print_text, net_dev);
 }
 
-static int transtable_global_open(struct inode *inode, struct file *file)
+#ifdef CONFIG_BATMAN_ADV_BLA
+static int bla_claim_table_open(struct inode *inode, struct file *file)
 {
         struct net_device *net_dev = (struct net_device *)inode->i_private;
-        return single_open(file, tt_global_seq_print_text, net_dev);
+        return single_open(file, bla_claim_table_seq_print_text, net_dev);
 }
+#endif
 
 static int transtable_local_open(struct inode *inode, struct file *file)
 {
@@ -274,18 +282,23 @@ struct bat_debuginfo bat_debuginfo_##_name = {	\
                 }                               \
 };
 
+static BAT_DEBUGINFO(routing_algos, S_IRUGO, bat_algorithms_open);
 static BAT_DEBUGINFO(originators, S_IRUGO, originators_open);
 static BAT_DEBUGINFO(gateways, S_IRUGO, gateways_open);
-static BAT_DEBUGINFO(softif_neigh, S_IRUGO, softif_neigh_open);
 static BAT_DEBUGINFO(transtable_global, S_IRUGO, transtable_global_open);
+#ifdef CONFIG_BATMAN_ADV_BLA
+static BAT_DEBUGINFO(bla_claim_table, S_IRUGO, bla_claim_table_open);
+#endif
 static BAT_DEBUGINFO(transtable_local, S_IRUGO, transtable_local_open);
 static BAT_DEBUGINFO(vis_data, S_IRUGO, vis_data_open);
 
 static struct bat_debuginfo *mesh_debuginfos[] = {
         &bat_debuginfo_originators,
         &bat_debuginfo_gateways,
-        &bat_debuginfo_softif_neigh,
         &bat_debuginfo_transtable_global,
+#ifdef CONFIG_BATMAN_ADV_BLA
+        &bat_debuginfo_bla_claim_table,
+#endif
         &bat_debuginfo_transtable_local,
         &bat_debuginfo_vis_data,
         NULL,
@@ -293,9 +306,25 @@ static struct bat_debuginfo *mesh_debuginfos[] = {
 
 void debugfs_init(void)
 {
+        struct bat_debuginfo *bat_debug;
+        struct dentry *file;
+
         bat_debugfs = debugfs_create_dir(DEBUGFS_BAT_SUBDIR, NULL);
         if (bat_debugfs == ERR_PTR(-ENODEV))
                 bat_debugfs = NULL;
+
+        if (!bat_debugfs)
+                goto out;
+
+        bat_debug = &bat_debuginfo_routing_algos;
+        file = debugfs_create_file(bat_debug->attr.name,
+                                   S_IFREG | bat_debug->attr.mode,
+                                   bat_debugfs, NULL, &bat_debug->fops);
+        if (!file)
+                pr_err("Can't add debugfs file: %s\n", bat_debug->attr.name);
+
+out:
+        return;
 }
 
 void debugfs_destroy(void)
diff --git a/net/batman-adv/bat_debugfs.h b/net/batman-adv/bat_debugfs.h
index bc9cda3f01e1..d605c6746428 100644
--- a/net/batman-adv/bat_debugfs.h
+++ b/net/batman-adv/bat_debugfs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2010-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner
  *
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 3512e251545b..dc53798ebb47 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner, Simon Wunderlich
  *
@@ -20,7 +20,6 @@
  */
 
 #include "main.h"
-#include "bat_ogm.h"
 #include "translation-table.h"
 #include "ring_buffer.h"
 #include "originator.h"
@@ -29,34 +28,71 @@
 #include "gateway_client.h"
 #include "hard-interface.h"
 #include "send.h"
+#include "bat_algo.h"
 
-void bat_ogm_init(struct hard_iface *hard_iface)
+static struct neigh_node *bat_iv_ogm_neigh_new(struct hard_iface *hard_iface,
+                                               const uint8_t *neigh_addr,
+                                               struct orig_node *orig_node,
+                                               struct orig_node *orig_neigh,
+                                               uint32_t seqno)
+{
+        struct neigh_node *neigh_node;
+
+        neigh_node = batadv_neigh_node_new(hard_iface, neigh_addr, seqno);
+        if (!neigh_node)
+                goto out;
+
+        INIT_LIST_HEAD(&neigh_node->bonding_list);
+
+        neigh_node->orig_node = orig_neigh;
+        neigh_node->if_incoming = hard_iface;
+
+        spin_lock_bh(&orig_node->neigh_list_lock);
+        hlist_add_head_rcu(&neigh_node->list, &orig_node->neigh_list);
+        spin_unlock_bh(&orig_node->neigh_list_lock);
+
+out:
+        return neigh_node;
+}
+
+static int bat_iv_ogm_iface_enable(struct hard_iface *hard_iface)
 {
         struct batman_ogm_packet *batman_ogm_packet;
+        uint32_t random_seqno;
+        int res = -1;
+
+        /* randomize initial seqno to avoid collision */
+        get_random_bytes(&random_seqno, sizeof(random_seqno));
+        atomic_set(&hard_iface->seqno, random_seqno);
 
-        hard_iface->packet_len = BATMAN_OGM_LEN;
+        hard_iface->packet_len = BATMAN_OGM_HLEN;
         hard_iface->packet_buff = kmalloc(hard_iface->packet_len, GFP_ATOMIC);
 
+        if (!hard_iface->packet_buff)
+                goto out;
+
         batman_ogm_packet = (struct batman_ogm_packet *)hard_iface->packet_buff;
-        batman_ogm_packet->packet_type = BAT_OGM;
-        batman_ogm_packet->version = COMPAT_VERSION;
+        batman_ogm_packet->header.packet_type = BAT_IV_OGM;
+        batman_ogm_packet->header.version = COMPAT_VERSION;
+        batman_ogm_packet->header.ttl = 2;
         batman_ogm_packet->flags = NO_FLAGS;
-        batman_ogm_packet->ttl = 2;
         batman_ogm_packet->tq = TQ_MAX_VALUE;
         batman_ogm_packet->tt_num_changes = 0;
         batman_ogm_packet->ttvn = 0;
+
+        res = 0;
+
+out:
+        return res;
 }
 
-void bat_ogm_init_primary(struct hard_iface *hard_iface)
+static void bat_iv_ogm_iface_disable(struct hard_iface *hard_iface)
 {
-        struct batman_ogm_packet *batman_ogm_packet;
-
-        batman_ogm_packet = (struct batman_ogm_packet *)hard_iface->packet_buff;
-        batman_ogm_packet->flags = PRIMARIES_FIRST_HOP;
-        batman_ogm_packet->ttl = TTL;
+        kfree(hard_iface->packet_buff);
+        hard_iface->packet_buff = NULL;
 }
 
-void bat_ogm_update_mac(struct hard_iface *hard_iface)
+static void bat_iv_ogm_iface_update_mac(struct hard_iface *hard_iface)
 {
         struct batman_ogm_packet *batman_ogm_packet;
 
@@ -67,8 +103,17 @@ void bat_ogm_update_mac(struct hard_iface *hard_iface)
                hard_iface->net_dev->dev_addr, ETH_ALEN);
 }
 
+static void bat_iv_ogm_primary_iface_set(struct hard_iface *hard_iface)
+{
+        struct batman_ogm_packet *batman_ogm_packet;
+
+        batman_ogm_packet = (struct batman_ogm_packet *)hard_iface->packet_buff;
+        batman_ogm_packet->flags = PRIMARIES_FIRST_HOP;
+        batman_ogm_packet->header.ttl = TTL;
+}
+
 /* when do we schedule our own ogm to be sent */
-static unsigned long bat_ogm_emit_send_time(const struct bat_priv *bat_priv)
+static unsigned long bat_iv_ogm_emit_send_time(const struct bat_priv *bat_priv)
 {
         return jiffies + msecs_to_jiffies(
                    atomic_read(&bat_priv->orig_interval) -
@@ -76,7 +121,7 @@ static unsigned long bat_ogm_emit_send_time(const struct bat_priv *bat_priv)
 }
 
 /* when do we schedule a ogm packet to be sent */
-static unsigned long bat_ogm_fwd_send_time(void)
+static unsigned long bat_iv_ogm_fwd_send_time(void)
 {
         return jiffies + msecs_to_jiffies(random32() % (JITTER/2));
 }
@@ -89,18 +134,18 @@ static uint8_t hop_penalty(uint8_t tq, const struct bat_priv *bat_priv)
 }
 
 /* is there another aggregated packet here? */
-static int bat_ogm_aggr_packet(int buff_pos, int packet_len,
-                               int tt_num_changes)
+static int bat_iv_ogm_aggr_packet(int buff_pos, int packet_len,
+                                  int tt_num_changes)
 {
-        int next_buff_pos = buff_pos + BATMAN_OGM_LEN + tt_len(tt_num_changes);
+        int next_buff_pos = buff_pos + BATMAN_OGM_HLEN + tt_len(tt_num_changes);
 
         return (next_buff_pos <= packet_len) &&
                 (next_buff_pos <= MAX_AGGREGATION_BYTES);
 }
 
 /* send a batman ogm to a given interface */
-static void bat_ogm_send_to_if(struct forw_packet *forw_packet,
-                               struct hard_iface *hard_iface)
+static void bat_iv_ogm_send_to_if(struct forw_packet *forw_packet,
+                                  struct hard_iface *hard_iface)
 {
         struct bat_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         char *fwd_str;
@@ -117,8 +162,8 @@ static void bat_ogm_send_to_if(struct forw_packet *forw_packet,
         batman_ogm_packet = (struct batman_ogm_packet *)forw_packet->skb->data;
 
         /* adjust all flags and log packets */
-        while (bat_ogm_aggr_packet(buff_pos, forw_packet->packet_len,
-                                   batman_ogm_packet->tt_num_changes)) {
+        while (bat_iv_ogm_aggr_packet(buff_pos, forw_packet->packet_len,
+                                      batman_ogm_packet->tt_num_changes)) {
 
                 /* we might have aggregated direct link packets with an
                  * ordinary base packet */
@@ -132,18 +177,17 @@ static void bat_ogm_send_to_if(struct forw_packet *forw_packet,
                                                             "Sending own" :
                                                             "Forwarding"));
                 bat_dbg(DBG_BATMAN, bat_priv,
-                        "%s %spacket (originator %pM, seqno %d, TQ %d, TTL %d,"
-                        " IDF %s, ttvn %d) on interface %s [%pM]\n",
+                        "%s %spacket (originator %pM, seqno %u, TQ %d, TTL %d, IDF %s, ttvn %d) on interface %s [%pM]\n",
                         fwd_str, (packet_num > 0 ? "aggregated " : ""),
                         batman_ogm_packet->orig,
                         ntohl(batman_ogm_packet->seqno),
-                        batman_ogm_packet->tq, batman_ogm_packet->ttl,
+                        batman_ogm_packet->tq, batman_ogm_packet->header.ttl,
                         (batman_ogm_packet->flags & DIRECTLINK ?
                          "on" : "off"),
                         batman_ogm_packet->ttvn, hard_iface->net_dev->name,
                         hard_iface->net_dev->dev_addr);
 
-                buff_pos += BATMAN_OGM_LEN +
+                buff_pos += BATMAN_OGM_HLEN +
                                 tt_len(batman_ogm_packet->tt_num_changes);
                 packet_num++;
                 batman_ogm_packet = (struct batman_ogm_packet *)
@@ -157,7 +201,7 @@ static void bat_ogm_send_to_if(struct forw_packet *forw_packet,
 }
 
 /* send a batman ogm packet */
-void bat_ogm_emit(struct forw_packet *forw_packet)
+static void bat_iv_ogm_emit(struct forw_packet *forw_packet)
 {
         struct hard_iface *hard_iface;
         struct net_device *soft_iface;
@@ -171,8 +215,7 @@ void bat_ogm_emit(struct forw_packet *forw_packet)
         directlink = (batman_ogm_packet->flags & DIRECTLINK ? 1 : 0);
 
         if (!forw_packet->if_incoming) {
-                pr_err("Error - can't forward packet: incoming iface not "
-                       "specified\n");
+                pr_err("Error - can't forward packet: incoming iface not specified\n");
                 goto out;
         }
 
@@ -188,17 +231,16 @@ void bat_ogm_emit(struct forw_packet *forw_packet)
 
         /* multihomed peer assumed */
         /* non-primary OGMs are only broadcasted on their interface */
-        if ((directlink && (batman_ogm_packet->ttl == 1)) ||
+        if ((directlink && (batman_ogm_packet->header.ttl == 1)) ||
             (forw_packet->own && (forw_packet->if_incoming != primary_if))) {
 
                 /* FIXME: what about aggregated packets ? */
                 bat_dbg(DBG_BATMAN, bat_priv,
-                        "%s packet (originator %pM, seqno %d, TTL %d) "
-                        "on interface %s [%pM]\n",
+                        "%s packet (originator %pM, seqno %u, TTL %d) on interface %s [%pM]\n",
                         (forw_packet->own ? "Sending own" : "Forwarding"),
                         batman_ogm_packet->orig,
                         ntohl(batman_ogm_packet->seqno),
-                        batman_ogm_packet->ttl,
+                        batman_ogm_packet->header.ttl,
                         forw_packet->if_incoming->net_dev->name,
                         forw_packet->if_incoming->net_dev->dev_addr);
 
@@ -216,7 +258,7 @@ void bat_ogm_emit(struct forw_packet *forw_packet)
                 if (hard_iface->soft_iface != soft_iface)
                         continue;
 
-                bat_ogm_send_to_if(forw_packet, hard_iface);
+                bat_iv_ogm_send_to_if(forw_packet, hard_iface);
         }
         rcu_read_unlock();
 
@@ -226,13 +268,13 @@ out:
 }
 
 /* return true if new_packet can be aggregated with forw_packet */
-static bool bat_ogm_can_aggregate(const struct batman_ogm_packet
+static bool bat_iv_ogm_can_aggregate(const struct batman_ogm_packet
                                                         *new_batman_ogm_packet,
-                                  struct bat_priv *bat_priv,
-                                  int packet_len, unsigned long send_time,
-                                  bool directlink,
-                                  const struct hard_iface *if_incoming,
-                                  const struct forw_packet *forw_packet)
+                                     struct bat_priv *bat_priv,
+                                     int packet_len, unsigned long send_time,
+                                     bool directlink,
+                                     const struct hard_iface *if_incoming,
+                                     const struct forw_packet *forw_packet)
 {
         struct batman_ogm_packet *batman_ogm_packet;
         int aggregated_bytes = forw_packet->packet_len + packet_len;
@@ -272,7 +314,7 @@ static bool bat_ogm_can_aggregate(const struct batman_ogm_packet
                  * are flooded through the net  */
                 if ((!directlink) &&
                     (!(batman_ogm_packet->flags & DIRECTLINK)) &&
-                    (batman_ogm_packet->ttl != 1) &&
+                    (batman_ogm_packet->header.ttl != 1) &&
 
                     /* own packets originating non-primary
                      * interfaces leave only that interface */
@@ -285,7 +327,7 @@ static bool bat_ogm_can_aggregate(const struct batman_ogm_packet
                 /* if the incoming packet is sent via this one
                  * interface only - we still can aggregate */
                 if ((directlink) &&
-                    (new_batman_ogm_packet->ttl == 1) &&
+                    (new_batman_ogm_packet->header.ttl == 1) &&
                     (forw_packet->if_incoming == if_incoming) &&
 
                     /* packets from direct neighbors or
@@ -306,11 +348,11 @@ out:
 }
 
 /* create a new aggregated packet and add this packet to it */
-static void bat_ogm_aggregate_new(const unsigned char *packet_buff,
-                                  int packet_len, unsigned long send_time,
-                                  bool direct_link,
-                                  struct hard_iface *if_incoming,
-                                  int own_packet)
+static void bat_iv_ogm_aggregate_new(const unsigned char *packet_buff,
+                                     int packet_len, unsigned long send_time,
+                                     bool direct_link,
+                                     struct hard_iface *if_incoming,
+                                     int own_packet)
 {
         struct bat_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
         struct forw_packet *forw_packet_aggr;
@@ -338,10 +380,9 @@ static void bat_ogm_aggregate_new(const unsigned char *packet_buff,
         if ((atomic_read(&bat_priv->aggregated_ogms)) &&
             (packet_len < MAX_AGGREGATION_BYTES))
                 forw_packet_aggr->skb = dev_alloc_skb(MAX_AGGREGATION_BYTES +
-                                                      sizeof(struct ethhdr));
+                                                      ETH_HLEN);
         else
-                forw_packet_aggr->skb = dev_alloc_skb(packet_len +
-                                                      sizeof(struct ethhdr));
+                forw_packet_aggr->skb = dev_alloc_skb(packet_len + ETH_HLEN);
 
         if (!forw_packet_aggr->skb) {
                 if (!own_packet)
@@ -349,7 +390,7 @@ static void bat_ogm_aggregate_new(const unsigned char *packet_buff,
                 kfree(forw_packet_aggr);
                 goto out;
         }
-        skb_reserve(forw_packet_aggr->skb, sizeof(struct ethhdr));
+        skb_reserve(forw_packet_aggr->skb, ETH_HLEN);
 
         INIT_HLIST_NODE(&forw_packet_aggr->list);
 
@@ -385,9 +426,9 @@ out:
 }
 
 /* aggregate a new packet into the existing ogm packet */
-static void bat_ogm_aggregate(struct forw_packet *forw_packet_aggr,
-                              const unsigned char *packet_buff,
-                              int packet_len, bool direct_link)
+static void bat_iv_ogm_aggregate(struct forw_packet *forw_packet_aggr,
+                                 const unsigned char *packet_buff,
+                                 int packet_len, bool direct_link)
 {
         unsigned char *skb_buff;
 
@@ -402,10 +443,10 @@ static void bat_ogm_aggregate(struct forw_packet *forw_packet_aggr,
                         (1 << forw_packet_aggr->num_packets);
 }
 
-static void bat_ogm_queue_add(struct bat_priv *bat_priv,
-                              unsigned char *packet_buff,
-                              int packet_len, struct hard_iface *if_incoming,
-                              int own_packet, unsigned long send_time)
+static void bat_iv_ogm_queue_add(struct bat_priv *bat_priv,
+                                 unsigned char *packet_buff,
+                                 int packet_len, struct hard_iface *if_incoming,
+                                 int own_packet, unsigned long send_time)
 {
         /**
          * _aggr -> pointer to the packet we want to aggregate with
@@ -425,11 +466,11 @@ static void bat_ogm_queue_add(struct bat_priv *bat_priv,
         if ((atomic_read(&bat_priv->aggregated_ogms)) && (!own_packet)) {
                 hlist_for_each_entry(forw_packet_pos, tmp_node,
                                      &bat_priv->forw_bat_list, list) {
-                        if (bat_ogm_can_aggregate(batman_ogm_packet,
-                                                  bat_priv, packet_len,
-                                                  send_time, direct_link,
-                                                  if_incoming,
-                                                  forw_packet_pos)) {
+                        if (bat_iv_ogm_can_aggregate(batman_ogm_packet,
+                                                     bat_priv, packet_len,
+                                                     send_time, direct_link,
+                                                     if_incoming,
+                                                     forw_packet_pos)) {
                                 forw_packet_aggr = forw_packet_pos;
                                 break;
                         }
@@ -451,83 +492,73 @@ static void bat_ogm_queue_add(struct bat_priv *bat_priv,
                     (atomic_read(&bat_priv->aggregated_ogms)))
                         send_time += msecs_to_jiffies(MAX_AGGREGATION_MS);
 
-                bat_ogm_aggregate_new(packet_buff, packet_len,
-                                      send_time, direct_link,
-                                      if_incoming, own_packet);
+                bat_iv_ogm_aggregate_new(packet_buff, packet_len,
+                                         send_time, direct_link,
+                                         if_incoming, own_packet);
         } else {
-                bat_ogm_aggregate(forw_packet_aggr, packet_buff, packet_len,
-                                  direct_link);
+                bat_iv_ogm_aggregate(forw_packet_aggr, packet_buff,
+                                     packet_len, direct_link);
                 spin_unlock_bh(&bat_priv->forw_bat_list_lock);
         }
 }
 
-static void bat_ogm_forward(struct orig_node *orig_node,
-                            const struct ethhdr *ethhdr,
-                            struct batman_ogm_packet *batman_ogm_packet,
-                            int directlink, struct hard_iface *if_incoming)
+static void bat_iv_ogm_forward(struct orig_node *orig_node,
+                               const struct ethhdr *ethhdr,
+                               struct batman_ogm_packet *batman_ogm_packet,
+                               bool is_single_hop_neigh,
+                               bool is_from_best_next_hop,
+                               struct hard_iface *if_incoming)
 {
         struct bat_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
-        struct neigh_node *router;
-        uint8_t in_tq, in_ttl, tq_avg = 0;
         uint8_t tt_num_changes;
 
-        if (batman_ogm_packet->ttl <= 1) {
+        if (batman_ogm_packet->header.ttl <= 1) {
                 bat_dbg(DBG_BATMAN, bat_priv, "ttl exceeded\n");
                 return;
         }
 
-        router = orig_node_get_router(orig_node);
+        if (!is_from_best_next_hop) {
+                /* Mark the forwarded packet when it is not coming from our
+                 * best next hop. We still need to forward the packet for our
+                 * neighbor link quality detection to work in case the packet
+                 * originated from a single hop neighbor. Otherwise we can
+                 * simply drop the ogm.
+                 */
+                if (is_single_hop_neigh)
+                        batman_ogm_packet->flags |= NOT_BEST_NEXT_HOP;
+                else
+                        return;
+        }
 
-        in_tq = batman_ogm_packet->tq;
-        in_ttl = batman_ogm_packet->ttl;
         tt_num_changes = batman_ogm_packet->tt_num_changes;
 
-        batman_ogm_packet->ttl--;
+        batman_ogm_packet->header.ttl--;
         memcpy(batman_ogm_packet->prev_sender, ethhdr->h_source, ETH_ALEN);
 
-        /* rebroadcast tq of our best ranking neighbor to ensure the rebroadcast
-         * of our best tq value */
-        if (router && router->tq_avg != 0) {
-
-                /* rebroadcast ogm of best ranking neighbor as is */
-                if (!compare_eth(router->addr, ethhdr->h_source)) {
-                        batman_ogm_packet->tq = router->tq_avg;
-
-                        if (router->last_ttl)
-                                batman_ogm_packet->ttl = router->last_ttl - 1;
-                }
-
-                tq_avg = router->tq_avg;
-        }
-
-        if (router)
-                neigh_node_free_ref(router);
-
         /* apply hop penalty */
         batman_ogm_packet->tq = hop_penalty(batman_ogm_packet->tq, bat_priv);
 
         bat_dbg(DBG_BATMAN, bat_priv,
-                "Forwarding packet: tq_orig: %i, tq_avg: %i, "
-                "tq_forw: %i, ttl_orig: %i, ttl_forw: %i\n",
-                in_tq, tq_avg, batman_ogm_packet->tq, in_ttl - 1,
-                batman_ogm_packet->ttl);
+                "Forwarding packet: tq: %i, ttl: %i\n",
+                batman_ogm_packet->tq, batman_ogm_packet->header.ttl);
 
         batman_ogm_packet->seqno = htonl(batman_ogm_packet->seqno);
         batman_ogm_packet->tt_crc = htons(batman_ogm_packet->tt_crc);
 
         /* switch of primaries first hop flag when forwarding */
         batman_ogm_packet->flags &= ~PRIMARIES_FIRST_HOP;
-        if (directlink)
+        if (is_single_hop_neigh)
                 batman_ogm_packet->flags |= DIRECTLINK;
         else
                 batman_ogm_packet->flags &= ~DIRECTLINK;
 
-        bat_ogm_queue_add(bat_priv, (unsigned char *)batman_ogm_packet,
-                          BATMAN_OGM_LEN + tt_len(tt_num_changes),
-                          if_incoming, 0, bat_ogm_fwd_send_time());
+        bat_iv_ogm_queue_add(bat_priv, (unsigned char *)batman_ogm_packet,
+                             BATMAN_OGM_HLEN + tt_len(tt_num_changes),
+                             if_incoming, 0, bat_iv_ogm_fwd_send_time());
 }
 
-void bat_ogm_schedule(struct hard_iface *hard_iface, int tt_num_changes)
+static void bat_iv_ogm_schedule(struct hard_iface *hard_iface,
+                                int tt_num_changes)
 {
         struct bat_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         struct batman_ogm_packet *batman_ogm_packet;
@@ -564,21 +595,22 @@ void bat_ogm_schedule(struct hard_iface *hard_iface, int tt_num_changes)
         atomic_inc(&hard_iface->seqno);
 
         slide_own_bcast_window(hard_iface);
-        bat_ogm_queue_add(bat_priv, hard_iface->packet_buff,
-                          hard_iface->packet_len, hard_iface, 1,
-                          bat_ogm_emit_send_time(bat_priv));
+        bat_iv_ogm_queue_add(bat_priv, hard_iface->packet_buff,
+                             hard_iface->packet_len, hard_iface, 1,
+                             bat_iv_ogm_emit_send_time(bat_priv));
 
         if (primary_if)
                 hardif_free_ref(primary_if);
 }
 
-static void bat_ogm_orig_update(struct bat_priv *bat_priv,
-                                struct orig_node *orig_node,
-                                const struct ethhdr *ethhdr,
-                                const struct batman_ogm_packet
+static void bat_iv_ogm_orig_update(struct bat_priv *bat_priv,
+                                   struct orig_node *orig_node,
+                                   const struct ethhdr *ethhdr,
+                                   const struct batman_ogm_packet
                                                         *batman_ogm_packet,
-                                struct hard_iface *if_incoming,
-                                const unsigned char *tt_buff, int is_duplicate)
+                                   struct hard_iface *if_incoming,
+                                   const unsigned char *tt_buff,
+                                   int is_duplicate)
 {
         struct neigh_node *neigh_node = NULL, *tmp_neigh_node = NULL;
         struct neigh_node *router = NULL;
@@ -586,8 +618,8 @@ static void bat_ogm_orig_update(struct bat_priv *bat_priv,
         struct hlist_node *node;
         uint8_t bcast_own_sum_orig, bcast_own_sum_neigh;
 
-        bat_dbg(DBG_BATMAN, bat_priv, "update_originator(): "
-                "Searching and updating originator entry of received packet\n");
+        bat_dbg(DBG_BATMAN, bat_priv,
+                "update_originator(): Searching and updating originator entry of received packet\n");
 
         rcu_read_lock();
         hlist_for_each_entry_rcu(tmp_neigh_node, node,
@@ -604,12 +636,12 @@ static void bat_ogm_orig_update(struct bat_priv *bat_priv,
                 if (is_duplicate)
                         continue;
 
-                spin_lock_bh(&tmp_neigh_node->tq_lock);
+                spin_lock_bh(&tmp_neigh_node->lq_update_lock);
                 ring_buffer_set(tmp_neigh_node->tq_recv,
                                 &tmp_neigh_node->tq_index, 0);
                 tmp_neigh_node->tq_avg =
                         ring_buffer_avg(tmp_neigh_node->tq_recv);
-                spin_unlock_bh(&tmp_neigh_node->tq_lock);
+                spin_unlock_bh(&tmp_neigh_node->lq_update_lock);
         }
 
         if (!neigh_node) {
@@ -619,8 +651,9 @@ static void bat_ogm_orig_update(struct bat_priv *bat_priv,
                 if (!orig_tmp)
                         goto unlock;
 
-                neigh_node = create_neighbor(orig_node, orig_tmp,
-                                             ethhdr->h_source, if_incoming);
+                neigh_node = bat_iv_ogm_neigh_new(if_incoming, ethhdr->h_source,
+                                                  orig_node, orig_tmp,
+                                                  batman_ogm_packet->seqno);
 
                 orig_node_free_ref(orig_tmp);
                 if (!neigh_node)
@@ -632,18 +665,18 @@ static void bat_ogm_orig_update(struct bat_priv *bat_priv,
         rcu_read_unlock();
 
         orig_node->flags = batman_ogm_packet->flags;
-        neigh_node->last_valid = jiffies;
+        neigh_node->last_seen = jiffies;
 
-        spin_lock_bh(&neigh_node->tq_lock);
+        spin_lock_bh(&neigh_node->lq_update_lock);
         ring_buffer_set(neigh_node->tq_recv,
                         &neigh_node->tq_index,
                         batman_ogm_packet->tq);
         neigh_node->tq_avg = ring_buffer_avg(neigh_node->tq_recv);
-        spin_unlock_bh(&neigh_node->tq_lock);
+        spin_unlock_bh(&neigh_node->lq_update_lock);
 
         if (!is_duplicate) {
-                orig_node->last_ttl = batman_ogm_packet->ttl;
-                neigh_node->last_ttl = batman_ogm_packet->ttl;
+                orig_node->last_ttl = batman_ogm_packet->header.ttl;
+                neigh_node->last_ttl = batman_ogm_packet->header.ttl;
         }
 
         bonding_candidate_add(orig_node, neigh_node);
@@ -683,7 +716,7 @@ update_tt:
         /* I have to check for transtable changes only if the OGM has been
          * sent through a primary interface */
         if (((batman_ogm_packet->orig != ethhdr->h_source) &&
-             (batman_ogm_packet->ttl > 2)) ||
+             (batman_ogm_packet->header.ttl > 2)) ||
             (batman_ogm_packet->flags & PRIMARIES_FIRST_HOP))
                 tt_update_orig(bat_priv, orig_node, tt_buff,
                                batman_ogm_packet->tt_num_changes,
@@ -713,10 +746,10 @@ out:
                 neigh_node_free_ref(router);
 }
 
-static int bat_ogm_calc_tq(struct orig_node *orig_node,
-                           struct orig_node *orig_neigh_node,
-                           struct batman_ogm_packet *batman_ogm_packet,
-                           struct hard_iface *if_incoming)
+static int bat_iv_ogm_calc_tq(struct orig_node *orig_node,
+                              struct orig_node *orig_neigh_node,
+                              struct batman_ogm_packet *batman_ogm_packet,
+                              struct hard_iface *if_incoming)
 {
         struct bat_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
         struct neigh_node *neigh_node = NULL, *tmp_neigh_node;
@@ -745,19 +778,20 @@ static int bat_ogm_calc_tq(struct orig_node *orig_node,
         rcu_read_unlock();
 
         if (!neigh_node)
-                neigh_node = create_neighbor(orig_neigh_node,
-                                             orig_neigh_node,
-                                             orig_neigh_node->orig,
-                                             if_incoming);
+                neigh_node = bat_iv_ogm_neigh_new(if_incoming,
+                                                  orig_neigh_node->orig,
+                                                  orig_neigh_node,
+                                                  orig_neigh_node,
+                                                  batman_ogm_packet->seqno);
 
         if (!neigh_node)
                 goto out;
 
-        /* if orig_node is direct neighbor update neigh_node last_valid */
+        /* if orig_node is direct neighbor update neigh_node last_seen */
         if (orig_node == orig_neigh_node)
-                neigh_node->last_valid = jiffies;
+                neigh_node->last_seen = jiffies;
 
-        orig_node->last_valid = jiffies;
+        orig_node->last_seen = jiffies;
 
         /* find packet count of corresponding one hop neighbor */
         spin_lock_bh(&orig_node->ogm_cnt_lock);
@@ -780,8 +814,7 @@ static int bat_ogm_calc_tq(struct orig_node *orig_node,
                  * information */
                 tq_own = (TQ_MAX_VALUE * total_count) / neigh_rq_count;
 
-        /*
-         * 1 - ((1-x) ** 3), normalized to TQ_MAX_VALUE this does
+        /* 1 - ((1-x) ** 3), normalized to TQ_MAX_VALUE this does
          * affect the nearly-symmetric links only a little, but
          * punishes asymmetric links more.  This will give a value
          * between 0 and TQ_MAX_VALUE
@@ -799,10 +832,7 @@ static int bat_ogm_calc_tq(struct orig_node *orig_node,
                                                 (TQ_MAX_VALUE * TQ_MAX_VALUE));
 
         bat_dbg(DBG_BATMAN, bat_priv,
-                "bidirectional: "
-                "orig = %-15pM neigh = %-15pM => own_bcast = %2i, "
-                "real recv = %2i, local tq: %3i, asym_penalty: %3i, "
-                "total tq: %3i\n",
+                "bidirectional: orig = %-15pM neigh = %-15pM => own_bcast = %2i, real recv = %2i, local tq: %3i, asym_penalty: %3i, total tq: %3i\n",
                 orig_node->orig, orig_neigh_node->orig, total_count,
                 neigh_rq_count, tq_own, tq_asym_penalty, batman_ogm_packet->tq);
 
@@ -825,10 +855,10 @@ out:
  *  -1 the packet is old and has been received while the seqno window
  *     was protected. Caller should drop it.
  */
-static int bat_ogm_update_seqnos(const struct ethhdr *ethhdr,
-                                 const struct batman_ogm_packet
+static int bat_iv_ogm_update_seqnos(const struct ethhdr *ethhdr,
+                                    const struct batman_ogm_packet
                                                         *batman_ogm_packet,
-                                 const struct hard_iface *if_incoming)
+                                    const struct hard_iface *if_incoming)
 {
         struct bat_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
         struct orig_node *orig_node;
@@ -847,7 +877,8 @@ static int bat_ogm_update_seqnos(const struct ethhdr *ethhdr,
         seq_diff = batman_ogm_packet->seqno - orig_node->last_real_seqno;
 
         /* signalize caller that the packet is to be dropped. */
-        if (window_protected(bat_priv, seq_diff,
+        if (!hlist_empty(&orig_node->neigh_list) &&
+            window_protected(bat_priv, seq_diff,
                              &orig_node->batman_seqno_reset))
                 goto out;
 
@@ -855,9 +886,9 @@ static int bat_ogm_update_seqnos(const struct ethhdr *ethhdr,
         hlist_for_each_entry_rcu(tmp_neigh_node, node,
                                  &orig_node->neigh_list, list) {
 
-                is_duplicate |= get_bit_status(tmp_neigh_node->real_bits,
-                                               orig_node->last_real_seqno,
-                                               batman_ogm_packet->seqno);
+                is_duplicate |= bat_test_bit(tmp_neigh_node->real_bits,
+                                             orig_node->last_real_seqno,
+                                             batman_ogm_packet->seqno);
 
                 if (compare_eth(tmp_neigh_node->addr, ethhdr->h_source) &&
                     (tmp_neigh_node->if_incoming == if_incoming))
@@ -871,13 +902,14 @@ static int bat_ogm_update_seqnos(const struct ethhdr *ethhdr,
                                               seq_diff, set_mark);
 
                 tmp_neigh_node->real_packet_count =
-                        bit_packet_count(tmp_neigh_node->real_bits);
+                        bitmap_weight(tmp_neigh_node->real_bits,
+                                      TQ_LOCAL_WINDOW_SIZE);
         }
         rcu_read_unlock();
 
         if (need_update) {
                 bat_dbg(DBG_BATMAN, bat_priv,
-                        "updating last_seqno: old %d, new %d\n",
+                        "updating last_seqno: old %u, new %u\n",
                         orig_node->last_real_seqno, batman_ogm_packet->seqno);
                 orig_node->last_real_seqno = batman_ogm_packet->seqno;
         }
@@ -890,10 +922,10 @@ out:
         return ret;
 }
 
-static void bat_ogm_process(const struct ethhdr *ethhdr,
-                            struct batman_ogm_packet *batman_ogm_packet,
-                            const unsigned char *tt_buff,
-                            struct hard_iface *if_incoming)
+static void bat_iv_ogm_process(const struct ethhdr *ethhdr,
+                               struct batman_ogm_packet *batman_ogm_packet,
+                               const unsigned char *tt_buff,
+                               struct hard_iface *if_incoming)
 {
         struct bat_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
         struct hard_iface *hard_iface;
@@ -902,7 +934,9 @@ static void bat_ogm_process(const struct ethhdr *ethhdr,
         struct neigh_node *orig_neigh_router = NULL;
         int has_directlink_flag;
         int is_my_addr = 0, is_my_orig = 0, is_my_oldorig = 0;
-        int is_broadcast = 0, is_bidirectional, is_single_hop_neigh;
+        int is_broadcast = 0, is_bidirectional;
+        bool is_single_hop_neigh = false;
+        bool is_from_best_next_hop = false;
         int is_duplicate;
         uint32_t if_incoming_seqno;
 
@@ -918,7 +952,7 @@ static void bat_ogm_process(const struct ethhdr *ethhdr,
          * packet in an aggregation.  Here we expect that the padding
          * is always zero (or not 0x01)
          */
-        if (batman_ogm_packet->packet_type != BAT_OGM)
+        if (batman_ogm_packet->header.packet_type != BAT_IV_OGM)
                 return;
 
         /* could be changed by schedule_own_packet() */
@@ -926,20 +960,18 @@ static void bat_ogm_process(const struct ethhdr *ethhdr,
 
         has_directlink_flag = (batman_ogm_packet->flags & DIRECTLINK ? 1 : 0);
 
-        is_single_hop_neigh = (compare_eth(ethhdr->h_source,
-                                           batman_ogm_packet->orig) ? 1 : 0);
+        if (compare_eth(ethhdr->h_source, batman_ogm_packet->orig))
+                is_single_hop_neigh = true;
 
         bat_dbg(DBG_BATMAN, bat_priv,
-                "Received BATMAN packet via NB: %pM, IF: %s [%pM] "
-                "(from OG: %pM, via prev OG: %pM, seqno %d, ttvn %u, "
-                "crc %u, changes %u, td %d, TTL %d, V %d, IDF %d)\n",
+                "Received BATMAN packet via NB: %pM, IF: %s [%pM] (from OG: %pM, via prev OG: %pM, seqno %u, ttvn %u, crc %u, changes %u, td %d, TTL %d, V %d, IDF %d)\n",
                 ethhdr->h_source, if_incoming->net_dev->name,
                 if_incoming->net_dev->dev_addr, batman_ogm_packet->orig,
                 batman_ogm_packet->prev_sender, batman_ogm_packet->seqno,
                 batman_ogm_packet->ttvn, batman_ogm_packet->tt_crc,
                 batman_ogm_packet->tt_num_changes, batman_ogm_packet->tq,
-                batman_ogm_packet->ttl, batman_ogm_packet->version,
-                has_directlink_flag);
+                batman_ogm_packet->header.ttl,
+                batman_ogm_packet->header.version, has_directlink_flag);
 
         rcu_read_lock();
         list_for_each_entry_rcu(hard_iface, &hardif_list, list) {
@@ -966,25 +998,24 @@ static void bat_ogm_process(const struct ethhdr *ethhdr,
         }
         rcu_read_unlock();
 
-        if (batman_ogm_packet->version != COMPAT_VERSION) {
+        if (batman_ogm_packet->header.version != COMPAT_VERSION) {
                 bat_dbg(DBG_BATMAN, bat_priv,
                         "Drop packet: incompatible batman version (%i)\n",
-                        batman_ogm_packet->version);
+                        batman_ogm_packet->header.version);
                 return;
         }
 
         if (is_my_addr) {
                 bat_dbg(DBG_BATMAN, bat_priv,
-                        "Drop packet: received my own broadcast (sender: %pM"
-                        ")\n",
+                        "Drop packet: received my own broadcast (sender: %pM)\n",
                         ethhdr->h_source);
                 return;
         }
 
         if (is_broadcast) {
-                bat_dbg(DBG_BATMAN, bat_priv, "Drop packet: "
-                "ignoring all packets with broadcast source addr (sender: %pM"
-                ")\n", ethhdr->h_source);
+                bat_dbg(DBG_BATMAN, bat_priv,
+                        "Drop packet: ignoring all packets with broadcast source addr (sender: %pM)\n",
+                        ethhdr->h_source);
                 return;
         }
 
@@ -1006,24 +1037,31 @@ static void bat_ogm_process(const struct ethhdr *ethhdr,
 
                         spin_lock_bh(&orig_neigh_node->ogm_cnt_lock);
                         word = &(orig_neigh_node->bcast_own[offset]);
-                        bit_mark(word,
-                                 if_incoming_seqno -
+                        bat_set_bit(word,
+                                    if_incoming_seqno -
                                                 batman_ogm_packet->seqno - 2);
                         orig_neigh_node->bcast_own_sum[if_incoming->if_num] =
-                                bit_packet_count(word);
+                                bitmap_weight(word, TQ_LOCAL_WINDOW_SIZE);
                         spin_unlock_bh(&orig_neigh_node->ogm_cnt_lock);
                 }
 
-                bat_dbg(DBG_BATMAN, bat_priv, "Drop packet: "
-                        "originator packet from myself (via neighbor)\n");
+                bat_dbg(DBG_BATMAN, bat_priv,
+                        "Drop packet: originator packet from myself (via neighbor)\n");
                 orig_node_free_ref(orig_neigh_node);
                 return;
         }
 
         if (is_my_oldorig) {
                 bat_dbg(DBG_BATMAN, bat_priv,
-                        "Drop packet: ignoring all rebroadcast echos (sender: "
-                        "%pM)\n", ethhdr->h_source);
+                        "Drop packet: ignoring all rebroadcast echos (sender: %pM)\n",
+                        ethhdr->h_source);
+                return;
+        }
+
+        if (batman_ogm_packet->flags & NOT_BEST_NEXT_HOP) {
+                bat_dbg(DBG_BATMAN, bat_priv,
+                        "Drop packet: ignoring all packets not forwarded from the best next hop (sender: %pM)\n",
+                        ethhdr->h_source);
                 return;
         }
 
@@ -1031,13 +1069,13 @@ static void bat_ogm_process(const struct ethhdr *ethhdr,
         if (!orig_node)
                 return;
 
-        is_duplicate = bat_ogm_update_seqnos(ethhdr, batman_ogm_packet,
-                                             if_incoming);
+        is_duplicate = bat_iv_ogm_update_seqnos(ethhdr, batman_ogm_packet,
+                                                if_incoming);
 
         if (is_duplicate == -1) {
                 bat_dbg(DBG_BATMAN, bat_priv,
-                        "Drop packet: packet within seqno protection time "
-                        "(sender: %pM)\n", ethhdr->h_source);
+                        "Drop packet: packet within seqno protection time (sender: %pM)\n",
+                        ethhdr->h_source);
                 goto out;
         }
 
@@ -1051,6 +1089,10 @@ static void bat_ogm_process(const struct ethhdr *ethhdr,
         if (router)
                 router_router = orig_node_get_router(router->orig_node);
 
+        if ((router && router->tq_avg != 0) &&
+            (compare_eth(router->addr, ethhdr->h_source)))
+                is_from_best_next_hop = true;
+
         /* avoid temporary routing loops */
         if (router && router_router &&
             (compare_eth(router->addr, batman_ogm_packet->prev_sender)) &&
@@ -1058,8 +1100,8 @@ static void bat_ogm_process(const struct ethhdr *ethhdr,
                           batman_ogm_packet->prev_sender)) &&
             (compare_eth(router->addr, router_router->addr))) {
                 bat_dbg(DBG_BATMAN, bat_priv,
-                        "Drop packet: ignoring all rebroadcast packets that "
-                        "may make me loop (sender: %pM)\n", ethhdr->h_source);
+                        "Drop packet: ignoring all rebroadcast packets that may make me loop (sender: %pM)\n",
+                        ethhdr->h_source);
                 goto out;
         }
 
@@ -1081,8 +1123,8 @@ static void bat_ogm_process(const struct ethhdr *ethhdr,
                 goto out_neigh;
         }
 
-        is_bidirectional = bat_ogm_calc_tq(orig_node, orig_neigh_node,
-                                           batman_ogm_packet, if_incoming);
+        is_bidirectional = bat_iv_ogm_calc_tq(orig_node, orig_neigh_node,
+                                              batman_ogm_packet, if_incoming);
 
         bonding_save_primary(orig_node, orig_neigh_node, batman_ogm_packet);
 
@@ -1091,20 +1133,21 @@ static void bat_ogm_process(const struct ethhdr *ethhdr,
         if (is_bidirectional &&
             (!is_duplicate ||
              ((orig_node->last_real_seqno == batman_ogm_packet->seqno) &&
-              (orig_node->last_ttl - 3 <= batman_ogm_packet->ttl))))
-                bat_ogm_orig_update(bat_priv, orig_node, ethhdr,
-                                    batman_ogm_packet, if_incoming,
-                                    tt_buff, is_duplicate);
+              (orig_node->last_ttl - 3 <= batman_ogm_packet->header.ttl))))
+                bat_iv_ogm_orig_update(bat_priv, orig_node, ethhdr,
+                                       batman_ogm_packet, if_incoming,
+                                       tt_buff, is_duplicate);
 
         /* is single hop (direct) neighbor */
         if (is_single_hop_neigh) {
 
                 /* mark direct link on incoming interface */
-                bat_ogm_forward(orig_node, ethhdr, batman_ogm_packet,
-                                1, if_incoming);
+                bat_iv_ogm_forward(orig_node, ethhdr, batman_ogm_packet,
+                                   is_single_hop_neigh, is_from_best_next_hop,
+                                   if_incoming);
 
-                bat_dbg(DBG_BATMAN, bat_priv, "Forwarding packet: "
-                        "rebroadcast neighbor packet with direct link flag\n");
+                bat_dbg(DBG_BATMAN, bat_priv,
+                        "Forwarding packet: rebroadcast neighbor packet with direct link flag\n");
                 goto out_neigh;
         }
 
@@ -1123,7 +1166,9 @@ static void bat_ogm_process(const struct ethhdr *ethhdr,
 
         bat_dbg(DBG_BATMAN, bat_priv,
                 "Forwarding packet: rebroadcast originator packet\n");
-        bat_ogm_forward(orig_node, ethhdr, batman_ogm_packet, 0, if_incoming);
+        bat_iv_ogm_forward(orig_node, ethhdr, batman_ogm_packet,
+                           is_single_hop_neigh, is_from_best_next_hop,
+                           if_incoming);
 
 out_neigh:
         if ((orig_neigh_node) && (!is_single_hop_neigh))
@@ -1139,13 +1184,29 @@ out:
         orig_node_free_ref(orig_node);
 }
 
-void bat_ogm_receive(const struct ethhdr *ethhdr, unsigned char *packet_buff,
-                     int packet_len, struct hard_iface *if_incoming)
+static int bat_iv_ogm_receive(struct sk_buff *skb,
+                              struct hard_iface *if_incoming)
 {
+        struct bat_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
         struct batman_ogm_packet *batman_ogm_packet;
-        int buff_pos = 0;
-        unsigned char *tt_buff;
+        struct ethhdr *ethhdr;
+        int buff_pos = 0, packet_len;
+        unsigned char *tt_buff, *packet_buff;
+        bool ret;
 
+        ret = check_management_packet(skb, if_incoming, BATMAN_OGM_HLEN);
+        if (!ret)
+                return NET_RX_DROP;
+
+        /* did we receive a B.A.T.M.A.N. IV OGM packet on an interface
+         * that does not have B.A.T.M.A.N. IV enabled ?
+         */
+        if (bat_priv->bat_algo_ops->bat_ogm_emit != bat_iv_ogm_emit)
+                return NET_RX_DROP;
+
+        packet_len = skb_headlen(skb);
+        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        packet_buff = skb->data;
         batman_ogm_packet = (struct batman_ogm_packet *)packet_buff;
 
         /* unpack the aggregated packets and process them one by one */
@@ -1155,16 +1216,50 @@ void bat_ogm_receive(const struct ethhdr *ethhdr, unsigned char *packet_buff,
                 batman_ogm_packet->seqno = ntohl(batman_ogm_packet->seqno);
                 batman_ogm_packet->tt_crc = ntohs(batman_ogm_packet->tt_crc);
 
-                tt_buff = packet_buff + buff_pos + BATMAN_OGM_LEN;
+                tt_buff = packet_buff + buff_pos + BATMAN_OGM_HLEN;
 
-                bat_ogm_process(ethhdr, batman_ogm_packet,
-                                tt_buff, if_incoming);
+                bat_iv_ogm_process(ethhdr, batman_ogm_packet,
+                                   tt_buff, if_incoming);
 
-                buff_pos += BATMAN_OGM_LEN +
+                buff_pos += BATMAN_OGM_HLEN +
                                 tt_len(batman_ogm_packet->tt_num_changes);
 
                 batman_ogm_packet = (struct batman_ogm_packet *)
                                                 (packet_buff + buff_pos);
-        } while (bat_ogm_aggr_packet(buff_pos, packet_len,
-                                     batman_ogm_packet->tt_num_changes));
+        } while (bat_iv_ogm_aggr_packet(buff_pos, packet_len,
+                                        batman_ogm_packet->tt_num_changes));
+
+        kfree_skb(skb);
+        return NET_RX_SUCCESS;
+}
+
+static struct bat_algo_ops batman_iv __read_mostly = {
+        .name = "BATMAN IV",
+        .bat_iface_enable = bat_iv_ogm_iface_enable,
+        .bat_iface_disable = bat_iv_ogm_iface_disable,
+        .bat_iface_update_mac = bat_iv_ogm_iface_update_mac,
+        .bat_primary_iface_set = bat_iv_ogm_primary_iface_set,
+        .bat_ogm_schedule = bat_iv_ogm_schedule,
+        .bat_ogm_emit = bat_iv_ogm_emit,
+};
+
+int __init bat_iv_init(void)
+{
+        int ret;
+
+        /* batman originator packet */
+        ret = recv_handler_register(BAT_IV_OGM, bat_iv_ogm_receive);
+        if (ret < 0)
+                goto out;
+
+        ret = bat_algo_register(&batman_iv);
+        if (ret < 0)
+                goto handler_unregister;
+
+        goto out;
+
+handler_unregister:
+        recv_handler_unregister(BAT_IV_OGM);
+out:
+        return ret;
 }
diff --git a/net/batman-adv/bat_sysfs.c b/net/batman-adv/bat_sysfs.c
index c25492f7d665..5bc7b66d32dc 100644
--- a/net/batman-adv/bat_sysfs.c
+++ b/net/batman-adv/bat_sysfs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2010-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner
  *
@@ -63,7 +63,7 @@ struct bat_attribute bat_attr_##_name = {	\
         .store  = _store,                       \
 };
 
-#define BAT_ATTR_STORE_BOOL(_name, _post_func)                          \
+#define BAT_ATTR_SIF_STORE_BOOL(_name, _post_func)                      \
 ssize_t store_##_name(struct kobject *kobj, struct attribute *attr,     \
                       char *buff, size_t count)                         \
 {                                                                       \
@@ -73,9 +73,9 @@ ssize_t store_##_name(struct kobject *kobj, struct attribute *attr,	\
                                  &bat_priv->_name, net_dev);            \
 }
 
-#define BAT_ATTR_SHOW_BOOL(_name)                                       \
-ssize_t show_##_name(struct kobject *kobj, struct attribute *attr,      \
-                            char *buff)                                 \
+#define BAT_ATTR_SIF_SHOW_BOOL(_name)                                   \
+ssize_t show_##_name(struct kobject *kobj,                              \
+                     struct attribute *attr, char *buff)                \
 {                                                                       \
         struct bat_priv *bat_priv = kobj_to_batpriv(kobj);              \
         return sprintf(buff, "%s\n",                                    \
@@ -83,16 +83,17 @@ ssize_t show_##_name(struct kobject *kobj, struct attribute *attr,	\
                        "disabled" : "enabled");                         \
 }                                                                       \
 
-/* Use this, if you are going to turn a [name] in bat_priv on or off */
-#define BAT_ATTR_BOOL(_name, _mode, _post_func)                         \
-        static BAT_ATTR_STORE_BOOL(_name, _post_func)                   \
-        static BAT_ATTR_SHOW_BOOL(_name)                                \
+/* Use this, if you are going to turn a [name] in the soft-interface
+ * (bat_priv) on or off */
+#define BAT_ATTR_SIF_BOOL(_name, _mode, _post_func)                     \
+        static BAT_ATTR_SIF_STORE_BOOL(_name, _post_func)               \
+        static BAT_ATTR_SIF_SHOW_BOOL(_name)                            \
         static BAT_ATTR(_name, _mode, show_##_name, store_##_name)
 
 
-#define BAT_ATTR_STORE_UINT(_name, _min, _max, _post_func)              \
+#define BAT_ATTR_SIF_STORE_UINT(_name, _min, _max, _post_func)          \
 ssize_t store_##_name(struct kobject *kobj, struct attribute *attr,     \
-                             char *buff, size_t count)                  \
+                      char *buff, size_t count)                         \
 {                                                                       \
         struct net_device *net_dev = kobj_to_netdev(kobj);              \
         struct bat_priv *bat_priv = netdev_priv(net_dev);               \
@@ -100,19 +101,62 @@ ssize_t store_##_name(struct kobject *kobj, struct attribute *attr,	\
                                  attr, &bat_priv->_name, net_dev);      \
 }
 
-#define BAT_ATTR_SHOW_UINT(_name)                                       \
-ssize_t show_##_name(struct kobject *kobj, struct attribute *attr,      \
-                            char *buff)                                 \
+#define BAT_ATTR_SIF_SHOW_UINT(_name)                                   \
+ssize_t show_##_name(struct kobject *kobj,                              \
+                     struct attribute *attr, char *buff)                \
 {                                                                       \
         struct bat_priv *bat_priv = kobj_to_batpriv(kobj);              \
         return sprintf(buff, "%i\n", atomic_read(&bat_priv->_name));    \
 }                                                                       \
 
-/* Use this, if you are going to set [name] in bat_priv to unsigned integer
- * values only */
-#define BAT_ATTR_UINT(_name, _mode, _min, _max, _post_func)             \
-        static BAT_ATTR_STORE_UINT(_name, _min, _max, _post_func)       \
-        static BAT_ATTR_SHOW_UINT(_name)                                \
+/* Use this, if you are going to set [name] in the soft-interface
+ * (bat_priv) to an unsigned integer value */
+#define BAT_ATTR_SIF_UINT(_name, _mode, _min, _max, _post_func)         \
+        static BAT_ATTR_SIF_STORE_UINT(_name, _min, _max, _post_func)   \
+        static BAT_ATTR_SIF_SHOW_UINT(_name)                            \
+        static BAT_ATTR(_name, _mode, show_##_name, store_##_name)
+
+
+#define BAT_ATTR_HIF_STORE_UINT(_name, _min, _max, _post_func)          \
+ssize_t store_##_name(struct kobject *kobj, struct attribute *attr,     \
+                      char *buff, size_t count)                         \
+{                                                                       \
+        struct net_device *net_dev = kobj_to_netdev(kobj);              \
+        struct hard_iface *hard_iface = hardif_get_by_netdev(net_dev);  \
+        ssize_t length;                                                 \
+                                                                        \
+        if (!hard_iface)                                                \
+                return 0;                                               \
+                                                                        \
+        length = __store_uint_attr(buff, count, _min, _max, _post_func, \
+                                   attr, &hard_iface->_name, net_dev);  \
+                                                                        \
+        hardif_free_ref(hard_iface);                                    \
+        return length;                                                  \
+}
+
+#define BAT_ATTR_HIF_SHOW_UINT(_name)                                   \
+ssize_t show_##_name(struct kobject *kobj,                              \
+                     struct attribute *attr, char *buff)                \
+{                                                                       \
+        struct net_device *net_dev = kobj_to_netdev(kobj);              \
+        struct hard_iface *hard_iface = hardif_get_by_netdev(net_dev);  \
+        ssize_t length;                                                 \
+                                                                        \
+        if (!hard_iface)                                                \
+                return 0;                                               \
+                                                                        \
+        length = sprintf(buff, "%i\n", atomic_read(&hard_iface->_name));\
+                                                                        \
+        hardif_free_ref(hard_iface);                                    \
+        return length;                                                  \
+}
+
+/* Use this, if you are going to set [name] in hard_iface to an
+ * unsigned integer value*/
+#define BAT_ATTR_HIF_UINT(_name, _mode, _min, _max, _post_func)         \
+        static BAT_ATTR_HIF_STORE_UINT(_name, _min, _max, _post_func)   \
+        static BAT_ATTR_HIF_SHOW_UINT(_name)                            \
         static BAT_ATTR(_name, _mode, show_##_name, store_##_name)
 
 
@@ -149,7 +193,7 @@ static int store_bool_attr(char *buff, size_t count,
                  atomic_read(attr) == 1 ? "enabled" : "disabled",
                  enabled == 1 ? "enabled" : "disabled");
 
-        atomic_set(attr, (unsigned)enabled);
+        atomic_set(attr, (unsigned int)enabled);
         return count;
 }
 
@@ -255,8 +299,8 @@ static ssize_t store_vis_mode(struct kobject *kobj, struct attribute *attr,
                         buff[count - 1] = '\0';
 
                 bat_info(net_dev,
-                         "Invalid parameter for 'vis mode' setting received: "
-                         "%s\n", buff);
+                         "Invalid parameter for 'vis mode' setting received: %s\n",
+                         buff);
                 return -EINVAL;
         }
 
@@ -268,10 +312,17 @@ static ssize_t store_vis_mode(struct kobject *kobj, struct attribute *attr,
                  "client" : "server", vis_mode_tmp == VIS_TYPE_CLIENT_UPDATE ?
                  "client" : "server");
 
-        atomic_set(&bat_priv->vis_mode, (unsigned)vis_mode_tmp);
+        atomic_set(&bat_priv->vis_mode, (unsigned int)vis_mode_tmp);
         return count;
 }
 
+static ssize_t show_bat_algo(struct kobject *kobj, struct attribute *attr,
+                            char *buff)
+{
+        struct bat_priv *bat_priv = kobj_to_batpriv(kobj);
+        return sprintf(buff, "%s\n", bat_priv->bat_algo_ops->name);
+}
+
 static void post_gw_deselect(struct net_device *net_dev)
 {
         struct bat_priv *bat_priv = netdev_priv(net_dev);
@@ -314,17 +365,17 @@ static ssize_t store_gw_mode(struct kobject *kobj, struct attribute *attr,
                 gw_mode_tmp = GW_MODE_OFF;
 
         if (strncmp(buff, GW_MODE_CLIENT_NAME,
-                   strlen(GW_MODE_CLIENT_NAME)) == 0)
+                    strlen(GW_MODE_CLIENT_NAME)) == 0)
                 gw_mode_tmp = GW_MODE_CLIENT;
 
         if (strncmp(buff, GW_MODE_SERVER_NAME,
-                   strlen(GW_MODE_SERVER_NAME)) == 0)
+                    strlen(GW_MODE_SERVER_NAME)) == 0)
                 gw_mode_tmp = GW_MODE_SERVER;
 
         if (gw_mode_tmp < 0) {
                 bat_info(net_dev,
-                         "Invalid parameter for 'gw mode' setting received: "
-                         "%s\n", buff);
+                         "Invalid parameter for 'gw mode' setting received: %s\n",
+                         buff);
                 return -EINVAL;
         }
 
@@ -347,7 +398,7 @@ static ssize_t store_gw_mode(struct kobject *kobj, struct attribute *attr,
                  curr_gw_mode_str, buff);
 
         gw_deselect(bat_priv);
-        atomic_set(&bat_priv->gw_mode, (unsigned)gw_mode_tmp);
+        atomic_set(&bat_priv->gw_mode, (unsigned int)gw_mode_tmp);
         return count;
 }
 
@@ -377,28 +428,36 @@ static ssize_t store_gw_bwidth(struct kobject *kobj, struct attribute *attr,
         return gw_bandwidth_set(net_dev, buff, count);
 }
 
-BAT_ATTR_BOOL(aggregated_ogms, S_IRUGO | S_IWUSR, NULL);
-BAT_ATTR_BOOL(bonding, S_IRUGO | S_IWUSR, NULL);
-BAT_ATTR_BOOL(fragmentation, S_IRUGO | S_IWUSR, update_min_mtu);
-BAT_ATTR_BOOL(ap_isolation, S_IRUGO | S_IWUSR, NULL);
+BAT_ATTR_SIF_BOOL(aggregated_ogms, S_IRUGO | S_IWUSR, NULL);
+BAT_ATTR_SIF_BOOL(bonding, S_IRUGO | S_IWUSR, NULL);
+#ifdef CONFIG_BATMAN_ADV_BLA
+BAT_ATTR_SIF_BOOL(bridge_loop_avoidance, S_IRUGO | S_IWUSR, NULL);
+#endif
+BAT_ATTR_SIF_BOOL(fragmentation, S_IRUGO | S_IWUSR, update_min_mtu);
+BAT_ATTR_SIF_BOOL(ap_isolation, S_IRUGO | S_IWUSR, NULL);
 static BAT_ATTR(vis_mode, S_IRUGO | S_IWUSR, show_vis_mode, store_vis_mode);
+static BAT_ATTR(routing_algo, S_IRUGO, show_bat_algo, NULL);
 static BAT_ATTR(gw_mode, S_IRUGO | S_IWUSR, show_gw_mode, store_gw_mode);
-BAT_ATTR_UINT(orig_interval, S_IRUGO | S_IWUSR, 2 * JITTER, INT_MAX, NULL);
-BAT_ATTR_UINT(hop_penalty, S_IRUGO | S_IWUSR, 0, TQ_MAX_VALUE, NULL);
-BAT_ATTR_UINT(gw_sel_class, S_IRUGO | S_IWUSR, 1, TQ_MAX_VALUE,
-              post_gw_deselect);
+BAT_ATTR_SIF_UINT(orig_interval, S_IRUGO | S_IWUSR, 2 * JITTER, INT_MAX, NULL);
+BAT_ATTR_SIF_UINT(hop_penalty, S_IRUGO | S_IWUSR, 0, TQ_MAX_VALUE, NULL);
+BAT_ATTR_SIF_UINT(gw_sel_class, S_IRUGO | S_IWUSR, 1, TQ_MAX_VALUE,
+                  post_gw_deselect);
 static BAT_ATTR(gw_bandwidth, S_IRUGO | S_IWUSR, show_gw_bwidth,
                 store_gw_bwidth);
 #ifdef CONFIG_BATMAN_ADV_DEBUG
-BAT_ATTR_UINT(log_level, S_IRUGO | S_IWUSR, 0, 7, NULL);
+BAT_ATTR_SIF_UINT(log_level, S_IRUGO | S_IWUSR, 0, 15, NULL);
 #endif
 
 static struct bat_attribute *mesh_attrs[] = {
         &bat_attr_aggregated_ogms,
         &bat_attr_bonding,
+#ifdef CONFIG_BATMAN_ADV_BLA
+        &bat_attr_bridge_loop_avoidance,
+#endif
         &bat_attr_fragmentation,
         &bat_attr_ap_isolation,
         &bat_attr_vis_mode,
+        &bat_attr_routing_algo,
         &bat_attr_gw_mode,
         &bat_attr_orig_interval,
         &bat_attr_hop_penalty,
@@ -493,8 +552,8 @@ static ssize_t store_mesh_iface(struct kobject *kobj, struct attribute *attr,
                 buff[count - 1] = '\0';
 
         if (strlen(buff) >= IFNAMSIZ) {
-                pr_err("Invalid parameter for 'mesh_iface' setting received: "
-                       "interface name too long '%s'\n", buff);
+                pr_err("Invalid parameter for 'mesh_iface' setting received: interface name too long '%s'\n",
+                       buff);
                 hardif_free_ref(hard_iface);
                 return -EINVAL;
         }
@@ -668,8 +727,8 @@ out:
                 hardif_free_ref(primary_if);
 
         if (ret)
-                bat_dbg(DBG_BATMAN, bat_priv, "Impossible to send "
-                        "uevent for (%s,%s,%s) event (err: %d)\n",
+                bat_dbg(DBG_BATMAN, bat_priv,
+                        "Impossible to send uevent for (%s,%s,%s) event (err: %d)\n",
                         uev_type_str[type], uev_action_str[action],
                         (action == UEV_DEL ? "NULL" : data), ret);
         return ret;
diff --git a/net/batman-adv/bat_sysfs.h b/net/batman-adv/bat_sysfs.h
index a3f75a723c56..fece77ae586e 100644
--- a/net/batman-adv/bat_sysfs.h
+++ b/net/batman-adv/bat_sysfs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2010-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner
  *
diff --git a/net/batman-adv/bitarray.c b/net/batman-adv/bitarray.c
index 9bc63b209b3f..07ae6e1b8aca 100644
--- a/net/batman-adv/bitarray.c
+++ b/net/batman-adv/bitarray.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2006-2012 B.A.T.M.A.N. contributors:
  *
  * Simon Wunderlich, Marek Lindner
  *
@@ -24,100 +24,13 @@
 
 #include <linux/bitops.h>
 
-/* returns true if the corresponding bit in the given seq_bits indicates true
- * and curr_seqno is within range of last_seqno */
-int get_bit_status(const unsigned long *seq_bits, uint32_t last_seqno,
-                   uint32_t curr_seqno)
-{
-        int32_t diff, word_offset, word_num;
-
-        diff = last_seqno - curr_seqno;
-        if (diff < 0 || diff >= TQ_LOCAL_WINDOW_SIZE) {
-                return 0;
-        } else {
-                /* which word */
-                word_num = (last_seqno - curr_seqno) / WORD_BIT_SIZE;
-                /* which position in the selected word */
-                word_offset = (last_seqno - curr_seqno) % WORD_BIT_SIZE;
-
-                if (test_bit(word_offset, &seq_bits[word_num]))
-                        return 1;
-                else
-                        return 0;
-        }
-}
-
-/* turn corresponding bit on, so we can remember that we got the packet */
-void bit_mark(unsigned long *seq_bits, int32_t n)
-{
-        int32_t word_offset, word_num;
-
-        /* if too old, just drop it */
-        if (n < 0 || n >= TQ_LOCAL_WINDOW_SIZE)
-                return;
-
-        /* which word */
-        word_num = n / WORD_BIT_SIZE;
-        /* which position in the selected word */
-        word_offset = n % WORD_BIT_SIZE;
-
-        set_bit(word_offset, &seq_bits[word_num]); /* turn the position on */
-}
-
 /* shift the packet array by n places. */
-static void bit_shift(unsigned long *seq_bits, int32_t n)
+static void bat_bitmap_shift_left(unsigned long *seq_bits, int32_t n)
 {
-        int32_t word_offset, word_num;
-        int32_t i;
-
         if (n <= 0 || n >= TQ_LOCAL_WINDOW_SIZE)
                 return;
 
-        word_offset = n % WORD_BIT_SIZE;/* shift how much inside each word */
-        word_num = n / WORD_BIT_SIZE;   /* shift over how much (full) words */
-
-        for (i = NUM_WORDS - 1; i > word_num; i--) {
-                /* going from old to new, so we don't overwrite the data we copy
-                 * from.
-                 *
-                 * left is high, right is low: FEDC BA98 7654 3210
-                 *                                        ^^ ^^
-                 *                             vvvv
-                 * ^^^^ = from, vvvvv =to, we'd have word_num==1 and
-                 * word_offset==WORD_BIT_SIZE/2 ????? in this example.
-                 * (=24 bits)
-                 *
-                 * our desired output would be: 9876 5432 1000 0000
-                 * */
-
-                seq_bits[i] =
-                        (seq_bits[i - word_num] << word_offset) +
-                        /* take the lower port from the left half, shift it left
-                         * to its final position */
-                        (seq_bits[i - word_num - 1] >>
-                         (WORD_BIT_SIZE-word_offset));
-                /* and the upper part of the right half and shift it left to
-                 * its position */
-                /* for our example that would be: word[0] = 9800 + 0076 =
-                 * 9876 */
-        }
-        /* now for our last word, i==word_num, we only have its "left" half.
-         * that's the 1000 word in our example.*/
-
-        seq_bits[i] = (seq_bits[i - word_num] << word_offset);
-
-        /* pad the rest with 0, if there is anything */
-        i--;
-
-        for (; i >= 0; i--)
-                seq_bits[i] = 0;
-}
-
-static void bit_reset_window(unsigned long *seq_bits)
-{
-        int i;
-        for (i = 0; i < NUM_WORDS; i++)
-                seq_bits[i] = 0;
+        bitmap_shift_left(seq_bits, seq_bits, n, TQ_LOCAL_WINDOW_SIZE);
 }
 
 
@@ -137,7 +50,7 @@ int bit_get_packet(void *priv, unsigned long *seq_bits,
 
         if ((seq_num_diff <= 0) && (seq_num_diff > -TQ_LOCAL_WINDOW_SIZE)) {
                 if (set_mark)
-                        bit_mark(seq_bits, -seq_num_diff);
+                        bat_set_bit(seq_bits, -seq_num_diff);
                 return 0;
         }
 
@@ -145,23 +58,23 @@ int bit_get_packet(void *priv, unsigned long *seq_bits,
          * set the mark if required */
 
         if ((seq_num_diff > 0) && (seq_num_diff < TQ_LOCAL_WINDOW_SIZE)) {
-                bit_shift(seq_bits, seq_num_diff);
+                bat_bitmap_shift_left(seq_bits, seq_num_diff);
 
                 if (set_mark)
-                        bit_mark(seq_bits, 0);
+                        bat_set_bit(seq_bits, 0);
                 return 1;
         }
 
         /* sequence number is much newer, probably missed a lot of packets */
 
-        if ((seq_num_diff >= TQ_LOCAL_WINDOW_SIZE)
-                && (seq_num_diff < EXPECTED_SEQNO_RANGE)) {
+        if ((seq_num_diff >= TQ_LOCAL_WINDOW_SIZE) &&
+            (seq_num_diff < EXPECTED_SEQNO_RANGE)) {
                 bat_dbg(DBG_BATMAN, bat_priv,
                         "We missed a lot of packets (%i) !\n",
                         seq_num_diff - 1);
-                bit_reset_window(seq_bits);
+                bitmap_zero(seq_bits, TQ_LOCAL_WINDOW_SIZE);
                 if (set_mark)
-                        bit_mark(seq_bits, 0);
+                        bat_set_bit(seq_bits, 0);
                 return 1;
         }
 
@@ -170,15 +83,15 @@ int bit_get_packet(void *priv, unsigned long *seq_bits,
          * packet should be dropped without calling this function if the
          * seqno window is protected. */
 
-        if ((seq_num_diff <= -TQ_LOCAL_WINDOW_SIZE)
-                || (seq_num_diff >= EXPECTED_SEQNO_RANGE)) {
+        if ((seq_num_diff <= -TQ_LOCAL_WINDOW_SIZE) ||
+            (seq_num_diff >= EXPECTED_SEQNO_RANGE)) {
 
                 bat_dbg(DBG_BATMAN, bat_priv,
                         "Other host probably restarted!\n");
 
-                bit_reset_window(seq_bits);
+                bitmap_zero(seq_bits, TQ_LOCAL_WINDOW_SIZE);
                 if (set_mark)
-                        bit_mark(seq_bits, 0);
+                        bat_set_bit(seq_bits, 0);
 
                 return 1;
         }
@@ -186,16 +99,3 @@ int bit_get_packet(void *priv, unsigned long *seq_bits,
         /* never reached */
         return 0;
 }
-
-/* count the hamming weight, how many good packets did we receive? just count
- * the 1's.
- */
-int bit_packet_count(const unsigned long *seq_bits)
-{
-        int i, hamming = 0;
-
-        for (i = 0; i < NUM_WORDS; i++)
-                hamming += hweight_long(seq_bits[i]);
-
-        return hamming;
-}
diff --git a/net/batman-adv/bitarray.h b/net/batman-adv/bitarray.h
index 9c04422aeb07..1835c15cda41 100644
--- a/net/batman-adv/bitarray.h
+++ b/net/batman-adv/bitarray.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2006-2012 B.A.T.M.A.N. contributors:
  *
  * Simon Wunderlich, Marek Lindner
  *
@@ -22,23 +22,33 @@
 #ifndef _NET_BATMAN_ADV_BITARRAY_H_
 #define _NET_BATMAN_ADV_BITARRAY_H_
 
-#define WORD_BIT_SIZE (sizeof(unsigned long) * 8)
-
 /* returns true if the corresponding bit in the given seq_bits indicates true
  * and curr_seqno is within range of last_seqno */
-int get_bit_status(const unsigned long *seq_bits, uint32_t last_seqno,
-                   uint32_t curr_seqno);
+static inline int bat_test_bit(const unsigned long *seq_bits,
+                               uint32_t last_seqno, uint32_t curr_seqno)
+{
+        int32_t diff;
+
+        diff = last_seqno - curr_seqno;
+        if (diff < 0 || diff >= TQ_LOCAL_WINDOW_SIZE)
+                return 0;
+        else
+                return  test_bit(diff, seq_bits);
+}
 
 /* turn corresponding bit on, so we can remember that we got the packet */
-void bit_mark(unsigned long *seq_bits, int32_t n);
+static inline void bat_set_bit(unsigned long *seq_bits, int32_t n)
+{
+        /* if too old, just drop it */
+        if (n < 0 || n >= TQ_LOCAL_WINDOW_SIZE)
+                return;
 
+        set_bit(n, seq_bits); /* turn the position on */
+}
 
 /* receive and process one packet, returns 1 if received seq_num is considered
  * new, 0 if old  */
 int bit_get_packet(void *priv, unsigned long *seq_bits,
                    int32_t seq_num_diff, int set_mark);
 
-/* count the hamming weight, how many good packets did we receive? */
-int bit_packet_count(const unsigned long *seq_bits);
-
 #endif /* _NET_BATMAN_ADV_BITARRAY_H_ */
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
new file mode 100644
index 000000000000..8bf97515a77d
--- /dev/null
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -0,0 +1,1580 @@
+/*
+ * Copyright (C) 2011-2012 B.A.T.M.A.N. contributors:
+ *
+ * Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "main.h"
+#include "hash.h"
+#include "hard-interface.h"
+#include "originator.h"
+#include "bridge_loop_avoidance.h"
+#include "translation-table.h"
+#include "send.h"
+
+#include <linux/etherdevice.h>
+#include <linux/crc16.h>
+#include <linux/if_arp.h>
+#include <net/arp.h>
+#include <linux/if_vlan.h>
+
+static const uint8_t announce_mac[4] = {0x43, 0x05, 0x43, 0x05};
+
+static void bla_periodic_work(struct work_struct *work);
+static void bla_send_announce(struct bat_priv *bat_priv,
+                              struct backbone_gw *backbone_gw);
+
+/* return the index of the claim */
+static inline uint32_t choose_claim(const void *data, uint32_t size)
+{
+        const unsigned char *key = data;
+        uint32_t hash = 0;
+        size_t i;
+
+        for (i = 0; i < ETH_ALEN + sizeof(short); i++) {
+                hash += key[i];
+                hash += (hash << 10);
+                hash ^= (hash >> 6);
+        }
+
+        hash += (hash << 3);
+        hash ^= (hash >> 11);
+        hash += (hash << 15);
+
+        return hash % size;
+}
+
+/* return the index of the backbone gateway */
+static inline uint32_t choose_backbone_gw(const void *data, uint32_t size)
+{
+        const unsigned char *key = data;
+        uint32_t hash = 0;
+        size_t i;
+
+        for (i = 0; i < ETH_ALEN + sizeof(short); i++) {
+                hash += key[i];
+                hash += (hash << 10);
+                hash ^= (hash >> 6);
+        }
+
+        hash += (hash << 3);
+        hash ^= (hash >> 11);
+        hash += (hash << 15);
+
+        return hash % size;
+}
+
+
+/* compares address and vid of two backbone gws */
+static int compare_backbone_gw(const struct hlist_node *node, const void *data2)
+{
+        const void *data1 = container_of(node, struct backbone_gw,
+                                         hash_entry);
+
+        return (memcmp(data1, data2, ETH_ALEN + sizeof(short)) == 0 ? 1 : 0);
+}
+
+/* compares address and vid of two claims */
+static int compare_claim(const struct hlist_node *node, const void *data2)
+{
+        const void *data1 = container_of(node, struct claim,
+                                         hash_entry);
+
+        return (memcmp(data1, data2, ETH_ALEN + sizeof(short)) == 0 ? 1 : 0);
+}
+
+/* free a backbone gw */
+static void backbone_gw_free_ref(struct backbone_gw *backbone_gw)
+{
+        if (atomic_dec_and_test(&backbone_gw->refcount))
+                kfree_rcu(backbone_gw, rcu);
+}
+
+/* finally deinitialize the claim */
+static void claim_free_rcu(struct rcu_head *rcu)
+{
+        struct claim *claim;
+
+        claim = container_of(rcu, struct claim, rcu);
+
+        backbone_gw_free_ref(claim->backbone_gw);
+        kfree(claim);
+}
+
+/* free a claim, call claim_free_rcu if its the last reference */
+static void claim_free_ref(struct claim *claim)
+{
+        if (atomic_dec_and_test(&claim->refcount))
+                call_rcu(&claim->rcu, claim_free_rcu);
+}
+
+/**
+ * @bat_priv: the bat priv with all the soft interface information
+ * @data: search data (may be local/static data)
+ *
+ * looks for a claim in the hash, and returns it if found
+ * or NULL otherwise.
+ */
+static struct claim *claim_hash_find(struct bat_priv *bat_priv,
+                                     struct claim *data)
+{
+        struct hashtable_t *hash = bat_priv->claim_hash;
+        struct hlist_head *head;
+        struct hlist_node *node;
+        struct claim *claim;
+        struct claim *claim_tmp = NULL;
+        int index;
+
+        if (!hash)
+                return NULL;
+
+        index = choose_claim(data, hash->size);
+        head = &hash->table[index];
+
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(claim, node, head, hash_entry) {
+                if (!compare_claim(&claim->hash_entry, data))
+                        continue;
+
+                if (!atomic_inc_not_zero(&claim->refcount))
+                        continue;
+
+                claim_tmp = claim;
+                break;
+        }
+        rcu_read_unlock();
+
+        return claim_tmp;
+}
+
+/**
+ * @bat_priv: the bat priv with all the soft interface information
+ * @addr: the address of the originator
+ * @vid: the VLAN ID
+ *
+ * looks for a claim in the hash, and returns it if found
+ * or NULL otherwise.
+ */
+static struct backbone_gw *backbone_hash_find(struct bat_priv *bat_priv,
+                                              uint8_t *addr, short vid)
+{
+        struct hashtable_t *hash = bat_priv->backbone_hash;
+        struct hlist_head *head;
+        struct hlist_node *node;
+        struct backbone_gw search_entry, *backbone_gw;
+        struct backbone_gw *backbone_gw_tmp = NULL;
+        int index;
+
+        if (!hash)
+                return NULL;
+
+        memcpy(search_entry.orig, addr, ETH_ALEN);
+        search_entry.vid = vid;
+
+        index = choose_backbone_gw(&search_entry, hash->size);
+        head = &hash->table[index];
+
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(backbone_gw, node, head, hash_entry) {
+                if (!compare_backbone_gw(&backbone_gw->hash_entry,
+                                         &search_entry))
+                        continue;
+
+                if (!atomic_inc_not_zero(&backbone_gw->refcount))
+                        continue;
+
+                backbone_gw_tmp = backbone_gw;
+                break;
+        }
+        rcu_read_unlock();
+
+        return backbone_gw_tmp;
+}
+
+/* delete all claims for a backbone */
+static void bla_del_backbone_claims(struct backbone_gw *backbone_gw)
+{
+        struct hashtable_t *hash;
+        struct hlist_node *node, *node_tmp;
+        struct hlist_head *head;
+        struct claim *claim;
+        int i;
+        spinlock_t *list_lock;  /* protects write access to the hash lists */
+
+        hash = backbone_gw->bat_priv->claim_hash;
+        if (!hash)
+                return;
+
+        for (i = 0; i < hash->size; i++) {
+                head = &hash->table[i];
+                list_lock = &hash->list_locks[i];
+
+                spin_lock_bh(list_lock);
+                hlist_for_each_entry_safe(claim, node, node_tmp,
+                                          head, hash_entry) {
+
+                        if (claim->backbone_gw != backbone_gw)
+                                continue;
+
+                        claim_free_ref(claim);
+                        hlist_del_rcu(node);
+                }
+                spin_unlock_bh(list_lock);
+        }
+
+        /* all claims gone, intialize CRC */
+        backbone_gw->crc = BLA_CRC_INIT;
+}
+
+/**
+ * @bat_priv: the bat priv with all the soft interface information
+ * @orig: the mac address to be announced within the claim
+ * @vid: the VLAN ID
+ * @claimtype: the type of the claim (CLAIM, UNCLAIM, ANNOUNCE, ...)
+ *
+ * sends a claim frame according to the provided info.
+ */
+static void bla_send_claim(struct bat_priv *bat_priv, uint8_t *mac,
+                           short vid, int claimtype)
+{
+        struct sk_buff *skb;
+        struct ethhdr *ethhdr;
+        struct hard_iface *primary_if;
+        struct net_device *soft_iface;
+        uint8_t *hw_src;
+        struct bla_claim_dst local_claim_dest;
+        uint32_t zeroip = 0;
+
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if)
+                return;
+
+        memcpy(&local_claim_dest, &bat_priv->claim_dest,
+               sizeof(local_claim_dest));
+        local_claim_dest.type = claimtype;
+
+        soft_iface = primary_if->soft_iface;
+
+        skb = arp_create(ARPOP_REPLY, ETH_P_ARP,
+                         /* IP DST: 0.0.0.0 */
+                         zeroip,
+                         primary_if->soft_iface,
+                         /* IP SRC: 0.0.0.0 */
+                         zeroip,
+                         /* Ethernet DST: Broadcast */
+                         NULL,
+                         /* Ethernet SRC/HW SRC:  originator mac */
+                         primary_if->net_dev->dev_addr,
+                         /* HW DST: FF:43:05:XX:00:00
+                          * with XX   = claim type
+                          * and YY:YY = group id
+                          */
+                         (uint8_t *)&local_claim_dest);
+
+        if (!skb)
+                goto out;
+
+        ethhdr = (struct ethhdr *)skb->data;
+        hw_src = (uint8_t *)ethhdr + ETH_HLEN + sizeof(struct arphdr);
+
+        /* now we pretend that the client would have sent this ... */
+        switch (claimtype) {
+        case CLAIM_TYPE_ADD:
+                /* normal claim frame
+                 * set Ethernet SRC to the clients mac
+                 */
+                memcpy(ethhdr->h_source, mac, ETH_ALEN);
+                bat_dbg(DBG_BLA, bat_priv,
+                        "bla_send_claim(): CLAIM %pM on vid %d\n", mac, vid);
+                break;
+        case CLAIM_TYPE_DEL:
+                /* unclaim frame
+                 * set HW SRC to the clients mac
+                 */
+                memcpy(hw_src, mac, ETH_ALEN);
+                bat_dbg(DBG_BLA, bat_priv,
+                        "bla_send_claim(): UNCLAIM %pM on vid %d\n", mac, vid);
+                break;
+        case CLAIM_TYPE_ANNOUNCE:
+                /* announcement frame
+                 * set HW SRC to the special mac containg the crc
+                 */
+                memcpy(hw_src, mac, ETH_ALEN);
+                bat_dbg(DBG_BLA, bat_priv,
+                        "bla_send_claim(): ANNOUNCE of %pM on vid %d\n",
+                        ethhdr->h_source, vid);
+                break;
+        case CLAIM_TYPE_REQUEST:
+                /* request frame
+                 * set HW SRC to the special mac containg the crc
+                 */
+                memcpy(hw_src, mac, ETH_ALEN);
+                memcpy(ethhdr->h_dest, mac, ETH_ALEN);
+                bat_dbg(DBG_BLA, bat_priv,
+                        "bla_send_claim(): REQUEST of %pM to %pMon vid %d\n",
+                        ethhdr->h_source, ethhdr->h_dest, vid);
+                break;
+
+        }
+
+        if (vid != -1)
+                skb = vlan_insert_tag(skb, vid);
+
+        skb_reset_mac_header(skb);
+        skb->protocol = eth_type_trans(skb, soft_iface);
+        bat_priv->stats.rx_packets++;
+        bat_priv->stats.rx_bytes += skb->len + ETH_HLEN;
+        soft_iface->last_rx = jiffies;
+
+        netif_rx(skb);
+out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
+}
+
+/**
+ * @bat_priv: the bat priv with all the soft interface information
+ * @orig: the mac address of the originator
+ * @vid: the VLAN ID
+ *
+ * searches for the backbone gw or creates a new one if it could not
+ * be found.
+ */
+static struct backbone_gw *bla_get_backbone_gw(struct bat_priv *bat_priv,
+                                               uint8_t *orig, short vid)
+{
+        struct backbone_gw *entry;
+        struct orig_node *orig_node;
+        int hash_added;
+
+        entry = backbone_hash_find(bat_priv, orig, vid);
+
+        if (entry)
+                return entry;
+
+        bat_dbg(DBG_BLA, bat_priv,
+                "bla_get_backbone_gw(): not found (%pM, %d), creating new entry\n",
+                orig, vid);
+
+        entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
+        if (!entry)
+                return NULL;
+
+        entry->vid = vid;
+        entry->lasttime = jiffies;
+        entry->crc = BLA_CRC_INIT;
+        entry->bat_priv = bat_priv;
+        atomic_set(&entry->request_sent, 0);
+        memcpy(entry->orig, orig, ETH_ALEN);
+
+        /* one for the hash, one for returning */
+        atomic_set(&entry->refcount, 2);
+
+        hash_added = hash_add(bat_priv->backbone_hash, compare_backbone_gw,
+                              choose_backbone_gw, entry, &entry->hash_entry);
+
+        if (unlikely(hash_added != 0)) {
+                /* hash failed, free the structure */
+                kfree(entry);
+                return NULL;
+        }
+
+        /* this is a gateway now, remove any tt entries */
+        orig_node = orig_hash_find(bat_priv, orig);
+        if (orig_node) {
+                tt_global_del_orig(bat_priv, orig_node,
+                                   "became a backbone gateway");
+                orig_node_free_ref(orig_node);
+        }
+        return entry;
+}
+
+/* update or add the own backbone gw to make sure we announce
+ * where we receive other backbone gws
+ */
+static void bla_update_own_backbone_gw(struct bat_priv *bat_priv,
+                                       struct hard_iface *primary_if,
+                                       short vid)
+{
+        struct backbone_gw *backbone_gw;
+
+        backbone_gw = bla_get_backbone_gw(bat_priv,
+                                          primary_if->net_dev->dev_addr, vid);
+        if (unlikely(!backbone_gw))
+                return;
+
+        backbone_gw->lasttime = jiffies;
+        backbone_gw_free_ref(backbone_gw);
+}
+
+/**
+ * @bat_priv: the bat priv with all the soft interface information
+ * @vid: the vid where the request came on
+ *
+ * Repeat all of our own claims, and finally send an ANNOUNCE frame
+ * to allow the requester another check if the CRC is correct now.
+ */
+static void bla_answer_request(struct bat_priv *bat_priv,
+                               struct hard_iface *primary_if, short vid)
+{
+        struct hlist_node *node;
+        struct hlist_head *head;
+        struct hashtable_t *hash;
+        struct claim *claim;
+        struct backbone_gw *backbone_gw;
+        int i;
+
+        bat_dbg(DBG_BLA, bat_priv,
+                "bla_answer_request(): received a claim request, send all of our own claims again\n");
+
+        backbone_gw = backbone_hash_find(bat_priv,
+                                         primary_if->net_dev->dev_addr, vid);
+        if (!backbone_gw)
+                return;
+
+        hash = bat_priv->claim_hash;
+        for (i = 0; i < hash->size; i++) {
+                head = &hash->table[i];
+
+                rcu_read_lock();
+                hlist_for_each_entry_rcu(claim, node, head, hash_entry) {
+                        /* only own claims are interesting */
+                        if (claim->backbone_gw != backbone_gw)
+                                continue;
+
+                        bla_send_claim(bat_priv, claim->addr, claim->vid,
+                                       CLAIM_TYPE_ADD);
+                }
+                rcu_read_unlock();
+        }
+
+        /* finally, send an announcement frame */
+        bla_send_announce(bat_priv, backbone_gw);
+        backbone_gw_free_ref(backbone_gw);
+}
+
+/**
+ * @backbone_gw: the backbone gateway from whom we are out of sync
+ *
+ * When the crc is wrong, ask the backbone gateway for a full table update.
+ * After the request, it will repeat all of his own claims and finally
+ * send an announcement claim with which we can check again.
+ */
+static void bla_send_request(struct backbone_gw *backbone_gw)
+{
+        /* first, remove all old entries */
+        bla_del_backbone_claims(backbone_gw);
+
+        bat_dbg(DBG_BLA, backbone_gw->bat_priv,
+                "Sending REQUEST to %pM\n",
+                backbone_gw->orig);
+
+        /* send request */
+        bla_send_claim(backbone_gw->bat_priv, backbone_gw->orig,
+                       backbone_gw->vid, CLAIM_TYPE_REQUEST);
+
+        /* no local broadcasts should be sent or received, for now. */
+        if (!atomic_read(&backbone_gw->request_sent)) {
+                atomic_inc(&backbone_gw->bat_priv->bla_num_requests);
+                atomic_set(&backbone_gw->request_sent, 1);
+        }
+}
+
+/**
+ * @bat_priv: the bat priv with all the soft interface information
+ * @backbone_gw: our backbone gateway which should be announced
+ *
+ * This function sends an announcement. It is called from multiple
+ * places.
+ */
+static void bla_send_announce(struct bat_priv *bat_priv,
+                              struct backbone_gw *backbone_gw)
+{
+        uint8_t mac[ETH_ALEN];
+        uint16_t crc;
+
+        memcpy(mac, announce_mac, 4);
+        crc = htons(backbone_gw->crc);
+        memcpy(&mac[4], (uint8_t *)&crc, 2);
+
+        bla_send_claim(bat_priv, mac, backbone_gw->vid, CLAIM_TYPE_ANNOUNCE);
+
+}
+
+/**
+ * @bat_priv: the bat priv with all the soft interface information
+ * @mac: the mac address of the claim
+ * @vid: the VLAN ID of the frame
+ * @backbone_gw: the backbone gateway which claims it
+ *
+ * Adds a claim in the claim hash.
+ */
+static void bla_add_claim(struct bat_priv *bat_priv, const uint8_t *mac,
+                          const short vid, struct backbone_gw *backbone_gw)
+{
+        struct claim *claim;
+        struct claim search_claim;
+        int hash_added;
+
+        memcpy(search_claim.addr, mac, ETH_ALEN);
+        search_claim.vid = vid;
+        claim = claim_hash_find(bat_priv, &search_claim);
+
+        /* create a new claim entry if it does not exist yet. */
+        if (!claim) {
+                claim = kzalloc(sizeof(*claim), GFP_ATOMIC);
+                if (!claim)
+                        return;
+
+                memcpy(claim->addr, mac, ETH_ALEN);
+                claim->vid = vid;
+                claim->lasttime = jiffies;
+                claim->backbone_gw = backbone_gw;
+
+                atomic_set(&claim->refcount, 2);
+                bat_dbg(DBG_BLA, bat_priv,
+                        "bla_add_claim(): adding new entry %pM, vid %d to hash ...\n",
+                        mac, vid);
+                hash_added = hash_add(bat_priv->claim_hash, compare_claim,
+                                      choose_claim, claim, &claim->hash_entry);
+
+                if (unlikely(hash_added != 0)) {
+                        /* only local changes happened. */
+                        kfree(claim);
+                        return;
+                }
+        } else {
+                claim->lasttime = jiffies;
+                if (claim->backbone_gw == backbone_gw)
+                        /* no need to register a new backbone */
+                        goto claim_free_ref;
+
+                bat_dbg(DBG_BLA, bat_priv,
+                        "bla_add_claim(): changing ownership for %pM, vid %d\n",
+                        mac, vid);
+
+                claim->backbone_gw->crc ^=
+                        crc16(0, claim->addr, ETH_ALEN);
+                backbone_gw_free_ref(claim->backbone_gw);
+
+        }
+        /* set (new) backbone gw */
+        atomic_inc(&backbone_gw->refcount);
+        claim->backbone_gw = backbone_gw;
+
+        backbone_gw->crc ^= crc16(0, claim->addr, ETH_ALEN);
+        backbone_gw->lasttime = jiffies;
+
+claim_free_ref:
+        claim_free_ref(claim);
+}
+
+/* Delete a claim from the claim hash which has the
+ * given mac address and vid.
+ */
+static void bla_del_claim(struct bat_priv *bat_priv, const uint8_t *mac,
+                          const short vid)
+{
+        struct claim search_claim, *claim;
+
+        memcpy(search_claim.addr, mac, ETH_ALEN);
+        search_claim.vid = vid;
+        claim = claim_hash_find(bat_priv, &search_claim);
+        if (!claim)
+                return;
+
+        bat_dbg(DBG_BLA, bat_priv, "bla_del_claim(): %pM, vid %d\n", mac, vid);
+
+        hash_remove(bat_priv->claim_hash, compare_claim, choose_claim, claim);
+        claim_free_ref(claim); /* reference from the hash is gone */
+
+        claim->backbone_gw->crc ^= crc16(0, claim->addr, ETH_ALEN);
+
+        /* don't need the reference from hash_find() anymore */
+        claim_free_ref(claim);
+}
+
+/* check for ANNOUNCE frame, return 1 if handled */
+static int handle_announce(struct bat_priv *bat_priv,
+                           uint8_t *an_addr, uint8_t *backbone_addr, short vid)
+{
+        struct backbone_gw *backbone_gw;
+        uint16_t crc;
+
+        if (memcmp(an_addr, announce_mac, 4) != 0)
+                return 0;
+
+        backbone_gw = bla_get_backbone_gw(bat_priv, backbone_addr, vid);
+
+        if (unlikely(!backbone_gw))
+                return 1;
+
+
+        /* handle as ANNOUNCE frame */
+        backbone_gw->lasttime = jiffies;
+        crc = ntohs(*((uint16_t *)(&an_addr[4])));
+
+        bat_dbg(DBG_BLA, bat_priv,
+                "handle_announce(): ANNOUNCE vid %d (sent by %pM)... CRC = %04x\n",
+                vid, backbone_gw->orig, crc);
+
+        if (backbone_gw->crc != crc) {
+                bat_dbg(DBG_BLA, backbone_gw->bat_priv,
+                        "handle_announce(): CRC FAILED for %pM/%d (my = %04x, sent = %04x)\n",
+                        backbone_gw->orig, backbone_gw->vid, backbone_gw->crc,
+                        crc);
+
+                bla_send_request(backbone_gw);
+        } else {
+                /* if we have sent a request and the crc was OK,
+                 * we can allow traffic again.
+                 */
+                if (atomic_read(&backbone_gw->request_sent)) {
+                        atomic_dec(&backbone_gw->bat_priv->bla_num_requests);
+                        atomic_set(&backbone_gw->request_sent, 0);
+                }
+        }
+
+        backbone_gw_free_ref(backbone_gw);
+        return 1;
+}
+
+/* check for REQUEST frame, return 1 if handled */
+static int handle_request(struct bat_priv *bat_priv,
+                          struct hard_iface *primary_if,
+                          uint8_t *backbone_addr,
+                          struct ethhdr *ethhdr, short vid)
+{
+        /* check for REQUEST frame */
+        if (!compare_eth(backbone_addr, ethhdr->h_dest))
+                return 0;
+
+        /* sanity check, this should not happen on a normal switch,
+         * we ignore it in this case.
+         */
+        if (!compare_eth(ethhdr->h_dest, primary_if->net_dev->dev_addr))
+                return 1;
+
+        bat_dbg(DBG_BLA, bat_priv,
+                "handle_request(): REQUEST vid %d (sent by %pM)...\n",
+                vid, ethhdr->h_source);
+
+        bla_answer_request(bat_priv, primary_if, vid);
+        return 1;
+}
+
+/* check for UNCLAIM frame, return 1 if handled */
+static int handle_unclaim(struct bat_priv *bat_priv,
+                          struct hard_iface *primary_if,
+                          uint8_t *backbone_addr,
+                          uint8_t *claim_addr, short vid)
+{
+        struct backbone_gw *backbone_gw;
+
+        /* unclaim in any case if it is our own */
+        if (primary_if && compare_eth(backbone_addr,
+                                      primary_if->net_dev->dev_addr))
+                bla_send_claim(bat_priv, claim_addr, vid, CLAIM_TYPE_DEL);
+
+        backbone_gw = backbone_hash_find(bat_priv, backbone_addr, vid);
+
+        if (!backbone_gw)
+                return 1;
+
+        /* this must be an UNCLAIM frame */
+        bat_dbg(DBG_BLA, bat_priv,
+                "handle_unclaim(): UNCLAIM %pM on vid %d (sent by %pM)...\n",
+                claim_addr, vid, backbone_gw->orig);
+
+        bla_del_claim(bat_priv, claim_addr, vid);
+        backbone_gw_free_ref(backbone_gw);
+        return 1;
+}
+
+/* check for CLAIM frame, return 1 if handled */
+static int handle_claim(struct bat_priv *bat_priv,
+                        struct hard_iface *primary_if, uint8_t *backbone_addr,
+                        uint8_t *claim_addr, short vid)
+{
+        struct backbone_gw *backbone_gw;
+
+        /* register the gateway if not yet available, and add the claim. */
+
+        backbone_gw = bla_get_backbone_gw(bat_priv, backbone_addr, vid);
+
+        if (unlikely(!backbone_gw))
+                return 1;
+
+        /* this must be a CLAIM frame */
+        bla_add_claim(bat_priv, claim_addr, vid, backbone_gw);
+        if (compare_eth(backbone_addr, primary_if->net_dev->dev_addr))
+                bla_send_claim(bat_priv, claim_addr, vid, CLAIM_TYPE_ADD);
+
+        /* TODO: we could call something like tt_local_del() here. */
+
+        backbone_gw_free_ref(backbone_gw);
+        return 1;
+}
+
+/**
+ * @bat_priv: the bat priv with all the soft interface information
+ * @hw_src: the Hardware source in the ARP Header
+ * @hw_dst: the Hardware destination in the ARP Header
+ * @ethhdr: pointer to the Ethernet header of the claim frame
+ *
+ * checks if it is a claim packet and if its on the same group.
+ * This function also applies the group ID of the sender
+ * if it is in the same mesh.
+ *
+ * returns:
+ *      2  - if it is a claim packet and on the same group
+ *      1  - if is a claim packet from another group
+ *      0  - if it is not a claim packet
+ */
+static int check_claim_group(struct bat_priv *bat_priv,
+                             struct hard_iface *primary_if,
+                             uint8_t *hw_src, uint8_t *hw_dst,
+                             struct ethhdr *ethhdr)
+{
+        uint8_t *backbone_addr;
+        struct orig_node *orig_node;
+        struct bla_claim_dst *bla_dst, *bla_dst_own;
+
+        bla_dst = (struct bla_claim_dst *)hw_dst;
+        bla_dst_own = &bat_priv->claim_dest;
+
+        /* check if it is a claim packet in general */
+        if (memcmp(bla_dst->magic, bla_dst_own->magic,
+                   sizeof(bla_dst->magic)) != 0)
+                return 0;
+
+        /* if announcement packet, use the source,
+         * otherwise assume it is in the hw_src
+         */
+        switch (bla_dst->type) {
+        case CLAIM_TYPE_ADD:
+                backbone_addr = hw_src;
+                break;
+        case CLAIM_TYPE_REQUEST:
+        case CLAIM_TYPE_ANNOUNCE:
+        case CLAIM_TYPE_DEL:
+                backbone_addr = ethhdr->h_source;
+                break;
+        default:
+                return 0;
+        }
+
+        /* don't accept claim frames from ourselves */
+        if (compare_eth(backbone_addr, primary_if->net_dev->dev_addr))
+                return 0;
+
+        /* if its already the same group, it is fine. */
+        if (bla_dst->group == bla_dst_own->group)
+                return 2;
+
+        /* lets see if this originator is in our mesh */
+        orig_node = orig_hash_find(bat_priv, backbone_addr);
+
+        /* dont accept claims from gateways which are not in
+         * the same mesh or group.
+         */
+        if (!orig_node)
+                return 1;
+
+        /* if our mesh friends mac is bigger, use it for ourselves. */
+        if (ntohs(bla_dst->group) > ntohs(bla_dst_own->group)) {
+                bat_dbg(DBG_BLA, bat_priv,
+                        "taking other backbones claim group: %04x\n",
+                        ntohs(bla_dst->group));
+                bla_dst_own->group = bla_dst->group;
+        }
+
+        orig_node_free_ref(orig_node);
+
+        return 2;
+}
+
+
+/**
+ * @bat_priv: the bat priv with all the soft interface information
+ * @skb: the frame to be checked
+ *
+ * Check if this is a claim frame, and process it accordingly.
+ *
+ * returns 1 if it was a claim frame, otherwise return 0 to
+ * tell the callee that it can use the frame on its own.
+ */
+static int bla_process_claim(struct bat_priv *bat_priv,
+                             struct hard_iface *primary_if,
+                             struct sk_buff *skb)
+{
+        struct ethhdr *ethhdr;
+        struct vlan_ethhdr *vhdr;
+        struct arphdr *arphdr;
+        uint8_t *hw_src, *hw_dst;
+        struct bla_claim_dst *bla_dst;
+        uint16_t proto;
+        int headlen;
+        short vid = -1;
+        int ret;
+
+        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+
+        if (ntohs(ethhdr->h_proto) == ETH_P_8021Q) {
+                vhdr = (struct vlan_ethhdr *)ethhdr;
+                vid = ntohs(vhdr->h_vlan_TCI) & VLAN_VID_MASK;
+                proto = ntohs(vhdr->h_vlan_encapsulated_proto);
+                headlen = sizeof(*vhdr);
+        } else {
+                proto = ntohs(ethhdr->h_proto);
+                headlen = ETH_HLEN;
+        }
+
+        if (proto != ETH_P_ARP)
+                return 0; /* not a claim frame */
+
+        /* this must be a ARP frame. check if it is a claim. */
+
+        if (unlikely(!pskb_may_pull(skb, headlen + arp_hdr_len(skb->dev))))
+                return 0;
+
+        /* pskb_may_pull() may have modified the pointers, get ethhdr again */
+        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+        arphdr = (struct arphdr *)((uint8_t *)ethhdr + headlen);
+
+        /* Check whether the ARP frame carries a valid
+         * IP information
+         */
+
+        if (arphdr->ar_hrd != htons(ARPHRD_ETHER))
+                return 0;
+        if (arphdr->ar_pro != htons(ETH_P_IP))
+                return 0;
+        if (arphdr->ar_hln != ETH_ALEN)
+                return 0;
+        if (arphdr->ar_pln != 4)
+                return 0;
+
+        hw_src = (uint8_t *)arphdr + sizeof(struct arphdr);
+        hw_dst = hw_src + ETH_ALEN + 4;
+        bla_dst = (struct bla_claim_dst *)hw_dst;
+
+        /* check if it is a claim frame. */
+        ret = check_claim_group(bat_priv, primary_if, hw_src, hw_dst, ethhdr);
+        if (ret == 1)
+                bat_dbg(DBG_BLA, bat_priv,
+                        "bla_process_claim(): received a claim frame from another group. From: %pM on vid %d ...(hw_src %pM, hw_dst %pM)\n",
+                        ethhdr->h_source, vid, hw_src, hw_dst);
+
+        if (ret < 2)
+                return ret;
+
+        /* become a backbone gw ourselves on this vlan if not happened yet */
+        bla_update_own_backbone_gw(bat_priv, primary_if, vid);
+
+        /* check for the different types of claim frames ... */
+        switch (bla_dst->type) {
+        case CLAIM_TYPE_ADD:
+                if (handle_claim(bat_priv, primary_if, hw_src,
+                                 ethhdr->h_source, vid))
+                        return 1;
+                break;
+        case CLAIM_TYPE_DEL:
+                if (handle_unclaim(bat_priv, primary_if,
+                                   ethhdr->h_source, hw_src, vid))
+                        return 1;
+                break;
+
+        case CLAIM_TYPE_ANNOUNCE:
+                if (handle_announce(bat_priv, hw_src, ethhdr->h_source, vid))
+                        return 1;
+                break;
+        case CLAIM_TYPE_REQUEST:
+                if (handle_request(bat_priv, primary_if, hw_src, ethhdr, vid))
+                        return 1;
+                break;
+        }
+
+        bat_dbg(DBG_BLA, bat_priv,
+                "bla_process_claim(): ERROR - this looks like a claim frame, but is useless. eth src %pM on vid %d ...(hw_src %pM, hw_dst %pM)\n",
+                ethhdr->h_source, vid, hw_src, hw_dst);
+        return 1;
+}
+
+/* Check when we last heard from other nodes, and remove them in case of
+ * a time out, or clean all backbone gws if now is set.
+ */
+static void bla_purge_backbone_gw(struct bat_priv *bat_priv, int now)
+{
+        struct backbone_gw *backbone_gw;
+        struct hlist_node *node, *node_tmp;
+        struct hlist_head *head;
+        struct hashtable_t *hash;
+        spinlock_t *list_lock;  /* protects write access to the hash lists */
+        int i;
+
+        hash = bat_priv->backbone_hash;
+        if (!hash)
+                return;
+
+        for (i = 0; i < hash->size; i++) {
+                head = &hash->table[i];
+                list_lock = &hash->list_locks[i];
+
+                spin_lock_bh(list_lock);
+                hlist_for_each_entry_safe(backbone_gw, node, node_tmp,
+                                          head, hash_entry) {
+                        if (now)
+                                goto purge_now;
+                        if (!has_timed_out(backbone_gw->lasttime,
+                                           BLA_BACKBONE_TIMEOUT))
+                                continue;
+
+                        bat_dbg(DBG_BLA, backbone_gw->bat_priv,
+                                "bla_purge_backbone_gw(): backbone gw %pM timed out\n",
+                                backbone_gw->orig);
+
+purge_now:
+                        /* don't wait for the pending request anymore */
+                        if (atomic_read(&backbone_gw->request_sent))
+                                atomic_dec(&bat_priv->bla_num_requests);
+
+                        bla_del_backbone_claims(backbone_gw);
+
+                        hlist_del_rcu(node);
+                        backbone_gw_free_ref(backbone_gw);
+                }
+                spin_unlock_bh(list_lock);
+        }
+}
+
+/**
+ * @bat_priv: the bat priv with all the soft interface information
+ * @primary_if: the selected primary interface, may be NULL if now is set
+ * @now: whether the whole hash shall be wiped now
+ *
+ * Check when we heard last time from our own claims, and remove them in case of
+ * a time out, or clean all claims if now is set
+ */
+static void bla_purge_claims(struct bat_priv *bat_priv,
+                             struct hard_iface *primary_if, int now)
+{
+        struct claim *claim;
+        struct hlist_node *node;
+        struct hlist_head *head;
+        struct hashtable_t *hash;
+        int i;
+
+        hash = bat_priv->claim_hash;
+        if (!hash)
+                return;
+
+        for (i = 0; i < hash->size; i++) {
+                head = &hash->table[i];
+
+                rcu_read_lock();
+                hlist_for_each_entry_rcu(claim, node, head, hash_entry) {
+                        if (now)
+                                goto purge_now;
+                        if (!compare_eth(claim->backbone_gw->orig,
+                                         primary_if->net_dev->dev_addr))
+                                continue;
+                        if (!has_timed_out(claim->lasttime,
+                                           BLA_CLAIM_TIMEOUT))
+                                continue;
+
+                        bat_dbg(DBG_BLA, bat_priv,
+                                "bla_purge_claims(): %pM, vid %d, time out\n",
+                                claim->addr, claim->vid);
+
+purge_now:
+                        handle_unclaim(bat_priv, primary_if,
+                                       claim->backbone_gw->orig,
+                                       claim->addr, claim->vid);
+                }
+                rcu_read_unlock();
+        }
+}
+
+/**
+ * @bat_priv: the bat priv with all the soft interface information
+ * @primary_if: the new selected primary_if
+ * @oldif: the old primary interface, may be NULL
+ *
+ * Update the backbone gateways when the own orig address changes.
+ *
+ */
+void bla_update_orig_address(struct bat_priv *bat_priv,
+                             struct hard_iface *primary_if,
+                             struct hard_iface *oldif)
+{
+        struct backbone_gw *backbone_gw;
+        struct hlist_node *node;
+        struct hlist_head *head;
+        struct hashtable_t *hash;
+        int i;
+
+        /* reset bridge loop avoidance group id */
+        bat_priv->claim_dest.group =
+                htons(crc16(0, primary_if->net_dev->dev_addr, ETH_ALEN));
+
+        if (!oldif) {
+                bla_purge_claims(bat_priv, NULL, 1);
+                bla_purge_backbone_gw(bat_priv, 1);
+                return;
+        }
+
+        hash = bat_priv->backbone_hash;
+        if (!hash)
+                return;
+
+        for (i = 0; i < hash->size; i++) {
+                head = &hash->table[i];
+
+                rcu_read_lock();
+                hlist_for_each_entry_rcu(backbone_gw, node, head, hash_entry) {
+                        /* own orig still holds the old value. */
+                        if (!compare_eth(backbone_gw->orig,
+                                         oldif->net_dev->dev_addr))
+                                continue;
+
+                        memcpy(backbone_gw->orig,
+                               primary_if->net_dev->dev_addr, ETH_ALEN);
+                        /* send an announce frame so others will ask for our
+                         * claims and update their tables.
+                         */
+                        bla_send_announce(bat_priv, backbone_gw);
+                }
+                rcu_read_unlock();
+        }
+}
+
+
+
+/* (re)start the timer */
+static void bla_start_timer(struct bat_priv *bat_priv)
+{
+        INIT_DELAYED_WORK(&bat_priv->bla_work, bla_periodic_work);
+        queue_delayed_work(bat_event_workqueue, &bat_priv->bla_work,
+                           msecs_to_jiffies(BLA_PERIOD_LENGTH));
+}
+
+/* periodic work to do:
+ *  * purge structures when they are too old
+ *  * send announcements
+ */
+static void bla_periodic_work(struct work_struct *work)
+{
+        struct delayed_work *delayed_work =
+                container_of(work, struct delayed_work, work);
+        struct bat_priv *bat_priv =
+                container_of(delayed_work, struct bat_priv, bla_work);
+        struct hlist_node *node;
+        struct hlist_head *head;
+        struct backbone_gw *backbone_gw;
+        struct hashtable_t *hash;
+        struct hard_iface *primary_if;
+        int i;
+
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if)
+                goto out;
+
+        bla_purge_claims(bat_priv, primary_if, 0);
+        bla_purge_backbone_gw(bat_priv, 0);
+
+        if (!atomic_read(&bat_priv->bridge_loop_avoidance))
+                goto out;
+
+        hash = bat_priv->backbone_hash;
+        if (!hash)
+                goto out;
+
+        for (i = 0; i < hash->size; i++) {
+                head = &hash->table[i];
+
+                rcu_read_lock();
+                hlist_for_each_entry_rcu(backbone_gw, node, head, hash_entry) {
+                        if (!compare_eth(backbone_gw->orig,
+                                         primary_if->net_dev->dev_addr))
+                                continue;
+
+                        backbone_gw->lasttime = jiffies;
+
+                        bla_send_announce(bat_priv, backbone_gw);
+                }
+                rcu_read_unlock();
+        }
+out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
+
+        bla_start_timer(bat_priv);
+}
+
+/* initialize all bla structures */
+int bla_init(struct bat_priv *bat_priv)
+{
+        int i;
+        uint8_t claim_dest[ETH_ALEN] = {0xff, 0x43, 0x05, 0x00, 0x00, 0x00};
+        struct hard_iface *primary_if;
+
+        bat_dbg(DBG_BLA, bat_priv, "bla hash registering\n");
+
+        /* setting claim destination address */
+        memcpy(&bat_priv->claim_dest.magic, claim_dest, 3);
+        bat_priv->claim_dest.type = 0;
+        primary_if = primary_if_get_selected(bat_priv);
+        if (primary_if) {
+                bat_priv->claim_dest.group =
+                        htons(crc16(0, primary_if->net_dev->dev_addr,
+                                    ETH_ALEN));
+                hardif_free_ref(primary_if);
+        } else {
+                bat_priv->claim_dest.group = 0; /* will be set later */
+        }
+
+        /* initialize the duplicate list */
+        for (i = 0; i < DUPLIST_SIZE; i++)
+                bat_priv->bcast_duplist[i].entrytime =
+                        jiffies - msecs_to_jiffies(DUPLIST_TIMEOUT);
+        bat_priv->bcast_duplist_curr = 0;
+
+        if (bat_priv->claim_hash)
+                return 1;
+
+        bat_priv->claim_hash = hash_new(128);
+        bat_priv->backbone_hash = hash_new(32);
+
+        if (!bat_priv->claim_hash || !bat_priv->backbone_hash)
+                return -1;
+
+        bat_dbg(DBG_BLA, bat_priv, "bla hashes initialized\n");
+
+        bla_start_timer(bat_priv);
+        return 1;
+}
+
+/**
+ * @bat_priv: the bat priv with all the soft interface information
+ * @bcast_packet: originator mac address
+ * @hdr_size: maximum length of the frame
+ *
+ * check if it is on our broadcast list. Another gateway might
+ * have sent the same packet because it is connected to the same backbone,
+ * so we have to remove this duplicate.
+ *
+ * This is performed by checking the CRC, which will tell us
+ * with a good chance that it is the same packet. If it is furthermore
+ * sent by another host, drop it. We allow equal packets from
+ * the same host however as this might be intended.
+ *
+ **/
+
+int bla_check_bcast_duplist(struct bat_priv *bat_priv,
+                            struct bcast_packet *bcast_packet,
+                            int hdr_size)
+{
+        int i, length, curr;
+        uint8_t *content;
+        uint16_t crc;
+        struct bcast_duplist_entry *entry;
+
+        length = hdr_size - sizeof(*bcast_packet);
+        content = (uint8_t *)bcast_packet;
+        content += sizeof(*bcast_packet);
+
+        /* calculate the crc ... */
+        crc = crc16(0, content, length);
+
+        for (i = 0 ; i < DUPLIST_SIZE; i++) {
+                curr = (bat_priv->bcast_duplist_curr + i) % DUPLIST_SIZE;
+                entry = &bat_priv->bcast_duplist[curr];
+
+                /* we can stop searching if the entry is too old ;
+                 * later entries will be even older
+                 */
+                if (has_timed_out(entry->entrytime, DUPLIST_TIMEOUT))
+                        break;
+
+                if (entry->crc != crc)
+                        continue;
+
+                if (compare_eth(entry->orig, bcast_packet->orig))
+                        continue;
+
+                /* this entry seems to match: same crc, not too old,
+                 * and from another gw. therefore return 1 to forbid it.
+                 */
+                return 1;
+        }
+        /* not found, add a new entry (overwrite the oldest entry) */
+        curr = (bat_priv->bcast_duplist_curr + DUPLIST_SIZE - 1) % DUPLIST_SIZE;
+        entry = &bat_priv->bcast_duplist[curr];
+        entry->crc = crc;
+        entry->entrytime = jiffies;
+        memcpy(entry->orig, bcast_packet->orig, ETH_ALEN);
+        bat_priv->bcast_duplist_curr = curr;
+
+        /* allow it, its the first occurence. */
+        return 0;
+}
+
+
+
+/**
+ * @bat_priv: the bat priv with all the soft interface information
+ * @orig: originator mac address
+ *
+ * check if the originator is a gateway for any VLAN ID.
+ *
+ * returns 1 if it is found, 0 otherwise
+ *
+ */
+
+int bla_is_backbone_gw_orig(struct bat_priv *bat_priv, uint8_t *orig)
+{
+        struct hashtable_t *hash = bat_priv->backbone_hash;
+        struct hlist_head *head;
+        struct hlist_node *node;
+        struct backbone_gw *backbone_gw;
+        int i;
+
+        if (!atomic_read(&bat_priv->bridge_loop_avoidance))
+                return 0;
+
+        if (!hash)
+                return 0;
+
+        for (i = 0; i < hash->size; i++) {
+                head = &hash->table[i];
+
+                rcu_read_lock();
+                hlist_for_each_entry_rcu(backbone_gw, node, head, hash_entry) {
+                        if (compare_eth(backbone_gw->orig, orig)) {
+                                rcu_read_unlock();
+                                return 1;
+                        }
+                }
+                rcu_read_unlock();
+        }
+
+        return 0;
+}
+
+
+/**
+ * @skb: the frame to be checked
+ * @orig_node: the orig_node of the frame
+ * @hdr_size: maximum length of the frame
+ *
+ * bla_is_backbone_gw inspects the skb for the VLAN ID and returns 1
+ * if the orig_node is also a gateway on the soft interface, otherwise it
+ * returns 0.
+ *
+ */
+int bla_is_backbone_gw(struct sk_buff *skb,
+                       struct orig_node *orig_node, int hdr_size)
+{
+        struct ethhdr *ethhdr;
+        struct vlan_ethhdr *vhdr;
+        struct backbone_gw *backbone_gw;
+        short vid = -1;
+
+        if (!atomic_read(&orig_node->bat_priv->bridge_loop_avoidance))
+                return 0;
+
+        /* first, find out the vid. */
+        if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
+                return 0;
+
+        ethhdr = (struct ethhdr *)(((uint8_t *)skb->data) + hdr_size);
+
+        if (ntohs(ethhdr->h_proto) == ETH_P_8021Q) {
+                if (!pskb_may_pull(skb, hdr_size + sizeof(struct vlan_ethhdr)))
+                        return 0;
+
+                vhdr = (struct vlan_ethhdr *)(((uint8_t *)skb->data) +
+                                              hdr_size);
+                vid = ntohs(vhdr->h_vlan_TCI) & VLAN_VID_MASK;
+        }
+
+        /* see if this originator is a backbone gw for this VLAN */
+
+        backbone_gw = backbone_hash_find(orig_node->bat_priv,
+                                         orig_node->orig, vid);
+        if (!backbone_gw)
+                return 0;
+
+        backbone_gw_free_ref(backbone_gw);
+        return 1;
+}
+
+/* free all bla structures (for softinterface free or module unload) */
+void bla_free(struct bat_priv *bat_priv)
+{
+        struct hard_iface *primary_if;
+
+        cancel_delayed_work_sync(&bat_priv->bla_work);
+        primary_if = primary_if_get_selected(bat_priv);
+
+        if (bat_priv->claim_hash) {
+                bla_purge_claims(bat_priv, primary_if, 1);
+                hash_destroy(bat_priv->claim_hash);
+                bat_priv->claim_hash = NULL;
+        }
+        if (bat_priv->backbone_hash) {
+                bla_purge_backbone_gw(bat_priv, 1);
+                hash_destroy(bat_priv->backbone_hash);
+                bat_priv->backbone_hash = NULL;
+        }
+        if (primary_if)
+                hardif_free_ref(primary_if);
+}
+
+/**
+ * @bat_priv: the bat priv with all the soft interface information
+ * @skb: the frame to be checked
+ * @vid: the VLAN ID of the frame
+ *
+ * bla_rx avoidance checks if:
+ *  * we have to race for a claim
+ *  * if the frame is allowed on the LAN
+ *
+ * in these cases, the skb is further handled by this function and
+ * returns 1, otherwise it returns 0 and the caller shall further
+ * process the skb.
+ *
+ */
+int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid)
+{
+        struct ethhdr *ethhdr;
+        struct claim search_claim, *claim = NULL;
+        struct hard_iface *primary_if;
+        int ret;
+
+        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if)
+                goto handled;
+
+        if (!atomic_read(&bat_priv->bridge_loop_avoidance))
+                goto allow;
+
+
+        if (unlikely(atomic_read(&bat_priv->bla_num_requests)))
+                /* don't allow broadcasts while requests are in flight */
+                if (is_multicast_ether_addr(ethhdr->h_dest))
+                        goto handled;
+
+        memcpy(search_claim.addr, ethhdr->h_source, ETH_ALEN);
+        search_claim.vid = vid;
+        claim = claim_hash_find(bat_priv, &search_claim);
+
+        if (!claim) {
+                /* possible optimization: race for a claim */
+                /* No claim exists yet, claim it for us!
+                 */
+                handle_claim(bat_priv, primary_if,
+                             primary_if->net_dev->dev_addr,
+                             ethhdr->h_source, vid);
+                goto allow;
+        }
+
+        /* if it is our own claim ... */
+        if (compare_eth(claim->backbone_gw->orig,
+                        primary_if->net_dev->dev_addr)) {
+                /* ... allow it in any case */
+                claim->lasttime = jiffies;
+                goto allow;
+        }
+
+        /* if it is a broadcast ... */
+        if (is_multicast_ether_addr(ethhdr->h_dest)) {
+                /* ... drop it. the responsible gateway is in charge. */
+                goto handled;
+        } else {
+                /* seems the client considers us as its best gateway.
+                 * send a claim and update the claim table
+                 * immediately.
+                 */
+                handle_claim(bat_priv, primary_if,
+                             primary_if->net_dev->dev_addr,
+                             ethhdr->h_source, vid);
+                goto allow;
+        }
+allow:
+        bla_update_own_backbone_gw(bat_priv, primary_if, vid);
+        ret = 0;
+        goto out;
+
+handled:
+        kfree_skb(skb);
+        ret = 1;
+
+out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
+        if (claim)
+                claim_free_ref(claim);
+        return ret;
+}
+
+/**
+ * @bat_priv: the bat priv with all the soft interface information
+ * @skb: the frame to be checked
+ * @vid: the VLAN ID of the frame
+ *
+ * bla_tx checks if:
+ *  * a claim was received which has to be processed
+ *  * the frame is allowed on the mesh
+ *
+ * in these cases, the skb is further handled by this function and
+ * returns 1, otherwise it returns 0 and the caller shall further
+ * process the skb.
+ *
+ */
+int bla_tx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid)
+{
+        struct ethhdr *ethhdr;
+        struct claim search_claim, *claim = NULL;
+        struct hard_iface *primary_if;
+        int ret = 0;
+
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if)
+                goto out;
+
+        if (!atomic_read(&bat_priv->bridge_loop_avoidance))
+                goto allow;
+
+        /* in VLAN case, the mac header might not be set. */
+        skb_reset_mac_header(skb);
+
+        if (bla_process_claim(bat_priv, primary_if, skb))
+                goto handled;
+
+        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+
+        if (unlikely(atomic_read(&bat_priv->bla_num_requests)))
+                /* don't allow broadcasts while requests are in flight */
+                if (is_multicast_ether_addr(ethhdr->h_dest))
+                        goto handled;
+
+        memcpy(search_claim.addr, ethhdr->h_source, ETH_ALEN);
+        search_claim.vid = vid;
+
+        claim = claim_hash_find(bat_priv, &search_claim);
+
+        /* if no claim exists, allow it. */
+        if (!claim)
+                goto allow;
+
+        /* check if we are responsible. */
+        if (compare_eth(claim->backbone_gw->orig,
+                        primary_if->net_dev->dev_addr)) {
+                /* if yes, the client has roamed and we have
+                 * to unclaim it.
+                 */
+                handle_unclaim(bat_priv, primary_if,
+                               primary_if->net_dev->dev_addr,
+                               ethhdr->h_source, vid);
+                goto allow;
+        }
+
+        /* check if it is a multicast/broadcast frame */
+        if (is_multicast_ether_addr(ethhdr->h_dest)) {
+                /* drop it. the responsible gateway has forwarded it into
+                 * the backbone network.
+                 */
+                goto handled;
+        } else {
+                /* we must allow it. at least if we are
+                 * responsible for the DESTINATION.
+                 */
+                goto allow;
+        }
+allow:
+        bla_update_own_backbone_gw(bat_priv, primary_if, vid);
+        ret = 0;
+        goto out;
+handled:
+        ret = 1;
+out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
+        if (claim)
+                claim_free_ref(claim);
+        return ret;
+}
+
+int bla_claim_table_seq_print_text(struct seq_file *seq, void *offset)
+{
+        struct net_device *net_dev = (struct net_device *)seq->private;
+        struct bat_priv *bat_priv = netdev_priv(net_dev);
+        struct hashtable_t *hash = bat_priv->claim_hash;
+        struct claim *claim;
+        struct hard_iface *primary_if;
+        struct hlist_node *node;
+        struct hlist_head *head;
+        uint32_t i;
+        bool is_own;
+        int ret = 0;
+
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if) {
+                ret = seq_printf(seq,
+                                 "BATMAN mesh %s disabled - please specify interfaces to enable it\n",
+                                 net_dev->name);
+                goto out;
+        }
+
+        if (primary_if->if_status != IF_ACTIVE) {
+                ret = seq_printf(seq,
+                                 "BATMAN mesh %s disabled - primary interface not active\n",
+                                 net_dev->name);
+                goto out;
+        }
+
+        seq_printf(seq,
+                   "Claims announced for the mesh %s (orig %pM, group id %04x)\n",
+                   net_dev->name, primary_if->net_dev->dev_addr,
+                   ntohs(bat_priv->claim_dest.group));
+        seq_printf(seq, "   %-17s    %-5s    %-17s [o] (%-4s)\n",
+                   "Client", "VID", "Originator", "CRC");
+        for (i = 0; i < hash->size; i++) {
+                head = &hash->table[i];
+
+                rcu_read_lock();
+                hlist_for_each_entry_rcu(claim, node, head, hash_entry) {
+                        is_own = compare_eth(claim->backbone_gw->orig,
+                                             primary_if->net_dev->dev_addr);
+                        seq_printf(seq, " * %pM on % 5d by %pM [%c] (%04x)\n",
+                                   claim->addr, claim->vid,
+                                   claim->backbone_gw->orig,
+                                   (is_own ? 'x' : ' '),
+                                   claim->backbone_gw->crc);
+                }
+                rcu_read_unlock();
+        }
+out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
+        return ret;
+}
diff --git a/net/batman-adv/bridge_loop_avoidance.h b/net/batman-adv/bridge_loop_avoidance.h
new file mode 100644
index 000000000000..e39f93acc28f
--- /dev/null
+++ b/net/batman-adv/bridge_loop_avoidance.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2011-2012 B.A.T.M.A.N. contributors:
+ *
+ * Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#ifndef _NET_BATMAN_ADV_BLA_H_
+#define _NET_BATMAN_ADV_BLA_H_
+
+#ifdef CONFIG_BATMAN_ADV_BLA
+int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid);
+int bla_tx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid);
+int bla_is_backbone_gw(struct sk_buff *skb,
+                       struct orig_node *orig_node, int hdr_size);
+int bla_claim_table_seq_print_text(struct seq_file *seq, void *offset);
+int bla_is_backbone_gw_orig(struct bat_priv *bat_priv, uint8_t *orig);
+int bla_check_bcast_duplist(struct bat_priv *bat_priv,
+                            struct bcast_packet *bcast_packet, int hdr_size);
+void bla_update_orig_address(struct bat_priv *bat_priv,
+                             struct hard_iface *primary_if,
+                             struct hard_iface *oldif);
+int bla_init(struct bat_priv *bat_priv);
+void bla_free(struct bat_priv *bat_priv);
+
+#define BLA_CRC_INIT    0
+#else /* ifdef CONFIG_BATMAN_ADV_BLA */
+
+static inline int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb,
+                         short vid)
+{
+        return 0;
+}
+
+static inline int bla_tx(struct bat_priv *bat_priv, struct sk_buff *skb,
+                         short vid)
+{
+        return 0;
+}
+
+static inline int bla_is_backbone_gw(struct sk_buff *skb,
+                                     struct orig_node *orig_node,
+                                     int hdr_size)
+{
+        return 0;
+}
+
+static inline int bla_claim_table_seq_print_text(struct seq_file *seq,
+                                                 void *offset)
+{
+        return 0;
+}
+
+static inline int bla_is_backbone_gw_orig(struct bat_priv *bat_priv,
+                                          uint8_t *orig)
+{
+        return 0;
+}
+
+static inline int bla_check_bcast_duplist(struct bat_priv *bat_priv,
+                                          struct bcast_packet *bcast_packet,
+                                          int hdr_size)
+{
+        return 0;
+}
+
+static inline void bla_update_orig_address(struct bat_priv *bat_priv,
+                                           struct hard_iface *primary_if,
+                                           struct hard_iface *oldif)
+{
+}
+
+static inline int bla_init(struct bat_priv *bat_priv)
+{
+        return 1;
+}
+
+static inline void bla_free(struct bat_priv *bat_priv)
+{
+}
+
+#endif /* ifdef CONFIG_BATMAN_ADV_BLA */
+
+#endif /* ifndef _NET_BATMAN_ADV_BLA_H_ */
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index 24403a7350f7..47f7186dcefc 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2009-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner
  *
@@ -224,16 +224,13 @@ void gw_election(struct bat_priv *bat_priv)
         } else if ((!curr_gw) && (next_gw)) {
                 bat_dbg(DBG_BATMAN, bat_priv,
                         "Adding route to gateway %pM (gw_flags: %i, tq: %i)\n",
-                        next_gw->orig_node->orig,
-                        next_gw->orig_node->gw_flags,
+                        next_gw->orig_node->orig, next_gw->orig_node->gw_flags,
                         router->tq_avg);
                 throw_uevent(bat_priv, UEV_GW, UEV_ADD, gw_addr);
         } else {
                 bat_dbg(DBG_BATMAN, bat_priv,
-                        "Changing route to gateway %pM "
-                        "(gw_flags: %i, tq: %i)\n",
-                        next_gw->orig_node->orig,
-                        next_gw->orig_node->gw_flags,
+                        "Changing route to gateway %pM (gw_flags: %i, tq: %i)\n",
+                        next_gw->orig_node->orig, next_gw->orig_node->gw_flags,
                         router->tq_avg);
                 throw_uevent(bat_priv, UEV_GW, UEV_CHANGE, gw_addr);
         }
@@ -287,8 +284,7 @@ void gw_check_election(struct bat_priv *bat_priv, struct orig_node *orig_node)
                 goto out;
 
         bat_dbg(DBG_BATMAN, bat_priv,
-                "Restarting gateway selection: better gateway found (tq curr: "
-                "%i, tq new: %i)\n",
+                "Restarting gateway selection: better gateway found (tq curr: %i, tq new: %i)\n",
                 gw_tq_avg, orig_tq_avg);
 
 deselect:
@@ -352,8 +348,7 @@ void gw_node_update(struct bat_priv *bat_priv,
                         continue;
 
                 bat_dbg(DBG_BATMAN, bat_priv,
-                        "Gateway class of originator %pM changed from "
-                        "%i to %i\n",
+                        "Gateway class of originator %pM changed from %i to %i\n",
                         orig_node->orig, gw_node->orig_node->gw_flags,
                         new_gwflags);
 
@@ -396,7 +391,7 @@ void gw_node_purge(struct bat_priv *bat_priv)
 {
         struct gw_node *gw_node, *curr_gw;
         struct hlist_node *node, *node_tmp;
-        unsigned long timeout = 2 * PURGE_TIMEOUT * HZ;
+        unsigned long timeout = msecs_to_jiffies(2 * PURGE_TIMEOUT);
         int do_deselect = 0;
 
         curr_gw = gw_get_selected_gw_node(bat_priv);
@@ -474,23 +469,23 @@ int gw_client_seq_print_text(struct seq_file *seq, void *offset)
 
         primary_if = primary_if_get_selected(bat_priv);
         if (!primary_if) {
-                ret = seq_printf(seq, "BATMAN mesh %s disabled - please "
-                                 "specify interfaces to enable it\n",
+                ret = seq_printf(seq,
+                                 "BATMAN mesh %s disabled - please specify interfaces to enable it\n",
                                  net_dev->name);
                 goto out;
         }
 
         if (primary_if->if_status != IF_ACTIVE) {
-                ret = seq_printf(seq, "BATMAN mesh %s disabled - "
-                                 "primary interface not active\n",
+                ret = seq_printf(seq,
+                                 "BATMAN mesh %s disabled - primary interface not active\n",
                                  net_dev->name);
                 goto out;
         }
 
-        seq_printf(seq, "      %-12s (%s/%i) %17s [%10s]: gw_class ... "
-                   "[B.A.T.M.A.N. adv %s, MainIF/MAC: %s/%pM (%s)]\n",
-                   "Gateway", "#", TQ_MAX_VALUE, "Nexthop",
-                   "outgoingIF", SOURCE_VERSION, primary_if->net_dev->name,
+        seq_printf(seq,
+                   "      %-12s (%s/%i) %17s [%10s]: gw_class ... [B.A.T.M.A.N. adv %s, MainIF/MAC: %s/%pM (%s)]\n",
+                   "Gateway", "#", TQ_MAX_VALUE, "Nexthop", "outgoingIF",
+                   SOURCE_VERSION, primary_if->net_dev->name,
                    primary_if->net_dev->dev_addr, net_dev->name);
 
         rcu_read_lock();
@@ -563,10 +558,10 @@ static bool is_type_dhcprequest(struct sk_buff *skb, int header_len)
                         p++;
 
                         /* ...and then we jump over the data */
-                        if (pkt_len < *p)
+                        if (pkt_len < 1 + (*p))
                                 goto out;
-                        pkt_len -= *p;
-                        p += (*p);
+                        pkt_len -= 1 + (*p);
+                        p += 1 + (*p);
                 }
         }
 out:
@@ -629,7 +624,7 @@ bool gw_is_dhcp_target(struct sk_buff *skb, unsigned int *header_len)
 
         /* check for bootp port */
         if ((ntohs(ethhdr->h_proto) == ETH_P_IP) &&
-             (ntohs(udphdr->dest) != 67))
+            (ntohs(udphdr->dest) != 67))
                 return false;
 
         if ((ntohs(ethhdr->h_proto) == ETH_P_IPV6) &&
diff --git a/net/batman-adv/gateway_client.h b/net/batman-adv/gateway_client.h
index e1edba08eb1d..bf56a5aea10b 100644
--- a/net/batman-adv/gateway_client.h
+++ b/net/batman-adv/gateway_client.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2009-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner
  *
diff --git a/net/batman-adv/gateway_common.c b/net/batman-adv/gateway_common.c
index c4ac7b0a2a63..ca57ac7d73b2 100644
--- a/net/batman-adv/gateway_common.c
+++ b/net/batman-adv/gateway_common.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2009-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner
  *
@@ -93,7 +93,7 @@ static bool parse_gw_bandwidth(struct net_device *net_dev, char *buff,
                         multi = 1024;
 
                 if ((strnicmp(tmp_ptr, "kbit", 4) == 0) ||
-                        (multi > 1))
+                    (multi > 1))
                         *tmp_ptr = '\0';
         }
 
@@ -118,15 +118,15 @@ static bool parse_gw_bandwidth(struct net_device *net_dev, char *buff,
                                 multi = 1024;
 
                         if ((strnicmp(tmp_ptr, "kbit", 4) == 0) ||
-                                (multi > 1))
+                            (multi > 1))
                                 *tmp_ptr = '\0';
                 }
 
                 ret = kstrtol(slash_ptr + 1, 10, &lup);
                 if (ret) {
                         bat_err(net_dev,
-                                "Upload speed of gateway mode invalid: "
-                                "%s\n", slash_ptr + 1);
+                                "Upload speed of gateway mode invalid: %s\n",
+                                slash_ptr + 1);
                         return false;
                 }
 
@@ -163,8 +163,8 @@ ssize_t gw_bandwidth_set(struct net_device *net_dev, char *buff, size_t count)
         gw_bandwidth_to_kbit((uint8_t)gw_bandwidth_tmp, &down, &up);
 
         gw_deselect(bat_priv);
-        bat_info(net_dev, "Changing gateway bandwidth from: '%i' to: '%ld' "
-                 "(propagating: %d%s/%d%s)\n",
+        bat_info(net_dev,
+                 "Changing gateway bandwidth from: '%i' to: '%ld' (propagating: %d%s/%d%s)\n",
                  atomic_read(&bat_priv->gw_bandwidth), gw_bandwidth_tmp,
                  (down > 2048 ? down / 1024 : down),
                  (down > 2048 ? "MBit" : "KBit"),
diff --git a/net/batman-adv/gateway_common.h b/net/batman-adv/gateway_common.h
index 55e527a489fe..b8fb11c4f927 100644
--- a/net/batman-adv/gateway_common.h
+++ b/net/batman-adv/gateway_common.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2009-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner
  *
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index 7704df468e0b..dc334fa89847 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner, Simon Wunderlich
  *
@@ -28,16 +28,10 @@
 #include "bat_sysfs.h"
 #include "originator.h"
 #include "hash.h"
-#include "bat_ogm.h"
+#include "bridge_loop_avoidance.h"
 
 #include <linux/if_arp.h>
 
-
-static int batman_skb_recv(struct sk_buff *skb,
-                           struct net_device *dev,
-                           struct packet_type *ptype,
-                           struct net_device *orig_dev);
-
 void hardif_free_rcu(struct rcu_head *rcu)
 {
         struct hard_iface *hard_iface;
@@ -108,7 +102,8 @@ out:
         return hard_iface;
 }
 
-static void primary_if_update_addr(struct bat_priv *bat_priv)
+static void primary_if_update_addr(struct bat_priv *bat_priv,
+                                   struct hard_iface *oldif)
 {
         struct vis_packet *vis_packet;
         struct hard_iface *primary_if;
@@ -123,6 +118,7 @@ static void primary_if_update_addr(struct bat_priv *bat_priv)
         memcpy(vis_packet->sender_orig,
                primary_if->net_dev->dev_addr, ETH_ALEN);
 
+        bla_update_orig_address(bat_priv, primary_if, oldif);
 out:
         if (primary_if)
                 hardif_free_ref(primary_if);
@@ -141,14 +137,15 @@ static void primary_if_select(struct bat_priv *bat_priv,
         curr_hard_iface = rcu_dereference_protected(bat_priv->primary_if, 1);
         rcu_assign_pointer(bat_priv->primary_if, new_hard_iface);
 
-        if (curr_hard_iface)
-                hardif_free_ref(curr_hard_iface);
-
         if (!new_hard_iface)
-                return;
+                goto out;
+
+        bat_priv->bat_algo_ops->bat_primary_iface_set(new_hard_iface);
+        primary_if_update_addr(bat_priv, curr_hard_iface);
 
-        bat_ogm_init_primary(new_hard_iface);
-        primary_if_update_addr(bat_priv);
+out:
+        if (curr_hard_iface)
+                hardif_free_ref(curr_hard_iface);
 }
 
 static bool hardif_is_iface_up(const struct hard_iface *hard_iface)
@@ -176,11 +173,9 @@ static void check_known_mac_addr(const struct net_device *net_dev)
                                  net_dev->dev_addr))
                         continue;
 
-                pr_warning("The newly added mac address (%pM) already exists "
-                           "on: %s\n", net_dev->dev_addr,
-                           hard_iface->net_dev->name);
-                pr_warning("It is strongly recommended to keep mac addresses "
-                           "unique to avoid problems!\n");
+                pr_warn("The newly added mac address (%pM) already exists on: %s\n",
+                        net_dev->dev_addr, hard_iface->net_dev->name);
+                pr_warn("It is strongly recommended to keep mac addresses unique to avoid problems!\n");
         }
         rcu_read_unlock();
 }
@@ -233,7 +228,7 @@ static void hardif_activate_interface(struct hard_iface *hard_iface)
 
         bat_priv = netdev_priv(hard_iface->soft_iface);
 
-        bat_ogm_update_mac(hard_iface);
+        bat_priv->bat_algo_ops->bat_iface_update_mac(hard_iface);
         hard_iface->if_status = IF_TO_BE_ACTIVATED;
 
         /**
@@ -281,6 +276,11 @@ int hardif_enable_interface(struct hard_iface *hard_iface,
         if (!atomic_inc_not_zero(&hard_iface->refcount))
                 goto out;
 
+        /* hard-interface is part of a bridge */
+        if (hard_iface->net_dev->priv_flags & IFF_BRIDGE_PORT)
+                pr_err("You are about to enable batman-adv on '%s' which already is part of a bridge. Unless you know exactly what you are doing this is probably wrong and won't work the way you think it would.\n",
+                       hard_iface->net_dev->name);
+
         soft_iface = dev_get_by_name(&init_net, iface_name);
 
         if (!soft_iface) {
@@ -296,24 +296,19 @@ int hardif_enable_interface(struct hard_iface *hard_iface,
         }
 
         if (!softif_is_valid(soft_iface)) {
-                pr_err("Can't create batman mesh interface %s: "
-                       "already exists as regular interface\n",
+                pr_err("Can't create batman mesh interface %s: already exists as regular interface\n",
                        soft_iface->name);
-                dev_put(soft_iface);
                 ret = -EINVAL;
-                goto err;
+                goto err_dev;
         }
 
         hard_iface->soft_iface = soft_iface;
         bat_priv = netdev_priv(hard_iface->soft_iface);
 
-        bat_ogm_init(hard_iface);
-
-        if (!hard_iface->packet_buff) {
-                bat_err(hard_iface->soft_iface, "Can't add interface packet "
-                        "(%s): out of memory\n", hard_iface->net_dev->name);
+        ret = bat_priv->bat_algo_ops->bat_iface_enable(hard_iface);
+        if (ret < 0) {
                 ret = -ENOMEM;
-                goto err;
+                goto err_dev;
         }
 
         hard_iface->if_num = bat_priv->num_ifaces;
@@ -326,7 +321,6 @@ int hardif_enable_interface(struct hard_iface *hard_iface,
         hard_iface->batman_adv_ptype.dev = hard_iface->net_dev;
         dev_add_pack(&hard_iface->batman_adv_ptype);
 
-        atomic_set(&hard_iface->seqno, 1);
         atomic_set(&hard_iface->frag_seqno, 1);
         bat_info(hard_iface->soft_iface, "Adding interface: %s\n",
                  hard_iface->net_dev->name);
@@ -334,29 +328,22 @@ int hardif_enable_interface(struct hard_iface *hard_iface,
         if (atomic_read(&bat_priv->fragmentation) && hard_iface->net_dev->mtu <
                 ETH_DATA_LEN + BAT_HEADER_LEN)
                 bat_info(hard_iface->soft_iface,
-                        "The MTU of interface %s is too small (%i) to handle "
-                        "the transport of batman-adv packets. Packets going "
-                        "over this interface will be fragmented on layer2 "
-                        "which could impact the performance. Setting the MTU "
-                        "to %zi would solve the problem.\n",
-                        hard_iface->net_dev->name, hard_iface->net_dev->mtu,
-                        ETH_DATA_LEN + BAT_HEADER_LEN);
+                         "The MTU of interface %s is too small (%i) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to %zi would solve the problem.\n",
+                         hard_iface->net_dev->name, hard_iface->net_dev->mtu,
+                         ETH_DATA_LEN + BAT_HEADER_LEN);
 
         if (!atomic_read(&bat_priv->fragmentation) && hard_iface->net_dev->mtu <
                 ETH_DATA_LEN + BAT_HEADER_LEN)
                 bat_info(hard_iface->soft_iface,
-                        "The MTU of interface %s is too small (%i) to handle "
-                        "the transport of batman-adv packets. If you experience"
-                        " problems getting traffic through try increasing the "
-                        "MTU to %zi.\n",
-                        hard_iface->net_dev->name, hard_iface->net_dev->mtu,
-                        ETH_DATA_LEN + BAT_HEADER_LEN);
+                         "The MTU of interface %s is too small (%i) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to %zi.\n",
+                         hard_iface->net_dev->name, hard_iface->net_dev->mtu,
+                         ETH_DATA_LEN + BAT_HEADER_LEN);
 
         if (hardif_is_iface_up(hard_iface))
                 hardif_activate_interface(hard_iface);
         else
-                bat_err(hard_iface->soft_iface, "Not using interface %s "
-                        "(retrying later): interface not active\n",
+                bat_err(hard_iface->soft_iface,
+                        "Not using interface %s (retrying later): interface not active\n",
                         hard_iface->net_dev->name);
 
         /* begin scheduling originator messages on that interface */
@@ -365,6 +352,8 @@ int hardif_enable_interface(struct hard_iface *hard_iface,
 out:
         return 0;
 
+err_dev:
+        dev_put(soft_iface);
 err:
         hardif_free_ref(hard_iface);
         return ret;
@@ -399,8 +388,7 @@ void hardif_disable_interface(struct hard_iface *hard_iface)
                         hardif_free_ref(new_if);
         }
 
-        kfree(hard_iface->packet_buff);
-        hard_iface->packet_buff = NULL;
+        bat_priv->bat_algo_ops->bat_iface_disable(hard_iface);
         hard_iface->if_status = IF_NOT_IN_USE;
 
         /* delete all references to this hard_iface */
@@ -452,6 +440,13 @@ static struct hard_iface *hardif_add_interface(struct net_device *net_dev)
         check_known_mac_addr(hard_iface->net_dev);
         list_add_tail_rcu(&hard_iface->list, &hardif_list);
 
+        /**
+         * This can't be called via a bat_priv callback because
+         * we have no bat_priv yet.
+         */
+        atomic_set(&hard_iface->seqno, 1);
+        hard_iface->packet_buff = NULL;
+
         return hard_iface;
 
 free_if:
@@ -527,15 +522,16 @@ static int hard_if_event(struct notifier_block *this,
                         goto hardif_put;
 
                 check_known_mac_addr(hard_iface->net_dev);
-                bat_ogm_update_mac(hard_iface);
 
                 bat_priv = netdev_priv(hard_iface->soft_iface);
+                bat_priv->bat_algo_ops->bat_iface_update_mac(hard_iface);
+
                 primary_if = primary_if_get_selected(bat_priv);
                 if (!primary_if)
                         goto hardif_put;
 
                 if (hard_iface == primary_if)
-                        primary_if_update_addr(bat_priv);
+                        primary_if_update_addr(bat_priv, NULL);
                 break;
         default:
                 break;
@@ -549,114 +545,6 @@ out:
         return NOTIFY_DONE;
 }
 
-/* incoming packets with the batman ethertype received on any active hard
- * interface */
-static int batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
-                           struct packet_type *ptype,
-                           struct net_device *orig_dev)
-{
-        struct bat_priv *bat_priv;
-        struct batman_ogm_packet *batman_ogm_packet;
-        struct hard_iface *hard_iface;
-        int ret;
-
-        hard_iface = container_of(ptype, struct hard_iface, batman_adv_ptype);
-        skb = skb_share_check(skb, GFP_ATOMIC);
-
-        /* skb was released by skb_share_check() */
-        if (!skb)
-                goto err_out;
-
-        /* packet should hold at least type and version */
-        if (unlikely(!pskb_may_pull(skb, 2)))
-                goto err_free;
-
-        /* expect a valid ethernet header here. */
-        if (unlikely(skb->mac_len != sizeof(struct ethhdr)
-                                || !skb_mac_header(skb)))
-                goto err_free;
-
-        if (!hard_iface->soft_iface)
-                goto err_free;
-
-        bat_priv = netdev_priv(hard_iface->soft_iface);
-
-        if (atomic_read(&bat_priv->mesh_state) != MESH_ACTIVE)
-                goto err_free;
-
-        /* discard frames on not active interfaces */
-        if (hard_iface->if_status != IF_ACTIVE)
-                goto err_free;
-
-        batman_ogm_packet = (struct batman_ogm_packet *)skb->data;
-
-        if (batman_ogm_packet->version != COMPAT_VERSION) {
-                bat_dbg(DBG_BATMAN, bat_priv,
-                        "Drop packet: incompatible batman version (%i)\n",
-                        batman_ogm_packet->version);
-                goto err_free;
-        }
-
-        /* all receive handlers return whether they received or reused
-         * the supplied skb. if not, we have to free the skb. */
-
-        switch (batman_ogm_packet->packet_type) {
-                /* batman originator packet */
-        case BAT_OGM:
-                ret = recv_bat_ogm_packet(skb, hard_iface);
-                break;
-
-                /* batman icmp packet */
-        case BAT_ICMP:
-                ret = recv_icmp_packet(skb, hard_iface);
-                break;
-
-                /* unicast packet */
-        case BAT_UNICAST:
-                ret = recv_unicast_packet(skb, hard_iface);
-                break;
-
-                /* fragmented unicast packet */
-        case BAT_UNICAST_FRAG:
-                ret = recv_ucast_frag_packet(skb, hard_iface);
-                break;
-
-                /* broadcast packet */
-        case BAT_BCAST:
-                ret = recv_bcast_packet(skb, hard_iface);
-                break;
-
-                /* vis packet */
-        case BAT_VIS:
-                ret = recv_vis_packet(skb, hard_iface);
-                break;
-                /* Translation table query (request or response) */
-        case BAT_TT_QUERY:
-                ret = recv_tt_query(skb, hard_iface);
-                break;
-                /* Roaming advertisement */
-        case BAT_ROAM_ADV:
-                ret = recv_roam_adv(skb, hard_iface);
-                break;
-        default:
-                ret = NET_RX_DROP;
-        }
-
-        if (ret == NET_RX_DROP)
-                kfree_skb(skb);
-
-        /* return NET_RX_SUCCESS in any case as we
-         * most probably dropped the packet for
-         * routing-logical reasons. */
-
-        return NET_RX_SUCCESS;
-
-err_free:
-        kfree_skb(skb);
-err_out:
-        return NET_RX_DROP;
-}
-
 /* This function returns true if the interface represented by ifindex is a
  * 802.11 wireless device */
 bool is_wifi_iface(int ifindex)
diff --git a/net/batman-adv/hard-interface.h b/net/batman-adv/hard-interface.h
index 67f78d1a63b4..e68c5655e616 100644
--- a/net/batman-adv/hard-interface.h
+++ b/net/batman-adv/hard-interface.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner, Simon Wunderlich
  *
diff --git a/net/batman-adv/hash.c b/net/batman-adv/hash.c
index d1da29da333b..117687bedf25 100644
--- a/net/batman-adv/hash.c
+++ b/net/batman-adv/hash.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2006-2012 B.A.T.M.A.N. contributors:
  *
  * Simon Wunderlich, Marek Lindner
  *
diff --git a/net/batman-adv/hash.h b/net/batman-adv/hash.h
index 4768717f07f9..d4bd7862719b 100644
--- a/net/batman-adv/hash.h
+++ b/net/batman-adv/hash.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2006-2012 B.A.T.M.A.N. contributors:
  *
  * Simon Wunderlich, Marek Lindner
  *
diff --git a/net/batman-adv/icmp_socket.c b/net/batman-adv/icmp_socket.c
index d9c1e7bb7fbf..2e98a57f3407 100644
--- a/net/batman-adv/icmp_socket.c
+++ b/net/batman-adv/icmp_socket.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner
  *
@@ -59,8 +59,7 @@ static int bat_socket_open(struct inode *inode, struct file *file)
         }
 
         if (i == ARRAY_SIZE(socket_client_hash)) {
-                pr_err("Error - can't add another packet client: "
-                       "maximum number of clients reached\n");
+                pr_err("Error - can't add another packet client: maximum number of clients reached\n");
                 kfree(socket_client);
                 return -EXFULL;
         }
@@ -162,8 +161,7 @@ static ssize_t bat_socket_write(struct file *file, const char __user *buff,
 
         if (len < sizeof(struct icmp_packet)) {
                 bat_dbg(DBG_BATMAN, bat_priv,
-                        "Error - can't send packet from char device: "
-                        "invalid packet size\n");
+                        "Error - can't send packet from char device: invalid packet size\n");
                 return -EINVAL;
         }
 
@@ -177,13 +175,13 @@ static ssize_t bat_socket_write(struct file *file, const char __user *buff,
         if (len >= sizeof(struct icmp_packet_rr))
                 packet_len = sizeof(struct icmp_packet_rr);
 
-        skb = dev_alloc_skb(packet_len + sizeof(struct ethhdr));
+        skb = dev_alloc_skb(packet_len + ETH_HLEN);
         if (!skb) {
                 len = -ENOMEM;
                 goto out;
         }
 
-        skb_reserve(skb, sizeof(struct ethhdr));
+        skb_reserve(skb, ETH_HLEN);
         icmp_packet = (struct icmp_packet_rr *)skb_put(skb, packet_len);
 
         if (copy_from_user(icmp_packet, buff, packet_len)) {
@@ -191,27 +189,25 @@ static ssize_t bat_socket_write(struct file *file, const char __user *buff,
                 goto free_skb;
         }
 
-        if (icmp_packet->packet_type != BAT_ICMP) {
+        if (icmp_packet->header.packet_type != BAT_ICMP) {
                 bat_dbg(DBG_BATMAN, bat_priv,
-                        "Error - can't send packet from char device: "
-                        "got bogus packet type (expected: BAT_ICMP)\n");
+                        "Error - can't send packet from char device: got bogus packet type (expected: BAT_ICMP)\n");
                 len = -EINVAL;
                 goto free_skb;
         }
 
         if (icmp_packet->msg_type != ECHO_REQUEST) {
                 bat_dbg(DBG_BATMAN, bat_priv,
-                        "Error - can't send packet from char device: "
-                        "got bogus message type (expected: ECHO_REQUEST)\n");
+                        "Error - can't send packet from char device: got bogus message type (expected: ECHO_REQUEST)\n");
                 len = -EINVAL;
                 goto free_skb;
         }
 
         icmp_packet->uid = socket_client->index;
 
-        if (icmp_packet->version != COMPAT_VERSION) {
+        if (icmp_packet->header.version != COMPAT_VERSION) {
                 icmp_packet->msg_type = PARAMETER_PROBLEM;
-                icmp_packet->version = COMPAT_VERSION;
+                icmp_packet->header.version = COMPAT_VERSION;
                 bat_socket_add_packet(socket_client, icmp_packet, packet_len);
                 goto free_skb;
         }
diff --git a/net/batman-adv/icmp_socket.h b/net/batman-adv/icmp_socket.h
index 462b190fa101..380ed4c2443a 100644
--- a/net/batman-adv/icmp_socket.h
+++ b/net/batman-adv/icmp_socket.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner
  *
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index fb87bdc2ce9b..083a2993efe4 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner, Simon Wunderlich
  *
@@ -30,21 +30,33 @@
 #include "translation-table.h"
 #include "hard-interface.h"
 #include "gateway_client.h"
+#include "bridge_loop_avoidance.h"
 #include "vis.h"
 #include "hash.h"
+#include "bat_algo.h"
 
 
 /* List manipulations on hardif_list have to be rtnl_lock()'ed,
  * list traversals just rcu-locked */
 struct list_head hardif_list;
+static int (*recv_packet_handler[256])(struct sk_buff *, struct hard_iface *);
+char bat_routing_algo[20] = "BATMAN IV";
+static struct hlist_head bat_algo_list;
 
 unsigned char broadcast_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 
 struct workqueue_struct *bat_event_workqueue;
 
+static void recv_handler_init(void);
+
 static int __init batman_init(void)
 {
         INIT_LIST_HEAD(&hardif_list);
+        INIT_HLIST_HEAD(&bat_algo_list);
+
+        recv_handler_init();
+
+        bat_iv_init();
 
         /* the name should not be longer than 10 chars - see
          * http://lwn.net/Articles/23634/ */
@@ -58,8 +70,8 @@ static int __init batman_init(void)
 
         register_netdevice_notifier(&hard_if_notifier);
 
-        pr_info("B.A.T.M.A.N. advanced %s (compatibility version %i) "
-                "loaded\n", SOURCE_VERSION, COMPAT_VERSION);
+        pr_info("B.A.T.M.A.N. advanced %s (compatibility version %i) loaded\n",
+                SOURCE_VERSION, COMPAT_VERSION);
 
         return 0;
 }
@@ -90,13 +102,10 @@ int mesh_init(struct net_device *soft_iface)
         spin_lock_init(&bat_priv->gw_list_lock);
         spin_lock_init(&bat_priv->vis_hash_lock);
         spin_lock_init(&bat_priv->vis_list_lock);
-        spin_lock_init(&bat_priv->softif_neigh_lock);
-        spin_lock_init(&bat_priv->softif_neigh_vid_lock);
 
         INIT_HLIST_HEAD(&bat_priv->forw_bat_list);
         INIT_HLIST_HEAD(&bat_priv->forw_bcast_list);
         INIT_HLIST_HEAD(&bat_priv->gw_list);
-        INIT_HLIST_HEAD(&bat_priv->softif_neigh_vids);
         INIT_LIST_HEAD(&bat_priv->tt_changes_list);
         INIT_LIST_HEAD(&bat_priv->tt_req_list);
         INIT_LIST_HEAD(&bat_priv->tt_roam_list);
@@ -112,6 +121,9 @@ int mesh_init(struct net_device *soft_iface)
         if (vis_init(bat_priv) < 1)
                 goto err;
 
+        if (bla_init(bat_priv) < 1)
+                goto err;
+
         atomic_set(&bat_priv->gw_reselect, 0);
         atomic_set(&bat_priv->mesh_state, MESH_ACTIVE);
         goto end;
@@ -139,7 +151,7 @@ void mesh_free(struct net_device *soft_iface)
 
         tt_free(bat_priv);
 
-        softif_neigh_purge(bat_priv);
+        bla_free(bat_priv);
 
         atomic_set(&bat_priv->mesh_state, MESH_INACTIVE);
 }
@@ -170,9 +182,224 @@ int is_my_mac(const uint8_t *addr)
         }
         rcu_read_unlock();
         return 0;
+}
+
+static int recv_unhandled_packet(struct sk_buff *skb,
+                                 struct hard_iface *recv_if)
+{
+        return NET_RX_DROP;
+}
+
+/* incoming packets with the batman ethertype received on any active hard
+ * interface
+ */
+int batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
+                    struct packet_type *ptype, struct net_device *orig_dev)
+{
+        struct bat_priv *bat_priv;
+        struct batman_ogm_packet *batman_ogm_packet;
+        struct hard_iface *hard_iface;
+        uint8_t idx;
+        int ret;
+
+        hard_iface = container_of(ptype, struct hard_iface, batman_adv_ptype);
+        skb = skb_share_check(skb, GFP_ATOMIC);
+
+        /* skb was released by skb_share_check() */
+        if (!skb)
+                goto err_out;
+
+        /* packet should hold at least type and version */
+        if (unlikely(!pskb_may_pull(skb, 2)))
+                goto err_free;
+
+        /* expect a valid ethernet header here. */
+        if (unlikely(skb->mac_len != ETH_HLEN || !skb_mac_header(skb)))
+                goto err_free;
+
+        if (!hard_iface->soft_iface)
+                goto err_free;
+
+        bat_priv = netdev_priv(hard_iface->soft_iface);
+
+        if (atomic_read(&bat_priv->mesh_state) != MESH_ACTIVE)
+                goto err_free;
+
+        /* discard frames on not active interfaces */
+        if (hard_iface->if_status != IF_ACTIVE)
+                goto err_free;
+
+        batman_ogm_packet = (struct batman_ogm_packet *)skb->data;
+
+        if (batman_ogm_packet->header.version != COMPAT_VERSION) {
+                bat_dbg(DBG_BATMAN, bat_priv,
+                        "Drop packet: incompatible batman version (%i)\n",
+                        batman_ogm_packet->header.version);
+                goto err_free;
+        }
+
+        /* all receive handlers return whether they received or reused
+         * the supplied skb. if not, we have to free the skb.
+         */
+        idx = batman_ogm_packet->header.packet_type;
+        ret = (*recv_packet_handler[idx])(skb, hard_iface);
+
+        if (ret == NET_RX_DROP)
+                kfree_skb(skb);
+
+        /* return NET_RX_SUCCESS in any case as we
+         * most probably dropped the packet for
+         * routing-logical reasons.
+         */
+        return NET_RX_SUCCESS;
+
+err_free:
+        kfree_skb(skb);
+err_out:
+        return NET_RX_DROP;
+}
+
+static void recv_handler_init(void)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(recv_packet_handler); i++)
+                recv_packet_handler[i] = recv_unhandled_packet;
+
+        /* batman icmp packet */
+        recv_packet_handler[BAT_ICMP] = recv_icmp_packet;
+        /* unicast packet */
+        recv_packet_handler[BAT_UNICAST] = recv_unicast_packet;
+        /* fragmented unicast packet */
+        recv_packet_handler[BAT_UNICAST_FRAG] = recv_ucast_frag_packet;
+        /* broadcast packet */
+        recv_packet_handler[BAT_BCAST] = recv_bcast_packet;
+        /* vis packet */
+        recv_packet_handler[BAT_VIS] = recv_vis_packet;
+        /* Translation table query (request or response) */
+        recv_packet_handler[BAT_TT_QUERY] = recv_tt_query;
+        /* Roaming advertisement */
+        recv_packet_handler[BAT_ROAM_ADV] = recv_roam_adv;
+}
+
+int recv_handler_register(uint8_t packet_type,
+                          int (*recv_handler)(struct sk_buff *,
+                                              struct hard_iface *))
+{
+        if (recv_packet_handler[packet_type] != &recv_unhandled_packet)
+                return -EBUSY;
+
+        recv_packet_handler[packet_type] = recv_handler;
+        return 0;
+}
+
+void recv_handler_unregister(uint8_t packet_type)
+{
+        recv_packet_handler[packet_type] = recv_unhandled_packet;
+}
+
+static struct bat_algo_ops *bat_algo_get(char *name)
+{
+        struct bat_algo_ops *bat_algo_ops = NULL, *bat_algo_ops_tmp;
+        struct hlist_node *node;
+
+        hlist_for_each_entry(bat_algo_ops_tmp, node, &bat_algo_list, list) {
+                if (strcmp(bat_algo_ops_tmp->name, name) != 0)
+                        continue;
+
+                bat_algo_ops = bat_algo_ops_tmp;
+                break;
+        }
+
+        return bat_algo_ops;
+}
+
+int bat_algo_register(struct bat_algo_ops *bat_algo_ops)
+{
+        struct bat_algo_ops *bat_algo_ops_tmp;
+        int ret = -1;
+
+        bat_algo_ops_tmp = bat_algo_get(bat_algo_ops->name);
+        if (bat_algo_ops_tmp) {
+                pr_info("Trying to register already registered routing algorithm: %s\n",
+                        bat_algo_ops->name);
+                goto out;
+        }
+
+        /* all algorithms must implement all ops (for now) */
+        if (!bat_algo_ops->bat_iface_enable ||
+            !bat_algo_ops->bat_iface_disable ||
+            !bat_algo_ops->bat_iface_update_mac ||
+            !bat_algo_ops->bat_primary_iface_set ||
+            !bat_algo_ops->bat_ogm_schedule ||
+            !bat_algo_ops->bat_ogm_emit) {
+                pr_info("Routing algo '%s' does not implement required ops\n",
+                        bat_algo_ops->name);
+                goto out;
+        }
+
+        INIT_HLIST_NODE(&bat_algo_ops->list);
+        hlist_add_head(&bat_algo_ops->list, &bat_algo_list);
+        ret = 0;
+
+out:
+        return ret;
+}
+
+int bat_algo_select(struct bat_priv *bat_priv, char *name)
+{
+        struct bat_algo_ops *bat_algo_ops;
+        int ret = -1;
+
+        bat_algo_ops = bat_algo_get(name);
+        if (!bat_algo_ops)
+                goto out;
+
+        bat_priv->bat_algo_ops = bat_algo_ops;
+        ret = 0;
+
+out:
+        return ret;
+}
+
+int bat_algo_seq_print_text(struct seq_file *seq, void *offset)
+{
+        struct bat_algo_ops *bat_algo_ops;
+        struct hlist_node *node;
+
+        seq_printf(seq, "Available routing algorithms:\n");
+
+        hlist_for_each_entry(bat_algo_ops, node, &bat_algo_list, list) {
+                seq_printf(seq, "%s\n", bat_algo_ops->name);
+        }
+
+        return 0;
+}
+
+static int param_set_ra(const char *val, const struct kernel_param *kp)
+{
+        struct bat_algo_ops *bat_algo_ops;
 
+        bat_algo_ops = bat_algo_get((char *)val);
+        if (!bat_algo_ops) {
+                pr_err("Routing algorithm '%s' is not supported\n", val);
+                return -EINVAL;
+        }
+
+        return param_set_copystring(val, kp);
 }
 
+static const struct kernel_param_ops param_ops_ra = {
+        .set = param_set_ra,
+        .get = param_get_string,
+};
+
+static struct kparam_string __param_string_ra = {
+        .maxlen = sizeof(bat_routing_algo),
+        .string = bat_routing_algo,
+};
+
+module_param_cb(routing_algo, &param_ops_ra, &__param_string_ra, 0644);
 module_init(batman_init);
 module_exit(batman_exit);
 
diff --git a/net/batman-adv/main.h b/net/batman-adv/main.h
index 86354e06eb48..f4a3ec003479 100644
--- a/net/batman-adv/main.h
+++ b/net/batman-adv/main.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner, Simon Wunderlich
  *
@@ -28,7 +28,7 @@
 #define DRIVER_DEVICE "batman-adv"
 
 #ifndef SOURCE_VERSION
-#define SOURCE_VERSION "2012.0.0"
+#define SOURCE_VERSION "2012.2.0"
 #endif
 
 /* B.A.T.M.A.N. parameters */
@@ -41,13 +41,14 @@
 
 /* purge originators after time in seconds if no valid packet comes in
  * -> TODO: check influence on TQ_LOCAL_WINDOW_SIZE */
-#define PURGE_TIMEOUT 200
-#define TT_LOCAL_TIMEOUT 3600 /* in seconds */
-#define TT_CLIENT_ROAM_TIMEOUT 600
+#define PURGE_TIMEOUT 200000 /* 200 seconds */
+#define TT_LOCAL_TIMEOUT 3600000 /* in miliseconds */
+#define TT_CLIENT_ROAM_TIMEOUT 600000 /* in miliseconds */
 /* sliding packet range of received originator messages in sequence numbers
  * (should be a multiple of our word size) */
 #define TQ_LOCAL_WINDOW_SIZE 64
-#define TT_REQUEST_TIMEOUT 3 /* seconds we have to keep pending tt_req */
+#define TT_REQUEST_TIMEOUT 3000 /* miliseconds we have to keep
+                                 * pending tt_req */
 
 #define TQ_GLOBAL_WINDOW_SIZE 5
 #define TQ_LOCAL_BIDRECT_SEND_MINIMUM 1
@@ -56,15 +57,15 @@
 
 #define TT_OGM_APPEND_MAX 3 /* number of OGMs sent with the last tt diff */
 
-#define ROAMING_MAX_TIME 20 /* Time in which a client can roam at most
-                             * ROAMING_MAX_COUNT times */
+#define ROAMING_MAX_TIME 20000 /* Time in which a client can roam at most
+                                * ROAMING_MAX_COUNT times in miliseconds*/
 #define ROAMING_MAX_COUNT 5
 
 #define NO_FLAGS 0
 
 #define NULL_IFINDEX 0 /* dummy ifindex used to avoid iface checks */
 
-#define NUM_WORDS (TQ_LOCAL_WINDOW_SIZE / WORD_BIT_SIZE)
+#define NUM_WORDS BITS_TO_LONGS(TQ_LOCAL_WINDOW_SIZE)
 
 #define LOG_BUF_LEN 8192          /* has to be a power of 2 */
 
@@ -79,8 +80,12 @@
 #define MAX_AGGREGATION_BYTES 512
 #define MAX_AGGREGATION_MS 100
 
-#define SOFTIF_NEIGH_TIMEOUT 180000 /* 3 minutes */
+#define BLA_PERIOD_LENGTH       10000   /* 10 seconds */
+#define BLA_BACKBONE_TIMEOUT    (BLA_PERIOD_LENGTH * 3)
+#define BLA_CLAIM_TIMEOUT       (BLA_PERIOD_LENGTH * 10)
 
+#define DUPLIST_SIZE            16
+#define DUPLIST_TIMEOUT         500     /* 500 ms */
 /* don't reset again within 30 seconds */
 #define RESET_PROTECTION_MS 30000
 #define EXPECTED_SEQNO_RANGE    65536
@@ -106,9 +111,7 @@ enum uev_type {
 
 #define GW_THRESHOLD    50
 
-/*
- * Debug Messages
- */
+/* Debug Messages */
 #ifdef pr_fmt
 #undef pr_fmt
 #endif
@@ -120,17 +123,11 @@ enum dbg_level {
         DBG_BATMAN = 1 << 0,
         DBG_ROUTES = 1 << 1, /* route added / changed / deleted */
         DBG_TT     = 1 << 2, /* translation table operations */
-        DBG_ALL    = 7
+        DBG_BLA    = 1 << 3, /* bridge loop avoidance */
+        DBG_ALL    = 15
 };
 
-
-/*
- *  Vis
- */
-
-/*
- * Kernel headers
- */
+/* Kernel headers */
 
 #include <linux/mutex.h>        /* mutex */
 #include <linux/module.h>       /* needed by all modules */
@@ -147,6 +144,7 @@ enum dbg_level {
 #include <linux/seq_file.h>
 #include "types.h"
 
+extern char bat_routing_algo[];
 extern struct list_head hardif_list;
 
 extern unsigned char broadcast_addr[];
@@ -157,6 +155,15 @@ void mesh_free(struct net_device *soft_iface);
 void inc_module_count(void);
 void dec_module_count(void);
 int is_my_mac(const uint8_t *addr);
+int batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
+                    struct packet_type *ptype, struct net_device *orig_dev);
+int recv_handler_register(uint8_t packet_type,
+                          int (*recv_handler)(struct sk_buff *,
+                                              struct hard_iface *));
+void recv_handler_unregister(uint8_t packet_type);
+int bat_algo_register(struct bat_algo_ops *bat_algo_ops);
+int bat_algo_select(struct bat_priv *bat_priv, char *name);
+int bat_algo_seq_print_text(struct seq_file *seq, void *offset);
 
 #ifdef CONFIG_BATMAN_ADV_DEBUG
 int debug_log(struct bat_priv *bat_priv, const char *fmt, ...) __printf(2, 3);
@@ -202,6 +209,17 @@ static inline int compare_eth(const void *data1, const void *data2)
         return (memcmp(data1, data2, ETH_ALEN) == 0 ? 1 : 0);
 }
 
+/**
+ * has_timed_out - compares current time (jiffies) and timestamp + timeout
+ * @timestamp:          base value to compare with (in jiffies)
+ * @timeout:            added to base value before comparing (in milliseconds)
+ *
+ * Returns true if current time is after timestamp + timeout
+ */
+static inline bool has_timed_out(unsigned long timestamp, unsigned int timeout)
+{
+        return time_is_before_jiffies(timestamp + msecs_to_jiffies(timeout));
+}
 
 #define atomic_dec_not_zero(v)  atomic_add_unless((v), -1, 0)
 
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 0bc2045a2f2e..41147942ba53 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2009-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner, Simon Wunderlich
  *
@@ -28,13 +28,15 @@
 #include "hard-interface.h"
 #include "unicast.h"
 #include "soft-interface.h"
+#include "bridge_loop_avoidance.h"
 
 static void purge_orig(struct work_struct *work);
 
 static void start_purge_timer(struct bat_priv *bat_priv)
 {
         INIT_DELAYED_WORK(&bat_priv->orig_work, purge_orig);
-        queue_delayed_work(bat_event_workqueue, &bat_priv->orig_work, 1 * HZ);
+        queue_delayed_work(bat_event_workqueue,
+                           &bat_priv->orig_work, msecs_to_jiffies(1000));
 }
 
 /* returns 1 if they are the same originator */
@@ -83,35 +85,30 @@ struct neigh_node *orig_node_get_router(struct orig_node *orig_node)
         return router;
 }
 
-struct neigh_node *create_neighbor(struct orig_node *orig_node,
-                                   struct orig_node *orig_neigh_node,
-                                   const uint8_t *neigh,
-                                   struct hard_iface *if_incoming)
+struct neigh_node *batadv_neigh_node_new(struct hard_iface *hard_iface,
+                                         const uint8_t *neigh_addr,
+                                         uint32_t seqno)
 {
-        struct bat_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
+        struct bat_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         struct neigh_node *neigh_node;
 
-        bat_dbg(DBG_BATMAN, bat_priv,
-                "Creating new last-hop neighbor of originator\n");
-
         neigh_node = kzalloc(sizeof(*neigh_node), GFP_ATOMIC);
         if (!neigh_node)
-                return NULL;
+                goto out;
 
         INIT_HLIST_NODE(&neigh_node->list);
-        INIT_LIST_HEAD(&neigh_node->bonding_list);
-        spin_lock_init(&neigh_node->tq_lock);
 
-        memcpy(neigh_node->addr, neigh, ETH_ALEN);
-        neigh_node->orig_node = orig_neigh_node;
-        neigh_node->if_incoming = if_incoming;
+        memcpy(neigh_node->addr, neigh_addr, ETH_ALEN);
+        spin_lock_init(&neigh_node->lq_update_lock);
 
         /* extra reference for return */
         atomic_set(&neigh_node->refcount, 2);
 
-        spin_lock_bh(&orig_node->neigh_list_lock);
-        hlist_add_head_rcu(&neigh_node->list, &orig_node->neigh_list);
-        spin_unlock_bh(&orig_node->neigh_list_lock);
+        bat_dbg(DBG_BATMAN, bat_priv,
+                "Creating new neighbor %pM, initial seqno %d\n",
+                neigh_addr, seqno);
+
+out:
         return neigh_node;
 }
 
@@ -143,7 +140,7 @@ static void orig_node_free_rcu(struct rcu_head *rcu)
 
         frag_list_free(&orig_node->frag_list);
         tt_global_del_orig(orig_node->bat_priv, orig_node,
-                            "originator timed out");
+                           "originator timed out");
 
         kfree(orig_node->tt_buff);
         kfree(orig_node->bcast_own);
@@ -219,6 +216,7 @@ struct orig_node *get_orig_node(struct bat_priv *bat_priv, const uint8_t *addr)
         /* extra reference for return */
         atomic_set(&orig_node->refcount, 2);
 
+        orig_node->tt_initialised = false;
         orig_node->tt_poss_change = false;
         orig_node->bat_priv = bat_priv;
         memcpy(orig_node->orig, addr, ETH_ALEN);
@@ -272,6 +270,7 @@ static bool purge_orig_neighbors(struct bat_priv *bat_priv,
         struct hlist_node *node, *node_tmp;
         struct neigh_node *neigh_node;
         bool neigh_purged = false;
+        unsigned long last_seen;
 
         *best_neigh_node = NULL;
 
@@ -281,12 +280,13 @@ static bool purge_orig_neighbors(struct bat_priv *bat_priv,
         hlist_for_each_entry_safe(neigh_node, node, node_tmp,
                                   &orig_node->neigh_list, list) {
 
-                if ((time_after(jiffies,
-                        neigh_node->last_valid + PURGE_TIMEOUT * HZ)) ||
+                if ((has_timed_out(neigh_node->last_seen, PURGE_TIMEOUT)) ||
                     (neigh_node->if_incoming->if_status == IF_INACTIVE) ||
                     (neigh_node->if_incoming->if_status == IF_NOT_IN_USE) ||
                     (neigh_node->if_incoming->if_status == IF_TO_BE_REMOVED)) {
 
+                        last_seen = neigh_node->last_seen;
+
                         if ((neigh_node->if_incoming->if_status ==
                                                                 IF_INACTIVE) ||
                             (neigh_node->if_incoming->if_status ==
@@ -294,16 +294,14 @@ static bool purge_orig_neighbors(struct bat_priv *bat_priv,
                             (neigh_node->if_incoming->if_status ==
                                                         IF_TO_BE_REMOVED))
                                 bat_dbg(DBG_BATMAN, bat_priv,
-                                        "neighbor purge: originator %pM, "
-                                        "neighbor: %pM, iface: %s\n",
+                                        "neighbor purge: originator %pM, neighbor: %pM, iface: %s\n",
                                         orig_node->orig, neigh_node->addr,
                                         neigh_node->if_incoming->net_dev->name);
                         else
                                 bat_dbg(DBG_BATMAN, bat_priv,
-                                        "neighbor timeout: originator %pM, "
-                                        "neighbor: %pM, last_valid: %lu\n",
+                                        "neighbor timeout: originator %pM, neighbor: %pM, last_seen: %u\n",
                                         orig_node->orig, neigh_node->addr,
-                                        (neigh_node->last_valid / HZ));
+                                        jiffies_to_msecs(last_seen));
 
                         neigh_purged = true;
 
@@ -326,18 +324,16 @@ static bool purge_orig_node(struct bat_priv *bat_priv,
 {
         struct neigh_node *best_neigh_node;
 
-        if (time_after(jiffies,
-                orig_node->last_valid + 2 * PURGE_TIMEOUT * HZ)) {
-
+        if (has_timed_out(orig_node->last_seen, 2 * PURGE_TIMEOUT)) {
                 bat_dbg(DBG_BATMAN, bat_priv,
-                        "Originator timeout: originator %pM, last_valid %lu\n",
-                        orig_node->orig, (orig_node->last_valid / HZ));
+                        "Originator timeout: originator %pM, last_seen %u\n",
+                        orig_node->orig,
+                        jiffies_to_msecs(orig_node->last_seen));
                 return true;
         } else {
                 if (purge_orig_neighbors(bat_priv, orig_node,
-                                                        &best_neigh_node)) {
+                                         &best_neigh_node))
                         update_route(bat_priv, orig_node, best_neigh_node);
-                }
         }
 
         return false;
@@ -371,8 +367,8 @@ static void _purge_orig(struct bat_priv *bat_priv)
                                 continue;
                         }
 
-                        if (time_after(jiffies, orig_node->last_frag_packet +
-                                                msecs_to_jiffies(FRAG_TIMEOUT)))
+                        if (has_timed_out(orig_node->last_frag_packet,
+                                          FRAG_TIMEOUT))
                                 frag_list_free(&orig_node->frag_list);
                 }
                 spin_unlock_bh(list_lock);
@@ -380,8 +376,6 @@ static void _purge_orig(struct bat_priv *bat_priv)
 
         gw_node_purge(bat_priv);
         gw_election(bat_priv);
-
-        softif_neigh_purge(bat_priv);
 }
 
 static void purge_orig(struct work_struct *work)
@@ -419,15 +413,15 @@ int orig_seq_print_text(struct seq_file *seq, void *offset)
         primary_if = primary_if_get_selected(bat_priv);
 
         if (!primary_if) {
-                ret = seq_printf(seq, "BATMAN mesh %s disabled - "
-                                 "please specify interfaces to enable it\n",
+                ret = seq_printf(seq,
+                                 "BATMAN mesh %s disabled - please specify interfaces to enable it\n",
                                  net_dev->name);
                 goto out;
         }
 
         if (primary_if->if_status != IF_ACTIVE) {
-                ret = seq_printf(seq, "BATMAN mesh %s "
-                                 "disabled - primary interface not active\n",
+                ret = seq_printf(seq,
+                                 "BATMAN mesh %s disabled - primary interface not active\n",
                                  net_dev->name);
                 goto out;
         }
@@ -452,9 +446,9 @@ int orig_seq_print_text(struct seq_file *seq, void *offset)
                                 goto next;
 
                         last_seen_secs = jiffies_to_msecs(jiffies -
-                                                orig_node->last_valid) / 1000;
+                                                orig_node->last_seen) / 1000;
                         last_seen_msecs = jiffies_to_msecs(jiffies -
-                                                orig_node->last_valid) % 1000;
+                                                orig_node->last_seen) % 1000;
 
                         seq_printf(seq, "%pM %4i.%03is   (%3i) %pM [%10s]:",
                                    orig_node->orig, last_seen_secs,
diff --git a/net/batman-adv/originator.h b/net/batman-adv/originator.h
index 67765ffef731..f74d0d693359 100644
--- a/net/batman-adv/originator.h
+++ b/net/batman-adv/originator.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner, Simon Wunderlich
  *
@@ -29,10 +29,9 @@ void originator_free(struct bat_priv *bat_priv);
 void purge_orig_ref(struct bat_priv *bat_priv);
 void orig_node_free_ref(struct orig_node *orig_node);
 struct orig_node *get_orig_node(struct bat_priv *bat_priv, const uint8_t *addr);
-struct neigh_node *create_neighbor(struct orig_node *orig_node,
-                                   struct orig_node *orig_neigh_node,
-                                   const uint8_t *neigh,
-                                   struct hard_iface *if_incoming);
+struct neigh_node *batadv_neigh_node_new(struct hard_iface *hard_iface,
+                                         const uint8_t *neigh_addr,
+                                         uint32_t seqno);
 void neigh_node_free_ref(struct neigh_node *neigh_node);
 struct neigh_node *orig_node_get_router(struct orig_node *orig_node);
 int orig_seq_print_text(struct seq_file *seq, void *offset);
diff --git a/net/batman-adv/packet.h b/net/batman-adv/packet.h
index 4d9e54c57a36..0ee1af770798 100644
--- a/net/batman-adv/packet.h
+++ b/net/batman-adv/packet.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner, Simon Wunderlich
  *
@@ -25,7 +25,7 @@
 #define ETH_P_BATMAN  0x4305    /* unofficial/not registered Ethertype */
 
 enum bat_packettype {
-        BAT_OGM          = 0x01,
+        BAT_IV_OGM       = 0x01,
         BAT_ICMP         = 0x02,
         BAT_UNICAST      = 0x03,
         BAT_BCAST        = 0x04,
@@ -38,7 +38,8 @@ enum bat_packettype {
 /* this file is included by batctl which needs these defines */
 #define COMPAT_VERSION 14
 
-enum batman_flags {
+enum batman_iv_flags {
+        NOT_BEST_NEXT_HOP   = 1 << 3,
         PRIMARIES_FIRST_HOP = 1 << 4,
         VIS_SERVER          = 1 << 5,
         DIRECTLINK          = 1 << 6
@@ -90,14 +91,35 @@ enum tt_client_flags {
         TT_CLIENT_PENDING = 1 << 10
 };
 
-struct batman_ogm_packet {
+/* claim frame types for the bridge loop avoidance */
+enum bla_claimframe {
+        CLAIM_TYPE_ADD          = 0x00,
+        CLAIM_TYPE_DEL          = 0x01,
+        CLAIM_TYPE_ANNOUNCE     = 0x02,
+        CLAIM_TYPE_REQUEST      = 0x03
+};
+
+/* the destination hardware field in the ARP frame is used to
+ * transport the claim type and the group id
+ */
+struct bla_claim_dst {
+        uint8_t magic[3];       /* FF:43:05 */
+        uint8_t type;           /* bla_claimframe */
+        uint16_t group;         /* group id */
+} __packed;
+
+struct batman_header {
         uint8_t  packet_type;
         uint8_t  version;  /* batman version field */
         uint8_t  ttl;
+} __packed;
+
+struct batman_ogm_packet {
+        struct batman_header header;
         uint8_t  flags;    /* 0x40: DIRECTLINK flag, 0x20 VIS_SERVER flag... */
         uint32_t seqno;
-        uint8_t  orig[6];
-        uint8_t  prev_sender[6];
+        uint8_t  orig[ETH_ALEN];
+        uint8_t  prev_sender[ETH_ALEN];
         uint8_t  gw_flags;  /* flags related to gateway class */
         uint8_t  tq;
         uint8_t  tt_num_changes;
@@ -105,15 +127,13 @@ struct batman_ogm_packet {
         uint16_t tt_crc;
 } __packed;
 
-#define BATMAN_OGM_LEN sizeof(struct batman_ogm_packet)
+#define BATMAN_OGM_HLEN sizeof(struct batman_ogm_packet)
 
 struct icmp_packet {
-        uint8_t  packet_type;
-        uint8_t  version;  /* batman version field */
-        uint8_t  ttl;
+        struct batman_header header;
         uint8_t  msg_type; /* see ICMP message types above */
-        uint8_t  dst[6];
-        uint8_t  orig[6];
+        uint8_t  dst[ETH_ALEN];
+        uint8_t  orig[ETH_ALEN];
         uint16_t seqno;
         uint8_t  uid;
         uint8_t  reserved;
@@ -124,12 +144,10 @@ struct icmp_packet {
 /* icmp_packet_rr must start with all fields from imcp_packet
  * as this is assumed by code that handles ICMP packets */
 struct icmp_packet_rr {
-        uint8_t  packet_type;
-        uint8_t  version;  /* batman version field */
-        uint8_t  ttl;
+        struct batman_header header;
         uint8_t  msg_type; /* see ICMP message types above */
-        uint8_t  dst[6];
-        uint8_t  orig[6];
+        uint8_t  dst[ETH_ALEN];
+        uint8_t  orig[ETH_ALEN];
         uint16_t seqno;
         uint8_t  uid;
         uint8_t  rr_cur;
@@ -137,51 +155,41 @@ struct icmp_packet_rr {
 } __packed;
 
 struct unicast_packet {
-        uint8_t  packet_type;
-        uint8_t  version;  /* batman version field */
-        uint8_t  ttl;
+        struct batman_header header;
         uint8_t  ttvn; /* destination translation table version number */
-        uint8_t  dest[6];
+        uint8_t  dest[ETH_ALEN];
 } __packed;
 
 struct unicast_frag_packet {
-        uint8_t  packet_type;
-        uint8_t  version;  /* batman version field */
-        uint8_t  ttl;
+        struct batman_header header;
         uint8_t  ttvn; /* destination translation table version number */
-        uint8_t  dest[6];
+        uint8_t  dest[ETH_ALEN];
         uint8_t  flags;
         uint8_t  align;
-        uint8_t  orig[6];
+        uint8_t  orig[ETH_ALEN];
         uint16_t seqno;
 } __packed;
 
 struct bcast_packet {
-        uint8_t  packet_type;
-        uint8_t  version;  /* batman version field */
-        uint8_t  ttl;
+        struct batman_header header;
         uint8_t  reserved;
         uint32_t seqno;
-        uint8_t  orig[6];
+        uint8_t  orig[ETH_ALEN];
 } __packed;
 
 struct vis_packet {
-        uint8_t  packet_type;
-        uint8_t  version;        /* batman version field */
-        uint8_t  ttl;            /* TTL */
+        struct batman_header header;
         uint8_t  vis_type;       /* which type of vis-participant sent this? */
         uint32_t seqno;          /* sequence number */
         uint8_t  entries;        /* number of entries behind this struct */
         uint8_t  reserved;
-        uint8_t  vis_orig[6];    /* originator that announces its neighbors */
-        uint8_t  target_orig[6]; /* who should receive this packet */
-        uint8_t  sender_orig[6]; /* who sent or rebroadcasted this packet */
+        uint8_t  vis_orig[ETH_ALEN];    /* originator reporting its neighbors */
+        uint8_t  target_orig[ETH_ALEN]; /* who should receive this packet */
+        uint8_t  sender_orig[ETH_ALEN]; /* who sent or forwarded this packet */
 } __packed;
 
 struct tt_query_packet {
-        uint8_t  packet_type;
-        uint8_t  version;  /* batman version field */
-        uint8_t  ttl;
+        struct batman_header header;
         /* the flag field is a combination of:
          * - TT_REQUEST or TT_RESPONSE
          * - TT_FULL_TABLE */
@@ -202,9 +210,7 @@ struct tt_query_packet {
 } __packed;
 
 struct roam_adv_packet {
-        uint8_t  packet_type;
-        uint8_t  version;
-        uint8_t  ttl;
+        struct batman_header header;
         uint8_t  reserved;
         uint8_t  dst[ETH_ALEN];
         uint8_t  src[ETH_ALEN];
diff --git a/net/batman-adv/ring_buffer.c b/net/batman-adv/ring_buffer.c
index f1ccfa76ce8a..fd63951d118d 100644
--- a/net/batman-adv/ring_buffer.c
+++ b/net/batman-adv/ring_buffer.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner
  *
diff --git a/net/batman-adv/ring_buffer.h b/net/batman-adv/ring_buffer.h
index 7cdfe62b657c..8b58bd82767d 100644
--- a/net/batman-adv/ring_buffer.h
+++ b/net/batman-adv/ring_buffer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner
  *
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 773e606f9702..840e2c64a301 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner, Simon Wunderlich
  *
@@ -29,7 +29,10 @@
 #include "originator.h"
 #include "vis.h"
 #include "unicast.h"
-#include "bat_ogm.h"
+#include "bridge_loop_avoidance.h"
+
+static int route_unicast_packet(struct sk_buff *skb,
+                                struct hard_iface *recv_if);
 
 void slide_own_bcast_window(struct hard_iface *hard_iface)
 {
@@ -53,7 +56,7 @@ void slide_own_bcast_window(struct hard_iface *hard_iface)
 
                         bit_get_packet(bat_priv, word, 1, 0);
                         orig_node->bcast_own_sum[hard_iface->if_num] =
-                                bit_packet_count(word);
+                                bitmap_weight(word, TQ_LOCAL_WINDOW_SIZE);
                         spin_unlock_bh(&orig_node->ogm_cnt_lock);
                 }
                 rcu_read_unlock();
@@ -73,7 +76,7 @@ static void _update_route(struct bat_priv *bat_priv,
                 bat_dbg(DBG_ROUTES, bat_priv, "Deleting route towards: %pM\n",
                         orig_node->orig);
                 tt_global_del_orig(bat_priv, orig_node,
-                                    "Deleted route towards originator");
+                                   "Deleted route towards originator");
 
         /* route added */
         } else if ((!curr_router) && (neigh_node)) {
@@ -84,8 +87,7 @@ static void _update_route(struct bat_priv *bat_priv,
         /* route changed */
         } else if (neigh_node && curr_router) {
                 bat_dbg(DBG_ROUTES, bat_priv,
-                        "Changing route towards: %pM "
-                        "(now via %pM - was via %pM)\n",
+                        "Changing route towards: %pM (now via %pM - was via %pM)\n",
                         orig_node->orig, neigh_node->addr,
                         curr_router->addr);
         }
@@ -230,54 +232,48 @@ void bonding_save_primary(const struct orig_node *orig_node,
 int window_protected(struct bat_priv *bat_priv, int32_t seq_num_diff,
                      unsigned long *last_reset)
 {
-        if ((seq_num_diff <= -TQ_LOCAL_WINDOW_SIZE)
-                || (seq_num_diff >= EXPECTED_SEQNO_RANGE)) {
-                if (time_after(jiffies, *last_reset +
-                        msecs_to_jiffies(RESET_PROTECTION_MS))) {
-
-                        *last_reset = jiffies;
-                        bat_dbg(DBG_BATMAN, bat_priv,
-                                "old packet received, start protection\n");
-
-                        return 0;
-                } else
+        if ((seq_num_diff <= -TQ_LOCAL_WINDOW_SIZE) ||
+            (seq_num_diff >= EXPECTED_SEQNO_RANGE)) {
+                if (!has_timed_out(*last_reset, RESET_PROTECTION_MS))
                         return 1;
+
+                *last_reset = jiffies;
+                bat_dbg(DBG_BATMAN, bat_priv,
+                        "old packet received, start protection\n");
         }
+
         return 0;
 }
 
-int recv_bat_ogm_packet(struct sk_buff *skb, struct hard_iface *hard_iface)
+bool check_management_packet(struct sk_buff *skb,
+                             struct hard_iface *hard_iface,
+                             int header_len)
 {
         struct ethhdr *ethhdr;
 
         /* drop packet if it has not necessary minimum size */
-        if (unlikely(!pskb_may_pull(skb, BATMAN_OGM_LEN)))
-                return NET_RX_DROP;
+        if (unlikely(!pskb_may_pull(skb, header_len)))
+                return false;
 
         ethhdr = (struct ethhdr *)skb_mac_header(skb);
 
         /* packet with broadcast indication but unicast recipient */
         if (!is_broadcast_ether_addr(ethhdr->h_dest))
-                return NET_RX_DROP;
+                return false;
 
         /* packet with broadcast sender address */
         if (is_broadcast_ether_addr(ethhdr->h_source))
-                return NET_RX_DROP;
+                return false;
 
         /* create a copy of the skb, if needed, to modify it. */
         if (skb_cow(skb, 0) < 0)
-                return NET_RX_DROP;
+                return false;
 
         /* keep skb linear */
         if (skb_linearize(skb) < 0)
-                return NET_RX_DROP;
-
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
+                return false;
 
-        bat_ogm_receive(ethhdr, skb->data, skb_headlen(skb), hard_iface);
-
-        kfree_skb(skb);
-        return NET_RX_SUCCESS;
+        return true;
 }
 
 static int recv_my_icmp_packet(struct bat_priv *bat_priv,
@@ -312,7 +308,7 @@ static int recv_my_icmp_packet(struct bat_priv *bat_priv,
                 goto out;
 
         /* create a copy of the skb, if needed, to modify it. */
-        if (skb_cow(skb, sizeof(struct ethhdr)) < 0)
+        if (skb_cow(skb, ETH_HLEN) < 0)
                 goto out;
 
         icmp_packet = (struct icmp_packet_rr *)skb->data;
@@ -320,7 +316,7 @@ static int recv_my_icmp_packet(struct bat_priv *bat_priv,
         memcpy(icmp_packet->dst, icmp_packet->orig, ETH_ALEN);
         memcpy(icmp_packet->orig, primary_if->net_dev->dev_addr, ETH_ALEN);
         icmp_packet->msg_type = ECHO_REPLY;
-        icmp_packet->ttl = TTL;
+        icmp_packet->header.ttl = TTL;
 
         send_skb_packet(skb, router->if_incoming, router->addr);
         ret = NET_RX_SUCCESS;
@@ -348,9 +344,8 @@ static int recv_icmp_ttl_exceeded(struct bat_priv *bat_priv,
 
         /* send TTL exceeded if packet is an echo request (traceroute) */
         if (icmp_packet->msg_type != ECHO_REQUEST) {
-                pr_debug("Warning - can't forward icmp packet from %pM to "
-                         "%pM: ttl exceeded\n", icmp_packet->orig,
-                         icmp_packet->dst);
+                pr_debug("Warning - can't forward icmp packet from %pM to %pM: ttl exceeded\n",
+                         icmp_packet->orig, icmp_packet->dst);
                 goto out;
         }
 
@@ -368,7 +363,7 @@ static int recv_icmp_ttl_exceeded(struct bat_priv *bat_priv,
                 goto out;
 
         /* create a copy of the skb, if needed, to modify it. */
-        if (skb_cow(skb, sizeof(struct ethhdr)) < 0)
+        if (skb_cow(skb, ETH_HLEN) < 0)
                 goto out;
 
         icmp_packet = (struct icmp_packet *)skb->data;
@@ -376,7 +371,7 @@ static int recv_icmp_ttl_exceeded(struct bat_priv *bat_priv,
         memcpy(icmp_packet->dst, icmp_packet->orig, ETH_ALEN);
         memcpy(icmp_packet->orig, primary_if->net_dev->dev_addr, ETH_ALEN);
         icmp_packet->msg_type = TTL_EXCEEDED;
-        icmp_packet->ttl = TTL;
+        icmp_packet->header.ttl = TTL;
 
         send_skb_packet(skb, router->if_incoming, router->addr);
         ret = NET_RX_SUCCESS;
@@ -432,7 +427,7 @@ int recv_icmp_packet(struct sk_buff *skb, struct hard_iface *recv_if)
         if ((hdr_size == sizeof(struct icmp_packet_rr)) &&
             (icmp_packet->rr_cur < BAT_RR_LEN)) {
                 memcpy(&(icmp_packet->rr[icmp_packet->rr_cur]),
-                        ethhdr->h_dest, ETH_ALEN);
+                       ethhdr->h_dest, ETH_ALEN);
                 icmp_packet->rr_cur++;
         }
 
@@ -441,7 +436,7 @@ int recv_icmp_packet(struct sk_buff *skb, struct hard_iface *recv_if)
                 return recv_my_icmp_packet(bat_priv, skb, hdr_size);
 
         /* TTL exceeded */
-        if (icmp_packet->ttl < 2)
+        if (icmp_packet->header.ttl < 2)
                 return recv_icmp_ttl_exceeded(bat_priv, skb);
 
         /* get routing information */
@@ -454,13 +449,13 @@ int recv_icmp_packet(struct sk_buff *skb, struct hard_iface *recv_if)
                 goto out;
 
         /* create a copy of the skb, if needed, to modify it. */
-        if (skb_cow(skb, sizeof(struct ethhdr)) < 0)
+        if (skb_cow(skb, ETH_HLEN) < 0)
                 goto out;
 
         icmp_packet = (struct icmp_packet_rr *)skb->data;
 
         /* decrement ttl */
-        icmp_packet->ttl--;
+        icmp_packet->header.ttl--;
 
         /* route it */
         send_skb_packet(skb, router->if_incoming, router->addr);
@@ -673,13 +668,20 @@ int recv_roam_adv(struct sk_buff *skb, struct hard_iface *recv_if)
         if (!is_my_mac(roam_adv_packet->dst))
                 return route_unicast_packet(skb, recv_if);
 
+        /* check if it is a backbone gateway. we don't accept
+         * roaming advertisement from it, as it has the same
+         * entries as we have.
+         */
+        if (bla_is_backbone_gw_orig(bat_priv, roam_adv_packet->src))
+                goto out;
+
         orig_node = orig_hash_find(bat_priv, roam_adv_packet->src);
         if (!orig_node)
                 goto out;
 
-        bat_dbg(DBG_TT, bat_priv, "Received ROAMING_ADV from %pM "
-                "(client %pM)\n", roam_adv_packet->src,
-                roam_adv_packet->client);
+        bat_dbg(DBG_TT, bat_priv,
+                "Received ROAMING_ADV from %pM (client %pM)\n",
+                roam_adv_packet->src, roam_adv_packet->client);
 
         tt_global_add(bat_priv, orig_node, roam_adv_packet->client,
                       atomic_read(&orig_node->last_ttvn) + 1, true, false);
@@ -802,7 +804,7 @@ static int check_unicast_packet(struct sk_buff *skb, int hdr_size)
         return 0;
 }
 
-int route_unicast_packet(struct sk_buff *skb, struct hard_iface *recv_if)
+static int route_unicast_packet(struct sk_buff *skb, struct hard_iface *recv_if)
 {
         struct bat_priv *bat_priv = netdev_priv(recv_if->soft_iface);
         struct orig_node *orig_node = NULL;
@@ -815,10 +817,9 @@ int route_unicast_packet(struct sk_buff *skb, struct hard_iface *recv_if)
         unicast_packet = (struct unicast_packet *)skb->data;
 
         /* TTL exceeded */
-        if (unicast_packet->ttl < 2) {
-                pr_debug("Warning - can't forward unicast packet from %pM to "
-                         "%pM: ttl exceeded\n", ethhdr->h_source,
-                         unicast_packet->dest);
+        if (unicast_packet->header.ttl < 2) {
+                pr_debug("Warning - can't forward unicast packet from %pM to %pM: ttl exceeded\n",
+                         ethhdr->h_source, unicast_packet->dest);
                 goto out;
         }
 
@@ -835,12 +836,12 @@ int route_unicast_packet(struct sk_buff *skb, struct hard_iface *recv_if)
                 goto out;
 
         /* create a copy of the skb, if needed, to modify it. */
-        if (skb_cow(skb, sizeof(struct ethhdr)) < 0)
+        if (skb_cow(skb, ETH_HLEN) < 0)
                 goto out;
 
         unicast_packet = (struct unicast_packet *)skb->data;
 
-        if (unicast_packet->packet_type == BAT_UNICAST &&
+        if (unicast_packet->header.packet_type == BAT_UNICAST &&
             atomic_read(&bat_priv->fragmentation) &&
             skb->len > neigh_node->if_incoming->net_dev->mtu) {
                 ret = frag_send_skb(skb, bat_priv,
@@ -848,7 +849,7 @@ int route_unicast_packet(struct sk_buff *skb, struct hard_iface *recv_if)
                 goto out;
         }
 
-        if (unicast_packet->packet_type == BAT_UNICAST_FRAG &&
+        if (unicast_packet->header.packet_type == BAT_UNICAST_FRAG &&
             frag_can_reassemble(skb, neigh_node->if_incoming->net_dev->mtu)) {
 
                 ret = frag_reassemble_skb(skb, bat_priv, &new_skb);
@@ -867,7 +868,7 @@ int route_unicast_packet(struct sk_buff *skb, struct hard_iface *recv_if)
         }
 
         /* decrement ttl */
-        unicast_packet->ttl--;
+        unicast_packet->header.ttl--;
 
         /* route it */
         send_skb_packet(skb, neigh_node->if_incoming, neigh_node->addr);
@@ -912,12 +913,20 @@ static int check_unicast_ttvn(struct bat_priv *bat_priv,
 
         /* Check whether I have to reroute the packet */
         if (seq_before(unicast_packet->ttvn, curr_ttvn) || tt_poss_change) {
-                /* Linearize the skb before accessing it */
-                if (skb_linearize(skb) < 0)
+                /* check if there is enough data before accessing it */
+                if (pskb_may_pull(skb, sizeof(struct unicast_packet) +
+                                  ETH_HLEN) < 0)
                         return 0;
 
                 ethhdr = (struct ethhdr *)(skb->data +
                         sizeof(struct unicast_packet));
+
+                /* we don't have an updated route for this client, so we should
+                 * not try to reroute the packet!!
+                 */
+                if (tt_global_client_is_roaming(bat_priv, ethhdr->h_dest))
+                        return 1;
+
                 orig_node = transtable_search(bat_priv, NULL, ethhdr->h_dest);
 
                 if (!orig_node) {
@@ -937,10 +946,10 @@ static int check_unicast_ttvn(struct bat_priv *bat_priv,
                         orig_node_free_ref(orig_node);
                 }
 
-                bat_dbg(DBG_ROUTES, bat_priv, "TTVN mismatch (old_ttvn %u "
-                        "new_ttvn %u)! Rerouting unicast packet (for %pM) to "
-                        "%pM\n", unicast_packet->ttvn, curr_ttvn,
-                        ethhdr->h_dest, unicast_packet->dest);
+                bat_dbg(DBG_ROUTES, bat_priv,
+                        "TTVN mismatch (old_ttvn %u new_ttvn %u)! Rerouting unicast packet (for %pM) to %pM\n",
+                        unicast_packet->ttvn, curr_ttvn, ethhdr->h_dest,
+                        unicast_packet->dest);
 
                 unicast_packet->ttvn = curr_ttvn;
         }
@@ -1041,7 +1050,7 @@ int recv_bcast_packet(struct sk_buff *skb, struct hard_iface *recv_if)
         if (is_my_mac(bcast_packet->orig))
                 goto out;
 
-        if (bcast_packet->ttl < 2)
+        if (bcast_packet->header.ttl < 2)
                 goto out;
 
         orig_node = orig_hash_find(bat_priv, bcast_packet->orig);
@@ -1052,8 +1061,8 @@ int recv_bcast_packet(struct sk_buff *skb, struct hard_iface *recv_if)
         spin_lock_bh(&orig_node->bcast_seqno_lock);
 
         /* check whether the packet is a duplicate */
-        if (get_bit_status(orig_node->bcast_bits, orig_node->last_bcast_seqno,
-                           ntohl(bcast_packet->seqno)))
+        if (bat_test_bit(orig_node->bcast_bits, orig_node->last_bcast_seqno,
+                         ntohl(bcast_packet->seqno)))
                 goto spin_unlock;
 
         seq_diff = ntohl(bcast_packet->seqno) - orig_node->last_bcast_seqno;
@@ -1070,9 +1079,19 @@ int recv_bcast_packet(struct sk_buff *skb, struct hard_iface *recv_if)
 
         spin_unlock_bh(&orig_node->bcast_seqno_lock);
 
+        /* check whether this has been sent by another originator before */
+        if (bla_check_bcast_duplist(bat_priv, bcast_packet, hdr_size))
+                goto out;
+
         /* rebroadcast packet */
         add_bcast_packet_to_list(bat_priv, skb, 1);
 
+        /* don't hand the broadcast up if it is from an originator
+         * from the same backbone.
+         */
+        if (bla_is_backbone_gw(skb, orig_node, hdr_size))
+                goto out;
+
         /* broadcast for me */
         interface_rx(recv_if->soft_iface, skb, recv_if, hdr_size);
         ret = NET_RX_SUCCESS;
diff --git a/net/batman-adv/routing.h b/net/batman-adv/routing.h
index 7aaee0fb0fdc..d6bbbebb6567 100644
--- a/net/batman-adv/routing.h
+++ b/net/batman-adv/routing.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner, Simon Wunderlich
  *
@@ -23,15 +23,16 @@
 #define _NET_BATMAN_ADV_ROUTING_H_
 
 void slide_own_bcast_window(struct hard_iface *hard_iface);
+bool check_management_packet(struct sk_buff *skb,
+                             struct hard_iface *hard_iface,
+                             int header_len);
 void update_route(struct bat_priv *bat_priv, struct orig_node *orig_node,
                   struct neigh_node *neigh_node);
-int route_unicast_packet(struct sk_buff *skb, struct hard_iface *recv_if);
 int recv_icmp_packet(struct sk_buff *skb, struct hard_iface *recv_if);
 int recv_unicast_packet(struct sk_buff *skb, struct hard_iface *recv_if);
 int recv_ucast_frag_packet(struct sk_buff *skb, struct hard_iface *recv_if);
 int recv_bcast_packet(struct sk_buff *skb, struct hard_iface *recv_if);
 int recv_vis_packet(struct sk_buff *skb, struct hard_iface *recv_if);
-int recv_bat_ogm_packet(struct sk_buff *skb, struct hard_iface *recv_if);
 int recv_tt_query(struct sk_buff *skb, struct hard_iface *recv_if);
 int recv_roam_adv(struct sk_buff *skb, struct hard_iface *recv_if);
 struct neigh_node *find_router(struct bat_priv *bat_priv,
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 8a684eb738ad..f47299f22c68 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner, Simon Wunderlich
  *
@@ -28,7 +28,6 @@
 #include "vis.h"
 #include "gateway_common.h"
 #include "originator.h"
-#include "bat_ogm.h"
 
 static void send_outstanding_bcast_packet(struct work_struct *work);
 
@@ -46,18 +45,18 @@ int send_skb_packet(struct sk_buff *skb, struct hard_iface *hard_iface,
                 goto send_skb_err;
 
         if (!(hard_iface->net_dev->flags & IFF_UP)) {
-                pr_warning("Interface %s is not up - can't send packet via "
-                           "that interface!\n", hard_iface->net_dev->name);
+                pr_warn("Interface %s is not up - can't send packet via that interface!\n",
+                        hard_iface->net_dev->name);
                 goto send_skb_err;
         }
 
         /* push to the ethernet header. */
-        if (my_skb_head_push(skb, sizeof(*ethhdr)) < 0)
+        if (my_skb_head_push(skb, ETH_HLEN) < 0)
                 goto send_skb_err;
 
         skb_reset_mac_header(skb);
 
-        ethhdr = (struct ethhdr *) skb_mac_header(skb);
+        ethhdr = (struct ethhdr *)skb_mac_header(skb);
         memcpy(ethhdr->h_source, hard_iface->net_dev->dev_addr, ETH_ALEN);
         memcpy(ethhdr->h_dest, dst_addr, ETH_ALEN);
         ethhdr->h_proto = __constant_htons(ETH_P_BATMAN);
@@ -88,7 +87,7 @@ static void realloc_packet_buffer(struct hard_iface *hard_iface,
         /* keep old buffer if kmalloc should fail */
         if (new_buff) {
                 memcpy(new_buff, hard_iface->packet_buff,
-                       BATMAN_OGM_LEN);
+                       BATMAN_OGM_HLEN);
 
                 kfree(hard_iface->packet_buff);
                 hard_iface->packet_buff = new_buff;
@@ -102,13 +101,13 @@ static int prepare_packet_buffer(struct bat_priv *bat_priv,
 {
         int new_len;
 
-        new_len = BATMAN_OGM_LEN +
+        new_len = BATMAN_OGM_HLEN +
                   tt_len((uint8_t)atomic_read(&bat_priv->tt_local_changes));
 
         /* if we have too many changes for one packet don't send any
          * and wait for the tt table request which will be fragmented */
         if (new_len > hard_iface->soft_iface->mtu)
-                new_len = BATMAN_OGM_LEN;
+                new_len = BATMAN_OGM_HLEN;
 
         realloc_packet_buffer(hard_iface, new_len);
 
@@ -118,14 +117,14 @@ static int prepare_packet_buffer(struct bat_priv *bat_priv,
         atomic_set(&bat_priv->tt_ogm_append_cnt, TT_OGM_APPEND_MAX);
 
         return tt_changes_fill_buffer(bat_priv,
-                                      hard_iface->packet_buff + BATMAN_OGM_LEN,
-                                      hard_iface->packet_len - BATMAN_OGM_LEN);
+                                      hard_iface->packet_buff + BATMAN_OGM_HLEN,
+                                      hard_iface->packet_len - BATMAN_OGM_HLEN);
 }
 
 static int reset_packet_buffer(struct bat_priv *bat_priv,
                                 struct hard_iface *hard_iface)
 {
-        realloc_packet_buffer(hard_iface, BATMAN_OGM_LEN);
+        realloc_packet_buffer(hard_iface, BATMAN_OGM_HLEN);
         return 0;
 }
 
@@ -168,7 +167,7 @@ void schedule_bat_ogm(struct hard_iface *hard_iface)
         if (primary_if)
                 hardif_free_ref(primary_if);
 
-        bat_ogm_schedule(hard_iface, tt_num_changes);
+        bat_priv->bat_algo_ops->bat_ogm_schedule(hard_iface, tt_num_changes);
 }
 
 static void forw_packet_free(struct forw_packet *forw_packet)
@@ -234,7 +233,7 @@ int add_bcast_packet_to_list(struct bat_priv *bat_priv,
 
         /* as we have a copy now, it is safe to decrease the TTL */
         bcast_packet = (struct bcast_packet *)newskb->data;
-        bcast_packet->ttl--;
+        bcast_packet->header.ttl--;
 
         skb_reset_mac_header(newskb);
 
@@ -293,7 +292,7 @@ static void send_outstanding_bcast_packet(struct work_struct *work)
         /* if we still have some more bcasts to send */
         if (forw_packet->num_packets < 3) {
                 _add_bcast_packet_to_list(bat_priv, forw_packet,
-                                          ((5 * HZ) / 1000));
+                                          msecs_to_jiffies(5));
                 return;
         }
 
@@ -318,7 +317,7 @@ void send_outstanding_bat_ogm_packet(struct work_struct *work)
         if (atomic_read(&bat_priv->mesh_state) == MESH_DEACTIVATING)
                 goto out;
 
-        bat_ogm_emit(forw_packet);
+        bat_priv->bat_algo_ops->bat_ogm_emit(forw_packet);
 
         /**
          * we have to have at least one packet in the queue
diff --git a/net/batman-adv/send.h b/net/batman-adv/send.h
index c8ca3ef7385b..824ef06f9b01 100644
--- a/net/batman-adv/send.h
+++ b/net/batman-adv/send.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner, Simon Wunderlich
  *
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 987c75a775f9..6e2530b02043 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner, Simon Wunderlich
  *
@@ -36,6 +36,7 @@
 #include <linux/etherdevice.h>
 #include <linux/if_vlan.h>
 #include "unicast.h"
+#include "bridge_loop_avoidance.h"
 
 
 static int bat_get_settings(struct net_device *dev, struct ethtool_cmd *cmd);
@@ -73,440 +74,6 @@ int my_skb_head_push(struct sk_buff *skb, unsigned int len)
         return 0;
 }
 
-static void softif_neigh_free_ref(struct softif_neigh *softif_neigh)
-{
-        if (atomic_dec_and_test(&softif_neigh->refcount))
-                kfree_rcu(softif_neigh, rcu);
-}
-
-static void softif_neigh_vid_free_rcu(struct rcu_head *rcu)
-{
-        struct softif_neigh_vid *softif_neigh_vid;
-        struct softif_neigh *softif_neigh;
-        struct hlist_node *node, *node_tmp;
-        struct bat_priv *bat_priv;
-
-        softif_neigh_vid = container_of(rcu, struct softif_neigh_vid, rcu);
-        bat_priv = softif_neigh_vid->bat_priv;
-
-        spin_lock_bh(&bat_priv->softif_neigh_lock);
-        hlist_for_each_entry_safe(softif_neigh, node, node_tmp,
-                                  &softif_neigh_vid->softif_neigh_list, list) {
-                hlist_del_rcu(&softif_neigh->list);
-                softif_neigh_free_ref(softif_neigh);
-        }
-        spin_unlock_bh(&bat_priv->softif_neigh_lock);
-
-        kfree(softif_neigh_vid);
-}
-
-static void softif_neigh_vid_free_ref(struct softif_neigh_vid *softif_neigh_vid)
-{
-        if (atomic_dec_and_test(&softif_neigh_vid->refcount))
-                call_rcu(&softif_neigh_vid->rcu, softif_neigh_vid_free_rcu);
-}
-
-static struct softif_neigh_vid *softif_neigh_vid_get(struct bat_priv *bat_priv,
-                                                     short vid)
-{
-        struct softif_neigh_vid *softif_neigh_vid;
-        struct hlist_node *node;
-
-        rcu_read_lock();
-        hlist_for_each_entry_rcu(softif_neigh_vid, node,
-                                 &bat_priv->softif_neigh_vids, list) {
-                if (softif_neigh_vid->vid != vid)
-                        continue;
-
-                if (!atomic_inc_not_zero(&softif_neigh_vid->refcount))
-                        continue;
-
-                goto out;
-        }
-
-        softif_neigh_vid = kzalloc(sizeof(*softif_neigh_vid), GFP_ATOMIC);
-        if (!softif_neigh_vid)
-                goto out;
-
-        softif_neigh_vid->vid = vid;
-        softif_neigh_vid->bat_priv = bat_priv;
-
-        /* initialize with 2 - caller decrements counter by one */
-        atomic_set(&softif_neigh_vid->refcount, 2);
-        INIT_HLIST_HEAD(&softif_neigh_vid->softif_neigh_list);
-        INIT_HLIST_NODE(&softif_neigh_vid->list);
-        spin_lock_bh(&bat_priv->softif_neigh_vid_lock);
-        hlist_add_head_rcu(&softif_neigh_vid->list,
-                           &bat_priv->softif_neigh_vids);
-        spin_unlock_bh(&bat_priv->softif_neigh_vid_lock);
-
-out:
-        rcu_read_unlock();
-        return softif_neigh_vid;
-}
-
-static struct softif_neigh *softif_neigh_get(struct bat_priv *bat_priv,
-                                             const uint8_t *addr, short vid)
-{
-        struct softif_neigh_vid *softif_neigh_vid;
-        struct softif_neigh *softif_neigh = NULL;
-        struct hlist_node *node;
-
-        softif_neigh_vid = softif_neigh_vid_get(bat_priv, vid);
-        if (!softif_neigh_vid)
-                goto out;
-
-        rcu_read_lock();
-        hlist_for_each_entry_rcu(softif_neigh, node,
-                                 &softif_neigh_vid->softif_neigh_list,
-                                 list) {
-                if (!compare_eth(softif_neigh->addr, addr))
-                        continue;
-
-                if (!atomic_inc_not_zero(&softif_neigh->refcount))
-                        continue;
-
-                softif_neigh->last_seen = jiffies;
-                goto unlock;
-        }
-
-        softif_neigh = kzalloc(sizeof(*softif_neigh), GFP_ATOMIC);
-        if (!softif_neigh)
-                goto unlock;
-
-        memcpy(softif_neigh->addr, addr, ETH_ALEN);
-        softif_neigh->last_seen = jiffies;
-        /* initialize with 2 - caller decrements counter by one */
-        atomic_set(&softif_neigh->refcount, 2);
-
-        INIT_HLIST_NODE(&softif_neigh->list);
-        spin_lock_bh(&bat_priv->softif_neigh_lock);
-        hlist_add_head_rcu(&softif_neigh->list,
-                           &softif_neigh_vid->softif_neigh_list);
-        spin_unlock_bh(&bat_priv->softif_neigh_lock);
-
-unlock:
-        rcu_read_unlock();
-out:
-        if (softif_neigh_vid)
-                softif_neigh_vid_free_ref(softif_neigh_vid);
-        return softif_neigh;
-}
-
-static struct softif_neigh *softif_neigh_get_selected(
-                                struct softif_neigh_vid *softif_neigh_vid)
-{
-        struct softif_neigh *softif_neigh;
-
-        rcu_read_lock();
-        softif_neigh = rcu_dereference(softif_neigh_vid->softif_neigh);
-
-        if (softif_neigh && !atomic_inc_not_zero(&softif_neigh->refcount))
-                softif_neigh = NULL;
-
-        rcu_read_unlock();
-        return softif_neigh;
-}
-
-static struct softif_neigh *softif_neigh_vid_get_selected(
-                                                struct bat_priv *bat_priv,
-                                                short vid)
-{
-        struct softif_neigh_vid *softif_neigh_vid;
-        struct softif_neigh *softif_neigh = NULL;
-
-        softif_neigh_vid = softif_neigh_vid_get(bat_priv, vid);
-        if (!softif_neigh_vid)
-                goto out;
-
-        softif_neigh = softif_neigh_get_selected(softif_neigh_vid);
-out:
-        if (softif_neigh_vid)
-                softif_neigh_vid_free_ref(softif_neigh_vid);
-        return softif_neigh;
-}
-
-static void softif_neigh_vid_select(struct bat_priv *bat_priv,
-                                    struct softif_neigh *new_neigh,
-                                    short vid)
-{
-        struct softif_neigh_vid *softif_neigh_vid;
-        struct softif_neigh *curr_neigh;
-
-        softif_neigh_vid = softif_neigh_vid_get(bat_priv, vid);
-        if (!softif_neigh_vid)
-                goto out;
-
-        spin_lock_bh(&bat_priv->softif_neigh_lock);
-
-        if (new_neigh && !atomic_inc_not_zero(&new_neigh->refcount))
-                new_neigh = NULL;
-
-        curr_neigh = rcu_dereference_protected(softif_neigh_vid->softif_neigh,
-                                               1);
-        rcu_assign_pointer(softif_neigh_vid->softif_neigh, new_neigh);
-
-        if ((curr_neigh) && (!new_neigh))
-                bat_dbg(DBG_ROUTES, bat_priv,
-                        "Removing mesh exit point on vid: %d (prev: %pM).\n",
-                        vid, curr_neigh->addr);
-        else if ((curr_neigh) && (new_neigh))
-                bat_dbg(DBG_ROUTES, bat_priv,
-                        "Changing mesh exit point on vid: %d from %pM "
-                        "to %pM.\n", vid, curr_neigh->addr, new_neigh->addr);
-        else if ((!curr_neigh) && (new_neigh))
-                bat_dbg(DBG_ROUTES, bat_priv,
-                        "Setting mesh exit point on vid: %d to %pM.\n",
-                        vid, new_neigh->addr);
-
-        if (curr_neigh)
-                softif_neigh_free_ref(curr_neigh);
-
-        spin_unlock_bh(&bat_priv->softif_neigh_lock);
-
-out:
-        if (softif_neigh_vid)
-                softif_neigh_vid_free_ref(softif_neigh_vid);
-}
-
-static void softif_neigh_vid_deselect(struct bat_priv *bat_priv,
-                                      struct softif_neigh_vid *softif_neigh_vid)
-{
-        struct softif_neigh *curr_neigh;
-        struct softif_neigh *softif_neigh = NULL, *softif_neigh_tmp;
-        struct hard_iface *primary_if = NULL;
-        struct hlist_node *node;
-
-        primary_if = primary_if_get_selected(bat_priv);
-        if (!primary_if)
-                goto out;
-
-        /* find new softif_neigh immediately to avoid temporary loops */
-        rcu_read_lock();
-        curr_neigh = rcu_dereference(softif_neigh_vid->softif_neigh);
-
-        hlist_for_each_entry_rcu(softif_neigh_tmp, node,
-                                 &softif_neigh_vid->softif_neigh_list,
-                                 list) {
-                if (softif_neigh_tmp == curr_neigh)
-                        continue;
-
-                /* we got a neighbor but its mac is 'bigger' than ours  */
-                if (memcmp(primary_if->net_dev->dev_addr,
-                           softif_neigh_tmp->addr, ETH_ALEN) < 0)
-                        continue;
-
-                if (!atomic_inc_not_zero(&softif_neigh_tmp->refcount))
-                        continue;
-
-                softif_neigh = softif_neigh_tmp;
-                goto unlock;
-        }
-
-unlock:
-        rcu_read_unlock();
-out:
-        softif_neigh_vid_select(bat_priv, softif_neigh, softif_neigh_vid->vid);
-
-        if (primary_if)
-                hardif_free_ref(primary_if);
-        if (softif_neigh)
-                softif_neigh_free_ref(softif_neigh);
-}
-
-int softif_neigh_seq_print_text(struct seq_file *seq, void *offset)
-{
-        struct net_device *net_dev = (struct net_device *)seq->private;
-        struct bat_priv *bat_priv = netdev_priv(net_dev);
-        struct softif_neigh_vid *softif_neigh_vid;
-        struct softif_neigh *softif_neigh;
-        struct hard_iface *primary_if;
-        struct hlist_node *node, *node_tmp;
-        struct softif_neigh *curr_softif_neigh;
-        int ret = 0, last_seen_secs, last_seen_msecs;
-
-        primary_if = primary_if_get_selected(bat_priv);
-        if (!primary_if) {
-                ret = seq_printf(seq, "BATMAN mesh %s disabled - "
-                                 "please specify interfaces to enable it\n",
-                                 net_dev->name);
-                goto out;
-        }
-
-        if (primary_if->if_status != IF_ACTIVE) {
-                ret = seq_printf(seq, "BATMAN mesh %s "
-                                 "disabled - primary interface not active\n",
-                                 net_dev->name);
-                goto out;
-        }
-
-        seq_printf(seq, "Softif neighbor list (%s)\n", net_dev->name);
-
-        rcu_read_lock();
-        hlist_for_each_entry_rcu(softif_neigh_vid, node,
-                                 &bat_priv->softif_neigh_vids, list) {
-                seq_printf(seq, "     %-15s %s on vid: %d\n",
-                           "Originator", "last-seen", softif_neigh_vid->vid);
-
-                curr_softif_neigh = softif_neigh_get_selected(softif_neigh_vid);
-
-                hlist_for_each_entry_rcu(softif_neigh, node_tmp,
-                                         &softif_neigh_vid->softif_neigh_list,
-                                         list) {
-                        last_seen_secs = jiffies_to_msecs(jiffies -
-                                                softif_neigh->last_seen) / 1000;
-                        last_seen_msecs = jiffies_to_msecs(jiffies -
-                                                softif_neigh->last_seen) % 1000;
-                        seq_printf(seq, "%s %pM  %3i.%03is\n",
-                                   curr_softif_neigh == softif_neigh
-                                   ? "=>" : "  ", softif_neigh->addr,
-                                   last_seen_secs, last_seen_msecs);
-                }
-
-                if (curr_softif_neigh)
-                        softif_neigh_free_ref(curr_softif_neigh);
-
-                seq_printf(seq, "\n");
-        }
-        rcu_read_unlock();
-
-out:
-        if (primary_if)
-                hardif_free_ref(primary_if);
-        return ret;
-}
-
-void softif_neigh_purge(struct bat_priv *bat_priv)
-{
-        struct softif_neigh *softif_neigh, *curr_softif_neigh;
-        struct softif_neigh_vid *softif_neigh_vid;
-        struct hlist_node *node, *node_tmp, *node_tmp2;
-        int do_deselect;
-
-        rcu_read_lock();
-        hlist_for_each_entry_rcu(softif_neigh_vid, node,
-                                 &bat_priv->softif_neigh_vids, list) {
-                if (!atomic_inc_not_zero(&softif_neigh_vid->refcount))
-                        continue;
-
-                curr_softif_neigh = softif_neigh_get_selected(softif_neigh_vid);
-                do_deselect = 0;
-
-                spin_lock_bh(&bat_priv->softif_neigh_lock);
-                hlist_for_each_entry_safe(softif_neigh, node_tmp, node_tmp2,
-                                          &softif_neigh_vid->softif_neigh_list,
-                                          list) {
-                        if ((!time_after(jiffies, softif_neigh->last_seen +
-                                msecs_to_jiffies(SOFTIF_NEIGH_TIMEOUT))) &&
-                            (atomic_read(&bat_priv->mesh_state) == MESH_ACTIVE))
-                                continue;
-
-                        if (curr_softif_neigh == softif_neigh) {
-                                bat_dbg(DBG_ROUTES, bat_priv,
-                                        "Current mesh exit point on vid: %d "
-                                        "'%pM' vanished.\n",
-                                        softif_neigh_vid->vid,
-                                        softif_neigh->addr);
-                                do_deselect = 1;
-                        }
-
-                        hlist_del_rcu(&softif_neigh->list);
-                        softif_neigh_free_ref(softif_neigh);
-                }
-                spin_unlock_bh(&bat_priv->softif_neigh_lock);
-
-                /* soft_neigh_vid_deselect() needs to acquire the
-                 * softif_neigh_lock */
-                if (do_deselect)
-                        softif_neigh_vid_deselect(bat_priv, softif_neigh_vid);
-
-                if (curr_softif_neigh)
-                        softif_neigh_free_ref(curr_softif_neigh);
-
-                softif_neigh_vid_free_ref(softif_neigh_vid);
-        }
-        rcu_read_unlock();
-
-        spin_lock_bh(&bat_priv->softif_neigh_vid_lock);
-        hlist_for_each_entry_safe(softif_neigh_vid, node, node_tmp,
-                                  &bat_priv->softif_neigh_vids, list) {
-                if (!hlist_empty(&softif_neigh_vid->softif_neigh_list))
-                        continue;
-
-                hlist_del_rcu(&softif_neigh_vid->list);
-                softif_neigh_vid_free_ref(softif_neigh_vid);
-        }
-        spin_unlock_bh(&bat_priv->softif_neigh_vid_lock);
-
-}
-
-static void softif_batman_recv(struct sk_buff *skb, struct net_device *dev,
-                               short vid)
-{
-        struct bat_priv *bat_priv = netdev_priv(dev);
-        struct ethhdr *ethhdr = (struct ethhdr *)skb->data;
-        struct batman_ogm_packet *batman_ogm_packet;
-        struct softif_neigh *softif_neigh = NULL;
-        struct hard_iface *primary_if = NULL;
-        struct softif_neigh *curr_softif_neigh = NULL;
-
-        if (ntohs(ethhdr->h_proto) == ETH_P_8021Q)
-                batman_ogm_packet = (struct batman_ogm_packet *)
-                                        (skb->data + ETH_HLEN + VLAN_HLEN);
-        else
-                batman_ogm_packet = (struct batman_ogm_packet *)
-                                                        (skb->data + ETH_HLEN);
-
-        if (batman_ogm_packet->version != COMPAT_VERSION)
-                goto out;
-
-        if (batman_ogm_packet->packet_type != BAT_OGM)
-                goto out;
-
-        if (!(batman_ogm_packet->flags & PRIMARIES_FIRST_HOP))
-                goto out;
-
-        if (is_my_mac(batman_ogm_packet->orig))
-                goto out;
-
-        softif_neigh = softif_neigh_get(bat_priv, batman_ogm_packet->orig, vid);
-        if (!softif_neigh)
-                goto out;
-
-        curr_softif_neigh = softif_neigh_vid_get_selected(bat_priv, vid);
-        if (curr_softif_neigh == softif_neigh)
-                goto out;
-
-        primary_if = primary_if_get_selected(bat_priv);
-        if (!primary_if)
-                goto out;
-
-        /* we got a neighbor but its mac is 'bigger' than ours  */
-        if (memcmp(primary_if->net_dev->dev_addr,
-                   softif_neigh->addr, ETH_ALEN) < 0)
-                goto out;
-
-        /* close own batX device and use softif_neigh as exit node */
-        if (!curr_softif_neigh) {
-                softif_neigh_vid_select(bat_priv, softif_neigh, vid);
-                goto out;
-        }
-
-        /* switch to new 'smallest neighbor' */
-        if (memcmp(softif_neigh->addr, curr_softif_neigh->addr, ETH_ALEN) < 0)
-                softif_neigh_vid_select(bat_priv, softif_neigh, vid);
-
-out:
-        kfree_skb(skb);
-        if (softif_neigh)
-                softif_neigh_free_ref(softif_neigh);
-        if (curr_softif_neigh)
-                softif_neigh_free_ref(curr_softif_neigh);
-        if (primary_if)
-                hardif_free_ref(primary_if);
-        return;
-}
-
 static int interface_open(struct net_device *dev)
 {
         netif_start_queue(dev);
@@ -541,6 +108,7 @@ static int interface_set_mac_addr(struct net_device *dev, void *p)
         }
 
         memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
+        dev->addr_assign_type &= ~NET_ADDR_RANDOM;
         return 0;
 }
 
@@ -562,10 +130,11 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
         struct hard_iface *primary_if = NULL;
         struct bcast_packet *bcast_packet;
         struct vlan_ethhdr *vhdr;
-        struct softif_neigh *curr_softif_neigh = NULL;
+        static const uint8_t stp_addr[ETH_ALEN] = {0x01, 0x80, 0xC2, 0x00, 0x00,
+                                                   0x00};
         unsigned int header_len = 0;
         int data_len = skb->len, ret;
-        short vid = -1;
+        short vid __maybe_unused = -1;
         bool do_bcast = false;
 
         if (atomic_read(&bat_priv->mesh_state) != MESH_ACTIVE)
@@ -583,21 +152,21 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
 
                 /* fall through */
         case ETH_P_BATMAN:
-                softif_batman_recv(skb, soft_iface, vid);
-                goto end;
+                goto dropped;
         }
 
-        /**
-         * if we have a another chosen mesh exit node in range
-         * it will transport the packets to the mesh
-         */
-        curr_softif_neigh = softif_neigh_vid_get_selected(bat_priv, vid);
-        if (curr_softif_neigh)
+        if (bla_tx(bat_priv, skb, vid))
                 goto dropped;
 
         /* Register the client MAC in the transtable */
         tt_local_add(soft_iface, ethhdr->h_source, skb->skb_iif);
 
+        /* don't accept stp packets. STP does not help in meshes.
+         * better use the bridge loop avoidance ...
+         */
+        if (compare_eth(ethhdr->h_dest, stp_addr))
+                goto dropped;
+
         if (is_multicast_ether_addr(ethhdr->h_dest)) {
                 do_bcast = true;
 
@@ -632,11 +201,11 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
                         goto dropped;
 
                 bcast_packet = (struct bcast_packet *)skb->data;
-                bcast_packet->version = COMPAT_VERSION;
-                bcast_packet->ttl = TTL;
+                bcast_packet->header.version = COMPAT_VERSION;
+                bcast_packet->header.ttl = TTL;
 
                 /* batman packet type: broadcast */
-                bcast_packet->packet_type = BAT_BCAST;
+                bcast_packet->header.packet_type = BAT_BCAST;
 
                 /* hw address of first interface is the orig mac because only
                  * this mac is known throughout the mesh */
@@ -675,8 +244,6 @@ dropped:
 dropped_freed:
         bat_priv->stats.tx_dropped++;
 end:
-        if (curr_softif_neigh)
-                softif_neigh_free_ref(curr_softif_neigh);
         if (primary_if)
                 hardif_free_ref(primary_if);
         return NETDEV_TX_OK;
@@ -687,12 +254,9 @@ void interface_rx(struct net_device *soft_iface,
                   int hdr_size)
 {
         struct bat_priv *bat_priv = netdev_priv(soft_iface);
-        struct unicast_packet *unicast_packet;
         struct ethhdr *ethhdr;
         struct vlan_ethhdr *vhdr;
-        struct softif_neigh *curr_softif_neigh = NULL;
-        short vid = -1;
-        int ret;
+        short vid __maybe_unused = -1;
 
         /* check if enough space is available for pulling, and pull */
         if (!pskb_may_pull(skb, hdr_size))
@@ -716,30 +280,6 @@ void interface_rx(struct net_device *soft_iface,
                 goto dropped;
         }
 
-        /**
-         * if we have a another chosen mesh exit node in range
-         * it will transport the packets to the non-mesh network
-         */
-        curr_softif_neigh = softif_neigh_vid_get_selected(bat_priv, vid);
-        if (curr_softif_neigh) {
-                skb_push(skb, hdr_size);
-                unicast_packet = (struct unicast_packet *)skb->data;
-
-                if ((unicast_packet->packet_type != BAT_UNICAST) &&
-                    (unicast_packet->packet_type != BAT_UNICAST_FRAG))
-                        goto dropped;
-
-                skb_reset_mac_header(skb);
-
-                memcpy(unicast_packet->dest,
-                       curr_softif_neigh->addr, ETH_ALEN);
-                ret = route_unicast_packet(skb, recv_if);
-                if (ret == NET_RX_DROP)
-                        goto dropped;
-
-                goto out;
-        }
-
         /* skb->dev & skb->pkt_type are set here */
         if (unlikely(!pskb_may_pull(skb, ETH_HLEN)))
                 goto dropped;
@@ -752,21 +292,25 @@ void interface_rx(struct net_device *soft_iface,
 /*      skb->ip_summed = CHECKSUM_UNNECESSARY;*/
 
         bat_priv->stats.rx_packets++;
-        bat_priv->stats.rx_bytes += skb->len + sizeof(struct ethhdr);
+        bat_priv->stats.rx_bytes += skb->len + ETH_HLEN;
 
         soft_iface->last_rx = jiffies;
 
         if (is_ap_isolated(bat_priv, ethhdr->h_source, ethhdr->h_dest))
                 goto dropped;
 
+        /* Let the bridge loop avoidance check the packet. If will
+         * not handle it, we can safely push it up.
+         */
+        if (bla_rx(bat_priv, skb, vid))
+                goto out;
+
         netif_rx(skb);
         goto out;
 
 dropped:
         kfree_skb(skb);
 out:
-        if (curr_softif_neigh)
-                softif_neigh_free_ref(curr_softif_neigh);
         return;
 }
 
@@ -783,7 +327,6 @@ static const struct net_device_ops bat_netdev_ops = {
 static void interface_setup(struct net_device *dev)
 {
         struct bat_priv *priv = netdev_priv(dev);
-        char dev_addr[ETH_ALEN];
 
         ether_setup(dev);
 
@@ -800,8 +343,7 @@ static void interface_setup(struct net_device *dev)
         dev->hard_header_len = BAT_HEADER_LEN;
 
         /* generate random address */
-        random_ether_addr(dev_addr);
-        memcpy(dev->dev_addr, dev_addr, ETH_ALEN);
+        eth_hw_addr_random(dev);
 
         SET_ETHTOOL_OPS(dev, &bat_ethtool_ops);
 
@@ -830,13 +372,14 @@ struct net_device *softif_create(const char *name)
 
         atomic_set(&bat_priv->aggregated_ogms, 1);
         atomic_set(&bat_priv->bonding, 0);
+        atomic_set(&bat_priv->bridge_loop_avoidance, 0);
         atomic_set(&bat_priv->ap_isolation, 0);
         atomic_set(&bat_priv->vis_mode, VIS_TYPE_CLIENT_UPDATE);
         atomic_set(&bat_priv->gw_mode, GW_MODE_OFF);
         atomic_set(&bat_priv->gw_sel_class, 20);
         atomic_set(&bat_priv->gw_bandwidth, 41);
         atomic_set(&bat_priv->orig_interval, 1000);
-        atomic_set(&bat_priv->hop_penalty, 10);
+        atomic_set(&bat_priv->hop_penalty, 30);
         atomic_set(&bat_priv->log_level, 0);
         atomic_set(&bat_priv->fragmentation, 1);
         atomic_set(&bat_priv->bcast_queue_left, BCAST_QUEUE_LEN);
@@ -847,6 +390,7 @@ struct net_device *softif_create(const char *name)
         atomic_set(&bat_priv->ttvn, 0);
         atomic_set(&bat_priv->tt_local_changes, 0);
         atomic_set(&bat_priv->tt_ogm_append_cnt, 0);
+        atomic_set(&bat_priv->bla_num_requests, 0);
 
         bat_priv->tt_buff = NULL;
         bat_priv->tt_buff_len = 0;
@@ -855,6 +399,10 @@ struct net_device *softif_create(const char *name)
         bat_priv->primary_if = NULL;
         bat_priv->num_ifaces = 0;
 
+        ret = bat_algo_select(bat_priv, bat_routing_algo);
+        if (ret < 0)
+                goto unreg_soft_iface;
+
         ret = sysfs_add_meshif(soft_iface);
         if (ret < 0)
                 goto unreg_soft_iface;
diff --git a/net/batman-adv/soft-interface.h b/net/batman-adv/soft-interface.h
index 001546fc96f1..020300673884 100644
--- a/net/batman-adv/soft-interface.h
+++ b/net/batman-adv/soft-interface.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner
  *
@@ -23,8 +23,6 @@
 #define _NET_BATMAN_ADV_SOFT_INTERFACE_H_
 
 int my_skb_head_push(struct sk_buff *skb, unsigned int len);
-int softif_neigh_seq_print_text(struct seq_file *seq, void *offset);
-void softif_neigh_purge(struct bat_priv *bat_priv);
 void interface_rx(struct net_device *soft_iface,
                   struct sk_buff *skb, struct hard_iface *recv_if,
                   int hdr_size);
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index ab8dea8b0b2e..a66c2dcd1088 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -1,7 +1,7 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
- * Marek Lindner, Simon Wunderlich
+ * Marek Lindner, Simon Wunderlich, Antonio Quartulli
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of version 2 of the GNU General Public
@@ -27,13 +27,14 @@
 #include "hash.h"
 #include "originator.h"
 #include "routing.h"
+#include "bridge_loop_avoidance.h"
 
 #include <linux/crc16.h>
 
-static void _tt_global_del(struct bat_priv *bat_priv,
-                           struct tt_global_entry *tt_global_entry,
-                           const char *message);
+static void send_roam_adv(struct bat_priv *bat_priv, uint8_t *client,
+                          struct orig_node *orig_node);
 static void tt_purge(struct work_struct *work);
+static void tt_global_del_orig_list(struct tt_global_entry *tt_global_entry);
 
 /* returns 1 if they are the same mac addr */
 static int compare_tt(const struct hlist_node *node, const void *data2)
@@ -108,14 +109,6 @@ static struct tt_global_entry *tt_global_hash_find(struct bat_priv *bat_priv,
 
 }
 
-static bool is_out_of_time(unsigned long starting_time, unsigned long timeout)
-{
-        unsigned long deadline;
-        deadline = starting_time + msecs_to_jiffies(timeout);
-
-        return time_after(jiffies, deadline);
-}
-
 static void tt_local_entry_free_ref(struct tt_local_entry *tt_local_entry)
 {
         if (atomic_dec_and_test(&tt_local_entry->common.refcount))
@@ -131,17 +124,31 @@ static void tt_global_entry_free_rcu(struct rcu_head *rcu)
         tt_global_entry = container_of(tt_common_entry, struct tt_global_entry,
                                        common);
 
-        if (tt_global_entry->orig_node)
-                orig_node_free_ref(tt_global_entry->orig_node);
-
         kfree(tt_global_entry);
 }
 
 static void tt_global_entry_free_ref(struct tt_global_entry *tt_global_entry)
 {
-        if (atomic_dec_and_test(&tt_global_entry->common.refcount))
+        if (atomic_dec_and_test(&tt_global_entry->common.refcount)) {
+                tt_global_del_orig_list(tt_global_entry);
                 call_rcu(&tt_global_entry->common.rcu,
                          tt_global_entry_free_rcu);
+        }
+}
+
+static void tt_orig_list_entry_free_rcu(struct rcu_head *rcu)
+{
+        struct tt_orig_list_entry *orig_entry;
+
+        orig_entry = container_of(rcu, struct tt_orig_list_entry, rcu);
+        atomic_dec(&orig_entry->orig_node->tt_size);
+        orig_node_free_ref(orig_entry->orig_node);
+        kfree(orig_entry);
+}
+
+static void tt_orig_list_entry_free_ref(struct tt_orig_list_entry *orig_entry)
+{
+        call_rcu(&orig_entry->rcu, tt_orig_list_entry_free_rcu);
 }
 
 static void tt_local_event(struct bat_priv *bat_priv, const uint8_t *addr,
@@ -190,12 +197,17 @@ void tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
         struct bat_priv *bat_priv = netdev_priv(soft_iface);
         struct tt_local_entry *tt_local_entry = NULL;
         struct tt_global_entry *tt_global_entry = NULL;
+        struct hlist_head *head;
+        struct hlist_node *node;
+        struct tt_orig_list_entry *orig_entry;
         int hash_added;
 
         tt_local_entry = tt_local_hash_find(bat_priv, addr);
 
         if (tt_local_entry) {
                 tt_local_entry->last_seen = jiffies;
+                /* possibly unset the TT_CLIENT_PENDING flag */
+                tt_local_entry->common.flags &= ~TT_CLIENT_PENDING;
                 goto out;
         }
 
@@ -218,6 +230,11 @@ void tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
         if (compare_eth(addr, soft_iface->dev_addr))
                 tt_local_entry->common.flags |= TT_CLIENT_NOPURGE;
 
+        /* The local entry has to be marked as NEW to avoid to send it in
+         * a full table response going out before the next ttvn increment
+         * (consistency check) */
+        tt_local_entry->common.flags |= TT_CLIENT_NEW;
+
         hash_added = hash_add(bat_priv->tt_local_hash, compare_tt, choose_orig,
                          &tt_local_entry->common,
                          &tt_local_entry->common.hash_entry);
@@ -230,24 +247,26 @@ void tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
 
         tt_local_event(bat_priv, addr, tt_local_entry->common.flags);
 
-        /* The local entry has to be marked as NEW to avoid to send it in
-         * a full table response going out before the next ttvn increment
-         * (consistency check) */
-        tt_local_entry->common.flags |= TT_CLIENT_NEW;
-
         /* remove address from global hash if present */
         tt_global_entry = tt_global_hash_find(bat_priv, addr);
 
         /* Check whether it is a roaming! */
         if (tt_global_entry) {
-                /* This node is probably going to update its tt table */
-                tt_global_entry->orig_node->tt_poss_change = true;
-                /* The global entry has to be marked as ROAMING and has to be
-                 * kept for consistency purpose */
+                /* These node are probably going to update their tt table */
+                head = &tt_global_entry->orig_list;
+                rcu_read_lock();
+                hlist_for_each_entry_rcu(orig_entry, node, head, list) {
+                        orig_entry->orig_node->tt_poss_change = true;
+
+                        send_roam_adv(bat_priv, tt_global_entry->common.addr,
+                                      orig_entry->orig_node);
+                }
+                rcu_read_unlock();
+                /* The global entry has to be marked as ROAMING and
+                 * has to be kept for consistency purpose
+                 */
                 tt_global_entry->common.flags |= TT_CLIENT_ROAM;
                 tt_global_entry->roam_at = jiffies;
-                send_roam_adv(bat_priv, tt_global_entry->common.addr,
-                              tt_global_entry->orig_node);
         }
 out:
         if (tt_local_entry)
@@ -269,7 +288,7 @@ int tt_changes_fill_buffer(struct bat_priv *bat_priv,
         atomic_set(&bat_priv->tt_local_changes, 0);
 
         list_for_each_entry_safe(entry, safe, &bat_priv->tt_changes_list,
-                        list) {
+                                 list) {
                 if (count < tot_changes) {
                         memcpy(buff + tt_len(count),
                                &entry->change, sizeof(struct tt_change));
@@ -317,21 +336,21 @@ int tt_local_seq_print_text(struct seq_file *seq, void *offset)
 
         primary_if = primary_if_get_selected(bat_priv);
         if (!primary_if) {
-                ret = seq_printf(seq, "BATMAN mesh %s disabled - "
-                                 "please specify interfaces to enable it\n",
+                ret = seq_printf(seq,
+                                 "BATMAN mesh %s disabled - please specify interfaces to enable it\n",
                                  net_dev->name);
                 goto out;
         }
 
         if (primary_if->if_status != IF_ACTIVE) {
-                ret = seq_printf(seq, "BATMAN mesh %s disabled - "
-                                 "primary interface not active\n",
+                ret = seq_printf(seq,
+                                 "BATMAN mesh %s disabled - primary interface not active\n",
                                  net_dev->name);
                 goto out;
         }
 
-        seq_printf(seq, "Locally retrieved addresses (from %s) "
-                   "announced via TT (TTVN: %u):\n",
+        seq_printf(seq,
+                   "Locally retrieved addresses (from %s) announced via TT (TTVN: %u):\n",
                    net_dev->name, (uint8_t)atomic_read(&bat_priv->ttvn));
 
         for (i = 0; i < hash->size; i++) {
@@ -341,17 +360,17 @@ int tt_local_seq_print_text(struct seq_file *seq, void *offset)
                 hlist_for_each_entry_rcu(tt_common_entry, node,
                                          head, hash_entry) {
                         seq_printf(seq, " * %pM [%c%c%c%c%c]\n",
-                                        tt_common_entry->addr,
-                                        (tt_common_entry->flags &
-                                         TT_CLIENT_ROAM ? 'R' : '.'),
-                                        (tt_common_entry->flags &
-                                         TT_CLIENT_NOPURGE ? 'P' : '.'),
-                                        (tt_common_entry->flags &
-                                         TT_CLIENT_NEW ? 'N' : '.'),
-                                        (tt_common_entry->flags &
-                                         TT_CLIENT_PENDING ? 'X' : '.'),
-                                        (tt_common_entry->flags &
-                                         TT_CLIENT_WIFI ? 'W' : '.'));
+                                   tt_common_entry->addr,
+                                   (tt_common_entry->flags &
+                                    TT_CLIENT_ROAM ? 'R' : '.'),
+                                   (tt_common_entry->flags &
+                                    TT_CLIENT_NOPURGE ? 'P' : '.'),
+                                   (tt_common_entry->flags &
+                                    TT_CLIENT_NEW ? 'N' : '.'),
+                                   (tt_common_entry->flags &
+                                    TT_CLIENT_PENDING ? 'X' : '.'),
+                                   (tt_common_entry->flags &
+                                    TT_CLIENT_WIFI ? 'W' : '.'));
                 }
                 rcu_read_unlock();
         }
@@ -363,7 +382,7 @@ out:
 
 static void tt_local_set_pending(struct bat_priv *bat_priv,
                                  struct tt_local_entry *tt_local_entry,
-                                 uint16_t flags)
+                                 uint16_t flags, const char *message)
 {
         tt_local_event(bat_priv, tt_local_entry->common.addr,
                        tt_local_entry->common.flags | flags);
@@ -372,6 +391,10 @@ static void tt_local_set_pending(struct bat_priv *bat_priv,
          * to be kept in the table in order to send it in a full table
          * response issued before the net ttvn increment (consistency check) */
         tt_local_entry->common.flags |= TT_CLIENT_PENDING;
+
+        bat_dbg(DBG_TT, bat_priv,
+                "Local tt entry (%pM) pending to be removed: %s\n",
+                tt_local_entry->common.addr, message);
 }
 
 void tt_local_remove(struct bat_priv *bat_priv, const uint8_t *addr,
@@ -384,10 +407,7 @@ void tt_local_remove(struct bat_priv *bat_priv, const uint8_t *addr,
                 goto out;
 
         tt_local_set_pending(bat_priv, tt_local_entry, TT_CLIENT_DEL |
-                             (roaming ? TT_CLIENT_ROAM : NO_FLAGS));
-
-        bat_dbg(DBG_TT, bat_priv, "Local tt entry (%pM) pending to be removed: "
-                "%s\n", tt_local_entry->common.addr, message);
+                             (roaming ? TT_CLIENT_ROAM : NO_FLAGS), message);
 out:
         if (tt_local_entry)
                 tt_local_entry_free_ref(tt_local_entry);
@@ -420,15 +440,12 @@ static void tt_local_purge(struct bat_priv *bat_priv)
                         if (tt_local_entry->common.flags & TT_CLIENT_PENDING)
                                 continue;
 
-                        if (!is_out_of_time(tt_local_entry->last_seen,
-                                            TT_LOCAL_TIMEOUT * 1000))
+                        if (!has_timed_out(tt_local_entry->last_seen,
+                                           TT_LOCAL_TIMEOUT))
                                 continue;
 
                         tt_local_set_pending(bat_priv, tt_local_entry,
-                                             TT_CLIENT_DEL);
-                        bat_dbg(DBG_TT, bat_priv, "Local tt entry (%pM) "
-                                "pending to be removed: timed out\n",
-                                tt_local_entry->common.addr);
+                                             TT_CLIENT_DEL, "timed out");
                 }
                 spin_unlock_bh(list_lock);
         }
@@ -500,33 +517,76 @@ static void tt_changes_list_free(struct bat_priv *bat_priv)
         spin_unlock_bh(&bat_priv->tt_changes_list_lock);
 }
 
+/* find out if an orig_node is already in the list of a tt_global_entry.
+ * returns 1 if found, 0 otherwise
+ */
+static bool tt_global_entry_has_orig(const struct tt_global_entry *entry,
+                                     const struct orig_node *orig_node)
+{
+        struct tt_orig_list_entry *tmp_orig_entry;
+        const struct hlist_head *head;
+        struct hlist_node *node;
+        bool found = false;
+
+        rcu_read_lock();
+        head = &entry->orig_list;
+        hlist_for_each_entry_rcu(tmp_orig_entry, node, head, list) {
+                if (tmp_orig_entry->orig_node == orig_node) {
+                        found = true;
+                        break;
+                }
+        }
+        rcu_read_unlock();
+        return found;
+}
+
+static void tt_global_add_orig_entry(struct tt_global_entry *tt_global_entry,
+                                     struct orig_node *orig_node,
+                                     int ttvn)
+{
+        struct tt_orig_list_entry *orig_entry;
+
+        orig_entry = kzalloc(sizeof(*orig_entry), GFP_ATOMIC);
+        if (!orig_entry)
+                return;
+
+        INIT_HLIST_NODE(&orig_entry->list);
+        atomic_inc(&orig_node->refcount);
+        atomic_inc(&orig_node->tt_size);
+        orig_entry->orig_node = orig_node;
+        orig_entry->ttvn = ttvn;
+
+        spin_lock_bh(&tt_global_entry->list_lock);
+        hlist_add_head_rcu(&orig_entry->list,
+                           &tt_global_entry->orig_list);
+        spin_unlock_bh(&tt_global_entry->list_lock);
+}
+
 /* caller must hold orig_node refcount */
 int tt_global_add(struct bat_priv *bat_priv, struct orig_node *orig_node,
                   const unsigned char *tt_addr, uint8_t ttvn, bool roaming,
                   bool wifi)
 {
-        struct tt_global_entry *tt_global_entry;
-        struct orig_node *orig_node_tmp;
+        struct tt_global_entry *tt_global_entry = NULL;
         int ret = 0;
         int hash_added;
 
         tt_global_entry = tt_global_hash_find(bat_priv, tt_addr);
 
         if (!tt_global_entry) {
-                tt_global_entry =
-                        kmalloc(sizeof(*tt_global_entry),
-                                GFP_ATOMIC);
+                tt_global_entry = kzalloc(sizeof(*tt_global_entry),
+                                          GFP_ATOMIC);
                 if (!tt_global_entry)
                         goto out;
 
                 memcpy(tt_global_entry->common.addr, tt_addr, ETH_ALEN);
+
                 tt_global_entry->common.flags = NO_FLAGS;
-                atomic_set(&tt_global_entry->common.refcount, 2);
-                /* Assign the new orig_node */
-                atomic_inc(&orig_node->refcount);
-                tt_global_entry->orig_node = orig_node;
-                tt_global_entry->ttvn = ttvn;
                 tt_global_entry->roam_at = 0;
+                atomic_set(&tt_global_entry->common.refcount, 2);
+
+                INIT_HLIST_HEAD(&tt_global_entry->orig_list);
+                spin_lock_init(&tt_global_entry->list_lock);
 
                 hash_added = hash_add(bat_priv->tt_global_hash, compare_tt,
                                  choose_orig, &tt_global_entry->common,
@@ -537,19 +597,27 @@ int tt_global_add(struct bat_priv *bat_priv, struct orig_node *orig_node,
                         tt_global_entry_free_ref(tt_global_entry);
                         goto out_remove;
                 }
-                atomic_inc(&orig_node->tt_size);
+
+                tt_global_add_orig_entry(tt_global_entry, orig_node, ttvn);
         } else {
-                if (tt_global_entry->orig_node != orig_node) {
-                        atomic_dec(&tt_global_entry->orig_node->tt_size);
-                        orig_node_tmp = tt_global_entry->orig_node;
-                        atomic_inc(&orig_node->refcount);
-                        tt_global_entry->orig_node = orig_node;
-                        orig_node_free_ref(orig_node_tmp);
-                        atomic_inc(&orig_node->tt_size);
+                /* there is already a global entry, use this one. */
+
+                /* If there is the TT_CLIENT_ROAM flag set, there is only one
+                 * originator left in the list and we previously received a
+                 * delete + roaming change for this originator.
+                 *
+                 * We should first delete the old originator before adding the
+                 * new one.
+                 */
+                if (tt_global_entry->common.flags & TT_CLIENT_ROAM) {
+                        tt_global_del_orig_list(tt_global_entry);
+                        tt_global_entry->common.flags &= ~TT_CLIENT_ROAM;
+                        tt_global_entry->roam_at = 0;
                 }
-                tt_global_entry->common.flags = NO_FLAGS;
-                tt_global_entry->ttvn = ttvn;
-                tt_global_entry->roam_at = 0;
+
+                if (!tt_global_entry_has_orig(tt_global_entry, orig_node))
+                        tt_global_add_orig_entry(tt_global_entry, orig_node,
+                                                 ttvn);
         }
 
         if (wifi)
@@ -570,6 +638,34 @@ out:
         return ret;
 }
 
+/* print all orig nodes who announce the address for this global entry.
+ * it is assumed that the caller holds rcu_read_lock();
+ */
+static void tt_global_print_entry(struct tt_global_entry *tt_global_entry,
+                                  struct seq_file *seq)
+{
+        struct hlist_head *head;
+        struct hlist_node *node;
+        struct tt_orig_list_entry *orig_entry;
+        struct tt_common_entry *tt_common_entry;
+        uint16_t flags;
+        uint8_t last_ttvn;
+
+        tt_common_entry = &tt_global_entry->common;
+
+        head = &tt_global_entry->orig_list;
+
+        hlist_for_each_entry_rcu(orig_entry, node, head, list) {
+                flags = tt_common_entry->flags;
+                last_ttvn = atomic_read(&orig_entry->orig_node->last_ttvn);
+                seq_printf(seq, " * %pM  (%3u) via %pM     (%3u)   [%c%c]\n",
+                           tt_global_entry->common.addr, orig_entry->ttvn,
+                           orig_entry->orig_node->orig, last_ttvn,
+                           (flags & TT_CLIENT_ROAM ? 'R' : '.'),
+                           (flags & TT_CLIENT_WIFI ? 'W' : '.'));
+        }
+}
+
 int tt_global_seq_print_text(struct seq_file *seq, void *offset)
 {
         struct net_device *net_dev = (struct net_device *)seq->private;
@@ -585,15 +681,15 @@ int tt_global_seq_print_text(struct seq_file *seq, void *offset)
 
         primary_if = primary_if_get_selected(bat_priv);
         if (!primary_if) {
-                ret = seq_printf(seq, "BATMAN mesh %s disabled - please "
-                                 "specify interfaces to enable it\n",
+                ret = seq_printf(seq,
+                                 "BATMAN mesh %s disabled - please specify interfaces to enable it\n",
                                  net_dev->name);
                 goto out;
         }
 
         if (primary_if->if_status != IF_ACTIVE) {
-                ret = seq_printf(seq, "BATMAN mesh %s disabled - "
-                                 "primary interface not active\n",
+                ret = seq_printf(seq,
+                                 "BATMAN mesh %s disabled - primary interface not active\n",
                                  net_dev->name);
                 goto out;
         }
@@ -613,20 +709,7 @@ int tt_global_seq_print_text(struct seq_file *seq, void *offset)
                         tt_global_entry = container_of(tt_common_entry,
                                                        struct tt_global_entry,
                                                        common);
-                        seq_printf(seq, " * %pM  (%3u) via %pM     (%3u)   "
-                                        "[%c%c%c]\n",
-                                        tt_global_entry->common.addr,
-                                        tt_global_entry->ttvn,
-                                        tt_global_entry->orig_node->orig,
-                                        (uint8_t) atomic_read(
-                                                &tt_global_entry->orig_node->
-                                                last_ttvn),
-                                        (tt_global_entry->common.flags &
-                                         TT_CLIENT_ROAM ? 'R' : '.'),
-                                        (tt_global_entry->common.flags &
-                                         TT_CLIENT_PENDING ? 'X' : '.'),
-                                        (tt_global_entry->common.flags &
-                                         TT_CLIENT_WIFI ? 'W' : '.'));
+                        tt_global_print_entry(tt_global_entry, seq);
                 }
                 rcu_read_unlock();
         }
@@ -636,30 +719,107 @@ out:
         return ret;
 }
 
-static void _tt_global_del(struct bat_priv *bat_priv,
-                           struct tt_global_entry *tt_global_entry,
-                           const char *message)
+/* deletes the orig list of a tt_global_entry */
+static void tt_global_del_orig_list(struct tt_global_entry *tt_global_entry)
 {
-        if (!tt_global_entry)
-                goto out;
+        struct hlist_head *head;
+        struct hlist_node *node, *safe;
+        struct tt_orig_list_entry *orig_entry;
 
-        bat_dbg(DBG_TT, bat_priv,
-                "Deleting global tt entry %pM (via %pM): %s\n",
-                tt_global_entry->common.addr, tt_global_entry->orig_node->orig,
-                message);
+        spin_lock_bh(&tt_global_entry->list_lock);
+        head = &tt_global_entry->orig_list;
+        hlist_for_each_entry_safe(orig_entry, node, safe, head, list) {
+                hlist_del_rcu(node);
+                tt_orig_list_entry_free_ref(orig_entry);
+        }
+        spin_unlock_bh(&tt_global_entry->list_lock);
+
+}
+
+static void tt_global_del_orig_entry(struct bat_priv *bat_priv,
+                                     struct tt_global_entry *tt_global_entry,
+                                     struct orig_node *orig_node,
+                                     const char *message)
+{
+        struct hlist_head *head;
+        struct hlist_node *node, *safe;
+        struct tt_orig_list_entry *orig_entry;
+
+        spin_lock_bh(&tt_global_entry->list_lock);
+        head = &tt_global_entry->orig_list;
+        hlist_for_each_entry_safe(orig_entry, node, safe, head, list) {
+                if (orig_entry->orig_node == orig_node) {
+                        bat_dbg(DBG_TT, bat_priv,
+                                "Deleting %pM from global tt entry %pM: %s\n",
+                                orig_node->orig, tt_global_entry->common.addr,
+                                message);
+                        hlist_del_rcu(node);
+                        tt_orig_list_entry_free_ref(orig_entry);
+                }
+        }
+        spin_unlock_bh(&tt_global_entry->list_lock);
+}
 
-        atomic_dec(&tt_global_entry->orig_node->tt_size);
+static void tt_global_del_struct(struct bat_priv *bat_priv,
+                                 struct tt_global_entry *tt_global_entry,
+                                 const char *message)
+{
+        bat_dbg(DBG_TT, bat_priv,
+                "Deleting global tt entry %pM: %s\n",
+                tt_global_entry->common.addr, message);
 
         hash_remove(bat_priv->tt_global_hash, compare_tt, choose_orig,
                     tt_global_entry->common.addr);
-out:
-        if (tt_global_entry)
-                tt_global_entry_free_ref(tt_global_entry);
+        tt_global_entry_free_ref(tt_global_entry);
+
+}
+
+/* If the client is to be deleted, we check if it is the last origantor entry
+ * within tt_global entry. If yes, we set the TT_CLIENT_ROAM flag and the timer,
+ * otherwise we simply remove the originator scheduled for deletion.
+ */
+static void tt_global_del_roaming(struct bat_priv *bat_priv,
+                                  struct tt_global_entry *tt_global_entry,
+                                  struct orig_node *orig_node,
+                                  const char *message)
+{
+        bool last_entry = true;
+        struct hlist_head *head;
+        struct hlist_node *node;
+        struct tt_orig_list_entry *orig_entry;
+
+        /* no local entry exists, case 1:
+         * Check if this is the last one or if other entries exist.
+         */
+
+        rcu_read_lock();
+        head = &tt_global_entry->orig_list;
+        hlist_for_each_entry_rcu(orig_entry, node, head, list) {
+                if (orig_entry->orig_node != orig_node) {
+                        last_entry = false;
+                        break;
+                }
+        }
+        rcu_read_unlock();
+
+        if (last_entry) {
+                /* its the last one, mark for roaming. */
+                tt_global_entry->common.flags |= TT_CLIENT_ROAM;
+                tt_global_entry->roam_at = jiffies;
+        } else
+                /* there is another entry, we can simply delete this
+                 * one and can still use the other one.
+                 */
+                tt_global_del_orig_entry(bat_priv, tt_global_entry,
+                                         orig_node, message);
 }
 
-void tt_global_del(struct bat_priv *bat_priv,
-                   struct orig_node *orig_node, const unsigned char *addr,
-                   const char *message, bool roaming)
+
+
+static void tt_global_del(struct bat_priv *bat_priv,
+                          struct orig_node *orig_node,
+                          const unsigned char *addr,
+                          const char *message, bool roaming)
 {
         struct tt_global_entry *tt_global_entry = NULL;
         struct tt_local_entry *tt_local_entry = NULL;
@@ -668,26 +828,42 @@ void tt_global_del(struct bat_priv *bat_priv,
         if (!tt_global_entry)
                 goto out;
 
-        if (tt_global_entry->orig_node == orig_node) {
-                if (roaming) {
-                        /* if we are deleting a global entry due to a roam
-                         * event, there are two possibilities:
-                         * 1) the client roamed from node A to node B => we mark
-                         *    it with TT_CLIENT_ROAM, we start a timer and we
-                         *    wait for node B to claim it. In case of timeout
-                         *    the entry is purged.
-                         * 2) the client roamed to us => we can directly delete
-                         *    the global entry, since it is useless now. */
-                        tt_local_entry = tt_local_hash_find(bat_priv,
-                                                            tt_global_entry->common.addr);
-                        if (!tt_local_entry) {
-                                tt_global_entry->common.flags |= TT_CLIENT_ROAM;
-                                tt_global_entry->roam_at = jiffies;
-                                goto out;
-                        }
-                }
-                _tt_global_del(bat_priv, tt_global_entry, message);
+        if (!roaming) {
+                tt_global_del_orig_entry(bat_priv, tt_global_entry, orig_node,
+                                         message);
+
+                if (hlist_empty(&tt_global_entry->orig_list))
+                        tt_global_del_struct(bat_priv, tt_global_entry,
+                                             message);
+
+                goto out;
         }
+
+        /* if we are deleting a global entry due to a roam
+         * event, there are two possibilities:
+         * 1) the client roamed from node A to node B => if there
+         *    is only one originator left for this client, we mark
+         *    it with TT_CLIENT_ROAM, we start a timer and we
+         *    wait for node B to claim it. In case of timeout
+         *    the entry is purged.
+         *
+         *    If there are other originators left, we directly delete
+         *    the originator.
+         * 2) the client roamed to us => we can directly delete
+         *    the global entry, since it is useless now. */
+
+        tt_local_entry = tt_local_hash_find(bat_priv,
+                                            tt_global_entry->common.addr);
+        if (tt_local_entry) {
+                /* local entry exists, case 2: client roamed to us. */
+                tt_global_del_orig_list(tt_global_entry);
+                tt_global_del_struct(bat_priv, tt_global_entry, message);
+        } else
+                /* no local entry exists, case 1: check for roaming */
+                tt_global_del_roaming(bat_priv, tt_global_entry, orig_node,
+                                      message);
+
+
 out:
         if (tt_global_entry)
                 tt_global_entry_free_ref(tt_global_entry);
@@ -715,16 +891,18 @@ void tt_global_del_orig(struct bat_priv *bat_priv,
 
                 spin_lock_bh(list_lock);
                 hlist_for_each_entry_safe(tt_common_entry, node, safe,
-                                         head, hash_entry) {
+                                          head, hash_entry) {
                         tt_global_entry = container_of(tt_common_entry,
                                                        struct tt_global_entry,
                                                        common);
-                        if (tt_global_entry->orig_node == orig_node) {
+
+                        tt_global_del_orig_entry(bat_priv, tt_global_entry,
+                                                 orig_node, message);
+
+                        if (hlist_empty(&tt_global_entry->orig_list)) {
                                 bat_dbg(DBG_TT, bat_priv,
-                                        "Deleting global tt entry %pM "
-                                        "(via %pM): %s\n",
+                                        "Deleting global tt entry %pM: %s\n",
                                         tt_global_entry->common.addr,
-                                        tt_global_entry->orig_node->orig,
                                         message);
                                 hlist_del_rcu(node);
                                 tt_global_entry_free_ref(tt_global_entry);
@@ -733,6 +911,7 @@ void tt_global_del_orig(struct bat_priv *bat_priv,
                 spin_unlock_bh(list_lock);
         }
         atomic_set(&orig_node->tt_size, 0);
+        orig_node->tt_initialised = false;
 }
 
 static void tt_global_roam_purge(struct bat_priv *bat_priv)
@@ -757,14 +936,14 @@ static void tt_global_roam_purge(struct bat_priv *bat_priv)
                                                        common);
                         if (!(tt_global_entry->common.flags & TT_CLIENT_ROAM))
                                 continue;
-                        if (!is_out_of_time(tt_global_entry->roam_at,
-                                            TT_CLIENT_ROAM_TIMEOUT * 1000))
+                        if (!has_timed_out(tt_global_entry->roam_at,
+                                           TT_CLIENT_ROAM_TIMEOUT))
                                 continue;
 
-                        bat_dbg(DBG_TT, bat_priv, "Deleting global "
-                                "tt entry (%pM): Roaming timeout\n",
+                        bat_dbg(DBG_TT, bat_priv,
+                                "Deleting global tt entry (%pM): Roaming timeout\n",
                                 tt_global_entry->common.addr);
-                        atomic_dec(&tt_global_entry->orig_node->tt_size);
+
                         hlist_del_rcu(node);
                         tt_global_entry_free_ref(tt_global_entry);
                 }
@@ -827,6 +1006,11 @@ struct orig_node *transtable_search(struct bat_priv *bat_priv,
         struct tt_local_entry *tt_local_entry = NULL;
         struct tt_global_entry *tt_global_entry = NULL;
         struct orig_node *orig_node = NULL;
+        struct neigh_node *router = NULL;
+        struct hlist_head *head;
+        struct hlist_node *node;
+        struct tt_orig_list_entry *orig_entry;
+        int best_tq;
 
         if (src && atomic_read(&bat_priv->ap_isolation)) {
                 tt_local_entry = tt_local_hash_find(bat_priv, src);
@@ -843,16 +1027,25 @@ struct orig_node *transtable_search(struct bat_priv *bat_priv,
         if (tt_local_entry && _is_ap_isolated(tt_local_entry, tt_global_entry))
                 goto out;
 
-        if (!atomic_inc_not_zero(&tt_global_entry->orig_node->refcount))
-                goto out;
-
-        /* A global client marked as PENDING has already moved from that
-         * originator */
-        if (tt_global_entry->common.flags & TT_CLIENT_PENDING)
-                goto out;
+        best_tq = 0;
 
-        orig_node = tt_global_entry->orig_node;
+        rcu_read_lock();
+        head = &tt_global_entry->orig_list;
+        hlist_for_each_entry_rcu(orig_entry, node, head, list) {
+                router = orig_node_get_router(orig_entry->orig_node);
+                if (!router)
+                        continue;
 
+                if (router->tq_avg > best_tq) {
+                        orig_node = orig_entry->orig_node;
+                        best_tq = router->tq_avg;
+                }
+                neigh_node_free_ref(router);
+        }
+        /* found anything? */
+        if (orig_node && !atomic_inc_not_zero(&orig_node->refcount))
+                orig_node = NULL;
+        rcu_read_unlock();
 out:
         if (tt_global_entry)
                 tt_global_entry_free_ref(tt_global_entry);
@@ -863,7 +1056,8 @@ out:
 }
 
 /* Calculates the checksum of the local table of a given orig_node */
-uint16_t tt_global_crc(struct bat_priv *bat_priv, struct orig_node *orig_node)
+static uint16_t tt_global_crc(struct bat_priv *bat_priv,
+                              struct orig_node *orig_node)
 {
         uint16_t total = 0, total_one;
         struct hashtable_t *hash = bat_priv->tt_global_hash;
@@ -883,20 +1077,26 @@ uint16_t tt_global_crc(struct bat_priv *bat_priv, struct orig_node *orig_node)
                         tt_global_entry = container_of(tt_common_entry,
                                                        struct tt_global_entry,
                                                        common);
-                        if (compare_eth(tt_global_entry->orig_node,
-                                        orig_node)) {
-                                /* Roaming clients are in the global table for
-                                 * consistency only. They don't have to be
-                                 * taken into account while computing the
-                                 * global crc */
-                                if (tt_common_entry->flags & TT_CLIENT_ROAM)
-                                        continue;
-                                total_one = 0;
-                                for (j = 0; j < ETH_ALEN; j++)
-                                        total_one = crc16_byte(total_one,
-                                                tt_common_entry->addr[j]);
-                                total ^= total_one;
-                        }
+                        /* Roaming clients are in the global table for
+                         * consistency only. They don't have to be
+                         * taken into account while computing the
+                         * global crc
+                         */
+                        if (tt_global_entry->common.flags & TT_CLIENT_ROAM)
+                                continue;
+
+                        /* find out if this global entry is announced by this
+                         * originator
+                         */
+                        if (!tt_global_entry_has_orig(tt_global_entry,
+                                                      orig_node))
+                                continue;
+
+                        total_one = 0;
+                        for (j = 0; j < ETH_ALEN; j++)
+                                total_one = crc16_byte(total_one,
+                                        tt_global_entry->common.addr[j]);
+                        total ^= total_one;
                 }
                 rcu_read_unlock();
         }
@@ -951,8 +1151,10 @@ static void tt_req_list_free(struct bat_priv *bat_priv)
         spin_unlock_bh(&bat_priv->tt_req_list_lock);
 }
 
-void tt_save_orig_buffer(struct bat_priv *bat_priv, struct orig_node *orig_node,
-                         const unsigned char *tt_buff, uint8_t tt_num_changes)
+static void tt_save_orig_buffer(struct bat_priv *bat_priv,
+                                struct orig_node *orig_node,
+                                const unsigned char *tt_buff,
+                                uint8_t tt_num_changes)
 {
         uint16_t tt_buff_len = tt_len(tt_num_changes);
 
@@ -977,8 +1179,7 @@ static void tt_req_purge(struct bat_priv *bat_priv)
 
         spin_lock_bh(&bat_priv->tt_req_list_lock);
         list_for_each_entry_safe(node, safe, &bat_priv->tt_req_list, list) {
-                if (is_out_of_time(node->issued_at,
-                    TT_REQUEST_TIMEOUT * 1000)) {
+                if (has_timed_out(node->issued_at, TT_REQUEST_TIMEOUT)) {
                         list_del(&node->list);
                         kfree(node);
                 }
@@ -996,8 +1197,8 @@ static struct tt_req_node *new_tt_req_node(struct bat_priv *bat_priv,
         spin_lock_bh(&bat_priv->tt_req_list_lock);
         list_for_each_entry(tt_req_node_tmp, &bat_priv->tt_req_list, list) {
                 if (compare_eth(tt_req_node_tmp, orig_node) &&
-                    !is_out_of_time(tt_req_node_tmp->issued_at,
-                                    TT_REQUEST_TIMEOUT * 1000))
+                    !has_timed_out(tt_req_node_tmp->issued_at,
+                                   TT_REQUEST_TIMEOUT))
                         goto unlock;
         }
 
@@ -1036,7 +1237,7 @@ static int tt_global_valid_entry(const void *entry_ptr, const void *data_ptr)
         tt_global_entry = container_of(tt_common_entry, struct tt_global_entry,
                                        common);
 
-        return (tt_global_entry->orig_node == orig_node);
+        return tt_global_entry_has_orig(tt_global_entry, orig_node);
 }
 
 static struct sk_buff *tt_response_fill_table(uint16_t tt_len, uint8_t ttvn,
@@ -1134,13 +1335,13 @@ static int send_tt_request(struct bat_priv *bat_priv,
         tt_request = (struct tt_query_packet *)skb_put(skb,
                                 sizeof(struct tt_query_packet));
 
-        tt_request->packet_type = BAT_TT_QUERY;
-        tt_request->version = COMPAT_VERSION;
+        tt_request->header.packet_type = BAT_TT_QUERY;
+        tt_request->header.version = COMPAT_VERSION;
         memcpy(tt_request->src, primary_if->net_dev->dev_addr, ETH_ALEN);
         memcpy(tt_request->dst, dst_orig_node->orig, ETH_ALEN);
-        tt_request->ttl = TTL;
+        tt_request->header.ttl = TTL;
         tt_request->ttvn = ttvn;
-        tt_request->tt_data = tt_crc;
+        tt_request->tt_data = htons(tt_crc);
         tt_request->flags = TT_REQUEST;
 
         if (full_table)
@@ -1150,8 +1351,9 @@ static int send_tt_request(struct bat_priv *bat_priv,
         if (!neigh_node)
                 goto out;
 
-        bat_dbg(DBG_TT, bat_priv, "Sending TT_REQUEST to %pM via %pM "
-                "[%c]\n", dst_orig_node->orig, neigh_node->addr,
+        bat_dbg(DBG_TT, bat_priv,
+                "Sending TT_REQUEST to %pM via %pM [%c]\n",
+                dst_orig_node->orig, neigh_node->addr,
                 (full_table ? 'F' : '.'));
 
         send_skb_packet(skb, neigh_node->if_incoming, neigh_node->addr);
@@ -1188,9 +1390,8 @@ static bool send_other_tt_response(struct bat_priv *bat_priv,
         struct tt_query_packet *tt_response;
 
         bat_dbg(DBG_TT, bat_priv,
-                "Received TT_REQUEST from %pM for "
-                "ttvn: %u (%pM) [%c]\n", tt_request->src,
-                tt_request->ttvn, tt_request->dst,
+                "Received TT_REQUEST from %pM for ttvn: %u (%pM) [%c]\n",
+                tt_request->src, tt_request->ttvn, tt_request->dst,
                 (tt_request->flags & TT_FULL_TABLE ? 'F' : '.'));
 
         /* Let's get the orig node of the REAL destination */
@@ -1264,9 +1465,9 @@ static bool send_other_tt_response(struct bat_priv *bat_priv,
                 tt_response = (struct tt_query_packet *)skb->data;
         }
 
-        tt_response->packet_type = BAT_TT_QUERY;
-        tt_response->version = COMPAT_VERSION;
-        tt_response->ttl = TTL;
+        tt_response->header.packet_type = BAT_TT_QUERY;
+        tt_response->header.version = COMPAT_VERSION;
+        tt_response->header.ttl = TTL;
         memcpy(tt_response->src, req_dst_orig_node->orig, ETH_ALEN);
         memcpy(tt_response->dst, tt_request->src, ETH_ALEN);
         tt_response->flags = TT_RESPONSE;
@@ -1315,9 +1516,8 @@ static bool send_my_tt_response(struct bat_priv *bat_priv,
         struct tt_query_packet *tt_response;
 
         bat_dbg(DBG_TT, bat_priv,
-                "Received TT_REQUEST from %pM for "
-                "ttvn: %u (me) [%c]\n", tt_request->src,
-                tt_request->ttvn,
+                "Received TT_REQUEST from %pM for ttvn: %u (me) [%c]\n",
+                tt_request->src, tt_request->ttvn,
                 (tt_request->flags & TT_FULL_TABLE ? 'F' : '.'));
 
 
@@ -1381,9 +1581,9 @@ static bool send_my_tt_response(struct bat_priv *bat_priv,
                 tt_response = (struct tt_query_packet *)skb->data;
         }
 
-        tt_response->packet_type = BAT_TT_QUERY;
-        tt_response->version = COMPAT_VERSION;
-        tt_response->ttl = TTL;
+        tt_response->header.packet_type = BAT_TT_QUERY;
+        tt_response->header.version = COMPAT_VERSION;
+        tt_response->header.ttl = TTL;
         memcpy(tt_response->src, primary_if->net_dev->dev_addr, ETH_ALEN);
         memcpy(tt_response->dst, tt_request->src, ETH_ALEN);
         tt_response->flags = TT_RESPONSE;
@@ -1418,10 +1618,15 @@ out:
 bool send_tt_response(struct bat_priv *bat_priv,
                       struct tt_query_packet *tt_request)
 {
-        if (is_my_mac(tt_request->dst))
+        if (is_my_mac(tt_request->dst)) {
+                /* don't answer backbone gws! */
+                if (bla_is_backbone_gw_orig(bat_priv, tt_request->src))
+                        return true;
+
                 return send_my_tt_response(bat_priv, tt_request);
-        else
+        } else {
                 return send_other_tt_response(bat_priv, tt_request);
+        }
 }
 
 static void _tt_update_changes(struct bat_priv *bat_priv,
@@ -1450,6 +1655,7 @@ static void _tt_update_changes(struct bat_priv *bat_priv,
                                  */
                                 return;
         }
+        orig_node->tt_initialised = true;
 }
 
 static void tt_fill_gtable(struct bat_priv *bat_priv,
@@ -1519,12 +1725,15 @@ void handle_tt_response(struct bat_priv *bat_priv,
         struct tt_req_node *node, *safe;
         struct orig_node *orig_node = NULL;
 
-        bat_dbg(DBG_TT, bat_priv, "Received TT_RESPONSE from %pM for "
-                "ttvn %d t_size: %d [%c]\n",
-                tt_response->src, tt_response->ttvn,
-                tt_response->tt_data,
+        bat_dbg(DBG_TT, bat_priv,
+                "Received TT_RESPONSE from %pM for ttvn %d t_size: %d [%c]\n",
+                tt_response->src, tt_response->ttvn, tt_response->tt_data,
                 (tt_response->flags & TT_FULL_TABLE ? 'F' : '.'));
 
+        /* we should have never asked a backbone gw */
+        if (bla_is_backbone_gw_orig(bat_priv, tt_response->src))
+                goto out;
+
         orig_node = orig_hash_find(bat_priv, tt_response->src);
         if (!orig_node)
                 goto out;
@@ -1589,8 +1798,7 @@ static void tt_roam_purge(struct bat_priv *bat_priv)
 
         spin_lock_bh(&bat_priv->tt_roam_list_lock);
         list_for_each_entry_safe(node, safe, &bat_priv->tt_roam_list, list) {
-                if (!is_out_of_time(node->first_time,
-                                    ROAMING_MAX_TIME * 1000))
+                if (!has_timed_out(node->first_time, ROAMING_MAX_TIME))
                         continue;
 
                 list_del(&node->list);
@@ -1617,8 +1825,7 @@ static bool tt_check_roam_count(struct bat_priv *bat_priv,
                 if (!compare_eth(tt_roam_node->addr, client))
                         continue;
 
-                if (is_out_of_time(tt_roam_node->first_time,
-                                   ROAMING_MAX_TIME * 1000))
+                if (has_timed_out(tt_roam_node->first_time, ROAMING_MAX_TIME))
                         continue;
 
                 if (!atomic_dec_not_zero(&tt_roam_node->counter))
@@ -1646,8 +1853,8 @@ unlock:
         return ret;
 }
 
-void send_roam_adv(struct bat_priv *bat_priv, uint8_t *client,
-                   struct orig_node *orig_node)
+static void send_roam_adv(struct bat_priv *bat_priv, uint8_t *client,
+                          struct orig_node *orig_node)
 {
         struct neigh_node *neigh_node = NULL;
         struct sk_buff *skb = NULL;
@@ -1669,9 +1876,9 @@ void send_roam_adv(struct bat_priv *bat_priv, uint8_t *client,
         roam_adv_packet = (struct roam_adv_packet *)skb_put(skb,
                                         sizeof(struct roam_adv_packet));
 
-        roam_adv_packet->packet_type = BAT_ROAM_ADV;
-        roam_adv_packet->version = COMPAT_VERSION;
-        roam_adv_packet->ttl = TTL;
+        roam_adv_packet->header.packet_type = BAT_ROAM_ADV;
+        roam_adv_packet->header.version = COMPAT_VERSION;
+        roam_adv_packet->header.ttl = TTL;
         primary_if = primary_if_get_selected(bat_priv);
         if (!primary_if)
                 goto out;
@@ -1788,8 +1995,9 @@ static void tt_local_purge_pending_clients(struct bat_priv *bat_priv)
                         if (!(tt_common_entry->flags & TT_CLIENT_PENDING))
                                 continue;
 
-                        bat_dbg(DBG_TT, bat_priv, "Deleting local tt entry "
-                                "(%pM): pending\n", tt_common_entry->addr);
+                        bat_dbg(DBG_TT, bat_priv,
+                                "Deleting local tt entry (%pM): pending\n",
+                                tt_common_entry->addr);
 
                         atomic_dec(&bat_priv->num_local_tt);
                         hlist_del_rcu(node);
@@ -1814,6 +2022,8 @@ void tt_commit_changes(struct bat_priv *bat_priv)
 
         /* Increment the TTVN only once per OGM interval */
         atomic_inc(&bat_priv->ttvn);
+        bat_dbg(DBG_TT, bat_priv, "Local changes committed, updating to ttvn %u\n",
+                (uint8_t)atomic_read(&bat_priv->ttvn));
         bat_priv->tt_poss_change = false;
 }
 
@@ -1854,8 +2064,14 @@ void tt_update_orig(struct bat_priv *bat_priv, struct orig_node *orig_node,
         uint8_t orig_ttvn = (uint8_t)atomic_read(&orig_node->last_ttvn);
         bool full_table = true;
 
-        /* the ttvn increased by one -> we can apply the attached changes */
-        if (ttvn - orig_ttvn == 1) {
+        /* don't care about a backbone gateways updates. */
+        if (bla_is_backbone_gw_orig(bat_priv, orig_node->orig))
+                return;
+
+        /* orig table not initialised AND first diff is in the OGM OR the ttvn
+         * increased by one -> we can apply the attached changes */
+        if ((!orig_node->tt_initialised && ttvn == 1) ||
+            ttvn - orig_ttvn == 1) {
                 /* the OGM could not contain the changes due to their size or
                  * because they have already been sent TT_OGM_APPEND_MAX times.
                  * In this case send a tt request */
@@ -1889,17 +2105,36 @@ void tt_update_orig(struct bat_priv *bat_priv, struct orig_node *orig_node,
         } else {
                 /* if we missed more than one change or our tables are not
                  * in sync anymore -> request fresh tt data */
-                if (ttvn != orig_ttvn || orig_node->tt_crc != tt_crc) {
+
+                if (!orig_node->tt_initialised || ttvn != orig_ttvn ||
+                    orig_node->tt_crc != tt_crc) {
 request_table:
-                        bat_dbg(DBG_TT, bat_priv, "TT inconsistency for %pM. "
-                                "Need to retrieve the correct information "
-                                "(ttvn: %u last_ttvn: %u crc: %u last_crc: "
-                                "%u num_changes: %u)\n", orig_node->orig, ttvn,
-                                orig_ttvn, tt_crc, orig_node->tt_crc,
-                                tt_num_changes);
+                        bat_dbg(DBG_TT, bat_priv,
+                                "TT inconsistency for %pM. Need to retrieve the correct information (ttvn: %u last_ttvn: %u crc: %u last_crc: %u num_changes: %u)\n",
+                                orig_node->orig, ttvn, orig_ttvn, tt_crc,
+                                orig_node->tt_crc, tt_num_changes);
                         send_tt_request(bat_priv, orig_node, ttvn, tt_crc,
                                         full_table);
                         return;
                 }
         }
 }
+
+/* returns true whether we know that the client has moved from its old
+ * originator to another one. This entry is kept is still kept for consistency
+ * purposes
+ */
+bool tt_global_client_is_roaming(struct bat_priv *bat_priv, uint8_t *addr)
+{
+        struct tt_global_entry *tt_global_entry;
+        bool ret = false;
+
+        tt_global_entry = tt_global_hash_find(bat_priv, addr);
+        if (!tt_global_entry)
+                goto out;
+
+        ret = tt_global_entry->common.flags & TT_CLIENT_ROAM;
+        tt_global_entry_free_ref(tt_global_entry);
+out:
+        return ret;
+}
diff --git a/net/batman-adv/translation-table.h b/net/batman-adv/translation-table.h
index 30efd49881a3..c43374dc364d 100644
--- a/net/batman-adv/translation-table.h
+++ b/net/batman-adv/translation-table.h
@@ -1,7 +1,7 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
- * Marek Lindner, Simon Wunderlich
+ * Marek Lindner, Simon Wunderlich, Antonio Quartulli
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of version 2 of the GNU General Public
@@ -39,27 +39,21 @@ int tt_global_add(struct bat_priv *bat_priv, struct orig_node *orig_node,
 int tt_global_seq_print_text(struct seq_file *seq, void *offset);
 void tt_global_del_orig(struct bat_priv *bat_priv,
                         struct orig_node *orig_node, const char *message);
-void tt_global_del(struct bat_priv *bat_priv,
-                   struct orig_node *orig_node, const unsigned char *addr,
-                   const char *message, bool roaming);
 struct orig_node *transtable_search(struct bat_priv *bat_priv,
                                     const uint8_t *src, const uint8_t *addr);
-void tt_save_orig_buffer(struct bat_priv *bat_priv, struct orig_node *orig_node,
-                         const unsigned char *tt_buff, uint8_t tt_num_changes);
 uint16_t tt_local_crc(struct bat_priv *bat_priv);
-uint16_t tt_global_crc(struct bat_priv *bat_priv, struct orig_node *orig_node);
 void tt_free(struct bat_priv *bat_priv);
 bool send_tt_response(struct bat_priv *bat_priv,
                       struct tt_query_packet *tt_request);
 bool is_my_client(struct bat_priv *bat_priv, const uint8_t *addr);
 void handle_tt_response(struct bat_priv *bat_priv,
                         struct tt_query_packet *tt_response);
-void send_roam_adv(struct bat_priv *bat_priv, uint8_t *client,
-                   struct orig_node *orig_node);
 void tt_commit_changes(struct bat_priv *bat_priv);
 bool is_ap_isolated(struct bat_priv *bat_priv, uint8_t *src, uint8_t *dst);
 void tt_update_orig(struct bat_priv *bat_priv, struct orig_node *orig_node,
                     const unsigned char *tt_buff, uint8_t tt_num_changes,
                     uint8_t ttvn, uint16_t tt_crc);
+bool tt_global_client_is_roaming(struct bat_priv *bat_priv, uint8_t *addr);
+
 
 #endif /* _NET_BATMAN_ADV_TRANSLATION_TABLE_H_ */
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index e9eb043719ac..61308e8016ff 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2007-2012 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner, Simon Wunderlich
  *
@@ -27,7 +27,7 @@
 #include "packet.h"
 #include "bitarray.h"
 
-#define BAT_HEADER_LEN (sizeof(struct ethhdr) + \
+#define BAT_HEADER_LEN (ETH_HLEN + \
         ((sizeof(struct unicast_packet) > sizeof(struct bcast_packet) ? \
          sizeof(struct unicast_packet) : \
          sizeof(struct bcast_packet))))
@@ -52,7 +52,7 @@ struct hard_iface {
 /**
  *      orig_node - structure for orig_list maintaining nodes of mesh
  *      @primary_addr: hosts primary interface address
- *      @last_valid: when last packet from this node was received
+ *      @last_seen: when last packet from this node was received
  *      @bcast_seqno_reset: time when the broadcast seqno window was reset
  *      @batman_seqno_reset: time when the batman seqno window was reset
  *      @gw_flags: flags related to gateway class
@@ -70,7 +70,7 @@ struct orig_node {
         struct neigh_node __rcu *router; /* rcu protected pointer */
         unsigned long *bcast_own;
         uint8_t *bcast_own_sum;
-        unsigned long last_valid;
+        unsigned long last_seen;
         unsigned long bcast_seqno_reset;
         unsigned long batman_seqno_reset;
         uint8_t gw_flags;
@@ -81,6 +81,7 @@ struct orig_node {
         int16_t tt_buff_len;
         spinlock_t tt_buff_lock; /* protects tt_buff */
         atomic_t tt_size;
+        bool tt_initialised;
         /* The tt_poss_change flag is used to detect an ongoing roaming phase.
          * If true, then I sent a Roaming_adv to this orig_node and I have to
          * inspect every packet directed to it to check whether it is still
@@ -89,7 +90,7 @@ struct orig_node {
         bool tt_poss_change;
         uint32_t last_real_seqno;
         uint8_t last_ttl;
-        unsigned long bcast_bits[NUM_WORDS];
+        DECLARE_BITMAP(bcast_bits, TQ_LOCAL_WINDOW_SIZE);
         uint32_t last_bcast_seqno;
         struct hlist_head neigh_list;
         struct list_head frag_list;
@@ -119,7 +120,7 @@ struct gw_node {
 
 /**
  *      neigh_node
- *      @last_valid: when last packet via this neighbor was received
+ *      @last_seen: when last packet via this neighbor was received
  */
 struct neigh_node {
         struct hlist_node list;
@@ -130,15 +131,22 @@ struct neigh_node {
         uint8_t tq_avg;
         uint8_t last_ttl;
         struct list_head bonding_list;
-        unsigned long last_valid;
-        unsigned long real_bits[NUM_WORDS];
+        unsigned long last_seen;
+        DECLARE_BITMAP(real_bits, TQ_LOCAL_WINDOW_SIZE);
         atomic_t refcount;
         struct rcu_head rcu;
         struct orig_node *orig_node;
         struct hard_iface *if_incoming;
-        spinlock_t tq_lock;     /* protects: tq_recv, tq_index */
+        spinlock_t lq_update_lock;      /* protects: tq_recv, tq_index */
 };
 
+#ifdef CONFIG_BATMAN_ADV_BLA
+struct bcast_duplist_entry {
+        uint8_t orig[ETH_ALEN];
+        uint16_t crc;
+        unsigned long entrytime;
+};
+#endif
 
 struct bat_priv {
         atomic_t mesh_state;
@@ -147,6 +155,7 @@ struct bat_priv {
         atomic_t bonding;               /* boolean */
         atomic_t fragmentation;         /* boolean */
         atomic_t ap_isolation;          /* boolean */
+        atomic_t bridge_loop_avoidance; /* boolean */
         atomic_t vis_mode;              /* VIS_TYPE_* */
         atomic_t gw_mode;               /* GW_MODE_* */
         atomic_t gw_sel_class;          /* uint */
@@ -160,6 +169,7 @@ struct bat_priv {
         atomic_t ttvn; /* translation table version number */
         atomic_t tt_ogm_append_cnt;
         atomic_t tt_local_changes; /* changes registered in a OGM interval */
+        atomic_t bla_num_requests; /* number of bla requests in flight */
         /* The tt_poss_change flag is used to detect an ongoing roaming phase.
          * If true, then I received a Roaming_adv and I have to inspect every
          * packet directed to me to check whether I am still the true
@@ -173,15 +183,23 @@ struct bat_priv {
         struct hlist_head forw_bat_list;
         struct hlist_head forw_bcast_list;
         struct hlist_head gw_list;
-        struct hlist_head softif_neigh_vids;
         struct list_head tt_changes_list; /* tracks changes in a OGM int */
         struct list_head vis_send_list;
         struct hashtable_t *orig_hash;
         struct hashtable_t *tt_local_hash;
         struct hashtable_t *tt_global_hash;
+#ifdef CONFIG_BATMAN_ADV_BLA
+        struct hashtable_t *claim_hash;
+        struct hashtable_t *backbone_hash;
+#endif
         struct list_head tt_req_list; /* list of pending tt_requests */
         struct list_head tt_roam_list;
         struct hashtable_t *vis_hash;
+#ifdef CONFIG_BATMAN_ADV_BLA
+        struct bcast_duplist_entry bcast_duplist[DUPLIST_SIZE];
+        int bcast_duplist_curr;
+        struct bla_claim_dst claim_dest;
+#endif
         spinlock_t forw_bat_list_lock; /* protects forw_bat_list */
         spinlock_t forw_bcast_list_lock; /* protects  */
         spinlock_t tt_changes_list_lock; /* protects tt_changes */
@@ -190,8 +208,6 @@ struct bat_priv {
         spinlock_t gw_list_lock; /* protects gw_list and curr_gw */
         spinlock_t vis_hash_lock; /* protects vis_hash */
         spinlock_t vis_list_lock; /* protects vis_info::recv_list */
-        spinlock_t softif_neigh_lock; /* protects soft-interface neigh list */
-        spinlock_t softif_neigh_vid_lock; /* protects soft-interface vid list */
         atomic_t num_local_tt;
         /* Checksum of the local table, recomputed before sending a new OGM */
         atomic_t tt_crc;
@@ -201,10 +217,12 @@ struct bat_priv {
         struct delayed_work tt_work;
         struct delayed_work orig_work;
         struct delayed_work vis_work;
+        struct delayed_work bla_work;
         struct gw_node __rcu *curr_gw;  /* rcu protected pointer */
         atomic_t gw_reselect;
         struct hard_iface __rcu *primary_if;  /* rcu protected pointer */
         struct vis_info *my_vis_info;
+        struct bat_algo_ops *bat_algo_ops;
 };
 
 struct socket_client {
@@ -237,11 +255,42 @@ struct tt_local_entry {
 
 struct tt_global_entry {
         struct tt_common_entry common;
+        struct hlist_head orig_list;
+        spinlock_t list_lock;   /* protects the list */
+        unsigned long roam_at; /* time at which TT_GLOBAL_ROAM was set */
+};
+
+struct tt_orig_list_entry {
         struct orig_node *orig_node;
         uint8_t ttvn;
-        unsigned long roam_at; /* time at which TT_GLOBAL_ROAM was set */
+        struct rcu_head rcu;
+        struct hlist_node list;
 };
 
+#ifdef CONFIG_BATMAN_ADV_BLA
+struct backbone_gw {
+        uint8_t orig[ETH_ALEN];
+        short vid;              /* used VLAN ID */
+        struct hlist_node hash_entry;
+        struct bat_priv *bat_priv;
+        unsigned long lasttime; /* last time we heard of this backbone gw */
+        atomic_t request_sent;
+        atomic_t refcount;
+        struct rcu_head rcu;
+        uint16_t crc;           /* crc checksum over all claims */
+};
+
+struct claim {
+        uint8_t addr[ETH_ALEN];
+        short vid;
+        struct backbone_gw *backbone_gw;
+        unsigned long lasttime; /* last time we heard of claim (locals only) */
+        struct rcu_head rcu;
+        atomic_t refcount;
+        struct hlist_node hash_entry;
+};
+#endif
+
 struct tt_change_node {
         struct list_head list;
         struct tt_change change;
@@ -325,22 +374,24 @@ struct recvlist_node {
         uint8_t mac[ETH_ALEN];
 };
 
-struct softif_neigh_vid {
+struct bat_algo_ops {
         struct hlist_node list;
-        struct bat_priv *bat_priv;
-        short vid;
-        atomic_t refcount;
-        struct softif_neigh __rcu *softif_neigh;
-        struct rcu_head rcu;
-        struct hlist_head softif_neigh_list;
-};
-
-struct softif_neigh {
-        struct hlist_node list;
-        uint8_t addr[ETH_ALEN];
-        unsigned long last_seen;
-        atomic_t refcount;
-        struct rcu_head rcu;
+        char *name;
+        /* init routing info when hard-interface is enabled */
+        int (*bat_iface_enable)(struct hard_iface *hard_iface);
+        /* de-init routing info when hard-interface is disabled */
+        void (*bat_iface_disable)(struct hard_iface *hard_iface);
+        /* (re-)init mac addresses of the protocol information
+         * belonging to this hard-interface
+         */
+        void (*bat_iface_update_mac)(struct hard_iface *hard_iface);
+        /* called when primary interface is selected / changed */
+        void (*bat_primary_iface_set)(struct hard_iface *hard_iface);
+        /* prepare a new outgoing OGM for the send queue */
+        void (*bat_ogm_schedule)(struct hard_iface *hard_iface,
+                                 int tt_num_changes);
+        /* send scheduled OGM */
+        void (*bat_ogm_emit)(struct forw_packet *forw_packet);
 };
 
 #endif /* _NET_BATMAN_ADV_TYPES_H_ */
diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c
index 07d1c1da89dd..74175c210858 100644
--- a/net/batman-adv/unicast.c
+++ b/net/batman-adv/unicast.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2010-2012 B.A.T.M.A.N. contributors:
  *
  * Andreas Langer
  *
@@ -66,8 +66,8 @@ static struct sk_buff *frag_merge_packet(struct list_head *head,
         kfree_skb(tmp_skb);
 
         memmove(skb->data + uni_diff, skb->data, hdr_len);
-        unicast_packet = (struct unicast_packet *) skb_pull(skb, uni_diff);
-        unicast_packet->packet_type = BAT_UNICAST;
+        unicast_packet = (struct unicast_packet *)skb_pull(skb, uni_diff);
+        unicast_packet->header.packet_type = BAT_UNICAST;
 
         return skb;
 
@@ -238,7 +238,7 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv,
                 goto dropped;
         skb_reserve(frag_skb, ucf_hdr_len);
 
-        unicast_packet = (struct unicast_packet *) skb->data;
+        unicast_packet = (struct unicast_packet *)skb->data;
         memcpy(&tmp_uc, unicast_packet, uc_hdr_len);
         skb_split(skb, frag_skb, data_len / 2 + uc_hdr_len);
 
@@ -251,9 +251,9 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv,
 
         memcpy(frag1, &tmp_uc, sizeof(tmp_uc));
 
-        frag1->ttl--;
-        frag1->version = COMPAT_VERSION;
-        frag1->packet_type = BAT_UNICAST_FRAG;
+        frag1->header.ttl--;
+        frag1->header.version = COMPAT_VERSION;
+        frag1->header.packet_type = BAT_UNICAST_FRAG;
 
         memcpy(frag1->orig, primary_if->net_dev->dev_addr, ETH_ALEN);
         memcpy(frag2, frag1, sizeof(*frag2));
@@ -320,22 +320,30 @@ find_router:
 
         unicast_packet = (struct unicast_packet *)skb->data;
 
-        unicast_packet->version = COMPAT_VERSION;
+        unicast_packet->header.version = COMPAT_VERSION;
         /* batman packet type: unicast */
-        unicast_packet->packet_type = BAT_UNICAST;
+        unicast_packet->header.packet_type = BAT_UNICAST;
         /* set unicast ttl */
-        unicast_packet->ttl = TTL;
+        unicast_packet->header.ttl = TTL;
         /* copy the destination for faster routing */
         memcpy(unicast_packet->dest, orig_node->orig, ETH_ALEN);
         /* set the destination tt version number */
         unicast_packet->ttvn =
                 (uint8_t)atomic_read(&orig_node->last_ttvn);
 
+        /* inform the destination node that we are still missing a correct route
+         * for this client. The destination will receive this packet and will
+         * try to reroute it because the ttvn contained in the header is less
+         * than the current one
+         */
+        if (tt_global_client_is_roaming(bat_priv, ethhdr->h_dest))
+                unicast_packet->ttvn = unicast_packet->ttvn - 1;
+
         if (atomic_read(&bat_priv->fragmentation) &&
             data_len + sizeof(*unicast_packet) >
                                 neigh_node->if_incoming->net_dev->mtu) {
                 /* send frag skb decreases ttl */
-                unicast_packet->ttl++;
+                unicast_packet->header.ttl++;
                 ret = frag_send_skb(skb, bat_priv,
                                     neigh_node->if_incoming, neigh_node->addr);
                 goto out;
diff --git a/net/batman-adv/unicast.h b/net/batman-adv/unicast.h
index 8fd5535544b9..a9faf6b1db19 100644
--- a/net/batman-adv/unicast.h
+++ b/net/batman-adv/unicast.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2010-2012 B.A.T.M.A.N. contributors:
  *
  * Andreas Langer
  *
diff --git a/net/batman-adv/vis.c b/net/batman-adv/vis.c
index cc3b9f2f3b5d..cec216fb77c7 100644
--- a/net/batman-adv/vis.c
+++ b/net/batman-adv/vis.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2008-2012 B.A.T.M.A.N. contributors:
  *
  * Simon Wunderlich
  *
@@ -434,12 +434,12 @@ static struct vis_info *add_packet(struct bat_priv *bat_priv,
                 return NULL;
 
         info->skb_packet = dev_alloc_skb(sizeof(*packet) + vis_info_len +
-                                         sizeof(struct ethhdr));
+                                         ETH_HLEN);
         if (!info->skb_packet) {
                 kfree(info);
                 return NULL;
         }
-        skb_reserve(info->skb_packet, sizeof(struct ethhdr));
+        skb_reserve(info->skb_packet, ETH_HLEN);
         packet = (struct vis_packet *)skb_put(info->skb_packet, sizeof(*packet)
                                               + vis_info_len);
 
@@ -617,7 +617,7 @@ static int generate_vis_packet(struct bat_priv *bat_priv)
         packet->vis_type = atomic_read(&bat_priv->vis_mode);
 
         memcpy(packet->target_orig, broadcast_addr, ETH_ALEN);
-        packet->ttl = TTL;
+        packet->header.ttl = TTL;
         packet->seqno = htonl(ntohl(packet->seqno) + 1);
         packet->entries = 0;
         skb_trim(info->skb_packet, sizeof(*packet));
@@ -714,8 +714,7 @@ static void purge_vis_packets(struct bat_priv *bat_priv)
                         if (info == bat_priv->my_vis_info)
                                 continue;
 
-                        if (time_after(jiffies,
-                                       info->first_seen + VIS_TIMEOUT * HZ)) {
+                        if (has_timed_out(info->first_seen, VIS_TIMEOUT)) {
                                 hlist_del(node);
                                 send_list_del(info);
                                 kref_put(&info->refcount, free_info);
@@ -818,19 +817,19 @@ static void send_vis_packet(struct bat_priv *bat_priv, struct vis_info *info)
                 goto out;
 
         packet = (struct vis_packet *)info->skb_packet->data;
-        if (packet->ttl < 2) {
+        if (packet->header.ttl < 2) {
                 pr_debug("Error - can't send vis packet: ttl exceeded\n");
                 goto out;
         }
 
         memcpy(packet->sender_orig, primary_if->net_dev->dev_addr, ETH_ALEN);
-        packet->ttl--;
+        packet->header.ttl--;
 
         if (is_broadcast_ether_addr(packet->target_orig))
                 broadcast_vis_packet(bat_priv, info);
         else
                 unicast_vis_packet(bat_priv, info);
-        packet->ttl++; /* restore TTL */
+        packet->header.ttl++; /* restore TTL */
 
 out:
         if (primary_if)
@@ -895,11 +894,11 @@ int vis_init(struct bat_priv *bat_priv)
 
         bat_priv->my_vis_info->skb_packet = dev_alloc_skb(sizeof(*packet) +
                                                           MAX_VIS_PACKET_SIZE +
-                                                         sizeof(struct ethhdr));
+                                                          ETH_HLEN);
         if (!bat_priv->my_vis_info->skb_packet)
                 goto free_info;
 
-        skb_reserve(bat_priv->my_vis_info->skb_packet, sizeof(struct ethhdr));
+        skb_reserve(bat_priv->my_vis_info->skb_packet, ETH_HLEN);
         packet = (struct vis_packet *)skb_put(bat_priv->my_vis_info->skb_packet,
                                               sizeof(*packet));
 
@@ -910,9 +909,9 @@ int vis_init(struct bat_priv *bat_priv)
         INIT_LIST_HEAD(&bat_priv->my_vis_info->send_list);
         kref_init(&bat_priv->my_vis_info->refcount);
         bat_priv->my_vis_info->bat_priv = bat_priv;
-        packet->version = COMPAT_VERSION;
-        packet->packet_type = BAT_VIS;
-        packet->ttl = TTL;
+        packet->header.version = COMPAT_VERSION;
+        packet->header.packet_type = BAT_VIS;
+        packet->header.ttl = TTL;
         packet->seqno = 0;
         packet->entries = 0;
 
diff --git a/net/batman-adv/vis.h b/net/batman-adv/vis.h
index 31b820d07f23..ee2e46e5347b 100644
--- a/net/batman-adv/vis.h
+++ b/net/batman-adv/vis.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008-2011 B.A.T.M.A.N. contributors:
+ * Copyright (C) 2008-2012 B.A.T.M.A.N. contributors:
  *
  * Simon Wunderlich, Marek Lindner
  *
@@ -22,7 +22,8 @@
 #ifndef _NET_BATMAN_ADV_VIS_H_
 #define _NET_BATMAN_ADV_VIS_H_
 
-#define VIS_TIMEOUT             200     /* timeout of vis packets in seconds */
+#define VIS_TIMEOUT             200000  /* timeout of vis packets
+                                         * in miliseconds */
 
 int vis_seq_print_text(struct seq_file *seq, void *offset);
 void receive_server_sync_packet(struct bat_priv *bat_priv,
diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig
index 9ec85eb8853d..3537d385035e 100644
--- a/net/bluetooth/Kconfig
+++ b/net/bluetooth/Kconfig
@@ -29,7 +29,6 @@ menuconfig BT
              BNEP Module (Bluetooth Network Encapsulation Protocol)
              CMTP Module (CAPI Message Transport Protocol)
              HIDP Module (Human Interface Device Protocol)
-             SMP Module (Security Manager Protocol)
 
           Say Y here to compile Bluetooth support into the kernel or say M to
           compile it as module (bluetooth).
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 72eb187a5f60..46e7f86acfc9 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -210,7 +210,7 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock)
                 }
 
                 if (sk->sk_state == BT_CONNECTED || !newsock ||
-                                                bt_sk(parent)->defer_setup) {
+                    test_bit(BT_DEFER_SETUP, &bt_sk(parent)->flags)) {
                         bt_accept_unlink(sk);
                         if (newsock)
                                 sock_graft(sk, newsock);
@@ -410,8 +410,8 @@ static inline unsigned int bt_accept_poll(struct sock *parent)
         list_for_each_safe(p, n, &bt_sk(parent)->accept_q) {
                 sk = (struct sock *) list_entry(p, struct bt_sock, accept_q);
                 if (sk->sk_state == BT_CONNECTED ||
-                                        (bt_sk(parent)->defer_setup &&
-                                                sk->sk_state == BT_CONNECT2))
+                    (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags) &&
+                     sk->sk_state == BT_CONNECT2))
                         return POLLIN | POLLRDNORM;
         }
 
@@ -450,7 +450,7 @@ unsigned int bt_sock_poll(struct file *file, struct socket *sock, poll_table *wa
                         sk->sk_state == BT_CONFIG)
                 return mask;
 
-        if (sock_writeable(sk))
+        if (!test_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags) && sock_writeable(sk))
                 mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
         else
                 set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index a779ec703323..031d7d656754 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -69,7 +69,7 @@ static struct bnep_session *__bnep_get_session(u8 *dst)
         BT_DBG("");
 
         list_for_each_entry(s, &bnep_session_list, list)
-                if (!compare_ether_addr(dst, s->eh.h_source))
+                if (ether_addr_equal(dst, s->eh.h_source))
                         return s;
 
         return NULL;
@@ -340,7 +340,7 @@ static inline int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb)
         }
 
         /* Strip 802.1p header */
-        if (ntohs(s->eh.h_proto) == 0x8100) {
+        if (ntohs(s->eh.h_proto) == ETH_P_8021Q) {
                 if (!skb_pull(skb, 4))
                         goto badframe;
                 s->eh.h_proto = get_unaligned((__be16 *) (skb->data - 2));
@@ -422,10 +422,10 @@ static inline int bnep_tx_frame(struct bnep_session *s, struct sk_buff *skb)
         iv[il++] = (struct kvec) { &type, 1 };
         len++;
 
-        if (compress_src && !compare_ether_addr(eh->h_dest, s->eh.h_source))
+        if (compress_src && ether_addr_equal(eh->h_dest, s->eh.h_source))
                 type |= 0x01;
 
-        if (compress_dst && !compare_ether_addr(eh->h_source, s->eh.h_dest))
+        if (compress_dst && ether_addr_equal(eh->h_source, s->eh.h_dest))
                 type |= 0x02;
 
         if (type)
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
index 17800b1d28ea..180bfc45810d 100644
--- a/net/bluetooth/bnep/sock.c
+++ b/net/bluetooth/bnep/sock.c
@@ -42,7 +42,6 @@
 #include <linux/uaccess.h>
 #include <net/sock.h>
 
-#include <asm/system.h>
 
 #include "bnep.h"
 
@@ -143,10 +142,10 @@ static int bnep_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigne
 {
         if (cmd == BNEPGETCONNLIST) {
                 struct bnep_connlist_req cl;
-                uint32_t uci;
+                u32 uci;
                 int err;
 
-                if (get_user(cl.cnum, (uint32_t __user *) arg) ||
+                if (get_user(cl.cnum, (u32 __user *) arg) ||
                                 get_user(uci, (u32 __user *) (arg + 4)))
                         return -EFAULT;
 
@@ -157,7 +156,7 @@ static int bnep_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigne
 
                 err = bnep_get_connlist(&cl);
 
-                if (!err && put_user(cl.cnum, (uint32_t __user *) arg))
+                if (!err && put_user(cl.cnum, (u32 __user *) arg))
                         err = -EFAULT;
 
                 return err;
diff --git a/net/bluetooth/cmtp/sock.c b/net/bluetooth/cmtp/sock.c
index 3f2dd5c25ae5..311668d14571 100644
--- a/net/bluetooth/cmtp/sock.c
+++ b/net/bluetooth/cmtp/sock.c
@@ -39,7 +39,6 @@
 
 #include <linux/isdn/capilli.h>
 
-#include <asm/system.h>
 
 #include "cmtp.h"
 
@@ -137,10 +136,10 @@ static int cmtp_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigne
 {
         if (cmd == CMTPGETCONNLIST) {
                 struct cmtp_connlist_req cl;
-                uint32_t uci;
+                u32 uci;
                 int err;
 
-                if (get_user(cl.cnum, (uint32_t __user *) arg) ||
+                if (get_user(cl.cnum, (u32 __user *) arg) ||
                                 get_user(uci, (u32 __user *) (arg + 4)))
                         return -EFAULT;
 
@@ -151,7 +150,7 @@ static int cmtp_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigne
 
                 err = cmtp_get_connlist(&cl);
 
-                if (!err && put_user(cl.cnum, (uint32_t __user *) arg))
+                if (!err && put_user(cl.cnum, (u32 __user *) arg))
                         err = -EFAULT;
 
                 return err;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 07bc69ed9498..3f18a6ed9731 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -35,10 +35,8 @@
 #include <linux/init.h>
 #include <linux/skbuff.h>
 #include <linux/interrupt.h>
-#include <linux/notifier.h>
 #include <net/sock.h>
 
-#include <asm/system.h>
 #include <linux/uaccess.h>
 #include <asm/unaligned.h>
 
@@ -51,7 +49,7 @@ static void hci_le_connect(struct hci_conn *conn)
         struct hci_cp_le_create_conn cp;
 
         conn->state = BT_CONNECT;
-        conn->out = 1;
+        conn->out = true;
         conn->link_mode |= HCI_LM_MASTER;
         conn->sec_level = BT_SECURITY_LOW;
 
@@ -80,10 +78,10 @@ void hci_acl_connect(struct hci_conn *conn)
         struct inquiry_entry *ie;
         struct hci_cp_create_conn cp;
 
-        BT_DBG("%p", conn);
+        BT_DBG("hcon %p", conn);
 
         conn->state = BT_CONNECT;
-        conn->out = 1;
+        conn->out = true;
 
         conn->link_mode = HCI_LM_MASTER;
 
@@ -105,7 +103,8 @@ void hci_acl_connect(struct hci_conn *conn)
                 }
 
                 memcpy(conn->dev_class, ie->data.dev_class, 3);
-                conn->ssp_mode = ie->data.ssp_mode;
+                if (ie->data.ssp_mode > 0)
+                        set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
         }
 
         cp.pkt_type = cpu_to_le16(conn->pkt_type);
@@ -151,7 +150,7 @@ void hci_add_sco(struct hci_conn *conn, __u16 handle)
         BT_DBG("%p", conn);
 
         conn->state = BT_CONNECT;
-        conn->out = 1;
+        conn->out = true;
 
         conn->attempt++;
 
@@ -169,7 +168,7 @@ void hci_setup_sync(struct hci_conn *conn, __u16 handle)
         BT_DBG("%p", conn);
 
         conn->state = BT_CONNECT;
-        conn->out = 1;
+        conn->out = true;
 
         conn->attempt++;
 
@@ -224,36 +223,6 @@ void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 }
 EXPORT_SYMBOL(hci_le_start_enc);
 
-void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16])
-{
-        struct hci_dev *hdev = conn->hdev;
-        struct hci_cp_le_ltk_reply cp;
-
-        BT_DBG("%p", conn);
-
-        memset(&cp, 0, sizeof(cp));
-
-        cp.handle = cpu_to_le16(conn->handle);
-        memcpy(cp.ltk, ltk, sizeof(ltk));
-
-        hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
-}
-EXPORT_SYMBOL(hci_le_ltk_reply);
-
-void hci_le_ltk_neg_reply(struct hci_conn *conn)
-{
-        struct hci_dev *hdev = conn->hdev;
-        struct hci_cp_le_ltk_neg_reply cp;
-
-        BT_DBG("%p", conn);
-
-        memset(&cp, 0, sizeof(cp));
-
-        cp.handle = cpu_to_le16(conn->handle);
-
-        hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(cp), &cp);
-}
-
 /* Device _must_ be locked */
 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 {
@@ -279,16 +248,13 @@ static void hci_conn_timeout(struct work_struct *work)
 {
         struct hci_conn *conn = container_of(work, struct hci_conn,
                                                         disc_work.work);
-        struct hci_dev *hdev = conn->hdev;
         __u8 reason;
 
-        BT_DBG("conn %p state %d", conn, conn->state);
+        BT_DBG("conn %p state %s", conn, state_to_string(conn->state));
 
         if (atomic_read(&conn->refcnt))
                 return;
 
-        hci_dev_lock(hdev);
-
         switch (conn->state) {
         case BT_CONNECT:
         case BT_CONNECT2:
@@ -308,8 +274,6 @@ static void hci_conn_timeout(struct work_struct *work)
                 conn->state = BT_CLOSED;
                 break;
         }
-
-        hci_dev_unlock(hdev);
 }
 
 /* Enter sniff mode */
@@ -337,7 +301,7 @@ static void hci_conn_enter_sniff_mode(struct hci_conn *conn)
                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
         }
 
-        if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
+        if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
                 struct hci_cp_sniff_mode cp;
                 cp.handle       = cpu_to_le16(conn->handle);
                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
@@ -372,7 +336,7 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 
         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 
-        conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
+        conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
         if (!conn)
                 return NULL;
 
@@ -386,7 +350,7 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
         conn->remote_auth = 0xff;
         conn->key_type = 0xff;
 
-        conn->power_save = 1;
+        set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 
         switch (type) {
@@ -407,7 +371,7 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 
         skb_queue_head_init(&conn->data_q);
 
-        INIT_LIST_HEAD(&conn->chan_list);;
+        INIT_LIST_HEAD(&conn->chan_list);
 
         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
@@ -519,7 +483,8 @@ EXPORT_SYMBOL(hci_get_route);
 
 /* Create SCO, ACL or LE connection.
  * Device _must_ be locked */
-struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
+struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
+                             __u8 dst_type, __u8 sec_level, __u8 auth_type)
 {
         struct hci_conn *acl;
         struct hci_conn *sco;
@@ -528,23 +493,18 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 
         if (type == LE_LINK) {
-                struct adv_entry *entry;
-
                 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
-                if (le)
-                        return ERR_PTR(-EBUSY);
-
-                entry = hci_find_adv_entry(hdev, dst);
-                if (!entry)
-                        return ERR_PTR(-EHOSTUNREACH);
-
-                le = hci_conn_add(hdev, LE_LINK, dst);
-                if (!le)
-                        return ERR_PTR(-ENOMEM);
+                if (!le) {
+                        le = hci_conn_add(hdev, LE_LINK, dst);
+                        if (!le)
+                                return ERR_PTR(-ENOMEM);
 
-                le->dst_type = entry->bdaddr_type;
+                        le->dst_type = bdaddr_to_le(dst_type);
+                        hci_le_connect(le);
+                }
 
-                hci_le_connect(le);
+                le->pending_sec_level = sec_level;
+                le->auth_type = auth_type;
 
                 hci_conn_hold(le);
 
@@ -555,7 +515,7 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
         if (!acl) {
                 acl = hci_conn_add(hdev, ACL_LINK, dst);
                 if (!acl)
-                        return NULL;
+                        return ERR_PTR(-ENOMEM);
         }
 
         hci_conn_hold(acl);
@@ -575,7 +535,7 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
                 sco = hci_conn_add(hdev, type, dst);
                 if (!sco) {
                         hci_conn_put(acl);
-                        return NULL;
+                        return ERR_PTR(-ENOMEM);
                 }
         }
 
@@ -586,12 +546,12 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
 
         if (acl->state == BT_CONNECTED &&
                         (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
-                acl->power_save = 1;
+                set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 
-                if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->pend)) {
+                if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
                         /* defer SCO setup until mode change completed */
-                        set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->pend);
+                        set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
                         return sco;
                 }
 
@@ -607,8 +567,7 @@ int hci_conn_check_link_mode(struct hci_conn *conn)
 {
         BT_DBG("conn %p", conn);
 
-        if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
-                                        !(conn->link_mode & HCI_LM_ENCRYPT))
+        if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
                 return 0;
 
         return 1;
@@ -633,17 +592,17 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 
         conn->auth_type = auth_type;
 
-        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
+        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
                 struct hci_cp_auth_requested cp;
 
                 /* encrypt must be pending if auth is also pending */
-                set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
+                set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 
                 cp.handle = cpu_to_le16(conn->handle);
                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
                                                         sizeof(cp), &cp);
                 if (conn->key_type != 0xff)
-                        set_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
+                        set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
         }
 
         return 0;
@@ -654,7 +613,7 @@ static void hci_conn_encrypt(struct hci_conn *conn)
 {
         BT_DBG("conn %p", conn);
 
-        if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
+        if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
                 struct hci_cp_set_conn_encrypt cp;
                 cp.handle  = cpu_to_le16(conn->handle);
                 cp.encrypt = 0x01;
@@ -674,8 +633,7 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 
         /* For non 2.1 devices and low security level we don't need the link
            key. */
-        if (sec_level == BT_SECURITY_LOW &&
-                                (!conn->ssp_mode || !conn->hdev->ssp_mode))
+        if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
                 return 1;
 
         /* For other security levels we need the link key. */
@@ -704,7 +662,7 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
                 goto encrypt;
 
 auth:
-        if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
+        if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
                 return 0;
 
         if (!hci_conn_auth(conn, sec_level, auth_type))
@@ -739,7 +697,7 @@ int hci_conn_change_link_key(struct hci_conn *conn)
 {
         BT_DBG("conn %p", conn);
 
-        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
+        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
                 struct hci_cp_change_conn_link_key cp;
                 cp.handle = cpu_to_le16(conn->handle);
                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
@@ -758,7 +716,7 @@ int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
         if (!role && conn->link_mode & HCI_LM_MASTER)
                 return 1;
 
-        if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
+        if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
                 struct hci_cp_switch_role cp;
                 bacpy(&cp.bdaddr, &conn->dst);
                 cp.role = role;
@@ -782,10 +740,10 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
         if (conn->mode != HCI_CM_SNIFF)
                 goto timer;
 
-        if (!conn->power_save && !force_active)
+        if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
                 goto timer;
 
-        if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
+        if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
                 struct hci_cp_exit_sniff_mode cp;
                 cp.handle = cpu_to_le16(conn->handle);
                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
@@ -801,11 +759,11 @@ timer:
 void hci_conn_hash_flush(struct hci_dev *hdev)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
-        struct hci_conn *c;
+        struct hci_conn *c, *n;
 
         BT_DBG("hdev %s", hdev->name);
 
-        list_for_each_entry_rcu(c, &h->list, list) {
+        list_for_each_entry_safe(c, n, &h->list, list) {
                 c->state = BT_CLOSED;
 
                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
@@ -950,7 +908,7 @@ struct hci_chan *hci_chan_create(struct hci_conn *conn)
 
         BT_DBG("%s conn %p", hdev->name, conn);
 
-        chan = kzalloc(sizeof(struct hci_chan), GFP_ATOMIC);
+        chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
         if (!chan)
                 return NULL;
 
@@ -981,10 +939,10 @@ int hci_chan_del(struct hci_chan *chan)
 
 void hci_chan_list_flush(struct hci_conn *conn)
 {
-        struct hci_chan *chan;
+        struct hci_chan *chan, *n;
 
         BT_DBG("conn %p", conn);
 
-        list_for_each_entry_rcu(chan, &conn->chan_list, list)
+        list_for_each_entry_safe(chan, n, &conn->chan_list, list)
                 hci_chan_del(chan);
 }
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 5aeb62491198..411ace8e647b 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -40,13 +40,11 @@
 #include <linux/skbuff.h>
 #include <linux/workqueue.h>
 #include <linux/interrupt.h>
-#include <linux/notifier.h>
 #include <linux/rfkill.h>
 #include <linux/timer.h>
 #include <linux/crypto.h>
 #include <net/sock.h>
 
-#include <asm/system.h>
 #include <linux/uaccess.h>
 #include <asm/unaligned.h>
 
@@ -55,8 +53,6 @@
 
 #define AUTO_OFF_TIMEOUT 2000
 
-bool enable_hs;
-
 static void hci_rx_work(struct work_struct *work);
 static void hci_cmd_work(struct work_struct *work);
 static void hci_tx_work(struct work_struct *work);
@@ -69,24 +65,11 @@ DEFINE_RWLOCK(hci_dev_list_lock);
 LIST_HEAD(hci_cb_list);
 DEFINE_RWLOCK(hci_cb_list_lock);
 
-/* HCI notifiers list */
-static ATOMIC_NOTIFIER_HEAD(hci_notifier);
-
 /* ---- HCI notifications ---- */
 
-int hci_register_notifier(struct notifier_block *nb)
-{
-        return atomic_notifier_chain_register(&hci_notifier, nb);
-}
-
-int hci_unregister_notifier(struct notifier_block *nb)
-{
-        return atomic_notifier_chain_unregister(&hci_notifier, nb);
-}
-
 static void hci_notify(struct hci_dev *hdev, int event)
 {
-        atomic_notifier_call_chain(&hci_notifier, event, hdev);
+        hci_sock_dev_event(hdev, event);
 }
 
 /* ---- HCI requests ---- */
@@ -98,8 +81,29 @@ void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
         /* If this is the init phase check if the completed command matches
          * the last init command, and if not just return.
          */
-        if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
+        if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd) {
+                struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
+                u16 opcode = __le16_to_cpu(sent->opcode);
+                struct sk_buff *skb;
+
+                /* Some CSR based controllers generate a spontaneous
+                 * reset complete event during init and any pending
+                 * command will never be completed. In such a case we
+                 * need to resend whatever was the last sent
+                 * command.
+                 */
+
+                if (cmd != HCI_OP_RESET || opcode == HCI_OP_RESET)
+                        return;
+
+                skb = skb_clone(hdev->sent_cmd, GFP_ATOMIC);
+                if (skb) {
+                        skb_queue_head(&hdev->cmd_q, skb);
+                        queue_work(hdev->workqueue, &hdev->cmd_work);
+                }
+
                 return;
+        }
 
         if (hdev->req_status == HCI_REQ_PEND) {
                 hdev->req_result = result;
@@ -248,6 +252,9 @@ static void amp_init(struct hci_dev *hdev)
 
         /* Read Local Version */
         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
+
+        /* Read Local AMP Info */
+        hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
 }
 
 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
@@ -355,72 +362,208 @@ struct hci_dev *hci_dev_get(int index)
 }
 
 /* ---- Inquiry support ---- */
-static void inquiry_cache_flush(struct hci_dev *hdev)
+
+bool hci_discovery_active(struct hci_dev *hdev)
+{
+        struct discovery_state *discov = &hdev->discovery;
+
+        switch (discov->state) {
+        case DISCOVERY_FINDING:
+        case DISCOVERY_RESOLVING:
+                return true;
+
+        default:
+                return false;
+        }
+}
+
+void hci_discovery_set_state(struct hci_dev *hdev, int state)
 {
-        struct inquiry_cache *cache = &hdev->inq_cache;
-        struct inquiry_entry *next  = cache->list, *e;
+        BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
+
+        if (hdev->discovery.state == state)
+                return;
+
+        switch (state) {
+        case DISCOVERY_STOPPED:
+                if (hdev->discovery.state != DISCOVERY_STARTING)
+                        mgmt_discovering(hdev, 0);
+                break;
+        case DISCOVERY_STARTING:
+                break;
+        case DISCOVERY_FINDING:
+                mgmt_discovering(hdev, 1);
+                break;
+        case DISCOVERY_RESOLVING:
+                break;
+        case DISCOVERY_STOPPING:
+                break;
+        }
+
+        hdev->discovery.state = state;
+}
 
-        BT_DBG("cache %p", cache);
+static void inquiry_cache_flush(struct hci_dev *hdev)
+{
+        struct discovery_state *cache = &hdev->discovery;
+        struct inquiry_entry *p, *n;
 
-        cache->list = NULL;
-        while ((e = next)) {
-                next = e->next;
-                kfree(e);
+        list_for_each_entry_safe(p, n, &cache->all, all) {
+                list_del(&p->all);
+                kfree(p);
         }
+
+        INIT_LIST_HEAD(&cache->unknown);
+        INIT_LIST_HEAD(&cache->resolve);
 }
 
 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
 {
-        struct inquiry_cache *cache = &hdev->inq_cache;
+        struct discovery_state *cache = &hdev->discovery;
+        struct inquiry_entry *e;
+
+        BT_DBG("cache %p, %s", cache, batostr(bdaddr));
+
+        list_for_each_entry(e, &cache->all, all) {
+                if (!bacmp(&e->data.bdaddr, bdaddr))
+                        return e;
+        }
+
+        return NULL;
+}
+
+struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
+                                                       bdaddr_t *bdaddr)
+{
+        struct discovery_state *cache = &hdev->discovery;
         struct inquiry_entry *e;
 
         BT_DBG("cache %p, %s", cache, batostr(bdaddr));
 
-        for (e = cache->list; e; e = e->next)
+        list_for_each_entry(e, &cache->unknown, list) {
+                if (!bacmp(&e->data.bdaddr, bdaddr))
+                        return e;
+        }
+
+        return NULL;
+}
+
+struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
+                                                       bdaddr_t *bdaddr,
+                                                       int state)
+{
+        struct discovery_state *cache = &hdev->discovery;
+        struct inquiry_entry *e;
+
+        BT_DBG("cache %p bdaddr %s state %d", cache, batostr(bdaddr), state);
+
+        list_for_each_entry(e, &cache->resolve, list) {
+                if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
+                        return e;
                 if (!bacmp(&e->data.bdaddr, bdaddr))
+                        return e;
+        }
+
+        return NULL;
+}
+
+void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
+                                      struct inquiry_entry *ie)
+{
+        struct discovery_state *cache = &hdev->discovery;
+        struct list_head *pos = &cache->resolve;
+        struct inquiry_entry *p;
+
+        list_del(&ie->list);
+
+        list_for_each_entry(p, &cache->resolve, list) {
+                if (p->name_state != NAME_PENDING &&
+                                abs(p->data.rssi) >= abs(ie->data.rssi))
                         break;
-        return e;
+                pos = &p->list;
+        }
+
+        list_add(&ie->list, pos);
 }
 
-void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
+bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
+                              bool name_known, bool *ssp)
 {
-        struct inquiry_cache *cache = &hdev->inq_cache;
+        struct discovery_state *cache = &hdev->discovery;
         struct inquiry_entry *ie;
 
         BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
 
+        if (ssp)
+                *ssp = data->ssp_mode;
+
         ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
-        if (!ie) {
-                /* Entry not in the cache. Add new one. */
-                ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
-                if (!ie)
-                        return;
+        if (ie) {
+                if (ie->data.ssp_mode && ssp)
+                        *ssp = true;
+
+                if (ie->name_state == NAME_NEEDED &&
+                                                data->rssi != ie->data.rssi) {
+                        ie->data.rssi = data->rssi;
+                        hci_inquiry_cache_update_resolve(hdev, ie);
+                }
+
+                goto update;
+        }
+
+        /* Entry not in the cache. Add new one. */
+        ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
+        if (!ie)
+                return false;
+
+        list_add(&ie->all, &cache->all);
+
+        if (name_known) {
+                ie->name_state = NAME_KNOWN;
+        } else {
+                ie->name_state = NAME_NOT_KNOWN;
+                list_add(&ie->list, &cache->unknown);
+        }
 
-                ie->next = cache->list;
-                cache->list = ie;
+update:
+        if (name_known && ie->name_state != NAME_KNOWN &&
+                                        ie->name_state != NAME_PENDING) {
+                ie->name_state = NAME_KNOWN;
+                list_del(&ie->list);
         }
 
         memcpy(&ie->data, data, sizeof(*data));
         ie->timestamp = jiffies;
         cache->timestamp = jiffies;
+
+        if (ie->name_state == NAME_NOT_KNOWN)
+                return false;
+
+        return true;
 }
 
 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
 {
-        struct inquiry_cache *cache = &hdev->inq_cache;
+        struct discovery_state *cache = &hdev->discovery;
         struct inquiry_info *info = (struct inquiry_info *) buf;
         struct inquiry_entry *e;
         int copied = 0;
 
-        for (e = cache->list; e && copied < num; e = e->next, copied++) {
+        list_for_each_entry(e, &cache->all, all) {
                 struct inquiry_data *data = &e->data;
+
+                if (copied >= num)
+                        break;
+
                 bacpy(&info->bdaddr, &data->bdaddr);
                 info->pscan_rep_mode    = data->pscan_rep_mode;
                 info->pscan_period_mode = data->pscan_period_mode;
                 info->pscan_mode        = data->pscan_mode;
                 memcpy(info->dev_class, data->dev_class, 3);
                 info->clock_offset      = data->clock_offset;
+
                 info++;
+                copied++;
         }
 
         BT_DBG("cache %p, copied %d", cache, copied);
@@ -525,6 +668,11 @@ int hci_dev_open(__u16 dev)
 
         hci_req_lock(hdev);
 
+        if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
+                ret = -ENODEV;
+                goto done;
+        }
+
         if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
                 ret = -ERFKILL;
                 goto done;
@@ -567,7 +715,7 @@ int hci_dev_open(__u16 dev)
                 hci_dev_hold(hdev);
                 set_bit(HCI_UP, &hdev->flags);
                 hci_notify(hdev, HCI_DEV_UP);
-                if (!test_bit(HCI_SETUP, &hdev->flags)) {
+                if (!test_bit(HCI_SETUP, &hdev->dev_flags)) {
                         hci_dev_lock(hdev);
                         mgmt_powered(hdev, 1);
                         hci_dev_unlock(hdev);
@@ -603,6 +751,8 @@ static int hci_dev_do_close(struct hci_dev *hdev)
 {
         BT_DBG("%s %p", hdev->name, hdev);
 
+        cancel_work_sync(&hdev->le_scan);
+
         hci_req_cancel(hdev, ENODEV);
         hci_req_lock(hdev);
 
@@ -619,14 +769,14 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         if (hdev->discov_timeout > 0) {
                 cancel_delayed_work(&hdev->discov_off);
                 hdev->discov_timeout = 0;
+                clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
         }
 
-        if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
-                cancel_delayed_work(&hdev->power_off);
-
-        if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags))
+        if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
                 cancel_delayed_work(&hdev->service_cache);
 
+        cancel_delayed_work_sync(&hdev->le_scan_disable);
+
         hci_dev_lock(hdev);
         inquiry_cache_flush(hdev);
         hci_conn_hash_flush(hdev);
@@ -667,13 +817,18 @@ static int hci_dev_do_close(struct hci_dev *hdev)
          * and no tasks are scheduled. */
         hdev->close(hdev);
 
-        hci_dev_lock(hdev);
-        mgmt_powered(hdev, 0);
-        hci_dev_unlock(hdev);
+        if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
+                hci_dev_lock(hdev);
+                mgmt_powered(hdev, 0);
+                hci_dev_unlock(hdev);
+        }
 
         /* Clear flags */
         hdev->flags = 0;
 
+        memset(hdev->eir, 0, sizeof(hdev->eir));
+        memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
+
         hci_req_unlock(hdev);
 
         hci_dev_put(hdev);
@@ -688,7 +843,12 @@ int hci_dev_close(__u16 dev)
         hdev = hci_dev_get(dev);
         if (!hdev)
                 return -ENODEV;
+
+        if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
+                cancel_delayed_work(&hdev->power_off);
+
         err = hci_dev_do_close(hdev);
+
         hci_dev_put(hdev);
         return err;
 }
@@ -847,11 +1007,11 @@ int hci_get_dev_list(void __user *arg)
 
         read_lock(&hci_dev_list_lock);
         list_for_each_entry(hdev, &hci_dev_list, list) {
-                if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
+                if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
                         cancel_delayed_work(&hdev->power_off);
 
-                if (!test_bit(HCI_MGMT, &hdev->flags))
-                        set_bit(HCI_PAIRABLE, &hdev->flags);
+                if (!test_bit(HCI_MGMT, &hdev->dev_flags))
+                        set_bit(HCI_PAIRABLE, &hdev->dev_flags);
 
                 (dr + n)->dev_id  = hdev->id;
                 (dr + n)->dev_opt = hdev->flags;
@@ -883,11 +1043,11 @@ int hci_get_dev_info(void __user *arg)
         if (!hdev)
                 return -ENODEV;
 
-        if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
+        if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
                 cancel_delayed_work_sync(&hdev->power_off);
 
-        if (!test_bit(HCI_MGMT, &hdev->flags))
-                set_bit(HCI_PAIRABLE, &hdev->flags);
+        if (!test_bit(HCI_MGMT, &hdev->dev_flags))
+                set_bit(HCI_PAIRABLE, &hdev->dev_flags);
 
         strcpy(di.name, hdev->name);
         di.bdaddr   = hdev->bdaddr;
@@ -932,32 +1092,6 @@ static const struct rfkill_ops hci_rfkill_ops = {
         .set_block = hci_rfkill_set_block,
 };
 
-/* Alloc HCI device */
-struct hci_dev *hci_alloc_dev(void)
-{
-        struct hci_dev *hdev;
-
-        hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
-        if (!hdev)
-                return NULL;
-
-        hci_init_sysfs(hdev);
-        skb_queue_head_init(&hdev->driver_init);
-
-        return hdev;
-}
-EXPORT_SYMBOL(hci_alloc_dev);
-
-/* Free HCI device */
-void hci_free_dev(struct hci_dev *hdev)
-{
-        skb_queue_purge(&hdev->driver_init);
-
-        /* will free via device release */
-        put_device(&hdev->dev);
-}
-EXPORT_SYMBOL(hci_free_dev);
-
 static void hci_power_on(struct work_struct *work)
 {
         struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
@@ -967,11 +1101,11 @@ static void hci_power_on(struct work_struct *work)
         if (hci_dev_open(hdev->id) < 0)
                 return;
 
-        if (test_bit(HCI_AUTO_OFF, &hdev->flags))
+        if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
                 schedule_delayed_work(&hdev->power_off,
                                         msecs_to_jiffies(AUTO_OFF_TIMEOUT));
 
-        if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
+        if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
                 mgmt_index_added(hdev);
 }
 
@@ -982,9 +1116,7 @@ static void hci_power_off(struct work_struct *work)
 
         BT_DBG("%s", hdev->name);
 
-        clear_bit(HCI_AUTO_OFF, &hdev->flags);
-
-        hci_dev_close(hdev->id);
+        hci_dev_do_close(hdev);
 }
 
 static void hci_discov_off(struct work_struct *work)
@@ -1037,6 +1169,18 @@ int hci_link_keys_clear(struct hci_dev *hdev)
         return 0;
 }
 
+int hci_smp_ltks_clear(struct hci_dev *hdev)
+{
+        struct smp_ltk *k, *tmp;
+
+        list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
+                list_del(&k->list);
+                kfree(k);
+        }
+
+        return 0;
+}
+
 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
 {
         struct link_key *k;
@@ -1048,83 +1192,78 @@ struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
         return NULL;
 }
 
-static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
+static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
                                                 u8 key_type, u8 old_key_type)
 {
         /* Legacy key */
         if (key_type < 0x03)
-                return 1;
+                return true;
 
         /* Debug keys are insecure so don't store them persistently */
         if (key_type == HCI_LK_DEBUG_COMBINATION)
-                return 0;
+                return false;
 
         /* Changed combination key and there's no previous one */
         if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
-                return 0;
+                return false;
 
         /* Security mode 3 case */
         if (!conn)
-                return 1;
+                return true;
 
         /* Neither local nor remote side had no-bonding as requirement */
         if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
-                return 1;
+                return true;
 
         /* Local side had dedicated bonding as requirement */
         if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
-                return 1;
+                return true;
 
         /* Remote side had dedicated bonding as requirement */
         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
-                return 1;
+                return true;
 
         /* If none of the above criteria match, then don't store the key
          * persistently */
-        return 0;
+        return false;
 }
 
-struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
+struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
 {
-        struct link_key *k;
-
-        list_for_each_entry(k, &hdev->link_keys, list) {
-                struct key_master_id *id;
+        struct smp_ltk *k;
 
-                if (k->type != HCI_LK_SMP_LTK)
+        list_for_each_entry(k, &hdev->long_term_keys, list) {
+                if (k->ediv != ediv ||
+                                memcmp(rand, k->rand, sizeof(k->rand)))
                         continue;
 
-                if (k->dlen != sizeof(*id))
-                        continue;
-
-                id = (void *) &k->data;
-                if (id->ediv == ediv &&
-                                (memcmp(rand, id->rand, sizeof(id->rand)) == 0))
-                        return k;
+                return k;
         }
 
         return NULL;
 }
 EXPORT_SYMBOL(hci_find_ltk);
 
-struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
-                                        bdaddr_t *bdaddr, u8 type)
+struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                     u8 addr_type)
 {
-        struct link_key *k;
+        struct smp_ltk *k;
 
-        list_for_each_entry(k, &hdev->link_keys, list)
-                if (k->type == type && bacmp(bdaddr, &k->bdaddr) == 0)
+        list_for_each_entry(k, &hdev->long_term_keys, list)
+                if (addr_type == k->bdaddr_type &&
+                                        bacmp(bdaddr, &k->bdaddr) == 0)
                         return k;
 
         return NULL;
 }
-EXPORT_SYMBOL(hci_find_link_key_type);
+EXPORT_SYMBOL(hci_find_ltk_by_addr);
 
 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
-                                bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
+                     bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
 {
         struct link_key *key, *old_key;
-        u8 old_key_type, persistent;
+        u8 old_key_type;
+        bool persistent;
 
         old_key = hci_find_link_key(hdev, bdaddr);
         if (old_key) {
@@ -1167,48 +1306,45 @@ int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
 
         mgmt_new_link_key(hdev, key, persistent);
 
-        if (!persistent) {
-                list_del(&key->list);
-                kfree(key);
-        }
+        if (conn)
+                conn->flush_key = !persistent;
 
         return 0;
 }
 
-int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
-                        u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16])
+int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
+                int new_key, u8 authenticated, u8 tk[16], u8 enc_size, __le16
+                ediv, u8 rand[8])
 {
-        struct link_key *key, *old_key;
-        struct key_master_id *id;
-        u8 old_key_type;
+        struct smp_ltk *key, *old_key;
 
-        BT_DBG("%s addr %s", hdev->name, batostr(bdaddr));
+        if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
+                return 0;
 
-        old_key = hci_find_link_key_type(hdev, bdaddr, HCI_LK_SMP_LTK);
-        if (old_key) {
+        old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
+        if (old_key)
                 key = old_key;
-                old_key_type = old_key->type;
-        } else {
-                key = kzalloc(sizeof(*key) + sizeof(*id), GFP_ATOMIC);
+        else {
+                key = kzalloc(sizeof(*key), GFP_ATOMIC);
                 if (!key)
                         return -ENOMEM;
-                list_add(&key->list, &hdev->link_keys);
-                old_key_type = 0xff;
+                list_add(&key->list, &hdev->long_term_keys);
         }
 
-        key->dlen = sizeof(*id);
-
         bacpy(&key->bdaddr, bdaddr);
-        memcpy(key->val, ltk, sizeof(key->val));
-        key->type = HCI_LK_SMP_LTK;
-        key->pin_len = key_size;
+        key->bdaddr_type = addr_type;
+        memcpy(key->val, tk, sizeof(key->val));
+        key->authenticated = authenticated;
+        key->ediv = ediv;
+        key->enc_size = enc_size;
+        key->type = type;
+        memcpy(key->rand, rand, sizeof(key->rand));
 
-        id = (void *) &key->data;
-        id->ediv = ediv;
-        memcpy(id->rand, rand, sizeof(id->rand));
+        if (!new_key)
+                return 0;
 
-        if (new_key)
-                mgmt_new_link_key(hdev, key, old_key_type);
+        if (type & HCI_SMP_LTK)
+                mgmt_new_ltk(hdev, key, 1);
 
         return 0;
 }
@@ -1229,6 +1365,23 @@ int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
         return 0;
 }
 
+int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
+{
+        struct smp_ltk *k, *tmp;
+
+        list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
+                if (bacmp(bdaddr, &k->bdaddr))
+                        continue;
+
+                BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
+
+                list_del(&k->list);
+                kfree(k);
+        }
+
+        return 0;
+}
+
 /* HCI command timer function */
 static void hci_cmd_timer(unsigned long arg)
 {
@@ -1240,7 +1393,7 @@ static void hci_cmd_timer(unsigned long arg)
 }
 
 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
-                                                        bdaddr_t *bdaddr)
+                                          bdaddr_t *bdaddr)
 {
         struct oob_data *data;
 
@@ -1280,7 +1433,7 @@ int hci_remote_oob_data_clear(struct hci_dev *hdev)
 }
 
 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
-                                                                u8 *randomizer)
+                            u8 *randomizer)
 {
         struct oob_data *data;
 
@@ -1303,8 +1456,7 @@ int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
         return 0;
 }
 
-struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
-                                                bdaddr_t *bdaddr)
+struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
 {
         struct bdaddr_list *b;
 
@@ -1331,7 +1483,7 @@ int hci_blacklist_clear(struct hci_dev *hdev)
         return 0;
 }
 
-int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr)
+int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
 {
         struct bdaddr_list *entry;
 
@@ -1349,10 +1501,10 @@ int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr)
 
         list_add(&entry->list, &hdev->blacklist);
 
-        return mgmt_device_blocked(hdev, bdaddr);
+        return mgmt_device_blocked(hdev, bdaddr, type);
 }
 
-int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr)
+int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
 {
         struct bdaddr_list *entry;
 
@@ -1366,168 +1518,225 @@ int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr)
         list_del(&entry->list);
         kfree(entry);
 
-        return mgmt_device_unblocked(hdev, bdaddr);
+        return mgmt_device_unblocked(hdev, bdaddr, type);
 }
 
-static void hci_clear_adv_cache(struct work_struct *work)
+static void le_scan_param_req(struct hci_dev *hdev, unsigned long opt)
 {
-        struct hci_dev *hdev = container_of(work, struct hci_dev,
-                                                        adv_work.work);
+        struct le_scan_params *param =  (struct le_scan_params *) opt;
+        struct hci_cp_le_set_scan_param cp;
 
-        hci_dev_lock(hdev);
+        memset(&cp, 0, sizeof(cp));
+        cp.type = param->type;
+        cp.interval = cpu_to_le16(param->interval);
+        cp.window = cpu_to_le16(param->window);
 
-        hci_adv_entries_clear(hdev);
+        hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_PARAM, sizeof(cp), &cp);
+}
 
-        hci_dev_unlock(hdev);
+static void le_scan_enable_req(struct hci_dev *hdev, unsigned long opt)
+{
+        struct hci_cp_le_set_scan_enable cp;
+
+        memset(&cp, 0, sizeof(cp));
+        cp.enable = 1;
+
+        hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
 }
 
-int hci_adv_entries_clear(struct hci_dev *hdev)
+static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
+                          u16 window, int timeout)
 {
-        struct adv_entry *entry, *tmp;
+        long timeo = msecs_to_jiffies(3000);
+        struct le_scan_params param;
+        int err;
 
-        list_for_each_entry_safe(entry, tmp, &hdev->adv_entries, list) {
-                list_del(&entry->list);
-                kfree(entry);
-        }
+        BT_DBG("%s", hdev->name);
+
+        if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
+                return -EINPROGRESS;
 
-        BT_DBG("%s adv cache cleared", hdev->name);
+        param.type = type;
+        param.interval = interval;
+        param.window = window;
+
+        hci_req_lock(hdev);
+
+        err = __hci_request(hdev, le_scan_param_req, (unsigned long) &param,
+                            timeo);
+        if (!err)
+                err = __hci_request(hdev, le_scan_enable_req, 0, timeo);
+
+        hci_req_unlock(hdev);
+
+        if (err < 0)
+                return err;
+
+        schedule_delayed_work(&hdev->le_scan_disable,
+                              msecs_to_jiffies(timeout));
 
         return 0;
 }
 
-struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr)
+int hci_cancel_le_scan(struct hci_dev *hdev)
 {
-        struct adv_entry *entry;
+        BT_DBG("%s", hdev->name);
 
-        list_for_each_entry(entry, &hdev->adv_entries, list)
-                if (bacmp(bdaddr, &entry->bdaddr) == 0)
-                        return entry;
+        if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
+                return -EALREADY;
 
-        return NULL;
-}
+        if (cancel_delayed_work(&hdev->le_scan_disable)) {
+                struct hci_cp_le_set_scan_enable cp;
 
-static inline int is_connectable_adv(u8 evt_type)
-{
-        if (evt_type == ADV_IND || evt_type == ADV_DIRECT_IND)
-                return 1;
+                /* Send HCI command to disable LE Scan */
+                memset(&cp, 0, sizeof(cp));
+                hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
+        }
 
         return 0;
 }
 
-int hci_add_adv_entry(struct hci_dev *hdev,
-                                        struct hci_ev_le_advertising_info *ev)
+static void le_scan_disable_work(struct work_struct *work)
 {
-        struct adv_entry *entry;
-
-        if (!is_connectable_adv(ev->evt_type))
-                return -EINVAL;
+        struct hci_dev *hdev = container_of(work, struct hci_dev,
+                                            le_scan_disable.work);
+        struct hci_cp_le_set_scan_enable cp;
 
-        /* Only new entries should be added to adv_entries. So, if
-         * bdaddr was found, don't add it. */
-        if (hci_find_adv_entry(hdev, &ev->bdaddr))
-                return 0;
+        BT_DBG("%s", hdev->name);
 
-        entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
-        if (!entry)
-                return -ENOMEM;
+        memset(&cp, 0, sizeof(cp));
 
-        bacpy(&entry->bdaddr, &ev->bdaddr);
-        entry->bdaddr_type = ev->bdaddr_type;
+        hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
+}
 
-        list_add(&entry->list, &hdev->adv_entries);
+static void le_scan_work(struct work_struct *work)
+{
+        struct hci_dev *hdev = container_of(work, struct hci_dev, le_scan);
+        struct le_scan_params *param = &hdev->le_scan_params;
 
-        BT_DBG("%s adv entry added: address %s type %u", hdev->name,
-                                batostr(&entry->bdaddr), entry->bdaddr_type);
+        BT_DBG("%s", hdev->name);
 
-        return 0;
+        hci_do_le_scan(hdev, param->type, param->interval, param->window,
+                       param->timeout);
 }
 
-/* Register HCI device */
-int hci_register_dev(struct hci_dev *hdev)
+int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
+                int timeout)
 {
-        struct list_head *head = &hci_dev_list, *p;
-        int i, id, error;
+        struct le_scan_params *param = &hdev->le_scan_params;
 
-        BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
-                                                hdev->bus, hdev->owner);
+        BT_DBG("%s", hdev->name);
 
-        if (!hdev->open || !hdev->close || !hdev->destruct)
-                return -EINVAL;
+        if (work_busy(&hdev->le_scan))
+                return -EINPROGRESS;
 
-        /* Do not allow HCI_AMP devices to register at index 0,
-         * so the index can be used as the AMP controller ID.
-         */
-        id = (hdev->dev_type == HCI_BREDR) ? 0 : 1;
+        param->type = type;
+        param->interval = interval;
+        param->window = window;
+        param->timeout = timeout;
 
-        write_lock(&hci_dev_list_lock);
+        queue_work(system_long_wq, &hdev->le_scan);
 
-        /* Find first available device id */
-        list_for_each(p, &hci_dev_list) {
-                if (list_entry(p, struct hci_dev, list)->id != id)
-                        break;
-                head = p; id++;
-        }
+        return 0;
+}
 
-        sprintf(hdev->name, "hci%d", id);
-        hdev->id = id;
-        list_add_tail(&hdev->list, head);
+/* Alloc HCI device */
+struct hci_dev *hci_alloc_dev(void)
+{
+        struct hci_dev *hdev;
 
-        atomic_set(&hdev->refcnt, 1);
-        mutex_init(&hdev->lock);
+        hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
+        if (!hdev)
+                return NULL;
 
-        hdev->flags = 0;
-        hdev->dev_flags = 0;
         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
         hdev->esco_type = (ESCO_HV1);
         hdev->link_mode = (HCI_LM_ACCEPT);
         hdev->io_capability = 0x03; /* No Input No Output */
 
-        hdev->idle_timeout = 0;
         hdev->sniff_max_interval = 800;
         hdev->sniff_min_interval = 80;
 
+        mutex_init(&hdev->lock);
+        mutex_init(&hdev->req_lock);
+
+        INIT_LIST_HEAD(&hdev->mgmt_pending);
+        INIT_LIST_HEAD(&hdev->blacklist);
+        INIT_LIST_HEAD(&hdev->uuids);
+        INIT_LIST_HEAD(&hdev->link_keys);
+        INIT_LIST_HEAD(&hdev->long_term_keys);
+        INIT_LIST_HEAD(&hdev->remote_oob_data);
+
         INIT_WORK(&hdev->rx_work, hci_rx_work);
         INIT_WORK(&hdev->cmd_work, hci_cmd_work);
         INIT_WORK(&hdev->tx_work, hci_tx_work);
+        INIT_WORK(&hdev->power_on, hci_power_on);
+        INIT_WORK(&hdev->le_scan, le_scan_work);
 
+        INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
+        INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
+        INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
 
+        skb_queue_head_init(&hdev->driver_init);
         skb_queue_head_init(&hdev->rx_q);
         skb_queue_head_init(&hdev->cmd_q);
         skb_queue_head_init(&hdev->raw_q);
 
-        setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
-
-        for (i = 0; i < NUM_REASSEMBLY; i++)
-                hdev->reassembly[i] = NULL;
-
         init_waitqueue_head(&hdev->req_wait_q);
-        mutex_init(&hdev->req_lock);
 
-        inquiry_cache_init(hdev);
+        setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
 
+        hci_init_sysfs(hdev);
+        discovery_init(hdev);
         hci_conn_hash_init(hdev);
 
-        INIT_LIST_HEAD(&hdev->mgmt_pending);
+        return hdev;
+}
+EXPORT_SYMBOL(hci_alloc_dev);
 
-        INIT_LIST_HEAD(&hdev->blacklist);
+/* Free HCI device */
+void hci_free_dev(struct hci_dev *hdev)
+{
+        skb_queue_purge(&hdev->driver_init);
 
-        INIT_LIST_HEAD(&hdev->uuids);
+        /* will free via device release */
+        put_device(&hdev->dev);
+}
+EXPORT_SYMBOL(hci_free_dev);
 
-        INIT_LIST_HEAD(&hdev->link_keys);
+/* Register HCI device */
+int hci_register_dev(struct hci_dev *hdev)
+{
+        struct list_head *head, *p;
+        int id, error;
 
-        INIT_LIST_HEAD(&hdev->remote_oob_data);
+        if (!hdev->open || !hdev->close)
+                return -EINVAL;
 
-        INIT_LIST_HEAD(&hdev->adv_entries);
+        write_lock(&hci_dev_list_lock);
 
-        INIT_DELAYED_WORK(&hdev->adv_work, hci_clear_adv_cache);
-        INIT_WORK(&hdev->power_on, hci_power_on);
-        INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
+        /* Do not allow HCI_AMP devices to register at index 0,
+         * so the index can be used as the AMP controller ID.
+         */
+        id = (hdev->dev_type == HCI_BREDR) ? 0 : 1;
+        head = &hci_dev_list;
 
-        INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
+        /* Find first available device id */
+        list_for_each(p, &hci_dev_list) {
+                int nid = list_entry(p, struct hci_dev, list)->id;
+                if (nid > id)
+                        break;
+                if (nid == id)
+                        id++;
+                head = p;
+        }
 
-        memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
+        sprintf(hdev->name, "hci%d", id);
+        hdev->id = id;
 
-        atomic_set(&hdev->promisc, 0);
+        BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
+
+        list_add(&hdev->list, head);
 
         write_unlock(&hci_dev_list_lock);
 
@@ -1551,11 +1760,12 @@ int hci_register_dev(struct hci_dev *hdev)
                 }
         }
 
-        set_bit(HCI_AUTO_OFF, &hdev->flags);
-        set_bit(HCI_SETUP, &hdev->flags);
+        set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
+        set_bit(HCI_SETUP, &hdev->dev_flags);
         schedule_work(&hdev->power_on);
 
         hci_notify(hdev, HCI_DEV_REG);
+        hci_dev_hold(hdev);
 
         return id;
 
@@ -1577,6 +1787,8 @@ void hci_unregister_dev(struct hci_dev *hdev)
 
         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
 
+        set_bit(HCI_UNREGISTER, &hdev->dev_flags);
+
         write_lock(&hci_dev_list_lock);
         list_del(&hdev->list);
         write_unlock(&hci_dev_list_lock);
@@ -1587,7 +1799,7 @@ void hci_unregister_dev(struct hci_dev *hdev)
                 kfree_skb(hdev->reassembly[i]);
 
         if (!test_bit(HCI_INIT, &hdev->flags) &&
-                                        !test_bit(HCI_SETUP, &hdev->flags)) {
+                                !test_bit(HCI_SETUP, &hdev->dev_flags)) {
                 hci_dev_lock(hdev);
                 mgmt_index_removed(hdev);
                 hci_dev_unlock(hdev);
@@ -1606,19 +1818,17 @@ void hci_unregister_dev(struct hci_dev *hdev)
 
         hci_del_sysfs(hdev);
 
-        cancel_delayed_work_sync(&hdev->adv_work);
-
         destroy_workqueue(hdev->workqueue);
 
         hci_dev_lock(hdev);
         hci_blacklist_clear(hdev);
         hci_uuids_clear(hdev);
         hci_link_keys_clear(hdev);
+        hci_smp_ltks_clear(hdev);
         hci_remote_oob_data_clear(hdev);
-        hci_adv_entries_clear(hdev);
         hci_dev_unlock(hdev);
 
-        __hci_dev_put(hdev);
+        hci_dev_put(hdev);
 }
 EXPORT_SYMBOL(hci_unregister_dev);
 
@@ -1706,7 +1916,7 @@ static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
 
         while (count) {
                 scb = (void *) skb->cb;
-                len = min(scb->expect, (__u16)count);
+                len = min_t(uint, scb->expect, count);
 
                 memcpy(skb_put(skb, len), data, len);
 
@@ -1862,11 +2072,15 @@ static int hci_send_frame(struct sk_buff *skb)
 
         BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
 
-        if (atomic_read(&hdev->promisc)) {
-                /* Time stamp */
-                __net_timestamp(skb);
+        /* Time stamp */
+        __net_timestamp(skb);
+
+        /* Send copy to monitor */
+        hci_send_to_monitor(hdev, skb);
 
-                hci_send_to_sock(hdev, skb, NULL);
+        if (atomic_read(&hdev->promisc)) {
+                /* Send copy to the sockets */
+                hci_send_to_sock(hdev, skb);
         }
 
         /* Get rid of skb owner, prior to sending to the driver. */
@@ -1948,6 +2162,12 @@ static void hci_queue_acl(struct hci_conn *conn, struct sk_buff_head *queue,
         struct hci_dev *hdev = conn->hdev;
         struct sk_buff *list;
 
+        skb->len = skb_headlen(skb);
+        skb->data_len = 0;
+
+        bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
+        hci_add_acl_hdr(skb, conn->handle, flags);
+
         list = skb_shinfo(skb)->frag_list;
         if (!list) {
                 /* Non fragmented */
@@ -1991,8 +2211,6 @@ void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
         BT_DBG("%s chan %p flags 0x%x", hdev->name, chan, flags);
 
         skb->dev = (void *) hdev;
-        bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
-        hci_add_acl_hdr(skb, conn->handle, flags);
 
         hci_queue_acl(conn, &chan->data_q, skb, flags);
 
@@ -2030,7 +2248,7 @@ static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
         struct hci_conn *conn = NULL, *c;
-        int num = 0, min = ~0;
+        unsigned int num = 0, min = ~0;
 
         /* We don't have to lock device here. Connections are always
          * added and removed with TX task disabled. */
@@ -2111,7 +2329,7 @@ static inline struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
         struct hci_chan *chan = NULL;
-        int num = 0, min = ~0, cur_prio = 0;
+        unsigned int num = 0, min = ~0, cur_prio = 0;
         struct hci_conn *conn;
         int cnt, q, conn_num = 0;
 
@@ -2235,26 +2453,31 @@ static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
 
 }
 
-static inline void hci_sched_acl(struct hci_dev *hdev)
+static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct hci_chan *chan;
-        struct sk_buff *skb;
-        int quote;
-        unsigned int cnt;
-
-        BT_DBG("%s", hdev->name);
-
-        if (!hci_conn_num(hdev, ACL_LINK))
-                return;
+        /* Calculate count of blocks used by this packet */
+        return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
+}
 
+static inline void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
+{
         if (!test_bit(HCI_RAW, &hdev->flags)) {
                 /* ACL tx timeout must be longer than maximum
                  * link supervision timeout (40.9 seconds) */
-                if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
+                if (!cnt && time_after(jiffies, hdev->acl_last_tx +
+                                        msecs_to_jiffies(HCI_ACL_TX_TIMEOUT)))
                         hci_link_tx_to(hdev, ACL_LINK);
         }
+}
+
+static inline void hci_sched_acl_pkt(struct hci_dev *hdev)
+{
+        unsigned int cnt = hdev->acl_cnt;
+        struct hci_chan *chan;
+        struct sk_buff *skb;
+        int quote;
 
-        cnt = hdev->acl_cnt;
+        __check_timeout(hdev, cnt);
 
         while (hdev->acl_cnt &&
                         (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
@@ -2270,7 +2493,7 @@ static inline void hci_sched_acl(struct hci_dev *hdev)
                         skb = skb_dequeue(&chan->data_q);
 
                         hci_conn_enter_active_mode(chan->conn,
-                                                bt_cb(skb)->force_active);
+                                                   bt_cb(skb)->force_active);
 
                         hci_send_frame(skb);
                         hdev->acl_last_tx = jiffies;
@@ -2285,6 +2508,70 @@ static inline void hci_sched_acl(struct hci_dev *hdev)
                 hci_prio_recalculate(hdev, ACL_LINK);
 }
 
+static inline void hci_sched_acl_blk(struct hci_dev *hdev)
+{
+        unsigned int cnt = hdev->block_cnt;
+        struct hci_chan *chan;
+        struct sk_buff *skb;
+        int quote;
+
+        __check_timeout(hdev, cnt);
+
+        while (hdev->block_cnt > 0 &&
+                        (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
+                u32 priority = (skb_peek(&chan->data_q))->priority;
+                while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
+                        int blocks;
+
+                        BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
+                                                skb->len, skb->priority);
+
+                        /* Stop if priority has changed */
+                        if (skb->priority < priority)
+                                break;
+
+                        skb = skb_dequeue(&chan->data_q);
+
+                        blocks = __get_blocks(hdev, skb);
+                        if (blocks > hdev->block_cnt)
+                                return;
+
+                        hci_conn_enter_active_mode(chan->conn,
+                                                bt_cb(skb)->force_active);
+
+                        hci_send_frame(skb);
+                        hdev->acl_last_tx = jiffies;
+
+                        hdev->block_cnt -= blocks;
+                        quote -= blocks;
+
+                        chan->sent += blocks;
+                        chan->conn->sent += blocks;
+                }
+        }
+
+        if (cnt != hdev->block_cnt)
+                hci_prio_recalculate(hdev, ACL_LINK);
+}
+
+static inline void hci_sched_acl(struct hci_dev *hdev)
+{
+        BT_DBG("%s", hdev->name);
+
+        if (!hci_conn_num(hdev, ACL_LINK))
+                return;
+
+        switch (hdev->flow_ctl_mode) {
+        case HCI_FLOW_CTL_MODE_PACKET_BASED:
+                hci_sched_acl_pkt(hdev);
+                break;
+
+        case HCI_FLOW_CTL_MODE_BLOCK_BASED:
+                hci_sched_acl_blk(hdev);
+                break;
+        }
+}
+
 /* Schedule SCO */
 static inline void hci_sched_sco(struct hci_dev *hdev)
 {
@@ -2432,6 +2719,14 @@ static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
         if (conn) {
                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
 
+                hci_dev_lock(hdev);
+                if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
+                    !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
+                        mgmt_device_connected(hdev, &conn->dst, conn->type,
+                                              conn->dst_type, 0, NULL, 0,
+                                              conn->dev_class);
+                hci_dev_unlock(hdev);
+
                 /* Send to upper protocol */
                 l2cap_recv_acldata(conn, skb, flags);
                 return;
@@ -2482,9 +2777,12 @@ static void hci_rx_work(struct work_struct *work)
         BT_DBG("%s", hdev->name);
 
         while ((skb = skb_dequeue(&hdev->rx_q))) {
+                /* Send copy to monitor */
+                hci_send_to_monitor(hdev, skb);
+
                 if (atomic_read(&hdev->promisc)) {
                         /* Send copy to the sockets */
-                        hci_send_to_sock(hdev, skb, NULL);
+                        hci_send_to_sock(hdev, skb);
                 }
 
                 if (test_bit(HCI_RAW, &hdev->flags)) {
@@ -2568,6 +2866,8 @@ int hci_do_inquiry(struct hci_dev *hdev, u8 length)
         if (test_bit(HCI_INQUIRY, &hdev->flags))
                 return -EINPROGRESS;
 
+        inquiry_cache_flush(hdev);
+
         memset(&cp, 0, sizeof(cp));
         memcpy(&cp.lap, lap, sizeof(cp.lap));
         cp.length  = length;
@@ -2580,10 +2880,19 @@ int hci_cancel_inquiry(struct hci_dev *hdev)
         BT_DBG("%s", hdev->name);
 
         if (!test_bit(HCI_INQUIRY, &hdev->flags))
-                return -EPERM;
+                return -EALREADY;
 
         return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
 }
 
-module_param(enable_hs, bool, 0644);
-MODULE_PARM_DESC(enable_hs, "Enable High Speed");
+u8 bdaddr_to_le(u8 bdaddr_type)
+{
+        switch (bdaddr_type) {
+        case BDADDR_LE_PUBLIC:
+                return ADDR_LE_DEV_PUBLIC;
+
+        default:
+                /* Fallback to LE Random address type */
+                return ADDR_LE_DEV_RANDOM;
+        }
+}
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 001307f81057..4eefb7f65cf6 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -35,18 +35,14 @@
 #include <linux/init.h>
 #include <linux/skbuff.h>
 #include <linux/interrupt.h>
-#include <linux/notifier.h>
 #include <net/sock.h>
 
-#include <asm/system.h>
 #include <linux/uaccess.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 
-static bool enable_le;
-
 /* Handle HCI Event packets */
 
 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
@@ -65,7 +61,7 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
         clear_bit(HCI_INQUIRY, &hdev->flags);
 
         hci_dev_lock(hdev);
-        mgmt_discovering(hdev, 0);
+        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
         hci_dev_unlock(hdev);
 
         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
@@ -73,6 +69,18 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
         hci_conn_check_pending(hdev);
 }
 
+static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
+
+        BT_DBG("%s status 0x%x", hdev->name, status);
+
+        if (status)
+                return;
+
+        set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
+}
+
 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
@@ -82,6 +90,8 @@ static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
         if (status)
                 return;
 
+        clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
+
         hci_conn_check_pending(hdev);
 }
 
@@ -195,7 +205,11 @@ static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 
         hci_req_complete(hdev, HCI_OP_RESET, status);
 
-        hdev->dev_flags = 0;
+        /* Reset all non-persistent flags */
+        hdev->dev_flags &= ~(BIT(HCI_LE_SCAN) | BIT(HCI_PENDING_CLASS) |
+                             BIT(HCI_PERIODIC_INQ));
+
+        hdev->discovery.state = DISCOVERY_STOPPED;
 }
 
 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
@@ -211,13 +225,14 @@ static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 
         hci_dev_lock(hdev);
 
-        if (test_bit(HCI_MGMT, &hdev->flags))
+        if (test_bit(HCI_MGMT, &hdev->dev_flags))
                 mgmt_set_local_name_complete(hdev, sent, status);
-
-        if (status == 0)
+        else if (!status)
                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 
         hci_dev_unlock(hdev);
+
+        hci_req_complete(hdev, HCI_OP_WRITE_LOCAL_NAME, status);
 }
 
 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
@@ -229,7 +244,8 @@ static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
         if (rp->status)
                 return;
 
-        memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
+        if (test_bit(HCI_SETUP, &hdev->dev_flags))
+                memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 }
 
 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
@@ -252,6 +268,9 @@ static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
                         clear_bit(HCI_AUTH, &hdev->flags);
         }
 
+        if (test_bit(HCI_MGMT, &hdev->dev_flags))
+                mgmt_auth_enable_complete(hdev, status);
+
         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 }
 
@@ -349,14 +368,19 @@ static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s status 0x%x", hdev->name, status);
 
-        if (status)
-                return;
-
         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
         if (!sent)
                 return;
 
-        memcpy(hdev->dev_class, sent, 3);
+        hci_dev_lock(hdev);
+
+        if (status == 0)
+                memcpy(hdev->dev_class, sent, 3);
+
+        if (test_bit(HCI_MGMT, &hdev->dev_flags))
+                mgmt_set_class_of_dev_complete(hdev, sent, status);
+
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
@@ -419,18 +443,6 @@ static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 }
 
-static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
-
-        BT_DBG("%s status 0x%x", hdev->name, rp->status);
-
-        if (rp->status)
-                return;
-
-        hdev->ssp_mode = rp->mode;
-}
-
 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
@@ -438,14 +450,18 @@ static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s status 0x%x", hdev->name, status);
 
-        if (status)
-                return;
-
         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
         if (!sent)
                 return;
 
-        hdev->ssp_mode = *((__u8 *) sent);
+        if (test_bit(HCI_MGMT, &hdev->dev_flags))
+                mgmt_ssp_enable_complete(hdev, *((u8 *) sent), status);
+        else if (!status) {
+                if (*((u8 *) sent))
+                        set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
+                else
+                        clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
+        }
 }
 
 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
@@ -504,7 +520,7 @@ static void hci_setup_event_mask(struct hci_dev *hdev)
         events[5] |= 0x10; /* Synchronous Connection Changed */
 
         if (hdev->features[3] & LMP_RSSI_INQ)
-                events[4] |= 0x04; /* Inquiry Result with RSSI */
+                events[4] |= 0x02; /* Inquiry Result with RSSI */
 
         if (hdev->features[5] & LMP_SNIFF_SUBR)
                 events[5] |= 0x20; /* Sniff Subrating */
@@ -540,20 +556,6 @@ static void hci_setup_event_mask(struct hci_dev *hdev)
         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 }
 
-static void hci_set_le_support(struct hci_dev *hdev)
-{
-        struct hci_cp_write_le_host_supported cp;
-
-        memset(&cp, 0, sizeof(cp));
-
-        if (enable_le) {
-                cp.le = 1;
-                cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
-        }
-
-        hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp), &cp);
-}
-
 static void hci_setup(struct hci_dev *hdev)
 {
         if (hdev->dev_type != HCI_BREDR)
@@ -565,8 +567,18 @@ static void hci_setup(struct hci_dev *hdev)
                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 
         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
-                u8 mode = 0x01;
-                hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
+                if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
+                        u8 mode = 0x01;
+                        hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE,
+                                     sizeof(mode), &mode);
+                } else {
+                        struct hci_cp_write_eir cp;
+
+                        memset(hdev->eir, 0, sizeof(hdev->eir));
+                        memset(&cp, 0, sizeof(cp));
+
+                        hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
+                }
         }
 
         if (hdev->features[3] & LMP_RSSI_INQ)
@@ -579,12 +591,15 @@ static void hci_setup(struct hci_dev *hdev)
                 struct hci_cp_read_local_ext_features cp;
 
                 cp.page = 0x01;
-                hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES,
-                                                        sizeof(cp), &cp);
+                hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp),
+                             &cp);
         }
 
-        if (hdev->features[4] & LMP_LE)
-                hci_set_le_support(hdev);
+        if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
+                u8 enable = 1;
+                hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
+                             &enable);
+        }
 }
 
 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
@@ -594,7 +609,7 @@ static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 
         if (rp->status)
-                return;
+                goto done;
 
         hdev->hci_ver = rp->hci_ver;
         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
@@ -608,10 +623,14 @@ static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 
         if (test_bit(HCI_INIT, &hdev->flags))
                 hci_setup(hdev);
+
+done:
+        hci_req_complete(hdev, HCI_OP_READ_LOCAL_VERSION, rp->status);
 }
 
 static void hci_setup_link_policy(struct hci_dev *hdev)
 {
+        struct hci_cp_write_def_link_policy cp;
         u16 link_policy = 0;
 
         if (hdev->features[0] & LMP_RSWITCH)
@@ -623,9 +642,8 @@ static void hci_setup_link_policy(struct hci_dev *hdev)
         if (hdev->features[1] & LMP_PARK)
                 link_policy |= HCI_LP_PARK;
 
-        link_policy = cpu_to_le16(link_policy);
-        hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
-                                        sizeof(link_policy), &link_policy);
+        cp.policy = cpu_to_le16(link_policy);
+        hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
 }
 
 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
@@ -701,6 +719,22 @@ static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb
                                         hdev->features[6], hdev->features[7]);
 }
 
+static void hci_set_le_support(struct hci_dev *hdev)
+{
+        struct hci_cp_write_le_host_supported cp;
+
+        memset(&cp, 0, sizeof(cp));
+
+        if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
+                cp.le = 1;
+                cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
+        }
+
+        if (cp.le != !!(hdev->host_features[0] & LMP_HOST_LE))
+                hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
+                             &cp);
+}
+
 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
                                                         struct sk_buff *skb)
 {
@@ -709,7 +743,7 @@ static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 
         if (rp->status)
-                return;
+                goto done;
 
         switch (rp->page) {
         case 0:
@@ -720,6 +754,10 @@ static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
                 break;
         }
 
+        if (test_bit(HCI_INIT, &hdev->flags) && hdev->features[4] & LMP_LE)
+                hci_set_le_support(hdev);
+
+done:
         hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
 }
 
@@ -864,11 +902,14 @@ static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
                                                         struct sk_buff *skb)
 {
-        __u8 status = *((__u8 *) skb->data);
+        struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 
-        BT_DBG("%s status 0x%x", hdev->name, status);
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (!rp->status)
+                hdev->inq_tx_power = rp->tx_power;
 
-        hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
+        hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, rp->status);
 }
 
 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
@@ -890,7 +931,7 @@ static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 
         hci_dev_lock(hdev);
 
-        if (test_bit(HCI_MGMT, &hdev->flags))
+        if (test_bit(HCI_MGMT, &hdev->dev_flags))
                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 
         if (rp->status != 0)
@@ -916,7 +957,7 @@ static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 
         hci_dev_lock(hdev);
 
-        if (test_bit(HCI_MGMT, &hdev->flags))
+        if (test_bit(HCI_MGMT, &hdev->dev_flags))
                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
                                                                 rp->status);
 
@@ -951,9 +992,9 @@ static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 
         hci_dev_lock(hdev);
 
-        if (test_bit(HCI_MGMT, &hdev->flags))
-                mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr,
-                                                                rp->status);
+        if (test_bit(HCI_MGMT, &hdev->dev_flags))
+                mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
+                                                 rp->status);
 
         hci_dev_unlock(hdev);
 }
@@ -967,9 +1008,9 @@ static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 
         hci_dev_lock(hdev);
 
-        if (test_bit(HCI_MGMT, &hdev->flags))
+        if (test_bit(HCI_MGMT, &hdev->dev_flags))
                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
-                                                                rp->status);
+                                                     ACL_LINK, 0, rp->status);
 
         hci_dev_unlock(hdev);
 }
@@ -982,9 +1023,9 @@ static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 
         hci_dev_lock(hdev);
 
-        if (test_bit(HCI_MGMT, &hdev->flags))
-                mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr,
-                                                                rp->status);
+        if (test_bit(HCI_MGMT, &hdev->dev_flags))
+                mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
+                                                 0, rp->status);
 
         hci_dev_unlock(hdev);
 }
@@ -998,9 +1039,9 @@ static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
 
         hci_dev_lock(hdev);
 
-        if (test_bit(HCI_MGMT, &hdev->flags))
+        if (test_bit(HCI_MGMT, &hdev->dev_flags))
                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
-                                                                rp->status);
+                                                     ACL_LINK, 0, rp->status);
 
         hci_dev_unlock(hdev);
 }
@@ -1023,6 +1064,15 @@ static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
         __u8 status = *((__u8 *) skb->data);
 
         BT_DBG("%s status 0x%x", hdev->name, status);
+
+        hci_req_complete(hdev, HCI_OP_LE_SET_SCAN_PARAM, status);
+
+        if (status) {
+                hci_dev_lock(hdev);
+                mgmt_start_discovery_failed(hdev, status);
+                hci_dev_unlock(hdev);
+                return;
+        }
 }
 
 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
@@ -1033,28 +1083,47 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
 
         BT_DBG("%s status 0x%x", hdev->name, status);
 
-        if (status)
-                return;
-
         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
         if (!cp)
                 return;
 
         switch (cp->enable) {
         case LE_SCANNING_ENABLED:
-                set_bit(HCI_LE_SCAN, &hdev->dev_flags);
+                hci_req_complete(hdev, HCI_OP_LE_SET_SCAN_ENABLE, status);
+
+                if (status) {
+                        hci_dev_lock(hdev);
+                        mgmt_start_discovery_failed(hdev, status);
+                        hci_dev_unlock(hdev);
+                        return;
+                }
 
-                cancel_delayed_work_sync(&hdev->adv_work);
+                set_bit(HCI_LE_SCAN, &hdev->dev_flags);
 
                 hci_dev_lock(hdev);
-                hci_adv_entries_clear(hdev);
+                hci_discovery_set_state(hdev, DISCOVERY_FINDING);
                 hci_dev_unlock(hdev);
                 break;
 
         case LE_SCANNING_DISABLED:
+                if (status) {
+                        hci_dev_lock(hdev);
+                        mgmt_stop_discovery_failed(hdev, status);
+                        hci_dev_unlock(hdev);
+                        return;
+                }
+
                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
 
-                schedule_delayed_work(&hdev->adv_work, ADV_CLEAR_TIMEOUT);
+                if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
+                    hdev->discovery.state == DISCOVERY_FINDING) {
+                        mgmt_interleaved_discovery(hdev);
+                } else {
+                        hci_dev_lock(hdev);
+                        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+                        hci_dev_unlock(hdev);
+                }
+
                 break;
 
         default:
@@ -1090,16 +1159,27 @@ static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 static inline void hci_cc_write_le_host_supported(struct hci_dev *hdev,
                                                         struct sk_buff *skb)
 {
-        struct hci_cp_read_local_ext_features cp;
+        struct hci_cp_write_le_host_supported *sent;
         __u8 status = *((__u8 *) skb->data);
 
         BT_DBG("%s status 0x%x", hdev->name, status);
 
-        if (status)
+        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
+        if (!sent)
                 return;
 
-        cp.page = 0x01;
-        hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp), &cp);
+        if (!status) {
+                if (sent->le)
+                        hdev->host_features[0] |= LMP_HOST_LE;
+                else
+                        hdev->host_features[0] &= ~LMP_HOST_LE;
+        }
+
+        if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
+                                        !test_bit(HCI_INIT, &hdev->flags))
+                mgmt_le_enable_complete(hdev, sent->le, status);
+
+        hci_req_complete(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, status);
 }
 
 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
@@ -1110,7 +1190,7 @@ static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
                 hci_conn_check_pending(hdev);
                 hci_dev_lock(hdev);
-                if (test_bit(HCI_MGMT, &hdev->flags))
+                if (test_bit(HCI_MGMT, &hdev->dev_flags))
                         mgmt_start_discovery_failed(hdev, status);
                 hci_dev_unlock(hdev);
                 return;
@@ -1119,7 +1199,7 @@ static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
         set_bit(HCI_INQUIRY, &hdev->flags);
 
         hci_dev_lock(hdev);
-        mgmt_discovering(hdev, 1);
+        hci_discovery_set_state(hdev, DISCOVERY_FINDING);
         hci_dev_unlock(hdev);
 }
 
@@ -1153,7 +1233,7 @@ static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
                 if (!conn) {
                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
                         if (conn) {
-                                conn->out = 1;
+                                conn->out = true;
                                 conn->link_mode |= HCI_LM_MASTER;
                         } else
                                 BT_ERR("No memory for new connection");
@@ -1263,7 +1343,7 @@ static int hci_outgoing_auth_needed(struct hci_dev *hdev,
 
         /* Only request authentication for SSP connections or non-SSP
          * devices with sec_level HIGH or if MITM protection is requested */
-        if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
+        if (!hci_conn_ssp_enabled(conn) &&
                                 conn->pending_sec_level != BT_SECURITY_HIGH &&
                                 !(conn->auth_type & 0x01))
                 return 0;
@@ -1271,6 +1351,73 @@ static int hci_outgoing_auth_needed(struct hci_dev *hdev,
         return 1;
 }
 
+static inline int hci_resolve_name(struct hci_dev *hdev,
+                                   struct inquiry_entry *e)
+{
+        struct hci_cp_remote_name_req cp;
+
+        memset(&cp, 0, sizeof(cp));
+
+        bacpy(&cp.bdaddr, &e->data.bdaddr);
+        cp.pscan_rep_mode = e->data.pscan_rep_mode;
+        cp.pscan_mode = e->data.pscan_mode;
+        cp.clock_offset = e->data.clock_offset;
+
+        return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
+}
+
+static bool hci_resolve_next_name(struct hci_dev *hdev)
+{
+        struct discovery_state *discov = &hdev->discovery;
+        struct inquiry_entry *e;
+
+        if (list_empty(&discov->resolve))
+                return false;
+
+        e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
+        if (hci_resolve_name(hdev, e) == 0) {
+                e->name_state = NAME_PENDING;
+                return true;
+        }
+
+        return false;
+}
+
+static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
+                                   bdaddr_t *bdaddr, u8 *name, u8 name_len)
+{
+        struct discovery_state *discov = &hdev->discovery;
+        struct inquiry_entry *e;
+
+        if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
+                mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00, 0, name,
+                                      name_len, conn->dev_class);
+
+        if (discov->state == DISCOVERY_STOPPED)
+                return;
+
+        if (discov->state == DISCOVERY_STOPPING)
+                goto discov_complete;
+
+        if (discov->state != DISCOVERY_RESOLVING)
+                return;
+
+        e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
+        if (e) {
+                e->name_state = NAME_KNOWN;
+                list_del(&e->list);
+                if (name)
+                        mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
+                                         e->data.rssi, name, name_len);
+        }
+
+        if (hci_resolve_next_name(hdev))
+                return;
+
+discov_complete:
+        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+}
+
 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
 {
         struct hci_cp_remote_name_req *cp;
@@ -1290,13 +1437,17 @@ static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
+
+        if (test_bit(HCI_MGMT, &hdev->dev_flags))
+                hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
+
         if (!conn)
                 goto unlock;
 
         if (!hci_outgoing_auth_needed(hdev, conn))
                 goto unlock;
 
-        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
+        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
                 struct hci_cp_auth_requested cp;
                 cp.handle = __cpu_to_le16(conn->handle);
                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
@@ -1413,9 +1564,9 @@ static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
         if (conn) {
-                clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
+                clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
 
-                if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
+                if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
                         hci_sco_setup(conn, status);
         }
 
@@ -1440,15 +1591,37 @@ static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
         if (conn) {
-                clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
+                clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
 
-                if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
+                if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
                         hci_sco_setup(conn, status);
         }
 
         hci_dev_unlock(hdev);
 }
 
+static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
+{
+        struct hci_cp_disconnect *cp;
+        struct hci_conn *conn;
+
+        if (!status)
+                return;
+
+        cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
+        if (!cp)
+                return;
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
+        if (conn)
+                mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
+                                       conn->dst_type, status);
+
+        hci_dev_unlock(hdev);
+}
+
 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
 {
         struct hci_cp_le_create_conn *cp;
@@ -1470,6 +1643,8 @@ static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
         if (status) {
                 if (conn && conn->state == BT_CONNECT) {
                         conn->state = BT_CLOSED;
+                        mgmt_connect_failed(hdev, &cp->peer_addr, conn->type,
+                                            conn->dst_type, status);
                         hci_proto_connect_cfm(conn, status);
                         hci_conn_del(conn);
                 }
@@ -1478,7 +1653,7 @@ static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
                         conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
                         if (conn) {
                                 conn->dst_type = cp->peer_addr_type;
-                                conn->out = 1;
+                                conn->out = true;
                         } else {
                                 BT_ERR("No memory for new connection");
                         }
@@ -1496,6 +1671,8 @@ static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
+        struct discovery_state *discov = &hdev->discovery;
+        struct inquiry_entry *e;
 
         BT_DBG("%s status %d", hdev->name, status);
 
@@ -1506,8 +1683,28 @@ static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff
         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
                 return;
 
+        if (!test_bit(HCI_MGMT, &hdev->dev_flags))
+                return;
+
         hci_dev_lock(hdev);
-        mgmt_discovering(hdev, 0);
+
+        if (discov->state != DISCOVERY_FINDING)
+                goto unlock;
+
+        if (list_empty(&discov->resolve)) {
+                hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+                goto unlock;
+        }
+
+        e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
+        if (e && hci_resolve_name(hdev, e) == 0) {
+                e->name_state = NAME_PENDING;
+                hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
+        } else {
+                hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+        }
+
+unlock:
         hci_dev_unlock(hdev);
 }
 
@@ -1522,9 +1719,14 @@ static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *
         if (!num_rsp)
                 return;
 
+        if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
+                return;
+
         hci_dev_lock(hdev);
 
         for (; num_rsp; num_rsp--, info++) {
+                bool name_known, ssp;
+
                 bacpy(&data.bdaddr, &info->bdaddr);
                 data.pscan_rep_mode     = info->pscan_rep_mode;
                 data.pscan_period_mode  = info->pscan_period_mode;
@@ -1533,9 +1735,11 @@ static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *
                 data.clock_offset       = info->clock_offset;
                 data.rssi               = 0x00;
                 data.ssp_mode           = 0x00;
-                hci_inquiry_cache_update(hdev, &data);
+
+                name_known = hci_inquiry_cache_update(hdev, &data, false, &ssp);
                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
-                                                info->dev_class, 0, NULL);
+                                  info->dev_class, 0, !name_known, ssp, NULL,
+                                  0);
         }
 
         hci_dev_unlock(hdev);
@@ -1569,8 +1773,6 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                         conn->state = BT_CONFIG;
                         hci_conn_hold(conn);
                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
-                        mgmt_connected(hdev, &ev->bdaddr, conn->type,
-                                                        conn->dst_type);
                 } else
                         conn->state = BT_CONNECTED;
 
@@ -1588,7 +1790,7 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                         struct hci_cp_read_remote_features cp;
                         cp.handle = ev->handle;
                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
-                                                        sizeof(cp), &cp);
+                                     sizeof(cp), &cp);
                 }
 
                 /* Set packet type for incoming connection */
@@ -1596,14 +1798,14 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                         struct hci_cp_change_conn_ptype cp;
                         cp.handle = ev->handle;
                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
-                        hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
-                                                        sizeof(cp), &cp);
+                        hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
+                                     &cp);
                 }
         } else {
                 conn->state = BT_CLOSED;
                 if (conn->type == ACL_LINK)
                         mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
-                                                conn->dst_type, ev->status);
+                                            conn->dst_type, ev->status);
         }
 
         if (conn->type == ACL_LINK)
@@ -1668,8 +1870,8 @@ static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *sk
                         else
                                 cp.role = 0x01; /* Remain slave */
 
-                        hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
-                                                        sizeof(cp), &cp);
+                        hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp),
+                                     &cp);
                 } else {
                         struct hci_cp_accept_sync_conn_req cp;
 
@@ -1683,7 +1885,7 @@ static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *sk
                         cp.retrans_effort = 0xff;
 
                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
-                                                        sizeof(cp), &cp);
+                                     sizeof(cp), &cp);
                 }
         } else {
                 /* Connection rejected */
@@ -1711,15 +1913,19 @@ static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff
         if (ev->status == 0)
                 conn->state = BT_CLOSED;
 
-        if (conn->type == ACL_LINK || conn->type == LE_LINK) {
+        if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags) &&
+                        (conn->type == ACL_LINK || conn->type == LE_LINK)) {
                 if (ev->status != 0)
-                        mgmt_disconnect_failed(hdev, &conn->dst, ev->status);
+                        mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
+                                                conn->dst_type, ev->status);
                 else
-                        mgmt_disconnected(hdev, &conn->dst, conn->type,
-                                                        conn->dst_type);
+                        mgmt_device_disconnected(hdev, &conn->dst, conn->type,
+                                                 conn->dst_type);
         }
 
         if (ev->status == 0) {
+                if (conn->type == ACL_LINK && conn->flush_key)
+                        hci_remove_link_key(hdev, &conn->dst);
                 hci_proto_disconn_cfm(conn, ev->reason);
                 hci_conn_del(conn);
         }
@@ -1742,22 +1948,23 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                 goto unlock;
 
         if (!ev->status) {
-                if (!(conn->ssp_mode > 0 && hdev->ssp_mode > 0) &&
-                                test_bit(HCI_CONN_REAUTH_PEND,  &conn->pend)) {
+                if (!hci_conn_ssp_enabled(conn) &&
+                                test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
                         BT_INFO("re-auth of legacy device is not possible.");
                 } else {
                         conn->link_mode |= HCI_LM_AUTH;
                         conn->sec_level = conn->pending_sec_level;
                 }
         } else {
-                mgmt_auth_failed(hdev, &conn->dst, ev->status);
+                mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
+                                 ev->status);
         }
 
-        clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
-        clear_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
+        clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
+        clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 
         if (conn->state == BT_CONFIG) {
-                if (!ev->status && hdev->ssp_mode > 0 && conn->ssp_mode > 0) {
+                if (!ev->status && hci_conn_ssp_enabled(conn)) {
                         struct hci_cp_set_conn_encrypt cp;
                         cp.handle  = ev->handle;
                         cp.encrypt = 0x01;
@@ -1776,7 +1983,7 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                 hci_conn_put(conn);
         }
 
-        if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
+        if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
                 if (!ev->status) {
                         struct hci_cp_set_conn_encrypt cp;
                         cp.handle  = ev->handle;
@@ -1784,7 +1991,7 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
                                                                         &cp);
                 } else {
-                        clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
+                        clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
                         hci_encrypt_cfm(conn, ev->status, 0x00);
                 }
         }
@@ -1804,17 +2011,25 @@ static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb
 
         hci_dev_lock(hdev);
 
-        if (ev->status == 0 && test_bit(HCI_MGMT, &hdev->flags))
-                mgmt_remote_name(hdev, &ev->bdaddr, ev->name);
-
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+
+        if (!test_bit(HCI_MGMT, &hdev->dev_flags))
+                goto check_auth;
+
+        if (ev->status == 0)
+                hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
+                                       strnlen(ev->name, HCI_MAX_NAME_LENGTH));
+        else
+                hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
+
+check_auth:
         if (!conn)
                 goto unlock;
 
         if (!hci_outgoing_auth_needed(hdev, conn))
                 goto unlock;
 
-        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
+        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
                 struct hci_cp_auth_requested cp;
                 cp.handle = __cpu_to_le16(conn->handle);
                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
@@ -1845,7 +2060,13 @@ static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *
                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
                 }
 
-                clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
+                clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
+
+                if (ev->status && conn->state == BT_CONNECTED) {
+                        hci_acl_disconn(conn, HCI_ERROR_AUTH_FAILURE);
+                        hci_conn_put(conn);
+                        goto unlock;
+                }
 
                 if (conn->state == BT_CONFIG) {
                         if (!ev->status)
@@ -1857,6 +2078,7 @@ static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *
                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
         }
 
+unlock:
         hci_dev_unlock(hdev);
 }
 
@@ -1874,7 +2096,7 @@ static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct
                 if (!ev->status)
                         conn->link_mode |= HCI_LM_SECURE;
 
-                clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
+                clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
 
                 hci_key_change_cfm(conn, ev->status);
         }
@@ -1910,13 +2132,16 @@ static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff
                 goto unlock;
         }
 
-        if (!ev->status) {
+        if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
                 struct hci_cp_remote_name_req cp;
                 memset(&cp, 0, sizeof(cp));
                 bacpy(&cp.bdaddr, &conn->dst);
                 cp.pscan_rep_mode = 0x02;
                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
-        }
+        } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
+                mgmt_device_connected(hdev, &conn->dst, conn->type,
+                                      conn->dst_type, 0, NULL, 0,
+                                      conn->dev_class);
 
         if (!hci_outgoing_auth_needed(hdev, conn)) {
                 conn->state = BT_CONNECTED;
@@ -1952,6 +2177,10 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
                 hci_cc_inquiry_cancel(hdev, skb);
                 break;
 
+        case HCI_OP_PERIODIC_INQ:
+                hci_cc_periodic_inq(hdev, skb);
+                break;
+
         case HCI_OP_EXIT_PERIODIC_INQ:
                 hci_cc_exit_periodic_inq(hdev, skb);
                 break;
@@ -2024,10 +2253,6 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
                 hci_cc_host_buffer_size(hdev, skb);
                 break;
 
-        case HCI_OP_READ_SSP_MODE:
-                hci_cc_read_ssp_mode(hdev, skb);
-                break;
-
         case HCI_OP_WRITE_SSP_MODE:
                 hci_cc_write_ssp_mode(hdev, skb);
                 break;
@@ -2122,6 +2347,7 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
 
         case HCI_OP_USER_PASSKEY_NEG_REPLY:
                 hci_cc_user_passkey_neg_reply(hdev, skb);
+                break;
 
         case HCI_OP_LE_SET_SCAN_PARAM:
                 hci_cc_le_set_scan_param(hdev, skb);
@@ -2213,8 +2439,7 @@ static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 break;
 
         case HCI_OP_DISCONNECT:
-                if (ev->status != 0)
-                        mgmt_disconnect_failed(hdev, NULL, ev->status);
+                hci_cs_disconnect(hdev, ev->status);
                 break;
 
         case HCI_OP_LE_CREATE_CONN:
@@ -2258,7 +2483,7 @@ static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb
                                 conn->link_mode |= HCI_LM_MASTER;
                 }
 
-                clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
+                clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
 
                 hci_role_switch_cfm(conn, ev->status, ev->role);
         }
@@ -2332,6 +2557,56 @@ static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *s
         queue_work(hdev->workqueue, &hdev->tx_work);
 }
 
+static inline void hci_num_comp_blocks_evt(struct hci_dev *hdev,
+                                           struct sk_buff *skb)
+{
+        struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
+        int i;
+
+        if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
+                BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
+                return;
+        }
+
+        if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
+                        ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
+                BT_DBG("%s bad parameters", hdev->name);
+                return;
+        }
+
+        BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
+                                                                ev->num_hndl);
+
+        for (i = 0; i < ev->num_hndl; i++) {
+                struct hci_comp_blocks_info *info = &ev->handles[i];
+                struct hci_conn *conn;
+                __u16  handle, block_count;
+
+                handle = __le16_to_cpu(info->handle);
+                block_count = __le16_to_cpu(info->blocks);
+
+                conn = hci_conn_hash_lookup_handle(hdev, handle);
+                if (!conn)
+                        continue;
+
+                conn->sent -= block_count;
+
+                switch (conn->type) {
+                case ACL_LINK:
+                        hdev->block_cnt += block_count;
+                        if (hdev->block_cnt > hdev->num_blocks)
+                                hdev->block_cnt = hdev->num_blocks;
+                        break;
+
+                default:
+                        BT_ERR("Unknown type %d conn %p", conn->type, conn);
+                        break;
+                }
+        }
+
+        queue_work(hdev->workqueue, &hdev->tx_work);
+}
+
 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_mode_change *ev = (void *) skb->data;
@@ -2346,14 +2621,14 @@ static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb
                 conn->mode = ev->mode;
                 conn->interval = __le16_to_cpu(ev->interval);
 
-                if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
+                if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
                         if (conn->mode == HCI_CM_ACTIVE)
-                                conn->power_save = 1;
+                                set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
                         else
-                                conn->power_save = 0;
+                                clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
                 }
 
-                if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
+                if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
                         hci_sco_setup(conn, ev->status);
         }
 
@@ -2379,10 +2654,10 @@ static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff
                 hci_conn_put(conn);
         }
 
-        if (!test_bit(HCI_PAIRABLE, &hdev->flags))
+        if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
                                         sizeof(ev->bdaddr), &ev->bdaddr);
-        else if (test_bit(HCI_MGMT, &hdev->flags)) {
+        else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
                 u8 secure;
 
                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
@@ -2406,7 +2681,7 @@ static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff
 
         BT_DBG("%s", hdev->name);
 
-        if (!test_bit(HCI_LINK_KEYS, &hdev->flags))
+        if (!test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
                 return;
 
         hci_dev_lock(hdev);
@@ -2421,7 +2696,7 @@ static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff
         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
                                                         batostr(&ev->bdaddr));
 
-        if (!test_bit(HCI_DEBUG_KEYS, &hdev->flags) &&
+        if (!test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) &&
                                 key->type == HCI_LK_DEBUG_COMBINATION) {
                 BT_DBG("%s ignoring debug key", hdev->name);
                 goto not_found;
@@ -2483,7 +2758,7 @@ static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff
                 hci_conn_put(conn);
         }
 
-        if (test_bit(HCI_LINK_KEYS, &hdev->flags))
+        if (test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
                                                         ev->key_type, pin_len);
 
@@ -2551,12 +2826,16 @@ static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct
 {
         struct inquiry_data data;
         int num_rsp = *((__u8 *) skb->data);
+        bool name_known, ssp;
 
         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
 
         if (!num_rsp)
                 return;
 
+        if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
+                return;
+
         hci_dev_lock(hdev);
 
         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
@@ -2572,10 +2851,12 @@ static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct
                         data.clock_offset       = info->clock_offset;
                         data.rssi               = info->rssi;
                         data.ssp_mode           = 0x00;
-                        hci_inquiry_cache_update(hdev, &data);
+
+                        name_known = hci_inquiry_cache_update(hdev, &data,
+                                                              false, &ssp);
                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
-                                                info->dev_class, info->rssi,
-                                                NULL);
+                                          info->dev_class, info->rssi,
+                                          !name_known, ssp, NULL, 0);
                 }
         } else {
                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
@@ -2589,10 +2870,11 @@ static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct
                         data.clock_offset       = info->clock_offset;
                         data.rssi               = info->rssi;
                         data.ssp_mode           = 0x00;
-                        hci_inquiry_cache_update(hdev, &data);
+                        name_known = hci_inquiry_cache_update(hdev, &data,
+                                                              false, &ssp);
                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
-                                                info->dev_class, info->rssi,
-                                                NULL);
+                                          info->dev_class, info->rssi,
+                                          !name_known, ssp, NULL, 0);
                 }
         }
 
@@ -2617,21 +2899,25 @@ static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_b
 
                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
                 if (ie)
-                        ie->data.ssp_mode = (ev->features[0] & 0x01);
+                        ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
 
-                conn->ssp_mode = (ev->features[0] & 0x01);
+                if (ev->features[0] & LMP_HOST_SSP)
+                        set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
         }
 
         if (conn->state != BT_CONFIG)
                 goto unlock;
 
-        if (!ev->status) {
+        if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
                 struct hci_cp_remote_name_req cp;
                 memset(&cp, 0, sizeof(cp));
                 bacpy(&cp.bdaddr, &conn->dst);
                 cp.pscan_rep_mode = 0x02;
                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
-        }
+        } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
+                mgmt_device_connected(hdev, &conn->dst, conn->type,
+                                      conn->dst_type, 0, NULL, 0,
+                                      conn->dev_class);
 
         if (!hci_outgoing_auth_needed(hdev, conn)) {
                 conn->state = BT_CONNECTED;
@@ -2715,15 +3001,21 @@ static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct
         struct inquiry_data data;
         struct extended_inquiry_info *info = (void *) (skb->data + 1);
         int num_rsp = *((__u8 *) skb->data);
+        size_t eir_len;
 
         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
 
         if (!num_rsp)
                 return;
 
+        if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
+                return;
+
         hci_dev_lock(hdev);
 
         for (; num_rsp; num_rsp--, info++) {
+                bool name_known, ssp;
+
                 bacpy(&data.bdaddr, &info->bdaddr);
                 data.pscan_rep_mode     = info->pscan_rep_mode;
                 data.pscan_period_mode  = info->pscan_period_mode;
@@ -2732,9 +3024,20 @@ static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct
                 data.clock_offset       = info->clock_offset;
                 data.rssi               = info->rssi;
                 data.ssp_mode           = 0x01;
-                hci_inquiry_cache_update(hdev, &data);
+
+                if (test_bit(HCI_MGMT, &hdev->dev_flags))
+                        name_known = eir_has_data_type(info->data,
+                                                       sizeof(info->data),
+                                                       EIR_NAME_COMPLETE);
+                else
+                        name_known = true;
+
+                name_known = hci_inquiry_cache_update(hdev, &data, name_known,
+                                                      &ssp);
+                eir_len = eir_get_length(info->data, sizeof(info->data));
                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
-                                info->dev_class, info->rssi, info->data);
+                                  info->dev_class, info->rssi, !name_known,
+                                  ssp, info->data, eir_len);
         }
 
         hci_dev_unlock(hdev);
@@ -2774,19 +3077,22 @@ static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff
 
         hci_conn_hold(conn);
 
-        if (!test_bit(HCI_MGMT, &hdev->flags))
+        if (!test_bit(HCI_MGMT, &hdev->dev_flags))
                 goto unlock;
 
-        if (test_bit(HCI_PAIRABLE, &hdev->flags) ||
+        if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
                         (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
                 struct hci_cp_io_capability_reply cp;
 
                 bacpy(&cp.bdaddr, &ev->bdaddr);
-                cp.capability = conn->io_capability;
+                /* Change the IO capability from KeyboardDisplay
+                 * to DisplayYesNo as it is not supported by BT spec. */
+                cp.capability = (conn->io_capability == 0x04) ?
+                                                0x01 : conn->io_capability;
                 conn->auth_type = hci_get_auth_req(conn);
                 cp.authentication = conn->auth_type;
 
-                if ((conn->out == 0x01 || conn->remote_oob == 0x01) &&
+                if ((conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)) &&
                                 hci_find_remote_oob_data(hdev, &conn->dst))
                         cp.oob_data = 0x01;
                 else
@@ -2822,8 +3128,9 @@ static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *s
                 goto unlock;
 
         conn->remote_cap = ev->capability;
-        conn->remote_oob = ev->oob_data;
         conn->remote_auth = ev->authentication;
+        if (ev->oob_data)
+                set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
 
 unlock:
         hci_dev_unlock(hdev);
@@ -2840,7 +3147,7 @@ static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
 
         hci_dev_lock(hdev);
 
-        if (!test_bit(HCI_MGMT, &hdev->flags))
+        if (!test_bit(HCI_MGMT, &hdev->dev_flags))
                 goto unlock;
 
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
@@ -2869,7 +3176,7 @@ static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
                 /* If we're not the initiators request authorization to
                  * proceed from user space (mgmt_user_confirm with
                  * confirm_hint set to 1). */
-                if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
+                if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
                         BT_DBG("Confirming auto-accept as acceptor");
                         confirm_hint = 1;
                         goto confirm;
@@ -2890,8 +3197,8 @@ static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
         }
 
 confirm:
-        mgmt_user_confirm_request(hdev, &ev->bdaddr, ev->passkey,
-                                                                confirm_hint);
+        mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0, ev->passkey,
+                                  confirm_hint);
 
 unlock:
         hci_dev_unlock(hdev);
@@ -2906,8 +3213,8 @@ static inline void hci_user_passkey_request_evt(struct hci_dev *hdev,
 
         hci_dev_lock(hdev);
 
-        if (test_bit(HCI_MGMT, &hdev->flags))
-                mgmt_user_passkey_request(hdev, &ev->bdaddr);
+        if (test_bit(HCI_MGMT, &hdev->dev_flags))
+                mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
 
         hci_dev_unlock(hdev);
 }
@@ -2930,8 +3237,9 @@ static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_
          * initiated the authentication. A traditional auth_complete
          * event gets always produced as initiator and is also mapped to
          * the mgmt_auth_failed event */
-        if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend) && ev->status != 0)
-                mgmt_auth_failed(hdev, &conn->dst, ev->status);
+        if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status != 0)
+                mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
+                                 ev->status);
 
         hci_conn_put(conn);
 
@@ -2950,13 +3258,13 @@ static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_
 
         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
         if (ie)
-                ie->data.ssp_mode = (ev->features[0] & 0x01);
+                ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
 
         hci_dev_unlock(hdev);
 }
 
 static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
-                                                        struct sk_buff *skb)
+                                                   struct sk_buff *skb)
 {
         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
         struct oob_data *data;
@@ -2965,7 +3273,7 @@ static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
 
         hci_dev_lock(hdev);
 
-        if (!test_bit(HCI_MGMT, &hdev->flags))
+        if (!test_bit(HCI_MGMT, &hdev->dev_flags))
                 goto unlock;
 
         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
@@ -3020,7 +3328,9 @@ static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff
                 goto unlock;
         }
 
-        mgmt_connected(hdev, &ev->bdaddr, conn->type, conn->dst_type);
+        if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
+                mgmt_device_connected(hdev, &ev->bdaddr, conn->type,
+                                      conn->dst_type, 0, NULL, 0, NULL);
 
         conn->sec_level = BT_SECURITY_LOW;
         conn->handle = __le16_to_cpu(ev->handle);
@@ -3040,13 +3350,16 @@ static inline void hci_le_adv_report_evt(struct hci_dev *hdev,
 {
         u8 num_reports = skb->data[0];
         void *ptr = &skb->data[1];
+        s8 rssi;
 
         hci_dev_lock(hdev);
 
         while (num_reports--) {
                 struct hci_ev_le_advertising_info *ev = ptr;
 
-                hci_add_adv_entry(hdev, ev);
+                rssi = ev->data[ev->length];
+                mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
+                                  NULL, rssi, 0, 1, ev->data, ev->length);
 
                 ptr += sizeof(*ev) + ev->length + 1;
         }
@@ -3061,9 +3374,9 @@ static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
         struct hci_cp_le_ltk_reply cp;
         struct hci_cp_le_ltk_neg_reply neg;
         struct hci_conn *conn;
-        struct link_key *ltk;
+        struct smp_ltk *ltk;
 
-        BT_DBG("%s handle %d", hdev->name, cpu_to_le16(ev->handle));
+        BT_DBG("%s handle %d", hdev->name, __le16_to_cpu(ev->handle));
 
         hci_dev_lock(hdev);
 
@@ -3077,10 +3390,17 @@ static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
 
         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
         cp.handle = cpu_to_le16(conn->handle);
-        conn->pin_length = ltk->pin_len;
+
+        if (ltk->authenticated)
+                conn->sec_level = BT_SECURITY_HIGH;
 
         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
 
+        if (ltk->type & HCI_SMP_STK) {
+                list_del(&ltk->list);
+                kfree(ltk);
+        }
+
         hci_dev_unlock(hdev);
 
         return;
@@ -3271,6 +3591,10 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_remote_oob_data_request_evt(hdev, skb);
                 break;
 
+        case HCI_EV_NUM_COMP_BLOCKS:
+                hci_num_comp_blocks_evt(hdev, skb);
+                break;
+
         default:
                 BT_DBG("%s event 0x%x", hdev->name, event);
                 break;
@@ -3279,34 +3603,3 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
         kfree_skb(skb);
         hdev->stat.evt_rx++;
 }
-
-/* Generate internal stack event */
-void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
-{
-        struct hci_event_hdr *hdr;
-        struct hci_ev_stack_internal *ev;
-        struct sk_buff *skb;
-
-        skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
-        if (!skb)
-                return;
-
-        hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
-        hdr->evt  = HCI_EV_STACK_INTERNAL;
-        hdr->plen = sizeof(*ev) + dlen;
-
-        ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
-        ev->type = type;
-        memcpy(ev->data, data, dlen);
-
-        bt_cb(skb)->incoming = 1;
-        __net_timestamp(skb);
-
-        bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
-        skb->dev = (void *) hdev;
-        hci_send_to_sock(hdev, skb, NULL);
-        kfree_skb(skb);
-}
-
-module_param(enable_le, bool, 0644);
-MODULE_PARM_DESC(enable_le, "Enable LE support");
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 0dcc96266779..5914623f426a 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -42,14 +42,14 @@
 #include <linux/ioctl.h>
 #include <net/sock.h>
 
-#include <asm/system.h>
 #include <linux/uaccess.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/hci_mon.h>
 
-static bool enable_mgmt;
+static atomic_t monitor_promisc = ATOMIC_INIT(0);
 
 /* ----- HCI socket interface ----- */
 
@@ -85,22 +85,20 @@ static struct bt_sock_list hci_sk_list = {
 };
 
 /* Send frame to RAW socket */
-void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb,
-                                                        struct sock *skip_sk)
+void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct sock *sk;
         struct hlist_node *node;
+        struct sk_buff *skb_copy = NULL;
 
         BT_DBG("hdev %p len %d", hdev, skb->len);
 
         read_lock(&hci_sk_list.lock);
+
         sk_for_each(sk, node, &hci_sk_list.head) {
                 struct hci_filter *flt;
                 struct sk_buff *nskb;
 
-                if (sk == skip_sk)
-                        continue;
-
                 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev)
                         continue;
 
@@ -108,12 +106,9 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb,
                 if (skb->sk == sk)
                         continue;
 
-                if (bt_cb(skb)->channel != hci_pi(sk)->channel)
+                if (hci_pi(sk)->channel != HCI_CHANNEL_RAW)
                         continue;
 
-                if (bt_cb(skb)->channel == HCI_CHANNEL_CONTROL)
-                        goto clone;
-
                 /* Apply filter */
                 flt = &hci_pi(sk)->filter;
 
@@ -137,21 +132,303 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb,
                                 continue;
                 }
 
-clone:
+                if (!skb_copy) {
+                        /* Create a private copy with headroom */
+                        skb_copy = __pskb_copy(skb, 1, GFP_ATOMIC);
+                        if (!skb_copy)
+                                continue;
+
+                        /* Put type byte before the data */
+                        memcpy(skb_push(skb_copy, 1), &bt_cb(skb)->pkt_type, 1);
+                }
+
+                nskb = skb_clone(skb_copy, GFP_ATOMIC);
+                if (!nskb)
+                        continue;
+
+                if (sock_queue_rcv_skb(sk, nskb))
+                        kfree_skb(nskb);
+        }
+
+        read_unlock(&hci_sk_list.lock);
+
+        kfree_skb(skb_copy);
+}
+
+/* Send frame to control socket */
+void hci_send_to_control(struct sk_buff *skb, struct sock *skip_sk)
+{
+        struct sock *sk;
+        struct hlist_node *node;
+
+        BT_DBG("len %d", skb->len);
+
+        read_lock(&hci_sk_list.lock);
+
+        sk_for_each(sk, node, &hci_sk_list.head) {
+                struct sk_buff *nskb;
+
+                /* Skip the original socket */
+                if (sk == skip_sk)
+                        continue;
+
+                if (sk->sk_state != BT_BOUND)
+                        continue;
+
+                if (hci_pi(sk)->channel != HCI_CHANNEL_CONTROL)
+                        continue;
+
                 nskb = skb_clone(skb, GFP_ATOMIC);
                 if (!nskb)
                         continue;
 
-                /* Put type byte before the data */
-                if (bt_cb(skb)->channel == HCI_CHANNEL_RAW)
-                        memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);
+                if (sock_queue_rcv_skb(sk, nskb))
+                        kfree_skb(nskb);
+        }
+
+        read_unlock(&hci_sk_list.lock);
+}
+
+/* Send frame to monitor socket */
+void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct sock *sk;
+        struct hlist_node *node;
+        struct sk_buff *skb_copy = NULL;
+        __le16 opcode;
+
+        if (!atomic_read(&monitor_promisc))
+                return;
+
+        BT_DBG("hdev %p len %d", hdev, skb->len);
+
+        switch (bt_cb(skb)->pkt_type) {
+        case HCI_COMMAND_PKT:
+                opcode = __constant_cpu_to_le16(HCI_MON_COMMAND_PKT);
+                break;
+        case HCI_EVENT_PKT:
+                opcode = __constant_cpu_to_le16(HCI_MON_EVENT_PKT);
+                break;
+        case HCI_ACLDATA_PKT:
+                if (bt_cb(skb)->incoming)
+                        opcode = __constant_cpu_to_le16(HCI_MON_ACL_RX_PKT);
+                else
+                        opcode = __constant_cpu_to_le16(HCI_MON_ACL_TX_PKT);
+                break;
+        case HCI_SCODATA_PKT:
+                if (bt_cb(skb)->incoming)
+                        opcode = __constant_cpu_to_le16(HCI_MON_SCO_RX_PKT);
+                else
+                        opcode = __constant_cpu_to_le16(HCI_MON_SCO_TX_PKT);
+                break;
+        default:
+                return;
+        }
+
+        read_lock(&hci_sk_list.lock);
+
+        sk_for_each(sk, node, &hci_sk_list.head) {
+                struct sk_buff *nskb;
+
+                if (sk->sk_state != BT_BOUND)
+                        continue;
+
+                if (hci_pi(sk)->channel != HCI_CHANNEL_MONITOR)
+                        continue;
+
+                if (!skb_copy) {
+                        struct hci_mon_hdr *hdr;
+
+                        /* Create a private copy with headroom */
+                        skb_copy = __pskb_copy(skb, HCI_MON_HDR_SIZE, GFP_ATOMIC);
+                        if (!skb_copy)
+                                continue;
+
+                        /* Put header before the data */
+                        hdr = (void *) skb_push(skb_copy, HCI_MON_HDR_SIZE);
+                        hdr->opcode = opcode;
+                        hdr->index = cpu_to_le16(hdev->id);
+                        hdr->len = cpu_to_le16(skb->len);
+                }
+
+                nskb = skb_clone(skb_copy, GFP_ATOMIC);
+                if (!nskb)
+                        continue;
+
+                if (sock_queue_rcv_skb(sk, nskb))
+                        kfree_skb(nskb);
+        }
+
+        read_unlock(&hci_sk_list.lock);
+
+        kfree_skb(skb_copy);
+}
+
+static void send_monitor_event(struct sk_buff *skb)
+{
+        struct sock *sk;
+        struct hlist_node *node;
+
+        BT_DBG("len %d", skb->len);
+
+        read_lock(&hci_sk_list.lock);
+
+        sk_for_each(sk, node, &hci_sk_list.head) {
+                struct sk_buff *nskb;
+
+                if (sk->sk_state != BT_BOUND)
+                        continue;
+
+                if (hci_pi(sk)->channel != HCI_CHANNEL_MONITOR)
+                        continue;
+
+                nskb = skb_clone(skb, GFP_ATOMIC);
+                if (!nskb)
+                        continue;
 
                 if (sock_queue_rcv_skb(sk, nskb))
                         kfree_skb(nskb);
         }
+
         read_unlock(&hci_sk_list.lock);
 }
 
+static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
+{
+        struct hci_mon_hdr *hdr;
+        struct hci_mon_new_index *ni;
+        struct sk_buff *skb;
+        __le16 opcode;
+
+        switch (event) {
+        case HCI_DEV_REG:
+                skb = bt_skb_alloc(HCI_MON_NEW_INDEX_SIZE, GFP_ATOMIC);
+                if (!skb)
+                        return NULL;
+
+                ni = (void *) skb_put(skb, HCI_MON_NEW_INDEX_SIZE);
+                ni->type = hdev->dev_type;
+                ni->bus = hdev->bus;
+                bacpy(&ni->bdaddr, &hdev->bdaddr);
+                memcpy(ni->name, hdev->name, 8);
+
+                opcode = __constant_cpu_to_le16(HCI_MON_NEW_INDEX);
+                break;
+
+        case HCI_DEV_UNREG:
+                skb = bt_skb_alloc(0, GFP_ATOMIC);
+                if (!skb)
+                        return NULL;
+
+                opcode = __constant_cpu_to_le16(HCI_MON_DEL_INDEX);
+                break;
+
+        default:
+                return NULL;
+        }
+
+        __net_timestamp(skb);
+
+        hdr = (void *) skb_push(skb, HCI_MON_HDR_SIZE);
+        hdr->opcode = opcode;
+        hdr->index = cpu_to_le16(hdev->id);
+        hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
+
+        return skb;
+}
+
+static void send_monitor_replay(struct sock *sk)
+{
+        struct hci_dev *hdev;
+
+        read_lock(&hci_dev_list_lock);
+
+        list_for_each_entry(hdev, &hci_dev_list, list) {
+                struct sk_buff *skb;
+
+                skb = create_monitor_event(hdev, HCI_DEV_REG);
+                if (!skb)
+                        continue;
+
+                if (sock_queue_rcv_skb(sk, skb))
+                        kfree_skb(skb);
+        }
+
+        read_unlock(&hci_dev_list_lock);
+}
+
+/* Generate internal stack event */
+static void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
+{
+        struct hci_event_hdr *hdr;
+        struct hci_ev_stack_internal *ev;
+        struct sk_buff *skb;
+
+        skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
+        if (!skb)
+                return;
+
+        hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
+        hdr->evt  = HCI_EV_STACK_INTERNAL;
+        hdr->plen = sizeof(*ev) + dlen;
+
+        ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
+        ev->type = type;
+        memcpy(ev->data, data, dlen);
+
+        bt_cb(skb)->incoming = 1;
+        __net_timestamp(skb);
+
+        bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
+        skb->dev = (void *) hdev;
+        hci_send_to_sock(hdev, skb);
+        kfree_skb(skb);
+}
+
+void hci_sock_dev_event(struct hci_dev *hdev, int event)
+{
+        struct hci_ev_si_device ev;
+
+        BT_DBG("hdev %s event %d", hdev->name, event);
+
+        /* Send event to monitor */
+        if (atomic_read(&monitor_promisc)) {
+                struct sk_buff *skb;
+
+                skb = create_monitor_event(hdev, event);
+                if (skb) {
+                        send_monitor_event(skb);
+                        kfree_skb(skb);
+                }
+        }
+
+        /* Send event to sockets */
+        ev.event  = event;
+        ev.dev_id = hdev->id;
+        hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);
+
+        if (event == HCI_DEV_UNREG) {
+                struct sock *sk;
+                struct hlist_node *node;
+
+                /* Detach sockets from device */
+                read_lock(&hci_sk_list.lock);
+                sk_for_each(sk, node, &hci_sk_list.head) {
+                        bh_lock_sock_nested(sk);
+                        if (hci_pi(sk)->hdev == hdev) {
+                                hci_pi(sk)->hdev = NULL;
+                                sk->sk_err = EPIPE;
+                                sk->sk_state = BT_OPEN;
+                                sk->sk_state_change(sk);
+
+                                hci_dev_put(hdev);
+                        }
+                        bh_unlock_sock(sk);
+                }
+                read_unlock(&hci_sk_list.lock);
+        }
+}
+
 static int hci_sock_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
@@ -164,6 +441,9 @@ static int hci_sock_release(struct socket *sock)
 
         hdev = hci_pi(sk)->hdev;
 
+        if (hci_pi(sk)->channel == HCI_CHANNEL_MONITOR)
+                atomic_dec(&monitor_promisc);
+
         bt_sock_unlink(&hci_sk_list, sk);
 
         if (hdev) {
@@ -190,7 +470,7 @@ static int hci_sock_blacklist_add(struct hci_dev *hdev, void __user *arg)
 
         hci_dev_lock(hdev);
 
-        err = hci_blacklist_add(hdev, &bdaddr);
+        err = hci_blacklist_add(hdev, &bdaddr, 0);
 
         hci_dev_unlock(hdev);
 
@@ -207,7 +487,7 @@ static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg)
 
         hci_dev_lock(hdev);
 
-        err = hci_blacklist_del(hdev, &bdaddr);
+        err = hci_blacklist_del(hdev, &bdaddr, 0);
 
         hci_dev_unlock(hdev);
 
@@ -340,34 +620,69 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_le
         if (haddr.hci_family != AF_BLUETOOTH)
                 return -EINVAL;
 
-        if (haddr.hci_channel > HCI_CHANNEL_CONTROL)
-                return -EINVAL;
-
-        if (haddr.hci_channel == HCI_CHANNEL_CONTROL) {
-                if (!enable_mgmt)
-                        return -EINVAL;
-                set_bit(HCI_PI_MGMT_INIT, &hci_pi(sk)->flags);
-        }
-
         lock_sock(sk);
 
-        if (sk->sk_state == BT_BOUND || hci_pi(sk)->hdev) {
+        if (sk->sk_state == BT_BOUND) {
                 err = -EALREADY;
                 goto done;
         }
 
-        if (haddr.hci_dev != HCI_DEV_NONE) {
-                hdev = hci_dev_get(haddr.hci_dev);
-                if (!hdev) {
-                        err = -ENODEV;
+        switch (haddr.hci_channel) {
+        case HCI_CHANNEL_RAW:
+                if (hci_pi(sk)->hdev) {
+                        err = -EALREADY;
                         goto done;
                 }
 
-                atomic_inc(&hdev->promisc);
+                if (haddr.hci_dev != HCI_DEV_NONE) {
+                        hdev = hci_dev_get(haddr.hci_dev);
+                        if (!hdev) {
+                                err = -ENODEV;
+                                goto done;
+                        }
+
+                        atomic_inc(&hdev->promisc);
+                }
+
+                hci_pi(sk)->hdev = hdev;
+                break;
+
+        case HCI_CHANNEL_CONTROL:
+                if (haddr.hci_dev != HCI_DEV_NONE) {
+                        err = -EINVAL;
+                        goto done;
+                }
+
+                if (!capable(CAP_NET_ADMIN)) {
+                        err = -EPERM;
+                        goto done;
+                }
+
+                break;
+
+        case HCI_CHANNEL_MONITOR:
+                if (haddr.hci_dev != HCI_DEV_NONE) {
+                        err = -EINVAL;
+                        goto done;
+                }
+
+                if (!capable(CAP_NET_RAW)) {
+                        err = -EPERM;
+                        goto done;
+                }
+
+                send_monitor_replay(sk);
+
+                atomic_inc(&monitor_promisc);
+                break;
+
+        default:
+                err = -EINVAL;
+                goto done;
         }
 
+
         hci_pi(sk)->channel = haddr.hci_channel;
-        hci_pi(sk)->hdev = hdev;
         sk->sk_state = BT_BOUND;
 
 done:
@@ -418,7 +733,8 @@ static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_
                 data = &tv;
                 len = sizeof(tv);
 #ifdef CONFIG_COMPAT
-                if (msg->msg_flags & MSG_CMSG_COMPAT) {
+                if (!COMPAT_USE_64BIT_TIME &&
+                    (msg->msg_flags & MSG_CMSG_COMPAT)) {
                         ctv.tv_sec = tv.tv_sec;
                         ctv.tv_usec = tv.tv_usec;
                         data = &ctv;
@@ -461,7 +777,15 @@ static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         skb_reset_transport_header(skb);
         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
 
-        hci_sock_cmsg(sk, msg, skb);
+        switch (hci_pi(sk)->channel) {
+        case HCI_CHANNEL_RAW:
+                hci_sock_cmsg(sk, msg, skb);
+                break;
+        case HCI_CHANNEL_CONTROL:
+        case HCI_CHANNEL_MONITOR:
+                sock_recv_timestamp(msg, sk, skb);
+                break;
+        }
 
         skb_free_datagram(sk, skb);
 
@@ -495,6 +819,9 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         case HCI_CHANNEL_CONTROL:
                 err = mgmt_control(sk, msg, len);
                 goto done;
+        case HCI_CHANNEL_MONITOR:
+                err = -EOPNOTSUPP;
+                goto done;
         default:
                 err = -EINVAL;
                 goto done;
@@ -574,6 +901,11 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname, char
 
         lock_sock(sk);
 
+        if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
+                err = -EINVAL;
+                goto done;
+        }
+
         switch (optname) {
         case HCI_DATA_DIR:
                 if (get_user(opt, (int __user *)optval)) {
@@ -636,6 +968,7 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname, char
                 break;
         }
 
+done:
         release_sock(sk);
         return err;
 }
@@ -644,11 +977,20 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char
 {
         struct hci_ufilter uf;
         struct sock *sk = sock->sk;
-        int len, opt;
+        int len, opt, err = 0;
+
+        BT_DBG("sk %p, opt %d", sk, optname);
 
         if (get_user(len, optlen))
                 return -EFAULT;
 
+        lock_sock(sk);
+
+        if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
+                err = -EINVAL;
+                goto done;
+        }
+
         switch (optname) {
         case HCI_DATA_DIR:
                 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
@@ -657,7 +999,7 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char
                         opt = 0;
 
                 if (put_user(opt, optval))
-                        return -EFAULT;
+                        err = -EFAULT;
                 break;
 
         case HCI_TIME_STAMP:
@@ -667,7 +1009,7 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char
                         opt = 0;
 
                 if (put_user(opt, optval))
-                        return -EFAULT;
+                        err = -EFAULT;
                 break;
 
         case HCI_FILTER:
@@ -682,15 +1024,17 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char
 
                 len = min_t(unsigned int, len, sizeof(uf));
                 if (copy_to_user(optval, &uf, len))
-                        return -EFAULT;
+                        err = -EFAULT;
                 break;
 
         default:
-                return -ENOPROTOOPT;
+                err = -ENOPROTOOPT;
                 break;
         }
 
-        return 0;
+done:
+        release_sock(sk);
+        return err;
 }
 
 static const struct proto_ops hci_sock_ops = {
@@ -748,52 +1092,12 @@ static int hci_sock_create(struct net *net, struct socket *sock, int protocol,
         return 0;
 }
 
-static int hci_sock_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
-{
-        struct hci_dev *hdev = (struct hci_dev *) ptr;
-        struct hci_ev_si_device ev;
-
-        BT_DBG("hdev %s event %ld", hdev->name, event);
-
-        /* Send event to sockets */
-        ev.event  = event;
-        ev.dev_id = hdev->id;
-        hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);
-
-        if (event == HCI_DEV_UNREG) {
-                struct sock *sk;
-                struct hlist_node *node;
-
-                /* Detach sockets from device */
-                read_lock(&hci_sk_list.lock);
-                sk_for_each(sk, node, &hci_sk_list.head) {
-                        bh_lock_sock_nested(sk);
-                        if (hci_pi(sk)->hdev == hdev) {
-                                hci_pi(sk)->hdev = NULL;
-                                sk->sk_err = EPIPE;
-                                sk->sk_state = BT_OPEN;
-                                sk->sk_state_change(sk);
-
-                                hci_dev_put(hdev);
-                        }
-                        bh_unlock_sock(sk);
-                }
-                read_unlock(&hci_sk_list.lock);
-        }
-
-        return NOTIFY_DONE;
-}
-
 static const struct net_proto_family hci_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = hci_sock_create,
 };
 
-static struct notifier_block hci_sock_nblock = {
-        .notifier_call = hci_sock_dev_event
-};
-
 int __init hci_sock_init(void)
 {
         int err;
@@ -806,8 +1110,6 @@ int __init hci_sock_init(void)
         if (err < 0)
                 goto error;
 
-        hci_register_notifier(&hci_sock_nblock);
-
         BT_INFO("HCI socket layer initialized");
 
         return 0;
@@ -823,10 +1125,5 @@ void hci_sock_cleanup(void)
         if (bt_sock_unregister(BTPROTO_HCI) < 0)
                 BT_ERR("HCI socket unregistration failed");
 
-        hci_unregister_notifier(&hci_sock_nblock);
-
         proto_unregister(&hci_sk_proto);
 }
-
-module_param(enable_mgmt, bool, 0644);
-MODULE_PARM_DESC(enable_mgmt, "Enable Management interface");
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 521095614235..937f3187eafa 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -33,19 +33,19 @@ static inline char *link_typetostr(int type)
 
 static ssize_t show_link_type(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct hci_conn *conn = dev_get_drvdata(dev);
+        struct hci_conn *conn = to_hci_conn(dev);
         return sprintf(buf, "%s\n", link_typetostr(conn->type));
 }
 
 static ssize_t show_link_address(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct hci_conn *conn = dev_get_drvdata(dev);
+        struct hci_conn *conn = to_hci_conn(dev);
         return sprintf(buf, "%s\n", batostr(&conn->dst));
 }
 
 static ssize_t show_link_features(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct hci_conn *conn = dev_get_drvdata(dev);
+        struct hci_conn *conn = to_hci_conn(dev);
 
         return sprintf(buf, "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
                                 conn->features[0], conn->features[1],
@@ -79,8 +79,8 @@ static const struct attribute_group *bt_link_groups[] = {
 
 static void bt_link_release(struct device *dev)
 {
-        void *data = dev_get_drvdata(dev);
-        kfree(data);
+        struct hci_conn *conn = to_hci_conn(dev);
+        kfree(conn);
 }
 
 static struct device_type bt_link = {
@@ -120,8 +120,6 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
 
         dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
 
-        dev_set_drvdata(&conn->dev, conn);
-
         if (device_add(&conn->dev) < 0) {
                 BT_ERR("Failed to register connection device");
                 return;
@@ -189,19 +187,19 @@ static inline char *host_typetostr(int type)
 
 static ssize_t show_bus(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
+        struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%s\n", host_bustostr(hdev->bus));
 }
 
 static ssize_t show_type(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
+        struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%s\n", host_typetostr(hdev->dev_type));
 }
 
 static ssize_t show_name(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
+        struct hci_dev *hdev = to_hci_dev(dev);
         char name[HCI_MAX_NAME_LENGTH + 1];
         int i;
 
@@ -214,20 +212,20 @@ static ssize_t show_name(struct device *dev, struct device_attribute *attr, char
 
 static ssize_t show_class(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
+        struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "0x%.2x%.2x%.2x\n",
                         hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 }
 
 static ssize_t show_address(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
+        struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%s\n", batostr(&hdev->bdaddr));
 }
 
 static ssize_t show_features(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
+        struct hci_dev *hdev = to_hci_dev(dev);
 
         return sprintf(buf, "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
                                 hdev->features[0], hdev->features[1],
@@ -238,31 +236,31 @@ static ssize_t show_features(struct device *dev, struct device_attribute *attr,
 
 static ssize_t show_manufacturer(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
+        struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%d\n", hdev->manufacturer);
 }
 
 static ssize_t show_hci_version(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
+        struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%d\n", hdev->hci_ver);
 }
 
 static ssize_t show_hci_revision(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
+        struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%d\n", hdev->hci_rev);
 }
 
 static ssize_t show_idle_timeout(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
+        struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%d\n", hdev->idle_timeout);
 }
 
 static ssize_t store_idle_timeout(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
+        struct hci_dev *hdev = to_hci_dev(dev);
         unsigned int val;
         int rv;
 
@@ -280,13 +278,13 @@ static ssize_t store_idle_timeout(struct device *dev, struct device_attribute *a
 
 static ssize_t show_sniff_max_interval(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
+        struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%d\n", hdev->sniff_max_interval);
 }
 
 static ssize_t store_sniff_max_interval(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
+        struct hci_dev *hdev = to_hci_dev(dev);
         u16 val;
         int rv;
 
@@ -304,13 +302,13 @@ static ssize_t store_sniff_max_interval(struct device *dev, struct device_attrib
 
 static ssize_t show_sniff_min_interval(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
+        struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%d\n", hdev->sniff_min_interval);
 }
 
 static ssize_t store_sniff_min_interval(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
+        struct hci_dev *hdev = to_hci_dev(dev);
         u16 val;
         int rv;
 
@@ -370,8 +368,9 @@ static const struct attribute_group *bt_host_groups[] = {
 
 static void bt_host_release(struct device *dev)
 {
-        void *data = dev_get_drvdata(dev);
-        kfree(data);
+        struct hci_dev *hdev = to_hci_dev(dev);
+        kfree(hdev);
+        module_put(THIS_MODULE);
 }
 
 static struct device_type bt_host = {
@@ -383,12 +382,12 @@ static struct device_type bt_host = {
 static int inquiry_cache_show(struct seq_file *f, void *p)
 {
         struct hci_dev *hdev = f->private;
-        struct inquiry_cache *cache = &hdev->inq_cache;
+        struct discovery_state *cache = &hdev->discovery;
         struct inquiry_entry *e;
 
         hci_dev_lock(hdev);
 
-        for (e = cache->list; e; e = e->next) {
+        list_for_each_entry(e, &cache->all, all) {
                 struct inquiry_data *data = &e->data;
                 seq_printf(f, "%s %d %d %d 0x%.2x%.2x%.2x 0x%.4x %d %d %u\n",
                            batostr(&data->bdaddr),
@@ -445,8 +444,8 @@ static const struct file_operations blacklist_fops = {
 
 static void print_bt_uuid(struct seq_file *f, u8 *uuid)
 {
-        u32 data0, data4;
-        u16 data1, data2, data3, data5;
+        __be32 data0, data4;
+        __be16 data1, data2, data3, data5;
 
         memcpy(&data0, &uuid[0], 4);
         memcpy(&data1, &uuid[4], 2);
@@ -523,7 +522,7 @@ void hci_init_sysfs(struct hci_dev *hdev)
         dev->type = &bt_host;
         dev->class = bt_class;
 
-        dev_set_drvdata(dev, hdev);
+        __module_get(THIS_MODULE);
         device_initialize(dev);
 }
 
@@ -534,7 +533,6 @@ int hci_add_sysfs(struct hci_dev *hdev)
 
         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
 
-        dev->parent = hdev->parent;
         dev_set_name(dev, "%s", hdev->name);
 
         err = device_add(dev);
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index d478be11d562..2c20d765b394 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -1195,41 +1195,16 @@ int hidp_get_conninfo(struct hidp_conninfo *ci)
         return err;
 }
 
-static const struct hid_device_id hidp_table[] = {
-        { HID_BLUETOOTH_DEVICE(HID_ANY_ID, HID_ANY_ID) },
-        { }
-};
-
-static struct hid_driver hidp_driver = {
-        .name = "generic-bluetooth",
-        .id_table = hidp_table,
-};
-
 static int __init hidp_init(void)
 {
-        int ret;
-
         BT_INFO("HIDP (Human Interface Emulation) ver %s", VERSION);
 
-        ret = hid_register_driver(&hidp_driver);
-        if (ret)
-                goto err;
-
-        ret = hidp_init_sockets();
-        if (ret)
-                goto err_drv;
-
-        return 0;
-err_drv:
-        hid_unregister_driver(&hidp_driver);
-err:
-        return ret;
+        return hidp_init_sockets();
 }
 
 static void __exit hidp_exit(void)
 {
         hidp_cleanup_sockets();
-        hid_unregister_driver(&hidp_driver);
 }
 
 module_init(hidp_init);
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 178ac7f127ad..73a32d705c1f 100644
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -160,10 +160,10 @@ static int hidp_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigne
 {
         if (cmd == HIDPGETCONNLIST) {
                 struct hidp_connlist_req cl;
-                uint32_t uci;
+                u32 uci;
                 int err;
 
-                if (get_user(cl.cnum, (uint32_t __user *) arg) ||
+                if (get_user(cl.cnum, (u32 __user *) arg) ||
                                 get_user(uci, (u32 __user *) (arg + 4)))
                         return -EFAULT;
 
@@ -174,7 +174,7 @@ static int hidp_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigne
 
                 err = hidp_get_connlist(&cl);
 
-                if (!err && put_user(cl.cnum, (uint32_t __user *) arg))
+                if (!err && put_user(cl.cnum, (u32 __user *) arg))
                         err = -EFAULT;
 
                 return err;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 32d338c30e65..24f144b72a96 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4,6 +4,7 @@
    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
    Copyright (C) 2010 Google Inc.
    Copyright (C) 2011 ProFUSION Embedded Systems
+   Copyright (c) 2012 Code Aurora Forum.  All rights reserved.
 
    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
 
@@ -49,7 +50,6 @@
 #include <linux/crc16.h>
 #include <net/sock.h>
 
-#include <asm/system.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -71,83 +71,56 @@ static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
                                                                 void *data);
 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
 static void l2cap_send_disconn_req(struct l2cap_conn *conn,
-                                struct l2cap_chan *chan, int err);
-
-static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb);
+                                   struct l2cap_chan *chan, int err);
 
 /* ---- L2CAP channels ---- */
 
 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid)
 {
-        struct l2cap_chan *c, *r = NULL;
-
-        rcu_read_lock();
+        struct l2cap_chan *c;
 
-        list_for_each_entry_rcu(c, &conn->chan_l, list) {
-                if (c->dcid == cid) {
-                        r = c;
-                        break;
-                }
+        list_for_each_entry(c, &conn->chan_l, list) {
+                if (c->dcid == cid)
+                        return c;
         }
-
-        rcu_read_unlock();
-        return r;
+        return NULL;
 }
 
 static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
 {
-        struct l2cap_chan *c, *r = NULL;
-
-        rcu_read_lock();
+        struct l2cap_chan *c;
 
-        list_for_each_entry_rcu(c, &conn->chan_l, list) {
-                if (c->scid == cid) {
-                        r = c;
-                        break;
-                }
+        list_for_each_entry(c, &conn->chan_l, list) {
+                if (c->scid == cid)
+                        return c;
         }
-
-        rcu_read_unlock();
-        return r;
+        return NULL;
 }
 
 /* Find channel with given SCID.
- * Returns locked socket */
+ * Returns locked channel. */
 static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
 {
         struct l2cap_chan *c;
 
+        mutex_lock(&conn->chan_lock);
         c = __l2cap_get_chan_by_scid(conn, cid);
         if (c)
-                lock_sock(c->sk);
+                l2cap_chan_lock(c);
+        mutex_unlock(&conn->chan_lock);
+
         return c;
 }
 
 static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
 {
-        struct l2cap_chan *c, *r = NULL;
-
-        rcu_read_lock();
-
-        list_for_each_entry_rcu(c, &conn->chan_l, list) {
-                if (c->ident == ident) {
-                        r = c;
-                        break;
-                }
-        }
-
-        rcu_read_unlock();
-        return r;
-}
-
-static inline struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
-{
         struct l2cap_chan *c;
 
-        c = __l2cap_get_chan_by_ident(conn, ident);
-        if (c)
-                lock_sock(c->sk);
-        return c;
+        list_for_each_entry(c, &conn->chan_l, list) {
+                if (c->ident == ident)
+                        return c;
+        }
+        return NULL;
 }
 
 static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
@@ -217,51 +190,169 @@ static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
         return 0;
 }
 
-static char *state_to_string(int state)
+static void __l2cap_state_change(struct l2cap_chan *chan, int state)
 {
-        switch(state) {
-        case BT_CONNECTED:
-                return "BT_CONNECTED";
-        case BT_OPEN:
-                return "BT_OPEN";
-        case BT_BOUND:
-                return "BT_BOUND";
-        case BT_LISTEN:
-                return "BT_LISTEN";
-        case BT_CONNECT:
-                return "BT_CONNECT";
-        case BT_CONNECT2:
-                return "BT_CONNECT2";
-        case BT_CONFIG:
-                return "BT_CONFIG";
-        case BT_DISCONN:
-                return "BT_DISCONN";
-        case BT_CLOSED:
-                return "BT_CLOSED";
-        }
+        BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
+                                                state_to_string(state));
 
-        return "invalid state";
+        chan->state = state;
+        chan->ops->state_change(chan->data, state);
 }
 
 static void l2cap_state_change(struct l2cap_chan *chan, int state)
 {
-        BT_DBG("%p %s -> %s", chan, state_to_string(chan->state),
-                                                state_to_string(state));
+        struct sock *sk = chan->sk;
 
-        chan->state = state;
-        chan->ops->state_change(chan->data, state);
+        lock_sock(sk);
+        __l2cap_state_change(chan, state);
+        release_sock(sk);
+}
+
+static inline void __l2cap_chan_set_err(struct l2cap_chan *chan, int err)
+{
+        struct sock *sk = chan->sk;
+
+        sk->sk_err = err;
+}
+
+static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
+{
+        struct sock *sk = chan->sk;
+
+        lock_sock(sk);
+        __l2cap_chan_set_err(chan, err);
+        release_sock(sk);
+}
+
+/* ---- L2CAP sequence number lists ---- */
+
+/* For ERTM, ordered lists of sequence numbers must be tracked for
+ * SREJ requests that are received and for frames that are to be
+ * retransmitted. These seq_list functions implement a singly-linked
+ * list in an array, where membership in the list can also be checked
+ * in constant time. Items can also be added to the tail of the list
+ * and removed from the head in constant time, without further memory
+ * allocs or frees.
+ */
+
+static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
+{
+        size_t alloc_size, i;
+
+        /* Allocated size is a power of 2 to map sequence numbers
+         * (which may be up to 14 bits) in to a smaller array that is
+         * sized for the negotiated ERTM transmit windows.
+         */
+        alloc_size = roundup_pow_of_two(size);
+
+        seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
+        if (!seq_list->list)
+                return -ENOMEM;
+
+        seq_list->mask = alloc_size - 1;
+        seq_list->head = L2CAP_SEQ_LIST_CLEAR;
+        seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
+        for (i = 0; i < alloc_size; i++)
+                seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
+
+        return 0;
+}
+
+static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
+{
+        kfree(seq_list->list);
+}
+
+static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
+                                           u16 seq)
+{
+        /* Constant-time check for list membership */
+        return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
+}
+
+static u16 l2cap_seq_list_remove(struct l2cap_seq_list *seq_list, u16 seq)
+{
+        u16 mask = seq_list->mask;
+
+        if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) {
+                /* In case someone tries to pop the head of an empty list */
+                return L2CAP_SEQ_LIST_CLEAR;
+        } else if (seq_list->head == seq) {
+                /* Head can be removed in constant time */
+                seq_list->head = seq_list->list[seq & mask];
+                seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
+
+                if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
+                        seq_list->head = L2CAP_SEQ_LIST_CLEAR;
+                        seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
+                }
+        } else {
+                /* Walk the list to find the sequence number */
+                u16 prev = seq_list->head;
+                while (seq_list->list[prev & mask] != seq) {
+                        prev = seq_list->list[prev & mask];
+                        if (prev == L2CAP_SEQ_LIST_TAIL)
+                                return L2CAP_SEQ_LIST_CLEAR;
+                }
+
+                /* Unlink the number from the list and clear it */
+                seq_list->list[prev & mask] = seq_list->list[seq & mask];
+                seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
+                if (seq_list->tail == seq)
+                        seq_list->tail = prev;
+        }
+        return seq;
+}
+
+static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
+{
+        /* Remove the head in constant time */
+        return l2cap_seq_list_remove(seq_list, seq_list->head);
+}
+
+static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
+{
+        u16 i;
+
+        if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
+                return;
+
+        for (i = 0; i <= seq_list->mask; i++)
+                seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
+
+        seq_list->head = L2CAP_SEQ_LIST_CLEAR;
+        seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
+}
+
+static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
+{
+        u16 mask = seq_list->mask;
+
+        /* All appends happen in constant time */
+
+        if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
+                return;
+
+        if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
+                seq_list->head = seq;
+        else
+                seq_list->list[seq_list->tail & mask] = seq;
+
+        seq_list->tail = seq;
+        seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
 }
 
 static void l2cap_chan_timeout(struct work_struct *work)
 {
         struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
                                                         chan_timer.work);
-        struct sock *sk = chan->sk;
+        struct l2cap_conn *conn = chan->conn;
         int reason;
 
-        BT_DBG("chan %p state %d", chan, chan->state);
+        BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
 
-        lock_sock(sk);
+        mutex_lock(&conn->chan_lock);
+        l2cap_chan_lock(chan);
 
         if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
                 reason = ECONNREFUSED;
@@ -273,13 +364,15 @@ static void l2cap_chan_timeout(struct work_struct *work)
 
         l2cap_chan_close(chan, reason);
 
-        release_sock(sk);
+        l2cap_chan_unlock(chan);
 
         chan->ops->close(chan->data);
+        mutex_unlock(&conn->chan_lock);
+
         l2cap_chan_put(chan);
 }
 
-struct l2cap_chan *l2cap_chan_create(struct sock *sk)
+struct l2cap_chan *l2cap_chan_create(void)
 {
         struct l2cap_chan *chan;
 
@@ -287,7 +380,7 @@ struct l2cap_chan *l2cap_chan_create(struct sock *sk)
         if (!chan)
                 return NULL;
 
-        chan->sk = sk;
+        mutex_init(&chan->lock);
 
         write_lock(&chan_list_lock);
         list_add(&chan->global_l, &chan_list);
@@ -299,7 +392,7 @@ struct l2cap_chan *l2cap_chan_create(struct sock *sk)
 
         atomic_set(&chan->refcnt, 1);
 
-        BT_DBG("sk %p chan %p", sk, chan);
+        BT_DBG("chan %p", chan);
 
         return chan;
 }
@@ -313,16 +406,28 @@ void l2cap_chan_destroy(struct l2cap_chan *chan)
         l2cap_chan_put(chan);
 }
 
-static void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
+void l2cap_chan_set_defaults(struct l2cap_chan *chan)
+{
+        chan->fcs  = L2CAP_FCS_CRC16;
+        chan->max_tx = L2CAP_DEFAULT_MAX_TX;
+        chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
+        chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
+        chan->sec_level = BT_SECURITY_LOW;
+
+        set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
+}
+
+static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 {
         BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
-                        chan->psm, chan->dcid);
+               __le16_to_cpu(chan->psm), chan->dcid);
 
         conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
 
         chan->conn = conn;
 
-        if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
+        switch (chan->chan_type) {
+        case L2CAP_CHAN_CONN_ORIENTED:
                 if (conn->hcon->type == LE_LINK) {
                         /* LE connection */
                         chan->omtu = L2CAP_LE_DEFAULT_MTU;
@@ -333,12 +438,16 @@ static void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
                         chan->scid = l2cap_alloc_cid(conn);
                         chan->omtu = L2CAP_DEFAULT_MTU;
                 }
-        } else if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
+                break;
+
+        case L2CAP_CHAN_CONN_LESS:
                 /* Connectionless socket */
                 chan->scid = L2CAP_CID_CONN_LESS;
                 chan->dcid = L2CAP_CID_CONN_LESS;
                 chan->omtu = L2CAP_DEFAULT_MTU;
-        } else {
+                break;
+
+        default:
                 /* Raw socket can send/recv signalling messages only */
                 chan->scid = L2CAP_CID_SIGNALING;
                 chan->dcid = L2CAP_CID_SIGNALING;
@@ -354,11 +463,16 @@ static void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 
         l2cap_chan_hold(chan);
 
-        list_add_rcu(&chan->list, &conn->chan_l);
+        list_add(&chan->list, &conn->chan_l);
+}
+
+static void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
+{
+        mutex_lock(&conn->chan_lock);
+        __l2cap_chan_add(conn, chan);
+        mutex_unlock(&conn->chan_lock);
 }
 
-/* Delete channel.
- * Must be called on the locked socket. */
 static void l2cap_chan_del(struct l2cap_chan *chan, int err)
 {
         struct sock *sk = chan->sk;
@@ -371,8 +485,7 @@ static void l2cap_chan_del(struct l2cap_chan *chan, int err)
 
         if (conn) {
                 /* Delete from channel list */
-                list_del_rcu(&chan->list);
-                synchronize_rcu();
+                list_del(&chan->list);
 
                 l2cap_chan_put(chan);
 
@@ -380,11 +493,13 @@ static void l2cap_chan_del(struct l2cap_chan *chan, int err)
                 hci_conn_put(conn->hcon);
         }
 
-        l2cap_state_change(chan, BT_CLOSED);
+        lock_sock(sk);
+
+        __l2cap_state_change(chan, BT_CLOSED);
         sock_set_flag(sk, SOCK_ZAPPED);
 
         if (err)
-                sk->sk_err = err;
+                __l2cap_chan_set_err(chan, err);
 
         if (parent) {
                 bt_accept_unlink(sk);
@@ -392,6 +507,8 @@ static void l2cap_chan_del(struct l2cap_chan *chan, int err)
         } else
                 sk->sk_state_change(sk);
 
+        release_sock(sk);
+
         if (!(test_bit(CONF_OUTPUT_DONE, &chan->conf_state) &&
                         test_bit(CONF_INPUT_DONE, &chan->conf_state)))
                 return;
@@ -407,6 +524,8 @@ static void l2cap_chan_del(struct l2cap_chan *chan, int err)
 
                 skb_queue_purge(&chan->srej_q);
 
+                l2cap_seq_list_free(&chan->srej_list);
+                l2cap_seq_list_free(&chan->retrans_list);
                 list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
                         list_del(&l->list);
                         kfree(l);
@@ -423,10 +542,12 @@ static void l2cap_chan_cleanup_listen(struct sock *parent)
         /* Close not yet accepted channels */
         while ((sk = bt_accept_dequeue(parent, NULL))) {
                 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+
+                l2cap_chan_lock(chan);
                 __clear_chan_timer(chan);
-                lock_sock(sk);
                 l2cap_chan_close(chan, ECONNRESET);
-                release_sock(sk);
+                l2cap_chan_unlock(chan);
+
                 chan->ops->close(chan->data);
         }
 }
@@ -436,21 +557,23 @@ void l2cap_chan_close(struct l2cap_chan *chan, int reason)
         struct l2cap_conn *conn = chan->conn;
         struct sock *sk = chan->sk;
 
-        BT_DBG("chan %p state %d socket %p", chan, chan->state, sk->sk_socket);
+        BT_DBG("chan %p state %s sk %p", chan,
+                                        state_to_string(chan->state), sk);
 
         switch (chan->state) {
         case BT_LISTEN:
+                lock_sock(sk);
                 l2cap_chan_cleanup_listen(sk);
 
-                l2cap_state_change(chan, BT_CLOSED);
+                __l2cap_state_change(chan, BT_CLOSED);
                 sock_set_flag(sk, SOCK_ZAPPED);
+                release_sock(sk);
                 break;
 
         case BT_CONNECTED:
         case BT_CONFIG:
                 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
                                         conn->hcon->type == ACL_LINK) {
-                        __clear_chan_timer(chan);
                         __set_chan_timer(chan, sk->sk_sndtimeo);
                         l2cap_send_disconn_req(conn, chan, reason);
                 } else
@@ -463,7 +586,7 @@ void l2cap_chan_close(struct l2cap_chan *chan, int reason)
                         struct l2cap_conn_rsp rsp;
                         __u16 result;
 
-                        if (bt_sk(sk)->defer_setup)
+                        if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
                                 result = L2CAP_CR_SEC_BLOCK;
                         else
                                 result = L2CAP_CR_BAD_PSM;
@@ -486,7 +609,9 @@ void l2cap_chan_close(struct l2cap_chan *chan, int reason)
                 break;
 
         default:
+                lock_sock(sk);
                 sock_set_flag(sk, SOCK_ZAPPED);
+                release_sock(sk);
                 break;
         }
 }
@@ -594,6 +719,117 @@ static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
         hci_send_acl(chan->conn->hchan, skb, flags);
 }
 
+static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
+{
+        control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
+        control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
+
+        if (enh & L2CAP_CTRL_FRAME_TYPE) {
+                /* S-Frame */
+                control->sframe = 1;
+                control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
+                control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
+
+                control->sar = 0;
+                control->txseq = 0;
+        } else {
+                /* I-Frame */
+                control->sframe = 0;
+                control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
+                control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
+
+                control->poll = 0;
+                control->super = 0;
+        }
+}
+
+static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
+{
+        control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
+        control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
+
+        if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
+                /* S-Frame */
+                control->sframe = 1;
+                control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
+                control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
+
+                control->sar = 0;
+                control->txseq = 0;
+        } else {
+                /* I-Frame */
+                control->sframe = 0;
+                control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
+                control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
+
+                control->poll = 0;
+                control->super = 0;
+        }
+}
+
+static inline void __unpack_control(struct l2cap_chan *chan,
+                                    struct sk_buff *skb)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
+                __unpack_extended_control(get_unaligned_le32(skb->data),
+                                          &bt_cb(skb)->control);
+        } else {
+                __unpack_enhanced_control(get_unaligned_le16(skb->data),
+                                          &bt_cb(skb)->control);
+        }
+}
+
+static u32 __pack_extended_control(struct l2cap_ctrl *control)
+{
+        u32 packed;
+
+        packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
+        packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
+
+        if (control->sframe) {
+                packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
+                packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
+                packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
+        } else {
+                packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
+                packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
+        }
+
+        return packed;
+}
+
+static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
+{
+        u16 packed;
+
+        packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
+        packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
+
+        if (control->sframe) {
+                packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
+                packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
+                packed |= L2CAP_CTRL_FRAME_TYPE;
+        } else {
+                packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
+                packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
+        }
+
+        return packed;
+}
+
+static inline void __pack_control(struct l2cap_chan *chan,
+                                  struct l2cap_ctrl *control,
+                                  struct sk_buff *skb)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
+                put_unaligned_le32(__pack_extended_control(control),
+                                   skb->data + L2CAP_HDR_SIZE);
+        } else {
+                put_unaligned_le16(__pack_enhanced_control(control),
+                                   skb->data + L2CAP_HDR_SIZE);
+        }
+}
+
 static inline void l2cap_send_sframe(struct l2cap_chan *chan, u32 control)
 {
         struct sk_buff *skb;
@@ -661,26 +897,60 @@ static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
         return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
 }
 
+static void l2cap_send_conn_req(struct l2cap_chan *chan)
+{
+        struct l2cap_conn *conn = chan->conn;
+        struct l2cap_conn_req req;
+
+        req.scid = cpu_to_le16(chan->scid);
+        req.psm  = chan->psm;
+
+        chan->ident = l2cap_get_ident(conn);
+
+        set_bit(CONF_CONNECT_PEND, &chan->conf_state);
+
+        l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
+}
+
+static void l2cap_chan_ready(struct l2cap_chan *chan)
+{
+        struct sock *sk = chan->sk;
+        struct sock *parent;
+
+        lock_sock(sk);
+
+        parent = bt_sk(sk)->parent;
+
+        BT_DBG("sk %p, parent %p", sk, parent);
+
+        chan->conf_state = 0;
+        __clear_chan_timer(chan);
+
+        __l2cap_state_change(chan, BT_CONNECTED);
+        sk->sk_state_change(sk);
+
+        if (parent)
+                parent->sk_data_ready(parent, 0);
+
+        release_sock(sk);
+}
+
 static void l2cap_do_start(struct l2cap_chan *chan)
 {
         struct l2cap_conn *conn = chan->conn;
 
+        if (conn->hcon->type == LE_LINK) {
+                l2cap_chan_ready(chan);
+                return;
+        }
+
         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
                 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
                         return;
 
                 if (l2cap_chan_check_security(chan) &&
-                                __l2cap_no_conn_pending(chan)) {
-                        struct l2cap_conn_req req;
-                        req.scid = cpu_to_le16(chan->scid);
-                        req.psm  = chan->psm;
-
-                        chan->ident = l2cap_get_ident(conn);
-                        set_bit(CONF_CONNECT_PEND, &chan->conf_state);
-
-                        l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ,
-                                                        sizeof(req), &req);
-                }
+                                __l2cap_no_conn_pending(chan))
+                        l2cap_send_conn_req(chan);
         } else {
                 struct l2cap_info_req req;
                 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
@@ -688,8 +958,7 @@ static void l2cap_do_start(struct l2cap_chan *chan)
                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
                 conn->info_ident = l2cap_get_ident(conn);
 
-                schedule_delayed_work(&conn->info_timer,
-                                        msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
+                schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
 
                 l2cap_send_cmd(conn, conn->info_ident,
                                         L2CAP_INFO_REQ, sizeof(req), &req);
@@ -714,14 +983,12 @@ static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
 
 static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err)
 {
-        struct sock *sk;
+        struct sock *sk = chan->sk;
         struct l2cap_disconn_req req;
 
         if (!conn)
                 return;
 
-        sk = chan->sk;
-
         if (chan->mode == L2CAP_MODE_ERTM) {
                 __clear_retrans_timer(chan);
                 __clear_monitor_timer(chan);
@@ -733,56 +1000,47 @@ static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *c
         l2cap_send_cmd(conn, l2cap_get_ident(conn),
                         L2CAP_DISCONN_REQ, sizeof(req), &req);
 
-        l2cap_state_change(chan, BT_DISCONN);
-        sk->sk_err = err;
+        lock_sock(sk);
+        __l2cap_state_change(chan, BT_DISCONN);
+        __l2cap_chan_set_err(chan, err);
+        release_sock(sk);
 }
 
 /* ---- L2CAP connections ---- */
 static void l2cap_conn_start(struct l2cap_conn *conn)
 {
-        struct l2cap_chan *chan;
+        struct l2cap_chan *chan, *tmp;
 
         BT_DBG("conn %p", conn);
 
-        rcu_read_lock();
+        mutex_lock(&conn->chan_lock);
 
-        list_for_each_entry_rcu(chan, &conn->chan_l, list) {
+        list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
                 struct sock *sk = chan->sk;
 
-                bh_lock_sock(sk);
+                l2cap_chan_lock(chan);
 
                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
-                        bh_unlock_sock(sk);
+                        l2cap_chan_unlock(chan);
                         continue;
                 }
 
                 if (chan->state == BT_CONNECT) {
-                        struct l2cap_conn_req req;
-
                         if (!l2cap_chan_check_security(chan) ||
                                         !__l2cap_no_conn_pending(chan)) {
-                                bh_unlock_sock(sk);
+                                l2cap_chan_unlock(chan);
                                 continue;
                         }
 
                         if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
                                         && test_bit(CONF_STATE2_DEVICE,
                                         &chan->conf_state)) {
-                                /* l2cap_chan_close() calls list_del(chan)
-                                 * so release the lock */
                                 l2cap_chan_close(chan, ECONNRESET);
-                                bh_unlock_sock(sk);
+                                l2cap_chan_unlock(chan);
                                 continue;
                         }
 
-                        req.scid = cpu_to_le16(chan->scid);
-                        req.psm  = chan->psm;
-
-                        chan->ident = l2cap_get_ident(conn);
-                        set_bit(CONF_CONNECT_PEND, &chan->conf_state);
-
-                        l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ,
-                                                        sizeof(req), &req);
+                        l2cap_send_conn_req(chan);
 
                 } else if (chan->state == BT_CONNECT2) {
                         struct l2cap_conn_rsp rsp;
@@ -791,7 +1049,9 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
                         rsp.dcid = cpu_to_le16(chan->scid);
 
                         if (l2cap_chan_check_security(chan)) {
-                                if (bt_sk(sk)->defer_setup) {
+                                lock_sock(sk);
+                                if (test_bit(BT_SK_DEFER_SETUP,
+                                             &bt_sk(sk)->flags)) {
                                         struct sock *parent = bt_sk(sk)->parent;
                                         rsp.result = cpu_to_le16(L2CAP_CR_PEND);
                                         rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
@@ -799,10 +1059,11 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
                                                 parent->sk_data_ready(parent, 0);
 
                                 } else {
-                                        l2cap_state_change(chan, BT_CONFIG);
+                                        __l2cap_state_change(chan, BT_CONFIG);
                                         rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
                                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
                                 }
+                                release_sock(sk);
                         } else {
                                 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
                                 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
@@ -813,7 +1074,7 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
 
                         if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
                                         rsp.result != L2CAP_CR_SUCCESS) {
-                                bh_unlock_sock(sk);
+                                l2cap_chan_unlock(chan);
                                 continue;
                         }
 
@@ -823,16 +1084,18 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
                         chan->num_conf_req++;
                 }
 
-                bh_unlock_sock(sk);
+                l2cap_chan_unlock(chan);
         }
 
-        rcu_read_unlock();
+        mutex_unlock(&conn->chan_lock);
 }
 
-/* Find socket with cid and source bdaddr.
+/* Find socket with cid and source/destination bdaddr.
  * Returns closest match, locked.
  */
-static struct l2cap_chan *l2cap_global_chan_by_scid(int state, __le16 cid, bdaddr_t *src)
+static struct l2cap_chan *l2cap_global_chan_by_scid(int state, u16 cid,
+                                                    bdaddr_t *src,
+                                                    bdaddr_t *dst)
 {
         struct l2cap_chan *c, *c1 = NULL;
 
@@ -845,14 +1108,22 @@ static struct l2cap_chan *l2cap_global_chan_by_scid(int state, __le16 cid, bdadd
                         continue;
 
                 if (c->scid == cid) {
+                        int src_match, dst_match;
+                        int src_any, dst_any;
+
                         /* Exact match. */
-                        if (!bacmp(&bt_sk(sk)->src, src)) {
+                        src_match = !bacmp(&bt_sk(sk)->src, src);
+                        dst_match = !bacmp(&bt_sk(sk)->dst, dst);
+                        if (src_match && dst_match) {
                                 read_unlock(&chan_list_lock);
                                 return c;
                         }
 
                         /* Closest match */
-                        if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
+                        src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
+                        dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
+                        if ((src_match && dst_any) || (src_any && dst_match) ||
+                            (src_any && dst_any))
                                 c1 = c;
                 }
         }
@@ -871,7 +1142,7 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)
 
         /* Check if we have socket listening on cid */
         pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
-                                                        conn->src);
+                                          conn->src, conn->dst);
         if (!pchan)
                 return;
 
@@ -902,30 +1173,13 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)
 
         __set_chan_timer(chan, sk->sk_sndtimeo);
 
-        l2cap_state_change(chan, BT_CONNECTED);
+        __l2cap_state_change(chan, BT_CONNECTED);
         parent->sk_data_ready(parent, 0);
 
 clean:
         release_sock(parent);
 }
 
-static void l2cap_chan_ready(struct sock *sk)
-{
-        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
-        struct sock *parent = bt_sk(sk)->parent;
-
-        BT_DBG("sk %p, parent %p", sk, parent);
-
-        chan->conf_state = 0;
-        __clear_chan_timer(chan);
-
-        l2cap_state_change(chan, BT_CONNECTED);
-        sk->sk_state_change(sk);
-
-        if (parent)
-                parent->sk_data_ready(parent, 0);
-}
-
 static void l2cap_conn_ready(struct l2cap_conn *conn)
 {
         struct l2cap_chan *chan;
@@ -938,29 +1192,31 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
         if (conn->hcon->out && conn->hcon->type == LE_LINK)
                 smp_conn_security(conn, conn->hcon->pending_sec_level);
 
-        rcu_read_lock();
+        mutex_lock(&conn->chan_lock);
 
-        list_for_each_entry_rcu(chan, &conn->chan_l, list) {
-                struct sock *sk = chan->sk;
+        list_for_each_entry(chan, &conn->chan_l, list) {
 
-                bh_lock_sock(sk);
+                l2cap_chan_lock(chan);
 
                 if (conn->hcon->type == LE_LINK) {
                         if (smp_conn_security(conn, chan->sec_level))
-                                l2cap_chan_ready(sk);
+                                l2cap_chan_ready(chan);
 
                 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
+                        struct sock *sk = chan->sk;
                         __clear_chan_timer(chan);
-                        l2cap_state_change(chan, BT_CONNECTED);
+                        lock_sock(sk);
+                        __l2cap_state_change(chan, BT_CONNECTED);
                         sk->sk_state_change(sk);
+                        release_sock(sk);
 
                 } else if (chan->state == BT_CONNECT)
                         l2cap_do_start(chan);
 
-                bh_unlock_sock(sk);
+                l2cap_chan_unlock(chan);
         }
 
-        rcu_read_unlock();
+        mutex_unlock(&conn->chan_lock);
 }
 
 /* Notify sockets that we cannot guaranty reliability anymore */
@@ -970,16 +1226,14 @@ static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
 
         BT_DBG("conn %p", conn);
 
-        rcu_read_lock();
-
-        list_for_each_entry_rcu(chan, &conn->chan_l, list) {
-                struct sock *sk = chan->sk;
+        mutex_lock(&conn->chan_lock);
 
+        list_for_each_entry(chan, &conn->chan_l, list) {
                 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
-                        sk->sk_err = err;
+                        __l2cap_chan_set_err(chan, err);
         }
 
-        rcu_read_unlock();
+        mutex_unlock(&conn->chan_lock);
 }
 
 static void l2cap_info_timeout(struct work_struct *work)
@@ -997,7 +1251,6 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 {
         struct l2cap_conn *conn = hcon->l2cap_data;
         struct l2cap_chan *chan, *l;
-        struct sock *sk;
 
         if (!conn)
                 return;
@@ -1006,21 +1259,29 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 
         kfree_skb(conn->rx_skb);
 
+        mutex_lock(&conn->chan_lock);
+
         /* Kill channels */
         list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
-                sk = chan->sk;
-                lock_sock(sk);
+                l2cap_chan_hold(chan);
+                l2cap_chan_lock(chan);
+
                 l2cap_chan_del(chan, err);
-                release_sock(sk);
+
+                l2cap_chan_unlock(chan);
+
                 chan->ops->close(chan->data);
+                l2cap_chan_put(chan);
         }
 
+        mutex_unlock(&conn->chan_lock);
+
         hci_chan_del(conn->hchan);
 
         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
                 cancel_delayed_work_sync(&conn->info_timer);
 
-        if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend)) {
+        if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
                 cancel_delayed_work_sync(&conn->security_timer);
                 smp_chan_destroy(conn);
         }
@@ -1072,6 +1333,7 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
         conn->feat_mask = 0;
 
         spin_lock_init(&conn->lock);
+        mutex_init(&conn->chan_lock);
 
         INIT_LIST_HEAD(&conn->chan_l);
 
@@ -1087,10 +1349,12 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
 
 /* ---- Socket interface ---- */
 
-/* Find socket with psm and source bdaddr.
+/* Find socket with psm and source / destination bdaddr.
  * Returns closest match.
  */
-static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, bdaddr_t *src)
+static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
+                                                   bdaddr_t *src,
+                                                   bdaddr_t *dst)
 {
         struct l2cap_chan *c, *c1 = NULL;
 
@@ -1103,14 +1367,22 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, bdaddr
                         continue;
 
                 if (c->psm == psm) {
+                        int src_match, dst_match;
+                        int src_any, dst_any;
+
                         /* Exact match. */
-                        if (!bacmp(&bt_sk(sk)->src, src)) {
+                        src_match = !bacmp(&bt_sk(sk)->src, src);
+                        dst_match = !bacmp(&bt_sk(sk)->dst, dst);
+                        if (src_match && dst_match) {
                                 read_unlock(&chan_list_lock);
                                 return c;
                         }
 
                         /* Closest match */
-                        if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
+                        src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
+                        dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
+                        if ((src_match && dst_any) || (src_any && dst_match) ||
+                            (src_any && dst_any))
                                 c1 = c;
                 }
         }
@@ -1120,7 +1392,8 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, bdaddr
         return c1;
 }
 
-int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, bdaddr_t *dst)
+int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
+                       bdaddr_t *dst, u8 dst_type)
 {
         struct sock *sk = chan->sk;
         bdaddr_t *src = &bt_sk(sk)->src;
@@ -1130,8 +1403,8 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, bdaddr_t *d
         __u8 auth_type;
         int err;
 
-        BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst),
-                                                        chan->psm);
+        BT_DBG("%s -> %s (type %u) psm 0x%2.2x", batostr(src), batostr(dst),
+               dst_type, __le16_to_cpu(chan->psm));
 
         hdev = hci_get_route(dst, src);
         if (!hdev)
@@ -1139,7 +1412,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, bdaddr_t *d
 
         hci_dev_lock(hdev);
 
-        lock_sock(sk);
+        l2cap_chan_lock(chan);
 
         /* PSM must be odd and lsb of upper byte must be 0 */
         if ((__le16_to_cpu(psm) & 0x0101) != 0x0001 && !cid &&
@@ -1166,17 +1439,21 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, bdaddr_t *d
                 goto done;
         }
 
+        lock_sock(sk);
+
         switch (sk->sk_state) {
         case BT_CONNECT:
         case BT_CONNECT2:
         case BT_CONFIG:
                 /* Already connecting */
                 err = 0;
+                release_sock(sk);
                 goto done;
 
         case BT_CONNECTED:
                 /* Already connected */
                 err = -EISCONN;
+                release_sock(sk);
                 goto done;
 
         case BT_OPEN:
@@ -1186,22 +1463,26 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, bdaddr_t *d
 
         default:
                 err = -EBADFD;
+                release_sock(sk);
                 goto done;
         }
 
         /* Set destination address and psm */
         bacpy(&bt_sk(sk)->dst, dst);
+
+        release_sock(sk);
+
         chan->psm = psm;
         chan->dcid = cid;
 
         auth_type = l2cap_get_auth_type(chan);
 
         if (chan->dcid == L2CAP_CID_LE_DATA)
-                hcon = hci_connect(hdev, LE_LINK, dst,
-                                        chan->sec_level, auth_type);
+                hcon = hci_connect(hdev, LE_LINK, dst, dst_type,
+                                   chan->sec_level, auth_type);
         else
-                hcon = hci_connect(hdev, ACL_LINK, dst,
-                                        chan->sec_level, auth_type);
+                hcon = hci_connect(hdev, ACL_LINK, dst, dst_type,
+                                   chan->sec_level, auth_type);
 
         if (IS_ERR(hcon)) {
                 err = PTR_ERR(hcon);
@@ -1215,10 +1496,24 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, bdaddr_t *d
                 goto done;
         }
 
+        if (hcon->type == LE_LINK) {
+                err = 0;
+
+                if (!list_empty(&conn->chan_l)) {
+                        err = -EBUSY;
+                        hci_conn_put(hcon);
+                }
+
+                if (err)
+                        goto done;
+        }
+
         /* Update source addr of the socket */
         bacpy(src, conn->src);
 
+        l2cap_chan_unlock(chan);
         l2cap_chan_add(conn, chan);
+        l2cap_chan_lock(chan);
 
         l2cap_state_change(chan, BT_CONNECT);
         __set_chan_timer(chan, sk->sk_sndtimeo);
@@ -1235,6 +1530,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, bdaddr_t *d
         err = 0;
 
 done:
+        l2cap_chan_unlock(chan);
         hci_dev_unlock(hdev);
         hci_dev_put(hdev);
         return err;
@@ -1276,14 +1572,15 @@ static void l2cap_monitor_timeout(struct work_struct *work)
 {
         struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
                                                         monitor_timer.work);
-        struct sock *sk = chan->sk;
 
         BT_DBG("chan %p", chan);
 
-        lock_sock(sk);
+        l2cap_chan_lock(chan);
+
         if (chan->retry_count >= chan->remote_max_tx) {
                 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
-                release_sock(sk);
+                l2cap_chan_unlock(chan);
+                l2cap_chan_put(chan);
                 return;
         }
 
@@ -1291,25 +1588,28 @@ static void l2cap_monitor_timeout(struct work_struct *work)
         __set_monitor_timer(chan);
 
         l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
-        release_sock(sk);
+        l2cap_chan_unlock(chan);
+        l2cap_chan_put(chan);
 }
 
 static void l2cap_retrans_timeout(struct work_struct *work)
 {
         struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
                                                         retrans_timer.work);
-        struct sock *sk = chan->sk;
 
         BT_DBG("chan %p", chan);
 
-        lock_sock(sk);
+        l2cap_chan_lock(chan);
+
         chan->retry_count = 1;
         __set_monitor_timer(chan);
 
         set_bit(CONN_WAIT_F, &chan->conn_state);
 
         l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
-        release_sock(sk);
+
+        l2cap_chan_unlock(chan);
+        l2cap_chan_put(chan);
 }
 
 static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
@@ -1318,7 +1618,7 @@ static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
 
         while ((skb = skb_peek(&chan->tx_q)) &&
                         chan->unacked_frames) {
-                if (bt_cb(skb)->tx_seq == chan->expected_ack_seq)
+                if (bt_cb(skb)->control.txseq == chan->expected_ack_seq)
                         break;
 
                 skb = skb_dequeue(&chan->tx_q);
@@ -1340,6 +1640,7 @@ static void l2cap_streaming_send(struct l2cap_chan *chan)
         while ((skb = skb_dequeue(&chan->tx_q))) {
                 control = __get_control(chan, skb->data + L2CAP_HDR_SIZE);
                 control |= __set_txseq(chan, chan->next_tx_seq);
+                control |= __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
                 __put_control(chan, control, skb->data + L2CAP_HDR_SIZE);
 
                 if (chan->fcs == L2CAP_FCS_CRC16) {
@@ -1365,21 +1666,21 @@ static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u16 tx_seq)
         if (!skb)
                 return;
 
-        while (bt_cb(skb)->tx_seq != tx_seq) {
+        while (bt_cb(skb)->control.txseq != tx_seq) {
                 if (skb_queue_is_last(&chan->tx_q, skb))
                         return;
 
                 skb = skb_queue_next(&chan->tx_q, skb);
         }
 
-        if (chan->remote_max_tx &&
-                        bt_cb(skb)->retries == chan->remote_max_tx) {
+        if (bt_cb(skb)->control.retries == chan->remote_max_tx &&
+            chan->remote_max_tx) {
                 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
                 return;
         }
 
         tx_skb = skb_clone(skb, GFP_ATOMIC);
-        bt_cb(skb)->retries++;
+        bt_cb(skb)->control.retries++;
 
         control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
         control &= __get_sar_mask(chan);
@@ -1412,17 +1713,20 @@ static int l2cap_ertm_send(struct l2cap_chan *chan)
         if (chan->state != BT_CONNECTED)
                 return -ENOTCONN;
 
+        if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
+                return 0;
+
         while ((skb = chan->tx_send_head) && (!l2cap_tx_window_full(chan))) {
 
-                if (chan->remote_max_tx &&
-                                bt_cb(skb)->retries == chan->remote_max_tx) {
+                if (bt_cb(skb)->control.retries == chan->remote_max_tx &&
+                    chan->remote_max_tx) {
                         l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
                         break;
                 }
 
                 tx_skb = skb_clone(skb, GFP_ATOMIC);
 
-                bt_cb(skb)->retries++;
+                bt_cb(skb)->control.retries++;
 
                 control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
                 control &= __get_sar_mask(chan);
@@ -1432,6 +1736,7 @@ static int l2cap_ertm_send(struct l2cap_chan *chan)
 
                 control |= __set_reqseq(chan, chan->buffer_seq);
                 control |= __set_txseq(chan, chan->next_tx_seq);
+                control |= __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
 
                 __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
 
@@ -1446,21 +1751,23 @@ static int l2cap_ertm_send(struct l2cap_chan *chan)
 
                 __set_retrans_timer(chan);
 
-                bt_cb(skb)->tx_seq = chan->next_tx_seq;
+                bt_cb(skb)->control.txseq = chan->next_tx_seq;
 
                 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
 
-                if (bt_cb(skb)->retries == 1)
+                if (bt_cb(skb)->control.retries == 1) {
                         chan->unacked_frames++;
 
+                        if (!nsent++)
+                                __clear_ack_timer(chan);
+                }
+
                 chan->frames_sent++;
 
                 if (skb_queue_is_last(&chan->tx_q, skb))
                         chan->tx_send_head = NULL;
                 else
                         chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
-
-                nsent++;
         }
 
         return nsent;
@@ -1478,7 +1785,7 @@ static int l2cap_retransmit_frames(struct l2cap_chan *chan)
         return ret;
 }
 
-static void l2cap_send_ack(struct l2cap_chan *chan)
+static void __l2cap_send_ack(struct l2cap_chan *chan)
 {
         u32 control = 0;
 
@@ -1498,6 +1805,12 @@ static void l2cap_send_ack(struct l2cap_chan *chan)
         l2cap_send_sframe(chan, control);
 }
 
+static void l2cap_send_ack(struct l2cap_chan *chan)
+{
+        __clear_ack_timer(chan);
+        __l2cap_send_ack(chan);
+}
+
 static void l2cap_send_srejtail(struct l2cap_chan *chan)
 {
         struct srej_list *tail;
@@ -1512,11 +1825,13 @@ static void l2cap_send_srejtail(struct l2cap_chan *chan)
         l2cap_send_sframe(chan, control);
 }
 
-static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, int len, int count, struct sk_buff *skb)
+static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
+                                         struct msghdr *msg, int len,
+                                         int count, struct sk_buff *skb)
 {
-        struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
+        struct l2cap_conn *conn = chan->conn;
         struct sk_buff **frag;
-        int err, sent = 0;
+        int sent = 0;
 
         if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
                 return -EFAULT;
@@ -1527,11 +1842,17 @@ static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, in
         /* Continuation fragments (no L2CAP header) */
         frag = &skb_shinfo(skb)->frag_list;
         while (len) {
+                struct sk_buff *tmp;
+
                 count = min_t(unsigned int, conn->mtu, len);
 
-                *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
-                if (!*frag)
-                        return err;
+                tmp = chan->ops->alloc_skb(chan, count,
+                                           msg->msg_flags & MSG_DONTWAIT);
+                if (IS_ERR(tmp))
+                        return PTR_ERR(tmp);
+
+                *frag = tmp;
+
                 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
                         return -EFAULT;
 
@@ -1540,6 +1861,9 @@ static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, in
                 sent += count;
                 len  -= count;
 
+                skb->len += (*frag)->len;
+                skb->data_len += (*frag)->len;
+
                 frag = &(*frag)->next;
         }
 
@@ -1550,29 +1874,29 @@ static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
                                                 struct msghdr *msg, size_t len,
                                                 u32 priority)
 {
-        struct sock *sk = chan->sk;
         struct l2cap_conn *conn = chan->conn;
         struct sk_buff *skb;
         int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
         struct l2cap_hdr *lh;
 
-        BT_DBG("sk %p len %d priority %u", sk, (int)len, priority);
+        BT_DBG("chan %p len %d priority %u", chan, (int)len, priority);
 
         count = min_t(unsigned int, (conn->mtu - hlen), len);
-        skb = bt_skb_send_alloc(sk, count + hlen,
-                        msg->msg_flags & MSG_DONTWAIT, &err);
-        if (!skb)
-                return ERR_PTR(err);
+
+        skb = chan->ops->alloc_skb(chan, count + hlen,
+                                   msg->msg_flags & MSG_DONTWAIT);
+        if (IS_ERR(skb))
+                return skb;
 
         skb->priority = priority;
 
         /* Create L2CAP header */
         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
         lh->cid = cpu_to_le16(chan->dcid);
-        lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
-        put_unaligned_le16(chan->psm, skb_put(skb, 2));
+        lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
+        put_unaligned(chan->psm, skb_put(skb, L2CAP_PSMLEN_SIZE));
 
-        err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
+        err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
         if (unlikely(err < 0)) {
                 kfree_skb(skb);
                 return ERR_PTR(err);
@@ -1584,28 +1908,28 @@ static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
                                                 struct msghdr *msg, size_t len,
                                                 u32 priority)
 {
-        struct sock *sk = chan->sk;
         struct l2cap_conn *conn = chan->conn;
         struct sk_buff *skb;
-        int err, count, hlen = L2CAP_HDR_SIZE;
+        int err, count;
         struct l2cap_hdr *lh;
 
-        BT_DBG("sk %p len %d", sk, (int)len);
+        BT_DBG("chan %p len %d", chan, (int)len);
 
-        count = min_t(unsigned int, (conn->mtu - hlen), len);
-        skb = bt_skb_send_alloc(sk, count + hlen,
-                        msg->msg_flags & MSG_DONTWAIT, &err);
-        if (!skb)
-                return ERR_PTR(err);
+        count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
+
+        skb = chan->ops->alloc_skb(chan, count + L2CAP_HDR_SIZE,
+                                   msg->msg_flags & MSG_DONTWAIT);
+        if (IS_ERR(skb))
+                return skb;
 
         skb->priority = priority;
 
         /* Create L2CAP header */
         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
         lh->cid = cpu_to_le16(chan->dcid);
-        lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
+        lh->len = cpu_to_le16(len);
 
-        err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
+        err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
         if (unlikely(err < 0)) {
                 kfree_skb(skb);
                 return ERR_PTR(err);
@@ -1615,15 +1939,14 @@ static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
 
 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
                                                 struct msghdr *msg, size_t len,
-                                                u32 control, u16 sdulen)
+                                                u16 sdulen)
 {
-        struct sock *sk = chan->sk;
         struct l2cap_conn *conn = chan->conn;
         struct sk_buff *skb;
         int err, count, hlen;
         struct l2cap_hdr *lh;
 
-        BT_DBG("sk %p len %d", sk, (int)len);
+        BT_DBG("chan %p len %d", chan, (int)len);
 
         if (!conn)
                 return ERR_PTR(-ENOTCONN);
@@ -1640,22 +1963,23 @@ static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
                 hlen += L2CAP_FCS_SIZE;
 
         count = min_t(unsigned int, (conn->mtu - hlen), len);
-        skb = bt_skb_send_alloc(sk, count + hlen,
-                        msg->msg_flags & MSG_DONTWAIT, &err);
-        if (!skb)
-                return ERR_PTR(err);
+
+        skb = chan->ops->alloc_skb(chan, count + hlen,
+                                   msg->msg_flags & MSG_DONTWAIT);
+        if (IS_ERR(skb))
+                return skb;
 
         /* Create L2CAP header */
         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
         lh->cid = cpu_to_le16(chan->dcid);
         lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
 
-        __put_control(chan, control, skb_put(skb, __ctrl_size(chan)));
+        __put_control(chan, 0, skb_put(skb, __ctrl_size(chan)));
 
         if (sdulen)
                 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
 
-        err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
+        err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
         if (unlikely(err < 0)) {
                 kfree_skb(skb);
                 return ERR_PTR(err);
@@ -1664,61 +1988,82 @@ static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
         if (chan->fcs == L2CAP_FCS_CRC16)
                 put_unaligned_le16(0, skb_put(skb, L2CAP_FCS_SIZE));
 
-        bt_cb(skb)->retries = 0;
+        bt_cb(skb)->control.retries = 0;
         return skb;
 }
 
-static int l2cap_sar_segment_sdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
+static int l2cap_segment_sdu(struct l2cap_chan *chan,
+                             struct sk_buff_head *seg_queue,
+                             struct msghdr *msg, size_t len)
 {
         struct sk_buff *skb;
-        struct sk_buff_head sar_queue;
-        u32 control;
-        size_t size = 0;
+        u16 sdu_len;
+        size_t pdu_len;
+        int err = 0;
+        u8 sar;
 
-        skb_queue_head_init(&sar_queue);
-        control = __set_ctrl_sar(chan, L2CAP_SAR_START);
-        skb = l2cap_create_iframe_pdu(chan, msg, chan->remote_mps, control, len);
-        if (IS_ERR(skb))
-                return PTR_ERR(skb);
+        BT_DBG("chan %p, msg %p, len %d", chan, msg, (int)len);
+
+        /* It is critical that ERTM PDUs fit in a single HCI fragment,
+         * so fragmented skbs are not used.  The HCI layer's handling
+         * of fragmented skbs is not compatible with ERTM's queueing.
+         */
 
-        __skb_queue_tail(&sar_queue, skb);
-        len -= chan->remote_mps;
-        size += chan->remote_mps;
+        /* PDU size is derived from the HCI MTU */
+        pdu_len = chan->conn->mtu;
 
-        while (len > 0) {
-                size_t buflen;
+        pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
 
-                if (len > chan->remote_mps) {
-                        control = __set_ctrl_sar(chan, L2CAP_SAR_CONTINUE);
-                        buflen = chan->remote_mps;
-                } else {
-                        control = __set_ctrl_sar(chan, L2CAP_SAR_END);
-                        buflen = len;
-                }
+        /* Adjust for largest possible L2CAP overhead. */
+        pdu_len -= L2CAP_EXT_HDR_SIZE + L2CAP_FCS_SIZE;
+
+        /* Remote device may have requested smaller PDUs */
+        pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
+
+        if (len <= pdu_len) {
+                sar = L2CAP_SAR_UNSEGMENTED;
+                sdu_len = 0;
+                pdu_len = len;
+        } else {
+                sar = L2CAP_SAR_START;
+                sdu_len = len;
+                pdu_len -= L2CAP_SDULEN_SIZE;
+        }
+
+        while (len > 0) {
+                skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
 
-                skb = l2cap_create_iframe_pdu(chan, msg, buflen, control, 0);
                 if (IS_ERR(skb)) {
-                        skb_queue_purge(&sar_queue);
+                        __skb_queue_purge(seg_queue);
                         return PTR_ERR(skb);
                 }
 
-                __skb_queue_tail(&sar_queue, skb);
-                len -= buflen;
-                size += buflen;
+                bt_cb(skb)->control.sar = sar;
+                __skb_queue_tail(seg_queue, skb);
+
+                len -= pdu_len;
+                if (sdu_len) {
+                        sdu_len = 0;
+                        pdu_len += L2CAP_SDULEN_SIZE;
+                }
+
+                if (len <= pdu_len) {
+                        sar = L2CAP_SAR_END;
+                        pdu_len = len;
+                } else {
+                        sar = L2CAP_SAR_CONTINUE;
+                }
         }
-        skb_queue_splice_tail(&sar_queue, &chan->tx_q);
-        if (chan->tx_send_head == NULL)
-                chan->tx_send_head = sar_queue.next;
 
-        return size;
+        return err;
 }
 
 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
                                                                 u32 priority)
 {
         struct sk_buff *skb;
-        u32 control;
         int err;
+        struct sk_buff_head seg_queue;
 
         /* Connectionless channel */
         if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
@@ -1747,42 +2092,47 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
 
         case L2CAP_MODE_ERTM:
         case L2CAP_MODE_STREAMING:
-                /* Entire SDU fits into one PDU */
-                if (len <= chan->remote_mps) {
-                        control = __set_ctrl_sar(chan, L2CAP_SAR_UNSEGMENTED);
-                        skb = l2cap_create_iframe_pdu(chan, msg, len, control,
-                                                                        0);
-                        if (IS_ERR(skb))
-                                return PTR_ERR(skb);
+                /* Check outgoing MTU */
+                if (len > chan->omtu) {
+                        err = -EMSGSIZE;
+                        break;
+                }
 
-                        __skb_queue_tail(&chan->tx_q, skb);
+                __skb_queue_head_init(&seg_queue);
 
-                        if (chan->tx_send_head == NULL)
-                                chan->tx_send_head = skb;
+                /* Do segmentation before calling in to the state machine,
+                 * since it's possible to block while waiting for memory
+                 * allocation.
+                 */
+                err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
 
-                } else {
-                        /* Segment SDU into multiples PDUs */
-                        err = l2cap_sar_segment_sdu(chan, msg, len);
-                        if (err < 0)
-                                return err;
+                /* The channel could have been closed while segmenting,
+                 * check that it is still connected.
+                 */
+                if (chan->state != BT_CONNECTED) {
+                        __skb_queue_purge(&seg_queue);
+                        err = -ENOTCONN;
                 }
 
-                if (chan->mode == L2CAP_MODE_STREAMING) {
-                        l2cap_streaming_send(chan);
-                        err = len;
+                if (err)
                         break;
-                }
 
-                if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
-                                test_bit(CONN_WAIT_F, &chan->conn_state)) {
-                        err = len;
-                        break;
-                }
+                if (chan->mode == L2CAP_MODE_ERTM && chan->tx_send_head == NULL)
+                        chan->tx_send_head = seg_queue.next;
+                skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
+
+                if (chan->mode == L2CAP_MODE_ERTM)
+                        err = l2cap_ertm_send(chan);
+                else
+                        l2cap_streaming_send(chan);
 
-                err = l2cap_ertm_send(chan);
                 if (err >= 0)
                         err = len;
 
+                /* If the skbs were not queued for sending, they'll still be in
+                 * seg_queue and need to be purged.
+                 */
+                __skb_queue_purge(&seg_queue);
                 break;
 
         default:
@@ -1801,9 +2151,9 @@ static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
 
         BT_DBG("conn %p", conn);
 
-        rcu_read_lock();
+        mutex_lock(&conn->chan_lock);
 
-        list_for_each_entry_rcu(chan, &conn->chan_l, list) {
+        list_for_each_entry(chan, &conn->chan_l, list) {
                 struct sock *sk = chan->sk;
                 if (chan->chan_type != L2CAP_CHAN_RAW)
                         continue;
@@ -1819,7 +2169,7 @@ static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
                         kfree_skb(nskb);
         }
 
-        rcu_read_unlock();
+        mutex_unlock(&conn->chan_lock);
 }
 
 /* ---- L2CAP signalling commands ---- */
@@ -1987,18 +2337,38 @@ static void l2cap_ack_timeout(struct work_struct *work)
 
         BT_DBG("chan %p", chan);
 
-        lock_sock(chan->sk);
-        l2cap_send_ack(chan);
-        release_sock(chan->sk);
+        l2cap_chan_lock(chan);
+
+        __l2cap_send_ack(chan);
+
+        l2cap_chan_unlock(chan);
+
+        l2cap_chan_put(chan);
 }
 
-static inline void l2cap_ertm_init(struct l2cap_chan *chan)
+static inline int l2cap_ertm_init(struct l2cap_chan *chan)
 {
+        int err;
+
+        chan->next_tx_seq = 0;
+        chan->expected_tx_seq = 0;
         chan->expected_ack_seq = 0;
         chan->unacked_frames = 0;
         chan->buffer_seq = 0;
         chan->num_acked = 0;
         chan->frames_sent = 0;
+        chan->last_acked_seq = 0;
+        chan->sdu = NULL;
+        chan->sdu_last_frag = NULL;
+        chan->sdu_len = 0;
+
+        skb_queue_head_init(&chan->tx_q);
+
+        if (chan->mode != L2CAP_MODE_ERTM)
+                return 0;
+
+        chan->rx_state = L2CAP_RX_STATE_RECV;
+        chan->tx_state = L2CAP_TX_STATE_XMIT;
 
         INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
         INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
@@ -2007,6 +2377,11 @@ static inline void l2cap_ertm_init(struct l2cap_chan *chan)
         skb_queue_head_init(&chan->srej_q);
 
         INIT_LIST_HEAD(&chan->srej_l);
+        err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
+        if (err < 0)
+                return err;
+
+        return l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
 }
 
 static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
@@ -2330,9 +2705,9 @@ done:
                         chan->remote_mps = size;
 
                         rfc.retrans_timeout =
-                                le16_to_cpu(L2CAP_DEFAULT_RETRANS_TO);
+                                __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
                         rfc.monitor_timeout =
-                                le16_to_cpu(L2CAP_DEFAULT_MONITOR_TO);
+                                __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
 
                         set_bit(CONF_MODE_DONE, &chan->conf_state);
 
@@ -2596,10 +2971,10 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
         u16 dcid = 0, scid = __le16_to_cpu(req->scid);
         __le16 psm = req->psm;
 
-        BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
+        BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
 
         /* Check if we have socket listening on psm */
-        pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src);
+        pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src, conn->dst);
         if (!pchan) {
                 result = L2CAP_CR_BAD_PSM;
                 goto sendresp;
@@ -2607,6 +2982,7 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
 
         parent = pchan->sk;
 
+        mutex_lock(&conn->chan_lock);
         lock_sock(parent);
 
         /* Check if the ACL is secure enough (if not SDP) */
@@ -2647,7 +3023,7 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
 
         bt_accept_enqueue(parent, sk);
 
-        l2cap_chan_add(conn, chan);
+        __l2cap_chan_add(conn, chan);
 
         dcid = chan->scid;
 
@@ -2657,29 +3033,30 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
 
         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
                 if (l2cap_chan_check_security(chan)) {
-                        if (bt_sk(sk)->defer_setup) {
-                                l2cap_state_change(chan, BT_CONNECT2);
+                        if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
+                                __l2cap_state_change(chan, BT_CONNECT2);
                                 result = L2CAP_CR_PEND;
                                 status = L2CAP_CS_AUTHOR_PEND;
                                 parent->sk_data_ready(parent, 0);
                         } else {
-                                l2cap_state_change(chan, BT_CONFIG);
+                                __l2cap_state_change(chan, BT_CONFIG);
                                 result = L2CAP_CR_SUCCESS;
                                 status = L2CAP_CS_NO_INFO;
                         }
                 } else {
-                        l2cap_state_change(chan, BT_CONNECT2);
+                        __l2cap_state_change(chan, BT_CONNECT2);
                         result = L2CAP_CR_PEND;
                         status = L2CAP_CS_AUTHEN_PEND;
                 }
         } else {
-                l2cap_state_change(chan, BT_CONNECT2);
+                __l2cap_state_change(chan, BT_CONNECT2);
                 result = L2CAP_CR_PEND;
                 status = L2CAP_CS_NO_INFO;
         }
 
 response:
         release_sock(parent);
+        mutex_unlock(&conn->chan_lock);
 
 sendresp:
         rsp.scid   = cpu_to_le16(scid);
@@ -2695,8 +3072,7 @@ sendresp:
                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
                 conn->info_ident = l2cap_get_ident(conn);
 
-                schedule_delayed_work(&conn->info_timer,
-                                        msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
+                schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
 
                 l2cap_send_cmd(conn, conn->info_ident,
                                         L2CAP_INFO_REQ, sizeof(info), &info);
@@ -2719,27 +3095,36 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
         struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
         u16 scid, dcid, result, status;
         struct l2cap_chan *chan;
-        struct sock *sk;
         u8 req[128];
+        int err;
 
         scid   = __le16_to_cpu(rsp->scid);
         dcid   = __le16_to_cpu(rsp->dcid);
         result = __le16_to_cpu(rsp->result);
         status = __le16_to_cpu(rsp->status);
 
-        BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status);
+        BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
+                                                dcid, scid, result, status);
+
+        mutex_lock(&conn->chan_lock);
 
         if (scid) {
-                chan = l2cap_get_chan_by_scid(conn, scid);
-                if (!chan)
-                        return -EFAULT;
+                chan = __l2cap_get_chan_by_scid(conn, scid);
+                if (!chan) {
+                        err = -EFAULT;
+                        goto unlock;
+                }
         } else {
-                chan = l2cap_get_chan_by_ident(conn, cmd->ident);
-                if (!chan)
-                        return -EFAULT;
+                chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
+                if (!chan) {
+                        err = -EFAULT;
+                        goto unlock;
+                }
         }
 
-        sk = chan->sk;
+        err = 0;
+
+        l2cap_chan_lock(chan);
 
         switch (result) {
         case L2CAP_CR_SUCCESS:
@@ -2765,8 +3150,12 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
                 break;
         }
 
-        release_sock(sk);
-        return 0;
+        l2cap_chan_unlock(chan);
+
+unlock:
+        mutex_unlock(&conn->chan_lock);
+
+        return err;
 }
 
 static inline void set_default_fcs(struct l2cap_chan *chan)
@@ -2786,8 +3175,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         u16 dcid, flags;
         u8 rsp[64];
         struct l2cap_chan *chan;
-        struct sock *sk;
-        int len;
+        int len, err = 0;
 
         dcid  = __le16_to_cpu(req->dcid);
         flags = __le16_to_cpu(req->flags);
@@ -2798,8 +3186,6 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         if (!chan)
                 return -ENOENT;
 
-        sk = chan->sk;
-
         if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
                 struct l2cap_cmd_rej_cid rej;
 
@@ -2854,13 +3240,15 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 
                 l2cap_state_change(chan, BT_CONNECTED);
 
-                chan->next_tx_seq = 0;
-                chan->expected_tx_seq = 0;
-                skb_queue_head_init(&chan->tx_q);
-                if (chan->mode == L2CAP_MODE_ERTM)
-                        l2cap_ertm_init(chan);
+                if (chan->mode == L2CAP_MODE_ERTM ||
+                    chan->mode == L2CAP_MODE_STREAMING)
+                        err = l2cap_ertm_init(chan);
+
+                if (err < 0)
+                        l2cap_send_disconn_req(chan->conn, chan, -err);
+                else
+                        l2cap_chan_ready(chan);
 
-                l2cap_chan_ready(sk);
                 goto unlock;
         }
 
@@ -2887,8 +3275,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         }
 
 unlock:
-        release_sock(sk);
-        return 0;
+        l2cap_chan_unlock(chan);
+        return err;
 }
 
 static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
@@ -2896,22 +3284,20 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
         u16 scid, flags, result;
         struct l2cap_chan *chan;
-        struct sock *sk;
-        int len = cmd->len - sizeof(*rsp);
+        int len = le16_to_cpu(cmd->len) - sizeof(*rsp);
+        int err = 0;
 
         scid   = __le16_to_cpu(rsp->scid);
         flags  = __le16_to_cpu(rsp->flags);
         result = __le16_to_cpu(rsp->result);
 
-        BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x",
-                        scid, flags, result);
+        BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
+               result, len);
 
         chan = l2cap_get_chan_by_scid(conn, scid);
         if (!chan)
                 return 0;
 
-        sk = chan->sk;
-
         switch (result) {
         case L2CAP_CONF_SUCCESS:
                 l2cap_conf_rfc_get(chan, rsp->data, len);
@@ -2969,9 +3355,9 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                 }
 
         default:
-                sk->sk_err = ECONNRESET;
-                __set_chan_timer(chan,
-                                msecs_to_jiffies(L2CAP_DISC_REJ_TIMEOUT));
+                l2cap_chan_set_err(chan, ECONNRESET);
+
+                __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
                 l2cap_send_disconn_req(conn, chan, ECONNRESET);
                 goto done;
         }
@@ -2985,18 +3371,19 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                 set_default_fcs(chan);
 
                 l2cap_state_change(chan, BT_CONNECTED);
-                chan->next_tx_seq = 0;
-                chan->expected_tx_seq = 0;
-                skb_queue_head_init(&chan->tx_q);
-                if (chan->mode ==  L2CAP_MODE_ERTM)
-                        l2cap_ertm_init(chan);
+                if (chan->mode == L2CAP_MODE_ERTM ||
+                    chan->mode == L2CAP_MODE_STREAMING)
+                        err = l2cap_ertm_init(chan);
 
-                l2cap_chan_ready(sk);
+                if (err < 0)
+                        l2cap_send_disconn_req(chan->conn, chan, -err);
+                else
+                        l2cap_chan_ready(chan);
         }
 
 done:
-        release_sock(sk);
-        return 0;
+        l2cap_chan_unlock(chan);
+        return err;
 }
 
 static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
@@ -3012,9 +3399,15 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd
 
         BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
 
-        chan = l2cap_get_chan_by_scid(conn, dcid);
-        if (!chan)
+        mutex_lock(&conn->chan_lock);
+
+        chan = __l2cap_get_chan_by_scid(conn, dcid);
+        if (!chan) {
+                mutex_unlock(&conn->chan_lock);
                 return 0;
+        }
+
+        l2cap_chan_lock(chan);
 
         sk = chan->sk;
 
@@ -3022,12 +3415,20 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd
         rsp.scid = cpu_to_le16(chan->dcid);
         l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
 
+        lock_sock(sk);
         sk->sk_shutdown = SHUTDOWN_MASK;
+        release_sock(sk);
 
+        l2cap_chan_hold(chan);
         l2cap_chan_del(chan, ECONNRESET);
-        release_sock(sk);
+
+        l2cap_chan_unlock(chan);
 
         chan->ops->close(chan->data);
+        l2cap_chan_put(chan);
+
+        mutex_unlock(&conn->chan_lock);
+
         return 0;
 }
 
@@ -3036,23 +3437,32 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd
         struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
         u16 dcid, scid;
         struct l2cap_chan *chan;
-        struct sock *sk;
 
         scid = __le16_to_cpu(rsp->scid);
         dcid = __le16_to_cpu(rsp->dcid);
 
         BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
 
-        chan = l2cap_get_chan_by_scid(conn, scid);
-        if (!chan)
+        mutex_lock(&conn->chan_lock);
+
+        chan = __l2cap_get_chan_by_scid(conn, scid);
+        if (!chan) {
+                mutex_unlock(&conn->chan_lock);
                 return 0;
+        }
 
-        sk = chan->sk;
+        l2cap_chan_lock(chan);
 
+        l2cap_chan_hold(chan);
         l2cap_chan_del(chan, 0);
-        release_sock(sk);
+
+        l2cap_chan_unlock(chan);
 
         chan->ops->close(chan->data);
+        l2cap_chan_put(chan);
+
+        mutex_unlock(&conn->chan_lock);
+
         return 0;
 }
 
@@ -3132,7 +3542,8 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cm
                 return 0;
         }
 
-        if (type == L2CAP_IT_FEAT_MASK) {
+        switch (type) {
+        case L2CAP_IT_FEAT_MASK:
                 conn->feat_mask = get_unaligned_le32(rsp->data);
 
                 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
@@ -3149,11 +3560,15 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cm
 
                         l2cap_conn_start(conn);
                 }
-        } else if (type == L2CAP_IT_FIXED_CHAN) {
+                break;
+
+        case L2CAP_IT_FIXED_CHAN:
+                conn->fixed_chan_mask = rsp->data[0];
                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
                 conn->info_ident = 0;
 
                 l2cap_conn_start(conn);
+                break;
         }
 
         return 0;
@@ -3181,8 +3596,8 @@ static inline int l2cap_create_channel_req(struct l2cap_conn *conn,
         /* Placeholder: Always reject */
         rsp.dcid = 0;
         rsp.scid = cpu_to_le16(scid);
-        rsp.result = L2CAP_CR_NO_MEM;
-        rsp.status = L2CAP_CS_NO_INFO;
+        rsp.result = __constant_cpu_to_le16(L2CAP_CR_NO_MEM);
+        rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
 
         l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
                        sizeof(rsp), &rsp);
@@ -3581,19 +3996,19 @@ static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb,
         struct sk_buff *next_skb;
         int tx_seq_offset, next_tx_seq_offset;
 
-        bt_cb(skb)->tx_seq = tx_seq;
-        bt_cb(skb)->sar = sar;
+        bt_cb(skb)->control.txseq = tx_seq;
+        bt_cb(skb)->control.sar = sar;
 
         next_skb = skb_peek(&chan->srej_q);
 
         tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
 
         while (next_skb) {
-                if (bt_cb(next_skb)->tx_seq == tx_seq)
+                if (bt_cb(next_skb)->control.txseq == tx_seq)
                         return -EINVAL;
 
                 next_tx_seq_offset = __seq_offset(chan,
-                                bt_cb(next_skb)->tx_seq, chan->buffer_seq);
+                        bt_cb(next_skb)->control.txseq, chan->buffer_seq);
 
                 if (next_tx_seq_offset > tx_seq_offset) {
                         __skb_queue_before(&chan->srej_q, next_skb, skb);
@@ -3713,19 +4128,12 @@ static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u3
 
 static void l2cap_ertm_enter_local_busy(struct l2cap_chan *chan)
 {
-        u32 control;
-
         BT_DBG("chan %p, Enter local busy", chan);
 
         set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
+        l2cap_seq_list_clear(&chan->srej_list);
 
-        control = __set_reqseq(chan, chan->buffer_seq);
-        control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
-        l2cap_send_sframe(chan, control);
-
-        set_bit(CONN_RNR_SENT, &chan->conn_state);
-
-        __clear_ack_timer(chan);
+        __set_ack_timer(chan);
 }
 
 static void l2cap_ertm_exit_local_busy(struct l2cap_chan *chan)
@@ -3772,11 +4180,11 @@ static void l2cap_check_srej_gap(struct l2cap_chan *chan, u16 tx_seq)
                         !test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
                 int err;
 
-                if (bt_cb(skb)->tx_seq != tx_seq)
+                if (bt_cb(skb)->control.txseq != tx_seq)
                         break;
 
                 skb = skb_dequeue(&chan->srej_q);
-                control = __set_ctrl_sar(chan, bt_cb(skb)->sar);
+                control = __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
                 err = l2cap_reassemble_sdu(chan, skb, control);
 
                 if (err < 0) {
@@ -3816,6 +4224,7 @@ static int l2cap_send_srejframe(struct l2cap_chan *chan, u16 tx_seq)
         while (tx_seq != chan->expected_tx_seq) {
                 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
                 control |= __set_reqseq(chan, chan->expected_tx_seq);
+                l2cap_seq_list_append(&chan->srej_list, chan->expected_tx_seq);
                 l2cap_send_sframe(chan, control);
 
                 new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
@@ -3865,8 +4274,11 @@ static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u32 rx_cont
                 goto drop;
         }
 
-        if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
+        if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
+                if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
+                        l2cap_send_ack(chan);
                 goto drop;
+        }
 
         if (tx_seq == chan->expected_tx_seq)
                 goto expected;
@@ -3927,15 +4339,15 @@ static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u32 rx_cont
                 __skb_queue_head_init(&chan->srej_q);
                 l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
 
-                set_bit(CONN_SEND_PBIT, &chan->conn_state);
+                /* Set P-bit only if there are some I-frames to ack. */
+                if (__clear_ack_timer(chan))
+                        set_bit(CONN_SEND_PBIT, &chan->conn_state);
 
                 err = l2cap_send_srejframe(chan, tx_seq);
                 if (err < 0) {
                         l2cap_send_disconn_req(chan->conn, chan, -err);
                         return err;
                 }
-
-                __clear_ack_timer(chan);
         }
         return 0;
 
@@ -3943,8 +4355,8 @@ expected:
         chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
 
         if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
-                bt_cb(skb)->tx_seq = tx_seq;
-                bt_cb(skb)->sar = sar;
+                bt_cb(skb)->control.txseq = tx_seq;
+                bt_cb(skb)->control.sar = sar;
                 __skb_queue_tail(&chan->srej_q, skb);
                 return 0;
         }
@@ -4135,13 +4547,14 @@ static inline int l2cap_data_channel_sframe(struct l2cap_chan *chan, u32 rx_cont
         return 0;
 }
 
-static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb)
+static int l2cap_ertm_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
 {
-        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
         u32 control;
         u16 req_seq;
         int len, next_tx_seq_offset, req_seq_offset;
 
+        __unpack_control(chan, skb);
+
         control = __get_control(chan, skb->data);
         skb_pull(skb, __ctrl_size(chan));
         len = skb->len;
@@ -4205,7 +4618,6 @@ drop:
 static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
 {
         struct l2cap_chan *chan;
-        struct sock *sk = NULL;
         u32 control;
         u16 tx_seq;
         int len;
@@ -4213,11 +4625,11 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
         chan = l2cap_get_chan_by_scid(conn, cid);
         if (!chan) {
                 BT_DBG("unknown cid 0x%4.4x", cid);
-                goto drop;
+                /* Drop packet and return */
+                kfree_skb(skb);
+                return 0;
         }
 
-        sk = chan->sk;
-
         BT_DBG("chan %p, len %d", chan, skb->len);
 
         if (chan->state != BT_CONNECTED)
@@ -4238,7 +4650,7 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
                 break;
 
         case L2CAP_MODE_ERTM:
-                l2cap_ertm_data_rcv(sk, skb);
+                l2cap_ertm_data_rcv(chan, skb);
 
                 goto done;
 
@@ -4287,26 +4699,20 @@ drop:
         kfree_skb(skb);
 
 done:
-        if (sk)
-                release_sock(sk);
+        l2cap_chan_unlock(chan);
 
         return 0;
 }
 
 static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
 {
-        struct sock *sk = NULL;
         struct l2cap_chan *chan;
 
-        chan = l2cap_global_chan_by_psm(0, psm, conn->src);
+        chan = l2cap_global_chan_by_psm(0, psm, conn->src, conn->dst);
         if (!chan)
                 goto drop;
 
-        sk = chan->sk;
-
-        lock_sock(sk);
-
-        BT_DBG("sk %p, len %d", sk, skb->len);
+        BT_DBG("chan %p, len %d", chan, skb->len);
 
         if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
                 goto drop;
@@ -4315,31 +4721,24 @@ static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, str
                 goto drop;
 
         if (!chan->ops->recv(chan->data, skb))
-                goto done;
+                return 0;
 
 drop:
         kfree_skb(skb);
 
-done:
-        if (sk)
-                release_sock(sk);
         return 0;
 }
 
-static inline int l2cap_att_channel(struct l2cap_conn *conn, __le16 cid, struct sk_buff *skb)
+static inline int l2cap_att_channel(struct l2cap_conn *conn, u16 cid,
+                                    struct sk_buff *skb)
 {
-        struct sock *sk = NULL;
         struct l2cap_chan *chan;
 
-        chan = l2cap_global_chan_by_scid(0, cid, conn->src);
+        chan = l2cap_global_chan_by_scid(0, cid, conn->src, conn->dst);
         if (!chan)
                 goto drop;
 
-        sk = chan->sk;
-
-        lock_sock(sk);
-
-        BT_DBG("sk %p, len %d", sk, skb->len);
+        BT_DBG("chan %p, len %d", chan, skb->len);
 
         if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
                 goto drop;
@@ -4348,14 +4747,11 @@ static inline int l2cap_att_channel(struct l2cap_conn *conn, __le16 cid, struct
                 goto drop;
 
         if (!chan->ops->recv(chan->data, skb))
-                goto done;
+                return 0;
 
 drop:
         kfree_skb(skb);
 
-done:
-        if (sk)
-                release_sock(sk);
         return 0;
 }
 
@@ -4383,7 +4779,7 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
                 break;
 
         case L2CAP_CID_CONN_LESS:
-                psm = get_unaligned_le16(skb->data);
+                psm = get_unaligned((__le16 *) skb->data);
                 skb_pull(skb, 2);
                 l2cap_conless_channel(conn, psm, skb);
                 break;
@@ -4478,9 +4874,7 @@ static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
 
         if (encrypt == 0x00) {
                 if (chan->sec_level == BT_SECURITY_MEDIUM) {
-                        __clear_chan_timer(chan);
-                        __set_chan_timer(chan,
-                                        msecs_to_jiffies(L2CAP_ENC_TIMEOUT));
+                        __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
                 } else if (chan->sec_level == BT_SECURITY_HIGH)
                         l2cap_chan_close(chan, ECONNREFUSED);
         } else {
@@ -4500,81 +4894,80 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
         BT_DBG("conn %p", conn);
 
         if (hcon->type == LE_LINK) {
-                smp_distribute_keys(conn, 0);
+                if (!status && encrypt)
+                        smp_distribute_keys(conn, 0);
                 cancel_delayed_work(&conn->security_timer);
         }
 
-        rcu_read_lock();
-
-        list_for_each_entry_rcu(chan, &conn->chan_l, list) {
-                struct sock *sk = chan->sk;
+        mutex_lock(&conn->chan_lock);
 
-                bh_lock_sock(sk);
+        list_for_each_entry(chan, &conn->chan_l, list) {
+                l2cap_chan_lock(chan);
 
                 BT_DBG("chan->scid %d", chan->scid);
 
                 if (chan->scid == L2CAP_CID_LE_DATA) {
                         if (!status && encrypt) {
                                 chan->sec_level = hcon->sec_level;
-                                l2cap_chan_ready(sk);
+                                l2cap_chan_ready(chan);
                         }
 
-                        bh_unlock_sock(sk);
+                        l2cap_chan_unlock(chan);
                         continue;
                 }
 
                 if (test_bit(CONF_CONNECT_PEND, &chan->conf_state)) {
-                        bh_unlock_sock(sk);
+                        l2cap_chan_unlock(chan);
                         continue;
                 }
 
                 if (!status && (chan->state == BT_CONNECTED ||
                                                 chan->state == BT_CONFIG)) {
+                        struct sock *sk = chan->sk;
+
+                        clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
+                        sk->sk_state_change(sk);
+
                         l2cap_check_encryption(chan, encrypt);
-                        bh_unlock_sock(sk);
+                        l2cap_chan_unlock(chan);
                         continue;
                 }
 
                 if (chan->state == BT_CONNECT) {
                         if (!status) {
-                                struct l2cap_conn_req req;
-                                req.scid = cpu_to_le16(chan->scid);
-                                req.psm  = chan->psm;
-
-                                chan->ident = l2cap_get_ident(conn);
-                                set_bit(CONF_CONNECT_PEND, &chan->conf_state);
-
-                                l2cap_send_cmd(conn, chan->ident,
-                                        L2CAP_CONN_REQ, sizeof(req), &req);
+                                l2cap_send_conn_req(chan);
                         } else {
-                                __clear_chan_timer(chan);
-                                __set_chan_timer(chan,
-                                        msecs_to_jiffies(L2CAP_DISC_TIMEOUT));
+                                __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
                         }
                 } else if (chan->state == BT_CONNECT2) {
+                        struct sock *sk = chan->sk;
                         struct l2cap_conn_rsp rsp;
                         __u16 res, stat;
 
+                        lock_sock(sk);
+
                         if (!status) {
-                                if (bt_sk(sk)->defer_setup) {
+                                if (test_bit(BT_SK_DEFER_SETUP,
+                                             &bt_sk(sk)->flags)) {
                                         struct sock *parent = bt_sk(sk)->parent;
                                         res = L2CAP_CR_PEND;
                                         stat = L2CAP_CS_AUTHOR_PEND;
                                         if (parent)
                                                 parent->sk_data_ready(parent, 0);
                                 } else {
-                                        l2cap_state_change(chan, BT_CONFIG);
+                                        __l2cap_state_change(chan, BT_CONFIG);
                                         res = L2CAP_CR_SUCCESS;
                                         stat = L2CAP_CS_NO_INFO;
                                 }
                         } else {
-                                l2cap_state_change(chan, BT_DISCONN);
-                                __set_chan_timer(chan,
-                                        msecs_to_jiffies(L2CAP_DISC_TIMEOUT));
+                                __l2cap_state_change(chan, BT_DISCONN);
+                                __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
                                 res = L2CAP_CR_SEC_BLOCK;
                                 stat = L2CAP_CS_NO_INFO;
                         }
 
+                        release_sock(sk);
+
                         rsp.scid   = cpu_to_le16(chan->dcid);
                         rsp.dcid   = cpu_to_le16(chan->scid);
                         rsp.result = cpu_to_le16(res);
@@ -4583,10 +4976,10 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                                         sizeof(rsp), &rsp);
                 }
 
-                bh_unlock_sock(sk);
+                l2cap_chan_unlock(chan);
         }
 
-        rcu_read_unlock();
+        mutex_unlock(&conn->chan_lock);
 
         return 0;
 }
@@ -4605,8 +4998,6 @@ int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
 
         if (!(flags & ACL_CONT)) {
                 struct l2cap_hdr *hdr;
-                struct l2cap_chan *chan;
-                u16 cid;
                 int len;
 
                 if (conn->rx_len) {
@@ -4626,7 +5017,6 @@ int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
 
                 hdr = (struct l2cap_hdr *) skb->data;
                 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
-                cid = __le16_to_cpu(hdr->cid);
 
                 if (len == skb->len) {
                         /* Complete frame received */
@@ -4643,22 +5033,6 @@ int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
                         goto drop;
                 }
 
-                chan = l2cap_get_chan_by_scid(conn, cid);
-
-                if (chan && chan->sk) {
-                        struct sock *sk = chan->sk;
-
-                        if (chan->imtu < len - L2CAP_HDR_SIZE) {
-                                BT_ERR("Frame exceeding recv MTU (len %d, "
-                                                        "MTU %d)", len,
-                                                        chan->imtu);
-                                release_sock(sk);
-                                l2cap_conn_unreliable(conn, ECOMM);
-                                goto drop;
-                        }
-                        release_sock(sk);
-                }
-
                 /* Allocate skb for the complete frame (with header) */
                 conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
                 if (!conn->rx_skb)
@@ -4717,7 +5091,7 @@ static int l2cap_debugfs_show(struct seq_file *f, void *p)
                                         c->state, __le16_to_cpu(c->psm),
                                         c->scid, c->dcid, c->imtu, c->omtu,
                                         c->sec_level, c->mode);
-}
+        }
 
         read_unlock(&chan_list_lock);
 
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 401d9428ae4c..3bb1611b9d48 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -82,7 +82,7 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
         }
 
         if (la.l2_cid)
-                err = l2cap_add_scid(chan, la.l2_cid);
+                err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
         else
                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 
@@ -123,15 +123,18 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
         if (la.l2_cid && la.l2_psm)
                 return -EINVAL;
 
-        err = l2cap_chan_connect(chan, la.l2_psm, la.l2_cid, &la.l2_bdaddr);
+        err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
+                                 &la.l2_bdaddr, la.l2_bdaddr_type);
         if (err)
-                goto done;
+                return err;
+
+        lock_sock(sk);
 
         err = bt_sock_wait_state(sk, BT_CONNECTED,
                         sock_sndtimeo(sk, flags & O_NONBLOCK));
-done:
-        if (sock_owned_by_user(sk))
-                release_sock(sk);
+
+        release_sock(sk);
+
         return err;
 }
 
@@ -145,12 +148,16 @@ static int l2cap_sock_listen(struct socket *sock, int backlog)
 
         lock_sock(sk);
 
-        if ((sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM)
-                        || sk->sk_state != BT_BOUND) {
+        if (sk->sk_state != BT_BOUND) {
                 err = -EBADFD;
                 goto done;
         }
 
+        if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
+                err = -EINVAL;
+                goto done;
+        }
+
         switch (chan->mode) {
         case L2CAP_MODE_BASIC:
                 break;
@@ -317,8 +324,8 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __us
 
         case L2CAP_CONNINFO:
                 if (sk->sk_state != BT_CONNECTED &&
-                                        !(sk->sk_state == BT_CONNECT2 &&
-                                                bt_sk(sk)->defer_setup)) {
+                    !(sk->sk_state == BT_CONNECT2 &&
+                      test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
                         err = -ENOTCONN;
                         break;
                 }
@@ -372,7 +379,10 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
                 }
 
                 memset(&sec, 0, sizeof(sec));
-                sec.level = chan->sec_level;
+                if (chan->conn)
+                        sec.level = chan->conn->hcon->sec_level;
+                else
+                        sec.level = chan->sec_level;
 
                 if (sk->sk_state == BT_CONNECTED)
                         sec.key_size = chan->conn->hcon->enc_key_size;
@@ -389,7 +399,8 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
                         break;
                 }
 
-                if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
+                if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
+                             (u32 __user *) optval))
                         err = -EFAULT;
 
                 break;
@@ -589,10 +600,14 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
                         sk->sk_state = BT_CONFIG;
                         chan->state = BT_CONFIG;
 
-                /* or for ACL link, under defer_setup time */
-                } else if (sk->sk_state == BT_CONNECT2 &&
-                                        bt_sk(sk)->defer_setup) {
-                        err = l2cap_chan_check_security(chan);
+                /* or for ACL link */
+                } else if ((sk->sk_state == BT_CONNECT2 &&
+                           test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
+                           sk->sk_state == BT_CONNECTED) {
+                        if (!l2cap_chan_check_security(chan))
+                                set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
+                        else
+                                sk->sk_state_change(sk);
                 } else {
                         err = -EINVAL;
                 }
@@ -609,7 +624,10 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
                         break;
                 }
 
-                bt_sk(sk)->defer_setup = opt;
+                if (opt)
+                        set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
+                else
+                        clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
                 break;
 
         case BT_FLUSHABLE:
@@ -709,16 +727,13 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
         if (msg->msg_flags & MSG_OOB)
                 return -EOPNOTSUPP;
 
-        lock_sock(sk);
-
-        if (sk->sk_state != BT_CONNECTED) {
-                release_sock(sk);
+        if (sk->sk_state != BT_CONNECTED)
                 return -ENOTCONN;
-        }
 
+        l2cap_chan_lock(chan);
         err = l2cap_chan_send(chan, msg, len, sk->sk_priority);
+        l2cap_chan_unlock(chan);
 
-        release_sock(sk);
         return err;
 }
 
@@ -730,7 +745,8 @@ static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct ms
 
         lock_sock(sk);
 
-        if (sk->sk_state == BT_CONNECT2 && bt_sk(sk)->defer_setup) {
+        if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
+                                                    &bt_sk(sk)->flags)) {
                 sk->sk_state = BT_CONFIG;
                 pi->chan->state = BT_CONFIG;
 
@@ -783,7 +799,7 @@ static void l2cap_sock_kill(struct sock *sk)
         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
                 return;
 
-        BT_DBG("sk %p state %d", sk, sk->sk_state);
+        BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
 
         /* Kill poor orphan */
 
@@ -795,7 +811,8 @@ static void l2cap_sock_kill(struct sock *sk)
 static int l2cap_sock_shutdown(struct socket *sock, int how)
 {
         struct sock *sk = sock->sk;
-        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        struct l2cap_chan *chan;
+        struct l2cap_conn *conn;
         int err = 0;
 
         BT_DBG("sock %p, sk %p", sock, sk);
@@ -803,13 +820,24 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
         if (!sk)
                 return 0;
 
+        chan = l2cap_pi(sk)->chan;
+        conn = chan->conn;
+
+        if (conn)
+                mutex_lock(&conn->chan_lock);
+
+        l2cap_chan_lock(chan);
         lock_sock(sk);
+
         if (!sk->sk_shutdown) {
                 if (chan->mode == L2CAP_MODE_ERTM)
                         err = __l2cap_wait_ack(sk);
 
                 sk->sk_shutdown = SHUTDOWN_MASK;
+
+                release_sock(sk);
                 l2cap_chan_close(chan, 0);
+                lock_sock(sk);
 
                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
                         err = bt_sock_wait_state(sk, BT_CLOSED,
@@ -820,6 +848,11 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
                 err = -sk->sk_err;
 
         release_sock(sk);
+        l2cap_chan_unlock(chan);
+
+        if (conn)
+                mutex_unlock(&conn->chan_lock);
+
         return err;
 }
 
@@ -862,8 +895,12 @@ static int l2cap_sock_recv_cb(void *data, struct sk_buff *skb)
         struct sock *sk = data;
         struct l2cap_pinfo *pi = l2cap_pi(sk);
 
-        if (pi->rx_busy_skb)
-                return -ENOMEM;
+        lock_sock(sk);
+
+        if (pi->rx_busy_skb) {
+                err = -ENOMEM;
+                goto done;
+        }
 
         err = sock_queue_rcv_skb(sk, skb);
 
@@ -882,6 +919,9 @@ static int l2cap_sock_recv_cb(void *data, struct sk_buff *skb)
                 err = 0;
         }
 
+done:
+        release_sock(sk);
+
         return err;
 }
 
@@ -899,18 +939,36 @@ static void l2cap_sock_state_change_cb(void *data, int state)
         sk->sk_state = state;
 }
 
+static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
+                                               unsigned long len, int nb)
+{
+        struct sk_buff *skb;
+        int err;
+
+        l2cap_chan_unlock(chan);
+        skb = bt_skb_send_alloc(chan->sk, len, nb, &err);
+        l2cap_chan_lock(chan);
+
+        if (!skb)
+                return ERR_PTR(err);
+
+        return skb;
+}
+
 static struct l2cap_ops l2cap_chan_ops = {
         .name           = "L2CAP Socket Interface",
         .new_connection = l2cap_sock_new_connection_cb,
         .recv           = l2cap_sock_recv_cb,
         .close          = l2cap_sock_close_cb,
         .state_change   = l2cap_sock_state_change_cb,
+        .alloc_skb      = l2cap_sock_alloc_skb_cb,
 };
 
 static void l2cap_sock_destruct(struct sock *sk)
 {
         BT_DBG("sk %p", sk);
 
+        l2cap_chan_put(l2cap_pi(sk)->chan);
         if (l2cap_pi(sk)->rx_busy_skb) {
                 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
                 l2cap_pi(sk)->rx_busy_skb = NULL;
@@ -931,7 +989,7 @@ static void l2cap_sock_init(struct sock *sk, struct sock *parent)
                 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
 
                 sk->sk_type = parent->sk_type;
-                bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
+                bt_sk(sk)->flags = bt_sk(parent)->flags;
 
                 chan->chan_type = pchan->chan_type;
                 chan->imtu = pchan->imtu;
@@ -969,13 +1027,8 @@ static void l2cap_sock_init(struct sock *sk, struct sock *parent)
                 } else {
                         chan->mode = L2CAP_MODE_BASIC;
                 }
-                chan->max_tx = L2CAP_DEFAULT_MAX_TX;
-                chan->fcs  = L2CAP_FCS_CRC16;
-                chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
-                chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
-                chan->sec_level = BT_SECURITY_LOW;
-                chan->flags = 0;
-                set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
+
+                l2cap_chan_set_defaults(chan);
         }
 
         /* Default config options */
@@ -1004,19 +1057,23 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int p
         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 
         sk->sk_destruct = l2cap_sock_destruct;
-        sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
+        sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
 
         sock_reset_flag(sk, SOCK_ZAPPED);
 
         sk->sk_protocol = proto;
         sk->sk_state = BT_OPEN;
 
-        chan = l2cap_chan_create(sk);
+        chan = l2cap_chan_create();
         if (!chan) {
                 l2cap_sock_kill(sk);
                 return NULL;
         }
 
+        l2cap_chan_hold(chan);
+
+        chan->sk = sk;
+
         l2cap_pi(sk)->chan = chan;
 
         return sk;
diff --git a/net/bluetooth/lib.c b/net/bluetooth/lib.c
index 86a6bed229df..506628876f36 100644
--- a/net/bluetooth/lib.c
+++ b/net/bluetooth/lib.c
@@ -24,6 +24,8 @@
 
 /* Bluetooth kernel library. */
 
+#define pr_fmt(fmt) "Bluetooth: " fmt
+
 #include <linux/module.h>
 
 #include <linux/kernel.h>
@@ -151,7 +153,26 @@ int bt_to_errno(__u16 code)
 }
 EXPORT_SYMBOL(bt_to_errno);
 
-int bt_printk(const char *level, const char *format, ...)
+int bt_info(const char *format, ...)
+{
+        struct va_format vaf;
+        va_list args;
+        int r;
+
+        va_start(args, format);
+
+        vaf.fmt = format;
+        vaf.va = &args;
+
+        r = pr_info("%pV", &vaf);
+
+        va_end(args);
+
+        return r;
+}
+EXPORT_SYMBOL(bt_info);
+
+int bt_err(const char *format, ...)
 {
         struct va_format vaf;
         va_list args;
@@ -162,10 +183,10 @@ int bt_printk(const char *level, const char *format, ...)
         vaf.fmt = format;
         vaf.va = &args;
 
-        r = printk("%sBluetooth: %pV\n", level, &vaf);
+        r = pr_err("%pV", &vaf);
 
         va_end(args);
 
         return r;
 }
-EXPORT_SYMBOL(bt_printk);
+EXPORT_SYMBOL(bt_err);
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index bc8e59dda78e..25d220776079 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1,6 +1,8 @@
 /*
    BlueZ - Bluetooth protocol stack for Linux
+
    Copyright (C) 2010  Nokia Corporation
+   Copyright (C) 2011-2012 Intel Corporation
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License version 2 as
@@ -32,12 +34,92 @@
 #include <net/bluetooth/mgmt.h>
 #include <net/bluetooth/smp.h>
 
-#define MGMT_VERSION    0
+bool enable_hs;
+
+#define MGMT_VERSION    1
 #define MGMT_REVISION   1
 
-#define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
+static const u16 mgmt_commands[] = {
+        MGMT_OP_READ_INDEX_LIST,
+        MGMT_OP_READ_INFO,
+        MGMT_OP_SET_POWERED,
+        MGMT_OP_SET_DISCOVERABLE,
+        MGMT_OP_SET_CONNECTABLE,
+        MGMT_OP_SET_FAST_CONNECTABLE,
+        MGMT_OP_SET_PAIRABLE,
+        MGMT_OP_SET_LINK_SECURITY,
+        MGMT_OP_SET_SSP,
+        MGMT_OP_SET_HS,
+        MGMT_OP_SET_LE,
+        MGMT_OP_SET_DEV_CLASS,
+        MGMT_OP_SET_LOCAL_NAME,
+        MGMT_OP_ADD_UUID,
+        MGMT_OP_REMOVE_UUID,
+        MGMT_OP_LOAD_LINK_KEYS,
+        MGMT_OP_LOAD_LONG_TERM_KEYS,
+        MGMT_OP_DISCONNECT,
+        MGMT_OP_GET_CONNECTIONS,
+        MGMT_OP_PIN_CODE_REPLY,
+        MGMT_OP_PIN_CODE_NEG_REPLY,
+        MGMT_OP_SET_IO_CAPABILITY,
+        MGMT_OP_PAIR_DEVICE,
+        MGMT_OP_CANCEL_PAIR_DEVICE,
+        MGMT_OP_UNPAIR_DEVICE,
+        MGMT_OP_USER_CONFIRM_REPLY,
+        MGMT_OP_USER_CONFIRM_NEG_REPLY,
+        MGMT_OP_USER_PASSKEY_REPLY,
+        MGMT_OP_USER_PASSKEY_NEG_REPLY,
+        MGMT_OP_READ_LOCAL_OOB_DATA,
+        MGMT_OP_ADD_REMOTE_OOB_DATA,
+        MGMT_OP_REMOVE_REMOTE_OOB_DATA,
+        MGMT_OP_START_DISCOVERY,
+        MGMT_OP_STOP_DISCOVERY,
+        MGMT_OP_CONFIRM_NAME,
+        MGMT_OP_BLOCK_DEVICE,
+        MGMT_OP_UNBLOCK_DEVICE,
+        MGMT_OP_SET_DEVICE_ID,
+};
+
+static const u16 mgmt_events[] = {
+        MGMT_EV_CONTROLLER_ERROR,
+        MGMT_EV_INDEX_ADDED,
+        MGMT_EV_INDEX_REMOVED,
+        MGMT_EV_NEW_SETTINGS,
+        MGMT_EV_CLASS_OF_DEV_CHANGED,
+        MGMT_EV_LOCAL_NAME_CHANGED,
+        MGMT_EV_NEW_LINK_KEY,
+        MGMT_EV_NEW_LONG_TERM_KEY,
+        MGMT_EV_DEVICE_CONNECTED,
+        MGMT_EV_DEVICE_DISCONNECTED,
+        MGMT_EV_CONNECT_FAILED,
+        MGMT_EV_PIN_CODE_REQUEST,
+        MGMT_EV_USER_CONFIRM_REQUEST,
+        MGMT_EV_USER_PASSKEY_REQUEST,
+        MGMT_EV_AUTH_FAILED,
+        MGMT_EV_DEVICE_FOUND,
+        MGMT_EV_DISCOVERING,
+        MGMT_EV_DEVICE_BLOCKED,
+        MGMT_EV_DEVICE_UNBLOCKED,
+        MGMT_EV_DEVICE_UNPAIRED,
+};
+
+/*
+ * These LE scan and inquiry parameters were chosen according to LE General
+ * Discovery Procedure specification.
+ */
+#define LE_SCAN_TYPE                    0x01
+#define LE_SCAN_WIN                     0x12
+#define LE_SCAN_INT                     0x12
+#define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
+#define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
+
+#define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
+#define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
+
+#define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 
-#define SERVICE_CACHE_TIMEOUT (5 * 1000)
+#define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
+                                !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 
 struct pending_cmd {
         struct list_head list;
@@ -142,7 +224,7 @@ static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 
         ev = (void *) skb_put(skb, sizeof(*ev));
         ev->status = status;
-        put_unaligned_le16(cmd, &ev->opcode);
+        ev->opcode = cpu_to_le16(cmd);
 
         err = sock_queue_rcv_skb(sk, skb);
         if (err < 0)
@@ -151,8 +233,8 @@ static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
         return err;
 }
 
-static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
-                                                                size_t rp_len)
+static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
+                        void *rp, size_t rp_len)
 {
         struct sk_buff *skb;
         struct mgmt_hdr *hdr;
@@ -172,7 +254,8 @@ static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 
         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
-        put_unaligned_le16(cmd, &ev->opcode);
+        ev->opcode = cpu_to_le16(cmd);
+        ev->status = status;
 
         if (rp)
                 memcpy(ev->data, rp, rp_len);
@@ -181,23 +264,59 @@ static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
         if (err < 0)
                 kfree_skb(skb);
 
-        return err;;
+        return err;
 }
 
-static int read_version(struct sock *sk)
+static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
+                        u16 data_len)
 {
         struct mgmt_rp_read_version rp;
 
         BT_DBG("sock %p", sk);
 
         rp.version = MGMT_VERSION;
-        put_unaligned_le16(MGMT_REVISION, &rp.revision);
+        rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
+
+        return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
+                            sizeof(rp));
+}
+
+static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
+                         u16 data_len)
+{
+        struct mgmt_rp_read_commands *rp;
+        const u16 num_commands = ARRAY_SIZE(mgmt_commands);
+        const u16 num_events = ARRAY_SIZE(mgmt_events);
+        __le16 *opcode;
+        size_t rp_size;
+        int i, err;
+
+        BT_DBG("sock %p", sk);
+
+        rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
+
+        rp = kmalloc(rp_size, GFP_KERNEL);
+        if (!rp)
+                return -ENOMEM;
 
-        return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
-                                                                sizeof(rp));
+        rp->num_commands = __constant_cpu_to_le16(num_commands);
+        rp->num_events = __constant_cpu_to_le16(num_events);
+
+        for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
+                put_unaligned_le16(mgmt_commands[i], opcode);
+
+        for (i = 0; i < num_events; i++, opcode++)
+                put_unaligned_le16(mgmt_events[i], opcode);
+
+        err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
+                           rp_size);
+        kfree(rp);
+
+        return err;
 }
 
-static int read_index_list(struct sock *sk)
+static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
+                           u16 data_len)
 {
         struct mgmt_rp_read_index_list *rp;
         struct list_head *p;
@@ -222,24 +341,21 @@ static int read_index_list(struct sock *sk)
                 return -ENOMEM;
         }
 
-        put_unaligned_le16(count, &rp->num_controllers);
+        rp->num_controllers = cpu_to_le16(count);
 
         i = 0;
         list_for_each_entry(d, &hci_dev_list, list) {
-                if (test_and_clear_bit(HCI_AUTO_OFF, &d->flags))
-                        cancel_delayed_work(&d->power_off);
-
-                if (test_bit(HCI_SETUP, &d->flags))
+                if (test_bit(HCI_SETUP, &d->dev_flags))
                         continue;
 
-                put_unaligned_le16(d->id, &rp->index[i++]);
+                rp->index[i++] = cpu_to_le16(d->id);
                 BT_DBG("Added hci%u", d->id);
         }
 
         read_unlock(&hci_dev_list_lock);
 
-        err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
-                                                                        rp_len);
+        err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
+                           rp_len);
 
         kfree(rp);
 
@@ -264,6 +380,9 @@ static u32 get_supported_settings(struct hci_dev *hdev)
                 settings |= MGMT_SETTING_LINK_SECURITY;
         }
 
+        if (enable_hs)
+                settings |= MGMT_SETTING_HS;
+
         if (hdev->features[4] & LMP_LE)
                 settings |= MGMT_SETTING_LE;
 
@@ -274,47 +393,36 @@ static u32 get_current_settings(struct hci_dev *hdev)
 {
         u32 settings = 0;
 
-        if (test_bit(HCI_UP, &hdev->flags))
+        if (hdev_is_powered(hdev))
                 settings |= MGMT_SETTING_POWERED;
-        else
-                return settings;
 
-        if (test_bit(HCI_PSCAN, &hdev->flags))
+        if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
                 settings |= MGMT_SETTING_CONNECTABLE;
 
-        if (test_bit(HCI_ISCAN, &hdev->flags))
+        if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
                 settings |= MGMT_SETTING_DISCOVERABLE;
 
-        if (test_bit(HCI_PAIRABLE, &hdev->flags))
+        if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
                 settings |= MGMT_SETTING_PAIRABLE;
 
         if (!(hdev->features[4] & LMP_NO_BREDR))
                 settings |= MGMT_SETTING_BREDR;
 
-        if (hdev->host_features[0] & LMP_HOST_LE)
+        if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
                 settings |= MGMT_SETTING_LE;
 
-        if (test_bit(HCI_AUTH, &hdev->flags))
+        if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
                 settings |= MGMT_SETTING_LINK_SECURITY;
 
-        if (hdev->ssp_mode > 0)
+        if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
                 settings |= MGMT_SETTING_SSP;
 
+        if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
+                settings |= MGMT_SETTING_HS;
+
         return settings;
 }
 
-#define EIR_FLAGS               0x01 /* flags */
-#define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
-#define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
-#define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
-#define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
-#define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
-#define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
-#define EIR_NAME_SHORT          0x08 /* shortened local name */
-#define EIR_NAME_COMPLETE       0x09 /* complete local name */
-#define EIR_TX_POWER            0x0A /* transmit power level */
-#define EIR_DEVICE_ID           0x10 /* device ID */
-
 #define PNP_INFO_SVCLASS_ID             0x1200
 
 static u8 bluetooth_base_uuid[] = {
@@ -332,9 +440,7 @@ static u16 get_uuid16(u8 *uuid128)
                         return 0;
         }
 
-        memcpy(&val, &uuid128[12], 4);
-
-        val = le32_to_cpu(val);
+        val = get_unaligned_le32(&uuid128[12]);
         if (val > 0xffff)
                 return 0;
 
@@ -369,6 +475,28 @@ static void create_eir(struct hci_dev *hdev, u8 *data)
                 ptr += (name_len + 2);
         }
 
+        if (hdev->inq_tx_power) {
+                ptr[0] = 2;
+                ptr[1] = EIR_TX_POWER;
+                ptr[2] = (u8) hdev->inq_tx_power;
+
+                eir_len += 3;
+                ptr += 3;
+        }
+
+        if (hdev->devid_source > 0) {
+                ptr[0] = 9;
+                ptr[1] = EIR_DEVICE_ID;
+
+                put_unaligned_le16(hdev->devid_source, ptr + 2);
+                put_unaligned_le16(hdev->devid_vendor, ptr + 4);
+                put_unaligned_le16(hdev->devid_product, ptr + 6);
+                put_unaligned_le16(hdev->devid_version, ptr + 8);
+
+                eir_len += 10;
+                ptr += 10;
+        }
+
         memset(uuid16_list, 0, sizeof(uuid16_list));
 
         /* Group all UUID16 types */
@@ -425,13 +553,16 @@ static int update_eir(struct hci_dev *hdev)
 {
         struct hci_cp_write_eir cp;
 
+        if (!hdev_is_powered(hdev))
+                return 0;
+
         if (!(hdev->features[6] & LMP_EXT_INQ))
                 return 0;
 
-        if (hdev->ssp_mode == 0)
+        if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
                 return 0;
 
-        if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
+        if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
                 return 0;
 
         memset(&cp, 0, sizeof(cp));
@@ -460,10 +591,14 @@ static u8 get_service_classes(struct hci_dev *hdev)
 static int update_class(struct hci_dev *hdev)
 {
         u8 cod[3];
+        int err;
 
         BT_DBG("%s", hdev->name);
 
-        if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
+        if (!hdev_is_powered(hdev))
+                return 0;
+
+        if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
                 return 0;
 
         cod[0] = hdev->minor_class;
@@ -473,15 +608,19 @@ static int update_class(struct hci_dev *hdev)
         if (memcmp(cod, hdev->dev_class, 3) == 0)
                 return 0;
 
-        return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
+        err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
+        if (err == 0)
+                set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
+
+        return err;
 }
 
 static void service_cache_off(struct work_struct *work)
 {
         struct hci_dev *hdev = container_of(work, struct hci_dev,
-                                                        service_cache.work);
+                                            service_cache.work);
 
-        if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags))
+        if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
                 return;
 
         hci_dev_lock(hdev);
@@ -492,43 +631,36 @@ static void service_cache_off(struct work_struct *work)
         hci_dev_unlock(hdev);
 }
 
-static void mgmt_init_hdev(struct hci_dev *hdev)
+static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 {
-        if (!test_and_set_bit(HCI_MGMT, &hdev->flags))
-                INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
+        if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
+                return;
 
-        if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->flags))
-                schedule_delayed_work(&hdev->service_cache,
-                                msecs_to_jiffies(SERVICE_CACHE_TIMEOUT));
+        INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
+
+        /* Non-mgmt controlled devices get this bit set
+         * implicitly so that pairing works for them, however
+         * for mgmt we require user-space to explicitly enable
+         * it
+         */
+        clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 }
 
-static int read_controller_info(struct sock *sk, u16 index)
+static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
+                                void *data, u16 data_len)
 {
         struct mgmt_rp_read_info rp;
-        struct hci_dev *hdev;
-
-        BT_DBG("sock %p hci%u", sk, index);
 
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_READ_INFO,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
-        if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
-                cancel_delayed_work_sync(&hdev->power_off);
+        BT_DBG("sock %p %s", sk, hdev->name);
 
         hci_dev_lock(hdev);
 
-        if (test_and_clear_bit(HCI_PI_MGMT_INIT, &hci_pi(sk)->flags))
-                mgmt_init_hdev(hdev);
-
         memset(&rp, 0, sizeof(rp));
 
         bacpy(&rp.bdaddr, &hdev->bdaddr);
 
         rp.version = hdev->hci_ver;
-
-        put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
+        rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 
         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
@@ -536,11 +668,12 @@ static int read_controller_info(struct sock *sk, u16 index)
         memcpy(rp.dev_class, hdev->dev_class, 3);
 
         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
+        memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
 
-        return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
+        return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
+                            sizeof(rp));
 }
 
 static void mgmt_pending_free(struct pending_cmd *cmd)
@@ -551,8 +684,8 @@ static void mgmt_pending_free(struct pending_cmd *cmd)
 }
 
 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
-                                                        struct hci_dev *hdev,
-                                                        void *data, u16 len)
+                                            struct hci_dev *hdev, void *data,
+                                            u16 len)
 {
         struct pending_cmd *cmd;
 
@@ -581,8 +714,8 @@ static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 }
 
 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
-                                void (*cb)(struct pending_cmd *cmd, void *data),
-                                void *data)
+                                 void (*cb)(struct pending_cmd *cmd, void *data),
+                                 void *data)
 {
         struct list_head *p, *n;
 
@@ -620,40 +753,39 @@ static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 {
         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 
-        return cmd_complete(sk, hdev->id, opcode, &settings, sizeof(settings));
+        return cmd_complete(sk, hdev->id, opcode, 0, &settings,
+                            sizeof(settings));
 }
 
-static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
+static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
+                       u16 len)
 {
-        struct mgmt_mode *cp;
-        struct hci_dev *hdev;
+        struct mgmt_mode *cp = data;
         struct pending_cmd *cmd;
-        int err, up;
-
-        cp = (void *) data;
+        int err;
 
-        BT_DBG("request for hci%u", index);
+        BT_DBG("request for %s", hdev->name);
 
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_SET_POWERED,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        hci_dev_lock(hdev);
 
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_SET_POWERED,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
+                cancel_delayed_work(&hdev->power_off);
 
-        hci_dev_lock(hdev);
+                if (cp->val) {
+                        err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
+                        mgmt_powered(hdev, 1);
+                        goto failed;
+                }
+        }
 
-        up = test_bit(HCI_UP, &hdev->flags);
-        if ((cp->val && up) || (!cp->val && !up)) {
+        if (!!cp->val == hdev_is_powered(hdev)) {
                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
                 goto failed;
         }
 
         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
-                err = cmd_status(sk, index, MGMT_OP_SET_POWERED,
-                                                        MGMT_STATUS_BUSY);
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
+                                 MGMT_STATUS_BUSY);
                 goto failed;
         }
 
@@ -672,49 +804,115 @@ static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 
 failed:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
         return err;
 }
 
-static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
-                                                                        u16 len)
+static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
+                      struct sock *skip_sk)
 {
-        struct mgmt_cp_set_discoverable *cp;
-        struct hci_dev *hdev;
+        struct sk_buff *skb;
+        struct mgmt_hdr *hdr;
+
+        skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
+        if (!skb)
+                return -ENOMEM;
+
+        hdr = (void *) skb_put(skb, sizeof(*hdr));
+        hdr->opcode = cpu_to_le16(event);
+        if (hdev)
+                hdr->index = cpu_to_le16(hdev->id);
+        else
+                hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
+        hdr->len = cpu_to_le16(data_len);
+
+        if (data)
+                memcpy(skb_put(skb, data_len), data, data_len);
+
+        /* Time stamp */
+        __net_timestamp(skb);
+
+        hci_send_to_control(skb, skip_sk);
+        kfree_skb(skb);
+
+        return 0;
+}
+
+static int new_settings(struct hci_dev *hdev, struct sock *skip)
+{
+        __le32 ev;
+
+        ev = cpu_to_le32(get_current_settings(hdev));
+
+        return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
+}
+
+static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
+                            u16 len)
+{
+        struct mgmt_cp_set_discoverable *cp = data;
         struct pending_cmd *cmd;
+        u16 timeout;
         u8 scan;
         int err;
 
-        cp = (void *) data;
+        BT_DBG("request for %s", hdev->name);
 
-        BT_DBG("request for hci%u", index);
-
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        timeout = __le16_to_cpu(cp->timeout);
+        if (!cp->val && timeout > 0)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
+                                  MGMT_STATUS_INVALID_PARAMS);
 
         hci_dev_lock(hdev);
 
-        if (!test_bit(HCI_UP, &hdev->flags)) {
-                err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
-                                                MGMT_STATUS_NOT_POWERED);
+        if (!hdev_is_powered(hdev) && timeout > 0) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
+                                 MGMT_STATUS_NOT_POWERED);
                 goto failed;
         }
 
         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
-                err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
-                                                        MGMT_STATUS_BUSY);
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
+                                 MGMT_STATUS_BUSY);
+                goto failed;
+        }
+
+        if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
+                                 MGMT_STATUS_REJECTED);
+                goto failed;
+        }
+
+        if (!hdev_is_powered(hdev)) {
+                bool changed = false;
+
+                if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
+                        change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
+                        changed = true;
+                }
+
+                err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
+                if (err < 0)
+                        goto failed;
+
+                if (changed)
+                        err = new_settings(hdev, sk);
+
                 goto failed;
         }
 
-        if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
-                                        test_bit(HCI_PSCAN, &hdev->flags)) {
+        if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
+                if (hdev->discov_timeout > 0) {
+                        cancel_delayed_work(&hdev->discov_off);
+                        hdev->discov_timeout = 0;
+                }
+
+                if (cp->val && timeout > 0) {
+                        hdev->discov_timeout = timeout;
+                        queue_delayed_work(hdev->workqueue, &hdev->discov_off,
+                                msecs_to_jiffies(hdev->discov_timeout * 1000));
+                }
+
                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
                 goto failed;
         }
@@ -737,53 +935,56 @@ static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
                 mgmt_pending_remove(cmd);
 
         if (cp->val)
-                hdev->discov_timeout = get_unaligned_le16(&cp->timeout);
+                hdev->discov_timeout = timeout;
 
 failed:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
-
         return err;
 }
 
-static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
-                                                                        u16 len)
+static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
+                           u16 len)
 {
-        struct mgmt_mode *cp;
-        struct hci_dev *hdev;
+        struct mgmt_mode *cp = data;
         struct pending_cmd *cmd;
         u8 scan;
         int err;
 
-        cp = (void *) data;
+        BT_DBG("request for %s", hdev->name);
 
-        BT_DBG("request for hci%u", index);
+        hci_dev_lock(hdev);
 
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        if (!hdev_is_powered(hdev)) {
+                bool changed = false;
 
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
-                                                MGMT_STATUS_INVALID_PARAMS);
+                if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
+                        changed = true;
 
-        hci_dev_lock(hdev);
+                if (cp->val) {
+                        set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
+                } else {
+                        clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
+                        clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
+                }
+
+                err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
+                if (err < 0)
+                        goto failed;
+
+                if (changed)
+                        err = new_settings(hdev, sk);
 
-        if (!test_bit(HCI_UP, &hdev->flags)) {
-                err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
-                                                MGMT_STATUS_NOT_POWERED);
                 goto failed;
         }
 
         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
-                err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
-                                                        MGMT_STATUS_BUSY);
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
+                                 MGMT_STATUS_BUSY);
                 goto failed;
         }
 
-        if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
+        if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
                 goto failed;
         }
@@ -794,116 +995,280 @@ static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
                 goto failed;
         }
 
-        if (cp->val)
+        if (cp->val) {
                 scan = SCAN_PAGE;
-        else
+        } else {
                 scan = 0;
 
+                if (test_bit(HCI_ISCAN, &hdev->flags) &&
+                                                hdev->discov_timeout > 0)
+                        cancel_delayed_work(&hdev->discov_off);
+        }
+
         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
         if (err < 0)
                 mgmt_pending_remove(cmd);
 
 failed:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
-
         return err;
 }
 
-static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
-                                        u16 data_len, struct sock *skip_sk)
+static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
+                        u16 len)
 {
-        struct sk_buff *skb;
-        struct mgmt_hdr *hdr;
+        struct mgmt_mode *cp = data;
+        int err;
 
-        skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
-        if (!skb)
-                return -ENOMEM;
+        BT_DBG("request for %s", hdev->name);
 
-        bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
+        hci_dev_lock(hdev);
 
-        hdr = (void *) skb_put(skb, sizeof(*hdr));
-        hdr->opcode = cpu_to_le16(event);
-        if (hdev)
-                hdr->index = cpu_to_le16(hdev->id);
+        if (cp->val)
+                set_bit(HCI_PAIRABLE, &hdev->dev_flags);
         else
-                hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
-        hdr->len = cpu_to_le16(data_len);
+                clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 
-        if (data)
-                memcpy(skb_put(skb, data_len), data, data_len);
+        err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
+        if (err < 0)
+                goto failed;
 
-        hci_send_to_sock(NULL, skb, skip_sk);
-        kfree_skb(skb);
+        err = new_settings(hdev, sk);
 
-        return 0;
+failed:
+        hci_dev_unlock(hdev);
+        return err;
 }
 
-static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
-                                                                        u16 len)
+static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
+                             u16 len)
 {
-        struct mgmt_mode *cp;
-        struct hci_dev *hdev;
-        __le32 ev;
+        struct mgmt_mode *cp = data;
+        struct pending_cmd *cmd;
+        u8 val;
         int err;
 
-        cp = (void *) data;
+        BT_DBG("request for %s", hdev->name);
 
-        BT_DBG("request for hci%u", index);
+        hci_dev_lock(hdev);
 
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        if (!hdev_is_powered(hdev)) {
+                bool changed = false;
 
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
-                                                MGMT_STATUS_INVALID_PARAMS);
+                if (!!cp->val != test_bit(HCI_LINK_SECURITY,
+                                                        &hdev->dev_flags)) {
+                        change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
+                        changed = true;
+                }
 
-        hci_dev_lock(hdev);
+                err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
+                if (err < 0)
+                        goto failed;
 
-        if (cp->val)
-                set_bit(HCI_PAIRABLE, &hdev->flags);
-        else
-                clear_bit(HCI_PAIRABLE, &hdev->flags);
+                if (changed)
+                        err = new_settings(hdev, sk);
 
-        err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
-        if (err < 0)
                 goto failed;
+        }
 
-        ev = cpu_to_le32(get_current_settings(hdev));
+        if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
+                                 MGMT_STATUS_BUSY);
+                goto failed;
+        }
+
+        val = !!cp->val;
+
+        if (test_bit(HCI_AUTH, &hdev->flags) == val) {
+                err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
+                goto failed;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto failed;
+        }
 
-        err = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), sk);
+        err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
+        if (err < 0) {
+                mgmt_pending_remove(cmd);
+                goto failed;
+        }
 
 failed:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
+        return err;
+}
+
+static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
+{
+        struct mgmt_mode *cp = data;
+        struct pending_cmd *cmd;
+        u8 val;
+        int err;
+
+        BT_DBG("request for %s", hdev->name);
+
+        hci_dev_lock(hdev);
+
+        if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
+                                 MGMT_STATUS_NOT_SUPPORTED);
+                goto failed;
+        }
+
+        val = !!cp->val;
+
+        if (!hdev_is_powered(hdev)) {
+                bool changed = false;
+
+                if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
+                        change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
+                        changed = true;
+                }
+
+                err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
+                if (err < 0)
+                        goto failed;
+
+                if (changed)
+                        err = new_settings(hdev, sk);
+
+                goto failed;
+        }
+
+        if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
+                                 MGMT_STATUS_BUSY);
+                goto failed;
+        }
+
+        if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
+                err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
+                goto failed;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto failed;
+        }
+
+        err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
+        if (err < 0) {
+                mgmt_pending_remove(cmd);
+                goto failed;
+        }
 
+failed:
+        hci_dev_unlock(hdev);
         return err;
 }
 
-static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
+static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 {
-        struct mgmt_cp_add_uuid *cp;
-        struct hci_dev *hdev;
-        struct bt_uuid *uuid;
+        struct mgmt_mode *cp = data;
+
+        BT_DBG("request for %s", hdev->name);
+
+        if (!enable_hs)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+                                  MGMT_STATUS_NOT_SUPPORTED);
+
+        if (cp->val)
+                set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
+        else
+                clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
+
+        return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
+}
+
+static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
+{
+        struct mgmt_mode *cp = data;
+        struct hci_cp_write_le_host_supported hci_cp;
+        struct pending_cmd *cmd;
         int err;
+        u8 val, enabled;
 
-        cp = (void *) data;
+        BT_DBG("request for %s", hdev->name);
 
-        BT_DBG("request for hci%u", index);
+        hci_dev_lock(hdev);
 
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_ADD_UUID,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        if (!(hdev->features[4] & LMP_LE)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
+                                 MGMT_STATUS_NOT_SUPPORTED);
+                goto unlock;
+        }
+
+        val = !!cp->val;
+        enabled = !!(hdev->host_features[0] & LMP_HOST_LE);
+
+        if (!hdev_is_powered(hdev) || val == enabled) {
+                bool changed = false;
+
+                if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
+                        change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
+                        changed = true;
+                }
+
+                err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
+                if (err < 0)
+                        goto unlock;
+
+                if (changed)
+                        err = new_settings(hdev, sk);
 
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_ADD_UUID,
-                                                MGMT_STATUS_INVALID_PARAMS);
+                goto unlock;
+        }
+
+        if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
+                                 MGMT_STATUS_BUSY);
+                goto unlock;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto unlock;
+        }
+
+        memset(&hci_cp, 0, sizeof(hci_cp));
+
+        if (val) {
+                hci_cp.le = val;
+                hci_cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
+        }
+
+        err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
+                           &hci_cp);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+unlock:
+        hci_dev_unlock(hdev);
+        return err;
+}
+
+static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
+{
+        struct mgmt_cp_add_uuid *cp = data;
+        struct pending_cmd *cmd;
+        struct bt_uuid *uuid;
+        int err;
+
+        BT_DBG("request for %s", hdev->name);
 
         hci_dev_lock(hdev);
 
+        if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
+                                 MGMT_STATUS_BUSY);
+                goto failed;
+        }
+
         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
         if (!uuid) {
                 err = -ENOMEM;
@@ -923,41 +1288,63 @@ static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
         if (err < 0)
                 goto failed;
 
-        err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
+        if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
+                err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
+                                   hdev->dev_class, 3);
+                goto failed;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
+        if (!cmd)
+                err = -ENOMEM;
 
 failed:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
-
         return err;
 }
 
-static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
+static bool enable_service_cache(struct hci_dev *hdev)
 {
-        struct list_head *p, *n;
-        struct mgmt_cp_remove_uuid *cp;
-        struct hci_dev *hdev;
-        u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
-        int err, found;
+        if (!hdev_is_powered(hdev))
+                return false;
 
-        cp = (void *) data;
+        if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
+                schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
+                return true;
+        }
 
-        BT_DBG("request for hci%u", index);
+        return false;
+}
 
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
-                                                MGMT_STATUS_INVALID_PARAMS);
+static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
+                                                                u16 len)
+{
+        struct mgmt_cp_remove_uuid *cp = data;
+        struct pending_cmd *cmd;
+        struct list_head *p, *n;
+        u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
+        int err, found;
 
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        BT_DBG("request for %s", hdev->name);
 
         hci_dev_lock(hdev);
 
+        if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
+                                 MGMT_STATUS_BUSY);
+                goto unlock;
+        }
+
         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
                 err = hci_uuids_clear(hdev);
-                goto unlock;
+
+                if (enable_service_cache(hdev)) {
+                        err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
+                                           0, hdev->dev_class, 3);
+                        goto unlock;
+                }
+
+                goto update_class;
         }
 
         found = 0;
@@ -973,11 +1360,12 @@ static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
         }
 
         if (found == 0) {
-                err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
-                                                MGMT_STATUS_INVALID_PARAMS);
+                err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
+                                 MGMT_STATUS_INVALID_PARAMS);
                 goto unlock;
         }
 
+update_class:
         err = update_class(hdev);
         if (err < 0)
                 goto unlock;
@@ -986,41 +1374,48 @@ static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
         if (err < 0)
                 goto unlock;
 
-        err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
+        if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
+                err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
+                                   hdev->dev_class, 3);
+                goto unlock;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
+        if (!cmd)
+                err = -ENOMEM;
 
 unlock:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
-
         return err;
 }
 
-static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
-                                                                        u16 len)
+static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
+                         u16 len)
 {
-        struct hci_dev *hdev;
-        struct mgmt_cp_set_dev_class *cp;
+        struct mgmt_cp_set_dev_class *cp = data;
+        struct pending_cmd *cmd;
         int err;
 
-        cp = (void *) data;
-
-        BT_DBG("request for hci%u", index);
-
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        BT_DBG("request for %s", hdev->name);
 
         hci_dev_lock(hdev);
 
+        if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
+                                 MGMT_STATUS_BUSY);
+                goto unlock;
+        }
+
         hdev->major_class = cp->major;
         hdev->minor_class = cp->minor;
 
-        if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags)) {
+        if (!hdev_is_powered(hdev)) {
+                err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
+                                   hdev->dev_class, 3);
+                goto unlock;
+        }
+
+        if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
                 hci_dev_unlock(hdev);
                 cancel_delayed_work_sync(&hdev->service_cache);
                 hci_dev_lock(hdev);
@@ -1028,148 +1423,155 @@ static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
         }
 
         err = update_class(hdev);
+        if (err < 0)
+                goto unlock;
 
-        if (err == 0)
-                err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
+        if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
+                err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
+                                   hdev->dev_class, 3);
+                goto unlock;
+        }
 
-        hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
+        cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
+        if (!cmd)
+                err = -ENOMEM;
 
+unlock:
+        hci_dev_unlock(hdev);
         return err;
 }
 
-static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
+static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
                                                                 u16 len)
 {
-        struct hci_dev *hdev;
-        struct mgmt_cp_load_link_keys *cp;
+        struct mgmt_cp_load_link_keys *cp = data;
         u16 key_count, expected_len;
         int i;
 
-        cp = (void *) data;
-
-        if (len < sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
-        key_count = get_unaligned_le16(&cp->key_count);
+        key_count = __le16_to_cpu(cp->key_count);
 
         expected_len = sizeof(*cp) + key_count *
                                         sizeof(struct mgmt_link_key_info);
         if (expected_len != len) {
                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
                                                         len, expected_len);
-                return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
-                                                MGMT_STATUS_INVALID_PARAMS);
+                return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
+                                  MGMT_STATUS_INVALID_PARAMS);
         }
 
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
-        BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
+        BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
                                                                 key_count);
 
         hci_dev_lock(hdev);
 
         hci_link_keys_clear(hdev);
 
-        set_bit(HCI_LINK_KEYS, &hdev->flags);
+        set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
 
         if (cp->debug_keys)
-                set_bit(HCI_DEBUG_KEYS, &hdev->flags);
+                set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
         else
-                clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
+                clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
 
         for (i = 0; i < key_count; i++) {
                 struct mgmt_link_key_info *key = &cp->keys[i];
 
-                hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
-                                                                key->pin_len);
+                hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
+                                 key->type, key->pin_len);
         }
 
-        cmd_complete(sk, index, MGMT_OP_LOAD_LINK_KEYS, NULL, 0);
+        cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
 
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
 
         return 0;
 }
 
-static int remove_keys(struct sock *sk, u16 index, unsigned char *data,
-                                                                u16 len)
+static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                           u8 addr_type, struct sock *skip_sk)
 {
-        struct hci_dev *hdev;
-        struct mgmt_cp_remove_keys *cp;
-        struct mgmt_rp_remove_keys rp;
+        struct mgmt_ev_device_unpaired ev;
+
+        bacpy(&ev.addr.bdaddr, bdaddr);
+        ev.addr.type = addr_type;
+
+        return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
+                          skip_sk);
+}
+
+static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
+                         u16 len)
+{
+        struct mgmt_cp_unpair_device *cp = data;
+        struct mgmt_rp_unpair_device rp;
         struct hci_cp_disconnect dc;
         struct pending_cmd *cmd;
         struct hci_conn *conn;
         int err;
 
-        cp = (void *) data;
-
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
         hci_dev_lock(hdev);
 
         memset(&rp, 0, sizeof(rp));
-        bacpy(&rp.bdaddr, &cp->bdaddr);
-        rp.status = MGMT_STATUS_FAILED;
+        bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
+        rp.addr.type = cp->addr.type;
 
-        err = hci_remove_link_key(hdev, &cp->bdaddr);
-        if (err < 0) {
-                rp.status = MGMT_STATUS_NOT_PAIRED;
+        if (!hdev_is_powered(hdev)) {
+                err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
+                                   MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
                 goto unlock;
         }
 
-        if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect) {
-                err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
-                                                                sizeof(rp));
+        if (cp->addr.type == BDADDR_BREDR)
+                err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
+        else
+                err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
+
+        if (err < 0) {
+                err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
+                                   MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
                 goto unlock;
         }
 
-        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
+        if (cp->disconnect) {
+                if (cp->addr.type == BDADDR_BREDR)
+                        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
+                                                        &cp->addr.bdaddr);
+                else
+                        conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
+                                                        &cp->addr.bdaddr);
+        } else {
+                conn = NULL;
+        }
+
         if (!conn) {
-                err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
-                                                                sizeof(rp));
+                err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
+                                   &rp, sizeof(rp));
+                device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
                 goto unlock;
         }
 
-        cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_KEYS, hdev, cp, sizeof(*cp));
+        cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
+                               sizeof(*cp));
         if (!cmd) {
                 err = -ENOMEM;
                 goto unlock;
         }
 
-        put_unaligned_le16(conn->handle, &dc.handle);
+        dc.handle = cpu_to_le16(conn->handle);
         dc.reason = 0x13; /* Remote User Terminated Connection */
         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
         if (err < 0)
                 mgmt_pending_remove(cmd);
 
 unlock:
-        if (err < 0)
-                err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
-                                                                sizeof(rp));
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
-
         return err;
 }
 
-static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
+static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
+                      u16 len)
 {
-        struct hci_dev *hdev;
-        struct mgmt_cp_disconnect *cp;
+        struct mgmt_cp_disconnect *cp = data;
         struct hci_cp_disconnect dc;
         struct pending_cmd *cmd;
         struct hci_conn *conn;
@@ -1177,38 +1579,28 @@ static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
 
         BT_DBG("");
 
-        cp = (void *) data;
-
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_DISCONNECT,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_DISCONNECT,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
         hci_dev_lock(hdev);
 
         if (!test_bit(HCI_UP, &hdev->flags)) {
-                err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
-                                                MGMT_STATUS_NOT_POWERED);
+                err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
+                                 MGMT_STATUS_NOT_POWERED);
                 goto failed;
         }
 
         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
-                err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
-                                                        MGMT_STATUS_BUSY);
+                err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
+                                 MGMT_STATUS_BUSY);
                 goto failed;
         }
 
-        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
-        if (!conn)
-                conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
+        if (cp->addr.type == BDADDR_BREDR)
+                conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
+        else
+                conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
 
         if (!conn) {
-                err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
-                                                MGMT_STATUS_NOT_CONNECTED);
+                err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
+                                 MGMT_STATUS_NOT_CONNECTED);
                 goto failed;
         }
 
@@ -1218,7 +1610,7 @@ static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
                 goto failed;
         }
 
-        put_unaligned_le16(conn->handle, &dc.handle);
+        dc.handle = cpu_to_le16(conn->handle);
         dc.reason = 0x13; /* Remote User Terminated Connection */
 
         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
@@ -1227,151 +1619,142 @@ static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
 
 failed:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
-
         return err;
 }
 
-static u8 link_to_mgmt(u8 link_type, u8 addr_type)
+static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
 {
         switch (link_type) {
         case LE_LINK:
                 switch (addr_type) {
                 case ADDR_LE_DEV_PUBLIC:
-                        return MGMT_ADDR_LE_PUBLIC;
-                case ADDR_LE_DEV_RANDOM:
-                        return MGMT_ADDR_LE_RANDOM;
+                        return BDADDR_LE_PUBLIC;
+
                 default:
-                        return MGMT_ADDR_INVALID;
+                        /* Fallback to LE Random address type */
+                        return BDADDR_LE_RANDOM;
                 }
-        case ACL_LINK:
-                return MGMT_ADDR_BREDR;
+
         default:
-                return MGMT_ADDR_INVALID;
+                /* Fallback to BR/EDR type */
+                return BDADDR_BREDR;
         }
 }
 
-static int get_connections(struct sock *sk, u16 index)
+static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
+                           u16 data_len)
 {
         struct mgmt_rp_get_connections *rp;
-        struct hci_dev *hdev;
         struct hci_conn *c;
-        struct list_head *p;
         size_t rp_len;
-        u16 count;
-        int i, err;
+        int err;
+        u16 i;
 
         BT_DBG("");
 
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
         hci_dev_lock(hdev);
 
-        count = 0;
-        list_for_each(p, &hdev->conn_hash.list) {
-                count++;
+        if (!hdev_is_powered(hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
+                                 MGMT_STATUS_NOT_POWERED);
+                goto unlock;
+        }
+
+        i = 0;
+        list_for_each_entry(c, &hdev->conn_hash.list, list) {
+                if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
+                        i++;
         }
 
-        rp_len = sizeof(*rp) + (count * sizeof(struct mgmt_addr_info));
+        rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
         rp = kmalloc(rp_len, GFP_ATOMIC);
         if (!rp) {
                 err = -ENOMEM;
                 goto unlock;
         }
 
-        put_unaligned_le16(count, &rp->conn_count);
-
         i = 0;
         list_for_each_entry(c, &hdev->conn_hash.list, list) {
+                if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
+                        continue;
                 bacpy(&rp->addr[i].bdaddr, &c->dst);
-                rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
-                if (rp->addr[i].type == MGMT_ADDR_INVALID)
+                rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
+                if (c->type == SCO_LINK || c->type == ESCO_LINK)
                         continue;
                 i++;
         }
 
+        rp->conn_count = cpu_to_le16(i);
+
         /* Recalculate length in case of filtered SCO connections, etc */
         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
 
-        err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
+        err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
+                           rp_len);
 
-unlock:
         kfree(rp);
+
+unlock:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
         return err;
 }
 
-static int send_pin_code_neg_reply(struct sock *sk, u16 index,
-                struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
+static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
+                                   struct mgmt_cp_pin_code_neg_reply *cp)
 {
         struct pending_cmd *cmd;
         int err;
 
         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
-                                                                sizeof(*cp));
+                               sizeof(*cp));
         if (!cmd)
                 return -ENOMEM;
 
-        err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
-                                                                &cp->bdaddr);
+        err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
+                           sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
         if (err < 0)
                 mgmt_pending_remove(cmd);
 
         return err;
 }
 
-static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
-                                                                        u16 len)
+static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
+                          u16 len)
 {
-        struct hci_dev *hdev;
         struct hci_conn *conn;
-        struct mgmt_cp_pin_code_reply *cp;
-        struct mgmt_cp_pin_code_neg_reply ncp;
+        struct mgmt_cp_pin_code_reply *cp = data;
         struct hci_cp_pin_code_reply reply;
         struct pending_cmd *cmd;
         int err;
 
         BT_DBG("");
 
-        cp = (void *) data;
-
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
         hci_dev_lock(hdev);
 
-        if (!test_bit(HCI_UP, &hdev->flags)) {
-                err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
-                                                MGMT_STATUS_NOT_POWERED);
+        if (!hdev_is_powered(hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
+                                 MGMT_STATUS_NOT_POWERED);
                 goto failed;
         }
 
-        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
         if (!conn) {
-                err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
-                                                MGMT_STATUS_NOT_CONNECTED);
+                err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
+                                 MGMT_STATUS_NOT_CONNECTED);
                 goto failed;
         }
 
         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
-                bacpy(&ncp.bdaddr, &cp->bdaddr);
+                struct mgmt_cp_pin_code_neg_reply ncp;
+
+                memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
 
                 BT_ERR("PIN code is not 16 bytes long");
 
-                err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
+                err = send_pin_code_neg_reply(sk, hdev, &ncp);
                 if (err >= 0)
-                        err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
-                                                MGMT_STATUS_INVALID_PARAMS);
+                        err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
+                                         MGMT_STATUS_INVALID_PARAMS);
 
                 goto failed;
         }
@@ -1382,7 +1765,7 @@ static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
                 goto failed;
         }
 
-        bacpy(&reply.bdaddr, &cp->bdaddr);
+        bacpy(&reply.bdaddr, &cp->addr.bdaddr);
         reply.pin_len = cp->pin_len;
         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
 
@@ -1392,67 +1775,39 @@ static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
 
 failed:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
-
         return err;
 }
 
-static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
-                                                                        u16 len)
+static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
+                              void *data, u16 len)
 {
-        struct hci_dev *hdev;
-        struct mgmt_cp_pin_code_neg_reply *cp;
+        struct mgmt_cp_pin_code_neg_reply *cp = data;
         int err;
 
         BT_DBG("");
 
-        cp = (void *) data;
-
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
         hci_dev_lock(hdev);
 
-        if (!test_bit(HCI_UP, &hdev->flags)) {
-                err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
-                                                MGMT_STATUS_NOT_POWERED);
+        if (!hdev_is_powered(hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
+                                 MGMT_STATUS_NOT_POWERED);
                 goto failed;
         }
 
-        err = send_pin_code_neg_reply(sk, index, hdev, cp);
+        err = send_pin_code_neg_reply(sk, hdev, cp);
 
 failed:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
-
         return err;
 }
 
-static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
-                                                                        u16 len)
+static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
+                             u16 len)
 {
-        struct hci_dev *hdev;
-        struct mgmt_cp_set_io_capability *cp;
+        struct mgmt_cp_set_io_capability *cp = data;
 
         BT_DBG("");
 
-        cp = (void *) data;
-
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
         hci_dev_lock(hdev);
 
         hdev->io_capability = cp->io_capability;
@@ -1461,9 +1816,9 @@ static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
                                                         hdev->io_capability);
 
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
 
-        return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
+        return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
+                            0);
 }
 
 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
@@ -1490,10 +1845,10 @@ static void pairing_complete(struct pending_cmd *cmd, u8 status)
         struct hci_conn *conn = cmd->user_data;
 
         bacpy(&rp.addr.bdaddr, &conn->dst);
-        rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
-        rp.status = status;
+        rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
 
-        cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
+        cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
+                     &rp, sizeof(rp));
 
         /* So we don't get further callbacks for this connection */
         conn->connect_cfm_cb = NULL;
@@ -1515,13 +1870,13 @@ static void pairing_complete_cb(struct hci_conn *conn, u8 status)
         if (!cmd)
                 BT_DBG("Unable to find a pending command");
         else
-                pairing_complete(cmd, status);
+                pairing_complete(cmd, mgmt_status(status));
 }
 
-static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
+static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
+                       u16 len)
 {
-        struct hci_dev *hdev;
-        struct mgmt_cp_pair_device *cp;
+        struct mgmt_cp_pair_device *cp = data;
         struct mgmt_rp_pair_device rp;
         struct pending_cmd *cmd;
         u8 sec_level, auth_type;
@@ -1530,48 +1885,42 @@ static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
 
         BT_DBG("");
 
-        cp = (void *) data;
-
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
         hci_dev_lock(hdev);
 
+        if (!hdev_is_powered(hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
+                                 MGMT_STATUS_NOT_POWERED);
+                goto unlock;
+        }
+
         sec_level = BT_SECURITY_MEDIUM;
         if (cp->io_cap == 0x03)
                 auth_type = HCI_AT_DEDICATED_BONDING;
         else
                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
 
-        if (cp->addr.type == MGMT_ADDR_BREDR)
-                conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, sec_level,
-                                                                auth_type);
+        if (cp->addr.type == BDADDR_BREDR)
+                conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
+                                   cp->addr.type, sec_level, auth_type);
         else
-                conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, sec_level,
-                                                                auth_type);
+                conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
+                                   cp->addr.type, sec_level, auth_type);
 
         memset(&rp, 0, sizeof(rp));
         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
         rp.addr.type = cp->addr.type;
 
         if (IS_ERR(conn)) {
-                rp.status = -PTR_ERR(conn);
-                err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
-                                                        &rp, sizeof(rp));
+                err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
+                                   MGMT_STATUS_CONNECT_FAILED, &rp,
+                                   sizeof(rp));
                 goto unlock;
         }
 
         if (conn->connect_cfm_cb) {
                 hci_conn_put(conn);
-                rp.status = EBUSY;
-                err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
-                                                        &rp, sizeof(rp));
+                err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
+                                   MGMT_STATUS_BUSY, &rp, sizeof(rp));
                 goto unlock;
         }
 
@@ -1583,7 +1932,7 @@ static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
         }
 
         /* For LE, just connecting isn't a proof that the pairing finished */
-        if (cp->addr.type == MGMT_ADDR_BREDR)
+        if (cp->addr.type == BDADDR_BREDR)
                 conn->connect_cfm_cb = pairing_complete_cb;
 
         conn->security_cfm_cb = pairing_complete_cb;
@@ -1599,58 +1948,88 @@ static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
 
 unlock:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
-
         return err;
 }
 
-static int user_pairing_resp(struct sock *sk, u16 index, bdaddr_t *bdaddr,
-                                        u16 mgmt_op, u16 hci_op, __le32 passkey)
+static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
+                              u16 len)
 {
+        struct mgmt_addr_info *addr = data;
         struct pending_cmd *cmd;
-        struct hci_dev *hdev;
         struct hci_conn *conn;
         int err;
 
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, mgmt_op,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        BT_DBG("");
 
         hci_dev_lock(hdev);
 
-        if (!test_bit(HCI_UP, &hdev->flags)) {
-                err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_NOT_POWERED);
+        if (!hdev_is_powered(hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
+                                 MGMT_STATUS_NOT_POWERED);
+                goto unlock;
+        }
+
+        cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
+        if (!cmd) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
+                                 MGMT_STATUS_INVALID_PARAMS);
+                goto unlock;
+        }
+
+        conn = cmd->user_data;
+
+        if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
+                                 MGMT_STATUS_INVALID_PARAMS);
+                goto unlock;
+        }
+
+        pairing_complete(cmd, MGMT_STATUS_CANCELLED);
+
+        err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
+                           addr, sizeof(*addr));
+unlock:
+        hci_dev_unlock(hdev);
+        return err;
+}
+
+static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
+                             bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
+                             u16 hci_op, __le32 passkey)
+{
+        struct pending_cmd *cmd;
+        struct hci_conn *conn;
+        int err;
+
+        hci_dev_lock(hdev);
+
+        if (!hdev_is_powered(hdev)) {
+                err = cmd_status(sk, hdev->id, mgmt_op,
+                                 MGMT_STATUS_NOT_POWERED);
                 goto done;
         }
 
-        /*
-         * Check for an existing ACL link, if present pair via
-         * HCI commands.
-         *
-         * If no ACL link is present, check for an LE link and if
-         * present, pair via the SMP engine.
-         *
-         * If neither ACL nor LE links are present, fail with error.
-         */
-        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
-        if (!conn) {
+        if (type == BDADDR_BREDR)
+                conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
+        else
                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
-                if (!conn) {
-                        err = cmd_status(sk, index, mgmt_op,
-                                                MGMT_STATUS_NOT_CONNECTED);
-                        goto done;
-                }
 
+        if (!conn) {
+                err = cmd_status(sk, hdev->id, mgmt_op,
+                                 MGMT_STATUS_NOT_CONNECTED);
+                goto done;
+        }
+
+        if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
                 /* Continue with pairing via SMP */
                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
 
                 if (!err)
-                        err = cmd_status(sk, index, mgmt_op,
-                                                        MGMT_STATUS_SUCCESS);
+                        err = cmd_status(sk, hdev->id, mgmt_op,
+                                         MGMT_STATUS_SUCCESS);
                 else
-                        err = cmd_status(sk, index, mgmt_op,
-                                                        MGMT_STATUS_FAILED);
+                        err = cmd_status(sk, hdev->id, mgmt_op,
+                                         MGMT_STATUS_FAILED);
 
                 goto done;
         }
@@ -1676,94 +2055,96 @@ static int user_pairing_resp(struct sock *sk, u16 index, bdaddr_t *bdaddr,
 
 done:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
-
         return err;
 }
 
-static int user_confirm_reply(struct sock *sk, u16 index, void *data, u16 len)
+static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
+                              u16 len)
 {
-        struct mgmt_cp_user_confirm_reply *cp = (void *) data;
+        struct mgmt_cp_user_confirm_reply *cp = data;
 
         BT_DBG("");
 
         if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_REPLY,
-                                                MGMT_STATUS_INVALID_PARAMS);
+                return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
+                                  MGMT_STATUS_INVALID_PARAMS);
 
-        return user_pairing_resp(sk, index, &cp->bdaddr,
-                        MGMT_OP_USER_CONFIRM_REPLY,
-                        HCI_OP_USER_CONFIRM_REPLY, 0);
+        return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
+                                 MGMT_OP_USER_CONFIRM_REPLY,
+                                 HCI_OP_USER_CONFIRM_REPLY, 0);
 }
 
-static int user_confirm_neg_reply(struct sock *sk, u16 index, void *data,
-                                                                        u16 len)
+static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
+                                  void *data, u16 len)
 {
         struct mgmt_cp_user_confirm_neg_reply *cp = data;
 
         BT_DBG("");
 
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_NEG_REPLY,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
-        return user_pairing_resp(sk, index, &cp->bdaddr,
-                        MGMT_OP_USER_CONFIRM_NEG_REPLY,
-                        HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
+        return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
+                                 MGMT_OP_USER_CONFIRM_NEG_REPLY,
+                                 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
 }
 
-static int user_passkey_reply(struct sock *sk, u16 index, void *data, u16 len)
+static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
+                              u16 len)
 {
-        struct mgmt_cp_user_passkey_reply *cp = (void *) data;
+        struct mgmt_cp_user_passkey_reply *cp = data;
 
         BT_DBG("");
 
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_REPLY,
-                                                                        EINVAL);
-
-        return user_pairing_resp(sk, index, &cp->bdaddr,
-                        MGMT_OP_USER_PASSKEY_REPLY,
-                        HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
+        return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
+                                 MGMT_OP_USER_PASSKEY_REPLY,
+                                 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
 }
 
-static int user_passkey_neg_reply(struct sock *sk, u16 index, void *data,
-                                                                        u16 len)
+static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
+                                  void *data, u16 len)
 {
-        struct mgmt_cp_user_passkey_neg_reply *cp = (void *) data;
+        struct mgmt_cp_user_passkey_neg_reply *cp = data;
 
         BT_DBG("");
 
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_NEG_REPLY,
-                                                                        EINVAL);
+        return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
+                                 MGMT_OP_USER_PASSKEY_NEG_REPLY,
+                                 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
+}
+
+static int update_name(struct hci_dev *hdev, const char *name)
+{
+        struct hci_cp_write_local_name cp;
 
-        return user_pairing_resp(sk, index, &cp->bdaddr,
-                        MGMT_OP_USER_PASSKEY_NEG_REPLY,
-                        HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
+        memcpy(cp.name, name, sizeof(cp.name));
+
+        return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
 }
 
-static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
-                                                                u16 len)
+static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
+                          u16 len)
 {
-        struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
-        struct hci_cp_write_local_name hci_cp;
-        struct hci_dev *hdev;
+        struct mgmt_cp_set_local_name *cp = data;
         struct pending_cmd *cmd;
         int err;
 
         BT_DBG("");
 
-        if (len != sizeof(*mgmt_cp))
-                return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        hci_dev_lock(hdev);
 
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
 
-        hci_dev_lock(hdev);
+        if (!hdev_is_powered(hdev)) {
+                memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
+
+                err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
+                                   data, len);
+                if (err < 0)
+                        goto failed;
+
+                err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
+                                 sk);
+
+                goto failed;
+        }
 
         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
         if (!cmd) {
@@ -1771,49 +2152,40 @@ static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
                 goto failed;
         }
 
-        memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
-        err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
-                                                                &hci_cp);
+        err = update_name(hdev, cp->name);
         if (err < 0)
                 mgmt_pending_remove(cmd);
 
 failed:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
-
         return err;
 }
 
-static int read_local_oob_data(struct sock *sk, u16 index)
+static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
+                               void *data, u16 data_len)
 {
-        struct hci_dev *hdev;
         struct pending_cmd *cmd;
         int err;
 
-        BT_DBG("hci%u", index);
-
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        BT_DBG("%s", hdev->name);
 
         hci_dev_lock(hdev);
 
-        if (!test_bit(HCI_UP, &hdev->flags)) {
-                err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
-                                                MGMT_STATUS_NOT_POWERED);
+        if (!hdev_is_powered(hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                 MGMT_STATUS_NOT_POWERED);
                 goto unlock;
         }
 
         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
-                err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
-                                                MGMT_STATUS_NOT_SUPPORTED);
+                err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                 MGMT_STATUS_NOT_SUPPORTED);
                 goto unlock;
         }
 
         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
-                err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
-                                                        MGMT_STATUS_BUSY);
+                err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                 MGMT_STATUS_BUSY);
                 goto unlock;
         }
 
@@ -1829,104 +2201,118 @@ static int read_local_oob_data(struct sock *sk, u16 index)
 
 unlock:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
-
         return err;
 }
 
-static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
-                                                                        u16 len)
+static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
+                               void *data, u16 len)
 {
-        struct hci_dev *hdev;
-        struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
+        struct mgmt_cp_add_remote_oob_data *cp = data;
+        u8 status;
         int err;
 
-        BT_DBG("hci%u ", index);
-
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
-                                                MGMT_STATUS_INVALID_PARAMS);
-
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        BT_DBG("%s ", hdev->name);
 
         hci_dev_lock(hdev);
 
-        err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
-                                                                cp->randomizer);
+        if (!hdev_is_powered(hdev)) {
+                err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
+                                   MGMT_STATUS_NOT_POWERED, &cp->addr,
+                                   sizeof(cp->addr));
+                goto unlock;
+        }
+
+        err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
+                                      cp->randomizer);
         if (err < 0)
-                err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
-                                                        MGMT_STATUS_FAILED);
+                status = MGMT_STATUS_FAILED;
         else
-                err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
-                                                                        0);
+                status = 0;
 
-        hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
+        err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
+                           &cp->addr, sizeof(cp->addr));
 
+unlock:
+        hci_dev_unlock(hdev);
         return err;
 }
 
-static int remove_remote_oob_data(struct sock *sk, u16 index,
-                                                unsigned char *data, u16 len)
+static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
+                                                void *data, u16 len)
 {
-        struct hci_dev *hdev;
-        struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
+        struct mgmt_cp_remove_remote_oob_data *cp = data;
+        u8 status;
         int err;
 
-        BT_DBG("hci%u ", index);
+        BT_DBG("%s", hdev->name);
+
+        hci_dev_lock(hdev);
 
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        if (!hdev_is_powered(hdev)) {
+                err = cmd_complete(sk, hdev->id,
+                                   MGMT_OP_REMOVE_REMOTE_OOB_DATA,
+                                   MGMT_STATUS_NOT_POWERED, &cp->addr,
+                                   sizeof(cp->addr));
+                goto unlock;
+        }
 
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
+        if (err < 0)
+                status = MGMT_STATUS_INVALID_PARAMS;
+        else
+                status = 0;
+
+        err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
+                           status, &cp->addr, sizeof(cp->addr));
+
+unlock:
+        hci_dev_unlock(hdev);
+        return err;
+}
+
+int mgmt_interleaved_discovery(struct hci_dev *hdev)
+{
+        int err;
+
+        BT_DBG("%s", hdev->name);
 
         hci_dev_lock(hdev);
 
-        err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
+        err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
         if (err < 0)
-                err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
-                                                MGMT_STATUS_INVALID_PARAMS);
-        else
-                err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
-                                                                NULL, 0);
+                hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
 
         return err;
 }
 
-static int start_discovery(struct sock *sk, u16 index,
-                                                unsigned char *data, u16 len)
+static int start_discovery(struct sock *sk, struct hci_dev *hdev,
+                           void *data, u16 len)
 {
-        struct mgmt_cp_start_discovery *cp = (void *) data;
+        struct mgmt_cp_start_discovery *cp = data;
         struct pending_cmd *cmd;
-        struct hci_dev *hdev;
         int err;
 
-        BT_DBG("hci%u", index);
+        BT_DBG("%s", hdev->name);
 
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        hci_dev_lock(hdev);
 
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        if (!hdev_is_powered(hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                 MGMT_STATUS_NOT_POWERED);
+                goto failed;
+        }
 
-        hci_dev_lock(hdev);
+        if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                 MGMT_STATUS_BUSY);
+                goto failed;
+        }
 
-        if (!test_bit(HCI_UP, &hdev->flags)) {
-                err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
-                                                MGMT_STATUS_NOT_POWERED);
+        if (hdev->discovery.state != DISCOVERY_STOPPED) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                 MGMT_STATUS_BUSY);
                 goto failed;
         }
 
@@ -1936,179 +2322,402 @@ static int start_discovery(struct sock *sk, u16 index,
                 goto failed;
         }
 
-        err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
+        hdev->discovery.type = cp->type;
+
+        switch (hdev->discovery.type) {
+        case DISCOV_TYPE_BREDR:
+                if (lmp_bredr_capable(hdev))
+                        err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
+                else
+                        err = -ENOTSUPP;
+                break;
+
+        case DISCOV_TYPE_LE:
+                if (lmp_host_le_capable(hdev))
+                        err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
+                                          LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
+                else
+                        err = -ENOTSUPP;
+                break;
+
+        case DISCOV_TYPE_INTERLEAVED:
+                if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
+                        err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
+                                          LE_SCAN_WIN,
+                                          LE_SCAN_TIMEOUT_BREDR_LE);
+                else
+                        err = -ENOTSUPP;
+                break;
+
+        default:
+                err = -EINVAL;
+        }
+
         if (err < 0)
                 mgmt_pending_remove(cmd);
+        else
+                hci_discovery_set_state(hdev, DISCOVERY_STARTING);
 
 failed:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
-
         return err;
 }
 
-static int stop_discovery(struct sock *sk, u16 index)
+static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
+                          u16 len)
 {
-        struct hci_dev *hdev;
+        struct mgmt_cp_stop_discovery *mgmt_cp = data;
         struct pending_cmd *cmd;
+        struct hci_cp_remote_name_req_cancel cp;
+        struct inquiry_entry *e;
         int err;
 
-        BT_DBG("hci%u", index);
-
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        BT_DBG("%s", hdev->name);
 
         hci_dev_lock(hdev);
 
+        if (!hci_discovery_active(hdev)) {
+                err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
+                                   MGMT_STATUS_REJECTED, &mgmt_cp->type,
+                                   sizeof(mgmt_cp->type));
+                goto unlock;
+        }
+
+        if (hdev->discovery.type != mgmt_cp->type) {
+                err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
+                                   MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
+                                   sizeof(mgmt_cp->type));
+                goto unlock;
+        }
+
         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
         if (!cmd) {
                 err = -ENOMEM;
-                goto failed;
+                goto unlock;
+        }
+
+        switch (hdev->discovery.state) {
+        case DISCOVERY_FINDING:
+                if (test_bit(HCI_INQUIRY, &hdev->flags))
+                        err = hci_cancel_inquiry(hdev);
+                else
+                        err = hci_cancel_le_scan(hdev);
+
+                break;
+
+        case DISCOVERY_RESOLVING:
+                e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
+                                                        NAME_PENDING);
+                if (!e) {
+                        mgmt_pending_remove(cmd);
+                        err = cmd_complete(sk, hdev->id,
+                                           MGMT_OP_STOP_DISCOVERY, 0,
+                                           &mgmt_cp->type,
+                                           sizeof(mgmt_cp->type));
+                        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+                        goto unlock;
+                }
+
+                bacpy(&cp.bdaddr, &e->data.bdaddr);
+                err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
+                                   sizeof(cp), &cp);
+
+                break;
+
+        default:
+                BT_DBG("unknown discovery state %u", hdev->discovery.state);
+                err = -EFAULT;
         }
 
-        err = hci_cancel_inquiry(hdev);
         if (err < 0)
                 mgmt_pending_remove(cmd);
+        else
+                hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
 
-failed:
+unlock:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
+        return err;
+}
+
+static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
+                        u16 len)
+{
+        struct mgmt_cp_confirm_name *cp = data;
+        struct inquiry_entry *e;
+        int err;
+
+        BT_DBG("%s", hdev->name);
+
+        hci_dev_lock(hdev);
+
+        if (!hci_discovery_active(hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
+                                 MGMT_STATUS_FAILED);
+                goto failed;
+        }
+
+        e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
+        if (!e) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
+                                 MGMT_STATUS_INVALID_PARAMS);
+                goto failed;
+        }
+
+        if (cp->name_known) {
+                e->name_state = NAME_KNOWN;
+                list_del(&e->list);
+        } else {
+                e->name_state = NAME_NEEDED;
+                hci_inquiry_cache_update_resolve(hdev, e);
+        }
 
+        err = 0;
+
+failed:
+        hci_dev_unlock(hdev);
         return err;
 }
 
-static int block_device(struct sock *sk, u16 index, unsigned char *data,
-                                                                u16 len)
+static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
+                        u16 len)
 {
-        struct hci_dev *hdev;
-        struct mgmt_cp_block_device *cp = (void *) data;
+        struct mgmt_cp_block_device *cp = data;
+        u8 status;
         int err;
 
-        BT_DBG("hci%u", index);
+        BT_DBG("%s", hdev->name);
+
+        hci_dev_lock(hdev);
 
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
+        if (err < 0)
+                status = MGMT_STATUS_FAILED;
+        else
+                status = 0;
+
+        err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
+                           &cp->addr, sizeof(cp->addr));
+
+        hci_dev_unlock(hdev);
+
+        return err;
+}
+
+static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
+                          u16 len)
+{
+        struct mgmt_cp_unblock_device *cp = data;
+        u8 status;
+        int err;
 
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        BT_DBG("%s", hdev->name);
 
         hci_dev_lock(hdev);
 
-        err = hci_blacklist_add(hdev, &cp->bdaddr);
+        err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
         if (err < 0)
-                err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
-                                                        MGMT_STATUS_FAILED);
+                status = MGMT_STATUS_INVALID_PARAMS;
         else
-                err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
-                                                        NULL, 0);
+                status = 0;
+
+        err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
+                           &cp->addr, sizeof(cp->addr));
 
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
 
         return err;
 }
 
-static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
-                                                                u16 len)
+static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
+                         u16 len)
 {
-        struct hci_dev *hdev;
-        struct mgmt_cp_unblock_device *cp = (void *) data;
+        struct mgmt_cp_set_device_id *cp = data;
         int err;
+        __u16 source;
 
-        BT_DBG("hci%u", index);
+        BT_DBG("%s", hdev->name);
 
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        source = __le16_to_cpu(cp->source);
 
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        if (source > 0x0002)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
+                                  MGMT_STATUS_INVALID_PARAMS);
 
         hci_dev_lock(hdev);
 
-        err = hci_blacklist_del(hdev, &cp->bdaddr);
+        hdev->devid_source = source;
+        hdev->devid_vendor = __le16_to_cpu(cp->vendor);
+        hdev->devid_product = __le16_to_cpu(cp->product);
+        hdev->devid_version = __le16_to_cpu(cp->version);
 
-        if (err < 0)
-                err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
-                                                MGMT_STATUS_INVALID_PARAMS);
-        else
-                err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
-                                                                NULL, 0);
+        err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
+
+        update_eir(hdev);
 
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
 
         return err;
 }
 
-static int set_fast_connectable(struct sock *sk, u16 index,
-                                        unsigned char *data, u16 len)
+static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
+                                void *data, u16 len)
 {
-        struct hci_dev *hdev;
-        struct mgmt_mode *cp = (void *) data;
+        struct mgmt_mode *cp = data;
         struct hci_cp_write_page_scan_activity acp;
         u8 type;
         int err;
 
-        BT_DBG("hci%u", index);
+        BT_DBG("%s", hdev->name);
 
-        if (len != sizeof(*cp))
-                return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        if (!hdev_is_powered(hdev))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
+                                  MGMT_STATUS_NOT_POWERED);
 
-        hdev = hci_dev_get(index);
-        if (!hdev)
-                return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
-                                                MGMT_STATUS_INVALID_PARAMS);
+        if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
+                                  MGMT_STATUS_REJECTED);
 
         hci_dev_lock(hdev);
 
         if (cp->val) {
                 type = PAGE_SCAN_TYPE_INTERLACED;
-                acp.interval = 0x0024;  /* 22.5 msec page scan interval */
+
+                /* 22.5 msec page scan interval */
+                acp.interval = __constant_cpu_to_le16(0x0024);
         } else {
                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
-                acp.interval = 0x0800;  /* default 1.28 sec page scan */
+
+                /* default 1.28 sec page scan */
+                acp.interval = __constant_cpu_to_le16(0x0800);
         }
 
-        acp.window = 0x0012;    /* default 11.25 msec page scan window */
+        /* default 11.25 msec page scan window */
+        acp.window = __constant_cpu_to_le16(0x0012);
 
-        err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
-                                                sizeof(acp), &acp);
+        err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
+                           &acp);
         if (err < 0) {
-                err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
-                                                        MGMT_STATUS_FAILED);
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
+                                 MGMT_STATUS_FAILED);
                 goto done;
         }
 
         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
         if (err < 0) {
-                err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
-                                                        MGMT_STATUS_FAILED);
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
+                                 MGMT_STATUS_FAILED);
                 goto done;
         }
 
-        err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
-                                                        NULL, 0);
+        err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
+                           NULL, 0);
 done:
         hci_dev_unlock(hdev);
-        hci_dev_put(hdev);
-
         return err;
 }
 
+static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
+                               void *cp_data, u16 len)
+{
+        struct mgmt_cp_load_long_term_keys *cp = cp_data;
+        u16 key_count, expected_len;
+        int i;
+
+        key_count = __le16_to_cpu(cp->key_count);
+
+        expected_len = sizeof(*cp) + key_count *
+                                        sizeof(struct mgmt_ltk_info);
+        if (expected_len != len) {
+                BT_ERR("load_keys: expected %u bytes, got %u bytes",
+                                                        len, expected_len);
+                return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
+                                  EINVAL);
+        }
+
+        BT_DBG("%s key_count %u", hdev->name, key_count);
+
+        hci_dev_lock(hdev);
+
+        hci_smp_ltks_clear(hdev);
+
+        for (i = 0; i < key_count; i++) {
+                struct mgmt_ltk_info *key = &cp->keys[i];
+                u8 type;
+
+                if (key->master)
+                        type = HCI_SMP_LTK;
+                else
+                        type = HCI_SMP_LTK_SLAVE;
+
+                hci_add_ltk(hdev, &key->addr.bdaddr,
+                            bdaddr_to_le(key->addr.type),
+                            type, 0, key->authenticated, key->val,
+                            key->enc_size, key->ediv, key->rand);
+        }
+
+        hci_dev_unlock(hdev);
+
+        return 0;
+}
+
+static const struct mgmt_handler {
+        int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
+                     u16 data_len);
+        bool var_len;
+        size_t data_len;
+} mgmt_handlers[] = {
+        { NULL }, /* 0x0000 (no command) */
+        { read_version,           false, MGMT_READ_VERSION_SIZE },
+        { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
+        { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
+        { read_controller_info,   false, MGMT_READ_INFO_SIZE },
+        { set_powered,            false, MGMT_SETTING_SIZE },
+        { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
+        { set_connectable,        false, MGMT_SETTING_SIZE },
+        { set_fast_connectable,   false, MGMT_SETTING_SIZE },
+        { set_pairable,           false, MGMT_SETTING_SIZE },
+        { set_link_security,      false, MGMT_SETTING_SIZE },
+        { set_ssp,                false, MGMT_SETTING_SIZE },
+        { set_hs,                 false, MGMT_SETTING_SIZE },
+        { set_le,                 false, MGMT_SETTING_SIZE },
+        { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
+        { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
+        { add_uuid,               false, MGMT_ADD_UUID_SIZE },
+        { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
+        { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
+        { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
+        { disconnect,             false, MGMT_DISCONNECT_SIZE },
+        { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
+        { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
+        { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
+        { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
+        { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
+        { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
+        { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
+        { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
+        { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
+        { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
+        { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
+        { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
+        { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
+        { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
+        { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
+        { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
+        { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
+        { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
+        { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
+        { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
+};
+
+
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
 {
-        unsigned char *buf;
+        void *buf;
+        u8 *cp;
         struct mgmt_hdr *hdr;
         u16 opcode, index, len;
+        struct hci_dev *hdev = NULL;
+        const struct mgmt_handler *handler;
         int err;
 
         BT_DBG("got %zu bytes", msglen);
@@ -2125,127 +2734,64 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
                 goto done;
         }
 
-        hdr = (struct mgmt_hdr *) buf;
-        opcode = get_unaligned_le16(&hdr->opcode);
-        index = get_unaligned_le16(&hdr->index);
-        len = get_unaligned_le16(&hdr->len);
+        hdr = buf;
+        opcode = __le16_to_cpu(hdr->opcode);
+        index = __le16_to_cpu(hdr->index);
+        len = __le16_to_cpu(hdr->len);
 
         if (len != msglen - sizeof(*hdr)) {
                 err = -EINVAL;
                 goto done;
         }
 
-        switch (opcode) {
-        case MGMT_OP_READ_VERSION:
-                err = read_version(sk);
-                break;
-        case MGMT_OP_READ_INDEX_LIST:
-                err = read_index_list(sk);
-                break;
-        case MGMT_OP_READ_INFO:
-                err = read_controller_info(sk, index);
-                break;
-        case MGMT_OP_SET_POWERED:
-                err = set_powered(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_SET_DISCOVERABLE:
-                err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_SET_CONNECTABLE:
-                err = set_connectable(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_SET_FAST_CONNECTABLE:
-                err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
-                                                                len);
-                break;
-        case MGMT_OP_SET_PAIRABLE:
-                err = set_pairable(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_ADD_UUID:
-                err = add_uuid(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_REMOVE_UUID:
-                err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_SET_DEV_CLASS:
-                err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_LOAD_LINK_KEYS:
-                err = load_link_keys(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_REMOVE_KEYS:
-                err = remove_keys(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_DISCONNECT:
-                err = disconnect(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_GET_CONNECTIONS:
-                err = get_connections(sk, index);
-                break;
-        case MGMT_OP_PIN_CODE_REPLY:
-                err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_PIN_CODE_NEG_REPLY:
-                err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_SET_IO_CAPABILITY:
-                err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_PAIR_DEVICE:
-                err = pair_device(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_USER_CONFIRM_REPLY:
-                err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_USER_CONFIRM_NEG_REPLY:
-                err = user_confirm_neg_reply(sk, index, buf + sizeof(*hdr),
-                                                                        len);
-                break;
-        case MGMT_OP_USER_PASSKEY_REPLY:
-                err = user_passkey_reply(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_USER_PASSKEY_NEG_REPLY:
-                err = user_passkey_neg_reply(sk, index, buf + sizeof(*hdr),
-                                                                        len);
-                break;
-        case MGMT_OP_SET_LOCAL_NAME:
-                err = set_local_name(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_READ_LOCAL_OOB_DATA:
-                err = read_local_oob_data(sk, index);
-                break;
-        case MGMT_OP_ADD_REMOTE_OOB_DATA:
-                err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
-                err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
-                                                                        len);
-                break;
-        case MGMT_OP_START_DISCOVERY:
-                err = start_discovery(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_STOP_DISCOVERY:
-                err = stop_discovery(sk, index);
-                break;
-        case MGMT_OP_BLOCK_DEVICE:
-                err = block_device(sk, index, buf + sizeof(*hdr), len);
-                break;
-        case MGMT_OP_UNBLOCK_DEVICE:
-                err = unblock_device(sk, index, buf + sizeof(*hdr), len);
-                break;
-        default:
+        if (index != MGMT_INDEX_NONE) {
+                hdev = hci_dev_get(index);
+                if (!hdev) {
+                        err = cmd_status(sk, index, opcode,
+                                         MGMT_STATUS_INVALID_INDEX);
+                        goto done;
+                }
+        }
+
+        if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
+                                        mgmt_handlers[opcode].func == NULL) {
                 BT_DBG("Unknown op %u", opcode);
                 err = cmd_status(sk, index, opcode,
-                                                MGMT_STATUS_UNKNOWN_COMMAND);
-                break;
+                                 MGMT_STATUS_UNKNOWN_COMMAND);
+                goto done;
+        }
+
+        if ((hdev && opcode < MGMT_OP_READ_INFO) ||
+                        (!hdev && opcode >= MGMT_OP_READ_INFO)) {
+                err = cmd_status(sk, index, opcode,
+                                 MGMT_STATUS_INVALID_INDEX);
+                goto done;
+        }
+
+        handler = &mgmt_handlers[opcode];
+
+        if ((handler->var_len && len < handler->data_len) ||
+                        (!handler->var_len && len != handler->data_len)) {
+                err = cmd_status(sk, index, opcode,
+                                 MGMT_STATUS_INVALID_PARAMS);
+                goto done;
         }
 
+        if (hdev)
+                mgmt_init_hdev(sk, hdev);
+
+        cp = buf + sizeof(*hdr);
+
+        err = handler->func(sk, hdev, cp, len);
         if (err < 0)
                 goto done;
 
         err = msglen;
 
 done:
+        if (hdev)
+                hci_dev_put(hdev);
+
         kfree(buf);
         return err;
 }
@@ -2265,7 +2811,7 @@ int mgmt_index_added(struct hci_dev *hdev)
 
 int mgmt_index_removed(struct hci_dev *hdev)
 {
-        u8 status = ENODEV;
+        u8 status = MGMT_STATUS_INVALID_INDEX;
 
         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
 
@@ -2273,9 +2819,9 @@ int mgmt_index_removed(struct hci_dev *hdev)
 }
 
 struct cmd_lookup {
-        u8 val;
         struct sock *sk;
         struct hci_dev *hdev;
+        u8 mgmt_status;
 };
 
 static void settings_rsp(struct pending_cmd *cmd, void *data)
@@ -2296,63 +2842,91 @@ static void settings_rsp(struct pending_cmd *cmd, void *data)
 
 int mgmt_powered(struct hci_dev *hdev, u8 powered)
 {
-        struct cmd_lookup match = { powered, NULL, hdev };
-        __le32 ev;
-        int ret;
+        struct cmd_lookup match = { NULL, hdev };
+        int err;
+
+        if (!test_bit(HCI_MGMT, &hdev->dev_flags))
+                return 0;
 
         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
 
-        if (!powered) {
-                u8 status = ENETDOWN;
+        if (powered) {
+                u8 scan = 0;
+
+                if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
+                        scan |= SCAN_PAGE;
+                if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
+                        scan |= SCAN_INQUIRY;
+
+                if (scan)
+                        hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
+
+                update_class(hdev);
+                update_name(hdev, hdev->dev_name);
+                update_eir(hdev);
+        } else {
+                u8 status = MGMT_STATUS_NOT_POWERED;
                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
         }
 
-        ev = cpu_to_le32(get_current_settings(hdev));
-
-        ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
-                                                                match.sk);
+        err = new_settings(hdev, match.sk);
 
         if (match.sk)
                 sock_put(match.sk);
 
-        return ret;
+        return err;
 }
 
 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
 {
-        struct cmd_lookup match = { discoverable, NULL, hdev };
-        __le32 ev;
-        int ret;
+        struct cmd_lookup match = { NULL, hdev };
+        bool changed = false;
+        int err = 0;
+
+        if (discoverable) {
+                if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
+                        changed = true;
+        } else {
+                if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
+                        changed = true;
+        }
 
-        mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp, &match);
+        mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
+                             &match);
 
-        ev = cpu_to_le32(get_current_settings(hdev));
+        if (changed)
+                err = new_settings(hdev, match.sk);
 
-        ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
-                                                                match.sk);
         if (match.sk)
                 sock_put(match.sk);
 
-        return ret;
+        return err;
 }
 
 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
 {
-        __le32 ev;
-        struct cmd_lookup match = { connectable, NULL, hdev };
-        int ret;
+        struct cmd_lookup match = { NULL, hdev };
+        bool changed = false;
+        int err = 0;
 
-        mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
-                                                                &match);
+        if (connectable) {
+                if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
+                        changed = true;
+        } else {
+                if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
+                        changed = true;
+        }
 
-        ev = cpu_to_le32(get_current_settings(hdev));
+        mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
+                             &match);
 
-        ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), match.sk);
+        if (changed)
+                err = new_settings(hdev, match.sk);
 
         if (match.sk)
                 sock_put(match.sk);
 
-        return ret;
+        return err;
 }
 
 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
@@ -2361,24 +2935,25 @@ int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
 
         if (scan & SCAN_PAGE)
                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
-                                                cmd_status_rsp, &mgmt_err);
+                                     cmd_status_rsp, &mgmt_err);
 
         if (scan & SCAN_INQUIRY)
                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
-                                                cmd_status_rsp, &mgmt_err);
+                                     cmd_status_rsp, &mgmt_err);
 
         return 0;
 }
 
 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
-                                                                u8 persistent)
+                      bool persistent)
 {
         struct mgmt_ev_new_link_key ev;
 
         memset(&ev, 0, sizeof(ev));
 
         ev.store_hint = persistent;
-        bacpy(&ev.key.bdaddr, &key->bdaddr);
+        bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
+        ev.key.addr.type = BDADDR_BREDR;
         ev.key.type = key->type;
         memcpy(ev.key.val, key->val, 16);
         ev.key.pin_len = key->pin_len;
@@ -2386,15 +2961,54 @@ int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
 }
 
-int mgmt_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-                                                                u8 addr_type)
+int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
 {
-        struct mgmt_addr_info ev;
+        struct mgmt_ev_new_long_term_key ev;
 
-        bacpy(&ev.bdaddr, bdaddr);
-        ev.type = link_to_mgmt(link_type, addr_type);
+        memset(&ev, 0, sizeof(ev));
+
+        ev.store_hint = persistent;
+        bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
+        ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
+        ev.key.authenticated = key->authenticated;
+        ev.key.enc_size = key->enc_size;
+        ev.key.ediv = key->ediv;
+
+        if (key->type == HCI_SMP_LTK)
+                ev.key.master = 1;
+
+        memcpy(ev.key.rand, key->rand, sizeof(key->rand));
+        memcpy(ev.key.val, key->val, sizeof(key->val));
+
+        return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
+                          NULL);
+}
+
+int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
+                          u8 addr_type, u32 flags, u8 *name, u8 name_len,
+                          u8 *dev_class)
+{
+        char buf[512];
+        struct mgmt_ev_device_connected *ev = (void *) buf;
+        u16 eir_len = 0;
+
+        bacpy(&ev->addr.bdaddr, bdaddr);
+        ev->addr.type = link_to_bdaddr(link_type, addr_type);
+
+        ev->flags = __cpu_to_le32(flags);
+
+        if (name_len > 0)
+                eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
+                                          name, name_len);
+
+        if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
+                eir_len = eir_append_data(ev->eir, eir_len,
+                                          EIR_CLASS_OF_DEV, dev_class, 3);
+
+        ev->eir_len = cpu_to_le16(eir_len);
 
-        return mgmt_event(MGMT_EV_CONNECTED, hdev, &ev, sizeof(ev), NULL);
+        return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
+                          sizeof(*ev) + eir_len, NULL);
 }
 
 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
@@ -2403,10 +3017,11 @@ static void disconnect_rsp(struct pending_cmd *cmd, void *data)
         struct sock **sk = data;
         struct mgmt_rp_disconnect rp;
 
-        bacpy(&rp.bdaddr, &cp->bdaddr);
-        rp.status = 0;
+        bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
+        rp.addr.type = cp->addr.type;
 
-        cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
+        cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
+                     sizeof(rp));
 
         *sk = cmd->sk;
         sock_hold(*sk);
@@ -2414,25 +3029,25 @@ static void disconnect_rsp(struct pending_cmd *cmd, void *data)
         mgmt_pending_remove(cmd);
 }
 
-static void remove_keys_rsp(struct pending_cmd *cmd, void *data)
+static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
 {
-        u8 *status = data;
-        struct mgmt_cp_remove_keys *cp = cmd->param;
-        struct mgmt_rp_remove_keys rp;
+        struct hci_dev *hdev = data;
+        struct mgmt_cp_unpair_device *cp = cmd->param;
+        struct mgmt_rp_unpair_device rp;
 
         memset(&rp, 0, sizeof(rp));
-        bacpy(&rp.bdaddr, &cp->bdaddr);
-        if (status != NULL)
-                rp.status = *status;
+        bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
+        rp.addr.type = cp->addr.type;
+
+        device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
 
-        cmd_complete(cmd->sk, cmd->index, MGMT_OP_REMOVE_KEYS, &rp,
-                                                                sizeof(rp));
+        cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
 
         mgmt_pending_remove(cmd);
 }
 
-int mgmt_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-                                                                u8 addr_type)
+int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                             u8 link_type, u8 addr_type)
 {
         struct mgmt_addr_info ev;
         struct sock *sk = NULL;
@@ -2441,52 +3056,51 @@ int mgmt_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
 
         bacpy(&ev.bdaddr, bdaddr);
-        ev.type = link_to_mgmt(link_type, addr_type);
+        ev.type = link_to_bdaddr(link_type, addr_type);
 
-        err = mgmt_event(MGMT_EV_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
+        err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
+                         sk);
 
         if (sk)
                 sock_put(sk);
 
-        mgmt_pending_foreach(MGMT_OP_REMOVE_KEYS, hdev, remove_keys_rsp, NULL);
+        mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
+                             hdev);
 
         return err;
 }
 
-int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
+int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                           u8 link_type, u8 addr_type, u8 status)
 {
+        struct mgmt_rp_disconnect rp;
         struct pending_cmd *cmd;
-        u8 mgmt_err = mgmt_status(status);
         int err;
 
         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
         if (!cmd)
                 return -ENOENT;
 
-        if (bdaddr) {
-                struct mgmt_rp_disconnect rp;
-
-                bacpy(&rp.bdaddr, bdaddr);
-                rp.status = status;
+        bacpy(&rp.addr.bdaddr, bdaddr);
+        rp.addr.type = link_to_bdaddr(link_type, addr_type);
 
-                err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
-                                                        &rp, sizeof(rp));
-        } else
-                err = cmd_status(cmd->sk, hdev->id, MGMT_OP_DISCONNECT,
-                                                                mgmt_err);
+        err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
+                           mgmt_status(status), &rp, sizeof(rp));
 
         mgmt_pending_remove(cmd);
 
+        mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
+                                                                        hdev);
         return err;
 }
 
 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-                                                u8 addr_type, u8 status)
+                        u8 addr_type, u8 status)
 {
         struct mgmt_ev_connect_failed ev;
 
         bacpy(&ev.addr.bdaddr, bdaddr);
-        ev.addr.type = link_to_mgmt(link_type, addr_type);
+        ev.addr.type = link_to_bdaddr(link_type, addr_type);
         ev.status = mgmt_status(status);
 
         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
@@ -2496,15 +3110,16 @@ int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
 {
         struct mgmt_ev_pin_code_request ev;
 
-        bacpy(&ev.bdaddr, bdaddr);
+        bacpy(&ev.addr.bdaddr, bdaddr);
+        ev.addr.type = BDADDR_BREDR;
         ev.secure = secure;
 
         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
-                                                                        NULL);
+                          NULL);
 }
 
 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                                u8 status)
+                                 u8 status)
 {
         struct pending_cmd *cmd;
         struct mgmt_rp_pin_code_reply rp;
@@ -2514,11 +3129,11 @@ int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
         if (!cmd)
                 return -ENOENT;
 
-        bacpy(&rp.bdaddr, bdaddr);
-        rp.status = mgmt_status(status);
+        bacpy(&rp.addr.bdaddr, bdaddr);
+        rp.addr.type = BDADDR_BREDR;
 
-        err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, &rp,
-                                                                sizeof(rp));
+        err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
+                           mgmt_status(status), &rp, sizeof(rp));
 
         mgmt_pending_remove(cmd);
 
@@ -2526,7 +3141,7 @@ int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
 }
 
 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                                u8 status)
+                                     u8 status)
 {
         struct pending_cmd *cmd;
         struct mgmt_rp_pin_code_reply rp;
@@ -2536,11 +3151,11 @@ int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
         if (!cmd)
                 return -ENOENT;
 
-        bacpy(&rp.bdaddr, bdaddr);
-        rp.status = mgmt_status(status);
+        bacpy(&rp.addr.bdaddr, bdaddr);
+        rp.addr.type = BDADDR_BREDR;
 
-        err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
-                                                                sizeof(rp));
+        err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
+                           mgmt_status(status), &rp, sizeof(rp));
 
         mgmt_pending_remove(cmd);
 
@@ -2548,34 +3163,39 @@ int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
 }
 
 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                __le32 value, u8 confirm_hint)
+                              u8 link_type, u8 addr_type, __le32 value,
+                              u8 confirm_hint)
 {
         struct mgmt_ev_user_confirm_request ev;
 
         BT_DBG("%s", hdev->name);
 
-        bacpy(&ev.bdaddr, bdaddr);
+        bacpy(&ev.addr.bdaddr, bdaddr);
+        ev.addr.type = link_to_bdaddr(link_type, addr_type);
         ev.confirm_hint = confirm_hint;
-        put_unaligned_le32(value, &ev.value);
+        ev.value = value;
 
         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
-                                                                        NULL);
+                          NULL);
 }
 
-int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr)
+int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                                u8 link_type, u8 addr_type)
 {
         struct mgmt_ev_user_passkey_request ev;
 
         BT_DBG("%s", hdev->name);
 
-        bacpy(&ev.bdaddr, bdaddr);
+        bacpy(&ev.addr.bdaddr, bdaddr);
+        ev.addr.type = link_to_bdaddr(link_type, addr_type);
 
         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
-                                                                        NULL);
+                          NULL);
 }
 
 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                        u8 status, u8 opcode)
+                                        u8 link_type, u8 addr_type, u8 status,
+                                        u8 opcode)
 {
         struct pending_cmd *cmd;
         struct mgmt_rp_user_confirm_reply rp;
@@ -2585,9 +3205,10 @@ static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
         if (!cmd)
                 return -ENOENT;
 
-        bacpy(&rp.bdaddr, bdaddr);
-        rp.status = mgmt_status(status);
-        err = cmd_complete(cmd->sk, hdev->id, opcode, &rp, sizeof(rp));
+        bacpy(&rp.addr.bdaddr, bdaddr);
+        rp.addr.type = link_to_bdaddr(link_type, addr_type);
+        err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
+                           &rp, sizeof(rp));
 
         mgmt_pending_remove(cmd);
 
@@ -2595,72 +3216,215 @@ static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
 }
 
 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                                u8 status)
+                                     u8 link_type, u8 addr_type, u8 status)
 {
-        return user_pairing_resp_complete(hdev, bdaddr, status,
-                                                MGMT_OP_USER_CONFIRM_REPLY);
+        return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
+                                          status, MGMT_OP_USER_CONFIRM_REPLY);
 }
 
-int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev,
-                                                bdaddr_t *bdaddr, u8 status)
+int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                         u8 link_type, u8 addr_type, u8 status)
 {
-        return user_pairing_resp_complete(hdev, bdaddr, status,
-                                        MGMT_OP_USER_CONFIRM_NEG_REPLY);
+        return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
+                                          status, MGMT_OP_USER_CONFIRM_NEG_REPLY);
 }
 
 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                                u8 status)
+                                     u8 link_type, u8 addr_type, u8 status)
 {
-        return user_pairing_resp_complete(hdev, bdaddr, status,
-                                                MGMT_OP_USER_PASSKEY_REPLY);
+        return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
+                                          status, MGMT_OP_USER_PASSKEY_REPLY);
 }
 
-int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev,
-                                                bdaddr_t *bdaddr, u8 status)
+int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                         u8 link_type, u8 addr_type, u8 status)
 {
-        return user_pairing_resp_complete(hdev, bdaddr, status,
-                                        MGMT_OP_USER_PASSKEY_NEG_REPLY);
+        return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
+                                          status, MGMT_OP_USER_PASSKEY_NEG_REPLY);
 }
 
-int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
+int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
+                     u8 addr_type, u8 status)
 {
         struct mgmt_ev_auth_failed ev;
 
-        bacpy(&ev.bdaddr, bdaddr);
+        bacpy(&ev.addr.bdaddr, bdaddr);
+        ev.addr.type = link_to_bdaddr(link_type, addr_type);
         ev.status = mgmt_status(status);
 
         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
 }
 
+int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
+{
+        struct cmd_lookup match = { NULL, hdev };
+        bool changed = false;
+        int err = 0;
+
+        if (status) {
+                u8 mgmt_err = mgmt_status(status);
+                mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
+                                     cmd_status_rsp, &mgmt_err);
+                return 0;
+        }
+
+        if (test_bit(HCI_AUTH, &hdev->flags)) {
+                if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
+                        changed = true;
+        } else {
+                if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
+                        changed = true;
+        }
+
+        mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
+                             &match);
+
+        if (changed)
+                err = new_settings(hdev, match.sk);
+
+        if (match.sk)
+                sock_put(match.sk);
+
+        return err;
+}
+
+static int clear_eir(struct hci_dev *hdev)
+{
+        struct hci_cp_write_eir cp;
+
+        if (!(hdev->features[6] & LMP_EXT_INQ))
+                return 0;
+
+        memset(hdev->eir, 0, sizeof(hdev->eir));
+
+        memset(&cp, 0, sizeof(cp));
+
+        return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
+}
+
+int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
+{
+        struct cmd_lookup match = { NULL, hdev };
+        bool changed = false;
+        int err = 0;
+
+        if (status) {
+                u8 mgmt_err = mgmt_status(status);
+
+                if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
+                                                 &hdev->dev_flags))
+                        err = new_settings(hdev, NULL);
+
+                mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
+                                     &mgmt_err);
+
+                return err;
+        }
+
+        if (enable) {
+                if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
+                        changed = true;
+        } else {
+                if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
+                        changed = true;
+        }
+
+        mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
+
+        if (changed)
+                err = new_settings(hdev, match.sk);
+
+        if (match.sk)
+                sock_put(match.sk);
+
+        if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
+                update_eir(hdev);
+        else
+                clear_eir(hdev);
+
+        return err;
+}
+
+static void class_rsp(struct pending_cmd *cmd, void *data)
+{
+        struct cmd_lookup *match = data;
+
+        cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
+                     match->hdev->dev_class, 3);
+
+        list_del(&cmd->list);
+
+        if (match->sk == NULL) {
+                match->sk = cmd->sk;
+                sock_hold(match->sk);
+        }
+
+        mgmt_pending_free(cmd);
+}
+
+int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
+                                   u8 status)
+{
+        struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
+        int err = 0;
+
+        clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
+
+        mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
+        mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
+        mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
+
+        if (!status)
+                err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
+                                 3, NULL);
+
+        if (match.sk)
+                sock_put(match.sk);
+
+        return err;
+}
+
 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
 {
         struct pending_cmd *cmd;
         struct mgmt_cp_set_local_name ev;
-        int err;
+        bool changed = false;
+        int err = 0;
+
+        if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
+                memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
+                changed = true;
+        }
 
         memset(&ev, 0, sizeof(ev));
         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
+        memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
 
         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
         if (!cmd)
                 goto send_event;
 
+        /* Always assume that either the short or the complete name has
+         * changed if there was a pending mgmt command */
+        changed = true;
+
         if (status) {
                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
-                                                        mgmt_status(status));
+                                 mgmt_status(status));
                 goto failed;
         }
 
-        update_eir(hdev);
-
-        err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, &ev,
-                                                                sizeof(ev));
+        err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
+                           sizeof(ev));
         if (err < 0)
                 goto failed;
 
 send_event:
-        err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
-                                                        cmd ? cmd->sk : NULL);
+        if (changed)
+                err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
+                                 sizeof(ev), cmd ? cmd->sk : NULL);
+
+        update_eir(hdev);
 
 failed:
         if (cmd)
@@ -2669,7 +3433,7 @@ failed:
 }
 
 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
-                                                u8 *randomizer, u8 status)
+                                            u8 *randomizer, u8 status)
 {
         struct pending_cmd *cmd;
         int err;
@@ -2681,9 +3445,8 @@ int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
                 return -ENOENT;
 
         if (status) {
-                err = cmd_status(cmd->sk, hdev->id,
-                                                MGMT_OP_READ_LOCAL_OOB_DATA,
-                                                mgmt_status(status));
+                err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                 mgmt_status(status));
         } else {
                 struct mgmt_rp_read_local_oob_data rp;
 
@@ -2691,8 +3454,8 @@ int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
 
                 err = cmd_complete(cmd->sk, hdev->id,
-                                                MGMT_OP_READ_LOCAL_OOB_DATA,
-                                                &rp, sizeof(rp));
+                                   MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
+                                   sizeof(rp));
         }
 
         mgmt_pending_remove(cmd);
@@ -2700,48 +3463,120 @@ int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
         return err;
 }
 
+int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
+{
+        struct cmd_lookup match = { NULL, hdev };
+        bool changed = false;
+        int err = 0;
+
+        if (status) {
+                u8 mgmt_err = mgmt_status(status);
+
+                if (enable && test_and_clear_bit(HCI_LE_ENABLED,
+                                                 &hdev->dev_flags))
+                        err = new_settings(hdev, NULL);
+
+                mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
+                                     &mgmt_err);
+
+                return err;
+        }
+
+        if (enable) {
+                if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
+                        changed = true;
+        } else {
+                if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
+                        changed = true;
+        }
+
+        mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
+
+        if (changed)
+                err = new_settings(hdev, match.sk);
+
+        if (match.sk)
+                sock_put(match.sk);
+
+        return err;
+}
+
 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-                                u8 addr_type, u8 *dev_class, s8 rssi, u8 *eir)
+                      u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
+                      ssp, u8 *eir, u16 eir_len)
 {
-        struct mgmt_ev_device_found ev;
+        char buf[512];
+        struct mgmt_ev_device_found *ev = (void *) buf;
+        size_t ev_size;
 
-        memset(&ev, 0, sizeof(ev));
+        /* Leave 5 bytes for a potential CoD field */
+        if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
+                return -EINVAL;
 
-        bacpy(&ev.addr.bdaddr, bdaddr);
-        ev.addr.type = link_to_mgmt(link_type, addr_type);
-        ev.rssi = rssi;
+        memset(buf, 0, sizeof(buf));
+
+        bacpy(&ev->addr.bdaddr, bdaddr);
+        ev->addr.type = link_to_bdaddr(link_type, addr_type);
+        ev->rssi = rssi;
+        if (cfm_name)
+                ev->flags[0] |= MGMT_DEV_FOUND_CONFIRM_NAME;
+        if (!ssp)
+                ev->flags[0] |= MGMT_DEV_FOUND_LEGACY_PAIRING;
 
-        if (eir)
-                memcpy(ev.eir, eir, sizeof(ev.eir));
+        if (eir_len > 0)
+                memcpy(ev->eir, eir, eir_len);
 
-        if (dev_class)
-                memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
+        if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
+                eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
+                                          dev_class, 3);
 
-        return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, &ev, sizeof(ev), NULL);
+        ev->eir_len = cpu_to_le16(eir_len);
+
+        ev_size = sizeof(*ev) + eir_len;
+
+        return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
 }
 
-int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name)
+int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
+                     u8 addr_type, s8 rssi, u8 *name, u8 name_len)
 {
-        struct mgmt_ev_remote_name ev;
+        struct mgmt_ev_device_found *ev;
+        char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
+        u16 eir_len;
 
-        memset(&ev, 0, sizeof(ev));
+        ev = (struct mgmt_ev_device_found *) buf;
 
-        bacpy(&ev.bdaddr, bdaddr);
-        memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
+        memset(buf, 0, sizeof(buf));
+
+        bacpy(&ev->addr.bdaddr, bdaddr);
+        ev->addr.type = link_to_bdaddr(link_type, addr_type);
+        ev->rssi = rssi;
+
+        eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
+                                  name_len);
 
-        return mgmt_event(MGMT_EV_REMOTE_NAME, hdev, &ev, sizeof(ev), NULL);
+        ev->eir_len = cpu_to_le16(eir_len);
+
+        return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
+                          sizeof(*ev) + eir_len, NULL);
 }
 
 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
 {
         struct pending_cmd *cmd;
+        u8 type;
         int err;
 
+        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+
         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
         if (!cmd)
                 return -ENOENT;
 
-        err = cmd_status(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status));
+        type = hdev->discovery.type;
+
+        err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
+                           &type, sizeof(type));
         mgmt_pending_remove(cmd);
 
         return err;
@@ -2756,7 +3591,8 @@ int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
         if (!cmd)
                 return -ENOENT;
 
-        err = cmd_status(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status));
+        err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
+                           &hdev->discovery.type, sizeof(hdev->discovery.type));
         mgmt_pending_remove(cmd);
 
         return err;
@@ -2764,44 +3600,58 @@ int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
 
 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
 {
+        struct mgmt_ev_discovering ev;
         struct pending_cmd *cmd;
 
+        BT_DBG("%s discovering %u", hdev->name, discovering);
+
         if (discovering)
                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
         else
                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
 
         if (cmd != NULL) {
-                cmd_complete(cmd->sk, hdev->id, cmd->opcode, NULL, 0);
+                u8 type = hdev->discovery.type;
+
+                cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
+                             sizeof(type));
                 mgmt_pending_remove(cmd);
         }
 
-        return mgmt_event(MGMT_EV_DISCOVERING, hdev, &discovering,
-                                                sizeof(discovering), NULL);
+        memset(&ev, 0, sizeof(ev));
+        ev.type = hdev->discovery.type;
+        ev.discovering = discovering;
+
+        return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
 }
 
-int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
+int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
 {
         struct pending_cmd *cmd;
         struct mgmt_ev_device_blocked ev;
 
         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
 
-        bacpy(&ev.bdaddr, bdaddr);
+        bacpy(&ev.addr.bdaddr, bdaddr);
+        ev.addr.type = type;
 
         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
-                                                        cmd ? cmd->sk : NULL);
+                          cmd ? cmd->sk : NULL);
 }
 
-int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
+int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
 {
         struct pending_cmd *cmd;
         struct mgmt_ev_device_unblocked ev;
 
         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
 
-        bacpy(&ev.bdaddr, bdaddr);
+        bacpy(&ev.addr.bdaddr, bdaddr);
+        ev.addr.type = type;
 
         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
-                                                        cmd ? cmd->sk : NULL);
+                          cmd ? cmd->sk : NULL);
 }
+
+module_param(enable_hs, bool, 0644);
+MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 22169c3f1482..e8707debb864 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -45,7 +45,6 @@
 #include <linux/security.h>
 #include <net/sock.h>
 
-#include <asm/system.h>
 #include <linux/uaccess.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -261,7 +260,8 @@ static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
 
         if (parent) {
                 sk->sk_type = parent->sk_type;
-                pi->dlc->defer_setup = bt_sk(parent)->defer_setup;
+                pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP,
+                                                &bt_sk(parent)->flags);
 
                 pi->sec_level = rfcomm_pi(parent)->sec_level;
                 pi->role_switch = rfcomm_pi(parent)->role_switch;
@@ -732,7 +732,11 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
                         break;
                 }
 
-                bt_sk(sk)->defer_setup = opt;
+                if (opt)
+                        set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
+                else
+                        clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
+
                 break;
 
         default:
@@ -850,7 +854,8 @@ static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, c
                         break;
                 }
 
-                if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
+                if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
+                             (u32 __user *) optval))
                         err = -EFAULT;
 
                 break;
@@ -973,7 +978,7 @@ int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc *
 done:
         bh_unlock_sock(parent);
 
-        if (bt_sk(parent)->defer_setup)
+        if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
                 parent->sk_state_change(parent);
 
         return result;
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index a2d4f5122a6a..d1820ff14aee 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -48,13 +48,12 @@
 static struct tty_driver *rfcomm_tty_driver;
 
 struct rfcomm_dev {
+        struct tty_port         port;
         struct list_head        list;
-        atomic_t                refcnt;
 
         char                    name[12];
         int                     id;
         unsigned long           flags;
-        atomic_t                opened;
         int                     err;
 
         bdaddr_t                src;
@@ -64,9 +63,7 @@ struct rfcomm_dev {
         uint                    modem_status;
 
         struct rfcomm_dlc       *dlc;
-        struct tty_struct       *tty;
         wait_queue_head_t       wait;
-        struct work_struct      wakeup_task;
 
         struct device           *tty_dev;
 
@@ -82,11 +79,18 @@ static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
 
-static void rfcomm_tty_wakeup(struct work_struct *work);
-
 /* ---- Device functions ---- */
-static void rfcomm_dev_destruct(struct rfcomm_dev *dev)
+
+/*
+ * The reason this isn't actually a race, as you no doubt have a little voice
+ * screaming at you in your head, is that the refcount should never actually
+ * reach zero unless the device has already been taken off the list, in
+ * rfcomm_dev_del(). And if that's not true, we'll hit the BUG() in
+ * rfcomm_dev_destruct() anyway.
+ */
+static void rfcomm_dev_destruct(struct tty_port *port)
 {
+        struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
         struct rfcomm_dlc *dlc = dev->dlc;
 
         BT_DBG("dev %p dlc %p", dev, dlc);
@@ -113,23 +117,9 @@ static void rfcomm_dev_destruct(struct rfcomm_dev *dev)
         module_put(THIS_MODULE);
 }
 
-static inline void rfcomm_dev_hold(struct rfcomm_dev *dev)
-{
-        atomic_inc(&dev->refcnt);
-}
-
-static inline void rfcomm_dev_put(struct rfcomm_dev *dev)
-{
-        /* The reason this isn't actually a race, as you no
-           doubt have a little voice screaming at you in your
-           head, is that the refcount should never actually
-           reach zero unless the device has already been taken
-           off the list, in rfcomm_dev_del(). And if that's not
-           true, we'll hit the BUG() in rfcomm_dev_destruct()
-           anyway. */
-        if (atomic_dec_and_test(&dev->refcnt))
-                rfcomm_dev_destruct(dev);
-}
+static const struct tty_port_operations rfcomm_port_ops = {
+        .destruct = rfcomm_dev_destruct,
+};
 
 static struct rfcomm_dev *__rfcomm_dev_get(int id)
 {
@@ -154,7 +144,7 @@ static inline struct rfcomm_dev *rfcomm_dev_get(int id)
                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
                         dev = NULL;
                 else
-                        rfcomm_dev_hold(dev);
+                        tty_port_get(&dev->port);
         }
 
         spin_unlock(&rfcomm_dev_lock);
@@ -196,7 +186,7 @@ static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 {
         struct rfcomm_dev *dev, *entry;
-        struct list_head *head = &rfcomm_dev_list, *p;
+        struct list_head *head = &rfcomm_dev_list;
         int err = 0;
 
         BT_DBG("id %d channel %d", req->dev_id, req->channel);
@@ -215,7 +205,7 @@ static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
                                 break;
 
                         dev->id++;
-                        head = p;
+                        head = &entry->list;
                 }
         } else {
                 dev->id = req->dev_id;
@@ -229,7 +219,7 @@ static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
                         if (entry->id > dev->id - 1)
                                 break;
 
-                        head = p;
+                        head = &entry->list;
                 }
         }
 
@@ -241,7 +231,6 @@ static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
         sprintf(dev->name, "rfcomm%d", dev->id);
 
         list_add(&dev->list, head);
-        atomic_set(&dev->refcnt, 1);
 
         bacpy(&dev->src, &req->src);
         bacpy(&dev->dst, &req->dst);
@@ -250,10 +239,9 @@ static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
         dev->flags = req->flags &
                 ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
 
-        atomic_set(&dev->opened, 0);
-
+        tty_port_init(&dev->port);
+        dev->port.ops = &rfcomm_port_ops;
         init_waitqueue_head(&dev->wait);
-        INIT_WORK(&dev->wakeup_task, rfcomm_tty_wakeup);
 
         skb_queue_head_init(&dev->pending);
 
@@ -320,18 +308,23 @@ free:
 
 static void rfcomm_dev_del(struct rfcomm_dev *dev)
 {
+        unsigned long flags;
         BT_DBG("dev %p", dev);
 
         BUG_ON(test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags));
 
-        if (atomic_read(&dev->opened) > 0)
+        spin_lock_irqsave(&dev->port.lock, flags);
+        if (dev->port.count > 0) {
+                spin_unlock_irqrestore(&dev->port.lock, flags);
                 return;
+        }
+        spin_unlock_irqrestore(&dev->port.lock, flags);
 
         spin_lock(&rfcomm_dev_lock);
         list_del_init(&dev->list);
         spin_unlock(&rfcomm_dev_lock);
 
-        rfcomm_dev_put(dev);
+        tty_port_put(&dev->port);
 }
 
 /* ---- Send buffer ---- */
@@ -345,15 +338,16 @@ static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 static void rfcomm_wfree(struct sk_buff *skb)
 {
         struct rfcomm_dev *dev = (void *) skb->sk;
+        struct tty_struct *tty = dev->port.tty;
         atomic_sub(skb->truesize, &dev->wmem_alloc);
-        if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
-                queue_work(system_nrt_wq, &dev->wakeup_task);
-        rfcomm_dev_put(dev);
+        if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags) && tty)
+                tty_wakeup(tty);
+        tty_port_put(&dev->port);
 }
 
 static inline void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
 {
-        rfcomm_dev_hold(dev);
+        tty_port_get(&dev->port);
         atomic_add(skb->truesize, &dev->wmem_alloc);
         skb->sk = (void *) dev;
         skb->destructor = rfcomm_wfree;
@@ -432,7 +426,7 @@ static int rfcomm_release_dev(void __user *arg)
                 return -ENODEV;
 
         if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
-                rfcomm_dev_put(dev);
+                tty_port_put(&dev->port);
                 return -EPERM;
         }
 
@@ -440,12 +434,12 @@ static int rfcomm_release_dev(void __user *arg)
                 rfcomm_dlc_close(dev->dlc, 0);
 
         /* Shut down TTY synchronously before freeing rfcomm_dev */
-        if (dev->tty)
-                tty_vhangup(dev->tty);
+        if (dev->port.tty)
+                tty_vhangup(dev->port.tty);
 
         if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
                 rfcomm_dev_del(dev);
-        rfcomm_dev_put(dev);
+        tty_port_put(&dev->port);
         return 0;
 }
 
@@ -523,7 +517,7 @@ static int rfcomm_get_dev_info(void __user *arg)
         if (copy_to_user(arg, &di, sizeof(di)))
                 err = -EFAULT;
 
-        rfcomm_dev_put(dev);
+        tty_port_put(&dev->port);
         return err;
 }
 
@@ -559,7 +553,7 @@ static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
                 return;
         }
 
-        tty = dev->tty;
+        tty = dev->port.tty;
         if (!tty || !skb_queue_empty(&dev->pending)) {
                 skb_queue_tail(&dev->pending, skb);
                 return;
@@ -585,13 +579,13 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
         wake_up_interruptible(&dev->wait);
 
         if (dlc->state == BT_CLOSED) {
-                if (!dev->tty) {
+                if (!dev->port.tty) {
                         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
                                 /* Drop DLC lock here to avoid deadlock
                                  * 1. rfcomm_dev_get will take rfcomm_dev_lock
                                  *    but in rfcomm_dev_add there's lock order:
                                  *    rfcomm_dev_lock -> dlc lock
-                                 * 2. rfcomm_dev_put will deadlock if it's
+                                 * 2. tty_port_put will deadlock if it's
                                  *    the last reference
                                  */
                                 rfcomm_dlc_unlock(dlc);
@@ -601,11 +595,11 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
                                 }
 
                                 rfcomm_dev_del(dev);
-                                rfcomm_dev_put(dev);
+                                tty_port_put(&dev->port);
                                 rfcomm_dlc_lock(dlc);
                         }
                 } else
-                        tty_hangup(dev->tty);
+                        tty_hangup(dev->port.tty);
         }
 }
 
@@ -618,8 +612,8 @@ static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
         BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
 
         if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV)) {
-                if (dev->tty && !C_CLOCAL(dev->tty))
-                        tty_hangup(dev->tty);
+                if (dev->port.tty && !C_CLOCAL(dev->port.tty))
+                        tty_hangup(dev->port.tty);
         }
 
         dev->modem_status =
@@ -630,21 +624,9 @@ static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
 }
 
 /* ---- TTY functions ---- */
-static void rfcomm_tty_wakeup(struct work_struct *work)
-{
-        struct rfcomm_dev *dev = container_of(work, struct rfcomm_dev,
-                                                                wakeup_task);
-        struct tty_struct *tty = dev->tty;
-        if (!tty)
-                return;
-
-        BT_DBG("dev %p tty %p", dev, tty);
-        tty_wakeup(tty);
-}
-
 static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev)
 {
-        struct tty_struct *tty = dev->tty;
+        struct tty_struct *tty = dev->port.tty;
         struct sk_buff *skb;
         int inserted = 0;
 
@@ -671,6 +653,7 @@ static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
         DECLARE_WAITQUEUE(wait, current);
         struct rfcomm_dev *dev;
         struct rfcomm_dlc *dlc;
+        unsigned long flags;
         int err, id;
 
         id = tty->index;
@@ -686,10 +669,14 @@ static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
                 return -ENODEV;
 
         BT_DBG("dev %p dst %s channel %d opened %d", dev, batostr(&dev->dst),
-                                dev->channel, atomic_read(&dev->opened));
+                                dev->channel, dev->port.count);
 
-        if (atomic_inc_return(&dev->opened) > 1)
+        spin_lock_irqsave(&dev->port.lock, flags);
+        if (++dev->port.count > 1) {
+                spin_unlock_irqrestore(&dev->port.lock, flags);
                 return 0;
+        }
+        spin_unlock_irqrestore(&dev->port.lock, flags);
 
         dlc = dev->dlc;
 
@@ -697,7 +684,7 @@ static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
 
         rfcomm_dlc_lock(dlc);
         tty->driver_data = dev;
-        dev->tty = tty;
+        dev->port.tty = tty;
         rfcomm_dlc_unlock(dlc);
         set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 
@@ -744,13 +731,17 @@ static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
+        unsigned long flags;
+
         if (!dev)
                 return;
 
         BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
-                                                atomic_read(&dev->opened));
+                                                dev->port.count);
 
-        if (atomic_dec_and_test(&dev->opened)) {
+        spin_lock_irqsave(&dev->port.lock, flags);
+        if (!--dev->port.count) {
+                spin_unlock_irqrestore(&dev->port.lock, flags);
                 if (dev->tty_dev->parent)
                         device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
 
@@ -758,11 +749,10 @@ static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
                 rfcomm_dlc_close(dev->dlc, 0);
 
                 clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
-                cancel_work_sync(&dev->wakeup_task);
 
                 rfcomm_dlc_lock(dev->dlc);
                 tty->driver_data = NULL;
-                dev->tty = NULL;
+                dev->port.tty = NULL;
                 rfcomm_dlc_unlock(dev->dlc);
 
                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags)) {
@@ -770,11 +760,12 @@ static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
                         list_del_init(&dev->list);
                         spin_unlock(&rfcomm_dev_lock);
 
-                        rfcomm_dev_put(dev);
+                        tty_port_put(&dev->port);
                 }
-        }
+        } else
+                spin_unlock_irqrestore(&dev->port.lock, flags);
 
-        rfcomm_dev_put(dev);
+        tty_port_put(&dev->port);
 }
 
 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
@@ -1083,7 +1074,7 @@ static void rfcomm_tty_hangup(struct tty_struct *tty)
                 if (rfcomm_dev_get(dev->id) == NULL)
                         return;
                 rfcomm_dev_del(dev);
-                rfcomm_dev_put(dev);
+                tty_port_put(&dev->port);
         }
 }
 
@@ -1157,7 +1148,6 @@ int __init rfcomm_init_ttys(void)
         if (!rfcomm_tty_driver)
                 return -ENOMEM;
 
-        rfcomm_tty_driver->owner        = THIS_MODULE;
         rfcomm_tty_driver->driver_name  = "rfcomm";
         rfcomm_tty_driver->name         = "rfcomm";
         rfcomm_tty_driver->major        = RFCOMM_TTY_MAJOR;
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 8bf26d1bc5c1..cbdd313659a7 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -44,7 +44,6 @@
 #include <linux/security.h>
 #include <net/sock.h>
 
-#include <asm/system.h>
 #include <linux/uaccess.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -62,8 +61,6 @@ static struct bt_sock_list sco_sk_list = {
 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent);
 static void sco_chan_del(struct sock *sk, int err);
 
-static int  sco_conn_del(struct hci_conn *conn, int err);
-
 static void sco_sock_close(struct sock *sk);
 static void sco_sock_kill(struct sock *sk);
 
@@ -96,12 +93,12 @@ static void sco_sock_clear_timer(struct sock *sk)
 }
 
 /* ---- SCO connections ---- */
-static struct sco_conn *sco_conn_add(struct hci_conn *hcon, __u8 status)
+static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
 {
         struct hci_dev *hdev = hcon->hdev;
         struct sco_conn *conn = hcon->sco_data;
 
-        if (conn || status)
+        if (conn)
                 return conn;
 
         conn = kzalloc(sizeof(struct sco_conn), GFP_ATOMIC);
@@ -196,13 +193,14 @@ static int sco_connect(struct sock *sk)
         else
                 type = SCO_LINK;
 
-        hcon = hci_connect(hdev, type, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
+        hcon = hci_connect(hdev, type, dst, BDADDR_BREDR, BT_SECURITY_LOW,
+                           HCI_AT_NO_BONDING);
         if (IS_ERR(hcon)) {
                 err = PTR_ERR(hcon);
                 goto done;
         }
 
-        conn = sco_conn_add(hcon, 0);
+        conn = sco_conn_add(hcon);
         if (!conn) {
                 hci_conn_put(hcon);
                 err = -ENOMEM;
@@ -234,7 +232,7 @@ static inline int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
 {
         struct sco_conn *conn = sco_pi(sk)->conn;
         struct sk_buff *skb;
-        int err, count;
+        int err;
 
         /* Check outgoing MTU */
         if (len > conn->mtu)
@@ -242,20 +240,18 @@ static inline int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
 
         BT_DBG("sk %p len %d", sk, len);
 
-        count = min_t(unsigned int, conn->mtu, len);
-        skb = bt_skb_send_alloc(sk, count,
-                        msg->msg_flags & MSG_DONTWAIT, &err);
+        skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
         if (!skb)
                 return err;
 
-        if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
+        if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
                 kfree_skb(skb);
                 return -EFAULT;
         }
 
         hci_send_sco(conn->hcon, skb);
 
-        return count;
+        return len;
 }
 
 static inline void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
@@ -278,17 +274,20 @@ drop:
 }
 
 /* -------- Socket interface ---------- */
-static struct sock *__sco_get_sock_by_addr(bdaddr_t *ba)
+static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba)
 {
-        struct sock *sk;
         struct hlist_node *node;
+        struct sock *sk;
+
+        sk_for_each(sk, node, &sco_sk_list.head) {
+                if (sk->sk_state != BT_LISTEN)
+                        continue;
 
-        sk_for_each(sk, node, &sco_sk_list.head)
                 if (!bacmp(&bt_sk(sk)->src, ba))
-                        goto found;
-        sk = NULL;
-found:
-        return sk;
+                        return sk;
+        }
+
+        return NULL;
 }
 
 /* Find socket listening on source bdaddr.
@@ -467,7 +466,6 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_le
 {
         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
         struct sock *sk = sock->sk;
-        bdaddr_t *src = &sa->sco_bdaddr;
         int err = 0;
 
         BT_DBG("sk %p %s", sk, batostr(&sa->sco_bdaddr));
@@ -482,17 +480,14 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_le
                 goto done;
         }
 
-        write_lock(&sco_sk_list.lock);
-
-        if (bacmp(src, BDADDR_ANY) && __sco_get_sock_by_addr(src)) {
-                err = -EADDRINUSE;
-        } else {
-                /* Save source address */
-                bacpy(&bt_sk(sk)->src, &sa->sco_bdaddr);
-                sk->sk_state = BT_BOUND;
+        if (sk->sk_type != SOCK_SEQPACKET) {
+                err = -EINVAL;
+                goto done;
         }
 
-        write_unlock(&sco_sk_list.lock);
+        bacpy(&bt_sk(sk)->src, &sa->sco_bdaddr);
+
+        sk->sk_state = BT_BOUND;
 
 done:
         release_sock(sk);
@@ -538,21 +533,38 @@ done:
 static int sco_sock_listen(struct socket *sock, int backlog)
 {
         struct sock *sk = sock->sk;
+        bdaddr_t *src = &bt_sk(sk)->src;
         int err = 0;
 
         BT_DBG("sk %p backlog %d", sk, backlog);
 
         lock_sock(sk);
 
-        if (sk->sk_state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
+        if (sk->sk_state != BT_BOUND) {
                 err = -EBADFD;
                 goto done;
         }
 
+        if (sk->sk_type != SOCK_SEQPACKET) {
+                err = -EINVAL;
+                goto done;
+        }
+
+        write_lock(&sco_sk_list.lock);
+
+        if (__sco_get_sock_listen_by_addr(src)) {
+                err = -EADDRINUSE;
+                goto unlock;
+        }
+
         sk->sk_max_ack_backlog = backlog;
         sk->sk_ack_backlog = 0;
+
         sk->sk_state = BT_LISTEN;
 
+unlock:
+        write_unlock(&sco_sk_list.lock);
+
 done:
         release_sock(sk);
         return err;
@@ -924,7 +936,7 @@ int sco_connect_cfm(struct hci_conn *hcon, __u8 status)
         if (!status) {
                 struct sco_conn *conn;
 
-                conn = sco_conn_add(hcon, status);
+                conn = sco_conn_add(hcon);
                 if (conn)
                         sco_conn_ready(conn);
         } else
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 32c47de30344..6fc7c4708f3e 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -29,7 +29,7 @@
 #include <linux/scatterlist.h>
 #include <crypto/b128ops.h>
 
-#define SMP_TIMEOUT 30000 /* 30 seconds */
+#define SMP_TIMEOUT     msecs_to_jiffies(30000)
 
 static inline void swap128(u8 src[16], u8 dst[16])
 {
@@ -186,8 +186,7 @@ static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
         hci_send_acl(conn->hchan, skb, 0);
 
         cancel_delayed_work_sync(&conn->security_timer);
-        schedule_delayed_work(&conn->security_timer,
-                                        msecs_to_jiffies(SMP_TIMEOUT));
+        schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
 }
 
 static __u8 authreq_to_seclevel(__u8 authreq)
@@ -217,7 +216,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
 {
         u8 dist_keys = 0;
 
-        if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->flags)) {
+        if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
                 dist_keys = SMP_DIST_ENC_KEY;
                 authreq |= SMP_AUTH_BONDING;
         } else {
@@ -250,21 +249,27 @@ static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
                         (max_key_size < SMP_MIN_ENC_KEY_SIZE))
                 return SMP_ENC_KEY_SIZE;
 
-        smp->smp_key_size = max_key_size;
+        smp->enc_key_size = max_key_size;
 
         return 0;
 }
 
 static void smp_failure(struct l2cap_conn *conn, u8 reason, u8 send)
 {
+        struct hci_conn *hcon = conn->hcon;
+
         if (send)
                 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
                                                                 &reason);
 
-        clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->hcon->pend);
-        mgmt_auth_failed(conn->hcon->hdev, conn->dst, reason);
-        cancel_delayed_work_sync(&conn->security_timer);
-        smp_chan_destroy(conn);
+        clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->hcon->flags);
+        mgmt_auth_failed(conn->hcon->hdev, conn->dst, hcon->type,
+                         hcon->dst_type, reason);
+
+        if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
+                cancel_delayed_work_sync(&conn->security_timer);
+                smp_chan_destroy(conn);
+        }
 }
 
 #define JUST_WORKS      0x00
@@ -305,7 +310,7 @@ static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
                         remote_io > SMP_IO_KEYBOARD_DISPLAY)
                 method = JUST_WORKS;
         else
-                method = gen_method[local_io][remote_io];
+                method = gen_method[remote_io][local_io];
 
         /* If not bonding, don't ask user to confirm a Zero TK */
         if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
@@ -346,9 +351,11 @@ static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
         hci_dev_lock(hcon->hdev);
 
         if (method == REQ_PASSKEY)
-                ret = mgmt_user_passkey_request(hcon->hdev, conn->dst);
+                ret = mgmt_user_passkey_request(hcon->hdev, conn->dst,
+                                                hcon->type, hcon->dst_type);
         else
                 ret = mgmt_user_confirm_request(hcon->hdev, conn->dst,
+                                                hcon->type, hcon->dst_type,
                                                 cpu_to_le32(passkey), 0);
 
         hci_dev_unlock(hcon->hdev);
@@ -377,12 +384,11 @@ static void confirm_work(struct work_struct *work)
 
         if (conn->hcon->out)
                 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp, 0,
-                                conn->src, conn->hcon->dst_type, conn->dst,
-                                res);
+                             conn->src, conn->hcon->dst_type, conn->dst, res);
         else
                 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
-                                conn->hcon->dst_type, conn->dst, 0, conn->src,
-                                res);
+                             conn->hcon->dst_type, conn->dst, 0, conn->src,
+                             res);
         if (ret) {
                 reason = SMP_UNSPECIFIED;
                 goto error;
@@ -417,12 +423,10 @@ static void random_work(struct work_struct *work)
 
         if (hcon->out)
                 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp, 0,
-                                conn->src, hcon->dst_type, conn->dst,
-                                res);
+                             conn->src, hcon->dst_type, conn->dst, res);
         else
                 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
-                                hcon->dst_type, conn->dst, 0, conn->src,
-                                res);
+                             hcon->dst_type, conn->dst, 0, conn->src, res);
         if (ret) {
                 reason = SMP_UNSPECIFIED;
                 goto error;
@@ -446,16 +450,16 @@ static void random_work(struct work_struct *work)
                 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
                 swap128(key, stk);
 
-                memset(stk + smp->smp_key_size, 0,
-                                SMP_MAX_ENC_KEY_SIZE - smp->smp_key_size);
+                memset(stk + smp->enc_key_size, 0,
+                       SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
 
-                if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend)) {
+                if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
                         reason = SMP_UNSPECIFIED;
                         goto error;
                 }
 
                 hci_le_start_enc(hcon, ediv, rand, stk);
-                hcon->enc_key_size = smp->smp_key_size;
+                hcon->enc_key_size = smp->enc_key_size;
         } else {
                 u8 stk[16], r[16], rand[8];
                 __le16 ediv;
@@ -469,11 +473,12 @@ static void random_work(struct work_struct *work)
                 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
                 swap128(key, stk);
 
-                memset(stk + smp->smp_key_size, 0,
-                                SMP_MAX_ENC_KEY_SIZE - smp->smp_key_size);
+                memset(stk + smp->enc_key_size, 0,
+                                SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
 
-                hci_add_ltk(hcon->hdev, 0, conn->dst, smp->smp_key_size,
-                                                        ediv, rand, stk);
+                hci_add_ltk(hcon->hdev, conn->dst, hcon->dst_type,
+                            HCI_SMP_STK_SLAVE, 0, 0, stk, smp->enc_key_size,
+                            ediv, rand);
         }
 
         return;
@@ -506,7 +511,7 @@ void smp_chan_destroy(struct l2cap_conn *conn)
 {
         struct smp_chan *smp = conn->smp_chan;
 
-        clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->pend);
+        BUG_ON(!smp);
 
         if (smp->tfm)
                 crypto_free_blkcipher(smp->tfm);
@@ -571,7 +576,7 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
         if (conn->hcon->link_mode & HCI_LM_MASTER)
                 return SMP_CMD_NOTSUPP;
 
-        if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->pend))
+        if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
                 smp = smp_chan_create(conn);
 
         smp = conn->smp_chan;
@@ -584,6 +589,8 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
         if (req->auth_req & SMP_AUTH_BONDING)
                 auth = req->auth_req;
 
+        conn->hcon->pending_sec_level = authreq_to_seclevel(auth);
+
         build_pairing_cmd(conn, req, &rsp, auth);
 
         key_size = min(req->max_key_size, rsp.max_key_size);
@@ -698,23 +705,18 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
 
 static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
 {
-        struct link_key *key;
-        struct key_master_id *master;
+        struct smp_ltk *key;
         struct hci_conn *hcon = conn->hcon;
 
-        key = hci_find_link_key_type(hcon->hdev, conn->dst,
-                                                HCI_LK_SMP_LTK);
+        key = hci_find_ltk_by_addr(hcon->hdev, conn->dst, hcon->dst_type);
         if (!key)
                 return 0;
 
-        if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND,
-                                        &hcon->pend))
+        if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
                 return 1;
 
-        master = (void *) key->data;
-        hci_le_start_enc(hcon, master->ediv, master->rand,
-                                                key->val);
-        hcon->enc_key_size = key->pin_len;
+        hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
+        hcon->enc_key_size = key->enc_size;
 
         return 1;
 
@@ -733,7 +735,7 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
         if (smp_ltk_encrypt(conn))
                 return 0;
 
-        if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend))
+        if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
                 return 0;
 
         smp = smp_chan_create(conn);
@@ -772,7 +774,7 @@ int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
                 if (smp_ltk_encrypt(conn))
                         goto done;
 
-        if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend))
+        if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
                 return 0;
 
         smp = smp_chan_create(conn);
@@ -817,13 +819,19 @@ static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
 {
         struct smp_cmd_master_ident *rp = (void *) skb->data;
         struct smp_chan *smp = conn->smp_chan;
+        struct hci_dev *hdev = conn->hcon->hdev;
+        struct hci_conn *hcon = conn->hcon;
+        u8 authenticated;
 
         skb_pull(skb, sizeof(*rp));
 
-        hci_add_ltk(conn->hcon->hdev, 1, conn->dst, smp->smp_key_size,
-                                                rp->ediv, rp->rand, smp->tk);
-
+        hci_dev_lock(hdev);
+        authenticated = (conn->hcon->sec_level == BT_SECURITY_HIGH);
+        hci_add_ltk(conn->hcon->hdev, conn->dst, hcon->dst_type,
+                    HCI_SMP_LTK, 1, authenticated, smp->tk, smp->enc_key_size,
+                    rp->ediv, rp->rand);
         smp_distribute_keys(conn, 1);
+        hci_dev_unlock(hdev);
 
         return 0;
 }
@@ -908,7 +916,7 @@ int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
 
         BT_DBG("conn %p force %d", conn, force);
 
-        if (!test_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->pend))
+        if (!test_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
                 return 0;
 
         rsp = (void *) &smp->prsp[1];
@@ -933,6 +941,8 @@ int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
         if (*keydist & SMP_DIST_ENC_KEY) {
                 struct smp_cmd_encrypt_info enc;
                 struct smp_cmd_master_ident ident;
+                struct hci_conn *hcon = conn->hcon;
+                u8 authenticated;
                 __le16 ediv;
 
                 get_random_bytes(enc.ltk, sizeof(enc.ltk));
@@ -941,10 +951,12 @@ int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
 
                 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
 
-                hci_add_ltk(conn->hcon->hdev, 1, conn->dst, smp->smp_key_size,
-                                                ediv, ident.rand, enc.ltk);
+                authenticated = hcon->sec_level == BT_SECURITY_HIGH;
+                hci_add_ltk(conn->hcon->hdev, conn->dst, hcon->dst_type,
+                            HCI_SMP_LTK_SLAVE, 1, authenticated,
+                            enc.ltk, smp->enc_key_size, ediv, ident.rand);
 
-                ident.ediv = cpu_to_le16(ediv);
+                ident.ediv = ediv;
 
                 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
 
@@ -982,7 +994,7 @@ int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
         }
 
         if (conn->hcon->out || force) {
-                clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->pend);
+                clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
                 cancel_delayed_work_sync(&conn->security_timer);
                 smp_chan_destroy(conn);
         }
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 71773b014e0c..929e48aed444 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -167,10 +167,11 @@ static int br_set_mac_address(struct net_device *dev, void *p)
         struct sockaddr *addr = p;
 
         if (!is_valid_ether_addr(addr->sa_data))
-                return -EINVAL;
+                return -EADDRNOTAVAIL;
 
         spin_lock_bh(&br->lock);
-        if (compare_ether_addr(dev->dev_addr, addr->sa_data)) {
+        if (!ether_addr_equal(dev->dev_addr, addr->sa_data)) {
+                dev->addr_assign_type &= ~NET_ADDR_RANDOM;
                 memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
                 br_fdb_change_mac_address(br, addr->sa_data);
                 br_stp_change_bridge_id(br, addr->sa_data);
@@ -316,6 +317,9 @@ static const struct net_device_ops br_netdev_ops = {
         .ndo_add_slave           = br_add_slave,
         .ndo_del_slave           = br_del_slave,
         .ndo_fix_features        = br_fix_features,
+        .ndo_fdb_add             = br_fdb_add,
+        .ndo_fdb_del             = br_fdb_delete,
+        .ndo_fdb_dump            = br_fdb_dump,
 };
 
 static void br_dev_free(struct net_device *dev)
@@ -334,7 +338,7 @@ void br_dev_setup(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
 
-        random_ether_addr(dev->dev_addr);
+        eth_hw_addr_random(dev);
         ether_setup(dev);
 
         dev->netdev_ops = &br_netdev_ops;
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 5ba0c844d508..d21f32383517 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -107,8 +107,8 @@ void br_fdb_changeaddr(struct net_bridge_port *p, const unsigned char *newaddr)
                                 struct net_bridge_port *op;
                                 list_for_each_entry(op, &br->port_list, list) {
                                         if (op != p &&
-                                            !compare_ether_addr(op->dev->dev_addr,
-                                                                f->addr.addr)) {
+                                            ether_addr_equal(op->dev->dev_addr,
+                                                             f->addr.addr)) {
                                                 f->dst = op;
                                                 goto insert;
                                         }
@@ -214,8 +214,8 @@ void br_fdb_delete_by_port(struct net_bridge *br,
                                 struct net_bridge_port *op;
                                 list_for_each_entry(op, &br->port_list, list) {
                                         if (op != p &&
-                                            !compare_ether_addr(op->dev->dev_addr,
-                                                                f->addr.addr)) {
+                                            ether_addr_equal(op->dev->dev_addr,
+                                                             f->addr.addr)) {
                                                 f->dst = op;
                                                 goto skip_delete;
                                         }
@@ -237,7 +237,7 @@ struct net_bridge_fdb_entry *__br_fdb_get(struct net_bridge *br,
         struct net_bridge_fdb_entry *fdb;
 
         hlist_for_each_entry_rcu(fdb, h, &br->hash[br_mac_hash(addr)], hlist) {
-                if (!compare_ether_addr(fdb->addr.addr, addr)) {
+                if (ether_addr_equal(fdb->addr.addr, addr)) {
                         if (unlikely(has_expired(br, fdb)))
                                 break;
                         return fdb;
@@ -331,7 +331,7 @@ static struct net_bridge_fdb_entry *fdb_find(struct hlist_head *head,
         struct net_bridge_fdb_entry *fdb;
 
         hlist_for_each_entry(fdb, h, head, hlist) {
-                if (!compare_ether_addr(fdb->addr.addr, addr))
+                if (ether_addr_equal(fdb->addr.addr, addr))
                         return fdb;
         }
         return NULL;
@@ -344,7 +344,7 @@ static struct net_bridge_fdb_entry *fdb_find_rcu(struct hlist_head *head,
         struct net_bridge_fdb_entry *fdb;
 
         hlist_for_each_entry_rcu(fdb, h, head, hlist) {
-                if (!compare_ether_addr(fdb->addr.addr, addr))
+                if (ether_addr_equal(fdb->addr.addr, addr))
                         return fdb;
         }
         return NULL;
@@ -487,14 +487,14 @@ static int fdb_fill_info(struct sk_buff *skb, const struct net_bridge *br,
         ndm->ndm_ifindex = fdb->dst ? fdb->dst->dev->ifindex : br->dev->ifindex;
         ndm->ndm_state   = fdb_to_nud(fdb);
 
-        NLA_PUT(skb, NDA_LLADDR, ETH_ALEN, &fdb->addr);
-
+        if (nla_put(skb, NDA_LLADDR, ETH_ALEN, &fdb->addr))
+                goto nla_put_failure;
         ci.ndm_used      = jiffies_to_clock_t(now - fdb->used);
         ci.ndm_confirmed = 0;
         ci.ndm_updated   = jiffies_to_clock_t(now - fdb->updated);
         ci.ndm_refcnt    = 0;
-        NLA_PUT(skb, NDA_CACHEINFO, sizeof(ci), &ci);
-
+        if (nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
+                goto nla_put_failure;
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
@@ -535,44 +535,38 @@ errout:
 }
 
 /* Dump information about entries, in response to GETNEIGH */
-int br_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
+int br_fdb_dump(struct sk_buff *skb,
+                struct netlink_callback *cb,
+                struct net_device *dev,
+                int idx)
 {
-        struct net *net = sock_net(skb->sk);
-        struct net_device *dev;
-        int idx = 0;
-
-        rcu_read_lock();
-        for_each_netdev_rcu(net, dev) {
-                struct net_bridge *br = netdev_priv(dev);
-                int i;
+        struct net_bridge *br = netdev_priv(dev);
+        int i;
 
-                if (!(dev->priv_flags & IFF_EBRIDGE))
-                        continue;
+        if (!(dev->priv_flags & IFF_EBRIDGE))
+                goto out;
 
-                for (i = 0; i < BR_HASH_SIZE; i++) {
-                        struct hlist_node *h;
-                        struct net_bridge_fdb_entry *f;
-
-                        hlist_for_each_entry_rcu(f, h, &br->hash[i], hlist) {
-                                if (idx < cb->args[0])
-                                        goto skip;
+        for (i = 0; i < BR_HASH_SIZE; i++) {
+                struct hlist_node *h;
+                struct net_bridge_fdb_entry *f;
 
-                                if (fdb_fill_info(skb, br, f,
-                                                  NETLINK_CB(cb->skb).pid,
-                                                  cb->nlh->nlmsg_seq,
-                                                  RTM_NEWNEIGH,
-                                                  NLM_F_MULTI) < 0)
-                                        break;
+                hlist_for_each_entry_rcu(f, h, &br->hash[i], hlist) {
+                        if (idx < cb->args[0])
+                                goto skip;
+
+                        if (fdb_fill_info(skb, br, f,
+                                          NETLINK_CB(cb->skb).pid,
+                                          cb->nlh->nlmsg_seq,
+                                          RTM_NEWNEIGH,
+                                          NLM_F_MULTI) < 0)
+                                break;
 skip:
-                                ++idx;
-                        }
+                        ++idx;
                 }
         }
-        rcu_read_unlock();
 
-        cb->args[0] = idx;
-
-        return skb->len;
+out:
+        return idx;
 }
 
 /* Update (create or replace) forwarding database entry */
@@ -614,43 +608,11 @@ static int fdb_add_entry(struct net_bridge_port *source, const __u8 *addr,
 }
 
 /* Add new permanent fdb entry with RTM_NEWNEIGH */
-int br_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
+int br_fdb_add(struct ndmsg *ndm, struct net_device *dev,
+               unsigned char *addr, u16 nlh_flags)
 {
-        struct net *net = sock_net(skb->sk);
-        struct ndmsg *ndm;
-        struct nlattr *tb[NDA_MAX+1];
-        struct net_device *dev;
         struct net_bridge_port *p;
-        const __u8 *addr;
-        int err;
-
-        ASSERT_RTNL();
-        err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL);
-        if (err < 0)
-                return err;
-
-        ndm = nlmsg_data(nlh);
-        if (ndm->ndm_ifindex == 0) {
-                pr_info("bridge: RTM_NEWNEIGH with invalid ifindex\n");
-                return -EINVAL;
-        }
-
-        dev = __dev_get_by_index(net, ndm->ndm_ifindex);
-        if (dev == NULL) {
-                pr_info("bridge: RTM_NEWNEIGH with unknown ifindex\n");
-                return -ENODEV;
-        }
-
-        if (!tb[NDA_LLADDR] || nla_len(tb[NDA_LLADDR]) != ETH_ALEN) {
-                pr_info("bridge: RTM_NEWNEIGH with invalid address\n");
-                return -EINVAL;
-        }
-
-        addr = nla_data(tb[NDA_LLADDR]);
-        if (!is_valid_ether_addr(addr)) {
-                pr_info("bridge: RTM_NEWNEIGH with invalid ether address\n");
-                return -EINVAL;
-        }
+        int err = 0;
 
         if (!(ndm->ndm_state & (NUD_PERMANENT|NUD_NOARP|NUD_REACHABLE))) {
                 pr_info("bridge: RTM_NEWNEIGH with invalid state %#x\n", ndm->ndm_state);
@@ -670,14 +632,14 @@ int br_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
                 rcu_read_unlock();
         } else {
                 spin_lock_bh(&p->br->hash_lock);
-                err = fdb_add_entry(p, addr, ndm->ndm_state, nlh->nlmsg_flags);
+                err = fdb_add_entry(p, addr, ndm->ndm_state, nlh_flags);
                 spin_unlock_bh(&p->br->hash_lock);
         }
 
         return err;
 }
 
-static int fdb_delete_by_addr(struct net_bridge_port *p, const u8 *addr)
+static int fdb_delete_by_addr(struct net_bridge_port *p, u8 *addr)
 {
         struct net_bridge *br = p->br;
         struct hlist_head *head = &br->hash[br_mac_hash(addr)];
@@ -692,40 +654,12 @@ static int fdb_delete_by_addr(struct net_bridge_port *p, const u8 *addr)
 }
 
 /* Remove neighbor entry with RTM_DELNEIGH */
-int br_fdb_delete(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
+int br_fdb_delete(struct ndmsg *ndm, struct net_device *dev,
+                  unsigned char *addr)
 {
-        struct net *net = sock_net(skb->sk);
-        struct ndmsg *ndm;
         struct net_bridge_port *p;
-        struct nlattr *llattr;
-        const __u8 *addr;
-        struct net_device *dev;
         int err;
 
-        ASSERT_RTNL();
-        if (nlmsg_len(nlh) < sizeof(*ndm))
-                return -EINVAL;
-
-        ndm = nlmsg_data(nlh);
-        if (ndm->ndm_ifindex == 0) {
-                pr_info("bridge: RTM_DELNEIGH with invalid ifindex\n");
-                return -EINVAL;
-        }
-
-        dev = __dev_get_by_index(net, ndm->ndm_ifindex);
-        if (dev == NULL) {
-                pr_info("bridge: RTM_DELNEIGH with unknown ifindex\n");
-                return -ENODEV;
-        }
-
-        llattr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_LLADDR);
-        if (llattr == NULL || nla_len(llattr) != ETH_ALEN) {
-                pr_info("bridge: RTM_DELNEIGH with invalid address\n");
-                return -EINVAL;
-        }
-
-        addr = nla_data(llattr);
-
         p = br_port_get_rtnl(dev);
         if (p == NULL) {
                 pr_info("bridge: RTM_DELNEIGH %s not a bridge port\n",
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 61f65344e711..e9466d412707 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -34,7 +34,7 @@ static inline int should_deliver(const struct net_bridge_port *p,
                 p->state == BR_STATE_FORWARDING);
 }
 
-static inline unsigned packet_length(const struct sk_buff *skb)
+static inline unsigned int packet_length(const struct sk_buff *skb)
 {
         return skb->len - (skb->protocol == htons(ETH_P_8021Q) ? VLAN_HLEN : 0);
 }
@@ -47,6 +47,7 @@ int br_dev_queue_push_xmit(struct sk_buff *skb)
                 kfree_skb(skb);
         } else {
                 skb_push(skb, ETH_HLEN);
+                br_drop_fake_rtable(skb);
                 dev_queue_xmit(skb);
         }
 
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 5a31731be4d0..76f15fda0212 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -216,7 +216,7 @@ forward:
                 }
                 /* fall through */
         case BR_STATE_LEARNING:
-                if (!compare_ether_addr(p->br->dev->dev_addr, dest))
+                if (ether_addr_equal(p->br->dev->dev_addr, dest))
                         skb->pkt_type = PACKET_HOST;
 
                 NF_HOOK(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 702a1ae9220b..b66581208cb2 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -36,6 +36,8 @@
 #define mlock_dereference(X, br) \
         rcu_dereference_protected(X, lockdep_is_held(&br->multicast_lock))
 
+static void br_multicast_start_querier(struct net_bridge *br);
+
 #if IS_ENABLED(CONFIG_IPV6)
 static inline int ipv6_is_transient_multicast(const struct in6_addr *addr)
 {
@@ -241,7 +243,6 @@ static void br_multicast_group_expired(unsigned long data)
         hlist_del_rcu(&mp->hlist[mdb->ver]);
         mdb->size--;
 
-        del_timer(&mp->query_timer);
         call_rcu_bh(&mp->rcu, br_multicast_free_group);
 
 out:
@@ -271,7 +272,6 @@ static void br_multicast_del_pg(struct net_bridge *br,
                 rcu_assign_pointer(*pp, p->next);
                 hlist_del_init(&p->mglist);
                 del_timer(&p->timer);
-                del_timer(&p->query_timer);
                 call_rcu_bh(&p->rcu, br_multicast_free_pg);
 
                 if (!mp->ports && !mp->mglist &&
@@ -460,8 +460,8 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
         hopopt[3] = 2;                          /* Length of RA Option */
         hopopt[4] = 0;                          /* Type = 0x0000 (MLD) */
         hopopt[5] = 0;
-        hopopt[6] = IPV6_TLV_PAD0;              /* Pad0 */
-        hopopt[7] = IPV6_TLV_PAD0;              /* Pad0 */
+        hopopt[6] = IPV6_TLV_PAD1;              /* Pad1 */
+        hopopt[7] = IPV6_TLV_PAD1;              /* Pad1 */
 
         skb_put(skb, sizeof(*ip6h) + 8);
 
@@ -507,74 +507,6 @@ static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
         return NULL;
 }
 
-static void br_multicast_send_group_query(struct net_bridge_mdb_entry *mp)
-{
-        struct net_bridge *br = mp->br;
-        struct sk_buff *skb;
-
-        skb = br_multicast_alloc_query(br, &mp->addr);
-        if (!skb)
-                goto timer;
-
-        netif_rx(skb);
-
-timer:
-        if (++mp->queries_sent < br->multicast_last_member_count)
-                mod_timer(&mp->query_timer,
-                          jiffies + br->multicast_last_member_interval);
-}
-
-static void br_multicast_group_query_expired(unsigned long data)
-{
-        struct net_bridge_mdb_entry *mp = (void *)data;
-        struct net_bridge *br = mp->br;
-
-        spin_lock(&br->multicast_lock);
-        if (!netif_running(br->dev) || !mp->mglist ||
-            mp->queries_sent >= br->multicast_last_member_count)
-                goto out;
-
-        br_multicast_send_group_query(mp);
-
-out:
-        spin_unlock(&br->multicast_lock);
-}
-
-static void br_multicast_send_port_group_query(struct net_bridge_port_group *pg)
-{
-        struct net_bridge_port *port = pg->port;
-        struct net_bridge *br = port->br;
-        struct sk_buff *skb;
-
-        skb = br_multicast_alloc_query(br, &pg->addr);
-        if (!skb)
-                goto timer;
-
-        br_deliver(port, skb);
-
-timer:
-        if (++pg->queries_sent < br->multicast_last_member_count)
-                mod_timer(&pg->query_timer,
-                          jiffies + br->multicast_last_member_interval);
-}
-
-static void br_multicast_port_group_query_expired(unsigned long data)
-{
-        struct net_bridge_port_group *pg = (void *)data;
-        struct net_bridge_port *port = pg->port;
-        struct net_bridge *br = port->br;
-
-        spin_lock(&br->multicast_lock);
-        if (!netif_running(br->dev) || hlist_unhashed(&pg->mglist) ||
-            pg->queries_sent >= br->multicast_last_member_count)
-                goto out;
-
-        br_multicast_send_port_group_query(pg);
-
-out:
-        spin_unlock(&br->multicast_lock);
-}
-
 static struct net_bridge_mdb_entry *br_multicast_get_group(
         struct net_bridge *br, struct net_bridge_port *port,
         struct br_ip *group, int hash)
@@ -582,8 +514,8 @@ static struct net_bridge_mdb_entry *br_multicast_get_group(
         struct net_bridge_mdb_htable *mdb;
         struct net_bridge_mdb_entry *mp;
         struct hlist_node *p;
-        unsigned count = 0;
-        unsigned max;
+        unsigned int count = 0;
+        unsigned int max;
         int elasticity;
         int err;
 
@@ -690,8 +622,6 @@ rehash:
         mp->addr = *group;
         setup_timer(&mp->timer, br_multicast_group_expired,
                     (unsigned long)mp);
-        setup_timer(&mp->query_timer, br_multicast_group_query_expired,
-                    (unsigned long)mp);
 
         hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
         mdb->size++;
@@ -746,8 +676,6 @@ static int br_multicast_add_group(struct net_bridge *br,
         hlist_add_head(&p->mglist, &port->mglist);
         setup_timer(&p->timer, br_multicast_port_group_expired,
                     (unsigned long)p);
-        setup_timer(&p->query_timer, br_multicast_port_group_query_expired,
-                    (unsigned long)p);
 
         rcu_assign_pointer(*pp, p);
 
@@ -814,6 +742,20 @@ static void br_multicast_local_router_expired(unsigned long data)
 {
 }
 
+static void br_multicast_querier_expired(unsigned long data)
+{
+        struct net_bridge *br = (void *)data;
+
+        spin_lock(&br->multicast_lock);
+        if (!netif_running(br->dev) || br->multicast_disabled)
+                goto out;
+
+        br_multicast_start_querier(br);
+
+out:
+        spin_unlock(&br->multicast_lock);
+}
+
 static void __br_multicast_send_query(struct net_bridge *br,
                                       struct net_bridge_port *port,
                                       struct br_ip *ip)
@@ -840,6 +782,7 @@ static void br_multicast_send_query(struct net_bridge *br,
         struct br_ip br_group;
 
         if (!netif_running(br->dev) || br->multicast_disabled ||
+            !br->multicast_querier ||
             timer_pending(&br->multicast_querier_timer))
                 return;
 
@@ -1291,9 +1234,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
                      time_after(mp->timer.expires, time) :
                      try_to_del_timer_sync(&mp->timer) >= 0)) {
                         mod_timer(&mp->timer, time);
-
-                        mp->queries_sent = 0;
-                        mod_timer(&mp->query_timer, now);
                 }
 
                 goto out;
@@ -1310,9 +1250,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
                      time_after(p->timer.expires, time) :
                      try_to_del_timer_sync(&p->timer) >= 0)) {
                         mod_timer(&p->timer, time);
-
-                        p->queries_sent = 0;
-                        mod_timer(&p->query_timer, now);
                 }
 
                 break;
@@ -1361,8 +1298,8 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
         struct sk_buff *skb2 = skb;
         const struct iphdr *iph;
         struct igmphdr *ih;
-        unsigned len;
-        unsigned offset;
+        unsigned int len;
+        unsigned int offset;
         int err;
 
         /* We treat OOM as packet loss for now. */
@@ -1462,7 +1399,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
         u8 icmp6_type;
         u8 nexthdr;
         __be16 frag_off;
-        unsigned len;
+        unsigned int len;
         int offset;
         int err;
 
@@ -1628,6 +1565,7 @@ void br_multicast_init(struct net_bridge *br)
         br->hash_max = 512;
 
         br->multicast_router = 1;
+        br->multicast_querier = 0;
         br->multicast_last_member_count = 2;
         br->multicast_startup_query_count = 2;
 
@@ -1642,7 +1580,7 @@ void br_multicast_init(struct net_bridge *br)
         setup_timer(&br->multicast_router_timer,
                     br_multicast_local_router_expired, 0);
         setup_timer(&br->multicast_querier_timer,
-                    br_multicast_local_router_expired, 0);
+                    br_multicast_querier_expired, (unsigned long)br);
         setup_timer(&br->multicast_query_timer, br_multicast_query_expired,
                     (unsigned long)br);
 }
@@ -1681,7 +1619,6 @@ void br_multicast_stop(struct net_bridge *br)
                 hlist_for_each_entry_safe(mp, p, n, &mdb->mhash[i],
                                           hlist[ver]) {
                         del_timer(&mp->timer);
-                        del_timer(&mp->query_timer);
                         call_rcu_bh(&mp->rcu, br_multicast_free_group);
                 }
         }
@@ -1770,9 +1707,23 @@ unlock:
         return err;
 }
 
-int br_multicast_toggle(struct net_bridge *br, unsigned long val)
+static void br_multicast_start_querier(struct net_bridge *br)
 {
         struct net_bridge_port *port;
+
+        br_multicast_open(br);
+
+        list_for_each_entry(port, &br->port_list, list) {
+                if (port->state == BR_STATE_DISABLED ||
+                    port->state == BR_STATE_BLOCKING)
+                        continue;
+
+                __br_multicast_enable_port(port);
+        }
+}
+
+int br_multicast_toggle(struct net_bridge *br, unsigned long val)
+{
         int err = 0;
         struct net_bridge_mdb_htable *mdb;
 
@@ -1802,14 +1753,7 @@ rollback:
                         goto rollback;
         }
 
-        br_multicast_open(br);
-        list_for_each_entry(port, &br->port_list, list) {
-                if (port->state == BR_STATE_DISABLED ||
-                    port->state == BR_STATE_BLOCKING)
-                        continue;
-
-                __br_multicast_enable_port(port);
-        }
+        br_multicast_start_querier(br);
 
 unlock:
         spin_unlock_bh(&br->multicast_lock);
@@ -1817,6 +1761,24 @@ unlock:
         return err;
 }
 
+int br_multicast_set_querier(struct net_bridge *br, unsigned long val)
+{
+        val = !!val;
+
+        spin_lock_bh(&br->multicast_lock);
+        if (br->multicast_querier == val)
+                goto unlock;
+
+        br->multicast_querier = val;
+        if (val)
+                br_multicast_start_querier(br);
+
+unlock:
+        spin_unlock_bh(&br->multicast_lock);
+
+        return 0;
+}
+
 int br_multicast_set_hash_max(struct net_bridge *br, unsigned long val)
 {
         int err = -ENOENT;
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index dec4f3817133..e41456bd3cc6 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -54,12 +54,14 @@ static int brnf_call_ip6tables __read_mostly = 1;
 static int brnf_call_arptables __read_mostly = 1;
 static int brnf_filter_vlan_tagged __read_mostly = 0;
 static int brnf_filter_pppoe_tagged __read_mostly = 0;
+static int brnf_pass_vlan_indev __read_mostly = 0;
 #else
 #define brnf_call_iptables 1
 #define brnf_call_ip6tables 1
 #define brnf_call_arptables 1
 #define brnf_filter_vlan_tagged 0
 #define brnf_filter_pppoe_tagged 0
+#define brnf_pass_vlan_indev 0
 #endif
 
 #define IS_IP(skb) \
@@ -156,7 +158,7 @@ void br_netfilter_rtable_init(struct net_bridge *br)
         rt->dst.dev = br->dev;
         rt->dst.path = &rt->dst;
         dst_init_metrics(&rt->dst, br_dst_default_metrics, true);
-        rt->dst.flags   = DST_NOXFRM | DST_NOPEER;
+        rt->dst.flags   = DST_NOXFRM | DST_NOPEER | DST_FAKE_RTABLE;
         rt->dst.ops = &fake_dst_ops;
 }
 
@@ -503,6 +505,19 @@ bridged_dnat:
         return 0;
 }
 
+static struct net_device *brnf_get_logical_dev(struct sk_buff *skb, const struct net_device *dev)
+{
+        struct net_device *vlan, *br;
+
+        br = bridge_parent(dev);
+        if (brnf_pass_vlan_indev == 0 || !vlan_tx_tag_present(skb))
+                return br;
+
+        vlan = __vlan_find_dev_deep(br, vlan_tx_tag_get(skb) & VLAN_VID_MASK);
+
+        return vlan ? vlan : br;
+}
+
 /* Some common code for IPv4/IPv6 */
 static struct net_device *setup_pre_routing(struct sk_buff *skb)
 {
@@ -515,7 +530,7 @@ static struct net_device *setup_pre_routing(struct sk_buff *skb)
 
         nf_bridge->mask |= BRNF_NF_BRIDGE_PREROUTING;
         nf_bridge->physindev = skb->dev;
-        skb->dev = bridge_parent(skb->dev);
+        skb->dev = brnf_get_logical_dev(skb, skb->dev);
         if (skb->protocol == htons(ETH_P_8021Q))
                 nf_bridge->mask |= BRNF_8021Q;
         else if (skb->protocol == htons(ETH_P_PPP_SES))
@@ -543,7 +558,7 @@ static int check_hbh_len(struct sk_buff *skb)
                 int optlen = nh[off + 1] + 2;
 
                 switch (nh[off]) {
-                case IPV6_TLV_PAD0:
+                case IPV6_TLV_PAD1:
                         optlen = 1;
                         break;
 
@@ -694,11 +709,7 @@ static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff *skb,
                                    const struct net_device *out,
                                    int (*okfn)(struct sk_buff *))
 {
-        struct rtable *rt = skb_rtable(skb);
-
-        if (rt && rt == bridge_parent_rtable(in))
-                skb_dst_drop(skb);
-
+        br_drop_fake_rtable(skb);
         return NF_ACCEPT;
 }
 
@@ -778,7 +789,7 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
         else
                 skb->protocol = htons(ETH_P_IPV6);
 
-        NF_HOOK(pf, NF_INET_FORWARD, skb, bridge_parent(in), parent,
+        NF_HOOK(pf, NF_INET_FORWARD, skb, brnf_get_logical_dev(skb, in), parent,
                 br_nf_forward_finish);
 
         return NF_STOLEN;
@@ -1006,12 +1017,13 @@ static ctl_table brnf_table[] = {
                 .mode           = 0644,
                 .proc_handler   = brnf_sysctl_call_tables,
         },
-        { }
-};
-
-static struct ctl_path brnf_path[] = {
-        { .procname = "net", },
-        { .procname = "bridge", },
+        {
+                .procname       = "bridge-nf-pass-vlan-input-dev",
+                .data           = &brnf_pass_vlan_indev,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = brnf_sysctl_call_tables,
+        },
         { }
 };
 #endif
@@ -1030,7 +1042,7 @@ int __init br_netfilter_init(void)
                 return ret;
         }
 #ifdef CONFIG_SYSCTL
-        brnf_sysctl_header = register_sysctl_paths(brnf_path, brnf_table);
+        brnf_sysctl_header = register_net_sysctl(&init_net, "net/bridge", brnf_table);
         if (brnf_sysctl_header == NULL) {
                 printk(KERN_WARNING
                        "br_netfilter: can't register to sysctl.\n");
@@ -1047,7 +1059,7 @@ void br_netfilter_fini(void)
 {
         nf_unregister_hooks(br_nf_ops, ARRAY_SIZE(br_nf_ops));
 #ifdef CONFIG_SYSCTL
-        unregister_sysctl_table(brnf_sysctl_header);
+        unregister_net_sysctl_table(brnf_sysctl_header);
 #endif
         dst_entries_destroy(&fake_dst_ops);
 }
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index a1daf8227ed1..2080485515f1 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -60,20 +60,17 @@ static int br_fill_ifinfo(struct sk_buff *skb, const struct net_bridge_port *por
         hdr->ifi_flags = dev_get_flags(dev);
         hdr->ifi_change = 0;
 
-        NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
-        NLA_PUT_U32(skb, IFLA_MASTER, br->dev->ifindex);
-        NLA_PUT_U32(skb, IFLA_MTU, dev->mtu);
-        NLA_PUT_U8(skb, IFLA_OPERSTATE, operstate);
-
-        if (dev->addr_len)
-                NLA_PUT(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr);
-
-        if (dev->ifindex != dev->iflink)
-                NLA_PUT_U32(skb, IFLA_LINK, dev->iflink);
-
-        if (event == RTM_NEWLINK)
-                NLA_PUT_U8(skb, IFLA_PROTINFO, port->state);
-
+        if (nla_put_string(skb, IFLA_IFNAME, dev->name) ||
+            nla_put_u32(skb, IFLA_MASTER, br->dev->ifindex) ||
+            nla_put_u32(skb, IFLA_MTU, dev->mtu) ||
+            nla_put_u8(skb, IFLA_OPERSTATE, operstate) ||
+            (dev->addr_len &&
+             nla_put(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr)) ||
+            (dev->ifindex != dev->iflink &&
+             nla_put_u32(skb, IFLA_LINK, dev->iflink)) ||
+            (event == RTM_NEWLINK &&
+             nla_put_u8(skb, IFLA_PROTINFO, port->state)))
+                goto nla_put_failure;
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
@@ -91,7 +88,7 @@ void br_ifinfo_notify(int event, struct net_bridge_port *port)
         int err = -ENOBUFS;
 
         br_debug(port->br, "port %u(%s) event %d\n",
-                 (unsigned)port->port_no, port->dev->name, event);
+                 (unsigned int)port->port_no, port->dev->name, event);
 
         skb = nlmsg_new(br_nlmsg_size(), GFP_ATOMIC);
         if (skb == NULL)
@@ -235,18 +232,6 @@ int __init br_netlink_init(void)
                               br_rtm_setlink, NULL, NULL);
         if (err)
                 goto err3;
-        err = __rtnl_register(PF_BRIDGE, RTM_NEWNEIGH,
-                              br_fdb_add, NULL, NULL);
-        if (err)
-                goto err3;
-        err = __rtnl_register(PF_BRIDGE, RTM_DELNEIGH,
-                              br_fdb_delete, NULL, NULL);
-        if (err)
-                goto err3;
-        err = __rtnl_register(PF_BRIDGE, RTM_GETNEIGH,
-                              NULL, br_fdb_dump, NULL);
-        if (err)
-                goto err3;
 
         return 0;
 
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 0b67a63ad7a8..1a8ad4fb9a6b 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -82,9 +82,7 @@ struct net_bridge_port_group {
         struct hlist_node               mglist;
         struct rcu_head                 rcu;
         struct timer_list               timer;
-        struct timer_list               query_timer;
         struct br_ip                    addr;
-        u32                             queries_sent;
 };
 
 struct net_bridge_mdb_entry
@@ -94,10 +92,8 @@ struct net_bridge_mdb_entry
         struct net_bridge_port_group __rcu *ports;
         struct rcu_head                 rcu;
         struct timer_list               timer;
-        struct timer_list               query_timer;
         struct br_ip                    addr;
         bool                            mglist;
-        u32                             queries_sent;
 };
 
 struct net_bridge_mdb_htable
@@ -228,6 +224,7 @@ struct net_bridge
         unsigned char                   multicast_router;
 
         u8                              multicast_disabled:1;
+        u8                              multicast_querier:1;
 
         u32                             hash_elasticity;
         u32                             hash_max;
@@ -363,9 +360,18 @@ extern int br_fdb_insert(struct net_bridge *br,
 extern void br_fdb_update(struct net_bridge *br,
                           struct net_bridge_port *source,
                           const unsigned char *addr);
-extern int br_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb);
-extern int br_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg);
-extern int br_fdb_delete(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg);
+
+extern int br_fdb_delete(struct ndmsg *ndm,
+                         struct net_device *dev,
+                         unsigned char *addr);
+extern int br_fdb_add(struct ndmsg *nlh,
+                      struct net_device *dev,
+                      unsigned char *addr,
+                      u16 nlh_flags);
+extern int br_fdb_dump(struct sk_buff *skb,
+                       struct netlink_callback *cb,
+                       struct net_device *dev,
+                       int idx);
 
 /* br_forward.c */
 extern void br_deliver(const struct net_bridge_port *to,
@@ -421,6 +427,7 @@ extern int br_multicast_set_router(struct net_bridge *br, unsigned long val);
 extern int br_multicast_set_port_router(struct net_bridge_port *p,
                                         unsigned long val);
 extern int br_multicast_toggle(struct net_bridge *br, unsigned long val);
+extern int br_multicast_set_querier(struct net_bridge *br, unsigned long val);
 extern int br_multicast_set_hash_max(struct net_bridge *br, unsigned long val);
 
 static inline bool br_multicast_is_router(struct net_bridge *br)
diff --git a/net/bridge/br_private_stp.h b/net/bridge/br_private_stp.h
index 05ed9bc7e426..0c0fe36e7aa9 100644
--- a/net/bridge/br_private_stp.h
+++ b/net/bridge/br_private_stp.h
@@ -29,10 +29,9 @@
 #define BR_MIN_PATH_COST        1
 #define BR_MAX_PATH_COST        65535
 
-struct br_config_bpdu
-{
-        unsigned        topology_change:1;
-        unsigned        topology_change_ack:1;
+struct br_config_bpdu {
+        unsigned int    topology_change:1;
+        unsigned int    topology_change_ack:1;
         bridge_id       root;
         int             root_path_cost;
         bridge_id       bridge_id;
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index 8c836d96ba76..af9a12099ba4 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -32,7 +32,7 @@ static const char *const br_port_state_names[] = {
 void br_log_state(const struct net_bridge_port *p)
 {
         br_info(p->br, "port %u(%s) entered %s state\n",
-                (unsigned) p->port_no, p->dev->name,
+                (unsigned int) p->port_no, p->dev->name,
                 br_port_state_names[p->state]);
 }
 
@@ -478,7 +478,7 @@ void br_received_tcn_bpdu(struct net_bridge_port *p)
 {
         if (br_is_designated_port(p)) {
                 br_info(p->br, "port %u(%s) received tcn bpdu\n",
-                        (unsigned) p->port_no, p->dev->name);
+                        (unsigned int) p->port_no, p->dev->name);
 
                 br_topology_change_detection(p->br);
                 br_topology_change_acknowledge(p);
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index e16aade51ae0..fd30a6022dea 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -167,7 +167,7 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
         if (p->state == BR_STATE_DISABLED)
                 goto out;
 
-        if (compare_ether_addr(dest, br->group_addr) != 0)
+        if (!ether_addr_equal(dest, br->group_addr))
                 goto out;
 
         buf = skb_pull(skb, 3);
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index f494496373d6..9d5a414a3943 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -178,7 +178,7 @@ void br_stp_set_enabled(struct net_bridge *br, unsigned long val)
 /* called under bridge lock */
 void br_stp_change_bridge_id(struct net_bridge *br, const unsigned char *addr)
 {
-        /* should be aligned on 2 bytes for compare_ether_addr() */
+        /* should be aligned on 2 bytes for ether_addr_equal() */
         unsigned short oldaddr_aligned[ETH_ALEN >> 1];
         unsigned char *oldaddr = (unsigned char *)oldaddr_aligned;
         struct net_bridge_port *p;
@@ -191,12 +191,11 @@ void br_stp_change_bridge_id(struct net_bridge *br, const unsigned char *addr)
         memcpy(br->dev->dev_addr, addr, ETH_ALEN);
 
         list_for_each_entry(p, &br->port_list, list) {
-                if (!compare_ether_addr(p->designated_bridge.addr, oldaddr))
+                if (ether_addr_equal(p->designated_bridge.addr, oldaddr))
                         memcpy(p->designated_bridge.addr, addr, ETH_ALEN);
 
-                if (!compare_ether_addr(p->designated_root.addr, oldaddr))
+                if (ether_addr_equal(p->designated_root.addr, oldaddr))
                         memcpy(p->designated_root.addr, addr, ETH_ALEN);
-
         }
 
         br_configuration_update(br);
@@ -205,7 +204,7 @@ void br_stp_change_bridge_id(struct net_bridge *br, const unsigned char *addr)
                 br_become_root_bridge(br);
 }
 
-/* should be aligned on 2 bytes for compare_ether_addr() */
+/* should be aligned on 2 bytes for ether_addr_equal() */
 static const unsigned short br_mac_zero_aligned[ETH_ALEN >> 1];
 
 /* called under bridge lock */
@@ -227,7 +226,7 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
 
         }
 
-        if (compare_ether_addr(br->bridge_id.addr, addr) == 0)
+        if (ether_addr_equal(br->bridge_id.addr, addr))
                 return false;   /* no change */
 
         br_stp_change_bridge_id(br, addr);
diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
index 58de2a0f9975..a6747e673426 100644
--- a/net/bridge/br_stp_timer.c
+++ b/net/bridge/br_stp_timer.c
@@ -56,7 +56,7 @@ static void br_message_age_timer_expired(unsigned long arg)
                 return;
 
         br_info(br, "port %u(%s) neighbor %.2x%.2x.%pM lost\n",
-                (unsigned) p->port_no, p->dev->name,
+                (unsigned int) p->port_no, p->dev->name,
                 id->prio[0], id->prio[1], &id->addr);
 
         /*
@@ -84,7 +84,7 @@ static void br_forward_delay_timer_expired(unsigned long arg)
         struct net_bridge *br = p->br;
 
         br_debug(br, "port %u(%s) forward delay timer\n",
-                 (unsigned) p->port_no, p->dev->name);
+                 (unsigned int) p->port_no, p->dev->name);
         spin_lock(&br->lock);
         if (p->state == BR_STATE_LISTENING) {
                 p->state = BR_STATE_LEARNING;
@@ -131,7 +131,7 @@ static void br_hold_timer_expired(unsigned long arg)
         struct net_bridge_port *p = (struct net_bridge_port *) arg;
 
         br_debug(p->br, "port %u(%s) hold timer expired\n",
-                 (unsigned) p->port_no, p->dev->name);
+                 (unsigned int) p->port_no, p->dev->name);
 
         spin_lock(&p->br->lock);
         if (p->config_pending)
diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c
index c236c0e43984..c5c059333eab 100644
--- a/net/bridge/br_sysfs_br.c
+++ b/net/bridge/br_sysfs_br.c
@@ -297,7 +297,7 @@ static ssize_t store_group_addr(struct device *d,
                                 const char *buf, size_t len)
 {
         struct net_bridge *br = to_bridge(d);
-        unsigned new_addr[6];
+        unsigned int new_addr[6];
         int i;
 
         if (!capable(CAP_NET_ADMIN))
@@ -379,6 +379,23 @@ static ssize_t store_multicast_snooping(struct device *d,
 static DEVICE_ATTR(multicast_snooping, S_IRUGO | S_IWUSR,
                    show_multicast_snooping, store_multicast_snooping);
 
+static ssize_t show_multicast_querier(struct device *d,
+                                      struct device_attribute *attr,
+                                      char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%d\n", br->multicast_querier);
+}
+
+static ssize_t store_multicast_querier(struct device *d,
+                                       struct device_attribute *attr,
+                                       const char *buf, size_t len)
+{
+        return store_bridge_parm(d, buf, len, br_multicast_set_querier);
+}
+static DEVICE_ATTR(multicast_querier, S_IRUGO | S_IWUSR,
+                   show_multicast_querier, store_multicast_querier);
+
 static ssize_t show_hash_elasticity(struct device *d,
                                     struct device_attribute *attr, char *buf)
 {
@@ -702,6 +719,7 @@ static struct attribute *bridge_attrs[] = {
 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
         &dev_attr_multicast_router.attr,
         &dev_attr_multicast_snooping.attr,
+        &dev_attr_multicast_querier.attr,
         &dev_attr_hash_elasticity.attr,
         &dev_attr_hash_max.attr,
         &dev_attr_multicast_last_member_count.attr,
diff --git a/net/bridge/netfilter/ebt_stp.c b/net/bridge/netfilter/ebt_stp.c
index 5b33a2e634a6..071d87214dde 100644
--- a/net/bridge/netfilter/ebt_stp.c
+++ b/net/bridge/netfilter/ebt_stp.c
@@ -164,8 +164,8 @@ static int ebt_stp_mt_check(const struct xt_mtchk_param *par)
             !(info->bitmask & EBT_STP_MASK))
                 return -EINVAL;
         /* Make sure the match only receives stp frames */
-        if (compare_ether_addr(e->destmac, bridge_ula) ||
-            compare_ether_addr(e->destmsk, msk) || !(e->bitmask & EBT_DESTMAC))
+        if (!ether_addr_equal(e->destmac, bridge_ula) ||
+            !ether_addr_equal(e->destmsk, msk) || !(e->bitmask & EBT_DESTMAC))
                 return -EINVAL;
 
         return 0;
diff --git a/net/caif/Kconfig b/net/caif/Kconfig
index 936361e5a2b6..d3694953b1d7 100644
--- a/net/caif/Kconfig
+++ b/net/caif/Kconfig
@@ -25,7 +25,7 @@ config  CAIF_DEBUG
         bool "Enable Debug"
         depends on CAIF
         default n
-        --- help ---
+        ---help---
         Enable the inclusion of debug code in the CAIF stack.
         Be aware that doing this will impact performance.
         If unsure say N.
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 82c57069415f..aa6f716524fd 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -162,7 +162,6 @@ void caif_flow_cb(struct sk_buff *skb)
 static int transmit(struct cflayer *layer, struct cfpkt *pkt)
 {
         int err, high = 0, qlen = 0;
-        struct caif_dev_common *caifdev;
         struct caif_device_entry *caifd =
             container_of(layer, struct caif_device_entry, layer);
         struct sk_buff *skb;
@@ -174,7 +173,6 @@ static int transmit(struct cflayer *layer, struct cfpkt *pkt)
         skb->dev = caifd->netdev;
         skb_reset_network_header(skb);
         skb->protocol = htons(ETH_P_CAIF);
-        caifdev = netdev_priv(caifd->netdev);
 
         /* Check if we need to handle xoff */
         if (likely(caifd->netdev->tx_queue_len == 0))
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index a97d97a3a512..fb8944355264 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -19,7 +19,7 @@
 #include <linux/uaccess.h>
 #include <linux/debugfs.h>
 #include <linux/caif/caif_socket.h>
-#include <linux/atomic.h>
+#include <linux/pkt_sched.h>
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <net/caif/caif_layer.h>
@@ -43,34 +43,9 @@ enum caif_states {
 #define TX_FLOW_ON_BIT  1
 #define RX_FLOW_ON_BIT  2
 
-static struct dentry *debugfsdir;
-
-#ifdef CONFIG_DEBUG_FS
-struct debug_fs_counter {
-        atomic_t caif_nr_socks;
-        atomic_t caif_sock_create;
-        atomic_t num_connect_req;
-        atomic_t num_connect_resp;
-        atomic_t num_connect_fail_resp;
-        atomic_t num_disconnect;
-        atomic_t num_remote_shutdown_ind;
-        atomic_t num_tx_flow_off_ind;
-        atomic_t num_tx_flow_on_ind;
-        atomic_t num_rx_flow_off;
-        atomic_t num_rx_flow_on;
-};
-static struct debug_fs_counter cnt;
-#define dbfs_atomic_inc(v) atomic_inc_return(v)
-#define dbfs_atomic_dec(v) atomic_dec_return(v)
-#else
-#define dbfs_atomic_inc(v) 0
-#define dbfs_atomic_dec(v) 0
-#endif
-
 struct caifsock {
         struct sock sk; /* must be first member */
         struct cflayer layer;
-        char name[CAIF_LAYER_NAME_SZ]; /* Used for debugging */
         u32 flow_state;
         struct caif_connect_request conn_req;
         struct mutex readlock;
@@ -155,13 +130,11 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
         struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
 
         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
-                (unsigned)sk->sk_rcvbuf && rx_flow_is_on(cf_sk)) {
-                if (net_ratelimit())
-                        pr_debug("sending flow OFF (queue len = %d %d)\n",
-                                        atomic_read(&cf_sk->sk.sk_rmem_alloc),
-                                        sk_rcvbuf_lowwater(cf_sk));
+                (unsigned int)sk->sk_rcvbuf && rx_flow_is_on(cf_sk)) {
+                net_dbg_ratelimited("sending flow OFF (queue len = %d %d)\n",
+                                    atomic_read(&cf_sk->sk.sk_rmem_alloc),
+                                    sk_rcvbuf_lowwater(cf_sk));
                 set_rx_flow_off(cf_sk);
-                dbfs_atomic_inc(&cnt.num_rx_flow_off);
                 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
         }
 
@@ -170,9 +143,7 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 return err;
         if (!sk_rmem_schedule(sk, skb->truesize) && rx_flow_is_on(cf_sk)) {
                 set_rx_flow_off(cf_sk);
-                if (net_ratelimit())
-                        pr_debug("sending flow OFF due to rmem_schedule\n");
-                dbfs_atomic_inc(&cnt.num_rx_flow_off);
+                net_dbg_ratelimited("sending flow OFF due to rmem_schedule\n");
                 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
         }
         skb->dev = NULL;
@@ -233,14 +204,12 @@ static void caif_ctrl_cb(struct cflayer *layr,
         switch (flow) {
         case CAIF_CTRLCMD_FLOW_ON_IND:
                 /* OK from modem to start sending again */
-                dbfs_atomic_inc(&cnt.num_tx_flow_on_ind);
                 set_tx_flow_on(cf_sk);
                 cf_sk->sk.sk_state_change(&cf_sk->sk);
                 break;
 
         case CAIF_CTRLCMD_FLOW_OFF_IND:
                 /* Modem asks us to shut up */
-                dbfs_atomic_inc(&cnt.num_tx_flow_off_ind);
                 set_tx_flow_off(cf_sk);
                 cf_sk->sk.sk_state_change(&cf_sk->sk);
                 break;
@@ -249,7 +218,6 @@ static void caif_ctrl_cb(struct cflayer *layr,
                 /* We're now connected */
                 caif_client_register_refcnt(&cf_sk->layer,
                                                 cfsk_hold, cfsk_put);
-                dbfs_atomic_inc(&cnt.num_connect_resp);
                 cf_sk->sk.sk_state = CAIF_CONNECTED;
                 set_tx_flow_on(cf_sk);
                 cf_sk->sk.sk_state_change(&cf_sk->sk);
@@ -263,7 +231,6 @@ static void caif_ctrl_cb(struct cflayer *layr,
 
         case CAIF_CTRLCMD_INIT_FAIL_RSP:
                 /* Connect request failed */
-                dbfs_atomic_inc(&cnt.num_connect_fail_resp);
                 cf_sk->sk.sk_err = ECONNREFUSED;
                 cf_sk->sk.sk_state = CAIF_DISCONNECTED;
                 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
@@ -277,7 +244,6 @@ static void caif_ctrl_cb(struct cflayer *layr,
 
         case CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND:
                 /* Modem has closed this connection, or device is down. */
-                dbfs_atomic_inc(&cnt.num_remote_shutdown_ind);
                 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
                 cf_sk->sk.sk_err = ECONNRESET;
                 set_rx_flow_on(cf_sk);
@@ -297,7 +263,6 @@ static void caif_check_flow_release(struct sock *sk)
                 return;
 
         if (atomic_read(&sk->sk_rmem_alloc) <= sk_rcvbuf_lowwater(cf_sk)) {
-                        dbfs_atomic_inc(&cnt.num_rx_flow_on);
                         set_rx_flow_on(cf_sk);
                         caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
         }
@@ -538,6 +503,7 @@ static int transmit_skb(struct sk_buff *skb, struct caifsock *cf_sk,
 
         pkt = cfpkt_fromnative(CAIF_DIR_OUT, skb);
         memset(skb->cb, 0, sizeof(struct caif_payload_info));
+        cfpkt_set_prio(pkt, cf_sk->sk.sk_priority);
 
         if (cf_sk->layer.dn == NULL) {
                 kfree_skb(skb);
@@ -856,7 +822,6 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
         /*ifindex = id of the interface.*/
         cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
 
-        dbfs_atomic_inc(&cnt.num_connect_req);
         cf_sk->layer.receive = caif_sktrecv_cb;
 
         err = caif_connect_client(sock_net(sk), &cf_sk->conn_req,
@@ -945,8 +910,6 @@ static int caif_release(struct socket *sock)
         spin_unlock_bh(&sk->sk_receive_queue.lock);
         sock->sk = NULL;
 
-        dbfs_atomic_inc(&cnt.num_disconnect);
-
         WARN_ON(IS_ERR(cf_sk->debugfs_socket_dir));
         if (cf_sk->debugfs_socket_dir != NULL)
                 debugfs_remove_recursive(cf_sk->debugfs_socket_dir);
@@ -1054,14 +1017,12 @@ static void caif_sock_destructor(struct sock *sk)
                 return;
         }
         sk_stream_kill_queues(&cf_sk->sk);
-        dbfs_atomic_dec(&cnt.caif_nr_socks);
         caif_free_client(&cf_sk->layer);
 }
 
 static int caif_create(struct net *net, struct socket *sock, int protocol,
                         int kern)
 {
-        int num;
         struct sock *sk = NULL;
         struct caifsock *cf_sk = NULL;
         static struct proto prot = {.name = "PF_CAIF",
@@ -1100,6 +1061,18 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
         /* Store the protocol */
         sk->sk_protocol = (unsigned char) protocol;
 
+        /* Initialize default priority for well-known cases */
+        switch (protocol) {
+        case CAIFPROTO_AT:
+                sk->sk_priority = TC_PRIO_CONTROL;
+                break;
+        case CAIFPROTO_RFM:
+                sk->sk_priority = TC_PRIO_INTERACTIVE_BULK;
+                break;
+        default:
+                sk->sk_priority = TC_PRIO_BESTEFFORT;
+        }
+
         /*
          * Lock in order to try to stop someone from opening the socket
          * too early.
@@ -1119,37 +1092,8 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
         set_rx_flow_on(cf_sk);
 
         /* Set default options on configuration */
-        cf_sk->sk.sk_priority = CAIF_PRIO_NORMAL;
         cf_sk->conn_req.link_selector = CAIF_LINK_LOW_LATENCY;
         cf_sk->conn_req.protocol = protocol;
-        /* Increase the number of sockets created. */
-        dbfs_atomic_inc(&cnt.caif_nr_socks);
-        num = dbfs_atomic_inc(&cnt.caif_sock_create);
-#ifdef CONFIG_DEBUG_FS
-        if (!IS_ERR(debugfsdir)) {
-
-                /* Fill in some information concerning the misc socket. */
-                snprintf(cf_sk->name, sizeof(cf_sk->name), "cfsk%d", num);
-
-                cf_sk->debugfs_socket_dir =
-                        debugfs_create_dir(cf_sk->name, debugfsdir);
-
-                debugfs_create_u32("sk_state", S_IRUSR | S_IWUSR,
-                                cf_sk->debugfs_socket_dir,
-                                (u32 *) &cf_sk->sk.sk_state);
-                debugfs_create_u32("flow_state", S_IRUSR | S_IWUSR,
-                                cf_sk->debugfs_socket_dir, &cf_sk->flow_state);
-                debugfs_create_u32("sk_rmem_alloc", S_IRUSR | S_IWUSR,
-                                cf_sk->debugfs_socket_dir,
-                                (u32 *) &cf_sk->sk.sk_rmem_alloc);
-                debugfs_create_u32("sk_wmem_alloc", S_IRUSR | S_IWUSR,
-                                cf_sk->debugfs_socket_dir,
-                                (u32 *) &cf_sk->sk.sk_wmem_alloc);
-                debugfs_create_u32("identity", S_IRUSR | S_IWUSR,
-                                cf_sk->debugfs_socket_dir,
-                                (u32 *) &cf_sk->layer.id);
-        }
-#endif
         release_sock(&cf_sk->sk);
         return 0;
 }
@@ -1161,7 +1105,7 @@ static struct net_proto_family caif_family_ops = {
         .owner = THIS_MODULE,
 };
 
-static int af_caif_init(void)
+static int __init caif_sktinit_module(void)
 {
         int err = sock_register(&caif_family_ops);
         if (!err)
@@ -1169,54 +1113,9 @@ static int af_caif_init(void)
         return 0;
 }
 
-static int __init caif_sktinit_module(void)
-{
-#ifdef CONFIG_DEBUG_FS
-        debugfsdir = debugfs_create_dir("caif_sk", NULL);
-        if (!IS_ERR(debugfsdir)) {
-                debugfs_create_u32("num_sockets", S_IRUSR | S_IWUSR,
-                                debugfsdir,
-                                (u32 *) &cnt.caif_nr_socks);
-                debugfs_create_u32("num_create", S_IRUSR | S_IWUSR,
-                                debugfsdir,
-                                (u32 *) &cnt.caif_sock_create);
-                debugfs_create_u32("num_connect_req", S_IRUSR | S_IWUSR,
-                                debugfsdir,
-                                (u32 *) &cnt.num_connect_req);
-                debugfs_create_u32("num_connect_resp", S_IRUSR | S_IWUSR,
-                                debugfsdir,
-                                (u32 *) &cnt.num_connect_resp);
-                debugfs_create_u32("num_connect_fail_resp", S_IRUSR | S_IWUSR,
-                                debugfsdir,
-                                (u32 *) &cnt.num_connect_fail_resp);
-                debugfs_create_u32("num_disconnect", S_IRUSR | S_IWUSR,
-                                debugfsdir,
-                                (u32 *) &cnt.num_disconnect);
-                debugfs_create_u32("num_remote_shutdown_ind",
-                                S_IRUSR | S_IWUSR, debugfsdir,
-                                (u32 *) &cnt.num_remote_shutdown_ind);
-                debugfs_create_u32("num_tx_flow_off_ind", S_IRUSR | S_IWUSR,
-                                debugfsdir,
-                                (u32 *) &cnt.num_tx_flow_off_ind);
-                debugfs_create_u32("num_tx_flow_on_ind", S_IRUSR | S_IWUSR,
-                                debugfsdir,
-                                (u32 *) &cnt.num_tx_flow_on_ind);
-                debugfs_create_u32("num_rx_flow_off", S_IRUSR | S_IWUSR,
-                                debugfsdir,
-                                (u32 *) &cnt.num_rx_flow_off);
-                debugfs_create_u32("num_rx_flow_on", S_IRUSR | S_IWUSR,
-                                debugfsdir,
-                                (u32 *) &cnt.num_rx_flow_on);
-        }
-#endif
-        return af_caif_init();
-}
-
 static void __exit caif_sktexit_module(void)
 {
         sock_unregister(PF_CAIF);
-        if (debugfsdir != NULL)
-                debugfs_remove_recursive(debugfsdir);
 }
 module_init(caif_sktinit_module);
 module_exit(caif_sktexit_module);
diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
index 5cf52225692e..047cd0eec022 100644
--- a/net/caif/cfctrl.c
+++ b/net/caif/cfctrl.c
@@ -9,6 +9,7 @@
 #include <linux/stddef.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
+#include <linux/pkt_sched.h>
 #include <net/caif/caif_layer.h>
 #include <net/caif/cfpkt.h>
 #include <net/caif/cfctrl.h>
@@ -189,6 +190,7 @@ void cfctrl_enum_req(struct cflayer *layer, u8 physlinkid)
         cfctrl->serv.dev_info.id = physlinkid;
         cfpkt_addbdy(pkt, CFCTRL_CMD_ENUM);
         cfpkt_addbdy(pkt, physlinkid);
+        cfpkt_set_prio(pkt, TC_PRIO_CONTROL);
         dn->transmit(dn, pkt);
 }
 
@@ -281,6 +283,7 @@ int cfctrl_linkup_request(struct cflayer *layer,
          *      might arrive with the newly allocated channel ID.
          */
         cfpkt_info(pkt)->dev_info->id = param->phyid;
+        cfpkt_set_prio(pkt, TC_PRIO_CONTROL);
         ret =
             dn->transmit(dn, pkt);
         if (ret < 0) {
@@ -314,6 +317,7 @@ int cfctrl_linkdown_req(struct cflayer *layer, u8 channelid,
         cfpkt_addbdy(pkt, CFCTRL_CMD_LINK_DESTROY);
         cfpkt_addbdy(pkt, channelid);
         init_info(cfpkt_info(pkt), cfctrl);
+        cfpkt_set_prio(pkt, TC_PRIO_CONTROL);
         ret =
             dn->transmit(dn, pkt);
 #ifndef CAIF_NO_LOOP
diff --git a/net/caif/cfdbgl.c b/net/caif/cfdbgl.c
index 65d6ef3cf9aa..2914659eb9b2 100644
--- a/net/caif/cfdbgl.c
+++ b/net/caif/cfdbgl.c
@@ -41,8 +41,10 @@ static int cfdbgl_transmit(struct cflayer *layr, struct cfpkt *pkt)
         struct caif_payload_info *info;
         int ret;
 
-        if (!cfsrvl_ready(service, &ret))
+        if (!cfsrvl_ready(service, &ret)) {
+                cfpkt_destroy(pkt);
                 return ret;
+        }
 
         /* Add info for MUX-layer to route the packet out */
         info = cfpkt_info(pkt);
diff --git a/net/caif/cfdgml.c b/net/caif/cfdgml.c
index 0f5ff27aa41c..a63f4a5f5aff 100644
--- a/net/caif/cfdgml.c
+++ b/net/caif/cfdgml.c
@@ -86,12 +86,17 @@ static int cfdgml_transmit(struct cflayer *layr, struct cfpkt *pkt)
         struct caif_payload_info *info;
         struct cfsrvl *service = container_obj(layr);
         int ret;
-        if (!cfsrvl_ready(service, &ret))
+
+        if (!cfsrvl_ready(service, &ret)) {
+                cfpkt_destroy(pkt);
                 return ret;
+        }
 
         /* STE Modem cannot handle more than 1500 bytes datagrams */
-        if (cfpkt_getlen(pkt) > DGM_MTU)
+        if (cfpkt_getlen(pkt) > DGM_MTU) {
+                cfpkt_destroy(pkt);
                 return -EMSGSIZE;
+        }
 
         cfpkt_add_head(pkt, &zero, 3);
         packet_type = 0x08; /* B9 set - UNCLASSIFIED */
diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c
index e335ba859b97..863dedd91bb6 100644
--- a/net/caif/cfpkt_skbuff.c
+++ b/net/caif/cfpkt_skbuff.c
@@ -381,6 +381,7 @@ struct cfpkt *cfpkt_split(struct cfpkt *pkt, u16 pos)
         memcpy(skb2->data, split, len2nd);
         skb2->tail += len2nd;
         skb2->len += len2nd;
+        skb2->priority = skb->priority;
         return skb_to_pkt(skb2);
 }
 
@@ -394,3 +395,9 @@ struct caif_payload_info *cfpkt_info(struct cfpkt *pkt)
         return (struct caif_payload_info *)&pkt_to_skb(pkt)->cb;
 }
 EXPORT_SYMBOL(cfpkt_info);
+
+void cfpkt_set_prio(struct cfpkt *pkt, int prio)
+{
+        pkt_to_skb(pkt)->priority = prio;
+}
+EXPORT_SYMBOL(cfpkt_set_prio);
diff --git a/net/caif/cfrfml.c b/net/caif/cfrfml.c
index 6dc75d4f8d94..2b563ad04597 100644
--- a/net/caif/cfrfml.c
+++ b/net/caif/cfrfml.c
@@ -184,6 +184,11 @@ out:
                                         rfml->serv.dev_info.id);
         }
         spin_unlock(&rfml->sync);
+
+        if (unlikely(err == -EAGAIN))
+                /* It is not possible to recover after drop of a fragment */
+                err = -EIO;
+
         return err;
 }
 
@@ -218,7 +223,7 @@ static int cfrfml_transmit(struct cflayer *layr, struct cfpkt *pkt)
         caif_assert(layr->dn->transmit != NULL);
 
         if (!cfsrvl_ready(&rfml->serv, &err))
-                return err;
+                goto out;
 
         err = -EPROTO;
         if (cfpkt_getlen(pkt) <= RFM_HEAD_SIZE-1)
@@ -251,8 +256,11 @@ static int cfrfml_transmit(struct cflayer *layr, struct cfpkt *pkt)
 
                 err = cfrfml_transmit_segment(rfml, frontpkt);
 
-                if (err != 0)
+                if (err != 0) {
+                        frontpkt = NULL;
                         goto out;
+                }
+
                 frontpkt = rearpkt;
                 rearpkt = NULL;
 
@@ -286,19 +294,8 @@ out:
                 if (rearpkt)
                         cfpkt_destroy(rearpkt);
 
-                if (frontpkt && frontpkt != pkt) {
-
+                if (frontpkt)
                         cfpkt_destroy(frontpkt);
-                        /*
-                         * Socket layer will free the original packet,
-                         * but this packet may already be sent and
-                         * freed. So we have to return 0 in this case
-                         * to avoid socket layer to re-free this packet.
-                         * The return of shutdown indication will
-                         * cause connection to be invalidated anyhow.
-                         */
-                        err = 0;
-                }
         }
 
         return err;
diff --git a/net/caif/cfsrvl.c b/net/caif/cfsrvl.c
index b99f5b22689d..dd485f6128e8 100644
--- a/net/caif/cfsrvl.c
+++ b/net/caif/cfsrvl.c
@@ -11,6 +11,7 @@
 #include <linux/errno.h>
 #include <linux/slab.h>
 #include <linux/module.h>
+#include <linux/pkt_sched.h>
 #include <net/caif/caif_layer.h>
 #include <net/caif/cfsrvl.h>
 #include <net/caif/cfpkt.h>
@@ -120,6 +121,7 @@ static int cfservl_modemcmd(struct cflayer *layr, enum caif_modemcmd ctrl)
                         info->channel_id = service->layer.id;
                         info->hdr_len = 1;
                         info->dev_info = &service->dev_info;
+                        cfpkt_set_prio(pkt, TC_PRIO_CONTROL);
                         return layr->dn->transmit(layr->dn, pkt);
                 }
         case CAIF_MODEMCMD_FLOW_OFF_REQ:
@@ -140,6 +142,7 @@ static int cfservl_modemcmd(struct cflayer *layr, enum caif_modemcmd ctrl)
                         info->channel_id = service->layer.id;
                         info->hdr_len = 1;
                         info->dev_info = &service->dev_info;
+                        cfpkt_set_prio(pkt, TC_PRIO_CONTROL);
                         return layr->dn->transmit(layr->dn, pkt);
                 }
         default:
@@ -174,15 +177,11 @@ void cfsrvl_init(struct cfsrvl *service,
 
 bool cfsrvl_ready(struct cfsrvl *service, int *err)
 {
-        if (service->open && service->modem_flow_on && service->phy_flow_on)
-                return true;
         if (!service->open) {
                 *err = -ENOTCONN;
                 return false;
         }
-        caif_assert(!(service->modem_flow_on && service->phy_flow_on));
-        *err = -EAGAIN;
-        return false;
+        return true;
 }
 
 u8 cfsrvl_getphyid(struct cflayer *layer)
diff --git a/net/caif/cfutill.c b/net/caif/cfutill.c
index 53e49f3e3af3..86d2dadb4b73 100644
--- a/net/caif/cfutill.c
+++ b/net/caif/cfutill.c
@@ -84,8 +84,11 @@ static int cfutill_transmit(struct cflayer *layr, struct cfpkt *pkt)
         caif_assert(layr != NULL);
         caif_assert(layr->dn != NULL);
         caif_assert(layr->dn->transmit != NULL);
-        if (!cfsrvl_ready(service, &ret))
+
+        if (!cfsrvl_ready(service, &ret)) {
+                cfpkt_destroy(pkt);
                 return ret;
+        }
 
         cfpkt_add_head(pkt, &zero, 1);
         /* Add info for MUX-layer to route the packet out. */
diff --git a/net/caif/cfvidl.c b/net/caif/cfvidl.c
index e3f37db40ac3..a8e2a2d758a5 100644
--- a/net/caif/cfvidl.c
+++ b/net/caif/cfvidl.c
@@ -50,8 +50,12 @@ static int cfvidl_transmit(struct cflayer *layr, struct cfpkt *pkt)
         struct caif_payload_info *info;
         u32 videoheader = 0;
         int ret;
-        if (!cfsrvl_ready(service, &ret))
+
+        if (!cfsrvl_ready(service, &ret)) {
+                cfpkt_destroy(pkt);
                 return ret;
+        }
+
         cfpkt_add_head(pkt, &videoheader, 4);
         /* Add info for MUX-layer to route the packet out */
         info = cfpkt_info(pkt);
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index 865690948bbc..69771c04ba8f 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -28,6 +28,7 @@
 /* 5 sec. connect timeout */
 #define CONNECT_TIMEOUT (5 * HZ)
 #define CAIF_NET_DEFAULT_QUEUE_LEN 500
+#define UNDEF_CONNID 0xffffffff
 
 /*This list is protected by the rtnl lock. */
 static LIST_HEAD(chnl_net_list);
@@ -72,14 +73,12 @@ static void robust_list_del(struct list_head *delete_node)
 static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
 {
         struct sk_buff *skb;
-        struct chnl_net *priv  = container_of(layr, struct chnl_net, chnl);
+        struct chnl_net *priv;
         int pktlen;
-        int err = 0;
         const u8 *ip_version;
         u8 buf;
 
         priv = container_of(layr, struct chnl_net, chnl);
-
         if (!priv)
                 return -EINVAL;
 
@@ -95,8 +94,7 @@ static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
 
         /* check the version of IP */
         ip_version = skb_header_pointer(skb, 0, 1, &buf);
-        if (!ip_version)
-                return -EINVAL;
+
         switch (*ip_version >> 4) {
         case 4:
                 skb->protocol = htons(ETH_P_IP);
@@ -105,6 +103,8 @@ static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
                 skb->protocol = htons(ETH_P_IPV6);
                 break;
         default:
+                kfree_skb(skb);
+                priv->netdev->stats.rx_errors++;
                 return -EINVAL;
         }
 
@@ -123,7 +123,7 @@ static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
         priv->netdev->stats.rx_packets++;
         priv->netdev->stats.rx_bytes += pktlen;
 
-        return err;
+        return 0;
 }
 
 static int delete_device(struct chnl_net *dev)
@@ -221,12 +221,16 @@ static int chnl_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         if (skb->len > priv->netdev->mtu) {
                 pr_warn("Size of skb exceeded MTU\n");
-                return -ENOSPC;
+                kfree_skb(skb);
+                dev->stats.tx_errors++;
+                return NETDEV_TX_OK;
         }
 
         if (!priv->flowenabled) {
                 pr_debug("dropping packets flow off\n");
-                return NETDEV_TX_BUSY;
+                kfree_skb(skb);
+                dev->stats.tx_dropped++;
+                return NETDEV_TX_OK;
         }
 
         if (priv->conn_req.protocol == CAIFPROTO_DATAGRAM_LOOP)
@@ -240,9 +244,8 @@ static int chnl_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
         /* Send the packet down the stack. */
         result = priv->chnl.dn->transmit(priv->chnl.dn, pkt);
         if (result) {
-                if (result == -EAGAIN)
-                        result = NETDEV_TX_BUSY;
-                return result;
+                dev->stats.tx_dropped++;
+                return NETDEV_TX_OK;
         }
 
         /* Update statistics. */
@@ -409,7 +412,7 @@ static void ipcaif_net_setup(struct net_device *dev)
         priv->conn_req.link_selector = CAIF_LINK_HIGH_BANDW;
         priv->conn_req.priority = CAIF_PRIO_LOW;
         /* Insert illegal value */
-        priv->conn_req.sockaddr.u.dgm.connection_id = 0;
+        priv->conn_req.sockaddr.u.dgm.connection_id = UNDEF_CONNID;
         priv->flowenabled = false;
 
         init_waitqueue_head(&priv->netmgmt_wq);
@@ -421,14 +424,14 @@ static int ipcaif_fill_info(struct sk_buff *skb, const struct net_device *dev)
         struct chnl_net *priv;
         u8 loop;
         priv = netdev_priv(dev);
-        NLA_PUT_U32(skb, IFLA_CAIF_IPV4_CONNID,
-                    priv->conn_req.sockaddr.u.dgm.connection_id);
-        NLA_PUT_U32(skb, IFLA_CAIF_IPV6_CONNID,
-                    priv->conn_req.sockaddr.u.dgm.connection_id);
+        if (nla_put_u32(skb, IFLA_CAIF_IPV4_CONNID,
+                        priv->conn_req.sockaddr.u.dgm.connection_id) ||
+            nla_put_u32(skb, IFLA_CAIF_IPV6_CONNID,
+                        priv->conn_req.sockaddr.u.dgm.connection_id))
+                goto nla_put_failure;
         loop = priv->conn_req.protocol == CAIFPROTO_DATAGRAM_LOOP;
-        NLA_PUT_U8(skb, IFLA_CAIF_LOOPBACK, loop);
-
-
+        if (nla_put_u8(skb, IFLA_CAIF_LOOPBACK, loop))
+                goto nla_put_failure;
         return 0;
 nla_put_failure:
         return -EMSGSIZE;
@@ -472,9 +475,11 @@ static int ipcaif_newlink(struct net *src_net, struct net_device *dev,
         else
                 list_add(&caifdev->list_field, &chnl_net_list);
 
-        /* Take ifindex as connection-id if null */
-        if (caifdev->conn_req.sockaddr.u.dgm.connection_id == 0)
+        /* Use ifindex as connection id, and use loopback channel default. */
+        if (caifdev->conn_req.sockaddr.u.dgm.connection_id == UNDEF_CONNID) {
                 caifdev->conn_req.sockaddr.u.dgm.connection_id = dev->ifindex;
+                caifdev->conn_req.protocol = CAIFPROTO_DATAGRAM_LOOP;
+        }
         return ret;
 }
 
diff --git a/net/can/gw.c b/net/can/gw.c
index 3d79b127881e..b41acf25668f 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -66,7 +66,7 @@ MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Oliver Hartkopp <oliver.hartkopp@volkswagen.de>");
 MODULE_ALIAS("can-gw");
 
-HLIST_HEAD(cgw_list);
+static HLIST_HEAD(cgw_list);
 static struct notifier_block notifier;
 
 static struct kmem_cache *cgw_cache __read_mostly;
diff --git a/net/ceph/auth_x.h b/net/ceph/auth_x.h
index e02da7a5c5a1..f459e93b774f 100644
--- a/net/ceph/auth_x.h
+++ b/net/ceph/auth_x.h
@@ -13,7 +13,7 @@
  */
 struct ceph_x_ticket_handler {
         struct rb_node node;
-        unsigned service;
+        unsigned int service;
 
         struct ceph_crypto_key session_key;
         struct ceph_timespec validity;
@@ -27,7 +27,7 @@ struct ceph_x_ticket_handler {
 
 struct ceph_x_authorizer {
         struct ceph_buffer *buf;
-        unsigned service;
+        unsigned int service;
         u64 nonce;
         char reply_buf[128];  /* big enough for encrypted blob */
 };
@@ -38,7 +38,7 @@ struct ceph_x_info {
         bool starting;
         u64 server_challenge;
 
-        unsigned have_keys;
+        unsigned int have_keys;
         struct rb_root ticket_handlers;
 
         struct ceph_x_authorizer auth_authorizer;
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index c815f31a1a3f..58b09efb528d 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -441,8 +441,8 @@ EXPORT_SYMBOL(ceph_client_id);
  * create a fresh client instance
  */
 struct ceph_client *ceph_create_client(struct ceph_options *opt, void *private,
-                                       unsigned supported_features,
-                                       unsigned required_features)
+                                       unsigned int supported_features,
+                                       unsigned int required_features)
 {
         struct ceph_client *client;
         struct ceph_entity_addr *myaddr = NULL;
diff --git a/net/ceph/ceph_hash.c b/net/ceph/ceph_hash.c
index 0a1b53bce76d..67bb1f11e613 100644
--- a/net/ceph/ceph_hash.c
+++ b/net/ceph/ceph_hash.c
@@ -20,7 +20,7 @@
                 c = c - a;  c = c - b;  c = c ^ (b >> 15);      \
         } while (0)
 
-unsigned ceph_str_hash_rjenkins(const char *str, unsigned length)
+unsigned int ceph_str_hash_rjenkins(const char *str, unsigned int length)
 {
         const unsigned char *k = (const unsigned char *)str;
         __u32 a, b, c;  /* the internal state */
@@ -81,7 +81,7 @@ unsigned ceph_str_hash_rjenkins(const char *str, unsigned length)
 /*
  * linux dcache hash
  */
-unsigned ceph_str_hash_linux(const char *str, unsigned length)
+unsigned int ceph_str_hash_linux(const char *str, unsigned int length)
 {
         unsigned long hash = 0;
         unsigned char c;
@@ -94,7 +94,7 @@ unsigned ceph_str_hash_linux(const char *str, unsigned length)
 }
 
 
-unsigned ceph_str_hash(int type, const char *s, unsigned len)
+unsigned int ceph_str_hash(int type, const char *s, unsigned int len)
 {
         switch (type) {
         case CEPH_STR_HASH_LINUX:
diff --git a/net/ceph/crush/mapper.c b/net/ceph/crush/mapper.c
index 11cf352201ba..d7edc24333b8 100644
--- a/net/ceph/crush/mapper.c
+++ b/net/ceph/crush/mapper.c
@@ -20,6 +20,7 @@
 
 #include <linux/crush/crush.h>
 #include <linux/crush/hash.h>
+#include <linux/crush/mapper.h>
 
 /*
  * Implement the core CRUSH mapping algorithm.
@@ -68,8 +69,8 @@ int crush_find_rule(const struct crush_map *map, int ruleset, int type, int size
 static int bucket_perm_choose(struct crush_bucket *bucket,
                               int x, int r)
 {
-        unsigned pr = r % bucket->size;
-        unsigned i, s;
+        unsigned int pr = r % bucket->size;
+        unsigned int i, s;
 
         /* start a new permutation if @x has changed */
         if (bucket->perm_x != (__u32)x || bucket->perm_n == 0) {
@@ -100,13 +101,13 @@ static int bucket_perm_choose(struct crush_bucket *bucket,
         for (i = 0; i < bucket->perm_n; i++)
                 dprintk(" perm_choose have %d: %d\n", i, bucket->perm[i]);
         while (bucket->perm_n <= pr) {
-                unsigned p = bucket->perm_n;
+                unsigned int p = bucket->perm_n;
                 /* no point in swapping the final entry */
                 if (p < bucket->size - 1) {
                         i = crush_hash32_3(bucket->hash, x, bucket->id, p) %
                                 (bucket->size - p);
                         if (i) {
-                                unsigned t = bucket->perm[p + i];
+                                unsigned int t = bucket->perm[p + i];
                                 bucket->perm[p + i] = bucket->perm[p];
                                 bucket->perm[p] = t;
                         }
diff --git a/net/ceph/debugfs.c b/net/ceph/debugfs.c
index 27d4ea315d12..54b531a01121 100644
--- a/net/ceph/debugfs.c
+++ b/net/ceph/debugfs.c
@@ -94,9 +94,9 @@ static int monc_show(struct seq_file *s, void *p)
         mutex_lock(&monc->mutex);
 
         if (monc->have_mdsmap)
-                seq_printf(s, "have mdsmap %u\n", (unsigned)monc->have_mdsmap);
+                seq_printf(s, "have mdsmap %u\n", (unsigned int)monc->have_mdsmap);
         if (monc->have_osdmap)
-                seq_printf(s, "have osdmap %u\n", (unsigned)monc->have_osdmap);
+                seq_printf(s, "have osdmap %u\n", (unsigned int)monc->have_osdmap);
         if (monc->want_next_osdmap)
                 seq_printf(s, "want next osdmap\n");
 
@@ -146,7 +146,7 @@ static int osdc_show(struct seq_file *s, void *pp)
 
                 if (req->r_reassert_version.epoch)
                         seq_printf(s, "\t%u'%llu",
-                           (unsigned)le32_to_cpu(req->r_reassert_version.epoch),
+                           (unsigned int)le32_to_cpu(req->r_reassert_version.epoch),
                            le64_to_cpu(req->r_reassert_version.version));
                 else
                         seq_printf(s, "\t");
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index bdbecac2d69d..5e9f61d6d234 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -789,7 +789,7 @@ static void prepare_write_banner(struct ceph_connection *con)
 
 static int prepare_write_connect(struct ceph_connection *con)
 {
-        unsigned global_seq = get_global_seq(con->msgr, 0);
+        unsigned int global_seq = get_global_seq(con->msgr, 0);
         int proto;
         int auth_proto;
         struct ceph_auth_handshake *auth;
@@ -917,7 +917,7 @@ static void iter_bio_next(struct bio **bio_iter, int *seg)
 static int write_partial_msg_pages(struct ceph_connection *con)
 {
         struct ceph_msg *msg = con->out_msg;
-        unsigned data_len = le32_to_cpu(msg->hdr.data_len);
+        unsigned int data_len = le32_to_cpu(msg->hdr.data_len);
         size_t len;
         bool do_datacrc = !con->msgr->nocrc;
         int ret;
@@ -1673,7 +1673,7 @@ static bool ceph_con_in_msg_alloc(struct ceph_connection *con,
 
 static int read_partial_message_pages(struct ceph_connection *con,
                                       struct page **pages,
-                                      unsigned data_len, bool do_datacrc)
+                                      unsigned int data_len, bool do_datacrc)
 {
         void *p;
         int ret;
@@ -1706,7 +1706,7 @@ static int read_partial_message_pages(struct ceph_connection *con,
 #ifdef CONFIG_BLOCK
 static int read_partial_message_bio(struct ceph_connection *con,
                                     struct bio **bio_iter, int *bio_seg,
-                                    unsigned data_len, bool do_datacrc)
+                                    unsigned int data_len, bool do_datacrc)
 {
         struct bio_vec *bv = bio_iovec_idx(*bio_iter, *bio_seg);
         void *p;
@@ -1749,7 +1749,7 @@ static int read_partial_message(struct ceph_connection *con)
         int size;
         int end;
         int ret;
-        unsigned front_len, middle_len, data_len;
+        unsigned int front_len, middle_len, data_len;
         bool do_datacrc = !con->msgr->nocrc;
         u64 seq;
         u32 crc;
@@ -2473,9 +2473,9 @@ void ceph_msg_revoke_incoming(struct ceph_msg *msg)
         con = msg->con;
         mutex_lock(&con->mutex);
         if (con->in_msg == msg) {
-                unsigned front_len = le32_to_cpu(con->in_hdr.front_len);
-                unsigned middle_len = le32_to_cpu(con->in_hdr.middle_len);
-                unsigned data_len = le32_to_cpu(con->in_hdr.data_len);
+                unsigned int front_len = le32_to_cpu(con->in_hdr.front_len);
+                unsigned int middle_len = le32_to_cpu(con->in_hdr.middle_len);
+                unsigned int data_len = le32_to_cpu(con->in_hdr.data_len);
 
                 /* skip rest of message */
                 dout("%s %p msg %p revoked\n", __func__, con, msg);
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index dc16595d6885..e9db3de20b2e 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -171,7 +171,7 @@ static bool __sub_expired(struct ceph_mon_client *monc)
  */
 static void __schedule_delayed(struct ceph_mon_client *monc)
 {
-        unsigned delay;
+        unsigned int delay;
 
         if (monc->cur_mon < 0 || __sub_expired(monc))
                 delay = 10 * HZ;
@@ -187,7 +187,7 @@ static void __schedule_delayed(struct ceph_mon_client *monc)
 static void __send_subscribe(struct ceph_mon_client *monc)
 {
         dout("__send_subscribe sub_sent=%u exp=%u want_osd=%d\n",
-             (unsigned)monc->sub_sent, __sub_expired(monc),
+             (unsigned int)monc->sub_sent, __sub_expired(monc),
              monc->want_next_osdmap);
         if ((__sub_expired(monc) && !monc->sub_sent) ||
             monc->want_next_osdmap == 1) {
@@ -204,7 +204,7 @@ static void __send_subscribe(struct ceph_mon_client *monc)
 
                 if (monc->want_next_osdmap) {
                         dout("__send_subscribe to 'osdmap' %u\n",
-                             (unsigned)monc->have_osdmap);
+                             (unsigned int)monc->have_osdmap);
                         ceph_encode_string(&p, end, "osdmap", 6);
                         i = p;
                         i->have = cpu_to_le64(monc->have_osdmap);
@@ -214,7 +214,7 @@ static void __send_subscribe(struct ceph_mon_client *monc)
                 }
                 if (monc->want_mdsmap) {
                         dout("__send_subscribe to 'mdsmap' %u+\n",
-                             (unsigned)monc->have_mdsmap);
+                             (unsigned int)monc->have_mdsmap);
                         ceph_encode_string(&p, end, "mdsmap", 6);
                         i = p;
                         i->have = cpu_to_le64(monc->have_mdsmap);
@@ -239,7 +239,7 @@ static void __send_subscribe(struct ceph_mon_client *monc)
 static void handle_subscribe_ack(struct ceph_mon_client *monc,
                                  struct ceph_msg *msg)
 {
-        unsigned seconds;
+        unsigned int seconds;
         struct ceph_mon_subscribe_ack *h = msg->front.iov_base;
 
         if (msg->front.iov_len < sizeof(*h))
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index c178c770acb4..db2da54f7336 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1216,7 +1216,7 @@ static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
         }
 
         if (!req->r_got_reply) {
-                unsigned bytes;
+                unsigned int bytes;
 
                 req->r_result = le32_to_cpu(rhead->result);
                 bytes = le32_to_cpu(msg->hdr.data_len);
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index d3de09f519b2..9600674c2c39 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -38,7 +38,7 @@ done:
 
 /* maps */
 
-static int calc_bits_of(unsigned t)
+static int calc_bits_of(unsigned int t)
 {
         int b = 0;
         while (t) {
@@ -154,7 +154,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
         magic = ceph_decode_32(p);
         if (magic != CRUSH_MAGIC) {
                 pr_err("crush_decode magic %x != current %x\n",
-                       (unsigned)magic, (unsigned)CRUSH_MAGIC);
+                       (unsigned int)magic, (unsigned int)CRUSH_MAGIC);
                 goto bad;
         }
         c->max_buckets = ceph_decode_32(p);
@@ -453,7 +453,7 @@ static void __remove_pg_pool(struct rb_root *root, struct ceph_pg_pool_info *pi)
 
 static int __decode_pool(void **p, void *end, struct ceph_pg_pool_info *pi)
 {
-        unsigned n, m;
+        unsigned int n, m;
 
         ceph_decode_copy(p, &pi->v, sizeof(pi->v));
         calc_pg_masks(pi);
@@ -975,7 +975,7 @@ void ceph_calc_file_object_mapping(struct ceph_file_layout *layout,
         objsetno = stripeno / su_per_object;
 
         *ono = objsetno * sc + stripepos;
-        dout("objset %u * sc %u = ono %u\n", objsetno, sc, (unsigned)*ono);
+        dout("objset %u * sc %u = ono %u\n", objsetno, sc, (unsigned int)*ono);
 
         /* *oxoff = *off % layout->fl_stripe_unit;  # offset in su */
         t = off;
@@ -1003,11 +1003,11 @@ int ceph_calc_object_layout(struct ceph_object_layout *ol,
                             struct ceph_file_layout *fl,
                             struct ceph_osdmap *osdmap)
 {
-        unsigned num, num_mask;
+        unsigned int num, num_mask;
         struct ceph_pg pgid;
         int poolid = le32_to_cpu(fl->fl_pg_pool);
         struct ceph_pg_pool_info *pool;
-        unsigned ps;
+        unsigned int ps;
 
         BUG_ON(!osdmap);
 
@@ -1039,7 +1039,7 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
         struct ceph_pg_mapping *pg;
         struct ceph_pg_pool_info *pool;
         int ruleno;
-        unsigned poolid, ps, pps, t, r;
+        unsigned int poolid, ps, pps, t, r;
 
         poolid = le32_to_cpu(pgid.pool);
         ps = le16_to_cpu(pgid.ps);
diff --git a/net/compat.c b/net/compat.c
index 6def90e0a112..1b96281892de 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -79,7 +79,7 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
 
 /* I've named the args so it is easy to tell whose space the pointers are in. */
 int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
-                   struct sockaddr *kern_address, int mode)
+                   struct sockaddr_storage *kern_address, int mode)
 {
         int tot_len;
 
@@ -219,8 +219,6 @@ Efault:
 
 int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *data)
 {
-        struct compat_timeval ctv;
-        struct compat_timespec cts[3];
         struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
         struct compat_cmsghdr cmhdr;
         int cmlen;
@@ -230,24 +228,28 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
                 return 0; /* XXX: return error? check spec. */
         }
 
-        if (level == SOL_SOCKET && type == SCM_TIMESTAMP) {
-                struct timeval *tv = (struct timeval *)data;
-                ctv.tv_sec = tv->tv_sec;
-                ctv.tv_usec = tv->tv_usec;
-                data = &ctv;
-                len = sizeof(ctv);
-        }
-        if (level == SOL_SOCKET &&
-            (type == SCM_TIMESTAMPNS || type == SCM_TIMESTAMPING)) {
-                int count = type == SCM_TIMESTAMPNS ? 1 : 3;
-                int i;
-                struct timespec *ts = (struct timespec *)data;
-                for (i = 0; i < count; i++) {
-                        cts[i].tv_sec = ts[i].tv_sec;
-                        cts[i].tv_nsec = ts[i].tv_nsec;
+        if (!COMPAT_USE_64BIT_TIME) {
+                struct compat_timeval ctv;
+                struct compat_timespec cts[3];
+                if (level == SOL_SOCKET && type == SCM_TIMESTAMP) {
+                        struct timeval *tv = (struct timeval *)data;
+                        ctv.tv_sec = tv->tv_sec;
+                        ctv.tv_usec = tv->tv_usec;
+                        data = &ctv;
+                        len = sizeof(ctv);
+                }
+                if (level == SOL_SOCKET &&
+                    (type == SCM_TIMESTAMPNS || type == SCM_TIMESTAMPING)) {
+                        int count = type == SCM_TIMESTAMPNS ? 1 : 3;
+                        int i;
+                        struct timespec *ts = (struct timespec *)data;
+                        for (i = 0; i < count; i++) {
+                                cts[i].tv_sec = ts[i].tv_sec;
+                                cts[i].tv_nsec = ts[i].tv_nsec;
+                        }
+                        data = &cts;
+                        len = sizeof(cts[0]) * count;
                 }
-                data = &cts;
-                len = sizeof(cts[0]) * count;
         }
 
         cmlen = CMSG_COMPAT_LEN(len);
@@ -326,14 +328,6 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
         __scm_destroy(scm);
 }
 
-/*
- * A struct sock_filter is architecture independent.
- */
-struct compat_sock_fprog {
-        u16             len;
-        compat_uptr_t   filter;         /* struct sock_filter * */
-};
-
 static int do_set_attach_filter(struct socket *sock, int level, int optname,
                                 char __user *optval, unsigned int optlen)
 {
@@ -454,11 +448,15 @@ static int compat_sock_getsockopt(struct socket *sock, int level, int optname,
 
 int compat_sock_get_timestamp(struct sock *sk, struct timeval __user *userstamp)
 {
-        struct compat_timeval __user *ctv =
-                        (struct compat_timeval __user *) userstamp;
-        int err = -ENOENT;
+        struct compat_timeval __user *ctv;
+        int err;
         struct timeval tv;
 
+        if (COMPAT_USE_64BIT_TIME)
+                return sock_get_timestamp(sk, userstamp);
+
+        ctv = (struct compat_timeval __user *) userstamp;
+        err = -ENOENT;
         if (!sock_flag(sk, SOCK_TIMESTAMP))
                 sock_enable_timestamp(sk, SOCK_TIMESTAMP);
         tv = ktime_to_timeval(sk->sk_stamp);
@@ -478,11 +476,15 @@ EXPORT_SYMBOL(compat_sock_get_timestamp);
 
 int compat_sock_get_timestampns(struct sock *sk, struct timespec __user *userstamp)
 {
-        struct compat_timespec __user *ctv =
-                        (struct compat_timespec __user *) userstamp;
-        int err = -ENOENT;
+        struct compat_timespec __user *ctv;
+        int err;
         struct timespec ts;
 
+        if (COMPAT_USE_64BIT_TIME)
+                return sock_get_timestampns (sk, userstamp);
+
+        ctv = (struct compat_timespec __user *) userstamp;
+        err = -ENOENT;
         if (!sock_flag(sk, SOCK_TIMESTAMP))
                 sock_enable_timestamp(sk, SOCK_TIMESTAMP);
         ts = ktime_to_timespec(sk->sk_stamp);
@@ -731,13 +733,13 @@ static unsigned char nas[21] = {
 };
 #undef AL
 
-asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned flags)
+asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
 {
         return sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
 asmlinkage long compat_sys_sendmmsg(int fd, struct compat_mmsghdr __user *mmsg,
-                                    unsigned vlen, unsigned int flags)
+                                    unsigned int vlen, unsigned int flags)
 {
         return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
                               flags | MSG_CMSG_COMPAT);
@@ -748,25 +750,30 @@ asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, uns
         return sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
-asmlinkage long compat_sys_recv(int fd, void __user *buf, size_t len, unsigned flags)
+asmlinkage long compat_sys_recv(int fd, void __user *buf, size_t len, unsigned int flags)
 {
         return sys_recv(fd, buf, len, flags | MSG_CMSG_COMPAT);
 }
 
 asmlinkage long compat_sys_recvfrom(int fd, void __user *buf, size_t len,
-                                    unsigned flags, struct sockaddr __user *addr,
+                                    unsigned int flags, struct sockaddr __user *addr,
                                     int __user *addrlen)
 {
         return sys_recvfrom(fd, buf, len, flags | MSG_CMSG_COMPAT, addr, addrlen);
 }
 
 asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
-                                    unsigned vlen, unsigned int flags,
+                                    unsigned int vlen, unsigned int flags,
                                     struct compat_timespec __user *timeout)
 {
         int datagrams;
         struct timespec ktspec;
 
+        if (COMPAT_USE_64BIT_TIME)
+                return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+                                      flags | MSG_CMSG_COMPAT,
+                                      (struct timespec *) timeout);
+
         if (timeout == NULL)
                 return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
                                       flags | MSG_CMSG_COMPAT, NULL);
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 68bbf9f65cb0..ae6acf6a3dea 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -37,7 +37,6 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 #include <linux/errno.h>
@@ -66,7 +65,7 @@ static inline int connection_based(struct sock *sk)
         return sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM;
 }
 
-static int receiver_wake_function(wait_queue_t *wait, unsigned mode, int sync,
+static int receiver_wake_function(wait_queue_t *wait, unsigned int mode, int sync,
                                   void *key)
 {
         unsigned long bits = (unsigned long)key;
@@ -132,6 +131,8 @@ out_noerr:
  *      __skb_recv_datagram - Receive a datagram skbuff
  *      @sk: socket
  *      @flags: MSG_ flags
+ *      @off: an offset in bytes to peek skb from. Returns an offset
+ *            within an skb where data actually starts
  *      @peeked: returns non-zero if this packet has been seen before
  *      @err: error code returned
  *
@@ -157,8 +158,8 @@ out_noerr:
  *      quite explicitly by POSIX 1003.1g, don't change them without having
  *      the standard around please.
  */
-struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
-                                    int *peeked, int *err)
+struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+                                    int *peeked, int *off, int *err)
 {
         struct sk_buff *skb;
         long timeo;
@@ -180,21 +181,25 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
                  * However, this function was correct in any case. 8)
                  */
                 unsigned long cpu_flags;
+                struct sk_buff_head *queue = &sk->sk_receive_queue;
 
-                spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
-                skb = skb_peek(&sk->sk_receive_queue);
-                if (skb) {
+                spin_lock_irqsave(&queue->lock, cpu_flags);
+                skb_queue_walk(queue, skb) {
                         *peeked = skb->peeked;
                         if (flags & MSG_PEEK) {
+                                if (*off >= skb->len) {
+                                        *off -= skb->len;
+                                        continue;
+                                }
                                 skb->peeked = 1;
                                 atomic_inc(&skb->users);
                         } else
-                                __skb_unlink(skb, &sk->sk_receive_queue);
-                }
-                spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
+                                __skb_unlink(skb, queue);
 
-                if (skb)
+                        spin_unlock_irqrestore(&queue->lock, cpu_flags);
                         return skb;
+                }
+                spin_unlock_irqrestore(&queue->lock, cpu_flags);
 
                 /* User doesn't want to wait */
                 error = -EAGAIN;
@@ -211,13 +216,13 @@ no_packet:
 }
 EXPORT_SYMBOL(__skb_recv_datagram);
 
-struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags,
+struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned int flags,
                                   int noblock, int *err)
 {
-        int peeked;
+        int peeked, off = 0;
 
         return __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
-                                   &peeked, err);
+                                   &peeked, &off, err);
 }
 EXPORT_SYMBOL(skb_recv_datagram);
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 6ca32f6b3105..cd0981977f5c 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -73,7 +73,6 @@
  */
 
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/bitops.h>
 #include <linux/capability.h>
 #include <linux/cpu.h>
@@ -134,7 +133,7 @@
 #include <linux/inetdevice.h>
 #include <linux/cpu_rmap.h>
 #include <linux/net_tstamp.h>
-#include <linux/jump_label.h>
+#include <linux/static_key.h>
 #include <net/flow_keys.h>
 
 #include "net-sysfs.h"
@@ -209,7 +208,8 @@ static inline void dev_base_seq_inc(struct net *net)
 
 static inline struct hlist_head *dev_name_hash(struct net *net, const char *name)
 {
-        unsigned hash = full_name_hash(name, strnlen(name, IFNAMSIZ));
+        unsigned int hash = full_name_hash(name, strnlen(name, IFNAMSIZ));
+
         return &net->dev_name_head[hash_32(hash, NETDEV_HASHBITS)];
 }
 
@@ -300,10 +300,9 @@ static const unsigned short netdev_lock_type[] =
          ARPHRD_BIF, ARPHRD_SIT, ARPHRD_IPDDP, ARPHRD_IPGRE,
          ARPHRD_PIMREG, ARPHRD_HIPPI, ARPHRD_ASH, ARPHRD_ECONET,
          ARPHRD_IRDA, ARPHRD_FCPP, ARPHRD_FCAL, ARPHRD_FCPL,
-         ARPHRD_FCFABRIC, ARPHRD_IEEE802_TR, ARPHRD_IEEE80211,
-         ARPHRD_IEEE80211_PRISM, ARPHRD_IEEE80211_RADIOTAP, ARPHRD_PHONET,
-         ARPHRD_PHONET_PIPE, ARPHRD_IEEE802154,
-         ARPHRD_VOID, ARPHRD_NONE};
+         ARPHRD_FCFABRIC, ARPHRD_IEEE80211, ARPHRD_IEEE80211_PRISM,
+         ARPHRD_IEEE80211_RADIOTAP, ARPHRD_PHONET, ARPHRD_PHONET_PIPE,
+         ARPHRD_IEEE802154, ARPHRD_VOID, ARPHRD_NONE};
 
 static const char *const netdev_lock_name[] =
         {"_xmit_NETROM", "_xmit_ETHER", "_xmit_EETHER", "_xmit_AX25",
@@ -318,10 +317,9 @@ static const char *const netdev_lock_name[] =
          "_xmit_BIF", "_xmit_SIT", "_xmit_IPDDP", "_xmit_IPGRE",
          "_xmit_PIMREG", "_xmit_HIPPI", "_xmit_ASH", "_xmit_ECONET",
          "_xmit_IRDA", "_xmit_FCPP", "_xmit_FCAL", "_xmit_FCPL",
-         "_xmit_FCFABRIC", "_xmit_IEEE802_TR", "_xmit_IEEE80211",
-         "_xmit_IEEE80211_PRISM", "_xmit_IEEE80211_RADIOTAP", "_xmit_PHONET",
-         "_xmit_PHONET_PIPE", "_xmit_IEEE802154",
-         "_xmit_VOID", "_xmit_NONE"};
+         "_xmit_FCFABRIC", "_xmit_IEEE80211", "_xmit_IEEE80211_PRISM",
+         "_xmit_IEEE80211_RADIOTAP", "_xmit_PHONET", "_xmit_PHONET_PIPE",
+         "_xmit_IEEE802154", "_xmit_VOID", "_xmit_NONE"};
 
 static struct lock_class_key netdev_xmit_lock_key[ARRAY_SIZE(netdev_lock_type)];
 static struct lock_class_key netdev_addr_lock_key[ARRAY_SIZE(netdev_lock_type)];
@@ -446,7 +444,7 @@ void __dev_remove_pack(struct packet_type *pt)
                 }
         }
 
-        printk(KERN_WARNING "dev_remove_pack: %p not found.\n", pt);
+        pr_warn("dev_remove_pack: %p not found\n", pt);
 out:
         spin_unlock(&ptype_lock);
 }
@@ -848,21 +846,21 @@ EXPORT_SYMBOL(dev_get_by_flags_rcu);
  *      to allow sysfs to work.  We also disallow any kind of
  *      whitespace.
  */
-int dev_valid_name(const char *name)
+bool dev_valid_name(const char *name)
 {
         if (*name == '\0')
-                return 0;
+                return false;
         if (strlen(name) >= IFNAMSIZ)
-                return 0;
+                return false;
         if (!strcmp(name, ".") || !strcmp(name, ".."))
-                return 0;
+                return false;
 
         while (*name) {
                 if (*name == '/' || isspace(*name))
-                        return 0;
+                        return false;
                 name++;
         }
-        return 1;
+        return true;
 }
 EXPORT_SYMBOL(dev_valid_name);
 
@@ -1039,8 +1037,7 @@ rollback:
                         memcpy(dev->name, oldname, IFNAMSIZ);
                         goto rollback;
                 } else {
-                        printk(KERN_ERR
-                               "%s: name change rollback failed: %d.\n",
+                        pr_err("%s: name change rollback failed: %d\n",
                                dev->name, ret);
                 }
         }
@@ -1139,9 +1136,8 @@ void dev_load(struct net *net, const char *name)
                 no_module = request_module("netdev-%s", name);
         if (no_module && capable(CAP_SYS_MODULE)) {
                 if (!request_module("%s", name))
-                        pr_err("Loading kernel module for a network device "
-"with CAP_SYS_MODULE (deprecated).  Use CAP_NET_ADMIN and alias netdev-%s "
-"instead\n", name);
+                        pr_err("Loading kernel module for a network device with CAP_SYS_MODULE (deprecated).  Use CAP_NET_ADMIN and alias netdev-%s instead.\n",
+                               name);
         }
 }
 EXPORT_SYMBOL(dev_load);
@@ -1412,14 +1408,34 @@ EXPORT_SYMBOL(register_netdevice_notifier);
  *      register_netdevice_notifier(). The notifier is unlinked into the
  *      kernel structures and may then be reused. A negative errno code
  *      is returned on a failure.
+ *
+ *      After unregistering unregister and down device events are synthesized
+ *      for all devices on the device list to the removed notifier to remove
+ *      the need for special case cleanup code.
  */
 
 int unregister_netdevice_notifier(struct notifier_block *nb)
 {
+        struct net_device *dev;
+        struct net *net;
         int err;
 
         rtnl_lock();
         err = raw_notifier_chain_unregister(&netdev_chain, nb);
+        if (err)
+                goto unlock;
+
+        for_each_net(net) {
+                for_each_netdev(net, dev) {
+                        if (dev->flags & IFF_UP) {
+                                nb->notifier_call(nb, NETDEV_GOING_DOWN, dev);
+                                nb->notifier_call(nb, NETDEV_DOWN, dev);
+                        }
+                        nb->notifier_call(nb, NETDEV_UNREGISTER, dev);
+                        nb->notifier_call(nb, NETDEV_UNREGISTER_BATCH, dev);
+                }
+        }
+unlock:
         rtnl_unlock();
         return err;
 }
@@ -1441,11 +1457,11 @@ int call_netdevice_notifiers(unsigned long val, struct net_device *dev)
 }
 EXPORT_SYMBOL(call_netdevice_notifiers);
 
-static struct jump_label_key netstamp_needed __read_mostly;
+static struct static_key netstamp_needed __read_mostly;
 #ifdef HAVE_JUMP_LABEL
-/* We are not allowed to call jump_label_dec() from irq context
+/* We are not allowed to call static_key_slow_dec() from irq context
  * If net_disable_timestamp() is called from irq context, defer the
- * jump_label_dec() calls.
+ * static_key_slow_dec() calls.
  */
 static atomic_t netstamp_needed_deferred;
 #endif
@@ -1457,12 +1473,12 @@ void net_enable_timestamp(void)
 
         if (deferred) {
                 while (--deferred)
-                        jump_label_dec(&netstamp_needed);
+                        static_key_slow_dec(&netstamp_needed);
                 return;
         }
 #endif
         WARN_ON(in_interrupt());
-        jump_label_inc(&netstamp_needed);
+        static_key_slow_inc(&netstamp_needed);
 }
 EXPORT_SYMBOL(net_enable_timestamp);
 
@@ -1474,19 +1490,19 @@ void net_disable_timestamp(void)
                 return;
         }
 #endif
-        jump_label_dec(&netstamp_needed);
+        static_key_slow_dec(&netstamp_needed);
 }
 EXPORT_SYMBOL(net_disable_timestamp);
 
 static inline void net_timestamp_set(struct sk_buff *skb)
 {
         skb->tstamp.tv64 = 0;
-        if (static_branch(&netstamp_needed))
+        if (static_key_false(&netstamp_needed))
                 __net_timestamp(skb);
 }
 
 #define net_timestamp_check(COND, SKB)                  \
-        if (static_branch(&netstamp_needed)) {          \
+        if (static_key_false(&netstamp_needed)) {               \
                 if ((COND) && !(SKB)->tstamp.tv64)      \
                         __net_timestamp(SKB);           \
         }                                               \
@@ -1599,10 +1615,15 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
-        skb_set_dev(skb, dev);
+        skb->skb_iif = 0;
+        skb->dev = dev;
+        skb_dst_drop(skb);
         skb->tstamp.tv64 = 0;
         skb->pkt_type = PACKET_HOST;
         skb->protocol = eth_type_trans(skb, dev);
+        skb->mark = 0;
+        secpath_reset(skb);
+        nf_reset(skb);
         return netif_rx(skb);
 }
 EXPORT_SYMBOL_GPL(dev_forward_skb);
@@ -1654,11 +1675,9 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
 
                         if (skb_network_header(skb2) < skb2->data ||
                             skb2->network_header > skb2->tail) {
-                                if (net_ratelimit())
-                                        printk(KERN_CRIT "protocol %04x is "
-                                               "buggy, dev %s\n",
-                                               ntohs(skb2->protocol),
-                                               dev->name);
+                                net_crit_ratelimited("protocol %04x is buggy, dev %s\n",
+                                                     ntohs(skb2->protocol),
+                                                     dev->name);
                                 skb_reset_network_header(skb2);
                         }
 
@@ -1691,9 +1710,7 @@ static void netif_setup_tc(struct net_device *dev, unsigned int txq)
 
         /* If TC0 is invalidated disable TC mapping */
         if (tc->offset + tc->count > txq) {
-                pr_warning("Number of in use tx queues changed "
-                           "invalidating tc mappings. Priority "
-                           "traffic classification disabled!\n");
+                pr_warn("Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled!\n");
                 dev->num_tc = 0;
                 return;
         }
@@ -1704,11 +1721,8 @@ static void netif_setup_tc(struct net_device *dev, unsigned int txq)
 
                 tc = &dev->tc_to_txq[q];
                 if (tc->offset + tc->count > txq) {
-                        pr_warning("Number of in use tx queues "
-                                   "changed. Priority %i to tc "
-                                   "mapping %i is no longer valid "
-                                   "setting map to 0\n",
-                                   i, q);
+                        pr_warn("Number of in use tx queues changed. Priority %i to tc mapping %i is no longer valid. Setting map to 0\n",
+                                i, q);
                         netdev_set_prio_tc_map(dev, i, 0);
                 }
         }
@@ -1857,36 +1871,6 @@ void netif_device_attach(struct net_device *dev)
 }
 EXPORT_SYMBOL(netif_device_attach);
 
-/**
- * skb_dev_set -- assign a new device to a buffer
- * @skb: buffer for the new device
- * @dev: network device
- *
- * If an skb is owned by a device already, we have to reset
- * all data private to the namespace a device belongs to
- * before assigning it a new device.
- */
-#ifdef CONFIG_NET_NS
-void skb_set_dev(struct sk_buff *skb, struct net_device *dev)
-{
-        skb_dst_drop(skb);
-        if (skb->dev && !net_eq(dev_net(skb->dev), dev_net(dev))) {
-                secpath_reset(skb);
-                nf_reset(skb);
-                skb_init_secmark(skb);
-                skb->mark = 0;
-                skb->priority = 0;
-                skb->nf_trace = 0;
-                skb->ipvs_property = 0;
-#ifdef CONFIG_NET_SCHED
-                skb->tc_index = 0;
-#endif
-        }
-        skb->dev = dev;
-}
-EXPORT_SYMBOL(skb_set_dev);
-#endif /* CONFIG_NET_NS */
-
 static void skb_warn_bad_offload(const struct sk_buff *skb)
 {
         static const netdev_features_t null_features = 0;
@@ -2014,8 +1998,7 @@ EXPORT_SYMBOL(skb_gso_segment);
 void netdev_rx_csum_fault(struct net_device *dev)
 {
         if (net_ratelimit()) {
-                printk(KERN_ERR "%s: hw csum failure.\n",
-                        dev ? dev->name : "<unknown>");
+                pr_err("%s: hw csum failure\n", dev ? dev->name : "<unknown>");
                 dump_stack();
         }
 }
@@ -2331,11 +2314,9 @@ EXPORT_SYMBOL(__skb_tx_hash);
 static inline u16 dev_cap_txqueue(struct net_device *dev, u16 queue_index)
 {
         if (unlikely(queue_index >= dev->real_num_tx_queues)) {
-                if (net_ratelimit()) {
-                        pr_warning("%s selects TX queue %d, but "
-                                "real number of TX queues is %d\n",
-                                dev->name, queue_index, dev->real_num_tx_queues);
-                }
+                net_warn_ratelimited("%s selects TX queue %d, but real number of TX queues is %d\n",
+                                     dev->name, queue_index,
+                                     dev->real_num_tx_queues);
                 return 0;
         }
         return queue_index;
@@ -2577,17 +2558,15 @@ int dev_queue_xmit(struct sk_buff *skb)
                                 }
                         }
                         HARD_TX_UNLOCK(dev, txq);
-                        if (net_ratelimit())
-                                printk(KERN_CRIT "Virtual device %s asks to "
-                                       "queue packet!\n", dev->name);
+                        net_crit_ratelimited("Virtual device %s asks to queue packet!\n",
+                                             dev->name);
                 } else {
                         /* Recursion is detected! It is possible,
                          * unfortunately
                          */
 recursion_alert:
-                        if (net_ratelimit())
-                                printk(KERN_CRIT "Dead loop on virtual device "
-                                       "%s, fix it urgently!\n", dev->name);
+                        net_crit_ratelimited("Dead loop on virtual device %s, fix it urgently!\n",
+                                             dev->name);
                 }
         }
 
@@ -2660,7 +2639,7 @@ EXPORT_SYMBOL(__skb_get_rxhash);
 struct rps_sock_flow_table __rcu *rps_sock_flow_table __read_mostly;
 EXPORT_SYMBOL(rps_sock_flow_table);
 
-struct jump_label_key rps_needed __read_mostly;
+struct static_key rps_needed __read_mostly;
 
 static struct rps_dev_flow *
 set_rps_cpu(struct net_device *dev, struct sk_buff *skb,
@@ -2945,7 +2924,7 @@ int netif_rx(struct sk_buff *skb)
 
         trace_netif_rx(skb);
 #ifdef CONFIG_RPS
-        if (static_branch(&rps_needed)) {
+        if (static_key_false(&rps_needed)) {
                 struct rps_dev_flow voidflow, *rflow = &voidflow;
                 int cpu;
 
@@ -3068,9 +3047,8 @@ static int ing_filter(struct sk_buff *skb, struct netdev_queue *rxq)
         struct Qdisc *q;
 
         if (unlikely(MAX_RED_LOOP < ttl++)) {
-                if (net_ratelimit())
-                        pr_warning( "Redir loop detected Dropping packet (%d->%d)\n",
-                               skb->skb_iif, dev->ifindex);
+                net_warn_ratelimited("Redir loop detected Dropping packet (%d->%d)\n",
+                                     skb->skb_iif, dev->ifindex);
                 return TC_ACT_SHOT;
         }
 
@@ -3309,7 +3287,7 @@ int netif_receive_skb(struct sk_buff *skb)
                 return NET_RX_SUCCESS;
 
 #ifdef CONFIG_RPS
-        if (static_branch(&rps_needed)) {
+        if (static_key_false(&rps_needed)) {
                 struct rps_dev_flow voidflow, *rflow = &voidflow;
                 int cpu, ret;
 
@@ -3530,10 +3508,16 @@ gro_result_t napi_skb_finish(gro_result_t ret, struct sk_buff *skb)
                 break;
 
         case GRO_DROP:
-        case GRO_MERGED_FREE:
                 kfree_skb(skb);
                 break;
 
+        case GRO_MERGED_FREE:
+                if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD)
+                        kmem_cache_free(skbuff_head_cache, skb);
+                else
+                        __kfree_skb(skb);
+                break;
+
         case GRO_HELD:
         case GRO_MERGED:
                 break;
@@ -3569,7 +3553,8 @@ EXPORT_SYMBOL(napi_gro_receive);
 static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
 {
         __skb_pull(skb, skb_headlen(skb));
-        skb_reserve(skb, NET_IP_ALIGN - skb_headroom(skb));
+        /* restore the reserve we had after netdev_alloc_skb_ip_align() */
+        skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN - skb_headroom(skb));
         skb->vlan_tci = 0;
         skb->dev = napi->dev;
         skb->skb_iif = 0;
@@ -3617,7 +3602,7 @@ gro_result_t napi_frags_finish(struct napi_struct *napi, struct sk_buff *skb,
 }
 EXPORT_SYMBOL(napi_frags_finish);
 
-struct sk_buff *napi_frags_skb(struct napi_struct *napi)
+static struct sk_buff *napi_frags_skb(struct napi_struct *napi)
 {
         struct sk_buff *skb = napi->skb;
         struct ethhdr *eth;
@@ -3652,7 +3637,6 @@ struct sk_buff *napi_frags_skb(struct napi_struct *napi)
 out:
         return skb;
 }
-EXPORT_SYMBOL(napi_frags_skb);
 
 gro_result_t napi_gro_frags(struct napi_struct *napi)
 {
@@ -4036,54 +4020,41 @@ static int dev_ifconf(struct net *net, char __user *arg)
 
 #ifdef CONFIG_PROC_FS
 
-#define BUCKET_SPACE (32 - NETDEV_HASHBITS)
-
-struct dev_iter_state {
-        struct seq_net_private p;
-        unsigned int pos; /* bucket << BUCKET_SPACE + offset */
-};
+#define BUCKET_SPACE (32 - NETDEV_HASHBITS - 1)
 
 #define get_bucket(x) ((x) >> BUCKET_SPACE)
 #define get_offset(x) ((x) & ((1 << BUCKET_SPACE) - 1))
 #define set_bucket_offset(b, o) ((b) << BUCKET_SPACE | (o))
 
-static inline struct net_device *dev_from_same_bucket(struct seq_file *seq)
+static inline struct net_device *dev_from_same_bucket(struct seq_file *seq, loff_t *pos)
 {
-        struct dev_iter_state *state = seq->private;
         struct net *net = seq_file_net(seq);
         struct net_device *dev;
         struct hlist_node *p;
         struct hlist_head *h;
-        unsigned int count, bucket, offset;
+        unsigned int count = 0, offset = get_offset(*pos);
 
-        bucket = get_bucket(state->pos);
-        offset = get_offset(state->pos);
-        h = &net->dev_name_head[bucket];
-        count = 0;
+        h = &net->dev_name_head[get_bucket(*pos)];
         hlist_for_each_entry_rcu(dev, p, h, name_hlist) {
-                if (count++ == offset) {
-                        state->pos = set_bucket_offset(bucket, count);
+                if (++count == offset)
                         return dev;
-                }
         }
 
         return NULL;
 }
 
-static inline struct net_device *dev_from_new_bucket(struct seq_file *seq)
+static inline struct net_device *dev_from_bucket(struct seq_file *seq, loff_t *pos)
 {
-        struct dev_iter_state *state = seq->private;
         struct net_device *dev;
         unsigned int bucket;
 
-        bucket = get_bucket(state->pos);
         do {
-                dev = dev_from_same_bucket(seq);
+                dev = dev_from_same_bucket(seq, pos);
                 if (dev)
                         return dev;
 
-                bucket++;
-                state->pos = set_bucket_offset(bucket, 0);
+                bucket = get_bucket(*pos) + 1;
+                *pos = set_bucket_offset(bucket, 1);
         } while (bucket < NETDEV_HASHENTRIES);
 
         return NULL;
@@ -4096,33 +4067,20 @@ static inline struct net_device *dev_from_new_bucket(struct seq_file *seq)
 void *dev_seq_start(struct seq_file *seq, loff_t *pos)
         __acquires(RCU)
 {
-        struct dev_iter_state *state = seq->private;
-
         rcu_read_lock();
         if (!*pos)
                 return SEQ_START_TOKEN;
 
-        /* check for end of the hash */
-        if (state->pos == 0 && *pos > 1)
+        if (get_bucket(*pos) >= NETDEV_HASHENTRIES)
                 return NULL;
 
-        return dev_from_new_bucket(seq);
+        return dev_from_bucket(seq, pos);
 }
 
 void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct net_device *dev;
-
         ++*pos;
-
-        if (v == SEQ_START_TOKEN)
-                return dev_from_new_bucket(seq);
-
-        dev = dev_from_same_bucket(seq);
-        if (dev)
-                return dev;
-
-        return dev_from_new_bucket(seq);
+        return dev_from_bucket(seq, pos);
 }
 
 void dev_seq_stop(struct seq_file *seq, void *v)
@@ -4221,13 +4179,7 @@ static const struct seq_operations dev_seq_ops = {
 static int dev_seq_open(struct inode *inode, struct file *file)
 {
         return seq_open_net(inode, file, &dev_seq_ops,
-                            sizeof(struct dev_iter_state));
-}
-
-int dev_seq_open_ops(struct inode *inode, struct file *file,
-                     const struct seq_operations *ops)
-{
-        return seq_open_net(inode, file, ops, sizeof(struct dev_iter_state));
+                            sizeof(struct seq_net_private));
 }
 
 static const struct file_operations dev_seq_fops = {
@@ -4497,16 +4449,15 @@ static int __dev_set_promiscuity(struct net_device *dev, int inc)
                         dev->flags &= ~IFF_PROMISC;
                 else {
                         dev->promiscuity -= inc;
-                        printk(KERN_WARNING "%s: promiscuity touches roof, "
-                                "set promiscuity failed, promiscuity feature "
-                                "of device might be broken.\n", dev->name);
+                        pr_warn("%s: promiscuity touches roof, set promiscuity failed. promiscuity feature of device might be broken.\n",
+                                dev->name);
                         return -EOVERFLOW;
                 }
         }
         if (dev->flags != old_flags) {
-                printk(KERN_INFO "device %s %s promiscuous mode\n",
-                       dev->name, (dev->flags & IFF_PROMISC) ? "entered" :
-                                                               "left");
+                pr_info("device %s %s promiscuous mode\n",
+                        dev->name,
+                        dev->flags & IFF_PROMISC ? "entered" : "left");
                 if (audit_enabled) {
                         current_uid_gid(&uid, &gid);
                         audit_log(current->audit_context, GFP_ATOMIC,
@@ -4579,9 +4530,8 @@ int dev_set_allmulti(struct net_device *dev, int inc)
                         dev->flags &= ~IFF_ALLMULTI;
                 else {
                         dev->allmulti -= inc;
-                        printk(KERN_WARNING "%s: allmulti touches roof, "
-                                "set allmulti failed, allmulti feature of "
-                                "device might be broken.\n", dev->name);
+                        pr_warn("%s: allmulti touches roof, set allmulti failed. allmulti feature of device might be broken.\n",
+                                dev->name);
                         return -EOVERFLOW;
                 }
         }
@@ -4640,9 +4590,9 @@ void dev_set_rx_mode(struct net_device *dev)
  *
  *      Get the combination of flag bits exported through APIs to userspace.
  */
-unsigned dev_get_flags(const struct net_device *dev)
+unsigned int dev_get_flags(const struct net_device *dev)
 {
-        unsigned flags;
+        unsigned int flags;
 
         flags = (dev->flags & ~(IFF_PROMISC |
                                 IFF_ALLMULTI |
@@ -5238,8 +5188,8 @@ static void rollback_registered_many(struct list_head *head)
                  * devices and proceed with the remaining.
                  */
                 if (dev->reg_state == NETREG_UNINITIALIZED) {
-                        pr_debug("unregister_netdevice: device %s/%p never "
-                                 "was registered\n", dev->name, dev);
+                        pr_debug("unregister_netdevice: device %s/%p never was registered\n",
+                                 dev->name, dev);
 
                         WARN_ON(1);
                         list_del(&dev->unreg_list);
@@ -5471,7 +5421,7 @@ static int netif_alloc_rx_queues(struct net_device *dev)
 
         rx = kcalloc(count, sizeof(struct netdev_rx_queue), GFP_KERNEL);
         if (!rx) {
-                pr_err("netdev: Unable to allocate %u rx queues.\n", count);
+                pr_err("netdev: Unable to allocate %u rx queues\n", count);
                 return -ENOMEM;
         }
         dev->_rx = rx;
@@ -5505,8 +5455,7 @@ static int netif_alloc_netdev_queues(struct net_device *dev)
 
         tx = kcalloc(count, sizeof(struct netdev_queue), GFP_KERNEL);
         if (!tx) {
-                pr_err("netdev: Unable to allocate %u tx queues.\n",
-                       count);
+                pr_err("netdev: Unable to allocate %u tx queues\n", count);
                 return -ENOMEM;
         }
         dev->_tx = tx;
@@ -5765,10 +5714,8 @@ static void netdev_wait_allrefs(struct net_device *dev)
                 refcnt = netdev_refcnt_read(dev);
 
                 if (time_after(jiffies, warning_time + 10 * HZ)) {
-                        printk(KERN_EMERG "unregister_netdevice: "
-                               "waiting for %s to become free. Usage "
-                               "count = %d\n",
-                               dev->name, refcnt);
+                        pr_emerg("unregister_netdevice: waiting for %s to become free. Usage count = %d\n",
+                                 dev->name, refcnt);
                         warning_time = jiffies;
                 }
         }
@@ -5819,7 +5766,7 @@ void netdev_run_todo(void)
                 list_del(&dev->todo_list);
 
                 if (unlikely(dev->reg_state != NETREG_UNREGISTERING)) {
-                        printk(KERN_ERR "network todo '%s' but state %d\n",
+                        pr_err("network todo '%s' but state %d\n",
                                dev->name, dev->reg_state);
                         dump_stack();
                         continue;
@@ -5848,12 +5795,12 @@ void netdev_run_todo(void)
 /* Convert net_device_stats to rtnl_link_stats64.  They have the same
  * fields in the same order, with only the type differing.
  */
-static void netdev_stats_to_stats64(struct rtnl_link_stats64 *stats64,
-                                    const struct net_device_stats *netdev_stats)
+void netdev_stats_to_stats64(struct rtnl_link_stats64 *stats64,
+                             const struct net_device_stats *netdev_stats)
 {
 #if BITS_PER_LONG == 64
-        BUILD_BUG_ON(sizeof(*stats64) != sizeof(*netdev_stats));
-        memcpy(stats64, netdev_stats, sizeof(*stats64));
+        BUILD_BUG_ON(sizeof(*stats64) != sizeof(*netdev_stats));
+        memcpy(stats64, netdev_stats, sizeof(*stats64));
 #else
         size_t i, n = sizeof(*stats64) / sizeof(u64);
         const unsigned long *src = (const unsigned long *)netdev_stats;
@@ -5865,6 +5812,7 @@ static void netdev_stats_to_stats64(struct rtnl_link_stats64 *stats64,
                 dst[i] = src[i];
 #endif
 }
+EXPORT_SYMBOL(netdev_stats_to_stats64);
 
 /**
  *      dev_get_stats   - get network device statistics
@@ -5935,15 +5883,13 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
         BUG_ON(strlen(name) >= sizeof(dev->name));
 
         if (txqs < 1) {
-                pr_err("alloc_netdev: Unable to allocate device "
-                       "with zero queues.\n");
+                pr_err("alloc_netdev: Unable to allocate device with zero queues\n");
                 return NULL;
         }
 
 #ifdef CONFIG_RPS
         if (rxqs < 1) {
-                pr_err("alloc_netdev: Unable to allocate device "
-                       "with zero RX queues.\n");
+                pr_err("alloc_netdev: Unable to allocate device with zero RX queues\n");
                 return NULL;
         }
 #endif
@@ -5959,7 +5905,7 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
 
         p = kzalloc(alloc_size, GFP_KERNEL);
         if (!p) {
-                printk(KERN_ERR "alloc_netdev: Unable to allocate device.\n");
+                pr_err("alloc_netdev: Unable to allocate device\n");
                 return NULL;
         }
 
@@ -6492,8 +6438,8 @@ static void __net_exit default_device_exit(struct net *net)
                 snprintf(fb_name, IFNAMSIZ, "dev%d", dev->ifindex);
                 err = dev_change_net_namespace(dev, &init_net, fb_name);
                 if (err) {
-                        printk(KERN_EMERG "%s: failed to move %s to init_net: %d\n",
-                                __func__, dev->name, err);
+                        pr_emerg("%s: failed to move %s to init_net: %d\n",
+                                 __func__, dev->name, err);
                         BUG();
                 }
         }
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index 29c07fef9228..c4cc2bc49f06 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -21,12 +21,35 @@
  * General list handling functions
  */
 
+static int __hw_addr_create_ex(struct netdev_hw_addr_list *list,
+                               unsigned char *addr, int addr_len,
+                               unsigned char addr_type, bool global)
+{
+        struct netdev_hw_addr *ha;
+        int alloc_size;
+
+        alloc_size = sizeof(*ha);
+        if (alloc_size < L1_CACHE_BYTES)
+                alloc_size = L1_CACHE_BYTES;
+        ha = kmalloc(alloc_size, GFP_ATOMIC);
+        if (!ha)
+                return -ENOMEM;
+        memcpy(ha->addr, addr, addr_len);
+        ha->type = addr_type;
+        ha->refcount = 1;
+        ha->global_use = global;
+        ha->synced = false;
+        list_add_tail_rcu(&ha->list, &list->list);
+        list->count++;
+
+        return 0;
+}
+
 static int __hw_addr_add_ex(struct netdev_hw_addr_list *list,
                             unsigned char *addr, int addr_len,
                             unsigned char addr_type, bool global)
 {
         struct netdev_hw_addr *ha;
-        int alloc_size;
 
         if (addr_len > MAX_ADDR_LEN)
                 return -EINVAL;
@@ -46,21 +69,7 @@ static int __hw_addr_add_ex(struct netdev_hw_addr_list *list,
                 }
         }
 
-
-        alloc_size = sizeof(*ha);
-        if (alloc_size < L1_CACHE_BYTES)
-                alloc_size = L1_CACHE_BYTES;
-        ha = kmalloc(alloc_size, GFP_ATOMIC);
-        if (!ha)
-                return -ENOMEM;
-        memcpy(ha->addr, addr, addr_len);
-        ha->type = addr_type;
-        ha->refcount = 1;
-        ha->global_use = global;
-        ha->synced = false;
-        list_add_tail_rcu(&ha->list, &list->list);
-        list->count++;
-        return 0;
+        return __hw_addr_create_ex(list, addr, addr_len, addr_type, global);
 }
 
 static int __hw_addr_add(struct netdev_hw_addr_list *list, unsigned char *addr,
@@ -377,6 +386,34 @@ EXPORT_SYMBOL(dev_addr_del_multiple);
  */
 
 /**
+ *      dev_uc_add_excl - Add a global secondary unicast address
+ *      @dev: device
+ *      @addr: address to add
+ */
+int dev_uc_add_excl(struct net_device *dev, unsigned char *addr)
+{
+        struct netdev_hw_addr *ha;
+        int err;
+
+        netif_addr_lock_bh(dev);
+        list_for_each_entry(ha, &dev->uc.list, list) {
+                if (!memcmp(ha->addr, addr, dev->addr_len) &&
+                    ha->type == NETDEV_HW_ADDR_T_UNICAST) {
+                        err = -EEXIST;
+                        goto out;
+                }
+        }
+        err = __hw_addr_create_ex(&dev->uc, addr, dev->addr_len,
+                                  NETDEV_HW_ADDR_T_UNICAST, true);
+        if (!err)
+                __dev_set_rx_mode(dev);
+out:
+        netif_addr_unlock_bh(dev);
+        return err;
+}
+EXPORT_SYMBOL(dev_uc_add_excl);
+
+/**
  *      dev_uc_add - Add a secondary unicast address
  *      @dev: device
  *      @addr: address to add
@@ -501,6 +538,34 @@ EXPORT_SYMBOL(dev_uc_init);
  * Multicast list handling functions
  */
 
+/**
+ *      dev_mc_add_excl - Add a global secondary multicast address
+ *      @dev: device
+ *      @addr: address to add
+ */
+int dev_mc_add_excl(struct net_device *dev, unsigned char *addr)
+{
+        struct netdev_hw_addr *ha;
+        int err;
+
+        netif_addr_lock_bh(dev);
+        list_for_each_entry(ha, &dev->mc.list, list) {
+                if (!memcmp(ha->addr, addr, dev->addr_len) &&
+                    ha->type == NETDEV_HW_ADDR_T_MULTICAST) {
+                        err = -EEXIST;
+                        goto out;
+                }
+        }
+        err = __hw_addr_create_ex(&dev->mc, addr, dev->addr_len,
+                                  NETDEV_HW_ADDR_T_MULTICAST, true);
+        if (!err)
+                __dev_set_rx_mode(dev);
+out:
+        netif_addr_unlock_bh(dev);
+        return err;
+}
+EXPORT_SYMBOL(dev_mc_add_excl);
+
 static int __dev_mc_add(struct net_device *dev, unsigned char *addr,
                         bool global)
 {
@@ -696,7 +761,8 @@ static const struct seq_operations dev_mc_seq_ops = {
 
 static int dev_mc_seq_open(struct inode *inode, struct file *file)
 {
-        return dev_seq_open_ops(inode, file, &dev_mc_seq_ops);
+        return seq_open_net(inode, file, &dev_mc_seq_ops,
+                            sizeof(struct seq_net_private));
 }
 
 static const struct file_operations dev_mc_seq_fops = {
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 7f36b38e060f..ea5fb9fcc3f5 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -4,6 +4,8 @@
  * Copyright (C) 2009 Neil Horman <nhorman@tuxdriver.com>
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/string.h>
@@ -22,6 +24,7 @@
 #include <linux/timer.h>
 #include <linux/bitops.h>
 #include <linux/slab.h>
+#include <linux/module.h>
 #include <net/genetlink.h>
 #include <net/netevent.h>
 
@@ -42,13 +45,14 @@ static void send_dm_alert(struct work_struct *unused);
  * netlink alerts
  */
 static int trace_state = TRACE_OFF;
-static DEFINE_SPINLOCK(trace_state_lock);
+static DEFINE_MUTEX(trace_state_mutex);
 
 struct per_cpu_dm_data {
         struct work_struct dm_alert_work;
-        struct sk_buff *skb;
+        struct sk_buff __rcu *skb;
         atomic_t dm_hit_count;
         struct timer_list send_timer;
+        int cpu;
 };
 
 struct dm_hw_stat_delta {
@@ -79,29 +83,53 @@ static void reset_per_cpu_data(struct per_cpu_dm_data *data)
         size_t al;
         struct net_dm_alert_msg *msg;
         struct nlattr *nla;
+        struct sk_buff *skb;
+        struct sk_buff *oskb = rcu_dereference_protected(data->skb, 1);
 
         al = sizeof(struct net_dm_alert_msg);
         al += dm_hit_limit * sizeof(struct net_dm_drop_point);
         al += sizeof(struct nlattr);
 
-        data->skb = genlmsg_new(al, GFP_KERNEL);
-        genlmsg_put(data->skb, 0, 0, &net_drop_monitor_family,
-                        0, NET_DM_CMD_ALERT);
-        nla = nla_reserve(data->skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));
-        msg = nla_data(nla);
-        memset(msg, 0, al);
-        atomic_set(&data->dm_hit_count, dm_hit_limit);
+        skb = genlmsg_new(al, GFP_KERNEL);
+
+        if (skb) {
+                genlmsg_put(skb, 0, 0, &net_drop_monitor_family,
+                                0, NET_DM_CMD_ALERT);
+                nla = nla_reserve(skb, NLA_UNSPEC,
+                                  sizeof(struct net_dm_alert_msg));
+                msg = nla_data(nla);
+                memset(msg, 0, al);
+        } else
+                schedule_work_on(data->cpu, &data->dm_alert_work);
+
+        /*
+         * Don't need to lock this, since we are guaranteed to only
+         * run this on a single cpu at a time.
+         * Note also that we only update data->skb if the old and new skb
+         * pointers don't match.  This ensures that we don't continually call
+         * synchornize_rcu if we repeatedly fail to alloc a new netlink message.
+         */
+        if (skb != oskb) {
+                rcu_assign_pointer(data->skb, skb);
+
+                synchronize_rcu();
+
+                atomic_set(&data->dm_hit_count, dm_hit_limit);
+        }
+
 }
 
 static void send_dm_alert(struct work_struct *unused)
 {
         struct sk_buff *skb;
-        struct per_cpu_dm_data *data = &__get_cpu_var(dm_cpu_data);
+        struct per_cpu_dm_data *data = &get_cpu_var(dm_cpu_data);
+
+        WARN_ON_ONCE(data->cpu != smp_processor_id());
 
         /*
          * Grab the skb we're about to send
          */
-        skb = data->skb;
+        skb = rcu_dereference_protected(data->skb, 1);
 
         /*
          * Replace it with a new one
@@ -111,8 +139,10 @@ static void send_dm_alert(struct work_struct *unused)
         /*
          * Ship it!
          */
-        genlmsg_multicast(skb, 0, NET_DM_GRP_ALERT, GFP_KERNEL);
+        if (skb)
+                genlmsg_multicast(skb, 0, NET_DM_GRP_ALERT, GFP_KERNEL);
 
+        put_cpu_var(dm_cpu_data);
 }
 
 /*
@@ -123,9 +153,11 @@ static void send_dm_alert(struct work_struct *unused)
  */
 static void sched_send_work(unsigned long unused)
 {
-        struct per_cpu_dm_data *data =  &__get_cpu_var(dm_cpu_data);
+        struct per_cpu_dm_data *data =  &get_cpu_var(dm_cpu_data);
+
+        schedule_work_on(smp_processor_id(), &data->dm_alert_work);
 
-        schedule_work(&data->dm_alert_work);
+        put_cpu_var(dm_cpu_data);
 }
 
 static void trace_drop_common(struct sk_buff *skb, void *location)
@@ -134,9 +166,16 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
         struct nlmsghdr *nlh;
         struct nlattr *nla;
         int i;
-        struct per_cpu_dm_data *data = &__get_cpu_var(dm_cpu_data);
+        struct sk_buff *dskb;
+        struct per_cpu_dm_data *data = &get_cpu_var(dm_cpu_data);
 
 
+        rcu_read_lock();
+        dskb = rcu_dereference(data->skb);
+
+        if (!dskb)
+                goto out;
+
         if (!atomic_add_unless(&data->dm_hit_count, -1, 0)) {
                 /*
                  * we're already at zero, discard this hit
@@ -144,12 +183,13 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
                 goto out;
         }
 
-        nlh = (struct nlmsghdr *)data->skb->data;
+        nlh = (struct nlmsghdr *)dskb->data;
         nla = genlmsg_data(nlmsg_data(nlh));
         msg = nla_data(nla);
         for (i = 0; i < msg->entries; i++) {
                 if (!memcmp(&location, msg->points[i].pc, sizeof(void *))) {
                         msg->points[i].count++;
+                        atomic_inc(&data->dm_hit_count);
                         goto out;
                 }
         }
@@ -157,7 +197,7 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
         /*
          * We need to create a new entry
          */
-        __nla_reserve_nohdr(data->skb, sizeof(struct net_dm_drop_point));
+        __nla_reserve_nohdr(dskb, sizeof(struct net_dm_drop_point));
         nla->nla_len += NLA_ALIGN(sizeof(struct net_dm_drop_point));
         memcpy(msg->points[msg->entries].pc, &location, sizeof(void *));
         msg->points[msg->entries].count = 1;
@@ -169,6 +209,8 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
         }
 
 out:
+        rcu_read_unlock();
+        put_cpu_var(dm_cpu_data);
         return;
 }
 
@@ -213,7 +255,7 @@ static int set_all_monitor_traces(int state)
         struct dm_hw_stat_delta *new_stat = NULL;
         struct dm_hw_stat_delta *temp;
 
-        spin_lock(&trace_state_lock);
+        mutex_lock(&trace_state_mutex);
 
         if (state == trace_state) {
                 rc = -EAGAIN;
@@ -222,9 +264,15 @@ static int set_all_monitor_traces(int state)
 
         switch (state) {
         case TRACE_ON:
+                if (!try_module_get(THIS_MODULE)) {
+                        rc = -ENODEV;
+                        break;
+                }
+
                 rc |= register_trace_kfree_skb(trace_kfree_skb_hit, NULL);
                 rc |= register_trace_napi_poll(trace_napi_poll_hit, NULL);
                 break;
+
         case TRACE_OFF:
                 rc |= unregister_trace_kfree_skb(trace_kfree_skb_hit, NULL);
                 rc |= unregister_trace_napi_poll(trace_napi_poll_hit, NULL);
@@ -240,6 +288,9 @@ static int set_all_monitor_traces(int state)
                                 kfree_rcu(new_stat, rcu);
                         }
                 }
+
+                module_put(THIS_MODULE);
+
                 break;
         default:
                 rc = 1;
@@ -252,7 +303,7 @@ static int set_all_monitor_traces(int state)
                 rc = -EINPROGRESS;
 
 out_unlock:
-        spin_unlock(&trace_state_lock);
+        mutex_unlock(&trace_state_mutex);
 
         return rc;
 }
@@ -295,12 +346,12 @@ static int dropmon_net_event(struct notifier_block *ev_block,
 
                 new_stat->dev = dev;
                 new_stat->last_rx = jiffies;
-                spin_lock(&trace_state_lock);
+                mutex_lock(&trace_state_mutex);
                 list_add_rcu(&new_stat->list, &hw_stats_list);
-                spin_unlock(&trace_state_lock);
+                mutex_unlock(&trace_state_mutex);
                 break;
         case NETDEV_UNREGISTER:
-                spin_lock(&trace_state_lock);
+                mutex_lock(&trace_state_mutex);
                 list_for_each_entry_safe(new_stat, tmp, &hw_stats_list, list) {
                         if (new_stat->dev == dev) {
                                 new_stat->dev = NULL;
@@ -311,7 +362,7 @@ static int dropmon_net_event(struct notifier_block *ev_block,
                                 }
                         }
                 }
-                spin_unlock(&trace_state_lock);
+                mutex_unlock(&trace_state_mutex);
                 break;
         }
 out:
@@ -342,10 +393,10 @@ static int __init init_net_drop_monitor(void)
         struct per_cpu_dm_data *data;
         int cpu, rc;
 
-        printk(KERN_INFO "Initializing network drop monitor service\n");
+        pr_info("Initializing network drop monitor service\n");
 
         if (sizeof(void *) > 8) {
-                printk(KERN_ERR "Unable to store program counters on this arch, Drop monitor failed\n");
+                pr_err("Unable to store program counters on this arch, Drop monitor failed\n");
                 return -ENOSPC;
         }
 
@@ -353,27 +404,29 @@ static int __init init_net_drop_monitor(void)
                                            dropmon_ops,
                                            ARRAY_SIZE(dropmon_ops));
         if (rc) {
-                printk(KERN_ERR "Could not create drop monitor netlink family\n");
+                pr_err("Could not create drop monitor netlink family\n");
                 return rc;
         }
 
         rc = register_netdevice_notifier(&dropmon_net_notifier);
         if (rc < 0) {
-                printk(KERN_CRIT "Failed to register netdevice notifier\n");
+                pr_crit("Failed to register netdevice notifier\n");
                 goto out_unreg;
         }
 
         rc = 0;
 
-        for_each_present_cpu(cpu) {
+        for_each_possible_cpu(cpu) {
                 data = &per_cpu(dm_cpu_data, cpu);
-                reset_per_cpu_data(data);
+                data->cpu = cpu;
                 INIT_WORK(&data->dm_alert_work, send_dm_alert);
                 init_timer(&data->send_timer);
                 data->send_timer.data = cpu;
                 data->send_timer.function = sched_send_work;
+                reset_per_cpu_data(data);
         }
 
+
         goto out;
 
 out_unreg:
@@ -382,4 +435,37 @@ out:
         return rc;
 }
 
-late_initcall(init_net_drop_monitor);
+static void exit_net_drop_monitor(void)
+{
+        struct per_cpu_dm_data *data;
+        int cpu;
+
+        BUG_ON(unregister_netdevice_notifier(&dropmon_net_notifier));
+
+        /*
+         * Because of the module_get/put we do in the trace state change path
+         * we are guarnateed not to have any current users when we get here
+         * all we need to do is make sure that we don't have any running timers
+         * or pending schedule calls
+         */
+
+        for_each_possible_cpu(cpu) {
+                data = &per_cpu(dm_cpu_data, cpu);
+                del_timer_sync(&data->send_timer);
+                cancel_work_sync(&data->dm_alert_work);
+                /*
+                 * At this point, we should have exclusive access
+                 * to this struct and can free the skb inside it
+                 */
+                kfree_skb(data->skb);
+        }
+
+        BUG_ON(genl_unregister_family(&net_drop_monitor_family));
+}
+
+module_init(init_net_drop_monitor);
+module_exit(exit_net_drop_monitor);
+
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Neil Horman <nhorman@tuxdriver.com>");
+MODULE_ALIAS_GENL_FAMILY("NET_DM");
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 3f79db1b612a..9c2afb480270 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -17,6 +17,8 @@
 #include <linux/errno.h>
 #include <linux/ethtool.h>
 #include <linux/netdevice.h>
+#include <linux/net_tstamp.h>
+#include <linux/phy.h>
 #include <linux/bitops.h>
 #include <linux/uaccess.h>
 #include <linux/vmalloc.h>
@@ -36,6 +38,17 @@ u32 ethtool_op_get_link(struct net_device *dev)
 }
 EXPORT_SYMBOL(ethtool_op_get_link);
 
+int ethtool_op_get_ts_info(struct net_device *dev, struct ethtool_ts_info *info)
+{
+        info->so_timestamping =
+                SOF_TIMESTAMPING_TX_SOFTWARE |
+                SOF_TIMESTAMPING_RX_SOFTWARE |
+                SOF_TIMESTAMPING_SOFTWARE;
+        info->phc_index = -1;
+        return 0;
+}
+EXPORT_SYMBOL(ethtool_op_get_ts_info);
+
 /* Handlers for each ethtool command */
 
 #define ETHTOOL_DEV_FEATURE_WORDS       ((NETDEV_FEATURE_COUNT + 31) / 32)
@@ -73,6 +86,8 @@ static const char netdev_features_strings[NETDEV_FEATURE_COUNT][ETH_GSTRING_LEN]
         [NETIF_F_RXCSUM_BIT] =           "rx-checksum",
         [NETIF_F_NOCACHE_COPY_BIT] =     "tx-nocache-copy",
         [NETIF_F_LOOPBACK_BIT] =         "loopback",
+        [NETIF_F_RXFCS_BIT] =            "rx-fcs",
+        [NETIF_F_RXALL_BIT] =            "rx-all",
 };
 
 static int ethtool_get_features(struct net_device *dev, void __user *useraddr)
@@ -736,18 +751,17 @@ static int ethtool_get_link(struct net_device *dev, char __user *useraddr)
         return 0;
 }
 
-static int ethtool_get_eeprom(struct net_device *dev, void __user *useraddr)
+static int ethtool_get_any_eeprom(struct net_device *dev, void __user *useraddr,
+                                  int (*getter)(struct net_device *,
+                                                struct ethtool_eeprom *, u8 *),
+                                  u32 total_len)
 {
         struct ethtool_eeprom eeprom;
-        const struct ethtool_ops *ops = dev->ethtool_ops;
         void __user *userbuf = useraddr + sizeof(eeprom);
         u32 bytes_remaining;
         u8 *data;
         int ret = 0;
 
-        if (!ops->get_eeprom || !ops->get_eeprom_len)
-                return -EOPNOTSUPP;
-
         if (copy_from_user(&eeprom, useraddr, sizeof(eeprom)))
                 return -EFAULT;
 
@@ -756,7 +770,7 @@ static int ethtool_get_eeprom(struct net_device *dev, void __user *useraddr)
                 return -EINVAL;
 
         /* Check for exceeding total eeprom len */
-        if (eeprom.offset + eeprom.len > ops->get_eeprom_len(dev))
+        if (eeprom.offset + eeprom.len > total_len)
                 return -EINVAL;
 
         data = kmalloc(PAGE_SIZE, GFP_USER);
@@ -767,7 +781,7 @@ static int ethtool_get_eeprom(struct net_device *dev, void __user *useraddr)
         while (bytes_remaining > 0) {
                 eeprom.len = min(bytes_remaining, (u32)PAGE_SIZE);
 
-                ret = ops->get_eeprom(dev, &eeprom, data);
+                ret = getter(dev, &eeprom, data);
                 if (ret)
                         break;
                 if (copy_to_user(userbuf, data, eeprom.len)) {
@@ -788,6 +802,17 @@ static int ethtool_get_eeprom(struct net_device *dev, void __user *useraddr)
         return ret;
 }
 
+static int ethtool_get_eeprom(struct net_device *dev, void __user *useraddr)
+{
+        const struct ethtool_ops *ops = dev->ethtool_ops;
+
+        if (!ops->get_eeprom || !ops->get_eeprom_len)
+                return -EOPNOTSUPP;
+
+        return ethtool_get_any_eeprom(dev, useraddr, ops->get_eeprom,
+                                      ops->get_eeprom_len(dev));
+}
+
 static int ethtool_set_eeprom(struct net_device *dev, void __user *useraddr)
 {
         struct ethtool_eeprom eeprom;
@@ -1276,6 +1301,81 @@ out:
         return ret;
 }
 
+static int ethtool_get_ts_info(struct net_device *dev, void __user *useraddr)
+{
+        int err = 0;
+        struct ethtool_ts_info info;
+        const struct ethtool_ops *ops = dev->ethtool_ops;
+        struct phy_device *phydev = dev->phydev;
+
+        memset(&info, 0, sizeof(info));
+        info.cmd = ETHTOOL_GET_TS_INFO;
+
+        if (phydev && phydev->drv && phydev->drv->ts_info) {
+
+                err = phydev->drv->ts_info(phydev, &info);
+
+        } else if (dev->ethtool_ops && dev->ethtool_ops->get_ts_info) {
+
+                err = ops->get_ts_info(dev, &info);
+
+        } else {
+                info.so_timestamping =
+                        SOF_TIMESTAMPING_RX_SOFTWARE |
+                        SOF_TIMESTAMPING_SOFTWARE;
+                info.phc_index = -1;
+        }
+
+        if (err)
+                return err;
+
+        if (copy_to_user(useraddr, &info, sizeof(info)))
+                err = -EFAULT;
+
+        return err;
+}
+
+static int ethtool_get_module_info(struct net_device *dev,
+                                   void __user *useraddr)
+{
+        int ret;
+        struct ethtool_modinfo modinfo;
+        const struct ethtool_ops *ops = dev->ethtool_ops;
+
+        if (!ops->get_module_info)
+                return -EOPNOTSUPP;
+
+        if (copy_from_user(&modinfo, useraddr, sizeof(modinfo)))
+                return -EFAULT;
+
+        ret = ops->get_module_info(dev, &modinfo);
+        if (ret)
+                return ret;
+
+        if (copy_to_user(useraddr, &modinfo, sizeof(modinfo)))
+                return -EFAULT;
+
+        return 0;
+}
+
+static int ethtool_get_module_eeprom(struct net_device *dev,
+                                     void __user *useraddr)
+{
+        int ret;
+        struct ethtool_modinfo modinfo;
+        const struct ethtool_ops *ops = dev->ethtool_ops;
+
+        if (!ops->get_module_info || !ops->get_module_eeprom)
+                return -EOPNOTSUPP;
+
+        ret = ops->get_module_info(dev, &modinfo);
+        if (ret)
+                return ret;
+
+        return ethtool_get_any_eeprom(dev, useraddr, ops->get_module_eeprom,
+                                      modinfo.eeprom_len);
+}
+
 /* The main entry point in this file.  Called from net/core/dev.c */
 
 int dev_ethtool(struct net *net, struct ifreq *ifr)
@@ -1293,11 +1393,13 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
                 return -EFAULT;
 
         if (!dev->ethtool_ops) {
-                /* ETHTOOL_GDRVINFO does not require any driver support.
-                 * It is also unprivileged and does not change anything,
-                 * so we can take a shortcut to it. */
+                /* A few commands do not require any driver support,
+                 * are unprivileged, and do not change anything, so we
+                 * can take a shortcut to them. */
                 if (ethcmd == ETHTOOL_GDRVINFO)
                         return ethtool_get_drvinfo(dev, useraddr);
+                else if (ethcmd == ETHTOOL_GET_TS_INFO)
+                        return ethtool_get_ts_info(dev, useraddr);
                 else
                         return -EOPNOTSUPP;
         }
@@ -1328,6 +1430,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_GRXCLSRULE:
         case ETHTOOL_GRXCLSRLALL:
         case ETHTOOL_GFEATURES:
+        case ETHTOOL_GET_TS_INFO:
                 break;
         default:
                 if (!capable(CAP_NET_ADMIN))
@@ -1494,6 +1597,15 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_GET_DUMP_DATA:
                 rc = ethtool_get_dump_data(dev, useraddr);
                 break;
+        case ETHTOOL_GET_TS_INFO:
+                rc = ethtool_get_ts_info(dev, useraddr);
+                break;
+        case ETHTOOL_GMODULEINFO:
+                rc = ethtool_get_module_info(dev, useraddr);
+                break;
+        case ETHTOOL_GMODULEEEPROM:
+                rc = ethtool_get_module_eeprom(dev, useraddr);
+                break;
         default:
                 rc = -EOPNOTSUPP;
         }
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index c02e63c908da..72cceb79d0d4 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -542,7 +542,8 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
         frh = nlmsg_data(nlh);
         frh->family = ops->family;
         frh->table = rule->table;
-        NLA_PUT_U32(skb, FRA_TABLE, rule->table);
+        if (nla_put_u32(skb, FRA_TABLE, rule->table))
+                goto nla_put_failure;
         frh->res1 = 0;
         frh->res2 = 0;
         frh->action = rule->action;
@@ -553,31 +554,28 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
                 frh->flags |= FIB_RULE_UNRESOLVED;
 
         if (rule->iifname[0]) {
-                NLA_PUT_STRING(skb, FRA_IIFNAME, rule->iifname);
-
+                if (nla_put_string(skb, FRA_IIFNAME, rule->iifname))
+                        goto nla_put_failure;
                 if (rule->iifindex == -1)
                         frh->flags |= FIB_RULE_IIF_DETACHED;
         }
 
         if (rule->oifname[0]) {
-                NLA_PUT_STRING(skb, FRA_OIFNAME, rule->oifname);
-
+                if (nla_put_string(skb, FRA_OIFNAME, rule->oifname))
+                        goto nla_put_failure;
                 if (rule->oifindex == -1)
                         frh->flags |= FIB_RULE_OIF_DETACHED;
         }
 
-        if (rule->pref)
-                NLA_PUT_U32(skb, FRA_PRIORITY, rule->pref);
-
-        if (rule->mark)
-                NLA_PUT_U32(skb, FRA_FWMARK, rule->mark);
-
-        if (rule->mark_mask || rule->mark)
-                NLA_PUT_U32(skb, FRA_FWMASK, rule->mark_mask);
-
-        if (rule->target)
-                NLA_PUT_U32(skb, FRA_GOTO, rule->target);
-
+        if ((rule->pref &&
+             nla_put_u32(skb, FRA_PRIORITY, rule->pref)) ||
+            (rule->mark &&
+             nla_put_u32(skb, FRA_FWMARK, rule->mark)) ||
+            ((rule->mark_mask || rule->mark) &&
+             nla_put_u32(skb, FRA_FWMASK, rule->mark_mask)) ||
+            (rule->target &&
+             nla_put_u32(skb, FRA_GOTO, rule->target)))
+                goto nla_put_failure;
         if (ops->fill(rule, skb, frh) < 0)
                 goto nla_put_failure;
 
diff --git a/net/core/filter.c b/net/core/filter.c
index 5dea45279215..a3eddb515d1b 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -33,15 +33,18 @@
 #include <net/sock.h>
 #include <linux/errno.h>
 #include <linux/timer.h>
-#include <asm/system.h>
 #include <asm/uaccess.h>
 #include <asm/unaligned.h>
 #include <linux/filter.h>
 #include <linux/reciprocal_div.h>
 #include <linux/ratelimit.h>
+#include <linux/seccomp.h>
 
-/* No hurry in this branch */
-static void *__load_pointer(const struct sk_buff *skb, int k, unsigned int size)
+/* No hurry in this branch
+ *
+ * Exported for the bpf jit load helper.
+ */
+void *bpf_internal_load_pointer_neg_helper(const struct sk_buff *skb, int k, unsigned int size)
 {
         u8 *ptr = NULL;
 
@@ -60,7 +63,7 @@ static inline void *load_pointer(const struct sk_buff *skb, int k,
 {
         if (k >= 0)
                 return skb_header_pointer(skb, k, size, buffer);
-        return __load_pointer(skb, k, size);
+        return bpf_internal_load_pointer_neg_helper(skb, k, size);
 }
 
 /**
@@ -315,6 +318,9 @@ load_b:
                 case BPF_S_ANC_CPU:
                         A = raw_smp_processor_id();
                         continue;
+                case BPF_S_ANC_ALU_XOR_X:
+                        A ^= X;
+                        continue;
                 case BPF_S_ANC_NLATTR: {
                         struct nlattr *nla;
 
@@ -350,6 +356,11 @@ load_b:
                                 A = 0;
                         continue;
                 }
+#ifdef CONFIG_SECCOMP_FILTER
+                case BPF_S_ANC_SECCOMP_LD_W:
+                        A = seccomp_bpf_load(fentry->k);
+                        continue;
+#endif
                 default:
                         WARN_RATELIMIT(1, "Unknown code:%u jt:%u tf:%u k:%u\n",
                                        fentry->code, fentry->jt,
@@ -526,7 +537,7 @@ int sk_chk_filter(struct sock_filter *filter, unsigned int flen)
                          * Compare this with conditional jumps below,
                          * where offsets are limited. --ANK (981016)
                          */
-                        if (ftest->k >= (unsigned)(flen-pc-1))
+                        if (ftest->k >= (unsigned int)(flen-pc-1))
                                 return -EINVAL;
                         break;
                 case BPF_S_JMP_JEQ_K:
@@ -559,6 +570,7 @@ int sk_chk_filter(struct sock_filter *filter, unsigned int flen)
                         ANCILLARY(HATYPE);
                         ANCILLARY(RXHASH);
                         ANCILLARY(CPU);
+                        ANCILLARY(ALU_XOR_X);
                         }
                 }
                 ftest->code = code;
@@ -587,6 +599,67 @@ void sk_filter_release_rcu(struct rcu_head *rcu)
 }
 EXPORT_SYMBOL(sk_filter_release_rcu);
 
+static int __sk_prepare_filter(struct sk_filter *fp)
+{
+        int err;
+
+        fp->bpf_func = sk_run_filter;
+
+        err = sk_chk_filter(fp->insns, fp->len);
+        if (err)
+                return err;
+
+        bpf_jit_compile(fp);
+        return 0;
+}
+
+/**
+ *      sk_unattached_filter_create - create an unattached filter
+ *      @fprog: the filter program
+ *      @sk: the socket to use
+ *
+ * Create a filter independent ofr any socket. We first run some
+ * sanity checks on it to make sure it does not explode on us later.
+ * If an error occurs or there is insufficient memory for the filter
+ * a negative errno code is returned. On success the return is zero.
+ */
+int sk_unattached_filter_create(struct sk_filter **pfp,
+                                struct sock_fprog *fprog)
+{
+        struct sk_filter *fp;
+        unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
+        int err;
+
+        /* Make sure new filter is there and in the right amounts. */
+        if (fprog->filter == NULL)
+                return -EINVAL;
+
+        fp = kmalloc(fsize + sizeof(*fp), GFP_KERNEL);
+        if (!fp)
+                return -ENOMEM;
+        memcpy(fp->insns, fprog->filter, fsize);
+
+        atomic_set(&fp->refcnt, 1);
+        fp->len = fprog->len;
+
+        err = __sk_prepare_filter(fp);
+        if (err)
+                goto free_mem;
+
+        *pfp = fp;
+        return 0;
+free_mem:
+        kfree(fp);
+        return err;
+}
+EXPORT_SYMBOL_GPL(sk_unattached_filter_create);
+
+void sk_unattached_filter_destroy(struct sk_filter *fp)
+{
+        sk_filter_release(fp);
+}
+EXPORT_SYMBOL_GPL(sk_unattached_filter_destroy);
+
 /**
  *      sk_attach_filter - attach a socket filter
  *      @fprog: the filter program
@@ -617,16 +690,13 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
 
         atomic_set(&fp->refcnt, 1);
         fp->len = fprog->len;
-        fp->bpf_func = sk_run_filter;
 
-        err = sk_chk_filter(fp->insns, fp->len);
+        err = __sk_prepare_filter(fp);
         if (err) {
                 sk_filter_uncharge(sk, fp);
                 return err;
         }
 
-        bpf_jit_compile(fp);
-
         old_fp = rcu_dereference_protected(sk->sk_filter,
                                            sock_owned_by_user(sk));
         rcu_assign_pointer(sk->sk_filter, fp);
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 43b03dd71e85..d9d198aa9fed 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -14,7 +14,6 @@
  */
 
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/bitops.h>
 #include <linux/module.h>
 #include <linux/types.h>
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index 0452eb27a272..ddedf211e588 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -27,7 +27,8 @@
 static inline int
 gnet_stats_copy(struct gnet_dump *d, int type, void *buf, int size)
 {
-        NLA_PUT(d->skb, type, size, buf);
+        if (nla_put(d->skb, type, size, buf))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
diff --git a/net/core/iovec.c b/net/core/iovec.c
index c40f27e7d208..7e7aeb01de45 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -35,7 +35,7 @@
  *      in any case.
  */
 
-int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address, int mode)
+int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *address, int mode)
 {
         int size, ct, err;
 
diff --git a/net/core/kmap_skb.h b/net/core/kmap_skb.h
deleted file mode 100644
index 81e1ed7c8383..000000000000
--- a/net/core/kmap_skb.h
+++ /dev/null
@@ -1,19 +0,0 @@
-#include <linux/highmem.h>
-
-static inline void *kmap_skb_frag(const skb_frag_t *frag)
-{
-#ifdef CONFIG_HIGHMEM
-        BUG_ON(in_irq());
-
-        local_bh_disable();
-#endif
-        return kmap_atomic(skb_frag_page(frag), KM_SKB_DATA_SOFTIRQ);
-}
-
-static inline void kunmap_skb_frag(void *vaddr)
-{
-        kunmap_atomic(vaddr, KM_SKB_DATA_SOFTIRQ);
-#ifdef CONFIG_HIGHMEM
-        local_bh_enable();
-#endif
-}
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 2a83914b0277..eb09f8bbbf07 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -15,6 +15,8 @@
  *      Harald Welte            Add neighbour cache statistics like rtstat
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
@@ -712,14 +714,13 @@ void neigh_destroy(struct neighbour *neigh)
         NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 
         if (!neigh->dead) {
-                printk(KERN_WARNING
-                       "Destroying alive neighbour %p\n", neigh);
+                pr_warn("Destroying alive neighbour %p\n", neigh);
                 dump_stack();
                 return;
         }
 
         if (neigh_del_timer(neigh))
-                printk(KERN_WARNING "Impossible event.\n");
+                pr_warn("Impossible event\n");
 
         skb_queue_purge(&neigh->arp_queue);
         neigh->arp_queue_len_bytes = 0;
@@ -890,7 +891,7 @@ static void neigh_timer_handler(unsigned long arg)
 {
         unsigned long now, next;
         struct neighbour *neigh = (struct neighbour *)arg;
-        unsigned state;
+        unsigned int state;
         int notify = 0;
 
         write_lock(&neigh->lock);
@@ -1500,7 +1501,7 @@ static void neigh_parms_destroy(struct neigh_parms *parms)
 
 static struct lock_class_key neigh_table_proxy_queue_class;
 
-void neigh_table_init_no_netlink(struct neigh_table *tbl)
+static void neigh_table_init_no_netlink(struct neigh_table *tbl)
 {
         unsigned long now = jiffies;
         unsigned long phsize;
@@ -1538,7 +1539,6 @@ void neigh_table_init_no_netlink(struct neigh_table *tbl)
         tbl->last_flush = now;
         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
 }
-EXPORT_SYMBOL(neigh_table_init_no_netlink);
 
 void neigh_table_init(struct neigh_table *tbl)
 {
@@ -1555,8 +1555,8 @@ void neigh_table_init(struct neigh_table *tbl)
         write_unlock(&neigh_tbl_lock);
 
         if (unlikely(tmp)) {
-                printk(KERN_ERR "NEIGH: Registering multiple tables for "
-                       "family %d\n", tbl->family);
+                pr_err("Registering multiple tables for family %d\n",
+                       tbl->family);
                 dump_stack();
         }
 }
@@ -1572,7 +1572,7 @@ int neigh_table_clear(struct neigh_table *tbl)
         pneigh_queue_purge(&tbl->proxy_queue);
         neigh_ifdown(tbl, NULL);
         if (atomic_read(&tbl->entries))
-                printk(KERN_CRIT "neighbour leakage\n");
+                pr_crit("neighbour leakage\n");
         write_lock(&neigh_tbl_lock);
         for (tp = &neigh_tables; *tp; tp = &(*tp)->next) {
                 if (*tp == tbl) {
@@ -1768,29 +1768,29 @@ static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
         if (nest == NULL)
                 return -ENOBUFS;
 
-        if (parms->dev)
-                NLA_PUT_U32(skb, NDTPA_IFINDEX, parms->dev->ifindex);
-
-        NLA_PUT_U32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt));
-        NLA_PUT_U32(skb, NDTPA_QUEUE_LENBYTES, parms->queue_len_bytes);
-        /* approximative value for deprecated QUEUE_LEN (in packets) */
-        NLA_PUT_U32(skb, NDTPA_QUEUE_LEN,
-                    DIV_ROUND_UP(parms->queue_len_bytes,
-                                 SKB_TRUESIZE(ETH_FRAME_LEN)));
-        NLA_PUT_U32(skb, NDTPA_PROXY_QLEN, parms->proxy_qlen);
-        NLA_PUT_U32(skb, NDTPA_APP_PROBES, parms->app_probes);
-        NLA_PUT_U32(skb, NDTPA_UCAST_PROBES, parms->ucast_probes);
-        NLA_PUT_U32(skb, NDTPA_MCAST_PROBES, parms->mcast_probes);
-        NLA_PUT_MSECS(skb, NDTPA_REACHABLE_TIME, parms->reachable_time);
-        NLA_PUT_MSECS(skb, NDTPA_BASE_REACHABLE_TIME,
-                      parms->base_reachable_time);
-        NLA_PUT_MSECS(skb, NDTPA_GC_STALETIME, parms->gc_staletime);
-        NLA_PUT_MSECS(skb, NDTPA_DELAY_PROBE_TIME, parms->delay_probe_time);
-        NLA_PUT_MSECS(skb, NDTPA_RETRANS_TIME, parms->retrans_time);
-        NLA_PUT_MSECS(skb, NDTPA_ANYCAST_DELAY, parms->anycast_delay);
-        NLA_PUT_MSECS(skb, NDTPA_PROXY_DELAY, parms->proxy_delay);
-        NLA_PUT_MSECS(skb, NDTPA_LOCKTIME, parms->locktime);
-
+        if ((parms->dev &&
+             nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
+            nla_put_u32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt)) ||
+            nla_put_u32(skb, NDTPA_QUEUE_LENBYTES, parms->queue_len_bytes) ||
+            /* approximative value for deprecated QUEUE_LEN (in packets) */
+            nla_put_u32(skb, NDTPA_QUEUE_LEN,
+                        DIV_ROUND_UP(parms->queue_len_bytes,
+                                     SKB_TRUESIZE(ETH_FRAME_LEN))) ||
+            nla_put_u32(skb, NDTPA_PROXY_QLEN, parms->proxy_qlen) ||
+            nla_put_u32(skb, NDTPA_APP_PROBES, parms->app_probes) ||
+            nla_put_u32(skb, NDTPA_UCAST_PROBES, parms->ucast_probes) ||
+            nla_put_u32(skb, NDTPA_MCAST_PROBES, parms->mcast_probes) ||
+            nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time) ||
+            nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
+                          parms->base_reachable_time) ||
+            nla_put_msecs(skb, NDTPA_GC_STALETIME, parms->gc_staletime) ||
+            nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
+                          parms->delay_probe_time) ||
+            nla_put_msecs(skb, NDTPA_RETRANS_TIME, parms->retrans_time) ||
+            nla_put_msecs(skb, NDTPA_ANYCAST_DELAY, parms->anycast_delay) ||
+            nla_put_msecs(skb, NDTPA_PROXY_DELAY, parms->proxy_delay) ||
+            nla_put_msecs(skb, NDTPA_LOCKTIME, parms->locktime))
+                goto nla_put_failure;
         return nla_nest_end(skb, nest);
 
 nla_put_failure:
@@ -1815,12 +1815,12 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
         ndtmsg->ndtm_pad1   = 0;
         ndtmsg->ndtm_pad2   = 0;
 
-        NLA_PUT_STRING(skb, NDTA_NAME, tbl->id);
-        NLA_PUT_MSECS(skb, NDTA_GC_INTERVAL, tbl->gc_interval);
-        NLA_PUT_U32(skb, NDTA_THRESH1, tbl->gc_thresh1);
-        NLA_PUT_U32(skb, NDTA_THRESH2, tbl->gc_thresh2);
-        NLA_PUT_U32(skb, NDTA_THRESH3, tbl->gc_thresh3);
-
+        if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
+            nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval) ||
+            nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
+            nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
+            nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
+                goto nla_put_failure;
         {
                 unsigned long now = jiffies;
                 unsigned int flush_delta = now - tbl->last_flush;
@@ -1841,7 +1841,8 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
                 ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
                 rcu_read_unlock_bh();
 
-                NLA_PUT(skb, NDTA_CONFIG, sizeof(ndc), &ndc);
+                if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
+                        goto nla_put_failure;
         }
 
         {
@@ -1866,7 +1867,8 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
                         ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
                 }
 
-                NLA_PUT(skb, NDTA_STATS, sizeof(ndst), &ndst);
+                if (nla_put(skb, NDTA_STATS, sizeof(ndst), &ndst))
+                        goto nla_put_failure;
         }
 
         BUG_ON(tbl->parms.dev);
@@ -2137,7 +2139,8 @@ static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
         ndm->ndm_type    = neigh->type;
         ndm->ndm_ifindex = neigh->dev->ifindex;
 
-        NLA_PUT(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key);
+        if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
+                goto nla_put_failure;
 
         read_lock_bh(&neigh->lock);
         ndm->ndm_state   = neigh->nud_state;
@@ -2157,8 +2160,39 @@ static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
         ci.ndm_refcnt    = atomic_read(&neigh->refcnt) - 1;
         read_unlock_bh(&neigh->lock);
 
-        NLA_PUT_U32(skb, NDA_PROBES, atomic_read(&neigh->probes));
-        NLA_PUT(skb, NDA_CACHEINFO, sizeof(ci), &ci);
+        if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
+            nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
+                goto nla_put_failure;
+
+        return nlmsg_end(skb, nlh);
+
+nla_put_failure:
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
+}
+
+static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
+                            u32 pid, u32 seq, int type, unsigned int flags,
+                            struct neigh_table *tbl)
+{
+        struct nlmsghdr *nlh;
+        struct ndmsg *ndm;
+
+        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
+        if (nlh == NULL)
+                return -EMSGSIZE;
+
+        ndm = nlmsg_data(nlh);
+        ndm->ndm_family  = tbl->family;
+        ndm->ndm_pad1    = 0;
+        ndm->ndm_pad2    = 0;
+        ndm->ndm_flags   = pn->flags | NTF_PROXY;
+        ndm->ndm_type    = NDA_DST;
+        ndm->ndm_ifindex = pn->dev->ifindex;
+        ndm->ndm_state   = NUD_NONE;
+
+        if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
+                goto nla_put_failure;
 
         return nlmsg_end(skb, nlh);
 
@@ -2216,23 +2250,78 @@ out:
         return rc;
 }
 
+static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
+                             struct netlink_callback *cb)
+{
+        struct pneigh_entry *n;
+        struct net *net = sock_net(skb->sk);
+        int rc, h, s_h = cb->args[3];
+        int idx, s_idx = idx = cb->args[4];
+
+        read_lock_bh(&tbl->lock);
+
+        for (h = 0; h <= PNEIGH_HASHMASK; h++) {
+                if (h < s_h)
+                        continue;
+                if (h > s_h)
+                        s_idx = 0;
+                for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
+                        if (dev_net(n->dev) != net)
+                                continue;
+                        if (idx < s_idx)
+                                goto next;
+                        if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).pid,
+                                            cb->nlh->nlmsg_seq,
+                                            RTM_NEWNEIGH,
+                                            NLM_F_MULTI, tbl) <= 0) {
+                                read_unlock_bh(&tbl->lock);
+                                rc = -1;
+                                goto out;
+                        }
+                next:
+                        idx++;
+                }
+        }
+
+        read_unlock_bh(&tbl->lock);
+        rc = skb->len;
+out:
+        cb->args[3] = h;
+        cb->args[4] = idx;
+        return rc;
+
+}
+
 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct neigh_table *tbl;
         int t, family, s_t;
+        int proxy = 0;
+        int err = 0;
 
         read_lock(&neigh_tbl_lock);
         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
+
+        /* check for full ndmsg structure presence, family member is
+         * the same for both structures
+         */
+        if (nlmsg_len(cb->nlh) >= sizeof(struct ndmsg) &&
+            ((struct ndmsg *) nlmsg_data(cb->nlh))->ndm_flags == NTF_PROXY)
+                proxy = 1;
+
         s_t = cb->args[0];
 
-        for (tbl = neigh_tables, t = 0; tbl; tbl = tbl->next, t++) {
+        for (tbl = neigh_tables, t = 0; tbl && (err >= 0);
+             tbl = tbl->next, t++) {
                 if (t < s_t || (family && tbl->family != family))
                         continue;
                 if (t > s_t)
                         memset(&cb->args[1], 0, sizeof(cb->args) -
                                                 sizeof(cb->args[0]));
-                if (neigh_dump_table(tbl, skb, cb) < 0)
-                        break;
+                if (proxy)
+                        err = pneigh_dump_table(tbl, skb, cb);
+                else
+                        err = neigh_dump_table(tbl, skb, cb);
         }
         read_unlock(&neigh_tbl_lock);
 
@@ -2711,7 +2800,6 @@ enum {
 static struct neigh_sysctl_table {
         struct ctl_table_header *sysctl_header;
         struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
-        char *dev_name;
 } neigh_sysctl_template __read_mostly = {
         .neigh_vars = {
                 [NEIGH_VAR_MCAST_PROBE] = {
@@ -2837,19 +2925,7 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
 {
         struct neigh_sysctl_table *t;
         const char *dev_name_source = NULL;
-
-#define NEIGH_CTL_PATH_ROOT     0
-#define NEIGH_CTL_PATH_PROTO    1
-#define NEIGH_CTL_PATH_NEIGH    2
-#define NEIGH_CTL_PATH_DEV      3
-
-        struct ctl_path neigh_path[] = {
-                { .procname = "net",     },
-                { .procname = "proto",   },
-                { .procname = "neigh",   },
-                { .procname = "default", },
-                { },
-        };
+        char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
 
         t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
         if (!t)
@@ -2877,7 +2953,7 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
                 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
                        sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
         } else {
-                dev_name_source = neigh_path[NEIGH_CTL_PATH_DEV].procname;
+                dev_name_source = "default";
                 t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = (int *)(p + 1);
                 t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = (int *)(p + 1) + 1;
                 t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = (int *)(p + 1) + 2;
@@ -2900,23 +2976,16 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].extra1 = dev;
         }
 
-        t->dev_name = kstrdup(dev_name_source, GFP_KERNEL);
-        if (!t->dev_name)
-                goto free;
-
-        neigh_path[NEIGH_CTL_PATH_DEV].procname = t->dev_name;
-        neigh_path[NEIGH_CTL_PATH_PROTO].procname = p_name;
-
+        snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
+                p_name, dev_name_source);
         t->sysctl_header =
-                register_net_sysctl_table(neigh_parms_net(p), neigh_path, t->neigh_vars);
+                register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
         if (!t->sysctl_header)
-                goto free_procname;
+                goto free;
 
         p->sysctl_table = t;
         return 0;
 
-free_procname:
-        kfree(t->dev_name);
 free:
         kfree(t);
 err:
@@ -2929,8 +2998,7 @@ void neigh_sysctl_unregister(struct neigh_parms *p)
         if (p->sysctl_table) {
                 struct neigh_sysctl_table *t = p->sysctl_table;
                 p->sysctl_table = NULL;
-                unregister_sysctl_table(t->sysctl_header);
-                kfree(t->dev_name);
+                unregister_net_sysctl_table(t->sysctl_header);
                 kfree(t);
         }
 }
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index a1727cda03d7..fdf9e61d0651 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -74,15 +74,14 @@ static ssize_t netdev_store(struct device *dev, struct device_attribute *attr,
                             int (*set)(struct net_device *, unsigned long))
 {
         struct net_device *net = to_net_dev(dev);
-        char *endp;
         unsigned long new;
         int ret = -EINVAL;
 
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
-        new = simple_strtoul(buf, &endp, 0);
-        if (endp == buf)
+        ret = kstrtoul(buf, 0, &new);
+        if (ret)
                 goto err;
 
         if (!rtnl_trylock())
@@ -232,7 +231,7 @@ NETDEVICE_SHOW(flags, fmt_hex);
 
 static int change_flags(struct net_device *net, unsigned long new_flags)
 {
-        return dev_change_flags(net, (unsigned) new_flags);
+        return dev_change_flags(net, (unsigned int) new_flags);
 }
 
 static ssize_t store_flags(struct device *dev, struct device_attribute *attr,
@@ -582,7 +581,7 @@ static ssize_t store_rps_map(struct netdev_rx_queue *queue,
                 return err;
         }
 
-        map = kzalloc(max_t(unsigned,
+        map = kzalloc(max_t(unsigned int,
             RPS_MAP_SIZE(cpumask_weight(mask)), L1_CACHE_BYTES),
             GFP_KERNEL);
         if (!map) {
@@ -608,10 +607,10 @@ static ssize_t store_rps_map(struct netdev_rx_queue *queue,
         spin_unlock(&rps_map_lock);
 
         if (map)
-                jump_label_inc(&rps_needed);
+                static_key_slow_inc(&rps_needed);
         if (old_map) {
                 kfree_rcu(old_map, rcu);
-                jump_label_dec(&rps_needed);
+                static_key_slow_dec(&rps_needed);
         }
         free_cpumask_var(mask);
         return len;
@@ -903,7 +902,7 @@ static ssize_t bql_set_hold_time(struct netdev_queue *queue,
                                  const char *buf, size_t len)
 {
         struct dql *dql = &queue->dql;
-        unsigned value;
+        unsigned int value;
         int err;
 
         err = kstrtouint(buf, 10, &value);
@@ -1107,7 +1106,7 @@ static ssize_t store_xps_map(struct netdev_queue *queue,
                 return err;
         }
 
-        new_dev_maps = kzalloc(max_t(unsigned,
+        new_dev_maps = kzalloc(max_t(unsigned int,
             XPS_DEV_MAPS_SIZE, L1_CACHE_BYTES), GFP_KERNEL);
         if (!new_dev_maps) {
                 free_cpumask_var(mask);
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 0e950fda9a0a..dddbacb8f28c 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -1,3 +1,5 @@
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/workqueue.h>
 #include <linux/rtnetlink.h>
 #include <linux/cache.h>
@@ -83,21 +85,29 @@ assign:
 
 static int ops_init(const struct pernet_operations *ops, struct net *net)
 {
-        int err;
+        int err = -ENOMEM;
+        void *data = NULL;
+
         if (ops->id && ops->size) {
-                void *data = kzalloc(ops->size, GFP_KERNEL);
+                data = kzalloc(ops->size, GFP_KERNEL);
                 if (!data)
-                        return -ENOMEM;
+                        goto out;
 
                 err = net_assign_generic(net, *ops->id, data);
-                if (err) {
-                        kfree(data);
-                        return err;
-                }
+                if (err)
+                        goto cleanup;
         }
+        err = 0;
         if (ops->init)
-                return ops->init(net);
-        return 0;
+                err = ops->init(net);
+        if (!err)
+                return 0;
+
+cleanup:
+        kfree(data);
+
+out:
+        return err;
 }
 
 static void ops_free(const struct pernet_operations *ops, struct net *net)
@@ -204,8 +214,8 @@ static void net_free(struct net *net)
 {
 #ifdef NETNS_REFCNT_DEBUG
         if (unlikely(atomic_read(&net->use_count) != 0)) {
-                printk(KERN_EMERG "network namespace not free! Usage: %d\n",
-                        atomic_read(&net->use_count));
+                pr_emerg("network namespace not free! Usage: %d\n",
+                         atomic_read(&net->use_count));
                 return;
         }
 #endif
@@ -448,12 +458,7 @@ static void __unregister_pernet_operations(struct pernet_operations *ops)
 static int __register_pernet_operations(struct list_head *list,
                                         struct pernet_operations *ops)
 {
-        int err = 0;
-        err = ops_init(ops, &init_net);
-        if (err)
-                ops_free(ops, &init_net);
-        return err;
-        
+        return ops_init(ops, &init_net);
 }
 
 static void __unregister_pernet_operations(struct pernet_operations *ops)
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index ddefc513b44a..3d84fb9d8873 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -9,6 +9,8 @@
  * Copyright (C) 2002  Red Hat, Inc.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/moduleparam.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
@@ -45,9 +47,11 @@ static atomic_t trapped;
 #define NETPOLL_RX_ENABLED  1
 #define NETPOLL_RX_DROP     2
 
-#define MAX_SKB_SIZE \
-                (MAX_UDP_CHUNK + sizeof(struct udphdr) + \
-                                sizeof(struct iphdr) + sizeof(struct ethhdr))
+#define MAX_SKB_SIZE                                                    \
+        (sizeof(struct ethhdr) +                                        \
+         sizeof(struct iphdr) +                                         \
+         sizeof(struct udphdr) +                                        \
+         MAX_UDP_CHUNK)
 
 static void zap_completion_queue(void);
 static void arp_reply(struct sk_buff *skb);
@@ -55,6 +59,13 @@ static void arp_reply(struct sk_buff *skb);
 static unsigned int carrier_timeout = 4;
 module_param(carrier_timeout, uint, 0644);
 
+#define np_info(np, fmt, ...)                           \
+        pr_info("%s: " fmt, np->name, ##__VA_ARGS__)
+#define np_err(np, fmt, ...)                            \
+        pr_err("%s: " fmt, np->name, ##__VA_ARGS__)
+#define np_notice(np, fmt, ...)                         \
+        pr_notice("%s: " fmt, np->name, ##__VA_ARGS__)
+
 static void queue_process(struct work_struct *work)
 {
         struct netpoll_info *npinfo =
@@ -627,18 +638,12 @@ out:
 
 void netpoll_print_options(struct netpoll *np)
 {
-        printk(KERN_INFO "%s: local port %d\n",
-                         np->name, np->local_port);
-        printk(KERN_INFO "%s: local IP %pI4\n",
-                         np->name, &np->local_ip);
-        printk(KERN_INFO "%s: interface '%s'\n",
-                         np->name, np->dev_name);
-        printk(KERN_INFO "%s: remote port %d\n",
-                         np->name, np->remote_port);
-        printk(KERN_INFO "%s: remote IP %pI4\n",
-                         np->name, &np->remote_ip);
-        printk(KERN_INFO "%s: remote ethernet address %pM\n",
-                         np->name, np->remote_mac);
+        np_info(np, "local port %d\n", np->local_port);
+        np_info(np, "local IP %pI4\n", &np->local_ip);
+        np_info(np, "interface '%s'\n", np->dev_name);
+        np_info(np, "remote port %d\n", np->remote_port);
+        np_info(np, "remote IP %pI4\n", &np->remote_ip);
+        np_info(np, "remote ethernet address %pM\n", np->remote_mac);
 }
 EXPORT_SYMBOL(netpoll_print_options);
 
@@ -680,8 +685,7 @@ int netpoll_parse_options(struct netpoll *np, char *opt)
                         goto parse_failed;
                 *delim = 0;
                 if (*cur == ' ' || *cur == '\t')
-                        printk(KERN_INFO "%s: warning: whitespace"
-                                        "is not allowed\n", np->name);
+                        np_info(np, "warning: whitespace is not allowed\n");
                 np->remote_port = simple_strtol(cur, NULL, 10);
                 cur = delim;
         }
@@ -705,8 +709,7 @@ int netpoll_parse_options(struct netpoll *np, char *opt)
         return 0;
 
  parse_failed:
-        printk(KERN_INFO "%s: couldn't parse config at '%s'!\n",
-               np->name, cur);
+        np_info(np, "couldn't parse config at '%s'!\n", cur);
         return -1;
 }
 EXPORT_SYMBOL(netpoll_parse_options);
@@ -721,8 +724,8 @@ int __netpoll_setup(struct netpoll *np)
 
         if ((ndev->priv_flags & IFF_DISABLE_NETPOLL) ||
             !ndev->netdev_ops->ndo_poll_controller) {
-                printk(KERN_ERR "%s: %s doesn't support polling, aborting.\n",
-                       np->name, np->dev_name);
+                np_err(np, "%s doesn't support polling, aborting\n",
+                       np->dev_name);
                 err = -ENOTSUPP;
                 goto out;
         }
@@ -785,14 +788,12 @@ int netpoll_setup(struct netpoll *np)
         if (np->dev_name)
                 ndev = dev_get_by_name(&init_net, np->dev_name);
         if (!ndev) {
-                printk(KERN_ERR "%s: %s doesn't exist, aborting.\n",
-                       np->name, np->dev_name);
+                np_err(np, "%s doesn't exist, aborting\n", np->dev_name);
                 return -ENODEV;
         }
 
         if (ndev->master) {
-                printk(KERN_ERR "%s: %s is a slave device, aborting.\n",
-                       np->name, np->dev_name);
+                np_err(np, "%s is a slave device, aborting\n", np->dev_name);
                 err = -EBUSY;
                 goto put;
         }
@@ -800,16 +801,14 @@ int netpoll_setup(struct netpoll *np)
         if (!netif_running(ndev)) {
                 unsigned long atmost, atleast;
 
-                printk(KERN_INFO "%s: device %s not up yet, forcing it\n",
-                       np->name, np->dev_name);
+                np_info(np, "device %s not up yet, forcing it\n", np->dev_name);
 
                 rtnl_lock();
                 err = dev_open(ndev);
                 rtnl_unlock();
 
                 if (err) {
-                        printk(KERN_ERR "%s: failed to open %s\n",
-                               np->name, ndev->name);
+                        np_err(np, "failed to open %s\n", ndev->name);
                         goto put;
                 }
 
@@ -817,9 +816,7 @@ int netpoll_setup(struct netpoll *np)
                 atmost = jiffies + carrier_timeout * HZ;
                 while (!netif_carrier_ok(ndev)) {
                         if (time_after(jiffies, atmost)) {
-                                printk(KERN_NOTICE
-                                       "%s: timeout waiting for carrier\n",
-                                       np->name);
+                                np_notice(np, "timeout waiting for carrier\n");
                                 break;
                         }
                         msleep(1);
@@ -831,9 +828,7 @@ int netpoll_setup(struct netpoll *np)
                  */
 
                 if (time_before(jiffies, atleast)) {
-                        printk(KERN_NOTICE "%s: carrier detect appears"
-                               " untrustworthy, waiting 4 seconds\n",
-                               np->name);
+                        np_notice(np, "carrier detect appears untrustworthy, waiting 4 seconds\n");
                         msleep(4000);
                 }
         }
@@ -844,15 +839,15 @@ int netpoll_setup(struct netpoll *np)
 
                 if (!in_dev || !in_dev->ifa_list) {
                         rcu_read_unlock();
-                        printk(KERN_ERR "%s: no IP address for %s, aborting\n",
-                               np->name, np->dev_name);
+                        np_err(np, "no IP address for %s, aborting\n",
+                               np->dev_name);
                         err = -EDESTADDRREQ;
                         goto put;
                 }
 
                 np->local_ip = in_dev->ifa_list->ifa_local;
                 rcu_read_unlock();
-                printk(KERN_INFO "%s: local IP %pI4\n", np->name, &np->local_ip);
+                np_info(np, "local IP %pI4\n", &np->local_ip);
         }
 
         np->dev = ndev;
diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
index 4dacc44637ef..5b8aa2fae48b 100644
--- a/net/core/netprio_cgroup.c
+++ b/net/core/netprio_cgroup.c
@@ -9,6 +9,8 @@
  * Authors:     Neil Horman <nhorman@tuxdriver.com>
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/types.h>
@@ -23,22 +25,6 @@
 #include <net/sock.h>
 #include <net/netprio_cgroup.h>
 
-static struct cgroup_subsys_state *cgrp_create(struct cgroup_subsys *ss,
-                                               struct cgroup *cgrp);
-static void cgrp_destroy(struct cgroup_subsys *ss, struct cgroup *cgrp);
-static int cgrp_populate(struct cgroup_subsys *ss, struct cgroup *cgrp);
-
-struct cgroup_subsys net_prio_subsys = {
-        .name           = "net_prio",
-        .create         = cgrp_create,
-        .destroy        = cgrp_destroy,
-        .populate       = cgrp_populate,
-#ifdef CONFIG_NETPRIO_CGROUP
-        .subsys_id      = net_prio_subsys_id,
-#endif
-        .module         = THIS_MODULE
-};
-
 #define PRIOIDX_SZ 128
 
 static unsigned long prioidx_map[PRIOIDX_SZ];
@@ -89,7 +75,7 @@ static void extend_netdev_table(struct net_device *dev, u32 new_len)
         old_priomap  = rtnl_dereference(dev->priomap);
 
         if (!new_priomap) {
-                printk(KERN_WARNING "Unable to alloc new priomap!\n");
+                pr_warn("Unable to alloc new priomap!\n");
                 return;
         }
 
@@ -121,8 +107,7 @@ static void update_netdev_tables(void)
         rtnl_unlock();
 }
 
-static struct cgroup_subsys_state *cgrp_create(struct cgroup_subsys *ss,
-                                                 struct cgroup *cgrp)
+static struct cgroup_subsys_state *cgrp_create(struct cgroup *cgrp)
 {
         struct cgroup_netprio_state *cs;
         int ret;
@@ -138,7 +123,7 @@ static struct cgroup_subsys_state *cgrp_create(struct cgroup_subsys *ss,
 
         ret = get_prioidx(&cs->prioidx);
         if (ret != 0) {
-                printk(KERN_WARNING "No space in priority index array\n");
+                pr_warn("No space in priority index array\n");
                 kfree(cs);
                 return ERR_PTR(ret);
         }
@@ -146,7 +131,7 @@ static struct cgroup_subsys_state *cgrp_create(struct cgroup_subsys *ss,
         return &cs->css;
 }
 
-static void cgrp_destroy(struct cgroup_subsys *ss, struct cgroup *cgrp)
+static void cgrp_destroy(struct cgroup *cgrp)
 {
         struct cgroup_netprio_state *cs;
         struct net_device *dev;
@@ -259,12 +244,19 @@ static struct cftype ss_files[] = {
                 .read_map = read_priomap,
                 .write_string = write_priomap,
         },
+        { }     /* terminate */
 };
 
-static int cgrp_populate(struct cgroup_subsys *ss, struct cgroup *cgrp)
-{
-        return cgroup_add_files(cgrp, ss, ss_files, ARRAY_SIZE(ss_files));
-}
+struct cgroup_subsys net_prio_subsys = {
+        .name           = "net_prio",
+        .create         = cgrp_create,
+        .destroy        = cgrp_destroy,
+#ifdef CONFIG_NETPRIO_CGROUP
+        .subsys_id      = net_prio_subsys_id,
+#endif
+        .base_cftypes   = ss_files,
+        .module         = THIS_MODULE
+};
 
 static int netprio_device_event(struct notifier_block *unused,
                                 unsigned long event, void *ptr)
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 4d8ce93cd503..cce9e53528b1 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -320,7 +320,7 @@ struct pktgen_dev {
                                 (see RFC 3260, sec. 4) */
 
         /* MPLS */
-        unsigned nr_labels;     /* Depth of stack, 0 = no MPLS */
+        unsigned int nr_labels; /* Depth of stack, 0 = no MPLS */
         __be32 labels[MAX_MPLS_LABELS];
 
         /* VLAN/SVLAN (802.1Q/Q-in-Q) */
@@ -373,10 +373,10 @@ struct pktgen_dev {
                                   */
         char odevname[32];
         struct flow_state *flows;
-        unsigned cflows;        /* Concurrent flows (config) */
-        unsigned lflow;         /* Flow length  (config) */
-        unsigned nflows;        /* accumulated flows (stats) */
-        unsigned curfl;         /* current sequenced flow (state)*/
+        unsigned int cflows;    /* Concurrent flows (config) */
+        unsigned int lflow;             /* Flow length  (config) */
+        unsigned int nflows;    /* accumulated flows (stats) */
+        unsigned int curfl;             /* current sequenced flow (state)*/
 
         u16 queue_map_min;
         u16 queue_map_max;
@@ -592,7 +592,7 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
                    pkt_dev->src_mac_count, pkt_dev->dst_mac_count);
 
         if (pkt_dev->nr_labels) {
-                unsigned i;
+                unsigned int i;
                 seq_printf(seq, "     mpls: ");
                 for (i = 0; i < pkt_dev->nr_labels; i++)
                         seq_printf(seq, "%08x%s", ntohl(pkt_dev->labels[i]),
@@ -812,7 +812,7 @@ done_str:
 
 static ssize_t get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev)
 {
-        unsigned n = 0;
+        unsigned int n = 0;
         char c;
         ssize_t i = 0;
         int len;
@@ -891,8 +891,8 @@ static ssize_t pktgen_if_write(struct file *file,
                 if (copy_from_user(tb, user_buffer, copy))
                         return -EFAULT;
                 tb[copy] = 0;
-                printk(KERN_DEBUG "pktgen: %s,%lu  buffer -:%s:-\n", name,
-                       (unsigned long)count, tb);
+                pr_debug("%s,%lu  buffer -:%s:-\n",
+                         name, (unsigned long)count, tb);
         }
 
         if (!strcmp(name, "min_pkt_size")) {
@@ -1261,8 +1261,7 @@ static ssize_t pktgen_if_write(struct file *file,
                         pkt_dev->cur_daddr = pkt_dev->daddr_min;
                 }
                 if (debug)
-                        printk(KERN_DEBUG "pktgen: dst_min set to: %s\n",
-                               pkt_dev->dst_min);
+                        pr_debug("dst_min set to: %s\n", pkt_dev->dst_min);
                 i += len;
                 sprintf(pg_result, "OK: dst_min=%s", pkt_dev->dst_min);
                 return count;
@@ -1284,8 +1283,7 @@ static ssize_t pktgen_if_write(struct file *file,
                         pkt_dev->cur_daddr = pkt_dev->daddr_max;
                 }
                 if (debug)
-                        printk(KERN_DEBUG "pktgen: dst_max set to: %s\n",
-                               pkt_dev->dst_max);
+                        pr_debug("dst_max set to: %s\n", pkt_dev->dst_max);
                 i += len;
                 sprintf(pg_result, "OK: dst_max=%s", pkt_dev->dst_max);
                 return count;
@@ -1307,7 +1305,7 @@ static ssize_t pktgen_if_write(struct file *file,
                 pkt_dev->cur_in6_daddr = pkt_dev->in6_daddr;
 
                 if (debug)
-                        printk(KERN_DEBUG "pktgen: dst6 set to: %s\n", buf);
+                        pr_debug("dst6 set to: %s\n", buf);
 
                 i += len;
                 sprintf(pg_result, "OK: dst6=%s", buf);
@@ -1329,7 +1327,7 @@ static ssize_t pktgen_if_write(struct file *file,
 
                 pkt_dev->cur_in6_daddr = pkt_dev->min_in6_daddr;
                 if (debug)
-                        printk(KERN_DEBUG "pktgen: dst6_min set to: %s\n", buf);
+                        pr_debug("dst6_min set to: %s\n", buf);
 
                 i += len;
                 sprintf(pg_result, "OK: dst6_min=%s", buf);
@@ -1350,7 +1348,7 @@ static ssize_t pktgen_if_write(struct file *file,
                 snprintf(buf, sizeof(buf), "%pI6c", &pkt_dev->max_in6_daddr);
 
                 if (debug)
-                        printk(KERN_DEBUG "pktgen: dst6_max set to: %s\n", buf);
+                        pr_debug("dst6_max set to: %s\n", buf);
 
                 i += len;
                 sprintf(pg_result, "OK: dst6_max=%s", buf);
@@ -1373,7 +1371,7 @@ static ssize_t pktgen_if_write(struct file *file,
                 pkt_dev->cur_in6_saddr = pkt_dev->in6_saddr;
 
                 if (debug)
-                        printk(KERN_DEBUG "pktgen: src6 set to: %s\n", buf);
+                        pr_debug("src6 set to: %s\n", buf);
 
                 i += len;
                 sprintf(pg_result, "OK: src6=%s", buf);
@@ -1394,8 +1392,7 @@ static ssize_t pktgen_if_write(struct file *file,
                         pkt_dev->cur_saddr = pkt_dev->saddr_min;
                 }
                 if (debug)
-                        printk(KERN_DEBUG "pktgen: src_min set to: %s\n",
-                               pkt_dev->src_min);
+                        pr_debug("src_min set to: %s\n", pkt_dev->src_min);
                 i += len;
                 sprintf(pg_result, "OK: src_min=%s", pkt_dev->src_min);
                 return count;
@@ -1415,8 +1412,7 @@ static ssize_t pktgen_if_write(struct file *file,
                         pkt_dev->cur_saddr = pkt_dev->saddr_max;
                 }
                 if (debug)
-                        printk(KERN_DEBUG "pktgen: src_max set to: %s\n",
-                               pkt_dev->src_max);
+                        pr_debug("src_max set to: %s\n", pkt_dev->src_max);
                 i += len;
                 sprintf(pg_result, "OK: src_max=%s", pkt_dev->src_max);
                 return count;
@@ -1510,7 +1506,7 @@ static ssize_t pktgen_if_write(struct file *file,
         }
 
         if (!strcmp(name, "mpls")) {
-                unsigned n, cnt;
+                unsigned int n, cnt;
 
                 len = get_labels(&user_buffer[i], pkt_dev);
                 if (len < 0)
@@ -1527,7 +1523,7 @@ static ssize_t pktgen_if_write(struct file *file,
                         pkt_dev->svlan_id = 0xffff;
 
                         if (debug)
-                                printk(KERN_DEBUG "pktgen: VLAN/SVLAN auto turned off\n");
+                                pr_debug("VLAN/SVLAN auto turned off\n");
                 }
                 return count;
         }
@@ -1542,10 +1538,10 @@ static ssize_t pktgen_if_write(struct file *file,
                         pkt_dev->vlan_id = value;  /* turn on VLAN */
 
                         if (debug)
-                                printk(KERN_DEBUG "pktgen: VLAN turned on\n");
+                                pr_debug("VLAN turned on\n");
 
                         if (debug && pkt_dev->nr_labels)
-                                printk(KERN_DEBUG "pktgen: MPLS auto turned off\n");
+                                pr_debug("MPLS auto turned off\n");
 
                         pkt_dev->nr_labels = 0;    /* turn off MPLS */
                         sprintf(pg_result, "OK: vlan_id=%u", pkt_dev->vlan_id);
@@ -1554,7 +1550,7 @@ static ssize_t pktgen_if_write(struct file *file,
                         pkt_dev->svlan_id = 0xffff;
 
                         if (debug)
-                                printk(KERN_DEBUG "pktgen: VLAN/SVLAN turned off\n");
+                                pr_debug("VLAN/SVLAN turned off\n");
                 }
                 return count;
         }
@@ -1599,10 +1595,10 @@ static ssize_t pktgen_if_write(struct file *file,
                         pkt_dev->svlan_id = value;  /* turn on SVLAN */
 
                         if (debug)
-                                printk(KERN_DEBUG "pktgen: SVLAN turned on\n");
+                                pr_debug("SVLAN turned on\n");
 
                         if (debug && pkt_dev->nr_labels)
-                                printk(KERN_DEBUG "pktgen: MPLS auto turned off\n");
+                                pr_debug("MPLS auto turned off\n");
 
                         pkt_dev->nr_labels = 0;    /* turn off MPLS */
                         sprintf(pg_result, "OK: svlan_id=%u", pkt_dev->svlan_id);
@@ -1611,7 +1607,7 @@ static ssize_t pktgen_if_write(struct file *file,
                         pkt_dev->svlan_id = 0xffff;
 
                         if (debug)
-                                printk(KERN_DEBUG "pktgen: VLAN/SVLAN turned off\n");
+                                pr_debug("VLAN/SVLAN turned off\n");
                 }
                 return count;
         }
@@ -1779,8 +1775,7 @@ static ssize_t pktgen_thread_write(struct file *file,
         i += len;
 
         if (debug)
-                printk(KERN_DEBUG "pktgen: t=%s, count=%lu\n",
-                       name, (unsigned long)count);
+                pr_debug("t=%s, count=%lu\n", name, (unsigned long)count);
 
         if (!t) {
                 pr_err("ERROR: No thread\n");
@@ -1931,7 +1926,7 @@ static int pktgen_device_event(struct notifier_block *unused,
 {
         struct net_device *dev = ptr;
 
-        if (!net_eq(dev_net(dev), &init_net))
+        if (!net_eq(dev_net(dev), &init_net) || pktgen_exiting)
                 return NOTIFY_DONE;
 
         /* It is OK that we do not hold the group lock right now,
@@ -2324,7 +2319,7 @@ static void mod_cur_headers(struct pktgen_dev *pkt_dev)
         }
 
         if (pkt_dev->flags & F_MPLS_RND) {
-                unsigned i;
+                unsigned int i;
                 for (i = 0; i < pkt_dev->nr_labels; i++)
                         if (pkt_dev->labels[i] & MPLS_STACK_BOTTOM)
                                 pkt_dev->labels[i] = MPLS_STACK_BOTTOM |
@@ -2550,7 +2545,7 @@ err:
 
 static void mpls_push(__be32 *mpls, struct pktgen_dev *pkt_dev)
 {
-        unsigned i;
+        unsigned int i;
         for (i = 0; i < pkt_dev->nr_labels; i++)
                 *mpls++ = pkt_dev->labels[i] & ~MPLS_STACK_BOTTOM;
 
@@ -2934,8 +2929,7 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
 
         if (datalen < sizeof(struct pktgen_hdr)) {
                 datalen = sizeof(struct pktgen_hdr);
-                if (net_ratelimit())
-                        pr_info("increased datalen to %d\n", datalen);
+                net_info_ratelimited("increased datalen to %d\n", datalen);
         }
 
         udph->source = htons(pkt_dev->cur_udp_src);
@@ -3365,8 +3359,8 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
                 pkt_dev->errors++;
                 break;
         default: /* Drivers are not supposed to return other values! */
-                if (net_ratelimit())
-                        pr_info("%s xmit error: %d\n", pkt_dev->odevname, ret);
+                net_info_ratelimited("%s xmit error: %d\n",
+                                     pkt_dev->odevname, ret);
                 pkt_dev->errors++;
                 /* fallthru */
         case NETDEV_TX_LOCKED:
@@ -3755,12 +3749,18 @@ static void __exit pg_cleanup(void)
 {
         struct pktgen_thread *t;
         struct list_head *q, *n;
+        LIST_HEAD(list);
 
         /* Stop all interfaces & threads */
         pktgen_exiting = true;
 
-        list_for_each_safe(q, n, &pktgen_threads) {
+        mutex_lock(&pktgen_thread_lock);
+        list_splice_init(&pktgen_threads, &list);
+        mutex_unlock(&pktgen_thread_lock);
+
+        list_for_each_safe(q, n, &list) {
                 t = list_entry(q, struct pktgen_thread, th_list);
+                list_del(&t->th_list);
                 kthread_stop(t->tsk);
                 kfree(t);
         }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index f965dce6f20f..21318d15bbc3 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -35,10 +35,11 @@
 #include <linux/security.h>
 #include <linux/mutex.h>
 #include <linux/if_addr.h>
+#include <linux/if_bridge.h>
 #include <linux/pci.h>
+#include <linux/etherdevice.h>
 
 #include <asm/uaccess.h>
-#include <asm/system.h>
 
 #include <linux/inet.h>
 #include <linux/netdevice.h>
@@ -553,7 +554,7 @@ void __rta_fill(struct sk_buff *skb, int attrtype, int attrlen, const void *data
 }
 EXPORT_SYMBOL(__rta_fill);
 
-int rtnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, unsigned group, int echo)
+int rtnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, unsigned int group, int echo)
 {
         struct sock *rtnl = net->rtnl;
         int err = 0;
@@ -608,7 +609,8 @@ int rtnetlink_put_metrics(struct sk_buff *skb, u32 *metrics)
         for (i = 0; i < RTAX_MAX; i++) {
                 if (metrics[i]) {
                         valid++;
-                        NLA_PUT_U32(skb, i+1, metrics[i]);
+                        if (nla_put_u32(skb, i+1, metrics[i]))
+                                goto nla_put_failure;
                 }
         }
 
@@ -783,6 +785,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
                + nla_total_size(4) /* IFLA_MTU */
                + nla_total_size(4) /* IFLA_LINK */
                + nla_total_size(4) /* IFLA_MASTER */
+               + nla_total_size(4) /* IFLA_PROMISCUITY */
                + nla_total_size(1) /* IFLA_OPERSTATE */
                + nla_total_size(1) /* IFLA_LINKMODE */
                + nla_total_size(ext_filter_mask
@@ -808,7 +811,8 @@ static int rtnl_vf_ports_fill(struct sk_buff *skb, struct net_device *dev)
                 vf_port = nla_nest_start(skb, IFLA_VF_PORT);
                 if (!vf_port)
                         goto nla_put_failure;
-                NLA_PUT_U32(skb, IFLA_PORT_VF, vf);
+                if (nla_put_u32(skb, IFLA_PORT_VF, vf))
+                        goto nla_put_failure;
                 err = dev->netdev_ops->ndo_get_vf_port(dev, vf, skb);
                 if (err == -EMSGSIZE)
                         goto nla_put_failure;
@@ -892,25 +896,23 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
         ifm->ifi_flags = dev_get_flags(dev);
         ifm->ifi_change = change;
 
-        NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
-        NLA_PUT_U32(skb, IFLA_TXQLEN, dev->tx_queue_len);
-        NLA_PUT_U8(skb, IFLA_OPERSTATE,
-                   netif_running(dev) ? dev->operstate : IF_OPER_DOWN);
-        NLA_PUT_U8(skb, IFLA_LINKMODE, dev->link_mode);
-        NLA_PUT_U32(skb, IFLA_MTU, dev->mtu);
-        NLA_PUT_U32(skb, IFLA_GROUP, dev->group);
-
-        if (dev->ifindex != dev->iflink)
-                NLA_PUT_U32(skb, IFLA_LINK, dev->iflink);
-
-        if (dev->master)
-                NLA_PUT_U32(skb, IFLA_MASTER, dev->master->ifindex);
-
-        if (dev->qdisc)
-                NLA_PUT_STRING(skb, IFLA_QDISC, dev->qdisc->ops->id);
-
-        if (dev->ifalias)
-                NLA_PUT_STRING(skb, IFLA_IFALIAS, dev->ifalias);
+        if (nla_put_string(skb, IFLA_IFNAME, dev->name) ||
+            nla_put_u32(skb, IFLA_TXQLEN, dev->tx_queue_len) ||
+            nla_put_u8(skb, IFLA_OPERSTATE,
+                       netif_running(dev) ? dev->operstate : IF_OPER_DOWN) ||
+            nla_put_u8(skb, IFLA_LINKMODE, dev->link_mode) ||
+            nla_put_u32(skb, IFLA_MTU, dev->mtu) ||
+            nla_put_u32(skb, IFLA_GROUP, dev->group) ||
+            nla_put_u32(skb, IFLA_PROMISCUITY, dev->promiscuity) ||
+            (dev->ifindex != dev->iflink &&
+             nla_put_u32(skb, IFLA_LINK, dev->iflink)) ||
+            (dev->master &&
+             nla_put_u32(skb, IFLA_MASTER, dev->master->ifindex)) ||
+            (dev->qdisc &&
+             nla_put_string(skb, IFLA_QDISC, dev->qdisc->ops->id)) ||
+            (dev->ifalias &&
+             nla_put_string(skb, IFLA_IFALIAS, dev->ifalias)))
+                goto nla_put_failure;
 
         if (1) {
                 struct rtnl_link_ifmap map = {
@@ -921,12 +923,14 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                         .dma         = dev->dma,
                         .port        = dev->if_port,
                 };
-                NLA_PUT(skb, IFLA_MAP, sizeof(map), &map);
+                if (nla_put(skb, IFLA_MAP, sizeof(map), &map))
+                        goto nla_put_failure;
         }
 
         if (dev->addr_len) {
-                NLA_PUT(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr);
-                NLA_PUT(skb, IFLA_BROADCAST, dev->addr_len, dev->broadcast);
+                if (nla_put(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr) ||
+                    nla_put(skb, IFLA_BROADCAST, dev->addr_len, dev->broadcast))
+                        goto nla_put_failure;
         }
 
         attr = nla_reserve(skb, IFLA_STATS,
@@ -943,8 +947,9 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                 goto nla_put_failure;
         copy_rtnl_link_stats64(nla_data(attr), stats);
 
-        if (dev->dev.parent && (ext_filter_mask & RTEXT_FILTER_VF))
-                NLA_PUT_U32(skb, IFLA_NUM_VF, dev_num_vf(dev->dev.parent));
+        if (dev->dev.parent && (ext_filter_mask & RTEXT_FILTER_VF) &&
+            nla_put_u32(skb, IFLA_NUM_VF, dev_num_vf(dev->dev.parent)))
+                goto nla_put_failure;
 
         if (dev->netdev_ops->ndo_get_vf_config && dev->dev.parent
             && (ext_filter_mask & RTEXT_FILTER_VF)) {
@@ -987,12 +992,13 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                                 nla_nest_cancel(skb, vfinfo);
                                 goto nla_put_failure;
                         }
-                        NLA_PUT(skb, IFLA_VF_MAC, sizeof(vf_mac), &vf_mac);
-                        NLA_PUT(skb, IFLA_VF_VLAN, sizeof(vf_vlan), &vf_vlan);
-                        NLA_PUT(skb, IFLA_VF_TX_RATE, sizeof(vf_tx_rate),
-                                &vf_tx_rate);
-                        NLA_PUT(skb, IFLA_VF_SPOOFCHK, sizeof(vf_spoofchk),
-                                &vf_spoofchk);
+                        if (nla_put(skb, IFLA_VF_MAC, sizeof(vf_mac), &vf_mac) ||
+                            nla_put(skb, IFLA_VF_VLAN, sizeof(vf_vlan), &vf_vlan) ||
+                            nla_put(skb, IFLA_VF_TX_RATE, sizeof(vf_tx_rate),
+                                    &vf_tx_rate) ||
+                            nla_put(skb, IFLA_VF_SPOOFCHK, sizeof(vf_spoofchk),
+                                    &vf_spoofchk))
+                                goto nla_put_failure;
                         nla_nest_end(skb, vf);
                 }
                 nla_nest_end(skb, vfinfo);
@@ -1114,6 +1120,7 @@ const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_PORT_SELF]        = { .type = NLA_NESTED },
         [IFLA_AF_SPEC]          = { .type = NLA_NESTED },
         [IFLA_EXT_MASK]         = { .type = NLA_U32 },
+        [IFLA_PROMISCUITY]      = { .type = NLA_U32 },
 };
 EXPORT_SYMBOL(ifla_policy);
 
@@ -1133,6 +1140,8 @@ static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = {
                                     .len = sizeof(struct ifla_vf_vlan) },
         [IFLA_VF_TX_RATE]       = { .type = NLA_BINARY,
                                     .len = sizeof(struct ifla_vf_tx_rate) },
+        [IFLA_VF_SPOOFCHK]      = { .type = NLA_BINARY,
+                                    .len = sizeof(struct ifla_vf_spoofchk) },
 };
 
 static const struct nla_policy ifla_port_policy[IFLA_PORT_MAX+1] = {
@@ -1515,11 +1524,9 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
         err = 0;
 
 errout:
-        if (err < 0 && modified && net_ratelimit())
-                printk(KERN_WARNING "A link change request failed with "
-                       "some changes committed already. Interface %s may "
-                       "have been left with an inconsistent configuration, "
-                       "please check.\n", dev->name);
+        if (err < 0 && modified)
+                net_warn_ratelimited("A link change request failed with some changes committed already. Interface %s may have been left with an inconsistent configuration, please check.\n",
+                                     dev->name);
 
         if (send_addr_notify)
                 call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
@@ -1633,14 +1640,14 @@ struct net_device *rtnl_create_link(struct net *src_net, struct net *net,
         int err;
         struct net_device *dev;
         unsigned int num_queues = 1;
-        unsigned int real_num_queues = 1;
 
         if (ops->get_tx_queues) {
-                err = ops->get_tx_queues(src_net, tb, &num_queues,
-                                         &real_num_queues);
-                if (err)
+                err = ops->get_tx_queues(src_net, tb);
+                if (err < 0)
                         goto err;
+                num_queues = err;
         }
+
         err = -ENOMEM;
         dev = alloc_netdev_mq(ops->priv_size, ifname, ops->setup, num_queues);
         if (!dev)
@@ -1946,7 +1953,7 @@ static int rtnl_dump_all(struct sk_buff *skb, struct netlink_callback *cb)
         return skb->len;
 }
 
-void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change)
+void rtmsg_ifinfo(int type, struct net_device *dev, unsigned int change)
 {
         struct net *net = dev_net(dev);
         struct sk_buff *skb;
@@ -1971,6 +1978,267 @@ errout:
                 rtnl_set_sk_err(net, RTNLGRP_LINK, err);
 }
 
+static int nlmsg_populate_fdb_fill(struct sk_buff *skb,
+                                   struct net_device *dev,
+                                   u8 *addr, u32 pid, u32 seq,
+                                   int type, unsigned int flags)
+{
+        struct nlmsghdr *nlh;
+        struct ndmsg *ndm;
+
+        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), NLM_F_MULTI);
+        if (!nlh)
+                return -EMSGSIZE;
+
+        ndm = nlmsg_data(nlh);
+        ndm->ndm_family  = AF_BRIDGE;
+        ndm->ndm_pad1    = 0;
+        ndm->ndm_pad2    = 0;
+        ndm->ndm_flags   = flags;
+        ndm->ndm_type    = 0;
+        ndm->ndm_ifindex = dev->ifindex;
+        ndm->ndm_state   = NUD_PERMANENT;
+
+        if (nla_put(skb, NDA_LLADDR, ETH_ALEN, addr))
+                goto nla_put_failure;
+
+        return nlmsg_end(skb, nlh);
+
+nla_put_failure:
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
+}
+
+static inline size_t rtnl_fdb_nlmsg_size(void)
+{
+        return NLMSG_ALIGN(sizeof(struct ndmsg)) + nla_total_size(ETH_ALEN);
+}
+
+static void rtnl_fdb_notify(struct net_device *dev, u8 *addr, int type)
+{
+        struct net *net = dev_net(dev);
+        struct sk_buff *skb;
+        int err = -ENOBUFS;
+
+        skb = nlmsg_new(rtnl_fdb_nlmsg_size(), GFP_ATOMIC);
+        if (!skb)
+                goto errout;
+
+        err = nlmsg_populate_fdb_fill(skb, dev, addr, 0, 0, type, NTF_SELF);
+        if (err < 0) {
+                kfree_skb(skb);
+                goto errout;
+        }
+
+        rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
+        return;
+errout:
+        rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
+}
+
+static int rtnl_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
+{
+        struct net *net = sock_net(skb->sk);
+        struct net_device *master = NULL;
+        struct ndmsg *ndm;
+        struct nlattr *tb[NDA_MAX+1];
+        struct net_device *dev;
+        u8 *addr;
+        int err;
+
+        err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL);
+        if (err < 0)
+                return err;
+
+        ndm = nlmsg_data(nlh);
+        if (ndm->ndm_ifindex == 0) {
+                pr_info("PF_BRIDGE: RTM_NEWNEIGH with invalid ifindex\n");
+                return -EINVAL;
+        }
+
+        dev = __dev_get_by_index(net, ndm->ndm_ifindex);
+        if (dev == NULL) {
+                pr_info("PF_BRIDGE: RTM_NEWNEIGH with unknown ifindex\n");
+                return -ENODEV;
+        }
+
+        if (!tb[NDA_LLADDR] || nla_len(tb[NDA_LLADDR]) != ETH_ALEN) {
+                pr_info("PF_BRIDGE: RTM_NEWNEIGH with invalid address\n");
+                return -EINVAL;
+        }
+
+        addr = nla_data(tb[NDA_LLADDR]);
+        if (!is_valid_ether_addr(addr)) {
+                pr_info("PF_BRIDGE: RTM_NEWNEIGH with invalid ether address\n");
+                return -EINVAL;
+        }
+
+        err = -EOPNOTSUPP;
+
+        /* Support fdb on master device the net/bridge default case */
+        if ((!ndm->ndm_flags || ndm->ndm_flags & NTF_MASTER) &&
+            (dev->priv_flags & IFF_BRIDGE_PORT)) {
+                master = dev->master;
+                err = master->netdev_ops->ndo_fdb_add(ndm, dev, addr,
+                                                      nlh->nlmsg_flags);
+                if (err)
+                        goto out;
+                else
+                        ndm->ndm_flags &= ~NTF_MASTER;
+        }
+
+        /* Embedded bridge, macvlan, and any other device support */
+        if ((ndm->ndm_flags & NTF_SELF) && dev->netdev_ops->ndo_fdb_add) {
+                err = dev->netdev_ops->ndo_fdb_add(ndm, dev, addr,
+                                                   nlh->nlmsg_flags);
+
+                if (!err) {
+                        rtnl_fdb_notify(dev, addr, RTM_NEWNEIGH);
+                        ndm->ndm_flags &= ~NTF_SELF;
+                }
+        }
+out:
+        return err;
+}
+
+static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
+{
+        struct net *net = sock_net(skb->sk);
+        struct ndmsg *ndm;
+        struct nlattr *llattr;
+        struct net_device *dev;
+        int err = -EINVAL;
+        __u8 *addr;
+
+        if (nlmsg_len(nlh) < sizeof(*ndm))
+                return -EINVAL;
+
+        ndm = nlmsg_data(nlh);
+        if (ndm->ndm_ifindex == 0) {
+                pr_info("PF_BRIDGE: RTM_DELNEIGH with invalid ifindex\n");
+                return -EINVAL;
+        }
+
+        dev = __dev_get_by_index(net, ndm->ndm_ifindex);
+        if (dev == NULL) {
+                pr_info("PF_BRIDGE: RTM_DELNEIGH with unknown ifindex\n");
+                return -ENODEV;
+        }
+
+        llattr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_LLADDR);
+        if (llattr == NULL || nla_len(llattr) != ETH_ALEN) {
+                pr_info("PF_BRIGDE: RTM_DELNEIGH with invalid address\n");
+                return -EINVAL;
+        }
+
+        addr = nla_data(llattr);
+        err = -EOPNOTSUPP;
+
+        /* Support fdb on master device the net/bridge default case */
+        if ((!ndm->ndm_flags || ndm->ndm_flags & NTF_MASTER) &&
+            (dev->priv_flags & IFF_BRIDGE_PORT)) {
+                struct net_device *master = dev->master;
+
+                if (master->netdev_ops->ndo_fdb_del)
+                        err = master->netdev_ops->ndo_fdb_del(ndm, dev, addr);
+
+                if (err)
+                        goto out;
+                else
+                        ndm->ndm_flags &= ~NTF_MASTER;
+        }
+
+        /* Embedded bridge, macvlan, and any other device support */
+        if ((ndm->ndm_flags & NTF_SELF) && dev->netdev_ops->ndo_fdb_del) {
+                err = dev->netdev_ops->ndo_fdb_del(ndm, dev, addr);
+
+                if (!err) {
+                        rtnl_fdb_notify(dev, addr, RTM_DELNEIGH);
+                        ndm->ndm_flags &= ~NTF_SELF;
+                }
+        }
+out:
+        return err;
+}
+
+static int nlmsg_populate_fdb(struct sk_buff *skb,
+                              struct netlink_callback *cb,
+                              struct net_device *dev,
+                              int *idx,
+                              struct netdev_hw_addr_list *list)
+{
+        struct netdev_hw_addr *ha;
+        int err;
+        u32 pid, seq;
+
+        pid = NETLINK_CB(cb->skb).pid;
+        seq = cb->nlh->nlmsg_seq;
+
+        list_for_each_entry(ha, &list->list, list) {
+                if (*idx < cb->args[0])
+                        goto skip;
+
+                err = nlmsg_populate_fdb_fill(skb, dev, ha->addr,
+                                              pid, seq, 0, NTF_SELF);
+                if (err < 0)
+                        return err;
+skip:
+                *idx += 1;
+        }
+        return 0;
+}
+
+/**
+ * ndo_dflt_fdb_dump: default netdevice operation to dump an FDB table.
+ * @nlh: netlink message header
+ * @dev: netdevice
+ *
+ * Default netdevice operation to dump the existing unicast address list.
+ * Returns zero on success.
+ */
+int ndo_dflt_fdb_dump(struct sk_buff *skb,
+                      struct netlink_callback *cb,
+                      struct net_device *dev,
+                      int idx)
+{
+        int err;
+
+        netif_addr_lock_bh(dev);
+        err = nlmsg_populate_fdb(skb, cb, dev, &idx, &dev->uc);
+        if (err)
+                goto out;
+        nlmsg_populate_fdb(skb, cb, dev, &idx, &dev->mc);
+out:
+        netif_addr_unlock_bh(dev);
+        return idx;
+}
+EXPORT_SYMBOL(ndo_dflt_fdb_dump);
+
+static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        int idx = 0;
+        struct net *net = sock_net(skb->sk);
+        struct net_device *dev;
+
+        rcu_read_lock();
+        for_each_netdev_rcu(net, dev) {
+                if (dev->priv_flags & IFF_BRIDGE_PORT) {
+                        struct net_device *master = dev->master;
+                        const struct net_device_ops *ops = master->netdev_ops;
+
+                        if (ops->ndo_fdb_dump)
+                                idx = ops->ndo_fdb_dump(skb, cb, dev, idx);
+                }
+
+                if (dev->netdev_ops->ndo_fdb_dump)
+                        idx = dev->netdev_ops->ndo_fdb_dump(skb, cb, dev, idx);
+        }
+        rcu_read_unlock();
+
+        cb->args[0] = idx;
+        return skb->len;
+}
+
 /* Protected by RTNL sempahore.  */
 static struct rtattr **rta_buf;
 static int rtattr_max;
@@ -2019,8 +2287,13 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 
                 __rtnl_unlock();
                 rtnl = net->rtnl;
-                err = netlink_dump_start(rtnl, skb, nlh, dumpit,
-                                         NULL, min_dump_alloc);
+                {
+                        struct netlink_dump_control c = {
+                                .dump           = dumpit,
+                                .min_dump_alloc = min_dump_alloc,
+                        };
+                        err = netlink_dump_start(rtnl, skb, nlh, &c);
+                }
                 rtnl_lock();
                 return err;
         }
@@ -2036,7 +2309,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 struct rtattr *attr = (void *)nlh + NLMSG_ALIGN(min_len);
 
                 while (RTA_OK(attr, attrlen)) {
-                        unsigned flavor = attr->rta_type;
+                        unsigned int flavor = attr->rta_type;
                         if (flavor) {
                                 if (flavor > rta_max[sz_idx])
                                         return -EINVAL;
@@ -2138,5 +2411,9 @@ void __init rtnetlink_init(void)
 
         rtnl_register(PF_UNSPEC, RTM_GETADDR, NULL, rtnl_dump_all, NULL);
         rtnl_register(PF_UNSPEC, RTM_GETROUTE, NULL, rtnl_dump_all, NULL);
+
+        rtnl_register(PF_BRIDGE, RTM_NEWNEIGH, rtnl_fdb_add, NULL, NULL);
+        rtnl_register(PF_BRIDGE, RTM_DELNEIGH, rtnl_fdb_del, NULL, NULL);
+        rtnl_register(PF_BRIDGE, RTM_GETNEIGH, NULL, rtnl_fdb_dump, NULL);
 }
 
diff --git a/net/core/scm.c b/net/core/scm.c
index ff52ad0a5150..611c5efd4cb0 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -28,7 +28,6 @@
 #include <linux/nsproxy.h>
 #include <linux/slab.h>
 
-#include <asm/system.h>
 #include <asm/uaccess.h>
 
 #include <net/protocol.h>
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index da0c97f2fab4..016694d62484 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -36,6 +36,8 @@
  *      The functions in this file will not compile correctly with gcc 2.4.x
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
@@ -66,12 +68,10 @@
 #include <net/xfrm.h>
 
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <trace/events/skb.h>
+#include <linux/highmem.h>
 
-#include "kmap_skb.h"
-
-static struct kmem_cache *skbuff_head_cache __read_mostly;
+struct kmem_cache *skbuff_head_cache __read_mostly;
 static struct kmem_cache *skbuff_fclone_cache __read_mostly;
 
 static void sock_pipe_buf_release(struct pipe_inode_info *pipe,
@@ -120,11 +120,10 @@ static const struct pipe_buf_operations sock_pipe_buf_ops = {
  */
 static void skb_over_panic(struct sk_buff *skb, int sz, void *here)
 {
-        printk(KERN_EMERG "skb_over_panic: text:%p len:%d put:%d head:%p "
-                          "data:%p tail:%#lx end:%#lx dev:%s\n",
-               here, skb->len, sz, skb->head, skb->data,
-               (unsigned long)skb->tail, (unsigned long)skb->end,
-               skb->dev ? skb->dev->name : "<NULL>");
+        pr_emerg("%s: text:%p len:%d put:%d head:%p data:%p tail:%#lx end:%#lx dev:%s\n",
+                 __func__, here, skb->len, sz, skb->head, skb->data,
+                 (unsigned long)skb->tail, (unsigned long)skb->end,
+                 skb->dev ? skb->dev->name : "<NULL>");
         BUG();
 }
 
@@ -139,11 +138,10 @@ static void skb_over_panic(struct sk_buff *skb, int sz, void *here)
 
 static void skb_under_panic(struct sk_buff *skb, int sz, void *here)
 {
-        printk(KERN_EMERG "skb_under_panic: text:%p len:%d put:%d head:%p "
-                          "data:%p tail:%#lx end:%#lx dev:%s\n",
-               here, skb->len, sz, skb->head, skb->data,
-               (unsigned long)skb->tail, (unsigned long)skb->end,
-               skb->dev ? skb->dev->name : "<NULL>");
+        pr_emerg("%s: text:%p len:%d put:%d head:%p data:%p tail:%#lx end:%#lx dev:%s\n",
+                 __func__, here, skb->len, sz, skb->head, skb->data,
+                 (unsigned long)skb->tail, (unsigned long)skb->end,
+                 skb->dev ? skb->dev->name : "<NULL>");
         BUG();
 }
 
@@ -247,6 +245,7 @@ EXPORT_SYMBOL(__alloc_skb);
 /**
  * build_skb - build a network buffer
  * @data: data buffer provided by caller
+ * @frag_size: size of fragment, or 0 if head was kmalloced
  *
  * Allocate a new &sk_buff. Caller provides space holding head and
  * skb_shared_info. @data must have been allocated by kmalloc()
@@ -260,20 +259,21 @@ EXPORT_SYMBOL(__alloc_skb);
  *  before giving packet to stack.
  *  RX rings only contains data buffers, not full skbs.
  */
-struct sk_buff *build_skb(void *data)
+struct sk_buff *build_skb(void *data, unsigned int frag_size)
 {
         struct skb_shared_info *shinfo;
         struct sk_buff *skb;
-        unsigned int size;
+        unsigned int size = frag_size ? : ksize(data);
 
         skb = kmem_cache_alloc(skbuff_head_cache, GFP_ATOMIC);
         if (!skb)
                 return NULL;
 
-        size = ksize(data) - SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+        size -= SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
 
         memset(skb, 0, offsetof(struct sk_buff, tail));
         skb->truesize = SKB_TRUESIZE(size);
+        skb->head_frag = frag_size != 0;
         atomic_set(&skb->users, 1);
         skb->head = data;
         skb->data = data;
@@ -293,6 +293,46 @@ struct sk_buff *build_skb(void *data)
 }
 EXPORT_SYMBOL(build_skb);
 
+struct netdev_alloc_cache {
+        struct page *page;
+        unsigned int offset;
+};
+static DEFINE_PER_CPU(struct netdev_alloc_cache, netdev_alloc_cache);
+
+/**
+ * netdev_alloc_frag - allocate a page fragment
+ * @fragsz: fragment size
+ *
+ * Allocates a frag from a page for receive buffer.
+ * Uses GFP_ATOMIC allocations.
+ */
+void *netdev_alloc_frag(unsigned int fragsz)
+{
+        struct netdev_alloc_cache *nc;
+        void *data = NULL;
+        unsigned long flags;
+
+        local_irq_save(flags);
+        nc = &__get_cpu_var(netdev_alloc_cache);
+        if (unlikely(!nc->page)) {
+refill:
+                nc->page = alloc_page(GFP_ATOMIC | __GFP_COLD);
+                nc->offset = 0;
+        }
+        if (likely(nc->page)) {
+                if (nc->offset + fragsz > PAGE_SIZE) {
+                        put_page(nc->page);
+                        goto refill;
+                }
+                data = page_address(nc->page) + nc->offset;
+                nc->offset += fragsz;
+                get_page(nc->page);
+        }
+        local_irq_restore(flags);
+        return data;
+}
+EXPORT_SYMBOL(netdev_alloc_frag);
+
 /**
  *      __netdev_alloc_skb - allocate an skbuff for rx on a specific device
  *      @dev: network device to receive on
@@ -307,11 +347,23 @@ EXPORT_SYMBOL(build_skb);
  *      %NULL is returned if there is no free memory.
  */
 struct sk_buff *__netdev_alloc_skb(struct net_device *dev,
-                unsigned int length, gfp_t gfp_mask)
+                                   unsigned int length, gfp_t gfp_mask)
 {
-        struct sk_buff *skb;
+        struct sk_buff *skb = NULL;
+        unsigned int fragsz = SKB_DATA_ALIGN(length + NET_SKB_PAD) +
+                              SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+
+        if (fragsz <= PAGE_SIZE && !(gfp_mask & __GFP_WAIT)) {
+                void *data = netdev_alloc_frag(fragsz);
 
-        skb = __alloc_skb(length + NET_SKB_PAD, gfp_mask, 0, NUMA_NO_NODE);
+                if (likely(data)) {
+                        skb = build_skb(data, fragsz);
+                        if (unlikely(!skb))
+                                put_page(virt_to_head_page(data));
+                }
+        } else {
+                skb = __alloc_skb(length + NET_SKB_PAD, gfp_mask, 0, NUMA_NO_NODE);
+        }
         if (likely(skb)) {
                 skb_reserve(skb, NET_SKB_PAD);
                 skb->dev = dev;
@@ -321,37 +373,15 @@ struct sk_buff *__netdev_alloc_skb(struct net_device *dev,
 EXPORT_SYMBOL(__netdev_alloc_skb);
 
 void skb_add_rx_frag(struct sk_buff *skb, int i, struct page *page, int off,
-                int size)
+                     int size, unsigned int truesize)
 {
         skb_fill_page_desc(skb, i, page, off, size);
         skb->len += size;
         skb->data_len += size;
-        skb->truesize += size;
+        skb->truesize += truesize;
 }
 EXPORT_SYMBOL(skb_add_rx_frag);
 
-/**
- *      dev_alloc_skb - allocate an skbuff for receiving
- *      @length: length to allocate
- *
- *      Allocate a new &sk_buff and assign it a usage count of one. The
- *      buffer has unspecified headroom built in. Users should allocate
- *      the headroom they think they need without accounting for the
- *      built in space. The built in space is used for optimisations.
- *
- *      %NULL is returned if there is no free memory. Although this function
- *      allocates memory it can be called from an interrupt.
- */
-struct sk_buff *dev_alloc_skb(unsigned int length)
-{
-        /*
-         * There is more code here than it seems:
-         * __dev_alloc_skb is an inline
-         */
-        return __dev_alloc_skb(length, GFP_ATOMIC);
-}
-EXPORT_SYMBOL(dev_alloc_skb);
-
 static void skb_drop_list(struct sk_buff **listp)
 {
         struct sk_buff *list = *listp;
@@ -378,6 +408,14 @@ static void skb_clone_fraglist(struct sk_buff *skb)
                 skb_get(list);
 }
 
+static void skb_free_head(struct sk_buff *skb)
+{
+        if (skb->head_frag)
+                put_page(virt_to_head_page(skb->head));
+        else
+                kfree(skb->head);
+}
+
 static void skb_release_data(struct sk_buff *skb)
 {
         if (!skb->cloned ||
@@ -404,7 +442,7 @@ static void skb_release_data(struct sk_buff *skb)
                 if (skb_has_frag_list(skb))
                         skb_drop_fraglist(skb);
 
-                kfree(skb->head);
+                skb_free_head(skb);
         }
 }
 
@@ -592,6 +630,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         new->rxhash             = old->rxhash;
         new->ooo_okay           = old->ooo_okay;
         new->l4_rxhash          = old->l4_rxhash;
+        new->no_fcs             = old->no_fcs;
 #ifdef CONFIG_XFRM
         new->sp                 = secpath_get(old->sp);
 #endif
@@ -645,6 +684,7 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
         C(tail);
         C(end);
         C(head);
+        C(head_frag);
         C(data);
         C(truesize);
         atomic_set(&n->users, 1);
@@ -707,10 +747,10 @@ int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
                         }
                         return -ENOMEM;
                 }
-                vaddr = kmap_skb_frag(&skb_shinfo(skb)->frags[i]);
+                vaddr = kmap_atomic(skb_frag_page(f));
                 memcpy(page_address(page),
                        vaddr + f->page_offset, skb_frag_size(f));
-                kunmap_skb_frag(vaddr);
+                kunmap_atomic(vaddr);
                 page->private = (unsigned long)head;
                 head = page;
         }
@@ -819,7 +859,7 @@ static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 struct sk_buff *skb_copy(const struct sk_buff *skb, gfp_t gfp_mask)
 {
         int headerlen = skb_headroom(skb);
-        unsigned int size = (skb_end_pointer(skb) - skb->head) + skb->data_len;
+        unsigned int size = skb_end_offset(skb) + skb->data_len;
         struct sk_buff *n = alloc_skb(size, gfp_mask);
 
         if (!n)
@@ -920,9 +960,8 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 {
         int i;
         u8 *data;
-        int size = nhead + (skb_end_pointer(skb) - skb->head) + ntail;
+        int size = nhead + skb_end_offset(skb) + ntail;
         long off;
-        bool fastpath;
 
         BUG_ON(nhead < 0);
 
@@ -931,30 +970,11 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 
         size = SKB_DATA_ALIGN(size);
 
-        /* Check if we can avoid taking references on fragments if we own
-         * the last reference on skb->head. (see skb_release_data())
-         */
-        if (!skb->cloned)
-                fastpath = true;
-        else {
-                int delta = skb->nohdr ? (1 << SKB_DATAREF_SHIFT) + 1 : 1;
-                fastpath = atomic_read(&skb_shinfo(skb)->dataref) == delta;
-        }
-
-        if (fastpath &&
-            size + sizeof(struct skb_shared_info) <= ksize(skb->head)) {
-                memmove(skb->head + size, skb_shinfo(skb),
-                        offsetof(struct skb_shared_info,
-                                 frags[skb_shinfo(skb)->nr_frags]));
-                memmove(skb->head + nhead, skb->head,
-                        skb_tail_pointer(skb) - skb->head);
-                off = nhead;
-                goto adjust_others;
-        }
-
-        data = kmalloc(size + sizeof(struct skb_shared_info), gfp_mask);
+        data = kmalloc(size + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)),
+                       gfp_mask);
         if (!data)
                 goto nodata;
+        size = SKB_WITH_OVERHEAD(ksize(data));
 
         /* Copy only real data... and, alas, header. This should be
          * optimized for the cases when header is void.
@@ -965,9 +985,12 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
                skb_shinfo(skb),
                offsetof(struct skb_shared_info, frags[skb_shinfo(skb)->nr_frags]));
 
-        if (fastpath) {
-                kfree(skb->head);
-        } else {
+        /*
+         * if shinfo is shared we must drop the old head gracefully, but if it
+         * is not we can just drop the old head and let the existing refcount
+         * be since all we did is relocate the values
+         */
+        if (skb_cloned(skb)) {
                 /* copy this zero copy skb frags */
                 if (skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY) {
                         if (skb_copy_ubufs(skb, gfp_mask))
@@ -980,11 +1003,13 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
                         skb_clone_fraglist(skb);
 
                 skb_release_data(skb);
+        } else {
+                skb_free_head(skb);
         }
         off = (data + nhead) - skb->head;
 
         skb->head     = data;
-adjust_others:
+        skb->head_frag = 0;
         skb->data    += off;
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
         skb->end      = size;
@@ -1273,7 +1298,7 @@ drop_pages:
                                 return -ENOMEM;
 
                         nfrag->next = frag->next;
-                        kfree_skb(frag);
+                        consume_skb(frag);
                         frag = nfrag;
                         *fragp = frag;
                 }
@@ -1485,21 +1510,22 @@ int skb_copy_bits(const struct sk_buff *skb, int offset, void *to, int len)
 
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
+                skb_frag_t *f = &skb_shinfo(skb)->frags[i];
 
                 WARN_ON(start > offset + len);
 
-                end = start + skb_frag_size(&skb_shinfo(skb)->frags[i]);
+                end = start + skb_frag_size(f);
                 if ((copy = end - offset) > 0) {
                         u8 *vaddr;
 
                         if (copy > len)
                                 copy = len;
 
-                        vaddr = kmap_skb_frag(&skb_shinfo(skb)->frags[i]);
+                        vaddr = kmap_atomic(skb_frag_page(f));
                         memcpy(to,
-                               vaddr + skb_shinfo(skb)->frags[i].page_offset+
-                               offset - start, copy);
-                        kunmap_skb_frag(vaddr);
+                               vaddr + f->page_offset + offset - start,
+                               copy);
+                        kunmap_atomic(vaddr);
 
                         if ((len -= copy) == 0)
                                 return 0;
@@ -1545,9 +1571,9 @@ static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i)
         put_page(spd->pages[i]);
 }
 
-static inline struct page *linear_to_page(struct page *page, unsigned int *len,
-                                          unsigned int *offset,
-                                          struct sk_buff *skb, struct sock *sk)
+static struct page *linear_to_page(struct page *page, unsigned int *len,
+                                   unsigned int *offset,
+                                   struct sk_buff *skb, struct sock *sk)
 {
         struct page *p = sk->sk_sndmsg_page;
         unsigned int off;
@@ -1563,6 +1589,9 @@ new_page:
         } else {
                 unsigned int mlen;
 
+                /* If we are the only user of the page, we can reset offset */
+                if (page_count(p) == 1)
+                        sk->sk_sndmsg_off = 0;
                 off = sk->sk_sndmsg_off;
                 mlen = PAGE_SIZE - off;
                 if (mlen < 64 && mlen < *len) {
@@ -1576,36 +1605,48 @@ new_page:
         memcpy(page_address(p) + off, page_address(page) + *offset, *len);
         sk->sk_sndmsg_off += *len;
         *offset = off;
-        get_page(p);
 
         return p;
 }
 
+static bool spd_can_coalesce(const struct splice_pipe_desc *spd,
+                             struct page *page,
+                             unsigned int offset)
+{
+        return  spd->nr_pages &&
+                spd->pages[spd->nr_pages - 1] == page &&
+                (spd->partial[spd->nr_pages - 1].offset +
+                 spd->partial[spd->nr_pages - 1].len == offset);
+}
+
 /*
  * Fill page/offset/length into spd, if it can hold more pages.
  */
-static inline int spd_fill_page(struct splice_pipe_desc *spd,
-                                struct pipe_inode_info *pipe, struct page *page,
-                                unsigned int *len, unsigned int offset,
-                                struct sk_buff *skb, int linear,
-                                struct sock *sk)
+static bool spd_fill_page(struct splice_pipe_desc *spd,
+                          struct pipe_inode_info *pipe, struct page *page,
+                          unsigned int *len, unsigned int offset,
+                          struct sk_buff *skb, bool linear,
+                          struct sock *sk)
 {
-        if (unlikely(spd->nr_pages == pipe->buffers))
-                return 1;
+        if (unlikely(spd->nr_pages == MAX_SKB_FRAGS))
+                return true;
 
         if (linear) {
                 page = linear_to_page(page, len, &offset, skb, sk);
                 if (!page)
-                        return 1;
-        } else
-                get_page(page);
-
+                        return true;
+        }
+        if (spd_can_coalesce(spd, page, offset)) {
+                spd->partial[spd->nr_pages - 1].len += *len;
+                return false;
+        }
+        get_page(page);
         spd->pages[spd->nr_pages] = page;
         spd->partial[spd->nr_pages].len = *len;
         spd->partial[spd->nr_pages].offset = offset;
         spd->nr_pages++;
 
-        return 0;
+        return false;
 }
 
 static inline void __segment_seek(struct page **page, unsigned int *poff,
@@ -1622,20 +1663,20 @@ static inline void __segment_seek(struct page **page, unsigned int *poff,
         *plen -= off;
 }
 
-static inline int __splice_segment(struct page *page, unsigned int poff,
-                                   unsigned int plen, unsigned int *off,
-                                   unsigned int *len, struct sk_buff *skb,
-                                   struct splice_pipe_desc *spd, int linear,
-                                   struct sock *sk,
-                                   struct pipe_inode_info *pipe)
+static bool __splice_segment(struct page *page, unsigned int poff,
+                             unsigned int plen, unsigned int *off,
+                             unsigned int *len, struct sk_buff *skb,
+                             struct splice_pipe_desc *spd, bool linear,
+                             struct sock *sk,
+                             struct pipe_inode_info *pipe)
 {
         if (!*len)
-                return 1;
+                return true;
 
         /* skip this segment if already processed */
         if (*off >= plen) {
                 *off -= plen;
-                return 0;
+                return false;
         }
 
         /* ignore any bits we already processed */
@@ -1651,34 +1692,38 @@ static inline int __splice_segment(struct page *page, unsigned int poff,
                 flen = min_t(unsigned int, flen, PAGE_SIZE - poff);
 
                 if (spd_fill_page(spd, pipe, page, &flen, poff, skb, linear, sk))
-                        return 1;
+                        return true;
 
                 __segment_seek(&page, &poff, &plen, flen);
                 *len -= flen;
 
         } while (*len && plen);
 
-        return 0;
+        return false;
 }
 
 /*
- * Map linear and fragment data from the skb to spd. It reports failure if the
+ * Map linear and fragment data from the skb to spd. It reports true if the
  * pipe is full or if we already spliced the requested length.
  */
-static int __skb_splice_bits(struct sk_buff *skb, struct pipe_inode_info *pipe,
-                             unsigned int *offset, unsigned int *len,
-                             struct splice_pipe_desc *spd, struct sock *sk)
+static bool __skb_splice_bits(struct sk_buff *skb, struct pipe_inode_info *pipe,
+                              unsigned int *offset, unsigned int *len,
+                              struct splice_pipe_desc *spd, struct sock *sk)
 {
         int seg;
 
-        /*
-         * map the linear part
+        /* map the linear part :
+         * If skb->head_frag is set, this 'linear' part is backed by a
+         * fragment, and if the head is not shared with any clones then
+         * we can avoid a copy since we own the head portion of this page.
          */
         if (__splice_segment(virt_to_page(skb->data),
                              (unsigned long) skb->data & (PAGE_SIZE - 1),
                              skb_headlen(skb),
-                             offset, len, skb, spd, 1, sk, pipe))
-                return 1;
+                             offset, len, skb, spd,
+                             skb_head_is_locked(skb),
+                             sk, pipe))
+                return true;
 
         /*
          * then map the fragments
@@ -1688,11 +1733,11 @@ static int __skb_splice_bits(struct sk_buff *skb, struct pipe_inode_info *pipe,
 
                 if (__splice_segment(skb_frag_page(f),
                                      f->page_offset, skb_frag_size(f),
-                                     offset, len, skb, spd, 0, sk, pipe))
-                        return 1;
+                                     offset, len, skb, spd, false, sk, pipe))
+                        return true;
         }
 
-        return 0;
+        return false;
 }
 
 /*
@@ -1705,8 +1750,8 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
                     struct pipe_inode_info *pipe, unsigned int tlen,
                     unsigned int flags)
 {
-        struct partial_page partial[PIPE_DEF_BUFFERS];
-        struct page *pages[PIPE_DEF_BUFFERS];
+        struct partial_page partial[MAX_SKB_FRAGS];
+        struct page *pages[MAX_SKB_FRAGS];
         struct splice_pipe_desc spd = {
                 .pages = pages,
                 .partial = partial,
@@ -1718,9 +1763,6 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
         struct sock *sk = skb->sk;
         int ret = 0;
 
-        if (splice_grow_spd(pipe, &spd))
-                return -ENOMEM;
-
         /*
          * __skb_splice_bits() only fails if the output has no room left,
          * so no point in going over the frag_list for the error case.
@@ -1756,7 +1798,6 @@ done:
                 lock_sock(sk);
         }
 
-        splice_shrink_spd(pipe, &spd);
         return ret;
 }
 
@@ -1804,10 +1845,10 @@ int skb_store_bits(struct sk_buff *skb, int offset, const void *from, int len)
                         if (copy > len)
                                 copy = len;
 
-                        vaddr = kmap_skb_frag(frag);
+                        vaddr = kmap_atomic(skb_frag_page(frag));
                         memcpy(vaddr + frag->page_offset + offset - start,
                                from, copy);
-                        kunmap_skb_frag(vaddr);
+                        kunmap_atomic(vaddr);
 
                         if ((len -= copy) == 0)
                                 return 0;
@@ -1867,21 +1908,21 @@ __wsum skb_checksum(const struct sk_buff *skb, int offset,
 
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
+                skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
 
                 WARN_ON(start > offset + len);
 
-                end = start + skb_frag_size(&skb_shinfo(skb)->frags[i]);
+                end = start + skb_frag_size(frag);
                 if ((copy = end - offset) > 0) {
                         __wsum csum2;
                         u8 *vaddr;
-                        skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
 
                         if (copy > len)
                                 copy = len;
-                        vaddr = kmap_skb_frag(frag);
+                        vaddr = kmap_atomic(skb_frag_page(frag));
                         csum2 = csum_partial(vaddr + frag->page_offset +
                                              offset - start, copy, 0);
-                        kunmap_skb_frag(vaddr);
+                        kunmap_atomic(vaddr);
                         csum = csum_block_add(csum, csum2, pos);
                         if (!(len -= copy))
                                 return csum;
@@ -1953,12 +1994,12 @@ __wsum skb_copy_and_csum_bits(const struct sk_buff *skb, int offset,
 
                         if (copy > len)
                                 copy = len;
-                        vaddr = kmap_skb_frag(frag);
+                        vaddr = kmap_atomic(skb_frag_page(frag));
                         csum2 = csum_partial_copy_nocheck(vaddr +
                                                           frag->page_offset +
                                                           offset - start, to,
                                                           copy, 0);
-                        kunmap_skb_frag(vaddr);
+                        kunmap_atomic(vaddr);
                         csum = csum_block_add(csum, csum2, pos);
                         if (!(len -= copy))
                                 return csum;
@@ -2478,7 +2519,7 @@ next_skb:
 
                 if (abs_offset < block_limit) {
                         if (!st->frag_data)
-                                st->frag_data = kmap_skb_frag(frag);
+                                st->frag_data = kmap_atomic(skb_frag_page(frag));
 
                         *data = (u8 *) st->frag_data + frag->page_offset +
                                 (abs_offset - st->stepped_offset);
@@ -2487,7 +2528,7 @@ next_skb:
                 }
 
                 if (st->frag_data) {
-                        kunmap_skb_frag(st->frag_data);
+                        kunmap_atomic(st->frag_data);
                         st->frag_data = NULL;
                 }
 
@@ -2496,7 +2537,7 @@ next_skb:
         }
 
         if (st->frag_data) {
-                kunmap_skb_frag(st->frag_data);
+                kunmap_atomic(st->frag_data);
                 st->frag_data = NULL;
         }
 
@@ -2524,7 +2565,7 @@ EXPORT_SYMBOL(skb_seq_read);
 void skb_abort_seq_read(struct skb_seq_state *st)
 {
         if (st->frag_data)
-                kunmap_skb_frag(st->frag_data);
+                kunmap_atomic(st->frag_data);
 }
 EXPORT_SYMBOL(skb_abort_seq_read);
 
@@ -2716,14 +2757,13 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                         if (unlikely(!nskb))
                                 goto err;
 
-                        hsize = skb_end_pointer(nskb) - nskb->head;
+                        hsize = skb_end_offset(nskb);
                         if (skb_cow_head(nskb, doffset + headroom)) {
                                 kfree_skb(nskb);
                                 goto err;
                         }
 
-                        nskb->truesize += skb_end_pointer(nskb) - nskb->head -
-                                          hsize;
+                        nskb->truesize += skb_end_offset(nskb) - hsize;
                         skb_release_head_state(nskb);
                         __skb_push(nskb, doffset);
                 } else {
@@ -2841,6 +2881,7 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         unsigned int len = skb_gro_len(skb);
         unsigned int offset = skb_gro_offset(skb);
         unsigned int headlen = skb_headlen(skb);
+        unsigned int delta_truesize;
 
         if (p->len + len >= 65536)
                 return -E2BIG;
@@ -2870,11 +2911,41 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
                 frag->page_offset += offset;
                 skb_frag_size_sub(frag, offset);
 
+                /* all fragments truesize : remove (head size + sk_buff) */
+                delta_truesize = skb->truesize -
+                                 SKB_TRUESIZE(skb_end_offset(skb));
+
                 skb->truesize -= skb->data_len;
                 skb->len -= skb->data_len;
                 skb->data_len = 0;
 
-                NAPI_GRO_CB(skb)->free = 1;
+                NAPI_GRO_CB(skb)->free = NAPI_GRO_FREE;
+                goto done;
+        } else if (skb->head_frag) {
+                int nr_frags = pinfo->nr_frags;
+                skb_frag_t *frag = pinfo->frags + nr_frags;
+                struct page *page = virt_to_head_page(skb->head);
+                unsigned int first_size = headlen - offset;
+                unsigned int first_offset;
+
+                if (nr_frags + 1 + skbinfo->nr_frags > MAX_SKB_FRAGS)
+                        return -E2BIG;
+
+                first_offset = skb->data -
+                               (unsigned char *)page_address(page) +
+                               offset;
+
+                pinfo->nr_frags = nr_frags + 1 + skbinfo->nr_frags;
+
+                frag->page.p      = page;
+                frag->page_offset = first_offset;
+                skb_frag_size_set(frag, first_size);
+
+                memcpy(frag + 1, skbinfo->frags, sizeof(*frag) * skbinfo->nr_frags);
+                /* We dont need to clear skbinfo->nr_frags here */
+
+                delta_truesize = skb->truesize - SKB_DATA_ALIGN(sizeof(struct sk_buff));
+                NAPI_GRO_CB(skb)->free = NAPI_GRO_FREE_STOLEN_HEAD;
                 goto done;
         } else if (skb_gro_len(p) != pinfo->gso_size)
                 return -E2BIG;
@@ -2906,7 +2977,7 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         nskb->prev = p;
 
         nskb->data_len += p->len;
-        nskb->truesize += p->len;
+        nskb->truesize += p->truesize;
         nskb->len += p->len;
 
         *head = nskb;
@@ -2916,6 +2987,7 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         p = nskb;
 
 merge:
+        delta_truesize = skb->truesize;
         if (offset > headlen) {
                 unsigned int eat = offset - headlen;
 
@@ -2935,7 +3007,7 @@ merge:
 done:
         NAPI_GRO_CB(p)->count++;
         p->data_len += len;
-        p->truesize += len;
+        p->truesize += delta_truesize;
         p->len += len;
 
         NAPI_GRO_CB(skb)->same_flow = 1;
@@ -3160,8 +3232,10 @@ static void sock_rmem_free(struct sk_buff *skb)
  */
 int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
 {
+        int len = skb->len;
+
         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
-            (unsigned)sk->sk_rcvbuf)
+            (unsigned int)sk->sk_rcvbuf)
                 return -ENOMEM;
 
         skb_orphan(skb);
@@ -3174,7 +3248,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
 
         skb_queue_tail(&sk->sk_error_queue, skb);
         if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk, skb->len);
+                sk->sk_data_ready(sk, len);
         return 0;
 }
 EXPORT_SYMBOL(sock_queue_err_skb);
@@ -3255,10 +3329,8 @@ bool skb_partial_csum_set(struct sk_buff *skb, u16 start, u16 off)
 {
         if (unlikely(start > skb_headlen(skb)) ||
             unlikely((int)start + off > skb_headlen(skb) - 2)) {
-                if (net_ratelimit())
-                        printk(KERN_WARNING
-                               "bad partial csum: csum=%u/%u len=%u\n",
-                               start, off, skb_headlen(skb));
+                net_warn_ratelimited("bad partial csum: csum=%u/%u len=%u\n",
+                                     start, off, skb_headlen(skb));
                 return false;
         }
         skb->ip_summed = CHECKSUM_PARTIAL;
@@ -3270,8 +3342,93 @@ EXPORT_SYMBOL_GPL(skb_partial_csum_set);
 
 void __skb_warn_lro_forwarding(const struct sk_buff *skb)
 {
-        if (net_ratelimit())
-                pr_warning("%s: received packets cannot be forwarded"
-                           " while LRO is enabled\n", skb->dev->name);
+        net_warn_ratelimited("%s: received packets cannot be forwarded while LRO is enabled\n",
+                             skb->dev->name);
 }
 EXPORT_SYMBOL(__skb_warn_lro_forwarding);
+
+void kfree_skb_partial(struct sk_buff *skb, bool head_stolen)
+{
+        if (head_stolen)
+                kmem_cache_free(skbuff_head_cache, skb);
+        else
+                __kfree_skb(skb);
+}
+EXPORT_SYMBOL(kfree_skb_partial);
+
+/**
+ * skb_try_coalesce - try to merge skb to prior one
+ * @to: prior buffer
+ * @from: buffer to add
+ * @fragstolen: pointer to boolean
+ *
+ */
+bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
+                      bool *fragstolen, int *delta_truesize)
+{
+        int i, delta, len = from->len;
+
+        *fragstolen = false;
+
+        if (skb_cloned(to))
+                return false;
+
+        if (len <= skb_tailroom(to)) {
+                BUG_ON(skb_copy_bits(from, 0, skb_put(to, len), len));
+                *delta_truesize = 0;
+                return true;
+        }
+
+        if (skb_has_frag_list(to) || skb_has_frag_list(from))
+                return false;
+
+        if (skb_headlen(from) != 0) {
+                struct page *page;
+                unsigned int offset;
+
+                if (skb_shinfo(to)->nr_frags +
+                    skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS)
+                        return false;
+
+                if (skb_head_is_locked(from))
+                        return false;
+
+                delta = from->truesize - SKB_DATA_ALIGN(sizeof(struct sk_buff));
+
+                page = virt_to_head_page(from->head);
+                offset = from->data - (unsigned char *)page_address(page);
+
+                skb_fill_page_desc(to, skb_shinfo(to)->nr_frags,
+                                   page, offset, skb_headlen(from));
+                *fragstolen = true;
+        } else {
+                if (skb_shinfo(to)->nr_frags +
+                    skb_shinfo(from)->nr_frags > MAX_SKB_FRAGS)
+                        return false;
+
+                delta = from->truesize -
+                        SKB_TRUESIZE(skb_end_pointer(from) - from->head);
+        }
+
+        WARN_ON_ONCE(delta < len);
+
+        memcpy(skb_shinfo(to)->frags + skb_shinfo(to)->nr_frags,
+               skb_shinfo(from)->frags,
+               skb_shinfo(from)->nr_frags * sizeof(skb_frag_t));
+        skb_shinfo(to)->nr_frags += skb_shinfo(from)->nr_frags;
+
+        if (!skb_cloned(from))
+                skb_shinfo(from)->nr_frags = 0;
+
+        /* if the skb is cloned this does nothing since we set nr_frags to 0 */
+        for (i = 0; i < skb_shinfo(from)->nr_frags; i++)
+                skb_frag_ref(from, i);
+
+        to->truesize += delta;
+        to->len += len;
+        to->data_len += len;
+
+        *delta_truesize = delta;
+        return true;
+}
+EXPORT_SYMBOL(skb_try_coalesce);
diff --git a/net/core/sock.c b/net/core/sock.c
index 02f8dfe320b7..9e5b71fda6ec 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -89,6 +89,8 @@
  *              2 of the License, or (at your option) any later version.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/capability.h>
 #include <linux/errno.h>
 #include <linux/types.h>
@@ -111,11 +113,11 @@
 #include <linux/init.h>
 #include <linux/highmem.h>
 #include <linux/user_namespace.h>
-#include <linux/jump_label.h>
+#include <linux/static_key.h>
 #include <linux/memcontrol.h>
+#include <linux/prefetch.h>
 
 #include <asm/uaccess.h>
-#include <asm/system.h>
 
 #include <linux/netdevice.h>
 #include <net/protocol.h>
@@ -141,7 +143,7 @@ static DEFINE_MUTEX(proto_list_mutex);
 static LIST_HEAD(proto_list);
 
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR_KMEM
-int mem_cgroup_sockets_init(struct cgroup *cgrp, struct cgroup_subsys *ss)
+int mem_cgroup_sockets_init(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
 {
         struct proto *proto;
         int ret = 0;
@@ -149,7 +151,7 @@ int mem_cgroup_sockets_init(struct cgroup *cgrp, struct cgroup_subsys *ss)
         mutex_lock(&proto_list_mutex);
         list_for_each_entry(proto, &proto_list, node) {
                 if (proto->init_cgroup) {
-                        ret = proto->init_cgroup(cgrp, ss);
+                        ret = proto->init_cgroup(memcg, ss);
                         if (ret)
                                 goto out;
                 }
@@ -160,19 +162,19 @@ int mem_cgroup_sockets_init(struct cgroup *cgrp, struct cgroup_subsys *ss)
 out:
         list_for_each_entry_continue_reverse(proto, &proto_list, node)
                 if (proto->destroy_cgroup)
-                        proto->destroy_cgroup(cgrp, ss);
+                        proto->destroy_cgroup(memcg);
         mutex_unlock(&proto_list_mutex);
         return ret;
 }
 
-void mem_cgroup_sockets_destroy(struct cgroup *cgrp, struct cgroup_subsys *ss)
+void mem_cgroup_sockets_destroy(struct mem_cgroup *memcg)
 {
         struct proto *proto;
 
         mutex_lock(&proto_list_mutex);
         list_for_each_entry_reverse(proto, &proto_list, node)
                 if (proto->destroy_cgroup)
-                        proto->destroy_cgroup(cgrp, ss);
+                        proto->destroy_cgroup(memcg);
         mutex_unlock(&proto_list_mutex);
 }
 #endif
@@ -184,7 +186,7 @@ void mem_cgroup_sockets_destroy(struct cgroup *cgrp, struct cgroup_subsys *ss)
 static struct lock_class_key af_family_keys[AF_MAX];
 static struct lock_class_key af_family_slock_keys[AF_MAX];
 
-struct jump_label_key memcg_socket_limit_enabled;
+struct static_key memcg_socket_limit_enabled;
 EXPORT_SYMBOL(memcg_socket_limit_enabled);
 
 /*
@@ -259,7 +261,9 @@ static struct lock_class_key af_callback_keys[AF_MAX];
 
 /* Run time adjustable parameters. */
 __u32 sysctl_wmem_max __read_mostly = SK_WMEM_MAX;
+EXPORT_SYMBOL(sysctl_wmem_max);
 __u32 sysctl_rmem_max __read_mostly = SK_RMEM_MAX;
+EXPORT_SYMBOL(sysctl_rmem_max);
 __u32 sysctl_wmem_default __read_mostly = SK_WMEM_MAX;
 __u32 sysctl_rmem_default __read_mostly = SK_RMEM_MAX;
 
@@ -295,9 +299,8 @@ static int sock_set_timeout(long *timeo_p, char __user *optval, int optlen)
                 *timeo_p = 0;
                 if (warned < 10 && net_ratelimit()) {
                         warned++;
-                        printk(KERN_INFO "sock_set_timeout: `%s' (pid %d) "
-                               "tries to set negative timeout\n",
-                                current->comm, task_pid_nr(current));
+                        pr_info("%s: `%s' (pid %d) tries to set negative timeout\n",
+                                __func__, current->comm, task_pid_nr(current));
                 }
                 return 0;
         }
@@ -315,8 +318,8 @@ static void sock_warn_obsolete_bsdism(const char *name)
         static char warncomm[TASK_COMM_LEN];
         if (strcmp(warncomm, current->comm) && warned < 5) {
                 strcpy(warncomm,  current->comm);
-                printk(KERN_WARNING "process `%s' is using obsolete "
-                       "%s SO_BSDCOMPAT\n", warncomm, name);
+                pr_warn("process `%s' is using obsolete %s SO_BSDCOMPAT\n",
+                        warncomm, name);
                 warned++;
         }
 }
@@ -390,7 +393,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
 
         skb->dev = NULL;
 
-        if (sk_rcvqueues_full(sk, skb)) {
+        if (sk_rcvqueues_full(sk, skb, sk->sk_rcvbuf)) {
                 atomic_inc(&sk->sk_drops);
                 goto discard_and_relse;
         }
@@ -407,7 +410,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
                 rc = sk_backlog_rcv(sk, skb);
 
                 mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
-        } else if (sk_add_backlog(sk, skb)) {
+        } else if (sk_add_backlog(sk, skb, sk->sk_rcvbuf)) {
                 bh_unlock_sock(sk);
                 atomic_inc(&sk->sk_drops);
                 goto discard_and_relse;
@@ -562,7 +565,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
                         sock_valbool_flag(sk, SOCK_DBG, valbool);
                 break;
         case SO_REUSEADDR:
-                sk->sk_reuse = valbool;
+                sk->sk_reuse = (valbool ? SK_CAN_REUSE : SK_NO_REUSE);
                 break;
         case SO_TYPE:
         case SO_PROTOCOL:
@@ -578,23 +581,15 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
                 break;
         case SO_SNDBUF:
                 /* Don't error on this BSD doesn't and if you think
-                   about it this is right. Otherwise apps have to
-                   play 'guess the biggest size' games. RCVBUF/SNDBUF
-                   are treated in BSD as hints */
-
-                if (val > sysctl_wmem_max)
-                        val = sysctl_wmem_max;
+                 * about it this is right. Otherwise apps have to
+                 * play 'guess the biggest size' games. RCVBUF/SNDBUF
+                 * are treated in BSD as hints
+                 */
+                val = min_t(u32, val, sysctl_wmem_max);
 set_sndbuf:
                 sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
-                if ((val * 2) < SOCK_MIN_SNDBUF)
-                        sk->sk_sndbuf = SOCK_MIN_SNDBUF;
-                else
-                        sk->sk_sndbuf = val * 2;
-
-                /*
-                 *      Wake up sending tasks if we
-                 *      upped the value.
-                 */
+                sk->sk_sndbuf = max_t(u32, val * 2, SOCK_MIN_SNDBUF);
+                /* Wake up sending tasks if we upped the value. */
                 sk->sk_write_space(sk);
                 break;
 
@@ -607,12 +602,11 @@ set_sndbuf:
 
         case SO_RCVBUF:
                 /* Don't error on this BSD doesn't and if you think
-                   about it this is right. Otherwise apps have to
-                   play 'guess the biggest size' games. RCVBUF/SNDBUF
-                   are treated in BSD as hints */
-
-                if (val > sysctl_rmem_max)
-                        val = sysctl_rmem_max;
+                 * about it this is right. Otherwise apps have to
+                 * play 'guess the biggest size' games. RCVBUF/SNDBUF
+                 * are treated in BSD as hints
+                 */
+                val = min_t(u32, val, sysctl_rmem_max);
 set_rcvbuf:
                 sk->sk_userlocks |= SOCK_RCVBUF_LOCK;
                 /*
@@ -630,10 +624,7 @@ set_rcvbuf:
                  * returning the value we actually used in getsockopt
                  * is the most desirable behavior.
                  */
-                if ((val * 2) < SOCK_MIN_RCVBUF)
-                        sk->sk_rcvbuf = SOCK_MIN_RCVBUF;
-                else
-                        sk->sk_rcvbuf = val * 2;
+                sk->sk_rcvbuf = max_t(u32, val * 2, SOCK_MIN_RCVBUF);
                 break;
 
         case SO_RCVBUFFORCE:
@@ -793,6 +784,17 @@ set_rcvbuf:
                 sock_valbool_flag(sk, SOCK_WIFI_STATUS, valbool);
                 break;
 
+        case SO_PEEK_OFF:
+                if (sock->ops->set_peek_off)
+                        sock->ops->set_peek_off(sk, val);
+                else
+                        ret = -EOPNOTSUPP;
+                break;
+
+        case SO_NOFCS:
+                sock_valbool_flag(sk, SOCK_NOFCS, valbool);
+                break;
+
         default:
                 ret = -ENOPROTOOPT;
                 break;
@@ -811,8 +813,8 @@ void cred_to_ucred(struct pid *pid, const struct cred *cred,
         if (cred) {
                 struct user_namespace *current_ns = current_user_ns();
 
-                ucred->uid = user_ns_map_uid(current_ns, cred, cred->euid);
-                ucred->gid = user_ns_map_gid(current_ns, cred, cred->egid);
+                ucred->uid = from_kuid(current_ns, cred->euid);
+                ucred->gid = from_kgid(current_ns, cred->egid);
         }
 }
 EXPORT_SYMBOL_GPL(cred_to_ucred);
@@ -848,7 +850,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case SO_BROADCAST:
-                v.val = !!sock_flag(sk, SOCK_BROADCAST);
+                v.val = sock_flag(sk, SOCK_BROADCAST);
                 break;
 
         case SO_SNDBUF:
@@ -864,7 +866,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case SO_KEEPALIVE:
-                v.val = !!sock_flag(sk, SOCK_KEEPOPEN);
+                v.val = sock_flag(sk, SOCK_KEEPOPEN);
                 break;
 
         case SO_TYPE:
@@ -886,7 +888,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case SO_OOBINLINE:
-                v.val = !!sock_flag(sk, SOCK_URGINLINE);
+                v.val = sock_flag(sk, SOCK_URGINLINE);
                 break;
 
         case SO_NO_CHECK:
@@ -899,7 +901,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
 
         case SO_LINGER:
                 lv              = sizeof(v.ling);
-                v.ling.l_onoff  = !!sock_flag(sk, SOCK_LINGER);
+                v.ling.l_onoff  = sock_flag(sk, SOCK_LINGER);
                 v.ling.l_linger = sk->sk_lingertime / HZ;
                 break;
 
@@ -965,7 +967,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case SO_PASSCRED:
-                v.val = test_bit(SOCK_PASSCRED, &sock->flags) ? 1 : 0;
+                v.val = !!test_bit(SOCK_PASSCRED, &sock->flags);
                 break;
 
         case SO_PEERCRED:
@@ -1000,7 +1002,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case SO_PASSSEC:
-                v.val = test_bit(SOCK_PASSSEC, &sock->flags) ? 1 : 0;
+                v.val = !!test_bit(SOCK_PASSSEC, &sock->flags);
                 break;
 
         case SO_PEERSEC:
@@ -1011,13 +1013,22 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case SO_RXQ_OVFL:
-                v.val = !!sock_flag(sk, SOCK_RXQ_OVFL);
+                v.val = sock_flag(sk, SOCK_RXQ_OVFL);
                 break;
 
         case SO_WIFI_STATUS:
-                v.val = !!sock_flag(sk, SOCK_WIFI_STATUS);
+                v.val = sock_flag(sk, SOCK_WIFI_STATUS);
                 break;
 
+        case SO_PEEK_OFF:
+                if (!sock->ops->set_peek_off)
+                        return -EOPNOTSUPP;
+
+                v.val = sk->sk_peek_off;
+                break;
+        case SO_NOFCS:
+                v.val = sock_flag(sk, SOCK_NOFCS);
+                break;
         default:
                 return -ENOPROTOOPT;
         }
@@ -1228,8 +1239,8 @@ static void __sk_free(struct sock *sk)
         sock_disable_timestamp(sk, SK_FLAGS_TIMESTAMP);
 
         if (atomic_read(&sk->sk_omem_alloc))
-                printk(KERN_DEBUG "%s: optmem leakage (%d bytes) detected.\n",
-                       __func__, atomic_read(&sk->sk_omem_alloc));
+                pr_debug("%s: optmem leakage (%d bytes) detected\n",
+                         __func__, atomic_read(&sk->sk_omem_alloc));
 
         if (sk->sk_peer_cred)
                 put_cred(sk->sk_peer_cred);
@@ -1515,7 +1526,7 @@ struct sk_buff *sock_rmalloc(struct sock *sk, unsigned long size, int force,
  */
 void *sock_kmalloc(struct sock *sk, int size, gfp_t priority)
 {
-        if ((unsigned)size <= sysctl_optmem_max &&
+        if ((unsigned int)size <= sysctl_optmem_max &&
             atomic_read(&sk->sk_omem_alloc) + size < sysctl_optmem_max) {
                 void *mem;
                 /* First do the add, to avoid the race if kmalloc
@@ -1581,6 +1592,11 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
         gfp_t gfp_mask;
         long timeo;
         int err;
+        int npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
+
+        err = -EMSGSIZE;
+        if (npages > MAX_SKB_FRAGS)
+                goto failure;
 
         gfp_mask = sk->sk_allocation;
         if (gfp_mask & __GFP_WAIT)
@@ -1599,14 +1615,12 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
                 if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
                         skb = alloc_skb(header_len, gfp_mask);
                         if (skb) {
-                                int npages;
                                 int i;
 
                                 /* No pages, we're done... */
                                 if (!data_len)
                                         break;
 
-                                npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
                                 skb->truesize += data_len;
                                 skb_shinfo(skb)->nr_frags = npages;
                                 for (i = 0; i < npages; i++) {
@@ -1693,6 +1707,7 @@ static void __release_sock(struct sock *sk)
                 do {
                         struct sk_buff *next = skb->next;
 
+                        prefetch(next);
                         WARN_ON_ONCE(skb_dst_is_noref(skb));
                         skb->next = NULL;
                         sk_backlog_rcv(sk, skb);
@@ -2092,6 +2107,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
 
         sk->sk_sndmsg_page      =       NULL;
         sk->sk_sndmsg_off       =       0;
+        sk->sk_peek_off         =       -1;
 
         sk->sk_peer_pid         =       NULL;
         sk->sk_peer_cred        =       NULL;
@@ -2412,7 +2428,7 @@ static void assign_proto_idx(struct proto *prot)
         prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR);
 
         if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) {
-                printk(KERN_ERR "PROTO_INUSE_NR exhausted\n");
+                pr_err("PROTO_INUSE_NR exhausted\n");
                 return;
         }
 
@@ -2442,8 +2458,8 @@ int proto_register(struct proto *prot, int alloc_slab)
                                         NULL);
 
                 if (prot->slab == NULL) {
-                        printk(KERN_CRIT "%s: Can't create sock SLAB cache!\n",
-                               prot->name);
+                        pr_crit("%s: Can't create sock SLAB cache!\n",
+                                prot->name);
                         goto out;
                 }
 
@@ -2457,8 +2473,8 @@ int proto_register(struct proto *prot, int alloc_slab)
                                                                  SLAB_HWCACHE_ALIGN, NULL);
 
                         if (prot->rsk_prot->slab == NULL) {
-                                printk(KERN_CRIT "%s: Can't create request sock SLAB cache!\n",
-                                       prot->name);
+                                pr_crit("%s: Can't create request sock SLAB cache!\n",
+                                        prot->name);
                                 goto out_free_request_sock_slab_name;
                         }
                 }
@@ -2556,7 +2572,7 @@ static char proto_method_implemented(const void *method)
 }
 static long sock_prot_memory_allocated(struct proto *proto)
 {
-        return proto->memory_allocated != NULL ? proto_memory_allocated(proto): -1L;
+        return proto->memory_allocated != NULL ? proto_memory_allocated(proto) : -1L;
 }
 
 static char *sock_prot_memory_pressure(struct proto *proto)
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index b9868e1fd62c..5fd146720f39 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -10,7 +10,7 @@
 #include <linux/inet_diag.h>
 #include <linux/sock_diag.h>
 
-static struct sock_diag_handler *sock_diag_handlers[AF_MAX];
+static const struct sock_diag_handler *sock_diag_handlers[AF_MAX];
 static int (*inet_rcv_compat)(struct sk_buff *skb, struct nlmsghdr *nlh);
 static DEFINE_MUTEX(sock_diag_table_mutex);
 
@@ -70,7 +70,7 @@ void sock_diag_unregister_inet_compat(int (*fn)(struct sk_buff *skb, struct nlms
 }
 EXPORT_SYMBOL_GPL(sock_diag_unregister_inet_compat);
 
-int sock_diag_register(struct sock_diag_handler *hndl)
+int sock_diag_register(const struct sock_diag_handler *hndl)
 {
         int err = 0;
 
@@ -88,7 +88,7 @@ int sock_diag_register(struct sock_diag_handler *hndl)
 }
 EXPORT_SYMBOL_GPL(sock_diag_register);
 
-void sock_diag_unregister(struct sock_diag_handler *hnld)
+void sock_diag_unregister(const struct sock_diag_handler *hnld)
 {
         int family = hnld->family;
 
@@ -102,7 +102,7 @@ void sock_diag_unregister(struct sock_diag_handler *hnld)
 }
 EXPORT_SYMBOL_GPL(sock_diag_unregister);
 
-static inline struct sock_diag_handler *sock_diag_lock_handler(int family)
+static const inline struct sock_diag_handler *sock_diag_lock_handler(int family)
 {
         if (sock_diag_handlers[family] == NULL)
                 request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
@@ -112,7 +112,7 @@ static inline struct sock_diag_handler *sock_diag_lock_handler(int family)
         return sock_diag_handlers[family];
 }
 
-static inline void sock_diag_unlock_handler(struct sock_diag_handler *h)
+static inline void sock_diag_unlock_handler(const struct sock_diag_handler *h)
 {
         mutex_unlock(&sock_diag_table_mutex);
 }
@@ -121,7 +121,7 @@ static int __sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         int err;
         struct sock_diag_req *req = NLMSG_DATA(nlh);
-        struct sock_diag_handler *hndl;
+        const struct sock_diag_handler *hndl;
 
         if (nlmsg_len(nlh) < sizeof(*req))
                 return -EINVAL;
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index d05559d4d9cd..a7c36845b123 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -14,6 +14,7 @@
 #include <linux/vmalloc.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/kmemleak.h>
 
 #include <net/ip.h>
 #include <net/sock.h>
@@ -69,9 +70,9 @@ static int rps_sock_flow_sysctl(ctl_table *table, int write,
                 if (sock_table != orig_sock_table) {
                         rcu_assign_pointer(rps_sock_flow_table, sock_table);
                         if (sock_table)
-                                jump_label_inc(&rps_needed);
+                                static_key_slow_inc(&rps_needed);
                         if (orig_sock_table) {
-                                jump_label_dec(&rps_needed);
+                                static_key_slow_dec(&rps_needed);
                                 synchronize_rcu();
                                 vfree(orig_sock_table);
                         }
@@ -202,12 +203,6 @@ static struct ctl_table netns_core_table[] = {
         { }
 };
 
-__net_initdata struct ctl_path net_core_path[] = {
-        { .procname = "net", },
-        { .procname = "core", },
-        { },
-};
-
 static __net_init int sysctl_core_net_init(struct net *net)
 {
         struct ctl_table *tbl;
@@ -223,8 +218,7 @@ static __net_init int sysctl_core_net_init(struct net *net)
                 tbl[0].data = &net->core.sysctl_somaxconn;
         }
 
-        net->core.sysctl_hdr = register_net_sysctl_table(net,
-                        net_core_path, tbl);
+        net->core.sysctl_hdr = register_net_sysctl(net, "net/core", tbl);
         if (net->core.sysctl_hdr == NULL)
                 goto err_reg;
 
@@ -254,10 +248,7 @@ static __net_initdata struct pernet_operations sysctl_core_ops = {
 
 static __init int sysctl_core_init(void)
 {
-        static struct ctl_table empty[1];
-
-        register_sysctl_paths(net_core_path, empty);
-        register_net_sysctl_rotable(net_core_path, net_core_table);
+        register_net_sysctl(&init_net, "net/core", net_core_table);
         return register_pernet_subsys(&sysctl_core_ops);
 }
 
diff --git a/net/core/utils.c b/net/core/utils.c
index 386e263f6066..39895a65e54a 100644
--- a/net/core/utils.c
+++ b/net/core/utils.c
@@ -30,7 +30,6 @@
 #include <net/net_ratelimit.h>
 
 #include <asm/byteorder.h>
-#include <asm/system.h>
 #include <asm/uaccess.h>
 
 int net_msg_warn __read_mostly = 1;
@@ -59,14 +58,11 @@ __be32 in_aton(const char *str)
         int i;
 
         l = 0;
-        for (i = 0; i < 4; i++)
-        {
+        for (i = 0; i < 4; i++) {
                 l <<= 8;
-                if (*str != '\0')
-                {
+                if (*str != '\0') {
                         val = 0;
-                        while (*str != '\0' && *str != '.' && *str != '\n')
-                        {
+                        while (*str != '\0' && *str != '.' && *str != '\n') {
                                 val *= 10;
                                 val += *str - '0';
                                 str++;
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index d86053002c16..656c7c75b192 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -178,6 +178,7 @@ static const struct nla_policy dcbnl_ieee_policy[DCB_ATTR_IEEE_MAX + 1] = {
         [DCB_ATTR_IEEE_ETS]         = {.len = sizeof(struct ieee_ets)},
         [DCB_ATTR_IEEE_PFC]         = {.len = sizeof(struct ieee_pfc)},
         [DCB_ATTR_IEEE_APP_TABLE]   = {.type = NLA_NESTED},
+        [DCB_ATTR_IEEE_MAXRATE]   = {.len = sizeof(struct ieee_maxrate)},
 };
 
 static const struct nla_policy dcbnl_ieee_app[DCB_ATTR_IEEE_APP_MAX + 1] = {
@@ -703,6 +704,7 @@ static int dcbnl_setapp(struct net_device *netdev, struct nlattr **tb,
 
         ret = dcbnl_reply(err, RTM_SETDCB, DCB_CMD_SAPP, DCB_ATTR_APP,
                           pid, seq, flags);
+        dcbnl_cee_notify(netdev, RTM_SETDCB, DCB_CMD_SAPP, seq, 0);
 out:
         return ret;
 }
@@ -935,6 +937,7 @@ static int dcbnl_setall(struct net_device *netdev, struct nlattr **tb,
 
         ret = dcbnl_reply(netdev->dcbnl_ops->setall(netdev), RTM_SETDCB,
                           DCB_CMD_SET_ALL, DCB_ATTR_SET_ALL, pid, seq, flags);
+        dcbnl_cee_notify(netdev, RTM_SETDCB, DCB_CMD_SET_ALL, seq, 0);
 
         return ret;
 }
@@ -1205,13 +1208,15 @@ static int dcbnl_build_peer_app(struct net_device *netdev, struct sk_buff* skb,
                 if (!app)
                         goto nla_put_failure;
 
-                if (app_info_type)
-                        NLA_PUT(skb, app_info_type, sizeof(info), &info);
-
-                for (i = 0; i < app_count; i++)
-                        NLA_PUT(skb, app_entry_type, sizeof(struct dcb_app),
-                                &table[i]);
+                if (app_info_type &&
+                    nla_put(skb, app_info_type, sizeof(info), &info))
+                        goto nla_put_failure;
 
+                for (i = 0; i < app_count; i++) {
+                        if (nla_put(skb, app_entry_type, sizeof(struct dcb_app),
+                                    &table[i]))
+                                goto nla_put_failure;
+                }
                 nla_nest_end(skb, app);
         }
         err = 0;
@@ -1230,8 +1235,8 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
         int dcbx;
         int err = -EMSGSIZE;
 
-        NLA_PUT_STRING(skb, DCB_ATTR_IFNAME, netdev->name);
-
+        if (nla_put_string(skb, DCB_ATTR_IFNAME, netdev->name))
+                goto nla_put_failure;
         ieee = nla_nest_start(skb, DCB_ATTR_IEEE);
         if (!ieee)
                 goto nla_put_failure;
@@ -1239,15 +1244,28 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
         if (ops->ieee_getets) {
                 struct ieee_ets ets;
                 err = ops->ieee_getets(netdev, &ets);
-                if (!err)
-                        NLA_PUT(skb, DCB_ATTR_IEEE_ETS, sizeof(ets), &ets);
+                if (!err &&
+                    nla_put(skb, DCB_ATTR_IEEE_ETS, sizeof(ets), &ets))
+                        goto nla_put_failure;
+        }
+
+        if (ops->ieee_getmaxrate) {
+                struct ieee_maxrate maxrate;
+                err = ops->ieee_getmaxrate(netdev, &maxrate);
+                if (!err) {
+                        err = nla_put(skb, DCB_ATTR_IEEE_MAXRATE,
+                                      sizeof(maxrate), &maxrate);
+                        if (err)
+                                goto nla_put_failure;
+                }
         }
 
         if (ops->ieee_getpfc) {
                 struct ieee_pfc pfc;
                 err = ops->ieee_getpfc(netdev, &pfc);
-                if (!err)
-                        NLA_PUT(skb, DCB_ATTR_IEEE_PFC, sizeof(pfc), &pfc);
+                if (!err &&
+                    nla_put(skb, DCB_ATTR_IEEE_PFC, sizeof(pfc), &pfc))
+                        goto nla_put_failure;
         }
 
         app = nla_nest_start(skb, DCB_ATTR_IEEE_APP_TABLE);
@@ -1278,15 +1296,17 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
         if (ops->ieee_peer_getets) {
                 struct ieee_ets ets;
                 err = ops->ieee_peer_getets(netdev, &ets);
-                if (!err)
-                        NLA_PUT(skb, DCB_ATTR_IEEE_PEER_ETS, sizeof(ets), &ets);
+                if (!err &&
+                    nla_put(skb, DCB_ATTR_IEEE_PEER_ETS, sizeof(ets), &ets))
+                        goto nla_put_failure;
         }
 
         if (ops->ieee_peer_getpfc) {
                 struct ieee_pfc pfc;
                 err = ops->ieee_peer_getpfc(netdev, &pfc);
-                if (!err)
-                        NLA_PUT(skb, DCB_ATTR_IEEE_PEER_PFC, sizeof(pfc), &pfc);
+                if (!err &&
+                    nla_put(skb, DCB_ATTR_IEEE_PEER_PFC, sizeof(pfc), &pfc))
+                        goto nla_put_failure;
         }
 
         if (ops->peer_getappinfo && ops->peer_getapptable) {
@@ -1340,10 +1360,11 @@ static int dcbnl_cee_pg_fill(struct sk_buff *skb, struct net_device *dev,
                         ops->getpgtccfgtx(dev, i - DCB_PG_ATTR_TC_0,
                                           &prio, &pgid, &tc_pct, &up_map);
 
-                NLA_PUT_U8(skb, DCB_TC_ATTR_PARAM_PGID, pgid);
-                NLA_PUT_U8(skb, DCB_TC_ATTR_PARAM_UP_MAPPING, up_map);
-                NLA_PUT_U8(skb, DCB_TC_ATTR_PARAM_STRICT_PRIO, prio);
-                NLA_PUT_U8(skb, DCB_TC_ATTR_PARAM_BW_PCT, tc_pct);
+                if (nla_put_u8(skb, DCB_TC_ATTR_PARAM_PGID, pgid) ||
+                    nla_put_u8(skb, DCB_TC_ATTR_PARAM_UP_MAPPING, up_map) ||
+                    nla_put_u8(skb, DCB_TC_ATTR_PARAM_STRICT_PRIO, prio) ||
+                    nla_put_u8(skb, DCB_TC_ATTR_PARAM_BW_PCT, tc_pct))
+                        goto nla_put_failure;
                 nla_nest_end(skb, tc_nest);
         }
 
@@ -1356,7 +1377,8 @@ static int dcbnl_cee_pg_fill(struct sk_buff *skb, struct net_device *dev,
                 else
                         ops->getpgbwgcfgtx(dev, i - DCB_PG_ATTR_BW_ID_0,
                                            &tc_pct);
-                NLA_PUT_U8(skb, i, tc_pct);
+                if (nla_put_u8(skb, i, tc_pct))
+                        goto nla_put_failure;
         }
         nla_nest_end(skb, pg);
         return 0;
@@ -1373,8 +1395,8 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev)
         int dcbx, i, err = -EMSGSIZE;
         u8 value;
 
-        NLA_PUT_STRING(skb, DCB_ATTR_IFNAME, netdev->name);
-
+        if (nla_put_string(skb, DCB_ATTR_IFNAME, netdev->name))
+                goto nla_put_failure;
         cee = nla_nest_start(skb, DCB_ATTR_CEE);
         if (!cee)
                 goto nla_put_failure;
@@ -1401,7 +1423,8 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev)
 
                 for (i = DCB_PFC_UP_ATTR_0; i <= DCB_PFC_UP_ATTR_7; i++) {
                         ops->getpfccfg(netdev, i - DCB_PFC_UP_ATTR_0, &value);
-                        NLA_PUT_U8(skb, i, value);
+                        if (nla_put_u8(skb, i, value))
+                                goto nla_put_failure;
                 }
                 nla_nest_end(skb, pfc_nest);
         }
@@ -1454,8 +1477,9 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev)
 
                 for (i = DCB_FEATCFG_ATTR_ALL + 1; i <= DCB_FEATCFG_ATTR_MAX;
                      i++)
-                        if (!ops->getfeatcfg(netdev, i, &value))
-                                NLA_PUT_U8(skb, i, value);
+                        if (!ops->getfeatcfg(netdev, i, &value) &&
+                            nla_put_u8(skb, i, value))
+                                goto nla_put_failure;
 
                 nla_nest_end(skb, feat);
         }
@@ -1464,15 +1488,17 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev)
         if (ops->cee_peer_getpg) {
                 struct cee_pg pg;
                 err = ops->cee_peer_getpg(netdev, &pg);
-                if (!err)
-                        NLA_PUT(skb, DCB_ATTR_CEE_PEER_PG, sizeof(pg), &pg);
+                if (!err &&
+                    nla_put(skb, DCB_ATTR_CEE_PEER_PG, sizeof(pg), &pg))
+                        goto nla_put_failure;
         }
 
         if (ops->cee_peer_getpfc) {
                 struct cee_pfc pfc;
                 err = ops->cee_peer_getpfc(netdev, &pfc);
-                if (!err)
-                        NLA_PUT(skb, DCB_ATTR_CEE_PEER_PFC, sizeof(pfc), &pfc);
+                if (!err &&
+                    nla_put(skb, DCB_ATTR_CEE_PEER_PFC, sizeof(pfc), &pfc))
+                        goto nla_put_failure;
         }
 
         if (ops->peer_getappinfo && ops->peer_getapptable) {
@@ -1589,6 +1615,14 @@ static int dcbnl_ieee_set(struct net_device *netdev, struct nlattr **tb,
                         goto err;
         }
 
+        if (ieee[DCB_ATTR_IEEE_MAXRATE] && ops->ieee_setmaxrate) {
+                struct ieee_maxrate *maxrate =
+                        nla_data(ieee[DCB_ATTR_IEEE_MAXRATE]);
+                err = ops->ieee_setmaxrate(netdev, maxrate);
+                if (err)
+                        goto err;
+        }
+
         if (ieee[DCB_ATTR_IEEE_PFC] && ops->ieee_setpfc) {
                 struct ieee_pfc *pfc = nla_data(ieee[DCB_ATTR_IEEE_PFC]);
                 err = ops->ieee_setpfc(netdev, pfc);
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 560627307200..8c67bedf85b0 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -98,8 +98,9 @@ static void ccid3_update_send_interval(struct ccid3_hc_tx_sock *hc)
 {
         hc->tx_t_ipi = scaled_div32(((u64)hc->tx_s) << 6, hc->tx_x);
 
+        DCCP_BUG_ON(hc->tx_t_ipi == 0);
         ccid3_pr_debug("t_ipi=%u, s=%u, X=%u\n", hc->tx_t_ipi,
-                       hc->tx_s, (unsigned)(hc->tx_x >> 6));
+                       hc->tx_s, (unsigned int)(hc->tx_x >> 6));
 }
 
 static u32 ccid3_hc_tx_idle_rtt(struct ccid3_hc_tx_sock *hc, ktime_t now)
@@ -152,9 +153,9 @@ static void ccid3_hc_tx_update_x(struct sock *sk, ktime_t *stamp)
 
         if (hc->tx_x != old_x) {
                 ccid3_pr_debug("X_prev=%u, X_now=%u, X_calc=%u, "
-                               "X_recv=%u\n", (unsigned)(old_x >> 6),
-                               (unsigned)(hc->tx_x >> 6), hc->tx_x_calc,
-                               (unsigned)(hc->tx_x_recv >> 6));
+                               "X_recv=%u\n", (unsigned int)(old_x >> 6),
+                               (unsigned int)(hc->tx_x >> 6), hc->tx_x_calc,
+                               (unsigned int)(hc->tx_x_recv >> 6));
 
                 ccid3_update_send_interval(hc);
         }
@@ -236,8 +237,6 @@ static void ccid3_hc_tx_no_feedback_timer(unsigned long data)
                  *
                  *  Note that X_recv is scaled by 2^6 while X_calc is not
                  */
-                BUG_ON(hc->tx_p && !hc->tx_x_calc);
-
                 if (hc->tx_x_calc > (hc->tx_x_recv >> 5))
                         hc->tx_x_recv =
                                 max(hc->tx_x_recv / 2,
@@ -426,8 +425,8 @@ done_computing_x:
                                "p=%u, X_calc=%u, X_recv=%u, X=%u\n",
                                dccp_role(sk), sk, hc->tx_rtt, r_sample,
                                hc->tx_s, hc->tx_p, hc->tx_x_calc,
-                               (unsigned)(hc->tx_x_recv >> 6),
-                               (unsigned)(hc->tx_x >> 6));
+                               (unsigned int)(hc->tx_x_recv >> 6),
+                               (unsigned int)(hc->tx_x >> 6));
 
         /* unschedule no feedback timer */
         sk_stop_timer(sk, &hc->tx_no_feedback_timer);
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index 29d6bb629a6c..9040be049d8c 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -75,7 +75,7 @@ extern void dccp_time_wait(struct sock *sk, int state, int timeo);
                                      * state, about 60 seconds */
 
 /* RFC 1122, 4.2.3.1 initial RTO value */
-#define DCCP_TIMEOUT_INIT ((unsigned)(3 * HZ))
+#define DCCP_TIMEOUT_INIT ((unsigned int)(3 * HZ))
 
 /*
  * The maximum back-off value for retransmissions. This is needed for
@@ -84,7 +84,7 @@ extern void dccp_time_wait(struct sock *sk, int state, int timeo);
  *  - feature-negotiation retransmission (sec. 6.6.3),
  *  - Acks in client-PARTOPEN state (sec. 8.1.5).
  */
-#define DCCP_RTO_MAX ((unsigned)(64 * HZ))
+#define DCCP_RTO_MAX ((unsigned int)(64 * HZ))
 
 /*
  * RTT sampling: sanity bounds and fallback RTT value from RFC 4340, section 3.4
@@ -287,9 +287,9 @@ extern struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
 extern int dccp_child_process(struct sock *parent, struct sock *child,
                               struct sk_buff *skb);
 extern int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
-                                  struct dccp_hdr *dh, unsigned len);
+                                  struct dccp_hdr *dh, unsigned int len);
 extern int dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
-                                const struct dccp_hdr *dh, const unsigned len);
+                                const struct dccp_hdr *dh, const unsigned int len);
 
 extern int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized);
 extern void dccp_destroy_sock(struct sock *sk);
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 51d5fe5fffba..bc93a333931e 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -285,7 +285,7 @@ static int dccp_check_seqno(struct sock *sk, struct sk_buff *skb)
 }
 
 static int __dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
-                                  const struct dccp_hdr *dh, const unsigned len)
+                                  const struct dccp_hdr *dh, const unsigned int len)
 {
         struct dccp_sock *dp = dccp_sk(sk);
 
@@ -366,7 +366,7 @@ discard:
 }
 
 int dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
-                         const struct dccp_hdr *dh, const unsigned len)
+                         const struct dccp_hdr *dh, const unsigned int len)
 {
         if (dccp_check_seqno(sk, skb))
                 goto discard;
@@ -388,7 +388,7 @@ EXPORT_SYMBOL_GPL(dccp_rcv_established);
 static int dccp_rcv_request_sent_state_process(struct sock *sk,
                                                struct sk_buff *skb,
                                                const struct dccp_hdr *dh,
-                                               const unsigned len)
+                                               const unsigned int len)
 {
         /*
          *  Step 4: Prepare sequence numbers in REQUEST
@@ -521,7 +521,7 @@ unable_to_proceed:
 static int dccp_rcv_respond_partopen_state_process(struct sock *sk,
                                                    struct sk_buff *skb,
                                                    const struct dccp_hdr *dh,
-                                                   const unsigned len)
+                                                   const unsigned int len)
 {
         struct dccp_sock *dp = dccp_sk(sk);
         u32 sample = dp->dccps_options_received.dccpor_timestamp_echo;
@@ -572,7 +572,7 @@ static int dccp_rcv_respond_partopen_state_process(struct sock *sk,
 }
 
 int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
-                           struct dccp_hdr *dh, unsigned len)
+                           struct dccp_hdr *dh, unsigned int len)
 {
         struct dccp_sock *dp = dccp_sk(sk);
         struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb);
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 1c67fe8ff90d..07f5579ca756 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -300,7 +300,8 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
                  */
                 WARN_ON(req->sk);
 
-                if (seq != dccp_rsk(req)->dreq_iss) {
+                if (!between48(seq, dccp_rsk(req)->dreq_iss,
+                                    dccp_rsk(req)->dreq_gss)) {
                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
                         goto out;
                 }
@@ -573,6 +574,11 @@ static void dccp_v4_reqsk_destructor(struct request_sock *req)
         kfree(inet_rsk(req)->opt);
 }
 
+void dccp_syn_ack_timeout(struct sock *sk, struct request_sock *req)
+{
+}
+EXPORT_SYMBOL(dccp_syn_ack_timeout);
+
 static struct request_sock_ops dccp_request_sock_ops __read_mostly = {
         .family         = PF_INET,
         .obj_size       = sizeof(struct dccp_request_sock),
@@ -580,6 +586,7 @@ static struct request_sock_ops dccp_request_sock_ops __read_mostly = {
         .send_ack       = dccp_reqsk_send_ack,
         .destructor     = dccp_v4_reqsk_destructor,
         .send_reset     = dccp_v4_ctl_send_reset,
+        .syn_ack_timeout = dccp_syn_ack_timeout,
 };
 
 int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
@@ -639,11 +646,12 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
          *
          * Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookie
          *
-         * In fact we defer setting S.GSR, S.SWL, S.SWH to
-         * dccp_create_openreq_child.
+         * Setting S.SWL/S.SWH to is deferred to dccp_create_openreq_child().
          */
         dreq->dreq_isr     = dcb->dccpd_seq;
+        dreq->dreq_gsr     = dreq->dreq_isr;
         dreq->dreq_iss     = dccp_v4_init_sequence(skb);
+        dreq->dreq_gss     = dreq->dreq_iss;
         dreq->dreq_service = service;
 
         if (dccp_v4_send_response(sk, req, NULL))
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index ce903f747e64..fa9512d86f3b 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -193,7 +193,8 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                  */
                 WARN_ON(req->sk != NULL);
 
-                if (seq != dccp_rsk(req)->dreq_iss) {
+                if (!between48(seq, dccp_rsk(req)->dreq_iss,
+                                    dccp_rsk(req)->dreq_gss)) {
                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
                         goto out;
                 }
@@ -342,6 +343,7 @@ static struct request_sock_ops dccp6_request_sock_ops = {
         .send_ack       = dccp_reqsk_send_ack,
         .destructor     = dccp_v6_reqsk_destructor,
         .send_reset     = dccp_v6_ctl_send_reset,
+        .syn_ack_timeout = dccp_syn_ack_timeout,
 };
 
 static struct sock *dccp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
@@ -440,11 +442,12 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
          *
          *   Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookie
          *
-         *   In fact we defer setting S.GSR, S.SWL, S.SWH to
-         *   dccp_create_openreq_child.
+         * Setting S.SWL/S.SWH to is deferred to dccp_create_openreq_child().
          */
         dreq->dreq_isr     = dcb->dccpd_seq;
+        dreq->dreq_gsr     = dreq->dreq_isr;
         dreq->dreq_iss     = dccp_v6_init_sequence(skb);
+        dreq->dreq_gss     = dreq->dreq_iss;
         dreq->dreq_service = service;
 
         if (dccp_v6_send_response(sk, req, NULL))
@@ -577,7 +580,7 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
         newnp->pktoptions = NULL;
         if (ireq6->pktopts != NULL) {
                 newnp->pktoptions = skb_clone(ireq6->pktopts, GFP_ATOMIC);
-                kfree_skb(ireq6->pktopts);
+                consume_skb(ireq6->pktopts);
                 ireq6->pktopts = NULL;
                 if (newnp->pktoptions)
                         skb_set_owner_r(newnp->pktoptions, newsk);
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index 5a7f90bbffac..ea850ce35d4a 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -127,9 +127,11 @@ struct sock *dccp_create_openreq_child(struct sock *sk,
                  *    activation below, as these windows all depend on the local
                  *    and remote Sequence Window feature values (7.5.2).
                  */
-                newdp->dccps_gss = newdp->dccps_iss = dreq->dreq_iss;
+                newdp->dccps_iss = dreq->dreq_iss;
+                newdp->dccps_gss = dreq->dreq_gss;
                 newdp->dccps_gar = newdp->dccps_iss;
-                newdp->dccps_gsr = newdp->dccps_isr = dreq->dreq_isr;
+                newdp->dccps_isr = dreq->dreq_isr;
+                newdp->dccps_gsr = dreq->dreq_gsr;
 
                 /*
                  * Activate features: initialise CCIDs, sequence windows etc.
@@ -164,9 +166,9 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
         /* Check for retransmitted REQUEST */
         if (dccp_hdr(skb)->dccph_type == DCCP_PKT_REQUEST) {
 
-                if (after48(DCCP_SKB_CB(skb)->dccpd_seq, dreq->dreq_isr)) {
+                if (after48(DCCP_SKB_CB(skb)->dccpd_seq, dreq->dreq_gsr)) {
                         dccp_pr_debug("Retransmitted REQUEST\n");
-                        dreq->dreq_isr = DCCP_SKB_CB(skb)->dccpd_seq;
+                        dreq->dreq_gsr = DCCP_SKB_CB(skb)->dccpd_seq;
                         /*
                          * Send another RESPONSE packet
                          * To protect against Request floods, increment retrans
@@ -186,12 +188,14 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
                 goto drop;
 
         /* Invalid ACK */
-        if (DCCP_SKB_CB(skb)->dccpd_ack_seq != dreq->dreq_iss) {
+        if (!between48(DCCP_SKB_CB(skb)->dccpd_ack_seq,
+                                dreq->dreq_iss, dreq->dreq_gss)) {
                 dccp_pr_debug("Invalid ACK number: ack_seq=%llu, "
-                              "dreq_iss=%llu\n",
+                              "dreq_iss=%llu, dreq_gss=%llu\n",
                               (unsigned long long)
                               DCCP_SKB_CB(skb)->dccpd_ack_seq,
-                              (unsigned long long) dreq->dreq_iss);
+                              (unsigned long long) dreq->dreq_iss,
+                              (unsigned long long) dreq->dreq_gss);
                 goto drop;
         }
 
diff --git a/net/dccp/output.c b/net/dccp/output.c
index dede3edb8849..787367308797 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -408,10 +408,10 @@ struct sk_buff *dccp_make_response(struct sock *sk, struct dst_entry *dst,
         skb_dst_set(skb, dst_clone(dst));
 
         dreq = dccp_rsk(req);
-        if (inet_rsk(req)->acked)       /* increase ISS upon retransmission */
-                dccp_inc_seqno(&dreq->dreq_iss);
+        if (inet_rsk(req)->acked)       /* increase GSS upon retransmission */
+                dccp_inc_seqno(&dreq->dreq_gss);
         DCCP_SKB_CB(skb)->dccpd_type = DCCP_PKT_RESPONSE;
-        DCCP_SKB_CB(skb)->dccpd_seq  = dreq->dreq_iss;
+        DCCP_SKB_CB(skb)->dccpd_seq  = dreq->dreq_gss;
 
         /* Resolve feature dependencies resulting from choice of CCID */
         if (dccp_feat_server_ccid_dependencies(dreq))
@@ -429,8 +429,8 @@ struct sk_buff *dccp_make_response(struct sock *sk, struct dst_entry *dst,
                            DCCP_SKB_CB(skb)->dccpd_opt_len) / 4;
         dh->dccph_type  = DCCP_PKT_RESPONSE;
         dh->dccph_x     = 1;
-        dccp_hdr_set_seq(dh, dreq->dreq_iss);
-        dccp_hdr_set_ack(dccp_hdr_ack_bits(skb), dreq->dreq_isr);
+        dccp_hdr_set_seq(dh, dreq->dreq_gss);
+        dccp_hdr_set_ack(dccp_hdr_ack_bits(skb), dreq->dreq_gsr);
         dccp_hdr_response(skb)->dccph_resp_service = dreq->dreq_service;
 
         dccp_csum_outgoing(skb);
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 7065c0ae1e7b..6c7c78b83940 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -848,7 +848,7 @@ int dccp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 default:
                         dccp_pr_debug("packet_type=%s\n",
                                       dccp_packet_name(dh->dccph_type));
-                        sk_eat_skb(sk, skb, 0);
+                        sk_eat_skb(sk, skb, false);
                 }
 verify_sock_status:
                 if (sock_flag(sk, SOCK_DONE)) {
@@ -905,7 +905,7 @@ verify_sock_status:
                         len = skb->len;
         found_fin_ok:
                 if (!(flags & MSG_PEEK))
-                        sk_eat_skb(sk, skb, 0);
+                        sk_eat_skb(sk, skb, false);
                 break;
         } while (1);
 out:
diff --git a/net/dccp/sysctl.c b/net/dccp/sysctl.c
index 42348824ee31..607ab71b5a0c 100644
--- a/net/dccp/sysctl.c
+++ b/net/dccp/sysctl.c
@@ -98,18 +98,11 @@ static struct ctl_table dccp_default_table[] = {
         { }
 };
 
-static struct ctl_path dccp_path[] = {
-        { .procname = "net", },
-        { .procname = "dccp", },
-        { .procname = "default", },
-        { }
-};
-
 static struct ctl_table_header *dccp_table_header;
 
 int __init dccp_sysctl_init(void)
 {
-        dccp_table_header = register_sysctl_paths(dccp_path,
+        dccp_table_header = register_net_sysctl(&init_net, "net/dccp/default",
                         dccp_default_table);
 
         return dccp_table_header != NULL ? 0 : -ENOMEM;
@@ -118,7 +111,7 @@ int __init dccp_sysctl_init(void)
 void dccp_sysctl_exit(void)
 {
         if (dccp_table_header != NULL) {
-                unregister_sysctl_table(dccp_table_header);
+                unregister_net_sysctl_table(dccp_table_header);
                 dccp_table_header = NULL;
         }
 }
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 19acd00a6382..2ba1a2814c24 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -119,7 +119,6 @@ Version 0.0.6    2.1.110   07-aug-98   Eduardo Marcelo Serrat
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <net/flow.h>
-#include <asm/system.h>
 #include <asm/ioctls.h>
 #include <linux/capability.h>
 #include <linux/mm.h>
@@ -251,7 +250,7 @@ static void dn_unhash_sock_bh(struct sock *sk)
 static struct hlist_head *listen_hash(struct sockaddr_dn *addr)
 {
         int i;
-        unsigned hash = addr->sdn_objnum;
+        unsigned int hash = addr->sdn_objnum;
 
         if (hash == 0) {
                 hash = addr->sdn_objnamel;
@@ -1845,9 +1844,9 @@ static inline int dn_queue_too_long(struct dn_scp *scp, struct sk_buff_head *que
  * inclusion (or not) of the two 16 bit acknowledgement fields so it doesn't
  * make much practical difference.
  */
-unsigned dn_mss_from_pmtu(struct net_device *dev, int mtu)
+unsigned int dn_mss_from_pmtu(struct net_device *dev, int mtu)
 {
-        unsigned mss = 230 - DN_MAX_NSP_DATA_HEADER;
+        unsigned int mss = 230 - DN_MAX_NSP_DATA_HEADER;
         if (dev) {
                 struct dn_dev *dn_db = rcu_dereference_raw(dev->dn_ptr);
                 mtu -= LL_RESERVED_SPACE(dev);
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index 74d321a60e7b..f3924ab1e019 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -42,7 +42,6 @@
 #include <linux/notifier.h>
 #include <linux/slab.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <net/net_namespace.h>
 #include <net/neighbour.h>
 #include <net/dst.h>
@@ -210,15 +209,7 @@ static void dn_dev_sysctl_register(struct net_device *dev, struct dn_dev_parms *
         struct dn_dev_sysctl_table *t;
         int i;
 
-#define DN_CTL_PATH_DEV 3
-
-        struct ctl_path dn_ctl_path[] = {
-                { .procname = "net",  },
-                { .procname = "decnet",  },
-                { .procname = "conf",  },
-                { /* to be set */ },
-                { },
-        };
+        char path[sizeof("net/decnet/conf/") + IFNAMSIZ];
 
         t = kmemdup(&dn_dev_sysctl, sizeof(*t), GFP_KERNEL);
         if (t == NULL)
@@ -229,15 +220,12 @@ static void dn_dev_sysctl_register(struct net_device *dev, struct dn_dev_parms *
                 t->dn_dev_vars[i].data = ((char *)parms) + offset;
         }
 
-        if (dev) {
-                dn_ctl_path[DN_CTL_PATH_DEV].procname = dev->name;
-        } else {
-                dn_ctl_path[DN_CTL_PATH_DEV].procname = parms->name;
-        }
+        snprintf(path, sizeof(path), "net/decnet/conf/%s",
+                dev? dev->name : parms->name);
 
         t->dn_dev_vars[0].extra1 = (void *)dev;
 
-        t->sysctl_header = register_sysctl_paths(dn_ctl_path, t->dn_dev_vars);
+        t->sysctl_header = register_net_sysctl(&init_net, path, t->dn_dev_vars);
         if (t->sysctl_header == NULL)
                 kfree(t);
         else
@@ -249,7 +237,7 @@ static void dn_dev_sysctl_unregister(struct dn_dev_parms *parms)
         if (parms->sysctl) {
                 struct dn_dev_sysctl_table *t = parms->sysctl;
                 parms->sysctl = NULL;
-                unregister_sysctl_table(t->sysctl_header);
+                unregister_net_sysctl_table(t->sysctl_header);
                 kfree(t);
         }
 }
@@ -695,13 +683,13 @@ static int dn_nl_fill_ifaddr(struct sk_buff *skb, struct dn_ifaddr *ifa,
         ifm->ifa_scope = ifa->ifa_scope;
         ifm->ifa_index = ifa->ifa_dev->dev->ifindex;
 
-        if (ifa->ifa_address)
-                NLA_PUT_LE16(skb, IFA_ADDRESS, ifa->ifa_address);
-        if (ifa->ifa_local)
-                NLA_PUT_LE16(skb, IFA_LOCAL, ifa->ifa_local);
-        if (ifa->ifa_label[0])
-                NLA_PUT_STRING(skb, IFA_LABEL, ifa->ifa_label);
-
+        if ((ifa->ifa_address &&
+             nla_put_le16(skb, IFA_ADDRESS, ifa->ifa_address)) ||
+            (ifa->ifa_local &&
+             nla_put_le16(skb, IFA_LOCAL, ifa->ifa_local)) ||
+            (ifa->ifa_label[0] &&
+             nla_put_string(skb, IFA_LABEL, ifa->ifa_label)))
+                goto nla_put_failure;
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
index 9e885f180b60..7eaf98799729 100644
--- a/net/decnet/dn_fib.c
+++ b/net/decnet/dn_fib.c
@@ -302,11 +302,12 @@ struct dn_fib_info *dn_fib_create_info(const struct rtmsg *r, struct dn_kern_rta
                 struct rtattr *attr = RTA_DATA(rta->rta_mx);
 
                 while(RTA_OK(attr, attrlen)) {
-                        unsigned flavour = attr->rta_type;
+                        unsigned int flavour = attr->rta_type;
+
                         if (flavour) {
                                 if (flavour > RTAX_MAX)
                                         goto err_inval;
-                                fi->fib_metrics[flavour-1] = *(unsigned*)RTA_DATA(attr);
+                                fi->fib_metrics[flavour-1] = *(unsigned int *)RTA_DATA(attr);
                         }
                         attr = RTA_NEXT(attr, attrlen);
                 }
@@ -437,9 +438,8 @@ int dn_fib_semantic_match(int type, struct dn_fib_info *fi, const struct flowidn
                         res->fi = NULL;
                         return 1;
                 default:
-                        if (net_ratelimit())
-                                printk("DECnet: impossible routing event : dn_fib_semantic_match type=%d\n",
-                                       type);
+                        net_err_ratelimited("DECnet: impossible routing event : dn_fib_semantic_match type=%d\n",
+                                            type);
                         res->fi = NULL;
                         return -EINVAL;
                 }
diff --git a/net/decnet/dn_neigh.c b/net/decnet/dn_neigh.c
index befe426491ba..ac90f658586c 100644
--- a/net/decnet/dn_neigh.c
+++ b/net/decnet/dn_neigh.c
@@ -162,8 +162,8 @@ static int dn_neigh_construct(struct neighbour *neigh)
         else if ((dev->type == ARPHRD_ETHER) || (dev->type == ARPHRD_LOOPBACK))
                 dn_dn2eth(neigh->ha, dn->addr);
         else {
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "Trying to create neigh for hw %d\n",  dev->type);
+                net_dbg_ratelimited("Trying to create neigh for hw %d\n",
+                                    dev->type);
                 return -EINVAL;
         }
 
@@ -205,17 +205,23 @@ static int dn_neigh_output_packet(struct sk_buff *skb)
         struct neighbour *neigh = dst_get_neighbour_noref(dst);
         struct net_device *dev = neigh->dev;
         char mac_addr[ETH_ALEN];
+        unsigned int seq;
+        int err;
 
         dn_dn2eth(mac_addr, rt->rt_local_src);
-        if (dev_hard_header(skb, dev, ntohs(skb->protocol), neigh->ha,
-                            mac_addr, skb->len) >= 0)
-                return dev_queue_xmit(skb);
-
-        if (net_ratelimit())
-                printk(KERN_DEBUG "dn_neigh_output_packet: oops, can't send packet\n");
-
-        kfree_skb(skb);
-        return -EINVAL;
+        do {
+                seq = read_seqbegin(&neigh->ha_lock);
+                err = dev_hard_header(skb, dev, ntohs(skb->protocol),
+                                      neigh->ha, mac_addr, skb->len);
+        } while (read_seqretry(&neigh->ha_lock, seq));
+
+        if (err >= 0)
+                err = dev_queue_xmit(skb);
+        else {
+                kfree_skb(skb);
+                err = -EINVAL;
+        }
+        return err;
 }
 
 static int dn_long_output(struct neighbour *neigh, struct sk_buff *skb)
@@ -230,15 +236,13 @@ static int dn_long_output(struct neighbour *neigh, struct sk_buff *skb)
         if (skb_headroom(skb) < headroom) {
                 struct sk_buff *skb2 = skb_realloc_headroom(skb, headroom);
                 if (skb2 == NULL) {
-                        if (net_ratelimit())
-                                printk(KERN_CRIT "dn_long_output: no memory\n");
+                        net_crit_ratelimited("dn_long_output: no memory\n");
                         kfree_skb(skb);
                         return -ENOBUFS;
                 }
                 kfree_skb(skb);
                 skb = skb2;
-                if (net_ratelimit())
-                        printk(KERN_INFO "dn_long_output: Increasing headroom\n");
+                net_info_ratelimited("dn_long_output: Increasing headroom\n");
         }
 
         data = skb_push(skb, sizeof(struct dn_long_packet) + 3);
@@ -275,15 +279,13 @@ static int dn_short_output(struct neighbour *neigh, struct sk_buff *skb)
         if (skb_headroom(skb) < headroom) {
                 struct sk_buff *skb2 = skb_realloc_headroom(skb, headroom);
                 if (skb2 == NULL) {
-                        if (net_ratelimit())
-                                printk(KERN_CRIT "dn_short_output: no memory\n");
+                        net_crit_ratelimited("dn_short_output: no memory\n");
                         kfree_skb(skb);
                         return -ENOBUFS;
                 }
                 kfree_skb(skb);
                 skb = skb2;
-                if (net_ratelimit())
-                        printk(KERN_INFO "dn_short_output: Increasing headroom\n");
+                net_info_ratelimited("dn_short_output: Increasing headroom\n");
         }
 
         data = skb_push(skb, sizeof(struct dn_short_packet) + 2);
@@ -316,15 +318,13 @@ static int dn_phase3_output(struct neighbour *neigh, struct sk_buff *skb)
         if (skb_headroom(skb) < headroom) {
                 struct sk_buff *skb2 = skb_realloc_headroom(skb, headroom);
                 if (skb2 == NULL) {
-                        if (net_ratelimit())
-                                printk(KERN_CRIT "dn_phase3_output: no memory\n");
+                        net_crit_ratelimited("dn_phase3_output: no memory\n");
                         kfree_skb(skb);
                         return -ENOBUFS;
                 }
                 kfree_skb(skb);
                 skb = skb2;
-                if (net_ratelimit())
-                        printk(KERN_INFO "dn_phase3_output: Increasing headroom\n");
+                net_info_ratelimited("dn_phase3_output: Increasing headroom\n");
         }
 
         data = skb_push(skb, sizeof(struct dn_short_packet) + 2);
diff --git a/net/decnet/dn_nsp_in.c b/net/decnet/dn_nsp_in.c
index 73fa268fe2e8..c344163e6ac0 100644
--- a/net/decnet/dn_nsp_in.c
+++ b/net/decnet/dn_nsp_in.c
@@ -60,7 +60,6 @@
 #include <linux/slab.h>
 #include <net/sock.h>
 #include <net/tcp_states.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/termios.h>
@@ -81,12 +80,15 @@ extern int decnet_log_martians;
 
 static void dn_log_martian(struct sk_buff *skb, const char *msg)
 {
-        if (decnet_log_martians && net_ratelimit()) {
+        if (decnet_log_martians) {
                 char *devname = skb->dev ? skb->dev->name : "???";
                 struct dn_skb_cb *cb = DN_SKB_CB(skb);
-                printk(KERN_INFO "DECnet: Martian packet (%s) dev=%s src=0x%04hx dst=0x%04hx srcport=0x%04hx dstport=0x%04hx\n",
-                       msg, devname, le16_to_cpu(cb->src), le16_to_cpu(cb->dst),
-                       le16_to_cpu(cb->src_port), le16_to_cpu(cb->dst_port));
+                net_info_ratelimited("DECnet: Martian packet (%s) dev=%s src=0x%04hx dst=0x%04hx srcport=0x%04hx dstport=0x%04hx\n",
+                                     msg, devname,
+                                     le16_to_cpu(cb->src),
+                                     le16_to_cpu(cb->dst),
+                                     le16_to_cpu(cb->src_port),
+                                     le16_to_cpu(cb->dst_port));
         }
 }
 
@@ -589,7 +591,7 @@ static __inline__ int dn_queue_skb(struct sock *sk, struct sk_buff *skb, int sig
            number of warnings when compiling with -W --ANK
          */
         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
-            (unsigned)sk->sk_rcvbuf) {
+            (unsigned int)sk->sk_rcvbuf) {
                 err = -ENOMEM;
                 goto out;
         }
diff --git a/net/decnet/dn_nsp_out.c b/net/decnet/dn_nsp_out.c
index bd78836a81eb..564a6ad13ce7 100644
--- a/net/decnet/dn_nsp_out.c
+++ b/net/decnet/dn_nsp_out.c
@@ -1,4 +1,3 @@
-
 /*
  * DECnet       An implementation of the DECnet protocol suite for the LINUX
  *              operating system.  DECnet is implemented using the  BSD Socket
@@ -52,7 +51,6 @@
 #include <linux/route.h>
 #include <linux/slab.h>
 #include <net/sock.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/termios.h>
@@ -210,7 +208,7 @@ static void dn_nsp_rtt(struct sock *sk, long rtt)
  *
  * Returns: The number of times the packet has been sent previously
  */
-static inline unsigned dn_nsp_clone_and_send(struct sk_buff *skb,
+static inline unsigned int dn_nsp_clone_and_send(struct sk_buff *skb,
                                              gfp_t gfp)
 {
         struct dn_skb_cb *cb = DN_SKB_CB(skb);
@@ -241,7 +239,7 @@ void dn_nsp_output(struct sock *sk)
 {
         struct dn_scp *scp = DN_SK(sk);
         struct sk_buff *skb;
-        unsigned reduce_win = 0;
+        unsigned int reduce_win = 0;
 
         /*
          * First we check for otherdata/linkservice messages
@@ -555,8 +553,8 @@ static __inline__ void dn_nsp_do_disc(struct sock *sk, unsigned char msgflg,
         unsigned char *msg;
 
         if ((dst == NULL) || (rem == 0)) {
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "DECnet: dn_nsp_do_disc: BUG! Please report this to SteveW@ACM.org rem=%u dst=%p\n", le16_to_cpu(rem), dst);
+                net_dbg_ratelimited("DECnet: dn_nsp_do_disc: BUG! Please report this to SteveW@ACM.org rem=%u dst=%p\n",
+                                    le16_to_cpu(rem), dst);
                 return;
         }
 
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index f31ce72dca65..586302e557ad 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -122,7 +122,7 @@ static int dn_route_input(struct sk_buff *);
 static void dn_run_flush(unsigned long dummy);
 
 static struct dn_rt_hash_bucket *dn_rt_hash_table;
-static unsigned dn_rt_hash_mask;
+static unsigned int dn_rt_hash_mask;
 
 static struct timer_list dn_route_timer;
 static DEFINE_TIMER(dn_rt_flush_timer, dn_run_flush, 0, 0);
@@ -149,13 +149,13 @@ static void dn_dst_destroy(struct dst_entry *dst)
         dst_destroy_metrics_generic(dst);
 }
 
-static __inline__ unsigned dn_hash(__le16 src, __le16 dst)
+static __inline__ unsigned int dn_hash(__le16 src, __le16 dst)
 {
         __u16 tmp = (__u16 __force)(src ^ dst);
         tmp ^= (tmp >> 3);
         tmp ^= (tmp >> 5);
         tmp ^= (tmp >> 10);
-        return dn_rt_hash_mask & (unsigned)tmp;
+        return dn_rt_hash_mask & (unsigned int)tmp;
 }
 
 static inline void dnrt_free(struct dn_route *rt)
@@ -297,7 +297,7 @@ static inline int compare_keys(struct flowidn *fl1, struct flowidn *fl2)
                 (fl1->flowidn_iif ^ fl2->flowidn_iif)) == 0;
 }
 
-static int dn_insert_route(struct dn_route *rt, unsigned hash, struct dn_route **rp)
+static int dn_insert_route(struct dn_route *rt, unsigned int hash, struct dn_route **rp)
 {
         struct dn_route *rth;
         struct dn_route __rcu **rthp;
@@ -724,11 +724,10 @@ static int dn_output(struct sk_buff *skb)
         struct dn_route *rt = (struct dn_route *)dst;
         struct net_device *dev = dst->dev;
         struct dn_skb_cb *cb = DN_SKB_CB(skb);
-        struct neighbour *neigh;
 
         int err = -EINVAL;
 
-        if ((neigh = dst_get_neighbour_noref(dst)) == NULL)
+        if (dst_get_neighbour_noref(dst) == NULL)
                 goto error;
 
         skb->dev = dev;
@@ -749,8 +748,7 @@ static int dn_output(struct sk_buff *skb)
                        dn_to_neigh_output);
 
 error:
-        if (net_ratelimit())
-                printk(KERN_DEBUG "dn_output: This should not happen\n");
+        net_dbg_ratelimited("dn_output: This should not happen\n");
 
         kfree_skb(skb);
 
@@ -808,12 +806,10 @@ drop:
  */
 static int dn_rt_bug(struct sk_buff *skb)
 {
-        if (net_ratelimit()) {
-                struct dn_skb_cb *cb = DN_SKB_CB(skb);
+        struct dn_skb_cb *cb = DN_SKB_CB(skb);
 
-                printk(KERN_DEBUG "dn_rt_bug: skb from:%04x to:%04x\n",
-                                le16_to_cpu(cb->src), le16_to_cpu(cb->dst));
-        }
+        net_dbg_ratelimited("dn_rt_bug: skb from:%04x to:%04x\n",
+                            le16_to_cpu(cb->src), le16_to_cpu(cb->dst));
 
         kfree_skb(skb);
 
@@ -935,8 +931,8 @@ static int dn_route_output_slow(struct dst_entry **pprt, const struct flowidn *o
         struct dn_route *rt = NULL;
         struct net_device *dev_out = NULL, *dev;
         struct neighbour *neigh = NULL;
-        unsigned hash;
-        unsigned flags = 0;
+        unsigned int hash;
+        unsigned int flags = 0;
         struct dn_fib_res res = { .fi = NULL, .type = RTN_UNICAST };
         int err;
         int free_res = 0;
@@ -1210,7 +1206,7 @@ e_neighbour:
  */
 static int __dn_route_output_key(struct dst_entry **pprt, const struct flowidn *flp, int flags)
 {
-        unsigned hash = dn_hash(flp->saddr, flp->daddr);
+        unsigned int hash = dn_hash(flp->saddr, flp->daddr);
         struct dn_route *rt = NULL;
 
         if (!(flags & MSG_TRYHARD)) {
@@ -1276,7 +1272,7 @@ static int dn_route_input_slow(struct sk_buff *skb)
         struct net_device *out_dev = NULL;
         struct dn_dev *dn_db;
         struct neighbour *neigh = NULL;
-        unsigned hash;
+        unsigned int hash;
         int flags = 0;
         __le16 gateway = 0;
         __le16 local_src = 0;
@@ -1328,9 +1324,7 @@ static int dn_route_input_slow(struct sk_buff *skb)
 
                 out_dev = DN_FIB_RES_DEV(res);
                 if (out_dev == NULL) {
-                        if (net_ratelimit())
-                                printk(KERN_CRIT "Bug in dn_route_input_slow() "
-                                                 "No output device\n");
+                        net_crit_ratelimited("Bug in dn_route_input_slow() No output device\n");
                         goto e_inval;
                 }
                 dev_hold(out_dev);
@@ -1491,7 +1485,7 @@ static int dn_route_input(struct sk_buff *skb)
 {
         struct dn_route *rt;
         struct dn_skb_cb *cb = DN_SKB_CB(skb);
-        unsigned hash = dn_hash(cb->src, cb->dst);
+        unsigned int hash = dn_hash(cb->src, cb->dst);
 
         if (skb_dst(skb))
                 return 0;
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index f65c9ddaee41..e65f2c856e06 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -177,11 +177,11 @@ static int dn_fib_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
         return 1;
 }
 
-unsigned dnet_addr_type(__le16 addr)
+unsigned int dnet_addr_type(__le16 addr)
 {
         struct flowidn fld = { .daddr = addr };
         struct dn_fib_res res;
-        unsigned ret = RTN_UNICAST;
+        unsigned int ret = RTN_UNICAST;
         struct dn_fib_table *tb = dn_fib_get_table(RT_TABLE_LOCAL, 0);
 
         res.r = NULL;
@@ -204,11 +204,11 @@ static int dn_fib_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
         frh->src_len = r->src_len;
         frh->tos = 0;
 
-        if (r->dst_len)
-                NLA_PUT_LE16(skb, FRA_DST, r->dst);
-        if (r->src_len)
-                NLA_PUT_LE16(skb, FRA_SRC, r->src);
-
+        if ((r->dst_len &&
+             nla_put_le16(skb, FRA_DST, r->dst)) ||
+            (r->src_len &&
+             nla_put_le16(skb, FRA_SRC, r->src)))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
diff --git a/net/decnet/dn_table.c b/net/decnet/dn_table.c
index a9a62f225a6b..650f3380c98a 100644
--- a/net/decnet/dn_table.c
+++ b/net/decnet/dn_table.c
@@ -836,8 +836,8 @@ struct dn_fib_table *dn_fib_get_table(u32 n, int create)
         if (!create)
                 return NULL;
 
-        if (in_interrupt() && net_ratelimit()) {
-                printk(KERN_DEBUG "DECnet: BUG! Attempt to create routing table from interrupt\n");
+        if (in_interrupt()) {
+                net_dbg_ratelimited("DECnet: BUG! Attempt to create routing table from interrupt\n");
                 return NULL;
         }
 
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index 1531135130db..44b890936fc0 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -57,8 +57,7 @@ nlmsg_failure:
         if (skb)
                 kfree_skb(skb);
         *errp = -ENOMEM;
-        if (net_ratelimit())
-                printk(KERN_ERR "dn_rtmsg: error creating netlink message\n");
+        net_err_ratelimited("dn_rtmsg: error creating netlink message\n");
         return NULL;
 }
 
diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
index 02e75d11cfbb..a55eeccaa72f 100644
--- a/net/decnet/sysctl_net_decnet.c
+++ b/net/decnet/sysctl_net_decnet.c
@@ -351,20 +351,14 @@ static ctl_table dn_table[] = {
         { }
 };
 
-static struct ctl_path dn_path[] = {
-        { .procname = "net", },
-        { .procname = "decnet", },
-        { }
-};
-
 void dn_register_sysctl(void)
 {
-        dn_table_header = register_sysctl_paths(dn_path, dn_table);
+        dn_table_header = register_net_sysctl(&init_net, "net/decnet", dn_table);
 }
 
 void dn_unregister_sysctl(void)
 {
-        unregister_sysctl_table(dn_table_header);
+        unregister_net_sysctl_table(dn_table_header);
 }
 
 #else  /* CONFIG_SYSCTL */
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index fa000d26dc60..d9507dd05818 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -38,7 +38,7 @@ MODULE_DESCRIPTION("DNS Resolver");
 MODULE_AUTHOR("Wang Lei");
 MODULE_LICENSE("GPL");
 
-unsigned dns_resolver_debug;
+unsigned int dns_resolver_debug;
 module_param_named(debug, dns_resolver_debug, uint, S_IWUSR | S_IRUGO);
 MODULE_PARM_DESC(debug, "DNS Resolver debugging mask");
 
@@ -249,9 +249,6 @@ static int __init init_dns_resolver(void)
         struct key *keyring;
         int ret;
 
-        printk(KERN_NOTICE "Registering the %s key type\n",
-               key_type_dns_resolver.name);
-
         /* create an override credential set with a special thread keyring in
          * which DNS requests are cached
          *
@@ -281,6 +278,7 @@ static int __init init_dns_resolver(void)
 
         /* instruct request_key() to use this special keyring as a cache for
          * the results it looks up */
+        set_bit(KEY_FLAG_ROOT_CAN_CLEAR, &keyring->flags);
         cred->thread_keyring = keyring;
         cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
         dns_resolver_cache = cred;
@@ -300,8 +298,6 @@ static void __exit exit_dns_resolver(void)
         key_revoke(dns_resolver_cache->thread_keyring);
         unregister_key_type(&key_type_dns_resolver);
         put_cred(dns_resolver_cache);
-        printk(KERN_NOTICE "Unregistered %s key type\n",
-               key_type_dns_resolver.name);
 }
 
 module_init(init_dns_resolver)
diff --git a/net/dns_resolver/internal.h b/net/dns_resolver/internal.h
index 189ca9e9b785..17c7886b5b3a 100644
--- a/net/dns_resolver/internal.h
+++ b/net/dns_resolver/internal.h
@@ -31,7 +31,7 @@ extern const struct cred *dns_resolver_cache;
 /*
  * debug tracing
  */
-extern unsigned dns_resolver_debug;
+extern unsigned int dns_resolver_debug;
 
 #define kdebug(FMT, ...)                                \
 do {                                                    \
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 56cf9b8e1c7c..e32083d5d8f8 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -66,7 +66,7 @@ static int dsa_slave_open(struct net_device *dev)
         if (!(master->flags & IFF_UP))
                 return -ENETDOWN;
 
-        if (compare_ether_addr(dev->dev_addr, master->dev_addr)) {
+        if (!ether_addr_equal(dev->dev_addr, master->dev_addr)) {
                 err = dev_uc_add(master, dev->dev_addr);
                 if (err < 0)
                         goto out;
@@ -89,7 +89,7 @@ clear_allmulti:
         if (dev->flags & IFF_ALLMULTI)
                 dev_set_allmulti(master, -1);
 del_unicast:
-        if (compare_ether_addr(dev->dev_addr, master->dev_addr))
+        if (!ether_addr_equal(dev->dev_addr, master->dev_addr))
                 dev_uc_del(master, dev->dev_addr);
 out:
         return err;
@@ -107,7 +107,7 @@ static int dsa_slave_close(struct net_device *dev)
         if (dev->flags & IFF_PROMISC)
                 dev_set_promiscuity(master, -1);
 
-        if (compare_ether_addr(dev->dev_addr, master->dev_addr))
+        if (!ether_addr_equal(dev->dev_addr, master->dev_addr))
                 dev_uc_del(master, dev->dev_addr);
 
         return 0;
@@ -146,13 +146,13 @@ static int dsa_slave_set_mac_address(struct net_device *dev, void *a)
         if (!(dev->flags & IFF_UP))
                 goto out;
 
-        if (compare_ether_addr(addr->sa_data, master->dev_addr)) {
+        if (!ether_addr_equal(addr->sa_data, master->dev_addr)) {
                 err = dev_uc_add(master, addr->sa_data);
                 if (err < 0)
                         return err;
         }
 
-        if (compare_ether_addr(dev->dev_addr, master->dev_addr))
+        if (!ether_addr_equal(dev->dev_addr, master->dev_addr))
                 dev_uc_del(master, dev->dev_addr);
 
 out:
diff --git a/net/econet/Kconfig b/net/econet/Kconfig
deleted file mode 100644
index 39a2d2975e0e..000000000000
--- a/net/econet/Kconfig
+++ /dev/null
@@ -1,36 +0,0 @@
-#
-# Acorn Econet/AUN protocols 
-#
-
-config ECONET
-        tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && INET
-        ---help---
-          Econet is a fairly old and slow networking protocol mainly used by
-          Acorn computers to access file and print servers. It uses native
-          Econet network cards. AUN is an implementation of the higher level
-          parts of Econet that runs over ordinary Ethernet connections, on
-          top of the UDP packet protocol, which in turn runs on top of the
-          Internet protocol IP.
-
-          If you say Y here, you can choose with the next two options whether
-          to send Econet/AUN traffic over a UDP Ethernet connection or over
-          a native Econet network card.
-
-          To compile this driver as a module, choose M here: the module
-          will be called econet.
-
-config ECONET_AUNUDP
-        bool "AUN over UDP"
-        depends on ECONET
-        help
-          Say Y here if you want to send Econet/AUN traffic over a UDP
-          connection (UDP is a packet based protocol that runs on top of the
-          Internet protocol IP) using an ordinary Ethernet network card.
-
-config ECONET_NATIVE
-        bool "Native Econet"
-        depends on ECONET
-        help
-          Say Y here if you have a native Econet network card installed in
-          your computer.
diff --git a/net/econet/Makefile b/net/econet/Makefile
deleted file mode 100644
index 05fae8be2fed..000000000000
--- a/net/econet/Makefile
+++ /dev/null
@@ -1,7 +0,0 @@
-#
-# Makefile for Econet support code.
-#
-
-obj-$(CONFIG_ECONET) += econet.o
-
-econet-y := af_econet.o
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
deleted file mode 100644
index 7e717cb35ad1..000000000000
--- a/net/econet/af_econet.c
+++ /dev/null
@@ -1,1173 +0,0 @@
-/*
- *      An implementation of the Acorn Econet and AUN protocols.
- *      Philip Blundell <philb@gnu.org>
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- *
- */
-
-#define pr_fmt(fmt) fmt
-
-#include <linux/module.h>
-
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/mm.h>
-#include <linux/socket.h>
-#include <linux/sockios.h>
-#include <linux/in.h>
-#include <linux/errno.h>
-#include <linux/interrupt.h>
-#include <linux/if_ether.h>
-#include <linux/netdevice.h>
-#include <linux/inetdevice.h>
-#include <linux/route.h>
-#include <linux/inet.h>
-#include <linux/etherdevice.h>
-#include <linux/if_arp.h>
-#include <linux/wireless.h>
-#include <linux/skbuff.h>
-#include <linux/udp.h>
-#include <linux/slab.h>
-#include <linux/vmalloc.h>
-#include <net/sock.h>
-#include <net/inet_common.h>
-#include <linux/stat.h>
-#include <linux/init.h>
-#include <linux/if_ec.h>
-#include <net/udp.h>
-#include <net/ip.h>
-#include <linux/spinlock.h>
-#include <linux/rcupdate.h>
-#include <linux/bitops.h>
-#include <linux/mutex.h>
-
-#include <linux/uaccess.h>
-#include <asm/system.h>
-
-static const struct proto_ops econet_ops;
-static struct hlist_head econet_sklist;
-static DEFINE_SPINLOCK(econet_lock);
-static DEFINE_MUTEX(econet_mutex);
-
-/* Since there are only 256 possible network numbers (or fewer, depends
-   how you count) it makes sense to use a simple lookup table. */
-static struct net_device *net2dev_map[256];
-
-#define EC_PORT_IP      0xd2
-
-#ifdef CONFIG_ECONET_AUNUDP
-static DEFINE_SPINLOCK(aun_queue_lock);
-static struct socket *udpsock;
-#define AUN_PORT        0x8000
-
-struct aunhdr {
-        unsigned char code;             /* AUN magic protocol byte */
-        unsigned char port;
-        unsigned char cb;
-        unsigned char pad;
-        unsigned long handle;
-};
-
-static unsigned long aun_seq;
-
-/* Queue of packets waiting to be transmitted. */
-static struct sk_buff_head aun_queue;
-static struct timer_list ab_cleanup_timer;
-
-#endif          /* CONFIG_ECONET_AUNUDP */
-
-/* Per-packet information */
-struct ec_cb {
-        struct sockaddr_ec sec;
-        unsigned long cookie;           /* Supplied by user. */
-#ifdef CONFIG_ECONET_AUNUDP
-        int done;
-        unsigned long seq;              /* Sequencing */
-        unsigned long timeout;          /* Timeout */
-        unsigned long start;            /* jiffies */
-#endif
-#ifdef CONFIG_ECONET_NATIVE
-        void (*sent)(struct sk_buff *, int result);
-#endif
-};
-
-static void econet_remove_socket(struct hlist_head *list, struct sock *sk)
-{
-        spin_lock_bh(&econet_lock);
-        sk_del_node_init(sk);
-        spin_unlock_bh(&econet_lock);
-}
-
-static void econet_insert_socket(struct hlist_head *list, struct sock *sk)
-{
-        spin_lock_bh(&econet_lock);
-        sk_add_node(sk, list);
-        spin_unlock_bh(&econet_lock);
-}
-
-/*
- *      Pull a packet from our receive queue and hand it to the user.
- *      If necessary we block.
- */
-
-static int econet_recvmsg(struct kiocb *iocb, struct socket *sock,
-                          struct msghdr *msg, size_t len, int flags)
-{
-        struct sock *sk = sock->sk;
-        struct sk_buff *skb;
-        size_t copied;
-        int err;
-
-        msg->msg_namelen = sizeof(struct sockaddr_ec);
-
-        mutex_lock(&econet_mutex);
-
-        /*
-         *      Call the generic datagram receiver. This handles all sorts
-         *      of horrible races and re-entrancy so we can forget about it
-         *      in the protocol layers.
-         *
-         *      Now it will return ENETDOWN, if device have just gone down,
-         *      but then it will block.
-         */
-
-        skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err);
-
-        /*
-         *      An error occurred so return it. Because skb_recv_datagram()
-         *      handles the blocking we don't see and worry about blocking
-         *      retries.
-         */
-
-        if (skb == NULL)
-                goto out;
-
-        /*
-         *      You lose any data beyond the buffer you gave. If it worries a
-         *      user program they can ask the device for its MTU anyway.
-         */
-
-        copied = skb->len;
-        if (copied > len) {
-                copied = len;
-                msg->msg_flags |= MSG_TRUNC;
-        }
-
-        /* We can't use skb_copy_datagram here */
-        err = memcpy_toiovec(msg->msg_iov, skb->data, copied);
-        if (err)
-                goto out_free;
-        sk->sk_stamp = skb->tstamp;
-
-        if (msg->msg_name)
-                memcpy(msg->msg_name, skb->cb, msg->msg_namelen);
-
-        /*
-         *      Free or return the buffer as appropriate. Again this
-         *      hides all the races and re-entrancy issues from us.
-         */
-        err = copied;
-
-out_free:
-        skb_free_datagram(sk, skb);
-out:
-        mutex_unlock(&econet_mutex);
-        return err;
-}
-
-/*
- *      Bind an Econet socket.
- */
-
-static int econet_bind(struct socket *sock, struct sockaddr *uaddr,
-                       int addr_len)
-{
-        struct sockaddr_ec *sec = (struct sockaddr_ec *)uaddr;
-        struct sock *sk;
-        struct econet_sock *eo;
-
-        /*
-         *      Check legality
-         */
-
-        if (addr_len < sizeof(struct sockaddr_ec) ||
-            sec->sec_family != AF_ECONET)
-                return -EINVAL;
-
-        mutex_lock(&econet_mutex);
-
-        sk = sock->sk;
-        eo = ec_sk(sk);
-
-        eo->cb      = sec->cb;
-        eo->port    = sec->port;
-        eo->station = sec->addr.station;
-        eo->net     = sec->addr.net;
-
-        mutex_unlock(&econet_mutex);
-
-        return 0;
-}
-
-#if defined(CONFIG_ECONET_AUNUDP) || defined(CONFIG_ECONET_NATIVE)
-/*
- *      Queue a transmit result for the user to be told about.
- */
-
-static void tx_result(struct sock *sk, unsigned long cookie, int result)
-{
-        struct sk_buff *skb = alloc_skb(0, GFP_ATOMIC);
-        struct ec_cb *eb;
-        struct sockaddr_ec *sec;
-
-        if (skb == NULL) {
-                pr_debug("econet: memory squeeze, transmit result dropped\n");
-                return;
-        }
-
-        eb = (struct ec_cb *)&skb->cb;
-        sec = (struct sockaddr_ec *)&eb->sec;
-        memset(sec, 0, sizeof(struct sockaddr_ec));
-        sec->cookie = cookie;
-        sec->type = ECTYPE_TRANSMIT_STATUS | result;
-        sec->sec_family = AF_ECONET;
-
-        if (sock_queue_rcv_skb(sk, skb) < 0)
-                kfree_skb(skb);
-}
-#endif
-
-#ifdef CONFIG_ECONET_NATIVE
-/*
- *      Called by the Econet hardware driver when a packet transmit
- *      has completed.  Tell the user.
- */
-
-static void ec_tx_done(struct sk_buff *skb, int result)
-{
-        struct ec_cb *eb = (struct ec_cb *)&skb->cb;
-        tx_result(skb->sk, eb->cookie, result);
-}
-#endif
-
-/*
- *      Send a packet.  We have to work out which device it's going out on
- *      and hence whether to use real Econet or the UDP emulation.
- */
-
-static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
-                          struct msghdr *msg, size_t len)
-{
-        struct sockaddr_ec *saddr = (struct sockaddr_ec *)msg->msg_name;
-        struct net_device *dev;
-        struct ec_addr addr;
-        int err;
-        unsigned char port, cb;
-#if defined(CONFIG_ECONET_AUNUDP) || defined(CONFIG_ECONET_NATIVE)
-        struct sock *sk = sock->sk;
-        struct sk_buff *skb;
-        struct ec_cb *eb;
-#endif
-#ifdef CONFIG_ECONET_AUNUDP
-        struct msghdr udpmsg;
-        struct iovec iov[2];
-        struct aunhdr ah;
-        struct sockaddr_in udpdest;
-        __kernel_size_t size;
-        mm_segment_t oldfs;
-        char *userbuf;
-#endif
-
-        /*
-         *      Check the flags.
-         */
-
-        if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_CMSG_COMPAT))
-                return -EINVAL;
-
-        /*
-         *      Get and verify the address.
-         */
-
-        mutex_lock(&econet_mutex);
-
-        if (saddr == NULL || msg->msg_namelen < sizeof(struct sockaddr_ec)) {
-                mutex_unlock(&econet_mutex);
-                return -EINVAL;
-        }
-        addr.station = saddr->addr.station;
-        addr.net = saddr->addr.net;
-        port = saddr->port;
-        cb = saddr->cb;
-
-        /* Look for a device with the right network number. */
-        dev = net2dev_map[addr.net];
-
-        /* If not directly reachable, use some default */
-        if (dev == NULL) {
-                dev = net2dev_map[0];
-                /* No interfaces at all? */
-                if (dev == NULL) {
-                        mutex_unlock(&econet_mutex);
-                        return -ENETDOWN;
-                }
-        }
-
-        if (dev->type == ARPHRD_ECONET) {
-                /* Real hardware Econet.  We're not worthy etc. */
-#ifdef CONFIG_ECONET_NATIVE
-                unsigned short proto = 0;
-                int hlen, tlen;
-                int res;
-
-                if (len + 15 > dev->mtu) {
-                        mutex_unlock(&econet_mutex);
-                        return -EMSGSIZE;
-                }
-
-                dev_hold(dev);
-
-                hlen = LL_RESERVED_SPACE(dev);
-                tlen = dev->needed_tailroom;
-                skb = sock_alloc_send_skb(sk, len + hlen + tlen,
-                                          msg->msg_flags & MSG_DONTWAIT, &err);
-                if (skb == NULL)
-                        goto out_unlock;
-
-                skb_reserve(skb, hlen);
-                skb_reset_network_header(skb);
-
-                eb = (struct ec_cb *)&skb->cb;
-
-                eb->cookie = saddr->cookie;
-                eb->sec = *saddr;
-                eb->sent = ec_tx_done;
-
-                err = -EINVAL;
-                res = dev_hard_header(skb, dev, ntohs(proto), &addr, NULL, len);
-                if (res < 0)
-                        goto out_free;
-                if (res > 0) {
-                        struct ec_framehdr *fh;
-                        /* Poke in our control byte and
-                           port number.  Hack, hack.  */
-                        fh = (struct ec_framehdr *)skb->data;
-                        fh->cb = cb;
-                        fh->port = port;
-                        if (sock->type != SOCK_DGRAM) {
-                                skb_reset_tail_pointer(skb);
-                                skb->len = 0;
-                        }
-                }
-
-                /* Copy the data. Returns -EFAULT on error */
-                err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
-                skb->protocol = proto;
-                skb->dev = dev;
-                skb->priority = sk->sk_priority;
-                if (err)
-                        goto out_free;
-
-                err = -ENETDOWN;
-                if (!(dev->flags & IFF_UP))
-                        goto out_free;
-
-                /*
-                 *      Now send it
-                 */
-
-                dev_queue_xmit(skb);
-                dev_put(dev);
-                mutex_unlock(&econet_mutex);
-                return len;
-
-out_free:
-                kfree_skb(skb);
-out_unlock:
-                if (dev)
-                        dev_put(dev);
-#else
-                err = -EPROTOTYPE;
-#endif
-                mutex_unlock(&econet_mutex);
-
-                return err;
-        }
-
-#ifdef CONFIG_ECONET_AUNUDP
-        /* AUN virtual Econet. */
-
-        if (udpsock == NULL) {
-                mutex_unlock(&econet_mutex);
-                return -ENETDOWN;               /* No socket - can't send */
-        }
-
-        if (len > 32768) {
-                err = -E2BIG;
-                goto error;
-        }
-
-        /* Make up a UDP datagram and hand it off to some higher intellect. */
-
-        memset(&udpdest, 0, sizeof(udpdest));
-        udpdest.sin_family = AF_INET;
-        udpdest.sin_port = htons(AUN_PORT);
-
-        /* At the moment we use the stupid Acorn scheme of Econet address
-           y.x maps to IP a.b.c.x.  This should be replaced with something
-           more flexible and more aware of subnet masks.  */
-        {
-                struct in_device *idev;
-                unsigned long network = 0;
-
-                rcu_read_lock();
-                idev = __in_dev_get_rcu(dev);
-                if (idev) {
-                        if (idev->ifa_list)
-                                network = ntohl(idev->ifa_list->ifa_address) &
-                                        0xffffff00;             /* !!! */
-                }
-                rcu_read_unlock();
-                udpdest.sin_addr.s_addr = htonl(network | addr.station);
-        }
-
-        memset(&ah, 0, sizeof(ah));
-        ah.port = port;
-        ah.cb = cb & 0x7f;
-        ah.code = 2;            /* magic */
-
-        /* tack our header on the front of the iovec */
-        size = sizeof(struct aunhdr);
-        iov[0].iov_base = (void *)&ah;
-        iov[0].iov_len = size;
-
-        userbuf = vmalloc(len);
-        if (userbuf == NULL) {
-                err = -ENOMEM;
-                goto error;
-        }
-
-        iov[1].iov_base = userbuf;
-        iov[1].iov_len = len;
-        err = memcpy_fromiovec(userbuf, msg->msg_iov, len);
-        if (err)
-                goto error_free_buf;
-
-        /* Get a skbuff (no data, just holds our cb information) */
-        skb = sock_alloc_send_skb(sk, 0, msg->msg_flags & MSG_DONTWAIT, &err);
-        if (skb == NULL)
-                goto error_free_buf;
-
-        eb = (struct ec_cb *)&skb->cb;
-
-        eb->cookie = saddr->cookie;
-        eb->timeout = 5 * HZ;
-        eb->start = jiffies;
-        ah.handle = aun_seq;
-        eb->seq = (aun_seq++);
-        eb->sec = *saddr;
-
-        skb_queue_tail(&aun_queue, skb);
-
-        udpmsg.msg_name = (void *)&udpdest;
-        udpmsg.msg_namelen = sizeof(udpdest);
-        udpmsg.msg_iov = &iov[0];
-        udpmsg.msg_iovlen = 2;
-        udpmsg.msg_control = NULL;
-        udpmsg.msg_controllen = 0;
-        udpmsg.msg_flags = 0;
-
-        oldfs = get_fs();
-        set_fs(KERNEL_DS);              /* More privs :-) */
-        err = sock_sendmsg(udpsock, &udpmsg, size);
-        set_fs(oldfs);
-
-error_free_buf:
-        vfree(userbuf);
-error:
-#else
-        err = -EPROTOTYPE;
-#endif
-        mutex_unlock(&econet_mutex);
-
-        return err;
-}
-
-/*
- *      Look up the address of a socket.
- */
-
-static int econet_getname(struct socket *sock, struct sockaddr *uaddr,
-                          int *uaddr_len, int peer)
-{
-        struct sock *sk;
-        struct econet_sock *eo;
-        struct sockaddr_ec *sec = (struct sockaddr_ec *)uaddr;
-
-        if (peer)
-                return -EOPNOTSUPP;
-
-        memset(sec, 0, sizeof(*sec));
-        mutex_lock(&econet_mutex);
-
-        sk = sock->sk;
-        eo = ec_sk(sk);
-
-        sec->sec_family   = AF_ECONET;
-        sec->port         = eo->port;
-        sec->addr.station = eo->station;
-        sec->addr.net     = eo->net;
-
-        mutex_unlock(&econet_mutex);
-
-        *uaddr_len = sizeof(*sec);
-        return 0;
-}
-
-static void econet_destroy_timer(unsigned long data)
-{
-        struct sock *sk = (struct sock *)data;
-
-        if (!sk_has_allocations(sk)) {
-                sk_free(sk);
-                return;
-        }
-
-        sk->sk_timer.expires = jiffies + 10 * HZ;
-        add_timer(&sk->sk_timer);
-        pr_debug("econet: socket destroy delayed\n");
-}
-
-/*
- *      Close an econet socket.
- */
-
-static int econet_release(struct socket *sock)
-{
-        struct sock *sk;
-
-        mutex_lock(&econet_mutex);
-
-        sk = sock->sk;
-        if (!sk)
-                goto out_unlock;
-
-        econet_remove_socket(&econet_sklist, sk);
-
-        /*
-         *      Now the socket is dead. No more input will appear.
-         */
-
-        sk->sk_state_change(sk);        /* It is useless. Just for sanity. */
-
-        sock_orphan(sk);
-
-        /* Purge queues */
-
-        skb_queue_purge(&sk->sk_receive_queue);
-
-        if (sk_has_allocations(sk)) {
-                sk->sk_timer.data     = (unsigned long)sk;
-                sk->sk_timer.expires  = jiffies + HZ;
-                sk->sk_timer.function = econet_destroy_timer;
-                add_timer(&sk->sk_timer);
-
-                goto out_unlock;
-        }
-
-        sk_free(sk);
-
-out_unlock:
-        mutex_unlock(&econet_mutex);
-        return 0;
-}
-
-static struct proto econet_proto = {
-        .name     = "ECONET",
-        .owner    = THIS_MODULE,
-        .obj_size = sizeof(struct econet_sock),
-};
-
-/*
- *      Create an Econet socket
- */
-
-static int econet_create(struct net *net, struct socket *sock, int protocol,
-                         int kern)
-{
-        struct sock *sk;
-        struct econet_sock *eo;
-        int err;
-
-        if (!net_eq(net, &init_net))
-                return -EAFNOSUPPORT;
-
-        /* Econet only provides datagram services. */
-        if (sock->type != SOCK_DGRAM)
-                return -ESOCKTNOSUPPORT;
-
-        sock->state = SS_UNCONNECTED;
-
-        err = -ENOBUFS;
-        sk = sk_alloc(net, PF_ECONET, GFP_KERNEL, &econet_proto);
-        if (sk == NULL)
-                goto out;
-
-        sk->sk_reuse = 1;
-        sock->ops = &econet_ops;
-        sock_init_data(sock, sk);
-
-        eo = ec_sk(sk);
-        sock_reset_flag(sk, SOCK_ZAPPED);
-        sk->sk_family = PF_ECONET;
-        eo->num = protocol;
-
-        econet_insert_socket(&econet_sklist, sk);
-        return 0;
-out:
-        return err;
-}
-
-/*
- *      Handle Econet specific ioctls
- */
-
-static int ec_dev_ioctl(struct socket *sock, unsigned int cmd, void __user *arg)
-{
-        struct ifreq ifr;
-        struct ec_device *edev;
-        struct net_device *dev;
-        struct sockaddr_ec *sec;
-        int err;
-
-        /*
-         *      Fetch the caller's info block into kernel space
-         */
-
-        if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
-                return -EFAULT;
-
-        dev = dev_get_by_name(&init_net, ifr.ifr_name);
-        if (dev == NULL)
-                return -ENODEV;
-
-        sec = (struct sockaddr_ec *)&ifr.ifr_addr;
-
-        mutex_lock(&econet_mutex);
-
-        err = 0;
-        switch (cmd) {
-        case SIOCSIFADDR:
-                if (!capable(CAP_NET_ADMIN)) {
-                        err = -EPERM;
-                        break;
-                }
-
-                edev = dev->ec_ptr;
-                if (edev == NULL) {
-                        /* Magic up a new one. */
-                        edev = kzalloc(sizeof(struct ec_device), GFP_KERNEL);
-                        if (edev == NULL) {
-                                err = -ENOMEM;
-                                break;
-                        }
-                        dev->ec_ptr = edev;
-                } else
-                        net2dev_map[edev->net] = NULL;
-                edev->station = sec->addr.station;
-                edev->net = sec->addr.net;
-                net2dev_map[sec->addr.net] = dev;
-                if (!net2dev_map[0])
-                        net2dev_map[0] = dev;
-                break;
-
-        case SIOCGIFADDR:
-                edev = dev->ec_ptr;
-                if (edev == NULL) {
-                        err = -ENODEV;
-                        break;
-                }
-                memset(sec, 0, sizeof(struct sockaddr_ec));
-                sec->addr.station = edev->station;
-                sec->addr.net = edev->net;
-                sec->sec_family = AF_ECONET;
-                dev_put(dev);
-                if (copy_to_user(arg, &ifr, sizeof(struct ifreq)))
-                        err = -EFAULT;
-                break;
-
-        default:
-                err = -EINVAL;
-                break;
-        }
-
-        mutex_unlock(&econet_mutex);
-
-        dev_put(dev);
-
-        return err;
-}
-
-/*
- *      Handle generic ioctls
- */
-
-static int econet_ioctl(struct socket *sock, unsigned int cmd,
-                        unsigned long arg)
-{
-        struct sock *sk = sock->sk;
-        void __user *argp = (void __user *)arg;
-
-        switch (cmd) {
-        case SIOCGSTAMP:
-                return sock_get_timestamp(sk, argp);
-
-        case SIOCGSTAMPNS:
-                return sock_get_timestampns(sk, argp);
-
-        case SIOCSIFADDR:
-        case SIOCGIFADDR:
-                return ec_dev_ioctl(sock, cmd, argp);
-
-        }
-
-        return -ENOIOCTLCMD;
-}
-
-static const struct net_proto_family econet_family_ops = {
-        .family =       PF_ECONET,
-        .create =       econet_create,
-        .owner  =       THIS_MODULE,
-};
-
-static const struct proto_ops econet_ops = {
-        .family =       PF_ECONET,
-        .owner =        THIS_MODULE,
-        .release =      econet_release,
-        .bind =         econet_bind,
-        .connect =      sock_no_connect,
-        .socketpair =   sock_no_socketpair,
-        .accept =       sock_no_accept,
-        .getname =      econet_getname,
-        .poll =         datagram_poll,
-        .ioctl =        econet_ioctl,
-        .listen =       sock_no_listen,
-        .shutdown =     sock_no_shutdown,
-        .setsockopt =   sock_no_setsockopt,
-        .getsockopt =   sock_no_getsockopt,
-        .sendmsg =      econet_sendmsg,
-        .recvmsg =      econet_recvmsg,
-        .mmap =         sock_no_mmap,
-        .sendpage =     sock_no_sendpage,
-};
-
-#if defined(CONFIG_ECONET_AUNUDP) || defined(CONFIG_ECONET_NATIVE)
-/*
- *      Find the listening socket, if any, for the given data.
- */
-
-static struct sock *ec_listening_socket(unsigned char port, unsigned char
-                                 station, unsigned char net)
-{
-        struct sock *sk;
-        struct hlist_node *node;
-
-        spin_lock(&econet_lock);
-        sk_for_each(sk, node, &econet_sklist) {
-                struct econet_sock *opt = ec_sk(sk);
-                if ((opt->port == port || opt->port == 0) &&
-                    (opt->station == station || opt->station == 0) &&
-                    (opt->net == net || opt->net == 0)) {
-                        sock_hold(sk);
-                        goto found;
-                }
-        }
-        sk = NULL;
-found:
-        spin_unlock(&econet_lock);
-        return sk;
-}
-
-/*
- *      Queue a received packet for a socket.
- */
-
-static int ec_queue_packet(struct sock *sk, struct sk_buff *skb,
-                           unsigned char stn, unsigned char net,
-                           unsigned char cb, unsigned char port)
-{
-        struct ec_cb *eb = (struct ec_cb *)&skb->cb;
-        struct sockaddr_ec *sec = (struct sockaddr_ec *)&eb->sec;
-
-        memset(sec, 0, sizeof(struct sockaddr_ec));
-        sec->sec_family = AF_ECONET;
-        sec->type = ECTYPE_PACKET_RECEIVED;
-        sec->port = port;
-        sec->cb = cb;
-        sec->addr.net = net;
-        sec->addr.station = stn;
-
-        return sock_queue_rcv_skb(sk, skb);
-}
-#endif
-
-#ifdef CONFIG_ECONET_AUNUDP
-/*
- *      Send an AUN protocol response.
- */
-
-static void aun_send_response(__u32 addr, unsigned long seq, int code, int cb)
-{
-        struct sockaddr_in sin = {
-                .sin_family = AF_INET,
-                .sin_port = htons(AUN_PORT),
-                .sin_addr = {.s_addr = addr}
-        };
-        struct aunhdr ah = {.code = code, .cb = cb, .handle = seq};
-        struct kvec iov = {.iov_base = (void *)&ah, .iov_len = sizeof(ah)};
-        struct msghdr udpmsg;
-
-        udpmsg.msg_name = (void *)&sin;
-        udpmsg.msg_namelen = sizeof(sin);
-        udpmsg.msg_control = NULL;
-        udpmsg.msg_controllen = 0;
-        udpmsg.msg_flags = 0;
-
-        kernel_sendmsg(udpsock, &udpmsg, &iov, 1, sizeof(ah));
-}
-
-
-/*
- *      Handle incoming AUN packets.  Work out if anybody wants them,
- *      and send positive or negative acknowledgements as appropriate.
- */
-
-static void aun_incoming(struct sk_buff *skb, struct aunhdr *ah, size_t len)
-{
-        struct iphdr *ip = ip_hdr(skb);
-        unsigned char stn = ntohl(ip->saddr) & 0xff;
-        struct dst_entry *dst = skb_dst(skb);
-        struct ec_device *edev = NULL;
-        struct sock *sk = NULL;
-        struct sk_buff *newskb;
-
-        if (dst)
-                edev = dst->dev->ec_ptr;
-
-        if (!edev)
-                goto bad;
-
-        sk = ec_listening_socket(ah->port, stn, edev->net);
-        if (sk == NULL)
-                goto bad;               /* Nobody wants it */
-
-        newskb = alloc_skb((len - sizeof(struct aunhdr) + 15) & ~15,
-                           GFP_ATOMIC);
-        if (newskb == NULL) {
-                pr_debug("AUN: memory squeeze, dropping packet\n");
-                /* Send nack and hope sender tries again */
-                goto bad;
-        }
-
-        memcpy(skb_put(newskb, len - sizeof(struct aunhdr)), (void *)(ah + 1),
-               len - sizeof(struct aunhdr));
-
-        if (ec_queue_packet(sk, newskb, stn, edev->net, ah->cb, ah->port)) {
-                /* Socket is bankrupt. */
-                kfree_skb(newskb);
-                goto bad;
-        }
-
-        aun_send_response(ip->saddr, ah->handle, 3, 0);
-        sock_put(sk);
-        return;
-
-bad:
-        aun_send_response(ip->saddr, ah->handle, 4, 0);
-        if (sk)
-                sock_put(sk);
-}
-
-/*
- *      Handle incoming AUN transmit acknowledgements.  If the sequence
- *      number matches something in our backlog then kill it and tell
- *      the user.  If the remote took too long to reply then we may have
- *      dropped the packet already.
- */
-
-static void aun_tx_ack(unsigned long seq, int result)
-{
-        struct sk_buff *skb;
-        unsigned long flags;
-        struct ec_cb *eb;
-
-        spin_lock_irqsave(&aun_queue_lock, flags);
-        skb_queue_walk(&aun_queue, skb) {
-                eb = (struct ec_cb *)&skb->cb;
-                if (eb->seq == seq)
-                        goto foundit;
-        }
-        spin_unlock_irqrestore(&aun_queue_lock, flags);
-        pr_debug("AUN: unknown sequence %ld\n", seq);
-        return;
-
-foundit:
-        tx_result(skb->sk, eb->cookie, result);
-        skb_unlink(skb, &aun_queue);
-        spin_unlock_irqrestore(&aun_queue_lock, flags);
-        kfree_skb(skb);
-}
-
-/*
- *      Deal with received AUN frames - sort out what type of thing it is
- *      and hand it to the right function.
- */
-
-static void aun_data_available(struct sock *sk, int slen)
-{
-        int err;
-        struct sk_buff *skb;
-        unsigned char *data;
-        struct aunhdr *ah;
-        size_t len;
-
-        while ((skb = skb_recv_datagram(sk, 0, 1, &err)) == NULL) {
-                if (err == -EAGAIN) {
-                        pr_err("AUN: no data available?!\n");
-                        return;
-                }
-                pr_debug("AUN: recvfrom() error %d\n", -err);
-        }
-
-        data = skb_transport_header(skb) + sizeof(struct udphdr);
-        ah = (struct aunhdr *)data;
-        len = skb->len - sizeof(struct udphdr);
-
-        switch (ah->code) {
-        case 2:
-                aun_incoming(skb, ah, len);
-                break;
-        case 3:
-                aun_tx_ack(ah->handle, ECTYPE_TRANSMIT_OK);
-                break;
-        case 4:
-                aun_tx_ack(ah->handle, ECTYPE_TRANSMIT_NOT_LISTENING);
-                break;
-        default:
-                pr_debug("AUN: unknown packet type: %d\n", data[0]);
-        }
-
-        skb_free_datagram(sk, skb);
-}
-
-/*
- *      Called by the timer to manage the AUN transmit queue.  If a packet
- *      was sent to a dead or nonexistent host then we will never get an
- *      acknowledgement back.  After a few seconds we need to spot this and
- *      drop the packet.
- */
-
-static void ab_cleanup(unsigned long h)
-{
-        struct sk_buff *skb, *n;
-        unsigned long flags;
-
-        spin_lock_irqsave(&aun_queue_lock, flags);
-        skb_queue_walk_safe(&aun_queue, skb, n) {
-                struct ec_cb *eb = (struct ec_cb *)&skb->cb;
-                if ((jiffies - eb->start) > eb->timeout) {
-                        tx_result(skb->sk, eb->cookie,
-                                  ECTYPE_TRANSMIT_NOT_PRESENT);
-                        skb_unlink(skb, &aun_queue);
-                        kfree_skb(skb);
-                }
-        }
-        spin_unlock_irqrestore(&aun_queue_lock, flags);
-
-        mod_timer(&ab_cleanup_timer, jiffies + (HZ * 2));
-}
-
-static int __init aun_udp_initialise(void)
-{
-        int error;
-        struct sockaddr_in sin;
-
-        skb_queue_head_init(&aun_queue);
-        setup_timer(&ab_cleanup_timer, ab_cleanup, 0);
-        ab_cleanup_timer.expires = jiffies + (HZ * 2);
-        add_timer(&ab_cleanup_timer);
-
-        memset(&sin, 0, sizeof(sin));
-        sin.sin_port = htons(AUN_PORT);
-
-        /* We can count ourselves lucky Acorn machines are too dim to
-           speak IPv6. :-) */
-        error = sock_create_kern(PF_INET, SOCK_DGRAM, 0, &udpsock);
-        if (error < 0) {
-                pr_err("AUN: socket error %d\n", -error);
-                return error;
-        }
-
-        udpsock->sk->sk_reuse = 1;
-        udpsock->sk->sk_allocation = GFP_ATOMIC; /* we're going to call it
-                                                    from interrupts */
-
-        error = udpsock->ops->bind(udpsock, (struct sockaddr *)&sin,
-                                   sizeof(sin));
-        if (error < 0) {
-                pr_err("AUN: bind error %d\n", -error);
-                goto release;
-        }
-
-        udpsock->sk->sk_data_ready = aun_data_available;
-
-        return 0;
-
-release:
-        sock_release(udpsock);
-        udpsock = NULL;
-        return error;
-}
-#endif
-
-#ifdef CONFIG_ECONET_NATIVE
-
-/*
- *      Receive an Econet frame from a device.
- */
-
-static int econet_rcv(struct sk_buff *skb, struct net_device *dev,
-                      struct packet_type *pt, struct net_device *orig_dev)
-{
-        struct ec_framehdr *hdr;
-        struct sock *sk = NULL;
-        struct ec_device *edev = dev->ec_ptr;
-
-        if (!net_eq(dev_net(dev), &init_net))
-                goto drop;
-
-        if (skb->pkt_type == PACKET_OTHERHOST)
-                goto drop;
-
-        if (!edev)
-                goto drop;
-
-        skb = skb_share_check(skb, GFP_ATOMIC);
-        if (skb == NULL)
-                return NET_RX_DROP;
-
-        if (!pskb_may_pull(skb, sizeof(struct ec_framehdr)))
-                goto drop;
-
-        hdr = (struct ec_framehdr *)skb->data;
-
-        /* First check for encapsulated IP */
-        if (hdr->port == EC_PORT_IP) {
-                skb->protocol = htons(ETH_P_IP);
-                skb_pull(skb, sizeof(struct ec_framehdr));
-                netif_rx(skb);
-                return NET_RX_SUCCESS;
-        }
-
-        sk = ec_listening_socket(hdr->port, hdr->src_stn, hdr->src_net);
-        if (!sk)
-                goto drop;
-
-        if (ec_queue_packet(sk, skb, edev->net, hdr->src_stn, hdr->cb,
-                            hdr->port))
-                goto drop;
-        sock_put(sk);
-        return NET_RX_SUCCESS;
-
-drop:
-        if (sk)
-                sock_put(sk);
-        kfree_skb(skb);
-        return NET_RX_DROP;
-}
-
-static struct packet_type econet_packet_type __read_mostly = {
-        .type = cpu_to_be16(ETH_P_ECONET),
-        .func = econet_rcv,
-};
-
-static void econet_hw_initialise(void)
-{
-        dev_add_pack(&econet_packet_type);
-}
-
-#endif
-
-static int econet_notifier(struct notifier_block *this, unsigned long msg,
-                           void *data)
-{
-        struct net_device *dev = data;
-        struct ec_device *edev;
-
-        if (!net_eq(dev_net(dev), &init_net))
-                return NOTIFY_DONE;
-
-        switch (msg) {
-        case NETDEV_UNREGISTER:
-                /* A device has gone down - kill any data we hold for it. */
-                edev = dev->ec_ptr;
-                if (edev) {
-                        if (net2dev_map[0] == dev)
-                                net2dev_map[0] = NULL;
-                        net2dev_map[edev->net] = NULL;
-                        kfree(edev);
-                        dev->ec_ptr = NULL;
-                }
-                break;
-        }
-
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block econet_netdev_notifier = {
-        .notifier_call = econet_notifier,
-};
-
-static void __exit econet_proto_exit(void)
-{
-#ifdef CONFIG_ECONET_AUNUDP
-        del_timer(&ab_cleanup_timer);
-        if (udpsock)
-                sock_release(udpsock);
-#endif
-        unregister_netdevice_notifier(&econet_netdev_notifier);
-#ifdef CONFIG_ECONET_NATIVE
-        dev_remove_pack(&econet_packet_type);
-#endif
-        sock_unregister(econet_family_ops.family);
-        proto_unregister(&econet_proto);
-}
-
-static int __init econet_proto_init(void)
-{
-        int err = proto_register(&econet_proto, 0);
-
-        if (err != 0)
-                goto out;
-        sock_register(&econet_family_ops);
-#ifdef CONFIG_ECONET_AUNUDP
-        aun_udp_initialise();
-#endif
-#ifdef CONFIG_ECONET_NATIVE
-        econet_hw_initialise();
-#endif
-        register_netdevice_notifier(&econet_netdev_notifier);
-out:
-        return err;
-}
-
-module_init(econet_proto_init);
-module_exit(econet_proto_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_ALIAS_NETPROTO(PF_ECONET);
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index a2468363978e..36e58800a9e3 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -59,7 +59,6 @@
 #include <net/ip.h>
 #include <net/dsa.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 
 __setup("ether=", netdev_boot_setup);
 
@@ -78,7 +77,7 @@ __setup("ether=", netdev_boot_setup);
  */
 int eth_header(struct sk_buff *skb, struct net_device *dev,
                unsigned short type,
-               const void *daddr, const void *saddr, unsigned len)
+               const void *daddr, const void *saddr, unsigned int len)
 {
         struct ethhdr *eth = (struct ethhdr *)skb_push(skb, ETH_HLEN);
 
@@ -165,7 +164,7 @@ __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev)
         eth = eth_hdr(skb);
 
         if (unlikely(is_multicast_ether_addr(eth->h_dest))) {
-                if (!compare_ether_addr_64bits(eth->h_dest, dev->broadcast))
+                if (ether_addr_equal_64bits(eth->h_dest, dev->broadcast))
                         skb->pkt_type = PACKET_BROADCAST;
                 else
                         skb->pkt_type = PACKET_MULTICAST;
@@ -180,7 +179,8 @@ __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev)
          */
 
         else if (1 /*dev->flags&IFF_PROMISC */ ) {
-                if (unlikely(compare_ether_addr_64bits(eth->h_dest, dev->dev_addr)))
+                if (unlikely(!ether_addr_equal_64bits(eth->h_dest,
+                                                      dev->dev_addr)))
                         skb->pkt_type = PACKET_OTHERHOST;
         }
 
@@ -288,6 +288,8 @@ int eth_mac_addr(struct net_device *dev, void *p)
         if (!is_valid_ether_addr(addr->sa_data))
                 return -EADDRNOTAVAIL;
         memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
+        /* if device marked as NET_ADDR_RANDOM, reset it */
+        dev->addr_assign_type &= ~NET_ADDR_RANDOM;
         return 0;
 }
 EXPORT_SYMBOL(eth_mac_addr);
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index e4ecc1eef98c..32eb4179e8fa 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -55,6 +55,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/netdevice.h>
+#include <linux/etherdevice.h>
 #include <net/af_ieee802154.h>
 #include <net/ieee802154.h>
 #include <net/ieee802154_netdev.h>
@@ -195,7 +196,7 @@ lowpan_compress_addr_64(u8 **hc06_ptr, u8 shift, const struct in6_addr *ipaddr,
 static void
 lowpan_uip_ds6_set_addr_iid(struct in6_addr *ipaddr, unsigned char *lladdr)
 {
-        memcpy(&ipaddr->s6_addr[8], lladdr, IEEE802154_ALEN);
+        memcpy(&ipaddr->s6_addr[8], lladdr, IEEE802154_ADDR_LEN);
         /* second bit-flip (Universe/Local) is done according RFC2464 */
         ipaddr->s6_addr[8] ^= 0x02;
 }
@@ -220,7 +221,7 @@ lowpan_uncompress_addr(struct sk_buff *skb, struct in6_addr *ipaddr,
 
         if (lladdr)
                 lowpan_raw_dump_inline(__func__, "linklocal address",
-                                                lladdr, IEEE802154_ALEN);
+                                                lladdr, IEEE802154_ADDR_LEN);
         if (prefcount > 0)
                 memcpy(ipaddr, prefix, prefcount);
 
@@ -370,7 +371,7 @@ err:
 static int lowpan_header_create(struct sk_buff *skb,
                            struct net_device *dev,
                            unsigned short type, const void *_daddr,
-                           const void *_saddr, unsigned len)
+                           const void *_saddr, unsigned int len)
 {
         u8 tmp, iphc0, iphc1, *hc06_ptr;
         struct ipv6hdr *hdr;
@@ -649,6 +650,53 @@ static void lowpan_fragment_timer_expired(unsigned long entry_addr)
         kfree(entry);
 }
 
+static struct lowpan_fragment *
+lowpan_alloc_new_frame(struct sk_buff *skb, u8 iphc0, u8 len, u8 tag)
+{
+        struct lowpan_fragment *frame;
+
+        frame = kzalloc(sizeof(struct lowpan_fragment),
+                        GFP_ATOMIC);
+        if (!frame)
+                goto frame_err;
+
+        INIT_LIST_HEAD(&frame->list);
+
+        frame->length = (iphc0 & 7) | (len << 3);
+        frame->tag = tag;
+
+        /* allocate buffer for frame assembling */
+        frame->skb = alloc_skb(frame->length +
+                               sizeof(struct ipv6hdr), GFP_ATOMIC);
+
+        if (!frame->skb)
+                goto skb_err;
+
+        frame->skb->priority = skb->priority;
+        frame->skb->dev = skb->dev;
+
+        /* reserve headroom for uncompressed ipv6 header */
+        skb_reserve(frame->skb, sizeof(struct ipv6hdr));
+        skb_put(frame->skb, frame->length);
+
+        init_timer(&frame->timer);
+        /* time out is the same as for ipv6 - 60 sec */
+        frame->timer.expires = jiffies + LOWPAN_FRAG_TIMEOUT;
+        frame->timer.data = (unsigned long)frame;
+        frame->timer.function = lowpan_fragment_timer_expired;
+
+        add_timer(&frame->timer);
+
+        list_add_tail(&frame->list, &lowpan_fragments);
+
+        return frame;
+
+skb_err:
+        kfree(frame);
+frame_err:
+        return NULL;
+}
+
 static int
 lowpan_process_data(struct sk_buff *skb)
 {
@@ -691,41 +739,9 @@ lowpan_process_data(struct sk_buff *skb)
 
                 /* alloc new frame structure */
                 if (!found) {
-                        frame = kzalloc(sizeof(struct lowpan_fragment),
-                                                                GFP_ATOMIC);
+                        frame = lowpan_alloc_new_frame(skb, iphc0, len, tag);
                         if (!frame)
                                 goto unlock_and_drop;
-
-                        INIT_LIST_HEAD(&frame->list);
-
-                        frame->length = (iphc0 & 7) | (len << 3);
-                        frame->tag = tag;
-
-                        /* allocate buffer for frame assembling */
-                        frame->skb = alloc_skb(frame->length +
-                                        sizeof(struct ipv6hdr), GFP_ATOMIC);
-
-                        if (!frame->skb) {
-                                kfree(frame);
-                                goto unlock_and_drop;
-                        }
-
-                        frame->skb->priority = skb->priority;
-                        frame->skb->dev = skb->dev;
-
-                        /* reserve headroom for uncompressed ipv6 header */
-                        skb_reserve(frame->skb, sizeof(struct ipv6hdr));
-                        skb_put(frame->skb, frame->length);
-
-                        init_timer(&frame->timer);
-                        /* time out is the same as for ipv6 - 60 sec */
-                        frame->timer.expires = jiffies + LOWPAN_FRAG_TIMEOUT;
-                        frame->timer.data = (unsigned long)frame;
-                        frame->timer.function = lowpan_fragment_timer_expired;
-
-                        add_timer(&frame->timer);
-
-                        list_add_tail(&frame->list, &lowpan_fragments);
                 }
 
                 if ((iphc0 & LOWPAN_DISPATCH_MASK) == LOWPAN_DISPATCH_FRAG1)
@@ -924,19 +940,6 @@ drop:
         return -EINVAL;
 }
 
-static int lowpan_set_address(struct net_device *dev, void *p)
-{
-        struct sockaddr *sa = p;
-
-        if (netif_running(dev))
-                return -EBUSY;
-
-        /* TODO: validate addr */
-        memcpy(dev->dev_addr, sa->sa_data, dev->addr_len);
-
-        return 0;
-}
-
 static int lowpan_get_mac_header_length(struct sk_buff *skb)
 {
         /*
@@ -1056,13 +1059,37 @@ static void lowpan_dev_free(struct net_device *dev)
         free_netdev(dev);
 }
 
+static struct wpan_phy *lowpan_get_phy(const struct net_device *dev)
+{
+        struct net_device *real_dev = lowpan_dev_info(dev)->real_dev;
+        return ieee802154_mlme_ops(real_dev)->get_phy(real_dev);
+}
+
+static u16 lowpan_get_pan_id(const struct net_device *dev)
+{
+        struct net_device *real_dev = lowpan_dev_info(dev)->real_dev;
+        return ieee802154_mlme_ops(real_dev)->get_pan_id(real_dev);
+}
+
+static u16 lowpan_get_short_addr(const struct net_device *dev)
+{
+        struct net_device *real_dev = lowpan_dev_info(dev)->real_dev;
+        return ieee802154_mlme_ops(real_dev)->get_short_addr(real_dev);
+}
+
 static struct header_ops lowpan_header_ops = {
         .create = lowpan_header_create,
 };
 
 static const struct net_device_ops lowpan_netdev_ops = {
         .ndo_start_xmit         = lowpan_xmit,
-        .ndo_set_mac_address    = lowpan_set_address,
+        .ndo_set_mac_address    = eth_mac_addr,
+};
+
+static struct ieee802154_mlme_ops lowpan_mlme = {
+        .get_pan_id = lowpan_get_pan_id,
+        .get_phy = lowpan_get_phy,
+        .get_short_addr = lowpan_get_short_addr,
 };
 
 static void lowpan_setup(struct net_device *dev)
@@ -1082,6 +1109,7 @@ static void lowpan_setup(struct net_device *dev)
 
         dev->netdev_ops         = &lowpan_netdev_ops;
         dev->header_ops         = &lowpan_header_ops;
+        dev->ml_priv            = &lowpan_mlme;
         dev->destructor         = lowpan_dev_free;
 }
 
@@ -1155,6 +1183,8 @@ static int lowpan_newlink(struct net *src_net, struct net_device *dev,
         list_add_tail(&entry->list, &lowpan_devices);
         mutex_unlock(&lowpan_dev_info(dev)->dev_list_mtx);
 
+        spin_lock_init(&flist_lock);
+
         register_netdevice(dev);
 
         return 0;
@@ -1164,11 +1194,20 @@ static void lowpan_dellink(struct net_device *dev, struct list_head *head)
 {
         struct lowpan_dev_info *lowpan_dev = lowpan_dev_info(dev);
         struct net_device *real_dev = lowpan_dev->real_dev;
-        struct lowpan_dev_record *entry;
-        struct lowpan_dev_record *tmp;
+        struct lowpan_dev_record *entry, *tmp;
+        struct lowpan_fragment *frame, *tframe;
 
         ASSERT_RTNL();
 
+        spin_lock(&flist_lock);
+        list_for_each_entry_safe(frame, tframe, &lowpan_fragments, list) {
+                del_timer(&frame->timer);
+                list_del(&frame->list);
+                dev_kfree_skb(frame->skb);
+                kfree(frame);
+        }
+        spin_unlock(&flist_lock);
+
         mutex_lock(&lowpan_dev_info(dev)->dev_list_mtx);
         list_for_each_entry_safe(entry, tmp, &lowpan_devices, list) {
                 if (entry->ldev == dev) {
diff --git a/net/ieee802154/6lowpan.h b/net/ieee802154/6lowpan.h
index aeff3f310482..8c2251fb0a3f 100644
--- a/net/ieee802154/6lowpan.h
+++ b/net/ieee802154/6lowpan.h
@@ -53,9 +53,6 @@
 #ifndef __6LOWPAN_H__
 #define __6LOWPAN_H__
 
-/* need to know address length to manipulate with it */
-#define IEEE802154_ALEN         8
-
 #define UIP_802154_SHORTADDR_LEN        2  /* compressed ipv6 address length */
 #define UIP_IPH_LEN                     40 /* ipv6 fixed header size */
 #define UIP_PROTO_UDP                   17 /* ipv6 next header value for UDP */
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 1b09eaabaac1..6fbb2ad7bb6d 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -44,8 +44,8 @@ struct dgram_sock {
         struct ieee802154_addr src_addr;
         struct ieee802154_addr dst_addr;
 
-        unsigned bound:1;
-        unsigned want_ack:1;
+        unsigned int bound:1;
+        unsigned int want_ack:1;
 };
 
 static inline struct dgram_sock *dgram_sk(const struct sock *sk)
@@ -206,7 +206,7 @@ static int dgram_sendmsg(struct kiocb *iocb, struct sock *sk,
                 struct msghdr *msg, size_t size)
 {
         struct net_device *dev;
-        unsigned mtu;
+        unsigned int mtu;
         struct sk_buff *skb;
         struct dgram_sock *ro = dgram_sk(sk);
         int hlen, tlen;
diff --git a/net/ieee802154/nl-mac.c b/net/ieee802154/nl-mac.c
index adaf46214905..ca92587720f4 100644
--- a/net/ieee802154/nl-mac.c
+++ b/net/ieee802154/nl-mac.c
@@ -63,15 +63,14 @@ int ieee802154_nl_assoc_indic(struct net_device *dev,
         if (!msg)
                 return -ENOBUFS;
 
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
-        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
-                        dev->dev_addr);
-
-        NLA_PUT(msg, IEEE802154_ATTR_SRC_HW_ADDR, IEEE802154_ADDR_LEN,
-                        addr->hwaddr);
-
-        NLA_PUT_U8(msg, IEEE802154_ATTR_CAPABILITY, cap);
+        if (nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, dev->name) ||
+            nla_put_u32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex) ||
+            nla_put(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                    dev->dev_addr) ||
+            nla_put(msg, IEEE802154_ATTR_SRC_HW_ADDR, IEEE802154_ADDR_LEN,
+                    addr->hwaddr) ||
+            nla_put_u8(msg, IEEE802154_ATTR_CAPABILITY, cap))
+                goto nla_put_failure;
 
         return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
 
@@ -92,14 +91,13 @@ int ieee802154_nl_assoc_confirm(struct net_device *dev, u16 short_addr,
         if (!msg)
                 return -ENOBUFS;
 
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
-        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
-                        dev->dev_addr);
-
-        NLA_PUT_U16(msg, IEEE802154_ATTR_SHORT_ADDR, short_addr);
-        NLA_PUT_U8(msg, IEEE802154_ATTR_STATUS, status);
-
+        if (nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, dev->name) ||
+            nla_put_u32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex) ||
+            nla_put(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                    dev->dev_addr) ||
+            nla_put_u16(msg, IEEE802154_ATTR_SHORT_ADDR, short_addr) ||
+            nla_put_u8(msg, IEEE802154_ATTR_STATUS, status))
+                goto nla_put_failure;
         return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
 
 nla_put_failure:
@@ -119,20 +117,22 @@ int ieee802154_nl_disassoc_indic(struct net_device *dev,
         if (!msg)
                 return -ENOBUFS;
 
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
-        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
-                        dev->dev_addr);
-
-        if (addr->addr_type == IEEE802154_ADDR_LONG)
-                NLA_PUT(msg, IEEE802154_ATTR_SRC_HW_ADDR, IEEE802154_ADDR_LEN,
-                                addr->hwaddr);
-        else
-                NLA_PUT_U16(msg, IEEE802154_ATTR_SRC_SHORT_ADDR,
-                                addr->short_addr);
-
-        NLA_PUT_U8(msg, IEEE802154_ATTR_REASON, reason);
-
+        if (nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, dev->name) ||
+            nla_put_u32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex) ||
+            nla_put(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                    dev->dev_addr))
+                goto nla_put_failure;
+        if (addr->addr_type == IEEE802154_ADDR_LONG) {
+                if (nla_put(msg, IEEE802154_ATTR_SRC_HW_ADDR, IEEE802154_ADDR_LEN,
+                            addr->hwaddr))
+                        goto nla_put_failure;
+        } else {
+                if (nla_put_u16(msg, IEEE802154_ATTR_SRC_SHORT_ADDR,
+                                addr->short_addr))
+                        goto nla_put_failure;
+        }
+        if (nla_put_u8(msg, IEEE802154_ATTR_REASON, reason))
+                goto nla_put_failure;
         return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
 
 nla_put_failure:
@@ -151,13 +151,12 @@ int ieee802154_nl_disassoc_confirm(struct net_device *dev, u8 status)
         if (!msg)
                 return -ENOBUFS;
 
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
-        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
-                        dev->dev_addr);
-
-        NLA_PUT_U8(msg, IEEE802154_ATTR_STATUS, status);
-
+        if (nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, dev->name) ||
+            nla_put_u32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex) ||
+            nla_put(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                    dev->dev_addr) ||
+            nla_put_u8(msg, IEEE802154_ATTR_STATUS, status))
+                goto nla_put_failure;
         return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
 
 nla_put_failure:
@@ -177,13 +176,13 @@ int ieee802154_nl_beacon_indic(struct net_device *dev,
         if (!msg)
                 return -ENOBUFS;
 
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
-        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
-                        dev->dev_addr);
-        NLA_PUT_U16(msg, IEEE802154_ATTR_COORD_SHORT_ADDR, coord_addr);
-        NLA_PUT_U16(msg, IEEE802154_ATTR_COORD_PAN_ID, panid);
-
+        if (nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, dev->name) ||
+            nla_put_u32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex) ||
+            nla_put(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                    dev->dev_addr) ||
+            nla_put_u16(msg, IEEE802154_ATTR_COORD_SHORT_ADDR, coord_addr) ||
+            nla_put_u16(msg, IEEE802154_ATTR_COORD_PAN_ID, panid))
+                goto nla_put_failure;
         return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
 
 nla_put_failure:
@@ -204,19 +203,17 @@ int ieee802154_nl_scan_confirm(struct net_device *dev,
         if (!msg)
                 return -ENOBUFS;
 
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
-        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
-                        dev->dev_addr);
-
-        NLA_PUT_U8(msg, IEEE802154_ATTR_STATUS, status);
-        NLA_PUT_U8(msg, IEEE802154_ATTR_SCAN_TYPE, scan_type);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_CHANNELS, unscanned);
-        NLA_PUT_U8(msg, IEEE802154_ATTR_PAGE, page);
-
-        if (edl)
-                NLA_PUT(msg, IEEE802154_ATTR_ED_LIST, 27, edl);
-
+        if (nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, dev->name) ||
+            nla_put_u32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex) ||
+            nla_put(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                    dev->dev_addr) ||
+            nla_put_u8(msg, IEEE802154_ATTR_STATUS, status) ||
+            nla_put_u8(msg, IEEE802154_ATTR_SCAN_TYPE, scan_type) ||
+            nla_put_u32(msg, IEEE802154_ATTR_CHANNELS, unscanned) ||
+            nla_put_u8(msg, IEEE802154_ATTR_PAGE, page) ||
+            (edl &&
+             nla_put(msg, IEEE802154_ATTR_ED_LIST, 27, edl)))
+                goto nla_put_failure;
         return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
 
 nla_put_failure:
@@ -235,13 +232,12 @@ int ieee802154_nl_start_confirm(struct net_device *dev, u8 status)
         if (!msg)
                 return -ENOBUFS;
 
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
-        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
-                        dev->dev_addr);
-
-        NLA_PUT_U8(msg, IEEE802154_ATTR_STATUS, status);
-
+        if (nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, dev->name) ||
+            nla_put_u32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex) ||
+            nla_put(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                    dev->dev_addr) ||
+            nla_put_u8(msg, IEEE802154_ATTR_STATUS, status))
+                goto nla_put_failure;
         return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
 
 nla_put_failure:
@@ -266,16 +262,16 @@ static int ieee802154_nl_fill_iface(struct sk_buff *msg, u32 pid,
         phy = ieee802154_mlme_ops(dev)->get_phy(dev);
         BUG_ON(!phy);
 
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_PHY_NAME, wpan_phy_name(phy));
-        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
-
-        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
-                dev->dev_addr);
-        NLA_PUT_U16(msg, IEEE802154_ATTR_SHORT_ADDR,
-                ieee802154_mlme_ops(dev)->get_short_addr(dev));
-        NLA_PUT_U16(msg, IEEE802154_ATTR_PAN_ID,
-                ieee802154_mlme_ops(dev)->get_pan_id(dev));
+        if (nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, dev->name) ||
+            nla_put_string(msg, IEEE802154_ATTR_PHY_NAME, wpan_phy_name(phy)) ||
+            nla_put_u32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex) ||
+            nla_put(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                    dev->dev_addr) ||
+            nla_put_u16(msg, IEEE802154_ATTR_SHORT_ADDR,
+                        ieee802154_mlme_ops(dev)->get_short_addr(dev)) ||
+            nla_put_u16(msg, IEEE802154_ATTR_PAN_ID,
+                        ieee802154_mlme_ops(dev)->get_pan_id(dev)))
+                goto nla_put_failure;
         wpan_phy_put(phy);
         return genlmsg_end(msg, hdr);
 
diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
index c64a38d57aa3..eed291626da6 100644
--- a/net/ieee802154/nl-phy.c
+++ b/net/ieee802154/nl-phy.c
@@ -53,18 +53,18 @@ static int ieee802154_nl_fill_phy(struct sk_buff *msg, u32 pid,
                 goto out;
 
         mutex_lock(&phy->pib_lock);
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_PHY_NAME, wpan_phy_name(phy));
-
-        NLA_PUT_U8(msg, IEEE802154_ATTR_PAGE, phy->current_page);
-        NLA_PUT_U8(msg, IEEE802154_ATTR_CHANNEL, phy->current_channel);
+        if (nla_put_string(msg, IEEE802154_ATTR_PHY_NAME, wpan_phy_name(phy)) ||
+            nla_put_u8(msg, IEEE802154_ATTR_PAGE, phy->current_page) ||
+            nla_put_u8(msg, IEEE802154_ATTR_CHANNEL, phy->current_channel))
+                goto nla_put_failure;
         for (i = 0; i < 32; i++) {
                 if (phy->channels_supported[i])
                         buf[pages++] = phy->channels_supported[i] | (i << 27);
         }
-        if (pages)
-                NLA_PUT(msg, IEEE802154_ATTR_CHANNEL_PAGE_LIST,
-                                pages * sizeof(uint32_t), buf);
-
+        if (pages &&
+            nla_put(msg, IEEE802154_ATTR_CHANNEL_PAGE_LIST,
+                    pages * sizeof(uint32_t), buf))
+                goto nla_put_failure;
         mutex_unlock(&phy->pib_lock);
         kfree(buf);
         return genlmsg_end(msg, hdr);
@@ -179,6 +179,7 @@ static int ieee802154_add_iface(struct sk_buff *skb,
         const char *devname;
         int rc = -ENOBUFS;
         struct net_device *dev;
+        int type = __IEEE802154_DEV_INVALID;
 
         pr_debug("%s\n", __func__);
 
@@ -221,7 +222,13 @@ static int ieee802154_add_iface(struct sk_buff *skb,
                 goto nla_put_failure;
         }
 
-        dev = phy->add_iface(phy, devname);
+        if (info->attrs[IEEE802154_ATTR_DEV_TYPE]) {
+                type = nla_get_u8(info->attrs[IEEE802154_ATTR_DEV_TYPE]);
+                if (type >= __IEEE802154_DEV_MAX)
+                        return -EINVAL;
+        }
+
+        dev = phy->add_iface(phy, devname, type);
         if (IS_ERR(dev)) {
                 rc = PTR_ERR(dev);
                 goto nla_put_failure;
@@ -245,9 +252,9 @@ static int ieee802154_add_iface(struct sk_buff *skb,
                         goto dev_unregister;
         }
 
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_PHY_NAME, wpan_phy_name(phy));
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-
+        if (nla_put_string(msg, IEEE802154_ATTR_PHY_NAME, wpan_phy_name(phy)) ||
+            nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, dev->name))
+                goto nla_put_failure;
         dev_put(dev);
 
         wpan_phy_put(phy);
@@ -333,10 +340,9 @@ static int ieee802154_del_iface(struct sk_buff *skb,
 
         rtnl_unlock();
 
-
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_PHY_NAME, wpan_phy_name(phy));
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, name);
-
+        if (nla_put_string(msg, IEEE802154_ATTR_PHY_NAME, wpan_phy_name(phy)) ||
+            nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, name))
+                goto nla_put_failure;
         wpan_phy_put(phy);
 
         return ieee802154_nl_reply(msg, info);
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index f96bae8fd330..50e823927d49 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -106,7 +106,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                        size_t size)
 {
         struct net_device *dev;
-        unsigned mtu;
+        unsigned int mtu;
         struct sk_buff *skb;
         int hlen, tlen;
         int err;
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index d183262943d9..20f1cb5c8aba 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -262,8 +262,8 @@ config ARPD
         bool "IP: ARP daemon support"
         ---help---
           The kernel maintains an internal cache which maps IP addresses to
-          hardware addresses on the local network, so that Ethernet/Token Ring/
-          etc. frames are sent to the proper address on the physical networking
+          hardware addresses on the local network, so that Ethernet
+          frames are sent to the proper address on the physical networking
           layer. Normally, kernel uses the ARP protocol to resolve these
           mappings.
 
@@ -312,7 +312,7 @@ config SYN_COOKIES
 
 config INET_AH
         tristate "IP: AH transformation"
-        select XFRM
+        select XFRM_ALGO
         select CRYPTO
         select CRYPTO_HMAC
         select CRYPTO_MD5
@@ -324,7 +324,7 @@ config INET_AH
 
 config INET_ESP
         tristate "IP: ESP transformation"
-        select XFRM
+        select XFRM_ALGO
         select CRYPTO
         select CRYPTO_AUTHENC
         select CRYPTO_HMAC
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index f7b5670744f0..c8f7aee587d1 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -65,6 +65,8 @@
  *              2 of the License, or (at your option) any later version.
  */
 
+#define pr_fmt(fmt) "IPv4: " fmt
+
 #include <linux/err.h>
 #include <linux/errno.h>
 #include <linux/types.h>
@@ -89,7 +91,6 @@
 #include <linux/slab.h>
 
 #include <asm/uaccess.h>
-#include <asm/system.h>
 
 #include <linux/inet.h>
 #include <linux/igmp.h>
@@ -349,7 +350,7 @@ lookup_protocol:
         err = 0;
         sk->sk_no_check = answer_no_check;
         if (INET_PROTOSW_REUSE & answer_flags)
-                sk->sk_reuse = 1;
+                sk->sk_reuse = SK_CAN_REUSE;
 
         inet = inet_sk(sk);
         inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
@@ -381,6 +382,7 @@ lookup_protocol:
         inet->mc_all    = 1;
         inet->mc_index  = 0;
         inet->mc_list   = NULL;
+        inet->rcv_tos   = 0;
 
         sk_refcnt_debug_inc(sk);
 
@@ -539,7 +541,7 @@ out:
 }
 EXPORT_SYMBOL(inet_bind);
 
-int inet_dgram_connect(struct socket *sock, struct sockaddr * uaddr,
+int inet_dgram_connect(struct socket *sock, struct sockaddr *uaddr,
                        int addr_len, int flags)
 {
         struct sock *sk = sock->sk;
@@ -1084,13 +1086,11 @@ out:
         return;
 
 out_permanent:
-        printk(KERN_ERR "Attempt to override permanent protocol %d.\n",
-               protocol);
+        pr_err("Attempt to override permanent protocol %d\n", protocol);
         goto out;
 
 out_illegal:
-        printk(KERN_ERR
-               "Ignoring attempt to register invalid socket type %d.\n",
+        pr_err("Ignoring attempt to register invalid socket type %d\n",
                p->type);
         goto out;
 }
@@ -1099,8 +1099,7 @@ EXPORT_SYMBOL(inet_register_protosw);
 void inet_unregister_protosw(struct inet_protosw *p)
 {
         if (INET_PROTOSW_PERMANENT & p->flags) {
-                printk(KERN_ERR
-                       "Attempt to unregister permanent protocol %d.\n",
+                pr_err("Attempt to unregister permanent protocol %d\n",
                        p->protocol);
         } else {
                 spin_lock_bh(&inetsw_lock);
@@ -1149,8 +1148,8 @@ static int inet_sk_reselect_saddr(struct sock *sk)
                 return 0;
 
         if (sysctl_ip_dynaddr > 1) {
-                printk(KERN_INFO "%s(): shifting inet->saddr from %pI4 to %pI4\n",
-                       __func__, &old_saddr, &new_saddr);
+                pr_info("%s(): shifting inet->saddr from %pI4 to %pI4\n",
+                        __func__, &old_saddr, &new_saddr);
         }
 
         inet->inet_saddr = inet->inet_rcv_saddr = new_saddr;
@@ -1679,14 +1678,14 @@ static int __init inet_init(void)
          */
 
         if (inet_add_protocol(&icmp_protocol, IPPROTO_ICMP) < 0)
-                printk(KERN_CRIT "inet_init: Cannot add ICMP protocol\n");
+                pr_crit("%s: Cannot add ICMP protocol\n", __func__);
         if (inet_add_protocol(&udp_protocol, IPPROTO_UDP) < 0)
-                printk(KERN_CRIT "inet_init: Cannot add UDP protocol\n");
+                pr_crit("%s: Cannot add UDP protocol\n", __func__);
         if (inet_add_protocol(&tcp_protocol, IPPROTO_TCP) < 0)
-                printk(KERN_CRIT "inet_init: Cannot add TCP protocol\n");
+                pr_crit("%s: Cannot add TCP protocol\n", __func__);
 #ifdef CONFIG_IP_MULTICAST
         if (inet_add_protocol(&igmp_protocol, IPPROTO_IGMP) < 0)
-                printk(KERN_CRIT "inet_init: Cannot add IGMP protocol\n");
+                pr_crit("%s: Cannot add IGMP protocol\n", __func__);
 #endif
 
         /* Register the socket-side information for inet_create. */
@@ -1733,14 +1732,14 @@ static int __init inet_init(void)
          */
 #if defined(CONFIG_IP_MROUTE)
         if (ip_mr_init())
-                printk(KERN_CRIT "inet_init: Cannot init ipv4 mroute\n");
+                pr_crit("%s: Cannot init ipv4 mroute\n", __func__);
 #endif
         /*
          *      Initialise per-cpu ipv4 mibs
          */
 
         if (init_ipv4_mibs())
-                printk(KERN_CRIT "inet_init: Cannot init ipv4 mibs\n");
+                pr_crit("%s: Cannot init ipv4 mibs\n", __func__);
 
         ipv4_proc_init();
 
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 36d14406261e..e8f2617ecd47 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -1,3 +1,5 @@
+#define pr_fmt(fmt) "IPsec: " fmt
+
 #include <crypto/hash.h>
 #include <linux/err.h>
 #include <linux/module.h>
@@ -75,7 +77,7 @@ static inline struct scatterlist *ah_req_sg(struct crypto_ahash *ahash,
 
 static int ip_clear_mutable_options(const struct iphdr *iph, __be32 *daddr)
 {
-        unsigned char * optptr = (unsigned char*)(iph+1);
+        unsigned char *optptr = (unsigned char *)(iph+1);
         int  l = iph->ihl*4 - sizeof(struct iphdr);
         int  optlen;
 
@@ -404,8 +406,8 @@ static void ah4_err(struct sk_buff *skb, u32 info)
                               ah->spi, IPPROTO_AH, AF_INET);
         if (!x)
                 return;
-        printk(KERN_DEBUG "pmtu discovery on SA AH/%08x/%08x\n",
-               ntohl(ah->spi), ntohl(iph->daddr));
+        pr_debug("pmtu discovery on SA AH/%08x/%08x\n",
+                 ntohl(ah->spi), ntohl(iph->daddr));
         xfrm_state_put(x);
 }
 
@@ -445,9 +447,10 @@ static int ah_init_state(struct xfrm_state *x)
 
         if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
             crypto_ahash_digestsize(ahash)) {
-                printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
-                       x->aalg->alg_name, crypto_ahash_digestsize(ahash),
-                       aalg_desc->uinfo.auth.icv_fullbits/8);
+                pr_info("%s: %s digestsize %u != %hu\n",
+                        __func__, x->aalg->alg_name,
+                        crypto_ahash_digestsize(ahash),
+                        aalg_desc->uinfo.auth.icv_fullbits / 8);
                 goto error;
         }
 
@@ -510,11 +513,11 @@ static const struct net_protocol ah4_protocol = {
 static int __init ah4_init(void)
 {
         if (xfrm_register_type(&ah_type, AF_INET) < 0) {
-                printk(KERN_INFO "ip ah init: can't add xfrm type\n");
+                pr_info("%s: can't add xfrm type\n", __func__);
                 return -EAGAIN;
         }
         if (inet_add_protocol(&ah4_protocol, IPPROTO_AH) < 0) {
-                printk(KERN_INFO "ip ah init: can't add protocol\n");
+                pr_info("%s: can't add protocol\n", __func__);
                 xfrm_unregister_type(&ah_type, AF_INET);
                 return -EAGAIN;
         }
@@ -524,9 +527,9 @@ static int __init ah4_init(void)
 static void __exit ah4_fini(void)
 {
         if (inet_del_protocol(&ah4_protocol, IPPROTO_AH) < 0)
-                printk(KERN_INFO "ip ah close: can't remove protocol\n");
+                pr_info("%s: can't remove protocol\n", __func__);
         if (xfrm_unregister_type(&ah_type, AF_INET) < 0)
-                printk(KERN_INFO "ip ah close: can't remove xfrm type\n");
+                pr_info("%s: can't remove xfrm type\n", __func__);
 }
 
 module_init(ah4_init);
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 63e49890ad31..cda37be02f8d 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -73,6 +73,8 @@
  *              Jesper D. Brouer:       Proxy ARP PVLAN RFC 3069 support.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/string.h>
@@ -89,7 +91,6 @@
 #include <linux/etherdevice.h>
 #include <linux/fddidevice.h>
 #include <linux/if_arp.h>
-#include <linux/trdevice.h>
 #include <linux/skbuff.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
@@ -113,7 +114,6 @@
 #include <net/ax25.h>
 #include <net/netrom.h>
 
-#include <asm/system.h>
 #include <linux/uaccess.h>
 
 #include <linux/netfilter_arp.h>
@@ -194,9 +194,6 @@ int arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir)
         case ARPHRD_IEEE802:
                 ip_eth_mc_map(addr, haddr);
                 return 0;
-        case ARPHRD_IEEE802_TR:
-                ip_tr_mc_map(addr, haddr);
-                return 0;
         case ARPHRD_INFINIBAND:
                 ip_ib_mc_map(addr, dev->broadcast, haddr);
                 return 0;
@@ -365,8 +362,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
         probes -= neigh->parms->ucast_probes;
         if (probes < 0) {
                 if (!(neigh->nud_state & NUD_VALID))
-                        printk(KERN_DEBUG
-                               "trying to ucast probe in NUD_INVALID\n");
+                        pr_debug("trying to ucast probe in NUD_INVALID\n");
                 dst_ha = neigh->ha;
                 read_lock_bh(&neigh->lock);
         } else {
@@ -453,7 +449,7 @@ static int arp_set_predefined(int addr_hint, unsigned char *haddr,
 {
         switch (addr_hint) {
         case RTN_LOCAL:
-                printk(KERN_DEBUG "ARP: arp called for own IP address\n");
+                pr_debug("arp called for own IP address\n");
                 memcpy(haddr, dev->dev_addr, dev->addr_len);
                 return 1;
         case RTN_MULTICAST:
@@ -474,7 +470,7 @@ int arp_find(unsigned char *haddr, struct sk_buff *skb)
         struct neighbour *n;
 
         if (!skb_dst(skb)) {
-                printk(KERN_DEBUG "arp_find is called with dst==NULL\n");
+                pr_debug("arp_find is called with dst==NULL\n");
                 kfree_skb(skb);
                 return 1;
         }
@@ -649,12 +645,6 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
                 arp->ar_pro = htons(ETH_P_IP);
                 break;
 #endif
-#if IS_ENABLED(CONFIG_TR)
-        case ARPHRD_IEEE802_TR:
-                arp->ar_hrd = htons(ARPHRD_IEEE802);
-                arp->ar_pro = htons(ETH_P_IP);
-                break;
-#endif
         }
 
         arp->ar_hln = dev->addr_len;
@@ -752,11 +742,10 @@ static int arp_process(struct sk_buff *skb)
                         goto out;
                 break;
         case ARPHRD_ETHER:
-        case ARPHRD_IEEE802_TR:
         case ARPHRD_FDDI:
         case ARPHRD_IEEE802:
                 /*
-                 * ETHERNET, Token Ring and Fibre Channel (which are IEEE 802
+                 * ETHERNET, and Fibre Channel (which are IEEE 802
                  * devices, according to RFC 2625) devices will accept ARP
                  * hardware types of either 1 (Ethernet) or 6 (IEEE 802.2).
                  * This is the case also of FDDI, where the RFC 1390 says that
@@ -889,7 +878,7 @@ static int arp_process(struct sk_buff *skb)
 
         n = __neigh_lookup(&arp_tbl, &sip, dev, 0);
 
-        if (IPV4_DEVCONF_ALL(dev_net(dev), ARP_ACCEPT)) {
+        if (IN_DEV_ARP_ACCEPT(in_dev)) {
                 /* Unsolicited ARP is not accepted by default.
                    It is possible, that this option should be enabled for some
                    devices (strip is candidate)
@@ -1060,7 +1049,7 @@ static int arp_req_set(struct net *net, struct arpreq *r,
         neigh = __neigh_lookup_errno(&arp_tbl, &ip, dev);
         err = PTR_ERR(neigh);
         if (!IS_ERR(neigh)) {
-                unsigned state = NUD_STALE;
+                unsigned int state = NUD_STALE;
                 if (r->arp_flags & ATF_PERM)
                         state = NUD_PERMANENT;
                 err = neigh_update(neigh, (r->arp_flags & ATF_COM) ?
@@ -1072,7 +1061,7 @@ static int arp_req_set(struct net *net, struct arpreq *r,
         return err;
 }
 
-static unsigned arp_state_to_flags(struct neighbour *neigh)
+static unsigned int arp_state_to_flags(struct neighbour *neigh)
 {
         if (neigh->nud_state&NUD_PERMANENT)
                 return ATF_PERM | ATF_COM;
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 86f3b885b4f3..c48adc565e92 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1857,11 +1857,6 @@ static int cipso_v4_genopt(unsigned char *buf, u32 buf_len,
         return CIPSO_V4_HDR_LEN + ret_val;
 }
 
-static void opt_kfree_rcu(struct rcu_head *head)
-{
-        kfree(container_of(head, struct ip_options_rcu, rcu));
-}
-
 /**
  * cipso_v4_sock_setattr - Add a CIPSO option to a socket
  * @sk: the socket
@@ -1938,7 +1933,7 @@ int cipso_v4_sock_setattr(struct sock *sk,
         }
         rcu_assign_pointer(sk_inet->inet_opt, opt);
         if (old)
-                call_rcu(&old->rcu, opt_kfree_rcu);
+                kfree_rcu(old, rcu);
 
         return 0;
 
@@ -2005,7 +2000,7 @@ int cipso_v4_req_setattr(struct request_sock *req,
         req_inet = inet_rsk(req);
         opt = xchg(&req_inet->opt, opt);
         if (opt)
-                call_rcu(&opt->rcu, opt_kfree_rcu);
+                kfree_rcu(opt, rcu);
 
         return 0;
 
@@ -2075,7 +2070,7 @@ static int cipso_v4_delopt(struct ip_options_rcu **opt_ptr)
                  * remove the entire option struct */
                 *opt_ptr = NULL;
                 hdr_delta = opt->opt.optlen;
-                call_rcu(&opt->rcu, opt_kfree_rcu);
+                kfree_rcu(opt, rcu);
         }
 
         return hdr_delta;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index e41c40f48cfe..10e15a144e95 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -27,7 +27,6 @@
 
 
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/bitops.h>
 #include <linux/capability.h>
 #include <linux/module.h>
@@ -218,8 +217,7 @@ void in_dev_finish_destroy(struct in_device *idev)
         WARN_ON(idev->ifa_list);
         WARN_ON(idev->mc_list);
 #ifdef NET_REFCNT_DEBUG
-        printk(KERN_DEBUG "in_dev_finish_destroy: %p=%s\n",
-               idev, dev ? dev->name : "NIL");
+        pr_debug("%s: %p=%s\n", __func__, idev, dev ? dev->name : "NIL");
 #endif
         dev_put(dev);
         if (!idev->dead)
@@ -1079,6 +1077,7 @@ __be32 inet_confirm_addr(struct in_device *in_dev,
 
         return addr;
 }
+EXPORT_SYMBOL(inet_confirm_addr);
 
 /*
  *      Device notifier
@@ -1125,7 +1124,7 @@ skip:
         }
 }
 
-static inline bool inetdev_valid_mtu(unsigned mtu)
+static inline bool inetdev_valid_mtu(unsigned int mtu)
 {
         return mtu >= 68;
 }
@@ -1174,7 +1173,7 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
 
         switch (event) {
         case NETDEV_REGISTER:
-                printk(KERN_DEBUG "inetdev_event: bug\n");
+                pr_debug("%s: bug\n", __func__);
                 RCU_INIT_POINTER(dev->ip_ptr, NULL);
                 break;
         case NETDEV_UP:
@@ -1266,17 +1265,15 @@ static int inet_fill_ifaddr(struct sk_buff *skb, struct in_ifaddr *ifa,
         ifm->ifa_scope = ifa->ifa_scope;
         ifm->ifa_index = ifa->ifa_dev->dev->ifindex;
 
-        if (ifa->ifa_address)
-                NLA_PUT_BE32(skb, IFA_ADDRESS, ifa->ifa_address);
-
-        if (ifa->ifa_local)
-                NLA_PUT_BE32(skb, IFA_LOCAL, ifa->ifa_local);
-
-        if (ifa->ifa_broadcast)
-                NLA_PUT_BE32(skb, IFA_BROADCAST, ifa->ifa_broadcast);
-
-        if (ifa->ifa_label[0])
-                NLA_PUT_STRING(skb, IFA_LABEL, ifa->ifa_label);
+        if ((ifa->ifa_address &&
+             nla_put_be32(skb, IFA_ADDRESS, ifa->ifa_address)) ||
+            (ifa->ifa_local &&
+             nla_put_be32(skb, IFA_LOCAL, ifa->ifa_local)) ||
+            (ifa->ifa_broadcast &&
+             nla_put_be32(skb, IFA_BROADCAST, ifa->ifa_broadcast)) ||
+            (ifa->ifa_label[0] &&
+             nla_put_string(skb, IFA_LABEL, ifa->ifa_label)))
+                goto nla_put_failure;
 
         return nlmsg_end(skb, nlh);
 
@@ -1587,7 +1584,6 @@ static int ipv4_doint_and_flush(ctl_table *ctl, int write,
 static struct devinet_sysctl_table {
         struct ctl_table_header *sysctl_header;
         struct ctl_table devinet_vars[__IPV4_DEVCONF_MAX];
-        char *dev_name;
 } devinet_sysctl = {
         .devinet_vars = {
                 DEVINET_SYSCTL_COMPLEX_ENTRY(FORWARDING, "forwarding",
@@ -1629,16 +1625,7 @@ static int __devinet_sysctl_register(struct net *net, char *dev_name,
 {
         int i;
         struct devinet_sysctl_table *t;
-
-#define DEVINET_CTL_PATH_DEV    3
-
-        struct ctl_path devinet_ctl_path[] = {
-                { .procname = "net",  },
-                { .procname = "ipv4", },
-                { .procname = "conf", },
-                { /* to be set */ },
-                { },
-        };
+        char path[sizeof("net/ipv4/conf/") + IFNAMSIZ];
 
         t = kmemdup(&devinet_sysctl, sizeof(*t), GFP_KERNEL);
         if (!t)
@@ -1650,27 +1637,15 @@ static int __devinet_sysctl_register(struct net *net, char *dev_name,
                 t->devinet_vars[i].extra2 = net;
         }
 
-        /*
-         * Make a copy of dev_name, because '.procname' is regarded as const
-         * by sysctl and we wouldn't want anyone to change it under our feet
-         * (see SIOCSIFNAME).
-         */
-        t->dev_name = kstrdup(dev_name, GFP_KERNEL);
-        if (!t->dev_name)
-                goto free;
-
-        devinet_ctl_path[DEVINET_CTL_PATH_DEV].procname = t->dev_name;
+        snprintf(path, sizeof(path), "net/ipv4/conf/%s", dev_name);
 
-        t->sysctl_header = register_net_sysctl_table(net, devinet_ctl_path,
-                        t->devinet_vars);
+        t->sysctl_header = register_net_sysctl(net, path, t->devinet_vars);
         if (!t->sysctl_header)
-                goto free_procname;
+                goto free;
 
         p->sysctl = t;
         return 0;
 
-free_procname:
-        kfree(t->dev_name);
 free:
         kfree(t);
 out:
@@ -1686,7 +1661,6 @@ static void __devinet_sysctl_unregister(struct ipv4_devconf *cnf)
 
         cnf->sysctl = NULL;
         unregister_net_sysctl_table(t->sysctl_header);
-        kfree(t->dev_name);
         kfree(t);
 }
 
@@ -1716,12 +1690,6 @@ static struct ctl_table ctl_forward_entry[] = {
         },
         { },
 };
-
-static __net_initdata struct ctl_path net_ipv4_path[] = {
-        { .procname = "net", },
-        { .procname = "ipv4", },
-        { },
-};
 #endif
 
 static __net_init int devinet_init_net(struct net *net)
@@ -1767,7 +1735,7 @@ static __net_init int devinet_init_net(struct net *net)
                 goto err_reg_dflt;
 
         err = -ENOMEM;
-        forw_hdr = register_net_sysctl_table(net, net_ipv4_path, tbl);
+        forw_hdr = register_net_sysctl(net, "net/ipv4", tbl);
         if (forw_hdr == NULL)
                 goto err_reg_ctl;
         net->ipv4.forw_hdr = forw_hdr;
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index a5b413416da3..cb982a61536f 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -1,3 +1,5 @@
+#define pr_fmt(fmt) "IPsec: " fmt
+
 #include <crypto/aead.h>
 #include <crypto/authenc.h>
 #include <linux/err.h>
@@ -457,28 +459,22 @@ static u32 esp4_get_mtu(struct xfrm_state *x, int mtu)
         struct esp_data *esp = x->data;
         u32 blksize = ALIGN(crypto_aead_blocksize(esp->aead), 4);
         u32 align = max_t(u32, blksize, esp->padlen);
-        u32 rem;
-
-        mtu -= x->props.header_len + crypto_aead_authsize(esp->aead);
-        rem = mtu & (align - 1);
-        mtu &= ~(align - 1);
+        unsigned int net_adj;
 
         switch (x->props.mode) {
-        case XFRM_MODE_TUNNEL:
-                break;
-        default:
         case XFRM_MODE_TRANSPORT:
-                /* The worst case */
-                mtu -= blksize - 4;
-                mtu += min_t(u32, blksize - 4, rem);
-                break;
         case XFRM_MODE_BEET:
-                /* The worst case. */
-                mtu += min_t(u32, IPV4_BEET_PHMAXLEN, rem);
+                net_adj = sizeof(struct iphdr);
+                break;
+        case XFRM_MODE_TUNNEL:
+                net_adj = 0;
                 break;
+        default:
+                BUG();
         }
 
-        return mtu - 2;
+        return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
+                 net_adj) & ~(align - 1)) + (net_adj - 2);
 }
 
 static void esp4_err(struct sk_buff *skb, u32 info)
@@ -706,11 +702,11 @@ static const struct net_protocol esp4_protocol = {
 static int __init esp4_init(void)
 {
         if (xfrm_register_type(&esp_type, AF_INET) < 0) {
-                printk(KERN_INFO "ip esp init: can't add xfrm type\n");
+                pr_info("%s: can't add xfrm type\n", __func__);
                 return -EAGAIN;
         }
         if (inet_add_protocol(&esp4_protocol, IPPROTO_ESP) < 0) {
-                printk(KERN_INFO "ip esp init: can't add protocol\n");
+                pr_info("%s: can't add protocol\n", __func__);
                 xfrm_unregister_type(&esp_type, AF_INET);
                 return -EAGAIN;
         }
@@ -720,9 +716,9 @@ static int __init esp4_init(void)
 static void __exit esp4_fini(void)
 {
         if (inet_del_protocol(&esp4_protocol, IPPROTO_ESP) < 0)
-                printk(KERN_INFO "ip esp close: can't remove protocol\n");
+                pr_info("%s: can't remove protocol\n", __func__);
         if (xfrm_unregister_type(&esp_type, AF_INET) < 0)
-                printk(KERN_INFO "ip esp close: can't remove xfrm type\n");
+                pr_info("%s: can't remove xfrm type\n", __func__);
 }
 
 module_init(esp4_init);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 92fc5f69f5da..3854411fa37c 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -15,7 +15,6 @@
 
 #include <linux/module.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/bitops.h>
 #include <linux/capability.h>
 #include <linux/types.h>
@@ -137,13 +136,13 @@ static void fib_flush(struct net *net)
  * Find address type as if only "dev" was present in the system. If
  * on_dev is NULL then all interfaces are taken into consideration.
  */
-static inline unsigned __inet_dev_addr_type(struct net *net,
-                                            const struct net_device *dev,
-                                            __be32 addr)
+static inline unsigned int __inet_dev_addr_type(struct net *net,
+                                                const struct net_device *dev,
+                                                __be32 addr)
 {
         struct flowi4           fl4 = { .daddr = addr };
         struct fib_result       res;
-        unsigned ret = RTN_BROADCAST;
+        unsigned int ret = RTN_BROADCAST;
         struct fib_table *local_table;
 
         if (ipv4_is_zeronet(addr) || ipv4_is_lbcast(addr))
@@ -695,7 +694,7 @@ void fib_add_ifaddr(struct in_ifaddr *ifa)
         if (ifa->ifa_flags & IFA_F_SECONDARY) {
                 prim = inet_ifa_byprefix(in_dev, prefix, mask);
                 if (prim == NULL) {
-                        printk(KERN_WARNING "fib_add_ifaddr: bug: prim == NULL\n");
+                        pr_warn("%s: bug: prim == NULL\n", __func__);
                         return;
                 }
         }
@@ -741,7 +740,7 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim)
 #define BRD_OK          2
 #define BRD0_OK         4
 #define BRD1_OK         8
-        unsigned ok = 0;
+        unsigned int ok = 0;
         int subnet = 0;         /* Primary network */
         int gone = 1;           /* Address is missing */
         int same_prefsrc = 0;   /* Another primary with same IP */
@@ -749,11 +748,11 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim)
         if (ifa->ifa_flags & IFA_F_SECONDARY) {
                 prim = inet_ifa_byprefix(in_dev, any, ifa->ifa_mask);
                 if (prim == NULL) {
-                        printk(KERN_WARNING "fib_del_ifaddr: bug: prim == NULL\n");
+                        pr_warn("%s: bug: prim == NULL\n", __func__);
                         return;
                 }
                 if (iprim && iprim != prim) {
-                        printk(KERN_WARNING "fib_del_ifaddr: bug: iprim != prim\n");
+                        pr_warn("%s: bug: iprim != prim\n", __func__);
                         return;
                 }
         } else if (!ipv4_is_zeronet(any) &&
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 799fc790b3cf..2d043f71ef70 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -221,15 +221,15 @@ static int fib4_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
         frh->src_len = rule4->src_len;
         frh->tos = rule4->tos;
 
-        if (rule4->dst_len)
-                NLA_PUT_BE32(skb, FRA_DST, rule4->dst);
-
-        if (rule4->src_len)
-                NLA_PUT_BE32(skb, FRA_SRC, rule4->src);
-
+        if ((rule4->dst_len &&
+             nla_put_be32(skb, FRA_DST, rule4->dst)) ||
+            (rule4->src_len &&
+             nla_put_be32(skb, FRA_SRC, rule4->src)))
+                goto nla_put_failure;
 #ifdef CONFIG_IP_ROUTE_CLASSID
-        if (rule4->tclassid)
-                NLA_PUT_U32(skb, FRA_FLOW, rule4->tclassid);
+        if (rule4->tclassid &&
+            nla_put_u32(skb, FRA_FLOW, rule4->tclassid))
+                goto nla_put_failure;
 #endif
         return 0;
 
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 80106d89d548..e5b7182fa099 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -14,7 +14,6 @@
  */
 
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/bitops.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
@@ -146,6 +145,12 @@ static void free_fib_info_rcu(struct rcu_head *head)
 {
         struct fib_info *fi = container_of(head, struct fib_info, rcu);
 
+        change_nexthops(fi) {
+                if (nexthop_nh->nh_dev)
+                        dev_put(nexthop_nh->nh_dev);
+        } endfor_nexthops(fi);
+
+        release_net(fi->fib_net);
         if (fi->fib_metrics != (u32 *) dst_default_metrics)
                 kfree(fi->fib_metrics);
         kfree(fi);
@@ -154,16 +159,10 @@ static void free_fib_info_rcu(struct rcu_head *head)
 void free_fib_info(struct fib_info *fi)
 {
         if (fi->fib_dead == 0) {
-                pr_warning("Freeing alive fib_info %p\n", fi);
+                pr_warn("Freeing alive fib_info %p\n", fi);
                 return;
         }
-        change_nexthops(fi) {
-                if (nexthop_nh->nh_dev)
-                        dev_put(nexthop_nh->nh_dev);
-                nexthop_nh->nh_dev = NULL;
-        } endfor_nexthops(fi);
         fib_info_cnt--;
-        release_net(fi->fib_net);
         call_rcu(&fi->rcu, free_fib_info_rcu);
 }
 
@@ -932,33 +931,36 @@ int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
                 rtm->rtm_table = tb_id;
         else
                 rtm->rtm_table = RT_TABLE_COMPAT;
-        NLA_PUT_U32(skb, RTA_TABLE, tb_id);
+        if (nla_put_u32(skb, RTA_TABLE, tb_id))
+                goto nla_put_failure;
         rtm->rtm_type = type;
         rtm->rtm_flags = fi->fib_flags;
         rtm->rtm_scope = fi->fib_scope;
         rtm->rtm_protocol = fi->fib_protocol;
 
-        if (rtm->rtm_dst_len)
-                NLA_PUT_BE32(skb, RTA_DST, dst);
-
-        if (fi->fib_priority)
-                NLA_PUT_U32(skb, RTA_PRIORITY, fi->fib_priority);
-
+        if (rtm->rtm_dst_len &&
+            nla_put_be32(skb, RTA_DST, dst))
+                goto nla_put_failure;
+        if (fi->fib_priority &&
+            nla_put_u32(skb, RTA_PRIORITY, fi->fib_priority))
+                goto nla_put_failure;
         if (rtnetlink_put_metrics(skb, fi->fib_metrics) < 0)
                 goto nla_put_failure;
 
-        if (fi->fib_prefsrc)
-                NLA_PUT_BE32(skb, RTA_PREFSRC, fi->fib_prefsrc);
-
+        if (fi->fib_prefsrc &&
+            nla_put_be32(skb, RTA_PREFSRC, fi->fib_prefsrc))
+                goto nla_put_failure;
         if (fi->fib_nhs == 1) {
-                if (fi->fib_nh->nh_gw)
-                        NLA_PUT_BE32(skb, RTA_GATEWAY, fi->fib_nh->nh_gw);
-
-                if (fi->fib_nh->nh_oif)
-                        NLA_PUT_U32(skb, RTA_OIF, fi->fib_nh->nh_oif);
+                if (fi->fib_nh->nh_gw &&
+                    nla_put_be32(skb, RTA_GATEWAY, fi->fib_nh->nh_gw))
+                        goto nla_put_failure;
+                if (fi->fib_nh->nh_oif &&
+                    nla_put_u32(skb, RTA_OIF, fi->fib_nh->nh_oif))
+                        goto nla_put_failure;
 #ifdef CONFIG_IP_ROUTE_CLASSID
-                if (fi->fib_nh[0].nh_tclassid)
-                        NLA_PUT_U32(skb, RTA_FLOW, fi->fib_nh[0].nh_tclassid);
+                if (fi->fib_nh[0].nh_tclassid &&
+                    nla_put_u32(skb, RTA_FLOW, fi->fib_nh[0].nh_tclassid))
+                        goto nla_put_failure;
 #endif
         }
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
@@ -979,11 +981,13 @@ int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
                         rtnh->rtnh_hops = nh->nh_weight - 1;
                         rtnh->rtnh_ifindex = nh->nh_oif;
 
-                        if (nh->nh_gw)
-                                NLA_PUT_BE32(skb, RTA_GATEWAY, nh->nh_gw);
+                        if (nh->nh_gw &&
+                            nla_put_be32(skb, RTA_GATEWAY, nh->nh_gw))
+                                goto nla_put_failure;
 #ifdef CONFIG_IP_ROUTE_CLASSID
-                        if (nh->nh_tclassid)
-                                NLA_PUT_U32(skb, RTA_FLOW, nh->nh_tclassid);
+                        if (nh->nh_tclassid &&
+                            nla_put_u32(skb, RTA_FLOW, nh->nh_tclassid))
+                                goto nla_put_failure;
 #endif
                         /* length of rtnetlink header + attributes */
                         rtnh->rtnh_len = nlmsg_get_pos(skb) - (void *) rtnh;
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 2b555a5521e0..30b88d7b4bd6 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -51,7 +51,6 @@
 #define VERSION "0.409"
 
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/bitops.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
@@ -1170,9 +1169,8 @@ static struct list_head *fib_insert_node(struct trie *t, u32 key, int plen)
         }
 
         if (tp && tp->pos + tp->bits > 32)
-                pr_warning("fib_trie"
-                           " tp=%p pos=%d, bits=%d, key=%0x plen=%d\n",
-                           tp, tp->pos, tp->bits, key, plen);
+                pr_warn("fib_trie tp=%p pos=%d, bits=%d, key=%0x plen=%d\n",
+                        tp, tp->pos, tp->bits, key, plen);
 
         /* Rebalance the trie */
 
@@ -1372,6 +1370,8 @@ static int check_leaf(struct fib_table *tb, struct trie *t, struct leaf *l,
 
                         if (fa->fa_tos && fa->fa_tos != flp->flowi4_tos)
                                 continue;
+                        if (fi->fib_dead)
+                                continue;
                         if (fa->fa_info->fib_scope < flp->flowi4_scope)
                                 continue;
                         fib_alias_accessed(fa);
diff --git a/net/ipv4/gre.c b/net/ipv4/gre.c
index 8cb1ebb7cd74..42a491055c76 100644
--- a/net/ipv4/gre.c
+++ b/net/ipv4/gre.c
@@ -10,6 +10,8 @@
  *
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/kmod.h>
@@ -118,10 +120,10 @@ static const struct net_protocol net_gre_protocol = {
 
 static int __init gre_init(void)
 {
-        pr_info("GRE over IPv4 demultiplexor driver");
+        pr_info("GRE over IPv4 demultiplexor driver\n");
 
         if (inet_add_protocol(&net_gre_protocol, IPPROTO_GRE) < 0) {
-                pr_err("gre: can't add protocol\n");
+                pr_err("can't add protocol\n");
                 return -EAGAIN;
         }
 
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index ab188ae12fd9..c75efbdc71cb 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -62,6 +62,8 @@
  *
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/jiffies.h>
@@ -89,7 +91,6 @@
 #include <linux/errno.h>
 #include <linux/timer.h>
 #include <linux/init.h>
-#include <asm/system.h>
 #include <asm/uaccess.h>
 #include <net/checksum.h>
 #include <net/xfrm.h>
@@ -670,7 +671,7 @@ static void icmp_unreach(struct sk_buff *skb)
                         break;
                 case ICMP_FRAG_NEEDED:
                         if (ipv4_config.no_pmtu_disc) {
-                                LIMIT_NETDEBUG(KERN_INFO "ICMP: %pI4: fragmentation needed and DF set.\n",
+                                LIMIT_NETDEBUG(KERN_INFO pr_fmt("%pI4: fragmentation needed and DF set\n"),
                                                &iph->daddr);
                         } else {
                                 info = ip_rt_frag_needed(net, iph,
@@ -681,7 +682,7 @@ static void icmp_unreach(struct sk_buff *skb)
                         }
                         break;
                 case ICMP_SR_FAILED:
-                        LIMIT_NETDEBUG(KERN_INFO "ICMP: %pI4: Source Route Failed.\n",
+                        LIMIT_NETDEBUG(KERN_INFO pr_fmt("%pI4: Source Route Failed\n"),
                                        &iph->daddr);
                         break;
                 default:
@@ -712,14 +713,10 @@ static void icmp_unreach(struct sk_buff *skb)
 
         if (!net->ipv4.sysctl_icmp_ignore_bogus_error_responses &&
             inet_addr_type(net, iph->daddr) == RTN_BROADCAST) {
-                if (net_ratelimit())
-                        printk(KERN_WARNING "%pI4 sent an invalid ICMP "
-                                            "type %u, code %u "
-                                            "error to a broadcast: %pI4 on %s\n",
-                               &ip_hdr(skb)->saddr,
-                               icmph->type, icmph->code,
-                               &iph->daddr,
-                               skb->dev->name);
+                net_warn_ratelimited("%pI4 sent an invalid ICMP type %u, code %u error to a broadcast: %pI4 on %s\n",
+                                     &ip_hdr(skb)->saddr,
+                                     icmph->type, icmph->code,
+                                     &iph->daddr, skb->dev->name);
                 goto out;
         }
 
@@ -908,8 +905,7 @@ out_err:
 static void icmp_address(struct sk_buff *skb)
 {
 #if 0
-        if (net_ratelimit())
-                printk(KERN_DEBUG "a guy asks for address mask. Who is it?\n");
+        net_dbg_ratelimited("a guy asks for address mask. Who is it?\n");
 #endif
 }
 
@@ -945,10 +941,10 @@ static void icmp_address_reply(struct sk_buff *skb)
                             inet_ifa_match(ip_hdr(skb)->saddr, ifa))
                                 break;
                 }
-                if (!ifa && net_ratelimit()) {
-                        printk(KERN_INFO "Wrong address mask %pI4 from %s/%pI4\n",
-                               mp, dev->name, &ip_hdr(skb)->saddr);
-                }
+                if (!ifa)
+                        net_info_ratelimited("Wrong address mask %pI4 from %s/%pI4\n",
+                                             mp,
+                                             dev->name, &ip_hdr(skb)->saddr);
         }
 }
 
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 450e5d21ed2a..6699f23e6f55 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -73,7 +73,6 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/jiffies.h>
@@ -345,10 +344,10 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
         pip->protocol = IPPROTO_IGMP;
         pip->tot_len  = 0;      /* filled in later */
         ip_select_ident(pip, &rt->dst, NULL);
-        ((u8*)&pip[1])[0] = IPOPT_RA;
-        ((u8*)&pip[1])[1] = 4;
-        ((u8*)&pip[1])[2] = 0;
-        ((u8*)&pip[1])[3] = 0;
+        ((u8 *)&pip[1])[0] = IPOPT_RA;
+        ((u8 *)&pip[1])[1] = 4;
+        ((u8 *)&pip[1])[2] = 0;
+        ((u8 *)&pip[1])[3] = 0;
 
         skb->transport_header = skb->network_header + sizeof(struct iphdr) + 4;
         skb_put(skb, sizeof(*pig));
@@ -689,10 +688,10 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
         iph->saddr    = fl4.saddr;
         iph->protocol = IPPROTO_IGMP;
         ip_select_ident(iph, &rt->dst, NULL);
-        ((u8*)&iph[1])[0] = IPOPT_RA;
-        ((u8*)&iph[1])[1] = 4;
-        ((u8*)&iph[1])[2] = 0;
-        ((u8*)&iph[1])[3] = 0;
+        ((u8 *)&iph[1])[0] = IPOPT_RA;
+        ((u8 *)&iph[1])[1] = 4;
+        ((u8 *)&iph[1])[2] = 0;
+        ((u8 *)&iph[1])[3] = 0;
 
         ih = (struct igmphdr *)skb_put(skb, sizeof(struct igmphdr));
         ih->type = type;
@@ -775,7 +774,7 @@ static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
                         if (psf->sf_count[MCAST_INCLUDE] ||
                             pmc->sfcount[MCAST_EXCLUDE] !=
                             psf->sf_count[MCAST_EXCLUDE])
-                                continue;
+                                break;
                         if (srcs[i] == psf->sf_inaddr) {
                                 scount++;
                                 break;
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 19d66cefd7d3..f9ee7417f6a0 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -42,7 +42,8 @@ EXPORT_SYMBOL(sysctl_local_reserved_ports);
 
 void inet_get_local_port_range(int *low, int *high)
 {
-        unsigned seq;
+        unsigned int seq;
+
         do {
                 seq = read_seqbegin(&sysctl_local_ports.lock);
 
@@ -53,7 +54,7 @@ void inet_get_local_port_range(int *low, int *high)
 EXPORT_SYMBOL(inet_get_local_port_range);
 
 int inet_csk_bind_conflict(const struct sock *sk,
-                           const struct inet_bind_bucket *tb)
+                           const struct inet_bind_bucket *tb, bool relax)
 {
         struct sock *sk2;
         struct hlist_node *node;
@@ -79,6 +80,14 @@ int inet_csk_bind_conflict(const struct sock *sk,
                                     sk2_rcv_saddr == sk_rcv_saddr(sk))
                                         break;
                         }
+                        if (!relax && reuse && sk2->sk_reuse &&
+                            sk2->sk_state != TCP_LISTEN) {
+                                const __be32 sk2_rcv_saddr = sk_rcv_saddr(sk2);
+
+                                if (!sk2_rcv_saddr || !sk_rcv_saddr(sk) ||
+                                    sk2_rcv_saddr == sk_rcv_saddr(sk))
+                                        break;
+                        }
                 }
         }
         return node != NULL;
@@ -122,12 +131,13 @@ again:
                                             (tb->num_owners < smallest_size || smallest_size == -1)) {
                                                 smallest_size = tb->num_owners;
                                                 smallest_rover = rover;
-                                                if (atomic_read(&hashinfo->bsockets) > (high - low) + 1) {
+                                                if (atomic_read(&hashinfo->bsockets) > (high - low) + 1 &&
+                                                    !inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb, false)) {
                                                         snum = smallest_rover;
                                                         goto tb_found;
                                                 }
                                         }
-                                        if (!inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
+                                        if (!inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb, false)) {
                                                 snum = rover;
                                                 goto tb_found;
                                         }
@@ -172,18 +182,22 @@ have_snum:
         goto tb_not_found;
 tb_found:
         if (!hlist_empty(&tb->owners)) {
+                if (sk->sk_reuse == SK_FORCE_REUSE)
+                        goto success;
+
                 if (tb->fastreuse > 0 &&
                     sk->sk_reuse && sk->sk_state != TCP_LISTEN &&
                     smallest_size == -1) {
                         goto success;
                 } else {
                         ret = 1;
-                        if (inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
+                        if (inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb, true)) {
                                 if (sk->sk_reuse && sk->sk_state != TCP_LISTEN &&
                                     smallest_size != -1 && --attempts >= 0) {
                                         spin_unlock(&head->lock);
                                         goto again;
                                 }
+
                                 goto fail_unlock;
                         }
                 }
@@ -363,7 +377,8 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
 
         flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark,
                            RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
-                           sk->sk_protocol, inet_sk_flowi_flags(sk),
+                           sk->sk_protocol,
+                           inet_sk_flowi_flags(sk) & ~FLOWI_FLAG_PRECOW_METRICS,
                            (opt && opt->opt.srr) ? opt->opt.faddr : ireq->rmt_addr,
                            ireq->loc_addr, ireq->rmt_port, inet_sk(sk)->inet_sport);
         security_req_classify_flow(req, flowi4_to_flowi(fl4));
@@ -514,7 +529,7 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
 
         /* Normally all the openreqs are young and become mature
          * (i.e. converted to established socket) for first timeout.
-         * If synack was not acknowledged for 3 seconds, it means
+         * If synack was not acknowledged for 1 second, it means
          * one of the following things: synack was lost, ack was lost,
          * rtt is high or nobody planned to ack (i.e. synflood).
          * When server is a bit loaded, queue is populated with old
@@ -555,8 +570,7 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
                                 syn_ack_recalc(req, thresh, max_retries,
                                                queue->rskq_defer_accept,
                                                &expire, &resend);
-                                if (req->rsk_ops->syn_ack_timeout)
-                                        req->rsk_ops->syn_ack_timeout(parent, req);
+                                req->rsk_ops->syn_ack_timeout(parent, req);
                                 if (!expire &&
                                     (!resend ||
                                      !req->rsk_ops->rtx_syn_ack(parent, req, NULL) ||
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index fcf281819cd4..46d1e7199a8c 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -141,7 +141,7 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
                         goto rtattr_failure;
 
         if (icsk == NULL) {
-                r->idiag_rqueue = r->idiag_wqueue = 0;
+                handler->idiag_get_info(sk, r, NULL);
                 goto out;
         }
 
@@ -960,9 +960,12 @@ static int inet_diag_rcv_msg_compat(struct sk_buff *skb, struct nlmsghdr *nlh)
                             inet_diag_bc_audit(nla_data(attr), nla_len(attr)))
                                 return -EINVAL;
                 }
-
-                return netlink_dump_start(sock_diag_nlsk, skb, nlh,
-                                          inet_diag_dump_compat, NULL, 0);
+                {
+                        struct netlink_dump_control c = {
+                                .dump = inet_diag_dump_compat,
+                        };
+                        return netlink_dump_start(sock_diag_nlsk, skb, nlh, &c);
+                }
         }
 
         return inet_diag_get_exact_compat(skb, nlh);
@@ -985,20 +988,23 @@ static int inet_diag_handler_dump(struct sk_buff *skb, struct nlmsghdr *h)
                             inet_diag_bc_audit(nla_data(attr), nla_len(attr)))
                                 return -EINVAL;
                 }
-
-                return netlink_dump_start(sock_diag_nlsk, skb, h,
-                                          inet_diag_dump, NULL, 0);
+                {
+                        struct netlink_dump_control c = {
+                                .dump = inet_diag_dump,
+                        };
+                        return netlink_dump_start(sock_diag_nlsk, skb, h, &c);
+                }
         }
 
         return inet_diag_get_exact(skb, h, (struct inet_diag_req_v2 *)NLMSG_DATA(h));
 }
 
-static struct sock_diag_handler inet_diag_handler = {
+static const struct sock_diag_handler inet_diag_handler = {
         .family = AF_INET,
         .dump = inet_diag_handler_dump,
 };
 
-static struct sock_diag_handler inet6_diag_handler = {
+static const struct sock_diag_handler inet6_diag_handler = {
         .family = AF_INET6,
         .dump = inet_diag_handler_dump,
 };
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 984ec656b03b..7880af970208 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -217,7 +217,7 @@ begin:
 }
 EXPORT_SYMBOL_GPL(__inet_lookup_listener);
 
-struct sock * __inet_lookup_established(struct net *net,
+struct sock *__inet_lookup_established(struct net *net,
                                   struct inet_hashinfo *hashinfo,
                                   const __be32 saddr, const __be16 sport,
                                   const __be32 daddr, const u16 hnum,
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 89168c6351ff..2784db3155fb 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -89,8 +89,8 @@ static void __inet_twsk_kill(struct inet_timewait_sock *tw,
 
 #ifdef SOCK_REFCNT_DEBUG
         if (atomic_read(&tw->tw_refcnt) != 1) {
-                printk(KERN_DEBUG "%s timewait_sock %p refcnt=%d\n",
-                       tw->tw_prot->name, tw, atomic_read(&tw->tw_refcnt));
+                pr_debug("%s timewait_sock %p refcnt=%d\n",
+                         tw->tw_prot->name, tw, atomic_read(&tw->tw_refcnt));
         }
 #endif
         while (refcnt) {
@@ -263,7 +263,7 @@ rescan:
 void inet_twdr_hangman(unsigned long data)
 {
         struct inet_timewait_death_row *twdr;
-        int unsigned need_timer;
+        unsigned int need_timer;
 
         twdr = (struct inet_timewait_death_row *)data;
         spin_lock(&twdr->death_lock);
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 29a07b6c7168..e5c44fc586ab 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -41,7 +41,7 @@
 
 static int ip_forward_finish(struct sk_buff *skb)
 {
-        struct ip_options * opt = &(IPCB(skb)->opt);
+        struct ip_options *opt  = &(IPCB(skb)->opt);
 
         IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS);
 
@@ -55,7 +55,7 @@ int ip_forward(struct sk_buff *skb)
 {
         struct iphdr *iph;      /* Our header */
         struct rtable *rt;      /* Route we use */
-        struct ip_options * opt = &(IPCB(skb)->opt);
+        struct ip_options *opt  = &(IPCB(skb)->opt);
 
         if (skb_warn_if_lro(skb))
                 goto drop;
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 1f23a57aa9e6..9dbd3dd6022d 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -20,6 +20,8 @@
  *              Patrick McHardy :       LRU queue of frag heads for evictor.
  */
 
+#define pr_fmt(fmt) "IPv4: " fmt
+
 #include <linux/compiler.h>
 #include <linux/module.h>
 #include <linux/types.h>
@@ -146,17 +148,17 @@ static unsigned int ip4_hashfn(struct inet_frag_queue *q)
         return ipqhashfn(ipq->id, ipq->saddr, ipq->daddr, ipq->protocol);
 }
 
-static int ip4_frag_match(struct inet_frag_queue *q, void *a)
+static bool ip4_frag_match(struct inet_frag_queue *q, void *a)
 {
         struct ipq *qp;
         struct ip4_create_arg *arg = a;
 
         qp = container_of(q, struct ipq, q);
         return  qp->id == arg->iph->id &&
-                        qp->saddr == arg->iph->saddr &&
-                        qp->daddr == arg->iph->daddr &&
-                        qp->protocol == arg->iph->protocol &&
-                        qp->user == arg->user;
+                qp->saddr == arg->iph->saddr &&
+                qp->daddr == arg->iph->daddr &&
+                qp->protocol == arg->iph->protocol &&
+                qp->user == arg->user;
 }
 
 /* Memory Tracking Functions. */
@@ -299,7 +301,7 @@ static inline struct ipq *ip_find(struct net *net, struct iphdr *iph, u32 user)
         return container_of(q, struct ipq, q);
 
 out_nomem:
-        LIMIT_NETDEBUG(KERN_ERR "ip_frag_create: no memory left !\n");
+        LIMIT_NETDEBUG(KERN_ERR pr_fmt("ip_frag_create: no memory left !\n"));
         return NULL;
 }
 
@@ -543,6 +545,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
         int len;
         int ihlen;
         int err;
+        int sum_truesize;
         u8 ecn;
 
         ipq_kill(qp);
@@ -567,7 +570,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                 skb_morph(head, qp->q.fragments);
                 head->next = qp->q.fragments->next;
 
-                kfree_skb(qp->q.fragments);
+                consume_skb(qp->q.fragments);
                 qp->q.fragments = head;
         }
 
@@ -609,19 +612,32 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                 atomic_add(clone->truesize, &qp->q.net->mem);
         }
 
-        skb_shinfo(head)->frag_list = head->next;
         skb_push(head, head->data - skb_network_header(head));
 
-        for (fp=head->next; fp; fp = fp->next) {
-                head->data_len += fp->len;
-                head->len += fp->len;
+        sum_truesize = head->truesize;
+        for (fp = head->next; fp;) {
+                bool headstolen;
+                int delta;
+                struct sk_buff *next = fp->next;
+
+                sum_truesize += fp->truesize;
                 if (head->ip_summed != fp->ip_summed)
                         head->ip_summed = CHECKSUM_NONE;
                 else if (head->ip_summed == CHECKSUM_COMPLETE)
                         head->csum = csum_add(head->csum, fp->csum);
-                head->truesize += fp->truesize;
+
+                if (skb_try_coalesce(head, fp, &headstolen, &delta)) {
+                        kfree_skb_partial(fp, headstolen);
+                } else {
+                        if (!skb_shinfo(head)->frag_list)
+                                skb_shinfo(head)->frag_list = fp;
+                        head->data_len += fp->len;
+                        head->len += fp->len;
+                        head->truesize += fp->truesize;
+                }
+                fp = next;
         }
-        atomic_sub(head->truesize, &qp->q.net->mem);
+        atomic_sub(sum_truesize, &qp->q.net->mem);
 
         head->next = NULL;
         head->dev = dev;
@@ -637,14 +653,12 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
         return 0;
 
 out_nomem:
-        LIMIT_NETDEBUG(KERN_ERR "IP: queue_glue: no memory for gluing "
-                              "queue %p\n", qp);
+        LIMIT_NETDEBUG(KERN_ERR pr_fmt("queue_glue: no memory for gluing queue %p\n"),
+                       qp);
         err = -ENOMEM;
         goto out_fail;
 out_oversize:
-        if (net_ratelimit())
-                printk(KERN_INFO "Oversized IP packet from %pI4.\n",
-                        &qp->saddr);
+        net_info_ratelimited("Oversized IP packet from %pI4\n", &qp->saddr);
 out_fail:
         IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS);
         return err;
@@ -781,7 +795,7 @@ static int __net_init ip4_frags_ns_ctl_register(struct net *net)
                 table[2].data = &net->ipv4.frags.timeout;
         }
 
-        hdr = register_net_sysctl_table(net, net_ipv4_ctl_path, table);
+        hdr = register_net_sysctl(net, "net/ipv4", table);
         if (hdr == NULL)
                 goto err_reg;
 
@@ -806,7 +820,7 @@ static void __net_exit ip4_frags_ns_ctl_unregister(struct net *net)
 
 static void ip4_frags_ctl_register(void)
 {
-        register_net_sysctl_rotable(net_ipv4_ctl_path, ip4_frags_ctl_table);
+        register_net_sysctl(&init_net, "net/ipv4", ip4_frags_ctl_table);
 }
 #else
 static inline int ip4_frags_ns_ctl_register(struct net *net)
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 38673d2860e2..f49047b79609 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -10,6 +10,8 @@
  *
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/capability.h>
 #include <linux/module.h>
 #include <linux/types.h>
@@ -167,37 +169,56 @@ struct ipgre_net {
 
 /* often modified stats are per cpu, other are shared (netdev->stats) */
 struct pcpu_tstats {
-        unsigned long   rx_packets;
-        unsigned long   rx_bytes;
-        unsigned long   tx_packets;
-        unsigned long   tx_bytes;
-} __attribute__((aligned(4*sizeof(unsigned long))));
+        u64     rx_packets;
+        u64     rx_bytes;
+        u64     tx_packets;
+        u64     tx_bytes;
+        struct u64_stats_sync   syncp;
+};
 
-static struct net_device_stats *ipgre_get_stats(struct net_device *dev)
+static struct rtnl_link_stats64 *ipgre_get_stats64(struct net_device *dev,
+                                                   struct rtnl_link_stats64 *tot)
 {
-        struct pcpu_tstats sum = { 0 };
         int i;
 
         for_each_possible_cpu(i) {
                 const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
-
-                sum.rx_packets += tstats->rx_packets;
-                sum.rx_bytes   += tstats->rx_bytes;
-                sum.tx_packets += tstats->tx_packets;
-                sum.tx_bytes   += tstats->tx_bytes;
+                u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
+                unsigned int start;
+
+                do {
+                        start = u64_stats_fetch_begin_bh(&tstats->syncp);
+                        rx_packets = tstats->rx_packets;
+                        tx_packets = tstats->tx_packets;
+                        rx_bytes = tstats->rx_bytes;
+                        tx_bytes = tstats->tx_bytes;
+                } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
+
+                tot->rx_packets += rx_packets;
+                tot->tx_packets += tx_packets;
+                tot->rx_bytes   += rx_bytes;
+                tot->tx_bytes   += tx_bytes;
         }
-        dev->stats.rx_packets = sum.rx_packets;
-        dev->stats.rx_bytes   = sum.rx_bytes;
-        dev->stats.tx_packets = sum.tx_packets;
-        dev->stats.tx_bytes   = sum.tx_bytes;
-        return &dev->stats;
+
+        tot->multicast = dev->stats.multicast;
+        tot->rx_crc_errors = dev->stats.rx_crc_errors;
+        tot->rx_fifo_errors = dev->stats.rx_fifo_errors;
+        tot->rx_length_errors = dev->stats.rx_length_errors;
+        tot->rx_errors = dev->stats.rx_errors;
+        tot->tx_fifo_errors = dev->stats.tx_fifo_errors;
+        tot->tx_carrier_errors = dev->stats.tx_carrier_errors;
+        tot->tx_dropped = dev->stats.tx_dropped;
+        tot->tx_aborted_errors = dev->stats.tx_aborted_errors;
+        tot->tx_errors = dev->stats.tx_errors;
+
+        return tot;
 }
 
 /* Given src, dst and key, find appropriate for input tunnel. */
 
-static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
-                                              __be32 remote, __be32 local,
-                                              __be32 key, __be16 gre_proto)
+static struct ip_tunnel *ipgre_tunnel_lookup(struct net_device *dev,
+                                             __be32 remote, __be32 local,
+                                             __be32 key, __be16 gre_proto)
 {
         struct net *net = dev_net(dev);
         int link = dev->ifindex;
@@ -462,7 +483,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
  */
 
         const struct iphdr *iph = (const struct iphdr *)skb->data;
-        __be16       *p = (__be16*)(skb->data+(iph->ihl<<2));
+        __be16       *p = (__be16 *)(skb->data+(iph->ihl<<2));
         int grehlen = (iph->ihl<<2) + 4;
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
@@ -572,7 +593,7 @@ static int ipgre_rcv(struct sk_buff *skb)
 
         iph = ip_hdr(skb);
         h = skb->data;
-        flags = *(__be16*)h;
+        flags = *(__be16 *)h;
 
         if (flags&(GRE_CSUM|GRE_KEY|GRE_ROUTING|GRE_SEQ|GRE_VERSION)) {
                 /* - Version must be 0.
@@ -596,11 +617,11 @@ static int ipgre_rcv(struct sk_buff *skb)
                         offset += 4;
                 }
                 if (flags&GRE_KEY) {
-                        key = *(__be32*)(h + offset);
+                        key = *(__be32 *)(h + offset);
                         offset += 4;
                 }
                 if (flags&GRE_SEQ) {
-                        seqno = ntohl(*(__be32*)(h + offset));
+                        seqno = ntohl(*(__be32 *)(h + offset));
                         offset += 4;
                 }
         }
@@ -670,8 +691,10 @@ static int ipgre_rcv(struct sk_buff *skb)
                 }
 
                 tstats = this_cpu_ptr(tunnel->dev->tstats);
+                u64_stats_update_begin(&tstats->syncp);
                 tstats->rx_packets++;
                 tstats->rx_bytes += skb->len;
+                u64_stats_update_end(&tstats->syncp);
 
                 __skb_tunnel_rx(skb, tunnel->dev);
 
@@ -730,15 +753,16 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
 
                 if (skb->protocol == htons(ETH_P_IP)) {
                         rt = skb_rtable(skb);
-                        if ((dst = rt->rt_gateway) == 0)
-                                goto tx_error_icmp;
+                        dst = rt->rt_gateway;
                 }
 #if IS_ENABLED(CONFIG_IPV6)
                 else if (skb->protocol == htons(ETH_P_IPV6)) {
-                        struct neighbour *neigh = dst_get_neighbour_noref(skb_dst(skb));
                         const struct in6_addr *addr6;
+                        struct neighbour *neigh;
+                        bool do_tx_error_icmp;
                         int addr_type;
 
+                        neigh = dst_neigh_lookup(skb_dst(skb), &ipv6_hdr(skb)->daddr);
                         if (neigh == NULL)
                                 goto tx_error;
 
@@ -751,9 +775,14 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                         }
 
                         if ((addr_type & IPV6_ADDR_COMPATv4) == 0)
+                                do_tx_error_icmp = true;
+                        else {
+                                do_tx_error_icmp = false;
+                                dst = addr6->s6_addr32[3];
+                        }
+                        neigh_release(neigh);
+                        if (do_tx_error_icmp)
                                 goto tx_error_icmp;
-
-                        dst = addr6->s6_addr32[3];
                 }
 #endif
                 else
@@ -892,7 +921,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                                    htons(ETH_P_TEB) : skb->protocol;
 
         if (tunnel->parms.o_flags&(GRE_KEY|GRE_CSUM|GRE_SEQ)) {
-                __be32 *ptr = (__be32*)(((u8*)iph) + tunnel->hlen - 4);
+                __be32 *ptr = (__be32 *)(((u8 *)iph) + tunnel->hlen - 4);
 
                 if (tunnel->parms.o_flags&GRE_SEQ) {
                         ++tunnel->o_seqno;
@@ -905,7 +934,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                 }
                 if (tunnel->parms.o_flags&GRE_CSUM) {
                         *ptr = 0;
-                        *(__sum16*)ptr = ip_compute_csum((void*)(iph+1), skb->len - sizeof(struct iphdr));
+                        *(__sum16 *)ptr = ip_compute_csum((void *)(iph+1), skb->len - sizeof(struct iphdr));
                 }
         }
 
@@ -914,9 +943,10 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
         __IPTUNNEL_XMIT(tstats, &dev->stats);
         return NETDEV_TX_OK;
 
+#if IS_ENABLED(CONFIG_IPV6)
 tx_error_icmp:
         dst_link_failure(skb);
-
+#endif
 tx_error:
         dev->stats.tx_errors++;
         dev_kfree_skb(skb);
@@ -1160,7 +1190,7 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
 {
         struct ip_tunnel *t = netdev_priv(dev);
         struct iphdr *iph = (struct iphdr *)skb_push(skb, t->hlen);
-        __be16 *p = (__be16*)(iph+1);
+        __be16 *p = (__be16 *)(iph+1);
 
         memcpy(iph, &t->parms.iph, sizeof(struct iphdr));
         p[0]            = t->parms.o_flags;
@@ -1244,7 +1274,7 @@ static const struct net_device_ops ipgre_netdev_ops = {
         .ndo_start_xmit         = ipgre_tunnel_xmit,
         .ndo_do_ioctl           = ipgre_tunnel_ioctl,
         .ndo_change_mtu         = ipgre_tunnel_change_mtu,
-        .ndo_get_stats          = ipgre_get_stats,
+        .ndo_get_stats64        = ipgre_get_stats64,
 };
 
 static void ipgre_dev_free(struct net_device *dev)
@@ -1498,7 +1528,7 @@ static const struct net_device_ops ipgre_tap_netdev_ops = {
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_change_mtu         = ipgre_tunnel_change_mtu,
-        .ndo_get_stats          = ipgre_get_stats,
+        .ndo_get_stats64        = ipgre_get_stats64,
 };
 
 static void ipgre_tap_setup(struct net_device *dev)
@@ -1529,7 +1559,7 @@ static int ipgre_newlink(struct net *src_net, struct net_device *dev, struct nla
                 return -EEXIST;
 
         if (dev->type == ARPHRD_ETHER && !tb[IFLA_ADDRESS])
-                random_ether_addr(dev->dev_addr);
+                eth_hw_addr_random(dev);
 
         mtu = ipgre_tunnel_bind_dev(dev);
         if (!tb[IFLA_MTU])
@@ -1645,17 +1675,18 @@ static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
         struct ip_tunnel *t = netdev_priv(dev);
         struct ip_tunnel_parm *p = &t->parms;
 
-        NLA_PUT_U32(skb, IFLA_GRE_LINK, p->link);
-        NLA_PUT_BE16(skb, IFLA_GRE_IFLAGS, p->i_flags);
-        NLA_PUT_BE16(skb, IFLA_GRE_OFLAGS, p->o_flags);
-        NLA_PUT_BE32(skb, IFLA_GRE_IKEY, p->i_key);
-        NLA_PUT_BE32(skb, IFLA_GRE_OKEY, p->o_key);
-        NLA_PUT_BE32(skb, IFLA_GRE_LOCAL, p->iph.saddr);
-        NLA_PUT_BE32(skb, IFLA_GRE_REMOTE, p->iph.daddr);
-        NLA_PUT_U8(skb, IFLA_GRE_TTL, p->iph.ttl);
-        NLA_PUT_U8(skb, IFLA_GRE_TOS, p->iph.tos);
-        NLA_PUT_U8(skb, IFLA_GRE_PMTUDISC, !!(p->iph.frag_off & htons(IP_DF)));
-
+        if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
+            nla_put_be16(skb, IFLA_GRE_IFLAGS, p->i_flags) ||
+            nla_put_be16(skb, IFLA_GRE_OFLAGS, p->o_flags) ||
+            nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) ||
+            nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) ||
+            nla_put_be32(skb, IFLA_GRE_LOCAL, p->iph.saddr) ||
+            nla_put_be32(skb, IFLA_GRE_REMOTE, p->iph.daddr) ||
+            nla_put_u8(skb, IFLA_GRE_TTL, p->iph.ttl) ||
+            nla_put_u8(skb, IFLA_GRE_TOS, p->iph.tos) ||
+            nla_put_u8(skb, IFLA_GRE_PMTUDISC,
+                       !!(p->iph.frag_off & htons(IP_DF))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -1709,7 +1740,7 @@ static int __init ipgre_init(void)
 {
         int err;
 
-        printk(KERN_INFO "GRE over IPv4 tunneling driver\n");
+        pr_info("GRE over IPv4 tunneling driver\n");
 
         err = register_pernet_device(&ipgre_net_ops);
         if (err < 0)
@@ -1717,7 +1748,7 @@ static int __init ipgre_init(void)
 
         err = gre_add_protocol(&ipgre_protocol, GREPROTO_CISCO);
         if (err < 0) {
-                printk(KERN_INFO "ipgre init: can't add protocol\n");
+                pr_info("%s: can't add protocol\n", __func__);
                 goto add_proto_failed;
         }
 
@@ -1746,7 +1777,7 @@ static void __exit ipgre_fini(void)
         rtnl_link_unregister(&ipgre_tap_ops);
         rtnl_link_unregister(&ipgre_link_ops);
         if (gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO) < 0)
-                printk(KERN_INFO "ipgre close: can't remove protocol\n");
+                pr_info("%s: can't remove protocol\n", __func__);
         unregister_pernet_device(&ipgre_net_ops);
 }
 
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 073a9b01c40c..8590144ca330 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -113,7 +113,8 @@
  *              2 of the License, or (at your option) any later version.
  */
 
-#include <asm/system.h>
+#define pr_fmt(fmt) "IPv4: " fmt
+
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
@@ -148,7 +149,7 @@
 /*
  *      Process Router Attention IP option (RFC 2113)
  */
-int ip_call_ra_chain(struct sk_buff *skb)
+bool ip_call_ra_chain(struct sk_buff *skb)
 {
         struct ip_ra_chain *ra;
         u8 protocol = ip_hdr(skb)->protocol;
@@ -167,7 +168,7 @@ int ip_call_ra_chain(struct sk_buff *skb)
                     net_eq(sock_net(sk), dev_net(dev))) {
                         if (ip_is_fragment(ip_hdr(skb))) {
                                 if (ip_defrag(skb, IP_DEFRAG_CALL_RA_CHAIN))
-                                        return 1;
+                                        return true;
                         }
                         if (last) {
                                 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
@@ -180,9 +181,9 @@ int ip_call_ra_chain(struct sk_buff *skb)
 
         if (last) {
                 raw_rcv(last, skb);
-                return 1;
+                return true;
         }
-        return 0;
+        return false;
 }
 
 static int ip_local_deliver_finish(struct sk_buff *skb)
@@ -209,9 +210,8 @@ static int ip_local_deliver_finish(struct sk_buff *skb)
                         int ret;
 
                         if (!net_eq(net, &init_net) && !ipprot->netns_ok) {
-                                if (net_ratelimit())
-                                        printk("%s: proto %d isn't netns-ready\n",
-                                                __func__, protocol);
+                                net_info_ratelimited("%s: proto %d isn't netns-ready\n",
+                                                     __func__, protocol);
                                 kfree_skb(skb);
                                 goto out;
                         }
@@ -265,7 +265,7 @@ int ip_local_deliver(struct sk_buff *skb)
                        ip_local_deliver_finish);
 }
 
-static inline int ip_rcv_options(struct sk_buff *skb)
+static inline bool ip_rcv_options(struct sk_buff *skb)
 {
         struct ip_options *opt;
         const struct iphdr *iph;
@@ -297,10 +297,10 @@ static inline int ip_rcv_options(struct sk_buff *skb)
 
                 if (in_dev) {
                         if (!IN_DEV_SOURCE_ROUTE(in_dev)) {
-                                if (IN_DEV_LOG_MARTIANS(in_dev) &&
-                                    net_ratelimit())
-                                        printk(KERN_INFO "source route option %pI4 -> %pI4\n",
-                                               &iph->saddr, &iph->daddr);
+                                if (IN_DEV_LOG_MARTIANS(in_dev))
+                                        net_info_ratelimited("source route option %pI4 -> %pI4\n",
+                                                             &iph->saddr,
+                                                             &iph->daddr);
                                 goto drop;
                         }
                 }
@@ -309,9 +309,9 @@ static inline int ip_rcv_options(struct sk_buff *skb)
                         goto drop;
         }
 
-        return 0;
+        return false;
 drop:
-        return -1;
+        return true;
 }
 
 static int ip_rcv_finish(struct sk_buff *skb)
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 42dd1a90edea..708b99494e23 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -9,6 +9,8 @@
  *
  */
 
+#define pr_fmt(fmt) "IPv4: " fmt
+
 #include <linux/capability.h>
 #include <linux/module.h>
 #include <linux/slab.h>
@@ -208,10 +210,10 @@ int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb)
  *      Simple and stupid 8), but the most efficient way.
  */
 
-void ip_options_fragment(struct sk_buff * skb)
+void ip_options_fragment(struct sk_buff *skb)
 {
         unsigned char *optptr = skb_network_header(skb) + sizeof(struct iphdr);
-        struct ip_options * opt = &(IPCB(skb)->opt);
+        struct ip_options *opt = &(IPCB(skb)->opt);
         int  l = opt->optlen;
         int  optlen;
 
@@ -246,13 +248,13 @@ void ip_options_fragment(struct sk_buff * skb)
  */
 
 int ip_options_compile(struct net *net,
-                       struct ip_options * opt, struct sk_buff * skb)
+                       struct ip_options *opt, struct sk_buff *skb)
 {
         int l;
-        unsigned char * iph;
-        unsigned char * optptr;
+        unsigned char *iph;
+        unsigned char *optptr;
         int optlen;
-        unsigned char * pp_ptr = NULL;
+        unsigned char *pp_ptr = NULL;
         struct rtable *rt = NULL;
 
         if (skb != NULL) {
@@ -411,7 +413,7 @@ int ip_options_compile(struct net *net,
                                         opt->is_changed = 1;
                                 }
                         } else {
-                                unsigned overflow = optptr[3]>>4;
+                                unsigned int overflow = optptr[3]>>4;
                                 if (overflow == 15) {
                                         pp_ptr = optptr + 3;
                                         goto error;
@@ -471,20 +473,20 @@ EXPORT_SYMBOL(ip_options_compile);
  *      Undo all the changes done by ip_options_compile().
  */
 
-void ip_options_undo(struct ip_options * opt)
+void ip_options_undo(struct ip_options *opt)
 {
         if (opt->srr) {
-                unsigned  char * optptr = opt->__data+opt->srr-sizeof(struct  iphdr);
+                unsigned  char *optptr = opt->__data+opt->srr-sizeof(struct  iphdr);
                 memmove(optptr+7, optptr+3, optptr[1]-7);
                 memcpy(optptr+3, &opt->faddr, 4);
         }
         if (opt->rr_needaddr) {
-                unsigned  char * optptr = opt->__data+opt->rr-sizeof(struct  iphdr);
+                unsigned  char *optptr = opt->__data+opt->rr-sizeof(struct  iphdr);
                 optptr[2] -= 4;
                 memset(&optptr[optptr[2]-1], 0, 4);
         }
         if (opt->ts) {
-                unsigned  char * optptr = opt->__data+opt->ts-sizeof(struct  iphdr);
+                unsigned  char *optptr = opt->__data+opt->ts-sizeof(struct  iphdr);
                 if (opt->ts_needtime) {
                         optptr[2] -= 4;
                         memset(&optptr[optptr[2]-1], 0, 4);
@@ -547,8 +549,8 @@ int ip_options_get(struct net *net, struct ip_options_rcu **optp,
 
 void ip_forward_options(struct sk_buff *skb)
 {
-        struct   ip_options * opt       = &(IPCB(skb)->opt);
-        unsigned char * optptr;
+        struct   ip_options *opt        = &(IPCB(skb)->opt);
+        unsigned char *optptr;
         struct rtable *rt = skb_rtable(skb);
         unsigned char *raw = skb_network_header(skb);
 
@@ -576,8 +578,10 @@ void ip_forward_options(struct sk_buff *skb)
                         ip_hdr(skb)->daddr = opt->nexthop;
                         ip_rt_get_source(&optptr[srrptr-1], skb, rt);
                         optptr[2] = srrptr+4;
-                } else if (net_ratelimit())
-                        printk(KERN_CRIT "ip_forward(): Argh! Destination lost!\n");
+                } else {
+                        net_crit_ratelimited("%s(): Argh! Destination lost!\n",
+                                             __func__);
+                }
                 if (opt->ts_needaddr) {
                         optptr = raw + opt->ts;
                         ip_rt_get_source(&optptr[optptr[2]-9], skb, rt);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index ff302bde8890..451f97c42eb4 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -43,7 +43,6 @@
  */
 
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
@@ -215,8 +214,8 @@ static inline int ip_finish_output2(struct sk_buff *skb)
         }
         rcu_read_unlock();
 
-        if (net_ratelimit())
-                printk(KERN_DEBUG "ip_finish_output2: No header cache and no neighbour!\n");
+        net_dbg_ratelimited("%s: No header cache and no neighbour!\n",
+                            __func__);
         kfree_skb(skb);
         return -EINVAL;
 }
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 8aa87c19fa00..0d11f234d615 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -90,7 +90,7 @@ static void ip_cmsg_recv_opts(struct msghdr *msg, struct sk_buff *skb)
 static void ip_cmsg_recv_retopts(struct msghdr *msg, struct sk_buff *skb)
 {
         unsigned char optbuf[sizeof(struct ip_options) + 40];
-        struct ip_options * opt = (struct ip_options *)optbuf;
+        struct ip_options *opt = (struct ip_options *)optbuf;
 
         if (IPCB(skb)->opt.optlen == 0)
                 return;
@@ -147,7 +147,7 @@ static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)
 void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb)
 {
         struct inet_sock *inet = inet_sk(skb->sk);
-        unsigned flags = inet->cmsg_flags;
+        unsigned int flags = inet->cmsg_flags;
 
         /* Ordered by supposed usage frequency */
         if (flags & 1)
@@ -445,11 +445,6 @@ out:
 }
 
 
-static void opt_kfree_rcu(struct rcu_head *head)
-{
-        kfree(container_of(head, struct ip_options_rcu, rcu));
-}
-
 /*
  *      Socket option code for IP. This is the end of the line after any
  *      TCP,UDP etc options on an IP socket.
@@ -469,6 +464,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                              (1<<IP_ROUTER_ALERT) | (1<<IP_FREEBIND) |
                              (1<<IP_PASSSEC) | (1<<IP_TRANSPARENT) |
                              (1<<IP_MINTTL) | (1<<IP_NODEFRAG))) ||
+            optname == IP_UNICAST_IF ||
             optname == IP_MULTICAST_TTL ||
             optname == IP_MULTICAST_ALL ||
             optname == IP_MULTICAST_LOOP ||
@@ -525,7 +521,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                 }
                 rcu_assign_pointer(inet->inet_opt, opt);
                 if (old)
-                        call_rcu(&old->rcu, opt_kfree_rcu);
+                        kfree_rcu(old, rcu);
                 break;
         }
         case IP_PKTINFO:
@@ -628,6 +624,35 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                         goto e_inval;
                 inet->mc_loop = !!val;
                 break;
+        case IP_UNICAST_IF:
+        {
+                struct net_device *dev = NULL;
+                int ifindex;
+
+                if (optlen != sizeof(int))
+                        goto e_inval;
+
+                ifindex = (__force int)ntohl((__force __be32)val);
+                if (ifindex == 0) {
+                        inet->uc_index = 0;
+                        err = 0;
+                        break;
+                }
+
+                dev = dev_get_by_index(sock_net(sk), ifindex);
+                err = -EADDRNOTAVAIL;
+                if (!dev)
+                        break;
+                dev_put(dev);
+
+                err = -EINVAL;
+                if (sk->sk_bound_dev_if)
+                        break;
+
+                inet->uc_index = ifindex;
+                err = 0;
+                break;
+        }
         case IP_MULTICAST_IF:
         {
                 struct ip_mreqn mreq;
@@ -648,10 +673,15 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                                 break;
                 } else {
                         memset(&mreq, 0, sizeof(mreq));
-                        if (optlen >= sizeof(struct in_addr) &&
-                            copy_from_user(&mreq.imr_address, optval,
-                                           sizeof(struct in_addr)))
-                                break;
+                        if (optlen >= sizeof(struct ip_mreq)) {
+                                if (copy_from_user(&mreq, optval,
+                                                   sizeof(struct ip_mreq)))
+                                        break;
+                        } else if (optlen >= sizeof(struct in_addr)) {
+                                if (copy_from_user(&mreq.imr_address, optval,
+                                                   sizeof(struct in_addr)))
+                                        break;
+                        }
                 }
 
                 if (!mreq.imr_ifindex) {
@@ -1069,7 +1099,7 @@ EXPORT_SYMBOL(compat_ip_setsockopt);
  */
 
 static int do_ip_getsockopt(struct sock *sk, int level, int optname,
-                            char __user *optval, int __user *optlen, unsigned flags)
+                            char __user *optval, int __user *optlen, unsigned int flags)
 {
         struct inet_sock *inet = inet_sk(sk);
         int val;
@@ -1178,6 +1208,9 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
         case IP_MULTICAST_LOOP:
                 val = inet->mc_loop;
                 break;
+        case IP_UNICAST_IF:
+                val = (__force int)htonl((__u32) inet->uc_index);
+                break;
         case IP_MULTICAST_IF:
         {
                 struct in_addr addr;
@@ -1256,6 +1289,10 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
                         int hlim = inet->mc_ttl;
                         put_cmsg(&msg, SOL_IP, IP_TTL, sizeof(hlim), &hlim);
                 }
+                if (inet->cmsg_flags & IP_CMSG_TOS) {
+                        int tos = inet->rcv_tos;
+                        put_cmsg(&msg, SOL_IP, IP_TOS, sizeof(tos), &tos);
+                }
                 len -= msg.msg_controllen;
                 return put_user(len, optlen);
         }
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index c857f6f49b03..63b64c45a826 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -156,11 +156,11 @@ static const struct net_protocol ipcomp4_protocol = {
 static int __init ipcomp4_init(void)
 {
         if (xfrm_register_type(&ipcomp_type, AF_INET) < 0) {
-                printk(KERN_INFO "ipcomp init: can't add xfrm type\n");
+                pr_info("%s: can't add xfrm type\n", __func__);
                 return -EAGAIN;
         }
         if (inet_add_protocol(&ipcomp4_protocol, IPPROTO_COMP) < 0) {
-                printk(KERN_INFO "ipcomp init: can't add protocol\n");
+                pr_info("%s: can't add protocol\n", __func__);
                 xfrm_unregister_type(&ipcomp_type, AF_INET);
                 return -EAGAIN;
         }
@@ -170,9 +170,9 @@ static int __init ipcomp4_init(void)
 static void __exit ipcomp4_fini(void)
 {
         if (inet_del_protocol(&ipcomp4_protocol, IPPROTO_COMP) < 0)
-                printk(KERN_INFO "ip ipcomp close: can't remove protocol\n");
+                pr_info("%s: can't remove protocol\n", __func__);
         if (xfrm_unregister_type(&ipcomp_type, AF_INET) < 0)
-                printk(KERN_INFO "ip ipcomp close: can't remove xfrm type\n");
+                pr_info("%s: can't remove xfrm type\n", __func__);
 }
 
 module_init(ipcomp4_init);
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 6e412a60a91f..67e8a6b086ea 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -214,7 +214,7 @@ static int __init ic_open_devs(void)
                 if (!(dev->flags & IFF_LOOPBACK))
                         continue;
                 if (dev_change_flags(dev, dev->flags | IFF_UP) < 0)
-                        printk(KERN_ERR "IP-Config: Failed to open %s\n", dev->name);
+                        pr_err("IP-Config: Failed to open %s\n", dev->name);
         }
 
         for_each_netdev(&init_net, dev) {
@@ -223,7 +223,8 @@ static int __init ic_open_devs(void)
                         if (dev->mtu >= 364)
                                 able |= IC_BOOTP;
                         else
-                                printk(KERN_WARNING "DHCP/BOOTP: Ignoring device %s, MTU %d too small", dev->name, dev->mtu);
+                                pr_warn("DHCP/BOOTP: Ignoring device %s, MTU %d too small",
+                                        dev->name, dev->mtu);
                         if (!(dev->flags & IFF_NOARP))
                                 able |= IC_RARP;
                         able &= ic_proto_enabled;
@@ -231,7 +232,8 @@ static int __init ic_open_devs(void)
                                 continue;
                         oflags = dev->flags;
                         if (dev_change_flags(dev, oflags | IFF_UP) < 0) {
-                                printk(KERN_ERR "IP-Config: Failed to open %s\n", dev->name);
+                                pr_err("IP-Config: Failed to open %s\n",
+                                       dev->name);
                                 continue;
                         }
                         if (!(d = kmalloc(sizeof(struct ic_device), GFP_KERNEL))) {
@@ -273,9 +275,10 @@ have_carrier:
 
         if (!ic_first_dev) {
                 if (user_dev_name[0])
-                        printk(KERN_ERR "IP-Config: Device `%s' not found.\n", user_dev_name);
+                        pr_err("IP-Config: Device `%s' not found\n",
+                               user_dev_name);
                 else
-                        printk(KERN_ERR "IP-Config: No network devices available.\n");
+                        pr_err("IP-Config: No network devices available\n");
                 return -ENODEV;
         }
         return 0;
@@ -359,17 +362,20 @@ static int __init ic_setup_if(void)
         strcpy(ir.ifr_ifrn.ifrn_name, ic_dev->name);
         set_sockaddr(sin, ic_myaddr, 0);
         if ((err = ic_devinet_ioctl(SIOCSIFADDR, &ir)) < 0) {
-                printk(KERN_ERR "IP-Config: Unable to set interface address (%d).\n", err);
+                pr_err("IP-Config: Unable to set interface address (%d)\n",
+                       err);
                 return -1;
         }
         set_sockaddr(sin, ic_netmask, 0);
         if ((err = ic_devinet_ioctl(SIOCSIFNETMASK, &ir)) < 0) {
-                printk(KERN_ERR "IP-Config: Unable to set interface netmask (%d).\n", err);
+                pr_err("IP-Config: Unable to set interface netmask (%d)\n",
+                       err);
                 return -1;
         }
         set_sockaddr(sin, ic_myaddr | ~ic_netmask, 0);
         if ((err = ic_devinet_ioctl(SIOCSIFBRDADDR, &ir)) < 0) {
-                printk(KERN_ERR "IP-Config: Unable to set interface broadcast address (%d).\n", err);
+                pr_err("IP-Config: Unable to set interface broadcast address (%d)\n",
+                       err);
                 return -1;
         }
         /* Handle the case where we need non-standard MTU on the boot link (a network
@@ -380,8 +386,8 @@ static int __init ic_setup_if(void)
                 strcpy(ir.ifr_name, ic_dev->name);
                 ir.ifr_mtu = ic_dev_mtu;
                 if ((err = ic_dev_ioctl(SIOCSIFMTU, &ir)) < 0)
-                        printk(KERN_ERR "IP-Config: Unable to set interface mtu to %d (%d).\n",
-                                         ic_dev_mtu, err);
+                        pr_err("IP-Config: Unable to set interface mtu to %d (%d)\n",
+                               ic_dev_mtu, err);
         }
         return 0;
 }
@@ -396,7 +402,7 @@ static int __init ic_setup_routes(void)
 
                 memset(&rm, 0, sizeof(rm));
                 if ((ic_gateway ^ ic_myaddr) & ic_netmask) {
-                        printk(KERN_ERR "IP-Config: Gateway not on directly connected network.\n");
+                        pr_err("IP-Config: Gateway not on directly connected network\n");
                         return -1;
                 }
                 set_sockaddr((struct sockaddr_in *) &rm.rt_dst, 0, 0);
@@ -404,7 +410,8 @@ static int __init ic_setup_routes(void)
                 set_sockaddr((struct sockaddr_in *) &rm.rt_gateway, ic_gateway, 0);
                 rm.rt_flags = RTF_UP | RTF_GATEWAY;
                 if ((err = ic_route_ioctl(SIOCADDRT, &rm)) < 0) {
-                        printk(KERN_ERR "IP-Config: Cannot add default route (%d).\n", err);
+                        pr_err("IP-Config: Cannot add default route (%d)\n",
+                               err);
                         return -1;
                 }
         }
@@ -437,8 +444,8 @@ static int __init ic_defaults(void)
                 else if (IN_CLASSC(ntohl(ic_myaddr)))
                         ic_netmask = htonl(IN_CLASSC_NET);
                 else {
-                        printk(KERN_ERR "IP-Config: Unable to guess netmask for address %pI4\n",
-                                &ic_myaddr);
+                        pr_err("IP-Config: Unable to guess netmask for address %pI4\n",
+                               &ic_myaddr);
                         return -1;
                 }
                 printk("IP-Config: Guessing netmask %pI4\n", &ic_netmask);
@@ -688,8 +695,8 @@ ic_dhcp_init_options(u8 *options)
                         e += len;
                 }
                 if (*vendor_class_identifier) {
-                        printk(KERN_INFO "DHCP: sending class identifier \"%s\"\n",
-                               vendor_class_identifier);
+                        pr_info("DHCP: sending class identifier \"%s\"\n",
+                                vendor_class_identifier);
                         *e++ = 60;      /* Class-identifier */
                         len = strlen(vendor_class_identifier);
                         *e++ = len;
@@ -801,8 +808,6 @@ static void __init ic_bootp_send_if(struct ic_device *d, unsigned long jiffies_d
         b->op = BOOTP_REQUEST;
         if (dev->type < 256) /* check for false types */
                 b->htype = dev->type;
-        else if (dev->type == ARPHRD_IEEE802_TR) /* fix for token ring */
-                b->htype = ARPHRD_IEEE802;
         else if (dev->type == ARPHRD_FDDI)
                 b->htype = ARPHRD_ETHER;
         else {
@@ -948,9 +953,7 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str
 
         /* Fragments are not supported */
         if (ip_is_fragment(h)) {
-                if (net_ratelimit())
-                        printk(KERN_ERR "DHCP/BOOTP: Ignoring fragmented "
-                               "reply.\n");
+                net_err_ratelimited("DHCP/BOOTP: Ignoring fragmented reply\n");
                 goto drop;
         }
 
@@ -998,17 +1001,14 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str
         /* Is it a reply to our BOOTP request? */
         if (b->op != BOOTP_REPLY ||
             b->xid != d->xid) {
-                if (net_ratelimit())
-                        printk(KERN_ERR "DHCP/BOOTP: Reply not for us, "
-                               "op[%x] xid[%x]\n",
-                               b->op, b->xid);
+                net_err_ratelimited("DHCP/BOOTP: Reply not for us, op[%x] xid[%x]\n",
+                                    b->op, b->xid);
                 goto drop_unlock;
         }
 
         /* Is it a reply for the device we are configuring? */
         if (b->xid != ic_dev_xid) {
-                if (net_ratelimit())
-                        printk(KERN_ERR "DHCP/BOOTP: Ignoring delayed packet\n");
+                net_err_ratelimited("DHCP/BOOTP: Ignoring delayed packet\n");
                 goto drop_unlock;
         }
 
@@ -1146,17 +1146,17 @@ static int __init ic_dynamic(void)
          * are missing, and without DHCP/BOOTP/RARP we are unable to get it.
          */
         if (!ic_proto_enabled) {
-                printk(KERN_ERR "IP-Config: Incomplete network configuration information.\n");
+                pr_err("IP-Config: Incomplete network configuration information\n");
                 return -1;
         }
 
 #ifdef IPCONFIG_BOOTP
         if ((ic_proto_enabled ^ ic_proto_have_if) & IC_BOOTP)
-                printk(KERN_ERR "DHCP/BOOTP: No suitable device found.\n");
+                pr_err("DHCP/BOOTP: No suitable device found\n");
 #endif
 #ifdef IPCONFIG_RARP
         if ((ic_proto_enabled ^ ic_proto_have_if) & IC_RARP)
-                printk(KERN_ERR "RARP: No suitable device found.\n");
+                pr_err("RARP: No suitable device found\n");
 #endif
 
         if (!ic_proto_have_if)
@@ -1183,17 +1183,17 @@ static int __init ic_dynamic(void)
          * [Actually we could now, but the nothing else running note still
          *  applies.. - AC]
          */
-        printk(KERN_NOTICE "Sending %s%s%s requests .",
-               do_bootp
-                ? ((ic_proto_enabled & IC_USE_DHCP) ? "DHCP" : "BOOTP") : "",
-               (do_bootp && do_rarp) ? " and " : "",
-               do_rarp ? "RARP" : "");
+        pr_notice("Sending %s%s%s requests .",
+                  do_bootp
+                  ? ((ic_proto_enabled & IC_USE_DHCP) ? "DHCP" : "BOOTP") : "",
+                  (do_bootp && do_rarp) ? " and " : "",
+                  do_rarp ? "RARP" : "");
 
         start_jiffies = jiffies;
         d = ic_first_dev;
         retries = CONF_SEND_RETRIES;
         get_random_bytes(&timeout, sizeof(timeout));
-        timeout = CONF_BASE_TIMEOUT + (timeout % (unsigned) CONF_TIMEOUT_RANDOM);
+        timeout = CONF_BASE_TIMEOUT + (timeout % (unsigned int) CONF_TIMEOUT_RANDOM);
         for (;;) {
                 /* Track the device we are configuring */
                 ic_dev_xid = d->xid;
@@ -1216,13 +1216,13 @@ static int __init ic_dynamic(void)
                     (ic_proto_enabled & IC_USE_DHCP) &&
                     ic_dhcp_msgtype != DHCPACK) {
                         ic_got_reply = 0;
-                        printk(KERN_CONT ",");
+                        pr_cont(",");
                         continue;
                 }
 #endif /* IPCONFIG_DHCP */
 
                 if (ic_got_reply) {
-                        printk(KERN_CONT " OK\n");
+                        pr_cont(" OK\n");
                         break;
                 }
 
@@ -1230,7 +1230,7 @@ static int __init ic_dynamic(void)
                         continue;
 
                 if (! --retries) {
-                        printk(KERN_CONT " timed out!\n");
+                        pr_cont(" timed out!\n");
                         break;
                 }
 
@@ -1240,7 +1240,7 @@ static int __init ic_dynamic(void)
                 if (timeout > CONF_TIMEOUT_MAX)
                         timeout = CONF_TIMEOUT_MAX;
 
-                printk(KERN_CONT ".");
+                pr_cont(".");
         }
 
 #ifdef IPCONFIG_BOOTP
@@ -1260,8 +1260,8 @@ static int __init ic_dynamic(void)
         printk("IP-Config: Got %s answer from %pI4, ",
                 ((ic_got_reply & IC_RARP) ? "RARP"
                  : (ic_proto_enabled & IC_USE_DHCP) ? "DHCP" : "BOOTP"),
-                &ic_servaddr);
-        printk(KERN_CONT "my address is %pI4\n", &ic_myaddr);
+               &ic_servaddr);
+        pr_cont("my address is %pI4\n", &ic_myaddr);
 
         return 0;
 }
@@ -1437,24 +1437,22 @@ static int __init ip_auto_config(void)
                          */
 #ifdef CONFIG_ROOT_NFS
                         if (ROOT_DEV ==  Root_NFS) {
-                                printk(KERN_ERR
-                                        "IP-Config: Retrying forever (NFS root)...\n");
+                                pr_err("IP-Config: Retrying forever (NFS root)...\n");
                                 goto try_try_again;
                         }
 #endif
 
                         if (--retries) {
-                                printk(KERN_ERR
-                                       "IP-Config: Reopening network devices...\n");
+                                pr_err("IP-Config: Reopening network devices...\n");
                                 goto try_try_again;
                         }
 
                         /* Oh, well.  At least we tried. */
-                        printk(KERN_ERR "IP-Config: Auto-configuration of network failed.\n");
+                        pr_err("IP-Config: Auto-configuration of network failed\n");
                         return -1;
                 }
 #else /* !DYNAMIC */
-                printk(KERN_ERR "IP-Config: Incomplete network configuration information.\n");
+                pr_err("IP-Config: Incomplete network configuration information\n");
                 ic_close_devs();
                 return -1;
 #endif /* IPCONFIG_DYNAMIC */
@@ -1492,19 +1490,16 @@ static int __init ip_auto_config(void)
         /*
          * Clue in the operator.
          */
-        printk("IP-Config: Complete:\n");
-        printk("     device=%s", ic_dev->name);
-        printk(KERN_CONT ", addr=%pI4", &ic_myaddr);
-        printk(KERN_CONT ", mask=%pI4", &ic_netmask);
-        printk(KERN_CONT ", gw=%pI4", &ic_gateway);
-        printk(KERN_CONT ",\n     host=%s, domain=%s, nis-domain=%s",
-               utsname()->nodename, ic_domain, utsname()->domainname);
-        printk(KERN_CONT ",\n     bootserver=%pI4", &ic_servaddr);
-        printk(KERN_CONT ", rootserver=%pI4", &root_server_addr);
-        printk(KERN_CONT ", rootpath=%s", root_server_path);
+        pr_info("IP-Config: Complete:\n");
+        pr_info("     device=%s, addr=%pI4, mask=%pI4, gw=%pI4\n",
+                ic_dev->name, &ic_myaddr, &ic_netmask, &ic_gateway);
+        pr_info("     host=%s, domain=%s, nis-domain=%s\n",
+                utsname()->nodename, ic_domain, utsname()->domainname);
+        pr_info("     bootserver=%pI4, rootserver=%pI4, rootpath=%s",
+                &ic_servaddr, &root_server_addr, root_server_path);
         if (ic_dev_mtu)
-                printk(KERN_CONT ", mtu=%d", ic_dev_mtu);
-        printk(KERN_CONT "\n");
+                pr_cont(", mtu=%d", ic_dev_mtu);
+        pr_cont("\n");
 #endif /* !SILENT */
 
         return 0;
@@ -1626,22 +1621,21 @@ static int __init ip_auto_config_setup(char *addrs)
 
         return 1;
 }
+__setup("ip=", ip_auto_config_setup);
 
 static int __init nfsaddrs_config_setup(char *addrs)
 {
         return ip_auto_config_setup(addrs);
 }
+__setup("nfsaddrs=", nfsaddrs_config_setup);
 
 static int __init vendor_class_identifier_setup(char *addrs)
 {
         if (strlcpy(vendor_class_identifier, addrs,
                     sizeof(vendor_class_identifier))
             >= sizeof(vendor_class_identifier))
-                printk(KERN_WARNING "DHCP: vendorclass too long, truncated to \"%s\"",
-                       vendor_class_identifier);
+                pr_warn("DHCP: vendorclass too long, truncated to \"%s\"",
+                        vendor_class_identifier);
         return 1;
 }
-
-__setup("ip=", ip_auto_config_setup);
-__setup("nfsaddrs=", nfsaddrs_config_setup);
 __setup("dhcpclass=", vendor_class_identifier_setup);
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 22a199315309..2d0f99bf61b3 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -144,33 +144,48 @@ static void ipip_dev_free(struct net_device *dev);
 
 /* often modified stats are per cpu, other are shared (netdev->stats) */
 struct pcpu_tstats {
-        unsigned long   rx_packets;
-        unsigned long   rx_bytes;
-        unsigned long   tx_packets;
-        unsigned long   tx_bytes;
-} __attribute__((aligned(4*sizeof(unsigned long))));
+        u64     rx_packets;
+        u64     rx_bytes;
+        u64     tx_packets;
+        u64     tx_bytes;
+        struct u64_stats_sync   syncp;
+};
 
-static struct net_device_stats *ipip_get_stats(struct net_device *dev)
+static struct rtnl_link_stats64 *ipip_get_stats64(struct net_device *dev,
+                                                  struct rtnl_link_stats64 *tot)
 {
-        struct pcpu_tstats sum = { 0 };
         int i;
 
         for_each_possible_cpu(i) {
                 const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
-
-                sum.rx_packets += tstats->rx_packets;
-                sum.rx_bytes   += tstats->rx_bytes;
-                sum.tx_packets += tstats->tx_packets;
-                sum.tx_bytes   += tstats->tx_bytes;
+                u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
+                unsigned int start;
+
+                do {
+                        start = u64_stats_fetch_begin_bh(&tstats->syncp);
+                        rx_packets = tstats->rx_packets;
+                        tx_packets = tstats->tx_packets;
+                        rx_bytes = tstats->rx_bytes;
+                        tx_bytes = tstats->tx_bytes;
+                } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
+
+                tot->rx_packets += rx_packets;
+                tot->tx_packets += tx_packets;
+                tot->rx_bytes   += rx_bytes;
+                tot->tx_bytes   += tx_bytes;
         }
-        dev->stats.rx_packets = sum.rx_packets;
-        dev->stats.rx_bytes   = sum.rx_bytes;
-        dev->stats.tx_packets = sum.tx_packets;
-        dev->stats.tx_bytes   = sum.tx_bytes;
-        return &dev->stats;
+
+        tot->tx_fifo_errors = dev->stats.tx_fifo_errors;
+        tot->tx_carrier_errors = dev->stats.tx_carrier_errors;
+        tot->tx_dropped = dev->stats.tx_dropped;
+        tot->tx_aborted_errors = dev->stats.tx_aborted_errors;
+        tot->tx_errors = dev->stats.tx_errors;
+        tot->collisions = dev->stats.collisions;
+
+        return tot;
 }
 
-static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
+static struct ip_tunnel *ipip_tunnel_lookup(struct net *net,
                 __be32 remote, __be32 local)
 {
         unsigned int h0 = HASH(remote);
@@ -245,7 +260,7 @@ static void ipip_tunnel_link(struct ipip_net *ipn, struct ip_tunnel *t)
         rcu_assign_pointer(*tp, t);
 }
 
-static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
+static struct ip_tunnel *ipip_tunnel_locate(struct net *net,
                 struct ip_tunnel_parm *parms, int create)
 {
         __be32 remote = parms->iph.daddr;
@@ -404,8 +419,10 @@ static int ipip_rcv(struct sk_buff *skb)
                 skb->pkt_type = PACKET_HOST;
 
                 tstats = this_cpu_ptr(tunnel->dev->tstats);
+                u64_stats_update_begin(&tstats->syncp);
                 tstats->rx_packets++;
                 tstats->rx_bytes += skb->len;
+                u64_stats_update_end(&tstats->syncp);
 
                 __skb_tunnel_rx(skb, tunnel->dev);
 
@@ -454,8 +471,7 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                         dev->stats.tx_fifo_errors++;
                         goto tx_error;
                 }
-                if ((dst = rt->rt_gateway) == 0)
-                        goto tx_error_icmp;
+                dst = rt->rt_gateway;
         }
 
         rt = ip_route_output_ports(dev_net(dev), &fl4, NULL,
@@ -731,7 +747,7 @@ static const struct net_device_ops ipip_netdev_ops = {
         .ndo_start_xmit = ipip_tunnel_xmit,
         .ndo_do_ioctl   = ipip_tunnel_ioctl,
         .ndo_change_mtu = ipip_tunnel_change_mtu,
-        .ndo_get_stats  = ipip_get_stats,
+        .ndo_get_stats64 = ipip_get_stats64,
 };
 
 static void ipip_dev_free(struct net_device *dev)
@@ -893,7 +909,7 @@ static int __init ipip_init(void)
         err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
         if (err < 0) {
                 unregister_pernet_device(&ipip_net_ops);
-                printk(KERN_INFO "ipip init: can't register tunnel\n");
+                pr_info("%s: can't register tunnel\n", __func__);
         }
         return err;
 }
@@ -901,7 +917,7 @@ static int __init ipip_init(void)
 static void __exit ipip_fini(void)
 {
         if (xfrm4_tunnel_deregister(&ipip_handler, AF_INET))
-                printk(KERN_INFO "ipip close: can't deregister tunnel\n");
+                pr_info("%s: can't deregister tunnel\n", __func__);
 
         unregister_pernet_device(&ipip_net_ops);
 }
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 7bc2db6db8d4..a9e519ad6db5 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -26,7 +26,6 @@
  *
  */
 
-#include <asm/system.h>
 #include <asm/uaccess.h>
 #include <linux/types.h>
 #include <linux/capability.h>
@@ -950,8 +949,7 @@ static int ipmr_cache_report(struct mr_table *mrt,
         ret = sock_queue_rcv_skb(mroute_sk, skb);
         rcu_read_unlock();
         if (ret < 0) {
-                if (net_ratelimit())
-                        printk(KERN_WARNING "mroute: pending queue full, dropping entries.\n");
+                net_warn_ratelimited("mroute: pending queue full, dropping entries\n");
                 kfree_skb(skb);
         }
 
@@ -2120,15 +2118,16 @@ static int ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
         rtm->rtm_src_len  = 32;
         rtm->rtm_tos      = 0;
         rtm->rtm_table    = mrt->id;
-        NLA_PUT_U32(skb, RTA_TABLE, mrt->id);
+        if (nla_put_u32(skb, RTA_TABLE, mrt->id))
+                goto nla_put_failure;
         rtm->rtm_type     = RTN_MULTICAST;
         rtm->rtm_scope    = RT_SCOPE_UNIVERSE;
         rtm->rtm_protocol = RTPROT_UNSPEC;
         rtm->rtm_flags    = 0;
 
-        NLA_PUT_BE32(skb, RTA_SRC, c->mfc_origin);
-        NLA_PUT_BE32(skb, RTA_DST, c->mfc_mcastgrp);
-
+        if (nla_put_be32(skb, RTA_SRC, c->mfc_origin) ||
+            nla_put_be32(skb, RTA_DST, c->mfc_mcastgrp))
+                goto nla_put_failure;
         if (__ipmr_fill_mroute(mrt, skb, c, rtm) < 0)
                 goto nla_put_failure;
 
@@ -2538,7 +2537,7 @@ int __init ip_mr_init(void)
                 goto reg_notif_fail;
 #ifdef CONFIG_IP_PIMSM_V2
         if (inet_add_protocol(&pim_protocol, IPPROTO_PIM) < 0) {
-                printk(KERN_ERR "ip_mr_init: can't add PIM protocol\n");
+                pr_err("%s: can't add PIM protocol\n", __func__);
                 err = -EAGAIN;
                 goto add_proto_fail;
         }
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 4f47e064e262..ed1b36783192 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -12,7 +12,7 @@
 #include <net/netfilter/nf_queue.h>
 
 /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
-int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
+int ip_route_me_harder(struct sk_buff *skb, unsigned int addr_type)
 {
         struct net *net = dev_net(skb_dst(skb)->dev);
         const struct iphdr *iph = ip_hdr(skb);
@@ -237,13 +237,3 @@ static void ipv4_netfilter_fini(void)
 
 module_init(ipv4_netfilter_init);
 module_exit(ipv4_netfilter_fini);
-
-#ifdef CONFIG_SYSCTL
-struct ctl_path nf_net_ipv4_netfilter_sysctl_path[] = {
-        { .procname = "net", },
-        { .procname = "ipv4", },
-        { .procname = "netfilter", },
-        { }
-};
-EXPORT_SYMBOL_GPL(nf_net_ipv4_netfilter_sysctl_path);
-#endif /* CONFIG_SYSCTL */
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 74dfc9e5211f..fcc543cd987a 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -123,15 +123,6 @@ config IP_NF_TARGET_REJECT
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP_NF_TARGET_LOG
-        tristate "LOG target support"
-        default m if NETFILTER_ADVANCED=n
-        help
-          This option adds a `LOG' target, which allows you to create rules in
-          any iptables table which records the packet header to the syslog.
-
-          To compile it as a module, choose M here.  If unsure, say N.
-
 config IP_NF_TARGET_ULOG
         tristate "ULOG target support"
         default m if NETFILTER_ADVANCED=n
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 213a462b739b..c20674dc9452 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -54,7 +54,6 @@ obj-$(CONFIG_IP_NF_MATCH_RPFILTER) += ipt_rpfilter.o
 # targets
 obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o
 obj-$(CONFIG_IP_NF_TARGET_ECN) += ipt_ECN.o
-obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
 obj-$(CONFIG_IP_NF_TARGET_MASQUERADE) += ipt_MASQUERADE.o
 obj-$(CONFIG_IP_NF_TARGET_NETMAP) += ipt_NETMAP.o
 obj-$(CONFIG_IP_NF_TARGET_REDIRECT) += ipt_REDIRECT.o
@@ -67,6 +66,3 @@ obj-$(CONFIG_IP_NF_ARP_MANGLE) += arpt_mangle.o
 
 # just filtering instance of ARP tables for now
 obj-$(CONFIG_IP_NF_ARPFILTER) += arptable_filter.o
-
-obj-$(CONFIG_IP_NF_QUEUE) += ip_queue.o
-
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index fd7a3f68917f..97e61eadf580 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -221,9 +221,8 @@ static inline int arp_checkentry(const struct arpt_arp *arp)
 static unsigned int
 arpt_error(struct sk_buff *skb, const struct xt_action_param *par)
 {
-        if (net_ratelimit())
-                pr_err("arp_tables: error: '%s'\n",
-                       (const char *)par->targinfo);
+        net_err_ratelimited("arp_tables: error: '%s'\n",
+                            (const char *)par->targinfo);
 
         return NF_DROP;
 }
@@ -303,7 +302,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
                         if (v < 0) {
                                 /* Pop from stack? */
                                 if (v != XT_RETURN) {
-                                        verdict = (unsigned)(-v) - 1;
+                                        verdict = (unsigned int)(-v) - 1;
                                         break;
                                 }
                                 e = back;
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
deleted file mode 100644
index 94d45e1f8882..000000000000
--- a/net/ipv4/netfilter/ip_queue.c
+++ /dev/null
@@ -1,639 +0,0 @@
-/*
- * This is a module which is used for queueing IPv4 packets and
- * communicating with userspace via netlink.
- *
- * (C) 2000-2002 James Morris <jmorris@intercode.com.au>
- * (C) 2003-2005 Netfilter Core Team <coreteam@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/init.h>
-#include <linux/ip.h>
-#include <linux/notifier.h>
-#include <linux/netdevice.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter_ipv4/ip_queue.h>
-#include <linux/netfilter_ipv4/ip_tables.h>
-#include <linux/netlink.h>
-#include <linux/spinlock.h>
-#include <linux/sysctl.h>
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#include <linux/security.h>
-#include <linux/net.h>
-#include <linux/mutex.h>
-#include <linux/slab.h>
-#include <net/net_namespace.h>
-#include <net/sock.h>
-#include <net/route.h>
-#include <net/netfilter/nf_queue.h>
-#include <net/ip.h>
-
-#define IPQ_QMAX_DEFAULT 1024
-#define IPQ_PROC_FS_NAME "ip_queue"
-#define NET_IPQ_QMAX 2088
-#define NET_IPQ_QMAX_NAME "ip_queue_maxlen"
-
-typedef int (*ipq_cmpfn)(struct nf_queue_entry *, unsigned long);
-
-static unsigned char copy_mode __read_mostly = IPQ_COPY_NONE;
-static unsigned int queue_maxlen __read_mostly = IPQ_QMAX_DEFAULT;
-static DEFINE_SPINLOCK(queue_lock);
-static int peer_pid __read_mostly;
-static unsigned int copy_range __read_mostly;
-static unsigned int queue_total;
-static unsigned int queue_dropped = 0;
-static unsigned int queue_user_dropped = 0;
-static struct sock *ipqnl __read_mostly;
-static LIST_HEAD(queue_list);
-static DEFINE_MUTEX(ipqnl_mutex);
-
-static inline void
-__ipq_enqueue_entry(struct nf_queue_entry *entry)
-{
-       list_add_tail(&entry->list, &queue_list);
-       queue_total++;
-}
-
-static inline int
-__ipq_set_mode(unsigned char mode, unsigned int range)
-{
-        int status = 0;
-
-        switch(mode) {
-        case IPQ_COPY_NONE:
-        case IPQ_COPY_META:
-                copy_mode = mode;
-                copy_range = 0;
-                break;
-
-        case IPQ_COPY_PACKET:
-                if (range > 0xFFFF)
-                        range = 0xFFFF;
-                copy_range = range;
-                copy_mode = mode;
-                break;
-
-        default:
-                status = -EINVAL;
-
-        }
-        return status;
-}
-
-static void __ipq_flush(ipq_cmpfn cmpfn, unsigned long data);
-
-static inline void
-__ipq_reset(void)
-{
-        peer_pid = 0;
-        net_disable_timestamp();
-        __ipq_set_mode(IPQ_COPY_NONE, 0);
-        __ipq_flush(NULL, 0);
-}
-
-static struct nf_queue_entry *
-ipq_find_dequeue_entry(unsigned long id)
-{
-        struct nf_queue_entry *entry = NULL, *i;
-
-        spin_lock_bh(&queue_lock);
-
-        list_for_each_entry(i, &queue_list, list) {
-                if ((unsigned long)i == id) {
-                        entry = i;
-                        break;
-                }
-        }
-
-        if (entry) {
-                list_del(&entry->list);
-                queue_total--;
-        }
-
-        spin_unlock_bh(&queue_lock);
-        return entry;
-}
-
-static void
-__ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
-{
-        struct nf_queue_entry *entry, *next;
-
-        list_for_each_entry_safe(entry, next, &queue_list, list) {
-                if (!cmpfn || cmpfn(entry, data)) {
-                        list_del(&entry->list);
-                        queue_total--;
-                        nf_reinject(entry, NF_DROP);
-                }
-        }
-}
-
-static void
-ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
-{
-        spin_lock_bh(&queue_lock);
-        __ipq_flush(cmpfn, data);
-        spin_unlock_bh(&queue_lock);
-}
-
-static struct sk_buff *
-ipq_build_packet_message(struct nf_queue_entry *entry, int *errp)
-{
-        sk_buff_data_t old_tail;
-        size_t size = 0;
-        size_t data_len = 0;
-        struct sk_buff *skb;
-        struct ipq_packet_msg *pmsg;
-        struct nlmsghdr *nlh;
-        struct timeval tv;
-
-        switch (ACCESS_ONCE(copy_mode)) {
-        case IPQ_COPY_META:
-        case IPQ_COPY_NONE:
-                size = NLMSG_SPACE(sizeof(*pmsg));
-                break;
-
-        case IPQ_COPY_PACKET:
-                if (entry->skb->ip_summed == CHECKSUM_PARTIAL &&
-                    (*errp = skb_checksum_help(entry->skb)))
-                        return NULL;
-
-                data_len = ACCESS_ONCE(copy_range);
-                if (data_len == 0 || data_len > entry->skb->len)
-                        data_len = entry->skb->len;
-
-                size = NLMSG_SPACE(sizeof(*pmsg) + data_len);
-                break;
-
-        default:
-                *errp = -EINVAL;
-                return NULL;
-        }
-
-        skb = alloc_skb(size, GFP_ATOMIC);
-        if (!skb)
-                goto nlmsg_failure;
-
-        old_tail = skb->tail;
-        nlh = NLMSG_PUT(skb, 0, 0, IPQM_PACKET, size - sizeof(*nlh));
-        pmsg = NLMSG_DATA(nlh);
-        memset(pmsg, 0, sizeof(*pmsg));
-
-        pmsg->packet_id       = (unsigned long )entry;
-        pmsg->data_len        = data_len;
-        tv = ktime_to_timeval(entry->skb->tstamp);
-        pmsg->timestamp_sec   = tv.tv_sec;
-        pmsg->timestamp_usec  = tv.tv_usec;
-        pmsg->mark            = entry->skb->mark;
-        pmsg->hook            = entry->hook;
-        pmsg->hw_protocol     = entry->skb->protocol;
-
-        if (entry->indev)
-                strcpy(pmsg->indev_name, entry->indev->name);
-        else
-                pmsg->indev_name[0] = '\0';
-
-        if (entry->outdev)
-                strcpy(pmsg->outdev_name, entry->outdev->name);
-        else
-                pmsg->outdev_name[0] = '\0';
-
-        if (entry->indev && entry->skb->dev &&
-            entry->skb->mac_header != entry->skb->network_header) {
-                pmsg->hw_type = entry->skb->dev->type;
-                pmsg->hw_addrlen = dev_parse_header(entry->skb,
-                                                    pmsg->hw_addr);
-        }
-
-        if (data_len)
-                if (skb_copy_bits(entry->skb, 0, pmsg->payload, data_len))
-                        BUG();
-
-        nlh->nlmsg_len = skb->tail - old_tail;
-        return skb;
-
-nlmsg_failure:
-        kfree_skb(skb);
-        *errp = -EINVAL;
-        printk(KERN_ERR "ip_queue: error creating packet message\n");
-        return NULL;
-}
-
-static int
-ipq_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
-{
-        int status = -EINVAL;
-        struct sk_buff *nskb;
-
-        if (copy_mode == IPQ_COPY_NONE)
-                return -EAGAIN;
-
-        nskb = ipq_build_packet_message(entry, &status);
-        if (nskb == NULL)
-                return status;
-
-        spin_lock_bh(&queue_lock);
-
-        if (!peer_pid)
-                goto err_out_free_nskb;
-
-        if (queue_total >= queue_maxlen) {
-                queue_dropped++;
-                status = -ENOSPC;
-                if (net_ratelimit())
-                          printk (KERN_WARNING "ip_queue: full at %d entries, "
-                                  "dropping packets(s). Dropped: %d\n", queue_total,
-                                  queue_dropped);
-                goto err_out_free_nskb;
-        }
-
-        /* netlink_unicast will either free the nskb or attach it to a socket */
-        status = netlink_unicast(ipqnl, nskb, peer_pid, MSG_DONTWAIT);
-        if (status < 0) {
-                queue_user_dropped++;
-                goto err_out_unlock;
-        }
-
-        __ipq_enqueue_entry(entry);
-
-        spin_unlock_bh(&queue_lock);
-        return status;
-
-err_out_free_nskb:
-        kfree_skb(nskb);
-
-err_out_unlock:
-        spin_unlock_bh(&queue_lock);
-        return status;
-}
-
-static int
-ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
-{
-        int diff;
-        struct iphdr *user_iph = (struct iphdr *)v->payload;
-        struct sk_buff *nskb;
-
-        if (v->data_len < sizeof(*user_iph))
-                return 0;
-        diff = v->data_len - e->skb->len;
-        if (diff < 0) {
-                if (pskb_trim(e->skb, v->data_len))
-                        return -ENOMEM;
-        } else if (diff > 0) {
-                if (v->data_len > 0xFFFF)
-                        return -EINVAL;
-                if (diff > skb_tailroom(e->skb)) {
-                        nskb = skb_copy_expand(e->skb, skb_headroom(e->skb),
-                                               diff, GFP_ATOMIC);
-                        if (!nskb) {
-                                printk(KERN_WARNING "ip_queue: error "
-                                      "in mangle, dropping packet\n");
-                                return -ENOMEM;
-                        }
-                        kfree_skb(e->skb);
-                        e->skb = nskb;
-                }
-                skb_put(e->skb, diff);
-        }
-        if (!skb_make_writable(e->skb, v->data_len))
-                return -ENOMEM;
-        skb_copy_to_linear_data(e->skb, v->payload, v->data_len);
-        e->skb->ip_summed = CHECKSUM_NONE;
-
-        return 0;
-}
-
-static int
-ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
-{
-        struct nf_queue_entry *entry;
-
-        if (vmsg->value > NF_MAX_VERDICT || vmsg->value == NF_STOLEN)
-                return -EINVAL;
-
-        entry = ipq_find_dequeue_entry(vmsg->id);
-        if (entry == NULL)
-                return -ENOENT;
-        else {
-                int verdict = vmsg->value;
-
-                if (vmsg->data_len && vmsg->data_len == len)
-                        if (ipq_mangle_ipv4(vmsg, entry) < 0)
-                                verdict = NF_DROP;
-
-                nf_reinject(entry, verdict);
-                return 0;
-        }
-}
-
-static int
-ipq_set_mode(unsigned char mode, unsigned int range)
-{
-        int status;
-
-        spin_lock_bh(&queue_lock);
-        status = __ipq_set_mode(mode, range);
-        spin_unlock_bh(&queue_lock);
-        return status;
-}
-
-static int
-ipq_receive_peer(struct ipq_peer_msg *pmsg,
-                 unsigned char type, unsigned int len)
-{
-        int status = 0;
-
-        if (len < sizeof(*pmsg))
-                return -EINVAL;
-
-        switch (type) {
-        case IPQM_MODE:
-                status = ipq_set_mode(pmsg->msg.mode.value,
-                                      pmsg->msg.mode.range);
-                break;
-
-        case IPQM_VERDICT:
-                status = ipq_set_verdict(&pmsg->msg.verdict,
-                                         len - sizeof(*pmsg));
-                break;
-        default:
-                status = -EINVAL;
-        }
-        return status;
-}
-
-static int
-dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex)
-{
-        if (entry->indev)
-                if (entry->indev->ifindex == ifindex)
-                        return 1;
-        if (entry->outdev)
-                if (entry->outdev->ifindex == ifindex)
-                        return 1;
-#ifdef CONFIG_BRIDGE_NETFILTER
-        if (entry->skb->nf_bridge) {
-                if (entry->skb->nf_bridge->physindev &&
-                    entry->skb->nf_bridge->physindev->ifindex == ifindex)
-                        return 1;
-                if (entry->skb->nf_bridge->physoutdev &&
-                    entry->skb->nf_bridge->physoutdev->ifindex == ifindex)
-                        return 1;
-        }
-#endif
-        return 0;
-}
-
-static void
-ipq_dev_drop(int ifindex)
-{
-        ipq_flush(dev_cmp, ifindex);
-}
-
-#define RCV_SKB_FAIL(err) do { netlink_ack(skb, nlh, (err)); return; } while (0)
-
-static inline void
-__ipq_rcv_skb(struct sk_buff *skb)
-{
-        int status, type, pid, flags;
-        unsigned int nlmsglen, skblen;
-        struct nlmsghdr *nlh;
-        bool enable_timestamp = false;
-
-        skblen = skb->len;
-        if (skblen < sizeof(*nlh))
-                return;
-
-        nlh = nlmsg_hdr(skb);
-        nlmsglen = nlh->nlmsg_len;
-        if (nlmsglen < sizeof(*nlh) || skblen < nlmsglen)
-                return;
-
-        pid = nlh->nlmsg_pid;
-        flags = nlh->nlmsg_flags;
-
-        if(pid <= 0 || !(flags & NLM_F_REQUEST) || flags & NLM_F_MULTI)
-                RCV_SKB_FAIL(-EINVAL);
-
-        if (flags & MSG_TRUNC)
-                RCV_SKB_FAIL(-ECOMM);
-
-        type = nlh->nlmsg_type;
-        if (type < NLMSG_NOOP || type >= IPQM_MAX)
-                RCV_SKB_FAIL(-EINVAL);
-
-        if (type <= IPQM_BASE)
-                return;
-
-        if (!capable(CAP_NET_ADMIN))
-                RCV_SKB_FAIL(-EPERM);
-
-        spin_lock_bh(&queue_lock);
-
-        if (peer_pid) {
-                if (peer_pid != pid) {
-                        spin_unlock_bh(&queue_lock);
-                        RCV_SKB_FAIL(-EBUSY);
-                }
-        } else {
-                enable_timestamp = true;
-                peer_pid = pid;
-        }
-
-        spin_unlock_bh(&queue_lock);
-        if (enable_timestamp)
-                net_enable_timestamp();
-        status = ipq_receive_peer(NLMSG_DATA(nlh), type,
-                                  nlmsglen - NLMSG_LENGTH(0));
-        if (status < 0)
-                RCV_SKB_FAIL(status);
-
-        if (flags & NLM_F_ACK)
-                netlink_ack(skb, nlh, 0);
-}
-
-static void
-ipq_rcv_skb(struct sk_buff *skb)
-{
-        mutex_lock(&ipqnl_mutex);
-        __ipq_rcv_skb(skb);
-        mutex_unlock(&ipqnl_mutex);
-}
-
-static int
-ipq_rcv_dev_event(struct notifier_block *this,
-                  unsigned long event, void *ptr)
-{
-        struct net_device *dev = ptr;
-
-        if (!net_eq(dev_net(dev), &init_net))
-                return NOTIFY_DONE;
-
-        /* Drop any packets associated with the downed device */
-        if (event == NETDEV_DOWN)
-                ipq_dev_drop(dev->ifindex);
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block ipq_dev_notifier = {
-        .notifier_call  = ipq_rcv_dev_event,
-};
-
-static int
-ipq_rcv_nl_event(struct notifier_block *this,
-                 unsigned long event, void *ptr)
-{
-        struct netlink_notify *n = ptr;
-
-        if (event == NETLINK_URELEASE && n->protocol == NETLINK_FIREWALL) {
-                spin_lock_bh(&queue_lock);
-                if ((net_eq(n->net, &init_net)) && (n->pid == peer_pid))
-                        __ipq_reset();
-                spin_unlock_bh(&queue_lock);
-        }
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block ipq_nl_notifier = {
-        .notifier_call  = ipq_rcv_nl_event,
-};
-
-#ifdef CONFIG_SYSCTL
-static struct ctl_table_header *ipq_sysctl_header;
-
-static ctl_table ipq_table[] = {
-        {
-                .procname       = NET_IPQ_QMAX_NAME,
-                .data           = &queue_maxlen,
-                .maxlen         = sizeof(queue_maxlen),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        { }
-};
-#endif
-
-#ifdef CONFIG_PROC_FS
-static int ip_queue_show(struct seq_file *m, void *v)
-{
-        spin_lock_bh(&queue_lock);
-
-        seq_printf(m,
-                      "Peer PID          : %d\n"
-                      "Copy mode         : %hu\n"
-                      "Copy range        : %u\n"
-                      "Queue length      : %u\n"
-                      "Queue max. length : %u\n"
-                      "Queue dropped     : %u\n"
-                      "Netlink dropped   : %u\n",
-                      peer_pid,
-                      copy_mode,
-                      copy_range,
-                      queue_total,
-                      queue_maxlen,
-                      queue_dropped,
-                      queue_user_dropped);
-
-        spin_unlock_bh(&queue_lock);
-        return 0;
-}
-
-static int ip_queue_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, ip_queue_show, NULL);
-}
-
-static const struct file_operations ip_queue_proc_fops = {
-        .open           = ip_queue_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-        .owner          = THIS_MODULE,
-};
-#endif
-
-static const struct nf_queue_handler nfqh = {
-        .name   = "ip_queue",
-        .outfn  = &ipq_enqueue_packet,
-};
-
-static int __init ip_queue_init(void)
-{
-        int status = -ENOMEM;
-        struct proc_dir_entry *proc __maybe_unused;
-
-        netlink_register_notifier(&ipq_nl_notifier);
-        ipqnl = netlink_kernel_create(&init_net, NETLINK_FIREWALL, 0,
-                                      ipq_rcv_skb, NULL, THIS_MODULE);
-        if (ipqnl == NULL) {
-                printk(KERN_ERR "ip_queue: failed to create netlink socket\n");
-                goto cleanup_netlink_notifier;
-        }
-
-#ifdef CONFIG_PROC_FS
-        proc = proc_create(IPQ_PROC_FS_NAME, 0, init_net.proc_net,
-                           &ip_queue_proc_fops);
-        if (!proc) {
-                printk(KERN_ERR "ip_queue: failed to create proc entry\n");
-                goto cleanup_ipqnl;
-        }
-#endif
-        register_netdevice_notifier(&ipq_dev_notifier);
-#ifdef CONFIG_SYSCTL
-        ipq_sysctl_header = register_sysctl_paths(net_ipv4_ctl_path, ipq_table);
-#endif
-        status = nf_register_queue_handler(NFPROTO_IPV4, &nfqh);
-        if (status < 0) {
-                printk(KERN_ERR "ip_queue: failed to register queue handler\n");
-                goto cleanup_sysctl;
-        }
-        return status;
-
-cleanup_sysctl:
-#ifdef CONFIG_SYSCTL
-        unregister_sysctl_table(ipq_sysctl_header);
-#endif
-        unregister_netdevice_notifier(&ipq_dev_notifier);
-        proc_net_remove(&init_net, IPQ_PROC_FS_NAME);
-cleanup_ipqnl: __maybe_unused
-        netlink_kernel_release(ipqnl);
-        mutex_lock(&ipqnl_mutex);
-        mutex_unlock(&ipqnl_mutex);
-
-cleanup_netlink_notifier:
-        netlink_unregister_notifier(&ipq_nl_notifier);
-        return status;
-}
-
-static void __exit ip_queue_fini(void)
-{
-        nf_unregister_queue_handlers(&nfqh);
-
-        ipq_flush(NULL, 0);
-
-#ifdef CONFIG_SYSCTL
-        unregister_sysctl_table(ipq_sysctl_header);
-#endif
-        unregister_netdevice_notifier(&ipq_dev_notifier);
-        proc_net_remove(&init_net, IPQ_PROC_FS_NAME);
-
-        netlink_kernel_release(ipqnl);
-        mutex_lock(&ipqnl_mutex);
-        mutex_unlock(&ipqnl_mutex);
-
-        netlink_unregister_notifier(&ipq_nl_notifier);
-}
-
-MODULE_DESCRIPTION("IPv4 packet queue handler");
-MODULE_AUTHOR("James Morris <jmorris@intercode.com.au>");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_FIREWALL);
-
-module_init(ip_queue_init);
-module_exit(ip_queue_fini);
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 24e556e83a3b..170b1fdd6b72 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -153,8 +153,7 @@ ip_checkentry(const struct ipt_ip *ip)
 static unsigned int
 ipt_error(struct sk_buff *skb, const struct xt_action_param *par)
 {
-        if (net_ratelimit())
-                pr_info("error: `%s'\n", (const char *)par->targinfo);
+        net_info_ratelimited("error: `%s'\n", (const char *)par->targinfo);
 
         return NF_DROP;
 }
@@ -377,7 +376,7 @@ ipt_do_table(struct sk_buff *skb,
                         if (v < 0) {
                                 /* Pop from stack? */
                                 if (v != XT_RETURN) {
-                                        verdict = (unsigned)(-v) - 1;
+                                        verdict = (unsigned int)(-v) - 1;
                                         break;
                                 }
                                 if (*stackptr <= origptr) {
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index a639967eb727..fe5daea5214d 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -246,8 +246,7 @@ clusterip_hashfn(const struct sk_buff *skb,
                         dport = ports[1];
                 }
         } else {
-                if (net_ratelimit())
-                        pr_info("unknown protocol %u\n", iph->protocol);
+                net_info_ratelimited("unknown protocol %u\n", iph->protocol);
         }
 
         switch (config->hash_mode) {
diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
deleted file mode 100644
index d76d6c9ed946..000000000000
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ /dev/null
@@ -1,516 +0,0 @@
-/*
- * This is a module which is used for logging packets.
- */
-
-/* (C) 1999-2001 Paul `Rusty' Russell
- * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-#include <linux/module.h>
-#include <linux/spinlock.h>
-#include <linux/skbuff.h>
-#include <linux/if_arp.h>
-#include <linux/ip.h>
-#include <net/icmp.h>
-#include <net/udp.h>
-#include <net/tcp.h>
-#include <net/route.h>
-
-#include <linux/netfilter.h>
-#include <linux/netfilter/x_tables.h>
-#include <linux/netfilter_ipv4/ipt_LOG.h>
-#include <net/netfilter/nf_log.h>
-#include <net/netfilter/xt_log.h>
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
-MODULE_DESCRIPTION("Xtables: IPv4 packet logging to syslog");
-
-/* One level of recursion won't kill us */
-static void dump_packet(struct sbuff *m,
-                        const struct nf_loginfo *info,
-                        const struct sk_buff *skb,
-                        unsigned int iphoff)
-{
-        struct iphdr _iph;
-        const struct iphdr *ih;
-        unsigned int logflags;
-
-        if (info->type == NF_LOG_TYPE_LOG)
-                logflags = info->u.log.logflags;
-        else
-                logflags = NF_LOG_MASK;
-
-        ih = skb_header_pointer(skb, iphoff, sizeof(_iph), &_iph);
-        if (ih == NULL) {
-                sb_add(m, "TRUNCATED");
-                return;
-        }
-
-        /* Important fields:
-         * TOS, len, DF/MF, fragment offset, TTL, src, dst, options. */
-        /* Max length: 40 "SRC=255.255.255.255 DST=255.255.255.255 " */
-        sb_add(m, "SRC=%pI4 DST=%pI4 ",
-               &ih->saddr, &ih->daddr);
-
-        /* Max length: 46 "LEN=65535 TOS=0xFF PREC=0xFF TTL=255 ID=65535 " */
-        sb_add(m, "LEN=%u TOS=0x%02X PREC=0x%02X TTL=%u ID=%u ",
-               ntohs(ih->tot_len), ih->tos & IPTOS_TOS_MASK,
-               ih->tos & IPTOS_PREC_MASK, ih->ttl, ntohs(ih->id));
-
-        /* Max length: 6 "CE DF MF " */
-        if (ntohs(ih->frag_off) & IP_CE)
-                sb_add(m, "CE ");
-        if (ntohs(ih->frag_off) & IP_DF)
-                sb_add(m, "DF ");
-        if (ntohs(ih->frag_off) & IP_MF)
-                sb_add(m, "MF ");
-
-        /* Max length: 11 "FRAG:65535 " */
-        if (ntohs(ih->frag_off) & IP_OFFSET)
-                sb_add(m, "FRAG:%u ", ntohs(ih->frag_off) & IP_OFFSET);
-
-        if ((logflags & IPT_LOG_IPOPT) &&
-            ih->ihl * 4 > sizeof(struct iphdr)) {
-                const unsigned char *op;
-                unsigned char _opt[4 * 15 - sizeof(struct iphdr)];
-                unsigned int i, optsize;
-
-                optsize = ih->ihl * 4 - sizeof(struct iphdr);
-                op = skb_header_pointer(skb, iphoff+sizeof(_iph),
-                                        optsize, _opt);
-                if (op == NULL) {
-                        sb_add(m, "TRUNCATED");
-                        return;
-                }
-
-                /* Max length: 127 "OPT (" 15*4*2chars ") " */
-                sb_add(m, "OPT (");
-                for (i = 0; i < optsize; i++)
-                        sb_add(m, "%02X", op[i]);
-                sb_add(m, ") ");
-        }
-
-        switch (ih->protocol) {
-        case IPPROTO_TCP: {
-                struct tcphdr _tcph;
-                const struct tcphdr *th;
-
-                /* Max length: 10 "PROTO=TCP " */
-                sb_add(m, "PROTO=TCP ");
-
-                if (ntohs(ih->frag_off) & IP_OFFSET)
-                        break;
-
-                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
-                th = skb_header_pointer(skb, iphoff + ih->ihl * 4,
-                                        sizeof(_tcph), &_tcph);
-                if (th == NULL) {
-                        sb_add(m, "INCOMPLETE [%u bytes] ",
-                               skb->len - iphoff - ih->ihl*4);
-                        break;
-                }
-
-                /* Max length: 20 "SPT=65535 DPT=65535 " */
-                sb_add(m, "SPT=%u DPT=%u ",
-                       ntohs(th->source), ntohs(th->dest));
-                /* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */
-                if (logflags & IPT_LOG_TCPSEQ)
-                        sb_add(m, "SEQ=%u ACK=%u ",
-                               ntohl(th->seq), ntohl(th->ack_seq));
-                /* Max length: 13 "WINDOW=65535 " */
-                sb_add(m, "WINDOW=%u ", ntohs(th->window));
-                /* Max length: 9 "RES=0x3F " */
-                sb_add(m, "RES=0x%02x ", (u8)(ntohl(tcp_flag_word(th) & TCP_RESERVED_BITS) >> 22));
-                /* Max length: 32 "CWR ECE URG ACK PSH RST SYN FIN " */
-                if (th->cwr)
-                        sb_add(m, "CWR ");
-                if (th->ece)
-                        sb_add(m, "ECE ");
-                if (th->urg)
-                        sb_add(m, "URG ");
-                if (th->ack)
-                        sb_add(m, "ACK ");
-                if (th->psh)
-                        sb_add(m, "PSH ");
-                if (th->rst)
-                        sb_add(m, "RST ");
-                if (th->syn)
-                        sb_add(m, "SYN ");
-                if (th->fin)
-                        sb_add(m, "FIN ");
-                /* Max length: 11 "URGP=65535 " */
-                sb_add(m, "URGP=%u ", ntohs(th->urg_ptr));
-
-                if ((logflags & IPT_LOG_TCPOPT) &&
-                    th->doff * 4 > sizeof(struct tcphdr)) {
-                        unsigned char _opt[4 * 15 - sizeof(struct tcphdr)];
-                        const unsigned char *op;
-                        unsigned int i, optsize;
-
-                        optsize = th->doff * 4 - sizeof(struct tcphdr);
-                        op = skb_header_pointer(skb,
-                                                iphoff+ih->ihl*4+sizeof(_tcph),
-                                                optsize, _opt);
-                        if (op == NULL) {
-                                sb_add(m, "TRUNCATED");
-                                return;
-                        }
-
-                        /* Max length: 127 "OPT (" 15*4*2chars ") " */
-                        sb_add(m, "OPT (");
-                        for (i = 0; i < optsize; i++)
-                                sb_add(m, "%02X", op[i]);
-                        sb_add(m, ") ");
-                }
-                break;
-        }
-        case IPPROTO_UDP:
-        case IPPROTO_UDPLITE: {
-                struct udphdr _udph;
-                const struct udphdr *uh;
-
-                if (ih->protocol == IPPROTO_UDP)
-                        /* Max length: 10 "PROTO=UDP "     */
-                        sb_add(m, "PROTO=UDP " );
-                else    /* Max length: 14 "PROTO=UDPLITE " */
-                        sb_add(m, "PROTO=UDPLITE ");
-
-                if (ntohs(ih->frag_off) & IP_OFFSET)
-                        break;
-
-                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
-                uh = skb_header_pointer(skb, iphoff+ih->ihl*4,
-                                        sizeof(_udph), &_udph);
-                if (uh == NULL) {
-                        sb_add(m, "INCOMPLETE [%u bytes] ",
-                               skb->len - iphoff - ih->ihl*4);
-                        break;
-                }
-
-                /* Max length: 20 "SPT=65535 DPT=65535 " */
-                sb_add(m, "SPT=%u DPT=%u LEN=%u ",
-                       ntohs(uh->source), ntohs(uh->dest),
-                       ntohs(uh->len));
-                break;
-        }
-        case IPPROTO_ICMP: {
-                struct icmphdr _icmph;
-                const struct icmphdr *ich;
-                static const size_t required_len[NR_ICMP_TYPES+1]
-                        = { [ICMP_ECHOREPLY] = 4,
-                            [ICMP_DEST_UNREACH]
-                            = 8 + sizeof(struct iphdr),
-                            [ICMP_SOURCE_QUENCH]
-                            = 8 + sizeof(struct iphdr),
-                            [ICMP_REDIRECT]
-                            = 8 + sizeof(struct iphdr),
-                            [ICMP_ECHO] = 4,
-                            [ICMP_TIME_EXCEEDED]
-                            = 8 + sizeof(struct iphdr),
-                            [ICMP_PARAMETERPROB]
-                            = 8 + sizeof(struct iphdr),
-                            [ICMP_TIMESTAMP] = 20,
-                            [ICMP_TIMESTAMPREPLY] = 20,
-                            [ICMP_ADDRESS] = 12,
-                            [ICMP_ADDRESSREPLY] = 12 };
-
-                /* Max length: 11 "PROTO=ICMP " */
-                sb_add(m, "PROTO=ICMP ");
-
-                if (ntohs(ih->frag_off) & IP_OFFSET)
-                        break;
-
-                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
-                ich = skb_header_pointer(skb, iphoff + ih->ihl * 4,
-                                         sizeof(_icmph), &_icmph);
-                if (ich == NULL) {
-                        sb_add(m, "INCOMPLETE [%u bytes] ",
-                               skb->len - iphoff - ih->ihl*4);
-                        break;
-                }
-
-                /* Max length: 18 "TYPE=255 CODE=255 " */
-                sb_add(m, "TYPE=%u CODE=%u ", ich->type, ich->code);
-
-                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
-                if (ich->type <= NR_ICMP_TYPES &&
-                    required_len[ich->type] &&
-                    skb->len-iphoff-ih->ihl*4 < required_len[ich->type]) {
-                        sb_add(m, "INCOMPLETE [%u bytes] ",
-                               skb->len - iphoff - ih->ihl*4);
-                        break;
-                }
-
-                switch (ich->type) {
-                case ICMP_ECHOREPLY:
-                case ICMP_ECHO:
-                        /* Max length: 19 "ID=65535 SEQ=65535 " */
-                        sb_add(m, "ID=%u SEQ=%u ",
-                               ntohs(ich->un.echo.id),
-                               ntohs(ich->un.echo.sequence));
-                        break;
-
-                case ICMP_PARAMETERPROB:
-                        /* Max length: 14 "PARAMETER=255 " */
-                        sb_add(m, "PARAMETER=%u ",
-                               ntohl(ich->un.gateway) >> 24);
-                        break;
-                case ICMP_REDIRECT:
-                        /* Max length: 24 "GATEWAY=255.255.255.255 " */
-                        sb_add(m, "GATEWAY=%pI4 ", &ich->un.gateway);
-                        /* Fall through */
-                case ICMP_DEST_UNREACH:
-                case ICMP_SOURCE_QUENCH:
-                case ICMP_TIME_EXCEEDED:
-                        /* Max length: 3+maxlen */
-                        if (!iphoff) { /* Only recurse once. */
-                                sb_add(m, "[");
-                                dump_packet(m, info, skb,
-                                            iphoff + ih->ihl*4+sizeof(_icmph));
-                                sb_add(m, "] ");
-                        }
-
-                        /* Max length: 10 "MTU=65535 " */
-                        if (ich->type == ICMP_DEST_UNREACH &&
-                            ich->code == ICMP_FRAG_NEEDED)
-                                sb_add(m, "MTU=%u ", ntohs(ich->un.frag.mtu));
-                }
-                break;
-        }
-        /* Max Length */
-        case IPPROTO_AH: {
-                struct ip_auth_hdr _ahdr;
-                const struct ip_auth_hdr *ah;
-
-                if (ntohs(ih->frag_off) & IP_OFFSET)
-                        break;
-
-                /* Max length: 9 "PROTO=AH " */
-                sb_add(m, "PROTO=AH ");
-
-                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
-                ah = skb_header_pointer(skb, iphoff+ih->ihl*4,
-                                        sizeof(_ahdr), &_ahdr);
-                if (ah == NULL) {
-                        sb_add(m, "INCOMPLETE [%u bytes] ",
-                               skb->len - iphoff - ih->ihl*4);
-                        break;
-                }
-
-                /* Length: 15 "SPI=0xF1234567 " */
-                sb_add(m, "SPI=0x%x ", ntohl(ah->spi));
-                break;
-        }
-        case IPPROTO_ESP: {
-                struct ip_esp_hdr _esph;
-                const struct ip_esp_hdr *eh;
-
-                /* Max length: 10 "PROTO=ESP " */
-                sb_add(m, "PROTO=ESP ");
-
-                if (ntohs(ih->frag_off) & IP_OFFSET)
-                        break;
-
-                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
-                eh = skb_header_pointer(skb, iphoff+ih->ihl*4,
-                                        sizeof(_esph), &_esph);
-                if (eh == NULL) {
-                        sb_add(m, "INCOMPLETE [%u bytes] ",
-                               skb->len - iphoff - ih->ihl*4);
-                        break;
-                }
-
-                /* Length: 15 "SPI=0xF1234567 " */
-                sb_add(m, "SPI=0x%x ", ntohl(eh->spi));
-                break;
-        }
-        /* Max length: 10 "PROTO 255 " */
-        default:
-                sb_add(m, "PROTO=%u ", ih->protocol);
-        }
-
-        /* Max length: 15 "UID=4294967295 " */
-        if ((logflags & IPT_LOG_UID) && !iphoff && skb->sk) {
-                read_lock_bh(&skb->sk->sk_callback_lock);
-                if (skb->sk->sk_socket && skb->sk->sk_socket->file)
-                        sb_add(m, "UID=%u GID=%u ",
-                                skb->sk->sk_socket->file->f_cred->fsuid,
-                                skb->sk->sk_socket->file->f_cred->fsgid);
-                read_unlock_bh(&skb->sk->sk_callback_lock);
-        }
-
-        /* Max length: 16 "MARK=0xFFFFFFFF " */
-        if (!iphoff && skb->mark)
-                sb_add(m, "MARK=0x%x ", skb->mark);
-
-        /* Proto    Max log string length */
-        /* IP:      40+46+6+11+127 = 230 */
-        /* TCP:     10+max(25,20+30+13+9+32+11+127) = 252 */
-        /* UDP:     10+max(25,20) = 35 */
-        /* UDPLITE: 14+max(25,20) = 39 */
-        /* ICMP:    11+max(25, 18+25+max(19,14,24+3+n+10,3+n+10)) = 91+n */
-        /* ESP:     10+max(25)+15 = 50 */
-        /* AH:      9+max(25)+15 = 49 */
-        /* unknown: 10 */
-
-        /* (ICMP allows recursion one level deep) */
-        /* maxlen =  IP + ICMP +  IP + max(TCP,UDP,ICMP,unknown) */
-        /* maxlen = 230+   91  + 230 + 252 = 803 */
-}
-
-static void dump_mac_header(struct sbuff *m,
-                            const struct nf_loginfo *info,
-                            const struct sk_buff *skb)
-{
-        struct net_device *dev = skb->dev;
-        unsigned int logflags = 0;
-
-        if (info->type == NF_LOG_TYPE_LOG)
-                logflags = info->u.log.logflags;
-
-        if (!(logflags & IPT_LOG_MACDECODE))
-                goto fallback;
-
-        switch (dev->type) {
-        case ARPHRD_ETHER:
-                sb_add(m, "MACSRC=%pM MACDST=%pM MACPROTO=%04x ",
-                       eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
-                       ntohs(eth_hdr(skb)->h_proto));
-                return;
-        default:
-                break;
-        }
-
-fallback:
-        sb_add(m, "MAC=");
-        if (dev->hard_header_len &&
-            skb->mac_header != skb->network_header) {
-                const unsigned char *p = skb_mac_header(skb);
-                unsigned int i;
-
-                sb_add(m, "%02x", *p++);
-                for (i = 1; i < dev->hard_header_len; i++, p++)
-                        sb_add(m, ":%02x", *p);
-        }
-        sb_add(m, " ");
-}
-
-static struct nf_loginfo default_loginfo = {
-        .type   = NF_LOG_TYPE_LOG,
-        .u = {
-                .log = {
-                        .level    = 5,
-                        .logflags = NF_LOG_MASK,
-                },
-        },
-};
-
-static void
-ipt_log_packet(u_int8_t pf,
-               unsigned int hooknum,
-               const struct sk_buff *skb,
-               const struct net_device *in,
-               const struct net_device *out,
-               const struct nf_loginfo *loginfo,
-               const char *prefix)
-{
-        struct sbuff *m = sb_open();
-
-        if (!loginfo)
-                loginfo = &default_loginfo;
-
-        sb_add(m, "<%d>%sIN=%s OUT=%s ", loginfo->u.log.level,
-               prefix,
-               in ? in->name : "",
-               out ? out->name : "");
-#ifdef CONFIG_BRIDGE_NETFILTER
-        if (skb->nf_bridge) {
-                const struct net_device *physindev;
-                const struct net_device *physoutdev;
-
-                physindev = skb->nf_bridge->physindev;
-                if (physindev && in != physindev)
-                        sb_add(m, "PHYSIN=%s ", physindev->name);
-                physoutdev = skb->nf_bridge->physoutdev;
-                if (physoutdev && out != physoutdev)
-                        sb_add(m, "PHYSOUT=%s ", physoutdev->name);
-        }
-#endif
-
-        if (in != NULL)
-                dump_mac_header(m, loginfo, skb);
-
-        dump_packet(m, loginfo, skb, 0);
-
-        sb_close(m);
-}
-
-static unsigned int
-log_tg(struct sk_buff *skb, const struct xt_action_param *par)
-{
-        const struct ipt_log_info *loginfo = par->targinfo;
-        struct nf_loginfo li;
-
-        li.type = NF_LOG_TYPE_LOG;
-        li.u.log.level = loginfo->level;
-        li.u.log.logflags = loginfo->logflags;
-
-        ipt_log_packet(NFPROTO_IPV4, par->hooknum, skb, par->in, par->out, &li,
-                       loginfo->prefix);
-        return XT_CONTINUE;
-}
-
-static int log_tg_check(const struct xt_tgchk_param *par)
-{
-        const struct ipt_log_info *loginfo = par->targinfo;
-
-        if (loginfo->level >= 8) {
-                pr_debug("level %u >= 8\n", loginfo->level);
-                return -EINVAL;
-        }
-        if (loginfo->prefix[sizeof(loginfo->prefix)-1] != '\0') {
-                pr_debug("prefix is not null-terminated\n");
-                return -EINVAL;
-        }
-        return 0;
-}
-
-static struct xt_target log_tg_reg __read_mostly = {
-        .name           = "LOG",
-        .family         = NFPROTO_IPV4,
-        .target         = log_tg,
-        .targetsize     = sizeof(struct ipt_log_info),
-        .checkentry     = log_tg_check,
-        .me             = THIS_MODULE,
-};
-
-static struct nf_logger ipt_log_logger __read_mostly = {
-        .name           = "ipt_LOG",
-        .logfn          = &ipt_log_packet,
-        .me             = THIS_MODULE,
-};
-
-static int __init log_tg_init(void)
-{
-        int ret;
-
-        ret = xt_register_target(&log_tg_reg);
-        if (ret < 0)
-                return ret;
-        nf_log_register(NFPROTO_IPV4, &ipt_log_logger);
-        return 0;
-}
-
-static void __exit log_tg_exit(void)
-{
-        nf_log_unregister(&ipt_log_logger);
-        xt_unregister_target(&log_tg_reg);
-}
-
-module_init(log_tg_init);
-module_exit(log_tg_exit);
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index 0e58f09e59fb..851acec852d2 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -52,7 +52,7 @@ iptable_filter_hook(unsigned int hook, struct sk_buff *skb,
 static struct nf_hook_ops *filter_ops __read_mostly;
 
 /* Default to forward because I got too much mail already. */
-static bool forward = NF_ACCEPT;
+static bool forward = true;
 module_param(forward, bool, 0000);
 
 static int __net_init iptable_filter_net_init(struct net *net)
@@ -64,7 +64,7 @@ static int __net_init iptable_filter_net_init(struct net *net)
                 return -ENOMEM;
         /* Entry 1 is the FORWARD hook */
         ((struct ipt_standard *)repl->entries)[1].target.verdict =
-                -forward - 1;
+                forward ? -NF_ACCEPT - 1 : -NF_DROP - 1;
 
         net->ipv4.iptable_filter =
                 ipt_register_table(net, &packet_filter, repl);
@@ -88,11 +88,6 @@ static int __init iptable_filter_init(void)
 {
         int ret;
 
-        if (forward < 0 || forward > NF_MAX_VERDICT) {
-                pr_err("iptables forward must be 0 or 1\n");
-                return -EINVAL;
-        }
-
         ret = register_pernet_subsys(&iptable_filter_net_ops);
         if (ret < 0)
                 return ret;
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index de9da21113a1..91747d4ebc26 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -74,16 +74,24 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
 
         iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
         if (iph == NULL)
-                return -NF_DROP;
+                return -NF_ACCEPT;
 
         /* Conntrack defragments packets, we might still see fragments
          * inside ICMP packets though. */
         if (iph->frag_off & htons(IP_OFFSET))
-                return -NF_DROP;
+                return -NF_ACCEPT;
 
         *dataoff = nhoff + (iph->ihl << 2);
         *protonum = iph->protocol;
 
+        /* Check bogus IP headers */
+        if (*dataoff > skb->len) {
+                pr_debug("nf_conntrack_ipv4: bogus IPv4 packet: "
+                         "nhoff %u, ihl %u, skblen %u\n",
+                         nhoff, iph->ihl << 2, skb->len);
+                return -NF_ACCEPT;
+        }
+
         return NF_ACCEPT;
 }
 
@@ -303,8 +311,9 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
 static int ipv4_tuple_to_nlattr(struct sk_buff *skb,
                                 const struct nf_conntrack_tuple *tuple)
 {
-        NLA_PUT_BE32(skb, CTA_IP_V4_SRC, tuple->src.u3.ip);
-        NLA_PUT_BE32(skb, CTA_IP_V4_DST, tuple->dst.u3.ip);
+        if (nla_put_be32(skb, CTA_IP_V4_SRC, tuple->src.u3.ip) ||
+            nla_put_be32(skb, CTA_IP_V4_DST, tuple->dst.u3.ip))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -356,7 +365,7 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 __read_mostly = {
         .nla_policy      = ipv4_nla_policy,
 #endif
 #if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
-        .ctl_table_path  = nf_net_ipv4_netfilter_sysctl_path,
+        .ctl_table_path  = "net/ipv4/netfilter",
         .ctl_table       = ip_ct_sysctl_table,
 #endif
         .me              = THIS_MODULE,
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index ab5b27a2916f..0847e373d33c 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -75,25 +75,31 @@ static int icmp_print_tuple(struct seq_file *s,
                           ntohs(tuple->src.u.icmp.id));
 }
 
+static unsigned int *icmp_get_timeouts(struct net *net)
+{
+        return &nf_ct_icmp_timeout;
+}
+
 /* Returns verdict for packet, or -1 for invalid. */
 static int icmp_packet(struct nf_conn *ct,
                        const struct sk_buff *skb,
                        unsigned int dataoff,
                        enum ip_conntrack_info ctinfo,
                        u_int8_t pf,
-                       unsigned int hooknum)
+                       unsigned int hooknum,
+                       unsigned int *timeout)
 {
         /* Do not immediately delete the connection after the first
            successful reply to avoid excessive conntrackd traffic
            and also to handle correctly ICMP echo reply duplicates. */
-        nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_icmp_timeout);
+        nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
 
         return NF_ACCEPT;
 }
 
 /* Called when a new connection for this protocol found. */
 static bool icmp_new(struct nf_conn *ct, const struct sk_buff *skb,
-                     unsigned int dataoff)
+                     unsigned int dataoff, unsigned int *timeouts)
 {
         static const u_int8_t valid_new[] = {
                 [ICMP_ECHO] = 1,
@@ -222,10 +228,10 @@ icmp_error(struct net *net, struct nf_conn *tmpl,
 static int icmp_tuple_to_nlattr(struct sk_buff *skb,
                                 const struct nf_conntrack_tuple *t)
 {
-        NLA_PUT_BE16(skb, CTA_PROTO_ICMP_ID, t->src.u.icmp.id);
-        NLA_PUT_U8(skb, CTA_PROTO_ICMP_TYPE, t->dst.u.icmp.type);
-        NLA_PUT_U8(skb, CTA_PROTO_ICMP_CODE, t->dst.u.icmp.code);
-
+        if (nla_put_be16(skb, CTA_PROTO_ICMP_ID, t->src.u.icmp.id) ||
+            nla_put_u8(skb, CTA_PROTO_ICMP_TYPE, t->dst.u.icmp.type) ||
+            nla_put_u8(skb, CTA_PROTO_ICMP_CODE, t->dst.u.icmp.code))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -263,6 +269,44 @@ static int icmp_nlattr_tuple_size(void)
 }
 #endif
 
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nfnetlink_cttimeout.h>
+
+static int icmp_timeout_nlattr_to_obj(struct nlattr *tb[], void *data)
+{
+        unsigned int *timeout = data;
+
+        if (tb[CTA_TIMEOUT_ICMP_TIMEOUT]) {
+                *timeout =
+                        ntohl(nla_get_be32(tb[CTA_TIMEOUT_ICMP_TIMEOUT])) * HZ;
+        } else {
+                /* Set default ICMP timeout. */
+                *timeout = nf_ct_icmp_timeout;
+        }
+        return 0;
+}
+
+static int
+icmp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
+{
+        const unsigned int *timeout = data;
+
+        if (nla_put_be32(skb, CTA_TIMEOUT_ICMP_TIMEOUT, htonl(*timeout / HZ)))
+                goto nla_put_failure;
+        return 0;
+
+nla_put_failure:
+        return -ENOSPC;
+}
+
+static const struct nla_policy
+icmp_timeout_nla_policy[CTA_TIMEOUT_ICMP_MAX+1] = {
+        [CTA_TIMEOUT_ICMP_TIMEOUT]      = { .type = NLA_U32 },
+};
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+
 #ifdef CONFIG_SYSCTL
 static struct ctl_table_header *icmp_sysctl_header;
 static struct ctl_table icmp_sysctl_table[] = {
@@ -298,6 +342,7 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp __read_mostly =
         .invert_tuple           = icmp_invert_tuple,
         .print_tuple            = icmp_print_tuple,
         .packet                 = icmp_packet,
+        .get_timeouts           = icmp_get_timeouts,
         .new                    = icmp_new,
         .error                  = icmp_error,
         .destroy                = NULL,
@@ -308,6 +353,15 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp __read_mostly =
         .nlattr_to_tuple        = icmp_nlattr_to_tuple,
         .nla_policy             = icmp_nla_policy,
 #endif
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+        .ctnl_timeout           = {
+                .nlattr_to_obj  = icmp_timeout_nlattr_to_obj,
+                .obj_to_nlattr  = icmp_timeout_obj_to_nlattr,
+                .nlattr_max     = CTA_TIMEOUT_ICMP_MAX,
+                .obj_size       = sizeof(unsigned int),
+                .nla_policy     = icmp_timeout_nla_policy,
+        },
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
 #ifdef CONFIG_SYSCTL
         .ctl_table_header       = &icmp_sysctl_header,
         .ctl_table              = icmp_sysctl_table,
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index a708933dc230..abb52adf5acd 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -686,6 +686,11 @@ static struct pernet_operations nf_nat_net_ops = {
         .exit = nf_nat_net_exit,
 };
 
+static struct nf_ct_helper_expectfn follow_master_nat = {
+        .name           = "nat-follow-master",
+        .expectfn       = nf_nat_follow_master,
+};
+
 static int __init nf_nat_init(void)
 {
         size_t i;
@@ -717,6 +722,8 @@ static int __init nf_nat_init(void)
 
         l3proto = nf_ct_l3proto_find_get((u_int16_t)AF_INET);
 
+        nf_ct_helper_expectfn_register(&follow_master_nat);
+
         BUG_ON(nf_nat_seq_adjust_hook != NULL);
         RCU_INIT_POINTER(nf_nat_seq_adjust_hook, nf_nat_seq_adjust);
         BUG_ON(nfnetlink_parse_nat_setup_hook != NULL);
@@ -736,6 +743,7 @@ static void __exit nf_nat_cleanup(void)
         unregister_pernet_subsys(&nf_nat_net_ops);
         nf_ct_l3proto_put(l3proto);
         nf_ct_extend_unregister(&nat_extend);
+        nf_ct_helper_expectfn_unregister(&follow_master_nat);
         RCU_INIT_POINTER(nf_nat_seq_adjust_hook, NULL);
         RCU_INIT_POINTER(nfnetlink_parse_nat_setup_hook, NULL);
         RCU_INIT_POINTER(nf_ct_nat_offset, NULL);
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index dc1dd912baf4..cad29c121318 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -42,9 +42,7 @@ static int set_addr(struct sk_buff *skb,
                 if (!nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
                                               addroff, sizeof(buf),
                                               (char *) &buf, sizeof(buf))) {
-                        if (net_ratelimit())
-                                pr_notice("nf_nat_h323: nf_nat_mangle_tcp_packet"
-                                       " error\n");
+                        net_notice_ratelimited("nf_nat_h323: nf_nat_mangle_tcp_packet error\n");
                         return -1;
                 }
 
@@ -58,9 +56,7 @@ static int set_addr(struct sk_buff *skb,
                 if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo,
                                               addroff, sizeof(buf),
                                               (char *) &buf, sizeof(buf))) {
-                        if (net_ratelimit())
-                                pr_notice("nf_nat_h323: nf_nat_mangle_udp_packet"
-                                       " error\n");
+                        net_notice_ratelimited("nf_nat_h323: nf_nat_mangle_udp_packet error\n");
                         return -1;
                 }
                 /* nf_nat_mangle_udp_packet uses skb_make_writable() to copy
@@ -214,8 +210,7 @@ static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
 
         /* Run out of expectations */
         if (i >= H323_RTP_CHANNEL_MAX) {
-                if (net_ratelimit())
-                        pr_notice("nf_nat_h323: out of expectations\n");
+                net_notice_ratelimited("nf_nat_h323: out of expectations\n");
                 return 0;
         }
 
@@ -244,8 +239,7 @@ static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
         }
 
         if (nated_port == 0) {  /* No port available */
-                if (net_ratelimit())
-                        pr_notice("nf_nat_h323: out of RTP ports\n");
+                net_notice_ratelimited("nf_nat_h323: out of RTP ports\n");
                 return 0;
         }
 
@@ -308,8 +302,7 @@ static int nat_t120(struct sk_buff *skb, struct nf_conn *ct,
         }
 
         if (nated_port == 0) {  /* No port available */
-                if (net_ratelimit())
-                        pr_notice("nf_nat_h323: out of TCP ports\n");
+                net_notice_ratelimited("nf_nat_h323: out of TCP ports\n");
                 return 0;
         }
 
@@ -365,8 +358,7 @@ static int nat_h245(struct sk_buff *skb, struct nf_conn *ct,
         }
 
         if (nated_port == 0) {  /* No port available */
-                if (net_ratelimit())
-                        pr_notice("nf_nat_q931: out of TCP ports\n");
+                net_notice_ratelimited("nf_nat_q931: out of TCP ports\n");
                 return 0;
         }
 
@@ -456,8 +448,7 @@ static int nat_q931(struct sk_buff *skb, struct nf_conn *ct,
         }
 
         if (nated_port == 0) {  /* No port available */
-                if (net_ratelimit())
-                        pr_notice("nf_nat_ras: out of TCP ports\n");
+                net_notice_ratelimited("nf_nat_ras: out of TCP ports\n");
                 return 0;
         }
 
@@ -545,8 +536,7 @@ static int nat_callforwarding(struct sk_buff *skb, struct nf_conn *ct,
         }
 
         if (nated_port == 0) {  /* No port available */
-                if (net_ratelimit())
-                        pr_notice("nf_nat_q931: out of TCP ports\n");
+                net_notice_ratelimited("nf_nat_q931: out of TCP ports\n");
                 return 0;
         }
 
@@ -568,6 +558,16 @@ static int nat_callforwarding(struct sk_buff *skb, struct nf_conn *ct,
         return 0;
 }
 
+static struct nf_ct_helper_expectfn q931_nat = {
+        .name           = "Q.931",
+        .expectfn       = ip_nat_q931_expect,
+};
+
+static struct nf_ct_helper_expectfn callforwarding_nat = {
+        .name           = "callforwarding",
+        .expectfn       = ip_nat_callforwarding_expect,
+};
+
 /****************************************************************************/
 static int __init init(void)
 {
@@ -590,6 +590,8 @@ static int __init init(void)
         RCU_INIT_POINTER(nat_h245_hook, nat_h245);
         RCU_INIT_POINTER(nat_callforwarding_hook, nat_callforwarding);
         RCU_INIT_POINTER(nat_q931_hook, nat_q931);
+        nf_ct_helper_expectfn_register(&q931_nat);
+        nf_ct_helper_expectfn_register(&callforwarding_nat);
         return 0;
 }
 
@@ -605,6 +607,8 @@ static void __exit fini(void)
         RCU_INIT_POINTER(nat_h245_hook, NULL);
         RCU_INIT_POINTER(nat_callforwarding_hook, NULL);
         RCU_INIT_POINTER(nat_q931_hook, NULL);
+        nf_ct_helper_expectfn_unregister(&q931_nat);
+        nf_ct_helper_expectfn_unregister(&callforwarding_nat);
         synchronize_rcu();
 }
 
diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
index d0319f96269f..ea4a23813d26 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -283,7 +283,7 @@ static unsigned int ip_nat_sip_expect(struct sk_buff *skb, unsigned int dataoff,
         __be32 newip;
         u_int16_t port;
         char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
-        unsigned buflen;
+        unsigned int buflen;
 
         /* Connection will come from reply */
         if (ct->tuplehash[dir].tuple.src.u3.ip == ct->tuplehash[!dir].tuple.dst.u3.ip)
@@ -526,6 +526,11 @@ err1:
         return NF_DROP;
 }
 
+static struct nf_ct_helper_expectfn sip_nat = {
+        .name           = "sip",
+        .expectfn       = ip_nat_sip_expected,
+};
+
 static void __exit nf_nat_sip_fini(void)
 {
         RCU_INIT_POINTER(nf_nat_sip_hook, NULL);
@@ -535,6 +540,7 @@ static void __exit nf_nat_sip_fini(void)
         RCU_INIT_POINTER(nf_nat_sdp_port_hook, NULL);
         RCU_INIT_POINTER(nf_nat_sdp_session_hook, NULL);
         RCU_INIT_POINTER(nf_nat_sdp_media_hook, NULL);
+        nf_ct_helper_expectfn_unregister(&sip_nat);
         synchronize_rcu();
 }
 
@@ -554,6 +560,7 @@ static int __init nf_nat_sip_init(void)
         RCU_INIT_POINTER(nf_nat_sdp_port_hook, ip_nat_sdp_port);
         RCU_INIT_POINTER(nf_nat_sdp_session_hook, ip_nat_sdp_session);
         RCU_INIT_POINTER(nf_nat_sdp_media_hook, ip_nat_sdp_media);
+        nf_ct_helper_expectfn_register(&sip_nat);
         return 0;
 }
 
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 2133c30a4a5f..746edec8b86e 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -1206,8 +1206,7 @@ static int snmp_translate(struct nf_conn *ct,
 
         if (!snmp_parse_mangle((unsigned char *)udph + sizeof(struct udphdr),
                                paylen, &map, &udph->check)) {
-                if (net_ratelimit())
-                        printk(KERN_WARNING "bsalg: parser failed\n");
+                net_warn_ratelimited("bsalg: parser failed\n");
                 return NF_DROP;
         }
         return NF_ACCEPT;
@@ -1241,9 +1240,8 @@ static int help(struct sk_buff *skb, unsigned int protoff,
          * can mess around with the payload.
          */
         if (ntohs(udph->len) != skb->len - (iph->ihl << 2)) {
-                 if (net_ratelimit())
-                         printk(KERN_WARNING "SNMP: dropping malformed packet src=%pI4 dst=%pI4\n",
-                                &iph->saddr, &iph->daddr);
+                net_warn_ratelimited("SNMP: dropping malformed packet src=%pI4 dst=%pI4\n",
+                                     &iph->saddr, &iph->daddr);
                  return NF_DROP;
         }
 
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index b072386cee21..2c00e8bf684d 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -20,7 +20,6 @@
  *
  */
 
-#include <asm/system.h>
 #include <linux/uaccess.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
@@ -52,15 +51,16 @@ static struct ping_table ping_table;
 
 static u16 ping_port_rover;
 
-static inline int ping_hashfn(struct net *net, unsigned num, unsigned mask)
+static inline int ping_hashfn(struct net *net, unsigned int num, unsigned int mask)
 {
         int res = (num + net_hash_mix(net)) & mask;
+
         pr_debug("hash(%d) = %d\n", num, res);
         return res;
 }
 
 static inline struct hlist_nulls_head *ping_hashslot(struct ping_table *table,
-                                             struct net *net, unsigned num)
+                                             struct net *net, unsigned int num)
 {
         return &table->hash[ping_hashfn(net, num, PING_HTABLE_MASK)];
 }
@@ -156,7 +156,7 @@ static struct sock *ping_v4_lookup(struct net *net, __be32 saddr, __be32 daddr,
         struct hlist_nulls_node *hnode;
 
         pr_debug("try to find: num = %d, daddr = %pI4, dif = %d\n",
-                         (int)ident, &daddr, dif);
+                 (int)ident, &daddr, dif);
         read_lock_bh(&ping_table.lock);
 
         ping_portaddr_for_each_entry(sk, hnode, hslot) {
@@ -189,7 +189,8 @@ static void inet_get_ping_group_range_net(struct net *net, gid_t *low,
                                           gid_t *high)
 {
         gid_t *data = net->ipv4.sysctl_ping_group_range;
-        unsigned seq;
+        unsigned int seq;
+
         do {
                 seq = read_seqbegin(&sysctl_local_ports.lock);
 
@@ -206,17 +207,22 @@ static int ping_init_sock(struct sock *sk)
         gid_t range[2];
         struct group_info *group_info = get_current_groups();
         int i, j, count = group_info->ngroups;
+        kgid_t low, high;
 
         inet_get_ping_group_range_net(net, range, range+1);
+        low = make_kgid(&init_user_ns, range[0]);
+        high = make_kgid(&init_user_ns, range[1]);
+        if (!gid_valid(low) || !gid_valid(high) || gid_lt(high, low))
+                return -EACCES;
+
         if (range[0] <= group && group <= range[1])
                 return 0;
 
         for (i = 0; i < group_info->nblocks; i++) {
                 int cp_count = min_t(int, NGROUPS_PER_BLOCK, count);
-
                 for (j = 0; j < cp_count; j++) {
-                        group = group_info->blocks[i][j];
-                        if (range[0] <= group && group <= range[1])
+                        kgid_t gid = group_info->blocks[i][j];
+                        if (gid_lte(low, gid) && gid_lte(gid, high))
                                 return 0;
                 }
 
@@ -229,7 +235,7 @@ static int ping_init_sock(struct sock *sk)
 static void ping_close(struct sock *sk, long timeout)
 {
         pr_debug("ping_close(sk=%p,sk->num=%u)\n",
-                inet_sk(sk), inet_sk(sk)->inet_num);
+                 inet_sk(sk), inet_sk(sk)->inet_num);
         pr_debug("isk->refcnt = %d\n", sk->sk_refcnt.counter);
 
         sk_common_release(sk);
@@ -252,7 +258,7 @@ static int ping_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 return -EINVAL;
 
         pr_debug("ping_v4_bind(sk=%p,sa_addr=%08x,sa_port=%d)\n",
-                sk, addr->sin_addr.s_addr, ntohs(addr->sin_port));
+                 sk, addr->sin_addr.s_addr, ntohs(addr->sin_port));
 
         chk_addr_ret = inet_addr_type(sock_net(sk), addr->sin_addr.s_addr);
         if (addr->sin_addr.s_addr == htonl(INADDR_ANY))
@@ -280,9 +286,9 @@ static int ping_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         }
 
         pr_debug("after bind(): num = %d, daddr = %pI4, dif = %d\n",
-                (int)isk->inet_num,
-                &isk->inet_rcv_saddr,
-                (int)sk->sk_bound_dev_if);
+                 (int)isk->inet_num,
+                 &isk->inet_rcv_saddr,
+                 (int)sk->sk_bound_dev_if);
 
         err = 0;
         if (isk->inet_rcv_saddr)
@@ -335,7 +341,7 @@ void ping_err(struct sk_buff *skb, u32 info)
                 return;
 
         pr_debug("ping_err(type=%04x,code=%04x,id=%04x,seq=%04x)\n", type,
-                code, ntohs(icmph->un.echo.id), ntohs(icmph->un.echo.sequence));
+                 code, ntohs(icmph->un.echo.id), ntohs(icmph->un.echo.sequence));
 
         sk = ping_v4_lookup(net, iph->daddr, iph->saddr,
                             ntohs(icmph->un.echo.id), skb->dev->ifindex);
@@ -411,7 +417,7 @@ struct pingfakehdr {
         __wsum wcheck;
 };
 
-static int ping_getfrag(void *from, char * to,
+static int ping_getfrag(void *from, char *to,
                         int offset, int fraglen, int odd, struct sk_buff *skb)
 {
         struct pingfakehdr *pfh = (struct pingfakehdr *)from;
@@ -556,7 +562,8 @@ static int ping_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         ipc.oif = inet->mc_index;
                 if (!saddr)
                         saddr = inet->mc_addr;
-        }
+        } else if (!ipc.oif)
+                ipc.oif = inet->uc_index;
 
         flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
                            RT_SCOPE_UNIVERSE, sk->sk_protocol,
@@ -678,7 +685,7 @@ out:
 static int ping_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         pr_debug("ping_queue_rcv_skb(sk=%p,sk->num=%d,skb=%p)\n",
-                inet_sk(sk), inet_sk(sk)->inet_num, skb);
+                 inet_sk(sk), inet_sk(sk)->inet_num, skb);
         if (sock_queue_rcv_skb(sk, skb) < 0) {
                 kfree_skb(skb);
                 pr_debug("ping_queue_rcv_skb -> failed\n");
@@ -704,7 +711,7 @@ void ping_rcv(struct sk_buff *skb)
         /* We assume the packet has already been checked by icmp_rcv */
 
         pr_debug("ping_rcv(skb=%p,id=%04x,seq=%04x)\n",
-                skb, ntohs(icmph->un.echo.id), ntohs(icmph->un.echo.sequence));
+                 skb, ntohs(icmph->un.echo.id), ntohs(icmph->un.echo.sequence));
 
         /* Push ICMP header back */
         skb_push(skb, skb->data - (u8 *)icmph);
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 6afc807ee2ad..8af0d44e4e22 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -256,6 +256,8 @@ static const struct snmp_mib snmp4_net_list[] = {
         SNMP_MIB_ITEM("TCPTimeWaitOverflow", LINUX_MIB_TCPTIMEWAITOVERFLOW),
         SNMP_MIB_ITEM("TCPReqQFullDoCookies", LINUX_MIB_TCPREQQFULLDOCOOKIES),
         SNMP_MIB_ITEM("TCPReqQFullDrop", LINUX_MIB_TCPREQQFULLDROP),
+        SNMP_MIB_ITEM("TCPRetransFail", LINUX_MIB_TCPRETRANSFAIL),
+        SNMP_MIB_ITEM("TCPRcvCoalesce", LINUX_MIB_TCPRCVCOALESCE),
         SNMP_MIB_SENTINEL
 };
 
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 3ccda5ae8a27..4032b818f3e4 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -288,7 +288,7 @@ void raw_icmp_error(struct sk_buff *skb, int protocol, u32 info)
         read_unlock(&raw_v4_hashinfo.lock);
 }
 
-static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
+static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         /* Charge it to the socket. */
 
@@ -491,11 +491,8 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 if (msg->msg_namelen < sizeof(*usin))
                         goto out;
                 if (usin->sin_family != AF_INET) {
-                        static int complained;
-                        if (!complained++)
-                                printk(KERN_INFO "%s forgot to set AF_INET in "
-                                                 "raw sendmsg. Fix it!\n",
-                                                 current->comm);
+                        pr_info_once("%s: %s forgot to set AF_INET. Fix it!\n",
+                                     __func__, current->comm);
                         err = -EAFNOSUPPORT;
                         if (usin->sin_family)
                                 goto out;
@@ -563,7 +560,8 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         ipc.oif = inet->mc_index;
                 if (!saddr)
                         saddr = inet->mc_addr;
-        }
+        } else if (!ipc.oif)
+                ipc.oif = inet->uc_index;
 
         flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
                            RT_SCOPE_UNIVERSE,
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 019774796174..98b30d08efe9 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -62,9 +62,10 @@
  *              2 of the License, or (at your option) any later version.
  */
 
+#define pr_fmt(fmt) "IPv4: " fmt
+
 #include <linux/module.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/bitops.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
@@ -108,6 +109,7 @@
 #include <net/rtnetlink.h>
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
+#include <linux/kmemleak.h>
 #endif
 #include <net/secure_seq.h>
 
@@ -228,7 +230,7 @@ const __u8 ip_tos2prio[16] = {
         TC_PRIO_INTERACTIVE_BULK,
         ECN_OR_COST(INTERACTIVE_BULK)
 };
-
+EXPORT_SYMBOL(ip_tos2prio);
 
 /*
  * Route cache.
@@ -295,7 +297,7 @@ static inline void rt_hash_lock_init(void)
 #endif
 
 static struct rt_hash_bucket    *rt_hash_table __read_mostly;
-static unsigned                 rt_hash_mask __read_mostly;
+static unsigned int             rt_hash_mask __read_mostly;
 static unsigned int             rt_hash_log  __read_mostly;
 
 static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat);
@@ -958,8 +960,7 @@ void rt_cache_flush_batch(struct net *net)
 
 static void rt_emergency_hash_rebuild(struct net *net)
 {
-        if (net_ratelimit())
-                printk(KERN_WARNING "Route hash chain too long!\n");
+        net_warn_ratelimited("Route hash chain too long!\n");
         rt_cache_invalidate(net);
 }
 
@@ -1082,8 +1083,7 @@ static int rt_garbage_collect(struct dst_ops *ops)
                 goto out;
         if (dst_entries_get_slow(&ipv4_dst_ops) < ip_rt_max_size)
                 goto out;
-        if (net_ratelimit())
-                printk(KERN_WARNING "dst cache overflow\n");
+        net_warn_ratelimited("dst cache overflow\n");
         RT_CACHE_STAT_INC(gc_dst_overflow);
         return 1;
 
@@ -1116,12 +1116,17 @@ static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst, const vo
         static const __be32 inaddr_any = 0;
         struct net_device *dev = dst->dev;
         const __be32 *pkey = daddr;
+        const struct rtable *rt;
         struct neighbour *n;
 
+        rt = (const struct rtable *) dst;
+
         if (dev->flags & (IFF_LOOPBACK | IFF_POINTOPOINT))
                 pkey = &inaddr_any;
+        else if (rt->rt_gateway)
+                pkey = (const __be32 *) &rt->rt_gateway;
 
-        n = __ipv4_neigh_lookup(&arp_tbl, dev, *(__force u32 *)pkey);
+        n = __ipv4_neigh_lookup(dev, *(__force u32 *)pkey);
         if (n)
                 return n;
         return neigh_create(&arp_tbl, pkey, dev);
@@ -1137,7 +1142,7 @@ static int rt_bind_neighbour(struct rtable *rt)
         return 0;
 }
 
-static struct rtable *rt_intern_hash(unsigned hash, struct rtable *rt,
+static struct rtable *rt_intern_hash(unsigned int hash, struct rtable *rt,
                                      struct sk_buff *skb, int ifindex)
 {
         struct rtable   *rth, *cand;
@@ -1175,9 +1180,7 @@ restart:
                 if (rt->rt_type == RTN_UNICAST || rt_is_output_route(rt)) {
                         int err = rt_bind_neighbour(rt);
                         if (err) {
-                                if (net_ratelimit())
-                                        printk(KERN_WARNING
-                                            "Neighbour table failure & not caching routes.\n");
+                                net_warn_ratelimited("Neighbour table failure & not caching routes\n");
                                 ip_rt_put(rt);
                                 return ERR_PTR(err);
                         }
@@ -1253,7 +1256,7 @@ restart:
                         struct net *net = dev_net(rt->dst.dev);
                         int num = ++net->ipv4.current_rt_cache_rebuild_count;
                         if (!rt_caching(net)) {
-                                printk(KERN_WARNING "%s: %d rebuilds is over limit, route caching disabled\n",
+                                pr_warn("%s: %d rebuilds is over limit, route caching disabled\n",
                                         rt->dst.dev->name, num);
                         }
                         rt_emergency_hash_rebuild(net);
@@ -1293,8 +1296,7 @@ restart:
                                 goto restart;
                         }
 
-                        if (net_ratelimit())
-                                printk(KERN_WARNING "ipv4: Neighbour table overflow.\n");
+                        net_warn_ratelimited("Neighbour table overflow\n");
                         rt_drop(rt);
                         return ERR_PTR(-ENOBUFS);
                 }
@@ -1372,14 +1374,13 @@ void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more)
                         return;
                 }
         } else if (!rt)
-                printk(KERN_DEBUG "rt_bind_peer(0) @%p\n",
-                       __builtin_return_address(0));
+                pr_debug("rt_bind_peer(0) @%p\n", __builtin_return_address(0));
 
         ip_select_fb_ident(iph);
 }
 EXPORT_SYMBOL(__ip_select_ident);
 
-static void rt_del(unsigned hash, struct rtable *rt)
+static void rt_del(unsigned int hash, struct rtable *rt)
 {
         struct rtable __rcu **rthp;
         struct rtable *aux;
@@ -1497,11 +1498,11 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
 
 reject_redirect:
 #ifdef CONFIG_IP_ROUTE_VERBOSE
-        if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit())
-                printk(KERN_INFO "Redirect from %pI4 on %s about %pI4 ignored.\n"
-                        "  Advised path = %pI4 -> %pI4\n",
-                       &old_gw, dev->name, &new_gw,
-                       &saddr, &daddr);
+        if (IN_DEV_LOG_MARTIANS(in_dev))
+                net_info_ratelimited("Redirect from %pI4 on %s about %pI4 ignored\n"
+                                     "  Advised path = %pI4 -> %pI4\n",
+                                     &old_gw, dev->name, &new_gw,
+                                     &saddr, &daddr);
 #endif
         ;
 }
@@ -1533,7 +1534,7 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
                         ip_rt_put(rt);
                         ret = NULL;
                 } else if (rt->rt_flags & RTCF_REDIRECTED) {
-                        unsigned hash = rt_hash(rt->rt_key_dst, rt->rt_key_src,
+                        unsigned int hash = rt_hash(rt->rt_key_dst, rt->rt_key_src,
                                                 rt->rt_oif,
                                                 rt_genid(dev_net(dst->dev)));
                         rt_del(hash, rt);
@@ -1611,11 +1612,10 @@ void ip_rt_send_redirect(struct sk_buff *skb)
                 ++peer->rate_tokens;
 #ifdef CONFIG_IP_ROUTE_VERBOSE
                 if (log_martians &&
-                    peer->rate_tokens == ip_rt_redirect_number &&
-                    net_ratelimit())
-                        printk(KERN_WARNING "host %pI4/if%d ignores redirects for %pI4 to %pI4.\n",
-                               &ip_hdr(skb)->saddr, rt->rt_iif,
-                                &rt->rt_dst, &rt->rt_gateway);
+                    peer->rate_tokens == ip_rt_redirect_number)
+                        net_warn_ratelimited("host %pI4/if%d ignores redirects for %pI4 to %pI4\n",
+                                             &ip_hdr(skb)->saddr, rt->rt_iif,
+                                             &rt->rt_dst, &rt->rt_gateway);
 #endif
         }
 }
@@ -1838,9 +1838,9 @@ static void ipv4_link_failure(struct sk_buff *skb)
 
 static int ip_rt_bug(struct sk_buff *skb)
 {
-        printk(KERN_DEBUG "ip_rt_bug: %pI4 -> %pI4, %s\n",
-                &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
-                skb->dev ? skb->dev->name : "?");
+        pr_debug("%s: %pI4 -> %pI4, %s\n",
+                 __func__, &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
+                 skb->dev ? skb->dev->name : "?");
         kfree_skb(skb);
         WARN_ON(1);
         return 0;
@@ -2036,7 +2036,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                 if (err < 0)
                         goto e_err;
         }
-        rth = rt_dst_alloc(init_net.loopback_dev,
+        rth = rt_dst_alloc(dev_net(dev)->loopback_dev,
                            IN_DEV_CONF_GET(in_dev, NOPOLICY), false);
         if (!rth)
                 goto e_nobufs;
@@ -2100,18 +2100,13 @@ static void ip_handle_martian_source(struct net_device *dev,
                  *      RFC1812 recommendation, if source is martian,
                  *      the only hint is MAC header.
                  */
-                printk(KERN_WARNING "martian source %pI4 from %pI4, on dev %s\n",
+                pr_warn("martian source %pI4 from %pI4, on dev %s\n",
                         &daddr, &saddr, dev->name);
                 if (dev->hard_header_len && skb_mac_header_was_set(skb)) {
-                        int i;
-                        const unsigned char *p = skb_mac_header(skb);
-                        printk(KERN_WARNING "ll header: ");
-                        for (i = 0; i < dev->hard_header_len; i++, p++) {
-                                printk("%02x", *p);
-                                if (i < (dev->hard_header_len - 1))
-                                        printk(":");
-                        }
-                        printk("\n");
+                        print_hex_dump(KERN_WARNING, "ll header: ",
+                                       DUMP_PREFIX_OFFSET, 16, 1,
+                                       skb_mac_header(skb),
+                                       dev->hard_header_len, true);
                 }
         }
 #endif
@@ -2134,9 +2129,7 @@ static int __mkroute_input(struct sk_buff *skb,
         /* get a working reference to the output device */
         out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res));
         if (out_dev == NULL) {
-                if (net_ratelimit())
-                        printk(KERN_CRIT "Bug in ip_route_input" \
-                               "_slow(). Please, report\n");
+                net_crit_ratelimited("Bug in ip_route_input_slow(). Please report.\n");
                 return -EINVAL;
         }
 
@@ -2216,9 +2209,9 @@ static int ip_mkroute_input(struct sk_buff *skb,
                             struct in_device *in_dev,
                             __be32 daddr, __be32 saddr, u32 tos)
 {
-        struct rtable* rth = NULL;
+        struct rtable *rth = NULL;
         int err;
-        unsigned hash;
+        unsigned int hash;
 
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
         if (res->fi && res->fi->fib_nhs > 1)
@@ -2256,13 +2249,13 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         struct fib_result res;
         struct in_device *in_dev = __in_dev_get_rcu(dev);
         struct flowi4   fl4;
-        unsigned        flags = 0;
+        unsigned int    flags = 0;
         u32             itag = 0;
-        struct rtable * rth;
-        unsigned        hash;
+        struct rtable   *rth;
+        unsigned int    hash;
         __be32          spec_dst;
         int             err = -EINVAL;
-        struct net    * net = dev_net(dev);
+        struct net    *net = dev_net(dev);
 
         /* IP on this device is disabled. */
 
@@ -2407,9 +2400,9 @@ no_route:
 martian_destination:
         RT_CACHE_STAT_INC(in_martian_dst);
 #ifdef CONFIG_IP_ROUTE_VERBOSE
-        if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit())
-                printk(KERN_WARNING "martian destination %pI4 from %pI4, dev %s\n",
-                        &daddr, &saddr, dev->name);
+        if (IN_DEV_LOG_MARTIANS(in_dev))
+                net_warn_ratelimited("martian destination %pI4 from %pI4, dev %s\n",
+                                     &daddr, &saddr, dev->name);
 #endif
 
 e_hostunreach:
@@ -2434,8 +2427,8 @@ martian_source_keep_err:
 int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                            u8 tos, struct net_device *dev, bool noref)
 {
-        struct rtable * rth;
-        unsigned        hash;
+        struct rtable   *rth;
+        unsigned int    hash;
         int iif = dev->ifindex;
         struct net *net;
         int res;
@@ -2973,7 +2966,8 @@ static int rt_fill_info(struct net *net,
         r->rtm_src_len  = 0;
         r->rtm_tos      = rt->rt_key_tos;
         r->rtm_table    = RT_TABLE_MAIN;
-        NLA_PUT_U32(skb, RTA_TABLE, RT_TABLE_MAIN);
+        if (nla_put_u32(skb, RTA_TABLE, RT_TABLE_MAIN))
+                goto nla_put_failure;
         r->rtm_type     = rt->rt_type;
         r->rtm_scope    = RT_SCOPE_UNIVERSE;
         r->rtm_protocol = RTPROT_UNSPEC;
@@ -2981,31 +2975,38 @@ static int rt_fill_info(struct net *net,
         if (rt->rt_flags & RTCF_NOTIFY)
                 r->rtm_flags |= RTM_F_NOTIFY;
 
-        NLA_PUT_BE32(skb, RTA_DST, rt->rt_dst);
-
+        if (nla_put_be32(skb, RTA_DST, rt->rt_dst))
+                goto nla_put_failure;
         if (rt->rt_key_src) {
                 r->rtm_src_len = 32;
-                NLA_PUT_BE32(skb, RTA_SRC, rt->rt_key_src);
+                if (nla_put_be32(skb, RTA_SRC, rt->rt_key_src))
+                        goto nla_put_failure;
         }
-        if (rt->dst.dev)
-                NLA_PUT_U32(skb, RTA_OIF, rt->dst.dev->ifindex);
+        if (rt->dst.dev &&
+            nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex))
+                goto nla_put_failure;
 #ifdef CONFIG_IP_ROUTE_CLASSID
-        if (rt->dst.tclassid)
-                NLA_PUT_U32(skb, RTA_FLOW, rt->dst.tclassid);
+        if (rt->dst.tclassid &&
+            nla_put_u32(skb, RTA_FLOW, rt->dst.tclassid))
+                goto nla_put_failure;
 #endif
-        if (rt_is_input_route(rt))
-                NLA_PUT_BE32(skb, RTA_PREFSRC, rt->rt_spec_dst);
-        else if (rt->rt_src != rt->rt_key_src)
-                NLA_PUT_BE32(skb, RTA_PREFSRC, rt->rt_src);
-
-        if (rt->rt_dst != rt->rt_gateway)
-                NLA_PUT_BE32(skb, RTA_GATEWAY, rt->rt_gateway);
+        if (rt_is_input_route(rt)) {
+                if (nla_put_be32(skb, RTA_PREFSRC, rt->rt_spec_dst))
+                        goto nla_put_failure;
+        } else if (rt->rt_src != rt->rt_key_src) {
+                if (nla_put_be32(skb, RTA_PREFSRC, rt->rt_src))
+                        goto nla_put_failure;
+        }
+        if (rt->rt_dst != rt->rt_gateway &&
+            nla_put_be32(skb, RTA_GATEWAY, rt->rt_gateway))
+                goto nla_put_failure;
 
         if (rtnetlink_put_metrics(skb, dst_metrics_ptr(&rt->dst)) < 0)
                 goto nla_put_failure;
 
-        if (rt->rt_mark)
-                NLA_PUT_BE32(skb, RTA_MARK, rt->rt_mark);
+        if (rt->rt_mark &&
+            nla_put_be32(skb, RTA_MARK, rt->rt_mark))
+                goto nla_put_failure;
 
         error = rt->dst.error;
         if (peer) {
@@ -3046,7 +3047,8 @@ static int rt_fill_info(struct net *net,
                         }
                 } else
 #endif
-                        NLA_PUT_U32(skb, RTA_IIF, rt->rt_iif);
+                        if (nla_put_u32(skb, RTA_IIF, rt->rt_iif))
+                                goto nla_put_failure;
         }
 
         if (rtnl_put_cacheinfo(skb, &rt->dst, id, ts, tsage,
@@ -3060,7 +3062,7 @@ nla_put_failure:
         return -EMSGSIZE;
 }
 
-static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void *arg)
+static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, void *arg)
 {
         struct net *net = sock_net(in_skb->sk);
         struct rtmsg *rtm;
@@ -3335,23 +3337,6 @@ static ctl_table ipv4_route_table[] = {
         { }
 };
 
-static struct ctl_table empty[1];
-
-static struct ctl_table ipv4_skeleton[] =
-{
-        { .procname = "route", 
-          .mode = 0555, .child = ipv4_route_table},
-        { .procname = "neigh", 
-          .mode = 0555, .child = empty},
-        { }
-};
-
-static __net_initdata struct ctl_path ipv4_path[] = {
-        { .procname = "net", },
-        { .procname = "ipv4", },
-        { },
-};
-
 static struct ctl_table ipv4_route_flush_table[] = {
         {
                 .procname       = "flush",
@@ -3362,13 +3347,6 @@ static struct ctl_table ipv4_route_flush_table[] = {
         { },
 };
 
-static __net_initdata struct ctl_path ipv4_route_path[] = {
-        { .procname = "net", },
-        { .procname = "ipv4", },
-        { .procname = "route", },
-        { },
-};
-
 static __net_init int sysctl_route_net_init(struct net *net)
 {
         struct ctl_table *tbl;
@@ -3381,8 +3359,7 @@ static __net_init int sysctl_route_net_init(struct net *net)
         }
         tbl[0].extra1 = net;
 
-        net->ipv4.route_hdr =
-                register_net_sysctl_table(net, ipv4_route_path, tbl);
+        net->ipv4.route_hdr = register_net_sysctl(net, "net/ipv4/route", tbl);
         if (net->ipv4.route_hdr == NULL)
                 goto err_reg;
         return 0;
@@ -3431,9 +3408,15 @@ struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
 static __initdata unsigned long rhash_entries;
 static int __init set_rhash_entries(char *str)
 {
+        ssize_t ret;
+
         if (!str)
                 return 0;
-        rhash_entries = simple_strtoul(str, &str, 0);
+
+        ret = kstrtoul(str, 0, &rhash_entries);
+        if (ret)
+                return 0;
+
         return 1;
 }
 __setup("rhash_entries=", set_rhash_entries);
@@ -3469,6 +3452,7 @@ int __init ip_rt_init(void)
                                         0,
                                         &rt_hash_log,
                                         &rt_hash_mask,
+                                        0,
                                         rhash_entries ? 0 : 512 * 1024);
         memset(rt_hash_table, 0, (rt_hash_mask + 1) * sizeof(struct rt_hash_bucket));
         rt_hash_lock_init();
@@ -3485,7 +3469,7 @@ int __init ip_rt_init(void)
                 net_random() % ip_rt_gc_interval + ip_rt_gc_interval);
 
         if (ip_rt_proc_init())
-                printk(KERN_ERR "Unable to create route proc files\n");
+                pr_err("Unable to create route proc files\n");
 #ifdef CONFIG_XFRM
         xfrm_init();
         xfrm4_init(ip_rt_max_size);
@@ -3506,6 +3490,6 @@ int __init ip_rt_init(void)
  */
 void __init ip_static_sysctl_init(void)
 {
-        register_sysctl_paths(ipv4_path, ipv4_skeleton);
+        register_net_sysctl(&init_net, "net/ipv4/route", ipv4_route_table);
 }
 #endif
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 7a7724da9bff..ef32956ed655 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -27,6 +27,7 @@
 #include <net/tcp_memcontrol.h>
 
 static int zero;
+static int two = 2;
 static int tcp_retr1_max = 255;
 static int ip_local_port_range_min[] = { 1, 1 };
 static int ip_local_port_range_max[] = { 65535, 65535 };
@@ -78,7 +79,7 @@ static int ipv4_local_port_range(ctl_table *table, int write,
 static void inet_get_ping_group_range_table(struct ctl_table *table, gid_t *low, gid_t *high)
 {
         gid_t *data = table->data;
-        unsigned seq;
+        unsigned int seq;
         do {
                 seq = read_seqbegin(&sysctl_local_ports.lock);
 
@@ -677,6 +678,15 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
+                .procname       = "tcp_early_retrans",
+                .data           = &sysctl_tcp_early_retrans,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &two,
+        },
+        {
                 .procname       = "udp_mem",
                 .data           = &sysctl_udp_mem,
                 .maxlen         = sizeof(sysctl_udp_mem),
@@ -768,13 +778,6 @@ static struct ctl_table ipv4_net_table[] = {
         { }
 };
 
-struct ctl_path net_ipv4_ctl_path[] = {
-        { .procname = "net", },
-        { .procname = "ipv4", },
-        { },
-};
-EXPORT_SYMBOL_GPL(net_ipv4_ctl_path);
-
 static __net_init int ipv4_sysctl_init_net(struct net *net)
 {
         struct ctl_table *table;
@@ -815,8 +818,7 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
 
         tcp_init_mem(net);
 
-        net->ipv4.ipv4_hdr = register_net_sysctl_table(net,
-                        net_ipv4_ctl_path, table);
+        net->ipv4.ipv4_hdr = register_net_sysctl(net, "net/ipv4", table);
         if (net->ipv4.ipv4_hdr == NULL)
                 goto err_reg;
 
@@ -857,12 +859,12 @@ static __init int sysctl_ipv4_init(void)
         if (!i->procname)
                 return -EINVAL;
 
-        hdr = register_sysctl_paths(net_ipv4_ctl_path, ipv4_table);
+        hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table);
         if (hdr == NULL)
                 return -ENOMEM;
 
         if (register_pernet_subsys(&ipv4_sysctl_ops)) {
-                unregister_sysctl_table(hdr);
+                unregister_net_sysctl_table(hdr);
                 return -ENOMEM;
         }
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 22ef5f9fd2ff..3ba605f60e4e 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -245,6 +245,8 @@
  *      TCP_CLOSE               socket is finished
  */
 
+#define pr_fmt(fmt) "TCP: " fmt
+
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/types.h>
@@ -361,6 +363,71 @@ static int retrans_to_secs(u8 retrans, int timeout, int rto_max)
         return period;
 }
 
+/* Address-family independent initialization for a tcp_sock.
+ *
+ * NOTE: A lot of things set to zero explicitly by call to
+ *       sk_alloc() so need not be done here.
+ */
+void tcp_init_sock(struct sock *sk)
+{
+        struct inet_connection_sock *icsk = inet_csk(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        skb_queue_head_init(&tp->out_of_order_queue);
+        tcp_init_xmit_timers(sk);
+        tcp_prequeue_init(tp);
+
+        icsk->icsk_rto = TCP_TIMEOUT_INIT;
+        tp->mdev = TCP_TIMEOUT_INIT;
+
+        /* So many TCP implementations out there (incorrectly) count the
+         * initial SYN frame in their delayed-ACK and congestion control
+         * algorithms that we must have the following bandaid to talk
+         * efficiently to them.  -DaveM
+         */
+        tp->snd_cwnd = TCP_INIT_CWND;
+
+        /* See draft-stevens-tcpca-spec-01 for discussion of the
+         * initialization of these values.
+         */
+        tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
+        tp->snd_cwnd_clamp = ~0;
+        tp->mss_cache = TCP_MSS_DEFAULT;
+
+        tp->reordering = sysctl_tcp_reordering;
+        tcp_enable_early_retrans(tp);
+        icsk->icsk_ca_ops = &tcp_init_congestion_ops;
+
+        sk->sk_state = TCP_CLOSE;
+
+        sk->sk_write_space = sk_stream_write_space;
+        sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
+
+        icsk->icsk_sync_mss = tcp_sync_mss;
+
+        /* TCP Cookie Transactions */
+        if (sysctl_tcp_cookie_size > 0) {
+                /* Default, cookies without s_data_payload. */
+                tp->cookie_values =
+                        kzalloc(sizeof(*tp->cookie_values),
+                                sk->sk_allocation);
+                if (tp->cookie_values != NULL)
+                        kref_init(&tp->cookie_values->kref);
+        }
+        /* Presumed zeroed, in order of appearance:
+         *      cookie_in_always, cookie_out_never,
+         *      s_data_constant, s_data_in, s_data_out
+         */
+        sk->sk_sndbuf = sysctl_tcp_wmem[1];
+        sk->sk_rcvbuf = sysctl_tcp_rmem[1];
+
+        local_bh_disable();
+        sock_update_memcg(sk);
+        sk_sockets_allocated_inc(sk);
+        local_bh_enable();
+}
+EXPORT_SYMBOL(tcp_init_sock);
+
 /*
  *      Wait for a TCP event.
  *
@@ -526,7 +593,7 @@ static inline void tcp_mark_push(struct tcp_sock *tp, struct sk_buff *skb)
         tp->pushed_seq = tp->write_seq;
 }
 
-static inline int forced_push(const struct tcp_sock *tp)
+static inline bool forced_push(const struct tcp_sock *tp)
 {
         return after(tp->write_seq, tp->pushed_seq + (tp->max_window >> 1));
 }
@@ -699,11 +766,12 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp)
         skb = alloc_skb_fclone(size + sk->sk_prot->max_header, gfp);
         if (skb) {
                 if (sk_wmem_schedule(sk, skb->truesize)) {
+                        skb_reserve(skb, sk->sk_prot->max_header);
                         /*
                          * Make sure that we have exactly size bytes
                          * available to the caller, no more, no less.
                          */
-                        skb_reserve(skb, skb_tailroom(skb) - size);
+                        skb->avail_size = size;
                         return skb;
                 }
                 __kfree_skb(skb);
@@ -781,9 +849,10 @@ static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffse
         while (psize > 0) {
                 struct sk_buff *skb = tcp_write_queue_tail(sk);
                 struct page *page = pages[poffset / PAGE_SIZE];
-                int copy, i, can_coalesce;
+                int copy, i;
                 int offset = poffset % PAGE_SIZE;
                 int size = min_t(size_t, psize, PAGE_SIZE - offset);
+                bool can_coalesce;
 
                 if (!tcp_send_head(sk) || (copy = size_goal - skb->len) <= 0) {
 new_segment:
@@ -848,8 +917,7 @@ new_segment:
 wait_for_sndbuf:
                 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
-                if (copied)
-                        tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+                tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
 
                 if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
                         goto do_error;
@@ -858,7 +926,7 @@ wait_for_memory:
         }
 
 out:
-        if (copied)
+        if (copied && !(flags & MSG_SENDPAGE_NOTLAST))
                 tcp_push(sk, flags, mss_now, tp->nonagle);
         return copied;
 
@@ -916,7 +984,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
         int iovlen, flags, err, copied;
-        int mss_now, size_goal;
+        int mss_now = 0, size_goal;
         bool sg;
         long timeo;
 
@@ -930,6 +998,19 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 if ((err = sk_stream_wait_connect(sk, &timeo)) != 0)
                         goto out_err;
 
+        if (unlikely(tp->repair)) {
+                if (tp->repair_queue == TCP_RECV_QUEUE) {
+                        copied = tcp_send_rcvq(sk, msg, size);
+                        goto out;
+                }
+
+                err = -EINVAL;
+                if (tp->repair_queue == TCP_NO_QUEUE)
+                        goto out_err;
+
+                /* 'common' sending to sendq */
+        }
+
         /* This should be in poll */
         clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
 
@@ -993,15 +1074,14 @@ new_segment:
                                 copy = seglen;
 
                         /* Where to copy to? */
-                        if (skb_tailroom(skb) > 0) {
+                        if (skb_availroom(skb) > 0) {
                                 /* We have some space in skb head. Superb! */
-                                if (copy > skb_tailroom(skb))
-                                        copy = skb_tailroom(skb);
+                                copy = min_t(int, copy, skb_availroom(skb));
                                 err = skb_add_data_nocache(sk, skb, from, copy);
                                 if (err)
                                         goto do_fault;
                         } else {
-                                int merge = 0;
+                                bool merge = false;
                                 int i = skb_shinfo(skb)->nr_frags;
                                 struct page *page = sk->sk_sndmsg_page;
                                 int off;
@@ -1015,7 +1095,7 @@ new_segment:
                                     off != PAGE_SIZE) {
                                         /* We can extend the last page
                                          * fragment. */
-                                        merge = 1;
+                                        merge = true;
                                 } else if (i == MAX_SKB_FRAGS || !sg) {
                                         /* Need to add new fragment and cannot
                                          * do this because interface is non-SG,
@@ -1087,7 +1167,7 @@ new_segment:
                         if ((seglen -= copy) == 0 && iovlen == 0)
                                 goto out;
 
-                        if (skb->len < max || (flags & MSG_OOB))
+                        if (skb->len < max || (flags & MSG_OOB) || unlikely(tp->repair))
                                 continue;
 
                         if (forced_push(tp)) {
@@ -1100,7 +1180,7 @@ new_segment:
 wait_for_sndbuf:
                         set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
-                        if (copied)
+                        if (copied && likely(!tp->repair))
                                 tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
 
                         if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
@@ -1111,7 +1191,7 @@ wait_for_memory:
         }
 
 out:
-        if (copied)
+        if (copied && likely(!tp->repair))
                 tcp_push(sk, flags, mss_now, tp->nonagle);
         release_sock(sk);
         return copied;
@@ -1185,6 +1265,24 @@ static int tcp_recv_urg(struct sock *sk, struct msghdr *msg, int len, int flags)
         return -EAGAIN;
 }
 
+static int tcp_peek_sndq(struct sock *sk, struct msghdr *msg, int len)
+{
+        struct sk_buff *skb;
+        int copied = 0, err = 0;
+
+        /* XXX -- need to support SO_PEEK_OFF */
+
+        skb_queue_walk(&sk->sk_write_queue, skb) {
+                err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, skb->len);
+                if (err)
+                        break;
+
+                copied += skb->len;
+        }
+
+        return err ?: copied;
+}
+
 /* Clean up the receive buffer for full frames taken by the user,
  * then send an ACK if necessary.  COPIED is the number of bytes
  * tcp_recvmsg has given to the user so far, it speeds up the
@@ -1194,7 +1292,7 @@ static int tcp_recv_urg(struct sock *sk, struct msghdr *msg, int len, int flags)
 void tcp_cleanup_rbuf(struct sock *sk, int copied)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        int time_to_ack = 0;
+        bool time_to_ack = false;
 
         struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
 
@@ -1220,7 +1318,7 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied)
                       ((icsk->icsk_ack.pending & ICSK_ACK_PUSHED) &&
                        !icsk->icsk_ack.pingpong)) &&
                       !atomic_read(&sk->sk_rmem_alloc)))
-                        time_to_ack = 1;
+                        time_to_ack = true;
         }
 
         /* We send an ACK if we can now advertise a non-zero window
@@ -1242,7 +1340,7 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied)
                          * "Lots" means "at least twice" here.
                          */
                         if (new_window && new_window >= 2 * rcv_window_now)
-                                time_to_ack = 1;
+                                time_to_ack = true;
                 }
         }
         if (time_to_ack)
@@ -1374,11 +1472,11 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
                                 break;
                 }
                 if (tcp_hdr(skb)->fin) {
-                        sk_eat_skb(sk, skb, 0);
+                        sk_eat_skb(sk, skb, false);
                         ++seq;
                         break;
                 }
-                sk_eat_skb(sk, skb, 0);
+                sk_eat_skb(sk, skb, false);
                 if (!desc->count)
                         break;
                 tp->copied_seq = seq;
@@ -1414,7 +1512,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         int target;             /* Read at least this many bytes */
         long timeo;
         struct task_struct *user_recv = NULL;
-        int copied_early = 0;
+        bool copied_early = false;
         struct sk_buff *skb;
         u32 urg_hole = 0;
 
@@ -1430,6 +1528,21 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (flags & MSG_OOB)
                 goto recv_urg;
 
+        if (unlikely(tp->repair)) {
+                err = -EPERM;
+                if (!(flags & MSG_PEEK))
+                        goto out;
+
+                if (tp->repair_queue == TCP_SEND_QUEUE)
+                        goto recv_sndq;
+
+                err = -EINVAL;
+                if (tp->repair_queue == TCP_NO_QUEUE)
+                        goto out;
+
+                /* 'common' recv queue MSG_PEEK-ing */
+        }
+
         seq = &tp->copied_seq;
         if (flags & MSG_PEEK) {
                 peek_seq = tp->copied_seq;
@@ -1450,7 +1563,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 if ((available < target) &&
                     (len > sysctl_tcp_dma_copybreak) && !(flags & MSG_PEEK) &&
                     !sysctl_tcp_low_latency &&
-                    dma_find_channel(DMA_MEMCPY)) {
+                    net_dma_find_channel()) {
                         preempt_enable_no_resched();
                         tp->ucopy.pinned_list =
                                         dma_pin_iovec_pages(msg->msg_iov, len);
@@ -1631,9 +1744,9 @@ do_prequeue:
                 }
                 if ((flags & MSG_PEEK) &&
                     (peek_seq - copied - urg_hole != tp->copied_seq)) {
-                        if (net_ratelimit())
-                                printk(KERN_DEBUG "TCP(%s:%d): Application bug, race in MSG_PEEK.\n",
-                                       current->comm, task_pid_nr(current));
+                        net_dbg_ratelimited("TCP(%s:%d): Application bug, race in MSG_PEEK\n",
+                                            current->comm,
+                                            task_pid_nr(current));
                         peek_seq = tp->copied_seq;
                 }
                 continue;
@@ -1665,7 +1778,7 @@ do_prequeue:
                 if (!(flags & MSG_TRUNC)) {
 #ifdef CONFIG_NET_DMA
                         if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
-                                tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
+                                tp->ucopy.dma_chan = net_dma_find_channel();
 
                         if (tp->ucopy.dma_chan) {
                                 tp->ucopy.dma_cookie = dma_skb_copy_datagram_iovec(
@@ -1675,7 +1788,8 @@ do_prequeue:
 
                                 if (tp->ucopy.dma_cookie < 0) {
 
-                                        printk(KERN_ALERT "dma_cookie < 0\n");
+                                        pr_alert("%s: dma_cookie < 0\n",
+                                                 __func__);
 
                                         /* Exception. Bailout! */
                                         if (!copied)
@@ -1686,7 +1800,7 @@ do_prequeue:
                                 dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
 
                                 if ((offset + used) == skb->len)
-                                        copied_early = 1;
+                                        copied_early = true;
 
                         } else
 #endif
@@ -1720,7 +1834,7 @@ skip_copy:
                         goto found_fin_ok;
                 if (!(flags & MSG_PEEK)) {
                         sk_eat_skb(sk, skb, copied_early);
-                        copied_early = 0;
+                        copied_early = false;
                 }
                 continue;
 
@@ -1729,7 +1843,7 @@ skip_copy:
                 ++*seq;
                 if (!(flags & MSG_PEEK)) {
                         sk_eat_skb(sk, skb, copied_early);
-                        copied_early = 0;
+                        copied_early = false;
                 }
                 break;
         } while (len > 0);
@@ -1780,6 +1894,10 @@ out:
 recv_urg:
         err = tcp_recv_urg(sk, msg, len, flags);
         goto out;
+
+recv_sndq:
+        err = tcp_peek_sndq(sk, msg, len);
+        goto out;
 }
 EXPORT_SYMBOL(tcp_recvmsg);
 
@@ -1883,10 +2001,10 @@ bool tcp_check_oom(struct sock *sk, int shift)
         too_many_orphans = tcp_too_many_orphans(sk, shift);
         out_of_socket_memory = tcp_out_of_memory(sk);
 
-        if (too_many_orphans && net_ratelimit())
-                pr_info("TCP: too many orphaned sockets\n");
-        if (out_of_socket_memory && net_ratelimit())
-                pr_info("TCP: out of memory -- consider tuning tcp_mem\n");
+        if (too_many_orphans)
+                net_info_ratelimited("too many orphaned sockets\n");
+        if (out_of_socket_memory)
+                net_info_ratelimited("out of memory -- consider tuning tcp_mem\n");
         return too_many_orphans || out_of_socket_memory;
 }
 
@@ -1932,7 +2050,9 @@ void tcp_close(struct sock *sk, long timeout)
          * advertise a zero window, then kill -9 the FTP client, wheee...
          * Note: timeout is always zero in such a case.
          */
-        if (data_was_unread) {
+        if (unlikely(tcp_sk(sk)->repair)) {
+                sk->sk_prot->disconnect(sk, 0);
+        } else if (data_was_unread) {
                 /* Unread data was tossed, zap the connection. */
                 NET_INC_STATS_USER(sock_net(sk), LINUX_MIB_TCPABORTONCLOSE);
                 tcp_set_state(sk, TCP_CLOSE);
@@ -2050,7 +2170,7 @@ EXPORT_SYMBOL(tcp_close);
 
 /* These states need RST on ABORT according to RFC793 */
 
-static inline int tcp_need_reset(int state)
+static inline bool tcp_need_reset(int state)
 {
         return (1 << state) &
                (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT | TCPF_FIN_WAIT1 |
@@ -2071,6 +2191,8 @@ int tcp_disconnect(struct sock *sk, int flags)
         /* ABORT function of RFC793 */
         if (old_state == TCP_LISTEN) {
                 inet_csk_listen_stop(sk);
+        } else if (unlikely(tp->repair)) {
+                sk->sk_err = ECONNABORTED;
         } else if (tcp_need_reset(old_state) ||
                    (tp->snd_nxt != tp->write_seq &&
                     (1 << old_state) & (TCPF_CLOSING | TCPF_LAST_ACK))) {
@@ -2122,6 +2244,54 @@ int tcp_disconnect(struct sock *sk, int flags)
 }
 EXPORT_SYMBOL(tcp_disconnect);
 
+static inline bool tcp_can_repair_sock(const struct sock *sk)
+{
+        return capable(CAP_NET_ADMIN) &&
+                ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_ESTABLISHED));
+}
+
+static int tcp_repair_options_est(struct tcp_sock *tp,
+                struct tcp_repair_opt __user *optbuf, unsigned int len)
+{
+        struct tcp_repair_opt opt;
+
+        while (len >= sizeof(opt)) {
+                if (copy_from_user(&opt, optbuf, sizeof(opt)))
+                        return -EFAULT;
+
+                optbuf++;
+                len -= sizeof(opt);
+
+                switch (opt.opt_code) {
+                case TCPOPT_MSS:
+                        tp->rx_opt.mss_clamp = opt.opt_val;
+                        break;
+                case TCPOPT_WINDOW:
+                        if (opt.opt_val > 14)
+                                return -EFBIG;
+
+                        tp->rx_opt.snd_wscale = opt.opt_val;
+                        break;
+                case TCPOPT_SACK_PERM:
+                        if (opt.opt_val != 0)
+                                return -EINVAL;
+
+                        tp->rx_opt.sack_ok |= TCP_SACK_SEEN;
+                        if (sysctl_tcp_fack)
+                                tcp_enable_fack(tp);
+                        break;
+                case TCPOPT_TIMESTAMP:
+                        if (opt.opt_val != 0)
+                                return -EINVAL;
+
+                        tp->rx_opt.tstamp_ok = 1;
+                        break;
+                }
+        }
+
+        return 0;
+}
+
 /*
  *      Socket option code for TCP.
  */
@@ -2292,6 +2462,55 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                         err = -EINVAL;
                 else
                         tp->thin_dupack = val;
+                        if (tp->thin_dupack)
+                                tcp_disable_early_retrans(tp);
+                break;
+
+        case TCP_REPAIR:
+                if (!tcp_can_repair_sock(sk))
+                        err = -EPERM;
+                else if (val == 1) {
+                        tp->repair = 1;
+                        sk->sk_reuse = SK_FORCE_REUSE;
+                        tp->repair_queue = TCP_NO_QUEUE;
+                } else if (val == 0) {
+                        tp->repair = 0;
+                        sk->sk_reuse = SK_NO_REUSE;
+                        tcp_send_window_probe(sk);
+                } else
+                        err = -EINVAL;
+
+                break;
+
+        case TCP_REPAIR_QUEUE:
+                if (!tp->repair)
+                        err = -EPERM;
+                else if (val < TCP_QUEUES_NR)
+                        tp->repair_queue = val;
+                else
+                        err = -EINVAL;
+                break;
+
+        case TCP_QUEUE_SEQ:
+                if (sk->sk_state != TCP_CLOSE)
+                        err = -EPERM;
+                else if (tp->repair_queue == TCP_SEND_QUEUE)
+                        tp->write_seq = val;
+                else if (tp->repair_queue == TCP_RECV_QUEUE)
+                        tp->rcv_nxt = val;
+                else
+                        err = -EINVAL;
+                break;
+
+        case TCP_REPAIR_OPTIONS:
+                if (!tp->repair)
+                        err = -EINVAL;
+                else if (sk->sk_state == TCP_ESTABLISHED)
+                        err = tcp_repair_options_est(tp,
+                                        (struct tcp_repair_opt __user *)optval,
+                                        optlen);
+                else
+                        err = -EPERM;
                 break;
 
         case TCP_CORK:
@@ -2527,6 +2746,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                 val = tp->mss_cache;
                 if (!val && ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
                         val = tp->rx_opt.user_mss;
+                if (tp->repair)
+                        val = tp->rx_opt.mss_clamp;
                 break;
         case TCP_NODELAY:
                 val = !!(tp->nonagle&TCP_NAGLE_OFF);
@@ -2629,6 +2850,26 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                 val = tp->thin_dupack;
                 break;
 
+        case TCP_REPAIR:
+                val = tp->repair;
+                break;
+
+        case TCP_REPAIR_QUEUE:
+                if (tp->repair)
+                        val = tp->repair_queue;
+                else
+                        return -EINVAL;
+                break;
+
+        case TCP_QUEUE_SEQ:
+                if (tp->repair_queue == TCP_SEND_QUEUE)
+                        val = tp->write_seq;
+                else if (tp->repair_queue == TCP_RECV_QUEUE)
+                        val = tp->rcv_nxt;
+                else
+                        return -EINVAL;
+                break;
+
         case TCP_USER_TIMEOUT:
                 val = jiffies_to_msecs(icsk->icsk_user_timeout);
                 break;
@@ -2672,7 +2913,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
 {
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         struct tcphdr *th;
-        unsigned thlen;
+        unsigned int thlen;
         unsigned int seq;
         __be32 delta;
         unsigned int oldlen;
@@ -2930,13 +3171,13 @@ out_free:
 struct tcp_md5sig_pool __percpu *tcp_alloc_md5sig_pool(struct sock *sk)
 {
         struct tcp_md5sig_pool __percpu *pool;
-        int alloc = 0;
+        bool alloc = false;
 
 retry:
         spin_lock_bh(&tcp_md5sig_pool_lock);
         pool = tcp_md5sig_pool;
         if (tcp_md5sig_users++ == 0) {
-                alloc = 1;
+                alloc = true;
                 spin_unlock_bh(&tcp_md5sig_pool_lock);
         } else if (!pool) {
                 tcp_md5sig_users--;
@@ -3030,9 +3271,9 @@ int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *hp,
         struct scatterlist sg;
         const struct tcphdr *tp = tcp_hdr(skb);
         struct hash_desc *desc = &hp->md5_desc;
-        unsigned i;
-        const unsigned head_data_len = skb_headlen(skb) > header_len ?
-                                       skb_headlen(skb) - header_len : 0;
+        unsigned int i;
+        const unsigned int head_data_len = skb_headlen(skb) > header_len ?
+                                           skb_headlen(skb) - header_len : 0;
         const struct skb_shared_info *shi = skb_shinfo(skb);
         struct sk_buff *frag_iter;
 
@@ -3220,9 +3461,15 @@ extern struct tcp_congestion_ops tcp_reno;
 static __initdata unsigned long thash_entries;
 static int __init set_thash_entries(char *str)
 {
+        ssize_t ret;
+
         if (!str)
                 return 0;
-        thash_entries = simple_strtoul(str, &str, 0);
+
+        ret = kstrtoul(str, 0, &thash_entries);
+        if (ret)
+                return 0;
+
         return 1;
 }
 __setup("thash_entries=", set_thash_entries);
@@ -3240,7 +3487,7 @@ void __init tcp_init(void)
 {
         struct sk_buff *skb = NULL;
         unsigned long limit;
-        int max_share, cnt;
+        int max_rshare, max_wshare, cnt;
         unsigned int i;
         unsigned long jiffy = jiffies;
 
@@ -3267,6 +3514,7 @@ void __init tcp_init(void)
                                         0,
                                         NULL,
                                         &tcp_hashinfo.ehash_mask,
+                                        0,
                                         thash_entries ? 0 : 512 * 1024);
         for (i = 0; i <= tcp_hashinfo.ehash_mask; i++) {
                 INIT_HLIST_NULLS_HEAD(&tcp_hashinfo.ehash[i].chain, i);
@@ -3283,6 +3531,7 @@ void __init tcp_init(void)
                                         0,
                                         &tcp_hashinfo.bhash_size,
                                         NULL,
+                                        0,
                                         64 * 1024);
         tcp_hashinfo.bhash_size = 1U << tcp_hashinfo.bhash_size;
         for (i = 0; i < tcp_hashinfo.bhash_size; i++) {
@@ -3299,21 +3548,20 @@ void __init tcp_init(void)
 
         tcp_init_mem(&init_net);
         /* Set per-socket limits to no more than 1/128 the pressure threshold */
-        limit = nr_free_buffer_pages() << (PAGE_SHIFT - 10);
-        limit = max(limit, 128UL);
-        max_share = min(4UL*1024*1024, limit);
+        limit = nr_free_buffer_pages() << (PAGE_SHIFT - 7);
+        max_wshare = min(4UL*1024*1024, limit);
+        max_rshare = min(6UL*1024*1024, limit);
 
         sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
         sysctl_tcp_wmem[1] = 16*1024;
-        sysctl_tcp_wmem[2] = max(64*1024, max_share);
+        sysctl_tcp_wmem[2] = max(64*1024, max_wshare);
 
         sysctl_tcp_rmem[0] = SK_MEM_QUANTUM;
         sysctl_tcp_rmem[1] = 87380;
-        sysctl_tcp_rmem[2] = max(87380, max_share);
+        sysctl_tcp_rmem[2] = max(87380, max_rshare);
 
-        printk(KERN_INFO "TCP: Hash tables configured "
-               "(established %u bind %u)\n",
-               tcp_hashinfo.ehash_mask + 1, tcp_hashinfo.bhash_size);
+        pr_info("Hash tables configured (established %u bind %u)\n",
+                tcp_hashinfo.ehash_mask + 1, tcp_hashinfo.bhash_size);
 
         tcp_register_congestion_control(&tcp_reno);
 
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index fc6d475f488f..04dbd7ae7c62 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -6,6 +6,8 @@
  * Copyright (C) 2005 Stephen Hemminger <shemminger@osdl.org>
  */
 
+#define pr_fmt(fmt) "TCP: " fmt
+
 #include <linux/module.h>
 #include <linux/mm.h>
 #include <linux/types.h>
@@ -41,18 +43,17 @@ int tcp_register_congestion_control(struct tcp_congestion_ops *ca)
 
         /* all algorithms must implement ssthresh and cong_avoid ops */
         if (!ca->ssthresh || !ca->cong_avoid) {
-                printk(KERN_ERR "TCP %s does not implement required ops\n",
-                       ca->name);
+                pr_err("%s does not implement required ops\n", ca->name);
                 return -EINVAL;
         }
 
         spin_lock(&tcp_cong_list_lock);
         if (tcp_ca_find(ca->name)) {
-                printk(KERN_NOTICE "TCP %s already registered\n", ca->name);
+                pr_notice("%s already registered\n", ca->name);
                 ret = -EEXIST;
         } else {
                 list_add_tail_rcu(&ca->list, &tcp_cong_list);
-                printk(KERN_INFO "TCP %s registered\n", ca->name);
+                pr_info("%s registered\n", ca->name);
         }
         spin_unlock(&tcp_cong_list_lock);
 
@@ -279,19 +280,19 @@ int tcp_set_congestion_control(struct sock *sk, const char *name)
 /* RFC2861 Check whether we are limited by application or congestion window
  * This is the inverse of cwnd check in tcp_tso_should_defer
  */
-int tcp_is_cwnd_limited(const struct sock *sk, u32 in_flight)
+bool tcp_is_cwnd_limited(const struct sock *sk, u32 in_flight)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         u32 left;
 
         if (in_flight >= tp->snd_cwnd)
-                return 1;
+                return true;
 
         left = tp->snd_cwnd - in_flight;
         if (sk_can_gso(sk) &&
             left * sysctl_tcp_tso_win_divisor < tp->snd_cwnd &&
             left * tp->mss_cache < sk->sk_gso_max_size)
-                return 1;
+                return true;
         return left <= tcp_max_tso_deferred_mss(tp);
 }
 EXPORT_SYMBOL_GPL(tcp_is_cwnd_limited);
diff --git a/net/ipv4/tcp_hybla.c b/net/ipv4/tcp_hybla.c
index fe3ecf484b44..57bdd17dff4d 100644
--- a/net/ipv4/tcp_hybla.c
+++ b/net/ipv4/tcp_hybla.c
@@ -15,7 +15,7 @@
 
 /* Tcp Hybla structure. */
 struct hybla {
-        u8    hybla_en;
+        bool  hybla_en;
         u32   snd_cwnd_cents; /* Keeps increment values when it is <1, <<7 */
         u32   rho;            /* Rho parameter, integer part  */
         u32   rho2;           /* Rho * Rho, integer part */
@@ -24,8 +24,7 @@ struct hybla {
         u32   minrtt;         /* Minimum smoothed round trip time value seen */
 };
 
-/* Hybla reference round trip time (default= 1/40 sec = 25 ms),
-   expressed in jiffies */
+/* Hybla reference round trip time (default= 1/40 sec = 25 ms), in ms */
 static int rtt0 = 25;
 module_param(rtt0, int, 0644);
 MODULE_PARM_DESC(rtt0, "reference rout trip time (ms)");
@@ -39,7 +38,7 @@ static inline void hybla_recalc_param (struct sock *sk)
         ca->rho_3ls = max_t(u32, tcp_sk(sk)->srtt / msecs_to_jiffies(rtt0), 8);
         ca->rho = ca->rho_3ls >> 3;
         ca->rho2_7ls = (ca->rho_3ls * ca->rho_3ls) << 1;
-        ca->rho2 = ca->rho2_7ls >>7;
+        ca->rho2 = ca->rho2_7ls >> 7;
 }
 
 static void hybla_init(struct sock *sk)
@@ -52,7 +51,7 @@ static void hybla_init(struct sock *sk)
         ca->rho_3ls = 0;
         ca->rho2_7ls = 0;
         ca->snd_cwnd_cents = 0;
-        ca->hybla_en = 1;
+        ca->hybla_en = true;
         tp->snd_cwnd = 2;
         tp->snd_cwnd_clamp = 65535;
 
@@ -67,6 +66,7 @@ static void hybla_init(struct sock *sk)
 static void hybla_state(struct sock *sk, u8 ca_state)
 {
         struct hybla *ca = inet_csk_ca(sk);
+
         ca->hybla_en = (ca_state == TCP_CA_Open);
 }
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index b5e315f13641..b224eb8bce8b 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -61,6 +61,8 @@
  *              Pasi Sarolahti:         F-RTO for dealing with spurious RTOs
  */
 
+#define pr_fmt(fmt) "TCP: " fmt
+
 #include <linux/mm.h>
 #include <linux/slab.h>
 #include <linux/module.h>
@@ -83,7 +85,7 @@ int sysctl_tcp_ecn __read_mostly = 2;
 EXPORT_SYMBOL(sysctl_tcp_ecn);
 int sysctl_tcp_dsack __read_mostly = 1;
 int sysctl_tcp_app_win __read_mostly = 31;
-int sysctl_tcp_adv_win_scale __read_mostly = 2;
+int sysctl_tcp_adv_win_scale __read_mostly = 1;
 EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
 
 int sysctl_tcp_stdurg __read_mostly;
@@ -97,6 +99,7 @@ int sysctl_tcp_thin_dupack __read_mostly;
 
 int sysctl_tcp_moderate_rcvbuf __read_mostly = 1;
 int sysctl_tcp_abc __read_mostly;
+int sysctl_tcp_early_retrans __read_mostly = 2;
 
 #define FLAG_DATA               0x01 /* Incoming frame contained data.          */
 #define FLAG_WIN_UPDATE         0x02 /* Incoming ACK was a window update.       */
@@ -173,7 +176,7 @@ static void tcp_measure_rcv_mss(struct sock *sk, const struct sk_buff *skb)
 static void tcp_incr_quickack(struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
-        unsigned quickacks = tcp_sk(sk)->rcv_wnd / (2 * icsk->icsk_ack.rcv_mss);
+        unsigned int quickacks = tcp_sk(sk)->rcv_wnd / (2 * icsk->icsk_ack.rcv_mss);
 
         if (quickacks == 0)
                 quickacks = 2;
@@ -193,9 +196,10 @@ static void tcp_enter_quickack_mode(struct sock *sk)
  * and the session is not interactive.
  */
 
-static inline int tcp_in_quickack_mode(const struct sock *sk)
+static inline bool tcp_in_quickack_mode(const struct sock *sk)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
+
         return icsk->icsk_ack.quick && !icsk->icsk_ack.pingpong;
 }
 
@@ -250,11 +254,11 @@ static inline void TCP_ECN_rcv_syn(struct tcp_sock *tp, const struct tcphdr *th)
                 tp->ecn_flags &= ~TCP_ECN_OK;
 }
 
-static inline int TCP_ECN_rcv_ecn_echo(const struct tcp_sock *tp, const struct tcphdr *th)
+static bool TCP_ECN_rcv_ecn_echo(const struct tcp_sock *tp, const struct tcphdr *th)
 {
         if (th->ece && !th->syn && (tp->ecn_flags & TCP_ECN_OK))
-                return 1;
-        return 0;
+                return true;
+        return false;
 }
 
 /* Buffer size and advertised window tuning.
@@ -333,6 +337,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
                         incr = __tcp_grow_window(sk, skb);
 
                 if (incr) {
+                        incr = max_t(int, incr, 2 * skb->len);
                         tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr,
                                                tp->window_clamp);
                         inet_csk(sk)->icsk_ack.quick |= 1;
@@ -472,8 +477,11 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep)
                 if (!win_dep) {
                         m -= (new_sample >> 3);
                         new_sample += m;
-                } else if (m < new_sample)
-                        new_sample = m << 3;
+                } else {
+                        m <<= 3;
+                        if (m < new_sample)
+                                new_sample = m;
+                }
         } else {
                 /* No previous measure. */
                 new_sample = m << 3;
@@ -489,7 +497,7 @@ static inline void tcp_rcv_rtt_measure(struct tcp_sock *tp)
                 goto new_measure;
         if (before(tp->rcv_nxt, tp->rcv_rtt_est.seq))
                 return;
-        tcp_rcv_rtt_update(tp, jiffies - tp->rcv_rtt_est.time, 1);
+        tcp_rcv_rtt_update(tp, tcp_time_stamp - tp->rcv_rtt_est.time, 1);
 
 new_measure:
         tp->rcv_rtt_est.seq = tp->rcv_nxt + tp->rcv_wnd;
@@ -900,6 +908,7 @@ static void tcp_init_metrics(struct sock *sk)
         if (dst_metric(dst, RTAX_REORDERING) &&
             tp->reordering != dst_metric(dst, RTAX_REORDERING)) {
                 tcp_disable_fack(tp);
+                tcp_disable_early_retrans(tp);
                 tp->reordering = dst_metric(dst, RTAX_REORDERING);
         }
 
@@ -931,7 +940,7 @@ static void tcp_init_metrics(struct sock *sk)
         tcp_set_rto(sk);
 reset:
         if (tp->srtt == 0) {
-                /* RFC2988bis: We've failed to get a valid RTT sample from
+                /* RFC6298: 5.7 We've failed to get a valid RTT sample from
                  * 3WHS. This is most likely due to retransmission,
                  * including spurious one. Reset the RTO back to 3secs
                  * from the more aggressive 1sec to avoid more spurious
@@ -941,7 +950,7 @@ reset:
                 inet_csk(sk)->icsk_rto = TCP_TIMEOUT_FALLBACK;
         }
         /* Cut cwnd down to 1 per RFC5681 if SYN or SYN-ACK has been
-         * retransmitted. In light of RFC2988bis' more aggressive 1sec
+         * retransmitted. In light of RFC6298 more aggressive 1sec
          * initRTO, we only reset cwnd when more than 1 SYN/SYN-ACK
          * retransmission has occurred.
          */
@@ -973,15 +982,18 @@ static void tcp_update_reordering(struct sock *sk, const int metric,
 
                 NET_INC_STATS_BH(sock_net(sk), mib_idx);
 #if FASTRETRANS_DEBUG > 1
-                printk(KERN_DEBUG "Disorder%d %d %u f%u s%u rr%d\n",
-                       tp->rx_opt.sack_ok, inet_csk(sk)->icsk_ca_state,
-                       tp->reordering,
-                       tp->fackets_out,
-                       tp->sacked_out,
-                       tp->undo_marker ? tp->undo_retrans : 0);
+                pr_debug("Disorder%d %d %u f%u s%u rr%d\n",
+                         tp->rx_opt.sack_ok, inet_csk(sk)->icsk_ca_state,
+                         tp->reordering,
+                         tp->fackets_out,
+                         tp->sacked_out,
+                         tp->undo_marker ? tp->undo_retrans : 0);
 #endif
                 tcp_disable_fack(tp);
         }
+
+        if (metric > 0)
+                tcp_disable_early_retrans(tp);
 }
 
 /* This must be called before lost_out is incremented */
@@ -1112,36 +1124,36 @@ static void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp,
  * the exact amount is rather hard to quantify. However, tp->max_window can
  * be used as an exaggerated estimate.
  */
-static int tcp_is_sackblock_valid(struct tcp_sock *tp, int is_dsack,
-                                  u32 start_seq, u32 end_seq)
+static bool tcp_is_sackblock_valid(struct tcp_sock *tp, bool is_dsack,
+                                   u32 start_seq, u32 end_seq)
 {
         /* Too far in future, or reversed (interpretation is ambiguous) */
         if (after(end_seq, tp->snd_nxt) || !before(start_seq, end_seq))
-                return 0;
+                return false;
 
         /* Nasty start_seq wrap-around check (see comments above) */
         if (!before(start_seq, tp->snd_nxt))
-                return 0;
+                return false;
 
         /* In outstanding window? ...This is valid exit for D-SACKs too.
          * start_seq == snd_una is non-sensical (see comments above)
          */
         if (after(start_seq, tp->snd_una))
-                return 1;
+                return true;
 
         if (!is_dsack || !tp->undo_marker)
-                return 0;
+                return false;
 
         /* ...Then it's D-SACK, and must reside below snd_una completely */
         if (after(end_seq, tp->snd_una))
-                return 0;
+                return false;
 
         if (!before(start_seq, tp->undo_marker))
-                return 1;
+                return true;
 
         /* Too old */
         if (!after(end_seq, tp->undo_marker))
-                return 0;
+                return false;
 
         /* Undo_marker boundary crossing (overestimates a lot). Known already:
          *   start_seq < undo_marker and end_seq >= undo_marker.
@@ -1213,17 +1225,17 @@ static void tcp_mark_lost_retrans(struct sock *sk)
                 tp->lost_retrans_low = new_low_seq;
 }
 
-static int tcp_check_dsack(struct sock *sk, const struct sk_buff *ack_skb,
-                           struct tcp_sack_block_wire *sp, int num_sacks,
-                           u32 prior_snd_una)
+static bool tcp_check_dsack(struct sock *sk, const struct sk_buff *ack_skb,
+                            struct tcp_sack_block_wire *sp, int num_sacks,
+                            u32 prior_snd_una)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         u32 start_seq_0 = get_unaligned_be32(&sp[0].start_seq);
         u32 end_seq_0 = get_unaligned_be32(&sp[0].end_seq);
-        int dup_sack = 0;
+        bool dup_sack = false;
 
         if (before(start_seq_0, TCP_SKB_CB(ack_skb)->ack_seq)) {
-                dup_sack = 1;
+                dup_sack = true;
                 tcp_dsack_seen(tp);
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPDSACKRECV);
         } else if (num_sacks > 1) {
@@ -1232,7 +1244,7 @@ static int tcp_check_dsack(struct sock *sk, const struct sk_buff *ack_skb,
 
                 if (!after(end_seq_0, end_seq_1) &&
                     !before(start_seq_0, start_seq_1)) {
-                        dup_sack = 1;
+                        dup_sack = true;
                         tcp_dsack_seen(tp);
                         NET_INC_STATS_BH(sock_net(sk),
                                         LINUX_MIB_TCPDSACKOFORECV);
@@ -1263,9 +1275,10 @@ struct tcp_sacktag_state {
  * FIXME: this could be merged to shift decision code
  */
 static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
-                                 u32 start_seq, u32 end_seq)
+                                  u32 start_seq, u32 end_seq)
 {
-        int in_sack, err;
+        int err;
+        bool in_sack;
         unsigned int pkt_len;
         unsigned int mss;
 
@@ -1311,7 +1324,7 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
 static u8 tcp_sacktag_one(struct sock *sk,
                           struct tcp_sacktag_state *state, u8 sacked,
                           u32 start_seq, u32 end_seq,
-                          int dup_sack, int pcount)
+                          bool dup_sack, int pcount)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int fack_count = state->fack_count;
@@ -1391,10 +1404,10 @@ static u8 tcp_sacktag_one(struct sock *sk,
 /* Shift newly-SACKed bytes from this skb to the immediately previous
  * already-SACKed sk_buff. Mark the newly-SACKed bytes as such.
  */
-static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
-                           struct tcp_sacktag_state *state,
-                           unsigned int pcount, int shifted, int mss,
-                           int dup_sack)
+static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
+                            struct tcp_sacktag_state *state,
+                            unsigned int pcount, int shifted, int mss,
+                            bool dup_sack)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *prev = tcp_write_queue_prev(sk, skb);
@@ -1444,7 +1457,7 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
         if (skb->len > 0) {
                 BUG_ON(!tcp_skb_pcount(skb));
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SACKSHIFTED);
-                return 0;
+                return false;
         }
 
         /* Whole SKB was eaten :-) */
@@ -1467,7 +1480,7 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
 
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SACKMERGED);
 
-        return 1;
+        return true;
 }
 
 /* I wish gso_size would have a bit more sane initialization than
@@ -1490,7 +1503,7 @@ static int skb_can_shift(const struct sk_buff *skb)
 static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
                                           struct tcp_sacktag_state *state,
                                           u32 start_seq, u32 end_seq,
-                                          int dup_sack)
+                                          bool dup_sack)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *prev;
@@ -1629,14 +1642,14 @@ static struct sk_buff *tcp_sacktag_walk(struct sk_buff *skb, struct sock *sk,
                                         struct tcp_sack_block *next_dup,
                                         struct tcp_sacktag_state *state,
                                         u32 start_seq, u32 end_seq,
-                                        int dup_sack_in)
+                                        bool dup_sack_in)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *tmp;
 
         tcp_for_write_queue_from(skb, sk) {
                 int in_sack = 0;
-                int dup_sack = dup_sack_in;
+                bool dup_sack = dup_sack_in;
 
                 if (skb == tcp_send_head(sk))
                         break;
@@ -1651,7 +1664,7 @@ static struct sk_buff *tcp_sacktag_walk(struct sk_buff *skb, struct sock *sk,
                                                         next_dup->start_seq,
                                                         next_dup->end_seq);
                         if (in_sack > 0)
-                                dup_sack = 1;
+                                dup_sack = true;
                 }
 
                 /* skb reference here is a bit tricky to get right, since
@@ -1756,7 +1769,7 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
         struct sk_buff *skb;
         int num_sacks = min(TCP_NUM_SACKS, (ptr[1] - TCPOLEN_SACK_BASE) >> 3);
         int used_sacks;
-        int found_dup_sack = 0;
+        bool found_dup_sack = false;
         int i, j;
         int first_sack_index;
 
@@ -1787,7 +1800,7 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
         used_sacks = 0;
         first_sack_index = 0;
         for (i = 0; i < num_sacks; i++) {
-                int dup_sack = !i && found_dup_sack;
+                bool dup_sack = !i && found_dup_sack;
 
                 sp[used_sacks].start_seq = get_unaligned_be32(&sp_wire[i].start_seq);
                 sp[used_sacks].end_seq = get_unaligned_be32(&sp_wire[i].end_seq);
@@ -1854,7 +1867,7 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
         while (i < used_sacks) {
                 u32 start_seq = sp[i].start_seq;
                 u32 end_seq = sp[i].end_seq;
-                int dup_sack = (found_dup_sack && (i == first_sack_index));
+                bool dup_sack = (found_dup_sack && (i == first_sack_index));
                 struct tcp_sack_block *next_dup = NULL;
 
                 if (found_dup_sack && ((i + 1) == first_sack_index))
@@ -1956,9 +1969,9 @@ out:
 }
 
 /* Limits sacked_out so that sum with lost_out isn't ever larger than
- * packets_out. Returns zero if sacked_out adjustement wasn't necessary.
+ * packets_out. Returns false if sacked_out adjustement wasn't necessary.
  */
-static int tcp_limit_reno_sacked(struct tcp_sock *tp)
+static bool tcp_limit_reno_sacked(struct tcp_sock *tp)
 {
         u32 holes;
 
@@ -1967,9 +1980,9 @@ static int tcp_limit_reno_sacked(struct tcp_sock *tp)
 
         if ((tp->sacked_out + holes) > tp->packets_out) {
                 tp->sacked_out = tp->packets_out - holes;
-                return 1;
+                return true;
         }
-        return 0;
+        return false;
 }
 
 /* If we receive more dupacks than we expected counting segments
@@ -2023,40 +2036,40 @@ static int tcp_is_sackfrto(const struct tcp_sock *tp)
 /* F-RTO can only be used if TCP has never retransmitted anything other than
  * head (SACK enhanced variant from Appendix B of RFC4138 is more robust here)
  */
-int tcp_use_frto(struct sock *sk)
+bool tcp_use_frto(struct sock *sk)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct sk_buff *skb;
 
         if (!sysctl_tcp_frto)
-                return 0;
+                return false;
 
         /* MTU probe and F-RTO won't really play nicely along currently */
         if (icsk->icsk_mtup.probe_size)
-                return 0;
+                return false;
 
         if (tcp_is_sackfrto(tp))
-                return 1;
+                return true;
 
         /* Avoid expensive walking of rexmit queue if possible */
         if (tp->retrans_out > 1)
-                return 0;
+                return false;
 
         skb = tcp_write_queue_head(sk);
         if (tcp_skb_is_last(sk, skb))
-                return 1;
+                return true;
         skb = tcp_write_queue_next(sk, skb);    /* Skips head */
         tcp_for_write_queue_from(skb, sk) {
                 if (skb == tcp_send_head(sk))
                         break;
                 if (TCP_SKB_CB(skb)->sacked & TCPCB_RETRANS)
-                        return 0;
+                        return false;
                 /* Short-circuit when first non-SACKed skb has been checked */
                 if (!(TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED))
                         break;
         }
-        return 1;
+        return true;
 }
 
 /* RTO occurred, but do not yet enter Loss state. Instead, defer RTO
@@ -2292,7 +2305,7 @@ void tcp_enter_loss(struct sock *sk, int how)
  *
  * Do processing similar to RTO timeout.
  */
-static int tcp_check_sack_reneging(struct sock *sk, int flag)
+static bool tcp_check_sack_reneging(struct sock *sk, int flag)
 {
         if (flag & FLAG_SACK_RENEGING) {
                 struct inet_connection_sock *icsk = inet_csk(sk);
@@ -2303,9 +2316,9 @@ static int tcp_check_sack_reneging(struct sock *sk, int flag)
                 tcp_retransmit_skb(sk, tcp_write_queue_head(sk));
                 inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
                                           icsk->icsk_rto, TCP_RTO_MAX);
-                return 1;
+                return true;
         }
-        return 0;
+        return false;
 }
 
 static inline int tcp_fackets_out(const struct tcp_sock *tp)
@@ -2333,6 +2346,27 @@ static inline int tcp_dupack_heuristics(const struct tcp_sock *tp)
         return tcp_is_fack(tp) ? tp->fackets_out : tp->sacked_out + 1;
 }
 
+static bool tcp_pause_early_retransmit(struct sock *sk, int flag)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        unsigned long delay;
+
+        /* Delay early retransmit and entering fast recovery for
+         * max(RTT/4, 2msec) unless ack has ECE mark, no RTT samples
+         * available, or RTO is scheduled to fire first.
+         */
+        if (sysctl_tcp_early_retrans < 2 || (flag & FLAG_ECE) || !tp->srtt)
+                return false;
+
+        delay = max_t(unsigned long, (tp->srtt >> 5), msecs_to_jiffies(2));
+        if (!time_after(inet_csk(sk)->icsk_timeout, (jiffies + delay)))
+                return false;
+
+        inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, delay, TCP_RTO_MAX);
+        tp->early_retrans_delayed = 1;
+        return true;
+}
+
 static inline int tcp_skb_timedout(const struct sock *sk,
                                    const struct sk_buff *skb)
 {
@@ -2440,28 +2474,28 @@ static inline int tcp_head_timedout(const struct sock *sk)
  * Main question: may we further continue forward transmission
  * with the same cwnd?
  */
-static int tcp_time_to_recover(struct sock *sk)
+static bool tcp_time_to_recover(struct sock *sk, int flag)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         __u32 packets_out;
 
         /* Do not perform any recovery during F-RTO algorithm */
         if (tp->frto_counter)
-                return 0;
+                return false;
 
         /* Trick#1: The loss is proven. */
         if (tp->lost_out)
-                return 1;
+                return true;
 
         /* Not-A-Trick#2 : Classic rule... */
         if (tcp_dupack_heuristics(tp) > tp->reordering)
-                return 1;
+                return true;
 
         /* Trick#3 : when we use RFC2988 timer restart, fast
          * retransmit can be triggered by timeout of queue head.
          */
         if (tcp_is_fack(tp) && tcp_head_timedout(sk))
-                return 1;
+                return true;
 
         /* Trick#4: It is still not OK... But will it be useful to delay
          * recovery more?
@@ -2473,7 +2507,7 @@ static int tcp_time_to_recover(struct sock *sk)
                 /* We have nothing to send. This connection is limited
                  * either by receiver window or by application.
                  */
-                return 1;
+                return true;
         }
 
         /* If a thin stream is detected, retransmit after first
@@ -2484,9 +2518,19 @@ static int tcp_time_to_recover(struct sock *sk)
         if ((tp->thin_dupack || sysctl_tcp_thin_dupack) &&
             tcp_stream_is_thin(tp) && tcp_dupack_heuristics(tp) > 1 &&
             tcp_is_sack(tp) && !tcp_send_head(sk))
-                return 1;
+                return true;
 
-        return 0;
+        /* Trick#6: TCP early retransmit, per RFC5827.  To avoid spurious
+         * retransmissions due to small network reorderings, we implement
+         * Mitigation A.3 in the RFC and delay the retransmission for a short
+         * interval if appropriate.
+         */
+        if (tp->do_early_retrans && !tp->retrans_out && tp->sacked_out &&
+            (tp->packets_out == (tp->sacked_out + 1) && tp->packets_out < 4) &&
+            !tcp_may_send_now(sk))
+                return !tcp_pause_early_retransmit(sk, flag);
+
+        return false;
 }
 
 /* New heuristics: it is possible only after we switched to restart timer
@@ -2674,22 +2718,22 @@ static void DBGUNDO(struct sock *sk, const char *msg)
         struct inet_sock *inet = inet_sk(sk);
 
         if (sk->sk_family == AF_INET) {
-                printk(KERN_DEBUG "Undo %s %pI4/%u c%u l%u ss%u/%u p%u\n",
-                       msg,
-                       &inet->inet_daddr, ntohs(inet->inet_dport),
-                       tp->snd_cwnd, tcp_left_out(tp),
-                       tp->snd_ssthresh, tp->prior_ssthresh,
-                       tp->packets_out);
+                pr_debug("Undo %s %pI4/%u c%u l%u ss%u/%u p%u\n",
+                         msg,
+                         &inet->inet_daddr, ntohs(inet->inet_dport),
+                         tp->snd_cwnd, tcp_left_out(tp),
+                         tp->snd_ssthresh, tp->prior_ssthresh,
+                         tp->packets_out);
         }
 #if IS_ENABLED(CONFIG_IPV6)
         else if (sk->sk_family == AF_INET6) {
                 struct ipv6_pinfo *np = inet6_sk(sk);
-                printk(KERN_DEBUG "Undo %s %pI6/%u c%u l%u ss%u/%u p%u\n",
-                       msg,
-                       &np->daddr, ntohs(inet->inet_dport),
-                       tp->snd_cwnd, tcp_left_out(tp),
-                       tp->snd_ssthresh, tp->prior_ssthresh,
-                       tp->packets_out);
+                pr_debug("Undo %s %pI6/%u c%u l%u ss%u/%u p%u\n",
+                         msg,
+                         &np->daddr, ntohs(inet->inet_dport),
+                         tp->snd_cwnd, tcp_left_out(tp),
+                         tp->snd_ssthresh, tp->prior_ssthresh,
+                         tp->packets_out);
         }
 #endif
 }
@@ -2725,7 +2769,7 @@ static inline int tcp_may_undo(const struct tcp_sock *tp)
 }
 
 /* People celebrate: "We love our President!" */
-static int tcp_try_undo_recovery(struct sock *sk)
+static bool tcp_try_undo_recovery(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
@@ -2750,10 +2794,10 @@ static int tcp_try_undo_recovery(struct sock *sk)
                  * is ACKed. For Reno it is MUST to prevent false
                  * fast retransmits (RFC2582). SACK TCP is safe. */
                 tcp_moderate_cwnd(tp);
-                return 1;
+                return true;
         }
         tcp_set_ca_state(sk, TCP_CA_Open);
-        return 0;
+        return false;
 }
 
 /* Try to undo cwnd reduction, because D-SACKs acked all retransmitted data */
@@ -2783,19 +2827,19 @@ static void tcp_try_undo_dsack(struct sock *sk)
  * that successive retransmissions of a segment must not advance
  * retrans_stamp under any conditions.
  */
-static int tcp_any_retrans_done(const struct sock *sk)
+static bool tcp_any_retrans_done(const struct sock *sk)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
 
         if (tp->retrans_out)
-                return 1;
+                return true;
 
         skb = tcp_write_queue_head(sk);
         if (unlikely(skb && TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS))
-                return 1;
+                return true;
 
-        return 0;
+        return false;
 }
 
 /* Undo during fast recovery after partial ACK. */
@@ -2829,7 +2873,7 @@ static int tcp_try_undo_partial(struct sock *sk, int acked)
 }
 
 /* Undo during loss recovery after partial ACK. */
-static int tcp_try_undo_loss(struct sock *sk)
+static bool tcp_try_undo_loss(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
@@ -2851,9 +2895,9 @@ static int tcp_try_undo_loss(struct sock *sk)
                 tp->undo_marker = 0;
                 if (tcp_is_sack(tp))
                         tcp_set_ca_state(sk, TCP_CA_Open);
-                return 1;
+                return true;
         }
-        return 0;
+        return false;
 }
 
 static inline void tcp_complete_cwr(struct sock *sk)
@@ -2862,11 +2906,14 @@ static inline void tcp_complete_cwr(struct sock *sk)
 
         /* Do not moderate cwnd if it's already undone in cwr or recovery. */
         if (tp->undo_marker) {
-                if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR)
+                if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR) {
                         tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
-                else /* PRR */
+                        tp->snd_cwnd_stamp = tcp_time_stamp;
+                } else if (tp->snd_ssthresh < TCP_INFINITE_SSTHRESH) {
+                        /* PRR algorithm. */
                         tp->snd_cwnd = tp->snd_ssthresh;
-                tp->snd_cwnd_stamp = tcp_time_stamp;
+                        tp->snd_cwnd_stamp = tcp_time_stamp;
+                }
         }
         tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
 }
@@ -3016,6 +3063,38 @@ static void tcp_update_cwnd_in_recovery(struct sock *sk, int newly_acked_sacked,
         tp->snd_cwnd = tcp_packets_in_flight(tp) + sndcnt;
 }
 
+static void tcp_enter_recovery(struct sock *sk, bool ece_ack)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        int mib_idx;
+
+        if (tcp_is_reno(tp))
+                mib_idx = LINUX_MIB_TCPRENORECOVERY;
+        else
+                mib_idx = LINUX_MIB_TCPSACKRECOVERY;
+
+        NET_INC_STATS_BH(sock_net(sk), mib_idx);
+
+        tp->high_seq = tp->snd_nxt;
+        tp->prior_ssthresh = 0;
+        tp->undo_marker = tp->snd_una;
+        tp->undo_retrans = tp->retrans_out;
+
+        if (inet_csk(sk)->icsk_ca_state < TCP_CA_CWR) {
+                if (!ece_ack)
+                        tp->prior_ssthresh = tcp_current_ssthresh(sk);
+                tp->snd_ssthresh = inet_csk(sk)->icsk_ca_ops->ssthresh(sk);
+                TCP_ECN_queue_cwr(tp);
+        }
+
+        tp->bytes_acked = 0;
+        tp->snd_cwnd_cnt = 0;
+        tp->prior_cwnd = tp->snd_cwnd;
+        tp->prr_delivered = 0;
+        tp->prr_out = 0;
+        tcp_set_ca_state(sk, TCP_CA_Recovery);
+}
+
 /* Process an event, which can update packets-in-flight not trivially.
  * Main goal of this function is to calculate new estimate for left_out,
  * taking into account both packets sitting in receiver's buffer and
@@ -3035,7 +3114,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
         struct tcp_sock *tp = tcp_sk(sk);
         int do_lost = is_dupack || ((flag & FLAG_DATA_SACKED) &&
                                     (tcp_fackets_out(tp) > tp->reordering));
-        int fast_rexmit = 0, mib_idx;
+        int fast_rexmit = 0;
 
         if (WARN_ON(!tp->packets_out && tp->sacked_out))
                 tp->sacked_out = 0;
@@ -3119,7 +3198,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
                 if (icsk->icsk_ca_state <= TCP_CA_Disorder)
                         tcp_try_undo_dsack(sk);
 
-                if (!tcp_time_to_recover(sk)) {
+                if (!tcp_time_to_recover(sk, flag)) {
                         tcp_try_to_open(sk, flag);
                         return;
                 }
@@ -3136,32 +3215,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
                 }
 
                 /* Otherwise enter Recovery state */
-
-                if (tcp_is_reno(tp))
-                        mib_idx = LINUX_MIB_TCPRENORECOVERY;
-                else
-                        mib_idx = LINUX_MIB_TCPSACKRECOVERY;
-
-                NET_INC_STATS_BH(sock_net(sk), mib_idx);
-
-                tp->high_seq = tp->snd_nxt;
-                tp->prior_ssthresh = 0;
-                tp->undo_marker = tp->snd_una;
-                tp->undo_retrans = tp->retrans_out;
-
-                if (icsk->icsk_ca_state < TCP_CA_CWR) {
-                        if (!(flag & FLAG_ECE))
-                                tp->prior_ssthresh = tcp_current_ssthresh(sk);
-                        tp->snd_ssthresh = icsk->icsk_ca_ops->ssthresh(sk);
-                        TCP_ECN_queue_cwr(tp);
-                }
-
-                tp->bytes_acked = 0;
-                tp->snd_cwnd_cnt = 0;
-                tp->prior_cwnd = tp->snd_cwnd;
-                tp->prr_delivered = 0;
-                tp->prr_out = 0;
-                tcp_set_ca_state(sk, TCP_CA_Recovery);
+                tcp_enter_recovery(sk, (flag & FLAG_ECE));
                 fast_rexmit = 1;
         }
 
@@ -3243,16 +3297,47 @@ static void tcp_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
 /* Restart timer after forward progress on connection.
  * RFC2988 recommends to restart timer to now+rto.
  */
-static void tcp_rearm_rto(struct sock *sk)
+void tcp_rearm_rto(struct sock *sk)
 {
-        const struct tcp_sock *tp = tcp_sk(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
 
         if (!tp->packets_out) {
                 inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
         } else {
-                inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
-                                          inet_csk(sk)->icsk_rto, TCP_RTO_MAX);
+                u32 rto = inet_csk(sk)->icsk_rto;
+                /* Offset the time elapsed after installing regular RTO */
+                if (tp->early_retrans_delayed) {
+                        struct sk_buff *skb = tcp_write_queue_head(sk);
+                        const u32 rto_time_stamp = TCP_SKB_CB(skb)->when + rto;
+                        s32 delta = (s32)(rto_time_stamp - tcp_time_stamp);
+                        /* delta may not be positive if the socket is locked
+                         * when the delayed ER timer fires and is rescheduled.
+                         */
+                        if (delta > 0)
+                                rto = delta;
+                }
+                inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, rto,
+                                          TCP_RTO_MAX);
         }
+        tp->early_retrans_delayed = 0;
+}
+
+/* This function is called when the delayed ER timer fires. TCP enters
+ * fast recovery and performs fast-retransmit.
+ */
+void tcp_resume_early_retransmit(struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        tcp_rearm_rto(sk);
+
+        /* Stop if ER is disabled after the delayed ER timer is scheduled */
+        if (!tp->do_early_retrans)
+                return;
+
+        tcp_enter_recovery(sk, false);
+        tcp_update_scoreboard(sk, 1);
+        tcp_xmit_retransmit_queue(sk);
 }
 
 /* If we get here, the whole TSO packet has not been acked. */
@@ -3287,7 +3372,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct sk_buff *skb;
         u32 now = tcp_time_stamp;
-        int fully_acked = 1;
+        int fully_acked = true;
         int flag = 0;
         u32 pkts_acked = 0;
         u32 reord = tp->packets_out;
@@ -3311,7 +3396,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                         if (!acked_pcount)
                                 break;
 
-                        fully_acked = 0;
+                        fully_acked = false;
                 } else {
                         acked_pcount = tcp_skb_pcount(skb);
                 }
@@ -3428,18 +3513,18 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
         if (!tp->packets_out && tcp_is_sack(tp)) {
                 icsk = inet_csk(sk);
                 if (tp->lost_out) {
-                        printk(KERN_DEBUG "Leak l=%u %d\n",
-                               tp->lost_out, icsk->icsk_ca_state);
+                        pr_debug("Leak l=%u %d\n",
+                                 tp->lost_out, icsk->icsk_ca_state);
                         tp->lost_out = 0;
                 }
                 if (tp->sacked_out) {
-                        printk(KERN_DEBUG "Leak s=%u %d\n",
-                               tp->sacked_out, icsk->icsk_ca_state);
+                        pr_debug("Leak s=%u %d\n",
+                                 tp->sacked_out, icsk->icsk_ca_state);
                         tp->sacked_out = 0;
                 }
                 if (tp->retrans_out) {
-                        printk(KERN_DEBUG "Leak r=%u %d\n",
-                               tp->retrans_out, icsk->icsk_ca_state);
+                        pr_debug("Leak r=%u %d\n",
+                                 tp->retrans_out, icsk->icsk_ca_state);
                         tp->retrans_out = 0;
                 }
         }
@@ -3590,7 +3675,7 @@ static void tcp_undo_spur_to_response(struct sock *sk, int flag)
  *     to prove that the RTO is indeed spurious. It transfers the control
  *     from F-RTO to the conventional RTO recovery
  */
-static int tcp_process_frto(struct sock *sk, int flag)
+static bool tcp_process_frto(struct sock *sk, int flag)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
@@ -3606,7 +3691,7 @@ static int tcp_process_frto(struct sock *sk, int flag)
 
         if (!before(tp->snd_una, tp->frto_highmark)) {
                 tcp_enter_frto_loss(sk, (tp->frto_counter == 1 ? 2 : 3), flag);
-                return 1;
+                return true;
         }
 
         if (!tcp_is_sackfrto(tp)) {
@@ -3615,19 +3700,19 @@ static int tcp_process_frto(struct sock *sk, int flag)
                  * data, winupdate
                  */
                 if (!(flag & FLAG_ANY_PROGRESS) && (flag & FLAG_NOT_DUP))
-                        return 1;
+                        return true;
 
                 if (!(flag & FLAG_DATA_ACKED)) {
                         tcp_enter_frto_loss(sk, (tp->frto_counter == 1 ? 0 : 3),
                                             flag);
-                        return 1;
+                        return true;
                 }
         } else {
                 if (!(flag & FLAG_DATA_ACKED) && (tp->frto_counter == 1)) {
                         /* Prevent sending of new data. */
                         tp->snd_cwnd = min(tp->snd_cwnd,
                                            tcp_packets_in_flight(tp));
-                        return 1;
+                        return true;
                 }
 
                 if ((tp->frto_counter >= 2) &&
@@ -3637,10 +3722,10 @@ static int tcp_process_frto(struct sock *sk, int flag)
                         /* RFC4138 shortcoming (see comment above) */
                         if (!(flag & FLAG_FORWARD_PROGRESS) &&
                             (flag & FLAG_NOT_DUP))
-                                return 1;
+                                return true;
 
                         tcp_enter_frto_loss(sk, 3, flag);
-                        return 1;
+                        return true;
                 }
         }
 
@@ -3652,7 +3737,7 @@ static int tcp_process_frto(struct sock *sk, int flag)
                 if (!tcp_may_send_now(sk))
                         tcp_enter_frto_loss(sk, 2, flag);
 
-                return 1;
+                return true;
         } else {
                 switch (sysctl_tcp_frto_response) {
                 case 2:
@@ -3669,7 +3754,7 @@ static int tcp_process_frto(struct sock *sk, int flag)
                 tp->undo_marker = 0;
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSPURIOUSRTOS);
         }
-        return 0;
+        return false;
 }
 
 /* This routine deals with incoming acks, but not outgoing ones. */
@@ -3687,7 +3772,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
         int prior_sacked = tp->sacked_out;
         int pkts_acked = 0;
         int newly_acked_sacked = 0;
-        int frto_cwnd = 0;
+        bool frto_cwnd = false;
 
         /* If the ack is older than previous acks
          * then we can probably ignore it.
@@ -3701,6 +3786,9 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
         if (after(ack, tp->snd_nxt))
                 goto invalid_ack;
 
+        if (tp->early_retrans_delayed)
+                tcp_rearm_rto(sk);
+
         if (after(ack, prior_snd_una))
                 flag |= FLAG_SND_UNA_ADVANCED;
 
@@ -3866,10 +3954,9 @@ void tcp_parse_options(const struct sk_buff *skb, struct tcp_options_received *o
                                         __u8 snd_wscale = *(__u8 *)ptr;
                                         opt_rx->wscale_ok = 1;
                                         if (snd_wscale > 14) {
-                                                if (net_ratelimit())
-                                                        printk(KERN_INFO "tcp_parse_options: Illegal window "
-                                                               "scaling value %d >14 received.\n",
-                                                               snd_wscale);
+                                                net_info_ratelimited("%s: Illegal window scaling value %d >14 received\n",
+                                                                     __func__,
+                                                                     snd_wscale);
                                                 snd_wscale = 14;
                                         }
                                         opt_rx->snd_wscale = snd_wscale;
@@ -3940,7 +4027,7 @@ void tcp_parse_options(const struct sk_buff *skb, struct tcp_options_received *o
 }
 EXPORT_SYMBOL(tcp_parse_options);
 
-static int tcp_parse_aligned_timestamp(struct tcp_sock *tp, const struct tcphdr *th)
+static bool tcp_parse_aligned_timestamp(struct tcp_sock *tp, const struct tcphdr *th)
 {
         const __be32 *ptr = (const __be32 *)(th + 1);
 
@@ -3951,31 +4038,31 @@ static int tcp_parse_aligned_timestamp(struct tcp_sock *tp, const struct tcphdr
                 tp->rx_opt.rcv_tsval = ntohl(*ptr);
                 ++ptr;
                 tp->rx_opt.rcv_tsecr = ntohl(*ptr);
-                return 1;
+                return true;
         }
-        return 0;
+        return false;
 }
 
 /* Fast parse options. This hopes to only see timestamps.
  * If it is wrong it falls back on tcp_parse_options().
  */
-static int tcp_fast_parse_options(const struct sk_buff *skb,
-                                  const struct tcphdr *th,
-                                  struct tcp_sock *tp, const u8 **hvpp)
+static bool tcp_fast_parse_options(const struct sk_buff *skb,
+                                   const struct tcphdr *th,
+                                   struct tcp_sock *tp, const u8 **hvpp)
 {
         /* In the spirit of fast parsing, compare doff directly to constant
          * values.  Because equality is used, short doff can be ignored here.
          */
         if (th->doff == (sizeof(*th) / 4)) {
                 tp->rx_opt.saw_tstamp = 0;
-                return 0;
+                return false;
         } else if (tp->rx_opt.tstamp_ok &&
                    th->doff == ((sizeof(*th) + TCPOLEN_TSTAMP_ALIGNED) / 4)) {
                 if (tcp_parse_aligned_timestamp(tp, th))
-                        return 1;
+                        return true;
         }
         tcp_parse_options(skb, &tp->rx_opt, hvpp, 1);
-        return 1;
+        return true;
 }
 
 #ifdef CONFIG_TCP_MD5SIG
@@ -4191,7 +4278,7 @@ static void tcp_fin(struct sock *sk)
                 /* Only TCP_LISTEN and TCP_CLOSE are left, in these
                  * cases we should never reach this piece of code.
                  */
-                printk(KERN_ERR "%s: Impossible, sk->sk_state=%d\n",
+                pr_err("%s: Impossible, sk->sk_state=%d\n",
                        __func__, sk->sk_state);
                 break;
         }
@@ -4216,7 +4303,7 @@ static void tcp_fin(struct sock *sk)
         }
 }
 
-static inline int tcp_sack_extend(struct tcp_sack_block *sp, u32 seq,
+static inline bool tcp_sack_extend(struct tcp_sack_block *sp, u32 seq,
                                   u32 end_seq)
 {
         if (!after(seq, sp->end_seq) && !after(sp->start_seq, end_seq)) {
@@ -4224,9 +4311,9 @@ static inline int tcp_sack_extend(struct tcp_sack_block *sp, u32 seq,
                         sp->start_seq = seq;
                 if (after(end_seq, sp->end_seq))
                         sp->end_seq = end_seq;
-                return 1;
+                return true;
         }
-        return 0;
+        return false;
 }
 
 static void tcp_dsack_set(struct sock *sk, u32 seq, u32 end_seq)
@@ -4422,10 +4509,10 @@ static void tcp_ofo_queue(struct sock *sk)
         }
 }
 
-static int tcp_prune_ofo_queue(struct sock *sk);
+static bool tcp_prune_ofo_queue(struct sock *sk);
 static int tcp_prune_queue(struct sock *sk);
 
-static inline int tcp_try_rmem_schedule(struct sock *sk, unsigned int size)
+static int tcp_try_rmem_schedule(struct sock *sk, unsigned int size)
 {
         if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
             !sk_rmem_schedule(sk, size)) {
@@ -4444,11 +4531,225 @@ static inline int tcp_try_rmem_schedule(struct sock *sk, unsigned int size)
         return 0;
 }
 
+/**
+ * tcp_try_coalesce - try to merge skb to prior one
+ * @sk: socket
+ * @to: prior buffer
+ * @from: buffer to add in queue
+ * @fragstolen: pointer to boolean
+ *
+ * Before queueing skb @from after @to, try to merge them
+ * to reduce overall memory use and queue lengths, if cost is small.
+ * Packets in ofo or receive queues can stay a long time.
+ * Better try to coalesce them right now to avoid future collapses.
+ * Returns true if caller should free @from instead of queueing it
+ */
+static bool tcp_try_coalesce(struct sock *sk,
+                             struct sk_buff *to,
+                             struct sk_buff *from,
+                             bool *fragstolen)
+{
+        int delta;
+
+        *fragstolen = false;
+
+        if (tcp_hdr(from)->fin)
+                return false;
+
+        /* Its possible this segment overlaps with prior segment in queue */
+        if (TCP_SKB_CB(from)->seq != TCP_SKB_CB(to)->end_seq)
+                return false;
+
+        if (!skb_try_coalesce(to, from, fragstolen, &delta))
+                return false;
+
+        atomic_add(delta, &sk->sk_rmem_alloc);
+        sk_mem_charge(sk, delta);
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRCVCOALESCE);
+        TCP_SKB_CB(to)->end_seq = TCP_SKB_CB(from)->end_seq;
+        TCP_SKB_CB(to)->ack_seq = TCP_SKB_CB(from)->ack_seq;
+        return true;
+}
+
+static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct sk_buff *skb1;
+        u32 seq, end_seq;
+
+        TCP_ECN_check_ce(tp, skb);
+
+        if (tcp_try_rmem_schedule(sk, skb->truesize)) {
+                /* TODO: should increment a counter */
+                __kfree_skb(skb);
+                return;
+        }
+
+        /* Disable header prediction. */
+        tp->pred_flags = 0;
+        inet_csk_schedule_ack(sk);
+
+        SOCK_DEBUG(sk, "out of order segment: rcv_next %X seq %X - %X\n",
+                   tp->rcv_nxt, TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq);
+
+        skb1 = skb_peek_tail(&tp->out_of_order_queue);
+        if (!skb1) {
+                /* Initial out of order segment, build 1 SACK. */
+                if (tcp_is_sack(tp)) {
+                        tp->rx_opt.num_sacks = 1;
+                        tp->selective_acks[0].start_seq = TCP_SKB_CB(skb)->seq;
+                        tp->selective_acks[0].end_seq =
+                                                TCP_SKB_CB(skb)->end_seq;
+                }
+                __skb_queue_head(&tp->out_of_order_queue, skb);
+                goto end;
+        }
+
+        seq = TCP_SKB_CB(skb)->seq;
+        end_seq = TCP_SKB_CB(skb)->end_seq;
+
+        if (seq == TCP_SKB_CB(skb1)->end_seq) {
+                bool fragstolen;
+
+                if (!tcp_try_coalesce(sk, skb1, skb, &fragstolen)) {
+                        __skb_queue_after(&tp->out_of_order_queue, skb1, skb);
+                } else {
+                        kfree_skb_partial(skb, fragstolen);
+                        skb = NULL;
+                }
+
+                if (!tp->rx_opt.num_sacks ||
+                    tp->selective_acks[0].end_seq != seq)
+                        goto add_sack;
+
+                /* Common case: data arrive in order after hole. */
+                tp->selective_acks[0].end_seq = end_seq;
+                goto end;
+        }
+
+        /* Find place to insert this segment. */
+        while (1) {
+                if (!after(TCP_SKB_CB(skb1)->seq, seq))
+                        break;
+                if (skb_queue_is_first(&tp->out_of_order_queue, skb1)) {
+                        skb1 = NULL;
+                        break;
+                }
+                skb1 = skb_queue_prev(&tp->out_of_order_queue, skb1);
+        }
+
+        /* Do skb overlap to previous one? */
+        if (skb1 && before(seq, TCP_SKB_CB(skb1)->end_seq)) {
+                if (!after(end_seq, TCP_SKB_CB(skb1)->end_seq)) {
+                        /* All the bits are present. Drop. */
+                        __kfree_skb(skb);
+                        skb = NULL;
+                        tcp_dsack_set(sk, seq, end_seq);
+                        goto add_sack;
+                }
+                if (after(seq, TCP_SKB_CB(skb1)->seq)) {
+                        /* Partial overlap. */
+                        tcp_dsack_set(sk, seq,
+                                      TCP_SKB_CB(skb1)->end_seq);
+                } else {
+                        if (skb_queue_is_first(&tp->out_of_order_queue,
+                                               skb1))
+                                skb1 = NULL;
+                        else
+                                skb1 = skb_queue_prev(
+                                        &tp->out_of_order_queue,
+                                        skb1);
+                }
+        }
+        if (!skb1)
+                __skb_queue_head(&tp->out_of_order_queue, skb);
+        else
+                __skb_queue_after(&tp->out_of_order_queue, skb1, skb);
+
+        /* And clean segments covered by new one as whole. */
+        while (!skb_queue_is_last(&tp->out_of_order_queue, skb)) {
+                skb1 = skb_queue_next(&tp->out_of_order_queue, skb);
+
+                if (!after(end_seq, TCP_SKB_CB(skb1)->seq))
+                        break;
+                if (before(end_seq, TCP_SKB_CB(skb1)->end_seq)) {
+                        tcp_dsack_extend(sk, TCP_SKB_CB(skb1)->seq,
+                                         end_seq);
+                        break;
+                }
+                __skb_unlink(skb1, &tp->out_of_order_queue);
+                tcp_dsack_extend(sk, TCP_SKB_CB(skb1)->seq,
+                                 TCP_SKB_CB(skb1)->end_seq);
+                __kfree_skb(skb1);
+        }
+
+add_sack:
+        if (tcp_is_sack(tp))
+                tcp_sack_new_ofo_skb(sk, seq, end_seq);
+end:
+        if (skb)
+                skb_set_owner_r(skb, sk);
+}
+
+static int __must_check tcp_queue_rcv(struct sock *sk, struct sk_buff *skb, int hdrlen,
+                  bool *fragstolen)
+{
+        int eaten;
+        struct sk_buff *tail = skb_peek_tail(&sk->sk_receive_queue);
+
+        __skb_pull(skb, hdrlen);
+        eaten = (tail &&
+                 tcp_try_coalesce(sk, tail, skb, fragstolen)) ? 1 : 0;
+        tcp_sk(sk)->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
+        if (!eaten) {
+                __skb_queue_tail(&sk->sk_receive_queue, skb);
+                skb_set_owner_r(skb, sk);
+        }
+        return eaten;
+}
+
+int tcp_send_rcvq(struct sock *sk, struct msghdr *msg, size_t size)
+{
+        struct sk_buff *skb;
+        struct tcphdr *th;
+        bool fragstolen;
+
+        if (tcp_try_rmem_schedule(sk, size + sizeof(*th)))
+                goto err;
+
+        skb = alloc_skb(size + sizeof(*th), sk->sk_allocation);
+        if (!skb)
+                goto err;
+
+        th = (struct tcphdr *)skb_put(skb, sizeof(*th));
+        skb_reset_transport_header(skb);
+        memset(th, 0, sizeof(*th));
+
+        if (memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size))
+                goto err_free;
+
+        TCP_SKB_CB(skb)->seq = tcp_sk(sk)->rcv_nxt;
+        TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(skb)->seq + size;
+        TCP_SKB_CB(skb)->ack_seq = tcp_sk(sk)->snd_una - 1;
+
+        if (tcp_queue_rcv(sk, skb, sizeof(*th), &fragstolen)) {
+                WARN_ON_ONCE(fragstolen); /* should not happen */
+                __kfree_skb(skb);
+        }
+        return size;
+
+err_free:
+        kfree_skb(skb);
+err:
+        return -ENOMEM;
+}
+
 static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
 {
         const struct tcphdr *th = tcp_hdr(skb);
         struct tcp_sock *tp = tcp_sk(sk);
         int eaten = -1;
+        bool fragstolen = false;
 
         if (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq)
                 goto drop;
@@ -4493,8 +4794,7 @@ queue_and_out:
                             tcp_try_rmem_schedule(sk, skb->truesize))
                                 goto drop;
 
-                        skb_set_owner_r(skb, sk);
-                        __skb_queue_tail(&sk->sk_receive_queue, skb);
+                        eaten = tcp_queue_rcv(sk, skb, 0, &fragstolen);
                 }
                 tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
                 if (skb->len)
@@ -4518,7 +4818,7 @@ queue_and_out:
                 tcp_fast_path_check(sk);
 
                 if (eaten > 0)
-                        __kfree_skb(skb);
+                        kfree_skb_partial(skb, fragstolen);
                 else if (!sock_flag(sk, SOCK_DEAD))
                         sk->sk_data_ready(sk, 0);
                 return;
@@ -4559,105 +4859,7 @@ drop:
                 goto queue_and_out;
         }
 
-        TCP_ECN_check_ce(tp, skb);
-
-        if (tcp_try_rmem_schedule(sk, skb->truesize))
-                goto drop;
-
-        /* Disable header prediction. */
-        tp->pred_flags = 0;
-        inet_csk_schedule_ack(sk);
-
-        SOCK_DEBUG(sk, "out of order segment: rcv_next %X seq %X - %X\n",
-                   tp->rcv_nxt, TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq);
-
-        skb_set_owner_r(skb, sk);
-
-        if (!skb_peek(&tp->out_of_order_queue)) {
-                /* Initial out of order segment, build 1 SACK. */
-                if (tcp_is_sack(tp)) {
-                        tp->rx_opt.num_sacks = 1;
-                        tp->selective_acks[0].start_seq = TCP_SKB_CB(skb)->seq;
-                        tp->selective_acks[0].end_seq =
-                                                TCP_SKB_CB(skb)->end_seq;
-                }
-                __skb_queue_head(&tp->out_of_order_queue, skb);
-        } else {
-                struct sk_buff *skb1 = skb_peek_tail(&tp->out_of_order_queue);
-                u32 seq = TCP_SKB_CB(skb)->seq;
-                u32 end_seq = TCP_SKB_CB(skb)->end_seq;
-
-                if (seq == TCP_SKB_CB(skb1)->end_seq) {
-                        __skb_queue_after(&tp->out_of_order_queue, skb1, skb);
-
-                        if (!tp->rx_opt.num_sacks ||
-                            tp->selective_acks[0].end_seq != seq)
-                                goto add_sack;
-
-                        /* Common case: data arrive in order after hole. */
-                        tp->selective_acks[0].end_seq = end_seq;
-                        return;
-                }
-
-                /* Find place to insert this segment. */
-                while (1) {
-                        if (!after(TCP_SKB_CB(skb1)->seq, seq))
-                                break;
-                        if (skb_queue_is_first(&tp->out_of_order_queue, skb1)) {
-                                skb1 = NULL;
-                                break;
-                        }
-                        skb1 = skb_queue_prev(&tp->out_of_order_queue, skb1);
-                }
-
-                /* Do skb overlap to previous one? */
-                if (skb1 && before(seq, TCP_SKB_CB(skb1)->end_seq)) {
-                        if (!after(end_seq, TCP_SKB_CB(skb1)->end_seq)) {
-                                /* All the bits are present. Drop. */
-                                __kfree_skb(skb);
-                                tcp_dsack_set(sk, seq, end_seq);
-                                goto add_sack;
-                        }
-                        if (after(seq, TCP_SKB_CB(skb1)->seq)) {
-                                /* Partial overlap. */
-                                tcp_dsack_set(sk, seq,
-                                              TCP_SKB_CB(skb1)->end_seq);
-                        } else {
-                                if (skb_queue_is_first(&tp->out_of_order_queue,
-                                                       skb1))
-                                        skb1 = NULL;
-                                else
-                                        skb1 = skb_queue_prev(
-                                                &tp->out_of_order_queue,
-                                                skb1);
-                        }
-                }
-                if (!skb1)
-                        __skb_queue_head(&tp->out_of_order_queue, skb);
-                else
-                        __skb_queue_after(&tp->out_of_order_queue, skb1, skb);
-
-                /* And clean segments covered by new one as whole. */
-                while (!skb_queue_is_last(&tp->out_of_order_queue, skb)) {
-                        skb1 = skb_queue_next(&tp->out_of_order_queue, skb);
-
-                        if (!after(end_seq, TCP_SKB_CB(skb1)->seq))
-                                break;
-                        if (before(end_seq, TCP_SKB_CB(skb1)->end_seq)) {
-                                tcp_dsack_extend(sk, TCP_SKB_CB(skb1)->seq,
-                                                 end_seq);
-                                break;
-                        }
-                        __skb_unlink(skb1, &tp->out_of_order_queue);
-                        tcp_dsack_extend(sk, TCP_SKB_CB(skb1)->seq,
-                                         TCP_SKB_CB(skb1)->end_seq);
-                        __kfree_skb(skb1);
-                }
-
-add_sack:
-                if (tcp_is_sack(tp))
-                        tcp_sack_new_ofo_skb(sk, seq, end_seq);
-        }
+        tcp_data_queue_ofo(sk, skb);
 }
 
 static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
@@ -4836,10 +5038,10 @@ static void tcp_collapse_ofo_queue(struct sock *sk)
  * Purge the out-of-order queue.
  * Return true if queue was pruned.
  */
-static int tcp_prune_ofo_queue(struct sock *sk)
+static bool tcp_prune_ofo_queue(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        int res = 0;
+        bool res = false;
 
         if (!skb_queue_empty(&tp->out_of_order_queue)) {
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_OFOPRUNED);
@@ -4853,7 +5055,7 @@ static int tcp_prune_ofo_queue(struct sock *sk)
                 if (tp->rx_opt.sack_ok)
                         tcp_sack_reset(&tp->rx_opt);
                 sk_mem_reclaim(sk);
-                res = 1;
+                res = true;
         }
         return res;
 }
@@ -4930,7 +5132,7 @@ void tcp_cwnd_application_limited(struct sock *sk)
         tp->snd_cwnd_stamp = tcp_time_stamp;
 }
 
-static int tcp_should_expand_sndbuf(const struct sock *sk)
+static bool tcp_should_expand_sndbuf(const struct sock *sk)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
 
@@ -4938,21 +5140,21 @@ static int tcp_should_expand_sndbuf(const struct sock *sk)
          * not modify it.
          */
         if (sk->sk_userlocks & SOCK_SNDBUF_LOCK)
-                return 0;
+                return false;
 
         /* If we are under global TCP memory pressure, do not expand.  */
         if (sk_under_memory_pressure(sk))
-                return 0;
+                return false;
 
         /* If we are under soft global TCP memory pressure, do not expand.  */
         if (sk_memory_allocated(sk) >= sk_prot_mem_limits(sk, 0))
-                return 0;
+                return false;
 
         /* If we filled the congestion window, do not expand.  */
         if (tp->packets_out >= tp->snd_cwnd)
-                return 0;
+                return false;
 
-        return 1;
+        return true;
 }
 
 /* When incoming ACK allowed to free some skb from write_queue,
@@ -5178,19 +5380,19 @@ static inline int tcp_checksum_complete_user(struct sock *sk,
 }
 
 #ifdef CONFIG_NET_DMA
-static int tcp_dma_try_early_copy(struct sock *sk, struct sk_buff *skb,
+static bool tcp_dma_try_early_copy(struct sock *sk, struct sk_buff *skb,
                                   int hlen)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int chunk = skb->len - hlen;
         int dma_cookie;
-        int copied_early = 0;
+        bool copied_early = false;
 
         if (tp->ucopy.wakeup)
-                return 0;
+                return false;
 
         if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
-                tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
+                tp->ucopy.dma_chan = net_dma_find_channel();
 
         if (tp->ucopy.dma_chan && skb_csum_unnecessary(skb)) {
 
@@ -5203,7 +5405,7 @@ static int tcp_dma_try_early_copy(struct sock *sk, struct sk_buff *skb,
                         goto out;
 
                 tp->ucopy.dma_cookie = dma_cookie;
-                copied_early = 1;
+                copied_early = true;
 
                 tp->ucopy.len -= chunk;
                 tp->copied_seq += chunk;
@@ -5395,6 +5597,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                 } else {
                         int eaten = 0;
                         int copied_early = 0;
+                        bool fragstolen = false;
 
                         if (tp->copied_seq == tp->rcv_nxt &&
                             len - tcp_header_len <= tp->ucopy.len) {
@@ -5452,10 +5655,8 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPHPHITS);
 
                                 /* Bulk data transfer: receiver */
-                                __skb_pull(skb, tcp_header_len);
-                                __skb_queue_tail(&sk->sk_receive_queue, skb);
-                                skb_set_owner_r(skb, sk);
-                                tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
+                                eaten = tcp_queue_rcv(sk, skb, tcp_header_len,
+                                                      &fragstolen);
                         }
 
                         tcp_event_data_recv(sk, skb);
@@ -5477,7 +5678,7 @@ no_ack:
                         else
 #endif
                         if (eaten)
-                                __kfree_skb(skb);
+                                kfree_skb_partial(skb, fragstolen);
                         else
                                 sk->sk_data_ready(sk, 0);
                         return 0;
@@ -5521,6 +5722,44 @@ discard:
 }
 EXPORT_SYMBOL(tcp_rcv_established);
 
+void tcp_finish_connect(struct sock *sk, struct sk_buff *skb)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct inet_connection_sock *icsk = inet_csk(sk);
+
+        tcp_set_state(sk, TCP_ESTABLISHED);
+
+        if (skb != NULL)
+                security_inet_conn_established(sk, skb);
+
+        /* Make sure socket is routed, for correct metrics.  */
+        icsk->icsk_af_ops->rebuild_header(sk);
+
+        tcp_init_metrics(sk);
+
+        tcp_init_congestion_control(sk);
+
+        /* Prevent spurious tcp_cwnd_restart() on first data
+         * packet.
+         */
+        tp->lsndtime = tcp_time_stamp;
+
+        tcp_init_buffer_space(sk);
+
+        if (sock_flag(sk, SOCK_KEEPOPEN))
+                inet_csk_reset_keepalive_timer(sk, keepalive_time_when(tp));
+
+        if (!tp->rx_opt.snd_wscale)
+                __tcp_fast_path_on(tp, tp->snd_wnd);
+        else
+                tp->pred_flags = 0;
+
+        if (!sock_flag(sk, SOCK_DEAD)) {
+                sk->sk_state_change(sk);
+                sk_wake_async(sk, SOCK_WAKE_IO, POLL_OUT);
+        }
+}
+
 static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                                          const struct tcphdr *th, unsigned int len)
 {
@@ -5653,36 +5892,8 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                 }
 
                 smp_mb();
-                tcp_set_state(sk, TCP_ESTABLISHED);
-
-                security_inet_conn_established(sk, skb);
 
-                /* Make sure socket is routed, for correct metrics.  */
-                icsk->icsk_af_ops->rebuild_header(sk);
-
-                tcp_init_metrics(sk);
-
-                tcp_init_congestion_control(sk);
-
-                /* Prevent spurious tcp_cwnd_restart() on first data
-                 * packet.
-                 */
-                tp->lsndtime = tcp_time_stamp;
-
-                tcp_init_buffer_space(sk);
-
-                if (sock_flag(sk, SOCK_KEEPOPEN))
-                        inet_csk_reset_keepalive_timer(sk, keepalive_time_when(tp));
-
-                if (!tp->rx_opt.snd_wscale)
-                        __tcp_fast_path_on(tp, tp->snd_wnd);
-                else
-                        tp->pred_flags = 0;
-
-                if (!sock_flag(sk, SOCK_DEAD)) {
-                        sk->sk_state_change(sk);
-                        sk_wake_async(sk, SOCK_WAKE_IO, POLL_OUT);
-                }
+                tcp_finish_connect(sk, skb);
 
                 if (sk->sk_write_pending ||
                     icsk->icsk_accept_queue.rskq_defer_accept ||
@@ -5696,8 +5907,6 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                          */
                         inet_csk_schedule_ack(sk);
                         icsk->icsk_ack.lrcvtime = tcp_time_stamp;
-                        icsk->icsk_ack.ato       = TCP_ATO_MIN;
-                        tcp_incr_quickack(sk);
                         tcp_enter_quickack_mode(sk);
                         inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
                                                   TCP_DELACK_MAX, TCP_RTO_MAX);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index fd54c5f8a255..c8d28c433b2b 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -50,6 +50,7 @@
  *                                      a single port at the same time.
  */
 
+#define pr_fmt(fmt) "TCP: " fmt
 
 #include <linux/bottom_half.h>
 #include <linux/types.h>
@@ -90,16 +91,8 @@ EXPORT_SYMBOL(sysctl_tcp_low_latency);
 
 
 #ifdef CONFIG_TCP_MD5SIG
-static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
-                                                   __be32 addr);
-static int tcp_v4_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
+static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
                                __be32 daddr, __be32 saddr, const struct tcphdr *th);
-#else
-static inline
-struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk, __be32 addr)
-{
-        return NULL;
-}
 #endif
 
 struct inet_hashinfo tcp_hashinfo;
@@ -145,6 +138,14 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
 }
 EXPORT_SYMBOL_GPL(tcp_twsk_unique);
 
+static int tcp_repair_connect(struct sock *sk)
+{
+        tcp_connect_init(sk);
+        tcp_finish_connect(sk, NULL);
+
+        return 0;
+}
+
 /* This will initiate an outgoing connection. */
 int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
@@ -203,7 +204,8 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 /* Reset inherited state */
                 tp->rx_opt.ts_recent       = 0;
                 tp->rx_opt.ts_recent_stamp = 0;
-                tp->write_seq              = 0;
+                if (likely(!tp->repair))
+                        tp->write_seq      = 0;
         }
 
         if (tcp_death_row.sysctl_tw_recycle &&
@@ -254,7 +256,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         sk->sk_gso_type = SKB_GSO_TCPV4;
         sk_setup_caps(sk, &rt->dst);
 
-        if (!tp->write_seq)
+        if (!tp->write_seq && likely(!tp->repair))
                 tp->write_seq = secure_tcp_sequence_number(inet->inet_saddr,
                                                            inet->inet_daddr,
                                                            inet->inet_sport,
@@ -262,7 +264,11 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 
         inet->inet_id = tp->write_seq ^ jiffies;
 
-        err = tcp_connect(sk);
+        if (likely(!tp->repair))
+                err = tcp_connect(sk);
+        else
+                err = tcp_repair_connect(sk);
+
         rt = NULL;
         if (err)
                 goto failure;
@@ -601,6 +607,10 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
         struct ip_reply_arg arg;
 #ifdef CONFIG_TCP_MD5SIG
         struct tcp_md5sig_key *key;
+        const __u8 *hash_location = NULL;
+        unsigned char newhash[16];
+        int genhash;
+        struct sock *sk1 = NULL;
 #endif
         struct net *net;
 
@@ -631,7 +641,36 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
         arg.iov[0].iov_len  = sizeof(rep.th);
 
 #ifdef CONFIG_TCP_MD5SIG
-        key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->saddr) : NULL;
+        hash_location = tcp_parse_md5sig_option(th);
+        if (!sk && hash_location) {
+                /*
+                 * active side is lost. Try to find listening socket through
+                 * source port, and then find md5 key through listening socket.
+                 * we are not loose security here:
+                 * Incoming packet is checked with md5 hash with finding key,
+                 * no RST generated if md5 hash doesn't match.
+                 */
+                sk1 = __inet_lookup_listener(dev_net(skb_dst(skb)->dev),
+                                             &tcp_hashinfo, ip_hdr(skb)->daddr,
+                                             ntohs(th->source), inet_iif(skb));
+                /* don't send rst if it can't find key */
+                if (!sk1)
+                        return;
+                rcu_read_lock();
+                key = tcp_md5_do_lookup(sk1, (union tcp_md5_addr *)
+                                        &ip_hdr(skb)->saddr, AF_INET);
+                if (!key)
+                        goto release_sk1;
+
+                genhash = tcp_v4_md5_hash_skb(newhash, key, NULL, NULL, skb);
+                if (genhash || memcmp(hash_location, newhash, 16) != 0)
+                        goto release_sk1;
+        } else {
+                key = sk ? tcp_md5_do_lookup(sk, (union tcp_md5_addr *)
+                                             &ip_hdr(skb)->saddr,
+                                             AF_INET) : NULL;
+        }
+
         if (key) {
                 rep.opt[0] = htonl((TCPOPT_NOP << 24) |
                                    (TCPOPT_NOP << 16) |
@@ -664,6 +703,14 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
 
         TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
+
+#ifdef CONFIG_TCP_MD5SIG
+release_sk1:
+        if (sk1) {
+                rcu_read_unlock();
+                sock_put(sk1);
+        }
+#endif
 }
 
 /* The code following below sending ACKs in SYN-RECV and TIME-WAIT states
@@ -764,7 +811,8 @@ static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
                         tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd,
                         req->ts_recent,
                         0,
-                        tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->daddr),
+                        tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&ip_hdr(skb)->daddr,
+                                          AF_INET),
                         inet_rsk(req)->no_srccheck ? IP_REPLY_ARG_NOSRCCHECK : 0,
                         ip_hdr(skb)->tos);
 }
@@ -776,7 +824,8 @@ static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  */
 static int tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
                               struct request_sock *req,
-                              struct request_values *rvp)
+                              struct request_values *rvp,
+                              u16 queue_mapping)
 {
         const struct inet_request_sock *ireq = inet_rsk(req);
         struct flowi4 fl4;
@@ -792,6 +841,7 @@ static int tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
         if (skb) {
                 __tcp_v4_send_check(skb, ireq->loc_addr, ireq->rmt_addr);
 
+                skb_set_queue_mapping(skb, queue_mapping);
                 err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
                                             ireq->rmt_addr,
                                             ireq->opt);
@@ -806,7 +856,7 @@ static int tcp_v4_rtx_synack(struct sock *sk, struct request_sock *req,
                               struct request_values *rvp)
 {
         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
-        return tcp_v4_send_synack(sk, NULL, req, rvp);
+        return tcp_v4_send_synack(sk, NULL, req, rvp, 0);
 }
 
 /*
@@ -818,14 +868,14 @@ static void tcp_v4_reqsk_destructor(struct request_sock *req)
 }
 
 /*
- * Return 1 if a syncookie should be sent
+ * Return true if a syncookie should be sent
  */
-int tcp_syn_flood_action(struct sock *sk,
+bool tcp_syn_flood_action(struct sock *sk,
                          const struct sk_buff *skb,
                          const char *proto)
 {
         const char *msg = "Dropping request";
-        int want_cookie = 0;
+        bool want_cookie = false;
         struct listen_sock *lopt;
 
 
@@ -833,7 +883,7 @@ int tcp_syn_flood_action(struct sock *sk,
 #ifdef CONFIG_SYN_COOKIES
         if (sysctl_tcp_syncookies) {
                 msg = "Sending cookies";
-                want_cookie = 1;
+                want_cookie = true;
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPREQQFULLDOCOOKIES);
         } else
 #endif
@@ -842,8 +892,7 @@ int tcp_syn_flood_action(struct sock *sk,
         lopt = inet_csk(sk)->icsk_accept_queue.listen_opt;
         if (!lopt->synflood_warned) {
                 lopt->synflood_warned = 1;
-                pr_info("%s: Possible SYN flooding on port %d. %s. "
-                        " Check SNMP counters.\n",
+                pr_info("%s: Possible SYN flooding on port %d. %s.  Check SNMP counters.\n",
                         proto, ntohs(tcp_hdr(skb)->dest), msg);
         }
         return want_cookie;
@@ -881,153 +930,138 @@ static struct ip_options_rcu *tcp_v4_save_options(struct sock *sk,
  */
 
 /* Find the Key structure for an address.  */
-static struct tcp_md5sig_key *
-                        tcp_v4_md5_do_lookup(struct sock *sk, __be32 addr)
+struct tcp_md5sig_key *tcp_md5_do_lookup(struct sock *sk,
+                                         const union tcp_md5_addr *addr,
+                                         int family)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        int i;
-
-        if (!tp->md5sig_info || !tp->md5sig_info->entries4)
+        struct tcp_md5sig_key *key;
+        struct hlist_node *pos;
+        unsigned int size = sizeof(struct in_addr);
+        struct tcp_md5sig_info *md5sig;
+
+        /* caller either holds rcu_read_lock() or socket lock */
+        md5sig = rcu_dereference_check(tp->md5sig_info,
+                                       sock_owned_by_user(sk) ||
+                                       lockdep_is_held(&sk->sk_lock.slock));
+        if (!md5sig)
                 return NULL;
-        for (i = 0; i < tp->md5sig_info->entries4; i++) {
-                if (tp->md5sig_info->keys4[i].addr == addr)
-                        return &tp->md5sig_info->keys4[i].base;
+#if IS_ENABLED(CONFIG_IPV6)
+        if (family == AF_INET6)
+                size = sizeof(struct in6_addr);
+#endif
+        hlist_for_each_entry_rcu(key, pos, &md5sig->head, node) {
+                if (key->family != family)
+                        continue;
+                if (!memcmp(&key->addr, addr, size))
+                        return key;
         }
         return NULL;
 }
+EXPORT_SYMBOL(tcp_md5_do_lookup);
 
 struct tcp_md5sig_key *tcp_v4_md5_lookup(struct sock *sk,
                                          struct sock *addr_sk)
 {
-        return tcp_v4_md5_do_lookup(sk, inet_sk(addr_sk)->inet_daddr);
+        union tcp_md5_addr *addr;
+
+        addr = (union tcp_md5_addr *)&inet_sk(addr_sk)->inet_daddr;
+        return tcp_md5_do_lookup(sk, addr, AF_INET);
 }
 EXPORT_SYMBOL(tcp_v4_md5_lookup);
 
 static struct tcp_md5sig_key *tcp_v4_reqsk_md5_lookup(struct sock *sk,
                                                       struct request_sock *req)
 {
-        return tcp_v4_md5_do_lookup(sk, inet_rsk(req)->rmt_addr);
+        union tcp_md5_addr *addr;
+
+        addr = (union tcp_md5_addr *)&inet_rsk(req)->rmt_addr;
+        return tcp_md5_do_lookup(sk, addr, AF_INET);
 }
 
 /* This can be called on a newly created socket, from other files */
-int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
-                      u8 *newkey, u8 newkeylen)
+int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,
+                   int family, const u8 *newkey, u8 newkeylen, gfp_t gfp)
 {
         /* Add Key to the list */
         struct tcp_md5sig_key *key;
         struct tcp_sock *tp = tcp_sk(sk);
-        struct tcp4_md5sig_key *keys;
+        struct tcp_md5sig_info *md5sig;
 
-        key = tcp_v4_md5_do_lookup(sk, addr);
+        key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&addr, AF_INET);
         if (key) {
                 /* Pre-existing entry - just update that one. */
-                kfree(key->key);
-                key->key = newkey;
+                memcpy(key->key, newkey, newkeylen);
                 key->keylen = newkeylen;
-        } else {
-                struct tcp_md5sig_info *md5sig;
-
-                if (!tp->md5sig_info) {
-                        tp->md5sig_info = kzalloc(sizeof(*tp->md5sig_info),
-                                                  GFP_ATOMIC);
-                        if (!tp->md5sig_info) {
-                                kfree(newkey);
-                                return -ENOMEM;
-                        }
-                        sk_nocaps_add(sk, NETIF_F_GSO_MASK);
-                }
+                return 0;
+        }
 
-                md5sig = tp->md5sig_info;
-                if (md5sig->entries4 == 0 &&
-                    tcp_alloc_md5sig_pool(sk) == NULL) {
-                        kfree(newkey);
+        md5sig = rcu_dereference_protected(tp->md5sig_info,
+                                           sock_owned_by_user(sk));
+        if (!md5sig) {
+                md5sig = kmalloc(sizeof(*md5sig), gfp);
+                if (!md5sig)
                         return -ENOMEM;
-                }
 
-                if (md5sig->alloced4 == md5sig->entries4) {
-                        keys = kmalloc((sizeof(*keys) *
-                                        (md5sig->entries4 + 1)), GFP_ATOMIC);
-                        if (!keys) {
-                                kfree(newkey);
-                                if (md5sig->entries4 == 0)
-                                        tcp_free_md5sig_pool();
-                                return -ENOMEM;
-                        }
-
-                        if (md5sig->entries4)
-                                memcpy(keys, md5sig->keys4,
-                                       sizeof(*keys) * md5sig->entries4);
+                sk_nocaps_add(sk, NETIF_F_GSO_MASK);
+                INIT_HLIST_HEAD(&md5sig->head);
+                rcu_assign_pointer(tp->md5sig_info, md5sig);
+        }
 
-                        /* Free old key list, and reference new one */
-                        kfree(md5sig->keys4);
-                        md5sig->keys4 = keys;
-                        md5sig->alloced4++;
-                }
-                md5sig->entries4++;
-                md5sig->keys4[md5sig->entries4 - 1].addr        = addr;
-                md5sig->keys4[md5sig->entries4 - 1].base.key    = newkey;
-                md5sig->keys4[md5sig->entries4 - 1].base.keylen = newkeylen;
+        key = sock_kmalloc(sk, sizeof(*key), gfp);
+        if (!key)
+                return -ENOMEM;
+        if (hlist_empty(&md5sig->head) && !tcp_alloc_md5sig_pool(sk)) {
+                sock_kfree_s(sk, key, sizeof(*key));
+                return -ENOMEM;
         }
-        return 0;
-}
-EXPORT_SYMBOL(tcp_v4_md5_do_add);
 
-static int tcp_v4_md5_add_func(struct sock *sk, struct sock *addr_sk,
-                               u8 *newkey, u8 newkeylen)
-{
-        return tcp_v4_md5_do_add(sk, inet_sk(addr_sk)->inet_daddr,
-                                 newkey, newkeylen);
+        memcpy(key->key, newkey, newkeylen);
+        key->keylen = newkeylen;
+        key->family = family;
+        memcpy(&key->addr, addr,
+               (family == AF_INET6) ? sizeof(struct in6_addr) :
+                                      sizeof(struct in_addr));
+        hlist_add_head_rcu(&key->node, &md5sig->head);
+        return 0;
 }
+EXPORT_SYMBOL(tcp_md5_do_add);
 
-int tcp_v4_md5_do_del(struct sock *sk, __be32 addr)
+int tcp_md5_do_del(struct sock *sk, const union tcp_md5_addr *addr, int family)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        int i;
-
-        for (i = 0; i < tp->md5sig_info->entries4; i++) {
-                if (tp->md5sig_info->keys4[i].addr == addr) {
-                        /* Free the key */
-                        kfree(tp->md5sig_info->keys4[i].base.key);
-                        tp->md5sig_info->entries4--;
-
-                        if (tp->md5sig_info->entries4 == 0) {
-                                kfree(tp->md5sig_info->keys4);
-                                tp->md5sig_info->keys4 = NULL;
-                                tp->md5sig_info->alloced4 = 0;
-                                tcp_free_md5sig_pool();
-                        } else if (tp->md5sig_info->entries4 != i) {
-                                /* Need to do some manipulation */
-                                memmove(&tp->md5sig_info->keys4[i],
-                                        &tp->md5sig_info->keys4[i+1],
-                                        (tp->md5sig_info->entries4 - i) *
-                                         sizeof(struct tcp4_md5sig_key));
-                        }
-                        return 0;
-                }
-        }
-        return -ENOENT;
+        struct tcp_md5sig_key *key;
+        struct tcp_md5sig_info *md5sig;
+
+        key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&addr, AF_INET);
+        if (!key)
+                return -ENOENT;
+        hlist_del_rcu(&key->node);
+        atomic_sub(sizeof(*key), &sk->sk_omem_alloc);
+        kfree_rcu(key, rcu);
+        md5sig = rcu_dereference_protected(tp->md5sig_info,
+                                           sock_owned_by_user(sk));
+        if (hlist_empty(&md5sig->head))
+                tcp_free_md5sig_pool();
+        return 0;
 }
-EXPORT_SYMBOL(tcp_v4_md5_do_del);
+EXPORT_SYMBOL(tcp_md5_do_del);
 
-static void tcp_v4_clear_md5_list(struct sock *sk)
+void tcp_clear_md5_list(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
+        struct tcp_md5sig_key *key;
+        struct hlist_node *pos, *n;
+        struct tcp_md5sig_info *md5sig;
 
-        /* Free each key, then the set of key keys,
-         * the crypto element, and then decrement our
-         * hold on the last resort crypto.
-         */
-        if (tp->md5sig_info->entries4) {
-                int i;
-                for (i = 0; i < tp->md5sig_info->entries4; i++)
-                        kfree(tp->md5sig_info->keys4[i].base.key);
-                tp->md5sig_info->entries4 = 0;
+        md5sig = rcu_dereference_protected(tp->md5sig_info, 1);
+
+        if (!hlist_empty(&md5sig->head))
                 tcp_free_md5sig_pool();
-        }
-        if (tp->md5sig_info->keys4) {
-                kfree(tp->md5sig_info->keys4);
-                tp->md5sig_info->keys4 = NULL;
-                tp->md5sig_info->alloced4  = 0;
+        hlist_for_each_entry_safe(key, pos, n, &md5sig->head, node) {
+                hlist_del_rcu(&key->node);
+                atomic_sub(sizeof(*key), &sk->sk_omem_alloc);
+                kfree_rcu(key, rcu);
         }
 }
 
@@ -1036,7 +1070,6 @@ static int tcp_v4_parse_md5_keys(struct sock *sk, char __user *optval,
 {
         struct tcp_md5sig cmd;
         struct sockaddr_in *sin = (struct sockaddr_in *)&cmd.tcpm_addr;
-        u8 *newkey;
 
         if (optlen < sizeof(cmd))
                 return -EINVAL;
@@ -1047,32 +1080,16 @@ static int tcp_v4_parse_md5_keys(struct sock *sk, char __user *optval,
         if (sin->sin_family != AF_INET)
                 return -EINVAL;
 
-        if (!cmd.tcpm_key || !cmd.tcpm_keylen) {
-                if (!tcp_sk(sk)->md5sig_info)
-                        return -ENOENT;
-                return tcp_v4_md5_do_del(sk, sin->sin_addr.s_addr);
-        }
+        if (!cmd.tcpm_key || !cmd.tcpm_keylen)
+                return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin->sin_addr.s_addr,
+                                      AF_INET);
 
         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
                 return -EINVAL;
 
-        if (!tcp_sk(sk)->md5sig_info) {
-                struct tcp_sock *tp = tcp_sk(sk);
-                struct tcp_md5sig_info *p;
-
-                p = kzalloc(sizeof(*p), sk->sk_allocation);
-                if (!p)
-                        return -EINVAL;
-
-                tp->md5sig_info = p;
-                sk_nocaps_add(sk, NETIF_F_GSO_MASK);
-        }
-
-        newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, sk->sk_allocation);
-        if (!newkey)
-                return -ENOMEM;
-        return tcp_v4_md5_do_add(sk, sin->sin_addr.s_addr,
-                                 newkey, cmd.tcpm_keylen);
+        return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin->sin_addr.s_addr,
+                              AF_INET, cmd.tcpm_key, cmd.tcpm_keylen,
+                              GFP_KERNEL);
 }
 
 static int tcp_v4_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
@@ -1098,7 +1115,7 @@ static int tcp_v4_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 }
 
-static int tcp_v4_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
+static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
                                __be32 daddr, __be32 saddr, const struct tcphdr *th)
 {
         struct tcp_md5sig_pool *hp;
@@ -1181,7 +1198,7 @@ clear_hash_noput:
 }
 EXPORT_SYMBOL(tcp_v4_md5_hash_skb);
 
-static int tcp_v4_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
+static bool tcp_v4_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
 {
         /*
          * This gets called for each TCP segment that arrives
@@ -1198,21 +1215,22 @@ static int tcp_v4_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
         int genhash;
         unsigned char newhash[16];
 
-        hash_expected = tcp_v4_md5_do_lookup(sk, iph->saddr);
+        hash_expected = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&iph->saddr,
+                                          AF_INET);
         hash_location = tcp_parse_md5sig_option(th);
 
         /* We've parsed the options - do we have a hash? */
         if (!hash_expected && !hash_location)
-                return 0;
+                return false;
 
         if (hash_expected && !hash_location) {
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
-                return 1;
+                return true;
         }
 
         if (!hash_expected && hash_location) {
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
-                return 1;
+                return true;
         }
 
         /* Okay, so this is hash_expected and hash_location -
@@ -1223,15 +1241,14 @@ static int tcp_v4_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
                                       NULL, NULL, skb);
 
         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
-                if (net_ratelimit()) {
-                        printk(KERN_INFO "MD5 Hash failed for (%pI4, %d)->(%pI4, %d)%s\n",
-                               &iph->saddr, ntohs(th->source),
-                               &iph->daddr, ntohs(th->dest),
-                               genhash ? " tcp_v4_calc_md5_hash failed" : "");
-                }
-                return 1;
+                net_info_ratelimited("MD5 Hash failed for (%pI4, %d)->(%pI4, %d)%s\n",
+                                     &iph->saddr, ntohs(th->source),
+                                     &iph->daddr, ntohs(th->dest),
+                                     genhash ? " tcp_v4_calc_md5_hash failed"
+                                     : "");
+                return true;
         }
-        return 0;
+        return false;
 }
 
 #endif
@@ -1265,7 +1282,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         __be32 saddr = ip_hdr(skb)->saddr;
         __be32 daddr = ip_hdr(skb)->daddr;
         __u32 isn = TCP_SKB_CB(skb)->when;
-        int want_cookie = 0;
+        bool want_cookie = false;
 
         /* Never answer to SYNs send to broadcast or multicast */
         if (skb_rtable(skb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
@@ -1324,7 +1341,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                 while (l-- > 0)
                         *c++ ^= *hash_location++;
 
-                want_cookie = 0;        /* not our kind of cookie */
+                want_cookie = false;    /* not our kind of cookie */
                 tmp_ext.cookie_out_never = 0; /* false */
                 tmp_ext.cookie_plus = tmp_opt.cookie_plus;
         } else if (!tp->rx_opt.cookie_in_always) {
@@ -1352,7 +1369,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                 goto drop_and_free;
 
         if (!want_cookie || tmp_opt.tstamp_ok)
-                TCP_ECN_create_request(req, tcp_hdr(skb));
+                TCP_ECN_create_request(req, skb);
 
         if (want_cookie) {
                 isn = cookie_v4_init_sequence(sk, skb, &req->mss);
@@ -1396,7 +1413,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                          * to destinations, already remembered
                          * to the moment of synflood.
                          */
-                        LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI4/%u\n",
+                        LIMIT_NETDEBUG(KERN_DEBUG pr_fmt("drop open request from %pI4/%u\n"),
                                        &saddr, ntohs(tcp_hdr(skb)->source));
                         goto drop_and_release;
                 }
@@ -1407,7 +1424,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_rsk(req)->snt_synack = tcp_time_stamp;
 
         if (tcp_v4_send_synack(sk, dst, req,
-                               (struct request_values *)&tmp_ext) ||
+                               (struct request_values *)&tmp_ext,
+                               skb_get_queue_mapping(skb)) ||
             want_cookie)
                 goto drop_and_free;
 
@@ -1461,6 +1479,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         ireq->opt             = NULL;
         newinet->mc_index     = inet_iif(skb);
         newinet->mc_ttl       = ip_hdr(skb)->ttl;
+        newinet->rcv_tos      = ip_hdr(skb)->tos;
         inet_csk(newsk)->icsk_ext_hdr_len = 0;
         if (inet_opt)
                 inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
@@ -1490,7 +1509,8 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Copy over the MD5 key from the original socket */
-        key = tcp_v4_md5_do_lookup(sk, newinet->inet_daddr);
+        key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&newinet->inet_daddr,
+                                AF_INET);
         if (key != NULL) {
                 /*
                  * We're using one, so create a matching key
@@ -1498,10 +1518,8 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                  * memory, then we end up not copying the key
                  * across. Shucks.
                  */
-                char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
-                if (newkey != NULL)
-                        tcp_v4_md5_do_add(newsk, newinet->inet_daddr,
-                                          newkey, key->keylen);
+                tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newinet->inet_daddr,
+                               AF_INET, key->key, key->keylen, GFP_ATOMIC);
                 sk_nocaps_add(newsk, NETIF_F_GSO_MASK);
         }
 #endif
@@ -1727,7 +1745,7 @@ process:
 #ifdef CONFIG_NET_DMA
                 struct tcp_sock *tp = tcp_sk(sk);
                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
-                        tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
+                        tp->ucopy.dma_chan = net_dma_find_channel();
                 if (tp->ucopy.dma_chan)
                         ret = tcp_v4_do_rcv(sk, skb);
                 else
@@ -1736,7 +1754,8 @@ process:
                         if (!tcp_prequeue(sk, skb))
                                 ret = tcp_v4_do_rcv(sk, skb);
                 }
-        } else if (unlikely(sk_add_backlog(sk, skb))) {
+        } else if (unlikely(sk_add_backlog(sk, skb,
+                                           sk->sk_rcvbuf + sk->sk_sndbuf))) {
                 bh_unlock_sock(sk);
                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
                 goto discard_and_relse;
@@ -1862,7 +1881,6 @@ EXPORT_SYMBOL(ipv4_specific);
 static const struct tcp_sock_af_ops tcp_sock_ipv4_specific = {
         .md5_lookup             = tcp_v4_md5_lookup,
         .calc_md5_hash          = tcp_v4_md5_hash_skb,
-        .md5_add                = tcp_v4_md5_add_func,
         .md5_parse              = tcp_v4_parse_md5_keys,
 };
 #endif
@@ -1873,64 +1891,15 @@ static const struct tcp_sock_af_ops tcp_sock_ipv4_specific = {
 static int tcp_v4_init_sock(struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        skb_queue_head_init(&tp->out_of_order_queue);
-        tcp_init_xmit_timers(sk);
-        tcp_prequeue_init(tp);
 
-        icsk->icsk_rto = TCP_TIMEOUT_INIT;
-        tp->mdev = TCP_TIMEOUT_INIT;
-
-        /* So many TCP implementations out there (incorrectly) count the
-         * initial SYN frame in their delayed-ACK and congestion control
-         * algorithms that we must have the following bandaid to talk
-         * efficiently to them.  -DaveM
-         */
-        tp->snd_cwnd = TCP_INIT_CWND;
-
-        /* See draft-stevens-tcpca-spec-01 for discussion of the
-         * initialization of these values.
-         */
-        tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
-        tp->snd_cwnd_clamp = ~0;
-        tp->mss_cache = TCP_MSS_DEFAULT;
-
-        tp->reordering = sysctl_tcp_reordering;
-        icsk->icsk_ca_ops = &tcp_init_congestion_ops;
-
-        sk->sk_state = TCP_CLOSE;
-
-        sk->sk_write_space = sk_stream_write_space;
-        sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
+        tcp_init_sock(sk);
 
         icsk->icsk_af_ops = &ipv4_specific;
-        icsk->icsk_sync_mss = tcp_sync_mss;
+
 #ifdef CONFIG_TCP_MD5SIG
-        tp->af_specific = &tcp_sock_ipv4_specific;
+        tcp_sk(sk)->af_specific = &tcp_sock_ipv4_specific;
 #endif
 
-        /* TCP Cookie Transactions */
-        if (sysctl_tcp_cookie_size > 0) {
-                /* Default, cookies without s_data_payload. */
-                tp->cookie_values =
-                        kzalloc(sizeof(*tp->cookie_values),
-                                sk->sk_allocation);
-                if (tp->cookie_values != NULL)
-                        kref_init(&tp->cookie_values->kref);
-        }
-        /* Presumed zeroed, in order of appearance:
-         *      cookie_in_always, cookie_out_never,
-         *      s_data_constant, s_data_in, s_data_out
-         */
-        sk->sk_sndbuf = sysctl_tcp_wmem[1];
-        sk->sk_rcvbuf = sysctl_tcp_rmem[1];
-
-        local_bh_disable();
-        sock_update_memcg(sk);
-        sk_sockets_allocated_inc(sk);
-        local_bh_enable();
-
         return 0;
 }
 
@@ -1951,8 +1920,8 @@ void tcp_v4_destroy_sock(struct sock *sk)
 #ifdef CONFIG_TCP_MD5SIG
         /* Clean up the MD5 key list, if any */
         if (tp->md5sig_info) {
-                tcp_v4_clear_md5_list(sk);
-                kfree(tp->md5sig_info);
+                tcp_clear_md5_list(sk);
+                kfree_rcu(tp->md5sig_info, rcu);
                 tp->md5sig_info = NULL;
         }
 #endif
@@ -2107,7 +2076,7 @@ static void *listening_get_idx(struct seq_file *seq, loff_t *pos)
         return rc;
 }
 
-static inline int empty_bucket(struct tcp_iter_state *st)
+static inline bool empty_bucket(struct tcp_iter_state *st)
 {
         return hlist_nulls_empty(&tcp_hashinfo.ehash[st->bucket].chain) &&
                 hlist_nulls_empty(&tcp_hashinfo.ehash[st->bucket].twchain);
diff --git a/net/ipv4/tcp_memcontrol.c b/net/ipv4/tcp_memcontrol.c
index 49978788a9dc..b6f3583ddfe8 100644
--- a/net/ipv4/tcp_memcontrol.c
+++ b/net/ipv4/tcp_memcontrol.c
@@ -6,37 +6,6 @@
 #include <linux/memcontrol.h>
 #include <linux/module.h>
 
-static u64 tcp_cgroup_read(struct cgroup *cont, struct cftype *cft);
-static int tcp_cgroup_write(struct cgroup *cont, struct cftype *cft,
-                            const char *buffer);
-static int tcp_cgroup_reset(struct cgroup *cont, unsigned int event);
-
-static struct cftype tcp_files[] = {
-        {
-                .name = "kmem.tcp.limit_in_bytes",
-                .write_string = tcp_cgroup_write,
-                .read_u64 = tcp_cgroup_read,
-                .private = RES_LIMIT,
-        },
-        {
-                .name = "kmem.tcp.usage_in_bytes",
-                .read_u64 = tcp_cgroup_read,
-                .private = RES_USAGE,
-        },
-        {
-                .name = "kmem.tcp.failcnt",
-                .private = RES_FAILCNT,
-                .trigger = tcp_cgroup_reset,
-                .read_u64 = tcp_cgroup_read,
-        },
-        {
-                .name = "kmem.tcp.max_usage_in_bytes",
-                .private = RES_MAX_USAGE,
-                .trigger = tcp_cgroup_reset,
-                .read_u64 = tcp_cgroup_read,
-        },
-};
-
 static inline struct tcp_memcontrol *tcp_from_cgproto(struct cg_proto *cg_proto)
 {
         return container_of(cg_proto, struct tcp_memcontrol, cg_proto);
@@ -49,7 +18,7 @@ static void memcg_tcp_enter_memory_pressure(struct sock *sk)
 }
 EXPORT_SYMBOL(memcg_tcp_enter_memory_pressure);
 
-int tcp_init_cgroup(struct cgroup *cgrp, struct cgroup_subsys *ss)
+int tcp_init_cgroup(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
 {
         /*
          * The root cgroup does not use res_counters, but rather,
@@ -59,13 +28,12 @@ int tcp_init_cgroup(struct cgroup *cgrp, struct cgroup_subsys *ss)
         struct res_counter *res_parent = NULL;
         struct cg_proto *cg_proto, *parent_cg;
         struct tcp_memcontrol *tcp;
-        struct mem_cgroup *memcg = mem_cgroup_from_cont(cgrp);
         struct mem_cgroup *parent = parent_mem_cgroup(memcg);
         struct net *net = current->nsproxy->net_ns;
 
         cg_proto = tcp_prot.proto_cgroup(memcg);
         if (!cg_proto)
-                goto create_files;
+                return 0;
 
         tcp = tcp_from_cgproto(cg_proto);
 
@@ -88,15 +56,12 @@ int tcp_init_cgroup(struct cgroup *cgrp, struct cgroup_subsys *ss)
         cg_proto->sockets_allocated = &tcp->tcp_sockets_allocated;
         cg_proto->memcg = memcg;
 
-create_files:
-        return cgroup_add_files(cgrp, ss, tcp_files,
-                                ARRAY_SIZE(tcp_files));
+        return 0;
 }
 EXPORT_SYMBOL(tcp_init_cgroup);
 
-void tcp_destroy_cgroup(struct cgroup *cgrp, struct cgroup_subsys *ss)
+void tcp_destroy_cgroup(struct mem_cgroup *memcg)
 {
-        struct mem_cgroup *memcg = mem_cgroup_from_cont(cgrp);
         struct cg_proto *cg_proto;
         struct tcp_memcontrol *tcp;
         u64 val;
@@ -109,9 +74,6 @@ void tcp_destroy_cgroup(struct cgroup *cgrp, struct cgroup_subsys *ss)
         percpu_counter_destroy(&tcp->tcp_sockets_allocated);
 
         val = res_counter_read_u64(&tcp->tcp_memory_allocated, RES_LIMIT);
-
-        if (val != RESOURCE_MAX)
-                jump_label_dec(&memcg_socket_limit_enabled);
 }
 EXPORT_SYMBOL(tcp_destroy_cgroup);
 
@@ -142,10 +104,33 @@ static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
                 tcp->tcp_prot_mem[i] = min_t(long, val >> PAGE_SHIFT,
                                              net->ipv4.sysctl_tcp_mem[i]);
 
-        if (val == RESOURCE_MAX && old_lim != RESOURCE_MAX)
-                jump_label_dec(&memcg_socket_limit_enabled);
-        else if (old_lim == RESOURCE_MAX && val != RESOURCE_MAX)
-                jump_label_inc(&memcg_socket_limit_enabled);
+        if (val == RESOURCE_MAX)
+                clear_bit(MEMCG_SOCK_ACTIVE, &cg_proto->flags);
+        else if (val != RESOURCE_MAX) {
+                /*
+                 * The active bit needs to be written after the static_key
+                 * update. This is what guarantees that the socket activation
+                 * function is the last one to run. See sock_update_memcg() for
+                 * details, and note that we don't mark any socket as belonging
+                 * to this memcg until that flag is up.
+                 *
+                 * We need to do this, because static_keys will span multiple
+                 * sites, but we can't control their order. If we mark a socket
+                 * as accounted, but the accounting functions are not patched in
+                 * yet, we'll lose accounting.
+                 *
+                 * We never race with the readers in sock_update_memcg(),
+                 * because when this value change, the code to process it is not
+                 * patched in yet.
+                 *
+                 * The activated bit is used to guarantee that no two writers
+                 * will do the update in the same memcg. Without that, we can't
+                 * properly shutdown the static key.
+                 */
+                if (!test_and_set_bit(MEMCG_SOCK_ACTIVATED, &cg_proto->flags))
+                        static_key_slow_inc(&memcg_socket_limit_enabled);
+                set_bit(MEMCG_SOCK_ACTIVE, &cg_proto->flags);
+        }
 
         return 0;
 }
@@ -270,3 +255,37 @@ void tcp_prot_mem(struct mem_cgroup *memcg, long val, int idx)
 
         tcp->tcp_prot_mem[idx] = val;
 }
+
+static struct cftype tcp_files[] = {
+        {
+                .name = "kmem.tcp.limit_in_bytes",
+                .write_string = tcp_cgroup_write,
+                .read_u64 = tcp_cgroup_read,
+                .private = RES_LIMIT,
+        },
+        {
+                .name = "kmem.tcp.usage_in_bytes",
+                .read_u64 = tcp_cgroup_read,
+                .private = RES_USAGE,
+        },
+        {
+                .name = "kmem.tcp.failcnt",
+                .private = RES_FAILCNT,
+                .trigger = tcp_cgroup_reset,
+                .read_u64 = tcp_cgroup_read,
+        },
+        {
+                .name = "kmem.tcp.max_usage_in_bytes",
+                .private = RES_MAX_USAGE,
+                .trigger = tcp_cgroup_reset,
+                .read_u64 = tcp_cgroup_read,
+        },
+        { }     /* terminate */
+};
+
+static int __init tcp_memcontrol_init(void)
+{
+        WARN_ON(cgroup_add_cftypes(&mem_cgroup_subsys, tcp_files));
+        return 0;
+}
+__initcall(tcp_memcontrol_init);
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 550e755747e0..b85d9fe7d663 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -55,7 +55,7 @@ EXPORT_SYMBOL_GPL(tcp_death_row);
  * state.
  */
 
-static int tcp_remember_stamp(struct sock *sk)
+static bool tcp_remember_stamp(struct sock *sk)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
@@ -72,13 +72,13 @@ static int tcp_remember_stamp(struct sock *sk)
                 }
                 if (release_it)
                         inet_putpeer(peer);
-                return 1;
+                return true;
         }
 
-        return 0;
+        return false;
 }
 
-static int tcp_tw_remember_stamp(struct inet_timewait_sock *tw)
+static bool tcp_tw_remember_stamp(struct inet_timewait_sock *tw)
 {
         struct sock *sk = (struct sock *) tw;
         struct inet_peer *peer;
@@ -94,17 +94,17 @@ static int tcp_tw_remember_stamp(struct inet_timewait_sock *tw)
                         peer->tcp_ts       = tcptw->tw_ts_recent;
                 }
                 inet_putpeer(peer);
-                return 1;
+                return true;
         }
-        return 0;
+        return false;
 }
 
-static __inline__ int tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
+static bool tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
 {
         if (seq == s_win)
-                return 1;
+                return true;
         if (after(end_seq, s_win) && before(seq, e_win))
-                return 1;
+                return true;
         return seq == e_win && seq == end_seq;
 }
 
@@ -143,7 +143,7 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
         struct tcp_options_received tmp_opt;
         const u8 *hash_location;
         struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
-        int paws_reject = 0;
+        bool paws_reject = false;
 
         tmp_opt.saw_tstamp = 0;
         if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
@@ -316,7 +316,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
         struct inet_timewait_sock *tw = NULL;
         const struct inet_connection_sock *icsk = inet_csk(sk);
         const struct tcp_sock *tp = tcp_sk(sk);
-        int recycle_ok = 0;
+        bool recycle_ok = false;
 
         if (tcp_death_row.sysctl_tw_recycle && tp->rx_opt.ts_recent_stamp)
                 recycle_ok = tcp_remember_stamp(sk);
@@ -359,13 +359,11 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                  */
                 do {
                         struct tcp_md5sig_key *key;
-                        memset(tcptw->tw_md5_key, 0, sizeof(tcptw->tw_md5_key));
-                        tcptw->tw_md5_keylen = 0;
+                        tcptw->tw_md5_key = NULL;
                         key = tp->af_specific->md5_lookup(sk, sk);
                         if (key != NULL) {
-                                memcpy(&tcptw->tw_md5_key, key->key, key->keylen);
-                                tcptw->tw_md5_keylen = key->keylen;
-                                if (tcp_alloc_md5sig_pool(sk) == NULL)
+                                tcptw->tw_md5_key = kmemdup(key, sizeof(*key), GFP_ATOMIC);
+                                if (tcptw->tw_md5_key && tcp_alloc_md5sig_pool(sk) == NULL)
                                         BUG();
                         }
                 } while (0);
@@ -405,8 +403,10 @@ void tcp_twsk_destructor(struct sock *sk)
 {
 #ifdef CONFIG_TCP_MD5SIG
         struct tcp_timewait_sock *twsk = tcp_twsk(sk);
-        if (twsk->tw_md5_keylen)
+        if (twsk->tw_md5_key) {
                 tcp_free_md5sig_pool();
+                kfree_rcu(twsk->tw_md5_key, rcu);
+        }
 #endif
 }
 EXPORT_SYMBOL_GPL(tcp_twsk_destructor);
@@ -482,6 +482,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 newtp->sacked_out = 0;
                 newtp->fackets_out = 0;
                 newtp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
+                tcp_enable_early_retrans(newtp);
 
                 /* So many TCP implementations out there (incorrectly) count the
                  * initial SYN frame in their delayed-ACK and congestion control
@@ -574,7 +575,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
         struct sock *child;
         const struct tcphdr *th = tcp_hdr(skb);
         __be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
-        int paws_reject = 0;
+        bool paws_reject = false;
 
         tmp_opt.saw_tstamp = 0;
         if (th->doff > (sizeof(struct tcphdr)>>2)) {
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 4ff3b6dc74fc..803cbfe82fbc 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -34,6 +34,8 @@
  *
  */
 
+#define pr_fmt(fmt) "TCP: " fmt
+
 #include <net/tcp.h>
 
 #include <linux/compiler.h>
@@ -78,9 +80,8 @@ static void tcp_event_new_data_sent(struct sock *sk, const struct sk_buff *skb)
                 tp->frto_counter = 3;
 
         tp->packets_out += tcp_skb_pcount(skb);
-        if (!prior_packets)
-                inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
-                                          inet_csk(sk)->icsk_rto, TCP_RTO_MAX);
+        if (!prior_packets || tp->early_retrans_delayed)
+                tcp_rearm_rto(sk);
 }
 
 /* SND.NXT, if window was not shrunk.
@@ -369,7 +370,7 @@ static void tcp_init_nondata_skb(struct sk_buff *skb, u32 seq, u8 flags)
         TCP_SKB_CB(skb)->end_seq = seq;
 }
 
-static inline int tcp_urg_mode(const struct tcp_sock *tp)
+static inline bool tcp_urg_mode(const struct tcp_sock *tp)
 {
         return tp->snd_una != tp->snd_up;
 }
@@ -563,13 +564,13 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
 /* Compute TCP options for SYN packets. This is not the final
  * network wire format yet.
  */
-static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
+static unsigned int tcp_syn_options(struct sock *sk, struct sk_buff *skb,
                                 struct tcp_out_options *opts,
                                 struct tcp_md5sig_key **md5)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_cookie_values *cvp = tp->cookie_values;
-        unsigned remaining = MAX_TCP_OPTION_SPACE;
+        unsigned int remaining = MAX_TCP_OPTION_SPACE;
         u8 cookie_size = (!tp->rx_opt.cookie_out_never && cvp != NULL) ?
                          tcp_cookie_size_check(cvp->cookie_desired) :
                          0;
@@ -663,15 +664,15 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
 }
 
 /* Set up TCP options for SYN-ACKs. */
-static unsigned tcp_synack_options(struct sock *sk,
+static unsigned int tcp_synack_options(struct sock *sk,
                                    struct request_sock *req,
-                                   unsigned mss, struct sk_buff *skb,
+                                   unsigned int mss, struct sk_buff *skb,
                                    struct tcp_out_options *opts,
                                    struct tcp_md5sig_key **md5,
                                    struct tcp_extend_values *xvp)
 {
         struct inet_request_sock *ireq = inet_rsk(req);
-        unsigned remaining = MAX_TCP_OPTION_SPACE;
+        unsigned int remaining = MAX_TCP_OPTION_SPACE;
         u8 cookie_plus = (xvp != NULL && !xvp->cookie_out_never) ?
                          xvp->cookie_plus :
                          0;
@@ -742,13 +743,13 @@ static unsigned tcp_synack_options(struct sock *sk,
 /* Compute TCP options for ESTABLISHED sockets. This is not the
  * final wire format yet.
  */
-static unsigned tcp_established_options(struct sock *sk, struct sk_buff *skb,
+static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb,
                                         struct tcp_out_options *opts,
                                         struct tcp_md5sig_key **md5)
 {
         struct tcp_skb_cb *tcb = skb ? TCP_SKB_CB(skb) : NULL;
         struct tcp_sock *tp = tcp_sk(sk);
-        unsigned size = 0;
+        unsigned int size = 0;
         unsigned int eff_sacks;
 
 #ifdef CONFIG_TCP_MD5SIG
@@ -770,9 +771,9 @@ static unsigned tcp_established_options(struct sock *sk, struct sk_buff *skb,
 
         eff_sacks = tp->rx_opt.num_sacks + tp->rx_opt.dsack;
         if (unlikely(eff_sacks)) {
-                const unsigned remaining = MAX_TCP_OPTION_SPACE - size;
+                const unsigned int remaining = MAX_TCP_OPTION_SPACE - size;
                 opts->num_sack_blocks =
-                        min_t(unsigned, eff_sacks,
+                        min_t(unsigned int, eff_sacks,
                               (remaining - TCPOLEN_SACK_BASE_ALIGNED) /
                               TCPOLEN_SACK_PERBLOCK);
                 size += TCPOLEN_SACK_BASE_ALIGNED +
@@ -801,7 +802,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         struct tcp_sock *tp;
         struct tcp_skb_cb *tcb;
         struct tcp_out_options opts;
-        unsigned tcp_options_size, tcp_header_size;
+        unsigned int tcp_options_size, tcp_header_size;
         struct tcp_md5sig_key *md5;
         struct tcphdr *th;
         int err;
@@ -1096,6 +1097,7 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
         eat = min_t(int, len, skb_headlen(skb));
         if (eat) {
                 __skb_pull(skb, eat);
+                skb->avail_size -= eat;
                 len -= eat;
                 if (!len)
                         return;
@@ -1149,7 +1151,7 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
 }
 
 /* Calculate MSS. Not accounting for SACKs here.  */
-int tcp_mtu_to_mss(const struct sock *sk, int pmtu)
+int tcp_mtu_to_mss(struct sock *sk, int pmtu)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -1160,6 +1162,14 @@ int tcp_mtu_to_mss(const struct sock *sk, int pmtu)
          */
         mss_now = pmtu - icsk->icsk_af_ops->net_header_len - sizeof(struct tcphdr);
 
+        /* IPv6 adds a frag_hdr in case RTAX_FEATURE_ALLFRAG is set */
+        if (icsk->icsk_af_ops->net_frag_header_len) {
+                const struct dst_entry *dst = __sk_dst_get(sk);
+
+                if (dst && dst_allfrag(dst))
+                        mss_now -= icsk->icsk_af_ops->net_frag_header_len;
+        }
+
         /* Clamp it (mss_clamp does not include tcp options) */
         if (mss_now > tp->rx_opt.mss_clamp)
                 mss_now = tp->rx_opt.mss_clamp;
@@ -1178,7 +1188,7 @@ int tcp_mtu_to_mss(const struct sock *sk, int pmtu)
 }
 
 /* Inverse of above */
-int tcp_mss_to_mtu(const struct sock *sk, int mss)
+int tcp_mss_to_mtu(struct sock *sk, int mss)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -1189,6 +1199,13 @@ int tcp_mss_to_mtu(const struct sock *sk, int mss)
               icsk->icsk_ext_hdr_len +
               icsk->icsk_af_ops->net_header_len;
 
+        /* IPv6 adds a frag_hdr in case RTAX_FEATURE_ALLFRAG is set */
+        if (icsk->icsk_af_ops->net_frag_header_len) {
+                const struct dst_entry *dst = __sk_dst_get(sk);
+
+                if (dst && dst_allfrag(dst))
+                        mtu += icsk->icsk_af_ops->net_frag_header_len;
+        }
         return mtu;
 }
 
@@ -1258,7 +1275,7 @@ unsigned int tcp_current_mss(struct sock *sk)
         const struct tcp_sock *tp = tcp_sk(sk);
         const struct dst_entry *dst = __sk_dst_get(sk);
         u32 mss_now;
-        unsigned header_len;
+        unsigned int header_len;
         struct tcp_out_options opts;
         struct tcp_md5sig_key *md5;
 
@@ -1374,33 +1391,33 @@ static int tcp_init_tso_segs(const struct sock *sk, struct sk_buff *skb,
 }
 
 /* Minshall's variant of the Nagle send check. */
-static inline int tcp_minshall_check(const struct tcp_sock *tp)
+static inline bool tcp_minshall_check(const struct tcp_sock *tp)
 {
         return after(tp->snd_sml, tp->snd_una) &&
                 !after(tp->snd_sml, tp->snd_nxt);
 }
 
-/* Return 0, if packet can be sent now without violation Nagle's rules:
+/* Return false, if packet can be sent now without violation Nagle's rules:
  * 1. It is full sized.
  * 2. Or it contains FIN. (already checked by caller)
  * 3. Or TCP_CORK is not set, and TCP_NODELAY is set.
  * 4. Or TCP_CORK is not set, and all sent packets are ACKed.
  *    With Minshall's modification: all sent small packets are ACKed.
  */
-static inline int tcp_nagle_check(const struct tcp_sock *tp,
+static inline bool tcp_nagle_check(const struct tcp_sock *tp,
                                   const struct sk_buff *skb,
-                                  unsigned mss_now, int nonagle)
+                                  unsigned int mss_now, int nonagle)
 {
         return skb->len < mss_now &&
                 ((nonagle & TCP_NAGLE_CORK) ||
                  (!nonagle && tp->packets_out && tcp_minshall_check(tp)));
 }
 
-/* Return non-zero if the Nagle test allows this packet to be
+/* Return true if the Nagle test allows this packet to be
  * sent now.
  */
-static inline int tcp_nagle_test(const struct tcp_sock *tp, const struct sk_buff *skb,
-                                 unsigned int cur_mss, int nonagle)
+static inline bool tcp_nagle_test(const struct tcp_sock *tp, const struct sk_buff *skb,
+                                  unsigned int cur_mss, int nonagle)
 {
         /* Nagle rule does not apply to frames, which sit in the middle of the
          * write_queue (they have no chances to get new data).
@@ -1409,24 +1426,25 @@ static inline int tcp_nagle_test(const struct tcp_sock *tp, const struct sk_buff
          * argument based upon the location of SKB in the send queue.
          */
         if (nonagle & TCP_NAGLE_PUSH)
-                return 1;
+                return true;
 
         /* Don't use the nagle rule for urgent data (or for the final FIN).
          * Nagle can be ignored during F-RTO too (see RFC4138).
          */
         if (tcp_urg_mode(tp) || (tp->frto_counter == 2) ||
             (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN))
-                return 1;
+                return true;
 
         if (!tcp_nagle_check(tp, skb, cur_mss, nonagle))
-                return 1;
+                return true;
 
-        return 0;
+        return false;
 }
 
 /* Does at least the first segment of SKB fit into the send window? */
-static inline int tcp_snd_wnd_test(const struct tcp_sock *tp, const struct sk_buff *skb,
-                                   unsigned int cur_mss)
+static bool tcp_snd_wnd_test(const struct tcp_sock *tp,
+                             const struct sk_buff *skb,
+                             unsigned int cur_mss)
 {
         u32 end_seq = TCP_SKB_CB(skb)->end_seq;
 
@@ -1459,7 +1477,7 @@ static unsigned int tcp_snd_test(const struct sock *sk, struct sk_buff *skb,
 }
 
 /* Test if sending is allowed right now. */
-int tcp_may_send_now(struct sock *sk)
+bool tcp_may_send_now(struct sock *sk)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb = tcp_send_head(sk);
@@ -1529,7 +1547,7 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
  *
  * This algorithm is from John Heffner.
  */
-static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
+static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -1589,11 +1607,11 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
         /* Ok, it looks like it is advisable to defer.  */
         tp->tso_deferred = 1 | (jiffies << 1);
 
-        return 1;
+        return true;
 
 send_now:
         tp->tso_deferred = 0;
-        return 0;
+        return false;
 }
 
 /* Create a new MTU probe if we are ready.
@@ -1735,11 +1753,11 @@ static int tcp_mtu_probe(struct sock *sk)
  * snd_up-64k-mss .. snd_up cannot be large. However, taking into
  * account rare use of URG, this is not a big flaw.
  *
- * Returns 1, if no segments are in flight and we have queued segments, but
- * cannot send anything now because of SWS or another problem.
+ * Returns true, if no segments are in flight and we have queued segments,
+ * but cannot send anything now because of SWS or another problem.
  */
-static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
-                          int push_one, gfp_t gfp)
+static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
+                           int push_one, gfp_t gfp)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
@@ -1753,7 +1771,7 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                 /* Do MTU probing. */
                 result = tcp_mtu_probe(sk);
                 if (!result) {
-                        return 0;
+                        return false;
                 } else if (result > 0) {
                         sent_pkts = 1;
                 }
@@ -1812,7 +1830,7 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
 
         if (likely(sent_pkts)) {
                 tcp_cwnd_validate(sk);
-                return 0;
+                return false;
         }
         return !tp->packets_out && tcp_send_head(sk);
 }
@@ -2011,22 +2029,22 @@ static void tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
 }
 
 /* Check if coalescing SKBs is legal. */
-static int tcp_can_collapse(const struct sock *sk, const struct sk_buff *skb)
+static bool tcp_can_collapse(const struct sock *sk, const struct sk_buff *skb)
 {
         if (tcp_skb_pcount(skb) > 1)
-                return 0;
+                return false;
         /* TODO: SACK collapsing could be used to remove this condition */
         if (skb_shinfo(skb)->nr_frags != 0)
-                return 0;
+                return false;
         if (skb_cloned(skb))
-                return 0;
+                return false;
         if (skb == tcp_send_head(sk))
-                return 0;
+                return false;
         /* Some heurestics for collapsing over SACK'd could be invented */
         if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)
-                return 0;
+                return false;
 
-        return 1;
+        return true;
 }
 
 /* Collapse packets in the retransmit queue to make to create
@@ -2037,7 +2055,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb = to, *tmp;
-        int first = 1;
+        bool first = true;
 
         if (!sysctl_tcp_retrans_collapse)
                 return;
@@ -2051,7 +2069,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
                 space -= skb->len;
 
                 if (first) {
-                        first = 0;
+                        first = false;
                         continue;
                 }
 
@@ -2060,7 +2078,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
                 /* Punt if not enough space exists in the first SKB for
                  * the data in the second
                  */
-                if (skb->len > skb_tailroom(to))
+                if (skb->len > skb_availroom(to))
                         break;
 
                 if (after(TCP_SKB_CB(skb)->end_seq, tcp_wnd_end(tp)))
@@ -2166,8 +2184,7 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
 
 #if FASTRETRANS_DEBUG > 0
                 if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS) {
-                        if (net_ratelimit())
-                                printk(KERN_DEBUG "retrans_out leaked.\n");
+                        net_dbg_ratelimited("retrans_out leaked\n");
                 }
 #endif
                 if (!tp->retrans_out)
@@ -2192,18 +2209,18 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
 /* Check if we forward retransmits are possible in the current
  * window/congestion state.
  */
-static int tcp_can_forward_retransmit(struct sock *sk)
+static bool tcp_can_forward_retransmit(struct sock *sk)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
         const struct tcp_sock *tp = tcp_sk(sk);
 
         /* Forward retransmissions are possible only during Recovery. */
         if (icsk->icsk_ca_state != TCP_CA_Recovery)
-                return 0;
+                return false;
 
         /* No forward retransmissions in Reno are possible. */
         if (tcp_is_reno(tp))
-                return 0;
+                return false;
 
         /* Yeah, we have to make difficult choice between forward transmission
          * and retransmission... Both ways have their merits...
@@ -2214,9 +2231,9 @@ static int tcp_can_forward_retransmit(struct sock *sk)
          */
 
         if (tcp_may_send_now(sk))
-                return 0;
+                return false;
 
-        return 1;
+        return true;
 }
 
 /* This gets called after a retransmit timeout, and the initially
@@ -2306,8 +2323,10 @@ begin_fwd:
                 if (sacked & (TCPCB_SACKED_ACKED|TCPCB_SACKED_RETRANS))
                         continue;
 
-                if (tcp_retransmit_skb(sk, skb))
+                if (tcp_retransmit_skb(sk, skb)) {
+                        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL);
                         return;
+                }
                 NET_INC_STATS_BH(sock_net(sk), mib_idx);
 
                 if (inet_csk(sk)->icsk_ca_state == TCP_CA_Recovery)
@@ -2399,7 +2418,7 @@ int tcp_send_synack(struct sock *sk)
 
         skb = tcp_write_queue_head(sk);
         if (skb == NULL || !(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)) {
-                printk(KERN_DEBUG "tcp_send_synack: wrong queue state\n");
+                pr_debug("%s: wrong queue state\n", __func__);
                 return -EFAULT;
         }
         if (!(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_ACK)) {
@@ -2559,7 +2578,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
 EXPORT_SYMBOL(tcp_make_synack);
 
 /* Do all connect socket setups that can be done AF independent. */
-static void tcp_connect_init(struct sock *sk)
+void tcp_connect_init(struct sock *sk)
 {
         const struct dst_entry *dst = __sk_dst_get(sk);
         struct tcp_sock *tp = tcp_sk(sk);
@@ -2614,9 +2633,12 @@ static void tcp_connect_init(struct sock *sk)
         tp->snd_una = tp->write_seq;
         tp->snd_sml = tp->write_seq;
         tp->snd_up = tp->write_seq;
-        tp->rcv_nxt = 0;
-        tp->rcv_wup = 0;
-        tp->copied_seq = 0;
+        tp->snd_nxt = tp->write_seq;
+
+        if (likely(!tp->repair))
+                tp->rcv_nxt = 0;
+        tp->rcv_wup = tp->rcv_nxt;
+        tp->copied_seq = tp->rcv_nxt;
 
         inet_csk(sk)->icsk_rto = TCP_TIMEOUT_INIT;
         inet_csk(sk)->icsk_retransmits = 0;
@@ -2639,7 +2661,6 @@ int tcp_connect(struct sock *sk)
         /* Reserve space for headers. */
         skb_reserve(buff, MAX_TCP_HEADER);
 
-        tp->snd_nxt = tp->write_seq;
         tcp_init_nondata_skb(buff, tp->write_seq++, TCPHDR_SYN);
         TCP_ECN_send_syn(sk, buff);
 
@@ -2788,6 +2809,15 @@ static int tcp_xmit_probe_skb(struct sock *sk, int urgent)
         return tcp_transmit_skb(sk, skb, 0, GFP_ATOMIC);
 }
 
+void tcp_send_window_probe(struct sock *sk)
+{
+        if (sk->sk_state == TCP_ESTABLISHED) {
+                tcp_sk(sk)->snd_wl1 = tcp_sk(sk)->rcv_nxt - 1;
+                tcp_sk(sk)->snd_nxt = tcp_sk(sk)->write_seq;
+                tcp_xmit_probe_skb(sk, 0);
+        }
+}
+
 /* Initiate keepalive or window probe from timer. */
 int tcp_write_wakeup(struct sock *sk)
 {
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 85ee7eb7e38e..4526fe68e60e 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -18,6 +18,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/kprobes.h>
 #include <linux/socket.h>
@@ -89,7 +91,7 @@ static inline int tcp_probe_avail(void)
  * Note: arguments must match tcp_rcv_established()!
  */
 static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
-                               struct tcphdr *th, unsigned len)
+                               struct tcphdr *th, unsigned int len)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_sock *inet = inet_sk(sk);
@@ -136,7 +138,7 @@ static struct jprobe tcp_jprobe = {
         .entry  = jtcp_rcv_established,
 };
 
-static int tcpprobe_open(struct inode * inode, struct file * file)
+static int tcpprobe_open(struct inode *inode, struct file *file)
 {
         /* Reset (empty) log */
         spin_lock_bh(&tcp_probe.lock);
@@ -239,7 +241,7 @@ static __init int tcpprobe_init(void)
         if (ret)
                 goto err1;
 
-        pr_info("TCP probe registered (port=%d) bufsize=%u\n", port, bufsize);
+        pr_info("probe registered (port=%d) bufsize=%u\n", port, bufsize);
         return 0;
  err1:
         proc_net_remove(&init_net, procname);
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index cd2e0723266d..e911e6c523ec 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -319,6 +319,11 @@ void tcp_retransmit_timer(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
 
+        if (tp->early_retrans_delayed) {
+                tcp_resume_early_retransmit(sk);
+                return;
+        }
+
         if (!tp->packets_out)
                 goto out;
 
@@ -333,16 +338,18 @@ void tcp_retransmit_timer(struct sock *sk)
                  */
                 struct inet_sock *inet = inet_sk(sk);
                 if (sk->sk_family == AF_INET) {
-                        LIMIT_NETDEBUG(KERN_DEBUG "TCP: Peer %pI4:%u/%u unexpectedly shrunk window %u:%u (repaired)\n",
-                               &inet->inet_daddr, ntohs(inet->inet_dport),
-                               inet->inet_num, tp->snd_una, tp->snd_nxt);
+                        LIMIT_NETDEBUG(KERN_DEBUG pr_fmt("Peer %pI4:%u/%u unexpectedly shrunk window %u:%u (repaired)\n"),
+                                       &inet->inet_daddr,
+                                       ntohs(inet->inet_dport), inet->inet_num,
+                                       tp->snd_una, tp->snd_nxt);
                 }
 #if IS_ENABLED(CONFIG_IPV6)
                 else if (sk->sk_family == AF_INET6) {
                         struct ipv6_pinfo *np = inet6_sk(sk);
-                        LIMIT_NETDEBUG(KERN_DEBUG "TCP: Peer %pI6:%u/%u unexpectedly shrunk window %u:%u (repaired)\n",
-                               &np->daddr, ntohs(inet->inet_dport),
-                               inet->inet_num, tp->snd_una, tp->snd_nxt);
+                        LIMIT_NETDEBUG(KERN_DEBUG pr_fmt("Peer %pI6:%u/%u unexpectedly shrunk window %u:%u (repaired)\n"),
+                                       &np->daddr,
+                                       ntohs(inet->inet_dport), inet->inet_num,
+                                       tp->snd_una, tp->snd_nxt);
                 }
 #endif
                 if (tcp_time_stamp - tp->rcv_tstamp > TCP_RTO_MAX) {
diff --git a/net/ipv4/tunnel4.c b/net/ipv4/tunnel4.c
index 01775983b997..0d0171830620 100644
--- a/net/ipv4/tunnel4.c
+++ b/net/ipv4/tunnel4.c
@@ -164,12 +164,12 @@ static const struct net_protocol tunnel64_protocol = {
 static int __init tunnel4_init(void)
 {
         if (inet_add_protocol(&tunnel4_protocol, IPPROTO_IPIP)) {
-                printk(KERN_ERR "tunnel4 init: can't add protocol\n");
+                pr_err("%s: can't add protocol\n", __func__);
                 return -EAGAIN;
         }
 #if IS_ENABLED(CONFIG_IPV6)
         if (inet_add_protocol(&tunnel64_protocol, IPPROTO_IPV6)) {
-                printk(KERN_ERR "tunnel64 init: can't add protocol\n");
+                pr_err("tunnel64 init: can't add protocol\n");
                 inet_del_protocol(&tunnel4_protocol, IPPROTO_IPIP);
                 return -EAGAIN;
         }
@@ -181,10 +181,10 @@ static void __exit tunnel4_fini(void)
 {
 #if IS_ENABLED(CONFIG_IPV6)
         if (inet_del_protocol(&tunnel64_protocol, IPPROTO_IPV6))
-                printk(KERN_ERR "tunnel64 close: can't remove protocol\n");
+                pr_err("tunnel64 close: can't remove protocol\n");
 #endif
         if (inet_del_protocol(&tunnel4_protocol, IPPROTO_IPIP))
-                printk(KERN_ERR "tunnel4 close: can't remove protocol\n");
+                pr_err("tunnel4 close: can't remove protocol\n");
 }
 
 module_init(tunnel4_init);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 5d075b5f70fc..eaca73644e79 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -77,7 +77,8 @@
  *              2 of the License, or (at your option) any later version.
  */
 
-#include <asm/system.h>
+#define pr_fmt(fmt) "UDP: " fmt
+
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
 #include <linux/bootmem.h>
@@ -106,6 +107,7 @@
 #include <net/checksum.h>
 #include <net/xfrm.h>
 #include <trace/events/udp.h>
+#include <linux/static_key.h>
 #include "udp_impl.h"
 
 struct udp_table udp_table __read_mostly;
@@ -205,7 +207,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
 
         if (!snum) {
                 int low, high, remaining;
-                unsigned rand;
+                unsigned int rand;
                 unsigned short first, last;
                 DECLARE_BITMAP(bitmap, PORTS_PER_CHAIN);
 
@@ -845,7 +847,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
          *      Get and verify the address.
          */
         if (msg->msg_name) {
-                struct sockaddr_in * usin = (struct sockaddr_in *)msg->msg_name;
+                struct sockaddr_in *usin = (struct sockaddr_in *)msg->msg_name;
                 if (msg->msg_namelen < sizeof(*usin))
                         return -EINVAL;
                 if (usin->sin_family != AF_INET) {
@@ -917,7 +919,8 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 if (!saddr)
                         saddr = inet->mc_addr;
                 connected = 0;
-        }
+        } else if (!ipc.oif)
+                ipc.oif = inet->uc_index;
 
         if (connected)
                 rt = (struct rtable *)sk_dst_check(sk, 0);
@@ -974,7 +977,7 @@ back_from_confirm:
                 /* ... which is an evident application bug. --ANK */
                 release_sock(sk);
 
-                LIMIT_NETDEBUG(KERN_DEBUG "udp cork app bug 2\n");
+                LIMIT_NETDEBUG(KERN_DEBUG pr_fmt("cork app bug 2\n"));
                 err = -EINVAL;
                 goto out;
         }
@@ -1053,7 +1056,7 @@ int udp_sendpage(struct sock *sk, struct page *page, int offset,
         if (unlikely(!up->pending)) {
                 release_sock(sk);
 
-                LIMIT_NETDEBUG(KERN_DEBUG "udp cork app bug 3\n");
+                LIMIT_NETDEBUG(KERN_DEBUG pr_fmt("udp cork app bug 3\n"));
                 return -EINVAL;
         }
 
@@ -1166,7 +1169,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
         struct sk_buff *skb;
         unsigned int ulen, copied;
-        int peeked;
+        int peeked, off = 0;
         int err;
         int is_udplite = IS_UDPLITE(sk);
         bool slow;
@@ -1182,7 +1185,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
 try_again:
         skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
-                                  &peeked, &err);
+                                  &peeked, &off, &err);
         if (!skb)
                 goto out;
 
@@ -1377,6 +1380,14 @@ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
 }
 
+static struct static_key udp_encap_needed __read_mostly;
+void udp_encap_enable(void)
+{
+        if (!static_key_enabled(&udp_encap_needed))
+                static_key_slow_inc(&udp_encap_needed);
+}
+EXPORT_SYMBOL(udp_encap_enable);
+
 /* returns:
  *  -1: error
  *   0: success
@@ -1398,7 +1409,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 goto drop;
         nf_reset(skb);
 
-        if (up->encap_type) {
+        if (static_key_false(&udp_encap_needed) && up->encap_type) {
                 int (*encap_rcv)(struct sock *sk, struct sk_buff *skb);
 
                 /*
@@ -1446,9 +1457,8 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                  * provided by the application."
                  */
                 if (up->pcrlen == 0) {          /* full coverage was set  */
-                        LIMIT_NETDEBUG(KERN_WARNING "UDPLITE: partial coverage "
-                                "%d while full coverage %d requested\n",
-                                UDP_SKB_CB(skb)->cscov, skb->len);
+                        LIMIT_NETDEBUG(KERN_WARNING "UDPLite: partial coverage %d while full coverage %d requested\n",
+                                       UDP_SKB_CB(skb)->cscov, skb->len);
                         goto drop;
                 }
                 /* The next case involves violating the min. coverage requested
@@ -1458,9 +1468,8 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                  * Therefore the above ...()->partial_cov statement is essential.
                  */
                 if (UDP_SKB_CB(skb)->cscov  <  up->pcrlen) {
-                        LIMIT_NETDEBUG(KERN_WARNING
-                                "UDPLITE: coverage %d too small, need min %d\n",
-                                UDP_SKB_CB(skb)->cscov, up->pcrlen);
+                        LIMIT_NETDEBUG(KERN_WARNING "UDPLite: coverage %d too small, need min %d\n",
+                                       UDP_SKB_CB(skb)->cscov, up->pcrlen);
                         goto drop;
                 }
         }
@@ -1470,7 +1479,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 goto drop;
 
 
-        if (sk_rcvqueues_full(sk, skb))
+        if (sk_rcvqueues_full(sk, skb, sk->sk_rcvbuf))
                 goto drop;
 
         rc = 0;
@@ -1479,7 +1488,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk))
                 rc = __udp_queue_rcv_skb(sk, skb);
-        else if (sk_add_backlog(sk, skb)) {
+        else if (sk_add_backlog(sk, skb, sk->sk_rcvbuf)) {
                 bh_unlock_sock(sk);
                 goto drop;
         }
@@ -1688,13 +1697,10 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
 
 short_packet:
         LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: short packet: From %pI4:%u %d/%d to %pI4:%u\n",
-                       proto == IPPROTO_UDPLITE ? "-Lite" : "",
-                       &saddr,
-                       ntohs(uh->source),
-                       ulen,
-                       skb->len,
-                       &daddr,
-                       ntohs(uh->dest));
+                       proto == IPPROTO_UDPLITE ? "Lite" : "",
+                       &saddr, ntohs(uh->source),
+                       ulen, skb->len,
+                       &daddr, ntohs(uh->dest));
         goto drop;
 
 csum_error:
@@ -1703,11 +1709,8 @@ csum_error:
          * the network is concerned, anyway) as per 4.1.3.4 (MUST).
          */
         LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: bad checksum. From %pI4:%u to %pI4:%u ulen %d\n",
-                       proto == IPPROTO_UDPLITE ? "-Lite" : "",
-                       &saddr,
-                       ntohs(uh->source),
-                       &daddr,
-                       ntohs(uh->dest),
+                       proto == IPPROTO_UDPLITE ? "Lite" : "",
+                       &saddr, ntohs(uh->source), &daddr, ntohs(uh->dest),
                        ulen);
 drop:
         UDP_INC_STATS_BH(net, UDP_MIB_INERRORS, proto == IPPROTO_UDPLITE);
@@ -1766,6 +1769,7 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
                         /* FALLTHROUGH */
                 case UDP_ENCAP_L2TPINUDP:
                         up->encap_type = val;
+                        udp_encap_enable();
                         break;
                 default:
                         err = -ENOPROTOOPT;
@@ -2169,9 +2173,15 @@ void udp4_proc_exit(void)
 static __initdata unsigned long uhash_entries;
 static int __init set_uhash_entries(char *str)
 {
+        ssize_t ret;
+
         if (!str)
                 return 0;
-        uhash_entries = simple_strtoul(str, &str, 0);
+
+        ret = kstrtoul(str, 0, &uhash_entries);
+        if (ret)
+                return 0;
+
         if (uhash_entries && uhash_entries < UDP_HTABLE_SIZE_MIN)
                 uhash_entries = UDP_HTABLE_SIZE_MIN;
         return 1;
@@ -2182,26 +2192,16 @@ void __init udp_table_init(struct udp_table *table, const char *name)
 {
         unsigned int i;
 
-        if (!CONFIG_BASE_SMALL)
-                table->hash = alloc_large_system_hash(name,
-                        2 * sizeof(struct udp_hslot),
-                        uhash_entries,
-                        21, /* one slot per 2 MB */
-                        0,
-                        &table->log,
-                        &table->mask,
-                        64 * 1024);
-        /*
-         * Make sure hash table has the minimum size
-         */
-        if (CONFIG_BASE_SMALL || table->mask < UDP_HTABLE_SIZE_MIN - 1) {
-                table->hash = kmalloc(UDP_HTABLE_SIZE_MIN *
-                                      2 * sizeof(struct udp_hslot), GFP_KERNEL);
-                if (!table->hash)
-                        panic(name);
-                table->log = ilog2(UDP_HTABLE_SIZE_MIN);
-                table->mask = UDP_HTABLE_SIZE_MIN - 1;
-        }
+        table->hash = alloc_large_system_hash(name,
+                                              2 * sizeof(struct udp_hslot),
+                                              uhash_entries,
+                                              21, /* one slot per 2 MB */
+                                              0,
+                                              &table->log,
+                                              &table->mask,
+                                              UDP_HTABLE_SIZE_MIN,
+                                              64 * 1024);
+
         table->hash2 = table->hash + (table->mask + 1);
         for (i = 0; i <= table->mask; i++) {
                 INIT_HLIST_NULLS_HEAD(&table->hash[i].head, i);
diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c
index 8a949f19deb6..a7f86a3cd502 100644
--- a/net/ipv4/udp_diag.c
+++ b/net/ipv4/udp_diag.c
@@ -146,9 +146,17 @@ static int udp_diag_dump_one(struct sk_buff *in_skb, const struct nlmsghdr *nlh,
         return udp_dump_one(&udp_table, in_skb, nlh, req);
 }
 
+static void udp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
+                void *info)
+{
+        r->idiag_rqueue = sk_rmem_alloc_get(sk);
+        r->idiag_wqueue = sk_wmem_alloc_get(sk);
+}
+
 static const struct inet_diag_handler udp_diag_handler = {
         .dump            = udp_diag_dump,
         .dump_one        = udp_diag_dump_one,
+        .idiag_get_info  = udp_diag_get_info,
         .idiag_type      = IPPROTO_UDP,
 };
 
@@ -167,6 +175,7 @@ static int udplite_diag_dump_one(struct sk_buff *in_skb, const struct nlmsghdr *
 static const struct inet_diag_handler udplite_diag_handler = {
         .dump            = udplite_diag_dump,
         .dump_one        = udplite_diag_dump_one,
+        .idiag_get_info  = udp_diag_get_info,
         .idiag_type      = IPPROTO_UDPLITE,
 };
 
diff --git a/net/ipv4/udp_impl.h b/net/ipv4/udp_impl.h
index aaad650d47d9..5a681e298b90 100644
--- a/net/ipv4/udp_impl.h
+++ b/net/ipv4/udp_impl.h
@@ -25,7 +25,7 @@ extern int	udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                             size_t len, int noblock, int flags, int *addr_len);
 extern int      udp_sendpage(struct sock *sk, struct page *page, int offset,
                              size_t size, int flags);
-extern int      udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb);
+extern int      udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
 extern void     udp_destroy_sock(struct sock *sk);
 
 #ifdef CONFIG_PROC_FS
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index 12e9499a1a6c..2c46acd4cc36 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -10,6 +10,9 @@
  *              as published by the Free Software Foundation; either version
  *              2 of the License, or (at your option) any later version.
  */
+
+#define pr_fmt(fmt) "UDPLite: " fmt
+
 #include <linux/export.h>
 #include "udp_impl.h"
 
@@ -129,11 +132,11 @@ void __init udplite4_register(void)
         inet_register_protosw(&udplite4_protosw);
 
         if (udplite4_proc_init())
-                printk(KERN_ERR "%s: Cannot register /proc!\n", __func__);
+                pr_err("%s: Cannot register /proc!\n", __func__);
         return;
 
 out_unregister_proto:
         proto_unregister(&udplite_prot);
 out_register_err:
-        printk(KERN_CRIT "%s: Cannot add UDP-Lite protocol.\n", __func__);
+        pr_crit("%s: Cannot add UDP-Lite protocol\n", __func__);
 }
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index a0b4c5da8d43..0d3426cb5c4f 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -152,7 +152,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
 
                 case IPPROTO_AH:
                         if (pskb_may_pull(skb, xprth + 8 - skb->data)) {
-                                __be32 *ah_hdr = (__be32*)xprth;
+                                __be32 *ah_hdr = (__be32 *)xprth;
 
                                 fl4->fl4_ipsec_spi = ah_hdr[1];
                         }
@@ -298,8 +298,8 @@ void __init xfrm4_init(int rt_max_size)
         xfrm4_state_init();
         xfrm4_policy_init();
 #ifdef CONFIG_SYSCTL
-        sysctl_hdr = register_net_sysctl_table(&init_net, net_ipv4_ctl_path,
-                                                xfrm4_policy_table);
+        sysctl_hdr = register_net_sysctl(&init_net, "net/ipv4",
+                                         xfrm4_policy_table);
 #endif
 }
 
diff --git a/net/ipv4/xfrm4_tunnel.c b/net/ipv4/xfrm4_tunnel.c
index 9247d9d70e9d..05a5df2febc9 100644
--- a/net/ipv4/xfrm4_tunnel.c
+++ b/net/ipv4/xfrm4_tunnel.c
@@ -3,6 +3,8 @@
  * Copyright (C) 2003 David S. Miller (davem@redhat.com)
  */
 
+#define pr_fmt(fmt) "IPsec: " fmt
+
 #include <linux/skbuff.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
@@ -75,18 +77,18 @@ static struct xfrm_tunnel xfrm64_tunnel_handler __read_mostly = {
 static int __init ipip_init(void)
 {
         if (xfrm_register_type(&ipip_type, AF_INET) < 0) {
-                printk(KERN_INFO "ipip init: can't add xfrm type\n");
+                pr_info("%s: can't add xfrm type\n", __func__);
                 return -EAGAIN;
         }
 
         if (xfrm4_tunnel_register(&xfrm_tunnel_handler, AF_INET)) {
-                printk(KERN_INFO "ipip init: can't add xfrm handler for AF_INET\n");
+                pr_info("%s: can't add xfrm handler for AF_INET\n", __func__);
                 xfrm_unregister_type(&ipip_type, AF_INET);
                 return -EAGAIN;
         }
 #if IS_ENABLED(CONFIG_IPV6)
         if (xfrm4_tunnel_register(&xfrm64_tunnel_handler, AF_INET6)) {
-                printk(KERN_INFO "ipip init: can't add xfrm handler for AF_INET6\n");
+                pr_info("%s: can't add xfrm handler for AF_INET6\n", __func__);
                 xfrm4_tunnel_deregister(&xfrm_tunnel_handler, AF_INET);
                 xfrm_unregister_type(&ipip_type, AF_INET);
                 return -EAGAIN;
@@ -99,12 +101,14 @@ static void __exit ipip_fini(void)
 {
 #if IS_ENABLED(CONFIG_IPV6)
         if (xfrm4_tunnel_deregister(&xfrm64_tunnel_handler, AF_INET6))
-                printk(KERN_INFO "ipip close: can't remove xfrm handler for AF_INET6\n");
+                pr_info("%s: can't remove xfrm handler for AF_INET6\n",
+                        __func__);
 #endif
         if (xfrm4_tunnel_deregister(&xfrm_tunnel_handler, AF_INET))
-                printk(KERN_INFO "ipip close: can't remove xfrm handler for AF_INET\n");
+                pr_info("%s: can't remove xfrm handler for AF_INET\n",
+                        __func__);
         if (xfrm_unregister_type(&ipip_type, AF_INET) < 0)
-                printk(KERN_INFO "ipip close: can't remove xfrm type\n");
+                pr_info("%s: can't remove xfrm type\n", __func__);
 }
 
 module_init(ipip_init);
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index 36d7437ac054..5728695b5449 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -69,7 +69,7 @@ config IPV6_OPTIMISTIC_DAD
 
 config INET6_AH
         tristate "IPv6: AH transformation"
-        select XFRM
+        select XFRM_ALGO
         select CRYPTO
         select CRYPTO_HMAC
         select CRYPTO_MD5
@@ -81,7 +81,7 @@ config INET6_AH
 
 config INET6_ESP
         tristate "IPv6: ESP transformation"
-        select XFRM
+        select XFRM_ALGO
         select CRYPTO
         select CRYPTO_AUTHENC
         select CRYPTO_HMAC
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 6b8ebc5da0e1..8f6411c97189 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -38,6 +38,8 @@
  *                                              status etc.
  */
 
+#define pr_fmt(fmt) "IPv6: " fmt
+
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
@@ -66,6 +68,7 @@
 #include <net/sock.h>
 #include <net/snmp.h>
 
+#include <net/af_ieee802154.h>
 #include <net/ipv6.h>
 #include <net/protocol.h>
 #include <net/ndisc.h>
@@ -149,7 +152,7 @@ static void addrconf_type_change(struct net_device *dev,
                                  unsigned long event);
 static int addrconf_ifdown(struct net_device *dev, int how);
 
-static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags);
+static void addrconf_dad_start(struct inet6_ifaddr *ifp);
 static void addrconf_dad_timer(unsigned long data);
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp);
 static void addrconf_dad_run(struct inet6_dev *idev);
@@ -326,20 +329,19 @@ void in6_dev_finish_destroy(struct inet6_dev *idev)
         WARN_ON(idev->mc_list != NULL);
 
 #ifdef NET_REFCNT_DEBUG
-        printk(KERN_DEBUG "in6_dev_finish_destroy: %s\n", dev ? dev->name : "NIL");
+        pr_debug("%s: %s\n", __func__, dev ? dev->name : "NIL");
 #endif
         dev_put(dev);
         if (!idev->dead) {
-                pr_warning("Freeing alive inet6 device %p\n", idev);
+                pr_warn("Freeing alive inet6 device %p\n", idev);
                 return;
         }
         snmp6_free_dev(idev);
         kfree_rcu(idev, rcu);
 }
-
 EXPORT_SYMBOL(in6_dev_finish_destroy);
 
-static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
+static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
 {
         struct inet6_dev *ndev;
 
@@ -372,7 +374,7 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
 
         if (snmp6_alloc_dev(ndev) < 0) {
                 ADBG((KERN_WARNING
-                        "%s(): cannot allocate memory for statistics; dev=%s.\n",
+                        "%s: cannot allocate memory for statistics; dev=%s.\n",
                         __func__, dev->name));
                 neigh_parms_release(&nd_tbl, ndev->nd_parms);
                 dev_put(dev);
@@ -382,7 +384,7 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
 
         if (snmp6_register_dev(ndev) < 0) {
                 ADBG((KERN_WARNING
-                        "%s(): cannot create /proc/net/dev_snmp6/%s\n",
+                        "%s: cannot create /proc/net/dev_snmp6/%s\n",
                         __func__, dev->name));
                 neigh_parms_release(&nd_tbl, ndev->nd_parms);
                 ndev->dead = 1;
@@ -400,9 +402,7 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
 
 #if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
         if (dev->type == ARPHRD_SIT && (dev->priv_flags & IFF_ISATAP)) {
-                printk(KERN_INFO
-                       "%s: Disabled Multicast RS\n",
-                       dev->name);
+                pr_info("%s: Disabled Multicast RS\n", dev->name);
                 ndev->cnf.rtr_solicits = 0;
         }
 #endif
@@ -435,13 +435,13 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
         ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
 
         /* Join all-router multicast group if forwarding is set */
-        if (ndev->cnf.forwarding && dev && (dev->flags & IFF_MULTICAST))
+        if (ndev->cnf.forwarding && (dev->flags & IFF_MULTICAST))
                 ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
 
         return ndev;
 }
 
-static struct inet6_dev * ipv6_find_idev(struct net_device *dev)
+static struct inet6_dev *ipv6_find_idev(struct net_device *dev)
 {
         struct inet6_dev *idev;
 
@@ -542,7 +542,7 @@ void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
         WARN_ON(!hlist_unhashed(&ifp->addr_lst));
 
 #ifdef NET_REFCNT_DEBUG
-        printk(KERN_DEBUG "inet6_ifa_finish_destroy\n");
+        pr_debug("%s\n", __func__);
 #endif
 
         in6_dev_put(ifp->idev);
@@ -551,7 +551,7 @@ void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
                 pr_notice("Timer is still running, when freeing ifa=%p\n", ifp);
 
         if (ifp->state != INET6_IFADDR_STATE_DEAD) {
-                pr_warning("Freeing alive inet6 address %p\n", ifp);
+                pr_warn("Freeing alive inet6 address %p\n", ifp);
                 return;
         }
         dst_release(&ifp->rt->dst);
@@ -803,8 +803,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
                                 ip6_del_rt(rt);
                                 rt = NULL;
                         } else if (!(rt->rt6i_flags & RTF_EXPIRES)) {
-                                rt->dst.expires = expires;
-                                rt->rt6i_flags |= RTF_EXPIRES;
+                                rt6_set_expires(rt, expires);
                         }
                 }
                 dst_release(&rt->dst);
@@ -842,8 +841,7 @@ retry:
         in6_dev_hold(idev);
         if (idev->cnf.use_tempaddr <= 0) {
                 write_unlock(&idev->lock);
-                printk(KERN_INFO
-                        "ipv6_create_tempaddr(): use_tempaddr is disabled.\n");
+                pr_info("%s: use_tempaddr is disabled\n", __func__);
                 in6_dev_put(idev);
                 ret = -1;
                 goto out;
@@ -853,8 +851,8 @@ retry:
                 idev->cnf.use_tempaddr = -1;    /*XXX*/
                 spin_unlock_bh(&ifp->lock);
                 write_unlock(&idev->lock);
-                printk(KERN_WARNING
-                        "ipv6_create_tempaddr(): regeneration time exceeded. disabled temporary address support.\n");
+                pr_warn("%s: regeneration time exceeded - disabled temporary address support\n",
+                        __func__);
                 in6_dev_put(idev);
                 ret = -1;
                 goto out;
@@ -864,8 +862,8 @@ retry:
         if (__ipv6_try_regen_rndid(idev, tmpaddr) < 0) {
                 spin_unlock_bh(&ifp->lock);
                 write_unlock(&idev->lock);
-                printk(KERN_WARNING
-                        "ipv6_create_tempaddr(): regeneration of randomized interface id failed.\n");
+                pr_warn("%s: regeneration of randomized interface id failed\n",
+                        __func__);
                 in6_ifa_put(ifp);
                 in6_dev_put(idev);
                 ret = -1;
@@ -915,8 +913,7 @@ retry:
         if (!ift || IS_ERR(ift)) {
                 in6_ifa_put(ifp);
                 in6_dev_put(idev);
-                printk(KERN_INFO
-                        "ipv6_create_tempaddr(): retry temporary address regeneration.\n");
+                pr_info("%s: retry temporary address regeneration\n", __func__);
                 tmpaddr = &addr;
                 write_lock(&idev->lock);
                 goto retry;
@@ -930,7 +927,7 @@ retry:
         ift->tstamp = tmp_tstamp;
         spin_unlock_bh(&ift->lock);
 
-        addrconf_dad_start(ift, 0);
+        addrconf_dad_start(ift);
         in6_ifa_put(ift);
         in6_dev_put(idev);
 out:
@@ -1333,7 +1330,6 @@ int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)
         rcu_read_unlock();
         return onlink;
 }
-
 EXPORT_SYMBOL(ipv6_chk_prefix);
 
 struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *addr,
@@ -1417,9 +1413,8 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
                 return;
         }
 
-        if (net_ratelimit())
-                printk(KERN_INFO "%s: IPv6 duplicate address %pI6c detected!\n",
-                        ifp->idev->dev->name, &ifp->addr);
+        net_info_ratelimited("%s: IPv6 duplicate address %pI6c detected!\n",
+                             ifp->idev->dev->name, &ifp->addr);
 
         if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6) {
                 struct in6_addr addr;
@@ -1432,7 +1427,7 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
                         /* DAD failed for link-local based on MAC address */
                         idev->cnf.disable_ipv6 = 1;
 
-                        printk(KERN_INFO "%s: IPv6 being disabled!\n",
+                        pr_info("%s: IPv6 being disabled!\n",
                                 ifp->idev->dev->name);
                 }
         }
@@ -1517,13 +1512,21 @@ static int addrconf_ifid_eui48(u8 *eui, struct net_device *dev)
         return 0;
 }
 
+static int addrconf_ifid_eui64(u8 *eui, struct net_device *dev)
+{
+        if (dev->addr_len != IEEE802154_ADDR_LEN)
+                return -1;
+        memcpy(eui, dev->dev_addr, 8);
+        return 0;
+}
+
 static int addrconf_ifid_arcnet(u8 *eui, struct net_device *dev)
 {
         /* XXX: inherit EUI-64 from other interface -- yoshfuji */
         if (dev->addr_len != ARCNET_ALEN)
                 return -1;
         memset(eui, 0, 7);
-        eui[7] = *(u8*)dev->dev_addr;
+        eui[7] = *(u8 *)dev->dev_addr;
         return 0;
 }
 
@@ -1570,7 +1573,6 @@ static int ipv6_generate_eui64(u8 *eui, struct net_device *dev)
         switch (dev->type) {
         case ARPHRD_ETHER:
         case ARPHRD_FDDI:
-        case ARPHRD_IEEE802_TR:
                 return addrconf_ifid_eui48(eui, dev);
         case ARPHRD_ARCNET:
                 return addrconf_ifid_arcnet(eui, dev);
@@ -1580,6 +1582,8 @@ static int ipv6_generate_eui64(u8 *eui, struct net_device *dev)
                 return addrconf_ifid_sit(eui, dev);
         case ARPHRD_IPGRE:
                 return addrconf_ifid_gre(eui, dev);
+        case ARPHRD_IEEE802154:
+                return addrconf_ifid_eui64(eui, dev);
         }
         return -1;
 }
@@ -1653,9 +1657,8 @@ static void ipv6_regen_rndid(unsigned long data)
                 idev->cnf.regen_max_retry * idev->cnf.dad_transmits * idev->nd_parms->retrans_time -
                 idev->cnf.max_desync_factor * HZ;
         if (time_before(expires, jiffies)) {
-                printk(KERN_WARNING
-                        "ipv6_regen_rndid(): too short regeneration interval; timer disabled for %s.\n",
-                        idev->dev->name);
+                pr_warn("%s: too short regeneration interval; timer disabled for %s\n",
+                        __func__, idev->dev->name);
                 goto out;
         }
 
@@ -1668,7 +1671,8 @@ out:
         in6_dev_put(idev);
 }
 
-static int __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr) {
+static int __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr)
+{
         int ret = 0;
 
         if (tmpaddr && memcmp(idev->rndid, &tmpaddr->s6_addr[8], 8) == 0)
@@ -1838,16 +1842,15 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
         prefered_lft = ntohl(pinfo->prefered);
 
         if (prefered_lft > valid_lft) {
-                if (net_ratelimit())
-                        printk(KERN_WARNING "addrconf: prefix option has invalid lifetime\n");
+                net_warn_ratelimited("addrconf: prefix option has invalid lifetime\n");
                 return;
         }
 
         in6_dev = in6_dev_get(dev);
 
         if (in6_dev == NULL) {
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "addrconf: device %s not configured\n", dev->name);
+                net_dbg_ratelimited("addrconf: device %s not configured\n",
+                                    dev->name);
                 return;
         }
 
@@ -1887,11 +1890,9 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
                                 rt = NULL;
                         } else if (addrconf_finite_timeout(rt_expires)) {
                                 /* not infinity */
-                                rt->dst.expires = jiffies + rt_expires;
-                                rt->rt6i_flags |= RTF_EXPIRES;
+                                rt6_set_expires(rt, jiffies + rt_expires);
                         } else {
-                                rt->rt6i_flags &= ~RTF_EXPIRES;
-                                rt->dst.expires = 0;
+                                rt6_clean_expires(rt);
                         }
                 } else if (valid_lft) {
                         clock_t expires = 0;
@@ -1911,7 +1912,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
         /* Try to figure out our local address for this prefix */
 
         if (pinfo->autoconf && in6_dev->cnf.autoconf) {
-                struct inet6_ifaddr * ifp;
+                struct inet6_ifaddr *ifp;
                 struct in6_addr addr;
                 int create = 0, update_lft = 0;
 
@@ -1924,9 +1925,8 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
                         }
                         goto ok;
                 }
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "IPv6 addrconf: prefix with wrong length %d\n",
-                               pinfo->prefix_len);
+                net_dbg_ratelimited("IPv6 addrconf: prefix with wrong length %d\n",
+                                    pinfo->prefix_len);
                 in6_dev_put(in6_dev);
                 return;
 
@@ -1960,7 +1960,7 @@ ok:
 
                         update_lft = create = 1;
                         ifp->cstamp = jiffies;
-                        addrconf_dad_start(ifp, RTF_ADDRCONF|RTF_PREFIX_RT);
+                        addrconf_dad_start(ifp);
                 }
 
                 if (ifp) {
@@ -2239,7 +2239,7 @@ static int inet6_addr_add(struct net *net, int ifindex, const struct in6_addr *p
                  * that the Optimistic flag should not be set for
                  * manually configured addresses
                  */
-                addrconf_dad_start(ifp, 0);
+                addrconf_dad_start(ifp);
                 in6_ifa_put(ifp);
                 addrconf_verify(0);
                 return 0;
@@ -2365,9 +2365,9 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
         }
 
         for_each_netdev(net, dev) {
-                struct in_device * in_dev = __in_dev_get_rtnl(dev);
+                struct in_device *in_dev = __in_dev_get_rtnl(dev);
                 if (in_dev && (dev->flags & IFF_UP)) {
-                        struct in_ifaddr * ifa;
+                        struct in_ifaddr *ifa;
 
                         int flag = scope;
 
@@ -2404,7 +2404,7 @@ static void init_loopback(struct net_device *dev)
         ASSERT_RTNL();
 
         if ((idev = ipv6_find_idev(dev)) == NULL) {
-                printk(KERN_DEBUG "init loopback: add_dev failed\n");
+                pr_debug("%s: add_dev failed\n", __func__);
                 return;
         }
 
@@ -2413,7 +2413,7 @@ static void init_loopback(struct net_device *dev)
 
 static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr *addr)
 {
-        struct inet6_ifaddr * ifp;
+        struct inet6_ifaddr *ifp;
         u32 addr_flags = IFA_F_PERMANENT;
 
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
@@ -2426,7 +2426,7 @@ static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr
         ifp = ipv6_add_addr(idev, addr, 64, IFA_LINK, addr_flags);
         if (!IS_ERR(ifp)) {
                 addrconf_prefix_route(&ifp->addr, ifp->prefix_len, idev->dev, 0, 0);
-                addrconf_dad_start(ifp, 0);
+                addrconf_dad_start(ifp);
                 in6_ifa_put(ifp);
         }
 }
@@ -2434,15 +2434,15 @@ static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr
 static void addrconf_dev_config(struct net_device *dev)
 {
         struct in6_addr addr;
-        struct inet6_dev    * idev;
+        struct inet6_dev *idev;
 
         ASSERT_RTNL();
 
         if ((dev->type != ARPHRD_ETHER) &&
             (dev->type != ARPHRD_FDDI) &&
-            (dev->type != ARPHRD_IEEE802_TR) &&
             (dev->type != ARPHRD_ARCNET) &&
-            (dev->type != ARPHRD_INFINIBAND)) {
+            (dev->type != ARPHRD_INFINIBAND) &&
+            (dev->type != ARPHRD_IEEE802154)) {
                 /* Alas, we support only Ethernet autoconfiguration. */
                 return;
         }
@@ -2472,7 +2472,7 @@ static void addrconf_sit_config(struct net_device *dev)
          */
 
         if ((idev = ipv6_find_idev(dev)) == NULL) {
-                printk(KERN_DEBUG "init sit: add_dev failed\n");
+                pr_debug("%s: add_dev failed\n", __func__);
                 return;
         }
 
@@ -2502,12 +2502,12 @@ static void addrconf_gre_config(struct net_device *dev)
         struct inet6_dev *idev;
         struct in6_addr addr;
 
-        pr_info("ipv6: addrconf_gre_config(%s)\n", dev->name);
+        pr_info("%s(%s)\n", __func__, dev->name);
 
         ASSERT_RTNL();
 
         if ((idev = ipv6_find_idev(dev)) == NULL) {
-                printk(KERN_DEBUG "init gre: add_dev failed\n");
+                pr_debug("%s: add_dev failed\n", __func__);
                 return;
         }
 
@@ -2547,7 +2547,7 @@ static void ip6_tnl_add_linklocal(struct inet6_dev *idev)
                 if (!ipv6_inherit_linklocal(idev, link_dev))
                         return;
         }
-        printk(KERN_DEBUG "init ip6-ip6: add_linklocal failed\n");
+        pr_debug("init ip6-ip6: add_linklocal failed\n");
 }
 
 /*
@@ -2563,14 +2563,14 @@ static void addrconf_ip6_tnl_config(struct net_device *dev)
 
         idev = addrconf_add_dev(dev);
         if (IS_ERR(idev)) {
-                printk(KERN_DEBUG "init ip6-ip6: add_dev failed\n");
+                pr_debug("init ip6-ip6: add_dev failed\n");
                 return;
         }
         ip6_tnl_add_linklocal(idev);
 }
 
 static int addrconf_notify(struct notifier_block *this, unsigned long event,
-                           void * data)
+                           void *data)
 {
         struct net_device *dev = (struct net_device *) data;
         struct inet6_dev *idev = __in6_dev_get(dev);
@@ -2594,9 +2594,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                 if (event == NETDEV_UP) {
                         if (!addrconf_qdisc_ok(dev)) {
                                 /* device is not ready yet. */
-                                printk(KERN_INFO
-                                        "ADDRCONF(NETDEV_UP): %s: "
-                                        "link is not ready\n",
+                                pr_info("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
                                         dev->name);
                                 break;
                         }
@@ -2621,10 +2619,8 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                                 idev->if_flags |= IF_READY;
                         }
 
-                        printk(KERN_INFO
-                                        "ADDRCONF(NETDEV_CHANGE): %s: "
-                                        "link becomes ready\n",
-                                        dev->name);
+                        pr_info("ADDRCONF(NETDEV_CHANGE): %s: link becomes ready\n",
+                                dev->name);
 
                         run_pending = 1;
                 }
@@ -2895,8 +2891,7 @@ static void addrconf_rs_timer(unsigned long data)
                  * Note: we do not support deprecated "all on-link"
                  * assumption any longer.
                  */
-                printk(KERN_DEBUG "%s: no IPv6 routers present\n",
-                       idev->dev->name);
+                pr_debug("%s: no IPv6 routers present\n", idev->dev->name);
         }
 
 out:
@@ -2921,7 +2916,7 @@ static void addrconf_dad_kick(struct inet6_ifaddr *ifp)
         addrconf_mod_timer(ifp, AC_DAD, rand_num);
 }
 
-static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
+static void addrconf_dad_start(struct inet6_ifaddr *ifp)
 {
         struct inet6_dev *idev = ifp->idev;
         struct net_device *dev = idev->dev;
@@ -3794,7 +3789,7 @@ static int inet6_dump_ifacaddr(struct sk_buff *skb, struct netlink_callback *cb)
         return inet6_dump_addr(skb, cb, type);
 }
 
-static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr* nlh,
+static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh,
                              void *arg)
 {
         struct net *net = sock_net(in_skb->sk);
@@ -3989,14 +3984,14 @@ static int inet6_fill_ifla6_attrs(struct sk_buff *skb, struct inet6_dev *idev)
         struct nlattr *nla;
         struct ifla_cacheinfo ci;
 
-        NLA_PUT_U32(skb, IFLA_INET6_FLAGS, idev->if_flags);
-
+        if (nla_put_u32(skb, IFLA_INET6_FLAGS, idev->if_flags))
+                goto nla_put_failure;
         ci.max_reasm_len = IPV6_MAXPLEN;
         ci.tstamp = cstamp_delta(idev->tstamp);
         ci.reachable_time = jiffies_to_msecs(idev->nd_parms->reachable_time);
         ci.retrans_time = jiffies_to_msecs(idev->nd_parms->retrans_time);
-        NLA_PUT(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci);
-
+        if (nla_put(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci))
+                goto nla_put_failure;
         nla = nla_reserve(skb, IFLA_INET6_CONF, DEVCONF_MAX * sizeof(s32));
         if (nla == NULL)
                 goto nla_put_failure;
@@ -4061,15 +4056,13 @@ static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
         hdr->ifi_flags = dev_get_flags(dev);
         hdr->ifi_change = 0;
 
-        NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
-
-        if (dev->addr_len)
-                NLA_PUT(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr);
-
-        NLA_PUT_U32(skb, IFLA_MTU, dev->mtu);
-        if (dev->ifindex != dev->iflink)
-                NLA_PUT_U32(skb, IFLA_LINK, dev->iflink);
-
+        if (nla_put_string(skb, IFLA_IFNAME, dev->name) ||
+            (dev->addr_len &&
+             nla_put(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr)) ||
+            nla_put_u32(skb, IFLA_MTU, dev->mtu) ||
+            (dev->ifindex != dev->iflink &&
+             nla_put_u32(skb, IFLA_LINK, dev->iflink)))
+                goto nla_put_failure;
         protoinfo = nla_nest_start(skb, IFLA_PROTINFO);
         if (protoinfo == NULL)
                 goto nla_put_failure;
@@ -4182,12 +4175,12 @@ static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
         if (pinfo->autoconf)
                 pmsg->prefix_flags |= IF_PREFIX_AUTOCONF;
 
-        NLA_PUT(skb, PREFIX_ADDRESS, sizeof(pinfo->prefix), &pinfo->prefix);
-
+        if (nla_put(skb, PREFIX_ADDRESS, sizeof(pinfo->prefix), &pinfo->prefix))
+                goto nla_put_failure;
         ci.preferred_time = ntohl(pinfo->prefered);
         ci.valid_time = ntohl(pinfo->valid);
-        NLA_PUT(skb, PREFIX_CACHEINFO, sizeof(ci), &ci);
-
+        if (nla_put(skb, PREFIX_CACHEINFO, sizeof(ci), &ci))
+                goto nla_put_failure;
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
@@ -4371,7 +4364,6 @@ static struct addrconf_sysctl_table
 {
         struct ctl_table_header *sysctl_header;
         ctl_table addrconf_vars[DEVCONF_MAX+1];
-        char *dev_name;
 } addrconf_sysctl __read_mostly = {
         .sysctl_header = NULL,
         .addrconf_vars = {
@@ -4600,17 +4592,7 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name,
 {
         int i;
         struct addrconf_sysctl_table *t;
-
-#define ADDRCONF_CTL_PATH_DEV   3
-
-        struct ctl_path addrconf_ctl_path[] = {
-                { .procname = "net", },
-                { .procname = "ipv6", },
-                { .procname = "conf", },
-                { /* to be set */ },
-                { },
-        };
-
+        char path[sizeof("net/ipv6/conf/") + IFNAMSIZ];
 
         t = kmemdup(&addrconf_sysctl, sizeof(*t), GFP_KERNEL);
         if (t == NULL)
@@ -4622,27 +4604,15 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name,
                 t->addrconf_vars[i].extra2 = net;
         }
 
-        /*
-         * Make a copy of dev_name, because '.procname' is regarded as const
-         * by sysctl and we wouldn't want anyone to change it under our feet
-         * (see SIOCSIFNAME).
-         */
-        t->dev_name = kstrdup(dev_name, GFP_KERNEL);
-        if (!t->dev_name)
-                goto free;
-
-        addrconf_ctl_path[ADDRCONF_CTL_PATH_DEV].procname = t->dev_name;
+        snprintf(path, sizeof(path), "net/ipv6/conf/%s", dev_name);
 
-        t->sysctl_header = register_net_sysctl_table(net, addrconf_ctl_path,
-                        t->addrconf_vars);
+        t->sysctl_header = register_net_sysctl(net, path, t->addrconf_vars);
         if (t->sysctl_header == NULL)
-                goto free_procname;
+                goto free;
 
         p->sysctl = t;
         return 0;
 
-free_procname:
-        kfree(t->dev_name);
 free:
         kfree(t);
 out:
@@ -4659,7 +4629,6 @@ static void __addrconf_sysctl_unregister(struct ipv6_devconf *p)
         t = p->sysctl;
         p->sysctl = NULL;
         unregister_net_sysctl_table(t->sysctl_header);
-        kfree(t->dev_name);
         kfree(t);
 }
 
@@ -4778,8 +4747,8 @@ int __init addrconf_init(void)
 
         err = ipv6_addr_label_init();
         if (err < 0) {
-                printk(KERN_CRIT "IPv6 Addrconf:"
-                       " cannot initialize default policy table: %d.\n", err);
+                pr_crit("%s: cannot initialize default policy table: %d\n",
+                        __func__, err);
                 goto out;
         }
 
diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
index 399287e595d7..d051e5f4bf34 100644
--- a/net/ipv6/addrconf_core.c
+++ b/net/ipv6/addrconf_core.c
@@ -8,9 +8,9 @@
 
 #define IPV6_ADDR_SCOPE_TYPE(scope)     ((scope) << 16)
 
-static inline unsigned ipv6_addr_scope2type(unsigned scope)
+static inline unsigned int ipv6_addr_scope2type(unsigned int scope)
 {
-        switch(scope) {
+        switch (scope) {
         case IPV6_ADDR_SCOPE_NODELOCAL:
                 return (IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_NODELOCAL) |
                         IPV6_ADDR_LOOPBACK);
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index 2d8ddba9ee58..eb6a63632d3c 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -129,7 +129,7 @@ static void ip6addrlbl_free_rcu(struct rcu_head *h)
         ip6addrlbl_free(container_of(h, struct ip6addrlbl_entry, rcu));
 }
 
-static inline int ip6addrlbl_hold(struct ip6addrlbl_entry *p)
+static bool ip6addrlbl_hold(struct ip6addrlbl_entry *p)
 {
         return atomic_inc_not_zero(&p->refcnt);
 }
@@ -141,20 +141,20 @@ static inline void ip6addrlbl_put(struct ip6addrlbl_entry *p)
 }
 
 /* Find label */
-static int __ip6addrlbl_match(struct net *net,
-                              struct ip6addrlbl_entry *p,
-                              const struct in6_addr *addr,
-                              int addrtype, int ifindex)
+static bool __ip6addrlbl_match(struct net *net,
+                               const struct ip6addrlbl_entry *p,
+                               const struct in6_addr *addr,
+                               int addrtype, int ifindex)
 {
         if (!net_eq(ip6addrlbl_net(p), net))
-                return 0;
+                return false;
         if (p->ifindex && p->ifindex != ifindex)
-                return 0;
+                return false;
         if (p->addrtype && p->addrtype != addrtype)
-                return 0;
+                return false;
         if (!ipv6_prefix_equal(addr, &p->prefix, p->prefixlen))
-                return 0;
-        return 1;
+                return false;
+        return true;
 }
 
 static struct ip6addrlbl_entry *__ipv6_addr_label(struct net *net,
@@ -350,7 +350,7 @@ static int __net_init ip6addrlbl_net_init(struct net *net)
         int err = 0;
         int i;
 
-        ADDRLABEL(KERN_DEBUG "%s()\n", __func__);
+        ADDRLABEL(KERN_DEBUG "%s\n", __func__);
 
         for (i = 0; i < ARRAY_SIZE(ip6addrlbl_init_table); i++) {
                 int ret = ip6addrlbl_add(net,
@@ -456,8 +456,8 @@ static int ip6addrlbl_newdel(struct sk_buff *skb, struct nlmsghdr *nlh,
         return err;
 }
 
-static inline void ip6addrlbl_putmsg(struct nlmsghdr *nlh,
-                                     int prefixlen, int ifindex, u32 lseq)
+static void ip6addrlbl_putmsg(struct nlmsghdr *nlh,
+                              int prefixlen, int ifindex, u32 lseq)
 {
         struct ifaddrlblmsg *ifal = nlmsg_data(nlh);
         ifal->ifal_family = AF_INET6;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 273f48d1df2e..e22e6d88bac6 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -18,6 +18,7 @@
  *      2 of the License, or (at your option) any later version.
  */
 
+#define pr_fmt(fmt) "IPv6: " fmt
 
 #include <linux/module.h>
 #include <linux/capability.h>
@@ -60,7 +61,6 @@
 #endif
 
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/mroute6.h>
 
 MODULE_AUTHOR("Cast of dozens");
@@ -78,7 +78,7 @@ struct ipv6_params ipv6_defaults = {
         .autoconf = 1,
 };
 
-static int disable_ipv6_mod = 0;
+static int disable_ipv6_mod;
 
 module_param_named(disable, disable_ipv6_mod, int, 0444);
 MODULE_PARM_DESC(disable, "Disable IPv6 module such that it is non-functional");
@@ -181,7 +181,7 @@ lookup_protocol:
         err = 0;
         sk->sk_no_check = answer_no_check;
         if (INET_PROTOSW_REUSE & answer_flags)
-                sk->sk_reuse = 1;
+                sk->sk_reuse = SK_CAN_REUSE;
 
         inet = inet_sk(sk);
         inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
@@ -214,6 +214,7 @@ lookup_protocol:
         inet->mc_ttl    = 1;
         inet->mc_index  = 0;
         inet->mc_list   = NULL;
+        inet->rcv_tos   = 0;
 
         if (ipv4_config.no_pmtu_disc)
                 inet->pmtudisc = IP_PMTUDISC_DONT;
@@ -256,7 +257,7 @@ out_rcu_unlock:
 /* bind for INET6 API */
 int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
-        struct sockaddr_in6 *addr=(struct sockaddr_in6 *)uaddr;
+        struct sockaddr_in6 *addr = (struct sockaddr_in6 *)uaddr;
         struct sock *sk = sock->sk;
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -390,7 +391,6 @@ out_unlock:
         rcu_read_unlock();
         goto out;
 }
-
 EXPORT_SYMBOL(inet6_bind);
 
 int inet6_release(struct socket *sock)
@@ -408,7 +408,6 @@ int inet6_release(struct socket *sock)
 
         return inet_release(sock);
 }
-
 EXPORT_SYMBOL(inet6_release);
 
 void inet6_destroy_sock(struct sock *sk)
@@ -419,10 +418,12 @@ void inet6_destroy_sock(struct sock *sk)
 
         /* Release rx options */
 
-        if ((skb = xchg(&np->pktoptions, NULL)) != NULL)
+        skb = xchg(&np->pktoptions, NULL);
+        if (skb != NULL)
                 kfree_skb(skb);
 
-        if ((skb = xchg(&np->rxpmtu, NULL)) != NULL)
+        skb = xchg(&np->rxpmtu, NULL);
+        if (skb != NULL)
                 kfree_skb(skb);
 
         /* Free flowlabels */
@@ -430,10 +431,10 @@ void inet6_destroy_sock(struct sock *sk)
 
         /* Free tx options */
 
-        if ((opt = xchg(&np->opt, NULL)) != NULL)
+        opt = xchg(&np->opt, NULL);
+        if (opt != NULL)
                 sock_kfree_s(sk, opt, opt->tot_len);
 }
-
 EXPORT_SYMBOL_GPL(inet6_destroy_sock);
 
 /*
@@ -443,7 +444,7 @@ EXPORT_SYMBOL_GPL(inet6_destroy_sock);
 int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
                  int *uaddr_len, int peer)
 {
-        struct sockaddr_in6 *sin=(struct sockaddr_in6 *)uaddr;
+        struct sockaddr_in6 *sin = (struct sockaddr_in6 *)uaddr;
         struct sock *sk = sock->sk;
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -474,7 +475,6 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
         *uaddr_len = sizeof(*sin);
         return 0;
 }
-
 EXPORT_SYMBOL(inet6_getname);
 
 int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
@@ -482,8 +482,7 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         struct sock *sk = sock->sk;
         struct net *net = sock_net(sk);
 
-        switch(cmd)
-        {
+        switch (cmd) {
         case SIOCGSTAMP:
                 return sock_get_timestamp(sk, (struct timeval __user *)arg);
 
@@ -509,7 +508,6 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         /*NOTREACHED*/
         return 0;
 }
-
 EXPORT_SYMBOL(inet6_ioctl);
 
 const struct proto_ops inet6_stream_ops = {
@@ -615,25 +613,21 @@ out:
         return ret;
 
 out_permanent:
-        printk(KERN_ERR "Attempt to override permanent protocol %d.\n",
-               protocol);
+        pr_err("Attempt to override permanent protocol %d\n", protocol);
         goto out;
 
 out_illegal:
-        printk(KERN_ERR
-               "Ignoring attempt to register invalid socket type %d.\n",
+        pr_err("Ignoring attempt to register invalid socket type %d\n",
                p->type);
         goto out;
 }
-
 EXPORT_SYMBOL(inet6_register_protosw);
 
 void
 inet6_unregister_protosw(struct inet_protosw *p)
 {
         if (INET_PROTOSW_PERMANENT & p->flags) {
-                printk(KERN_ERR
-                       "Attempt to unregister permanent protocol %d.\n",
+                pr_err("Attempt to unregister permanent protocol %d\n",
                        p->protocol);
         } else {
                 spin_lock_bh(&inetsw6_lock);
@@ -643,7 +637,6 @@ inet6_unregister_protosw(struct inet_protosw *p)
                 synchronize_net();
         }
 }
-
 EXPORT_SYMBOL(inet6_unregister_protosw);
 
 int inet6_sk_rebuild_header(struct sock *sk)
@@ -683,13 +676,12 @@ int inet6_sk_rebuild_header(struct sock *sk)
 
         return 0;
 }
-
 EXPORT_SYMBOL_GPL(inet6_sk_rebuild_header);
 
-int ipv6_opt_accepted(struct sock *sk, struct sk_buff *skb)
+bool ipv6_opt_accepted(const struct sock *sk, const struct sk_buff *skb)
 {
-        struct ipv6_pinfo *np = inet6_sk(sk);
-        struct inet6_skb_parm *opt = IP6CB(skb);
+        const struct ipv6_pinfo *np = inet6_sk(sk);
+        const struct inet6_skb_parm *opt = IP6CB(skb);
 
         if (np->rxopt.all) {
                 if ((opt->hop && (np->rxopt.bits.hopopts ||
@@ -701,11 +693,10 @@ int ipv6_opt_accepted(struct sock *sk, struct sk_buff *skb)
                      np->rxopt.bits.osrcrt)) ||
                     ((opt->dst1 || opt->dst0) &&
                      (np->rxopt.bits.dstopts || np->rxopt.bits.odstopts)))
-                        return 1;
+                        return true;
         }
-        return 0;
+        return false;
 }
-
 EXPORT_SYMBOL_GPL(ipv6_opt_accepted);
 
 static int ipv6_gso_pull_exthdrs(struct sk_buff *skb, int proto)
@@ -1070,13 +1061,11 @@ static int __init inet6_init(void)
         BUILD_BUG_ON(sizeof(struct inet6_skb_parm) > sizeof(dummy_skb->cb));
 
         /* Register the socket-side information for inet6_create.  */
-        for(r = &inetsw6[0]; r < &inetsw6[SOCK_MAX]; ++r)
+        for (r = &inetsw6[0]; r < &inetsw6[SOCK_MAX]; ++r)
                 INIT_LIST_HEAD(r);
 
         if (disable_ipv6_mod) {
-                printk(KERN_INFO
-                       "IPv6: Loaded, but administratively disabled, "
-                       "reboot required to enable\n");
+                pr_info("Loaded, but administratively disabled, reboot required to enable\n");
                 goto out;
         }
 
@@ -1111,11 +1100,6 @@ static int __init inet6_init(void)
         if (err)
                 goto out_sock_register_fail;
 
-#ifdef CONFIG_SYSCTL
-        err = ipv6_static_sysctl_register();
-        if (err)
-                goto static_sysctl_fail;
-#endif
         tcpv6_prot.sysctl_mem = init_net.ipv4.sysctl_tcp_mem;
 
         /*
@@ -1242,10 +1226,6 @@ ipmr_fail:
 icmp_fail:
         unregister_pernet_subsys(&inet6_net_ops);
 register_pernet_fail:
-#ifdef CONFIG_SYSCTL
-        ipv6_static_sysctl_unregister();
-static_sysctl_fail:
-#endif
         sock_unregister(PF_INET6);
         rtnl_unregister_all(PF_INET6);
 out_sock_register_fail:
@@ -1272,9 +1252,6 @@ static void __exit inet6_exit(void)
         /* Disallow any further netlink messages */
         rtnl_unregister_all(PF_INET6);
 
-#ifdef CONFIG_SYSCTL
-        ipv6_sysctl_unregister();
-#endif
         udpv6_exit();
         udplitev6_exit();
         tcpv6_exit();
@@ -1302,9 +1279,6 @@ static void __exit inet6_exit(void)
         rawv6_exit();
 
         unregister_pernet_subsys(&inet6_net_ops);
-#ifdef CONFIG_SYSCTL
-        ipv6_static_sysctl_unregister();
-#endif
         proto_unregister(&rawv6_prot);
         proto_unregister(&udplitev6_prot);
         proto_unregister(&udpv6_prot);
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 2ae79dbeec2f..f1a4a2c28ed3 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -24,6 +24,8 @@
  *      This file is derived from net/ipv4/ah.c.
  */
 
+#define pr_fmt(fmt) "IPv6: " fmt
+
 #include <crypto/hash.h>
 #include <linux/module.h>
 #include <linux/slab.h>
@@ -111,7 +113,7 @@ static inline struct scatterlist *ah_req_sg(struct crypto_ahash *ahash,
                              __alignof__(struct scatterlist));
 }
 
-static int zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr)
+static bool zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr)
 {
         u8 *opt = (u8 *)opthdr;
         int len = ipv6_optlen(opthdr);
@@ -125,7 +127,7 @@ static int zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr)
 
                 switch (opt[off]) {
 
-                case IPV6_TLV_PAD0:
+                case IPV6_TLV_PAD1:
                         optlen = 1;
                         break;
                 default:
@@ -143,10 +145,10 @@ static int zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr)
                 len -= optlen;
         }
         if (len == 0)
-                return 1;
+                return true;
 
 bad:
-        return 0;
+        return false;
 }
 
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
@@ -169,7 +171,7 @@ static void ipv6_rearrange_destopt(struct ipv6hdr *iph, struct ipv6_opt_hdr *des
 
                 switch (opt[off]) {
 
-                case IPV6_TLV_PAD0:
+                case IPV6_TLV_PAD1:
                         optlen = 1;
                         break;
                 default:
@@ -189,8 +191,8 @@ static void ipv6_rearrange_destopt(struct ipv6hdr *iph, struct ipv6_opt_hdr *des
 
                                 hao = (struct ipv6_destopt_hao *)&opt[off];
                                 if (hao->length != sizeof(hao->addr)) {
-                                        if (net_ratelimit())
-                                                printk(KERN_WARNING "destopt hao: invalid header length: %u\n", hao->length);
+                                        net_warn_ratelimited("destopt hao: invalid header length: %u\n",
+                                                             hao->length);
                                         goto bad;
                                 }
                                 final_addr = hao->addr;
@@ -659,9 +661,9 @@ static int ah6_init_state(struct xfrm_state *x)
 
         if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
             crypto_ahash_digestsize(ahash)) {
-                printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
-                       x->aalg->alg_name, crypto_ahash_digestsize(ahash),
-                       aalg_desc->uinfo.auth.icv_fullbits/8);
+                pr_info("AH: %s digestsize %u != %hu\n",
+                        x->aalg->alg_name, crypto_ahash_digestsize(ahash),
+                        aalg_desc->uinfo.auth.icv_fullbits/8);
                 goto error;
         }
 
@@ -727,12 +729,12 @@ static const struct inet6_protocol ah6_protocol = {
 static int __init ah6_init(void)
 {
         if (xfrm_register_type(&ah6_type, AF_INET6) < 0) {
-                printk(KERN_INFO "ipv6 ah init: can't add xfrm type\n");
+                pr_info("%s: can't add xfrm type\n", __func__);
                 return -EAGAIN;
         }
 
         if (inet6_add_protocol(&ah6_protocol, IPPROTO_AH) < 0) {
-                printk(KERN_INFO "ipv6 ah init: can't add protocol\n");
+                pr_info("%s: can't add protocol\n", __func__);
                 xfrm_unregister_type(&ah6_type, AF_INET6);
                 return -EAGAIN;
         }
@@ -743,10 +745,10 @@ static int __init ah6_init(void)
 static void __exit ah6_fini(void)
 {
         if (inet6_del_protocol(&ah6_protocol, IPPROTO_AH) < 0)
-                printk(KERN_INFO "ipv6 ah close: can't remove protocol\n");
+                pr_info("%s: can't remove protocol\n", __func__);
 
         if (xfrm_unregister_type(&ah6_type, AF_INET6) < 0)
-                printk(KERN_INFO "ipv6 ah close: can't remove xfrm type\n");
+                pr_info("%s: can't remove xfrm type\n", __func__);
 
 }
 
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 59402b4637f9..cdf02be5f191 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -211,35 +211,6 @@ void ipv6_sock_ac_close(struct sock *sk)
         rcu_read_unlock();
 }
 
-#if 0
-/* The function is not used, which is funny. Apparently, author
- * supposed to use it to filter out datagrams inside udp/raw but forgot.
- *
- * It is OK, anycasts are not special comparing to delivery to unicasts.
- */
-
-int inet6_ac_check(struct sock *sk, struct in6_addr *addr, int ifindex)
-{
-        struct ipv6_ac_socklist *pac;
-        struct ipv6_pinfo *np = inet6_sk(sk);
-        int     found;
-
-        found = 0;
-        read_lock(&ipv6_sk_ac_lock);
-        for (pac=np->ipv6_ac_list; pac; pac=pac->acl_next) {
-                if (ifindex && pac->acl_ifindex != ifindex)
-                        continue;
-                found = ipv6_addr_equal(&pac->acl_addr, addr);
-                if (found)
-                        break;
-        }
-        read_unlock(&ipv6_sk_ac_lock);
-
-        return found;
-}
-
-#endif
-
 static void aca_put(struct ifacaddr6 *ac)
 {
         if (atomic_dec_and_test(&ac->aca_refcnt)) {
@@ -371,7 +342,7 @@ static int ipv6_dev_ac_dec(struct net_device *dev, const struct in6_addr *addr)
  *      check if the interface has this anycast address
  *      called with rcu_read_lock()
  */
-static int ipv6_chk_acast_dev(struct net_device *dev, const struct in6_addr *addr)
+static bool ipv6_chk_acast_dev(struct net_device *dev, const struct in6_addr *addr)
 {
         struct inet6_dev *idev;
         struct ifacaddr6 *aca;
@@ -385,16 +356,16 @@ static int ipv6_chk_acast_dev(struct net_device *dev, const struct in6_addr *add
                 read_unlock_bh(&idev->lock);
                 return aca != NULL;
         }
-        return 0;
+        return false;
 }
 
 /*
  *      check if given interface (or any, if dev==0) has this anycast address
  */
-int ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
-                        const struct in6_addr *addr)
+bool ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
+                         const struct in6_addr *addr)
 {
-        int found = 0;
+        bool found = false;
 
         rcu_read_lock();
         if (dev)
@@ -402,7 +373,7 @@ int ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
         else
                 for_each_netdev_rcu(net, dev)
                         if (ipv6_chk_acast_dev(dev, addr)) {
-                                found = 1;
+                                found = true;
                                 break;
                         }
         rcu_read_unlock();
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 251e7cd75e89..be2b67d631e5 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -22,6 +22,7 @@
 #include <linux/ipv6.h>
 #include <linux/route.h>
 #include <linux/slab.h>
+#include <linux/export.h>
 
 #include <net/ipv6.h>
 #include <net/ndisc.h>
@@ -33,9 +34,9 @@
 #include <linux/errqueue.h>
 #include <asm/uaccess.h>
 
-static inline int ipv6_mapped_addr_any(const struct in6_addr *a)
+static bool ipv6_mapped_addr_any(const struct in6_addr *a)
 {
-        return (ipv6_addr_v4mapped(a) && (a->s6_addr32[3] == 0));
+        return ipv6_addr_v4mapped(a) && (a->s6_addr32[3] == 0);
 }
 
 int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
@@ -98,7 +99,7 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 sin.sin_port = usin->sin6_port;
 
                 err = ip4_datagram_connect(sk,
-                                           (struct sockaddr*) &sin,
+                                           (struct sockaddr *) &sin,
                                            sizeof(sin));
 
 ipv4_connected:
@@ -202,6 +203,7 @@ out:
         fl6_sock_release(flowlabel);
         return err;
 }
+EXPORT_SYMBOL_GPL(ip6_datagram_connect);
 
 void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
                      __be16 port, u32 info, u8 *payload)
@@ -414,6 +416,7 @@ out_free_skb:
 out:
         return err;
 }
+EXPORT_SYMBOL_GPL(ipv6_recv_error);
 
 /*
  *      Handle IPV6_RECVPATHMTU
@@ -485,7 +488,7 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
         }
 
         if (np->rxopt.bits.rxtclass) {
-                int tclass = (ntohl(*(__be32 *)ipv6_hdr(skb)) >> 20) & 0xff;
+                int tclass = ipv6_tclass(ipv6_hdr(skb));
                 put_cmsg(msg, SOL_IPV6, IPV6_TCLASS, sizeof(tclass), &tclass);
         }
 
@@ -515,10 +518,10 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
                 u8 nexthdr = ipv6_hdr(skb)->nexthdr;
 
                 while (off <= opt->lastopt) {
-                        unsigned len;
+                        unsigned int len;
                         u8 *ptr = nh + off;
 
-                        switch(nexthdr) {
+                        switch (nexthdr) {
                         case IPPROTO_DSTOPTS:
                                 nexthdr = ptr[0];
                                 len = (ptr[1] + 1) << 3;
@@ -827,9 +830,8 @@ int datagram_send_ctl(struct net *net, struct sock *sk,
                         int tc;
 
                         err = -EINVAL;
-                        if (cmsg->cmsg_len != CMSG_LEN(sizeof(int))) {
+                        if (cmsg->cmsg_len != CMSG_LEN(sizeof(int)))
                                 goto exit_f;
-                        }
 
                         tc = *(int *)CMSG_DATA(cmsg);
                         if (tc < -1 || tc > 0xff)
@@ -846,9 +848,8 @@ int datagram_send_ctl(struct net *net, struct sock *sk,
                         int df;
 
                         err = -EINVAL;
-                        if (cmsg->cmsg_len != CMSG_LEN(sizeof(int))) {
+                        if (cmsg->cmsg_len != CMSG_LEN(sizeof(int)))
                                 goto exit_f;
-                        }
 
                         df = *(int *)CMSG_DATA(cmsg);
                         if (df < 0 || df > 1)
@@ -870,3 +871,4 @@ int datagram_send_ctl(struct net *net, struct sock *sk,
 exit_f:
         return err;
 }
+EXPORT_SYMBOL_GPL(datagram_send_ctl);
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 1ac7938dd9ec..db1521fcda5b 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -24,6 +24,8 @@
  *      This file is derived from net/ipv4/esp.c
  */
 
+#define pr_fmt(fmt) "IPv6: " fmt
+
 #include <crypto/aead.h>
 #include <crypto/authenc.h>
 #include <linux/err.h>
@@ -411,19 +413,15 @@ static u32 esp6_get_mtu(struct xfrm_state *x, int mtu)
         struct esp_data *esp = x->data;
         u32 blksize = ALIGN(crypto_aead_blocksize(esp->aead), 4);
         u32 align = max_t(u32, blksize, esp->padlen);
-        u32 rem;
-
-        mtu -= x->props.header_len + crypto_aead_authsize(esp->aead);
-        rem = mtu & (align - 1);
-        mtu &= ~(align - 1);
+        unsigned int net_adj;
 
-        if (x->props.mode != XFRM_MODE_TUNNEL) {
-                u32 padsize = ((blksize - 1) & 7) + 1;
-                mtu -= blksize - padsize;
-                mtu += min_t(u32, blksize - padsize, rem);
-        }
+        if (x->props.mode != XFRM_MODE_TUNNEL)
+                net_adj = sizeof(struct ipv6hdr);
+        else
+                net_adj = 0;
 
-        return mtu - 2;
+        return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
+                 net_adj) & ~(align - 1)) + (net_adj - 2);
 }
 
 static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
@@ -442,8 +440,8 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                               esph->spi, IPPROTO_ESP, AF_INET6);
         if (!x)
                 return;
-        printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%pI6\n",
-                        ntohl(esph->spi), &iph->daddr);
+        pr_debug("pmtu discovery on SA ESP/%08x/%pI6\n",
+                 ntohl(esph->spi), &iph->daddr);
         xfrm_state_put(x);
 }
 
@@ -651,11 +649,11 @@ static const struct inet6_protocol esp6_protocol = {
 static int __init esp6_init(void)
 {
         if (xfrm_register_type(&esp6_type, AF_INET6) < 0) {
-                printk(KERN_INFO "ipv6 esp init: can't add xfrm type\n");
+                pr_info("%s: can't add xfrm type\n", __func__);
                 return -EAGAIN;
         }
         if (inet6_add_protocol(&esp6_protocol, IPPROTO_ESP) < 0) {
-                printk(KERN_INFO "ipv6 esp init: can't add protocol\n");
+                pr_info("%s: can't add protocol\n", __func__);
                 xfrm_unregister_type(&esp6_type, AF_INET6);
                 return -EAGAIN;
         }
@@ -666,9 +664,9 @@ static int __init esp6_init(void)
 static void __exit esp6_fini(void)
 {
         if (inet6_del_protocol(&esp6_protocol, IPPROTO_ESP) < 0)
-                printk(KERN_INFO "ipv6 esp close: can't remove protocol\n");
+                pr_info("%s: can't remove protocol\n", __func__);
         if (xfrm_unregister_type(&esp6_type, AF_INET6) < 0)
-                printk(KERN_INFO "ipv6 esp close: can't remove xfrm type\n");
+                pr_info("%s: can't remove xfrm type\n", __func__);
 }
 
 module_init(esp6_init);
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 3d641b6e9b09..6447dc49429f 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -75,7 +75,7 @@ int ipv6_find_tlv(struct sk_buff *skb, int offset, int type)
                         return offset;
 
                 switch (opttype) {
-                case IPV6_TLV_PAD0:
+                case IPV6_TLV_PAD1:
                         optlen = 1;
                         break;
                 default:
@@ -96,14 +96,14 @@ EXPORT_SYMBOL_GPL(ipv6_find_tlv);
 /*
  *      Parsing tlv encoded headers.
  *
- *      Parsing function "func" returns 1, if parsing succeed
- *      and 0, if it failed.
+ *      Parsing function "func" returns true, if parsing succeed
+ *      and false, if it failed.
  *      It MUST NOT touch skb->h.
  */
 
 struct tlvtype_proc {
         int     type;
-        int     (*func)(struct sk_buff *skb, int offset);
+        bool    (*func)(struct sk_buff *skb, int offset);
 };
 
 /*********************
@@ -112,11 +112,11 @@ struct tlvtype_proc {
 
 /* An unknown option is detected, decide what to do */
 
-static int ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
+static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
 {
         switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
         case 0: /* ignore */
-                return 1;
+                return true;
 
         case 1: /* drop packet */
                 break;
@@ -129,21 +129,22 @@ static int ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
                         break;
         case 2: /* send ICMP PARM PROB regardless and drop packet */
                 icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
-                return 0;
+                return false;
         }
 
         kfree_skb(skb);
-        return 0;
+        return false;
 }
 
 /* Parse tlv encoded option header (hop-by-hop or destination) */
 
-static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff *skb)
+static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
 {
-        struct tlvtype_proc *curr;
+        const struct tlvtype_proc *curr;
         const unsigned char *nh = skb_network_header(skb);
         int off = skb_network_header_len(skb);
         int len = (skb_transport_header(skb)[1] + 1) << 3;
+        int padlen = 0;
 
         if (skb_transport_offset(skb) + len > skb_headlen(skb))
                 goto bad;
@@ -153,13 +154,33 @@ static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff *skb)
 
         while (len > 0) {
                 int optlen = nh[off + 1] + 2;
+                int i;
 
                 switch (nh[off]) {
-                case IPV6_TLV_PAD0:
+                case IPV6_TLV_PAD1:
                         optlen = 1;
+                        padlen++;
+                        if (padlen > 7)
+                                goto bad;
                         break;
 
                 case IPV6_TLV_PADN:
+                        /* RFC 2460 states that the purpose of PadN is
+                         * to align the containing header to multiples
+                         * of 8. 7 is therefore the highest valid value.
+                         * See also RFC 4942, Section 2.1.9.5.
+                         */
+                        padlen += optlen;
+                        if (padlen > 7)
+                                goto bad;
+                        /* RFC 4942 recommends receiving hosts to
+                         * actively check PadN payload to contain
+                         * only zeroes.
+                         */
+                        for (i = 2; i < optlen; i++) {
+                                if (nh[off + i] != 0)
+                                        goto bad;
+                        }
                         break;
 
                 default: /* Other TLV code so scan list */
@@ -170,25 +191,33 @@ static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff *skb)
                                         /* type specific length/alignment
                                            checks will be performed in the
                                            func(). */
-                                        if (curr->func(skb, off) == 0)
-                                                return 0;
+                                        if (curr->func(skb, off) == false)
+                                                return false;
                                         break;
                                 }
                         }
                         if (curr->type < 0) {
                                 if (ip6_tlvopt_unknown(skb, off) == 0)
-                                        return 0;
+                                        return false;
                         }
+                        padlen = 0;
                         break;
                 }
                 off += optlen;
                 len -= optlen;
         }
+        /* This case will not be caught by above check since its padding
+         * length is smaller than 7:
+         * 1 byte NH + 1 byte Length + 6 bytes Padding
+         */
+        if ((padlen == 6) && ((off - skb_network_header_len(skb)) == 8))
+                goto bad;
+
         if (len == 0)
-                return 1;
+                return true;
 bad:
         kfree_skb(skb);
-        return 0;
+        return false;
 }
 
 /*****************************
@@ -196,7 +225,7 @@ bad:
  *****************************/
 
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
-static int ipv6_dest_hao(struct sk_buff *skb, int optoff)
+static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
 {
         struct ipv6_destopt_hao *hao;
         struct inet6_skb_parm *opt = IP6CB(skb);
@@ -250,15 +279,15 @@ static int ipv6_dest_hao(struct sk_buff *skb, int optoff)
         if (skb->tstamp.tv64 == 0)
                 __net_timestamp(skb);
 
-        return 1;
+        return true;
 
  discard:
         kfree_skb(skb);
-        return 0;
+        return false;
 }
 #endif
 
-static struct tlvtype_proc tlvprocdestopt_lst[] = {
+static const struct tlvtype_proc tlvprocdestopt_lst[] = {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
         {
                 .type   = IPV6_TLV_HAO,
@@ -563,23 +592,23 @@ static inline struct net *ipv6_skb_net(struct sk_buff *skb)
 
 /* Router Alert as of RFC 2711 */
 
-static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
+static bool ipv6_hop_ra(struct sk_buff *skb, int optoff)
 {
         const unsigned char *nh = skb_network_header(skb);
 
         if (nh[optoff + 1] == 2) {
                 IP6CB(skb)->ra = optoff;
-                return 1;
+                return true;
         }
         LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_ra: wrong RA length %d\n",
                        nh[optoff + 1]);
         kfree_skb(skb);
-        return 0;
+        return false;
 }
 
 /* Jumbo payload */
 
-static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
+static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 {
         const unsigned char *nh = skb_network_header(skb);
         struct net *net = ipv6_skb_net(skb);
@@ -598,13 +627,13 @@ static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
                 IP6_INC_STATS_BH(net, ipv6_skb_idev(skb),
                                  IPSTATS_MIB_INHDRERRORS);
                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
-                return 0;
+                return false;
         }
         if (ipv6_hdr(skb)->payload_len) {
                 IP6_INC_STATS_BH(net, ipv6_skb_idev(skb),
                                  IPSTATS_MIB_INHDRERRORS);
                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
-                return 0;
+                return false;
         }
 
         if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
@@ -616,14 +645,14 @@ static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
         if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
                 goto drop;
 
-        return 1;
+        return true;
 
 drop:
         kfree_skb(skb);
-        return 0;
+        return false;
 }
 
-static struct tlvtype_proc tlvprochopopt_lst[] = {
+static const struct tlvtype_proc tlvprochopopt_lst[] = {
         {
                 .type   = IPV6_TLV_ROUTERALERT,
                 .func   = ipv6_hop_ra,
@@ -722,7 +751,6 @@ void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
         if (opt->hopopt)
                 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
 }
-
 EXPORT_SYMBOL(ipv6_push_nfrag_opts);
 
 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
@@ -738,20 +766,19 @@ ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
 
         opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
         if (opt2) {
-                long dif = (char*)opt2 - (char*)opt;
+                long dif = (char *)opt2 - (char *)opt;
                 memcpy(opt2, opt, opt->tot_len);
                 if (opt2->hopopt)
-                        *((char**)&opt2->hopopt) += dif;
+                        *((char **)&opt2->hopopt) += dif;
                 if (opt2->dst0opt)
-                        *((char**)&opt2->dst0opt) += dif;
+                        *((char **)&opt2->dst0opt) += dif;
                 if (opt2->dst1opt)
-                        *((char**)&opt2->dst1opt) += dif;
+                        *((char **)&opt2->dst1opt) += dif;
                 if (opt2->srcrt)
-                        *((char**)&opt2->srcrt) += dif;
+                        *((char **)&opt2->srcrt) += dif;
         }
         return opt2;
 }
-
 EXPORT_SYMBOL_GPL(ipv6_dup_options);
 
 static int ipv6_renew_option(void *ohdr,
@@ -869,6 +896,7 @@ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
 
         return opt;
 }
+EXPORT_SYMBOL_GPL(ipv6_fixup_options);
 
 /**
  * fl6_update_dst - update flowi destination address with info given
@@ -892,5 +920,4 @@ struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
         fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
         return orig;
 }
-
 EXPORT_SYMBOL_GPL(fl6_update_dst);
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index 72957f4a7c6c..f73d59a14131 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -9,7 +9,7 @@
  * find out if nexthdr is a well-known extension header or a protocol
  */
 
-int ipv6_ext_hdr(u8 nexthdr)
+bool ipv6_ext_hdr(u8 nexthdr)
 {
         /*
          * find out if nexthdr is an extension header or a protocol
@@ -21,6 +21,7 @@ int ipv6_ext_hdr(u8 nexthdr)
                  (nexthdr == NEXTHDR_NONE)      ||
                  (nexthdr == NEXTHDR_DEST);
 }
+EXPORT_SYMBOL(ipv6_ext_hdr);
 
 /*
  * Skip any extension headers. This is used by the ICMP module.
@@ -109,6 +110,4 @@ int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp,
         *nexthdrp = nexthdr;
         return start;
 }
-
-EXPORT_SYMBOL(ipv6_ext_hdr);
 EXPORT_SYMBOL(ipv6_skip_exthdr);
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index b6c573152067..0ff1cfd55bc4 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -22,8 +22,7 @@
 #include <net/ip6_route.h>
 #include <net/netlink.h>
 
-struct fib6_rule
-{
+struct fib6_rule {
         struct fib_rule         common;
         struct rt6key           src;
         struct rt6key           dst;
@@ -215,14 +214,13 @@ static int fib6_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
         frh->src_len = rule6->src.plen;
         frh->tos = rule6->tclass;
 
-        if (rule6->dst.plen)
-                NLA_PUT(skb, FRA_DST, sizeof(struct in6_addr),
-                        &rule6->dst.addr);
-
-        if (rule6->src.plen)
-                NLA_PUT(skb, FRA_SRC, sizeof(struct in6_addr),
-                        &rule6->src.addr);
-
+        if ((rule6->dst.plen &&
+             nla_put(skb, FRA_DST, sizeof(struct in6_addr),
+                     &rule6->dst.addr)) ||
+            (rule6->src.plen &&
+             nla_put(skb, FRA_SRC, sizeof(struct in6_addr),
+                     &rule6->src.addr)))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 01d46bff63c3..091a2971c7b7 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -29,6 +29,8 @@
  *      Kazunori MIYAZAWA @USAGI:       change output process to use ip6_append_data
  */
 
+#define pr_fmt(fmt) "IPv6: " fmt
+
 #include <linux/module.h>
 #include <linux/errno.h>
 #include <linux/types.h>
@@ -66,7 +68,6 @@
 #include <net/inet_common.h>
 
 #include <asm/uaccess.h>
-#include <asm/system.h>
 
 /*
  *      The ICMP socket(s). This is the most convenient way to flow control
@@ -130,7 +131,7 @@ void icmpv6_param_prob(struct sk_buff *skb, u8 code, int pos)
  *      --ANK (980726)
  */
 
-static int is_ineligible(struct sk_buff *skb)
+static bool is_ineligible(const struct sk_buff *skb)
 {
         int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
         int len = skb->len - ptr;
@@ -138,11 +139,11 @@ static int is_ineligible(struct sk_buff *skb)
         __be16 frag_off;
 
         if (len < 0)
-                return 1;
+                return true;
 
         ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off);
         if (ptr < 0)
-                return 0;
+                return false;
         if (nexthdr == IPPROTO_ICMPV6) {
                 u8 _type, *tp;
                 tp = skb_header_pointer(skb,
@@ -150,9 +151,9 @@ static int is_ineligible(struct sk_buff *skb)
                         sizeof(_type), &_type);
                 if (tp == NULL ||
                     !(*tp & ICMPV6_INFOMSG_MASK))
-                        return 1;
+                        return true;
         }
-        return 0;
+        return false;
 }
 
 /*
@@ -207,14 +208,14 @@ static inline bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
  *      highest-order two bits set to 10
  */
 
-static __inline__ int opt_unrec(struct sk_buff *skb, __u32 offset)
+static bool opt_unrec(struct sk_buff *skb, __u32 offset)
 {
         u8 _optval, *op;
 
         offset += skb_network_offset(skb);
         op = skb_header_pointer(skb, offset, sizeof(_optval), &_optval);
         if (op == NULL)
-                return 1;
+                return true;
         return (*op & 0xC0) == 0x80;
 }
 
@@ -468,6 +469,8 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
 
         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
                 fl6.flowi6_oif = np->mcast_oif;
+        else if (!fl6.flowi6_oif)
+                fl6.flowi6_oif = np->ucast_oif;
 
         dst = icmpv6_route_lookup(net, skb, sk, &fl6);
         if (IS_ERR(dst))
@@ -497,7 +500,7 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
         err = ip6_append_data(sk, icmpv6_getfrag, &msg,
                               len + sizeof(struct icmp6hdr),
                               sizeof(struct icmp6hdr), hlimit,
-                              np->tclass, NULL, &fl6, (struct rt6_info*)dst,
+                              np->tclass, NULL, &fl6, (struct rt6_info *)dst,
                               MSG_DONTWAIT, np->dontfrag);
         if (err) {
                 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
@@ -553,6 +556,8 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
 
         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
                 fl6.flowi6_oif = np->mcast_oif;
+        else if (!fl6.flowi6_oif)
+                fl6.flowi6_oif = np->ucast_oif;
 
         err = ip6_dst_lookup(sk, &dst, &fl6);
         if (err)
@@ -576,7 +581,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
 
         err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
                                 sizeof(struct icmp6hdr), hlimit, np->tclass, NULL, &fl6,
-                                (struct rt6_info*)dst, MSG_DONTWAIT,
+                                (struct rt6_info *)dst, MSG_DONTWAIT,
                                 np->dontfrag);
 
         if (err) {
@@ -817,9 +822,7 @@ static int __net_init icmpv6_sk_init(struct net *net)
                 err = inet_ctl_sock_create(&sk, PF_INET6,
                                            SOCK_RAW, IPPROTO_ICMPV6, net);
                 if (err < 0) {
-                        printk(KERN_ERR
-                               "Failed to initialize the ICMP6 control socket "
-                               "(err %d).\n",
+                        pr_err("Failed to initialize the ICMP6 control socket (err %d)\n",
                                err);
                         goto fail;
                 }
@@ -878,7 +881,7 @@ int __init icmpv6_init(void)
         return 0;
 
 fail:
-        printk(KERN_ERR "Failed to register ICMP6 protocol\n");
+        pr_err("Failed to register ICMP6 protocol\n");
         unregister_pernet_subsys(&icmpv6_sk_ops);
         return err;
 }
@@ -947,7 +950,6 @@ int icmpv6_err_convert(u8 type, u8 code, int *err)
 
         return fatal;
 }
-
 EXPORT_SYMBOL(icmpv6_err_convert);
 
 #ifdef CONFIG_SYSCTL
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 02dd203d9eac..e6cee5292a0b 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -28,7 +28,7 @@
 #include <net/inet6_connection_sock.h>
 
 int inet6_csk_bind_conflict(const struct sock *sk,
-                            const struct inet_bind_bucket *tb)
+                            const struct inet_bind_bucket *tb, bool relax)
 {
         const struct sock *sk2;
         const struct hlist_node *node;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index b82bcde53f7a..0c220a416626 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -18,6 +18,9 @@
  *                              routing table.
  *      Ville Nuorvala:         Fixed routing subtrees.
  */
+
+#define pr_fmt(fmt) "IPv6: " fmt
+
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/net.h>
@@ -38,7 +41,7 @@
 #define RT6_DEBUG 2
 
 #if RT6_DEBUG >= 3
-#define RT6_TRACE(x...) printk(KERN_DEBUG x)
+#define RT6_TRACE(x...) pr_debug(x)
 #else
 #define RT6_TRACE(x...) do { ; } while (0)
 #endif
@@ -451,12 +454,10 @@ static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr,
                     !ipv6_prefix_equal(&key->addr, addr, fn->fn_bit)) {
                         if (!allow_create) {
                                 if (replace_required) {
-                                        pr_warn("IPv6: Can't replace route, "
-                                                "no match found\n");
+                                        pr_warn("Can't replace route, no match found\n");
                                         return ERR_PTR(-ENOENT);
                                 }
-                                pr_warn("IPv6: NLM_F_CREATE should be set "
-                                        "when creating new route\n");
+                                pr_warn("NLM_F_CREATE should be set when creating new route\n");
                         }
                         goto insert_above;
                 }
@@ -499,11 +500,10 @@ static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr,
                  * That would keep IPv6 consistent with IPv4
                  */
                 if (replace_required) {
-                        pr_warn("IPv6: Can't replace route, no match found\n");
+                        pr_warn("Can't replace route, no match found\n");
                         return ERR_PTR(-ENOENT);
                 }
-                pr_warn("IPv6: NLM_F_CREATE should be set "
-                        "when creating new route\n");
+                pr_warn("NLM_F_CREATE should be set when creating new route\n");
         }
         /*
          *      We walked to the bottom of tree.
@@ -673,11 +673,10 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                                             &rt->rt6i_gateway)) {
                                 if (!(iter->rt6i_flags & RTF_EXPIRES))
                                         return -EEXIST;
-                                iter->dst.expires = rt->dst.expires;
-                                if (!(rt->rt6i_flags & RTF_EXPIRES)) {
-                                        iter->rt6i_flags &= ~RTF_EXPIRES;
-                                        iter->dst.expires = 0;
-                                }
+                                if (!(rt->rt6i_flags & RTF_EXPIRES))
+                                        rt6_clean_expires(iter);
+                                else
+                                        rt6_set_expires(iter, rt->dst.expires);
                                 return -EEXIST;
                         }
                 }
@@ -697,7 +696,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
          */
         if (!replace) {
                 if (!add)
-                        pr_warn("IPv6: NLM_F_CREATE should be set when creating new route\n");
+                        pr_warn("NLM_F_CREATE should be set when creating new route\n");
 
 add:
                 rt->dst.rt6_next = iter;
@@ -716,7 +715,7 @@ add:
                 if (!found) {
                         if (add)
                                 goto add;
-                        pr_warn("IPv6: NLM_F_REPLACE set, but no existing node found!\n");
+                        pr_warn("NLM_F_REPLACE set, but no existing node found!\n");
                         return -ENOENT;
                 }
                 *ins = rt;
@@ -769,7 +768,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
                         replace_required = 1;
         }
         if (!allow_create && !replace_required)
-                pr_warn("IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE\n");
+                pr_warn("RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE\n");
 
         fn = fib6_add_1(root, &rt->rt6i_dst.addr, sizeof(struct in6_addr),
                         rt->rt6i_dst.plen, offsetof(struct rt6_info, rt6i_dst),
@@ -1421,7 +1420,8 @@ static int fib6_clean_node(struct fib6_walker_t *w)
                         res = fib6_del(rt, &info);
                         if (res) {
 #if RT6_DEBUG >= 2
-                                printk(KERN_DEBUG "fib6_clean_node: del failed: rt=%p@%p err=%d\n", rt, rt->rt6i_node, res);
+                                pr_debug("%s: del failed: rt=%p@%p err=%d\n",
+                                         __func__, rt, rt->rt6i_node, res);
 #endif
                                 continue;
                         }
@@ -1552,11 +1552,20 @@ static int fib6_age(struct rt6_info *rt, void *arg)
                     time_after_eq(now, rt->dst.lastuse + gc_args.timeout)) {
                         RT6_TRACE("aging clone %p\n", rt);
                         return -1;
-                } else if ((rt->rt6i_flags & RTF_GATEWAY) &&
-                           (!(dst_get_neighbour_noref_raw(&rt->dst)->flags & NTF_ROUTER))) {
-                        RT6_TRACE("purging route %p via non-router but gateway\n",
-                                  rt);
-                        return -1;
+                } else if (rt->rt6i_flags & RTF_GATEWAY) {
+                        struct neighbour *neigh;
+                        __u8 neigh_flags = 0;
+
+                        neigh = dst_neigh_lookup(&rt->dst, &rt->rt6i_gateway);
+                        if (neigh) {
+                                neigh_flags = neigh->flags;
+                                neigh_release(neigh);
+                        }
+                        if (neigh_flags & NTF_ROUTER) {
+                                RT6_TRACE("purging route %p via non-router but gateway\n",
+                                          rt);
+                                return -1;
+                        }
                 }
                 gc_args.more++;
         }
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index b7867a1215b1..9772fbd8a3f5 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -294,6 +294,7 @@ struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions * opt_space,
         opt_space->opt_flen = fopt->opt_flen;
         return opt_space;
 }
+EXPORT_SYMBOL_GPL(fl6_merge_options);
 
 static unsigned long check_linger(unsigned long ttl)
 {
@@ -432,32 +433,32 @@ static int mem_check(struct sock *sk)
         return 0;
 }
 
-static int ipv6_hdr_cmp(struct ipv6_opt_hdr *h1, struct ipv6_opt_hdr *h2)
+static bool ipv6_hdr_cmp(struct ipv6_opt_hdr *h1, struct ipv6_opt_hdr *h2)
 {
         if (h1 == h2)
-                return 0;
+                return false;
         if (h1 == NULL || h2 == NULL)
-                return 1;
+                return true;
         if (h1->hdrlen != h2->hdrlen)
-                return 1;
+                return true;
         return memcmp(h1+1, h2+1, ((h1->hdrlen+1)<<3) - sizeof(*h1));
 }
 
-static int ipv6_opt_cmp(struct ipv6_txoptions *o1, struct ipv6_txoptions *o2)
+static bool ipv6_opt_cmp(struct ipv6_txoptions *o1, struct ipv6_txoptions *o2)
 {
         if (o1 == o2)
-                return 0;
+                return false;
         if (o1 == NULL || o2 == NULL)
-                return 1;
+                return true;
         if (o1->opt_nflen != o2->opt_nflen)
-                return 1;
+                return true;
         if (ipv6_hdr_cmp(o1->hopopt, o2->hopopt))
-                return 1;
+                return true;
         if (ipv6_hdr_cmp(o1->dst0opt, o2->dst0opt))
-                return 1;
+                return true;
         if (ipv6_hdr_cmp((struct ipv6_opt_hdr *)o1->srcrt, (struct ipv6_opt_hdr *)o2->srcrt))
-                return 1;
-        return 0;
+                return true;
+        return false;
 }
 
 static inline void fl_link(struct ipv6_pinfo *np, struct ipv6_fl_socklist *sfl,
@@ -705,9 +706,9 @@ static int ip6fl_seq_show(struct seq_file *seq, void *v)
                 struct ip6_flowlabel *fl = v;
                 seq_printf(seq,
                            "%05X %-1d %-6d %-6d %-6ld %-8ld %pi6 %-4d\n",
-                           (unsigned)ntohl(fl->label),
+                           (unsigned int)ntohl(fl->label),
                            fl->share,
-                           (unsigned)fl->owner,
+                           (int)fl->owner,
                            atomic_read(&fl->users),
                            fl->linger/HZ,
                            (long)(fl->expires - jiffies)/HZ,
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 1ca5d45a12e8..21a15dfe4a9e 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -170,7 +170,8 @@ static int ip6_input_finish(struct sk_buff *skb)
 {
         const struct inet6_protocol *ipprot;
         unsigned int nhoff;
-        int nexthdr, raw;
+        int nexthdr;
+        bool raw;
         u8 hash;
         struct inet6_dev *idev;
         struct net *net = dev_net(skb_dst(skb)->dev);
@@ -251,7 +252,7 @@ int ip6_input(struct sk_buff *skb)
 int ip6_mc_input(struct sk_buff *skb)
 {
         const struct ipv6hdr *hdr;
-        int deliver;
+        bool deliver;
 
         IP6_UPD_PO_STATS_BH(dev_net(skb_dst(skb)->dev),
                          ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_INMCAST,
@@ -287,7 +288,7 @@ int ip6_mc_input(struct sk_buff *skb)
                          * is for MLD (0x0000).
                          */
                         if ((ptr[2] | ptr[3]) == 0) {
-                                deliver = 0;
+                                deliver = false;
 
                                 if (!ipv6_ext_hdr(nexthdr)) {
                                         /* BUG */
@@ -312,7 +313,7 @@ int ip6_mc_input(struct sk_buff *skb)
                                 case ICMPV6_MGM_REPORT:
                                 case ICMPV6_MGM_REDUCTION:
                                 case ICMPV6_MLD2_REPORT:
-                                        deliver = 1;
+                                        deliver = true;
                                         break;
                                 }
                                 goto out;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index d97e07183ce9..17b8c67998bb 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -210,7 +210,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
                                 kfree_skb(skb);
                                 return -ENOBUFS;
                         }
-                        kfree_skb(skb);
+                        consume_skb(skb);
                         skb = skb2;
                         skb_set_owner_w(skb, sk);
                 }
@@ -252,8 +252,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
                                dst->dev, dst_output);
         }
 
-        if (net_ratelimit())
-                printk(KERN_DEBUG "IPv6: sending pkt_too_big to self\n");
+        net_dbg_ratelimited("IPv6: sending pkt_too_big to self\n");
         skb->dev = dst->dev;
         icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
@@ -388,7 +387,6 @@ int ip6_forward(struct sk_buff *skb)
         struct ipv6hdr *hdr = ipv6_hdr(skb);
         struct inet6_skb_parm *opt = IP6CB(skb);
         struct net *net = dev_net(dst->dev);
-        struct neighbour *n;
         u32 mtu;
 
         if (net->ipv6.devconf_all->forwarding == 0)
@@ -463,8 +461,7 @@ int ip6_forward(struct sk_buff *skb)
            send redirects to source routed frames.
            We don't send redirects to frames decapsulated from IPsec.
          */
-        n = dst_get_neighbour_noref(dst);
-        if (skb->dev == dst->dev && n && opt->srcrt == 0 && !skb_sec_path(skb)) {
+        if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
                 struct in6_addr *target = NULL;
                 struct rt6_info *rt;
 
@@ -474,8 +471,8 @@ int ip6_forward(struct sk_buff *skb)
                  */
 
                 rt = (struct rt6_info *) dst;
-                if ((rt->rt6i_flags & RTF_GATEWAY))
-                        target = (struct in6_addr*)&n->primary_key;
+                if (rt->rt6i_flags & RTF_GATEWAY)
+                        target = &rt->rt6i_gateway;
                 else
                         target = &hdr->daddr;
 
@@ -486,7 +483,7 @@ int ip6_forward(struct sk_buff *skb)
                    and by source (inside ndisc_send_redirect)
                  */
                 if (inet_peer_xrlim_allow(rt->rt6i_peer, 1*HZ))
-                        ndisc_send_redirect(skb, n, target);
+                        ndisc_send_redirect(skb, target);
         } else {
                 int addrtype = ipv6_addr_type(&hdr->saddr);
 
@@ -646,7 +643,10 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         /* We must not fragment if the socket is set to force MTU discovery
          * or if the skb it not generated by a local socket.
          */
-        if (!skb->local_df && skb->len > mtu) {
+        if (unlikely(!skb->local_df && skb->len > mtu)) {
+                if (skb->sk && dst_allfrag(skb_dst(skb)))
+                        sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);
+
                 skb->dev = skb_dst(skb)->dev;
                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
@@ -791,6 +791,10 @@ slow_path_clean:
         }
 
 slow_path:
+        if ((skb->ip_summed == CHECKSUM_PARTIAL) &&
+            skb_checksum_help(skb))
+                goto fail;
+
         left = skb->len - hlen;         /* Space per frame */
         ptr = hlen;                     /* Where to start from */
 
@@ -891,7 +895,7 @@ slow_path:
         }
         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
                       IPSTATS_MIB_FRAGOKS);
-        kfree_skb(skb);
+        consume_skb(skb);
         return err;
 
 fail:
@@ -1183,6 +1187,29 @@ static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
         return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
 }
 
+static void ip6_append_data_mtu(int *mtu,
+                                int *maxfraglen,
+                                unsigned int fragheaderlen,
+                                struct sk_buff *skb,
+                                struct rt6_info *rt)
+{
+        if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
+                if (skb == NULL) {
+                        /* first fragment, reserve header_len */
+                        *mtu = *mtu - rt->dst.header_len;
+
+                } else {
+                        /*
+                         * this fragment is not first, the headers
+                         * space is regarded as data space.
+                         */
+                        *mtu = dst_mtu(rt->dst.path);
+                }
+                *maxfraglen = ((*mtu - fragheaderlen) & ~7)
+                              + fragheaderlen - sizeof(struct frag_hdr);
+        }
+}
+
 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         int offset, int len, int odd, struct sk_buff *skb),
         void *from, int length, int transhdrlen,
@@ -1192,7 +1219,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct inet_cork *cork;
-        struct sk_buff *skb;
+        struct sk_buff *skb, *skb_prev = NULL;
         unsigned int maxfraglen, fragheaderlen;
         int exthdrlen;
         int dst_exthdrlen;
@@ -1201,7 +1228,6 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         int copy;
         int err;
         int offset = 0;
-        int csummode = CHECKSUM_NONE;
         __u8 tx_flags = 0;
 
         if (flags&MSG_PROBE)
@@ -1250,8 +1276,12 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 inet->cork.fl.u.ip6 = *fl6;
                 np->cork.hop_limit = hlimit;
                 np->cork.tclass = tclass;
-                mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
-                      rt->dst.dev->mtu : dst_mtu(&rt->dst);
+                if (rt->dst.flags & DST_XFRM_TUNNEL)
+                        mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
+                              rt->dst.dev->mtu : dst_mtu(&rt->dst);
+                else
+                        mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
+                              rt->dst.dev->mtu : dst_mtu(rt->dst.path);
                 if (np->frag_size < mtu) {
                         if (np->frag_size)
                                 mtu = np->frag_size;
@@ -1347,25 +1377,27 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                         unsigned int fraglen;
                         unsigned int fraggap;
                         unsigned int alloclen;
-                        struct sk_buff *skb_prev;
 alloc_new_skb:
-                        skb_prev = skb;
-
                         /* There's no room in the current skb */
-                        if (skb_prev)
-                                fraggap = skb_prev->len - maxfraglen;
+                        if (skb)
+                                fraggap = skb->len - maxfraglen;
                         else
                                 fraggap = 0;
+                        /* update mtu and maxfraglen if necessary */
+                        if (skb == NULL || skb_prev == NULL)
+                                ip6_append_data_mtu(&mtu, &maxfraglen,
+                                                    fragheaderlen, skb, rt);
+
+                        skb_prev = skb;
 
                         /*
                          * If remaining data exceeds the mtu,
                          * we know we need more fragment(s).
                          */
                         datalen = length + fraggap;
-                        if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
-                                datalen = maxfraglen - fragheaderlen;
 
-                        fraglen = datalen + fragheaderlen;
+                        if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
+                                datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
                         if ((flags & MSG_MORE) &&
                             !(rt->dst.dev->features&NETIF_F_SG))
                                 alloclen = mtu;
@@ -1374,13 +1406,16 @@ alloc_new_skb:
 
                         alloclen += dst_exthdrlen;
 
-                        /*
-                         * The last fragment gets additional space at tail.
-                         * Note: we overallocate on fragments with MSG_MODE
-                         * because we have no idea if we're the last one.
-                         */
-                        if (datalen == length + fraggap)
-                                alloclen += rt->dst.trailer_len;
+                        if (datalen != length + fraggap) {
+                                /*
+                                 * this is not the last fragment, the trailer
+                                 * space is regarded as data space.
+                                 */
+                                datalen += rt->dst.trailer_len;
+                        }
+
+                        alloclen += rt->dst.trailer_len;
+                        fraglen = datalen + fragheaderlen;
 
                         /*
                          * We just reserve space for fragment header.
@@ -1414,10 +1449,11 @@ alloc_new_skb:
                         /*
                          *      Fill in the control structures
                          */
-                        skb->ip_summed = csummode;
+                        skb->ip_summed = CHECKSUM_NONE;
                         skb->csum = 0;
-                        /* reserve for fragmentation */
-                        skb_reserve(skb, hh_len+sizeof(struct frag_hdr));
+                        /* reserve for fragmentation and ipsec header */
+                        skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
+                                    dst_exthdrlen);
 
                         if (sk->sk_type == SOCK_DGRAM)
                                 skb_shinfo(skb)->tx_flags = tx_flags;
@@ -1425,9 +1461,9 @@ alloc_new_skb:
                         /*
                          *      Find where to start putting bytes
                          */
-                        data = skb_put(skb, fraglen + dst_exthdrlen);
-                        skb_set_network_header(skb, exthdrlen + dst_exthdrlen);
-                        data += fragheaderlen + dst_exthdrlen;
+                        data = skb_put(skb, fraglen);
+                        skb_set_network_header(skb, exthdrlen);
+                        data += fragheaderlen;
                         skb->transport_header = (skb->network_header +
                                                  fragheaderlen);
                         if (fraggap) {
@@ -1456,7 +1492,6 @@ alloc_new_skb:
                         transhdrlen = 0;
                         exthdrlen = 0;
                         dst_exthdrlen = 0;
-                        csummode = CHECKSUM_NONE;
 
                         /*
                          * Put the packet on the pending queue
@@ -1536,6 +1571,7 @@ error:
         IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
         return err;
 }
+EXPORT_SYMBOL_GPL(ip6_append_data);
 
 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
 {
@@ -1639,6 +1675,7 @@ error:
         IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
         goto out;
 }
+EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
 
 void ip6_flush_pending_frames(struct sock *sk)
 {
@@ -1653,3 +1690,4 @@ void ip6_flush_pending_frames(struct sock *sk)
 
         ip6_cork_release(inet_sk(sk), inet6_sk(sk));
 }
+EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index aa21da6a09cd..c9015fad8d65 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -18,6 +18,8 @@
  *
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/capability.h>
 #include <linux/errno.h>
@@ -60,7 +62,7 @@ MODULE_LICENSE("GPL");
 MODULE_ALIAS_NETDEV("ip6tnl0");
 
 #ifdef IP6_TNL_DEBUG
-#define IP6_TNL_TRACE(x...) printk(KERN_DEBUG "%s:" x "\n", __func__)
+#define IP6_TNL_TRACE(x...) pr_debug("%s:" x "\n", __func__)
 #else
 #define IP6_TNL_TRACE(x...) do {;} while(0)
 #endif
@@ -198,7 +200,7 @@ ip6_tnl_bucket(struct ip6_tnl_net *ip6n, const struct ip6_tnl_parm *p)
 {
         const struct in6_addr *remote = &p->raddr;
         const struct in6_addr *local = &p->laddr;
-        unsigned h = 0;
+        unsigned int h = 0;
         int prio = 0;
 
         if (!ipv6_addr_any(remote) || !ipv6_addr_any(local)) {
@@ -460,19 +462,14 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
                 struct ipv6_tlv_tnl_enc_lim *tel;
                 __u32 mtu;
         case ICMPV6_DEST_UNREACH:
-                if (net_ratelimit())
-                        printk(KERN_WARNING
-                               "%s: Path to destination invalid "
-                               "or inactive!\n", t->parms.name);
+                net_warn_ratelimited("%s: Path to destination invalid or inactive!\n",
+                                     t->parms.name);
                 rel_msg = 1;
                 break;
         case ICMPV6_TIME_EXCEED:
                 if ((*code) == ICMPV6_EXC_HOPLIMIT) {
-                        if (net_ratelimit())
-                                printk(KERN_WARNING
-                                       "%s: Too small hop limit or "
-                                       "routing loop in tunnel!\n",
-                                       t->parms.name);
+                        net_warn_ratelimited("%s: Too small hop limit or routing loop in tunnel!\n",
+                                             t->parms.name);
                         rel_msg = 1;
                 }
                 break;
@@ -484,17 +481,13 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
                 if (teli && teli == *info - 2) {
                         tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli];
                         if (tel->encap_limit == 0) {
-                                if (net_ratelimit())
-                                        printk(KERN_WARNING
-                                               "%s: Too small encapsulation "
-                                               "limit or routing loop in "
-                                               "tunnel!\n", t->parms.name);
+                                net_warn_ratelimited("%s: Too small encapsulation limit or routing loop in tunnel!\n",
+                                                     t->parms.name);
                                 rel_msg = 1;
                         }
-                } else if (net_ratelimit()) {
-                        printk(KERN_WARNING
-                               "%s: Recipient unable to parse tunneled "
-                               "packet!\n ", t->parms.name);
+                } else {
+                        net_warn_ratelimited("%s: Recipient unable to parse tunneled packet!\n",
+                                             t->parms.name);
                 }
                 break;
         case ICMPV6_PKT_TOOBIG:
@@ -825,7 +818,7 @@ static void init_tel_txopt(struct ipv6_tel_txoption *opt, __u8 encap_limit)
  *   0 else
  **/
 
-static inline int
+static inline bool
 ip6_tnl_addr_conflict(const struct ip6_tnl *t, const struct ipv6hdr *hdr)
 {
         return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
@@ -845,15 +838,12 @@ static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
                         ldev = dev_get_by_index_rcu(net, p->link);
 
                 if (unlikely(!ipv6_chk_addr(net, &p->laddr, ldev, 0)))
-                        printk(KERN_WARNING
-                               "%s xmit: Local address not yet configured!\n",
-                               p->name);
+                        pr_warn("%s xmit: Local address not yet configured!\n",
+                                p->name);
                 else if (!ipv6_addr_is_multicast(&p->raddr) &&
                          unlikely(ipv6_chk_addr(net, &p->raddr, NULL, 0)))
-                        printk(KERN_WARNING
-                               "%s xmit: Routing loop! "
-                               "Remote address found on this node!\n",
-                               p->name);
+                        pr_warn("%s xmit: Routing loop! Remote address found on this node!\n",
+                                p->name);
                 else
                         ret = 1;
                 rcu_read_unlock();
@@ -919,10 +909,8 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
 
         if (tdev == dev) {
                 stats->collisions++;
-                if (net_ratelimit())
-                        printk(KERN_WARNING
-                               "%s: Local routing loop detected!\n",
-                               t->parms.name);
+                net_warn_ratelimited("%s: Local routing loop detected!\n",
+                                     t->parms.name);
                 goto tx_err_dst_release;
         }
         mtu = dst_mtu(dst) - sizeof (*ipv6h);
@@ -954,7 +942,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
 
                 if (skb->sk)
                         skb_set_owner_w(new_skb, skb->sk);
-                kfree_skb(skb);
+                consume_skb(skb);
                 skb = new_skb;
         }
         skb_dst_drop(skb);
@@ -1553,13 +1541,13 @@ static int __init ip6_tunnel_init(void)
 
         err = xfrm6_tunnel_register(&ip4ip6_handler, AF_INET);
         if (err < 0) {
-                printk(KERN_ERR "ip6_tunnel init: can't register ip4ip6\n");
+                pr_err("%s: can't register ip4ip6\n", __func__);
                 goto out_ip4ip6;
         }
 
         err = xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6);
         if (err < 0) {
-                printk(KERN_ERR "ip6_tunnel init: can't register ip6ip6\n");
+                pr_err("%s: can't register ip6ip6\n", __func__);
                 goto out_ip6ip6;
         }
 
@@ -1580,10 +1568,10 @@ out_pernet:
 static void __exit ip6_tunnel_cleanup(void)
 {
         if (xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET))
-                printk(KERN_INFO "ip6_tunnel close: can't deregister ip4ip6\n");
+                pr_info("%s: can't deregister ip4ip6\n", __func__);
 
         if (xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6))
-                printk(KERN_INFO "ip6_tunnel close: can't deregister ip6ip6\n");
+                pr_info("%s: can't deregister ip6ip6\n", __func__);
 
         unregister_pernet_device(&ip6_tnl_net_ops);
 }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 5aa3981a3922..b15dc08643a4 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -16,7 +16,6 @@
  *
  */
 
-#include <asm/system.h>
 #include <asm/uaccess.h>
 #include <linux/types.h>
 #include <linux/sched.h>
@@ -1148,8 +1147,7 @@ static int ip6mr_cache_report(struct mr6_table *mrt, struct sk_buff *pkt,
          */
         ret = sock_queue_rcv_skb(mrt->mroute6_sk, skb);
         if (ret < 0) {
-                if (net_ratelimit())
-                        printk(KERN_WARNING "mroute6: pending queue full, dropping entries.\n");
+                net_warn_ratelimited("mroute6: pending queue full, dropping entries\n");
                 kfree_skb(skb);
         }
 
@@ -1352,7 +1350,7 @@ int __init ip6_mr_init(void)
                 goto reg_notif_fail;
 #ifdef CONFIG_IPV6_PIMSM_V2
         if (inet6_add_protocol(&pim6_protocol, IPPROTO_PIM) < 0) {
-                printk(KERN_ERR "ip6_mr_init: can't add PIM protocol\n");
+                pr_err("%s: can't add PIM protocol\n", __func__);
                 err = -EAGAIN;
                 goto add_proto_fail;
         }
@@ -2216,14 +2214,15 @@ static int ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
         rtm->rtm_src_len  = 128;
         rtm->rtm_tos      = 0;
         rtm->rtm_table    = mrt->id;
-        NLA_PUT_U32(skb, RTA_TABLE, mrt->id);
+        if (nla_put_u32(skb, RTA_TABLE, mrt->id))
+                goto nla_put_failure;
         rtm->rtm_scope    = RT_SCOPE_UNIVERSE;
         rtm->rtm_protocol = RTPROT_UNSPEC;
         rtm->rtm_flags    = 0;
 
-        NLA_PUT(skb, RTA_SRC, 16, &c->mf6c_origin);
-        NLA_PUT(skb, RTA_DST, 16, &c->mf6c_mcastgrp);
-
+        if (nla_put(skb, RTA_SRC, 16, &c->mf6c_origin) ||
+            nla_put(skb, RTA_DST, 16, &c->mf6c_mcastgrp))
+                goto nla_put_failure;
         if (__ip6mr_fill_mroute(mrt, skb, c, rtm) < 0)
                 goto nla_put_failure;
 
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index bba658d9a03c..5cb75bfe45b1 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -30,6 +30,9 @@
  *  The decompression of IP datagram MUST be done after the reassembly,
  *  AH/ESP processing.
  */
+
+#define pr_fmt(fmt) "IPv6: " fmt
+
 #include <linux/module.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
@@ -69,8 +72,8 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (!x)
                 return;
 
-        printk(KERN_DEBUG "pmtu discovery on SA IPCOMP/%08x/%pI6\n",
-                        spi, &iph->daddr);
+        pr_debug("pmtu discovery on SA IPCOMP/%08x/%pI6\n",
+                 spi, &iph->daddr);
         xfrm_state_put(x);
 }
 
@@ -190,11 +193,11 @@ static const struct inet6_protocol ipcomp6_protocol =
 static int __init ipcomp6_init(void)
 {
         if (xfrm_register_type(&ipcomp6_type, AF_INET6) < 0) {
-                printk(KERN_INFO "ipcomp6 init: can't add xfrm type\n");
+                pr_info("%s: can't add xfrm type\n", __func__);
                 return -EAGAIN;
         }
         if (inet6_add_protocol(&ipcomp6_protocol, IPPROTO_COMP) < 0) {
-                printk(KERN_INFO "ipcomp6 init: can't add protocol\n");
+                pr_info("%s: can't add protocol\n", __func__);
                 xfrm_unregister_type(&ipcomp6_type, AF_INET6);
                 return -EAGAIN;
         }
@@ -204,9 +207,9 @@ static int __init ipcomp6_init(void)
 static void __exit ipcomp6_fini(void)
 {
         if (inet6_del_protocol(&ipcomp6_protocol, IPPROTO_COMP) < 0)
-                printk(KERN_INFO "ipv6 ipcomp close: can't remove protocol\n");
+                pr_info("%s: can't remove protocol\n", __func__);
         if (xfrm_unregister_type(&ipcomp6_type, AF_INET6) < 0)
-                printk(KERN_INFO "ipv6 ipcomp close: can't remove xfrm type\n");
+                pr_info("%s: can't remove xfrm type\n", __func__);
 }
 
 module_init(ipcomp6_init);
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 18a2719003c3..ba6d13d1f1e1 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -516,6 +516,36 @@ done:
                 retv = 0;
                 break;
 
+        case IPV6_UNICAST_IF:
+        {
+                struct net_device *dev = NULL;
+                int ifindex;
+
+                if (optlen != sizeof(int))
+                        goto e_inval;
+
+                ifindex = (__force int)ntohl((__force __be32)val);
+                if (ifindex == 0) {
+                        np->ucast_oif = 0;
+                        retv = 0;
+                        break;
+                }
+
+                dev = dev_get_by_index(net, ifindex);
+                retv = -EADDRNOTAVAIL;
+                if (!dev)
+                        break;
+                dev_put(dev);
+
+                retv = -EINVAL;
+                if (sk->sk_bound_dev_if)
+                        break;
+
+                np->ucast_oif = ifindex;
+                retv = 0;
+                break;
+        }
+
         case IPV6_MULTICAST_IF:
                 if (sk->sk_type == SOCK_STREAM)
                         break;
@@ -648,7 +678,6 @@ done:
         }
         case MCAST_MSFILTER:
         {
-                extern int sysctl_mld_max_msf;
                 struct group_filter *gsf;
 
                 if (optlen < GROUP_FILTER_SIZE(0))
@@ -913,7 +942,7 @@ static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt,
 }
 
 static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
-                    char __user *optval, int __user *optlen, unsigned flags)
+                    char __user *optval, int __user *optlen, unsigned int flags)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         int len;
@@ -987,6 +1016,10 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                                 int hlim = np->mcast_hops;
                                 put_cmsg(&msg, SOL_IPV6, IPV6_HOPLIMIT, sizeof(hlim), &hlim);
                         }
+                        if (np->rxopt.bits.rxtclass) {
+                                int tclass = np->rcv_tclass;
+                                put_cmsg(&msg, SOL_IPV6, IPV6_TCLASS, sizeof(tclass), &tclass);
+                        }
                         if (np->rxopt.bits.rxoinfo) {
                                 struct in6_pktinfo src_info;
                                 src_info.ipi6_ifindex = np->mcast_oif ? np->mcast_oif :
@@ -1160,6 +1193,10 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                 val = np->mcast_oif;
                 break;
 
+        case IPV6_UNICAST_IF:
+                val = (__force int)htonl((__u32) np->ucast_oif);
+                break;
+
         case IPV6_MTU_DISCOVER:
                 val = np->pmtudisc;
                 break;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 16c33e308121..6d0f5dc8e3a6 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -606,13 +606,13 @@ done:
         return err;
 }
 
-int inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
-                   const struct in6_addr *src_addr)
+bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
+                    const struct in6_addr *src_addr)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct ipv6_mc_socklist *mc;
         struct ip6_sf_socklist *psl;
-        int rv = 1;
+        bool rv = true;
 
         rcu_read_lock();
         for_each_pmc_rcu(np, mc) {
@@ -621,7 +621,7 @@ int inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
         }
         if (!mc) {
                 rcu_read_unlock();
-                return 1;
+                return true;
         }
         read_lock(&mc->sflock);
         psl = mc->sflist;
@@ -635,9 +635,9 @@ int inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
                                 break;
                 }
                 if (mc->sfmode == MCAST_INCLUDE && i >= psl->sl_count)
-                        rv = 0;
+                        rv = false;
                 if (mc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
-                        rv = 0;
+                        rv = false;
         }
         read_unlock(&mc->sflock);
         rcu_read_unlock();
@@ -931,15 +931,15 @@ int ipv6_dev_mc_dec(struct net_device *dev, const struct in6_addr *addr)
 /*
  * identify MLD packets for MLD filter exceptions
  */
-int ipv6_is_mld(struct sk_buff *skb, int nexthdr)
+bool ipv6_is_mld(struct sk_buff *skb, int nexthdr)
 {
         struct icmp6hdr *pic;
 
         if (nexthdr != IPPROTO_ICMPV6)
-                return 0;
+                return false;
 
         if (!pskb_may_pull(skb, sizeof(struct icmp6hdr)))
-                return 0;
+                return false;
 
         pic = icmp6_hdr(skb);
 
@@ -948,22 +948,22 @@ int ipv6_is_mld(struct sk_buff *skb, int nexthdr)
         case ICMPV6_MGM_REPORT:
         case ICMPV6_MGM_REDUCTION:
         case ICMPV6_MLD2_REPORT:
-                return 1;
+                return true;
         default:
                 break;
         }
-        return 0;
+        return false;
 }
 
 /*
  *      check if the interface/address pair is valid
  */
-int ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
-                        const struct in6_addr *src_addr)
+bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
+                         const struct in6_addr *src_addr)
 {
         struct inet6_dev *idev;
         struct ifmcaddr6 *mc;
-        int rv = 0;
+        bool rv = false;
 
         rcu_read_lock();
         idev = __in6_dev_get(dev);
@@ -990,7 +990,7 @@ int ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
                                         rv = mc->mca_sfcount[MCAST_EXCLUDE] !=0;
                                 spin_unlock_bh(&mc->mca_lock);
                         } else
-                                rv = 1; /* don't filter unspecified source */
+                                rv = true; /* don't filter unspecified source */
                 }
                 read_unlock_bh(&idev->lock);
         }
@@ -1046,8 +1046,8 @@ static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
 }
 
 /* mark EXCLUDE-mode sources */
-static int mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
-        const struct in6_addr *srcs)
+static bool mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
+                             const struct in6_addr *srcs)
 {
         struct ip6_sf_list *psf;
         int i, scount;
@@ -1061,7 +1061,7 @@ static int mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
                         if (psf->sf_count[MCAST_INCLUDE] ||
                             pmc->mca_sfcount[MCAST_EXCLUDE] !=
                             psf->sf_count[MCAST_EXCLUDE])
-                                continue;
+                                break;
                         if (ipv6_addr_equal(&srcs[i], &psf->sf_addr)) {
                                 scount++;
                                 break;
@@ -1070,12 +1070,12 @@ static int mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
         }
         pmc->mca_flags &= ~MAF_GSQUERY;
         if (scount == nsrcs)    /* all sources excluded */
-                return 0;
-        return 1;
+                return false;
+        return true;
 }
 
-static int mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
-        const struct in6_addr *srcs)
+static bool mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
+                            const struct in6_addr *srcs)
 {
         struct ip6_sf_list *psf;
         int i, scount;
@@ -1099,10 +1099,10 @@ static int mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
         }
         if (!scount) {
                 pmc->mca_flags &= ~MAF_GSQUERY;
-                return 0;
+                return false;
         }
         pmc->mca_flags |= MAF_GSQUERY;
-        return 1;
+        return true;
 }
 
 /* called with rcu_read_lock() */
@@ -1276,17 +1276,17 @@ int igmp6_event_report(struct sk_buff *skb)
         return 0;
 }
 
-static int is_in(struct ifmcaddr6 *pmc, struct ip6_sf_list *psf, int type,
-        int gdeleted, int sdeleted)
+static bool is_in(struct ifmcaddr6 *pmc, struct ip6_sf_list *psf, int type,
+                  int gdeleted, int sdeleted)
 {
         switch (type) {
         case MLD2_MODE_IS_INCLUDE:
         case MLD2_MODE_IS_EXCLUDE:
                 if (gdeleted || sdeleted)
-                        return 0;
+                        return false;
                 if (!((pmc->mca_flags & MAF_GSQUERY) && !psf->sf_gsresp)) {
                         if (pmc->mca_sfmode == MCAST_INCLUDE)
-                                return 1;
+                                return true;
                         /* don't include if this source is excluded
                          * in all filters
                          */
@@ -1295,29 +1295,29 @@ static int is_in(struct ifmcaddr6 *pmc, struct ip6_sf_list *psf, int type,
                         return pmc->mca_sfcount[MCAST_EXCLUDE] ==
                                 psf->sf_count[MCAST_EXCLUDE];
                 }
-                return 0;
+                return false;
         case MLD2_CHANGE_TO_INCLUDE:
                 if (gdeleted || sdeleted)
-                        return 0;
+                        return false;
                 return psf->sf_count[MCAST_INCLUDE] != 0;
         case MLD2_CHANGE_TO_EXCLUDE:
                 if (gdeleted || sdeleted)
-                        return 0;
+                        return false;
                 if (pmc->mca_sfcount[MCAST_EXCLUDE] == 0 ||
                     psf->sf_count[MCAST_INCLUDE])
-                        return 0;
+                        return false;
                 return pmc->mca_sfcount[MCAST_EXCLUDE] ==
                         psf->sf_count[MCAST_EXCLUDE];
         case MLD2_ALLOW_NEW_SOURCES:
                 if (gdeleted || !psf->sf_crcount)
-                        return 0;
+                        return false;
                 return (pmc->mca_sfmode == MCAST_INCLUDE) ^ sdeleted;
         case MLD2_BLOCK_OLD_SOURCES:
                 if (pmc->mca_sfmode == MCAST_INCLUDE)
                         return gdeleted || (psf->sf_crcount && sdeleted);
                 return psf->sf_crcount && !gdeleted && !sdeleted;
         }
-        return 0;
+        return false;
 }
 
 static int
@@ -2044,7 +2044,7 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
                 if (!delta)
                         pmc->mca_sfcount[sfmode]--;
                 for (j=0; j<i; j++)
-                        (void) ip6_mc_del1_src(pmc, sfmode, &psfsrc[i]);
+                        ip6_mc_del1_src(pmc, sfmode, &psfsrc[j]);
         } else if (isexclude != (pmc->mca_sfcount[MCAST_EXCLUDE] != 0)) {
                 struct ip6_sf_list *psf;
 
@@ -2627,8 +2627,7 @@ static int __net_init igmp6_net_init(struct net *net)
         err = inet_ctl_sock_create(&net->ipv6.igmp_sk, PF_INET6,
                                    SOCK_RAW, IPPROTO_ICMPV6, net);
         if (err < 0) {
-                printk(KERN_ERR
-                       "Failed to initialize the IGMP6 control socket (err %d).\n",
+                pr_err("Failed to initialize the IGMP6 control socket (err %d)\n",
                        err);
                 goto out;
         }
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 7e1e0fbfef21..5b087c31d87b 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -22,6 +22,8 @@
  *      Masahide NAKAMURA @USAGI
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/time.h>
@@ -44,7 +46,7 @@ static inline void *mip6_padn(__u8 *data, __u8 padlen)
         if (!data)
                 return NULL;
         if (padlen == 1) {
-                data[0] = IPV6_TLV_PAD0;
+                data[0] = IPV6_TLV_PAD1;
         } else if (padlen > 1) {
                 data[0] = IPV6_TLV_PADN;
                 data[1] = padlen - 2;
@@ -307,13 +309,12 @@ static int mip6_destopt_offset(struct xfrm_state *x, struct sk_buff *skb,
 static int mip6_destopt_init_state(struct xfrm_state *x)
 {
         if (x->id.spi) {
-                printk(KERN_INFO "%s: spi is not 0: %u\n", __func__,
-                       x->id.spi);
+                pr_info("%s: spi is not 0: %u\n", __func__, x->id.spi);
                 return -EINVAL;
         }
         if (x->props.mode != XFRM_MODE_ROUTEOPTIMIZATION) {
-                printk(KERN_INFO "%s: state's mode is not %u: %u\n",
-                       __func__, XFRM_MODE_ROUTEOPTIMIZATION, x->props.mode);
+                pr_info("%s: state's mode is not %u: %u\n",
+                        __func__, XFRM_MODE_ROUTEOPTIMIZATION, x->props.mode);
                 return -EINVAL;
         }
 
@@ -443,13 +444,12 @@ static int mip6_rthdr_offset(struct xfrm_state *x, struct sk_buff *skb,
 static int mip6_rthdr_init_state(struct xfrm_state *x)
 {
         if (x->id.spi) {
-                printk(KERN_INFO "%s: spi is not 0: %u\n", __func__,
-                       x->id.spi);
+                pr_info("%s: spi is not 0: %u\n", __func__, x->id.spi);
                 return -EINVAL;
         }
         if (x->props.mode != XFRM_MODE_ROUTEOPTIMIZATION) {
-                printk(KERN_INFO "%s: state's mode is not %u: %u\n",
-                       __func__, XFRM_MODE_ROUTEOPTIMIZATION, x->props.mode);
+                pr_info("%s: state's mode is not %u: %u\n",
+                        __func__, XFRM_MODE_ROUTEOPTIMIZATION, x->props.mode);
                 return -EINVAL;
         }
 
@@ -481,18 +481,18 @@ static const struct xfrm_type mip6_rthdr_type =
 
 static int __init mip6_init(void)
 {
-        printk(KERN_INFO "Mobile IPv6\n");
+        pr_info("Mobile IPv6\n");
 
         if (xfrm_register_type(&mip6_destopt_type, AF_INET6) < 0) {
-                printk(KERN_INFO "%s: can't add xfrm type(destopt)\n", __func__);
+                pr_info("%s: can't add xfrm type(destopt)\n", __func__);
                 goto mip6_destopt_xfrm_fail;
         }
         if (xfrm_register_type(&mip6_rthdr_type, AF_INET6) < 0) {
-                printk(KERN_INFO "%s: can't add xfrm type(rthdr)\n", __func__);
+                pr_info("%s: can't add xfrm type(rthdr)\n", __func__);
                 goto mip6_rthdr_xfrm_fail;
         }
         if (rawv6_mh_filter_register(mip6_mh_filter) < 0) {
-                printk(KERN_INFO "%s: can't add rawv6 mh filter\n", __func__);
+                pr_info("%s: can't add rawv6 mh filter\n", __func__);
                 goto mip6_rawv6_mh_fail;
         }
 
@@ -510,11 +510,11 @@ static int __init mip6_init(void)
 static void __exit mip6_fini(void)
 {
         if (rawv6_mh_filter_unregister(mip6_mh_filter) < 0)
-                printk(KERN_INFO "%s: can't remove rawv6 mh filter\n", __func__);
+                pr_info("%s: can't remove rawv6 mh filter\n", __func__);
         if (xfrm_unregister_type(&mip6_rthdr_type, AF_INET6) < 0)
-                printk(KERN_INFO "%s: can't remove xfrm type(rthdr)\n", __func__);
+                pr_info("%s: can't remove xfrm type(rthdr)\n", __func__);
         if (xfrm_unregister_type(&mip6_destopt_type, AF_INET6) < 0)
-                printk(KERN_INFO "%s: can't remove xfrm type(destopt)\n", __func__);
+                pr_info("%s: can't remove xfrm type(destopt)\n", __func__);
 }
 
 module_init(mip6_init);
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index c964958ac470..54f62d3b8dd6 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -15,6 +15,7 @@
 /*
  *      Changes:
  *
+ *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  *      Pierre Ynard                    :       export userland ND options
  *                                              through netlink (RDNSS support)
  *      Lars Fenneberg                  :       fixed MTU setting on receipt
@@ -26,27 +27,7 @@
  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  */
 
-/* Set to 3 to get tracing... */
-#define ND_DEBUG 1
-
-#define ND_PRINTK(fmt, args...) do { if (net_ratelimit()) { printk(fmt, ## args); } } while(0)
-#define ND_NOPRINTK(x...) do { ; } while(0)
-#define ND_PRINTK0 ND_PRINTK
-#define ND_PRINTK1 ND_NOPRINTK
-#define ND_PRINTK2 ND_NOPRINTK
-#define ND_PRINTK3 ND_NOPRINTK
-#if ND_DEBUG >= 1
-#undef ND_PRINTK1
-#define ND_PRINTK1 ND_PRINTK
-#endif
-#if ND_DEBUG >= 2
-#undef ND_PRINTK2
-#define ND_PRINTK2 ND_PRINTK
-#endif
-#if ND_DEBUG >= 3
-#undef ND_PRINTK3
-#define ND_PRINTK3 ND_PRINTK
-#endif
+#define pr_fmt(fmt) "ICMPv6: " fmt
 
 #include <linux/module.h>
 #include <linux/errno.h>
@@ -91,6 +72,15 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
 
+/* Set to 3 to get tracing... */
+#define ND_DEBUG 1
+
+#define ND_PRINTK(val, level, fmt, ...)                         \
+do {                                                            \
+        if (val <= ND_DEBUG)                                    \
+                net_##level##_ratelimited(fmt, ##__VA_ARGS__);  \
+} while (0)
+
 static u32 ndisc_hash(const void *pkey,
                       const struct net_device *dev,
                       __u32 *hash_rnd);
@@ -228,7 +218,8 @@ static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 
 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
 {
-        return opt->nd_opt_type == ND_OPT_RDNSS;
+        return opt->nd_opt_type == ND_OPT_RDNSS ||
+                opt->nd_opt_type == ND_OPT_DNSSL;
 }
 
 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
@@ -263,10 +254,9 @@ static struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
                 case ND_OPT_MTU:
                 case ND_OPT_REDIRECT_HDR:
                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
-                                ND_PRINTK2(KERN_WARNING
-                                           "%s(): duplicated ND6 option found: type=%d\n",
-                                           __func__,
-                                           nd_opt->nd_opt_type);
+                                ND_PRINTK(2, warn,
+                                          "%s: duplicated ND6 option found: type=%d\n",
+                                          __func__, nd_opt->nd_opt_type);
                         } else {
                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
                         }
@@ -294,10 +284,11 @@ static struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
                                  * to accommodate future extension to the
                                  * protocol.
                                  */
-                                ND_PRINTK2(KERN_NOTICE
-                                           "%s(): ignored unsupported option; type=%d, len=%d\n",
-                                           __func__,
-                                           nd_opt->nd_opt_type, nd_opt->nd_opt_len);
+                                ND_PRINTK(2, notice,
+                                          "%s: ignored unsupported option; type=%d, len=%d\n",
+                                          __func__,
+                                          nd_opt->nd_opt_type,
+                                          nd_opt->nd_opt_len);
                         }
                 }
                 opt_len -= l;
@@ -325,9 +316,6 @@ int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev,
         case ARPHRD_FDDI:
                 ipv6_eth_mc_map(addr, buf);
                 return 0;
-        case ARPHRD_IEEE802_TR:
-                ipv6_tr_mc_map(addr,buf);
-                return 0;
         case ARPHRD_ARCNET:
                 ipv6_arcnet_mc_map(addr, buf);
                 return 0;
@@ -360,7 +348,7 @@ static int ndisc_constructor(struct neighbour *neigh)
         struct net_device *dev = neigh->dev;
         struct inet6_dev *in6_dev;
         struct neigh_parms *parms;
-        int is_multicast = ipv6_addr_is_multicast(addr);
+        bool is_multicast = ipv6_addr_is_multicast(addr);
 
         in6_dev = in6_dev_get(dev);
         if (in6_dev == NULL) {
@@ -456,9 +444,8 @@ struct sk_buff *ndisc_build_skb(struct net_device *dev,
                                    len + hlen + tlen),
                                   1, &err);
         if (!skb) {
-                ND_PRINTK0(KERN_ERR
-                           "ICMPv6 ND: %s() failed to allocate an skb, err=%d.\n",
-                           __func__, err);
+                ND_PRINTK(0, err, "ND: %s failed to allocate an skb, err=%d\n",
+                          __func__, err);
                 return NULL;
         }
 
@@ -694,8 +681,9 @@ static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 
         if ((probes -= neigh->parms->ucast_probes) < 0) {
                 if (!(neigh->nud_state & NUD_VALID)) {
-                        ND_PRINTK1(KERN_DEBUG "%s(): trying to ucast probe in NUD_INVALID: %pI6\n",
-                                   __func__, target);
+                        ND_PRINTK(1, dbg,
+                                  "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
+                                  __func__, target);
                 }
                 ndisc_send_ns(dev, neigh, target, target, saddr);
         } else if ((probes -= neigh->parms->app_probes) < 0) {
@@ -737,12 +725,11 @@ static void ndisc_recv_ns(struct sk_buff *skb)
         struct inet6_dev *idev = NULL;
         struct neighbour *neigh;
         int dad = ipv6_addr_any(saddr);
-        int inc;
+        bool inc;
         int is_router = -1;
 
         if (ipv6_addr_is_multicast(&msg->target)) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 NS: multicast target address");
+                ND_PRINTK(2, warn, "NS: multicast target address\n");
                 return;
         }
 
@@ -755,22 +742,20 @@ static void ndisc_recv_ns(struct sk_buff *skb)
               daddr->s6_addr32[1] == htonl(0x00000000) &&
               daddr->s6_addr32[2] == htonl(0x00000001) &&
               daddr->s6_addr [12] == 0xff )) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 NS: bad DAD packet (wrong destination)\n");
+                ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
                 return;
         }
 
         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 NS: invalid ND options\n");
+                ND_PRINTK(2, warn, "NS: invalid ND options\n");
                 return;
         }
 
         if (ndopts.nd_opts_src_lladdr) {
                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
                 if (!lladdr) {
-                        ND_PRINTK2(KERN_WARNING
-                                   "ICMPv6 NS: invalid link-layer address length\n");
+                        ND_PRINTK(2, warn,
+                                  "NS: invalid link-layer address length\n");
                         return;
                 }
 
@@ -780,8 +765,8 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                  *      in the message.
                  */
                 if (dad) {
-                        ND_PRINTK2(KERN_WARNING
-                                   "ICMPv6 NS: bad DAD packet (link-layer address option)\n");
+                        ND_PRINTK(2, warn,
+                                  "NS: bad DAD packet (link-layer address option)\n");
                         return;
                 }
         }
@@ -793,20 +778,6 @@ static void ndisc_recv_ns(struct sk_buff *skb)
 
                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
                         if (dad) {
-                                if (dev->type == ARPHRD_IEEE802_TR) {
-                                        const unsigned char *sadr;
-                                        sadr = skb_mac_header(skb);
-                                        if (((sadr[8] ^ dev->dev_addr[0]) & 0x7f) == 0 &&
-                                            sadr[9] == dev->dev_addr[1] &&
-                                            sadr[10] == dev->dev_addr[2] &&
-                                            sadr[11] == dev->dev_addr[3] &&
-                                            sadr[12] == dev->dev_addr[4] &&
-                                            sadr[13] == dev->dev_addr[5]) {
-                                                /* looped-back to us */
-                                                goto out;
-                                        }
-                                }
-
                                 /*
                                  * We are colliding with another node
                                  * who is doing DAD
@@ -913,34 +884,30 @@ static void ndisc_recv_na(struct sk_buff *skb)
         struct neighbour *neigh;
 
         if (skb->len < sizeof(struct nd_msg)) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 NA: packet too short\n");
+                ND_PRINTK(2, warn, "NA: packet too short\n");
                 return;
         }
 
         if (ipv6_addr_is_multicast(&msg->target)) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 NA: target address is multicast.\n");
+                ND_PRINTK(2, warn, "NA: target address is multicast\n");
                 return;
         }
 
         if (ipv6_addr_is_multicast(daddr) &&
             msg->icmph.icmp6_solicited) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 NA: solicited NA is multicasted.\n");
+                ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
                 return;
         }
 
         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 NS: invalid ND option\n");
+                ND_PRINTK(2, warn, "NS: invalid ND option\n");
                 return;
         }
         if (ndopts.nd_opts_tgt_lladdr) {
                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
                 if (!lladdr) {
-                        ND_PRINTK2(KERN_WARNING
-                                   "ICMPv6 NA: invalid link-layer address length\n");
+                        ND_PRINTK(2, warn,
+                                  "NA: invalid link-layer address length\n");
                         return;
                 }
         }
@@ -961,9 +928,9 @@ static void ndisc_recv_na(struct sk_buff *skb)
                    unsolicited advertisement.
                  */
                 if (skb->pkt_type != PACKET_LOOPBACK)
-                        ND_PRINTK1(KERN_WARNING
-                           "ICMPv6 NA: someone advertises our address %pI6 on %s!\n",
-                           &ifp->addr, ifp->idev->dev->name);
+                        ND_PRINTK(1, warn,
+                                  "NA: someone advertises our address %pI6 on %s!\n",
+                                  &ifp->addr, ifp->idev->dev->name);
                 in6_ifa_put(ifp);
                 return;
         }
@@ -1025,8 +992,7 @@ static void ndisc_recv_rs(struct sk_buff *skb)
 
         idev = __in6_dev_get(skb->dev);
         if (!idev) {
-                if (net_ratelimit())
-                        ND_PRINTK1("ICMP6 RS: can't find in6 device\n");
+                ND_PRINTK(1, err, "RS: can't find in6 device\n");
                 return;
         }
 
@@ -1043,8 +1009,7 @@ static void ndisc_recv_rs(struct sk_buff *skb)
 
         /* Parse ND options */
         if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) {
-                if (net_ratelimit())
-                        ND_PRINTK2("ICMP6 NS: invalid ND option, ignored\n");
+                ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
                 goto out;
         }
 
@@ -1099,8 +1064,9 @@ static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
 
         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
 
-        NLA_PUT(skb, NDUSEROPT_SRCADDR, sizeof(struct in6_addr),
-                &ipv6_hdr(ra)->saddr);
+        if (nla_put(skb, NDUSEROPT_SRCADDR, sizeof(struct in6_addr),
+                    &ipv6_hdr(ra)->saddr))
+                goto nla_put_failure;
         nlmsg_end(skb, nlh);
 
         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
@@ -1141,20 +1107,17 @@ static void ndisc_router_discovery(struct sk_buff *skb)
         optlen = (skb->tail - skb->transport_header) - sizeof(struct ra_msg);
 
         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 RA: source address is not link-local.\n");
+                ND_PRINTK(2, warn, "RA: source address is not link-local\n");
                 return;
         }
         if (optlen < 0) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 RA: packet too short\n");
+                ND_PRINTK(2, warn, "RA: packet too short\n");
                 return;
         }
 
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 RA: from host or unauthorized router\n");
+                ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
                 return;
         }
 #endif
@@ -1165,15 +1128,13 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 
         in6_dev = __in6_dev_get(skb->dev);
         if (in6_dev == NULL) {
-                ND_PRINTK0(KERN_ERR
-                           "ICMPv6 RA: can't find inet6 device for %s.\n",
-                           skb->dev->name);
+                ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
+                          skb->dev->name);
                 return;
         }
 
         if (!ndisc_parse_options(opt, optlen, &ndopts)) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMP6 RA: invalid ND options\n");
+                ND_PRINTK(2, warn, "RA: invalid ND options\n");
                 return;
         }
 
@@ -1223,32 +1184,37 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 
         rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
 
-        if (rt)
-                neigh = dst_get_neighbour_noref(&rt->dst);
-
+        if (rt) {
+                neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
+                if (!neigh) {
+                        ND_PRINTK(0, err,
+                                  "RA: %s got default router without neighbour\n",
+                                  __func__);
+                        dst_release(&rt->dst);
+                        return;
+                }
+        }
         if (rt && lifetime == 0) {
-                neigh_clone(neigh);
                 ip6_del_rt(rt);
                 rt = NULL;
         }
 
         if (rt == NULL && lifetime) {
-                ND_PRINTK3(KERN_DEBUG
-                           "ICMPv6 RA: adding default router.\n");
+                ND_PRINTK(3, dbg, "RA: adding default router\n");
 
                 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
                 if (rt == NULL) {
-                        ND_PRINTK0(KERN_ERR
-                                   "ICMPv6 RA: %s() failed to add default route.\n",
-                                   __func__);
+                        ND_PRINTK(0, err,
+                                  "RA: %s failed to add default route\n",
+                                  __func__);
                         return;
                 }
 
-                neigh = dst_get_neighbour_noref(&rt->dst);
+                neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
                 if (neigh == NULL) {
-                        ND_PRINTK0(KERN_ERR
-                                   "ICMPv6 RA: %s() got default router without neighbour.\n",
-                                   __func__);
+                        ND_PRINTK(0, err,
+                                  "RA: %s got default router without neighbour\n",
+                                  __func__);
                         dst_release(&rt->dst);
                         return;
                 }
@@ -1258,8 +1224,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
         }
 
         if (rt)
-                rt->dst.expires = jiffies + (HZ * lifetime);
-
+                rt6_set_expires(rt, jiffies + (HZ * lifetime));
         if (ra_msg->icmph.icmp6_hop_limit) {
                 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
                 if (rt)
@@ -1317,8 +1282,8 @@ skip_linkparms:
                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
                                                      skb->dev);
                         if (!lladdr) {
-                                ND_PRINTK2(KERN_WARNING
-                                           "ICMPv6 RA: invalid link-layer address length\n");
+                                ND_PRINTK(2, warn,
+                                          "RA: invalid link-layer address length\n");
                                 goto out;
                         }
                 }
@@ -1382,9 +1347,7 @@ skip_routeinfo:
                 mtu = ntohl(n);
 
                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
-                        ND_PRINTK2(KERN_WARNING
-                                   "ICMPv6 RA: invalid mtu: %d\n",
-                                   mtu);
+                        ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
                 } else if (in6_dev->cnf.mtu6 != mtu) {
                         in6_dev->cnf.mtu6 = mtu;
 
@@ -1405,13 +1368,12 @@ skip_routeinfo:
         }
 
         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 RA: invalid RA options");
+                ND_PRINTK(2, warn, "RA: invalid RA options\n");
         }
 out:
         if (rt)
                 dst_release(&rt->dst);
-        else if (neigh)
+        if (neigh)
                 neigh_release(neigh);
 }
 
@@ -1431,15 +1393,15 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
         switch (skb->ndisc_nodetype) {
         case NDISC_NODETYPE_HOST:
         case NDISC_NODETYPE_NODEFAULT:
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 Redirect: from host or unauthorized router\n");
+                ND_PRINTK(2, warn,
+                          "Redirect: from host or unauthorized router\n");
                 return;
         }
 #endif
 
         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 Redirect: source address is not link-local.\n");
+                ND_PRINTK(2, warn,
+                          "Redirect: source address is not link-local\n");
                 return;
         }
 
@@ -1447,8 +1409,7 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
         optlen -= sizeof(struct icmp6hdr) + 2 * sizeof(struct in6_addr);
 
         if (optlen < 0) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 Redirect: packet too short\n");
+                ND_PRINTK(2, warn, "Redirect: packet too short\n");
                 return;
         }
 
@@ -1457,8 +1418,8 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
         dest = target + 1;
 
         if (ipv6_addr_is_multicast(dest)) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 Redirect: destination address is multicast.\n");
+                ND_PRINTK(2, warn,
+                          "Redirect: destination address is multicast\n");
                 return;
         }
 
@@ -1466,8 +1427,8 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
                 on_link = 1;
         } else if (ipv6_addr_type(target) !=
                    (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 Redirect: target address is not link-local unicast.\n");
+                ND_PRINTK(2, warn,
+                          "Redirect: target address is not link-local unicast\n");
                 return;
         }
 
@@ -1483,16 +1444,15 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
          */
 
         if (!ndisc_parse_options((u8*)(dest + 1), optlen, &ndopts)) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 Redirect: invalid ND options\n");
+                ND_PRINTK(2, warn, "Redirect: invalid ND options\n");
                 return;
         }
         if (ndopts.nd_opts_tgt_lladdr) {
                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr,
                                              skb->dev);
                 if (!lladdr) {
-                        ND_PRINTK2(KERN_WARNING
-                                   "ICMPv6 Redirect: invalid link-layer address length\n");
+                        ND_PRINTK(2, warn,
+                                  "Redirect: invalid link-layer address length\n");
                         return;
                 }
         }
@@ -1506,8 +1466,7 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
         }
 }
 
-void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
-                         const struct in6_addr *target)
+void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
 {
         struct net_device *dev = skb->dev;
         struct net *net = dev_net(dev);
@@ -1528,16 +1487,15 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
 
         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 Redirect: no link-local address on %s\n",
-                           dev->name);
+                ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
+                          dev->name);
                 return;
         }
 
         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
-                ND_PRINTK2(KERN_WARNING
-                        "ICMPv6 Redirect: target address is not link-local unicast.\n");
+                ND_PRINTK(2, warn,
+                          "Redirect: target address is not link-local unicast\n");
                 return;
         }
 
@@ -1556,8 +1514,8 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
         rt = (struct rt6_info *) dst;
 
         if (rt->rt6i_flags & RTF_GATEWAY) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 Redirect: destination is not a neighbour.\n");
+                ND_PRINTK(2, warn,
+                          "Redirect: destination is not a neighbour\n");
                 goto release;
         }
         if (!rt->rt6i_peer)
@@ -1566,6 +1524,13 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                 goto release;
 
         if (dev->addr_len) {
+                struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
+                if (!neigh) {
+                        ND_PRINTK(2, warn,
+                                  "Redirect: no neigh for target address\n");
+                        goto release;
+                }
+
                 read_lock_bh(&neigh->lock);
                 if (neigh->nud_state & NUD_VALID) {
                         memcpy(ha_buf, neigh->ha, dev->addr_len);
@@ -1574,6 +1539,8 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                         len += ndisc_opt_addr_space(dev);
                 } else
                         read_unlock_bh(&neigh->lock);
+
+                neigh_release(neigh);
         }
 
         rd_len = min_t(unsigned int,
@@ -1588,9 +1555,9 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                                     len + hlen + tlen),
                                    1, &err);
         if (buff == NULL) {
-                ND_PRINTK0(KERN_ERR
-                           "ICMPv6 Redirect: %s() failed to allocate an skb, err=%d.\n",
-                           __func__, err);
+                ND_PRINTK(0, err,
+                          "Redirect: %s failed to allocate an skb, err=%d\n",
+                          __func__, err);
                 goto release;
         }
 
@@ -1675,16 +1642,14 @@ int ndisc_rcv(struct sk_buff *skb)
         __skb_push(skb, skb->data - skb_transport_header(skb));
 
         if (ipv6_hdr(skb)->hop_limit != 255) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 NDISC: invalid hop-limit: %d\n",
-                           ipv6_hdr(skb)->hop_limit);
+                ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
+                          ipv6_hdr(skb)->hop_limit);
                 return 0;
         }
 
         if (msg->icmph.icmp6_code != 0) {
-                ND_PRINTK2(KERN_WARNING
-                           "ICMPv6 NDISC: invalid ICMPv6 code: %d\n",
-                           msg->icmph.icmp6_code);
+                ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
+                          msg->icmph.icmp6_code);
                 return 0;
         }
 
@@ -1751,11 +1716,7 @@ static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
         static int warned;
         if (strcmp(warncomm, current->comm) && warned < 5) {
                 strcpy(warncomm, current->comm);
-                printk(KERN_WARNING
-                        "process `%s' is using deprecated sysctl (%s) "
-                        "net.ipv6.neigh.%s.%s; "
-                        "Use net.ipv6.neigh.%s.%s_ms "
-                        "instead.\n",
+                pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
                         warncomm, func,
                         dev_name, ctl->procname,
                         dev_name, ctl->procname);
@@ -1809,9 +1770,9 @@ static int __net_init ndisc_net_init(struct net *net)
         err = inet_ctl_sock_create(&sk, PF_INET6,
                                    SOCK_RAW, IPPROTO_ICMPV6, net);
         if (err < 0) {
-                ND_PRINTK0(KERN_ERR
-                           "ICMPv6 NDISC: Failed to initialize the control socket (err %d).\n",
-                           err);
+                ND_PRINTK(0, err,
+                          "NDISC: Failed to initialize the control socket (err %d)\n",
+                          err);
                 return err;
         }
 
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 9a68fb5b9e77..10135342799e 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -25,28 +25,6 @@ config NF_CONNTRACK_IPV6
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP6_NF_QUEUE
-        tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)"
-        depends on INET && IPV6 && NETFILTER
-        depends on NETFILTER_ADVANCED
-        ---help---
-
-          This option adds a queue handler to the kernel for IPv6
-          packets which enables users to receive the filtered packets
-          with QUEUE target using libipq.
-
-          This option enables the old IPv6-only "ip6_queue" implementation
-          which has been obsoleted by the new "nfnetlink_queue" code (see
-          CONFIG_NETFILTER_NETLINK_QUEUE).
-
-          (C) Fernando Anton 2001
-          IPv64 Project - Work based in IPv64 draft by Arturo Azcorra.
-          Universidad Carlos III de Madrid
-          Universidad Politecnica de Alcala de Henares
-          email: <fanton@it.uc3m.es>.
-
-          To compile it as a module, choose M here.  If unsure, say N.
-
 config IP6_NF_IPTABLES
         tristate "IP6 tables support (required for filtering)"
         depends on INET && IPV6
@@ -154,15 +132,6 @@ config IP6_NF_TARGET_HL
         (e.g. when running oldconfig). It selects
         CONFIG_NETFILTER_XT_TARGET_HL.
 
-config IP6_NF_TARGET_LOG
-        tristate "LOG target support"
-        default m if NETFILTER_ADVANCED=n
-        help
-          This option adds a `LOG' target, which allows you to create rules in
-          any iptables table which records the packet header to the syslog.
-
-          To compile it as a module, choose M here.  If unsure, say N.
-
 config IP6_NF_FILTER
         tristate "Packet filtering"
         default m if NETFILTER_ADVANCED=n
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index 2eaed96db02c..534d3f216f7b 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -6,7 +6,6 @@
 obj-$(CONFIG_IP6_NF_IPTABLES) += ip6_tables.o
 obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
 obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
-obj-$(CONFIG_IP6_NF_QUEUE) += ip6_queue.o
 obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
 obj-$(CONFIG_IP6_NF_SECURITY) += ip6table_security.o
 
@@ -31,5 +30,4 @@ obj-$(CONFIG_IP6_NF_MATCH_RPFILTER) += ip6t_rpfilter.o
 obj-$(CONFIG_IP6_NF_MATCH_RT) += ip6t_rt.o
 
 # targets
-obj-$(CONFIG_IP6_NF_TARGET_LOG) += ip6t_LOG.o
 obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
deleted file mode 100644
index a34c9e4c792c..000000000000
--- a/net/ipv6/netfilter/ip6_queue.c
+++ /dev/null
@@ -1,641 +0,0 @@
-/*
- * This is a module which is used for queueing IPv6 packets and
- * communicating with userspace via netlink.
- *
- * (C) 2001 Fernando Anton, this code is GPL.
- *     IPv64 Project - Work based in IPv64 draft by Arturo Azcorra.
- *     Universidad Carlos III de Madrid - Leganes (Madrid) - Spain
- *     Universidad Politecnica de Alcala de Henares - Alcala de H. (Madrid) - Spain
- *     email: fanton@it.uc3m.es
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/init.h>
-#include <linux/ipv6.h>
-#include <linux/notifier.h>
-#include <linux/netdevice.h>
-#include <linux/netfilter.h>
-#include <linux/netlink.h>
-#include <linux/spinlock.h>
-#include <linux/sysctl.h>
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#include <linux/mutex.h>
-#include <linux/slab.h>
-#include <net/net_namespace.h>
-#include <net/sock.h>
-#include <net/ipv6.h>
-#include <net/ip6_route.h>
-#include <net/netfilter/nf_queue.h>
-#include <linux/netfilter_ipv4/ip_queue.h>
-#include <linux/netfilter_ipv4/ip_tables.h>
-#include <linux/netfilter_ipv6/ip6_tables.h>
-
-#define IPQ_QMAX_DEFAULT 1024
-#define IPQ_PROC_FS_NAME "ip6_queue"
-#define NET_IPQ_QMAX_NAME "ip6_queue_maxlen"
-
-typedef int (*ipq_cmpfn)(struct nf_queue_entry *, unsigned long);
-
-static unsigned char copy_mode __read_mostly = IPQ_COPY_NONE;
-static unsigned int queue_maxlen __read_mostly = IPQ_QMAX_DEFAULT;
-static DEFINE_SPINLOCK(queue_lock);
-static int peer_pid __read_mostly;
-static unsigned int copy_range __read_mostly;
-static unsigned int queue_total;
-static unsigned int queue_dropped = 0;
-static unsigned int queue_user_dropped = 0;
-static struct sock *ipqnl __read_mostly;
-static LIST_HEAD(queue_list);
-static DEFINE_MUTEX(ipqnl_mutex);
-
-static inline void
-__ipq_enqueue_entry(struct nf_queue_entry *entry)
-{
-       list_add_tail(&entry->list, &queue_list);
-       queue_total++;
-}
-
-static inline int
-__ipq_set_mode(unsigned char mode, unsigned int range)
-{
-        int status = 0;
-
-        switch(mode) {
-        case IPQ_COPY_NONE:
-        case IPQ_COPY_META:
-                copy_mode = mode;
-                copy_range = 0;
-                break;
-
-        case IPQ_COPY_PACKET:
-                if (range > 0xFFFF)
-                        range = 0xFFFF;
-                copy_range = range;
-                copy_mode = mode;
-                break;
-
-        default:
-                status = -EINVAL;
-
-        }
-        return status;
-}
-
-static void __ipq_flush(ipq_cmpfn cmpfn, unsigned long data);
-
-static inline void
-__ipq_reset(void)
-{
-        peer_pid = 0;
-        net_disable_timestamp();
-        __ipq_set_mode(IPQ_COPY_NONE, 0);
-        __ipq_flush(NULL, 0);
-}
-
-static struct nf_queue_entry *
-ipq_find_dequeue_entry(unsigned long id)
-{
-        struct nf_queue_entry *entry = NULL, *i;
-
-        spin_lock_bh(&queue_lock);
-
-        list_for_each_entry(i, &queue_list, list) {
-                if ((unsigned long)i == id) {
-                        entry = i;
-                        break;
-                }
-        }
-
-        if (entry) {
-                list_del(&entry->list);
-                queue_total--;
-        }
-
-        spin_unlock_bh(&queue_lock);
-        return entry;
-}
-
-static void
-__ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
-{
-        struct nf_queue_entry *entry, *next;
-
-        list_for_each_entry_safe(entry, next, &queue_list, list) {
-                if (!cmpfn || cmpfn(entry, data)) {
-                        list_del(&entry->list);
-                        queue_total--;
-                        nf_reinject(entry, NF_DROP);
-                }
-        }
-}
-
-static void
-ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
-{
-        spin_lock_bh(&queue_lock);
-        __ipq_flush(cmpfn, data);
-        spin_unlock_bh(&queue_lock);
-}
-
-static struct sk_buff *
-ipq_build_packet_message(struct nf_queue_entry *entry, int *errp)
-{
-        sk_buff_data_t old_tail;
-        size_t size = 0;
-        size_t data_len = 0;
-        struct sk_buff *skb;
-        struct ipq_packet_msg *pmsg;
-        struct nlmsghdr *nlh;
-        struct timeval tv;
-
-        switch (ACCESS_ONCE(copy_mode)) {
-        case IPQ_COPY_META:
-        case IPQ_COPY_NONE:
-                size = NLMSG_SPACE(sizeof(*pmsg));
-                break;
-
-        case IPQ_COPY_PACKET:
-                if (entry->skb->ip_summed == CHECKSUM_PARTIAL &&
-                    (*errp = skb_checksum_help(entry->skb)))
-                        return NULL;
-
-                data_len = ACCESS_ONCE(copy_range);
-                if (data_len == 0 || data_len > entry->skb->len)
-                        data_len = entry->skb->len;
-
-                size = NLMSG_SPACE(sizeof(*pmsg) + data_len);
-                break;
-
-        default:
-                *errp = -EINVAL;
-                return NULL;
-        }
-
-        skb = alloc_skb(size, GFP_ATOMIC);
-        if (!skb)
-                goto nlmsg_failure;
-
-        old_tail = skb->tail;
-        nlh = NLMSG_PUT(skb, 0, 0, IPQM_PACKET, size - sizeof(*nlh));
-        pmsg = NLMSG_DATA(nlh);
-        memset(pmsg, 0, sizeof(*pmsg));
-
-        pmsg->packet_id       = (unsigned long )entry;
-        pmsg->data_len        = data_len;
-        tv = ktime_to_timeval(entry->skb->tstamp);
-        pmsg->timestamp_sec   = tv.tv_sec;
-        pmsg->timestamp_usec  = tv.tv_usec;
-        pmsg->mark            = entry->skb->mark;
-        pmsg->hook            = entry->hook;
-        pmsg->hw_protocol     = entry->skb->protocol;
-
-        if (entry->indev)
-                strcpy(pmsg->indev_name, entry->indev->name);
-        else
-                pmsg->indev_name[0] = '\0';
-
-        if (entry->outdev)
-                strcpy(pmsg->outdev_name, entry->outdev->name);
-        else
-                pmsg->outdev_name[0] = '\0';
-
-        if (entry->indev && entry->skb->dev &&
-            entry->skb->mac_header != entry->skb->network_header) {
-                pmsg->hw_type = entry->skb->dev->type;
-                pmsg->hw_addrlen = dev_parse_header(entry->skb, pmsg->hw_addr);
-        }
-
-        if (data_len)
-                if (skb_copy_bits(entry->skb, 0, pmsg->payload, data_len))
-                        BUG();
-
-        nlh->nlmsg_len = skb->tail - old_tail;
-        return skb;
-
-nlmsg_failure:
-        kfree_skb(skb);
-        *errp = -EINVAL;
-        printk(KERN_ERR "ip6_queue: error creating packet message\n");
-        return NULL;
-}
-
-static int
-ipq_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
-{
-        int status = -EINVAL;
-        struct sk_buff *nskb;
-
-        if (copy_mode == IPQ_COPY_NONE)
-                return -EAGAIN;
-
-        nskb = ipq_build_packet_message(entry, &status);
-        if (nskb == NULL)
-                return status;
-
-        spin_lock_bh(&queue_lock);
-
-        if (!peer_pid)
-                goto err_out_free_nskb;
-
-        if (queue_total >= queue_maxlen) {
-                queue_dropped++;
-                status = -ENOSPC;
-                if (net_ratelimit())
-                        printk (KERN_WARNING "ip6_queue: fill at %d entries, "
-                                "dropping packet(s).  Dropped: %d\n", queue_total,
-                                queue_dropped);
-                goto err_out_free_nskb;
-        }
-
-        /* netlink_unicast will either free the nskb or attach it to a socket */
-        status = netlink_unicast(ipqnl, nskb, peer_pid, MSG_DONTWAIT);
-        if (status < 0) {
-                queue_user_dropped++;
-                goto err_out_unlock;
-        }
-
-        __ipq_enqueue_entry(entry);
-
-        spin_unlock_bh(&queue_lock);
-        return status;
-
-err_out_free_nskb:
-        kfree_skb(nskb);
-
-err_out_unlock:
-        spin_unlock_bh(&queue_lock);
-        return status;
-}
-
-static int
-ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
-{
-        int diff;
-        struct ipv6hdr *user_iph = (struct ipv6hdr *)v->payload;
-        struct sk_buff *nskb;
-
-        if (v->data_len < sizeof(*user_iph))
-                return 0;
-        diff = v->data_len - e->skb->len;
-        if (diff < 0) {
-                if (pskb_trim(e->skb, v->data_len))
-                        return -ENOMEM;
-        } else if (diff > 0) {
-                if (v->data_len > 0xFFFF)
-                        return -EINVAL;
-                if (diff > skb_tailroom(e->skb)) {
-                        nskb = skb_copy_expand(e->skb, skb_headroom(e->skb),
-                                               diff, GFP_ATOMIC);
-                        if (!nskb) {
-                                printk(KERN_WARNING "ip6_queue: OOM "
-                                      "in mangle, dropping packet\n");
-                                return -ENOMEM;
-                        }
-                        kfree_skb(e->skb);
-                        e->skb = nskb;
-                }
-                skb_put(e->skb, diff);
-        }
-        if (!skb_make_writable(e->skb, v->data_len))
-                return -ENOMEM;
-        skb_copy_to_linear_data(e->skb, v->payload, v->data_len);
-        e->skb->ip_summed = CHECKSUM_NONE;
-
-        return 0;
-}
-
-static int
-ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
-{
-        struct nf_queue_entry *entry;
-
-        if (vmsg->value > NF_MAX_VERDICT || vmsg->value == NF_STOLEN)
-                return -EINVAL;
-
-        entry = ipq_find_dequeue_entry(vmsg->id);
-        if (entry == NULL)
-                return -ENOENT;
-        else {
-                int verdict = vmsg->value;
-
-                if (vmsg->data_len && vmsg->data_len == len)
-                        if (ipq_mangle_ipv6(vmsg, entry) < 0)
-                                verdict = NF_DROP;
-
-                nf_reinject(entry, verdict);
-                return 0;
-        }
-}
-
-static int
-ipq_set_mode(unsigned char mode, unsigned int range)
-{
-        int status;
-
-        spin_lock_bh(&queue_lock);
-        status = __ipq_set_mode(mode, range);
-        spin_unlock_bh(&queue_lock);
-        return status;
-}
-
-static int
-ipq_receive_peer(struct ipq_peer_msg *pmsg,
-                 unsigned char type, unsigned int len)
-{
-        int status = 0;
-
-        if (len < sizeof(*pmsg))
-                return -EINVAL;
-
-        switch (type) {
-        case IPQM_MODE:
-                status = ipq_set_mode(pmsg->msg.mode.value,
-                                      pmsg->msg.mode.range);
-                break;
-
-        case IPQM_VERDICT:
-                status = ipq_set_verdict(&pmsg->msg.verdict,
-                                         len - sizeof(*pmsg));
-                break;
-        default:
-                status = -EINVAL;
-        }
-        return status;
-}
-
-static int
-dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex)
-{
-        if (entry->indev)
-                if (entry->indev->ifindex == ifindex)
-                        return 1;
-
-        if (entry->outdev)
-                if (entry->outdev->ifindex == ifindex)
-                        return 1;
-#ifdef CONFIG_BRIDGE_NETFILTER
-        if (entry->skb->nf_bridge) {
-                if (entry->skb->nf_bridge->physindev &&
-                    entry->skb->nf_bridge->physindev->ifindex == ifindex)
-                        return 1;
-                if (entry->skb->nf_bridge->physoutdev &&
-                    entry->skb->nf_bridge->physoutdev->ifindex == ifindex)
-                        return 1;
-        }
-#endif
-        return 0;
-}
-
-static void
-ipq_dev_drop(int ifindex)
-{
-        ipq_flush(dev_cmp, ifindex);
-}
-
-#define RCV_SKB_FAIL(err) do { netlink_ack(skb, nlh, (err)); return; } while (0)
-
-static inline void
-__ipq_rcv_skb(struct sk_buff *skb)
-{
-        int status, type, pid, flags;
-        unsigned int nlmsglen, skblen;
-        struct nlmsghdr *nlh;
-        bool enable_timestamp = false;
-
-        skblen = skb->len;
-        if (skblen < sizeof(*nlh))
-                return;
-
-        nlh = nlmsg_hdr(skb);
-        nlmsglen = nlh->nlmsg_len;
-        if (nlmsglen < sizeof(*nlh) || skblen < nlmsglen)
-                return;
-
-        pid = nlh->nlmsg_pid;
-        flags = nlh->nlmsg_flags;
-
-        if(pid <= 0 || !(flags & NLM_F_REQUEST) || flags & NLM_F_MULTI)
-                RCV_SKB_FAIL(-EINVAL);
-
-        if (flags & MSG_TRUNC)
-                RCV_SKB_FAIL(-ECOMM);
-
-        type = nlh->nlmsg_type;
-        if (type < NLMSG_NOOP || type >= IPQM_MAX)
-                RCV_SKB_FAIL(-EINVAL);
-
-        if (type <= IPQM_BASE)
-                return;
-
-        if (!capable(CAP_NET_ADMIN))
-                RCV_SKB_FAIL(-EPERM);
-
-        spin_lock_bh(&queue_lock);
-
-        if (peer_pid) {
-                if (peer_pid != pid) {
-                        spin_unlock_bh(&queue_lock);
-                        RCV_SKB_FAIL(-EBUSY);
-                }
-        } else {
-                enable_timestamp = true;
-                peer_pid = pid;
-        }
-
-        spin_unlock_bh(&queue_lock);
-        if (enable_timestamp)
-                net_enable_timestamp();
-
-        status = ipq_receive_peer(NLMSG_DATA(nlh), type,
-                                  nlmsglen - NLMSG_LENGTH(0));
-        if (status < 0)
-                RCV_SKB_FAIL(status);
-
-        if (flags & NLM_F_ACK)
-                netlink_ack(skb, nlh, 0);
-}
-
-static void
-ipq_rcv_skb(struct sk_buff *skb)
-{
-        mutex_lock(&ipqnl_mutex);
-        __ipq_rcv_skb(skb);
-        mutex_unlock(&ipqnl_mutex);
-}
-
-static int
-ipq_rcv_dev_event(struct notifier_block *this,
-                  unsigned long event, void *ptr)
-{
-        struct net_device *dev = ptr;
-
-        if (!net_eq(dev_net(dev), &init_net))
-                return NOTIFY_DONE;
-
-        /* Drop any packets associated with the downed device */
-        if (event == NETDEV_DOWN)
-                ipq_dev_drop(dev->ifindex);
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block ipq_dev_notifier = {
-        .notifier_call  = ipq_rcv_dev_event,
-};
-
-static int
-ipq_rcv_nl_event(struct notifier_block *this,
-                 unsigned long event, void *ptr)
-{
-        struct netlink_notify *n = ptr;
-
-        if (event == NETLINK_URELEASE && n->protocol == NETLINK_IP6_FW) {
-                spin_lock_bh(&queue_lock);
-                if ((net_eq(n->net, &init_net)) && (n->pid == peer_pid))
-                        __ipq_reset();
-                spin_unlock_bh(&queue_lock);
-        }
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block ipq_nl_notifier = {
-        .notifier_call  = ipq_rcv_nl_event,
-};
-
-#ifdef CONFIG_SYSCTL
-static struct ctl_table_header *ipq_sysctl_header;
-
-static ctl_table ipq_table[] = {
-        {
-                .procname       = NET_IPQ_QMAX_NAME,
-                .data           = &queue_maxlen,
-                .maxlen         = sizeof(queue_maxlen),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        { }
-};
-#endif
-
-#ifdef CONFIG_PROC_FS
-static int ip6_queue_show(struct seq_file *m, void *v)
-{
-        spin_lock_bh(&queue_lock);
-
-        seq_printf(m,
-                      "Peer PID          : %d\n"
-                      "Copy mode         : %hu\n"
-                      "Copy range        : %u\n"
-                      "Queue length      : %u\n"
-                      "Queue max. length : %u\n"
-                      "Queue dropped     : %u\n"
-                      "Netfilter dropped : %u\n",
-                      peer_pid,
-                      copy_mode,
-                      copy_range,
-                      queue_total,
-                      queue_maxlen,
-                      queue_dropped,
-                      queue_user_dropped);
-
-        spin_unlock_bh(&queue_lock);
-        return 0;
-}
-
-static int ip6_queue_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, ip6_queue_show, NULL);
-}
-
-static const struct file_operations ip6_queue_proc_fops = {
-        .open           = ip6_queue_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-        .owner          = THIS_MODULE,
-};
-#endif
-
-static const struct nf_queue_handler nfqh = {
-        .name   = "ip6_queue",
-        .outfn  = &ipq_enqueue_packet,
-};
-
-static int __init ip6_queue_init(void)
-{
-        int status = -ENOMEM;
-        struct proc_dir_entry *proc __maybe_unused;
-
-        netlink_register_notifier(&ipq_nl_notifier);
-        ipqnl = netlink_kernel_create(&init_net, NETLINK_IP6_FW, 0,
-                                      ipq_rcv_skb, NULL, THIS_MODULE);
-        if (ipqnl == NULL) {
-                printk(KERN_ERR "ip6_queue: failed to create netlink socket\n");
-                goto cleanup_netlink_notifier;
-        }
-
-#ifdef CONFIG_PROC_FS
-        proc = proc_create(IPQ_PROC_FS_NAME, 0, init_net.proc_net,
-                           &ip6_queue_proc_fops);
-        if (!proc) {
-                printk(KERN_ERR "ip6_queue: failed to create proc entry\n");
-                goto cleanup_ipqnl;
-        }
-#endif
-        register_netdevice_notifier(&ipq_dev_notifier);
-#ifdef CONFIG_SYSCTL
-        ipq_sysctl_header = register_sysctl_paths(net_ipv6_ctl_path, ipq_table);
-#endif
-        status = nf_register_queue_handler(NFPROTO_IPV6, &nfqh);
-        if (status < 0) {
-                printk(KERN_ERR "ip6_queue: failed to register queue handler\n");
-                goto cleanup_sysctl;
-        }
-        return status;
-
-cleanup_sysctl:
-#ifdef CONFIG_SYSCTL
-        unregister_sysctl_table(ipq_sysctl_header);
-#endif
-        unregister_netdevice_notifier(&ipq_dev_notifier);
-        proc_net_remove(&init_net, IPQ_PROC_FS_NAME);
-
-cleanup_ipqnl: __maybe_unused
-        netlink_kernel_release(ipqnl);
-        mutex_lock(&ipqnl_mutex);
-        mutex_unlock(&ipqnl_mutex);
-
-cleanup_netlink_notifier:
-        netlink_unregister_notifier(&ipq_nl_notifier);
-        return status;
-}
-
-static void __exit ip6_queue_fini(void)
-{
-        nf_unregister_queue_handlers(&nfqh);
-
-        ipq_flush(NULL, 0);
-
-#ifdef CONFIG_SYSCTL
-        unregister_sysctl_table(ipq_sysctl_header);
-#endif
-        unregister_netdevice_notifier(&ipq_dev_notifier);
-        proc_net_remove(&init_net, IPQ_PROC_FS_NAME);
-
-        netlink_kernel_release(ipqnl);
-        mutex_lock(&ipqnl_mutex);
-        mutex_unlock(&ipqnl_mutex);
-
-        netlink_unregister_notifier(&ipq_nl_notifier);
-}
-
-MODULE_DESCRIPTION("IPv6 packet queue handler");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_IP6_FW);
-
-module_init(ip6_queue_init);
-module_exit(ip6_queue_fini);
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 94874b0bdcdc..d7cb04506c3d 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -78,19 +78,6 @@ EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
 
    Hence the start of any table is given by get_table() below.  */
 
-/* Check for an extension */
-int
-ip6t_ext_hdr(u8 nexthdr)
-{
-        return  (nexthdr == IPPROTO_HOPOPTS)   ||
-                (nexthdr == IPPROTO_ROUTING)   ||
-                (nexthdr == IPPROTO_FRAGMENT)  ||
-                (nexthdr == IPPROTO_ESP)       ||
-                (nexthdr == IPPROTO_AH)        ||
-                (nexthdr == IPPROTO_NONE)      ||
-                (nexthdr == IPPROTO_DSTOPTS);
-}
-
 /* Returns whether matches rule or not. */
 /* Performance critical - called for every packet */
 static inline bool
@@ -146,7 +133,7 @@ ip6_packet_match(const struct sk_buff *skb,
                 int protohdr;
                 unsigned short _frag_off;
 
-                protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off);
+                protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off, NULL);
                 if (protohdr < 0) {
                         if (_frag_off == 0)
                                 *hotdrop = true;
@@ -194,8 +181,7 @@ ip6_checkentry(const struct ip6t_ip6 *ipv6)
 static unsigned int
 ip6t_error(struct sk_buff *skb, const struct xt_action_param *par)
 {
-        if (net_ratelimit())
-                pr_info("error: `%s'\n", (const char *)par->targinfo);
+        net_info_ratelimited("error: `%s'\n", (const char *)par->targinfo);
 
         return NF_DROP;
 }
@@ -375,6 +361,7 @@ ip6t_do_table(struct sk_buff *skb,
                 const struct xt_entry_match *ematch;
 
                 IP_NF_ASSERT(e);
+                acpar.thoff = 0;
                 if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
                     &acpar.thoff, &acpar.fragoff, &acpar.hotdrop)) {
  no_match:
@@ -409,7 +396,7 @@ ip6t_do_table(struct sk_buff *skb,
                         if (v < 0) {
                                 /* Pop from stack? */
                                 if (v != XT_RETURN) {
-                                        verdict = (unsigned)(-v) - 1;
+                                        verdict = (unsigned int)(-v) - 1;
                                         break;
                                 }
                                 if (*stackptr <= origptr)
@@ -2291,6 +2278,10 @@ static void __exit ip6_tables_fini(void)
  * if target < 0. "last header" is transport protocol header, ESP, or
  * "No next header".
  *
+ * Note that *offset is used as input/output parameter. an if it is not zero,
+ * then it must be a valid offset to an inner IPv6 header. This can be used
+ * to explore inner IPv6 header, eg. ICMPv6 error messages.
+ *
  * If target header is found, its offset is set in *offset and return protocol
  * number. Otherwise, return -1.
  *
@@ -2302,17 +2293,33 @@ static void __exit ip6_tables_fini(void)
  * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
  * isn't NULL.
  *
+ * if flags is not NULL and it's a fragment, then the frag flag IP6T_FH_F_FRAG
+ * will be set. If it's an AH header, the IP6T_FH_F_AUTH flag is set and
+ * target < 0, then this function will stop at the AH header.
  */
 int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
-                  int target, unsigned short *fragoff)
+                  int target, unsigned short *fragoff, int *flags)
 {
         unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
         u8 nexthdr = ipv6_hdr(skb)->nexthdr;
-        unsigned int len = skb->len - start;
+        unsigned int len;
 
         if (fragoff)
                 *fragoff = 0;
 
+        if (*offset) {
+                struct ipv6hdr _ip6, *ip6;
+
+                ip6 = skb_header_pointer(skb, *offset, sizeof(_ip6), &_ip6);
+                if (!ip6 || (ip6->version != 6)) {
+                        printk(KERN_ERR "IPv6 header not found\n");
+                        return -EBADMSG;
+                }
+                start = *offset + sizeof(struct ipv6hdr);
+                nexthdr = ip6->nexthdr;
+        }
+        len = skb->len - start;
+
         while (nexthdr != target) {
                 struct ipv6_opt_hdr _hdr, *hp;
                 unsigned int hdrlen;
@@ -2329,6 +2336,9 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                 if (nexthdr == NEXTHDR_FRAGMENT) {
                         unsigned short _frag_off;
                         __be16 *fp;
+
+                        if (flags)      /* Indicate that this is a fragment */
+                                *flags |= IP6T_FH_F_FRAG;
                         fp = skb_header_pointer(skb,
                                                 start+offsetof(struct frag_hdr,
                                                                frag_off),
@@ -2349,9 +2359,11 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                                 return -ENOENT;
                         }
                         hdrlen = 8;
-                } else if (nexthdr == NEXTHDR_AUTH)
+                } else if (nexthdr == NEXTHDR_AUTH) {
+                        if (flags && (*flags & IP6T_FH_F_AUTH) && (target < 0))
+                                break;
                         hdrlen = (hp->hdrlen + 2) << 2;
-                else
+                } else
                         hdrlen = ipv6_optlen(hp);
 
                 nexthdr = hp->nexthdr;
@@ -2366,7 +2378,6 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
 EXPORT_SYMBOL(ip6t_register_table);
 EXPORT_SYMBOL(ip6t_unregister_table);
 EXPORT_SYMBOL(ip6t_do_table);
-EXPORT_SYMBOL(ip6t_ext_hdr);
 EXPORT_SYMBOL(ipv6_find_hdr);
 
 module_init(ip6_tables_init);
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
deleted file mode 100644
index e6af8d72f26b..000000000000
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ /dev/null
@@ -1,527 +0,0 @@
-/*
- * This is a module which is used for logging packets.
- */
-
-/* (C) 2001 Jan Rekorajski <baggins@pld.org.pl>
- * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/if_arp.h>
-#include <linux/ip.h>
-#include <linux/spinlock.h>
-#include <linux/icmpv6.h>
-#include <net/udp.h>
-#include <net/tcp.h>
-#include <net/ipv6.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter/x_tables.h>
-#include <linux/netfilter_ipv6/ip6_tables.h>
-#include <net/netfilter/nf_log.h>
-#include <net/netfilter/xt_log.h>
-
-MODULE_AUTHOR("Jan Rekorajski <baggins@pld.org.pl>");
-MODULE_DESCRIPTION("Xtables: IPv6 packet logging to syslog");
-MODULE_LICENSE("GPL");
-
-struct in_device;
-#include <net/route.h>
-#include <linux/netfilter_ipv6/ip6t_LOG.h>
-
-/* One level of recursion won't kill us */
-static void dump_packet(struct sbuff *m,
-                        const struct nf_loginfo *info,
-                        const struct sk_buff *skb, unsigned int ip6hoff,
-                        int recurse)
-{
-        u_int8_t currenthdr;
-        int fragment;
-        struct ipv6hdr _ip6h;
-        const struct ipv6hdr *ih;
-        unsigned int ptr;
-        unsigned int hdrlen = 0;
-        unsigned int logflags;
-
-        if (info->type == NF_LOG_TYPE_LOG)
-                logflags = info->u.log.logflags;
-        else
-                logflags = NF_LOG_MASK;
-
-        ih = skb_header_pointer(skb, ip6hoff, sizeof(_ip6h), &_ip6h);
-        if (ih == NULL) {
-                sb_add(m, "TRUNCATED");
-                return;
-        }
-
-        /* Max length: 88 "SRC=0000.0000.0000.0000.0000.0000.0000.0000 DST=0000.0000.0000.0000.0000.0000.0000.0000 " */
-        sb_add(m, "SRC=%pI6 DST=%pI6 ", &ih->saddr, &ih->daddr);
-
-        /* Max length: 44 "LEN=65535 TC=255 HOPLIMIT=255 FLOWLBL=FFFFF " */
-        sb_add(m, "LEN=%Zu TC=%u HOPLIMIT=%u FLOWLBL=%u ",
-               ntohs(ih->payload_len) + sizeof(struct ipv6hdr),
-               (ntohl(*(__be32 *)ih) & 0x0ff00000) >> 20,
-               ih->hop_limit,
-               (ntohl(*(__be32 *)ih) & 0x000fffff));
-
-        fragment = 0;
-        ptr = ip6hoff + sizeof(struct ipv6hdr);
-        currenthdr = ih->nexthdr;
-        while (currenthdr != NEXTHDR_NONE && ip6t_ext_hdr(currenthdr)) {
-                struct ipv6_opt_hdr _hdr;
-                const struct ipv6_opt_hdr *hp;
-
-                hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
-                if (hp == NULL) {
-                        sb_add(m, "TRUNCATED");
-                        return;
-                }
-
-                /* Max length: 48 "OPT (...) " */
-                if (logflags & IP6T_LOG_IPOPT)
-                        sb_add(m, "OPT ( ");
-
-                switch (currenthdr) {
-                case IPPROTO_FRAGMENT: {
-                        struct frag_hdr _fhdr;
-                        const struct frag_hdr *fh;
-
-                        sb_add(m, "FRAG:");
-                        fh = skb_header_pointer(skb, ptr, sizeof(_fhdr),
-                                                &_fhdr);
-                        if (fh == NULL) {
-                                sb_add(m, "TRUNCATED ");
-                                return;
-                        }
-
-                        /* Max length: 6 "65535 " */
-                        sb_add(m, "%u ", ntohs(fh->frag_off) & 0xFFF8);
-
-                        /* Max length: 11 "INCOMPLETE " */
-                        if (fh->frag_off & htons(0x0001))
-                                sb_add(m, "INCOMPLETE ");
-
-                        sb_add(m, "ID:%08x ", ntohl(fh->identification));
-
-                        if (ntohs(fh->frag_off) & 0xFFF8)
-                                fragment = 1;
-
-                        hdrlen = 8;
-
-                        break;
-                }
-                case IPPROTO_DSTOPTS:
-                case IPPROTO_ROUTING:
-                case IPPROTO_HOPOPTS:
-                        if (fragment) {
-                                if (logflags & IP6T_LOG_IPOPT)
-                                        sb_add(m, ")");
-                                return;
-                        }
-                        hdrlen = ipv6_optlen(hp);
-                        break;
-                /* Max Length */
-                case IPPROTO_AH:
-                        if (logflags & IP6T_LOG_IPOPT) {
-                                struct ip_auth_hdr _ahdr;
-                                const struct ip_auth_hdr *ah;
-
-                                /* Max length: 3 "AH " */
-                                sb_add(m, "AH ");
-
-                                if (fragment) {
-                                        sb_add(m, ")");
-                                        return;
-                                }
-
-                                ah = skb_header_pointer(skb, ptr, sizeof(_ahdr),
-                                                        &_ahdr);
-                                if (ah == NULL) {
-                                        /*
-                                         * Max length: 26 "INCOMPLETE [65535
-                                         *  bytes] )"
-                                         */
-                                        sb_add(m, "INCOMPLETE [%u bytes] )",
-                                               skb->len - ptr);
-                                        return;
-                                }
-
-                                /* Length: 15 "SPI=0xF1234567 */
-                                sb_add(m, "SPI=0x%x ", ntohl(ah->spi));
-
-                        }
-
-                        hdrlen = (hp->hdrlen+2)<<2;
-                        break;
-                case IPPROTO_ESP:
-                        if (logflags & IP6T_LOG_IPOPT) {
-                                struct ip_esp_hdr _esph;
-                                const struct ip_esp_hdr *eh;
-
-                                /* Max length: 4 "ESP " */
-                                sb_add(m, "ESP ");
-
-                                if (fragment) {
-                                        sb_add(m, ")");
-                                        return;
-                                }
-
-                                /*
-                                 * Max length: 26 "INCOMPLETE [65535 bytes] )"
-                                 */
-                                eh = skb_header_pointer(skb, ptr, sizeof(_esph),
-                                                        &_esph);
-                                if (eh == NULL) {
-                                        sb_add(m, "INCOMPLETE [%u bytes] )",
-                                               skb->len - ptr);
-                                        return;
-                                }
-
-                                /* Length: 16 "SPI=0xF1234567 )" */
-                                sb_add(m, "SPI=0x%x )", ntohl(eh->spi) );
-
-                        }
-                        return;
-                default:
-                        /* Max length: 20 "Unknown Ext Hdr 255" */
-                        sb_add(m, "Unknown Ext Hdr %u", currenthdr);
-                        return;
-                }
-                if (logflags & IP6T_LOG_IPOPT)
-                        sb_add(m, ") ");
-
-                currenthdr = hp->nexthdr;
-                ptr += hdrlen;
-        }
-
-        switch (currenthdr) {
-        case IPPROTO_TCP: {
-                struct tcphdr _tcph;
-                const struct tcphdr *th;
-
-                /* Max length: 10 "PROTO=TCP " */
-                sb_add(m, "PROTO=TCP ");
-
-                if (fragment)
-                        break;
-
-                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
-                th = skb_header_pointer(skb, ptr, sizeof(_tcph), &_tcph);
-                if (th == NULL) {
-                        sb_add(m, "INCOMPLETE [%u bytes] ", skb->len - ptr);
-                        return;
-                }
-
-                /* Max length: 20 "SPT=65535 DPT=65535 " */
-                sb_add(m, "SPT=%u DPT=%u ",
-                       ntohs(th->source), ntohs(th->dest));
-                /* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */
-                if (logflags & IP6T_LOG_TCPSEQ)
-                        sb_add(m, "SEQ=%u ACK=%u ",
-                               ntohl(th->seq), ntohl(th->ack_seq));
-                /* Max length: 13 "WINDOW=65535 " */
-                sb_add(m, "WINDOW=%u ", ntohs(th->window));
-                /* Max length: 9 "RES=0x3C " */
-                sb_add(m, "RES=0x%02x ", (u_int8_t)(ntohl(tcp_flag_word(th) & TCP_RESERVED_BITS) >> 22));
-                /* Max length: 32 "CWR ECE URG ACK PSH RST SYN FIN " */
-                if (th->cwr)
-                        sb_add(m, "CWR ");
-                if (th->ece)
-                        sb_add(m, "ECE ");
-                if (th->urg)
-                        sb_add(m, "URG ");
-                if (th->ack)
-                        sb_add(m, "ACK ");
-                if (th->psh)
-                        sb_add(m, "PSH ");
-                if (th->rst)
-                        sb_add(m, "RST ");
-                if (th->syn)
-                        sb_add(m, "SYN ");
-                if (th->fin)
-                        sb_add(m, "FIN ");
-                /* Max length: 11 "URGP=65535 " */
-                sb_add(m, "URGP=%u ", ntohs(th->urg_ptr));
-
-                if ((logflags & IP6T_LOG_TCPOPT) &&
-                    th->doff * 4 > sizeof(struct tcphdr)) {
-                        u_int8_t _opt[60 - sizeof(struct tcphdr)];
-                        const u_int8_t *op;
-                        unsigned int i;
-                        unsigned int optsize = th->doff * 4
-                                               - sizeof(struct tcphdr);
-
-                        op = skb_header_pointer(skb,
-                                                ptr + sizeof(struct tcphdr),
-                                                optsize, _opt);
-                        if (op == NULL) {
-                                sb_add(m, "OPT (TRUNCATED)");
-                                return;
-                        }
-
-                        /* Max length: 127 "OPT (" 15*4*2chars ") " */
-                        sb_add(m, "OPT (");
-                        for (i =0; i < optsize; i++)
-                                sb_add(m, "%02X", op[i]);
-                        sb_add(m, ") ");
-                }
-                break;
-        }
-        case IPPROTO_UDP:
-        case IPPROTO_UDPLITE: {
-                struct udphdr _udph;
-                const struct udphdr *uh;
-
-                if (currenthdr == IPPROTO_UDP)
-                        /* Max length: 10 "PROTO=UDP "     */
-                        sb_add(m, "PROTO=UDP " );
-                else    /* Max length: 14 "PROTO=UDPLITE " */
-                        sb_add(m, "PROTO=UDPLITE ");
-
-                if (fragment)
-                        break;
-
-                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
-                uh = skb_header_pointer(skb, ptr, sizeof(_udph), &_udph);
-                if (uh == NULL) {
-                        sb_add(m, "INCOMPLETE [%u bytes] ", skb->len - ptr);
-                        return;
-                }
-
-                /* Max length: 20 "SPT=65535 DPT=65535 " */
-                sb_add(m, "SPT=%u DPT=%u LEN=%u ",
-                       ntohs(uh->source), ntohs(uh->dest),
-                       ntohs(uh->len));
-                break;
-        }
-        case IPPROTO_ICMPV6: {
-                struct icmp6hdr _icmp6h;
-                const struct icmp6hdr *ic;
-
-                /* Max length: 13 "PROTO=ICMPv6 " */
-                sb_add(m, "PROTO=ICMPv6 ");
-
-                if (fragment)
-                        break;
-
-                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
-                ic = skb_header_pointer(skb, ptr, sizeof(_icmp6h), &_icmp6h);
-                if (ic == NULL) {
-                        sb_add(m, "INCOMPLETE [%u bytes] ", skb->len - ptr);
-                        return;
-                }
-
-                /* Max length: 18 "TYPE=255 CODE=255 " */
-                sb_add(m, "TYPE=%u CODE=%u ", ic->icmp6_type, ic->icmp6_code);
-
-                switch (ic->icmp6_type) {
-                case ICMPV6_ECHO_REQUEST:
-                case ICMPV6_ECHO_REPLY:
-                        /* Max length: 19 "ID=65535 SEQ=65535 " */
-                        sb_add(m, "ID=%u SEQ=%u ",
-                                ntohs(ic->icmp6_identifier),
-                                ntohs(ic->icmp6_sequence));
-                        break;
-                case ICMPV6_MGM_QUERY:
-                case ICMPV6_MGM_REPORT:
-                case ICMPV6_MGM_REDUCTION:
-                        break;
-
-                case ICMPV6_PARAMPROB:
-                        /* Max length: 17 "POINTER=ffffffff " */
-                        sb_add(m, "POINTER=%08x ", ntohl(ic->icmp6_pointer));
-                        /* Fall through */
-                case ICMPV6_DEST_UNREACH:
-                case ICMPV6_PKT_TOOBIG:
-                case ICMPV6_TIME_EXCEED:
-                        /* Max length: 3+maxlen */
-                        if (recurse) {
-                                sb_add(m, "[");
-                                dump_packet(m, info, skb,
-                                            ptr + sizeof(_icmp6h), 0);
-                                sb_add(m, "] ");
-                        }
-
-                        /* Max length: 10 "MTU=65535 " */
-                        if (ic->icmp6_type == ICMPV6_PKT_TOOBIG)
-                                sb_add(m, "MTU=%u ", ntohl(ic->icmp6_mtu));
-                }
-                break;
-        }
-        /* Max length: 10 "PROTO=255 " */
-        default:
-                sb_add(m, "PROTO=%u ", currenthdr);
-        }
-
-        /* Max length: 15 "UID=4294967295 " */
-        if ((logflags & IP6T_LOG_UID) && recurse && skb->sk) {
-                read_lock_bh(&skb->sk->sk_callback_lock);
-                if (skb->sk->sk_socket && skb->sk->sk_socket->file)
-                        sb_add(m, "UID=%u GID=%u ",
-                                skb->sk->sk_socket->file->f_cred->fsuid,
-                                skb->sk->sk_socket->file->f_cred->fsgid);
-                read_unlock_bh(&skb->sk->sk_callback_lock);
-        }
-
-        /* Max length: 16 "MARK=0xFFFFFFFF " */
-        if (!recurse && skb->mark)
-                sb_add(m, "MARK=0x%x ", skb->mark);
-}
-
-static void dump_mac_header(struct sbuff *m,
-                            const struct nf_loginfo *info,
-                            const struct sk_buff *skb)
-{
-        struct net_device *dev = skb->dev;
-        unsigned int logflags = 0;
-
-        if (info->type == NF_LOG_TYPE_LOG)
-                logflags = info->u.log.logflags;
-
-        if (!(logflags & IP6T_LOG_MACDECODE))
-                goto fallback;
-
-        switch (dev->type) {
-        case ARPHRD_ETHER:
-                sb_add(m, "MACSRC=%pM MACDST=%pM MACPROTO=%04x ",
-                       eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
-                       ntohs(eth_hdr(skb)->h_proto));
-                return;
-        default:
-                break;
-        }
-
-fallback:
-        sb_add(m, "MAC=");
-        if (dev->hard_header_len &&
-            skb->mac_header != skb->network_header) {
-                const unsigned char *p = skb_mac_header(skb);
-                unsigned int len = dev->hard_header_len;
-                unsigned int i;
-
-                if (dev->type == ARPHRD_SIT &&
-                    (p -= ETH_HLEN) < skb->head)
-                        p = NULL;
-
-                if (p != NULL) {
-                        sb_add(m, "%02x", *p++);
-                        for (i = 1; i < len; i++)
-                                sb_add(m, ":%02x", *p++);
-                }
-                sb_add(m, " ");
-
-                if (dev->type == ARPHRD_SIT) {
-                        const struct iphdr *iph =
-                                (struct iphdr *)skb_mac_header(skb);
-                        sb_add(m, "TUNNEL=%pI4->%pI4 ", &iph->saddr, &iph->daddr);
-                }
-        } else
-                sb_add(m, " ");
-}
-
-static struct nf_loginfo default_loginfo = {
-        .type   = NF_LOG_TYPE_LOG,
-        .u = {
-                .log = {
-                        .level    = 5,
-                        .logflags = NF_LOG_MASK,
-                },
-        },
-};
-
-static void
-ip6t_log_packet(u_int8_t pf,
-                unsigned int hooknum,
-                const struct sk_buff *skb,
-                const struct net_device *in,
-                const struct net_device *out,
-                const struct nf_loginfo *loginfo,
-                const char *prefix)
-{
-        struct sbuff *m = sb_open();
-
-        if (!loginfo)
-                loginfo = &default_loginfo;
-
-        sb_add(m, "<%d>%sIN=%s OUT=%s ", loginfo->u.log.level,
-               prefix,
-               in ? in->name : "",
-               out ? out->name : "");
-
-        if (in != NULL)
-                dump_mac_header(m, loginfo, skb);
-
-        dump_packet(m, loginfo, skb, skb_network_offset(skb), 1);
-
-        sb_close(m);
-}
-
-static unsigned int
-log_tg6(struct sk_buff *skb, const struct xt_action_param *par)
-{
-        const struct ip6t_log_info *loginfo = par->targinfo;
-        struct nf_loginfo li;
-
-        li.type = NF_LOG_TYPE_LOG;
-        li.u.log.level = loginfo->level;
-        li.u.log.logflags = loginfo->logflags;
-
-        ip6t_log_packet(NFPROTO_IPV6, par->hooknum, skb, par->in, par->out,
-                        &li, loginfo->prefix);
-        return XT_CONTINUE;
-}
-
-
-static int log_tg6_check(const struct xt_tgchk_param *par)
-{
-        const struct ip6t_log_info *loginfo = par->targinfo;
-
-        if (loginfo->level >= 8) {
-                pr_debug("level %u >= 8\n", loginfo->level);
-                return -EINVAL;
-        }
-        if (loginfo->prefix[sizeof(loginfo->prefix)-1] != '\0') {
-                pr_debug("prefix not null-terminated\n");
-                return -EINVAL;
-        }
-        return 0;
-}
-
-static struct xt_target log_tg6_reg __read_mostly = {
-        .name           = "LOG",
-        .family         = NFPROTO_IPV6,
-        .target         = log_tg6,
-        .targetsize     = sizeof(struct ip6t_log_info),
-        .checkentry     = log_tg6_check,
-        .me             = THIS_MODULE,
-};
-
-static struct nf_logger ip6t_logger __read_mostly = {
-        .name           = "ip6t_LOG",
-        .logfn          = &ip6t_log_packet,
-        .me             = THIS_MODULE,
-};
-
-static int __init log_tg6_init(void)
-{
-        int ret;
-
-        ret = xt_register_target(&log_tg6_reg);
-        if (ret < 0)
-                return ret;
-        nf_log_register(NFPROTO_IPV6, &ip6t_logger);
-        return 0;
-}
-
-static void __exit log_tg6_exit(void)
-{
-        nf_log_unregister(&ip6t_logger);
-        xt_unregister_target(&log_tg6_reg);
-}
-
-module_init(log_tg6_init);
-module_exit(log_tg6_exit);
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index aad2fa41cf46..fd4fb34c51c7 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -114,8 +114,7 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
                          GFP_ATOMIC);
 
         if (!nskb) {
-                if (net_ratelimit())
-                        pr_debug("cannot alloc skb\n");
+                net_dbg_ratelimited("cannot alloc skb\n");
                 dst_release(dst);
                 return;
         }
@@ -210,8 +209,7 @@ reject_tg6(struct sk_buff *skb, const struct xt_action_param *par)
                 send_reset(net, skb);
                 break;
         default:
-                if (net_ratelimit())
-                        pr_info("case %u not handled yet\n", reject->with);
+                net_info_ratelimited("case %u not handled yet\n", reject->with);
                 break;
         }
 
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 89cccc5a9c92..04099ab7d2e3 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -41,11 +41,11 @@ static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par)
         struct ip_auth_hdr _ah;
         const struct ip_auth_hdr *ah;
         const struct ip6t_ah *ahinfo = par->matchinfo;
-        unsigned int ptr;
+        unsigned int ptr = 0;
         unsigned int hdrlen = 0;
         int err;
 
-        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL);
+        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
                         par->hotdrop = true;
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index eda898fda6ca..3b5735e56bfe 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -40,10 +40,10 @@ frag_mt6(const struct sk_buff *skb, struct xt_action_param *par)
         struct frag_hdr _frag;
         const struct frag_hdr *fh;
         const struct ip6t_frag *fraginfo = par->matchinfo;
-        unsigned int ptr;
+        unsigned int ptr = 0;
         int err;
 
-        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL);
+        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
                         par->hotdrop = true;
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index 59df051eaef6..01df142bb027 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -50,7 +50,7 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
         const struct ipv6_opt_hdr *oh;
         const struct ip6t_opts *optinfo = par->matchinfo;
         unsigned int temp;
-        unsigned int ptr;
+        unsigned int ptr = 0;
         unsigned int hdrlen = 0;
         bool ret = false;
         u8 _opttype;
@@ -62,7 +62,7 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 
         err = ipv6_find_hdr(skb, &ptr,
                             (par->match == &hbh_mt6_reg[0]) ?
-                            NEXTHDR_HOP : NEXTHDR_DEST, NULL);
+                            NEXTHDR_HOP : NEXTHDR_DEST, NULL, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
                         par->hotdrop = true;
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index d8488c50a8e0..2c99b94eeca3 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -42,14 +42,14 @@ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
         const struct ipv6_rt_hdr *rh;
         const struct ip6t_rt *rtinfo = par->matchinfo;
         unsigned int temp;
-        unsigned int ptr;
+        unsigned int ptr = 0;
         unsigned int hdrlen = 0;
         bool ret = false;
         struct in6_addr _addr;
         const struct in6_addr *ap;
         int err;
 
-        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL);
+        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
                         par->hotdrop = true;
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index a8f6da97e3b2..325e59a0224f 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -44,7 +44,7 @@ ip6table_filter_hook(unsigned int hook, struct sk_buff *skb,
 static struct nf_hook_ops *filter_ops __read_mostly;
 
 /* Default to forward because I got too much mail already. */
-static bool forward = NF_ACCEPT;
+static bool forward = true;
 module_param(forward, bool, 0000);
 
 static int __net_init ip6table_filter_net_init(struct net *net)
@@ -56,7 +56,7 @@ static int __net_init ip6table_filter_net_init(struct net *net)
                 return -ENOMEM;
         /* Entry 1 is the FORWARD hook */
         ((struct ip6t_standard *)repl->entries)[1].target.verdict =
-                -forward - 1;
+                forward ? -NF_ACCEPT - 1 : -NF_DROP - 1;
 
         net->ipv6.ip6table_filter =
                 ip6t_register_table(net, &packet_filter, repl);
@@ -80,11 +80,6 @@ static int __init ip6table_filter_init(void)
 {
         int ret;
 
-        if (forward < 0 || forward > NF_MAX_VERDICT) {
-                pr_err("iptables forward must be 0 or 1\n");
-                return -EINVAL;
-        }
-
         ret = register_pernet_subsys(&ip6table_filter_net_ops);
         if (ret < 0)
                 return ret;
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 00d19173db7e..4d782405f125 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -42,8 +42,7 @@ ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out)
         /* root is playing with raw sockets. */
         if (skb->len < sizeof(struct iphdr) ||
             ip_hdrlen(skb) < sizeof(struct iphdr)) {
-                if (net_ratelimit())
-                        pr_warning("ip6t_hook: happy cracking.\n");
+                net_warn_ratelimited("ip6t_hook: happy cracking\n");
                 return NF_ACCEPT;
         }
 #endif
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 4111050a9fc5..3224ef90a21a 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -232,8 +232,7 @@ static unsigned int ipv6_conntrack_local(unsigned int hooknum,
 {
         /* root is playing with raw sockets. */
         if (skb->len < sizeof(struct ipv6hdr)) {
-                if (net_ratelimit())
-                        pr_notice("ipv6_conntrack_local: packet too short\n");
+                net_notice_ratelimited("ipv6_conntrack_local: packet too short\n");
                 return NF_ACCEPT;
         }
         return __ipv6_conntrack_in(dev_net(out), hooknum, skb, okfn);
@@ -278,10 +277,11 @@ static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
 static int ipv6_tuple_to_nlattr(struct sk_buff *skb,
                                 const struct nf_conntrack_tuple *tuple)
 {
-        NLA_PUT(skb, CTA_IP_V6_SRC, sizeof(u_int32_t) * 4,
-                &tuple->src.u3.ip6);
-        NLA_PUT(skb, CTA_IP_V6_DST, sizeof(u_int32_t) * 4,
-                &tuple->dst.u3.ip6);
+        if (nla_put(skb, CTA_IP_V6_SRC, sizeof(u_int32_t) * 4,
+                    &tuple->src.u3.ip6) ||
+            nla_put(skb, CTA_IP_V6_DST, sizeof(u_int32_t) * 4,
+                    &tuple->dst.u3.ip6))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 7c05e7eacbc6..3e81904fbbcd 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -88,25 +88,31 @@ static int icmpv6_print_tuple(struct seq_file *s,
                           ntohs(tuple->src.u.icmp.id));
 }
 
+static unsigned int *icmpv6_get_timeouts(struct net *net)
+{
+        return &nf_ct_icmpv6_timeout;
+}
+
 /* Returns verdict for packet, or -1 for invalid. */
 static int icmpv6_packet(struct nf_conn *ct,
                        const struct sk_buff *skb,
                        unsigned int dataoff,
                        enum ip_conntrack_info ctinfo,
                        u_int8_t pf,
-                       unsigned int hooknum)
+                       unsigned int hooknum,
+                       unsigned int *timeout)
 {
         /* Do not immediately delete the connection after the first
            successful reply to avoid excessive conntrackd traffic
            and also to handle correctly ICMP echo reply duplicates. */
-        nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_icmpv6_timeout);
+        nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
 
         return NF_ACCEPT;
 }
 
 /* Called when a new connection for this protocol found. */
 static bool icmpv6_new(struct nf_conn *ct, const struct sk_buff *skb,
-                       unsigned int dataoff)
+                       unsigned int dataoff, unsigned int *timeouts)
 {
         static const u_int8_t valid_new[] = {
                 [ICMPV6_ECHO_REQUEST - 128] = 1,
@@ -228,10 +234,10 @@ icmpv6_error(struct net *net, struct nf_conn *tmpl,
 static int icmpv6_tuple_to_nlattr(struct sk_buff *skb,
                                   const struct nf_conntrack_tuple *t)
 {
-        NLA_PUT_BE16(skb, CTA_PROTO_ICMPV6_ID, t->src.u.icmp.id);
-        NLA_PUT_U8(skb, CTA_PROTO_ICMPV6_TYPE, t->dst.u.icmp.type);
-        NLA_PUT_U8(skb, CTA_PROTO_ICMPV6_CODE, t->dst.u.icmp.code);
-
+        if (nla_put_be16(skb, CTA_PROTO_ICMPV6_ID, t->src.u.icmp.id) ||
+            nla_put_u8(skb, CTA_PROTO_ICMPV6_TYPE, t->dst.u.icmp.type) ||
+            nla_put_u8(skb, CTA_PROTO_ICMPV6_CODE, t->dst.u.icmp.code))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -270,6 +276,44 @@ static int icmpv6_nlattr_tuple_size(void)
 }
 #endif
 
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nfnetlink_cttimeout.h>
+
+static int icmpv6_timeout_nlattr_to_obj(struct nlattr *tb[], void *data)
+{
+        unsigned int *timeout = data;
+
+        if (tb[CTA_TIMEOUT_ICMPV6_TIMEOUT]) {
+                *timeout =
+                    ntohl(nla_get_be32(tb[CTA_TIMEOUT_ICMPV6_TIMEOUT])) * HZ;
+        } else {
+                /* Set default ICMPv6 timeout. */
+                *timeout = nf_ct_icmpv6_timeout;
+        }
+        return 0;
+}
+
+static int
+icmpv6_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
+{
+        const unsigned int *timeout = data;
+
+        if (nla_put_be32(skb, CTA_TIMEOUT_ICMPV6_TIMEOUT, htonl(*timeout / HZ)))
+                goto nla_put_failure;
+        return 0;
+
+nla_put_failure:
+        return -ENOSPC;
+}
+
+static const struct nla_policy
+icmpv6_timeout_nla_policy[CTA_TIMEOUT_ICMPV6_MAX+1] = {
+        [CTA_TIMEOUT_ICMPV6_TIMEOUT]    = { .type = NLA_U32 },
+};
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+
 #ifdef CONFIG_SYSCTL
 static struct ctl_table_header *icmpv6_sysctl_header;
 static struct ctl_table icmpv6_sysctl_table[] = {
@@ -293,6 +337,7 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6 __read_mostly =
         .invert_tuple           = icmpv6_invert_tuple,
         .print_tuple            = icmpv6_print_tuple,
         .packet                 = icmpv6_packet,
+        .get_timeouts           = icmpv6_get_timeouts,
         .new                    = icmpv6_new,
         .error                  = icmpv6_error,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
@@ -301,6 +346,15 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6 __read_mostly =
         .nlattr_to_tuple        = icmpv6_nlattr_to_tuple,
         .nla_policy             = icmpv6_nla_policy,
 #endif
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+        .ctnl_timeout           = {
+                .nlattr_to_obj  = icmpv6_timeout_nlattr_to_obj,
+                .obj_to_nlattr  = icmpv6_timeout_obj_to_nlattr,
+                .nlattr_max     = CTA_TIMEOUT_ICMP_MAX,
+                .obj_size       = sizeof(unsigned int),
+                .nla_policy     = icmpv6_timeout_nla_policy,
+        },
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
 #ifdef CONFIG_SYSCTL
         .ctl_table_header       = &icmpv6_sysctl_header,
         .ctl_table              = icmpv6_sysctl_table,
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 38f00b0298d3..c9c78c2e666b 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -444,12 +444,11 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
         return head;
 
 out_oversize:
-        if (net_ratelimit())
-                printk(KERN_DEBUG "nf_ct_frag6_reasm: payload len = %d\n", payload_len);
+        net_dbg_ratelimited("nf_ct_frag6_reasm: payload len = %d\n",
+                            payload_len);
         goto out_fail;
 out_oom:
-        if (net_ratelimit())
-                printk(KERN_DEBUG "nf_ct_frag6_reasm: no memory for reassembly\n");
+        net_dbg_ratelimited("nf_ct_frag6_reasm: no memory for reassembly\n");
 out_fail:
         return NULL;
 }
@@ -626,8 +625,8 @@ int nf_ct_frag6_init(void)
         inet_frags_init(&nf_frags);
 
 #ifdef CONFIG_SYSCTL
-        nf_ct_frag6_sysctl_header = register_sysctl_paths(nf_net_netfilter_sysctl_path,
-                                                          nf_ct_frag6_sysctl_table);
+        nf_ct_frag6_sysctl_header = register_net_sysctl(&init_net, "net/netfilter",
+                                                        nf_ct_frag6_sysctl_table);
         if (!nf_ct_frag6_sysctl_header) {
                 inet_frags_fini(&nf_frags);
                 return -ENOMEM;
@@ -640,7 +639,7 @@ int nf_ct_frag6_init(void)
 void nf_ct_frag6_cleanup(void)
 {
 #ifdef CONFIG_SYSCTL
-        unregister_sysctl_table(nf_ct_frag6_sysctl_header);
+        unregister_net_sysctl_table(nf_ct_frag6_sysctl_header);
         nf_ct_frag6_sysctl_header = NULL;
 #endif
         inet_frags_fini(&nf_frags);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index d02f7e4dd611..93d69836fded 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -72,7 +72,7 @@ static struct sock *__raw_v6_lookup(struct net *net, struct sock *sk,
                 const struct in6_addr *rmt_addr, int dif)
 {
         struct hlist_node *node;
-        int is_multicast = ipv6_addr_is_multicast(loc_addr);
+        bool is_multicast = ipv6_addr_is_multicast(loc_addr);
 
         sk_for_each_from(sk, node)
                 if (inet_sk(sk)->inet_num == num) {
@@ -153,12 +153,12 @@ EXPORT_SYMBOL(rawv6_mh_filter_unregister);
  *
  *      Caller owns SKB so we must make clones.
  */
-static int ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
+static bool ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
 {
         const struct in6_addr *saddr;
         const struct in6_addr *daddr;
         struct sock *sk;
-        int delivered = 0;
+        bool delivered = false;
         __u8 hash;
         struct net *net;
 
@@ -179,7 +179,7 @@ static int ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
         while (sk) {
                 int filtered;
 
-                delivered = 1;
+                delivered = true;
                 switch (nexthdr) {
                 case IPPROTO_ICMPV6:
                         filtered = icmpv6_filter(sk, skb);
@@ -225,7 +225,7 @@ out:
         return delivered;
 }
 
-int raw6_local_deliver(struct sk_buff *skb, int nexthdr)
+bool raw6_local_deliver(struct sk_buff *skb, int nexthdr)
 {
         struct sock *raw_sk;
 
@@ -856,6 +856,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
 
         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
                 fl6.flowi6_oif = np->mcast_oif;
+        else if (!fl6.flowi6_oif)
+                fl6.flowi6_oif = np->ucast_oif;
         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 
         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index b69fae76a6f1..4ff9af628e72 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -134,15 +134,16 @@ static unsigned int ip6_hashfn(struct inet_frag_queue *q)
         return inet6_hash_frag(fq->id, &fq->saddr, &fq->daddr, ip6_frags.rnd);
 }
 
-int ip6_frag_match(struct inet_frag_queue *q, void *a)
+bool ip6_frag_match(struct inet_frag_queue *q, void *a)
 {
         struct frag_queue *fq;
         struct ip6_create_arg *arg = a;
 
         fq = container_of(q, struct frag_queue, q);
-        return (fq->id == arg->id && fq->user == arg->user &&
-                        ipv6_addr_equal(&fq->saddr, arg->src) &&
-                        ipv6_addr_equal(&fq->daddr, arg->dst));
+        return  fq->id == arg->id &&
+                fq->user == arg->user &&
+                ipv6_addr_equal(&fq->saddr, arg->src) &&
+                ipv6_addr_equal(&fq->daddr, arg->dst);
 }
 EXPORT_SYMBOL(ip6_frag_match);
 
@@ -336,12 +337,11 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
         }
 
 found:
-        /* RFC5722, Section 4:
-         *                                  When reassembling an IPv6 datagram, if
+        /* RFC5722, Section 4, amended by Errata ID : 3089
+         *                          When reassembling an IPv6 datagram, if
          *   one or more its constituent fragments is determined to be an
          *   overlapping fragment, the entire datagram (and any constituent
-         *   fragments, including those not yet received) MUST be silently
-         *   discarded.
+         *   fragments) MUST be silently discarded.
          */
 
         /* Check for overlap with preceding fragment. */
@@ -415,6 +415,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
         struct sk_buff *fp, *head = fq->q.fragments;
         int    payload_len;
         unsigned int nhoff;
+        int sum_truesize;
 
         fq_kill(fq);
 
@@ -434,7 +435,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
                 skb_morph(head, fq->q.fragments);
                 head->next = fq->q.fragments->next;
 
-                kfree_skb(fq->q.fragments);
+                consume_skb(fq->q.fragments);
                 fq->q.fragments = head;
         }
 
@@ -484,20 +485,33 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
         head->mac_header += sizeof(struct frag_hdr);
         head->network_header += sizeof(struct frag_hdr);
 
-        skb_shinfo(head)->frag_list = head->next;
         skb_reset_transport_header(head);
         skb_push(head, head->data - skb_network_header(head));
 
-        for (fp=head->next; fp; fp = fp->next) {
-                head->data_len += fp->len;
-                head->len += fp->len;
+        sum_truesize = head->truesize;
+        for (fp = head->next; fp;) {
+                bool headstolen;
+                int delta;
+                struct sk_buff *next = fp->next;
+
+                sum_truesize += fp->truesize;
                 if (head->ip_summed != fp->ip_summed)
                         head->ip_summed = CHECKSUM_NONE;
                 else if (head->ip_summed == CHECKSUM_COMPLETE)
                         head->csum = csum_add(head->csum, fp->csum);
-                head->truesize += fp->truesize;
+
+                if (skb_try_coalesce(head, fp, &headstolen, &delta)) {
+                        kfree_skb_partial(fp, headstolen);
+                } else {
+                        if (!skb_shinfo(head)->frag_list)
+                                skb_shinfo(head)->frag_list = fp;
+                        head->data_len += fp->len;
+                        head->len += fp->len;
+                        head->truesize += fp->truesize;
+                }
+                fp = next;
         }
-        atomic_sub(head->truesize, &fq->q.net->mem);
+        atomic_sub(sum_truesize, &fq->q.net->mem);
 
         head->next = NULL;
         head->dev = dev;
@@ -519,12 +533,10 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
         return 1;
 
 out_oversize:
-        if (net_ratelimit())
-                printk(KERN_DEBUG "ip6_frag_reasm: payload len = %d\n", payload_len);
+        net_dbg_ratelimited("ip6_frag_reasm: payload len = %d\n", payload_len);
         goto out_fail;
 out_oom:
-        if (net_ratelimit())
-                printk(KERN_DEBUG "ip6_frag_reasm: no memory for reassembly\n");
+        net_dbg_ratelimited("ip6_frag_reasm: no memory for reassembly\n");
 out_fail:
         rcu_read_lock();
         IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
@@ -647,7 +659,7 @@ static int __net_init ip6_frags_ns_sysctl_register(struct net *net)
                 table[2].data = &net->ipv6.frags.timeout;
         }
 
-        hdr = register_net_sysctl_table(net, net_ipv6_ctl_path, table);
+        hdr = register_net_sysctl(net, "net/ipv6", table);
         if (hdr == NULL)
                 goto err_reg;
 
@@ -675,7 +687,7 @@ static struct ctl_table_header *ip6_ctl_header;
 
 static int ip6_frags_sysctl_register(void)
 {
-        ip6_ctl_header = register_net_sysctl_rotable(net_ipv6_ctl_path,
+        ip6_ctl_header = register_net_sysctl(&init_net, "net/ipv6",
                         ip6_frags_ctl_table);
         return ip6_ctl_header == NULL ? -ENOMEM : 0;
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 22b766407de1..999a982ad3fd 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -24,6 +24,8 @@
  *              Fixed routing subtrees.
  */
 
+#define pr_fmt(fmt) "IPv6: " fmt
+
 #include <linux/capability.h>
 #include <linux/errno.h>
 #include <linux/export.h>
@@ -62,7 +64,7 @@
 #include <linux/sysctl.h>
 #endif
 
-static struct rt6_info *ip6_rt_copy(const struct rt6_info *ort,
+static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
                                     const struct in6_addr *dest);
 static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie);
 static unsigned int      ip6_default_advmss(const struct dst_entry *dst);
@@ -82,7 +84,7 @@ static void		ip6_rt_update_pmtu(struct dst_entry *dst, u32 mtu);
 static struct rt6_info *rt6_add_route_info(struct net *net,
                                            const struct in6_addr *prefix, int prefixlen,
                                            const struct in6_addr *gwaddr, int ifindex,
-                                           unsigned pref);
+                                           unsigned int pref);
 static struct rt6_info *rt6_get_route_info(struct net *net,
                                            const struct in6_addr *prefix, int prefixlen,
                                            const struct in6_addr *gwaddr, int ifindex);
@@ -121,9 +123,22 @@ static u32 *ipv6_cow_metrics(struct dst_entry *dst, unsigned long old)
         return p;
 }
 
+static inline const void *choose_neigh_daddr(struct rt6_info *rt, const void *daddr)
+{
+        struct in6_addr *p = &rt->rt6i_gateway;
+
+        if (!ipv6_addr_any(p))
+                return (const void *) p;
+        return daddr;
+}
+
 static struct neighbour *ip6_neigh_lookup(const struct dst_entry *dst, const void *daddr)
 {
-        struct neighbour *n = __ipv6_neigh_lookup(&nd_tbl, dst->dev, daddr);
+        struct rt6_info *rt = (struct rt6_info *) dst;
+        struct neighbour *n;
+
+        daddr = choose_neigh_daddr(rt, daddr);
+        n = __ipv6_neigh_lookup(&nd_tbl, dst->dev, daddr);
         if (n)
                 return n;
         return neigh_create(&nd_tbl, daddr, dst->dev);
@@ -272,6 +287,10 @@ static void ip6_dst_destroy(struct dst_entry *dst)
                 rt->rt6i_idev = NULL;
                 in6_dev_put(idev);
         }
+
+        if (!(rt->rt6i_flags & RTF_EXPIRES) && dst->from)
+                dst_release(dst->from);
+
         if (peer) {
                 rt->rt6i_peer = NULL;
                 inet_putpeer(peer);
@@ -314,13 +333,22 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
         }
 }
 
-static __inline__ int rt6_check_expired(const struct rt6_info *rt)
+static bool rt6_check_expired(const struct rt6_info *rt)
 {
-        return (rt->rt6i_flags & RTF_EXPIRES) &&
-                time_after(jiffies, rt->dst.expires);
+        struct rt6_info *ort = NULL;
+
+        if (rt->rt6i_flags & RTF_EXPIRES) {
+                if (time_after(jiffies, rt->dst.expires))
+                        return true;
+        } else if (rt->dst.from) {
+                ort = (struct rt6_info *) rt->dst.from;
+                return (ort->rt6i_flags & RTF_EXPIRES) &&
+                        time_after(jiffies, ort->dst.expires);
+        }
+        return false;
 }
 
-static inline int rt6_need_strict(const struct in6_addr *daddr)
+static bool rt6_need_strict(const struct in6_addr *daddr)
 {
         return ipv6_addr_type(daddr) &
                 (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
@@ -607,12 +635,11 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
                                  (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
 
         if (rt) {
-                if (!addrconf_finite_timeout(lifetime)) {
-                        rt->rt6i_flags &= ~RTF_EXPIRES;
-                } else {
-                        rt->dst.expires = jiffies + HZ * lifetime;
-                        rt->rt6i_flags |= RTF_EXPIRES;
-                }
+                if (!addrconf_finite_timeout(lifetime))
+                        rt6_clean_expires(rt);
+                else
+                        rt6_set_expires(rt, jiffies + HZ * lifetime);
+
                 dst_release(&rt->dst);
         }
         return 0;
@@ -717,7 +744,7 @@ int ip6_ins_rt(struct rt6_info *rt)
         return __ip6_ins_rt(rt, &info);
 }
 
-static struct rt6_info *rt6_alloc_cow(const struct rt6_info *ort,
+static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort,
                                       const struct in6_addr *daddr,
                                       const struct in6_addr *saddr)
 {
@@ -769,9 +796,7 @@ static struct rt6_info *rt6_alloc_cow(const struct rt6_info *ort,
                                 goto retry;
                         }
 
-                        if (net_ratelimit())
-                                printk(KERN_WARNING
-                                       "ipv6: Neighbour table overflow.\n");
+                        net_warn_ratelimited("Neighbour table overflow\n");
                         dst_free(&rt->dst);
                         return NULL;
                 }
@@ -868,6 +893,16 @@ static struct rt6_info *ip6_pol_route_input(struct net *net, struct fib6_table *
         return ip6_pol_route(net, table, fl6->flowi6_iif, fl6, flags);
 }
 
+static struct dst_entry *ip6_route_input_lookup(struct net *net,
+                                                struct net_device *dev,
+                                                struct flowi6 *fl6, int flags)
+{
+        if (rt6_need_strict(&fl6->daddr) && dev->type != ARPHRD_PIMREG)
+                flags |= RT6_LOOKUP_F_IFACE;
+
+        return fib6_rule_lookup(net, fl6, flags, ip6_pol_route_input);
+}
+
 void ip6_route_input(struct sk_buff *skb)
 {
         const struct ipv6hdr *iph = ipv6_hdr(skb);
@@ -882,10 +917,7 @@ void ip6_route_input(struct sk_buff *skb)
                 .flowi6_proto = iph->nexthdr,
         };
 
-        if (rt6_need_strict(&iph->daddr) && skb->dev->type != ARPHRD_PIMREG)
-                flags |= RT6_LOOKUP_F_IFACE;
-
-        skb_dst_set(skb, fib6_rule_lookup(net, &fl6, flags, ip6_pol_route_input));
+        skb_dst_set(skb, ip6_route_input_lookup(net, skb->dev, &fl6, flags));
 }
 
 static struct rt6_info *ip6_pol_route_output(struct net *net, struct fib6_table *table,
@@ -934,10 +966,10 @@ struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_ori
                 rt->rt6i_idev = ort->rt6i_idev;
                 if (rt->rt6i_idev)
                         in6_dev_hold(rt->rt6i_idev);
-                rt->dst.expires = 0;
 
                 rt->rt6i_gateway = ort->rt6i_gateway;
-                rt->rt6i_flags = ort->rt6i_flags & ~RTF_EXPIRES;
+                rt->rt6i_flags = ort->rt6i_flags;
+                rt6_clean_expires(rt);
                 rt->rt6i_metric = 0;
 
                 memcpy(&rt->rt6i_dst, &ort->rt6i_dst, sizeof(struct rt6key));
@@ -999,10 +1031,9 @@ static void ip6_link_failure(struct sk_buff *skb)
 
         rt = (struct rt6_info *) skb_dst(skb);
         if (rt) {
-                if (rt->rt6i_flags & RTF_CACHE) {
-                        dst_set_expires(&rt->dst, 0);
-                        rt->rt6i_flags |= RTF_EXPIRES;
-                } else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT))
+                if (rt->rt6i_flags & RTF_CACHE)
+                        rt6_update_expires(rt, 0);
+                else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT))
                         rt->rt6i_node->fn_sernum = -1;
         }
 }
@@ -1251,7 +1282,7 @@ int ip6_route_add(struct fib6_config *cfg)
             !(cfg->fc_nlinfo.nlh->nlmsg_flags & NLM_F_CREATE)) {
                 table = fib6_get_table(net, cfg->fc_table);
                 if (!table) {
-                        printk(KERN_WARNING "IPv6: NLM_F_CREATE should be specified when creating new route\n");
+                        pr_warn("NLM_F_CREATE should be specified when creating new route\n");
                         table = fib6_new_table(net, cfg->fc_table);
                 }
         } else {
@@ -1269,9 +1300,12 @@ int ip6_route_add(struct fib6_config *cfg)
         }
 
         rt->dst.obsolete = -1;
-        rt->dst.expires = (cfg->fc_flags & RTF_EXPIRES) ?
-                                jiffies + clock_t_to_jiffies(cfg->fc_expires) :
-                                0;
+
+        if (cfg->fc_flags & RTF_EXPIRES)
+                rt6_set_expires(rt, jiffies +
+                                clock_t_to_jiffies(cfg->fc_expires));
+        else
+                rt6_clean_expires(rt);
 
         if (cfg->fc_protocol == RTPROT_UNSPEC)
                 cfg->fc_protocol = RTPROT_BOOT;
@@ -1609,9 +1643,7 @@ void rt6_redirect(const struct in6_addr *dest, const struct in6_addr *src,
         rt = ip6_route_redirect(dest, src, saddr, neigh->dev);
 
         if (rt == net->ipv6.ip6_null_entry) {
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "rt6_redirect: source isn't a valid nexthop "
-                               "for redirect target\n");
+                net_dbg_ratelimited("rt6_redirect: source isn't a valid nexthop for redirect target\n");
                 goto out;
         }
 
@@ -1716,8 +1748,8 @@ again:
                         features |= RTAX_FEATURE_ALLFRAG;
                         dst_metric_set(&rt->dst, RTAX_FEATURES, features);
                 }
-                dst_set_expires(&rt->dst, net->ipv6.sysctl.ip6_rt_mtu_expires);
-                rt->rt6i_flags |= RTF_MODIFIED|RTF_EXPIRES;
+                rt6_update_expires(rt, net->ipv6.sysctl.ip6_rt_mtu_expires);
+                rt->rt6i_flags |= RTF_MODIFIED;
                 goto out;
         }
 
@@ -1745,9 +1777,8 @@ again:
                  * which is 10 mins. After 10 mins the decreased pmtu is expired
                  * and detecting PMTU increase will be automatically happened.
                  */
-                dst_set_expires(&nrt->dst, net->ipv6.sysctl.ip6_rt_mtu_expires);
-                nrt->rt6i_flags |= RTF_DYNAMIC|RTF_EXPIRES;
-
+                rt6_update_expires(nrt, net->ipv6.sysctl.ip6_rt_mtu_expires);
+                nrt->rt6i_flags |= RTF_DYNAMIC;
                 ip6_ins_rt(nrt);
         }
 out:
@@ -1779,7 +1810,7 @@ void rt6_pmtu_discovery(const struct in6_addr *daddr, const struct in6_addr *sad
  *      Misc support functions
  */
 
-static struct rt6_info *ip6_rt_copy(const struct rt6_info *ort,
+static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
                                     const struct in6_addr *dest)
 {
         struct net *net = dev_net(ort->dst.dev);
@@ -1799,10 +1830,14 @@ static struct rt6_info *ip6_rt_copy(const struct rt6_info *ort,
                 if (rt->rt6i_idev)
                         in6_dev_hold(rt->rt6i_idev);
                 rt->dst.lastuse = jiffies;
-                rt->dst.expires = 0;
 
                 rt->rt6i_gateway = ort->rt6i_gateway;
-                rt->rt6i_flags = ort->rt6i_flags & ~RTF_EXPIRES;
+                rt->rt6i_flags = ort->rt6i_flags;
+                if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ==
+                    (RTF_DEFAULT | RTF_ADDRCONF))
+                        rt6_set_from(rt, ort);
+                else
+                        rt6_clean_expires(rt);
                 rt->rt6i_metric = 0;
 
 #ifdef CONFIG_IPV6_SUBTREES
@@ -1850,7 +1885,7 @@ out:
 static struct rt6_info *rt6_add_route_info(struct net *net,
                                            const struct in6_addr *prefix, int prefixlen,
                                            const struct in6_addr *gwaddr, int ifindex,
-                                           unsigned pref)
+                                           unsigned int pref)
 {
         struct fib6_config cfg = {
                 .fc_table       = RT6_TABLE_INFO,
@@ -2069,9 +2104,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
         int err;
 
         if (!rt) {
-                if (net_ratelimit())
-                        pr_warning("IPv6:  Maximum number of routes reached,"
-                                   " consider increasing route/max_size.\n");
+                net_warn_ratelimited("Maximum number of routes reached, consider increasing route/max_size\n");
                 return ERR_PTR(-ENOMEM);
         }
 
@@ -2180,10 +2213,9 @@ void rt6_ifdown(struct net *net, struct net_device *dev)
         icmp6_clean_all(fib6_ifdown, &adn);
 }
 
-struct rt6_mtu_change_arg
-{
+struct rt6_mtu_change_arg {
         struct net_device *dev;
-        unsigned mtu;
+        unsigned int mtu;
 };
 
 static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
@@ -2225,7 +2257,7 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
         return 0;
 }
 
-void rt6_mtu_change(struct net_device *dev, unsigned mtu)
+void rt6_mtu_change(struct net_device *dev, unsigned int mtu)
 {
         struct rt6_mtu_change_arg arg = {
                 .dev = dev,
@@ -2393,7 +2425,8 @@ static int rt6_fill_node(struct net *net,
         else
                 table = RT6_TABLE_UNSPEC;
         rtm->rtm_table = table;
-        NLA_PUT_U32(skb, RTA_TABLE, table);
+        if (nla_put_u32(skb, RTA_TABLE, table))
+                goto nla_put_failure;
         if (rt->rt6i_flags & RTF_REJECT)
                 rtm->rtm_type = RTN_UNREACHABLE;
         else if (rt->rt6i_flags & RTF_LOCAL)
@@ -2416,16 +2449,20 @@ static int rt6_fill_node(struct net *net,
                 rtm->rtm_flags |= RTM_F_CLONED;
 
         if (dst) {
-                NLA_PUT(skb, RTA_DST, 16, dst);
+                if (nla_put(skb, RTA_DST, 16, dst))
+                        goto nla_put_failure;
                 rtm->rtm_dst_len = 128;
         } else if (rtm->rtm_dst_len)
-                NLA_PUT(skb, RTA_DST, 16, &rt->rt6i_dst.addr);
+                if (nla_put(skb, RTA_DST, 16, &rt->rt6i_dst.addr))
+                        goto nla_put_failure;
 #ifdef CONFIG_IPV6_SUBTREES
         if (src) {
-                NLA_PUT(skb, RTA_SRC, 16, src);
+                if (nla_put(skb, RTA_SRC, 16, src))
+                        goto nla_put_failure;
                 rtm->rtm_src_len = 128;
-        } else if (rtm->rtm_src_len)
-                NLA_PUT(skb, RTA_SRC, 16, &rt->rt6i_src.addr);
+        } else if (rtm->rtm_src_len &&
+                   nla_put(skb, RTA_SRC, 16, &rt->rt6i_src.addr))
+                goto nla_put_failure;
 #endif
         if (iif) {
 #ifdef CONFIG_IPV6_MROUTE
@@ -2443,17 +2480,20 @@ static int rt6_fill_node(struct net *net,
                         }
                 } else
 #endif
-                        NLA_PUT_U32(skb, RTA_IIF, iif);
+                        if (nla_put_u32(skb, RTA_IIF, iif))
+                                goto nla_put_failure;
         } else if (dst) {
                 struct in6_addr saddr_buf;
-                if (ip6_route_get_saddr(net, rt, dst, 0, &saddr_buf) == 0)
-                        NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
+                if (ip6_route_get_saddr(net, rt, dst, 0, &saddr_buf) == 0 &&
+                    nla_put(skb, RTA_PREFSRC, 16, &saddr_buf))
+                        goto nla_put_failure;
         }
 
         if (rt->rt6i_prefsrc.plen) {
                 struct in6_addr saddr_buf;
                 saddr_buf = rt->rt6i_prefsrc.addr;
-                NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
+                if (nla_put(skb, RTA_PREFSRC, 16, &saddr_buf))
+                        goto nla_put_failure;
         }
 
         if (rtnetlink_put_metrics(skb, dst_metrics_ptr(&rt->dst)) < 0)
@@ -2461,15 +2501,19 @@ static int rt6_fill_node(struct net *net,
 
         rcu_read_lock();
         n = dst_get_neighbour_noref(&rt->dst);
-        if (n)
-                NLA_PUT(skb, RTA_GATEWAY, 16, &n->primary_key);
+        if (n) {
+                if (nla_put(skb, RTA_GATEWAY, 16, &n->primary_key) < 0) {
+                        rcu_read_unlock();
+                        goto nla_put_failure;
+                }
+        }
         rcu_read_unlock();
 
-        if (rt->dst.dev)
-                NLA_PUT_U32(skb, RTA_OIF, rt->dst.dev->ifindex);
-
-        NLA_PUT_U32(skb, RTA_PRIORITY, rt->rt6i_metric);
-
+        if (rt->dst.dev &&
+            nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex))
+                goto nla_put_failure;
+        if (nla_put_u32(skb, RTA_PRIORITY, rt->rt6i_metric))
+                goto nla_put_failure;
         if (!(rt->rt6i_flags & RTF_EXPIRES))
                 expires = 0;
         else if (rt->dst.expires - jiffies < INT_MAX)
@@ -2520,7 +2564,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         struct sk_buff *skb;
         struct rtmsg *rtm;
         struct flowi6 fl6;
-        int err, iif = 0;
+        int err, iif = 0, oif = 0;
 
         err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv6_policy);
         if (err < 0)
@@ -2547,19 +2591,34 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
                 iif = nla_get_u32(tb[RTA_IIF]);
 
         if (tb[RTA_OIF])
-                fl6.flowi6_oif = nla_get_u32(tb[RTA_OIF]);
+                oif = nla_get_u32(tb[RTA_OIF]);
 
         if (iif) {
                 struct net_device *dev;
+                int flags = 0;
+
                 dev = __dev_get_by_index(net, iif);
                 if (!dev) {
                         err = -ENODEV;
                         goto errout;
                 }
+
+                fl6.flowi6_iif = iif;
+
+                if (!ipv6_addr_any(&fl6.saddr))
+                        flags |= RT6_LOOKUP_F_HAS_SADDR;
+
+                rt = (struct rt6_info *)ip6_route_input_lookup(net, dev, &fl6,
+                                                               flags);
+        } else {
+                fl6.flowi6_oif = oif;
+
+                rt = (struct rt6_info *)ip6_route_output(net, NULL, &fl6);
         }
 
         skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
         if (!skb) {
+                dst_release(&rt->dst);
                 err = -ENOBUFS;
                 goto errout;
         }
@@ -2570,7 +2629,6 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         skb_reset_mac_header(skb);
         skb_reserve(skb, MAX_HEADER + sizeof(struct ipv6hdr));
 
-        rt = (struct rt6_info*) ip6_route_output(net, NULL, &fl6);
         skb_dst_set(skb, &rt->dst);
 
         err = rt6_fill_node(net, skb, rt, &fl6.daddr, &fl6.saddr, iif,
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 133768e52912..60415711563f 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -17,6 +17,8 @@
  * Fred Templin <fred.l.templin@boeing.com>:    isatap support
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/capability.h>
 #include <linux/errno.h>
@@ -87,35 +89,51 @@ struct sit_net {
 
 /* often modified stats are per cpu, other are shared (netdev->stats) */
 struct pcpu_tstats {
-        unsigned long   rx_packets;
-        unsigned long   rx_bytes;
-        unsigned long   tx_packets;
-        unsigned long   tx_bytes;
-} __attribute__((aligned(4*sizeof(unsigned long))));
+        u64     rx_packets;
+        u64     rx_bytes;
+        u64     tx_packets;
+        u64     tx_bytes;
+        struct u64_stats_sync   syncp;
+};
 
-static struct net_device_stats *ipip6_get_stats(struct net_device *dev)
+static struct rtnl_link_stats64 *ipip6_get_stats64(struct net_device *dev,
+                                                   struct rtnl_link_stats64 *tot)
 {
-        struct pcpu_tstats sum = { 0 };
         int i;
 
         for_each_possible_cpu(i) {
                 const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
-
-                sum.rx_packets += tstats->rx_packets;
-                sum.rx_bytes   += tstats->rx_bytes;
-                sum.tx_packets += tstats->tx_packets;
-                sum.tx_bytes   += tstats->tx_bytes;
+                u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
+                unsigned int start;
+
+                do {
+                        start = u64_stats_fetch_begin_bh(&tstats->syncp);
+                        rx_packets = tstats->rx_packets;
+                        tx_packets = tstats->tx_packets;
+                        rx_bytes = tstats->rx_bytes;
+                        tx_bytes = tstats->tx_bytes;
+                } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
+
+                tot->rx_packets += rx_packets;
+                tot->tx_packets += tx_packets;
+                tot->rx_bytes   += rx_bytes;
+                tot->tx_bytes   += tx_bytes;
         }
-        dev->stats.rx_packets = sum.rx_packets;
-        dev->stats.rx_bytes   = sum.rx_bytes;
-        dev->stats.tx_packets = sum.tx_packets;
-        dev->stats.tx_bytes   = sum.tx_bytes;
-        return &dev->stats;
+
+        tot->rx_errors = dev->stats.rx_errors;
+        tot->tx_fifo_errors = dev->stats.tx_fifo_errors;
+        tot->tx_carrier_errors = dev->stats.tx_carrier_errors;
+        tot->tx_dropped = dev->stats.tx_dropped;
+        tot->tx_aborted_errors = dev->stats.tx_aborted_errors;
+        tot->tx_errors = dev->stats.tx_errors;
+
+        return tot;
 }
+
 /*
  * Must be invoked with rcu_read_lock
  */
-static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
+static struct ip_tunnel *ipip6_tunnel_lookup(struct net *net,
                 struct net_device *dev, __be32 remote, __be32 local)
 {
         unsigned int h0 = HASH(remote);
@@ -680,23 +698,27 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
         /* ISATAP (RFC4214) - must come before 6to4 */
         if (dev->priv_flags & IFF_ISATAP) {
                 struct neighbour *neigh = NULL;
+                bool do_tx_error = false;
 
                 if (skb_dst(skb))
-                        neigh = dst_get_neighbour_noref(skb_dst(skb));
+                        neigh = dst_neigh_lookup(skb_dst(skb), &iph6->daddr);
 
                 if (neigh == NULL) {
-                        if (net_ratelimit())
-                                printk(KERN_DEBUG "sit: nexthop == NULL\n");
+                        net_dbg_ratelimited("sit: nexthop == NULL\n");
                         goto tx_error;
                 }
 
-                addr6 = (const struct in6_addr*)&neigh->primary_key;
+                addr6 = (const struct in6_addr *)&neigh->primary_key;
                 addr_type = ipv6_addr_type(addr6);
 
                 if ((addr_type & IPV6_ADDR_UNICAST) &&
                      ipv6_addr_is_isatap(addr6))
                         dst = addr6->s6_addr32[3];
                 else
+                        do_tx_error = true;
+
+                neigh_release(neigh);
+                if (do_tx_error)
                         goto tx_error;
         }
 
@@ -705,17 +727,17 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
 
         if (!dst) {
                 struct neighbour *neigh = NULL;
+                bool do_tx_error = false;
 
                 if (skb_dst(skb))
-                        neigh = dst_get_neighbour_noref(skb_dst(skb));
+                        neigh = dst_neigh_lookup(skb_dst(skb), &iph6->daddr);
 
                 if (neigh == NULL) {
-                        if (net_ratelimit())
-                                printk(KERN_DEBUG "sit: nexthop == NULL\n");
+                        net_dbg_ratelimited("sit: nexthop == NULL\n");
                         goto tx_error;
                 }
 
-                addr6 = (const struct in6_addr*)&neigh->primary_key;
+                addr6 = (const struct in6_addr *)&neigh->primary_key;
                 addr_type = ipv6_addr_type(addr6);
 
                 if (addr_type == IPV6_ADDR_ANY) {
@@ -723,10 +745,14 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                         addr_type = ipv6_addr_type(addr6);
                 }
 
-                if ((addr_type & IPV6_ADDR_COMPATv4) == 0)
-                        goto tx_error_icmp;
+                if ((addr_type & IPV6_ADDR_COMPATv4) != 0)
+                        dst = addr6->s6_addr32[3];
+                else
+                        do_tx_error = true;
 
-                dst = addr6->s6_addr32[3];
+                neigh_release(neigh);
+                if (do_tx_error)
+                        goto tx_error;
         }
 
         rt = ip_route_output_ports(dev_net(dev), &fl4, NULL,
@@ -1116,7 +1142,7 @@ static const struct net_device_ops ipip6_netdev_ops = {
         .ndo_start_xmit = ipip6_tunnel_xmit,
         .ndo_do_ioctl   = ipip6_tunnel_ioctl,
         .ndo_change_mtu = ipip6_tunnel_change_mtu,
-        .ndo_get_stats  = ipip6_get_stats,
+        .ndo_get_stats64= ipip6_get_stats64,
 };
 
 static void ipip6_dev_free(struct net_device *dev)
@@ -1277,7 +1303,7 @@ static int __init sit_init(void)
 {
         int err;
 
-        printk(KERN_INFO "IPv6 over IPv4 tunneling driver\n");
+        pr_info("IPv6 over IPv4 tunneling driver\n");
 
         err = register_pernet_device(&sit_net_ops);
         if (err < 0)
@@ -1285,7 +1311,7 @@ static int __init sit_init(void)
         err = xfrm4_tunnel_register(&sit_handler, AF_INET6);
         if (err < 0) {
                 unregister_pernet_device(&sit_net_ops);
-                printk(KERN_INFO "sit init: Can't add protocol\n");
+                pr_info("%s: can't add protocol\n", __func__);
         }
         return err;
 }
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index 166a57c47d39..e85c48bd404f 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -16,32 +16,8 @@
 #include <net/addrconf.h>
 #include <net/inet_frag.h>
 
-static struct ctl_table empty[1];
-
-static ctl_table ipv6_static_skeleton[] = {
-        {
-                .procname       = "neigh",
-                .maxlen         = 0,
-                .mode           = 0555,
-                .child          = empty,
-        },
-        { }
-};
-
 static ctl_table ipv6_table_template[] = {
         {
-                .procname       = "route",
-                .maxlen         = 0,
-                .mode           = 0555,
-                .child          = ipv6_route_table_template
-        },
-        {
-                .procname       = "icmp",
-                .maxlen         = 0,
-                .mode           = 0555,
-                .child          = ipv6_icmp_table_template
-        },
-        {
                 .procname       = "bindv6only",
                 .data           = &init_net.ipv6.sysctl.bindv6only,
                 .maxlen         = sizeof(int),
@@ -62,13 +38,6 @@ static ctl_table ipv6_rotable[] = {
         { }
 };
 
-struct ctl_path net_ipv6_ctl_path[] = {
-        { .procname = "net", },
-        { .procname = "ipv6", },
-        { },
-};
-EXPORT_SYMBOL_GPL(net_ipv6_ctl_path);
-
 static int __net_init ipv6_sysctl_net_init(struct net *net)
 {
         struct ctl_table *ipv6_table;
@@ -81,28 +50,37 @@ static int __net_init ipv6_sysctl_net_init(struct net *net)
                              GFP_KERNEL);
         if (!ipv6_table)
                 goto out;
+        ipv6_table[0].data = &net->ipv6.sysctl.bindv6only;
 
         ipv6_route_table = ipv6_route_sysctl_init(net);
         if (!ipv6_route_table)
                 goto out_ipv6_table;
-        ipv6_table[0].child = ipv6_route_table;
 
         ipv6_icmp_table = ipv6_icmp_sysctl_init(net);
         if (!ipv6_icmp_table)
                 goto out_ipv6_route_table;
-        ipv6_table[1].child = ipv6_icmp_table;
 
-        ipv6_table[2].data = &net->ipv6.sysctl.bindv6only;
-
-        net->ipv6.sysctl.table = register_net_sysctl_table(net, net_ipv6_ctl_path,
-                                                           ipv6_table);
-        if (!net->ipv6.sysctl.table)
+        net->ipv6.sysctl.hdr = register_net_sysctl(net, "net/ipv6", ipv6_table);
+        if (!net->ipv6.sysctl.hdr)
                 goto out_ipv6_icmp_table;
 
+        net->ipv6.sysctl.route_hdr =
+                register_net_sysctl(net, "net/ipv6/route", ipv6_route_table);
+        if (!net->ipv6.sysctl.route_hdr)
+                goto out_unregister_ipv6_table;
+
+        net->ipv6.sysctl.icmp_hdr =
+                register_net_sysctl(net, "net/ipv6/icmp", ipv6_icmp_table);
+        if (!net->ipv6.sysctl.icmp_hdr)
+                goto out_unregister_route_table;
+
         err = 0;
 out:
         return err;
-
+out_unregister_route_table:
+        unregister_net_sysctl_table(net->ipv6.sysctl.route_hdr);
+out_unregister_ipv6_table:
+        unregister_net_sysctl_table(net->ipv6.sysctl.hdr);
 out_ipv6_icmp_table:
         kfree(ipv6_icmp_table);
 out_ipv6_route_table:
@@ -118,11 +96,13 @@ static void __net_exit ipv6_sysctl_net_exit(struct net *net)
         struct ctl_table *ipv6_route_table;
         struct ctl_table *ipv6_icmp_table;
 
-        ipv6_table = net->ipv6.sysctl.table->ctl_table_arg;
-        ipv6_route_table = ipv6_table[0].child;
-        ipv6_icmp_table = ipv6_table[1].child;
+        ipv6_table = net->ipv6.sysctl.hdr->ctl_table_arg;
+        ipv6_route_table = net->ipv6.sysctl.route_hdr->ctl_table_arg;
+        ipv6_icmp_table = net->ipv6.sysctl.icmp_hdr->ctl_table_arg;
 
-        unregister_net_sysctl_table(net->ipv6.sysctl.table);
+        unregister_net_sysctl_table(net->ipv6.sysctl.icmp_hdr);
+        unregister_net_sysctl_table(net->ipv6.sysctl.route_hdr);
+        unregister_net_sysctl_table(net->ipv6.sysctl.hdr);
 
         kfree(ipv6_table);
         kfree(ipv6_route_table);
@@ -140,7 +120,7 @@ int ipv6_sysctl_register(void)
 {
         int err = -ENOMEM;
 
-        ip6_header = register_net_sysctl_rotable(net_ipv6_ctl_path, ipv6_rotable);
+        ip6_header = register_net_sysctl(&init_net, "net/ipv6", ipv6_rotable);
         if (ip6_header == NULL)
                 goto out;
 
@@ -160,18 +140,3 @@ void ipv6_sysctl_unregister(void)
         unregister_net_sysctl_table(ip6_header);
         unregister_pernet_subsys(&ipv6_sysctl_net_ops);
 }
-
-static struct ctl_table_header *ip6_base;
-
-int ipv6_static_sysctl_register(void)
-{
-        ip6_base = register_sysctl_paths(net_ipv6_ctl_path, ipv6_static_skeleton);
-        if (ip6_base == NULL)
-                return -ENOMEM;
-        return 0;
-}
-
-void ipv6_static_sysctl_unregister(void)
-{
-        unregister_net_sysctl_table(ip6_base);
-}
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 3edd05ae4388..3a9aec29581a 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -476,7 +476,8 @@ out:
 
 
 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
-                              struct request_values *rvp)
+                              struct request_values *rvp,
+                              u16 queue_mapping)
 {
         struct inet6_request_sock *treq = inet6_rsk(req);
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -513,6 +514,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 
                 fl6.daddr = treq->rmt_addr;
+                skb_set_queue_mapping(skb, queue_mapping);
                 err = ip6_xmit(sk, skb, &fl6, opt, np->tclass);
                 err = net_xmit_eval(err);
         }
@@ -528,7 +530,7 @@ static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
                              struct request_values *rvp)
 {
         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
-        return tcp_v6_send_synack(sk, req, rvp);
+        return tcp_v6_send_synack(sk, req, rvp, 0);
 }
 
 static void tcp_v6_reqsk_destructor(struct request_sock *req)
@@ -540,19 +542,7 @@ static void tcp_v6_reqsk_destructor(struct request_sock *req)
 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
                                                    const struct in6_addr *addr)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
-        int i;
-
-        BUG_ON(tp == NULL);
-
-        if (!tp->md5sig_info || !tp->md5sig_info->entries6)
-                return NULL;
-
-        for (i = 0; i < tp->md5sig_info->entries6; i++) {
-                if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, addr))
-                        return &tp->md5sig_info->keys6[i].base;
-        }
-        return NULL;
+        return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 }
 
 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
@@ -567,136 +557,11 @@ static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 }
 
-static int tcp_v6_md5_do_add(struct sock *sk, const struct in6_addr *peer,
-                             char *newkey, u8 newkeylen)
-{
-        /* Add key to the list */
-        struct tcp_md5sig_key *key;
-        struct tcp_sock *tp = tcp_sk(sk);
-        struct tcp6_md5sig_key *keys;
-
-        key = tcp_v6_md5_do_lookup(sk, peer);
-        if (key) {
-                /* modify existing entry - just update that one */
-                kfree(key->key);
-                key->key = newkey;
-                key->keylen = newkeylen;
-        } else {
-                /* reallocate new list if current one is full. */
-                if (!tp->md5sig_info) {
-                        tp->md5sig_info = kzalloc(sizeof(*tp->md5sig_info), GFP_ATOMIC);
-                        if (!tp->md5sig_info) {
-                                kfree(newkey);
-                                return -ENOMEM;
-                        }
-                        sk_nocaps_add(sk, NETIF_F_GSO_MASK);
-                }
-                if (tp->md5sig_info->entries6 == 0 &&
-                        tcp_alloc_md5sig_pool(sk) == NULL) {
-                        kfree(newkey);
-                        return -ENOMEM;
-                }
-                if (tp->md5sig_info->alloced6 == tp->md5sig_info->entries6) {
-                        keys = kmalloc((sizeof (tp->md5sig_info->keys6[0]) *
-                                       (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
-
-                        if (!keys) {
-                                kfree(newkey);
-                                if (tp->md5sig_info->entries6 == 0)
-                                        tcp_free_md5sig_pool();
-                                return -ENOMEM;
-                        }
-
-                        if (tp->md5sig_info->entries6)
-                                memmove(keys, tp->md5sig_info->keys6,
-                                        (sizeof (tp->md5sig_info->keys6[0]) *
-                                         tp->md5sig_info->entries6));
-
-                        kfree(tp->md5sig_info->keys6);
-                        tp->md5sig_info->keys6 = keys;
-                        tp->md5sig_info->alloced6++;
-                }
-
-                tp->md5sig_info->keys6[tp->md5sig_info->entries6].addr = *peer;
-                tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.key = newkey;
-                tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.keylen = newkeylen;
-
-                tp->md5sig_info->entries6++;
-        }
-        return 0;
-}
-
-static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
-                               u8 *newkey, __u8 newkeylen)
-{
-        return tcp_v6_md5_do_add(sk, &inet6_sk(addr_sk)->daddr,
-                                 newkey, newkeylen);
-}
-
-static int tcp_v6_md5_do_del(struct sock *sk, const struct in6_addr *peer)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-        int i;
-
-        for (i = 0; i < tp->md5sig_info->entries6; i++) {
-                if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, peer)) {
-                        /* Free the key */
-                        kfree(tp->md5sig_info->keys6[i].base.key);
-                        tp->md5sig_info->entries6--;
-
-                        if (tp->md5sig_info->entries6 == 0) {
-                                kfree(tp->md5sig_info->keys6);
-                                tp->md5sig_info->keys6 = NULL;
-                                tp->md5sig_info->alloced6 = 0;
-                                tcp_free_md5sig_pool();
-                        } else {
-                                /* shrink the database */
-                                if (tp->md5sig_info->entries6 != i)
-                                        memmove(&tp->md5sig_info->keys6[i],
-                                                &tp->md5sig_info->keys6[i+1],
-                                                (tp->md5sig_info->entries6 - i)
-                                                * sizeof (tp->md5sig_info->keys6[0]));
-                        }
-                        return 0;
-                }
-        }
-        return -ENOENT;
-}
-
-static void tcp_v6_clear_md5_list (struct sock *sk)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-        int i;
-
-        if (tp->md5sig_info->entries6) {
-                for (i = 0; i < tp->md5sig_info->entries6; i++)
-                        kfree(tp->md5sig_info->keys6[i].base.key);
-                tp->md5sig_info->entries6 = 0;
-                tcp_free_md5sig_pool();
-        }
-
-        kfree(tp->md5sig_info->keys6);
-        tp->md5sig_info->keys6 = NULL;
-        tp->md5sig_info->alloced6 = 0;
-
-        if (tp->md5sig_info->entries4) {
-                for (i = 0; i < tp->md5sig_info->entries4; i++)
-                        kfree(tp->md5sig_info->keys4[i].base.key);
-                tp->md5sig_info->entries4 = 0;
-                tcp_free_md5sig_pool();
-        }
-
-        kfree(tp->md5sig_info->keys4);
-        tp->md5sig_info->keys4 = NULL;
-        tp->md5sig_info->alloced4 = 0;
-}
-
 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
                                   int optlen)
 {
         struct tcp_md5sig cmd;
         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
-        u8 *newkey;
 
         if (optlen < sizeof(cmd))
                 return -EINVAL;
@@ -708,36 +573,22 @@ static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
                 return -EINVAL;
 
         if (!cmd.tcpm_keylen) {
-                if (!tcp_sk(sk)->md5sig_info)
-                        return -ENOENT;
                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
-                        return tcp_v4_md5_do_del(sk, sin6->sin6_addr.s6_addr32[3]);
-                return tcp_v6_md5_do_del(sk, &sin6->sin6_addr);
+                        return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
+                                              AF_INET);
+                return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
+                                      AF_INET6);
         }
 
         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
                 return -EINVAL;
 
-        if (!tcp_sk(sk)->md5sig_info) {
-                struct tcp_sock *tp = tcp_sk(sk);
-                struct tcp_md5sig_info *p;
+        if (ipv6_addr_v4mapped(&sin6->sin6_addr))
+                return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
+                                      AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 
-                p = kzalloc(sizeof(struct tcp_md5sig_info), GFP_KERNEL);
-                if (!p)
-                        return -ENOMEM;
-
-                tp->md5sig_info = p;
-                sk_nocaps_add(sk, NETIF_F_GSO_MASK);
-        }
-
-        newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
-        if (!newkey)
-                return -ENOMEM;
-        if (ipv6_addr_v4mapped(&sin6->sin6_addr)) {
-                return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3],
-                                         newkey, cmd.tcpm_keylen);
-        }
-        return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
+        return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
+                              AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 }
 
 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
@@ -874,12 +725,10 @@ static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
                                       NULL, NULL, skb);
 
         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
-                if (net_ratelimit()) {
-                        printk(KERN_INFO "MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
-                               genhash ? "failed" : "mismatch",
-                               &ip6h->saddr, ntohs(th->source),
-                               &ip6h->daddr, ntohs(th->dest));
-                }
+                net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
+                                     genhash ? "failed" : "mismatch",
+                                     &ip6h->saddr, ntohs(th->source),
+                                     &ip6h->daddr, ntohs(th->dest));
                 return 1;
         }
         return 0;
@@ -1074,6 +923,13 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
         const struct tcphdr *th = tcp_hdr(skb);
         u32 seq = 0, ack_seq = 0;
         struct tcp_md5sig_key *key = NULL;
+#ifdef CONFIG_TCP_MD5SIG
+        const __u8 *hash_location = NULL;
+        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+        unsigned char newhash[16];
+        int genhash;
+        struct sock *sk1 = NULL;
+#endif
 
         if (th->rst)
                 return;
@@ -1082,8 +938,32 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
                 return;
 
 #ifdef CONFIG_TCP_MD5SIG
-        if (sk)
-                key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr);
+        hash_location = tcp_parse_md5sig_option(th);
+        if (!sk && hash_location) {
+                /*
+                 * active side is lost. Try to find listening socket through
+                 * source port, and then find md5 key through listening socket.
+                 * we are not loose security here:
+                 * Incoming packet is checked with md5 hash with finding key,
+                 * no RST generated if md5 hash doesn't match.
+                 */
+                sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
+                                           &tcp_hashinfo, &ipv6h->daddr,
+                                           ntohs(th->source), inet6_iif(skb));
+                if (!sk1)
+                        return;
+
+                rcu_read_lock();
+                key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
+                if (!key)
+                        goto release_sk1;
+
+                genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, NULL, skb);
+                if (genhash || memcmp(hash_location, newhash, 16) != 0)
+                        goto release_sk1;
+        } else {
+                key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
+        }
 #endif
 
         if (th->ack)
@@ -1093,6 +973,14 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
                           (th->doff << 2);
 
         tcp_v6_send_response(skb, seq, ack_seq, 0, 0, key, 1, 0);
+
+#ifdef CONFIG_TCP_MD5SIG
+release_sk1:
+        if (sk1) {
+                rcu_read_unlock();
+                sock_put(sk1);
+        }
+#endif
 }
 
 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts,
@@ -1169,7 +1057,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         struct tcp_sock *tp = tcp_sk(sk);
         __u32 isn = TCP_SKB_CB(skb)->when;
         struct dst_entry *dst = NULL;
-        int want_cookie = 0;
+        bool want_cookie = false;
 
         if (skb->protocol == htons(ETH_P_IP))
                 return tcp_v4_conn_request(sk, skb);
@@ -1230,7 +1118,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                 while (l-- > 0)
                         *c++ ^= *hash_location++;
 
-                want_cookie = 0;        /* not our kind of cookie */
+                want_cookie = false;    /* not our kind of cookie */
                 tmp_ext.cookie_out_never = 0; /* false */
                 tmp_ext.cookie_plus = tmp_opt.cookie_plus;
         } else if (!tp->rx_opt.cookie_in_always) {
@@ -1252,7 +1140,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         treq->rmt_addr = ipv6_hdr(skb)->saddr;
         treq->loc_addr = ipv6_hdr(skb)->daddr;
         if (!want_cookie || tmp_opt.tstamp_ok)
-                TCP_ECN_create_request(req, tcp_hdr(skb));
+                TCP_ECN_create_request(req, skb);
 
         treq->iif = sk->sk_bound_dev_if;
 
@@ -1327,7 +1215,8 @@ have_isn:
         security_inet_conn_request(sk, skb, req);
 
         if (tcp_v6_send_synack(sk, req,
-                               (struct request_values *)&tmp_ext) ||
+                               (struct request_values *)&tmp_ext,
+                               skb_get_queue_mapping(skb)) ||
             want_cookie)
                 goto drop_and_free;
 
@@ -1394,6 +1283,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 newnp->opt         = NULL;
                 newnp->mcast_oif   = inet6_iif(skb);
                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
+                newnp->rcv_tclass  = ipv6_tclass(ipv6_hdr(skb));
 
                 /*
                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
@@ -1464,7 +1354,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         newnp->pktoptions = NULL;
         if (treq->pktopts != NULL) {
                 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
-                kfree_skb(treq->pktopts);
+                consume_skb(treq->pktopts);
                 treq->pktopts = NULL;
                 if (newnp->pktoptions)
                         skb_set_owner_r(newnp->pktoptions, newsk);
@@ -1472,6 +1362,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         newnp->opt        = NULL;
         newnp->mcast_oif  = inet6_iif(skb);
         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
+        newnp->rcv_tclass = ipv6_tclass(ipv6_hdr(skb));
 
         /* Clone native IPv6 options from listening socket (if any)
 
@@ -1493,6 +1384,10 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         tcp_mtup_init(newsk);
         tcp_sync_mss(newsk, dst_mtu(dst));
         newtp->advmss = dst_metric_advmss(dst);
+        if (tcp_sk(sk)->rx_opt.user_mss &&
+            tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
+                newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
+
         tcp_initialize_rcv_mss(newsk);
         if (tcp_rsk(req)->snt_synack)
                 tcp_valid_rtt_meas(newsk,
@@ -1510,10 +1405,8 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                  * memory, then we end up not copying the key
                  * across. Shucks.
                  */
-                char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
-                if (newkey != NULL)
-                        tcp_v6_md5_do_add(newsk, &newnp->daddr,
-                                          newkey, key->keylen);
+                tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newnp->daddr,
+                               AF_INET6, key->key, key->keylen, GFP_ATOMIC);
         }
 #endif
 
@@ -1676,6 +1569,8 @@ ipv6_pktoptions:
                         np->mcast_oif = inet6_iif(opt_skb);
                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
+                if (np->rxopt.bits.rxtclass)
+                        np->rcv_tclass = ipv6_tclass(ipv6_hdr(skb));
                 if (ipv6_opt_accepted(sk, opt_skb)) {
                         skb_set_owner_r(opt_skb, sk);
                         opt_skb = xchg(&np->pktoptions, opt_skb);
@@ -1755,7 +1650,7 @@ process:
 #ifdef CONFIG_NET_DMA
                 struct tcp_sock *tp = tcp_sk(sk);
                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
-                        tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
+                        tp->ucopy.dma_chan = net_dma_find_channel();
                 if (tp->ucopy.dma_chan)
                         ret = tcp_v6_do_rcv(sk, skb);
                 else
@@ -1764,7 +1659,8 @@ process:
                         if (!tcp_prequeue(sk, skb))
                                 ret = tcp_v6_do_rcv(sk, skb);
                 }
-        } else if (unlikely(sk_add_backlog(sk, skb))) {
+        } else if (unlikely(sk_add_backlog(sk, skb,
+                                           sk->sk_rcvbuf + sk->sk_sndbuf))) {
                 bh_unlock_sock(sk);
                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
                 goto discard_and_relse;
@@ -1883,6 +1779,7 @@ static const struct inet_connection_sock_af_ops ipv6_specific = {
         .syn_recv_sock     = tcp_v6_syn_recv_sock,
         .get_peer          = tcp_v6_get_peer,
         .net_header_len    = sizeof(struct ipv6hdr),
+        .net_frag_header_len = sizeof(struct frag_hdr),
         .setsockopt        = ipv6_setsockopt,
         .getsockopt        = ipv6_getsockopt,
         .addr2sockaddr     = inet6_csk_addr2sockaddr,
@@ -1898,7 +1795,6 @@ static const struct inet_connection_sock_af_ops ipv6_specific = {
 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
         .md5_lookup     =       tcp_v6_md5_lookup,
         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
-        .md5_add        =       tcp_v6_md5_add_func,
         .md5_parse      =       tcp_v6_parse_md5_keys,
 };
 #endif
@@ -1930,7 +1826,6 @@ static const struct inet_connection_sock_af_ops ipv6_mapped = {
 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
         .md5_lookup     =       tcp_v4_md5_lookup,
         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
-        .md5_add        =       tcp_v6_md5_add_func,
         .md5_parse      =       tcp_v6_parse_md5_keys,
 };
 #endif
@@ -1941,74 +1836,20 @@ static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
 static int tcp_v6_init_sock(struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        skb_queue_head_init(&tp->out_of_order_queue);
-        tcp_init_xmit_timers(sk);
-        tcp_prequeue_init(tp);
 
-        icsk->icsk_rto = TCP_TIMEOUT_INIT;
-        tp->mdev = TCP_TIMEOUT_INIT;
-
-        /* So many TCP implementations out there (incorrectly) count the
-         * initial SYN frame in their delayed-ACK and congestion control
-         * algorithms that we must have the following bandaid to talk
-         * efficiently to them.  -DaveM
-         */
-        tp->snd_cwnd = 2;
-
-        /* See draft-stevens-tcpca-spec-01 for discussion of the
-         * initialization of these values.
-         */
-        tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
-        tp->snd_cwnd_clamp = ~0;
-        tp->mss_cache = TCP_MSS_DEFAULT;
-
-        tp->reordering = sysctl_tcp_reordering;
-
-        sk->sk_state = TCP_CLOSE;
+        tcp_init_sock(sk);
 
         icsk->icsk_af_ops = &ipv6_specific;
-        icsk->icsk_ca_ops = &tcp_init_congestion_ops;
-        icsk->icsk_sync_mss = tcp_sync_mss;
-        sk->sk_write_space = sk_stream_write_space;
-        sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
 
 #ifdef CONFIG_TCP_MD5SIG
-        tp->af_specific = &tcp_sock_ipv6_specific;
+        tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
 #endif
 
-        /* TCP Cookie Transactions */
-        if (sysctl_tcp_cookie_size > 0) {
-                /* Default, cookies without s_data_payload. */
-                tp->cookie_values =
-                        kzalloc(sizeof(*tp->cookie_values),
-                                sk->sk_allocation);
-                if (tp->cookie_values != NULL)
-                        kref_init(&tp->cookie_values->kref);
-        }
-        /* Presumed zeroed, in order of appearance:
-         *      cookie_in_always, cookie_out_never,
-         *      s_data_constant, s_data_in, s_data_out
-         */
-        sk->sk_sndbuf = sysctl_tcp_wmem[1];
-        sk->sk_rcvbuf = sysctl_tcp_rmem[1];
-
-        local_bh_disable();
-        sock_update_memcg(sk);
-        sk_sockets_allocated_inc(sk);
-        local_bh_enable();
-
         return 0;
 }
 
 static void tcp_v6_destroy_sock(struct sock *sk)
 {
-#ifdef CONFIG_TCP_MD5SIG
-        /* Clean up the MD5 key list */
-        if (tcp_sk(sk)->md5sig_info)
-                tcp_v6_clear_md5_list(sk);
-#endif
         tcp_v4_destroy_sock(sk);
         inet6_destroy_sock(sk);
 }
diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index 4f3cec12aa85..4b0f50d9a962 100644
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -19,6 +19,8 @@
  *              YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
  */
 
+#define pr_fmt(fmt) "IPv6: " fmt
+
 #include <linux/icmpv6.h>
 #include <linux/init.h>
 #include <linux/module.h>
@@ -160,11 +162,11 @@ static const struct inet6_protocol tunnel46_protocol = {
 static int __init tunnel6_init(void)
 {
         if (inet6_add_protocol(&tunnel6_protocol, IPPROTO_IPV6)) {
-                printk(KERN_ERR "tunnel6 init(): can't add protocol\n");
+                pr_err("%s: can't add protocol\n", __func__);
                 return -EAGAIN;
         }
         if (inet6_add_protocol(&tunnel46_protocol, IPPROTO_IPIP)) {
-                printk(KERN_ERR "tunnel6 init(): can't add protocol\n");
+                pr_err("%s: can't add protocol\n", __func__);
                 inet6_del_protocol(&tunnel6_protocol, IPPROTO_IPV6);
                 return -EAGAIN;
         }
@@ -174,9 +176,9 @@ static int __init tunnel6_init(void)
 static void __exit tunnel6_fini(void)
 {
         if (inet6_del_protocol(&tunnel46_protocol, IPPROTO_IPIP))
-                printk(KERN_ERR "tunnel6 close: can't remove protocol\n");
+                pr_err("%s: can't remove protocol\n", __func__);
         if (inet6_del_protocol(&tunnel6_protocol, IPPROTO_IPV6))
-                printk(KERN_ERR "tunnel6 close: can't remove protocol\n");
+                pr_err("%s: can't remove protocol\n", __func__);
 }
 
 module_init(tunnel6_init);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 4f96b5c63685..f05099fc5901 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -103,7 +103,7 @@ int udp_v6_get_port(struct sock *sk, unsigned short snum)
 {
         unsigned int hash2_nulladdr =
                 udp6_portaddr_hash(sock_net(sk), &in6addr_any, snum);
-        unsigned int hash2_partial = 
+        unsigned int hash2_partial =
                 udp6_portaddr_hash(sock_net(sk), &inet6_sk(sk)->rcv_saddr, 0);
 
         /* precompute partial secondary hash */
@@ -342,14 +342,14 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         struct inet_sock *inet = inet_sk(sk);
         struct sk_buff *skb;
         unsigned int ulen, copied;
-        int peeked;
+        int peeked, off = 0;
         int err;
         int is_udplite = IS_UDPLITE(sk);
         int is_udp4;
         bool slow;
 
         if (addr_len)
-                *addr_len=sizeof(struct sockaddr_in6);
+                *addr_len = sizeof(struct sockaddr_in6);
 
         if (flags & MSG_ERRQUEUE)
                 return ipv6_recv_error(sk, msg, len);
@@ -359,7 +359,7 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
 
 try_again:
         skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
-                                  &peeked, &err);
+                                  &peeked, &off, &err);
         if (!skb)
                 goto out;
 
@@ -496,6 +496,28 @@ out:
         sock_put(sk);
 }
 
+static int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+{
+        int rc;
+
+        if (!ipv6_addr_any(&inet6_sk(sk)->daddr))
+                sock_rps_save_rxhash(sk, skb);
+
+        rc = sock_queue_rcv_skb(sk, skb);
+        if (rc < 0) {
+                int is_udplite = IS_UDPLITE(sk);
+
+                /* Note that an ENOMEM error is charged twice */
+                if (rc == -ENOMEM)
+                        UDP6_INC_STATS_BH(sock_net(sk),
+                                        UDP_MIB_RCVBUFERRORS, is_udplite);
+                UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+                kfree_skb(skb);
+                return -1;
+        }
+        return 0;
+}
+
 static __inline__ void udpv6_err(struct sk_buff *skb,
                                  struct inet6_skb_parm *opt, u8 type,
                                  u8 code, int offset, __be32 info     )
@@ -503,18 +525,54 @@ static __inline__ void udpv6_err(struct sk_buff *skb,
         __udp6_lib_err(skb, opt, type, code, offset, info, &udp_table);
 }
 
-int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
+static struct static_key udpv6_encap_needed __read_mostly;
+void udpv6_encap_enable(void)
+{
+        if (!static_key_enabled(&udpv6_encap_needed))
+                static_key_slow_inc(&udpv6_encap_needed);
+}
+EXPORT_SYMBOL(udpv6_encap_enable);
+
+int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         struct udp_sock *up = udp_sk(sk);
         int rc;
         int is_udplite = IS_UDPLITE(sk);
 
-        if (!ipv6_addr_any(&inet6_sk(sk)->daddr))
-                sock_rps_save_rxhash(sk, skb);
-
         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto drop;
 
+        if (static_key_false(&udpv6_encap_needed) && up->encap_type) {
+                int (*encap_rcv)(struct sock *sk, struct sk_buff *skb);
+
+                /*
+                 * This is an encapsulation socket so pass the skb to
+                 * the socket's udp_encap_rcv() hook. Otherwise, just
+                 * fall through and pass this up the UDP socket.
+                 * up->encap_rcv() returns the following value:
+                 * =0 if skb was successfully passed to the encap
+                 *    handler or was discarded by it.
+                 * >0 if skb should be passed on to UDP.
+                 * <0 if skb should be resubmitted as proto -N
+                 */
+
+                /* if we're overly short, let UDP handle it */
+                encap_rcv = ACCESS_ONCE(up->encap_rcv);
+                if (skb->len > sizeof(struct udphdr) && encap_rcv != NULL) {
+                        int ret;
+
+                        ret = encap_rcv(sk, skb);
+                        if (ret <= 0) {
+                                UDP_INC_STATS_BH(sock_net(sk),
+                                                 UDP_MIB_INDATAGRAMS,
+                                                 is_udplite);
+                                return -ret;
+                        }
+                }
+
+                /* FALLTHROUGH -- it's a UDP Packet */
+        }
+
         /*
          * UDP-Lite specific tests, ignored on UDP sockets (see net/ipv4/udp.c).
          */
@@ -539,21 +597,25 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                         goto drop;
         }
 
+        if (sk_rcvqueues_full(sk, skb, sk->sk_rcvbuf))
+                goto drop;
+
         skb_dst_drop(skb);
-        rc = sock_queue_rcv_skb(sk, skb);
-        if (rc < 0) {
-                /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM)
-                        UDP6_INC_STATS_BH(sock_net(sk),
-                                        UDP_MIB_RCVBUFERRORS, is_udplite);
-                goto drop_no_sk_drops_inc;
+
+        bh_lock_sock(sk);
+        rc = 0;
+        if (!sock_owned_by_user(sk))
+                rc = __udpv6_queue_rcv_skb(sk, skb);
+        else if (sk_add_backlog(sk, skb, sk->sk_rcvbuf)) {
+                bh_unlock_sock(sk);
+                goto drop;
         }
+        bh_unlock_sock(sk);
 
-        return 0;
+        return rc;
 drop:
-        atomic_inc(&sk->sk_drops);
-drop_no_sk_drops_inc:
         UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+        atomic_inc(&sk->sk_drops);
         kfree_skb(skb);
         return -1;
 }
@@ -602,37 +664,27 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
 static void flush_stack(struct sock **stack, unsigned int count,
                         struct sk_buff *skb, unsigned int final)
 {
-        unsigned int i;
+        struct sk_buff *skb1 = NULL;
         struct sock *sk;
-        struct sk_buff *skb1;
+        unsigned int i;
 
         for (i = 0; i < count; i++) {
-                skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
-
                 sk = stack[i];
-                if (skb1) {
-                        if (sk_rcvqueues_full(sk, skb1)) {
-                                kfree_skb(skb1);
-                                goto drop;
-                        }
-                        bh_lock_sock(sk);
-                        if (!sock_owned_by_user(sk))
-                                udpv6_queue_rcv_skb(sk, skb1);
-                        else if (sk_add_backlog(sk, skb1)) {
-                                kfree_skb(skb1);
-                                bh_unlock_sock(sk);
-                                goto drop;
-                        }
-                        bh_unlock_sock(sk);
-                        continue;
+                if (likely(skb1 == NULL))
+                        skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
+                if (!skb1) {
+                        atomic_inc(&sk->sk_drops);
+                        UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
+                                          IS_UDPLITE(sk));
+                        UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
+                                          IS_UDPLITE(sk));
                 }
-drop:
-                atomic_inc(&sk->sk_drops);
-                UDP6_INC_STATS_BH(sock_net(sk),
-                                UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
-                UDP6_INC_STATS_BH(sock_net(sk),
-                                UDP_MIB_INERRORS, IS_UDPLITE(sk));
+
+                if (skb1 && udpv6_queue_rcv_skb(sk, skb1) <= 0)
+                        skb1 = NULL;
         }
+        if (unlikely(skb1))
+                kfree_skb(skb1);
 }
 /*
  * Note: called only from the BH handler context,
@@ -772,39 +824,29 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
          * for sock caches... i'll skip this for now.
          */
         sk = __udp6_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
+        if (sk != NULL) {
+                int ret = udpv6_queue_rcv_skb(sk, skb);
+                sock_put(sk);
 
-        if (sk == NULL) {
-                if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
-                        goto discard;
-
-                if (udp_lib_checksum_complete(skb))
-                        goto discard;
-                UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
-                                proto == IPPROTO_UDPLITE);
-
-                icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
+                /* a return value > 0 means to resubmit the input, but
+                 * it wants the return to be -protocol, or 0
+                 */
+                if (ret > 0)
+                        return -ret;
 
-                kfree_skb(skb);
                 return 0;
         }
 
-        /* deliver */
-
-        if (sk_rcvqueues_full(sk, skb)) {
-                sock_put(sk);
+        if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
                 goto discard;
-        }
-        bh_lock_sock(sk);
-        if (!sock_owned_by_user(sk))
-                udpv6_queue_rcv_skb(sk, skb);
-        else if (sk_add_backlog(sk, skb)) {
-                atomic_inc(&sk->sk_drops);
-                bh_unlock_sock(sk);
-                sock_put(sk);
+
+        if (udp_lib_checksum_complete(skb))
                 goto discard;
-        }
-        bh_unlock_sock(sk);
-        sock_put(sk);
+
+        UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
+
+        kfree_skb(skb);
         return 0;
 
 short_packet:
@@ -1130,7 +1172,8 @@ do_udp_sendmsg:
         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr)) {
                 fl6.flowi6_oif = np->mcast_oif;
                 connected = 0;
-        }
+        } else if (!fl6.flowi6_oif)
+                fl6.flowi6_oif = np->ucast_oif;
 
         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 
@@ -1336,7 +1379,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
          * do checksum of UDP packets sent as multiple IP fragments.
          */
         offset = skb_checksum_start_offset(skb);
-        csum = skb_checksum(skb, offset, skb->len- offset, 0);
+        csum = skb_checksum(skb, offset, skb->len - offset, 0);
         offset += skb->csum_offset;
         *(__sum16 *)(skb->data + offset) = csum_fold(csum);
         skb->ip_summed = CHECKSUM_NONE;
@@ -1470,7 +1513,7 @@ struct proto udpv6_prot = {
         .getsockopt        = udpv6_getsockopt,
         .sendmsg           = udpv6_sendmsg,
         .recvmsg           = udpv6_recvmsg,
-        .backlog_rcv       = udpv6_queue_rcv_skb,
+        .backlog_rcv       = __udpv6_queue_rcv_skb,
         .hash              = udp_lib_hash,
         .unhash            = udp_lib_unhash,
         .rehash            = udp_v6_rehash,
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 4eeff89c1aaa..8755a3079d0f 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -146,7 +146,7 @@ static int __xfrm6_output(struct sk_buff *skb)
                 return -EMSGSIZE;
         }
 
-        if ((x && x->props.mode == XFRM_MODE_TUNNEL) &&
+        if (x->props.mode == XFRM_MODE_TUNNEL &&
             ((skb->len > mtu && !skb_is_gso(skb)) ||
                 dst_allfrag(skb_dst(skb)))) {
                         return ip6_fragment(skb, x->outer_mode->afinfo->output_finish);
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8ea65e032733..8625fba96db9 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -334,8 +334,8 @@ int __init xfrm6_init(void)
                 goto out_policy;
 
 #ifdef CONFIG_SYSCTL
-        sysctl_hdr = register_net_sysctl_table(&init_net, net_ipv6_ctl_path,
-                                                xfrm6_policy_table);
+        sysctl_hdr = register_net_sysctl(&init_net, "net/ipv6",
+                                         xfrm6_policy_table);
 #endif
 out:
         return ret;
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 4fe1db12d2a3..ee5a7065aacc 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -68,9 +68,9 @@ static DEFINE_SPINLOCK(xfrm6_tunnel_spi_lock);
 
 static struct kmem_cache *xfrm6_tunnel_spi_kmem __read_mostly;
 
-static inline unsigned xfrm6_tunnel_spi_hash_byaddr(const xfrm_address_t *addr)
+static inline unsigned int xfrm6_tunnel_spi_hash_byaddr(const xfrm_address_t *addr)
 {
-        unsigned h;
+        unsigned int h;
 
         h = (__force u32)(addr->a6[0] ^ addr->a6[1] ^ addr->a6[2] ^ addr->a6[3]);
         h ^= h >> 16;
@@ -80,7 +80,7 @@ static inline unsigned xfrm6_tunnel_spi_hash_byaddr(const xfrm_address_t *addr)
         return h;
 }
 
-static inline unsigned xfrm6_tunnel_spi_hash_byspi(u32 spi)
+static inline unsigned int xfrm6_tunnel_spi_hash_byspi(u32 spi)
 {
         return spi % XFRM6_TUNNEL_SPI_BYSPI_HSIZE;
 }
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 9680226640ef..dfd6faaf0ea7 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -983,10 +983,6 @@ static int ipxitf_create(struct ipx_interface_definition *idef)
                 goto out;
 
         switch (idef->ipx_dlink_type) {
-        case IPX_FRAME_TR_8022:
-                printk(KERN_WARNING "IPX frame type 802.2TR is "
-                        "obsolete Use 802.2 instead.\n");
-                /* fall through */
         case IPX_FRAME_8022:
                 dlink_type      = htons(ETH_P_802_2);
                 datalink        = p8022_datalink;
@@ -996,10 +992,7 @@ static int ipxitf_create(struct ipx_interface_definition *idef)
                         dlink_type      = htons(ETH_P_IPX);
                         datalink        = pEII_datalink;
                         break;
-                } else
-                        printk(KERN_WARNING "IPX frame type EtherII over "
-                                        "token-ring is obsolete. Use SNAP "
-                                        "instead.\n");
+                }
                 /* fall through */
         case IPX_FRAME_SNAP:
                 dlink_type      = htons(ETH_P_SNAP);
@@ -1275,7 +1268,6 @@ const char *ipx_frame_name(__be16 frame)
         case ETH_P_802_2:       rc = "802.2";   break;
         case ETH_P_SNAP:        rc = "SNAP";    break;
         case ETH_P_802_3:       rc = "802.3";   break;
-        case ETH_P_TR_802_2:    rc = "802.2TR"; break;
         }
 
         return rc;
@@ -1909,9 +1901,7 @@ static int ipx_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                               (const unsigned short __user *)argp);
                 break;
         case SIOCGSTAMP:
-                rc = -EINVAL;
-                if (sk)
-                        rc = sock_get_timestamp(sk, argp);
+                rc = sock_get_timestamp(sk, argp);
                 break;
         case SIOCGIFDSTADDR:
         case SIOCSIFDSTADDR:
diff --git a/net/ipx/sysctl_net_ipx.c b/net/ipx/sysctl_net_ipx.c
index bd6dca00fb85..ad7c03dedaab 100644
--- a/net/ipx/sysctl_net_ipx.c
+++ b/net/ipx/sysctl_net_ipx.c
@@ -8,6 +8,7 @@
 
 #include <linux/mm.h>
 #include <linux/sysctl.h>
+#include <net/net_namespace.h>
 
 #ifndef CONFIG_SYSCTL
 #error This file should not be compiled without CONFIG_SYSCTL defined
@@ -27,20 +28,14 @@ static struct ctl_table ipx_table[] = {
         { },
 };
 
-static struct ctl_path ipx_path[] = {
-        { .procname = "net", },
-        { .procname = "ipx", },
-        { }
-};
-
 static struct ctl_table_header *ipx_table_header;
 
 void ipx_register_sysctl(void)
 {
-        ipx_table_header = register_sysctl_paths(ipx_path, ipx_table);
+        ipx_table_header = register_net_sysctl(&init_net, "net/ipx", ipx_table);
 }
 
 void ipx_unregister_sysctl(void)
 {
-        unregister_sysctl_table(ipx_table_header);
+        unregister_net_sysctl_table(ipx_table_header);
 }
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index 253695d43fd9..6b9d5a0e42f9 100644
--- a/net/irda/ircomm/ircomm_tty.c
+++ b/net/irda/ircomm/ircomm_tty.c
@@ -122,7 +122,6 @@ static int __init ircomm_tty_init(void)
                 return -ENOMEM;
         }
 
-        driver->owner           = THIS_MODULE;
         driver->driver_name     = "ircomm";
         driver->name            = "ircomm";
         driver->major           = IRCOMM_TTY_MAJOR;
@@ -366,16 +365,12 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
 static int ircomm_tty_open(struct tty_struct *tty, struct file *filp)
 {
         struct ircomm_tty_cb *self;
-        unsigned int line;
+        unsigned int line = tty->index;
         unsigned long   flags;
         int ret;
 
         IRDA_DEBUG(2, "%s()\n", __func__ );
 
-        line = tty->index;
-        if (line >= IRCOMM_TTY_PORTS)
-                return -ENODEV;
-
         /* Check if instance already exists */
         self = hashbin_lock_find(ircomm_tty, line, NULL);
         if (!self) {
diff --git a/net/irda/ircomm/ircomm_tty_ioctl.c b/net/irda/ircomm/ircomm_tty_ioctl.c
index 77c5e6499f8f..d0667d68351d 100644
--- a/net/irda/ircomm/ircomm_tty_ioctl.c
+++ b/net/irda/ircomm/ircomm_tty_ioctl.c
@@ -54,7 +54,7 @@
  */
 static void ircomm_tty_change_speed(struct ircomm_tty_cb *self)
 {
-        unsigned cflag, cval;
+        unsigned int cflag, cval;
         int baud;
 
         IRDA_DEBUG(2, "%s()\n", __func__ );
diff --git a/net/irda/irlan/irlan_client.c b/net/irda/irlan/irlan_client.c
index ba1a3fc39b5c..42cf1390ce9c 100644
--- a/net/irda/irlan/irlan_client.c
+++ b/net/irda/irlan/irlan_client.c
@@ -37,7 +37,6 @@
 #include <linux/bitops.h>
 #include <net/arp.h>
 
-#include <asm/system.h>
 #include <asm/byteorder.h>
 
 #include <net/irda/irda.h>
diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c
index 579617cca125..7ac4d1becbfc 100644
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -40,7 +40,6 @@
 #include <linux/moduleparam.h>
 #include <linux/bitops.h>
 
-#include <asm/system.h>
 #include <asm/byteorder.h>
 
 #include <net/irda/irda.h>
diff --git a/net/irda/irlan/irlan_provider.c b/net/irda/irlan/irlan_provider.c
index 8b61cf0d8a69..32dcaac70b0c 100644
--- a/net/irda/irlan/irlan_provider.c
+++ b/net/irda/irlan/irlan_provider.c
@@ -36,7 +36,6 @@
 #include <linux/bitops.h>
 #include <linux/slab.h>
 
-#include <asm/system.h>
 #include <asm/byteorder.h>
 
 #include <net/irda/irda.h>
diff --git a/net/irda/irnet/irnet.h b/net/irda/irnet/irnet.h
index 979ecb2435a7..564eb0b8afa3 100644
--- a/net/irda/irnet/irnet.h
+++ b/net/irda/irnet/irnet.h
@@ -254,7 +254,7 @@
 #include <linux/init.h>
 
 #include <linux/ppp_defs.h>
-#include <linux/if_ppp.h>
+#include <linux/ppp-ioctl.h>
 #include <linux/ppp_channel.h>
 
 #include <net/irda/irda.h>
diff --git a/net/irda/irsysctl.c b/net/irda/irsysctl.c
index 2615ffc8e785..de73f6496db5 100644
--- a/net/irda/irsysctl.c
+++ b/net/irda/irsysctl.c
@@ -235,12 +235,6 @@ static ctl_table irda_table[] = {
         { }
 };
 
-static struct ctl_path irda_path[] = {
-        { .procname = "net", },
-        { .procname = "irda", },
-        { }
-};
-
 static struct ctl_table_header *irda_table_header;
 
 /*
@@ -251,7 +245,7 @@ static struct ctl_table_header *irda_table_header;
  */
 int __init irda_sysctl_register(void)
 {
-        irda_table_header = register_sysctl_paths(irda_path, irda_table);
+        irda_table_header = register_net_sysctl(&init_net, "net/irda", irda_table);
         if (!irda_table_header)
                 return -ENOMEM;
 
@@ -266,7 +260,7 @@ int __init irda_sysctl_register(void)
  */
 void irda_sysctl_unregister(void)
 {
-        unregister_sysctl_table(irda_table_header);
+        unregister_net_sysctl_table(irda_table_header);
 }
 
 
diff --git a/net/irda/timer.c b/net/irda/timer.c
index f418cb2ad49c..1d552b3946fc 100644
--- a/net/irda/timer.c
+++ b/net/irda/timer.c
@@ -24,7 +24,6 @@
  *
  ********************************************************************/
 
-#include <asm/system.h>
 #include <linux/delay.h>
 
 #include <net/irda/timer.h>
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index d5c5b8fd1d01..07d7d55a1b93 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -90,6 +90,7 @@ do {									\
 
 static void iucv_sock_kill(struct sock *sk);
 static void iucv_sock_close(struct sock *sk);
+static void iucv_sever_path(struct sock *, int);
 
 static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev,
         struct packet_type *pt, struct net_device *orig_dev);
@@ -130,17 +131,6 @@ static inline void low_nmcpy(unsigned char *dst, char *src)
        memcpy(&dst[8], src, 8);
 }
 
-static void iucv_skb_queue_purge(struct sk_buff_head *list)
-{
-        struct sk_buff *skb;
-
-        while ((skb = skb_dequeue(list)) != NULL) {
-                if (skb->dev)
-                        dev_put(skb->dev);
-                kfree_skb(skb);
-        }
-}
-
 static int afiucv_pm_prepare(struct device *dev)
 {
 #ifdef CONFIG_PM_DEBUG
@@ -175,17 +165,11 @@ static int afiucv_pm_freeze(struct device *dev)
         read_lock(&iucv_sk_list.lock);
         sk_for_each(sk, node, &iucv_sk_list.head) {
                 iucv = iucv_sk(sk);
-                iucv_skb_queue_purge(&iucv->send_skb_q);
-                skb_queue_purge(&iucv->backlog_skb_q);
                 switch (sk->sk_state) {
                 case IUCV_DISCONN:
                 case IUCV_CLOSING:
                 case IUCV_CONNECTED:
-                        if (iucv->path) {
-                                err = pr_iucv->path_sever(iucv->path, NULL);
-                                iucv_path_free(iucv->path);
-                                iucv->path = NULL;
-                        }
+                        iucv_sever_path(sk, 0);
                         break;
                 case IUCV_OPEN:
                 case IUCV_BOUND:
@@ -194,6 +178,8 @@ static int afiucv_pm_freeze(struct device *dev)
                 default:
                         break;
                 }
+                skb_queue_purge(&iucv->send_skb_q);
+                skb_queue_purge(&iucv->backlog_skb_q);
         }
         read_unlock(&iucv_sk_list.lock);
         return err;
@@ -338,7 +324,6 @@ static void iucv_sock_wake_msglim(struct sock *sk)
 static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
                    struct sk_buff *skb, u8 flags)
 {
-        struct net *net = sock_net(sock);
         struct iucv_sock *iucv = iucv_sk(sock);
         struct af_iucv_trans_hdr *phs_hdr;
         struct sk_buff *nskb;
@@ -375,10 +360,10 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
         if (imsg)
                 memcpy(&phs_hdr->iucv_hdr, imsg, sizeof(struct iucv_message));
 
-        skb->dev = dev_get_by_index(net, sock->sk_bound_dev_if);
+        skb->dev = iucv->hs_dev;
         if (!skb->dev)
                 return -ENODEV;
-        if (!(skb->dev->flags & IFF_UP))
+        if (!(skb->dev->flags & IFF_UP) || !netif_carrier_ok(skb->dev))
                 return -ENETDOWN;
         if (skb->len > skb->dev->mtu) {
                 if (sock->sk_type == SOCK_SEQPACKET)
@@ -393,15 +378,14 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
                 return -ENOMEM;
         skb_queue_tail(&iucv->send_skb_q, nskb);
         err = dev_queue_xmit(skb);
-        if (err) {
+        if (net_xmit_eval(err)) {
                 skb_unlink(nskb, &iucv->send_skb_q);
-                dev_put(nskb->dev);
                 kfree_skb(nskb);
         } else {
                 atomic_sub(confirm_recv, &iucv->msg_recv);
                 WARN_ON(atomic_read(&iucv->msg_recv) < 0);
         }
-        return err;
+        return net_xmit_eval(err);
 }
 
 static struct sock *__iucv_get_sock_by_name(char *nm)
@@ -419,7 +403,19 @@ static struct sock *__iucv_get_sock_by_name(char *nm)
 static void iucv_sock_destruct(struct sock *sk)
 {
         skb_queue_purge(&sk->sk_receive_queue);
-        skb_queue_purge(&sk->sk_write_queue);
+        skb_queue_purge(&sk->sk_error_queue);
+
+        sk_mem_reclaim(sk);
+
+        if (!sock_flag(sk, SOCK_DEAD)) {
+                pr_err("Attempt to release alive iucv socket %p\n", sk);
+                return;
+        }
+
+        WARN_ON(atomic_read(&sk->sk_rmem_alloc));
+        WARN_ON(atomic_read(&sk->sk_wmem_alloc));
+        WARN_ON(sk->sk_wmem_queued);
+        WARN_ON(sk->sk_forward_alloc);
 }
 
 /* Cleanup Listen */
@@ -447,14 +443,48 @@ static void iucv_sock_kill(struct sock *sk)
         sock_put(sk);
 }
 
+/* Terminate an IUCV path */
+static void iucv_sever_path(struct sock *sk, int with_user_data)
+{
+        unsigned char user_data[16];
+        struct iucv_sock *iucv = iucv_sk(sk);
+        struct iucv_path *path = iucv->path;
+
+        if (iucv->path) {
+                iucv->path = NULL;
+                if (with_user_data) {
+                        low_nmcpy(user_data, iucv->src_name);
+                        high_nmcpy(user_data, iucv->dst_name);
+                        ASCEBC(user_data, sizeof(user_data));
+                        pr_iucv->path_sever(path, user_data);
+                } else
+                        pr_iucv->path_sever(path, NULL);
+                iucv_path_free(path);
+        }
+}
+
+/* Send FIN through an IUCV socket for HIPER transport */
+static int iucv_send_ctrl(struct sock *sk, u8 flags)
+{
+        int err = 0;
+        int blen;
+        struct sk_buff *skb;
+
+        blen = sizeof(struct af_iucv_trans_hdr) + ETH_HLEN;
+        skb = sock_alloc_send_skb(sk, blen, 1, &err);
+        if (skb) {
+                skb_reserve(skb, blen);
+                err = afiucv_hs_send(NULL, sk, skb, flags);
+        }
+        return err;
+}
+
 /* Close an IUCV socket */
 static void iucv_sock_close(struct sock *sk)
 {
-        unsigned char user_data[16];
         struct iucv_sock *iucv = iucv_sk(sk);
         unsigned long timeo;
-        int err, blen;
-        struct sk_buff *skb;
+        int err = 0;
 
         lock_sock(sk);
 
@@ -465,14 +495,7 @@ static void iucv_sock_close(struct sock *sk)
 
         case IUCV_CONNECTED:
                 if (iucv->transport == AF_IUCV_TRANS_HIPER) {
-                        /* send fin */
-                        blen = sizeof(struct af_iucv_trans_hdr) + ETH_HLEN;
-                        skb = sock_alloc_send_skb(sk, blen, 1, &err);
-                        if (skb) {
-                                skb_reserve(skb, blen);
-                                err = afiucv_hs_send(NULL, sk, skb,
-                                                     AF_IUCV_FLAG_FIN);
-                        }
+                        err = iucv_send_ctrl(sk, AF_IUCV_FLAG_FIN);
                         sk->sk_state = IUCV_DISCONN;
                         sk->sk_state_change(sk);
                 }
@@ -480,7 +503,7 @@ static void iucv_sock_close(struct sock *sk)
                 sk->sk_state = IUCV_CLOSING;
                 sk->sk_state_change(sk);
 
-                if (!skb_queue_empty(&iucv->send_skb_q)) {
+                if (!err && !skb_queue_empty(&iucv->send_skb_q)) {
                         if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
                                 timeo = sk->sk_lingertime;
                         else
@@ -494,25 +517,20 @@ static void iucv_sock_close(struct sock *sk)
                 sk->sk_state = IUCV_CLOSED;
                 sk->sk_state_change(sk);
 
-                if (iucv->path) {
-                        low_nmcpy(user_data, iucv->src_name);
-                        high_nmcpy(user_data, iucv->dst_name);
-                        ASCEBC(user_data, sizeof(user_data));
-                        pr_iucv->path_sever(iucv->path, user_data);
-                        iucv_path_free(iucv->path);
-                        iucv->path = NULL;
-                }
-
                 sk->sk_err = ECONNRESET;
                 sk->sk_state_change(sk);
 
-                iucv_skb_queue_purge(&iucv->send_skb_q);
+                skb_queue_purge(&iucv->send_skb_q);
                 skb_queue_purge(&iucv->backlog_skb_q);
-                break;
 
-        default:
-                /* nothing to do here */
-                break;
+        default:   /* fall through */
+                iucv_sever_path(sk, 1);
+        }
+
+        if (iucv->hs_dev) {
+                dev_put(iucv->hs_dev);
+                iucv->hs_dev = NULL;
+                sk->sk_bound_dev_if = 0;
         }
 
         /* mark socket for deletion by iucv_sock_kill() */
@@ -706,7 +724,6 @@ static int iucv_sock_bind(struct socket *sock, struct sockaddr *addr,
                 goto done_unlock;
 
         /* Bind the socket */
-
         if (pr_iucv)
                 if (!memcmp(sa->siucv_user_id, iucv_userid, 8))
                         goto vm_bind; /* VM IUCV transport */
@@ -720,6 +737,8 @@ static int iucv_sock_bind(struct socket *sock, struct sockaddr *addr,
                         memcpy(iucv->src_name, sa->siucv_name, 8);
                         memcpy(iucv->src_user_id, sa->siucv_user_id, 8);
                         sk->sk_bound_dev_if = dev->ifindex;
+                        iucv->hs_dev = dev;
+                        dev_hold(dev);
                         sk->sk_state = IUCV_BOUND;
                         iucv->transport = AF_IUCV_TRANS_HIPER;
                         if (!iucv->msglimit)
@@ -780,26 +799,6 @@ static int iucv_sock_autobind(struct sock *sk)
         return err;
 }
 
-static int afiucv_hs_connect(struct socket *sock)
-{
-        struct sock *sk = sock->sk;
-        struct sk_buff *skb;
-        int blen = sizeof(struct af_iucv_trans_hdr) + ETH_HLEN;
-        int err = 0;
-
-        /* send syn */
-        skb = sock_alloc_send_skb(sk, blen, 1, &err);
-        if (!skb) {
-                err = -ENOMEM;
-                goto done;
-        }
-        skb->dev = NULL;
-        skb_reserve(skb, blen);
-        err = afiucv_hs_send(NULL, sk, skb, AF_IUCV_FLAG_SYN);
-done:
-        return err;
-}
-
 static int afiucv_path_connect(struct socket *sock, struct sockaddr *addr)
 {
         struct sockaddr_iucv *sa = (struct sockaddr_iucv *) addr;
@@ -880,7 +879,7 @@ static int iucv_sock_connect(struct socket *sock, struct sockaddr *addr,
         memcpy(iucv->dst_name, sa->siucv_name, 8);
 
         if (iucv->transport == AF_IUCV_TRANS_HIPER)
-                err = afiucv_hs_connect(sock);
+                err = iucv_send_ctrl(sock->sk, AF_IUCV_FLAG_SYN);
         else
                 err = afiucv_path_connect(sock, addr);
         if (err)
@@ -894,11 +893,8 @@ static int iucv_sock_connect(struct socket *sock, struct sockaddr *addr,
         if (sk->sk_state == IUCV_DISCONN || sk->sk_state == IUCV_CLOSED)
                 err = -ECONNREFUSED;
 
-        if (err && iucv->transport == AF_IUCV_TRANS_IUCV) {
-                pr_iucv->path_sever(iucv->path, NULL);
-                iucv_path_free(iucv->path);
-                iucv->path = NULL;
-        }
+        if (err && iucv->transport == AF_IUCV_TRANS_IUCV)
+                iucv_sever_path(sk, 0);
 
 done:
         release_sock(sk);
@@ -1124,8 +1120,10 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                         noblock, &err);
         else
                 skb = sock_alloc_send_skb(sk, len, noblock, &err);
-        if (!skb)
+        if (!skb) {
+                err = -ENOMEM;
                 goto out;
+        }
         if (iucv->transport == AF_IUCV_TRANS_HIPER)
                 skb_reserve(skb, sizeof(struct af_iucv_trans_hdr) + ETH_HLEN);
         if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
@@ -1148,6 +1146,7 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         /* increment and save iucv message tag for msg_completion cbk */
         txmsg.tag = iucv->send_tag++;
         memcpy(CB_TAG(skb), &txmsg.tag, CB_TAG_LEN);
+
         if (iucv->transport == AF_IUCV_TRANS_HIPER) {
                 atomic_inc(&iucv->msg_sent);
                 err = afiucv_hs_send(&txmsg, sk, skb, 0);
@@ -1202,8 +1201,6 @@ release:
         return len;
 
 fail:
-        if (skb->dev)
-                dev_put(skb->dev);
         kfree_skb(skb);
 out:
         release_sock(sk);
@@ -1332,8 +1329,7 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         struct sock *sk = sock->sk;
         struct iucv_sock *iucv = iucv_sk(sk);
         unsigned int copied, rlen;
-        struct sk_buff *skb, *rskb, *cskb, *sskb;
-        int blen;
+        struct sk_buff *skb, *rskb, *cskb;
         int err = 0;
 
         if ((sk->sk_state == IUCV_DISCONN) &&
@@ -1356,6 +1352,8 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         rlen   = skb->len;              /* real length of skb */
         copied = min_t(unsigned int, rlen, len);
+        if (!rlen)
+                sk->sk_shutdown = sk->sk_shutdown | RCV_SHUTDOWN;
 
         cskb = skb;
         if (skb_copy_datagram_iovec(cskb, 0, msg->msg_iov, copied)) {
@@ -1396,7 +1394,14 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                 }
 
                 kfree_skb(skb);
-                atomic_inc(&iucv->msg_recv);
+                if (iucv->transport == AF_IUCV_TRANS_HIPER) {
+                        atomic_inc(&iucv->msg_recv);
+                        if (atomic_read(&iucv->msg_recv) > iucv->msglimit) {
+                                WARN_ON(1);
+                                iucv_sock_close(sk);
+                                return -EFAULT;
+                        }
+                }
 
                 /* Queue backlog skbs */
                 spin_lock_bh(&iucv->message_q.lock);
@@ -1415,15 +1420,7 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                                 iucv_process_message_q(sk);
                         if (atomic_read(&iucv->msg_recv) >=
                                                         iucv->msglimit / 2) {
-                                /* send WIN to peer */
-                                blen = sizeof(struct af_iucv_trans_hdr) +
-                                        ETH_HLEN;
-                                sskb = sock_alloc_send_skb(sk, blen, 1, &err);
-                                if (sskb) {
-                                        skb_reserve(sskb, blen);
-                                        err = afiucv_hs_send(NULL, sk, sskb,
-                                                             AF_IUCV_FLAG_WIN);
-                                }
+                                err = iucv_send_ctrl(sk, AF_IUCV_FLAG_WIN);
                                 if (err) {
                                         sk->sk_state = IUCV_DISCONN;
                                         sk->sk_state_change(sk);
@@ -1486,7 +1483,7 @@ unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
         if (sk->sk_state == IUCV_DISCONN)
                 mask |= POLLIN;
 
-        if (sock_writeable(sk))
+        if (sock_writeable(sk) && iucv_below_msglim(sk))
                 mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
         else
                 set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
@@ -1508,42 +1505,47 @@ static int iucv_sock_shutdown(struct socket *sock, int how)
 
         lock_sock(sk);
         switch (sk->sk_state) {
+        case IUCV_LISTEN:
         case IUCV_DISCONN:
         case IUCV_CLOSING:
         case IUCV_CLOSED:
                 err = -ENOTCONN;
                 goto fail;
-
         default:
-                sk->sk_shutdown |= how;
                 break;
         }
 
         if (how == SEND_SHUTDOWN || how == SHUTDOWN_MASK) {
-                txmsg.class = 0;
-                txmsg.tag = 0;
-                err = pr_iucv->message_send(iucv->path, &txmsg, IUCV_IPRMDATA,
-                                        0, (void *) iprm_shutdown, 8);
-                if (err) {
-                        switch (err) {
-                        case 1:
-                                err = -ENOTCONN;
-                                break;
-                        case 2:
-                                err = -ECONNRESET;
-                                break;
-                        default:
-                                err = -ENOTCONN;
-                                break;
+                if (iucv->transport == AF_IUCV_TRANS_IUCV) {
+                        txmsg.class = 0;
+                        txmsg.tag = 0;
+                        err = pr_iucv->message_send(iucv->path, &txmsg,
+                                IUCV_IPRMDATA, 0, (void *) iprm_shutdown, 8);
+                        if (err) {
+                                switch (err) {
+                                case 1:
+                                        err = -ENOTCONN;
+                                        break;
+                                case 2:
+                                        err = -ECONNRESET;
+                                        break;
+                                default:
+                                        err = -ENOTCONN;
+                                        break;
+                                }
                         }
-                }
+                } else
+                        iucv_send_ctrl(sk, AF_IUCV_FLAG_SHT);
         }
 
+        sk->sk_shutdown |= how;
         if (how == RCV_SHUTDOWN || how == SHUTDOWN_MASK) {
-                err = pr_iucv->path_quiesce(iucv->path, NULL);
-                if (err)
-                        err = -ENOTCONN;
-
+                if (iucv->transport == AF_IUCV_TRANS_IUCV) {
+                        err = pr_iucv->path_quiesce(iucv->path, NULL);
+                        if (err)
+                                err = -ENOTCONN;
+/*                      skb_queue_purge(&sk->sk_receive_queue); */
+                }
                 skb_queue_purge(&sk->sk_receive_queue);
         }
 
@@ -1565,13 +1567,6 @@ static int iucv_sock_release(struct socket *sock)
 
         iucv_sock_close(sk);
 
-        /* Unregister with IUCV base support */
-        if (iucv_sk(sk)->path) {
-                pr_iucv->path_sever(iucv_sk(sk)->path, NULL);
-                iucv_path_free(iucv_sk(sk)->path);
-                iucv_sk(sk)->path = NULL;
-        }
-
         sock_orphan(sk);
         iucv_sock_kill(sk);
         return err;
@@ -1633,7 +1628,8 @@ static int iucv_sock_getsockopt(struct socket *sock, int level, int optname,
 {
         struct sock *sk = sock->sk;
         struct iucv_sock *iucv = iucv_sk(sk);
-        int val, len;
+        unsigned int val;
+        int len;
 
         if (level != SOL_IUCV)
                 return -ENOPROTOOPT;
@@ -1656,6 +1652,13 @@ static int iucv_sock_getsockopt(struct socket *sock, int level, int optname,
                                            : iucv->msglimit;    /* default */
                 release_sock(sk);
                 break;
+        case SO_MSGSIZE:
+                if (sk->sk_state == IUCV_OPEN)
+                        return -EBADFD;
+                val = (iucv->hs_dev) ? iucv->hs_dev->mtu -
+                                sizeof(struct af_iucv_trans_hdr) - ETH_HLEN :
+                                0x7fffffff;
+                break;
         default:
                 return -ENOPROTOOPT;
         }
@@ -1750,8 +1753,7 @@ static int iucv_callback_connreq(struct iucv_path *path,
         path->msglim = iucv->msglimit;
         err = pr_iucv->path_accept(path, &af_iucv_handler, nuser_data, nsk);
         if (err) {
-                err = pr_iucv->path_sever(path, user_data);
-                iucv_path_free(path);
+                iucv_sever_path(nsk, 1);
                 iucv_sock_kill(nsk);
                 goto fail;
         }
@@ -1828,6 +1830,7 @@ static void iucv_callback_txdone(struct iucv_path *path,
         struct sk_buff *list_skb = list->next;
         unsigned long flags;
 
+        bh_lock_sock(sk);
         if (!skb_queue_empty(list)) {
                 spin_lock_irqsave(&list->lock, flags);
 
@@ -1849,7 +1852,6 @@ static void iucv_callback_txdone(struct iucv_path *path,
                         iucv_sock_wake_msglim(sk);
                 }
         }
-        BUG_ON(!this);
 
         if (sk->sk_state == IUCV_CLOSING) {
                 if (skb_queue_empty(&iucv_sk(sk)->send_skb_q)) {
@@ -1857,6 +1859,7 @@ static void iucv_callback_txdone(struct iucv_path *path,
                         sk->sk_state_change(sk);
                 }
         }
+        bh_unlock_sock(sk);
 
 }
 
@@ -1864,9 +1867,15 @@ static void iucv_callback_connrej(struct iucv_path *path, u8 ipuser[16])
 {
         struct sock *sk = path->private;
 
+        if (sk->sk_state == IUCV_CLOSED)
+                return;
+
+        bh_lock_sock(sk);
+        iucv_sever_path(sk, 1);
         sk->sk_state = IUCV_DISCONN;
 
         sk->sk_state_change(sk);
+        bh_unlock_sock(sk);
 }
 
 /* called if the other communication side shuts down its RECV direction;
@@ -1954,6 +1963,8 @@ static int afiucv_hs_callback_syn(struct sock *sk, struct sk_buff *skb)
         memcpy(niucv->src_name, iucv->src_name, 8);
         memcpy(niucv->src_user_id, iucv->src_user_id, 8);
         nsk->sk_bound_dev_if = sk->sk_bound_dev_if;
+        niucv->hs_dev = iucv->hs_dev;
+        dev_hold(niucv->hs_dev);
         afiucv_swap_src_dest(skb);
         trans_hdr->flags = AF_IUCV_FLAG_SYN | AF_IUCV_FLAG_ACK;
         trans_hdr->window = niucv->msglimit;
@@ -2022,12 +2033,15 @@ static int afiucv_hs_callback_fin(struct sock *sk, struct sk_buff *skb)
         struct iucv_sock *iucv = iucv_sk(sk);
 
         /* other end of connection closed */
-        if (iucv) {
-                bh_lock_sock(sk);
+        if (!iucv)
+                goto out;
+        bh_lock_sock(sk);
+        if (sk->sk_state == IUCV_CONNECTED) {
                 sk->sk_state = IUCV_DISCONN;
                 sk->sk_state_change(sk);
-                bh_unlock_sock(sk);
         }
+        bh_unlock_sock(sk);
+out:
         kfree_skb(skb);
         return NET_RX_SUCCESS;
 }
@@ -2069,8 +2083,13 @@ static int afiucv_hs_callback_rx(struct sock *sk, struct sk_buff *skb)
                 return NET_RX_SUCCESS;
         }
 
+        if (sk->sk_shutdown & RCV_SHUTDOWN) {
+                kfree_skb(skb);
+                return NET_RX_SUCCESS;
+        }
+
                 /* write stuff from iucv_msg to skb cb */
-        if (skb->len <= sizeof(struct af_iucv_trans_hdr)) {
+        if (skb->len < sizeof(struct af_iucv_trans_hdr)) {
                 kfree_skb(skb);
                 return NET_RX_SUCCESS;
         }
@@ -2172,11 +2191,14 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev,
                 break;
         case (AF_IUCV_FLAG_WIN):
                 err = afiucv_hs_callback_win(sk, skb);
-                if (skb->len > sizeof(struct af_iucv_trans_hdr))
-                        err = afiucv_hs_callback_rx(sk, skb);
-                else
-                        kfree(skb);
-                break;
+                if (skb->len == sizeof(struct af_iucv_trans_hdr)) {
+                        kfree_skb(skb);
+                        break;
+                }
+                /* fall through and receive non-zero length data */
+        case (AF_IUCV_FLAG_SHT):
+                /* shutdown request */
+                /* fall through and receive zero length data */
         case 0:
                 /* plain data frame */
                 memcpy(CB_TRGCLS(skb), &trans_hdr->iucv_hdr.class,
@@ -2202,65 +2224,64 @@ static void afiucv_hs_callback_txnotify(struct sk_buff *skb,
         struct iucv_sock *iucv = NULL;
         struct sk_buff_head *list;
         struct sk_buff *list_skb;
-        struct sk_buff *this = NULL;
+        struct sk_buff *nskb;
         unsigned long flags;
         struct hlist_node *node;
 
-        read_lock(&iucv_sk_list.lock);
+        read_lock_irqsave(&iucv_sk_list.lock, flags);
         sk_for_each(sk, node, &iucv_sk_list.head)
                 if (sk == isk) {
                         iucv = iucv_sk(sk);
                         break;
                 }
-        read_unlock(&iucv_sk_list.lock);
+        read_unlock_irqrestore(&iucv_sk_list.lock, flags);
 
-        if (!iucv)
+        if (!iucv || sock_flag(sk, SOCK_ZAPPED))
                 return;
 
-        bh_lock_sock(sk);
         list = &iucv->send_skb_q;
-        list_skb = list->next;
+        spin_lock_irqsave(&list->lock, flags);
         if (skb_queue_empty(list))
                 goto out_unlock;
-
-        spin_lock_irqsave(&list->lock, flags);
+        list_skb = list->next;
+        nskb = list_skb->next;
         while (list_skb != (struct sk_buff *)list) {
                 if (skb_shinfo(list_skb) == skb_shinfo(skb)) {
-                        this = list_skb;
                         switch (n) {
                         case TX_NOTIFY_OK:
-                                __skb_unlink(this, list);
+                                __skb_unlink(list_skb, list);
+                                kfree_skb(list_skb);
                                 iucv_sock_wake_msglim(sk);
-                                dev_put(this->dev);
-                                kfree_skb(this);
                                 break;
                         case TX_NOTIFY_PENDING:
                                 atomic_inc(&iucv->pendings);
                                 break;
                         case TX_NOTIFY_DELAYED_OK:
-                                __skb_unlink(this, list);
+                                __skb_unlink(list_skb, list);
                                 atomic_dec(&iucv->pendings);
                                 if (atomic_read(&iucv->pendings) <= 0)
                                         iucv_sock_wake_msglim(sk);
-                                dev_put(this->dev);
-                                kfree_skb(this);
+                                kfree_skb(list_skb);
                                 break;
                         case TX_NOTIFY_UNREACHABLE:
                         case TX_NOTIFY_DELAYED_UNREACHABLE:
                         case TX_NOTIFY_TPQFULL: /* not yet used */
                         case TX_NOTIFY_GENERALERROR:
                         case TX_NOTIFY_DELAYED_GENERALERROR:
-                                __skb_unlink(this, list);
-                                dev_put(this->dev);
-                                kfree_skb(this);
-                                sk->sk_state = IUCV_DISCONN;
-                                sk->sk_state_change(sk);
+                                __skb_unlink(list_skb, list);
+                                kfree_skb(list_skb);
+                                if (sk->sk_state == IUCV_CONNECTED) {
+                                        sk->sk_state = IUCV_DISCONN;
+                                        sk->sk_state_change(sk);
+                                }
                                 break;
                         }
                         break;
                 }
-                list_skb = list_skb->next;
+                list_skb = nskb;
+                nskb = nskb->next;
         }
+out_unlock:
         spin_unlock_irqrestore(&list->lock, flags);
 
         if (sk->sk_state == IUCV_CLOSING) {
@@ -2270,9 +2291,45 @@ static void afiucv_hs_callback_txnotify(struct sk_buff *skb,
                 }
         }
 
-out_unlock:
-        bh_unlock_sock(sk);
 }
+
+/*
+ * afiucv_netdev_event: handle netdev notifier chain events
+ */
+static int afiucv_netdev_event(struct notifier_block *this,
+                               unsigned long event, void *ptr)
+{
+        struct net_device *event_dev = (struct net_device *)ptr;
+        struct hlist_node *node;
+        struct sock *sk;
+        struct iucv_sock *iucv;
+
+        switch (event) {
+        case NETDEV_REBOOT:
+        case NETDEV_GOING_DOWN:
+                sk_for_each(sk, node, &iucv_sk_list.head) {
+                        iucv = iucv_sk(sk);
+                        if ((iucv->hs_dev == event_dev) &&
+                            (sk->sk_state == IUCV_CONNECTED)) {
+                                if (event == NETDEV_GOING_DOWN)
+                                        iucv_send_ctrl(sk, AF_IUCV_FLAG_FIN);
+                                sk->sk_state = IUCV_DISCONN;
+                                sk->sk_state_change(sk);
+                        }
+                }
+                break;
+        case NETDEV_DOWN:
+        case NETDEV_UNREGISTER:
+        default:
+                break;
+        }
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block afiucv_netdev_notifier = {
+        .notifier_call = afiucv_netdev_event,
+};
+
 static const struct proto_ops iucv_sock_ops = {
         .family         = PF_IUCV,
         .owner          = THIS_MODULE,
@@ -2372,7 +2429,8 @@ static int __init afiucv_init(void)
                 err = afiucv_iucv_init();
                 if (err)
                         goto out_sock;
-        }
+        } else
+                register_netdevice_notifier(&afiucv_netdev_notifier);
         dev_add_pack(&iucv_packet_type);
         return 0;
 
@@ -2393,7 +2451,8 @@ static void __exit afiucv_exit(void)
                 driver_unregister(&af_iucv_driver);
                 pr_iucv->iucv_unregister(&af_iucv_handler, 0);
                 symbol_put(iucv_if);
-        }
+        } else
+                unregister_netdevice_notifier(&afiucv_netdev_notifier);
         dev_remove_pack(&iucv_packet_type);
         sock_unregister(PF_IUCV);
         proto_unregister(&iucv_proto);
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index 403be43b793d..3ad1f9db5f8b 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -1800,7 +1800,7 @@ static void iucv_work_fn(struct work_struct *work)
  * Handles external interrupts coming in from CP.
  * Places the interrupt buffer on a queue and schedules iucv_tasklet_fn().
  */
-static void iucv_external_interrupt(unsigned int ext_int_code,
+static void iucv_external_interrupt(struct ext_code ext_code,
                                     unsigned int param32, unsigned long param64)
 {
         struct iucv_irq_data *p;
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 11dbb2255ccb..34e418508a67 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1714,7 +1714,7 @@ static int key_notify_sa_flush(const struct km_event *c)
 static int pfkey_flush(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
 {
         struct net *net = sock_net(sk);
-        unsigned proto;
+        unsigned int proto;
         struct km_event c;
         struct xfrm_audit audit_info;
         int err, err2;
@@ -3480,7 +3480,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
 
         /* Addresses to be used by KM for negotiation, if ext is available */
         if (k != NULL && (set_sadb_kmaddress(skb, k) < 0))
-                return -EINVAL;
+                goto err;
 
         /* selector src */
         set_sadb_address(skb, sasize_sel, SADB_EXT_ADDRESS_SRC, sel);
@@ -3547,7 +3547,7 @@ static int pfkey_sendmsg(struct kiocb *kiocb,
                 goto out;
 
         err = -EMSGSIZE;
-        if ((unsigned)len > sk->sk_sndbuf - 32)
+        if ((unsigned int)len > sk->sk_sndbuf - 32)
                 goto out;
 
         err = -ENOBUFS;
diff --git a/net/l2tp/Makefile b/net/l2tp/Makefile
index 110e7bc2de5e..2870f41ea44d 100644
--- a/net/l2tp/Makefile
+++ b/net/l2tp/Makefile
@@ -10,3 +10,6 @@ obj-$(subst y,$(CONFIG_L2TP),$(CONFIG_L2TP_IP)) += l2tp_ip.o
 obj-$(subst y,$(CONFIG_L2TP),$(CONFIG_L2TP_V3)) += l2tp_netlink.o
 obj-$(subst y,$(CONFIG_L2TP),$(CONFIG_L2TP_ETH)) += l2tp_eth.o
 obj-$(subst y,$(CONFIG_L2TP),$(CONFIG_L2TP_DEBUGFS)) += l2tp_debugfs.o
+ifneq ($(CONFIG_IPV6),)
+obj-$(subst y,$(CONFIG_L2TP),$(CONFIG_L2TP_IP)) += l2tp_ip6.o
+endif
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 89ff8c67943e..32b2155e7ab4 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -18,6 +18,8 @@
  * published by the Free Software Foundation.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/string.h>
 #include <linux/list.h>
@@ -53,6 +55,10 @@
 #include <net/inet_common.h>
 #include <net/xfrm.h>
 #include <net/protocol.h>
+#include <net/inet6_connection_sock.h>
+#include <net/inet_ecn.h>
+#include <net/ip6_route.h>
+#include <net/ip6_checksum.h>
 
 #include <asm/byteorder.h>
 #include <linux/atomic.h>
@@ -82,12 +88,6 @@
 /* Default trace flags */
 #define L2TP_DEFAULT_DEBUG_FLAGS        0
 
-#define PRINTK(_mask, _type, _lvl, _fmt, args...)                       \
-        do {                                                            \
-                if ((_mask) & (_type))                                  \
-                        printk(_lvl "L2TP: " _fmt, ##args);             \
-        } while (0)
-
 /* Private data stored for received packets in the skb.
  */
 struct l2tp_skb_cb {
@@ -137,14 +137,20 @@ static inline void l2tp_tunnel_dec_refcount_1(struct l2tp_tunnel *tunnel)
                 l2tp_tunnel_free(tunnel);
 }
 #ifdef L2TP_REFCNT_DEBUG
-#define l2tp_tunnel_inc_refcount(_t) do { \
-                printk(KERN_DEBUG "l2tp_tunnel_inc_refcount: %s:%d %s: cnt=%d\n", __func__, __LINE__, (_t)->name, atomic_read(&_t->ref_count)); \
-                l2tp_tunnel_inc_refcount_1(_t);                         \
-        } while (0)
-#define l2tp_tunnel_dec_refcount(_t) do { \
-                printk(KERN_DEBUG "l2tp_tunnel_dec_refcount: %s:%d %s: cnt=%d\n", __func__, __LINE__, (_t)->name, atomic_read(&_t->ref_count)); \
-                l2tp_tunnel_dec_refcount_1(_t);                         \
-        } while (0)
+#define l2tp_tunnel_inc_refcount(_t)                                    \
+do {                                                                    \
+        pr_debug("l2tp_tunnel_inc_refcount: %s:%d %s: cnt=%d\n",        \
+                 __func__, __LINE__, (_t)->name,                        \
+                 atomic_read(&_t->ref_count));                          \
+        l2tp_tunnel_inc_refcount_1(_t);                                 \
+} while (0)
+#define l2tp_tunnel_dec_refcount(_t)
+do {                                                                    \
+        pr_debug("l2tp_tunnel_dec_refcount: %s:%d %s: cnt=%d\n",        \
+                 __func__, __LINE__, (_t)->name,                        \
+                 atomic_read(&_t->ref_count));                          \
+        l2tp_tunnel_dec_refcount_1(_t);                                 \
+} while (0)
 #else
 #define l2tp_tunnel_inc_refcount(t) l2tp_tunnel_inc_refcount_1(t)
 #define l2tp_tunnel_dec_refcount(t) l2tp_tunnel_dec_refcount_1(t)
@@ -326,16 +332,20 @@ static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *sk
         struct sk_buff *skbp;
         struct sk_buff *tmp;
         u32 ns = L2TP_SKB_CB(skb)->ns;
+        struct l2tp_stats *sstats;
 
         spin_lock_bh(&session->reorder_q.lock);
+        sstats = &session->stats;
         skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
                 if (L2TP_SKB_CB(skbp)->ns > ns) {
                         __skb_queue_before(&session->reorder_q, skbp, skb);
-                        PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
-                               "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
-                               session->name, ns, L2TP_SKB_CB(skbp)->ns,
-                               skb_queue_len(&session->reorder_q));
-                        session->stats.rx_oos_packets++;
+                        l2tp_dbg(session, L2TP_MSG_SEQ,
+                                 "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
+                                 session->name, ns, L2TP_SKB_CB(skbp)->ns,
+                                 skb_queue_len(&session->reorder_q));
+                        u64_stats_update_begin(&sstats->syncp);
+                        sstats->rx_oos_packets++;
+                        u64_stats_update_end(&sstats->syncp);
                         goto out;
                 }
         }
@@ -352,16 +362,23 @@ static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *
 {
         struct l2tp_tunnel *tunnel = session->tunnel;
         int length = L2TP_SKB_CB(skb)->length;
+        struct l2tp_stats *tstats, *sstats;
 
         /* We're about to requeue the skb, so return resources
          * to its current owner (a socket receive buffer).
          */
         skb_orphan(skb);
 
-        tunnel->stats.rx_packets++;
-        tunnel->stats.rx_bytes += length;
-        session->stats.rx_packets++;
-        session->stats.rx_bytes += length;
+        tstats = &tunnel->stats;
+        u64_stats_update_begin(&tstats->syncp);
+        sstats = &session->stats;
+        u64_stats_update_begin(&sstats->syncp);
+        tstats->rx_packets++;
+        tstats->rx_bytes += length;
+        sstats->rx_packets++;
+        sstats->rx_bytes += length;
+        u64_stats_update_end(&tstats->syncp);
+        u64_stats_update_end(&sstats->syncp);
 
         if (L2TP_SKB_CB(skb)->has_seq) {
                 /* Bump our Nr */
@@ -371,8 +388,8 @@ static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *
                 else
                         session->nr &= 0xffffff;
 
-                PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
-                       "%s: updated nr to %hu\n", session->name, session->nr);
+                l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated nr to %hu\n",
+                         session->name, session->nr);
         }
 
         /* call private receive handler */
@@ -392,6 +409,7 @@ static void l2tp_recv_dequeue(struct l2tp_session *session)
 {
         struct sk_buff *skb;
         struct sk_buff *tmp;
+        struct l2tp_stats *sstats;
 
         /* If the pkt at the head of the queue has the nr that we
          * expect to send up next, dequeue it and any other
@@ -399,16 +417,19 @@ static void l2tp_recv_dequeue(struct l2tp_session *session)
          */
 start:
         spin_lock_bh(&session->reorder_q.lock);
+        sstats = &session->stats;
         skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
                 if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
-                        session->stats.rx_seq_discards++;
-                        session->stats.rx_errors++;
-                        PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
-                               "%s: oos pkt %u len %d discarded (too old), "
-                               "waiting for %u, reorder_q_len=%d\n",
-                               session->name, L2TP_SKB_CB(skb)->ns,
-                               L2TP_SKB_CB(skb)->length, session->nr,
-                               skb_queue_len(&session->reorder_q));
+                        u64_stats_update_begin(&sstats->syncp);
+                        sstats->rx_seq_discards++;
+                        sstats->rx_errors++;
+                        u64_stats_update_end(&sstats->syncp);
+                        l2tp_dbg(session, L2TP_MSG_SEQ,
+                                 "%s: oos pkt %u len %d discarded (too old), waiting for %u, reorder_q_len=%d\n",
+                                 session->name, L2TP_SKB_CB(skb)->ns,
+                                 L2TP_SKB_CB(skb)->length, session->nr,
+                                 skb_queue_len(&session->reorder_q));
+                        session->reorder_skip = 1;
                         __skb_unlink(skb, &session->reorder_q);
                         kfree_skb(skb);
                         if (session->deref)
@@ -417,13 +438,20 @@ start:
                 }
 
                 if (L2TP_SKB_CB(skb)->has_seq) {
+                        if (session->reorder_skip) {
+                                l2tp_dbg(session, L2TP_MSG_SEQ,
+                                         "%s: advancing nr to next pkt: %u -> %u",
+                                         session->name, session->nr,
+                                         L2TP_SKB_CB(skb)->ns);
+                                session->reorder_skip = 0;
+                                session->nr = L2TP_SKB_CB(skb)->ns;
+                        }
                         if (L2TP_SKB_CB(skb)->ns != session->nr) {
-                                PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
-                                       "%s: holding oos pkt %u len %d, "
-                                       "waiting for %u, reorder_q_len=%d\n",
-                                       session->name, L2TP_SKB_CB(skb)->ns,
-                                       L2TP_SKB_CB(skb)->length, session->nr,
-                                       skb_queue_len(&session->reorder_q));
+                                l2tp_dbg(session, L2TP_MSG_SEQ,
+                                         "%s: holding oos pkt %u len %d, waiting for %u, reorder_q_len=%d\n",
+                                         session->name, L2TP_SKB_CB(skb)->ns,
+                                         L2TP_SKB_CB(skb)->length, session->nr,
+                                         skb_queue_len(&session->reorder_q));
                                 goto out;
                         }
                 }
@@ -446,21 +474,43 @@ static inline int l2tp_verify_udp_checksum(struct sock *sk,
 {
         struct udphdr *uh = udp_hdr(skb);
         u16 ulen = ntohs(uh->len);
-        struct inet_sock *inet;
         __wsum psum;
 
-        if (sk->sk_no_check || skb_csum_unnecessary(skb) || !uh->check)
+        if (sk->sk_no_check || skb_csum_unnecessary(skb))
                 return 0;
 
-        inet = inet_sk(sk);
-        psum = csum_tcpudp_nofold(inet->inet_saddr, inet->inet_daddr, ulen,
-                                  IPPROTO_UDP, 0);
-
-        if ((skb->ip_summed == CHECKSUM_COMPLETE) &&
-            !csum_fold(csum_add(psum, skb->csum)))
-                return 0;
-
-        skb->csum = psum;
+#if IS_ENABLED(CONFIG_IPV6)
+        if (sk->sk_family == PF_INET6) {
+                if (!uh->check) {
+                        LIMIT_NETDEBUG(KERN_INFO "L2TP: IPv6: checksum is 0\n");
+                        return 1;
+                }
+                if ((skb->ip_summed == CHECKSUM_COMPLETE) &&
+                    !csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
+                                     &ipv6_hdr(skb)->daddr, ulen,
+                                     IPPROTO_UDP, skb->csum)) {
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                        return 0;
+                }
+                skb->csum = ~csum_unfold(csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
+                                                         &ipv6_hdr(skb)->daddr,
+                                                         skb->len, IPPROTO_UDP,
+                                                         0));
+        } else
+#endif
+        {
+                struct inet_sock *inet;
+                if (!uh->check)
+                        return 0;
+                inet = inet_sk(sk);
+                psum = csum_tcpudp_nofold(inet->inet_saddr, inet->inet_daddr,
+                                          ulen, IPPROTO_UDP, 0);
+
+                if ((skb->ip_summed == CHECKSUM_COMPLETE) &&
+                    !csum_fold(csum_add(psum, skb->csum)))
+                        return 0;
+                skb->csum = psum;
+        }
 
         return __skb_checksum_complete(skb);
 }
@@ -532,6 +582,7 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
         struct l2tp_tunnel *tunnel = session->tunnel;
         int offset;
         u32 ns, nr;
+        struct l2tp_stats *sstats = &session->stats;
 
         /* The ref count is increased since we now hold a pointer to
          * the session. Take care to decrement the refcnt when exiting
@@ -544,10 +595,13 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
         /* Parse and check optional cookie */
         if (session->peer_cookie_len > 0) {
                 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
-                        PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
-                               "%s: cookie mismatch (%u/%u). Discarding.\n",
-                               tunnel->name, tunnel->tunnel_id, session->session_id);
-                        session->stats.rx_cookie_discards++;
+                        l2tp_info(tunnel, L2TP_MSG_DATA,
+                                  "%s: cookie mismatch (%u/%u). Discarding.\n",
+                                  tunnel->name, tunnel->tunnel_id,
+                                  session->session_id);
+                        u64_stats_update_begin(&sstats->syncp);
+                        sstats->rx_cookie_discards++;
+                        u64_stats_update_end(&sstats->syncp);
                         goto discard;
                 }
                 ptr += session->peer_cookie_len;
@@ -573,9 +627,9 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                         L2TP_SKB_CB(skb)->ns = ns;
                         L2TP_SKB_CB(skb)->has_seq = 1;
 
-                        PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
-                               "%s: recv data ns=%u, nr=%u, session nr=%u\n",
-                               session->name, ns, nr, session->nr);
+                        l2tp_dbg(session, L2TP_MSG_SEQ,
+                                 "%s: recv data ns=%u, nr=%u, session nr=%u\n",
+                                 session->name, ns, nr, session->nr);
                 }
         } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
                 u32 l2h = ntohl(*(__be32 *) ptr);
@@ -587,9 +641,9 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                         L2TP_SKB_CB(skb)->ns = ns;
                         L2TP_SKB_CB(skb)->has_seq = 1;
 
-                        PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
-                               "%s: recv data ns=%u, session nr=%u\n",
-                               session->name, ns, session->nr);
+                        l2tp_dbg(session, L2TP_MSG_SEQ,
+                                 "%s: recv data ns=%u, session nr=%u\n",
+                                 session->name, ns, session->nr);
                 }
         }
 
@@ -602,9 +656,9 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                  * configure it so.
                  */
                 if ((!session->lns_mode) && (!session->send_seq)) {
-                        PRINTK(session->debug, L2TP_MSG_SEQ, KERN_INFO,
-                               "%s: requested to enable seq numbers by LNS\n",
-                               session->name);
+                        l2tp_info(session, L2TP_MSG_SEQ,
+                                  "%s: requested to enable seq numbers by LNS\n",
+                                  session->name);
                         session->send_seq = -1;
                         l2tp_session_set_header_len(session, tunnel->version);
                 }
@@ -613,10 +667,12 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                  * If user has configured mandatory sequence numbers, discard.
                  */
                 if (session->recv_seq) {
-                        PRINTK(session->debug, L2TP_MSG_SEQ, KERN_WARNING,
-                               "%s: recv data has no seq numbers when required. "
-                               "Discarding\n", session->name);
-                        session->stats.rx_seq_discards++;
+                        l2tp_warn(session, L2TP_MSG_SEQ,
+                                  "%s: recv data has no seq numbers when required. Discarding.\n",
+                                  session->name);
+                        u64_stats_update_begin(&sstats->syncp);
+                        sstats->rx_seq_discards++;
+                        u64_stats_update_end(&sstats->syncp);
                         goto discard;
                 }
 
@@ -626,16 +682,18 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                  * LAC is broken. Discard the frame.
                  */
                 if ((!session->lns_mode) && (session->send_seq)) {
-                        PRINTK(session->debug, L2TP_MSG_SEQ, KERN_INFO,
-                               "%s: requested to disable seq numbers by LNS\n",
-                               session->name);
+                        l2tp_info(session, L2TP_MSG_SEQ,
+                                  "%s: requested to disable seq numbers by LNS\n",
+                                  session->name);
                         session->send_seq = 0;
                         l2tp_session_set_header_len(session, tunnel->version);
                 } else if (session->send_seq) {
-                        PRINTK(session->debug, L2TP_MSG_SEQ, KERN_WARNING,
-                               "%s: recv data has no seq numbers when required. "
-                               "Discarding\n", session->name);
-                        session->stats.rx_seq_discards++;
+                        l2tp_warn(session, L2TP_MSG_SEQ,
+                                  "%s: recv data has no seq numbers when required. Discarding.\n",
+                                  session->name);
+                        u64_stats_update_begin(&sstats->syncp);
+                        sstats->rx_seq_discards++;
+                        u64_stats_update_end(&sstats->syncp);
                         goto discard;
                 }
         }
@@ -689,13 +747,14 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                          * packets
                          */
                         if (L2TP_SKB_CB(skb)->ns != session->nr) {
-                                session->stats.rx_seq_discards++;
-                                PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
-                                       "%s: oos pkt %u len %d discarded, "
-                                       "waiting for %u, reorder_q_len=%d\n",
-                                       session->name, L2TP_SKB_CB(skb)->ns,
-                                       L2TP_SKB_CB(skb)->length, session->nr,
-                                       skb_queue_len(&session->reorder_q));
+                                u64_stats_update_begin(&sstats->syncp);
+                                sstats->rx_seq_discards++;
+                                u64_stats_update_end(&sstats->syncp);
+                                l2tp_dbg(session, L2TP_MSG_SEQ,
+                                         "%s: oos pkt %u len %d discarded, waiting for %u, reorder_q_len=%d\n",
+                                         session->name, L2TP_SKB_CB(skb)->ns,
+                                         L2TP_SKB_CB(skb)->length, session->nr,
+                                         skb_queue_len(&session->reorder_q));
                                 goto discard;
                         }
                         skb_queue_tail(&session->reorder_q, skb);
@@ -716,7 +775,9 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
         return;
 
 discard:
-        session->stats.rx_errors++;
+        u64_stats_update_begin(&sstats->syncp);
+        sstats->rx_errors++;
+        u64_stats_update_end(&sstats->syncp);
         kfree_skb(skb);
 
         if (session->deref)
@@ -739,9 +800,9 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
         unsigned char *ptr, *optr;
         u16 hdrflags;
         u32 tunnel_id, session_id;
-        int offset;
         u16 version;
         int length;
+        struct l2tp_stats *tstats;
 
         if (tunnel->sock && l2tp_verify_udp_checksum(tunnel->sock, skb))
                 goto discard_bad_csum;
@@ -751,8 +812,9 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
 
         /* Short packet? */
         if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) {
-                PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
-                       "%s: recv short packet (len=%d)\n", tunnel->name, skb->len);
+                l2tp_info(tunnel, L2TP_MSG_DATA,
+                          "%s: recv short packet (len=%d)\n",
+                          tunnel->name, skb->len);
                 goto error;
         }
 
@@ -762,14 +824,8 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
                 if (!pskb_may_pull(skb, length))
                         goto error;
 
-                printk(KERN_DEBUG "%s: recv: ", tunnel->name);
-
-                offset = 0;
-                do {
-                        printk(" %02X", skb->data[offset]);
-                } while (++offset < length);
-
-                printk("\n");
+                pr_debug("%s: recv\n", tunnel->name);
+                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length);
         }
 
         /* Point to L2TP header */
@@ -781,9 +837,9 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
         /* Check protocol version */
         version = hdrflags & L2TP_HDR_VER_MASK;
         if (version != tunnel->version) {
-                PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
-                       "%s: recv protocol version mismatch: got %d expected %d\n",
-                       tunnel->name, version, tunnel->version);
+                l2tp_info(tunnel, L2TP_MSG_DATA,
+                          "%s: recv protocol version mismatch: got %d expected %d\n",
+                          tunnel->name, version, tunnel->version);
                 goto error;
         }
 
@@ -792,8 +848,9 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
 
         /* If type is control packet, it is handled by userspace. */
         if (hdrflags & L2TP_HDRFLAG_T) {
-                PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_DEBUG,
-                       "%s: recv control packet, len=%d\n", tunnel->name, length);
+                l2tp_dbg(tunnel, L2TP_MSG_DATA,
+                         "%s: recv control packet, len=%d\n",
+                         tunnel->name, length);
                 goto error;
         }
 
@@ -821,9 +878,9 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
         session = l2tp_session_find(tunnel->l2tp_net, tunnel, session_id);
         if (!session || !session->recv_skb) {
                 /* Not found? Pass to userspace to deal with */
-                PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
-                       "%s: no session found (%u/%u). Passing up.\n",
-                       tunnel->name, tunnel_id, session_id);
+                l2tp_info(tunnel, L2TP_MSG_DATA,
+                          "%s: no session found (%u/%u). Passing up.\n",
+                          tunnel->name, tunnel_id, session_id);
                 goto error;
         }
 
@@ -834,7 +891,10 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
 discard_bad_csum:
         LIMIT_NETDEBUG("%s: UDP: bad checksum\n", tunnel->name);
         UDP_INC_STATS_USER(tunnel->l2tp_net, UDP_MIB_INERRORS, 0);
-        tunnel->stats.rx_errors++;
+        tstats = &tunnel->stats;
+        u64_stats_update_begin(&tstats->syncp);
+        tstats->rx_errors++;
+        u64_stats_update_end(&tstats->syncp);
         kfree_skb(skb);
 
         return 0;
@@ -860,8 +920,8 @@ int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
         if (tunnel == NULL)
                 goto pass_up;
 
-        PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_DEBUG,
-               "%s: received %d bytes\n", tunnel->name, skb->len);
+        l2tp_dbg(tunnel, L2TP_MSG_DATA, "%s: received %d bytes\n",
+                 tunnel->name, skb->len);
 
         if (l2tp_udp_recv_core(tunnel, skb, tunnel->recv_payload_hook))
                 goto pass_up_put;
@@ -903,8 +963,8 @@ static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
                 *bufp++ = 0;
                 session->ns++;
                 session->ns &= 0xffff;
-                PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
-                       "%s: updated ns to %u\n", session->name, session->ns);
+                l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated ns to %u\n",
+                         session->name, session->ns);
         }
 
         return bufp - optr;
@@ -940,8 +1000,9 @@ static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
                                 l2h = 0x40000000 | session->ns;
                                 session->ns++;
                                 session->ns &= 0xffffff;
-                                PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
-                                       "%s: updated ns to %u\n", session->name, session->ns);
+                                l2tp_dbg(session, L2TP_MSG_SEQ,
+                                         "%s: updated ns to %u\n",
+                                         session->name, session->ns);
                         }
 
                         *((__be32 *) bufp) = htonl(l2h);
@@ -960,46 +1021,50 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
         struct l2tp_tunnel *tunnel = session->tunnel;
         unsigned int len = skb->len;
         int error;
+        struct l2tp_stats *tstats, *sstats;
 
         /* Debug */
         if (session->send_seq)
-                PRINTK(session->debug, L2TP_MSG_DATA, KERN_DEBUG,
-                       "%s: send %Zd bytes, ns=%u\n", session->name,
-                       data_len, session->ns - 1);
+                l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %Zd bytes, ns=%u\n",
+                         session->name, data_len, session->ns - 1);
         else
-                PRINTK(session->debug, L2TP_MSG_DATA, KERN_DEBUG,
-                       "%s: send %Zd bytes\n", session->name, data_len);
+                l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %Zd bytes\n",
+                         session->name, data_len);
 
         if (session->debug & L2TP_MSG_DATA) {
-                int i;
                 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
                 unsigned char *datap = skb->data + uhlen;
 
-                printk(KERN_DEBUG "%s: xmit:", session->name);
-                for (i = 0; i < (len - uhlen); i++) {
-                        printk(" %02X", *datap++);
-                        if (i == 31) {
-                                printk(" ...");
-                                break;
-                        }
-                }
-                printk("\n");
+                pr_debug("%s: xmit\n", session->name);
+                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
+                                     datap, min_t(size_t, 32, len - uhlen));
         }
 
         /* Queue the packet to IP for output */
         skb->local_df = 1;
-        error = ip_queue_xmit(skb, fl);
+#if IS_ENABLED(CONFIG_IPV6)
+        if (skb->sk->sk_family == PF_INET6)
+                error = inet6_csk_xmit(skb, NULL);
+        else
+#endif
+                error = ip_queue_xmit(skb, fl);
 
         /* Update stats */
+        tstats = &tunnel->stats;
+        u64_stats_update_begin(&tstats->syncp);
+        sstats = &session->stats;
+        u64_stats_update_begin(&sstats->syncp);
         if (error >= 0) {
-                tunnel->stats.tx_packets++;
-                tunnel->stats.tx_bytes += len;
-                session->stats.tx_packets++;
-                session->stats.tx_bytes += len;
+                tstats->tx_packets++;
+                tstats->tx_bytes += len;
+                sstats->tx_packets++;
+                sstats->tx_bytes += len;
         } else {
-                tunnel->stats.tx_errors++;
-                session->stats.tx_errors++;
+                tstats->tx_errors++;
+                sstats->tx_errors++;
         }
+        u64_stats_update_end(&tstats->syncp);
+        u64_stats_update_end(&sstats->syncp);
 
         return 0;
 }
@@ -1021,6 +1086,31 @@ static inline void l2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
         skb->destructor = l2tp_sock_wfree;
 }
 
+#if IS_ENABLED(CONFIG_IPV6)
+static void l2tp_xmit_ipv6_csum(struct sock *sk, struct sk_buff *skb,
+                                int udp_len)
+{
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct udphdr *uh = udp_hdr(skb);
+
+        if (!skb_dst(skb) || !skb_dst(skb)->dev ||
+            !(skb_dst(skb)->dev->features & NETIF_F_IPV6_CSUM)) {
+                __wsum csum = skb_checksum(skb, 0, udp_len, 0);
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+                uh->check = csum_ipv6_magic(&np->saddr, &np->daddr, udp_len,
+                                            IPPROTO_UDP, csum);
+                if (uh->check == 0)
+                        uh->check = CSUM_MANGLED_0;
+        } else {
+                skb->ip_summed = CHECKSUM_PARTIAL;
+                skb->csum_start = skb_transport_header(skb) - skb->head;
+                skb->csum_offset = offsetof(struct udphdr, check);
+                uh->check = ~csum_ipv6_magic(&np->saddr, &np->daddr,
+                                             udp_len, IPPROTO_UDP, 0);
+        }
+}
+#endif
+
 /* If caller requires the skb to have a ppp header, the header must be
  * inserted in the skb data before calling this function.
  */
@@ -1089,6 +1179,11 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
                 uh->check = 0;
 
                 /* Calculate UDP checksum if configured to do so */
+#if IS_ENABLED(CONFIG_IPV6)
+                if (sk->sk_family == PF_INET6)
+                        l2tp_xmit_ipv6_csum(sk, skb, udp_len);
+                else
+#endif
                 if (sk->sk_no_check == UDP_CSUM_NOXMIT)
                         skb->ip_summed = CHECKSUM_NONE;
                 else if ((skb_dst(skb) && skb_dst(skb)->dev) &&
@@ -1141,8 +1236,7 @@ static void l2tp_tunnel_destruct(struct sock *sk)
         if (tunnel == NULL)
                 goto end;
 
-        PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
-               "%s: closing...\n", tunnel->name);
+        l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing...\n", tunnel->name);
 
         /* Close all sessions */
         l2tp_tunnel_closeall(tunnel);
@@ -1184,8 +1278,8 @@ static void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
 
         BUG_ON(tunnel == NULL);
 
-        PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
-               "%s: closing all sessions...\n", tunnel->name);
+        l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing all sessions...\n",
+                  tunnel->name);
 
         write_lock_bh(&tunnel->hlist_lock);
         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
@@ -1193,8 +1287,8 @@ again:
                 hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
                         session = hlist_entry(walk, struct l2tp_session, hlist);
 
-                        PRINTK(session->debug, L2TP_MSG_CONTROL, KERN_INFO,
-                               "%s: closing session\n", session->name);
+                        l2tp_info(session, L2TP_MSG_CONTROL,
+                                  "%s: closing session\n", session->name);
 
                         hlist_del_init(&session->hlist);
 
@@ -1247,8 +1341,7 @@ static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
         BUG_ON(atomic_read(&tunnel->ref_count) != 0);
         BUG_ON(tunnel->sock != NULL);
 
-        PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
-               "%s: free...\n", tunnel->name);
+        l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: free...\n", tunnel->name);
 
         /* Remove from tunnel list */
         spin_lock_bh(&pn->l2tp_tunnel_list_lock);
@@ -1268,31 +1361,69 @@ static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2t
 {
         int err = -EINVAL;
         struct sockaddr_in udp_addr;
+#if IS_ENABLED(CONFIG_IPV6)
+        struct sockaddr_in6 udp6_addr;
+        struct sockaddr_l2tpip6 ip6_addr;
+#endif
         struct sockaddr_l2tpip ip_addr;
         struct socket *sock = NULL;
 
         switch (cfg->encap) {
         case L2TP_ENCAPTYPE_UDP:
-                err = sock_create(AF_INET, SOCK_DGRAM, 0, sockp);
-                if (err < 0)
-                        goto out;
+#if IS_ENABLED(CONFIG_IPV6)
+                if (cfg->local_ip6 && cfg->peer_ip6) {
+                        err = sock_create(AF_INET6, SOCK_DGRAM, 0, sockp);
+                        if (err < 0)
+                                goto out;
 
-                sock = *sockp;
+                        sock = *sockp;
 
-                memset(&udp_addr, 0, sizeof(udp_addr));
-                udp_addr.sin_family = AF_INET;
-                udp_addr.sin_addr = cfg->local_ip;
-                udp_addr.sin_port = htons(cfg->local_udp_port);
-                err = kernel_bind(sock, (struct sockaddr *) &udp_addr, sizeof(udp_addr));
-                if (err < 0)
-                        goto out;
+                        memset(&udp6_addr, 0, sizeof(udp6_addr));
+                        udp6_addr.sin6_family = AF_INET6;
+                        memcpy(&udp6_addr.sin6_addr, cfg->local_ip6,
+                               sizeof(udp6_addr.sin6_addr));
+                        udp6_addr.sin6_port = htons(cfg->local_udp_port);
+                        err = kernel_bind(sock, (struct sockaddr *) &udp6_addr,
+                                          sizeof(udp6_addr));
+                        if (err < 0)
+                                goto out;
 
-                udp_addr.sin_family = AF_INET;
-                udp_addr.sin_addr = cfg->peer_ip;
-                udp_addr.sin_port = htons(cfg->peer_udp_port);
-                err = kernel_connect(sock, (struct sockaddr *) &udp_addr, sizeof(udp_addr), 0);
-                if (err < 0)
-                        goto out;
+                        udp6_addr.sin6_family = AF_INET6;
+                        memcpy(&udp6_addr.sin6_addr, cfg->peer_ip6,
+                               sizeof(udp6_addr.sin6_addr));
+                        udp6_addr.sin6_port = htons(cfg->peer_udp_port);
+                        err = kernel_connect(sock,
+                                             (struct sockaddr *) &udp6_addr,
+                                             sizeof(udp6_addr), 0);
+                        if (err < 0)
+                                goto out;
+                } else
+#endif
+                {
+                        err = sock_create(AF_INET, SOCK_DGRAM, 0, sockp);
+                        if (err < 0)
+                                goto out;
+
+                        sock = *sockp;
+
+                        memset(&udp_addr, 0, sizeof(udp_addr));
+                        udp_addr.sin_family = AF_INET;
+                        udp_addr.sin_addr = cfg->local_ip;
+                        udp_addr.sin_port = htons(cfg->local_udp_port);
+                        err = kernel_bind(sock, (struct sockaddr *) &udp_addr,
+                                          sizeof(udp_addr));
+                        if (err < 0)
+                                goto out;
+
+                        udp_addr.sin_family = AF_INET;
+                        udp_addr.sin_addr = cfg->peer_ip;
+                        udp_addr.sin_port = htons(cfg->peer_udp_port);
+                        err = kernel_connect(sock,
+                                             (struct sockaddr *) &udp_addr,
+                                             sizeof(udp_addr), 0);
+                        if (err < 0)
+                                goto out;
+                }
 
                 if (!cfg->use_udp_checksums)
                         sock->sk->sk_no_check = UDP_CSUM_NOXMIT;
@@ -1300,27 +1431,61 @@ static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2t
                 break;
 
         case L2TP_ENCAPTYPE_IP:
-                err = sock_create(AF_INET, SOCK_DGRAM, IPPROTO_L2TP, sockp);
-                if (err < 0)
-                        goto out;
+#if IS_ENABLED(CONFIG_IPV6)
+                if (cfg->local_ip6 && cfg->peer_ip6) {
+                        err = sock_create(AF_INET6, SOCK_DGRAM, IPPROTO_L2TP,
+                                          sockp);
+                        if (err < 0)
+                                goto out;
 
-                sock = *sockp;
+                        sock = *sockp;
 
-                memset(&ip_addr, 0, sizeof(ip_addr));
-                ip_addr.l2tp_family = AF_INET;
-                ip_addr.l2tp_addr = cfg->local_ip;
-                ip_addr.l2tp_conn_id = tunnel_id;
-                err = kernel_bind(sock, (struct sockaddr *) &ip_addr, sizeof(ip_addr));
-                if (err < 0)
-                        goto out;
+                        memset(&ip6_addr, 0, sizeof(ip6_addr));
+                        ip6_addr.l2tp_family = AF_INET6;
+                        memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6,
+                               sizeof(ip6_addr.l2tp_addr));
+                        ip6_addr.l2tp_conn_id = tunnel_id;
+                        err = kernel_bind(sock, (struct sockaddr *) &ip6_addr,
+                                          sizeof(ip6_addr));
+                        if (err < 0)
+                                goto out;
 
-                ip_addr.l2tp_family = AF_INET;
-                ip_addr.l2tp_addr = cfg->peer_ip;
-                ip_addr.l2tp_conn_id = peer_tunnel_id;
-                err = kernel_connect(sock, (struct sockaddr *) &ip_addr, sizeof(ip_addr), 0);
-                if (err < 0)
-                        goto out;
+                        ip6_addr.l2tp_family = AF_INET6;
+                        memcpy(&ip6_addr.l2tp_addr, cfg->peer_ip6,
+                               sizeof(ip6_addr.l2tp_addr));
+                        ip6_addr.l2tp_conn_id = peer_tunnel_id;
+                        err = kernel_connect(sock,
+                                             (struct sockaddr *) &ip6_addr,
+                                             sizeof(ip6_addr), 0);
+                        if (err < 0)
+                                goto out;
+                } else
+#endif
+                {
+                        err = sock_create(AF_INET, SOCK_DGRAM, IPPROTO_L2TP,
+                                          sockp);
+                        if (err < 0)
+                                goto out;
+
+                        sock = *sockp;
+
+                        memset(&ip_addr, 0, sizeof(ip_addr));
+                        ip_addr.l2tp_family = AF_INET;
+                        ip_addr.l2tp_addr = cfg->local_ip;
+                        ip_addr.l2tp_conn_id = tunnel_id;
+                        err = kernel_bind(sock, (struct sockaddr *) &ip_addr,
+                                          sizeof(ip_addr));
+                        if (err < 0)
+                                goto out;
 
+                        ip_addr.l2tp_family = AF_INET;
+                        ip_addr.l2tp_addr = cfg->peer_ip;
+                        ip_addr.l2tp_conn_id = peer_tunnel_id;
+                        err = kernel_connect(sock, (struct sockaddr *) &ip_addr,
+                                             sizeof(ip_addr), 0);
+                        if (err < 0)
+                                goto out;
+                }
                 break;
 
         default:
@@ -1357,7 +1522,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                 err = -EBADF;
                 sock = sockfd_lookup(fd, &err);
                 if (!sock) {
-                        printk(KERN_ERR "tunl %hu: sockfd_lookup(fd=%d) returned %d\n",
+                        pr_err("tunl %hu: sockfd_lookup(fd=%d) returned %d\n",
                                tunnel_id, fd, err);
                         goto err;
                 }
@@ -1373,7 +1538,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
         case L2TP_ENCAPTYPE_UDP:
                 err = -EPROTONOSUPPORT;
                 if (sk->sk_protocol != IPPROTO_UDP) {
-                        printk(KERN_ERR "tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
+                        pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
                                tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
                         goto err;
                 }
@@ -1381,7 +1546,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
         case L2TP_ENCAPTYPE_IP:
                 err = -EPROTONOSUPPORT;
                 if (sk->sk_protocol != IPPROTO_L2TP) {
-                        printk(KERN_ERR "tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
+                        pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
                                tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP);
                         goto err;
                 }
@@ -1424,6 +1589,12 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                 /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
                 udp_sk(sk)->encap_type = UDP_ENCAP_L2TPINUDP;
                 udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv;
+#if IS_ENABLED(CONFIG_IPV6)
+                if (sk->sk_family == PF_INET6)
+                        udpv6_encap_enable();
+                else
+#endif
+                udp_encap_enable();
         }
 
         sk->sk_user_data = tunnel;
@@ -1577,7 +1748,7 @@ struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunn
 
                 session->session_id = session_id;
                 session->peer_session_id = peer_session_id;
-                session->nr = 1;
+                session->nr = 0;
 
                 sprintf(&session->name[0], "sess %u/%u",
                         tunnel->tunnel_id, session->session_id);
@@ -1683,7 +1854,7 @@ static int __init l2tp_init(void)
         if (rc)
                 goto out;
 
-        printk(KERN_INFO "L2TP core driver, %s\n", L2TP_DRV_VERSION);
+        pr_info("L2TP core driver, %s\n", L2TP_DRV_VERSION);
 
 out:
         return rc;
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index a16a48e79fab..a38ec6cdeee1 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -45,6 +45,7 @@ struct l2tp_stats {
         u64                     rx_oos_packets;
         u64                     rx_errors;
         u64                     rx_cookie_discards;
+        struct u64_stats_sync   syncp;
 };
 
 struct l2tp_tunnel;
@@ -54,15 +55,15 @@ struct l2tp_tunnel;
  */
 struct l2tp_session_cfg {
         enum l2tp_pwtype        pw_type;
-        unsigned                data_seq:2;     /* data sequencing level
+        unsigned int            data_seq:2;     /* data sequencing level
                                                  * 0 => none, 1 => IP only,
                                                  * 2 => all
                                                  */
-        unsigned                recv_seq:1;     /* expect receive packets with
+        unsigned int            recv_seq:1;     /* expect receive packets with
                                                  * sequence numbers? */
-        unsigned                send_seq:1;     /* send packets with sequence
+        unsigned int            send_seq:1;     /* send packets with sequence
                                                  * numbers? */
-        unsigned                lns_mode:1;     /* behave as LNS? LAC enables
+        unsigned int            lns_mode:1;     /* behave as LNS? LAC enables
                                                  * sequence numbers under
                                                  * control of LNS. */
         int                     debug;          /* bitmask of debug message
@@ -107,21 +108,22 @@ struct l2tp_session {
 
         char                    name[32];       /* for logging */
         char                    ifname[IFNAMSIZ];
-        unsigned                data_seq:2;     /* data sequencing level
+        unsigned int            data_seq:2;     /* data sequencing level
                                                  * 0 => none, 1 => IP only,
                                                  * 2 => all
                                                  */
-        unsigned                recv_seq:1;     /* expect receive packets with
+        unsigned int            recv_seq:1;     /* expect receive packets with
                                                  * sequence numbers? */
-        unsigned                send_seq:1;     /* send packets with sequence
+        unsigned int            send_seq:1;     /* send packets with sequence
                                                  * numbers? */
-        unsigned                lns_mode:1;     /* behave as LNS? LAC enables
+        unsigned int            lns_mode:1;     /* behave as LNS? LAC enables
                                                  * sequence numbers under
                                                  * control of LNS. */
         int                     debug;          /* bitmask of debug message
                                                  * categories */
         int                     reorder_timeout; /* configured reorder timeout
                                                   * (in jiffies) */
+        int                     reorder_skip;   /* set if skip to next nr */
         int                     mtu;
         int                     mru;
         enum l2tp_pwtype        pwtype;
@@ -150,6 +152,10 @@ struct l2tp_tunnel_cfg {
         /* Used only for kernel-created sockets */
         struct in_addr          local_ip;
         struct in_addr          peer_ip;
+#if IS_ENABLED(CONFIG_IPV6)
+        struct in6_addr         *local_ip6;
+        struct in6_addr         *peer_ip6;
+#endif
         u16                     local_udp_port;
         u16                     peer_udp_port;
         unsigned int            use_udp_checksums:1;
@@ -255,17 +261,36 @@ static inline void l2tp_session_dec_refcount_1(struct l2tp_session *session)
 }
 
 #ifdef L2TP_REFCNT_DEBUG
-#define l2tp_session_inc_refcount(_s) do { \
-                printk(KERN_DEBUG "l2tp_session_inc_refcount: %s:%d %s: cnt=%d\n", __func__, __LINE__, (_s)->name, atomic_read(&_s->ref_count)); \
-                l2tp_session_inc_refcount_1(_s);                                \
-        } while (0)
-#define l2tp_session_dec_refcount(_s) do { \
-                printk(KERN_DEBUG "l2tp_session_dec_refcount: %s:%d %s: cnt=%d\n", __func__, __LINE__, (_s)->name, atomic_read(&_s->ref_count)); \
-                l2tp_session_dec_refcount_1(_s);                                \
-        } while (0)
+#define l2tp_session_inc_refcount(_s)                                   \
+do {                                                                    \
+        pr_debug("l2tp_session_inc_refcount: %s:%d %s: cnt=%d\n",       \
+                 __func__, __LINE__, (_s)->name,                        \
+                 atomic_read(&_s->ref_count));                          \
+        l2tp_session_inc_refcount_1(_s);                                \
+} while (0)
+#define l2tp_session_dec_refcount(_s)                                   \
+do {                                                                    \
+        pr_debug("l2tp_session_dec_refcount: %s:%d %s: cnt=%d\n",       \
+                 __func__, __LINE__, (_s)->name,                        \
+                 atomic_read(&_s->ref_count));                          \
+        l2tp_session_dec_refcount_1(_s);                                \
+} while (0)
 #else
 #define l2tp_session_inc_refcount(s) l2tp_session_inc_refcount_1(s)
 #define l2tp_session_dec_refcount(s) l2tp_session_dec_refcount_1(s)
 #endif
 
+#define l2tp_printk(ptr, type, func, fmt, ...)                          \
+do {                                                                    \
+        if (((ptr)->debug) & (type))                                    \
+                func(fmt, ##__VA_ARGS__);                               \
+} while (0)
+
+#define l2tp_warn(ptr, type, fmt, ...)                                  \
+        l2tp_printk(ptr, type, pr_warn, fmt, ##__VA_ARGS__)
+#define l2tp_info(ptr, type, fmt, ...)                                  \
+        l2tp_printk(ptr, type, pr_info, fmt, ##__VA_ARGS__)
+#define l2tp_dbg(ptr, type, fmt, ...)                                   \
+        l2tp_printk(ptr, type, pr_debug, fmt, ##__VA_ARGS__)
+
 #endif /* _L2TP_CORE_H_ */
diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
index 76130134bfa6..c3813bc84552 100644
--- a/net/l2tp/l2tp_debugfs.c
+++ b/net/l2tp/l2tp_debugfs.c
@@ -9,6 +9,8 @@
  *      2 of the License, or (at your option) any later version.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/socket.h>
@@ -122,6 +124,14 @@ static void l2tp_dfs_seq_tunnel_show(struct seq_file *m, void *v)
         seq_printf(m, "\nTUNNEL %u peer %u", tunnel->tunnel_id, tunnel->peer_tunnel_id);
         if (tunnel->sock) {
                 struct inet_sock *inet = inet_sk(tunnel->sock);
+
+#if IS_ENABLED(CONFIG_IPV6)
+                if (tunnel->sock->sk_family == AF_INET6) {
+                        struct ipv6_pinfo *np = inet6_sk(tunnel->sock);
+                        seq_printf(m, " from %pI6c to %pI6c\n",
+                                &np->saddr, &np->daddr);
+                } else
+#endif
                 seq_printf(m, " from %pI4 to %pI4\n",
                            &inet->inet_saddr, &inet->inet_daddr);
                 if (tunnel->encap == L2TP_ENCAPTYPE_UDP)
@@ -317,11 +327,11 @@ static int __init l2tp_debugfs_init(void)
         if (tunnels == NULL)
                 rc = -EIO;
 
-        printk(KERN_INFO "L2TP debugfs support\n");
+        pr_info("L2TP debugfs support\n");
 
 out:
         if (rc)
-                printk(KERN_WARNING "l2tp debugfs: unable to init\n");
+                pr_warn("unable to init\n");
 
         return rc;
 }
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index d2726a74597d..443591d629ca 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -9,6 +9,8 @@
  *      2 of the License, or (at your option) any later version.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/socket.h>
@@ -64,7 +66,7 @@ static int l2tp_eth_dev_init(struct net_device *dev)
         struct l2tp_eth *priv = netdev_priv(dev);
 
         priv->dev = dev;
-        random_ether_addr(dev->dev_addr);
+        eth_hw_addr_random(dev);
         memset(&dev->broadcast[0], 0xff, 6);
 
         return 0;
@@ -115,21 +117,14 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,
 
         if (session->debug & L2TP_MSG_DATA) {
                 unsigned int length;
-                int offset;
                 u8 *ptr = skb->data;
 
                 length = min(32u, skb->len);
                 if (!pskb_may_pull(skb, length))
                         goto error;
 
-                printk(KERN_DEBUG "%s: eth recv: ", session->name);
-
-                offset = 0;
-                do {
-                        printk(" %02X", ptr[offset]);
-                } while (++offset < length);
-
-                printk("\n");
+                pr_debug("%s: eth recv\n", session->name);
+                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
         }
 
         if (!pskb_may_pull(skb, sizeof(ETH_HLEN)))
@@ -308,7 +303,7 @@ static int __init l2tp_eth_init(void)
         if (err)
                 goto out_unreg;
 
-        printk(KERN_INFO "L2TP ethernet pseudowire support (L2TPv3)\n");
+        pr_info("L2TP ethernet pseudowire support (L2TPv3)\n");
 
         return 0;
 
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 55670ec3cd0f..70614e7affab 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -9,6 +9,8 @@
  *      2 of the License, or (at your option) any later version.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/icmp.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
@@ -32,15 +34,8 @@ struct l2tp_ip_sock {
         /* inet_sock has to be the first member of l2tp_ip_sock */
         struct inet_sock        inet;
 
-        __u32                   conn_id;
-        __u32                   peer_conn_id;
-
-        __u64                   tx_packets;
-        __u64                   tx_bytes;
-        __u64                   tx_errors;
-        __u64                   rx_packets;
-        __u64                   rx_bytes;
-        __u64                   rx_errors;
+        u32                     conn_id;
+        u32                     peer_conn_id;
 };
 
 static DEFINE_RWLOCK(l2tp_ip_lock);
@@ -127,7 +122,6 @@ static int l2tp_ip_recv(struct sk_buff *skb)
         struct l2tp_session *session;
         struct l2tp_tunnel *tunnel = NULL;
         int length;
-        int offset;
 
         /* Point to L2TP header */
         optr = ptr = skb->data;
@@ -162,14 +156,8 @@ static int l2tp_ip_recv(struct sk_buff *skb)
                 if (!pskb_may_pull(skb, length))
                         goto discard;
 
-                printk(KERN_DEBUG "%s: ip recv: ", tunnel->name);
-
-                offset = 0;
-                do {
-                        printk(" %02X", ptr[offset]);
-                } while (++offset < length);
-
-                printk("\n");
+                pr_debug("%s: ip recv\n", tunnel->name);
+                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
         }
 
         l2tp_recv_common(session, skb, ptr, optr, 0, skb->len, tunnel->recv_payload_hook);
@@ -232,7 +220,7 @@ static void l2tp_ip_close(struct sock *sk, long timeout)
 {
         write_lock_bh(&l2tp_ip_lock);
         hlist_del_init(&sk->sk_bind_node);
-        hlist_del_init(&sk->sk_node);
+        sk_del_node_init(sk);
         write_unlock_bh(&l2tp_ip_lock);
         sk_common_release(sk);
 }
@@ -251,9 +239,16 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct sockaddr_l2tpip *addr = (struct sockaddr_l2tpip *) uaddr;
-        int ret = -EINVAL;
+        int ret;
         int chk_addr_ret;
 
+        if (!sock_flag(sk, SOCK_ZAPPED))
+                return -EINVAL;
+        if (addr_len < sizeof(struct sockaddr_l2tpip))
+                return -EINVAL;
+        if (addr->l2tp_family != AF_INET)
+                return -EINVAL;
+
         ret = -EADDRINUSE;
         read_lock_bh(&l2tp_ip_lock);
         if (__l2tp_ip_bind_lookup(&init_net, addr->l2tp_addr.s_addr, sk->sk_bound_dev_if, addr->l2tp_conn_id))
@@ -271,7 +266,8 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
             chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST)
                 goto out;
 
-        inet->inet_rcv_saddr = inet->inet_saddr = addr->l2tp_addr.s_addr;
+        if (addr->l2tp_addr.s_addr)
+                inet->inet_rcv_saddr = inet->inet_saddr = addr->l2tp_addr.s_addr;
         if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
                 inet->inet_saddr = 0;  /* Use device */
         sk_dst_reset(sk);
@@ -283,6 +279,8 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         sk_del_node_init(sk);
         write_unlock_bh(&l2tp_ip_lock);
         ret = 0;
+        sock_reset_flag(sk, SOCK_ZAPPED);
+
 out:
         release_sock(sk);
 
@@ -297,72 +295,42 @@ out_in_use:
 static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
         struct sockaddr_l2tpip *lsa = (struct sockaddr_l2tpip *) uaddr;
-        struct inet_sock *inet = inet_sk(sk);
-        struct flowi4 *fl4;
-        struct rtable *rt;
-        __be32 saddr;
-        int oif, rc;
-
-        rc = -EINVAL;
-        if (addr_len < sizeof(*lsa))
-                goto out;
-
-        rc = -EAFNOSUPPORT;
-        if (lsa->l2tp_family != AF_INET)
-                goto out;
-
-        lock_sock(sk);
+        int rc;
 
-        sk_dst_reset(sk);
+        if (sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
+                return -EINVAL;
 
-        oif = sk->sk_bound_dev_if;
-        saddr = inet->inet_saddr;
+        if (addr_len < sizeof(*lsa))
+                return -EINVAL;
 
-        rc = -EINVAL;
         if (ipv4_is_multicast(lsa->l2tp_addr.s_addr))
-                goto out;
+                return -EINVAL;
 
-        fl4 = &inet->cork.fl.u.ip4;
-        rt = ip_route_connect(fl4, lsa->l2tp_addr.s_addr, saddr,
-                              RT_CONN_FLAGS(sk), oif,
-                              IPPROTO_L2TP,
-                              0, 0, sk, true);
-        if (IS_ERR(rt)) {
-                rc = PTR_ERR(rt);
-                if (rc == -ENETUNREACH)
-                        IP_INC_STATS_BH(&init_net, IPSTATS_MIB_OUTNOROUTES);
-                goto out;
-        }
+        rc = ip4_datagram_connect(sk, uaddr, addr_len);
+        if (rc < 0)
+                return rc;
 
-        rc = -ENETUNREACH;
-        if (rt->rt_flags & (RTCF_MULTICAST | RTCF_BROADCAST)) {
-                ip_rt_put(rt);
-                goto out;
-        }
+        lock_sock(sk);
 
         l2tp_ip_sk(sk)->peer_conn_id = lsa->l2tp_conn_id;
 
-        if (!inet->inet_saddr)
-                inet->inet_saddr = fl4->saddr;
-        if (!inet->inet_rcv_saddr)
-                inet->inet_rcv_saddr = fl4->saddr;
-        inet->inet_daddr = fl4->daddr;
-        sk->sk_state = TCP_ESTABLISHED;
-        inet->inet_id = jiffies;
-
-        sk_dst_set(sk, &rt->dst);
-
         write_lock_bh(&l2tp_ip_lock);
         hlist_del_init(&sk->sk_bind_node);
         sk_add_bind_node(sk, &l2tp_ip_bind_table);
         write_unlock_bh(&l2tp_ip_lock);
 
-        rc = 0;
-out:
         release_sock(sk);
         return rc;
 }
 
+static int l2tp_ip_disconnect(struct sock *sk, int flags)
+{
+        if (sock_flag(sk, SOCK_ZAPPED))
+                return 0;
+
+        return udp_disconnect(sk, flags);
+}
+
 static int l2tp_ip_getname(struct socket *sock, struct sockaddr *uaddr,
                            int *uaddr_len, int peer)
 {
@@ -413,7 +381,6 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
 {
         struct sk_buff *skb;
         int rc;
-        struct l2tp_ip_sock *lsa = l2tp_ip_sk(sk);
         struct inet_sock *inet = inet_sk(sk);
         struct rtable *rt = NULL;
         struct flowi4 *fl4;
@@ -441,8 +408,9 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
 
                 daddr = lip->l2tp_addr.s_addr;
         } else {
+                rc = -EDESTADDRREQ;
                 if (sk->sk_state != TCP_ESTABLISHED)
-                        return -EDESTADDRREQ;
+                        goto out;
 
                 daddr = inet->inet_daddr;
                 connected = 1;
@@ -512,14 +480,8 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
         rcu_read_unlock();
 
 error:
-        /* Update stats */
-        if (rc >= 0) {
-                lsa->tx_packets++;
-                lsa->tx_bytes += len;
+        if (rc >= 0)
                 rc = len;
-        } else {
-                lsa->tx_errors++;
-        }
 
 out:
         release_sock(sk);
@@ -537,7 +499,6 @@ static int l2tp_ip_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
                            size_t len, int noblock, int flags, int *addr_len)
 {
         struct inet_sock *inet = inet_sk(sk);
-        struct l2tp_ip_sock *lsk = l2tp_ip_sk(sk);
         size_t copied = 0;
         int err = -EOPNOTSUPP;
         struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
@@ -579,15 +540,7 @@ static int l2tp_ip_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
 done:
         skb_free_datagram(sk, skb);
 out:
-        if (err) {
-                lsk->rx_errors++;
-                return err;
-        }
-
-        lsk->rx_packets++;
-        lsk->rx_bytes += copied;
-
-        return copied;
+        return err ? err : copied;
 }
 
 static struct proto l2tp_ip_prot = {
@@ -597,7 +550,7 @@ static struct proto l2tp_ip_prot = {
         .close             = l2tp_ip_close,
         .bind              = l2tp_ip_bind,
         .connect           = l2tp_ip_connect,
-        .disconnect        = udp_disconnect,
+        .disconnect        = l2tp_ip_disconnect,
         .ioctl             = udp_ioctl,
         .destroy           = l2tp_ip_destroy_sock,
         .setsockopt        = ip_setsockopt,
@@ -655,7 +608,7 @@ static int __init l2tp_ip_init(void)
 {
         int err;
 
-        printk(KERN_INFO "L2TP IP encapsulation support (L2TPv3)\n");
+        pr_info("L2TP IP encapsulation support (L2TPv3)\n");
 
         err = proto_register(&l2tp_ip_prot, 1);
         if (err != 0)
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
new file mode 100644
index 000000000000..35e1e4bde587
--- /dev/null
+++ b/net/l2tp/l2tp_ip6.c
@@ -0,0 +1,803 @@
+/*
+ * L2TPv3 IP encapsulation support for IPv6
+ *
+ * Copyright (c) 2012 Katalix Systems Ltd
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/icmp.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/random.h>
+#include <linux/socket.h>
+#include <linux/l2tp.h>
+#include <linux/in.h>
+#include <linux/in6.h>
+#include <net/sock.h>
+#include <net/ip.h>
+#include <net/icmp.h>
+#include <net/udp.h>
+#include <net/inet_common.h>
+#include <net/inet_hashtables.h>
+#include <net/tcp_states.h>
+#include <net/protocol.h>
+#include <net/xfrm.h>
+
+#include <net/transp_v6.h>
+#include <net/addrconf.h>
+#include <net/ip6_route.h>
+
+#include "l2tp_core.h"
+
+struct l2tp_ip6_sock {
+        /* inet_sock has to be the first member of l2tp_ip6_sock */
+        struct inet_sock        inet;
+
+        u32                     conn_id;
+        u32                     peer_conn_id;
+
+        /* ipv6_pinfo has to be the last member of l2tp_ip6_sock, see
+           inet6_sk_generic */
+        struct ipv6_pinfo       inet6;
+};
+
+static DEFINE_RWLOCK(l2tp_ip6_lock);
+static struct hlist_head l2tp_ip6_table;
+static struct hlist_head l2tp_ip6_bind_table;
+
+static inline struct l2tp_ip6_sock *l2tp_ip6_sk(const struct sock *sk)
+{
+        return (struct l2tp_ip6_sock *)sk;
+}
+
+static struct sock *__l2tp_ip6_bind_lookup(struct net *net,
+                                           struct in6_addr *laddr,
+                                           int dif, u32 tunnel_id)
+{
+        struct hlist_node *node;
+        struct sock *sk;
+
+        sk_for_each_bound(sk, node, &l2tp_ip6_bind_table) {
+                struct in6_addr *addr = inet6_rcv_saddr(sk);
+                struct l2tp_ip6_sock *l2tp = l2tp_ip6_sk(sk);
+
+                if (l2tp == NULL)
+                        continue;
+
+                if ((l2tp->conn_id == tunnel_id) &&
+                    net_eq(sock_net(sk), net) &&
+                    !(addr && ipv6_addr_equal(addr, laddr)) &&
+                    !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
+                        goto found;
+        }
+
+        sk = NULL;
+found:
+        return sk;
+}
+
+static inline struct sock *l2tp_ip6_bind_lookup(struct net *net,
+                                                struct in6_addr *laddr,
+                                                int dif, u32 tunnel_id)
+{
+        struct sock *sk = __l2tp_ip6_bind_lookup(net, laddr, dif, tunnel_id);
+        if (sk)
+                sock_hold(sk);
+
+        return sk;
+}
+
+/* When processing receive frames, there are two cases to
+ * consider. Data frames consist of a non-zero session-id and an
+ * optional cookie. Control frames consist of a regular L2TP header
+ * preceded by 32-bits of zeros.
+ *
+ * L2TPv3 Session Header Over IP
+ *
+ *  0                   1                   2                   3
+ *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                           Session ID                          |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |               Cookie (optional, maximum 64 bits)...
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *                                                                 |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *
+ * L2TPv3 Control Message Header Over IP
+ *
+ *  0                   1                   2                   3
+ *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                      (32 bits of zeros)                       |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |T|L|x|x|S|x|x|x|x|x|x|x|  Ver  |             Length            |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                     Control Connection ID                     |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |               Ns              |               Nr              |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *
+ * All control frames are passed to userspace.
+ */
+static int l2tp_ip6_recv(struct sk_buff *skb)
+{
+        struct sock *sk;
+        u32 session_id;
+        u32 tunnel_id;
+        unsigned char *ptr, *optr;
+        struct l2tp_session *session;
+        struct l2tp_tunnel *tunnel = NULL;
+        int length;
+
+        /* Point to L2TP header */
+        optr = ptr = skb->data;
+
+        if (!pskb_may_pull(skb, 4))
+                goto discard;
+
+        session_id = ntohl(*((__be32 *) ptr));
+        ptr += 4;
+
+        /* RFC3931: L2TP/IP packets have the first 4 bytes containing
+         * the session_id. If it is 0, the packet is a L2TP control
+         * frame and the session_id value can be discarded.
+         */
+        if (session_id == 0) {
+                __skb_pull(skb, 4);
+                goto pass_up;
+        }
+
+        /* Ok, this is a data packet. Lookup the session. */
+        session = l2tp_session_find(&init_net, NULL, session_id);
+        if (session == NULL)
+                goto discard;
+
+        tunnel = session->tunnel;
+        if (tunnel == NULL)
+                goto discard;
+
+        /* Trace packet contents, if enabled */
+        if (tunnel->debug & L2TP_MSG_DATA) {
+                length = min(32u, skb->len);
+                if (!pskb_may_pull(skb, length))
+                        goto discard;
+
+                pr_debug("%s: ip recv\n", tunnel->name);
+                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
+        }
+
+        l2tp_recv_common(session, skb, ptr, optr, 0, skb->len,
+                         tunnel->recv_payload_hook);
+        return 0;
+
+pass_up:
+        /* Get the tunnel_id from the L2TP header */
+        if (!pskb_may_pull(skb, 12))
+                goto discard;
+
+        if ((skb->data[0] & 0xc0) != 0xc0)
+                goto discard;
+
+        tunnel_id = ntohl(*(__be32 *) &skb->data[4]);
+        tunnel = l2tp_tunnel_find(&init_net, tunnel_id);
+        if (tunnel != NULL)
+                sk = tunnel->sock;
+        else {
+                struct ipv6hdr *iph = ipv6_hdr(skb);
+
+                read_lock_bh(&l2tp_ip6_lock);
+                sk = __l2tp_ip6_bind_lookup(&init_net, &iph->daddr,
+                                            0, tunnel_id);
+                read_unlock_bh(&l2tp_ip6_lock);
+        }
+
+        if (sk == NULL)
+                goto discard;
+
+        sock_hold(sk);
+
+        if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
+                goto discard_put;
+
+        nf_reset(skb);
+
+        return sk_receive_skb(sk, skb, 1);
+
+discard_put:
+        sock_put(sk);
+
+discard:
+        kfree_skb(skb);
+        return 0;
+}
+
+static int l2tp_ip6_open(struct sock *sk)
+{
+        /* Prevent autobind. We don't have ports. */
+        inet_sk(sk)->inet_num = IPPROTO_L2TP;
+
+        write_lock_bh(&l2tp_ip6_lock);
+        sk_add_node(sk, &l2tp_ip6_table);
+        write_unlock_bh(&l2tp_ip6_lock);
+
+        return 0;
+}
+
+static void l2tp_ip6_close(struct sock *sk, long timeout)
+{
+        write_lock_bh(&l2tp_ip6_lock);
+        hlist_del_init(&sk->sk_bind_node);
+        sk_del_node_init(sk);
+        write_unlock_bh(&l2tp_ip6_lock);
+
+        sk_common_release(sk);
+}
+
+static void l2tp_ip6_destroy_sock(struct sock *sk)
+{
+        lock_sock(sk);
+        ip6_flush_pending_frames(sk);
+        release_sock(sk);
+
+        inet6_destroy_sock(sk);
+}
+
+static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+{
+        struct inet_sock *inet = inet_sk(sk);
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct sockaddr_l2tpip6 *addr = (struct sockaddr_l2tpip6 *) uaddr;
+        __be32 v4addr = 0;
+        int addr_type;
+        int err;
+
+        if (!sock_flag(sk, SOCK_ZAPPED))
+                return -EINVAL;
+        if (addr->l2tp_family != AF_INET6)
+                return -EINVAL;
+        if (addr_len < sizeof(*addr))
+                return -EINVAL;
+
+        addr_type = ipv6_addr_type(&addr->l2tp_addr);
+
+        /* l2tp_ip6 sockets are IPv6 only */
+        if (addr_type == IPV6_ADDR_MAPPED)
+                return -EADDRNOTAVAIL;
+
+        /* L2TP is point-point, not multicast */
+        if (addr_type & IPV6_ADDR_MULTICAST)
+                return -EADDRNOTAVAIL;
+
+        err = -EADDRINUSE;
+        read_lock_bh(&l2tp_ip6_lock);
+        if (__l2tp_ip6_bind_lookup(&init_net, &addr->l2tp_addr,
+                                   sk->sk_bound_dev_if, addr->l2tp_conn_id))
+                goto out_in_use;
+        read_unlock_bh(&l2tp_ip6_lock);
+
+        lock_sock(sk);
+
+        err = -EINVAL;
+        if (sk->sk_state != TCP_CLOSE)
+                goto out_unlock;
+
+        /* Check if the address belongs to the host. */
+        rcu_read_lock();
+        if (addr_type != IPV6_ADDR_ANY) {
+                struct net_device *dev = NULL;
+
+                if (addr_type & IPV6_ADDR_LINKLOCAL) {
+                        if (addr_len >= sizeof(struct sockaddr_in6) &&
+                            addr->l2tp_scope_id) {
+                                /* Override any existing binding, if another
+                                 * one is supplied by user.
+                                 */
+                                sk->sk_bound_dev_if = addr->l2tp_scope_id;
+                        }
+
+                        /* Binding to link-local address requires an
+                           interface */
+                        if (!sk->sk_bound_dev_if)
+                                goto out_unlock_rcu;
+
+                        err = -ENODEV;
+                        dev = dev_get_by_index_rcu(sock_net(sk),
+                                                   sk->sk_bound_dev_if);
+                        if (!dev)
+                                goto out_unlock_rcu;
+                }
+
+                /* ipv4 addr of the socket is invalid.  Only the
+                 * unspecified and mapped address have a v4 equivalent.
+                 */
+                v4addr = LOOPBACK4_IPV6;
+                err = -EADDRNOTAVAIL;
+                if (!ipv6_chk_addr(sock_net(sk), &addr->l2tp_addr, dev, 0))
+                        goto out_unlock_rcu;
+        }
+        rcu_read_unlock();
+
+        inet->inet_rcv_saddr = inet->inet_saddr = v4addr;
+        np->rcv_saddr = addr->l2tp_addr;
+        np->saddr = addr->l2tp_addr;
+
+        l2tp_ip6_sk(sk)->conn_id = addr->l2tp_conn_id;
+
+        write_lock_bh(&l2tp_ip6_lock);
+        sk_add_bind_node(sk, &l2tp_ip6_bind_table);
+        sk_del_node_init(sk);
+        write_unlock_bh(&l2tp_ip6_lock);
+
+        sock_reset_flag(sk, SOCK_ZAPPED);
+        release_sock(sk);
+        return 0;
+
+out_unlock_rcu:
+        rcu_read_unlock();
+out_unlock:
+        release_sock(sk);
+        return err;
+
+out_in_use:
+        read_unlock_bh(&l2tp_ip6_lock);
+        return err;
+}
+
+static int l2tp_ip6_connect(struct sock *sk, struct sockaddr *uaddr,
+                            int addr_len)
+{
+        struct sockaddr_l2tpip6 *lsa = (struct sockaddr_l2tpip6 *) uaddr;
+        struct sockaddr_in6     *usin = (struct sockaddr_in6 *) uaddr;
+        struct in6_addr *daddr;
+        int     addr_type;
+        int rc;
+
+        if (sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
+                return -EINVAL;
+
+        if (addr_len < sizeof(*lsa))
+                return -EINVAL;
+
+        addr_type = ipv6_addr_type(&usin->sin6_addr);
+        if (addr_type & IPV6_ADDR_MULTICAST)
+                return -EINVAL;
+
+        if (addr_type & IPV6_ADDR_MAPPED) {
+                daddr = &usin->sin6_addr;
+                if (ipv4_is_multicast(daddr->s6_addr32[3]))
+                        return -EINVAL;
+        }
+
+        rc = ip6_datagram_connect(sk, uaddr, addr_len);
+
+        lock_sock(sk);
+
+        l2tp_ip6_sk(sk)->peer_conn_id = lsa->l2tp_conn_id;
+
+        write_lock_bh(&l2tp_ip6_lock);
+        hlist_del_init(&sk->sk_bind_node);
+        sk_add_bind_node(sk, &l2tp_ip6_bind_table);
+        write_unlock_bh(&l2tp_ip6_lock);
+
+        release_sock(sk);
+
+        return rc;
+}
+
+static int l2tp_ip6_disconnect(struct sock *sk, int flags)
+{
+        if (sock_flag(sk, SOCK_ZAPPED))
+                return 0;
+
+        return udp_disconnect(sk, flags);
+}
+
+static int l2tp_ip6_getname(struct socket *sock, struct sockaddr *uaddr,
+                            int *uaddr_len, int peer)
+{
+        struct sockaddr_l2tpip6 *lsa = (struct sockaddr_l2tpip6 *)uaddr;
+        struct sock *sk = sock->sk;
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct l2tp_ip6_sock *lsk = l2tp_ip6_sk(sk);
+
+        lsa->l2tp_family = AF_INET6;
+        lsa->l2tp_flowinfo = 0;
+        lsa->l2tp_scope_id = 0;
+        if (peer) {
+                if (!lsk->peer_conn_id)
+                        return -ENOTCONN;
+                lsa->l2tp_conn_id = lsk->peer_conn_id;
+                lsa->l2tp_addr = np->daddr;
+                if (np->sndflow)
+                        lsa->l2tp_flowinfo = np->flow_label;
+        } else {
+                if (ipv6_addr_any(&np->rcv_saddr))
+                        lsa->l2tp_addr = np->saddr;
+                else
+                        lsa->l2tp_addr = np->rcv_saddr;
+
+                lsa->l2tp_conn_id = lsk->conn_id;
+        }
+        if (ipv6_addr_type(&lsa->l2tp_addr) & IPV6_ADDR_LINKLOCAL)
+                lsa->l2tp_scope_id = sk->sk_bound_dev_if;
+        *uaddr_len = sizeof(*lsa);
+        return 0;
+}
+
+static int l2tp_ip6_backlog_recv(struct sock *sk, struct sk_buff *skb)
+{
+        int rc;
+
+        /* Charge it to the socket, dropping if the queue is full. */
+        rc = sock_queue_rcv_skb(sk, skb);
+        if (rc < 0)
+                goto drop;
+
+        return 0;
+
+drop:
+        IP_INC_STATS(&init_net, IPSTATS_MIB_INDISCARDS);
+        kfree_skb(skb);
+        return -1;
+}
+
+static int l2tp_ip6_push_pending_frames(struct sock *sk)
+{
+        struct sk_buff *skb;
+        __be32 *transhdr = NULL;
+        int err = 0;
+
+        skb = skb_peek(&sk->sk_write_queue);
+        if (skb == NULL)
+                goto out;
+
+        transhdr = (__be32 *)skb_transport_header(skb);
+        *transhdr = 0;
+
+        err = ip6_push_pending_frames(sk);
+
+out:
+        return err;
+}
+
+/* Userspace will call sendmsg() on the tunnel socket to send L2TP
+ * control frames.
+ */
+static int l2tp_ip6_sendmsg(struct kiocb *iocb, struct sock *sk,
+                            struct msghdr *msg, size_t len)
+{
+        struct ipv6_txoptions opt_space;
+        struct sockaddr_l2tpip6 *lsa =
+                (struct sockaddr_l2tpip6 *) msg->msg_name;
+        struct in6_addr *daddr, *final_p, final;
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct ipv6_txoptions *opt = NULL;
+        struct ip6_flowlabel *flowlabel = NULL;
+        struct dst_entry *dst = NULL;
+        struct flowi6 fl6;
+        int addr_len = msg->msg_namelen;
+        int hlimit = -1;
+        int tclass = -1;
+        int dontfrag = -1;
+        int transhdrlen = 4; /* zero session-id */
+        int ulen = len + transhdrlen;
+        int err;
+
+        /* Rough check on arithmetic overflow,
+           better check is made in ip6_append_data().
+         */
+        if (len > INT_MAX)
+                return -EMSGSIZE;
+
+        /* Mirror BSD error message compatibility */
+        if (msg->msg_flags & MSG_OOB)
+                return -EOPNOTSUPP;
+
+        /*
+         *      Get and verify the address.
+         */
+        memset(&fl6, 0, sizeof(fl6));
+
+        fl6.flowi6_mark = sk->sk_mark;
+
+        if (lsa) {
+                if (addr_len < SIN6_LEN_RFC2133)
+                        return -EINVAL;
+
+                if (lsa->l2tp_family && lsa->l2tp_family != AF_INET6)
+                        return -EAFNOSUPPORT;
+
+                daddr = &lsa->l2tp_addr;
+                if (np->sndflow) {
+                        fl6.flowlabel = lsa->l2tp_flowinfo & IPV6_FLOWINFO_MASK;
+                        if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
+                                flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
+                                if (flowlabel == NULL)
+                                        return -EINVAL;
+                                daddr = &flowlabel->dst;
+                        }
+                }
+
+                /*
+                 * Otherwise it will be difficult to maintain
+                 * sk->sk_dst_cache.
+                 */
+                if (sk->sk_state == TCP_ESTABLISHED &&
+                    ipv6_addr_equal(daddr, &np->daddr))
+                        daddr = &np->daddr;
+
+                if (addr_len >= sizeof(struct sockaddr_in6) &&
+                    lsa->l2tp_scope_id &&
+                    ipv6_addr_type(daddr) & IPV6_ADDR_LINKLOCAL)
+                        fl6.flowi6_oif = lsa->l2tp_scope_id;
+        } else {
+                if (sk->sk_state != TCP_ESTABLISHED)
+                        return -EDESTADDRREQ;
+
+                daddr = &np->daddr;
+                fl6.flowlabel = np->flow_label;
+        }
+
+        if (fl6.flowi6_oif == 0)
+                fl6.flowi6_oif = sk->sk_bound_dev_if;
+
+        if (msg->msg_controllen) {
+                opt = &opt_space;
+                memset(opt, 0, sizeof(struct ipv6_txoptions));
+                opt->tot_len = sizeof(struct ipv6_txoptions);
+
+                err = datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
+                                        &hlimit, &tclass, &dontfrag);
+                if (err < 0) {
+                        fl6_sock_release(flowlabel);
+                        return err;
+                }
+                if ((fl6.flowlabel & IPV6_FLOWLABEL_MASK) && !flowlabel) {
+                        flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
+                        if (flowlabel == NULL)
+                                return -EINVAL;
+                }
+                if (!(opt->opt_nflen|opt->opt_flen))
+                        opt = NULL;
+        }
+
+        if (opt == NULL)
+                opt = np->opt;
+        if (flowlabel)
+                opt = fl6_merge_options(&opt_space, flowlabel, opt);
+        opt = ipv6_fixup_options(&opt_space, opt);
+
+        fl6.flowi6_proto = sk->sk_protocol;
+        if (!ipv6_addr_any(daddr))
+                fl6.daddr = *daddr;
+        else
+                fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
+        if (ipv6_addr_any(&fl6.saddr) && !ipv6_addr_any(&np->saddr))
+                fl6.saddr = np->saddr;
+
+        final_p = fl6_update_dst(&fl6, opt, &final);
+
+        if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
+                fl6.flowi6_oif = np->mcast_oif;
+        else if (!fl6.flowi6_oif)
+                fl6.flowi6_oif = np->ucast_oif;
+
+        security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
+
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
+                goto out;
+        }
+
+        if (hlimit < 0) {
+                if (ipv6_addr_is_multicast(&fl6.daddr))
+                        hlimit = np->mcast_hops;
+                else
+                        hlimit = np->hop_limit;
+                if (hlimit < 0)
+                        hlimit = ip6_dst_hoplimit(dst);
+        }
+
+        if (tclass < 0)
+                tclass = np->tclass;
+
+        if (dontfrag < 0)
+                dontfrag = np->dontfrag;
+
+        if (msg->msg_flags & MSG_CONFIRM)
+                goto do_confirm;
+
+back_from_confirm:
+        lock_sock(sk);
+        err = ip6_append_data(sk, ip_generic_getfrag, msg->msg_iov,
+                              ulen, transhdrlen, hlimit, tclass, opt,
+                              &fl6, (struct rt6_info *)dst,
+                              msg->msg_flags, dontfrag);
+        if (err)
+                ip6_flush_pending_frames(sk);
+        else if (!(msg->msg_flags & MSG_MORE))
+                err = l2tp_ip6_push_pending_frames(sk);
+        release_sock(sk);
+done:
+        dst_release(dst);
+out:
+        fl6_sock_release(flowlabel);
+
+        return err < 0 ? err : len;
+
+do_confirm:
+        dst_confirm(dst);
+        if (!(msg->msg_flags & MSG_PROBE) || len)
+                goto back_from_confirm;
+        err = 0;
+        goto done;
+}
+
+static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
+                            struct msghdr *msg, size_t len, int noblock,
+                            int flags, int *addr_len)
+{
+        struct inet_sock *inet = inet_sk(sk);
+        struct sockaddr_l2tpip6 *lsa = (struct sockaddr_l2tpip6 *)msg->msg_name;
+        size_t copied = 0;
+        int err = -EOPNOTSUPP;
+        struct sk_buff *skb;
+
+        if (flags & MSG_OOB)
+                goto out;
+
+        if (addr_len)
+                *addr_len = sizeof(*lsa);
+
+        if (flags & MSG_ERRQUEUE)
+                return ipv6_recv_error(sk, msg, len);
+
+        skb = skb_recv_datagram(sk, flags, noblock, &err);
+        if (!skb)
+                goto out;
+
+        copied = skb->len;
+        if (len < copied) {
+                msg->msg_flags |= MSG_TRUNC;
+                copied = len;
+        }
+
+        err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
+        if (err)
+                goto done;
+
+        sock_recv_timestamp(msg, sk, skb);
+
+        /* Copy the address. */
+        if (lsa) {
+                lsa->l2tp_family = AF_INET6;
+                lsa->l2tp_unused = 0;
+                lsa->l2tp_addr = ipv6_hdr(skb)->saddr;
+                lsa->l2tp_flowinfo = 0;
+                lsa->l2tp_scope_id = 0;
+                if (ipv6_addr_type(&lsa->l2tp_addr) & IPV6_ADDR_LINKLOCAL)
+                        lsa->l2tp_scope_id = IP6CB(skb)->iif;
+        }
+
+        if (inet->cmsg_flags)
+                ip_cmsg_recv(msg, skb);
+
+        if (flags & MSG_TRUNC)
+                copied = skb->len;
+done:
+        skb_free_datagram(sk, skb);
+out:
+        return err ? err : copied;
+}
+
+static struct proto l2tp_ip6_prot = {
+        .name              = "L2TP/IPv6",
+        .owner             = THIS_MODULE,
+        .init              = l2tp_ip6_open,
+        .close             = l2tp_ip6_close,
+        .bind              = l2tp_ip6_bind,
+        .connect           = l2tp_ip6_connect,
+        .disconnect        = l2tp_ip6_disconnect,
+        .ioctl             = udp_ioctl,
+        .destroy           = l2tp_ip6_destroy_sock,
+        .setsockopt        = ipv6_setsockopt,
+        .getsockopt        = ipv6_getsockopt,
+        .sendmsg           = l2tp_ip6_sendmsg,
+        .recvmsg           = l2tp_ip6_recvmsg,
+        .backlog_rcv       = l2tp_ip6_backlog_recv,
+        .hash              = inet_hash,
+        .unhash            = inet_unhash,
+        .obj_size          = sizeof(struct l2tp_ip6_sock),
+#ifdef CONFIG_COMPAT
+        .compat_setsockopt = compat_ipv6_setsockopt,
+        .compat_getsockopt = compat_ipv6_getsockopt,
+#endif
+};
+
+static const struct proto_ops l2tp_ip6_ops = {
+        .family            = PF_INET6,
+        .owner             = THIS_MODULE,
+        .release           = inet6_release,
+        .bind              = inet6_bind,
+        .connect           = inet_dgram_connect,
+        .socketpair        = sock_no_socketpair,
+        .accept            = sock_no_accept,
+        .getname           = l2tp_ip6_getname,
+        .poll              = datagram_poll,
+        .ioctl             = inet6_ioctl,
+        .listen            = sock_no_listen,
+        .shutdown          = inet_shutdown,
+        .setsockopt        = sock_common_setsockopt,
+        .getsockopt        = sock_common_getsockopt,
+        .sendmsg           = inet_sendmsg,
+        .recvmsg           = sock_common_recvmsg,
+        .mmap              = sock_no_mmap,
+        .sendpage          = sock_no_sendpage,
+#ifdef CONFIG_COMPAT
+        .compat_setsockopt = compat_sock_common_setsockopt,
+        .compat_getsockopt = compat_sock_common_getsockopt,
+#endif
+};
+
+static struct inet_protosw l2tp_ip6_protosw = {
+        .type           = SOCK_DGRAM,
+        .protocol       = IPPROTO_L2TP,
+        .prot           = &l2tp_ip6_prot,
+        .ops            = &l2tp_ip6_ops,
+        .no_check       = 0,
+};
+
+static struct inet6_protocol l2tp_ip6_protocol __read_mostly = {
+        .handler        = l2tp_ip6_recv,
+};
+
+static int __init l2tp_ip6_init(void)
+{
+        int err;
+
+        pr_info("L2TP IP encapsulation support for IPv6 (L2TPv3)\n");
+
+        err = proto_register(&l2tp_ip6_prot, 1);
+        if (err != 0)
+                goto out;
+
+        err = inet6_add_protocol(&l2tp_ip6_protocol, IPPROTO_L2TP);
+        if (err)
+                goto out1;
+
+        inet6_register_protosw(&l2tp_ip6_protosw);
+        return 0;
+
+out1:
+        proto_unregister(&l2tp_ip6_prot);
+out:
+        return err;
+}
+
+static void __exit l2tp_ip6_exit(void)
+{
+        inet6_unregister_protosw(&l2tp_ip6_protosw);
+        inet6_del_protocol(&l2tp_ip6_protocol, IPPROTO_L2TP);
+        proto_unregister(&l2tp_ip6_prot);
+}
+
+module_init(l2tp_ip6_init);
+module_exit(l2tp_ip6_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Chris Elston <celston@katalix.com>");
+MODULE_DESCRIPTION("L2TP IP encapsulation for IPv6");
+MODULE_VERSION("1.0");
+
+/* Use the value of SOCK_DGRAM (2) directory, because __stringify doesn't like
+ * enums
+ */
+MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 2, IPPROTO_L2TP);
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index 93a41a09458b..ddc553e76671 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -14,6 +14,8 @@
  * published by the Free Software Foundation.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <net/sock.h>
 #include <net/genetlink.h>
 #include <net/udp.h>
@@ -133,10 +135,25 @@ static int l2tp_nl_cmd_tunnel_create(struct sk_buff *skb, struct genl_info *info
         if (info->attrs[L2TP_ATTR_FD]) {
                 fd = nla_get_u32(info->attrs[L2TP_ATTR_FD]);
         } else {
-                if (info->attrs[L2TP_ATTR_IP_SADDR])
-                        cfg.local_ip.s_addr = nla_get_be32(info->attrs[L2TP_ATTR_IP_SADDR]);
-                if (info->attrs[L2TP_ATTR_IP_DADDR])
-                        cfg.peer_ip.s_addr = nla_get_be32(info->attrs[L2TP_ATTR_IP_DADDR]);
+#if IS_ENABLED(CONFIG_IPV6)
+                if (info->attrs[L2TP_ATTR_IP6_SADDR] &&
+                    info->attrs[L2TP_ATTR_IP6_DADDR]) {
+                        cfg.local_ip6 = nla_data(
+                                info->attrs[L2TP_ATTR_IP6_SADDR]);
+                        cfg.peer_ip6 = nla_data(
+                                info->attrs[L2TP_ATTR_IP6_DADDR]);
+                } else
+#endif
+                if (info->attrs[L2TP_ATTR_IP_SADDR] &&
+                    info->attrs[L2TP_ATTR_IP_DADDR]) {
+                        cfg.local_ip.s_addr = nla_get_be32(
+                                info->attrs[L2TP_ATTR_IP_SADDR]);
+                        cfg.peer_ip.s_addr = nla_get_be32(
+                                info->attrs[L2TP_ATTR_IP_DADDR]);
+                } else {
+                        ret = -EINVAL;
+                        goto out;
+                }
                 if (info->attrs[L2TP_ATTR_UDP_SPORT])
                         cfg.local_udp_port = nla_get_u16(info->attrs[L2TP_ATTR_UDP_SPORT]);
                 if (info->attrs[L2TP_ATTR_UDP_DPORT])
@@ -225,47 +242,85 @@ static int l2tp_nl_tunnel_send(struct sk_buff *skb, u32 pid, u32 seq, int flags,
         struct nlattr *nest;
         struct sock *sk = NULL;
         struct inet_sock *inet;
+#if IS_ENABLED(CONFIG_IPV6)
+        struct ipv6_pinfo *np = NULL;
+#endif
+        struct l2tp_stats stats;
+        unsigned int start;
 
         hdr = genlmsg_put(skb, pid, seq, &l2tp_nl_family, flags,
                           L2TP_CMD_TUNNEL_GET);
         if (IS_ERR(hdr))
                 return PTR_ERR(hdr);
 
-        NLA_PUT_U8(skb, L2TP_ATTR_PROTO_VERSION, tunnel->version);
-        NLA_PUT_U32(skb, L2TP_ATTR_CONN_ID, tunnel->tunnel_id);
-        NLA_PUT_U32(skb, L2TP_ATTR_PEER_CONN_ID, tunnel->peer_tunnel_id);
-        NLA_PUT_U32(skb, L2TP_ATTR_DEBUG, tunnel->debug);
-        NLA_PUT_U16(skb, L2TP_ATTR_ENCAP_TYPE, tunnel->encap);
+        if (nla_put_u8(skb, L2TP_ATTR_PROTO_VERSION, tunnel->version) ||
+            nla_put_u32(skb, L2TP_ATTR_CONN_ID, tunnel->tunnel_id) ||
+            nla_put_u32(skb, L2TP_ATTR_PEER_CONN_ID, tunnel->peer_tunnel_id) ||
+            nla_put_u32(skb, L2TP_ATTR_DEBUG, tunnel->debug) ||
+            nla_put_u16(skb, L2TP_ATTR_ENCAP_TYPE, tunnel->encap))
+                goto nla_put_failure;
 
         nest = nla_nest_start(skb, L2TP_ATTR_STATS);
         if (nest == NULL)
                 goto nla_put_failure;
 
-        NLA_PUT_U64(skb, L2TP_ATTR_TX_PACKETS, tunnel->stats.tx_packets);
-        NLA_PUT_U64(skb, L2TP_ATTR_TX_BYTES, tunnel->stats.tx_bytes);
-        NLA_PUT_U64(skb, L2TP_ATTR_TX_ERRORS, tunnel->stats.tx_errors);
-        NLA_PUT_U64(skb, L2TP_ATTR_RX_PACKETS, tunnel->stats.rx_packets);
-        NLA_PUT_U64(skb, L2TP_ATTR_RX_BYTES, tunnel->stats.rx_bytes);
-        NLA_PUT_U64(skb, L2TP_ATTR_RX_SEQ_DISCARDS, tunnel->stats.rx_seq_discards);
-        NLA_PUT_U64(skb, L2TP_ATTR_RX_OOS_PACKETS, tunnel->stats.rx_oos_packets);
-        NLA_PUT_U64(skb, L2TP_ATTR_RX_ERRORS, tunnel->stats.rx_errors);
+        do {
+                start = u64_stats_fetch_begin(&tunnel->stats.syncp);
+                stats.tx_packets = tunnel->stats.tx_packets;
+                stats.tx_bytes = tunnel->stats.tx_bytes;
+                stats.tx_errors = tunnel->stats.tx_errors;
+                stats.rx_packets = tunnel->stats.rx_packets;
+                stats.rx_bytes = tunnel->stats.rx_bytes;
+                stats.rx_errors = tunnel->stats.rx_errors;
+                stats.rx_seq_discards = tunnel->stats.rx_seq_discards;
+                stats.rx_oos_packets = tunnel->stats.rx_oos_packets;
+        } while (u64_stats_fetch_retry(&tunnel->stats.syncp, start));
+
+        if (nla_put_u64(skb, L2TP_ATTR_TX_PACKETS, stats.tx_packets) ||
+            nla_put_u64(skb, L2TP_ATTR_TX_BYTES, stats.tx_bytes) ||
+            nla_put_u64(skb, L2TP_ATTR_TX_ERRORS, stats.tx_errors) ||
+            nla_put_u64(skb, L2TP_ATTR_RX_PACKETS, stats.rx_packets) ||
+            nla_put_u64(skb, L2TP_ATTR_RX_BYTES, stats.rx_bytes) ||
+            nla_put_u64(skb, L2TP_ATTR_RX_SEQ_DISCARDS,
+                        stats.rx_seq_discards) ||
+            nla_put_u64(skb, L2TP_ATTR_RX_OOS_PACKETS,
+                        stats.rx_oos_packets) ||
+            nla_put_u64(skb, L2TP_ATTR_RX_ERRORS, stats.rx_errors))
+                goto nla_put_failure;
         nla_nest_end(skb, nest);
 
         sk = tunnel->sock;
         if (!sk)
                 goto out;
 
+#if IS_ENABLED(CONFIG_IPV6)
+        if (sk->sk_family == AF_INET6)
+                np = inet6_sk(sk);
+#endif
+
         inet = inet_sk(sk);
 
         switch (tunnel->encap) {
         case L2TP_ENCAPTYPE_UDP:
-                NLA_PUT_U16(skb, L2TP_ATTR_UDP_SPORT, ntohs(inet->inet_sport));
-                NLA_PUT_U16(skb, L2TP_ATTR_UDP_DPORT, ntohs(inet->inet_dport));
-                NLA_PUT_U8(skb, L2TP_ATTR_UDP_CSUM, (sk->sk_no_check != UDP_CSUM_NOXMIT));
+                if (nla_put_u16(skb, L2TP_ATTR_UDP_SPORT, ntohs(inet->inet_sport)) ||
+                    nla_put_u16(skb, L2TP_ATTR_UDP_DPORT, ntohs(inet->inet_dport)) ||
+                    nla_put_u8(skb, L2TP_ATTR_UDP_CSUM,
+                               (sk->sk_no_check != UDP_CSUM_NOXMIT)))
+                        goto nla_put_failure;
                 /* NOBREAK */
         case L2TP_ENCAPTYPE_IP:
-                NLA_PUT_BE32(skb, L2TP_ATTR_IP_SADDR, inet->inet_saddr);
-                NLA_PUT_BE32(skb, L2TP_ATTR_IP_DADDR, inet->inet_daddr);
+#if IS_ENABLED(CONFIG_IPV6)
+                if (np) {
+                        if (nla_put(skb, L2TP_ATTR_IP6_SADDR, sizeof(np->saddr),
+                                    &np->saddr) ||
+                            nla_put(skb, L2TP_ATTR_IP6_DADDR, sizeof(np->daddr),
+                                    &np->daddr))
+                                goto nla_put_failure;
+                } else
+#endif
+                if (nla_put_be32(skb, L2TP_ATTR_IP_SADDR, inet->inet_saddr) ||
+                    nla_put_be32(skb, L2TP_ATTR_IP_DADDR, inet->inet_daddr))
+                        goto nla_put_failure;
                 break;
         }
 
@@ -556,6 +611,8 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 pid, u32 seq, int flags
         struct nlattr *nest;
         struct l2tp_tunnel *tunnel = session->tunnel;
         struct sock *sk = NULL;
+        struct l2tp_stats stats;
+        unsigned int start;
 
         sk = tunnel->sock;
 
@@ -563,43 +620,64 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 pid, u32 seq, int flags
         if (IS_ERR(hdr))
                 return PTR_ERR(hdr);
 
-        NLA_PUT_U32(skb, L2TP_ATTR_CONN_ID, tunnel->tunnel_id);
-        NLA_PUT_U32(skb, L2TP_ATTR_SESSION_ID, session->session_id);
-        NLA_PUT_U32(skb, L2TP_ATTR_PEER_CONN_ID, tunnel->peer_tunnel_id);
-        NLA_PUT_U32(skb, L2TP_ATTR_PEER_SESSION_ID, session->peer_session_id);
-        NLA_PUT_U32(skb, L2TP_ATTR_DEBUG, session->debug);
-        NLA_PUT_U16(skb, L2TP_ATTR_PW_TYPE, session->pwtype);
-        NLA_PUT_U16(skb, L2TP_ATTR_MTU, session->mtu);
-        if (session->mru)
-                NLA_PUT_U16(skb, L2TP_ATTR_MRU, session->mru);
-
-        if (session->ifname && session->ifname[0])
-                NLA_PUT_STRING(skb, L2TP_ATTR_IFNAME, session->ifname);
-        if (session->cookie_len)
-                NLA_PUT(skb, L2TP_ATTR_COOKIE, session->cookie_len, &session->cookie[0]);
-        if (session->peer_cookie_len)
-                NLA_PUT(skb, L2TP_ATTR_PEER_COOKIE, session->peer_cookie_len, &session->peer_cookie[0]);
-        NLA_PUT_U8(skb, L2TP_ATTR_RECV_SEQ, session->recv_seq);
-        NLA_PUT_U8(skb, L2TP_ATTR_SEND_SEQ, session->send_seq);
-        NLA_PUT_U8(skb, L2TP_ATTR_LNS_MODE, session->lns_mode);
+        if (nla_put_u32(skb, L2TP_ATTR_CONN_ID, tunnel->tunnel_id) ||
+            nla_put_u32(skb, L2TP_ATTR_SESSION_ID, session->session_id) ||
+            nla_put_u32(skb, L2TP_ATTR_PEER_CONN_ID, tunnel->peer_tunnel_id) ||
+            nla_put_u32(skb, L2TP_ATTR_PEER_SESSION_ID,
+                        session->peer_session_id) ||
+            nla_put_u32(skb, L2TP_ATTR_DEBUG, session->debug) ||
+            nla_put_u16(skb, L2TP_ATTR_PW_TYPE, session->pwtype) ||
+            nla_put_u16(skb, L2TP_ATTR_MTU, session->mtu) ||
+            (session->mru &&
+             nla_put_u16(skb, L2TP_ATTR_MRU, session->mru)))
+                goto nla_put_failure;
+
+        if ((session->ifname && session->ifname[0] &&
+             nla_put_string(skb, L2TP_ATTR_IFNAME, session->ifname)) ||
+            (session->cookie_len &&
+             nla_put(skb, L2TP_ATTR_COOKIE, session->cookie_len,
+                     &session->cookie[0])) ||
+            (session->peer_cookie_len &&
+             nla_put(skb, L2TP_ATTR_PEER_COOKIE, session->peer_cookie_len,
+                     &session->peer_cookie[0])) ||
+            nla_put_u8(skb, L2TP_ATTR_RECV_SEQ, session->recv_seq) ||
+            nla_put_u8(skb, L2TP_ATTR_SEND_SEQ, session->send_seq) ||
+            nla_put_u8(skb, L2TP_ATTR_LNS_MODE, session->lns_mode) ||
 #ifdef CONFIG_XFRM
-        if ((sk) && (sk->sk_policy[0] || sk->sk_policy[1]))
-                NLA_PUT_U8(skb, L2TP_ATTR_USING_IPSEC, 1);
+            (((sk) && (sk->sk_policy[0] || sk->sk_policy[1])) &&
+             nla_put_u8(skb, L2TP_ATTR_USING_IPSEC, 1)) ||
 #endif
-        if (session->reorder_timeout)
-                NLA_PUT_MSECS(skb, L2TP_ATTR_RECV_TIMEOUT, session->reorder_timeout);
+            (session->reorder_timeout &&
+             nla_put_msecs(skb, L2TP_ATTR_RECV_TIMEOUT, session->reorder_timeout)))
+                goto nla_put_failure;
 
         nest = nla_nest_start(skb, L2TP_ATTR_STATS);
         if (nest == NULL)
                 goto nla_put_failure;
-        NLA_PUT_U64(skb, L2TP_ATTR_TX_PACKETS, session->stats.tx_packets);
-        NLA_PUT_U64(skb, L2TP_ATTR_TX_BYTES, session->stats.tx_bytes);
-        NLA_PUT_U64(skb, L2TP_ATTR_TX_ERRORS, session->stats.tx_errors);
-        NLA_PUT_U64(skb, L2TP_ATTR_RX_PACKETS, session->stats.rx_packets);
-        NLA_PUT_U64(skb, L2TP_ATTR_RX_BYTES, session->stats.rx_bytes);
-        NLA_PUT_U64(skb, L2TP_ATTR_RX_SEQ_DISCARDS, session->stats.rx_seq_discards);
-        NLA_PUT_U64(skb, L2TP_ATTR_RX_OOS_PACKETS, session->stats.rx_oos_packets);
-        NLA_PUT_U64(skb, L2TP_ATTR_RX_ERRORS, session->stats.rx_errors);
+
+        do {
+                start = u64_stats_fetch_begin(&session->stats.syncp);
+                stats.tx_packets = session->stats.tx_packets;
+                stats.tx_bytes = session->stats.tx_bytes;
+                stats.tx_errors = session->stats.tx_errors;
+                stats.rx_packets = session->stats.rx_packets;
+                stats.rx_bytes = session->stats.rx_bytes;
+                stats.rx_errors = session->stats.rx_errors;
+                stats.rx_seq_discards = session->stats.rx_seq_discards;
+                stats.rx_oos_packets = session->stats.rx_oos_packets;
+        } while (u64_stats_fetch_retry(&session->stats.syncp, start));
+
+        if (nla_put_u64(skb, L2TP_ATTR_TX_PACKETS, stats.tx_packets) ||
+            nla_put_u64(skb, L2TP_ATTR_TX_BYTES, stats.tx_bytes) ||
+            nla_put_u64(skb, L2TP_ATTR_TX_ERRORS, stats.tx_errors) ||
+            nla_put_u64(skb, L2TP_ATTR_RX_PACKETS, stats.rx_packets) ||
+            nla_put_u64(skb, L2TP_ATTR_RX_BYTES, stats.rx_bytes) ||
+            nla_put_u64(skb, L2TP_ATTR_RX_SEQ_DISCARDS,
+                        stats.rx_seq_discards) ||
+            nla_put_u64(skb, L2TP_ATTR_RX_OOS_PACKETS,
+                        stats.rx_oos_packets) ||
+            nla_put_u64(skb, L2TP_ATTR_RX_ERRORS, stats.rx_errors))
+                goto nla_put_failure;
         nla_nest_end(skb, nest);
 
         return genlmsg_end(skb, hdr);
@@ -708,6 +786,14 @@ static struct nla_policy l2tp_nl_policy[L2TP_ATTR_MAX + 1] = {
         [L2TP_ATTR_MTU]                 = { .type = NLA_U16, },
         [L2TP_ATTR_MRU]                 = { .type = NLA_U16, },
         [L2TP_ATTR_STATS]               = { .type = NLA_NESTED, },
+        [L2TP_ATTR_IP6_SADDR] = {
+                .type = NLA_BINARY,
+                .len = sizeof(struct in6_addr),
+        },
+        [L2TP_ATTR_IP6_DADDR] = {
+                .type = NLA_BINARY,
+                .len = sizeof(struct in6_addr),
+        },
         [L2TP_ATTR_IFNAME] = {
                 .type = NLA_NUL_STRING,
                 .len = IFNAMSIZ - 1,
@@ -818,7 +904,7 @@ static int l2tp_nl_init(void)
 {
         int err;
 
-        printk(KERN_INFO "L2TP netlink interface\n");
+        pr_info("L2TP netlink interface\n");
         err = genl_register_family_with_ops(&l2tp_nl_family, l2tp_nl_ops,
                                             ARRAY_SIZE(l2tp_nl_ops));
 
@@ -837,5 +923,4 @@ MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
 MODULE_DESCRIPTION("L2TP netlink");
 MODULE_LICENSE("GPL");
 MODULE_VERSION("1.0");
-MODULE_ALIAS("net-pf-" __stringify(PF_NETLINK) "-proto-" \
-             __stringify(NETLINK_GENERIC) "-type-" "l2tp");
+MODULE_ALIAS_GENL_FAMILY("l2tp");
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 8a90d756c904..8ef6b9416cba 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -57,6 +57,8 @@
  * http://openl2tp.sourceforge.net.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/string.h>
 #include <linux/list.h>
@@ -82,7 +84,7 @@
 #include <net/sock.h>
 #include <linux/ppp_channel.h>
 #include <linux/ppp_defs.h>
-#include <linux/if_ppp.h>
+#include <linux/ppp-ioctl.h>
 #include <linux/file.h>
 #include <linux/hash.h>
 #include <linux/sort.h>
@@ -106,12 +108,6 @@
 /* Space for UDP, L2TP and PPP headers */
 #define PPPOL2TP_HEADER_OVERHEAD        40
 
-#define PRINTK(_mask, _type, _lvl, _fmt, args...)                       \
-        do {                                                            \
-                if ((_mask) & (_type))                                  \
-                        printk(_lvl "PPPOL2TP: " _fmt, ##args);         \
-        } while (0)
-
 /* Number of bytes to build transmit L2TP headers.
  * Unfortunately the size is different depending on whether sequence numbers
  * are enabled.
@@ -236,9 +232,9 @@ static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int
 
         if (sk->sk_state & PPPOX_BOUND) {
                 struct pppox_sock *po;
-                PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
-                       "%s: recv %d byte data frame, passing to ppp\n",
-                       session->name, data_len);
+                l2tp_dbg(session, PPPOL2TP_MSG_DATA,
+                         "%s: recv %d byte data frame, passing to ppp\n",
+                         session->name, data_len);
 
                 /* We need to forget all info related to the L2TP packet
                  * gathered in the skb as we are going to reuse the same
@@ -259,8 +255,8 @@ static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int
                 po = pppox_sk(sk);
                 ppp_input(&po->chan, skb);
         } else {
-                PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_INFO,
-                       "%s: socket not bound\n", session->name);
+                l2tp_info(session, PPPOL2TP_MSG_DATA, "%s: socket not bound\n",
+                          session->name);
 
                 /* Not bound. Nothing we can do, so discard. */
                 session->stats.rx_errors++;
@@ -270,8 +266,7 @@ static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int
         return;
 
 no_sock:
-        PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_INFO,
-               "%s: no socket\n", session->name);
+        l2tp_info(session, PPPOL2TP_MSG_DATA, "%s: no socket\n", session->name);
         kfree_skb(skb);
 }
 
@@ -628,7 +623,6 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
 {
         struct sock *sk = sock->sk;
         struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr;
-        struct sockaddr_pppol2tpv3 *sp3 = (struct sockaddr_pppol2tpv3 *) uservaddr;
         struct pppox_sock *po = pppox_sk(sk);
         struct l2tp_session *session = NULL;
         struct l2tp_tunnel *tunnel;
@@ -657,7 +651,13 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
         if (sk->sk_user_data)
                 goto end; /* socket is already attached */
 
-        /* Get params from socket address. Handle L2TPv2 and L2TPv3 */
+        /* Get params from socket address. Handle L2TPv2 and L2TPv3.
+         * This is nasty because there are different sockaddr_pppol2tp
+         * structs for L2TPv2, L2TPv3, over IPv4 and IPv6. We use
+         * the sockaddr size to determine which structure the caller
+         * is using.
+         */
+        peer_tunnel_id = 0;
         if (sockaddr_len == sizeof(struct sockaddr_pppol2tp)) {
                 fd = sp->pppol2tp.fd;
                 tunnel_id = sp->pppol2tp.s_tunnel;
@@ -665,12 +665,31 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
                 session_id = sp->pppol2tp.s_session;
                 peer_session_id = sp->pppol2tp.d_session;
         } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3)) {
+                struct sockaddr_pppol2tpv3 *sp3 =
+                        (struct sockaddr_pppol2tpv3 *) sp;
                 ver = 3;
                 fd = sp3->pppol2tp.fd;
                 tunnel_id = sp3->pppol2tp.s_tunnel;
                 peer_tunnel_id = sp3->pppol2tp.d_tunnel;
                 session_id = sp3->pppol2tp.s_session;
                 peer_session_id = sp3->pppol2tp.d_session;
+        } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpin6)) {
+                struct sockaddr_pppol2tpin6 *sp6 =
+                        (struct sockaddr_pppol2tpin6 *) sp;
+                fd = sp6->pppol2tp.fd;
+                tunnel_id = sp6->pppol2tp.s_tunnel;
+                peer_tunnel_id = sp6->pppol2tp.d_tunnel;
+                session_id = sp6->pppol2tp.s_session;
+                peer_session_id = sp6->pppol2tp.d_session;
+        } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3in6)) {
+                struct sockaddr_pppol2tpv3in6 *sp6 =
+                        (struct sockaddr_pppol2tpv3in6 *) sp;
+                ver = 3;
+                fd = sp6->pppol2tp.fd;
+                tunnel_id = sp6->pppol2tp.s_tunnel;
+                peer_tunnel_id = sp6->pppol2tp.d_tunnel;
+                session_id = sp6->pppol2tp.s_session;
+                peer_session_id = sp6->pppol2tp.d_session;
         } else {
                 error = -EINVAL;
                 goto end; /* bad socket address */
@@ -711,12 +730,8 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
         if (tunnel->recv_payload_hook == NULL)
                 tunnel->recv_payload_hook = pppol2tp_recv_payload_hook;
 
-        if (tunnel->peer_tunnel_id == 0) {
-                if (ver == 2)
-                        tunnel->peer_tunnel_id = sp->pppol2tp.d_tunnel;
-                else
-                        tunnel->peer_tunnel_id = sp3->pppol2tp.d_tunnel;
-        }
+        if (tunnel->peer_tunnel_id == 0)
+                tunnel->peer_tunnel_id = peer_tunnel_id;
 
         /* Create session if it doesn't already exist. We handle the
          * case where a session was previously created by the netlink
@@ -807,8 +822,8 @@ out_no_ppp:
         /* This is how we get the session context from the socket. */
         sk->sk_user_data = session;
         sk->sk_state = PPPOX_CONNECTED;
-        PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-               "%s: created\n", session->name);
+        l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: created\n",
+                  session->name);
 
 end:
         release_sock(sk);
@@ -861,8 +876,8 @@ static int pppol2tp_session_create(struct net *net, u32 tunnel_id, u32 session_i
         ps = l2tp_session_priv(session);
         ps->tunnel_sock = tunnel->sock;
 
-        PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-               "%s: created\n", session->name);
+        l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: created\n",
+                  session->name);
 
         error = 0;
 
@@ -915,8 +930,8 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
                 goto end_put_sess;
         }
 
-        inet = inet_sk(sk);
-        if (tunnel->version == 2) {
+        inet = inet_sk(tunnel->sock);
+        if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) {
                 struct sockaddr_pppol2tp sp;
                 len = sizeof(sp);
                 memset(&sp, 0, len);
@@ -932,6 +947,46 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
                 sp.pppol2tp.addr.sin_port = inet->inet_dport;
                 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
                 memcpy(uaddr, &sp, len);
+#if IS_ENABLED(CONFIG_IPV6)
+        } else if ((tunnel->version == 2) &&
+                   (tunnel->sock->sk_family == AF_INET6)) {
+                struct ipv6_pinfo *np = inet6_sk(tunnel->sock);
+                struct sockaddr_pppol2tpin6 sp;
+                len = sizeof(sp);
+                memset(&sp, 0, len);
+                sp.sa_family    = AF_PPPOX;
+                sp.sa_protocol  = PX_PROTO_OL2TP;
+                sp.pppol2tp.fd  = tunnel->fd;
+                sp.pppol2tp.pid = pls->owner;
+                sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
+                sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
+                sp.pppol2tp.s_session = session->session_id;
+                sp.pppol2tp.d_session = session->peer_session_id;
+                sp.pppol2tp.addr.sin6_family = AF_INET6;
+                sp.pppol2tp.addr.sin6_port = inet->inet_dport;
+                memcpy(&sp.pppol2tp.addr.sin6_addr, &np->daddr,
+                       sizeof(np->daddr));
+                memcpy(uaddr, &sp, len);
+        } else if ((tunnel->version == 3) &&
+                   (tunnel->sock->sk_family == AF_INET6)) {
+                struct ipv6_pinfo *np = inet6_sk(tunnel->sock);
+                struct sockaddr_pppol2tpv3in6 sp;
+                len = sizeof(sp);
+                memset(&sp, 0, len);
+                sp.sa_family    = AF_PPPOX;
+                sp.sa_protocol  = PX_PROTO_OL2TP;
+                sp.pppol2tp.fd  = tunnel->fd;
+                sp.pppol2tp.pid = pls->owner;
+                sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
+                sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
+                sp.pppol2tp.s_session = session->session_id;
+                sp.pppol2tp.d_session = session->peer_session_id;
+                sp.pppol2tp.addr.sin6_family = AF_INET6;
+                sp.pppol2tp.addr.sin6_port = inet->inet_dport;
+                memcpy(&sp.pppol2tp.addr.sin6_addr, &np->daddr,
+                       sizeof(np->daddr));
+                memcpy(uaddr, &sp, len);
+#endif
         } else if (tunnel->version == 3) {
                 struct sockaddr_pppol2tpv3 sp;
                 len = sizeof(sp);
@@ -998,9 +1053,9 @@ static int pppol2tp_session_ioctl(struct l2tp_session *session,
         struct l2tp_tunnel *tunnel = session->tunnel;
         struct pppol2tp_ioc_stats stats;
 
-        PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_DEBUG,
-               "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n",
-               session->name, cmd, arg);
+        l2tp_dbg(session, PPPOL2TP_MSG_CONTROL,
+                 "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n",
+                 session->name, cmd, arg);
 
         sk = ps->sock;
         sock_hold(sk);
@@ -1018,8 +1073,8 @@ static int pppol2tp_session_ioctl(struct l2tp_session *session,
                 if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq)))
                         break;
 
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: get mtu=%d\n", session->name, session->mtu);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: get mtu=%d\n",
+                          session->name, session->mtu);
                 err = 0;
                 break;
 
@@ -1034,8 +1089,8 @@ static int pppol2tp_session_ioctl(struct l2tp_session *session,
 
                 session->mtu = ifr.ifr_mtu;
 
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: set mtu=%d\n", session->name, session->mtu);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: set mtu=%d\n",
+                          session->name, session->mtu);
                 err = 0;
                 break;
 
@@ -1048,8 +1103,8 @@ static int pppol2tp_session_ioctl(struct l2tp_session *session,
                 if (put_user(session->mru, (int __user *) arg))
                         break;
 
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: get mru=%d\n", session->name, session->mru);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: get mru=%d\n",
+                          session->name, session->mru);
                 err = 0;
                 break;
 
@@ -1063,8 +1118,8 @@ static int pppol2tp_session_ioctl(struct l2tp_session *session,
                         break;
 
                 session->mru = val;
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: set mru=%d\n", session->name, session->mru);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: set mru=%d\n",
+                          session->name, session->mru);
                 err = 0;
                 break;
 
@@ -1073,8 +1128,8 @@ static int pppol2tp_session_ioctl(struct l2tp_session *session,
                 if (put_user(ps->flags, (int __user *) arg))
                         break;
 
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: get flags=%d\n", session->name, ps->flags);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: get flags=%d\n",
+                          session->name, ps->flags);
                 err = 0;
                 break;
 
@@ -1083,8 +1138,8 @@ static int pppol2tp_session_ioctl(struct l2tp_session *session,
                 if (get_user(val, (int __user *) arg))
                         break;
                 ps->flags = val;
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: set flags=%d\n", session->name, ps->flags);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: set flags=%d\n",
+                          session->name, ps->flags);
                 err = 0;
                 break;
 
@@ -1100,8 +1155,8 @@ static int pppol2tp_session_ioctl(struct l2tp_session *session,
                 if (copy_to_user((void __user *) arg, &stats,
                                  sizeof(stats)))
                         break;
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: get L2TP stats\n", session->name);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: get L2TP stats\n",
+                          session->name);
                 err = 0;
                 break;
 
@@ -1128,9 +1183,9 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
         struct sock *sk;
         struct pppol2tp_ioc_stats stats;
 
-        PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_DEBUG,
-               "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n",
-               tunnel->name, cmd, arg);
+        l2tp_dbg(tunnel, PPPOL2TP_MSG_CONTROL,
+                 "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n",
+                 tunnel->name, cmd, arg);
 
         sk = tunnel->sock;
         sock_hold(sk);
@@ -1164,8 +1219,8 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
                         err = -EFAULT;
                         break;
                 }
-                PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: get L2TP stats\n", tunnel->name);
+                l2tp_info(tunnel, PPPOL2TP_MSG_CONTROL, "%s: get L2TP stats\n",
+                          tunnel->name);
                 err = 0;
                 break;
 
@@ -1254,8 +1309,8 @@ static int pppol2tp_tunnel_setsockopt(struct sock *sk,
         switch (optname) {
         case PPPOL2TP_SO_DEBUG:
                 tunnel->debug = val;
-                PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: set debug=%x\n", tunnel->name, tunnel->debug);
+                l2tp_info(tunnel, PPPOL2TP_MSG_CONTROL, "%s: set debug=%x\n",
+                          tunnel->name, tunnel->debug);
                 break;
 
         default:
@@ -1282,8 +1337,9 @@ static int pppol2tp_session_setsockopt(struct sock *sk,
                         break;
                 }
                 session->recv_seq = val ? -1 : 0;
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: set recv_seq=%d\n", session->name, session->recv_seq);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL,
+                          "%s: set recv_seq=%d\n",
+                          session->name, session->recv_seq);
                 break;
 
         case PPPOL2TP_SO_SENDSEQ:
@@ -1298,8 +1354,9 @@ static int pppol2tp_session_setsockopt(struct sock *sk,
                         po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
                                 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
                 }
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: set send_seq=%d\n", session->name, session->send_seq);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL,
+                          "%s: set send_seq=%d\n",
+                          session->name, session->send_seq);
                 break;
 
         case PPPOL2TP_SO_LNSMODE:
@@ -1308,20 +1365,22 @@ static int pppol2tp_session_setsockopt(struct sock *sk,
                         break;
                 }
                 session->lns_mode = val ? -1 : 0;
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: set lns_mode=%d\n", session->name, session->lns_mode);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL,
+                          "%s: set lns_mode=%d\n",
+                          session->name, session->lns_mode);
                 break;
 
         case PPPOL2TP_SO_DEBUG:
                 session->debug = val;
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: set debug=%x\n", session->name, session->debug);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: set debug=%x\n",
+                          session->name, session->debug);
                 break;
 
         case PPPOL2TP_SO_REORDERTO:
                 session->reorder_timeout = msecs_to_jiffies(val);
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: set reorder_timeout=%d\n", session->name, session->reorder_timeout);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL,
+                          "%s: set reorder_timeout=%d\n",
+                          session->name, session->reorder_timeout);
                 break;
 
         default:
@@ -1400,8 +1459,8 @@ static int pppol2tp_tunnel_getsockopt(struct sock *sk,
         switch (optname) {
         case PPPOL2TP_SO_DEBUG:
                 *val = tunnel->debug;
-                PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: get debug=%x\n", tunnel->name, tunnel->debug);
+                l2tp_info(tunnel, PPPOL2TP_MSG_CONTROL, "%s: get debug=%x\n",
+                          tunnel->name, tunnel->debug);
                 break;
 
         default:
@@ -1423,32 +1482,32 @@ static int pppol2tp_session_getsockopt(struct sock *sk,
         switch (optname) {
         case PPPOL2TP_SO_RECVSEQ:
                 *val = session->recv_seq;
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: get recv_seq=%d\n", session->name, *val);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL,
+                          "%s: get recv_seq=%d\n", session->name, *val);
                 break;
 
         case PPPOL2TP_SO_SENDSEQ:
                 *val = session->send_seq;
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: get send_seq=%d\n", session->name, *val);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL,
+                          "%s: get send_seq=%d\n", session->name, *val);
                 break;
 
         case PPPOL2TP_SO_LNSMODE:
                 *val = session->lns_mode;
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: get lns_mode=%d\n", session->name, *val);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL,
+                          "%s: get lns_mode=%d\n", session->name, *val);
                 break;
 
         case PPPOL2TP_SO_DEBUG:
                 *val = session->debug;
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: get debug=%d\n", session->name, *val);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: get debug=%d\n",
+                          session->name, *val);
                 break;
 
         case PPPOL2TP_SO_REORDERTO:
                 *val = (int) jiffies_to_msecs(session->reorder_timeout);
-                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
-                       "%s: get reorder_timeout=%d\n", session->name, *val);
+                l2tp_info(session, PPPOL2TP_MSG_CONTROL,
+                          "%s: get reorder_timeout=%d\n", session->name, *val);
                 break;
 
         default:
@@ -1811,8 +1870,7 @@ static int __init pppol2tp_init(void)
                 goto out_unregister_pppox;
 #endif
 
-        printk(KERN_INFO "PPPoL2TP kernel driver, %s\n",
-               PPPOL2TP_DRV_VERSION);
+        pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION);
 
 out:
         return err;
@@ -1845,3 +1903,4 @@ MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
 MODULE_DESCRIPTION("PPP over L2TP over UDP");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(PPPOL2TP_DRV_VERSION);
+MODULE_ALIAS("pppox-proto-" __stringify(PX_PROTO_OL2TP));
diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
index 8d0324bac01c..3cdaa046c1bc 100644
--- a/net/lapb/lapb_iface.c
+++ b/net/lapb/lapb_iface.c
@@ -15,6 +15,8 @@
  *      2000-10-29      Henner Eisen    lapb_data_indication() return status.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/errno.h>
 #include <linux/types.h>
@@ -32,7 +34,6 @@
 #include <linux/slab.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
@@ -280,9 +281,7 @@ int lapb_connect_request(struct net_device *dev)
 
         lapb_establish_data_link(lapb);
 
-#if LAPB_DEBUG > 0
-        printk(KERN_DEBUG "lapb: (%p) S0 -> S1\n", lapb->dev);
-#endif
+        lapb_dbg(0, "(%p) S0 -> S1\n", lapb->dev);
         lapb->state = LAPB_STATE_1;
 
         rc = LAPB_OK;
@@ -306,12 +305,8 @@ int lapb_disconnect_request(struct net_device *dev)
                 goto out_put;
 
         case LAPB_STATE_1:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S1 TX DISC(1)\n", lapb->dev);
-#endif
-#if LAPB_DEBUG > 0
-                printk(KERN_DEBUG "lapb: (%p) S1 -> S0\n", lapb->dev);
-#endif
+                lapb_dbg(1, "(%p) S1 TX DISC(1)\n", lapb->dev);
+                lapb_dbg(0, "(%p) S1 -> S0\n", lapb->dev);
                 lapb_send_control(lapb, LAPB_DISC, LAPB_POLLON, LAPB_COMMAND);
                 lapb->state = LAPB_STATE_0;
                 lapb_start_t1timer(lapb);
@@ -330,12 +325,8 @@ int lapb_disconnect_request(struct net_device *dev)
         lapb_stop_t2timer(lapb);
         lapb->state = LAPB_STATE_2;
 
-#if LAPB_DEBUG > 1
-        printk(KERN_DEBUG "lapb: (%p) S3 DISC(1)\n", lapb->dev);
-#endif
-#if LAPB_DEBUG > 0
-        printk(KERN_DEBUG "lapb: (%p) S3 -> S2\n", lapb->dev);
-#endif
+        lapb_dbg(1, "(%p) S3 DISC(1)\n", lapb->dev);
+        lapb_dbg(0, "(%p) S3 -> S2\n", lapb->dev);
 
         rc = LAPB_OK;
 out_put:
diff --git a/net/lapb/lapb_in.c b/net/lapb/lapb_in.c
index 2ec1af5c36cc..5dba899131b3 100644
--- a/net/lapb/lapb_in.c
+++ b/net/lapb/lapb_in.c
@@ -15,6 +15,8 @@
  *      2000-10-29      Henner Eisen    lapb_data_indication() return status.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -30,7 +32,6 @@
 #include <linux/slab.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
@@ -45,25 +46,16 @@ static void lapb_state0_machine(struct lapb_cb *lapb, struct sk_buff *skb,
 {
         switch (frame->type) {
         case LAPB_SABM:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S0 RX SABM(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S0 RX SABM(%d)\n", lapb->dev, frame->pf);
                 if (lapb->mode & LAPB_EXTENDED) {
-#if LAPB_DEBUG > 1
-                        printk(KERN_DEBUG "lapb: (%p) S0 TX DM(%d)\n",
-                               lapb->dev, frame->pf);
-#endif
+                        lapb_dbg(1, "(%p) S0 TX DM(%d)\n",
+                                 lapb->dev, frame->pf);
                         lapb_send_control(lapb, LAPB_DM, frame->pf,
                                           LAPB_RESPONSE);
                 } else {
-#if LAPB_DEBUG > 1
-                        printk(KERN_DEBUG "lapb: (%p) S0 TX UA(%d)\n",
-                               lapb->dev, frame->pf);
-#endif
-#if LAPB_DEBUG > 0
-                        printk(KERN_DEBUG "lapb: (%p) S0 -> S3\n", lapb->dev);
-#endif
+                        lapb_dbg(1, "(%p) S0 TX UA(%d)\n",
+                                 lapb->dev, frame->pf);
+                        lapb_dbg(0, "(%p) S0 -> S3\n", lapb->dev);
                         lapb_send_control(lapb, LAPB_UA, frame->pf,
                                           LAPB_RESPONSE);
                         lapb_stop_t1timer(lapb);
@@ -79,18 +71,11 @@ static void lapb_state0_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                 break;
 
         case LAPB_SABME:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S0 RX SABME(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S0 RX SABME(%d)\n", lapb->dev, frame->pf);
                 if (lapb->mode & LAPB_EXTENDED) {
-#if LAPB_DEBUG > 1
-                        printk(KERN_DEBUG "lapb: (%p) S0 TX UA(%d)\n",
-                               lapb->dev, frame->pf);
-#endif
-#if LAPB_DEBUG > 0
-                        printk(KERN_DEBUG "lapb: (%p) S0 -> S3\n", lapb->dev);
-#endif
+                        lapb_dbg(1, "(%p) S0 TX UA(%d)\n",
+                                 lapb->dev, frame->pf);
+                        lapb_dbg(0, "(%p) S0 -> S3\n", lapb->dev);
                         lapb_send_control(lapb, LAPB_UA, frame->pf,
                                           LAPB_RESPONSE);
                         lapb_stop_t1timer(lapb);
@@ -103,22 +88,16 @@ static void lapb_state0_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                         lapb->va        = 0;
                         lapb_connect_indication(lapb, LAPB_OK);
                 } else {
-#if LAPB_DEBUG > 1
-                        printk(KERN_DEBUG "lapb: (%p) S0 TX DM(%d)\n",
-                               lapb->dev, frame->pf);
-#endif
+                        lapb_dbg(1, "(%p) S0 TX DM(%d)\n",
+                                 lapb->dev, frame->pf);
                         lapb_send_control(lapb, LAPB_DM, frame->pf,
                                           LAPB_RESPONSE);
                 }
                 break;
 
         case LAPB_DISC:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S0 RX DISC(%d)\n",
-                       lapb->dev, frame->pf);
-                printk(KERN_DEBUG "lapb: (%p) S0 TX UA(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S0 RX DISC(%d)\n", lapb->dev, frame->pf);
+                lapb_dbg(1, "(%p) S0 TX UA(%d)\n", lapb->dev, frame->pf);
                 lapb_send_control(lapb, LAPB_UA, frame->pf, LAPB_RESPONSE);
                 break;
 
@@ -138,68 +117,45 @@ static void lapb_state1_machine(struct lapb_cb *lapb, struct sk_buff *skb,
 {
         switch (frame->type) {
         case LAPB_SABM:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S1 RX SABM(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S1 RX SABM(%d)\n", lapb->dev, frame->pf);
                 if (lapb->mode & LAPB_EXTENDED) {
-#if LAPB_DEBUG > 1
-                        printk(KERN_DEBUG "lapb: (%p) S1 TX DM(%d)\n",
-                               lapb->dev, frame->pf);
-#endif
+                        lapb_dbg(1, "(%p) S1 TX DM(%d)\n",
+                                 lapb->dev, frame->pf);
                         lapb_send_control(lapb, LAPB_DM, frame->pf,
                                           LAPB_RESPONSE);
                 } else {
-#if LAPB_DEBUG > 1
-                        printk(KERN_DEBUG "lapb: (%p) S1 TX UA(%d)\n",
-                               lapb->dev, frame->pf);
-#endif
+                        lapb_dbg(1, "(%p) S1 TX UA(%d)\n",
+                                 lapb->dev, frame->pf);
                         lapb_send_control(lapb, LAPB_UA, frame->pf,
                                           LAPB_RESPONSE);
                 }
                 break;
 
         case LAPB_SABME:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S1 RX SABME(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S1 RX SABME(%d)\n", lapb->dev, frame->pf);
                 if (lapb->mode & LAPB_EXTENDED) {
-#if LAPB_DEBUG > 1
-                        printk(KERN_DEBUG "lapb: (%p) S1 TX UA(%d)\n",
-                               lapb->dev, frame->pf);
-#endif
+                        lapb_dbg(1, "(%p) S1 TX UA(%d)\n",
+                                 lapb->dev, frame->pf);
                         lapb_send_control(lapb, LAPB_UA, frame->pf,
                                           LAPB_RESPONSE);
                 } else {
-#if LAPB_DEBUG > 1
-                        printk(KERN_DEBUG "lapb: (%p) S1 TX DM(%d)\n",
-                               lapb->dev, frame->pf);
-#endif
+                        lapb_dbg(1, "(%p) S1 TX DM(%d)\n",
+                                 lapb->dev, frame->pf);
                         lapb_send_control(lapb, LAPB_DM, frame->pf,
                                           LAPB_RESPONSE);
                 }
                 break;
 
         case LAPB_DISC:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S1 RX DISC(%d)\n",
-                       lapb->dev, frame->pf);
-                printk(KERN_DEBUG "lapb: (%p) S1 TX DM(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S1 RX DISC(%d)\n", lapb->dev, frame->pf);
+                lapb_dbg(1, "(%p) S1 TX DM(%d)\n", lapb->dev, frame->pf);
                 lapb_send_control(lapb, LAPB_DM, frame->pf, LAPB_RESPONSE);
                 break;
 
         case LAPB_UA:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S1 RX UA(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S1 RX UA(%d)\n", lapb->dev, frame->pf);
                 if (frame->pf) {
-#if LAPB_DEBUG > 0
-                        printk(KERN_DEBUG "lapb: (%p) S1 -> S3\n", lapb->dev);
-#endif
+                        lapb_dbg(0, "(%p) S1 -> S3\n", lapb->dev);
                         lapb_stop_t1timer(lapb);
                         lapb_stop_t2timer(lapb);
                         lapb->state     = LAPB_STATE_3;
@@ -213,14 +169,9 @@ static void lapb_state1_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                 break;
 
         case LAPB_DM:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S1 RX DM(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S1 RX DM(%d)\n", lapb->dev, frame->pf);
                 if (frame->pf) {
-#if LAPB_DEBUG > 0
-                        printk(KERN_DEBUG "lapb: (%p) S1 -> S0\n", lapb->dev);
-#endif
+                        lapb_dbg(0, "(%p) S1 -> S0\n", lapb->dev);
                         lapb_clear_queues(lapb);
                         lapb->state = LAPB_STATE_0;
                         lapb_start_t1timer(lapb);
@@ -243,34 +194,22 @@ static void lapb_state2_machine(struct lapb_cb *lapb, struct sk_buff *skb,
         switch (frame->type) {
         case LAPB_SABM:
         case LAPB_SABME:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S2 RX {SABM,SABME}(%d)\n",
-                       lapb->dev, frame->pf);
-                printk(KERN_DEBUG "lapb: (%p) S2 TX DM(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S2 RX {SABM,SABME}(%d)\n",
+                         lapb->dev, frame->pf);
+                lapb_dbg(1, "(%p) S2 TX DM(%d)\n", lapb->dev, frame->pf);
                 lapb_send_control(lapb, LAPB_DM, frame->pf, LAPB_RESPONSE);
                 break;
 
         case LAPB_DISC:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S2 RX DISC(%d)\n",
-                       lapb->dev, frame->pf);
-                printk(KERN_DEBUG "lapb: (%p) S2 TX UA(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S2 RX DISC(%d)\n", lapb->dev, frame->pf);
+                lapb_dbg(1, "(%p) S2 TX UA(%d)\n", lapb->dev, frame->pf);
                 lapb_send_control(lapb, LAPB_UA, frame->pf, LAPB_RESPONSE);
                 break;
 
         case LAPB_UA:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S2 RX UA(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S2 RX UA(%d)\n", lapb->dev, frame->pf);
                 if (frame->pf) {
-#if LAPB_DEBUG > 0
-                        printk(KERN_DEBUG "lapb: (%p) S2 -> S0\n", lapb->dev);
-#endif
+                        lapb_dbg(0, "(%p) S2 -> S0\n", lapb->dev);
                         lapb->state = LAPB_STATE_0;
                         lapb_start_t1timer(lapb);
                         lapb_stop_t2timer(lapb);
@@ -279,14 +218,9 @@ static void lapb_state2_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                 break;
 
         case LAPB_DM:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S2 RX DM(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S2 RX DM(%d)\n", lapb->dev, frame->pf);
                 if (frame->pf) {
-#if LAPB_DEBUG > 0
-                        printk(KERN_DEBUG "lapb: (%p) S2 -> S0\n", lapb->dev);
-#endif
+                        lapb_dbg(0, "(%p) S2 -> S0\n", lapb->dev);
                         lapb->state = LAPB_STATE_0;
                         lapb_start_t1timer(lapb);
                         lapb_stop_t2timer(lapb);
@@ -298,12 +232,9 @@ static void lapb_state2_machine(struct lapb_cb *lapb, struct sk_buff *skb,
         case LAPB_REJ:
         case LAPB_RNR:
         case LAPB_RR:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S2 RX {I,REJ,RNR,RR}(%d)\n",
-                       lapb->dev, frame->pf);
-                printk(KERN_DEBUG "lapb: (%p) S2 RX DM(%d)\n",
+                lapb_dbg(1, "(%p) S2 RX {I,REJ,RNR,RR}(%d)\n",
                        lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S2 RX DM(%d)\n", lapb->dev, frame->pf);
                 if (frame->pf)
                         lapb_send_control(lapb, LAPB_DM, frame->pf,
                                           LAPB_RESPONSE);
@@ -326,22 +257,15 @@ static void lapb_state3_machine(struct lapb_cb *lapb, struct sk_buff *skb,
 
         switch (frame->type) {
         case LAPB_SABM:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S3 RX SABM(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S3 RX SABM(%d)\n", lapb->dev, frame->pf);
                 if (lapb->mode & LAPB_EXTENDED) {
-#if LAPB_DEBUG > 1
-                        printk(KERN_DEBUG "lapb: (%p) S3 TX DM(%d)\n",
-                               lapb->dev, frame->pf);
-#endif
+                        lapb_dbg(1, "(%p) S3 TX DM(%d)\n",
+                                 lapb->dev, frame->pf);
                         lapb_send_control(lapb, LAPB_DM, frame->pf,
                                           LAPB_RESPONSE);
                 } else {
-#if LAPB_DEBUG > 1
-                        printk(KERN_DEBUG "lapb: (%p) S3 TX UA(%d)\n",
-                               lapb->dev, frame->pf);
-#endif
+                        lapb_dbg(1, "(%p) S3 TX UA(%d)\n",
+                                 lapb->dev, frame->pf);
                         lapb_send_control(lapb, LAPB_UA, frame->pf,
                                           LAPB_RESPONSE);
                         lapb_stop_t1timer(lapb);
@@ -356,15 +280,10 @@ static void lapb_state3_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                 break;
 
         case LAPB_SABME:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S3 RX SABME(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S3 RX SABME(%d)\n", lapb->dev, frame->pf);
                 if (lapb->mode & LAPB_EXTENDED) {
-#if LAPB_DEBUG > 1
-                        printk(KERN_DEBUG "lapb: (%p) S3 TX UA(%d)\n",
-                               lapb->dev, frame->pf);
-#endif
+                        lapb_dbg(1, "(%p) S3 TX UA(%d)\n",
+                                 lapb->dev, frame->pf);
                         lapb_send_control(lapb, LAPB_UA, frame->pf,
                                           LAPB_RESPONSE);
                         lapb_stop_t1timer(lapb);
@@ -376,23 +295,16 @@ static void lapb_state3_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                         lapb->va        = 0;
                         lapb_requeue_frames(lapb);
                 } else {
-#if LAPB_DEBUG > 1
-                        printk(KERN_DEBUG "lapb: (%p) S3 TX DM(%d)\n",
-                               lapb->dev, frame->pf);
-#endif
+                        lapb_dbg(1, "(%p) S3 TX DM(%d)\n",
+                                 lapb->dev, frame->pf);
                         lapb_send_control(lapb, LAPB_DM, frame->pf,
                                           LAPB_RESPONSE);
                 }
                 break;
 
         case LAPB_DISC:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S3 RX DISC(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
-#if LAPB_DEBUG > 0
-                printk(KERN_DEBUG "lapb: (%p) S3 -> S0\n", lapb->dev);
-#endif
+                lapb_dbg(1, "(%p) S3 RX DISC(%d)\n", lapb->dev, frame->pf);
+                lapb_dbg(0, "(%p) S3 -> S0\n", lapb->dev);
                 lapb_clear_queues(lapb);
                 lapb_send_control(lapb, LAPB_UA, frame->pf, LAPB_RESPONSE);
                 lapb_start_t1timer(lapb);
@@ -402,13 +314,8 @@ static void lapb_state3_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                 break;
 
         case LAPB_DM:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S3 RX DM(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
-#if LAPB_DEBUG > 0
-                printk(KERN_DEBUG "lapb: (%p) S3 -> S0\n", lapb->dev);
-#endif
+                lapb_dbg(1, "(%p) S3 RX DM(%d)\n", lapb->dev, frame->pf);
+                lapb_dbg(0, "(%p) S3 -> S0\n", lapb->dev);
                 lapb_clear_queues(lapb);
                 lapb->state = LAPB_STATE_0;
                 lapb_start_t1timer(lapb);
@@ -417,10 +324,8 @@ static void lapb_state3_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                 break;
 
         case LAPB_RNR:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S3 RX RNR(%d) R%d\n",
-                       lapb->dev, frame->pf, frame->nr);
-#endif
+                lapb_dbg(1, "(%p) S3 RX RNR(%d) R%d\n",
+                         lapb->dev, frame->pf, frame->nr);
                 lapb->condition |= LAPB_PEER_RX_BUSY_CONDITION;
                 lapb_check_need_response(lapb, frame->cr, frame->pf);
                 if (lapb_validate_nr(lapb, frame->nr)) {
@@ -429,9 +334,7 @@ static void lapb_state3_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                         lapb->frmr_data = *frame;
                         lapb->frmr_type = LAPB_FRMR_Z;
                         lapb_transmit_frmr(lapb);
-#if LAPB_DEBUG > 0
-                        printk(KERN_DEBUG "lapb: (%p) S3 -> S4\n", lapb->dev);
-#endif
+                        lapb_dbg(0, "(%p) S3 -> S4\n", lapb->dev);
                         lapb_start_t1timer(lapb);
                         lapb_stop_t2timer(lapb);
                         lapb->state   = LAPB_STATE_4;
@@ -440,10 +343,8 @@ static void lapb_state3_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                 break;
 
         case LAPB_RR:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S3 RX RR(%d) R%d\n",
-                       lapb->dev, frame->pf, frame->nr);
-#endif
+                lapb_dbg(1, "(%p) S3 RX RR(%d) R%d\n",
+                         lapb->dev, frame->pf, frame->nr);
                 lapb->condition &= ~LAPB_PEER_RX_BUSY_CONDITION;
                 lapb_check_need_response(lapb, frame->cr, frame->pf);
                 if (lapb_validate_nr(lapb, frame->nr)) {
@@ -452,9 +353,7 @@ static void lapb_state3_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                         lapb->frmr_data = *frame;
                         lapb->frmr_type = LAPB_FRMR_Z;
                         lapb_transmit_frmr(lapb);
-#if LAPB_DEBUG > 0
-                        printk(KERN_DEBUG "lapb: (%p) S3 -> S4\n", lapb->dev);
-#endif
+                        lapb_dbg(0, "(%p) S3 -> S4\n", lapb->dev);
                         lapb_start_t1timer(lapb);
                         lapb_stop_t2timer(lapb);
                         lapb->state   = LAPB_STATE_4;
@@ -463,10 +362,8 @@ static void lapb_state3_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                 break;
 
         case LAPB_REJ:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S3 RX REJ(%d) R%d\n",
-                       lapb->dev, frame->pf, frame->nr);
-#endif
+                lapb_dbg(1, "(%p) S3 RX REJ(%d) R%d\n",
+                         lapb->dev, frame->pf, frame->nr);
                 lapb->condition &= ~LAPB_PEER_RX_BUSY_CONDITION;
                 lapb_check_need_response(lapb, frame->cr, frame->pf);
                 if (lapb_validate_nr(lapb, frame->nr)) {
@@ -478,9 +375,7 @@ static void lapb_state3_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                         lapb->frmr_data = *frame;
                         lapb->frmr_type = LAPB_FRMR_Z;
                         lapb_transmit_frmr(lapb);
-#if LAPB_DEBUG > 0
-                        printk(KERN_DEBUG "lapb: (%p) S3 -> S4\n", lapb->dev);
-#endif
+                        lapb_dbg(0, "(%p) S3 -> S4\n", lapb->dev);
                         lapb_start_t1timer(lapb);
                         lapb_stop_t2timer(lapb);
                         lapb->state   = LAPB_STATE_4;
@@ -489,17 +384,13 @@ static void lapb_state3_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                 break;
 
         case LAPB_I:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S3 RX I(%d) S%d R%d\n",
-                       lapb->dev, frame->pf, frame->ns, frame->nr);
-#endif
+                lapb_dbg(1, "(%p) S3 RX I(%d) S%d R%d\n",
+                         lapb->dev, frame->pf, frame->ns, frame->nr);
                 if (!lapb_validate_nr(lapb, frame->nr)) {
                         lapb->frmr_data = *frame;
                         lapb->frmr_type = LAPB_FRMR_Z;
                         lapb_transmit_frmr(lapb);
-#if LAPB_DEBUG > 0
-                        printk(KERN_DEBUG "lapb: (%p) S3 -> S4\n", lapb->dev);
-#endif
+                        lapb_dbg(0, "(%p) S3 -> S4\n", lapb->dev);
                         lapb_start_t1timer(lapb);
                         lapb_stop_t2timer(lapb);
                         lapb->state   = LAPB_STATE_4;
@@ -523,7 +414,7 @@ static void lapb_state3_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                          * a frame lost on the wire.
                          */
                         if (cn == NET_RX_DROP) {
-                                printk(KERN_DEBUG "LAPB: rx congestion\n");
+                                pr_debug("rx congestion\n");
                                 break;
                         }
                         lapb->vr = (lapb->vr + 1) % modulus;
@@ -542,11 +433,8 @@ static void lapb_state3_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                                 if (frame->pf)
                                         lapb_enquiry_response(lapb);
                         } else {
-#if LAPB_DEBUG > 1
-                                printk(KERN_DEBUG
-                                       "lapb: (%p) S3 TX REJ(%d) R%d\n",
-                                       lapb->dev, frame->pf, lapb->vr);
-#endif
+                                lapb_dbg(1, "(%p) S3 TX REJ(%d) R%d\n",
+                                         lapb->dev, frame->pf, lapb->vr);
                                 lapb->condition |= LAPB_REJECT_CONDITION;
                                 lapb_send_control(lapb, LAPB_REJ, frame->pf,
                                                   LAPB_RESPONSE);
@@ -556,31 +444,22 @@ static void lapb_state3_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                 break;
 
         case LAPB_FRMR:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S3 RX FRMR(%d) %02X "
-                       "%02X %02X %02X %02X\n", lapb->dev, frame->pf,
-                       skb->data[0], skb->data[1], skb->data[2],
-                       skb->data[3], skb->data[4]);
-#endif
+                lapb_dbg(1, "(%p) S3 RX FRMR(%d) %02X %02X %02X %02X %02X\n",
+                         lapb->dev, frame->pf,
+                         skb->data[0], skb->data[1], skb->data[2],
+                         skb->data[3], skb->data[4]);
                 lapb_establish_data_link(lapb);
-#if LAPB_DEBUG > 0
-                printk(KERN_DEBUG "lapb: (%p) S3 -> S1\n", lapb->dev);
-#endif
+                lapb_dbg(0, "(%p) S3 -> S1\n", lapb->dev);
                 lapb_requeue_frames(lapb);
                 lapb->state = LAPB_STATE_1;
                 break;
 
         case LAPB_ILLEGAL:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S3 RX ILLEGAL(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S3 RX ILLEGAL(%d)\n", lapb->dev, frame->pf);
                 lapb->frmr_data = *frame;
                 lapb->frmr_type = LAPB_FRMR_W;
                 lapb_transmit_frmr(lapb);
-#if LAPB_DEBUG > 0
-                printk(KERN_DEBUG "lapb: (%p) S3 -> S4\n", lapb->dev);
-#endif
+                lapb_dbg(0, "(%p) S3 -> S4\n", lapb->dev);
                 lapb_start_t1timer(lapb);
                 lapb_stop_t2timer(lapb);
                 lapb->state   = LAPB_STATE_4;
@@ -601,25 +480,16 @@ static void lapb_state4_machine(struct lapb_cb *lapb, struct sk_buff *skb,
 {
         switch (frame->type) {
         case LAPB_SABM:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S4 RX SABM(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S4 RX SABM(%d)\n", lapb->dev, frame->pf);
                 if (lapb->mode & LAPB_EXTENDED) {
-#if LAPB_DEBUG > 1
-                        printk(KERN_DEBUG "lapb: (%p) S4 TX DM(%d)\n",
-                               lapb->dev, frame->pf);
-#endif
+                        lapb_dbg(1, "(%p) S4 TX DM(%d)\n",
+                                 lapb->dev, frame->pf);
                         lapb_send_control(lapb, LAPB_DM, frame->pf,
                                           LAPB_RESPONSE);
                 } else {
-#if LAPB_DEBUG > 1
-                        printk(KERN_DEBUG "lapb: (%p) S4 TX UA(%d)\n",
-                               lapb->dev, frame->pf);
-#endif
-#if LAPB_DEBUG > 0
-                        printk(KERN_DEBUG "lapb: (%p) S4 -> S3\n", lapb->dev);
-#endif
+                        lapb_dbg(1, "(%p) S4 TX UA(%d)\n",
+                                 lapb->dev, frame->pf);
+                        lapb_dbg(0, "(%p) S4 -> S3\n", lapb->dev);
                         lapb_send_control(lapb, LAPB_UA, frame->pf,
                                           LAPB_RESPONSE);
                         lapb_stop_t1timer(lapb);
@@ -635,18 +505,11 @@ static void lapb_state4_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                 break;
 
         case LAPB_SABME:
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S4 RX SABME(%d)\n",
-                       lapb->dev, frame->pf);
-#endif
+                lapb_dbg(1, "(%p) S4 RX SABME(%d)\n", lapb->dev, frame->pf);
                 if (lapb->mode & LAPB_EXTENDED) {
-#if LAPB_DEBUG > 1
-                        printk(KERN_DEBUG "lapb: (%p) S4 TX UA(%d)\n",
-                               lapb->dev, frame->pf);
-#endif
-#if LAPB_DEBUG > 0
-                        printk(KERN_DEBUG "lapb: (%p) S4 -> S3\n", lapb->dev);
-#endif
+                        lapb_dbg(1, "(%p) S4 TX UA(%d)\n",
+                                 lapb->dev, frame->pf);
+                        lapb_dbg(0, "(%p) S4 -> S3\n", lapb->dev);
                         lapb_send_control(lapb, LAPB_UA, frame->pf,
                                           LAPB_RESPONSE);
                         lapb_stop_t1timer(lapb);
@@ -659,10 +522,8 @@ static void lapb_state4_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                         lapb->va        = 0;
                         lapb_connect_indication(lapb, LAPB_OK);
                 } else {
-#if LAPB_DEBUG > 1
-                        printk(KERN_DEBUG "lapb: (%p) S4 TX DM(%d)\n",
-                               lapb->dev, frame->pf);
-#endif
+                        lapb_dbg(1, "(%p) S4 TX DM(%d)\n",
+                                 lapb->dev, frame->pf);
                         lapb_send_control(lapb, LAPB_DM, frame->pf,
                                           LAPB_RESPONSE);
                 }
diff --git a/net/lapb/lapb_out.c b/net/lapb/lapb_out.c
index c75a79540f9f..ba4d015bd1a6 100644
--- a/net/lapb/lapb_out.c
+++ b/net/lapb/lapb_out.c
@@ -14,6 +14,8 @@
  *      LAPB 002        Jonathan Naylor New timer architecture.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -28,7 +30,6 @@
 #include <linux/slab.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
@@ -61,10 +62,8 @@ static void lapb_send_iframe(struct lapb_cb *lapb, struct sk_buff *skb, int poll
                 *frame |= lapb->vs << 1;
         }
 
-#if LAPB_DEBUG > 1
-        printk(KERN_DEBUG "lapb: (%p) S%d TX I(%d) S%d R%d\n",
-               lapb->dev, lapb->state, poll_bit, lapb->vs, lapb->vr);
-#endif
+        lapb_dbg(1, "(%p) S%d TX I(%d) S%d R%d\n",
+                 lapb->dev, lapb->state, poll_bit, lapb->vs, lapb->vr);
 
         lapb_transmit_buffer(lapb, skb, LAPB_COMMAND);
 }
@@ -149,11 +148,9 @@ void lapb_transmit_buffer(struct lapb_cb *lapb, struct sk_buff *skb, int type)
                 }
         }
 
-#if LAPB_DEBUG > 2
-        printk(KERN_DEBUG "lapb: (%p) S%d TX %02X %02X %02X\n",
-               lapb->dev, lapb->state,
-               skb->data[0], skb->data[1], skb->data[2]);
-#endif
+        lapb_dbg(2, "(%p) S%d TX %02X %02X %02X\n",
+                 lapb->dev, lapb->state,
+                 skb->data[0], skb->data[1], skb->data[2]);
 
         if (!lapb_data_transmit(lapb, skb))
                 kfree_skb(skb);
@@ -165,16 +162,10 @@ void lapb_establish_data_link(struct lapb_cb *lapb)
         lapb->n2count   = 0;
 
         if (lapb->mode & LAPB_EXTENDED) {
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S%d TX SABME(1)\n",
-                       lapb->dev, lapb->state);
-#endif
+                lapb_dbg(1, "(%p) S%d TX SABME(1)\n", lapb->dev, lapb->state);
                 lapb_send_control(lapb, LAPB_SABME, LAPB_POLLON, LAPB_COMMAND);
         } else {
-#if LAPB_DEBUG > 1
-                printk(KERN_DEBUG "lapb: (%p) S%d TX SABM(1)\n",
-                       lapb->dev, lapb->state);
-#endif
+                lapb_dbg(1, "(%p) S%d TX SABM(1)\n", lapb->dev, lapb->state);
                 lapb_send_control(lapb, LAPB_SABM, LAPB_POLLON, LAPB_COMMAND);
         }
 
@@ -184,10 +175,8 @@ void lapb_establish_data_link(struct lapb_cb *lapb)
 
 void lapb_enquiry_response(struct lapb_cb *lapb)
 {
-#if LAPB_DEBUG > 1
-        printk(KERN_DEBUG "lapb: (%p) S%d TX RR(1) R%d\n",
-               lapb->dev, lapb->state, lapb->vr);
-#endif
+        lapb_dbg(1, "(%p) S%d TX RR(1) R%d\n",
+                 lapb->dev, lapb->state, lapb->vr);
 
         lapb_send_control(lapb, LAPB_RR, LAPB_POLLON, LAPB_RESPONSE);
 
@@ -196,10 +185,8 @@ void lapb_enquiry_response(struct lapb_cb *lapb)
 
 void lapb_timeout_response(struct lapb_cb *lapb)
 {
-#if LAPB_DEBUG > 1
-        printk(KERN_DEBUG "lapb: (%p) S%d TX RR(0) R%d\n",
-               lapb->dev, lapb->state, lapb->vr);
-#endif
+        lapb_dbg(1, "(%p) S%d TX RR(0) R%d\n",
+                 lapb->dev, lapb->state, lapb->vr);
         lapb_send_control(lapb, LAPB_RR, LAPB_POLLOFF, LAPB_RESPONSE);
 
         lapb->condition &= ~LAPB_ACK_PENDING_CONDITION;
diff --git a/net/lapb/lapb_subr.c b/net/lapb/lapb_subr.c
index 43a2a7fb327b..9d0a426eccbb 100644
--- a/net/lapb/lapb_subr.c
+++ b/net/lapb/lapb_subr.c
@@ -13,6 +13,8 @@
  *      LAPB 001        Jonathan Naylor Started Coding
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -27,7 +29,6 @@
 #include <linux/slab.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
@@ -112,11 +113,9 @@ int lapb_decode(struct lapb_cb *lapb, struct sk_buff *skb,
 {
         frame->type = LAPB_ILLEGAL;
 
-#if LAPB_DEBUG > 2
-        printk(KERN_DEBUG "lapb: (%p) S%d RX %02X %02X %02X\n",
-               lapb->dev, lapb->state,
-               skb->data[0], skb->data[1], skb->data[2]);
-#endif
+        lapb_dbg(2, "(%p) S%d RX %02X %02X %02X\n",
+                 lapb->dev, lapb->state,
+                 skb->data[0], skb->data[1], skb->data[2]);
 
         /* We always need to look at 2 bytes, sometimes we need
          * to look at 3 and those cases are handled below.
@@ -285,12 +284,10 @@ void lapb_transmit_frmr(struct lapb_cb *lapb)
                 dptr++;
                 *dptr++ = lapb->frmr_type;
 
-#if LAPB_DEBUG > 1
-        printk(KERN_DEBUG "lapb: (%p) S%d TX FRMR %02X %02X %02X %02X %02X\n",
-               lapb->dev, lapb->state,
-               skb->data[1], skb->data[2], skb->data[3],
-               skb->data[4], skb->data[5]);
-#endif
+                lapb_dbg(1, "(%p) S%d TX FRMR %02X %02X %02X %02X %02X\n",
+                         lapb->dev, lapb->state,
+                         skb->data[1], skb->data[2], skb->data[3],
+                         skb->data[4], skb->data[5]);
         } else {
                 dptr    = skb_put(skb, 4);
                 *dptr++ = LAPB_FRMR;
@@ -302,11 +299,9 @@ void lapb_transmit_frmr(struct lapb_cb *lapb)
                 dptr++;
                 *dptr++ = lapb->frmr_type;
 
-#if LAPB_DEBUG > 1
-        printk(KERN_DEBUG "lapb: (%p) S%d TX FRMR %02X %02X %02X\n",
-               lapb->dev, lapb->state, skb->data[1],
-               skb->data[2], skb->data[3]);
-#endif
+                lapb_dbg(1, "(%p) S%d TX FRMR %02X %02X %02X\n",
+                         lapb->dev, lapb->state, skb->data[1],
+                         skb->data[2], skb->data[3]);
         }
 
         lapb_transmit_buffer(lapb, skb, LAPB_RESPONSE);
diff --git a/net/lapb/lapb_timer.c b/net/lapb/lapb_timer.c
index af6d14b44e2e..54563ad8aeb1 100644
--- a/net/lapb/lapb_timer.c
+++ b/net/lapb/lapb_timer.c
@@ -14,6 +14,8 @@
  *      LAPB 002        Jonathan Naylor New timer architecture.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -28,7 +30,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
@@ -106,21 +107,17 @@ static void lapb_t1timer_expiry(unsigned long param)
                                 lapb_clear_queues(lapb);
                                 lapb->state = LAPB_STATE_0;
                                 lapb_disconnect_indication(lapb, LAPB_TIMEDOUT);
-#if LAPB_DEBUG > 0
-                                printk(KERN_DEBUG "lapb: (%p) S1 -> S0\n", lapb->dev);
-#endif
+                                lapb_dbg(0, "(%p) S1 -> S0\n", lapb->dev);
                                 return;
                         } else {
                                 lapb->n2count++;
                                 if (lapb->mode & LAPB_EXTENDED) {
-#if LAPB_DEBUG > 1
-                                        printk(KERN_DEBUG "lapb: (%p) S1 TX SABME(1)\n", lapb->dev);
-#endif
+                                        lapb_dbg(1, "(%p) S1 TX SABME(1)\n",
+                                                 lapb->dev);
                                         lapb_send_control(lapb, LAPB_SABME, LAPB_POLLON, LAPB_COMMAND);
                                 } else {
-#if LAPB_DEBUG > 1
-                                        printk(KERN_DEBUG "lapb: (%p) S1 TX SABM(1)\n", lapb->dev);
-#endif
+                                        lapb_dbg(1, "(%p) S1 TX SABM(1)\n",
+                                                 lapb->dev);
                                         lapb_send_control(lapb, LAPB_SABM, LAPB_POLLON, LAPB_COMMAND);
                                 }
                         }
@@ -134,15 +131,11 @@ static void lapb_t1timer_expiry(unsigned long param)
                                 lapb_clear_queues(lapb);
                                 lapb->state = LAPB_STATE_0;
                                 lapb_disconnect_confirmation(lapb, LAPB_TIMEDOUT);
-#if LAPB_DEBUG > 0
-                                printk(KERN_DEBUG "lapb: (%p) S2 -> S0\n", lapb->dev);
-#endif
+                                lapb_dbg(0, "(%p) S2 -> S0\n", lapb->dev);
                                 return;
                         } else {
                                 lapb->n2count++;
-#if LAPB_DEBUG > 1
-                                printk(KERN_DEBUG "lapb: (%p) S2 TX DISC(1)\n", lapb->dev);
-#endif
+                                lapb_dbg(1, "(%p) S2 TX DISC(1)\n", lapb->dev);
                                 lapb_send_control(lapb, LAPB_DISC, LAPB_POLLON, LAPB_COMMAND);
                         }
                         break;
@@ -156,9 +149,7 @@ static void lapb_t1timer_expiry(unsigned long param)
                                 lapb->state = LAPB_STATE_0;
                                 lapb_stop_t2timer(lapb);
                                 lapb_disconnect_indication(lapb, LAPB_TIMEDOUT);
-#if LAPB_DEBUG > 0
-                                printk(KERN_DEBUG "lapb: (%p) S3 -> S0\n", lapb->dev);
-#endif
+                                lapb_dbg(0, "(%p) S3 -> S0\n", lapb->dev);
                                 return;
                         } else {
                                 lapb->n2count++;
@@ -174,9 +165,7 @@ static void lapb_t1timer_expiry(unsigned long param)
                                 lapb_clear_queues(lapb);
                                 lapb->state = LAPB_STATE_0;
                                 lapb_disconnect_indication(lapb, LAPB_TIMEDOUT);
-#if LAPB_DEBUG > 0
-                                printk(KERN_DEBUG "lapb: (%p) S4 -> S0\n", lapb->dev);
-#endif
+                                lapb_dbg(0, "(%p) S4 -> S0\n", lapb->dev);
                                 return;
                         } else {
                                 lapb->n2count++;
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index b9bef2c75026..fe5453c3e719 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -71,8 +71,7 @@ static inline u16 llc_ui_next_link_no(int sap)
  */
 static inline __be16 llc_proto_type(u16 arphrd)
 {
-        return arphrd == ARPHRD_IEEE802_TR ?
-                         htons(ETH_P_TR_802_2) : htons(ETH_P_802_2);
+        return htons(ETH_P_802_2);
 }
 
 /**
@@ -518,7 +517,7 @@ static int llc_ui_listen(struct socket *sock, int backlog)
         if (sock_flag(sk, SOCK_ZAPPED))
                 goto out;
         rc = 0;
-        if (!(unsigned)backlog) /* BSDism */
+        if (!(unsigned int)backlog)     /* BSDism */
                 backlog = 1;
         sk->sk_max_ack_backlog = backlog;
         if (sk->sk_state != TCP_LISTEN) {
@@ -806,10 +805,9 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
                         sk_wait_data(sk, &timeo);
 
                 if ((flags & MSG_PEEK) && peek_seq != llc->copied_seq) {
-                        if (net_ratelimit())
-                                printk(KERN_DEBUG "LLC(%s:%d): Application "
-                                                  "bug, race in MSG_PEEK.\n",
-                                       current->comm, task_pid_nr(current));
+                        net_dbg_ratelimited("LLC(%s:%d): Application bug, race in MSG_PEEK\n",
+                                            current->comm,
+                                            task_pid_nr(current));
                         peek_seq = llc->copied_seq;
                 }
                 continue;
@@ -840,7 +838,7 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                 if (!(flags & MSG_PEEK)) {
                         spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
-                        sk_eat_skb(sk, skb, 0);
+                        sk_eat_skb(sk, skb, false);
                         spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
                         *seq = 0;
                 }
@@ -863,7 +861,7 @@ copy_uaddr:
 
         if (!(flags & MSG_PEEK)) {
                         spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
-                        sk_eat_skb(sk, skb, 0);
+                        sk_eat_skb(sk, skb, false);
                         spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
                         *seq = 0;
         }
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index ba137a6a224d..0d0d416dfab6 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -828,7 +828,7 @@ void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb)
         else {
                 dprintk("%s: adding to backlog...\n", __func__);
                 llc_set_backlog_type(skb, LLC_PACKET);
-                if (sk_add_backlog(sk, skb))
+                if (sk_add_backlog(sk, skb, sk->sk_rcvbuf))
                         goto drop_unlock;
         }
 out:
diff --git a/net/llc/llc_output.c b/net/llc/llc_output.c
index b658cba89fdd..2dae8a5df23f 100644
--- a/net/llc/llc_output.c
+++ b/net/llc/llc_output.c
@@ -14,9 +14,7 @@
  */
 
 #include <linux/if_arp.h>
-#include <linux/if_tr.h>
 #include <linux/netdevice.h>
-#include <linux/trdevice.h>
 #include <linux/skbuff.h>
 #include <linux/export.h>
 #include <net/llc.h>
@@ -37,7 +35,6 @@ int llc_mac_hdr_init(struct sk_buff *skb,
         int rc = -EINVAL;
 
         switch (skb->dev->type) {
-        case ARPHRD_IEEE802_TR:
         case ARPHRD_ETHER:
         case ARPHRD_LOOPBACK:
                 rc = dev_hard_header(skb, skb->dev, ETH_P_802_2, da, sa,
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index 94e7fca75b85..7c5073badc73 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -31,10 +31,6 @@ static int llc_mac_header_len(unsigned short devtype)
         case ARPHRD_ETHER:
         case ARPHRD_LOOPBACK:
                 return sizeof(struct ethhdr);
-#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE)
-        case ARPHRD_IEEE802_TR:
-                return sizeof(struct trh_hdr);
-#endif
         }
         return 0;
 }
diff --git a/net/llc/sysctl_net_llc.c b/net/llc/sysctl_net_llc.c
index e2ebe3586263..d75306b9c2f3 100644
--- a/net/llc/sysctl_net_llc.c
+++ b/net/llc/sysctl_net_llc.c
@@ -7,6 +7,7 @@
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/sysctl.h>
+#include <net/net_namespace.h>
 #include <net/llc.h>
 
 #ifndef CONFIG_SYSCTL
@@ -56,48 +57,29 @@ static struct ctl_table llc_station_table[] = {
         { },
 };
 
-static struct ctl_table llc2_dir_timeout_table[] = {
-        {
-                .procname       = "timeout",
-                .mode           = 0555,
-                .child          = llc2_timeout_table,
-        },
-        { },
-};
-
-static struct ctl_table llc_table[] = {
-        {
-                .procname       = "llc2",
-                .mode           = 0555,
-                .child          = llc2_dir_timeout_table,
-        },
-        {
-                .procname       = "station",
-                .mode           = 0555,
-                .child          = llc_station_table,
-        },
-        { },
-};
-
-static struct ctl_path llc_path[] = {
-        { .procname = "net", },
-        { .procname = "llc", },
-        { }
-};
-
-static struct ctl_table_header *llc_table_header;
+static struct ctl_table_header *llc2_timeout_header;
+static struct ctl_table_header *llc_station_header;
 
 int __init llc_sysctl_init(void)
 {
-        llc_table_header = register_sysctl_paths(llc_path, llc_table);
+        llc2_timeout_header = register_net_sysctl(&init_net, "net/llc/llc2/timeout", llc2_timeout_table);
+        llc_station_header = register_net_sysctl(&init_net, "net/llc/station", llc_station_table);
 
-        return llc_table_header ? 0 : -ENOMEM;
+        if (!llc2_timeout_header || !llc_station_header) {
+                llc_sysctl_exit();
+                return -ENOMEM;
+        }
+        return 0;
 }
 
 void llc_sysctl_exit(void)
 {
-        if (llc_table_header) {
-                unregister_sysctl_table(llc_table_header);
-                llc_table_header = NULL;
+        if (llc2_timeout_header) {
+                unregister_net_sysctl_table(llc2_timeout_header);
+                llc2_timeout_header = NULL;
+        }
+        if (llc_station_header) {
+                unregister_net_sysctl_table(llc_station_header);
+                llc_station_header = NULL;
         }
 }
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 96ddb72760b9..8d249d705980 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -225,6 +225,17 @@ config MAC80211_VERBOSE_MHWMP_DEBUG
 
           Do not select this option.
 
+config MAC80211_VERBOSE_MESH_SYNC_DEBUG
+        bool "Verbose mesh mesh synchronization debugging"
+        depends on MAC80211_DEBUG_MENU
+        depends on MAC80211_MESH
+        ---help---
+          Selecting this option causes mac80211 to print out very verbose mesh
+          synchronization debugging messages (when mac80211 is taking part in a
+          mesh network).
+
+          Do not select this option.
+
 config MAC80211_VERBOSE_TDLS_DEBUG
         bool "Verbose TDLS debugging"
         depends on MAC80211_DEBUG_MENU
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index d540c3b160f3..3e9d931bba35 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -9,7 +9,7 @@ mac80211-y := \
         scan.o offchannel.o \
         ht.o agg-tx.o agg-rx.o \
         ibss.o \
-        mlme.o work.o \
+        work.o \
         iface.o \
         rate.o \
         michael.o \
@@ -25,7 +25,7 @@ mac80211-y := \
         wme.o \
         event.o \
         chan.o \
-        driver-trace.o
+        driver-trace.o mlme.o
 
 mac80211-$(CONFIG_MAC80211_LEDS) += led.o
 mac80211-$(CONFIG_MAC80211_DEBUGFS) += \
@@ -38,7 +38,8 @@ mac80211-$(CONFIG_MAC80211_MESH) += \
         mesh.o \
         mesh_pathtbl.o \
         mesh_plink.o \
-        mesh_hwmp.o
+        mesh_hwmp.o \
+        mesh_sync.o
 
 mac80211-$(CONFIG_PM) += pm.o
 
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 1068f668ac4e..26ddb699d693 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -49,6 +49,8 @@ static void ieee80211_free_tid_rx(struct rcu_head *h)
                 container_of(h, struct tid_ampdu_rx, rcu_head);
         int i;
 
+        del_timer_sync(&tid_rx->reorder_timer);
+
         for (i = 0; i < tid_rx->buf_size; i++)
                 dev_kfree_skb(tid_rx->reorder_buf[i]);
         kfree(tid_rx->reorder_buf);
@@ -91,7 +93,6 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                                      tid, WLAN_BACK_RECIPIENT, reason);
 
         del_timer_sync(&tid_rx->session_timer);
-        del_timer_sync(&tid_rx->reorder_timer);
 
         call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
 }
@@ -141,6 +142,18 @@ static void sta_rx_agg_session_timer_expired(unsigned long data)
         u8 *timer_to_id = ptid - *ptid;
         struct sta_info *sta = container_of(timer_to_id, struct sta_info,
                                          timer_to_tid[0]);
+        struct tid_ampdu_rx *tid_rx;
+        unsigned long timeout;
+
+        tid_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[*ptid]);
+        if (!tid_rx)
+                return;
+
+        timeout = tid_rx->last_rx + TU_TO_JIFFIES(tid_rx->timeout);
+        if (time_is_after_jiffies(timeout)) {
+                mod_timer(&tid_rx->session_timer, timeout);
+                return;
+        }
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
@@ -247,11 +260,8 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
             (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
                 status = WLAN_STATUS_INVALID_QOS_PARAM;
 #ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "AddBA Req with bad params from "
-                                "%pM on tid %u. policy %d, buffer size %d\n",
-                                mgmt->sa, tid, ba_policy,
-                                buf_size);
+                net_dbg_ratelimited("AddBA Req with bad params from %pM on tid %u. policy %d, buffer size %d\n",
+                                    mgmt->sa, tid, ba_policy, buf_size);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
                 goto end_no_lock;
         }
@@ -268,10 +278,8 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 
         if (sta->ampdu_mlme.tid_rx[tid]) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "unexpected AddBA Req from "
-                                "%pM on tid %u\n",
-                                mgmt->sa, tid);
+                net_dbg_ratelimited("unexpected AddBA Req from %pM on tid %u\n",
+                                    mgmt->sa, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
                 /* delete existing Rx BA session on the same tid */
@@ -290,7 +298,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         /* rx timer */
         tid_agg_rx->session_timer.function = sta_rx_agg_session_timer_expired;
         tid_agg_rx->session_timer.data = (unsigned long)&sta->timer_to_tid[tid];
-        init_timer(&tid_agg_rx->session_timer);
+        init_timer_deferrable(&tid_agg_rx->session_timer);
 
         /* rx reorder timer */
         tid_agg_rx->reorder_timer.function = sta_rx_agg_reorder_timer_expired;
@@ -334,8 +342,10 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         /* activate it for RX */
         rcu_assign_pointer(sta->ampdu_mlme.tid_rx[tid], tid_agg_rx);
 
-        if (timeout)
+        if (timeout) {
                 mod_timer(&tid_agg_rx->session_timer, TU_TO_EXP_TIME(timeout));
+                tid_agg_rx->last_rx = jiffies;
+        }
 
 end:
         mutex_unlock(&sta->ampdu_mlme.mtx);
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 76be61744198..7cf07158805c 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -286,25 +286,25 @@ static inline int ieee80211_ac_from_tid(int tid)
  * a global "agg_queue_stop" refcount.
  */
 static void __acquires(agg_queue)
-ieee80211_stop_queue_agg(struct ieee80211_local *local, int tid)
+ieee80211_stop_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
 {
-        int queue = ieee80211_ac_from_tid(tid);
+        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
 
-        if (atomic_inc_return(&local->agg_queue_stop[queue]) == 1)
+        if (atomic_inc_return(&sdata->local->agg_queue_stop[queue]) == 1)
                 ieee80211_stop_queue_by_reason(
-                        &local->hw, queue,
+                        &sdata->local->hw, queue,
                         IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
         __acquire(agg_queue);
 }
 
 static void __releases(agg_queue)
-ieee80211_wake_queue_agg(struct ieee80211_local *local, int tid)
+ieee80211_wake_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
 {
-        int queue = ieee80211_ac_from_tid(tid);
+        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
 
-        if (atomic_dec_return(&local->agg_queue_stop[queue]) == 0)
+        if (atomic_dec_return(&sdata->local->agg_queue_stop[queue]) == 0)
                 ieee80211_wake_queue_by_reason(
-                        &local->hw, queue,
+                        &sdata->local->hw, queue,
                         IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
         __release(agg_queue);
 }
@@ -314,13 +314,14 @@ ieee80211_wake_queue_agg(struct ieee80211_local *local, int tid)
  * requires a call to ieee80211_agg_splice_finish later
  */
 static void __acquires(agg_queue)
-ieee80211_agg_splice_packets(struct ieee80211_local *local,
+ieee80211_agg_splice_packets(struct ieee80211_sub_if_data *sdata,
                              struct tid_ampdu_tx *tid_tx, u16 tid)
 {
-        int queue = ieee80211_ac_from_tid(tid);
+        struct ieee80211_local *local = sdata->local;
+        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
         unsigned long flags;
 
-        ieee80211_stop_queue_agg(local, tid);
+        ieee80211_stop_queue_agg(sdata, tid);
 
         if (WARN(!tid_tx, "TID %d gone but expected when splicing aggregates"
                           " from the pending queue\n", tid))
@@ -336,9 +337,9 @@ ieee80211_agg_splice_packets(struct ieee80211_local *local,
 }
 
 static void __releases(agg_queue)
-ieee80211_agg_splice_finish(struct ieee80211_local *local, u16 tid)
+ieee80211_agg_splice_finish(struct ieee80211_sub_if_data *sdata, u16 tid)
 {
-        ieee80211_wake_queue_agg(local, tid);
+        ieee80211_wake_queue_agg(sdata, tid);
 }
 
 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
@@ -376,9 +377,9 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
                                         " tid %d\n", tid);
 #endif
                 spin_lock_bh(&sta->lock);
-                ieee80211_agg_splice_packets(local, tid_tx, tid);
+                ieee80211_agg_splice_packets(sdata, tid_tx, tid);
                 ieee80211_assign_tid_tx(sta, tid, NULL);
-                ieee80211_agg_splice_finish(local, tid);
+                ieee80211_agg_splice_finish(sdata, tid);
                 spin_unlock_bh(&sta->lock);
 
                 kfree_rcu(tid_tx, rcu_head);
@@ -417,6 +418,24 @@ static void sta_tx_agg_session_timer_expired(unsigned long data)
         u8 *timer_to_id = ptid - *ptid;
         struct sta_info *sta = container_of(timer_to_id, struct sta_info,
                                          timer_to_tid[0]);
+        struct tid_ampdu_tx *tid_tx;
+        unsigned long timeout;
+
+        rcu_read_lock();
+        tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[*ptid]);
+        if (!tid_tx || test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
+                rcu_read_unlock();
+                return;
+        }
+
+        timeout = tid_tx->last_tx + TU_TO_JIFFIES(tid_tx->timeout);
+        if (time_is_after_jiffies(timeout)) {
+                mod_timer(&tid_tx->session_timer, timeout);
+                rcu_read_unlock();
+                return;
+        }
+
+        rcu_read_unlock();
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "tx session timer expired on tid %d\n", (u16)*ptid);
@@ -542,7 +561,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
         /* tx timer */
         tid_tx->session_timer.function = sta_tx_agg_session_timer_expired;
         tid_tx->session_timer.data = (unsigned long)&sta->timer_to_tid[tid];
-        init_timer(&tid_tx->session_timer);
+        init_timer_deferrable(&tid_tx->session_timer);
 
         /* assign a dialog token */
         sta->ampdu_mlme.dialog_token_allocator++;
@@ -586,14 +605,14 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
          */
         spin_lock_bh(&sta->lock);
 
-        ieee80211_agg_splice_packets(local, tid_tx, tid);
+        ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid);
         /*
          * Now mark as operational. This will be visible
          * in the TX path, and lets it go lock-free in
          * the common case.
          */
         set_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
-        ieee80211_agg_splice_finish(local, tid);
+        ieee80211_agg_splice_finish(sta->sdata, tid);
 
         spin_unlock_bh(&sta->lock);
 }
@@ -778,12 +797,12 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
          * more.
          */
 
-        ieee80211_agg_splice_packets(local, tid_tx, tid);
+        ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid);
 
         /* future packets must not find the tid_tx struct any more */
         ieee80211_assign_tid_tx(sta, tid, NULL);
 
-        ieee80211_agg_splice_finish(local, tid);
+        ieee80211_agg_splice_finish(sta->sdata, tid);
 
         kfree_rcu(tid_tx, rcu_head);
 
@@ -884,9 +903,11 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
 
                 sta->ampdu_mlme.addba_req_num[tid] = 0;
 
-                if (tid_tx->timeout)
+                if (tid_tx->timeout) {
                         mod_timer(&tid_tx->session_timer,
                                   TU_TO_EXP_TIME(tid_tx->timeout));
+                        tid_tx->last_tx = jiffies;
+                }
 
         } else {
                 ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR,
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 296620d6ca0c..495831ee48f1 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -336,6 +336,20 @@ static void rate_idx_to_bitrate(struct rate_info *rate, struct sta_info *sta, in
                 rate->mcs = idx;
 }
 
+void sta_set_rate_info_tx(struct sta_info *sta,
+                          const struct ieee80211_tx_rate *rate,
+                          struct rate_info *rinfo)
+{
+        rinfo->flags = 0;
+        if (rate->flags & IEEE80211_TX_RC_MCS)
+                rinfo->flags |= RATE_INFO_FLAGS_MCS;
+        if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                rinfo->flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+        if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
+                rinfo->flags |= RATE_INFO_FLAGS_SHORT_GI;
+        rate_idx_to_bitrate(rinfo, sta, rate->idx);
+}
+
 static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -378,14 +392,7 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                 sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
         }
 
-        sinfo->txrate.flags = 0;
-        if (sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS)
-                sinfo->txrate.flags |= RATE_INFO_FLAGS_MCS;
-        if (sta->last_tx_rate.flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
-                sinfo->txrate.flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
-        if (sta->last_tx_rate.flags & IEEE80211_TX_RC_SHORT_GI)
-                sinfo->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
-        rate_idx_to_bitrate(&sinfo->txrate, sta, sta->last_tx_rate.idx);
+        sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
 
         sinfo->rxrate.flags = 0;
         if (sta->last_rx_rate_flag & RX_FLAG_HT)
@@ -405,6 +412,10 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                 sinfo->llid = le16_to_cpu(sta->llid);
                 sinfo->plid = le16_to_cpu(sta->plid);
                 sinfo->plink_state = sta->plink_state;
+                if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
+                        sinfo->filled |= STATION_INFO_T_OFFSET;
+                        sinfo->t_offset = sta->t_offset;
+                }
 #endif
         }
 
@@ -439,6 +450,180 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
 }
 
+static const char ieee80211_gstrings_sta_stats[][ETH_GSTRING_LEN] = {
+        "rx_packets", "rx_bytes", "wep_weak_iv_count",
+        "rx_duplicates", "rx_fragments", "rx_dropped",
+        "tx_packets", "tx_bytes", "tx_fragments",
+        "tx_filtered", "tx_retry_failed", "tx_retries",
+        "beacon_loss", "sta_state", "txrate", "rxrate", "signal",
+        "channel", "noise", "ch_time", "ch_time_busy",
+        "ch_time_ext_busy", "ch_time_rx", "ch_time_tx"
+};
+#define STA_STATS_LEN   ARRAY_SIZE(ieee80211_gstrings_sta_stats)
+
+static int ieee80211_get_et_sset_count(struct wiphy *wiphy,
+                                       struct net_device *dev,
+                                       int sset)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        int rv = 0;
+
+        if (sset == ETH_SS_STATS)
+                rv += STA_STATS_LEN;
+
+        rv += drv_get_et_sset_count(sdata, sset);
+
+        if (rv == 0)
+                return -EOPNOTSUPP;
+        return rv;
+}
+
+static void ieee80211_get_et_stats(struct wiphy *wiphy,
+                                   struct net_device *dev,
+                                   struct ethtool_stats *stats,
+                                   u64 *data)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct sta_info *sta;
+        struct ieee80211_local *local = sdata->local;
+        struct station_info sinfo;
+        struct survey_info survey;
+        int i, q;
+#define STA_STATS_SURVEY_LEN 7
+
+        memset(data, 0, sizeof(u64) * STA_STATS_LEN);
+
+#define ADD_STA_STATS(sta)                              \
+        do {                                            \
+                data[i++] += sta->rx_packets;           \
+                data[i++] += sta->rx_bytes;             \
+                data[i++] += sta->wep_weak_iv_count;    \
+                data[i++] += sta->num_duplicates;       \
+                data[i++] += sta->rx_fragments;         \
+                data[i++] += sta->rx_dropped;           \
+                                                        \
+                data[i++] += sta->tx_packets;           \
+                data[i++] += sta->tx_bytes;             \
+                data[i++] += sta->tx_fragments;         \
+                data[i++] += sta->tx_filtered_count;    \
+                data[i++] += sta->tx_retry_failed;      \
+                data[i++] += sta->tx_retry_count;       \
+                data[i++] += sta->beacon_loss_count;    \
+        } while (0)
+
+        /* For Managed stations, find the single station based on BSSID
+         * and use that.  For interface types, iterate through all available
+         * stations and add stats for any station that is assigned to this
+         * network device.
+         */
+
+        rcu_read_lock();
+
+        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                sta = sta_info_get_bss(sdata, sdata->u.mgd.bssid);
+
+                if (!(sta && !WARN_ON(sta->sdata->dev != dev)))
+                        goto do_survey;
+
+                i = 0;
+                ADD_STA_STATS(sta);
+
+                data[i++] = sta->sta_state;
+
+                sinfo.filled = 0;
+                sta_set_sinfo(sta, &sinfo);
+
+                if (sinfo.filled | STATION_INFO_TX_BITRATE)
+                        data[i] = 100000 *
+                                cfg80211_calculate_bitrate(&sinfo.txrate);
+                i++;
+                if (sinfo.filled | STATION_INFO_RX_BITRATE)
+                        data[i] = 100000 *
+                                cfg80211_calculate_bitrate(&sinfo.rxrate);
+                i++;
+
+                if (sinfo.filled | STATION_INFO_SIGNAL_AVG)
+                        data[i] = (u8)sinfo.signal_avg;
+                i++;
+        } else {
+                list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                        /* Make sure this station belongs to the proper dev */
+                        if (sta->sdata->dev != dev)
+                                continue;
+
+                        i = 0;
+                        ADD_STA_STATS(sta);
+                }
+        }
+
+do_survey:
+        i = STA_STATS_LEN - STA_STATS_SURVEY_LEN;
+        /* Get survey stats for current channel */
+        q = 0;
+        while (true) {
+                survey.filled = 0;
+                if (drv_get_survey(local, q, &survey) != 0) {
+                        survey.filled = 0;
+                        break;
+                }
+
+                if (survey.channel &&
+                    (local->oper_channel->center_freq ==
+                     survey.channel->center_freq))
+                        break;
+                q++;
+        }
+
+        if (survey.filled)
+                data[i++] = survey.channel->center_freq;
+        else
+                data[i++] = 0;
+        if (survey.filled & SURVEY_INFO_NOISE_DBM)
+                data[i++] = (u8)survey.noise;
+        else
+                data[i++] = -1LL;
+        if (survey.filled & SURVEY_INFO_CHANNEL_TIME)
+                data[i++] = survey.channel_time;
+        else
+                data[i++] = -1LL;
+        if (survey.filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
+                data[i++] = survey.channel_time_busy;
+        else
+                data[i++] = -1LL;
+        if (survey.filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
+                data[i++] = survey.channel_time_ext_busy;
+        else
+                data[i++] = -1LL;
+        if (survey.filled & SURVEY_INFO_CHANNEL_TIME_RX)
+                data[i++] = survey.channel_time_rx;
+        else
+                data[i++] = -1LL;
+        if (survey.filled & SURVEY_INFO_CHANNEL_TIME_TX)
+                data[i++] = survey.channel_time_tx;
+        else
+                data[i++] = -1LL;
+
+        rcu_read_unlock();
+
+        if (WARN_ON(i != STA_STATS_LEN))
+                return;
+
+        drv_get_et_stats(sdata, stats, &(data[STA_STATS_LEN]));
+}
+
+static void ieee80211_get_et_strings(struct wiphy *wiphy,
+                                     struct net_device *dev,
+                                     u32 sset, u8 *data)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        int sz_sta_stats = 0;
+
+        if (sset == ETH_SS_STATS) {
+                sz_sta_stats = sizeof(ieee80211_gstrings_sta_stats);
+                memcpy(data, *ieee80211_gstrings_sta_stats, sz_sta_stats);
+        }
+        drv_get_et_strings(sdata, sset, &(data[sz_sta_stats]));
+}
 
 static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
                                  int idx, u8 *mac, struct station_info *sinfo)
@@ -489,27 +674,13 @@ static int ieee80211_get_station(struct wiphy *wiphy, struct net_device *dev,
         return ret;
 }
 
-static void ieee80211_config_ap_ssid(struct ieee80211_sub_if_data *sdata,
-                                     struct beacon_parameters *params)
-{
-        struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
-
-        bss_conf->ssid_len = params->ssid_len;
-
-        if (params->ssid_len)
-                memcpy(bss_conf->ssid, params->ssid, params->ssid_len);
-
-        bss_conf->hidden_ssid =
-                (params->hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE);
-}
-
 static int ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
-                                    u8 *resp, size_t resp_len)
+                                    const u8 *resp, size_t resp_len)
 {
         struct sk_buff *new, *old;
 
         if (!resp || !resp_len)
-                return -EINVAL;
+                return 1;
 
         old = rtnl_dereference(sdata->u.ap.probe_resp);
 
@@ -520,50 +691,28 @@ static int ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
         memcpy(skb_put(new, resp_len), resp, resp_len);
 
         rcu_assign_pointer(sdata->u.ap.probe_resp, new);
-        synchronize_rcu();
-
-        if (old)
+        if (old) {
+                /* TODO: use call_rcu() */
+                synchronize_rcu();
                 dev_kfree_skb(old);
+        }
 
         return 0;
 }
 
-/*
- * This handles both adding a beacon and setting new beacon info
- */
-static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
-                                   struct beacon_parameters *params)
+static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
+                                   struct cfg80211_beacon_data *params)
 {
         struct beacon_data *new, *old;
         int new_head_len, new_tail_len;
-        int size;
-        int err = -EINVAL;
-        u32 changed = 0;
+        int size, err;
+        u32 changed = BSS_CHANGED_BEACON;
 
         old = rtnl_dereference(sdata->u.ap.beacon);
 
-        /* head must not be zero-length */
-        if (params->head && !params->head_len)
-                return -EINVAL;
-
-        /*
-         * This is a kludge. beacon interval should really be part
-         * of the beacon information.
-         */
-        if (params->interval &&
-            (sdata->vif.bss_conf.beacon_int != params->interval)) {
-                sdata->vif.bss_conf.beacon_int = params->interval;
-                ieee80211_bss_info_change_notify(sdata,
-                                                 BSS_CHANGED_BEACON_INT);
-        }
-
         /* Need to have a beacon head if we don't have one yet */
         if (!params->head && !old)
-                return err;
-
-        /* sorry, no way to start beaconing without dtim period */
-        if (!params->dtim_period && !old)
-                return err;
+                return -EINVAL;
 
         /* new or old head? */
         if (params->head)
@@ -586,12 +735,6 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
 
         /* start filling the new info now */
 
-        /* new or old dtim period? */
-        if (params->dtim_period)
-                new->dtim_period = params->dtim_period;
-        else
-                new->dtim_period = old->dtim_period;
-
         /*
          * pointers go into the block we allocated,
          * memory is | beacon_data | head | tail |
@@ -614,46 +757,37 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
                 if (old)
                         memcpy(new->tail, old->tail, new_tail_len);
 
-        sdata->vif.bss_conf.dtim_period = new->dtim_period;
-
-        rcu_assign_pointer(sdata->u.ap.beacon, new);
-
-        synchronize_rcu();
-
-        kfree(old);
-
         err = ieee80211_set_probe_resp(sdata, params->probe_resp,
                                        params->probe_resp_len);
-        if (!err)
+        if (err < 0)
+                return err;
+        if (err == 0)
                 changed |= BSS_CHANGED_AP_PROBE_RESP;
 
-        ieee80211_config_ap_ssid(sdata, params);
-        changed |= BSS_CHANGED_BEACON_ENABLED |
-                   BSS_CHANGED_BEACON |
-                   BSS_CHANGED_SSID;
+        rcu_assign_pointer(sdata->u.ap.beacon, new);
+
+        if (old)
+                kfree_rcu(old, rcu_head);
 
-        ieee80211_bss_info_change_notify(sdata, changed);
-        return 0;
+        return changed;
 }
 
-static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
-                                struct beacon_parameters *params)
+static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
+                              struct cfg80211_ap_settings *params)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct beacon_data *old;
         struct ieee80211_sub_if_data *vlan;
-        int ret;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        u32 changed = BSS_CHANGED_BEACON_INT |
+                      BSS_CHANGED_BEACON_ENABLED |
+                      BSS_CHANGED_BEACON |
+                      BSS_CHANGED_SSID;
+        int err;
 
         old = rtnl_dereference(sdata->u.ap.beacon);
         if (old)
                 return -EALREADY;
 
-        ret = ieee80211_config_beacon(sdata, params);
-        if (ret)
-                return ret;
-
         /*
          * Apply control port protocol, this allows us to
          * not encrypt dynamic WEP control frames.
@@ -667,14 +801,36 @@ static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
                         params->crypto.control_port_no_encrypt;
         }
 
+        sdata->vif.bss_conf.beacon_int = params->beacon_interval;
+        sdata->vif.bss_conf.dtim_period = params->dtim_period;
+
+        sdata->vif.bss_conf.ssid_len = params->ssid_len;
+        if (params->ssid_len)
+                memcpy(sdata->vif.bss_conf.ssid, params->ssid,
+                       params->ssid_len);
+        sdata->vif.bss_conf.hidden_ssid =
+                (params->hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE);
+
+        err = ieee80211_assign_beacon(sdata, &params->beacon);
+        if (err < 0)
+                return err;
+        changed |= err;
+
+        ieee80211_bss_info_change_notify(sdata, changed);
+
+        netif_carrier_on(dev);
+        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                netif_carrier_on(vlan->dev);
+
         return 0;
 }
 
-static int ieee80211_set_beacon(struct wiphy *wiphy, struct net_device *dev,
-                                struct beacon_parameters *params)
+static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
+                                   struct cfg80211_beacon_data *params)
 {
         struct ieee80211_sub_if_data *sdata;
         struct beacon_data *old;
+        int err;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
@@ -682,12 +838,16 @@ static int ieee80211_set_beacon(struct wiphy *wiphy, struct net_device *dev,
         if (!old)
                 return -ENOENT;
 
-        return ieee80211_config_beacon(sdata, params);
+        err = ieee80211_assign_beacon(sdata, params);
+        if (err < 0)
+                return err;
+        ieee80211_bss_info_change_notify(sdata, err);
+        return 0;
 }
 
-static int ieee80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
+static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata, *vlan;
         struct beacon_data *old;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -696,11 +856,16 @@ static int ieee80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
         if (!old)
                 return -ENOENT;
 
+        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                netif_carrier_off(vlan->dev);
+        netif_carrier_off(dev);
+
         RCU_INIT_POINTER(sdata->u.ap.beacon, NULL);
-        synchronize_rcu();
-        kfree(old);
+
+        kfree_rcu(old, rcu_head);
 
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
+
         return 0;
 }
 
@@ -776,12 +941,10 @@ static int sta_apply_parameters(struct ieee80211_local *local,
 
                 if (set & BIT(NL80211_STA_FLAG_AUTHENTICATED) &&
                     !test_sta_flag(sta, WLAN_STA_AUTH)) {
-                        ret = sta_info_move_state_checked(sta,
-                                        IEEE80211_STA_AUTH);
+                        ret = sta_info_move_state(sta, IEEE80211_STA_AUTH);
                         if (ret)
                                 return ret;
-                        ret = sta_info_move_state_checked(sta,
-                                        IEEE80211_STA_ASSOC);
+                        ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
                         if (ret)
                                 return ret;
                 }
@@ -789,11 +952,9 @@ static int sta_apply_parameters(struct ieee80211_local *local,
 
         if (mask & BIT(NL80211_STA_FLAG_AUTHORIZED)) {
                 if (set & BIT(NL80211_STA_FLAG_AUTHORIZED))
-                        ret = sta_info_move_state_checked(sta,
-                                        IEEE80211_STA_AUTHORIZED);
+                        ret = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
                 else if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
-                        ret = sta_info_move_state_checked(sta,
-                                        IEEE80211_STA_ASSOC);
+                        ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
                 if (ret)
                         return ret;
         }
@@ -805,12 +966,10 @@ static int sta_apply_parameters(struct ieee80211_local *local,
 
                 if (!(set & BIT(NL80211_STA_FLAG_AUTHENTICATED)) &&
                     test_sta_flag(sta, WLAN_STA_AUTH)) {
-                        ret = sta_info_move_state_checked(sta,
-                                        IEEE80211_STA_AUTH);
+                        ret = sta_info_move_state(sta, IEEE80211_STA_AUTH);
                         if (ret)
                                 return ret;
-                        ret = sta_info_move_state_checked(sta,
-                                        IEEE80211_STA_NONE);
+                        ret = sta_info_move_state(sta, IEEE80211_STA_NONE);
                         if (ret)
                                 return ret;
                 }
@@ -934,7 +1093,7 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         } else
                 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (compare_ether_addr(mac, sdata->vif.addr) == 0)
+        if (ether_addr_equal(mac, sdata->vif.addr))
                 return -EINVAL;
 
         if (is_multicast_ether_addr(mac))
@@ -944,8 +1103,8 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         if (!sta)
                 return -ENOMEM;
 
-        sta_info_move_state(sta, IEEE80211_STA_AUTH);
-        sta_info_move_state(sta, IEEE80211_STA_ASSOC);
+        sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
+        sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
 
         err = sta_apply_parameters(local, sta, params);
         if (err) {
@@ -1001,6 +1160,7 @@ static int ieee80211_change_station(struct wiphy *wiphy,
         struct ieee80211_local *local = wiphy_priv(wiphy);
         struct sta_info *sta;
         struct ieee80211_sub_if_data *vlansdata;
+        int err;
 
         mutex_lock(&local->sta_mtx);
 
@@ -1019,6 +1179,9 @@ static int ieee80211_change_station(struct wiphy *wiphy,
         }
 
         if (params->vlan && params->vlan != sta->sdata->dev) {
+                bool prev_4addr = false;
+                bool new_4addr = false;
+
                 vlansdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
 
                 if (vlansdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
@@ -1034,13 +1197,33 @@ static int ieee80211_change_station(struct wiphy *wiphy,
                         }
 
                         rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
+                        new_4addr = true;
+                }
+
+                if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+                    sta->sdata->u.vlan.sta) {
+                        rcu_assign_pointer(sta->sdata->u.vlan.sta, NULL);
+                        prev_4addr = true;
                 }
 
                 sta->sdata = vlansdata;
+
+                if (sta->sta_state == IEEE80211_STA_AUTHORIZED &&
+                    prev_4addr != new_4addr) {
+                        if (new_4addr)
+                                atomic_dec(&sta->sdata->bss->num_mcast_sta);
+                        else
+                                atomic_inc(&sta->sdata->bss->num_mcast_sta);
+                }
+
                 ieee80211_send_layer2_update(sta);
         }
 
-        sta_apply_parameters(local, sta, params);
+        err = sta_apply_parameters(local, sta, params);
+        if (err) {
+                mutex_unlock(&local->sta_mtx);
+                return err;
+        }
 
         if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) && params->supported_rates)
                 rate_control_rate_init(sta);
@@ -1257,6 +1440,7 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
         /* now copy the rest of the setup parameters */
         ifmsh->mesh_id_len = setup->mesh_id_len;
         memcpy(ifmsh->mesh_id, setup->mesh_id, ifmsh->mesh_id_len);
+        ifmsh->mesh_sp_id = setup->sync_method;
         ifmsh->mesh_pp_id = setup->path_sel_proto;
         ifmsh->mesh_pm_id = setup->path_metric;
         ifmsh->security = IEEE80211_MESH_SEC_NONE;
@@ -1301,6 +1485,9 @@ static int ieee80211_update_mesh_config(struct wiphy *wiphy,
                 conf->dot11MeshTTL = nconf->element_ttl;
         if (_chg_mesh_attr(NL80211_MESHCONF_AUTO_OPEN_PLINKS, mask))
                 conf->auto_open_plinks = nconf->auto_open_plinks;
+        if (_chg_mesh_attr(NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, mask))
+                conf->dot11MeshNbrOffsetMaxNeighbor =
+                        nconf->dot11MeshNbrOffsetMaxNeighbor;
         if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, mask))
                 conf->dot11MeshHWMPmaxPREQretries =
                         nconf->dot11MeshHWMPmaxPREQretries;
@@ -1341,6 +1528,21 @@ static int ieee80211_update_mesh_config(struct wiphy *wiphy,
                 conf->dot11MeshHWMPRannInterval =
                         nconf->dot11MeshHWMPRannInterval;
         }
+        if (_chg_mesh_attr(NL80211_MESHCONF_FORWARDING, mask))
+                conf->dot11MeshForwarding = nconf->dot11MeshForwarding;
+        if (_chg_mesh_attr(NL80211_MESHCONF_RSSI_THRESHOLD, mask)) {
+                /* our RSSI threshold implementation is supported only for
+                 * devices that report signal in dBm.
+                 */
+                if (!(sdata->local->hw.flags & IEEE80211_HW_SIGNAL_DBM))
+                        return -ENOTSUPP;
+                conf->rssi_threshold = nconf->rssi_threshold;
+        }
+        if (_chg_mesh_attr(NL80211_MESHCONF_HT_OPMODE, mask)) {
+                conf->ht_opmode = nconf->ht_opmode;
+                sdata->vif.bss_conf.ht_operation_mode = nconf->ht_opmode;
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_HT);
+        }
         return 0;
 }
 
@@ -1449,6 +1651,9 @@ static int ieee80211_set_txq_params(struct wiphy *wiphy,
         if (!local->ops->conf_tx)
                 return -EOPNOTSUPP;
 
+        if (local->hw.queues < IEEE80211_NUM_ACS)
+                return -EOPNOTSUPP;
+
         memset(&p, 0, sizeof(p));
         p.aifs = params->aifs;
         p.cw_max = params->cwmax;
@@ -1461,14 +1666,11 @@ static int ieee80211_set_txq_params(struct wiphy *wiphy,
          */
         p.uapsd = false;
 
-        if (params->queue >= local->hw.queues)
-                return -EINVAL;
-
-        sdata->tx_conf[params->queue] = p;
-        if (drv_conf_tx(local, sdata, params->queue, &p)) {
+        sdata->tx_conf[params->ac] = p;
+        if (drv_conf_tx(local, sdata, params->ac, &p)) {
                 wiphy_debug(local->hw.wiphy,
-                            "failed to set TX queue parameters for queue %d\n",
-                            params->queue);
+                            "failed to set TX queue parameters for AC %d\n",
+                            params->ac);
                 return -EINVAL;
         }
 
@@ -1622,19 +1824,15 @@ static int ieee80211_assoc(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_deauth(struct wiphy *wiphy, struct net_device *dev,
-                            struct cfg80211_deauth_request *req,
-                            void *cookie)
+                            struct cfg80211_deauth_request *req)
 {
-        return ieee80211_mgd_deauth(IEEE80211_DEV_TO_SUB_IF(dev),
-                                    req, cookie);
+        return ieee80211_mgd_deauth(IEEE80211_DEV_TO_SUB_IF(dev), req);
 }
 
 static int ieee80211_disassoc(struct wiphy *wiphy, struct net_device *dev,
-                              struct cfg80211_disassoc_request *req,
-                              void *cookie)
+                              struct cfg80211_disassoc_request *req)
 {
-        return ieee80211_mgd_disassoc(IEEE80211_DEV_TO_SUB_IF(dev),
-                                      req, cookie);
+        return ieee80211_mgd_disassoc(IEEE80211_DEV_TO_SUB_IF(dev), req);
 }
 
 static int ieee80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
@@ -1868,7 +2066,6 @@ static int ieee80211_set_cqm_rssi_config(struct wiphy *wiphy,
                                          s32 rssi_thold, u32 rssi_hyst)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_vif *vif = &sdata->vif;
         struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
 
@@ -1879,14 +2076,9 @@ static int ieee80211_set_cqm_rssi_config(struct wiphy *wiphy,
         bss_conf->cqm_rssi_thold = rssi_thold;
         bss_conf->cqm_rssi_hyst = rssi_hyst;
 
-        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_CQM_RSSI)) {
-                if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                        return -EOPNOTSUPP;
-                return 0;
-        }
-
         /* tell the driver upon association, unless already associated */
-        if (sdata->u.mgd.associated)
+        if (sdata->u.mgd.associated &&
+            sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)
                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_CQM);
 
         return 0;
@@ -1907,8 +2099,11 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
                         return ret;
         }
 
-        for (i = 0; i < IEEE80211_NUM_BANDS; i++)
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
                 sdata->rc_rateidx_mask[i] = mask->control[i].legacy;
+                memcpy(sdata->rc_rateidx_mcs_mask[i], mask->control[i].mcs,
+                       sizeof(mask->control[i].mcs));
+        }
 
         return 0;
 }
@@ -2030,7 +2225,7 @@ ieee80211_offchan_tx_done(struct ieee80211_work *wk, struct sk_buff *skb)
         if (wk->offchan_tx.wait && !wk->offchan_tx.status)
                 cfg80211_mgmt_tx_status(wk->sdata->dev,
                                         (unsigned long) wk->offchan_tx.frame,
-                                        wk->ie, wk->ie_len, false, GFP_KERNEL);
+                                        wk->data, wk->data_len, false, GFP_KERNEL);
 
         return WORK_DONE_DESTROY;
 }
@@ -2109,6 +2304,10 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
 
         IEEE80211_SKB_CB(skb)->flags = flags;
 
+        if (flags & IEEE80211_TX_CTL_TX_OFFCHAN)
+                IEEE80211_SKB_CB(skb)->hw_queue =
+                        local->hw.offchannel_tx_hw_queue;
+
         skb->dev = sdata->dev;
 
         *cookie = (unsigned long) skb;
@@ -2150,6 +2349,8 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
                 /* modify cookie to prevent API mismatches */
                 *cookie ^= 2;
                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN;
+                IEEE80211_SKB_CB(skb)->hw_queue =
+                        local->hw.offchannel_tx_hw_queue;
                 local->hw_roc_skb = skb;
                 local->hw_roc_skb_for_status = skb;
                 mutex_unlock(&local->mtx);
@@ -2181,8 +2382,8 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
         wk->done = ieee80211_offchan_tx_done;
         wk->offchan_tx.frame = skb;
         wk->offchan_tx.wait = wait;
-        wk->ie_len = len;
-        memcpy(wk->ie, buf, len);
+        wk->data_len = len;
+        memcpy(wk->data, buf, len);
 
         ieee80211_add_work(wk);
         return 0;
@@ -2369,8 +2570,8 @@ ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
                 tf->u.setup_req.capability =
                         cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
 
-                ieee80211_add_srates_ie(&sdata->vif, skb);
-                ieee80211_add_ext_srates_ie(&sdata->vif, skb);
+                ieee80211_add_srates_ie(&sdata->vif, skb, false);
+                ieee80211_add_ext_srates_ie(&sdata->vif, skb, false);
                 ieee80211_tdls_add_ext_capab(skb);
                 break;
         case WLAN_TDLS_SETUP_RESPONSE:
@@ -2383,8 +2584,8 @@ ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
                 tf->u.setup_resp.capability =
                         cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
 
-                ieee80211_add_srates_ie(&sdata->vif, skb);
-                ieee80211_add_ext_srates_ie(&sdata->vif, skb);
+                ieee80211_add_srates_ie(&sdata->vif, skb, false);
+                ieee80211_add_ext_srates_ie(&sdata->vif, skb, false);
                 ieee80211_tdls_add_ext_capab(skb);
                 break;
         case WLAN_TDLS_SETUP_CONFIRM:
@@ -2444,8 +2645,8 @@ ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
                 mgmt->u.action.u.tdls_discover_resp.capability =
                         cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
 
-                ieee80211_add_srates_ie(&sdata->vif, skb);
-                ieee80211_add_ext_srates_ie(&sdata->vif, skb);
+                ieee80211_add_srates_ie(&sdata->vif, skb, false);
+                ieee80211_add_ext_srates_ie(&sdata->vif, skb, false);
                 ieee80211_tdls_add_ext_capab(skb);
                 break;
         default:
@@ -2685,13 +2886,22 @@ static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static struct ieee80211_channel *
-ieee80211_wiphy_get_channel(struct wiphy *wiphy)
+ieee80211_wiphy_get_channel(struct wiphy *wiphy,
+                            enum nl80211_channel_type *type)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
 
+        *type = local->_oper_channel_type;
         return local->oper_channel;
 }
 
+#ifdef CONFIG_PM
+static void ieee80211_set_wakeup(struct wiphy *wiphy, bool enabled)
+{
+        drv_set_wakeup(wiphy_priv(wiphy), enabled);
+}
+#endif
+
 struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -2701,9 +2911,9 @@ struct cfg80211_ops mac80211_config_ops = {
         .get_key = ieee80211_get_key,
         .set_default_key = ieee80211_config_default_key,
         .set_default_mgmt_key = ieee80211_config_default_mgmt_key,
-        .add_beacon = ieee80211_add_beacon,
-        .set_beacon = ieee80211_set_beacon,
-        .del_beacon = ieee80211_del_beacon,
+        .start_ap = ieee80211_start_ap,
+        .change_beacon = ieee80211_change_beacon,
+        .stop_ap = ieee80211_stop_ap,
         .add_station = ieee80211_add_station,
         .del_station = ieee80211_del_station,
         .change_station = ieee80211_change_station,
@@ -2760,4 +2970,10 @@ struct cfg80211_ops mac80211_config_ops = {
         .probe_client = ieee80211_probe_client,
         .get_channel = ieee80211_wiphy_get_channel,
         .set_noack_map = ieee80211_set_noack_map,
+#ifdef CONFIG_PM
+        .set_wakeup = ieee80211_set_wakeup,
+#endif
+        .get_et_sset_count = ieee80211_get_et_sset_count,
+        .get_et_stats = ieee80211_get_et_stats,
+        .get_et_strings = ieee80211_get_et_strings,
 };
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 889c3e93e0f4..c76cf7230c7d 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -3,6 +3,7 @@
  */
 
 #include <linux/nl80211.h>
+#include <net/cfg80211.h>
 #include "ieee80211_i.h"
 
 static enum ieee80211_chan_mode
@@ -20,23 +21,29 @@ __ieee80211_get_channel_mode(struct ieee80211_local *local,
                 if (!ieee80211_sdata_running(sdata))
                         continue;
 
-                if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
+                switch (sdata->vif.type) {
+                case NL80211_IFTYPE_MONITOR:
                         continue;
-
-                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                    !sdata->u.mgd.associated)
-                        continue;
-
-                if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                case NL80211_IFTYPE_STATION:
+                        if (!sdata->u.mgd.associated)
+                                continue;
+                        break;
+                case NL80211_IFTYPE_ADHOC:
                         if (!sdata->u.ibss.ssid_len)
                                 continue;
                         if (!sdata->u.ibss.fixed_channel)
                                 return CHAN_MODE_HOPPING;
-                }
-
-                if (sdata->vif.type == NL80211_IFTYPE_AP &&
-                    !sdata->u.ap.beacon)
+                        break;
+                case NL80211_IFTYPE_AP_VLAN:
+                        /* will also have _AP interface */
                         continue;
+                case NL80211_IFTYPE_AP:
+                        if (!sdata->u.ap.beacon)
+                                continue;
+                        break;
+                default:
+                        break;
+                }
 
                 return CHAN_MODE_FIXED;
         }
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 90baea53e7c5..778e5916d7c3 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -15,12 +15,6 @@
 #include "rate.h"
 #include "debugfs.h"
 
-int mac80211_open_file_generic(struct inode *inode, struct file *file)
-{
-        file->private_data = inode->i_private;
-        return 0;
-}
-
 #define DEBUGFS_FORMAT_BUFFER_SIZE 100
 
 int mac80211_format_buffer(char __user *userbuf, size_t count,
@@ -50,7 +44,7 @@ static ssize_t name## _read(struct file *file, char __user *userbuf,	\
 #define DEBUGFS_READONLY_FILE_OPS(name)                 \
 static const struct file_operations name## _ops = {                     \
         .read = name## _read,                                           \
-        .open = mac80211_open_file_generic,                             \
+        .open = simple_open,                                            \
         .llseek = generic_file_llseek,                                  \
 };
 
@@ -93,89 +87,10 @@ static ssize_t reset_write(struct file *file, const char __user *user_buf,
 
 static const struct file_operations reset_ops = {
         .write = reset_write,
-        .open = mac80211_open_file_generic,
+        .open = simple_open,
         .llseek = noop_llseek,
 };
 
-static ssize_t uapsd_queues_read(struct file *file, char __user *user_buf,
-                                 size_t count, loff_t *ppos)
-{
-        struct ieee80211_local *local = file->private_data;
-        return mac80211_format_buffer(user_buf, count, ppos, "0x%x\n",
-                                      local->uapsd_queues);
-}
-
-static ssize_t uapsd_queues_write(struct file *file,
-                                  const char __user *user_buf,
-                                  size_t count, loff_t *ppos)
-{
-        struct ieee80211_local *local = file->private_data;
-        u8 val;
-        int ret;
-
-        ret = kstrtou8_from_user(user_buf, count, 0, &val);
-        if (ret)
-                return ret;
-
-        if (val & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
-                return -ERANGE;
-
-        local->uapsd_queues = val;
-
-        return count;
-}
-
-static const struct file_operations uapsd_queues_ops = {
-        .read = uapsd_queues_read,
-        .write = uapsd_queues_write,
-        .open = mac80211_open_file_generic,
-        .llseek = default_llseek,
-};
-
-static ssize_t uapsd_max_sp_len_read(struct file *file, char __user *user_buf,
-                                     size_t count, loff_t *ppos)
-{
-        struct ieee80211_local *local = file->private_data;
-
-        return mac80211_format_buffer(user_buf, count, ppos, "0x%x\n",
-                                      local->uapsd_max_sp_len);
-}
-
-static ssize_t uapsd_max_sp_len_write(struct file *file,
-                                      const char __user *user_buf,
-                                      size_t count, loff_t *ppos)
-{
-        struct ieee80211_local *local = file->private_data;
-        unsigned long val;
-        char buf[10];
-        size_t len;
-        int ret;
-
-        len = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, len))
-                return -EFAULT;
-        buf[len] = '\0';
-
-        ret = kstrtoul(buf, 0, &val);
-
-        if (ret)
-                return -EINVAL;
-
-        if (val & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
-                return -ERANGE;
-
-        local->uapsd_max_sp_len = val;
-
-        return count;
-}
-
-static const struct file_operations uapsd_max_sp_len_ops = {
-        .read = uapsd_max_sp_len_read,
-        .write = uapsd_max_sp_len_write,
-        .open = mac80211_open_file_generic,
-        .llseek = default_llseek,
-};
-
 static ssize_t channel_type_read(struct file *file, char __user *user_buf,
                        size_t count, loff_t *ppos)
 {
@@ -247,8 +162,6 @@ static ssize_t hwflags_read(struct file *file, char __user *user_buf,
                 sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_DYNAMIC_PS\n");
         if (local->hw.flags & IEEE80211_HW_MFP_CAPABLE)
                 sf += snprintf(buf + sf, mxln - sf, "MFP_CAPABLE\n");
-        if (local->hw.flags & IEEE80211_HW_BEACON_FILTER)
-                sf += snprintf(buf + sf, mxln - sf, "BEACON_FILTER\n");
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_STATIC_SMPS)
                 sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_STATIC_SMPS\n");
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS)
@@ -259,14 +172,14 @@ static ssize_t hwflags_read(struct file *file, char __user *user_buf,
                 sf += snprintf(buf + sf, mxln - sf, "REPORTS_TX_ACK_STATUS\n");
         if (local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
                 sf += snprintf(buf + sf, mxln - sf, "CONNECTION_MONITOR\n");
-        if (local->hw.flags & IEEE80211_HW_SUPPORTS_CQM_RSSI)
-                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_CQM_RSSI\n");
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_PER_STA_GTK)
                 sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_PER_STA_GTK\n");
         if (local->hw.flags & IEEE80211_HW_AP_LINK_PS)
                 sf += snprintf(buf + sf, mxln - sf, "AP_LINK_PS\n");
         if (local->hw.flags & IEEE80211_HW_TX_AMPDU_SETUP_IN_HW)
                 sf += snprintf(buf + sf, mxln - sf, "TX_AMPDU_SETUP_IN_HW\n");
+        if (local->hw.flags & IEEE80211_HW_SCAN_WHILE_IDLE)
+                sf += snprintf(buf + sf, mxln - sf, "SCAN_WHILE_IDLE\n");
 
         rv = simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf));
         kfree(buf);
@@ -335,7 +248,7 @@ static ssize_t stats_ ##name## _read(struct file *file,			\
                                                                         \
 static const struct file_operations stats_ ##name## _ops = {            \
         .read = stats_ ##name## _read,                                  \
-        .open = mac80211_open_file_generic,                             \
+        .open = simple_open,                                            \
         .llseek = generic_file_llseek,                                  \
 };
 
@@ -364,8 +277,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
         DEBUGFS_ADD(wep_iv);
         DEBUGFS_ADD(queues);
         DEBUGFS_ADD_MODE(reset, 0200);
-        DEBUGFS_ADD(uapsd_queues);
-        DEBUGFS_ADD(uapsd_max_sp_len);
         DEBUGFS_ADD(channel_type);
         DEBUGFS_ADD(hwflags);
         DEBUGFS_ADD(user_power);
diff --git a/net/mac80211/debugfs.h b/net/mac80211/debugfs.h
index 7c87529630f5..9be4e6d71d00 100644
--- a/net/mac80211/debugfs.h
+++ b/net/mac80211/debugfs.h
@@ -3,7 +3,6 @@
 
 #ifdef CONFIG_MAC80211_DEBUGFS
 extern void debugfs_hw_add(struct ieee80211_local *local);
-extern int mac80211_open_file_generic(struct inode *inode, struct file *file);
 extern int mac80211_format_buffer(char __user *userbuf, size_t count,
                                   loff_t *ppos, char *fmt, ...);
 #else
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 59edcd95a58d..7932767bb482 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -30,7 +30,7 @@ static ssize_t key_##name##_read(struct file *file,			\
 #define KEY_OPS(name)                                                   \
 static const struct file_operations key_ ##name## _ops = {              \
         .read = key_##name##_read,                                      \
-        .open = mac80211_open_file_generic,                             \
+        .open = simple_open,                                            \
         .llseek = generic_file_llseek,                                  \
 }
 
@@ -45,7 +45,7 @@ static const struct file_operations key_ ##name## _ops = {		\
 #define KEY_CONF_OPS(name)                                              \
 static const struct file_operations key_ ##name## _ops = {              \
         .read = key_conf_##name##_read,                                 \
-        .open = mac80211_open_file_generic,                             \
+        .open = simple_open,                                            \
         .llseek = generic_file_llseek,                                  \
 }
 
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 176c08ffb13c..7ed433c66d68 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -49,16 +49,15 @@ static ssize_t ieee80211_if_write(
         size_t count, loff_t *ppos,
         ssize_t (*write)(struct ieee80211_sub_if_data *, const char *, int))
 {
-        u8 *buf;
+        char buf[64];
         ssize_t ret;
 
-        buf = kmalloc(count, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
+        if (count >= sizeof(buf))
+                return -E2BIG;
 
-        ret = -EFAULT;
         if (copy_from_user(buf, userbuf, count))
-                goto freebuf;
+                return -EFAULT;
+        buf[count] = '\0';
 
         ret = -ENODEV;
         rtnl_lock();
@@ -66,8 +65,6 @@ static ssize_t ieee80211_if_write(
                 ret = (*write)(sdata, buf, count);
         rtnl_unlock();
 
-freebuf:
-        kfree(buf);
         return ret;
 }
 
@@ -87,6 +84,21 @@ static ssize_t ieee80211_if_fmt_##name(					\
 #define IEEE80211_IF_FMT_SIZE(name, field)                              \
                 IEEE80211_IF_FMT(name, field, "%zd\n")
 
+#define IEEE80211_IF_FMT_HEXARRAY(name, field)                          \
+static ssize_t ieee80211_if_fmt_##name(                                 \
+        const struct ieee80211_sub_if_data *sdata,                      \
+        char *buf, int buflen)                                          \
+{                                                                       \
+        char *p = buf;                                                  \
+        int i;                                                          \
+        for (i = 0; i < sizeof(sdata->field); i++) {                    \
+                p += scnprintf(p, buflen + buf - p, "%.2x ",            \
+                                 sdata->field[i]);                      \
+        }                                                               \
+        p += scnprintf(p, buflen + buf - p, "\n");                      \
+        return p - buf;                                                 \
+}
+
 #define IEEE80211_IF_FMT_ATOMIC(name, field)                            \
 static ssize_t ieee80211_if_fmt_##name(                                 \
         const struct ieee80211_sub_if_data *sdata,                      \
@@ -123,7 +135,7 @@ static ssize_t ieee80211_if_read_##name(struct file *file,		\
 static const struct file_operations name##_ops = {                      \
         .read = ieee80211_if_read_##name,                               \
         .write = (_write),                                              \
-        .open = mac80211_open_file_generic,                             \
+        .open = simple_open,                                            \
         .llseek = generic_file_llseek,                                  \
 }
 
@@ -148,6 +160,11 @@ IEEE80211_IF_FILE(rc_rateidx_mask_2ghz, rc_rateidx_mask[IEEE80211_BAND_2GHZ],
                   HEX);
 IEEE80211_IF_FILE(rc_rateidx_mask_5ghz, rc_rateidx_mask[IEEE80211_BAND_5GHZ],
                   HEX);
+IEEE80211_IF_FILE(rc_rateidx_mcs_mask_2ghz,
+                  rc_rateidx_mcs_mask[IEEE80211_BAND_2GHZ], HEXARRAY);
+IEEE80211_IF_FILE(rc_rateidx_mcs_mask_5ghz,
+                  rc_rateidx_mcs_mask[IEEE80211_BAND_5GHZ], HEXARRAY);
+
 IEEE80211_IF_FILE(flags, flags, HEX);
 IEEE80211_IF_FILE(state, state, LHEX);
 IEEE80211_IF_FILE(channel_type, vif.bss_conf.channel_type, DEC);
@@ -320,8 +337,64 @@ static ssize_t ieee80211_if_parse_tkip_mic_test(
 
 __IEEE80211_IF_FILE_W(tkip_mic_test);
 
+static ssize_t ieee80211_if_fmt_uapsd_queues(
+        const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
+{
+        const struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        return snprintf(buf, buflen, "0x%x\n", ifmgd->uapsd_queues);
+}
+
+static ssize_t ieee80211_if_parse_uapsd_queues(
+        struct ieee80211_sub_if_data *sdata, const char *buf, int buflen)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        u8 val;
+        int ret;
+
+        ret = kstrtou8(buf, 0, &val);
+        if (ret)
+                return ret;
+
+        if (val & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
+                return -ERANGE;
+
+        ifmgd->uapsd_queues = val;
+
+        return buflen;
+}
+__IEEE80211_IF_FILE_W(uapsd_queues);
+
+static ssize_t ieee80211_if_fmt_uapsd_max_sp_len(
+        const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
+{
+        const struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        return snprintf(buf, buflen, "0x%x\n", ifmgd->uapsd_max_sp_len);
+}
+
+static ssize_t ieee80211_if_parse_uapsd_max_sp_len(
+        struct ieee80211_sub_if_data *sdata, const char *buf, int buflen)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        unsigned long val;
+        int ret;
+
+        ret = kstrtoul(buf, 0, &val);
+        if (ret)
+                return -EINVAL;
+
+        if (val & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
+                return -ERANGE;
+
+        ifmgd->uapsd_max_sp_len = val;
+
+        return buflen;
+}
+__IEEE80211_IF_FILE_W(uapsd_max_sp_len);
+
 /* AP attributes */
-IEEE80211_IF_FILE(num_sta_authorized, u.ap.num_sta_authorized, ATOMIC);
+IEEE80211_IF_FILE(num_mcast_sta, u.ap.num_mcast_sta, ATOMIC);
 IEEE80211_IF_FILE(num_sta_ps, u.ap.num_sta_ps, ATOMIC);
 IEEE80211_IF_FILE(dtim_count, u.ap.dtim_count, DEC);
 
@@ -351,6 +424,7 @@ static ssize_t ieee80211_if_parse_tsf(
         struct ieee80211_local *local = sdata->local;
         unsigned long long tsf;
         int ret;
+        int tsf_is_delta = 0;
 
         if (strncmp(buf, "reset", 5) == 0) {
                 if (local->ops->reset_tsf) {
@@ -358,9 +432,20 @@ static ssize_t ieee80211_if_parse_tsf(
                         wiphy_info(local->hw.wiphy, "debugfs reset TSF\n");
                 }
         } else {
+                if (buflen > 10 && buf[1] == '=') {
+                        if (buf[0] == '+')
+                                tsf_is_delta = 1;
+                        else if (buf[0] == '-')
+                                tsf_is_delta = -1;
+                        else
+                                return -EINVAL;
+                        buf += 2;
+                }
                 ret = kstrtoull(buf, 10, &tsf);
                 if (ret < 0)
                         return -EINVAL;
+                if (tsf_is_delta)
+                        tsf = drv_get_tsf(local, sdata) + tsf_is_delta * tsf;
                 if (local->ops->set_tsf) {
                         drv_set_tsf(local, sdata, tsf);
                         wiphy_info(local->hw.wiphy,
@@ -422,44 +507,41 @@ IEEE80211_IF_FILE(dot11MeshGateAnnouncementProtocol,
                 u.mesh.mshcfg.dot11MeshGateAnnouncementProtocol, DEC);
 IEEE80211_IF_FILE(dot11MeshHWMPRannInterval,
                 u.mesh.mshcfg.dot11MeshHWMPRannInterval, DEC);
+IEEE80211_IF_FILE(dot11MeshForwarding, u.mesh.mshcfg.dot11MeshForwarding, DEC);
+IEEE80211_IF_FILE(rssi_threshold, u.mesh.mshcfg.rssi_threshold, DEC);
+IEEE80211_IF_FILE(ht_opmode, u.mesh.mshcfg.ht_opmode, DEC);
 #endif
 
-
-#define DEBUGFS_ADD(name) \
-        debugfs_create_file(#name, 0400, sdata->debugfs.dir, \
-                            sdata, &name##_ops);
-
 #define DEBUGFS_ADD_MODE(name, mode) \
         debugfs_create_file(#name, mode, sdata->debugfs.dir, \
                             sdata, &name##_ops);
 
-static void add_sta_files(struct ieee80211_sub_if_data *sdata)
+#define DEBUGFS_ADD(name) DEBUGFS_ADD_MODE(name, 0400)
+
+static void add_common_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(drop_unencrypted);
-        DEBUGFS_ADD(flags);
-        DEBUGFS_ADD(state);
-        DEBUGFS_ADD(channel_type);
         DEBUGFS_ADD(rc_rateidx_mask_2ghz);
         DEBUGFS_ADD(rc_rateidx_mask_5ghz);
+        DEBUGFS_ADD(rc_rateidx_mcs_mask_2ghz);
+        DEBUGFS_ADD(rc_rateidx_mcs_mask_5ghz);
+}
 
+static void add_sta_files(struct ieee80211_sub_if_data *sdata)
+{
         DEBUGFS_ADD(bssid);
         DEBUGFS_ADD(aid);
         DEBUGFS_ADD(last_beacon);
         DEBUGFS_ADD(ave_beacon);
         DEBUGFS_ADD_MODE(smps, 0600);
         DEBUGFS_ADD_MODE(tkip_mic_test, 0200);
+        DEBUGFS_ADD_MODE(uapsd_queues, 0600);
+        DEBUGFS_ADD_MODE(uapsd_max_sp_len, 0600);
 }
 
 static void add_ap_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(drop_unencrypted);
-        DEBUGFS_ADD(flags);
-        DEBUGFS_ADD(state);
-        DEBUGFS_ADD(channel_type);
-        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
-        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
-
-        DEBUGFS_ADD(num_sta_authorized);
+        DEBUGFS_ADD(num_mcast_sta);
         DEBUGFS_ADD(num_sta_ps);
         DEBUGFS_ADD(dtim_count);
         DEBUGFS_ADD(num_buffered_multicast);
@@ -473,40 +555,20 @@ static void add_ibss_files(struct ieee80211_sub_if_data *sdata)
 
 static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(drop_unencrypted);
-        DEBUGFS_ADD(flags);
-        DEBUGFS_ADD(state);
-        DEBUGFS_ADD(channel_type);
-        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
-        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
-
         DEBUGFS_ADD(peer);
 }
 
-static void add_vlan_files(struct ieee80211_sub_if_data *sdata)
-{
-        DEBUGFS_ADD(drop_unencrypted);
-        DEBUGFS_ADD(flags);
-        DEBUGFS_ADD(state);
-        DEBUGFS_ADD(channel_type);
-        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
-        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
-}
+#ifdef CONFIG_MAC80211_MESH
 
-static void add_monitor_files(struct ieee80211_sub_if_data *sdata)
+static void add_mesh_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(flags);
-        DEBUGFS_ADD(state);
-        DEBUGFS_ADD(channel_type);
+        DEBUGFS_ADD_MODE(tsf, 0600);
 }
 
-#ifdef CONFIG_MAC80211_MESH
-
 static void add_mesh_stats(struct ieee80211_sub_if_data *sdata)
 {
         struct dentry *dir = debugfs_create_dir("mesh_stats",
                                                 sdata->debugfs.dir);
-
 #define MESHSTATS_ADD(name)\
         debugfs_create_file(#name, 0400, dir, sdata, &name##_ops);
 
@@ -546,6 +608,8 @@ static void add_mesh_config(struct ieee80211_sub_if_data *sdata)
         MESHPARAMS_ADD(dot11MeshHWMPRootMode);
         MESHPARAMS_ADD(dot11MeshHWMPRannInterval);
         MESHPARAMS_ADD(dot11MeshGateAnnouncementProtocol);
+        MESHPARAMS_ADD(rssi_threshold);
+        MESHPARAMS_ADD(ht_opmode);
 #undef MESHPARAMS_ADD
 }
 #endif
@@ -555,9 +619,17 @@ static void add_files(struct ieee80211_sub_if_data *sdata)
         if (!sdata->debugfs.dir)
                 return;
 
+        DEBUGFS_ADD(flags);
+        DEBUGFS_ADD(state);
+        DEBUGFS_ADD(channel_type);
+
+        if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                add_common_files(sdata);
+
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_MESH_POINT:
 #ifdef CONFIG_MAC80211_MESH
+                add_mesh_files(sdata);
                 add_mesh_stats(sdata);
                 add_mesh_config(sdata);
 #endif
@@ -574,12 +646,6 @@ static void add_files(struct ieee80211_sub_if_data *sdata)
         case NL80211_IFTYPE_WDS:
                 add_wds_files(sdata);
                 break;
-        case NL80211_IFTYPE_MONITOR:
-                add_monitor_files(sdata);
-                break;
-        case NL80211_IFTYPE_AP_VLAN:
-                add_vlan_files(sdata);
-                break;
         default:
                 break;
         }
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index d86217d56bd7..5ccec2c1e9f6 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -33,7 +33,7 @@ static ssize_t sta_ ##name## _read(struct file *file,			\
 #define STA_OPS(name)                                                   \
 static const struct file_operations sta_ ##name## _ops = {              \
         .read = sta_##name##_read,                                      \
-        .open = mac80211_open_file_generic,                             \
+        .open = simple_open,                                            \
         .llseek = generic_file_llseek,                                  \
 }
 
@@ -41,7 +41,7 @@ static const struct file_operations sta_ ##name## _ops = {		\
 static const struct file_operations sta_ ##name## _ops = {              \
         .read = sta_##name##_read,                                      \
         .write = sta_##name##_write,                                    \
-        .open = mac80211_open_file_generic,                             \
+        .open = simple_open,                                            \
         .llseek = generic_file_llseek,                                  \
 }
 
@@ -63,14 +63,16 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
         test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
 
         int res = scnprintf(buf, sizeof(buf),
-                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
+                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
                             TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
                             TEST(PS_DRIVER), TEST(AUTHORIZED),
                             TEST(SHORT_PREAMBLE),
                             TEST(WME), TEST(WDS), TEST(CLEAR_PS_FILT),
                             TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
                             TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
-                            TEST(TDLS_PEER_AUTH), TEST(RATE_CONTROL));
+                            TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
+                            TEST(INSERTED), TEST(RATE_CONTROL),
+                            TEST(TOFFSET_KNOWN));
 #undef TEST
         return simple_read_from_buffer(userbuf, count, ppos, buf, res);
 }
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index e8960ae39861..6d33a0c743ab 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -7,7 +7,9 @@
 
 static inline void check_sdata_in_driver(struct ieee80211_sub_if_data *sdata)
 {
-        WARN_ON(!(sdata->flags & IEEE80211_SDATA_IN_DRIVER));
+        WARN(!(sdata->flags & IEEE80211_SDATA_IN_DRIVER),
+             "%s:  Failed check-sdata-in-driver check, flags: 0x%x\n",
+             sdata->dev->name, sdata->flags);
 }
 
 static inline struct ieee80211_sub_if_data *
@@ -33,6 +35,43 @@ static inline void drv_tx_frags(struct ieee80211_local *local,
         local->ops->tx_frags(&local->hw, vif, sta, skbs);
 }
 
+static inline void drv_get_et_strings(struct ieee80211_sub_if_data *sdata,
+                                      u32 sset, u8 *data)
+{
+        struct ieee80211_local *local = sdata->local;
+        if (local->ops->get_et_strings) {
+                trace_drv_get_et_strings(local, sset);
+                local->ops->get_et_strings(&local->hw, &sdata->vif, sset, data);
+                trace_drv_return_void(local);
+        }
+}
+
+static inline void drv_get_et_stats(struct ieee80211_sub_if_data *sdata,
+                                    struct ethtool_stats *stats,
+                                    u64 *data)
+{
+        struct ieee80211_local *local = sdata->local;
+        if (local->ops->get_et_stats) {
+                trace_drv_get_et_stats(local);
+                local->ops->get_et_stats(&local->hw, &sdata->vif, stats, data);
+                trace_drv_return_void(local);
+        }
+}
+
+static inline int drv_get_et_sset_count(struct ieee80211_sub_if_data *sdata,
+                                        int sset)
+{
+        struct ieee80211_local *local = sdata->local;
+        int rv = 0;
+        if (local->ops->get_et_sset_count) {
+                trace_drv_get_et_sset_count(local, sset);
+                rv = local->ops->get_et_sset_count(&local->hw, &sdata->vif,
+                                                   sset);
+                trace_drv_return_int(local, rv);
+        }
+        return rv;
+}
+
 static inline int drv_start(struct ieee80211_local *local)
 {
         int ret;
@@ -89,6 +128,19 @@ static inline int drv_resume(struct ieee80211_local *local)
         trace_drv_return_int(local, ret);
         return ret;
 }
+
+static inline void drv_set_wakeup(struct ieee80211_local *local,
+                                  bool enabled)
+{
+        might_sleep();
+
+        if (!local->ops->set_wakeup)
+                return;
+
+        trace_drv_set_wakeup(local, enabled);
+        local->ops->set_wakeup(&local->hw, enabled);
+        trace_drv_return_void(local);
+}
 #endif
 
 static inline int drv_add_interface(struct ieee80211_local *local,
@@ -99,7 +151,8 @@ static inline int drv_add_interface(struct ieee80211_local *local,
         might_sleep();
 
         if (WARN_ON(sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
-                    sdata->vif.type == NL80211_IFTYPE_MONITOR))
+                    (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
+                     !(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))))
                 return -EINVAL;
 
         trace_drv_add_interface(local, sdata);
@@ -168,41 +221,6 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local,
         trace_drv_return_void(local);
 }
 
-static inline int drv_tx_sync(struct ieee80211_local *local,
-                              struct ieee80211_sub_if_data *sdata,
-                              const u8 *bssid,
-                              enum ieee80211_tx_sync_type type)
-{
-        int ret = 0;
-
-        might_sleep();
-
-        check_sdata_in_driver(sdata);
-
-        trace_drv_tx_sync(local, sdata, bssid, type);
-        if (local->ops->tx_sync)
-                ret = local->ops->tx_sync(&local->hw, &sdata->vif,
-                                          bssid, type);
-        trace_drv_return_int(local, ret);
-        return ret;
-}
-
-static inline void drv_finish_tx_sync(struct ieee80211_local *local,
-                                      struct ieee80211_sub_if_data *sdata,
-                                      const u8 *bssid,
-                                      enum ieee80211_tx_sync_type type)
-{
-        might_sleep();
-
-        check_sdata_in_driver(sdata);
-
-        trace_drv_finish_tx_sync(local, sdata, bssid, type);
-        if (local->ops->finish_tx_sync)
-                local->ops->finish_tx_sync(&local->hw, &sdata->vif,
-                                           bssid, type);
-        trace_drv_return_void(local);
-}
-
 static inline u64 drv_prepare_multicast(struct ieee80211_local *local,
                                         struct netdev_hw_addr_list *mc_list)
 {
@@ -253,6 +271,7 @@ static inline int drv_set_key(struct ieee80211_local *local,
 
         might_sleep();
 
+        sdata = get_bss_sdata(sdata);
         check_sdata_in_driver(sdata);
 
         trace_drv_set_key(local, cmd, sdata, sta, key);
@@ -272,6 +291,7 @@ static inline void drv_update_tkip_key(struct ieee80211_local *local,
         if (sta)
                 ista = &sta->sta;
 
+        sdata = get_bss_sdata(sdata);
         check_sdata_in_driver(sdata);
 
         trace_drv_update_tkip_key(local, sdata, conf, ista, iv32);
@@ -476,8 +496,54 @@ static inline void drv_sta_remove(struct ieee80211_local *local,
         trace_drv_return_void(local);
 }
 
+static inline __must_check
+int drv_sta_state(struct ieee80211_local *local,
+                  struct ieee80211_sub_if_data *sdata,
+                  struct sta_info *sta,
+                  enum ieee80211_sta_state old_state,
+                  enum ieee80211_sta_state new_state)
+{
+        int ret = 0;
+
+        might_sleep();
+
+        sdata = get_bss_sdata(sdata);
+        check_sdata_in_driver(sdata);
+
+        trace_drv_sta_state(local, sdata, &sta->sta, old_state, new_state);
+        if (local->ops->sta_state) {
+                ret = local->ops->sta_state(&local->hw, &sdata->vif, &sta->sta,
+                                            old_state, new_state);
+        } else if (old_state == IEEE80211_STA_AUTH &&
+                   new_state == IEEE80211_STA_ASSOC) {
+                ret = drv_sta_add(local, sdata, &sta->sta);
+                if (ret == 0)
+                        sta->uploaded = true;
+        } else if (old_state == IEEE80211_STA_ASSOC &&
+                   new_state == IEEE80211_STA_AUTH) {
+                drv_sta_remove(local, sdata, &sta->sta);
+        }
+        trace_drv_return_int(local, ret);
+        return ret;
+}
+
+static inline void drv_sta_rc_update(struct ieee80211_local *local,
+                                     struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_sta *sta, u32 changed)
+{
+        sdata = get_bss_sdata(sdata);
+        check_sdata_in_driver(sdata);
+
+        trace_drv_sta_rc_update(local, sdata, sta, changed);
+        if (local->ops->sta_rc_update)
+                local->ops->sta_rc_update(&local->hw, &sdata->vif,
+                                          sta, changed);
+
+        trace_drv_return_void(local);
+}
+
 static inline int drv_conf_tx(struct ieee80211_local *local,
-                              struct ieee80211_sub_if_data *sdata, u16 queue,
+                              struct ieee80211_sub_if_data *sdata, u16 ac,
                               const struct ieee80211_tx_queue_params *params)
 {
         int ret = -EOPNOTSUPP;
@@ -486,10 +552,10 @@ static inline int drv_conf_tx(struct ieee80211_local *local,
 
         check_sdata_in_driver(sdata);
 
-        trace_drv_conf_tx(local, sdata, queue, params);
+        trace_drv_conf_tx(local, sdata, ac, params);
         if (local->ops->conf_tx)
                 ret = local->ops->conf_tx(&local->hw, &sdata->vif,
-                                          queue, params);
+                                          ac, params);
         trace_drv_return_int(local, ret);
         return ret;
 }
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 6e9df8fd8fb8..6de00b2c268c 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -161,6 +161,21 @@ DEFINE_EVENT(local_only_evt, drv_start,
         TP_ARGS(local)
 );
 
+DEFINE_EVENT(local_u32_evt, drv_get_et_strings,
+             TP_PROTO(struct ieee80211_local *local, u32 sset),
+             TP_ARGS(local, sset)
+);
+
+DEFINE_EVENT(local_u32_evt, drv_get_et_sset_count,
+             TP_PROTO(struct ieee80211_local *local, u32 sset),
+             TP_ARGS(local, sset)
+);
+
+DEFINE_EVENT(local_only_evt, drv_get_et_stats,
+             TP_PROTO(struct ieee80211_local *local),
+             TP_ARGS(local)
+);
+
 DEFINE_EVENT(local_only_evt, drv_suspend,
         TP_PROTO(struct ieee80211_local *local),
         TP_ARGS(local)
@@ -171,6 +186,20 @@ DEFINE_EVENT(local_only_evt, drv_resume,
         TP_ARGS(local)
 );
 
+TRACE_EVENT(drv_set_wakeup,
+        TP_PROTO(struct ieee80211_local *local, bool enabled),
+        TP_ARGS(local, enabled),
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(bool, enabled)
+        ),
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->enabled = enabled;
+        ),
+        TP_printk(LOCAL_PR_FMT " enabled:%d", LOCAL_PR_ARG, __entry->enabled)
+);
+
 DEFINE_EVENT(local_only_evt, drv_stop,
         TP_PROTO(struct ieee80211_local *local),
         TP_ARGS(local)
@@ -296,7 +325,7 @@ TRACE_EVENT(drv_bss_info_changed,
                 __entry->dtimper = info->dtim_period;
                 __entry->bcnint = info->beacon_int;
                 __entry->assoc_cap = info->assoc_capability;
-                __entry->timestamp = info->timestamp;
+                __entry->timestamp = info->last_tsf;
                 __entry->basic_rates = info->basic_rates;
                 __entry->enable_beacon = info->enable_beacon;
                 __entry->ht_operation_mode = info->ht_operation_mode;
@@ -308,49 +337,6 @@ TRACE_EVENT(drv_bss_info_changed,
         )
 );
 
-DECLARE_EVENT_CLASS(tx_sync_evt,
-        TP_PROTO(struct ieee80211_local *local,
-                 struct ieee80211_sub_if_data *sdata,
-                 const u8 *bssid,
-                 enum ieee80211_tx_sync_type type),
-        TP_ARGS(local, sdata, bssid, type),
-
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-                VIF_ENTRY
-                __array(char, bssid, ETH_ALEN)
-                __field(u32, sync_type)
-        ),
-
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-                VIF_ASSIGN;
-                memcpy(__entry->bssid, bssid, ETH_ALEN);
-                __entry->sync_type = type;
-        ),
-
-        TP_printk(
-                LOCAL_PR_FMT  VIF_PR_FMT " bssid:%pM type:%d",
-                LOCAL_PR_ARG, VIF_PR_ARG, __entry->bssid, __entry->sync_type
-        )
-);
-
-DEFINE_EVENT(tx_sync_evt, drv_tx_sync,
-        TP_PROTO(struct ieee80211_local *local,
-                 struct ieee80211_sub_if_data *sdata,
-                 const u8 *bssid,
-                 enum ieee80211_tx_sync_type type),
-        TP_ARGS(local, sdata, bssid, type)
-);
-
-DEFINE_EVENT(tx_sync_evt, drv_finish_tx_sync,
-        TP_PROTO(struct ieee80211_local *local,
-                 struct ieee80211_sub_if_data *sdata,
-                 const u8 *bssid,
-                 enum ieee80211_tx_sync_type type),
-        TP_ARGS(local, sdata, bssid, type)
-);
-
 TRACE_EVENT(drv_prepare_multicast,
         TP_PROTO(struct ieee80211_local *local, int mc_count),
 
@@ -635,6 +621,66 @@ TRACE_EVENT(drv_sta_notify,
         )
 );
 
+TRACE_EVENT(drv_sta_state,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 struct ieee80211_sta *sta,
+                 enum ieee80211_sta_state old_state,
+                 enum ieee80211_sta_state new_state),
+
+        TP_ARGS(local, sdata, sta, old_state, new_state),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                STA_ENTRY
+                __field(u32, old_state)
+                __field(u32, new_state)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                STA_ASSIGN;
+                __entry->old_state = old_state;
+                __entry->new_state = new_state;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT  STA_PR_FMT " state: %d->%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG,
+                __entry->old_state, __entry->new_state
+        )
+);
+
+TRACE_EVENT(drv_sta_rc_update,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 struct ieee80211_sta *sta,
+                 u32 changed),
+
+        TP_ARGS(local, sdata, sta, changed),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                STA_ENTRY
+                __field(u32, changed)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                STA_ASSIGN;
+                __entry->changed = changed;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT  STA_PR_FMT " changed: 0x%x",
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->changed
+        )
+);
+
 TRACE_EVENT(drv_sta_add,
         TP_PROTO(struct ieee80211_local *local,
                  struct ieee80211_sub_if_data *sdata,
@@ -688,15 +734,14 @@ TRACE_EVENT(drv_sta_remove,
 TRACE_EVENT(drv_conf_tx,
         TP_PROTO(struct ieee80211_local *local,
                  struct ieee80211_sub_if_data *sdata,
-                 u16 queue,
-                 const struct ieee80211_tx_queue_params *params),
+                 u16 ac, const struct ieee80211_tx_queue_params *params),
 
-        TP_ARGS(local, sdata, queue, params),
+        TP_ARGS(local, sdata, ac, params),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
                 VIF_ENTRY
-                __field(u16, queue)
+                __field(u16, ac)
                 __field(u16, txop)
                 __field(u16, cw_min)
                 __field(u16, cw_max)
@@ -707,7 +752,7 @@ TRACE_EVENT(drv_conf_tx,
         TP_fast_assign(
                 LOCAL_ASSIGN;
                 VIF_ASSIGN;
-                __entry->queue = queue;
+                __entry->ac = ac;
                 __entry->txop = params->txop;
                 __entry->cw_max = params->cw_max;
                 __entry->cw_min = params->cw_min;
@@ -716,8 +761,8 @@ TRACE_EVENT(drv_conf_tx,
         ),
 
         TP_printk(
-                LOCAL_PR_FMT  VIF_PR_FMT  " queue:%d",
-                LOCAL_PR_ARG, VIF_PR_ARG, __entry->queue
+                LOCAL_PR_FMT  VIF_PR_FMT  " AC:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->ac
         )
 );
 
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index f25fff7607d8..6f8615c54b22 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -19,15 +19,6 @@
 #include "ieee80211_i.h"
 #include "rate.h"
 
-bool ieee80111_cfg_override_disables_ht40(struct ieee80211_sub_if_data *sdata)
-{
-        const __le16 flg = cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40);
-        if ((sdata->u.mgd.ht_capa_mask.cap_info & flg) &&
-            !(sdata->u.mgd.ht_capa.cap_info & flg))
-                return true;
-        return false;
-}
-
 static void __check_htcap_disable(struct ieee80211_sub_if_data *sdata,
                                   struct ieee80211_sta_ht_cap *ht_cap,
                                   u16 flag)
@@ -315,10 +306,10 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
         initiator = (params & IEEE80211_DELBA_PARAM_INITIATOR_MASK) >> 11;
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
-        if (net_ratelimit())
-                printk(KERN_DEBUG "delba from %pM (%s) tid %d reason code %d\n",
-                        mgmt->sa, initiator ? "initiator" : "recipient", tid,
-                        le16_to_cpu(mgmt->u.action.u.delba.reason_code));
+        net_dbg_ratelimited("delba from %pM (%s) tid %d reason code %d\n",
+                            mgmt->sa, initiator ? "initiator" : "recipient",
+                            tid,
+                            le16_to_cpu(mgmt->u.action.u.delba.reason_code));
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         if (initiator == WLAN_BACK_INITIATOR)
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index a4643969a13b..33d9d0c3e3d0 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -20,7 +20,6 @@
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
 #include <net/mac80211.h>
-#include <asm/unaligned.h>
 
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -36,31 +35,6 @@
 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
 
 
-static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
-                                        struct ieee80211_mgmt *mgmt,
-                                        size_t len)
-{
-        u16 auth_alg, auth_transaction;
-
-        lockdep_assert_held(&sdata->u.ibss.mtx);
-
-        if (len < 24 + 6)
-                return;
-
-        auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
-        auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
-
-        /*
-         * IEEE 802.11 standard does not require authentication in IBSS
-         * networks and most implementations do not seem to use it.
-         * However, try to reply to authentication attempts if someone
-         * has actually implemented this.
-         */
-        if (auth_alg == WLAN_AUTH_OPEN && auth_transaction == 1)
-                ieee80211_send_auth(sdata, 2, WLAN_AUTH_OPEN, NULL, 0,
-                                    sdata->u.ibss.bssid, NULL, 0, 0);
-}
-
 static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                                       const u8 *bssid, const int beacon_int,
                                       struct ieee80211_channel *chan,
@@ -92,7 +66,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         skb_reset_tail_pointer(skb);
         skb_reserve(skb, sdata->local->hw.extra_tx_headroom);
 
-        if (memcmp(ifibss->bssid, bssid, ETH_ALEN))
+        if (!ether_addr_equal(ifibss->bssid, bssid))
                 sta_info_flush(sdata->local, sdata);
 
         /* if merging, indicate to driver that we leave the old IBSS */
@@ -186,16 +160,19 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         if (channel_type && sband->ht_cap.ht_supported) {
                 pos = skb_put(skb, 4 +
                                    sizeof(struct ieee80211_ht_cap) +
-                                   sizeof(struct ieee80211_ht_info));
+                                   sizeof(struct ieee80211_ht_operation));
                 pos = ieee80211_ie_build_ht_cap(pos, &sband->ht_cap,
                                                 sband->ht_cap.cap);
-                pos = ieee80211_ie_build_ht_info(pos,
-                                                 &sband->ht_cap,
-                                                 chan,
-                                                 channel_type);
+                /*
+                 * Note: According to 802.11n-2009 9.13.3.1, HT Protection
+                 * field and RIFS Mode are reserved in IBSS mode, therefore
+                 * keep them at 0
+                 */
+                pos = ieee80211_ie_build_ht_oper(pos, &sband->ht_cap,
+                                                 chan, channel_type, 0);
         }
 
-        if (local->hw.queues >= 4) {
+        if (local->hw.queues >= IEEE80211_NUM_ACS) {
                 pos = skb_put(skb, 9);
                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
                 *pos++ = 7; /* len */
@@ -276,7 +253,8 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                                   cbss->tsf);
 }
 
-static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta)
+static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta,
+                                                  bool auth)
         __acquires(RCU)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -290,22 +268,34 @@ static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta)
                     addr, sdata->name);
 #endif
 
-        sta_info_move_state(sta, IEEE80211_STA_AUTH);
-        sta_info_move_state(sta, IEEE80211_STA_ASSOC);
-        sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
+        sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
+        sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
+        /* authorize the station only if the network is not RSN protected. If
+         * not wait for the userspace to authorize it */
+        if (!sta->sdata->u.ibss.control_port)
+                sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 
         rate_control_rate_init(sta);
 
         /* If it fails, maybe we raced another insertion? */
         if (sta_info_insert_rcu(sta))
                 return sta_info_get(sdata, addr);
+        if (auth) {
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+                printk(KERN_DEBUG "TX Auth SA=%pM DA=%pM BSSID=%pM"
+                       "(auth_transaction=1)\n", sdata->vif.addr,
+                       sdata->u.ibss.bssid, addr);
+#endif
+                ieee80211_send_auth(sdata, 1, WLAN_AUTH_OPEN, NULL, 0,
+                                    addr, sdata->u.ibss.bssid, NULL, 0, 0);
+        }
         return sta;
 }
 
 static struct sta_info *
 ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
                        const u8 *bssid, const u8 *addr,
-                       u32 supp_rates)
+                       u32 supp_rates, bool auth)
         __acquires(RCU)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
@@ -318,9 +308,8 @@ ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
          *      allow new one to be added.
          */
         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "%s: No room for a new IBSS STA entry %pM\n",
-                               sdata->name, addr);
+                net_dbg_ratelimited("%s: No room for a new IBSS STA entry %pM\n",
+                                    sdata->name, addr);
                 rcu_read_lock();
                 return NULL;
         }
@@ -330,7 +319,7 @@ ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
                 return NULL;
         }
 
-        if (compare_ether_addr(bssid, sdata->u.ibss.bssid)) {
+        if (!ether_addr_equal(bssid, sdata->u.ibss.bssid)) {
                 rcu_read_lock();
                 return NULL;
         }
@@ -347,7 +336,42 @@ ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
         sta->sta.supp_rates[band] = supp_rates |
                         ieee80211_mandatory_rates(local, band);
 
-        return ieee80211_ibss_finish_sta(sta);
+        return ieee80211_ibss_finish_sta(sta, auth);
+}
+
+static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
+                                        struct ieee80211_mgmt *mgmt,
+                                        size_t len)
+{
+        u16 auth_alg, auth_transaction;
+
+        lockdep_assert_held(&sdata->u.ibss.mtx);
+
+        if (len < 24 + 6)
+                return;
+
+        auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
+        auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
+
+        if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
+                return;
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+        printk(KERN_DEBUG "%s: RX Auth SA=%pM DA=%pM BSSID=%pM."
+               "(auth_transaction=%d)\n",
+               sdata->name, mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction);
+#endif
+        sta_info_destroy_addr(sdata, mgmt->sa);
+        ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, 0, false);
+        rcu_read_unlock();
+
+        /*
+         * IEEE 802.11 standard does not require authentication in IBSS
+         * networks and most implementations do not seem to use it.
+         * However, try to reply to authentication attempts if someone
+         * has actually implemented this.
+         */
+        ieee80211_send_auth(sdata, 2, WLAN_AUTH_OPEN, NULL, 0,
+                            mgmt->sa, sdata->u.ibss.bssid, NULL, 0, 0);
 }
 
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
@@ -381,14 +405,14 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 return;
 
         if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
-            memcmp(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN) == 0) {
+            ether_addr_equal(mgmt->bssid, sdata->u.ibss.bssid)) {
 
                 rcu_read_lock();
                 sta = sta_info_get(sdata, mgmt->sa);
 
                 if (elems->supp_rates) {
                         supp_rates = ieee80211_sta_get_rates(local, elems,
-                                                             band);
+                                                             band, NULL);
                         if (sta) {
                                 u32 prev_rates;
 
@@ -412,20 +436,20 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                         } else {
                                 rcu_read_unlock();
                                 sta = ieee80211_ibss_add_sta(sdata, mgmt->bssid,
-                                                mgmt->sa, supp_rates);
+                                                mgmt->sa, supp_rates, true);
                         }
                 }
 
                 if (sta && elems->wmm_info)
                         set_sta_flag(sta, WLAN_STA_WME);
 
-                if (sta && elems->ht_info_elem && elems->ht_cap_elem &&
+                if (sta && elems->ht_operation && elems->ht_cap_elem &&
                     sdata->u.ibss.channel_type != NL80211_CHAN_NO_HT) {
                         /* we both use HT */
                         struct ieee80211_sta_ht_cap sta_ht_cap_new;
                         enum nl80211_channel_type channel_type =
-                                ieee80211_ht_info_to_channel_type(
-                                                        elems->ht_info_elem);
+                                ieee80211_ht_oper_to_channel_type(
+                                                        elems->ht_operation);
 
                         ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
                                                           elems->ht_cap_elem,
@@ -435,8 +459,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                          * fall back to HT20 if we don't use or use
                          * the other extension channel
                          */
-                        if ((channel_type == NL80211_CHAN_HT40MINUS ||
-                             channel_type == NL80211_CHAN_HT40PLUS) &&
+                        if (!(channel_type == NL80211_CHAN_HT40MINUS ||
+                              channel_type == NL80211_CHAN_HT40PLUS) ||
                             channel_type != sdata->u.ibss.channel_type)
                                 sta_ht_cap_new.cap &=
                                         ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
@@ -486,7 +510,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 goto put_bss;
 
         /* same BSSID */
-        if (memcmp(cbss->bssid, sdata->u.ibss.bssid, ETH_ALEN) == 0)
+        if (ether_addr_equal(cbss->bssid, sdata->u.ibss.bssid))
                 goto put_bss;
 
         if (rx_status->flag & RX_FLAG_MACTIME_MPDU) {
@@ -538,9 +562,9 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                        sdata->name, mgmt->bssid);
 #endif
                 ieee80211_sta_join_ibss(sdata, bss);
-                supp_rates = ieee80211_sta_get_rates(local, elems, band);
+                supp_rates = ieee80211_sta_get_rates(local, elems, band, NULL);
                 ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
-                                       supp_rates);
+                                       supp_rates, true);
                 rcu_read_unlock();
         }
 
@@ -562,16 +586,15 @@ void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
          *      allow new one to be added.
          */
         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "%s: No room for a new IBSS STA entry %pM\n",
-                               sdata->name, addr);
+                net_dbg_ratelimited("%s: No room for a new IBSS STA entry %pM\n",
+                                    sdata->name, addr);
                 return;
         }
 
         if (ifibss->state == IEEE80211_IBSS_MLME_SEARCH)
                 return;
 
-        if (compare_ether_addr(bssid, sdata->u.ibss.bssid))
+        if (!ether_addr_equal(bssid, sdata->u.ibss.bssid))
                 return;
 
         sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
@@ -643,8 +666,7 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
                "IBSS networks with same SSID (merge)\n", sdata->name);
 
         ieee80211_request_internal_scan(sdata,
-                        ifibss->ssid, ifibss->ssid_len,
-                        ifibss->fixed_channel ? ifibss->channel : NULL);
+                        ifibss->ssid, ifibss->ssid_len, NULL);
 }
 
 static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
@@ -810,8 +832,8 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da))
                 return;
 
-        if (memcmp(mgmt->bssid, ifibss->bssid, ETH_ALEN) != 0 &&
-            memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
+        if (!ether_addr_equal(mgmt->bssid, ifibss->bssid) &&
+            !is_broadcast_ether_addr(mgmt->bssid))
                 return;
 
         end = ((u8 *) mgmt) + len;
@@ -855,9 +877,6 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
         size_t baselen;
         struct ieee802_11_elems elems;
 
-        if (memcmp(mgmt->da, sdata->vif.addr, ETH_ALEN))
-                return; /* ignore ProbeResp to foreign address */
-
         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
         if (baselen > len)
                 return;
@@ -945,7 +964,7 @@ void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
                 list_del(&sta->list);
                 spin_unlock_bh(&ifibss->incomplete_lock);
 
-                ieee80211_ibss_finish_sta(sta);
+                ieee80211_ibss_finish_sta(sta, true);
                 rcu_read_unlock();
                 spin_lock_bh(&ifibss->incomplete_lock);
         }
@@ -1045,7 +1064,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
                             4 /* IBSS params */ +
                             2 + (IEEE80211_MAX_SUPP_RATES - 8) +
                             2 + sizeof(struct ieee80211_ht_cap) +
-                            2 + sizeof(struct ieee80211_ht_info) +
+                            2 + sizeof(struct ieee80211_ht_operation) +
                             params->ie_len);
         if (!skb)
                 return -ENOMEM;
@@ -1059,6 +1078,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
                 sdata->u.ibss.fixed_bssid = false;
 
         sdata->u.ibss.privacy = params->privacy;
+        sdata->u.ibss.control_port = params->control_port;
         sdata->u.ibss.basic_rates = params->basic_rates;
         memcpy(sdata->vif.bss_conf.mcast_rate, params->mcast_rate,
                sizeof(params->mcast_rate));
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 2f0642d9e154..3f3cd50fff16 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -52,7 +52,8 @@ struct ieee80211_local;
  * increased memory use (about 2 kB of RAM per entry). */
 #define IEEE80211_FRAGMENT_MAX 4
 
-#define TU_TO_EXP_TIME(x)       (jiffies + usecs_to_jiffies((x) * 1024))
+#define TU_TO_JIFFIES(x)        (usecs_to_jiffies((x) * 1024))
+#define TU_TO_EXP_TIME(x)       (jiffies + TU_TO_JIFFIES(x))
 
 #define IEEE80211_DEFAULT_UAPSD_QUEUES \
         (IEEE80211_WMM_IE_STA_QOSINFO_AC_BK |   \
@@ -105,6 +106,44 @@ struct ieee80211_bss {
          */
         bool has_erp_value;
         u8 erp_value;
+
+        /* Keep track of the corruption of the last beacon/probe response. */
+        u8 corrupt_data;
+
+        /* Keep track of what bits of information we have valid info for. */
+        u8 valid_data;
+};
+
+/**
+ * enum ieee80211_corrupt_data_flags - BSS data corruption flags
+ * @IEEE80211_BSS_CORRUPT_BEACON: last beacon frame received was corrupted
+ * @IEEE80211_BSS_CORRUPT_PROBE_RESP: last probe response received was corrupted
+ *
+ * These are bss flags that are attached to a bss in the
+ * @corrupt_data field of &struct ieee80211_bss.
+ */
+enum ieee80211_bss_corrupt_data_flags {
+        IEEE80211_BSS_CORRUPT_BEACON            = BIT(0),
+        IEEE80211_BSS_CORRUPT_PROBE_RESP        = BIT(1)
+};
+
+/**
+ * enum ieee80211_valid_data_flags - BSS valid data flags
+ * @IEEE80211_BSS_VALID_DTIM: DTIM data was gathered from non-corrupt IE
+ * @IEEE80211_BSS_VALID_WMM: WMM/UAPSD data was gathered from non-corrupt IE
+ * @IEEE80211_BSS_VALID_RATES: Supported rates were gathered from non-corrupt IE
+ * @IEEE80211_BSS_VALID_ERP: ERP flag was gathered from non-corrupt IE
+ *
+ * These are bss flags that are attached to a bss in the
+ * @valid_data field of &struct ieee80211_bss.  They show which parts
+ * of the data structure were recieved as a result of an un-corrupted
+ * beacon/probe response.
+ */
+enum ieee80211_bss_valid_data_flags {
+        IEEE80211_BSS_VALID_DTIM                = BIT(0),
+        IEEE80211_BSS_VALID_WMM                 = BIT(1),
+        IEEE80211_BSS_VALID_RATES               = BIT(2),
+        IEEE80211_BSS_VALID_ERP                 = BIT(3)
 };
 
 static inline u8 *bss_mesh_cfg(struct ieee80211_bss *bss)
@@ -228,7 +267,7 @@ struct ieee80211_rx_data {
 struct beacon_data {
         u8 *head, *tail;
         int head_len, tail_len;
-        int dtim_period;
+        struct rcu_head rcu_head;
 };
 
 struct ieee80211_if_ap {
@@ -243,7 +282,7 @@ struct ieee80211_if_ap {
         u8 tim[sizeof(unsigned long) * BITS_TO_LONGS(IEEE80211_MAX_AID + 1)];
         struct sk_buff_head ps_bc_buf;
         atomic_t num_sta_ps; /* number of stations in PS mode */
-        atomic_t num_sta_authorized; /* number of authorized stations */
+        atomic_t num_mcast_sta; /* number of stations receiving multicast */
         int dtim_count;
         bool dtim_bc_mc;
 };
@@ -280,10 +319,6 @@ struct mesh_preq_queue {
 
 enum ieee80211_work_type {
         IEEE80211_WORK_ABORT,
-        IEEE80211_WORK_DIRECT_PROBE,
-        IEEE80211_WORK_AUTH,
-        IEEE80211_WORK_ASSOC_BEACON_WAIT,
-        IEEE80211_WORK_ASSOC,
         IEEE80211_WORK_REMAIN_ON_CHANNEL,
         IEEE80211_WORK_OFFCHANNEL_TX,
 };
@@ -316,36 +351,10 @@ struct ieee80211_work {
         unsigned long timeout;
         enum ieee80211_work_type type;
 
-        u8 filter_ta[ETH_ALEN];
-
         bool started;
 
         union {
                 struct {
-                        int tries;
-                        u16 algorithm, transaction;
-                        u8 ssid[IEEE80211_MAX_SSID_LEN];
-                        u8 ssid_len;
-                        u8 key[WLAN_KEY_LEN_WEP104];
-                        u8 key_len, key_idx;
-                        bool privacy;
-                        bool synced;
-                } probe_auth;
-                struct {
-                        struct cfg80211_bss *bss;
-                        const u8 *supp_rates;
-                        const u8 *ht_information_ie;
-                        enum ieee80211_smps_mode smps;
-                        int tries;
-                        u16 capability;
-                        u8 prev_bssid[ETH_ALEN];
-                        u8 ssid[IEEE80211_MAX_SSID_LEN];
-                        u8 ssid_len;
-                        u8 supp_rates_len;
-                        bool wmm_used, use_11n, uapsd_used;
-                        bool synced;
-                } assoc;
-                struct {
                         u32 duration;
                 } remain;
                 struct {
@@ -355,9 +364,8 @@ struct ieee80211_work {
                 } offchan_tx;
         };
 
-        int ie_len;
-        /* must be last */
-        u8 ie[0];
+        size_t data_len;
+        u8 data[];
 };
 
 /* flags used in struct ieee80211_if_managed.flags */
@@ -371,6 +379,43 @@ enum ieee80211_sta_flags {
         IEEE80211_STA_UAPSD_ENABLED     = BIT(7),
         IEEE80211_STA_NULLFUNC_ACKED    = BIT(8),
         IEEE80211_STA_RESET_SIGNAL_AVE  = BIT(9),
+        IEEE80211_STA_DISABLE_40MHZ     = BIT(10),
+};
+
+struct ieee80211_mgd_auth_data {
+        struct cfg80211_bss *bss;
+        unsigned long timeout;
+        int tries;
+        u16 algorithm, expected_transaction;
+
+        u8 key[WLAN_KEY_LEN_WEP104];
+        u8 key_len, key_idx;
+        bool done;
+
+        size_t ie_len;
+        u8 ie[];
+};
+
+struct ieee80211_mgd_assoc_data {
+        struct cfg80211_bss *bss;
+        const u8 *supp_rates;
+        const u8 *ht_operation_ie;
+
+        unsigned long timeout;
+        int tries;
+
+        u16 capability;
+        u8 prev_bssid[ETH_ALEN];
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
+        u8 ssid_len;
+        u8 supp_rates_len;
+        bool wmm, uapsd;
+        bool have_beacon;
+        bool sent_assoc;
+        bool synced;
+
+        size_t ie_len;
+        u8 ie[];
 };
 
 struct ieee80211_if_managed {
@@ -389,6 +434,8 @@ struct ieee80211_if_managed {
 
         struct mutex mtx;
         struct cfg80211_bss *associated;
+        struct ieee80211_mgd_auth_data *auth_data;
+        struct ieee80211_mgd_assoc_data *assoc_data;
 
         u8 bssid[ETH_ALEN];
 
@@ -414,6 +461,20 @@ struct ieee80211_if_managed {
                 IEEE80211_MFP_REQUIRED
         } mfp; /* management frame protection */
 
+        /*
+         * Bitmask of enabled u-apsd queues,
+         * IEEE80211_WMM_IE_STA_QOSINFO_AC_BE & co. Needs a new association
+         * to take effect.
+         */
+        unsigned int uapsd_queues;
+
+        /*
+         * Maximum number of buffered frames AP can deliver during a
+         * service period, IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL or similar.
+         * Needs a new association to take effect.
+         */
+        unsigned int uapsd_max_sp_len;
+
         int wmm_last_param_set;
 
         u8 use_4addr;
@@ -470,7 +531,9 @@ struct ieee80211_if_ibss {
         bool fixed_channel;
         bool privacy;
 
-        u8 bssid[ETH_ALEN];
+        bool control_port;
+
+        u8 bssid[ETH_ALEN] __aligned(2);
         u8 ssid[IEEE80211_MAX_SSID_LEN];
         u8 ssid_len, ie_len;
         u8 *ie;
@@ -491,6 +554,24 @@ struct ieee80211_if_ibss {
         } state;
 };
 
+/**
+ * struct ieee80211_mesh_sync_ops - Extensible synchronization framework interface
+ *
+ * these declarations define the interface, which enables
+ * vendor-specific mesh synchronization
+ *
+ */
+struct ieee802_11_elems;
+struct ieee80211_mesh_sync_ops {
+        void (*rx_bcn_presp)(struct ieee80211_sub_if_data *sdata,
+                             u16 stype,
+                             struct ieee80211_mgmt *mgmt,
+                             struct ieee802_11_elems *elems,
+                             struct ieee80211_rx_status *rx_status);
+        void (*adjust_tbtt)(struct ieee80211_sub_if_data *sdata);
+        /* add other framework functions here */
+};
+
 struct ieee80211_if_mesh {
         struct timer_list housekeeping_timer;
         struct timer_list mesh_path_timer;
@@ -539,6 +620,11 @@ struct ieee80211_if_mesh {
                 IEEE80211_MESH_SEC_AUTHED = 0x1,
                 IEEE80211_MESH_SEC_SECURED = 0x2,
         } security;
+        /* Extensible Synchronization Framework */
+        struct ieee80211_mesh_sync_ops *sync_ops;
+        s64 sync_offset_clockdrift_max;
+        spinlock_t sync_offset_lock;
+        bool adjusting_tbtt;
 };
 
 #ifdef CONFIG_MAC80211_MESH
@@ -605,12 +691,6 @@ struct ieee80211_sub_if_data {
 
         char name[IFNAMSIZ];
 
-        /*
-         * keep track of whether the HT opmode (stored in
-         * vif.bss_info.ht_operation_mode) is valid.
-         */
-        bool ht_opmode_valid;
-
         /* to detect idle changes */
         bool old_idle;
 
@@ -630,7 +710,7 @@ struct ieee80211_sub_if_data {
         __be16 control_port_protocol;
         bool control_port_no_encrypt;
 
-        struct ieee80211_tx_queue_params tx_conf[IEEE80211_MAX_QUEUES];
+        struct ieee80211_tx_queue_params tx_conf[IEEE80211_NUM_ACS];
 
         struct work_struct work;
         struct sk_buff_head skb_queue;
@@ -646,6 +726,7 @@ struct ieee80211_sub_if_data {
 
         /* bitmap of allowed (non-MCS) rate indexes for rate control */
         u32 rc_rateidx_mask[IEEE80211_NUM_BANDS];
+        u8  rc_rateidx_mcs_mask[IEEE80211_NUM_BANDS][IEEE80211_HT_MCS_MASK_LEN];
 
         union {
                 struct ieee80211_if_ap ap;
@@ -699,7 +780,6 @@ enum queue_stop_reason {
         IEEE80211_QUEUE_STOP_REASON_AGGREGATION,
         IEEE80211_QUEUE_STOP_REASON_SUSPEND,
         IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
-        IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE,
 };
 
 #ifdef CONFIG_MAC80211_LEDS
@@ -723,6 +803,8 @@ struct tpt_led_trigger {
  *      well be on the operating channel
  * @SCAN_HW_SCANNING: The hardware is scanning for us, we have no way to
  *      determine if we are on the operating channel or not
+ * @SCAN_ONCHANNEL_SCANNING:  Do a software scan on only the current operating
+ *      channel. This should not interrupt normal traffic.
  * @SCAN_COMPLETED: Set for our scan work function when the driver reported
  *      that the scan completed.
  * @SCAN_ABORTED: Set for our scan work function when the driver reported
@@ -731,6 +813,7 @@ struct tpt_led_trigger {
 enum {
         SCAN_SW_SCANNING,
         SCAN_HW_SCANNING,
+        SCAN_ONCHANNEL_SCANNING,
         SCAN_COMPLETED,
         SCAN_ABORTED,
 };
@@ -769,7 +852,6 @@ struct ieee80211_local {
         struct list_head work_list;
         struct timer_list work_timer;
         struct work_struct work_work;
-        struct sk_buff_head work_skb_queue;
 
         /*
          * private workqueue to mac80211. mac80211 makes this accessible
@@ -970,20 +1052,6 @@ struct ieee80211_local {
                                 */
         unsigned int wmm_acm; /* bit field of ACM bits (BIT(802.1D tag)) */
 
-        /*
-         * Bitmask of enabled u-apsd queues,
-         * IEEE80211_WMM_IE_STA_QOSINFO_AC_BE & co. Needs a new association
-         * to take effect.
-         */
-        unsigned int uapsd_queues;
-
-        /*
-         * Maximum number of buffered frames AP can deliver during a
-         * service period, IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL or similar.
-         * Needs a new association to take effect.
-         */
-        unsigned int uapsd_max_sp_len;
-
         bool pspolling;
         bool offchannel_ps_enabled;
         /*
@@ -1035,6 +1103,9 @@ struct ieee80211_local {
         struct net_device napi_dev;
 
         struct napi_struct napi;
+
+        /* virtual monitor interface */
+        struct ieee80211_sub_if_data __rcu *monitor_sdata;
 };
 
 static inline struct ieee80211_sub_if_data *
@@ -1070,7 +1141,7 @@ struct ieee802_11_elems {
         u8 *wmm_info;
         u8 *wmm_param;
         struct ieee80211_ht_cap *ht_cap_elem;
-        struct ieee80211_ht_info *ht_info_elem;
+        struct ieee80211_ht_operation *ht_operation;
         struct ieee80211_meshconf_ie *mesh_config;
         u8 *mesh_id;
         u8 *peering;
@@ -1110,6 +1181,9 @@ struct ieee802_11_elems {
         u8 quiet_elem_len;
         u8 num_of_quiet_elem;   /* can be more the one */
         u8 timeout_int_len;
+
+        /* whether a parse error occurred while retrieving these elements */
+        bool parse_error;
 };
 
 static inline struct ieee80211_local *hw_to_local(
@@ -1118,16 +1192,10 @@ static inline struct ieee80211_local *hw_to_local(
         return container_of(hw, struct ieee80211_local, hw);
 }
 
-static inline struct ieee80211_hw *local_to_hw(
-        struct ieee80211_local *local)
-{
-        return &local->hw;
-}
-
 
 static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
 {
-        return compare_ether_addr(raddr, addr) == 0 ||
+        return ether_addr_equal(raddr, addr) ||
                is_broadcast_ether_addr(raddr);
 }
 
@@ -1146,11 +1214,9 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                         struct cfg80211_assoc_request *req);
 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
-                         struct cfg80211_deauth_request *req,
-                         void *cookie);
+                         struct cfg80211_deauth_request *req);
 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
-                           struct cfg80211_disassoc_request *req,
-                           void *cookie);
+                           struct cfg80211_disassoc_request *req);
 void ieee80211_send_pspoll(struct ieee80211_local *local,
                            struct ieee80211_sub_if_data *sdata);
 void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency);
@@ -1168,6 +1234,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                   struct sk_buff *skb);
 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata);
+void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata);
 
 /* IBSS code */
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
@@ -1196,6 +1263,7 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
                            struct cfg80211_scan_request *req);
 void ieee80211_scan_cancel(struct ieee80211_local *local);
+void ieee80211_run_deferred_scan(struct ieee80211_local *local);
 ieee80211_rx_result
 ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 
@@ -1208,9 +1276,6 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                           struct ieee802_11_elems *elems,
                           struct ieee80211_channel *channel,
                           bool beacon);
-struct ieee80211_bss *
-ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
-                     u8 *ssid, u8 ssid_len);
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
                           struct ieee80211_bss *bss);
 
@@ -1256,7 +1321,6 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                                        struct net_device *dev);
 
 /* HT */
-bool ieee80111_cfg_override_disables_ht40(struct ieee80211_sub_if_data *sdata);
 void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_sta_ht_cap *ht_cap);
 void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
@@ -1340,12 +1404,13 @@ static inline int __ieee80211_resume(struct ieee80211_hw *hw)
 extern void *mac80211_wiphy_privid; /* for wiphy privid */
 u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
                         enum nl80211_iftype type);
-int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
+int ieee80211_frame_duration(enum ieee80211_band band, size_t len,
                              int rate, int erp, int short_preamble);
 void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int keyidx,
                                      struct ieee80211_hdr *hdr, const u8 *tsc,
                                      gfp_t gfp);
-void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata);
+void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
+                               bool bss_notify);
 void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 
 void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,
@@ -1385,18 +1450,22 @@ void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
                                     enum queue_stop_reason reason);
 void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
                                     enum queue_stop_reason reason);
+void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue);
 void ieee80211_add_pending_skb(struct ieee80211_local *local,
                                struct sk_buff *skb);
-void ieee80211_add_pending_skbs(struct ieee80211_local *local,
-                                struct sk_buff_head *skbs);
 void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
                                    struct sk_buff_head *skbs,
                                    void (*fn)(void *data), void *data);
+static inline void ieee80211_add_pending_skbs(struct ieee80211_local *local,
+                                              struct sk_buff_head *skbs)
+{
+        ieee80211_add_pending_skbs_fn(local, skbs, NULL, NULL);
+}
 
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg,
                          u8 *extra, size_t extra_len, const u8 *bssid,
-                         const u8 *key, u8 key_len, u8 key_idx);
+                         const u8 *da, const u8 *key, u8 key_len, u8 key_idx);
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                              const u8 *ie, size_t ie_len,
                              enum ieee80211_band band, u32 rate_mask,
@@ -1416,7 +1485,7 @@ void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
                                   const u8 *supp_rates);
 u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
                             struct ieee802_11_elems *elems,
-                            enum ieee80211_band band);
+                            enum ieee80211_band band, u32 *basic_rates);
 int __ieee80211_request_smps(struct ieee80211_sub_if_data *sdata,
                              enum ieee80211_smps_mode smps_mode);
 void ieee80211_recalc_smps(struct ieee80211_local *local);
@@ -1426,18 +1495,16 @@ size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
 size_t ieee80211_ie_split_vendor(const u8 *ies, size_t ielen, size_t offset);
 u8 *ieee80211_ie_build_ht_cap(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
                               u16 cap);
-u8 *ieee80211_ie_build_ht_info(u8 *pos,
-                                struct ieee80211_sta_ht_cap *ht_cap,
-                                struct ieee80211_channel *channel,
-                                enum nl80211_channel_type channel_type);
+u8 *ieee80211_ie_build_ht_oper(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
+                               struct ieee80211_channel *channel,
+                               enum nl80211_channel_type channel_type,
+                               u16 prot_mode);
 
 /* internal work items */
 void ieee80211_work_init(struct ieee80211_local *local);
 void ieee80211_add_work(struct ieee80211_work *wk);
 void free_work(struct ieee80211_work *wk);
 void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata);
-ieee80211_rx_result ieee80211_work_rx_mgmt(struct ieee80211_sub_if_data *sdata,
-                                           struct sk_buff *skb);
 int ieee80211_wk_remain_on_channel(struct ieee80211_sub_if_data *sdata,
                                    struct ieee80211_channel *chan,
                                    enum nl80211_channel_type channel_type,
@@ -1459,7 +1526,7 @@ bool ieee80211_set_channel_type(struct ieee80211_local *local,
                                 struct ieee80211_sub_if_data *sdata,
                                 enum nl80211_channel_type chantype);
 enum nl80211_channel_type
-ieee80211_ht_info_to_channel_type(struct ieee80211_ht_info *ht_info);
+ieee80211_ht_oper_to_channel_type(struct ieee80211_ht_operation *ht_oper);
 
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 8e2137bd87e2..d4c19a7773db 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -127,7 +127,7 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
                          * The remaining checks are only performed for interfaces
                          * with the same MAC address.
                          */
-                        if (compare_ether_addr(dev->dev_addr, ndev->dev_addr))
+                        if (!ether_addr_equal(dev->dev_addr, ndev->dev_addr))
                                 continue;
 
                         /*
@@ -149,6 +149,35 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
+static int ieee80211_check_queues(struct ieee80211_sub_if_data *sdata)
+{
+        int n_queues = sdata->local->hw.queues;
+        int i;
+
+        for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+                if (WARN_ON_ONCE(sdata->vif.hw_queue[i] ==
+                                 IEEE80211_INVAL_HW_QUEUE))
+                        return -EINVAL;
+                if (WARN_ON_ONCE(sdata->vif.hw_queue[i] >=
+                                 n_queues))
+                        return -EINVAL;
+        }
+
+        if ((sdata->vif.type != NL80211_IFTYPE_AP) ||
+            !(sdata->local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)) {
+                sdata->vif.cab_queue = IEEE80211_INVAL_HW_QUEUE;
+                return 0;
+        }
+
+        if (WARN_ON_ONCE(sdata->vif.cab_queue == IEEE80211_INVAL_HW_QUEUE))
+                return -EINVAL;
+
+        if (WARN_ON_ONCE(sdata->vif.cab_queue >= n_queues))
+                return -EINVAL;
+
+        return 0;
+}
+
 void ieee80211_adjust_monitor_flags(struct ieee80211_sub_if_data *sdata,
                                     const int offset)
 {
@@ -169,6 +198,83 @@ void ieee80211_adjust_monitor_flags(struct ieee80211_sub_if_data *sdata,
 #undef ADJUST
 }
 
+static void ieee80211_set_default_queues(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        int i;
+
+        for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+                if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
+                        sdata->vif.hw_queue[i] = IEEE80211_INVAL_HW_QUEUE;
+                else if (local->hw.queues >= IEEE80211_NUM_ACS)
+                        sdata->vif.hw_queue[i] = i;
+                else
+                        sdata->vif.hw_queue[i] = 0;
+        }
+        sdata->vif.cab_queue = IEEE80211_INVAL_HW_QUEUE;
+}
+
+static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+        int ret;
+
+        if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
+                return 0;
+
+        if (local->monitor_sdata)
+                return 0;
+
+        sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size, GFP_KERNEL);
+        if (!sdata)
+                return -ENOMEM;
+
+        /* set up data */
+        sdata->local = local;
+        sdata->vif.type = NL80211_IFTYPE_MONITOR;
+        snprintf(sdata->name, IFNAMSIZ, "%s-monitor",
+                 wiphy_name(local->hw.wiphy));
+
+        ieee80211_set_default_queues(sdata);
+
+        ret = drv_add_interface(local, sdata);
+        if (WARN_ON(ret)) {
+                /* ok .. stupid driver, it asked for this! */
+                kfree(sdata);
+                return ret;
+        }
+
+        ret = ieee80211_check_queues(sdata);
+        if (ret) {
+                kfree(sdata);
+                return ret;
+        }
+
+        rcu_assign_pointer(local->monitor_sdata, sdata);
+
+        return 0;
+}
+
+static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
+                return;
+
+        sdata = rtnl_dereference(local->monitor_sdata);
+
+        if (!sdata)
+                return;
+
+        rcu_assign_pointer(local->monitor_sdata, NULL);
+        synchronize_net();
+
+        drv_remove_interface(local, sdata);
+
+        kfree(sdata);
+}
+
 /*
  * NOTE: Be very careful when changing this function, it must NOT return
  * an error on interface type changes that have been pre-checked, so most
@@ -246,15 +352,18 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                 memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
 
                 if (!is_valid_ether_addr(dev->dev_addr)) {
-                        if (!local->open_count)
-                                drv_stop(local);
-                        return -EADDRNOTAVAIL;
+                        res = -EADDRNOTAVAIL;
+                        goto err_stop;
                 }
         }
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP_VLAN:
-                /* no need to tell driver */
+                /* no need to tell driver, but set carrier */
+                if (rtnl_dereference(sdata->bss->beacon))
+                        netif_carrier_on(dev);
+                else
+                        netif_carrier_off(dev);
                 break;
         case NL80211_IFTYPE_MONITOR:
                 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
@@ -262,6 +371,12 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                         break;
                 }
 
+                if (local->monitors == 0 && local->open_count == 0) {
+                        res = ieee80211_add_virtual_monitor(local);
+                        if (res)
+                                goto err_stop;
+                }
+
                 /* must be before the call to ieee80211_configure_filter */
                 local->monitors++;
                 if (local->monitors == 1) {
@@ -276,9 +391,14 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                 break;
         default:
                 if (coming_up) {
+                        ieee80211_del_virtual_monitor(local);
+
                         res = drv_add_interface(local, sdata);
                         if (res)
                                 goto err_stop;
+                        res = ieee80211_check_queues(sdata);
+                        if (res)
+                                goto err_del_interface;
                 }
 
                 if (sdata->vif.type == NL80211_IFTYPE_AP) {
@@ -294,7 +414,8 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                 ieee80211_bss_info_change_notify(sdata, changed);
 
                 if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+                    sdata->vif.type == NL80211_IFTYPE_AP)
                         netif_carrier_off(dev);
                 else
                         netif_carrier_on(dev);
@@ -304,7 +425,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                  * need to initialise the hardware if the hardware
                  * doesn't start up with sane defaults
                  */
-                ieee80211_set_wmm_default(sdata);
+                ieee80211_set_wmm_default(sdata, true);
         }
 
         set_bit(SDATA_STATE_RUNNING, &sdata->state);
@@ -318,9 +439,9 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                         goto err_del_interface;
                 }
 
-                sta_info_move_state(sta, IEEE80211_STA_AUTH);
-                sta_info_move_state(sta, IEEE80211_STA_ASSOC);
-                sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
+                sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
+                sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
+                sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 
                 res = sta_info_insert(sta);
                 if (res) {
@@ -366,6 +487,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
         sdata->bss = NULL;
         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 list_del(&sdata->u.vlan.list);
+        /* might already be clear but that doesn't matter */
         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
         return res;
 }
@@ -486,6 +608,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 /* free all potentially still buffered bcast frames */
                 local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps_bc_buf);
                 skb_queue_purge(&sdata->u.ap.ps_bc_buf);
+        } else if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                ieee80211_mgd_stop(sdata);
         }
 
         if (going_down)
@@ -506,6 +630,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 if (local->monitors == 0) {
                         local->hw.conf.flags &= ~IEEE80211_CONF_MONITOR;
                         hw_reconf_flags |= IEEE80211_CONF_CHANGE_MONITOR;
+                        ieee80211_del_virtual_monitor(local);
                 }
 
                 ieee80211_adjust_monitor_flags(sdata, -1);
@@ -579,6 +704,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 }
         }
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+
+        if (local->monitors == local->open_count && local->monitors > 0)
+                ieee80211_add_virtual_monitor(local);
 }
 
 static int ieee80211_stop(struct net_device *dev)
@@ -674,7 +802,7 @@ static u16 ieee80211_monitor_select_queue(struct net_device *dev,
         struct ieee80211_hdr *hdr;
         struct ieee80211_radiotap_header *rtap = (void *)skb->data;
 
-        if (local->hw.queues < 4)
+        if (local->hw.queues < IEEE80211_NUM_ACS)
                 return 0;
 
         if (skb->len < 4 ||
@@ -905,6 +1033,18 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
         ieee80211_debugfs_add_netdev(sdata);
 }
 
+static void ieee80211_clean_sdata(struct ieee80211_sub_if_data *sdata)
+{
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_MESH_POINT:
+                mesh_path_flush_by_iface(sdata);
+                break;
+
+        default:
+                break;
+        }
+}
+
 static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
                                            enum nl80211_iftype type)
 {
@@ -968,6 +1108,13 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
         if (ret)
                 type = sdata->vif.type;
 
+        /*
+         * Ignore return value here, there's not much we can do since
+         * the driver changed the interface type internally already.
+         * The warnings will hopefully make driver authors fix it :-)
+         */
+        ieee80211_check_queues(sdata);
+
         ieee80211_setup_sdata(sdata, type);
 
         err = ieee80211_do_open(sdata->dev, false);
@@ -1131,11 +1278,15 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         struct net_device *ndev;
         struct ieee80211_sub_if_data *sdata = NULL;
         int ret, i;
+        int txqs = 1;
 
         ASSERT_RTNL();
 
+        if (local->hw.queues >= IEEE80211_NUM_ACS)
+                txqs = IEEE80211_NUM_ACS;
+
         ndev = alloc_netdev_mqs(sizeof(*sdata) + local->hw.vif_data_size,
-                                name, ieee80211_if_setup, local->hw.queues, 1);
+                                name, ieee80211_if_setup, txqs, 1);
         if (!ndev)
                 return -ENOMEM;
         dev_net_set(ndev, wiphy_net(local->hw.wiphy));
@@ -1181,8 +1332,17 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                 sband = local->hw.wiphy->bands[i];
                 sdata->rc_rateidx_mask[i] =
                         sband ? (1 << sband->n_bitrates) - 1 : 0;
+                if (sband)
+                        memcpy(sdata->rc_rateidx_mcs_mask[i],
+                               sband->ht_cap.mcs.rx_mask,
+                               sizeof(sdata->rc_rateidx_mcs_mask[i]));
+                else
+                        memset(sdata->rc_rateidx_mcs_mask[i], 0,
+                               sizeof(sdata->rc_rateidx_mcs_mask[i]));
         }
 
+        ieee80211_set_default_queues(sdata);
+
         /* setup type-dependent data */
         ieee80211_setup_sdata(sdata, type);
 
@@ -1218,8 +1378,8 @@ void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata)
         list_del_rcu(&sdata->list);
         mutex_unlock(&sdata->local->iflist_mtx);
 
-        if (ieee80211_vif_is_mesh(&sdata->vif))
-                mesh_path_flush_by_iface(sdata);
+        /* clean up type-dependent data */
+        ieee80211_clean_sdata(sdata);
 
         synchronize_rcu();
         unregister_netdevice(sdata->dev);
@@ -1240,8 +1400,7 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
         list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
                 list_del(&sdata->list);
 
-                if (ieee80211_vif_is_mesh(&sdata->vif))
-                        mesh_path_flush_by_iface(sdata);
+                ieee80211_clean_sdata(sdata);
 
                 unregister_netdevice_queue(sdata->dev, &unreg_list);
         }
@@ -1303,7 +1462,9 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
 
                 /* do not count disabled managed interfaces */
                 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                    !sdata->u.mgd.associated) {
+                    !sdata->u.mgd.associated &&
+                    !sdata->u.mgd.auth_data &&
+                    !sdata->u.mgd.assoc_data) {
                         sdata->vif.bss_conf.idle = true;
                         continue;
                 }
@@ -1323,7 +1484,8 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
                 wk->sdata->vif.bss_conf.idle = false;
         }
 
-        if (local->scan_sdata) {
+        if (local->scan_sdata &&
+            !(local->hw.flags & IEEE80211_HW_SCAN_WHILE_IDLE)) {
                 scanning = true;
                 local->scan_sdata->vif.bss_conf.idle = false;
         }
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 87a89741432d..5bb600d93d77 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -17,6 +17,7 @@
 #include <linux/slab.h>
 #include <linux/export.h>
 #include <net/mac80211.h>
+#include <asm/unaligned.h>
 #include "ieee80211_i.h"
 #include "driver-ops.h"
 #include "debugfs_key.h"
@@ -54,14 +55,6 @@ static void assert_key_lock(struct ieee80211_local *local)
         lockdep_assert_held(&local->key_mtx);
 }
 
-static struct ieee80211_sta *get_sta_for_key(struct ieee80211_key *key)
-{
-        if (key->sta)
-                return &key->sta->sta;
-
-        return NULL;
-}
-
 static void increment_tailroom_need_count(struct ieee80211_sub_if_data *sdata)
 {
         /*
@@ -95,7 +88,7 @@ static void increment_tailroom_need_count(struct ieee80211_sub_if_data *sdata)
 static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 {
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_sta *sta;
+        struct sta_info *sta;
         int ret;
 
         might_sleep();
@@ -105,7 +98,7 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 
         assert_key_lock(key->local);
 
-        sta = get_sta_for_key(key);
+        sta = key->sta;
 
         /*
          * If this is a per-STA GTK, check if it
@@ -115,6 +108,9 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
             !(key->local->hw.flags & IEEE80211_HW_SUPPORTS_PER_STA_GTK))
                 goto out_unsupported;
 
+        if (sta && !sta->uploaded)
+                goto out_unsupported;
+
         sdata = key->sdata;
         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
                 /*
@@ -123,12 +119,10 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                  */
                 if (!(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE))
                         goto out_unsupported;
-                sdata = container_of(sdata->bss,
-                                     struct ieee80211_sub_if_data,
-                                     u.ap);
         }
 
-        ret = drv_set_key(key->local, SET_KEY, sdata, sta, &key->conf);
+        ret = drv_set_key(key->local, SET_KEY, sdata,
+                          sta ? &sta->sta : NULL, &key->conf);
 
         if (!ret) {
                 key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
@@ -147,7 +141,8 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
         if (ret != -ENOSPC && ret != -EOPNOTSUPP)
                 wiphy_err(key->local->hw.wiphy,
                           "failed to set key (%d, %pM) to hardware (%d)\n",
-                          key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
+                          key->conf.keyidx,
+                          sta ? sta->sta.addr : bcast_addr, ret);
 
  out_unsupported:
         switch (key->conf.cipher) {
@@ -166,7 +161,7 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
 {
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_sta *sta;
+        struct sta_info *sta;
         int ret;
 
         might_sleep();
@@ -179,7 +174,7 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
         if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
                 return;
 
-        sta = get_sta_for_key(key);
+        sta = key->sta;
         sdata = key->sdata;
 
         if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
@@ -187,18 +182,14 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
               (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
                 increment_tailroom_need_count(sdata);
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                sdata = container_of(sdata->bss,
-                                     struct ieee80211_sub_if_data,
-                                     u.ap);
-
         ret = drv_set_key(key->local, DISABLE_KEY, sdata,
-                          sta, &key->conf);
+                          sta ? &sta->sta : NULL, &key->conf);
 
         if (ret)
                 wiphy_err(key->local->hw.wiphy,
                           "failed to remove key (%d, %pM) from hardware (%d)\n",
-                          key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
+                          key->conf.keyidx,
+                          sta ? sta->sta.addr : bcast_addr, ret);
 
         key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
 }
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index b142bd4c2390..f5548e953259 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -47,7 +47,8 @@ void ieee80211_configure_filter(struct ieee80211_local *local)
         if (atomic_read(&local->iff_allmultis))
                 new_flags |= FIF_ALLMULTI;
 
-        if (local->monitors || test_bit(SCAN_SW_SCANNING, &local->scanning))
+        if (local->monitors || test_bit(SCAN_SW_SCANNING, &local->scanning) ||
+            test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning))
                 new_flags |= FIF_BCN_PRBRESP_PROMISC;
 
         if (local->fif_probe_req || local->probe_req_reg)
@@ -102,9 +103,6 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
 
         might_sleep();
 
-        /* If this off-channel logic ever changes,  ieee80211_on_oper_channel
-         * may need to change as well.
-         */
         offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
         if (local->scan_channel) {
                 chan = local->scan_channel;
@@ -151,11 +149,13 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
         }
 
         if (test_bit(SCAN_SW_SCANNING, &local->scanning) ||
+            test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning) ||
             test_bit(SCAN_HW_SCANNING, &local->scanning))
                 power = chan->max_power;
         else
                 power = local->power_constr_level ?
-                        (chan->max_power - local->power_constr_level) :
+                        min(chan->max_power,
+                                (chan->max_reg_power  - local->power_constr_level)) :
                         chan->max_power;
 
         if (local->user_power_level >= 0)
@@ -198,15 +198,7 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                 return;
 
         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                /*
-                 * While not associated, claim a BSSID of all-zeroes
-                 * so that drivers don't do any weird things with the
-                 * BSSID at that time.
-                 */
-                if (sdata->vif.bss_conf.assoc)
-                        sdata->vif.bss_conf.bssid = sdata->u.mgd.bssid;
-                else
-                        sdata->vif.bss_conf.bssid = zero;
+                sdata->vif.bss_conf.bssid = sdata->u.mgd.bssid;
         } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
                 sdata->vif.bss_conf.bssid = sdata->u.ibss.bssid;
         else if (sdata->vif.type == NL80211_IFTYPE_AP)
@@ -293,11 +285,11 @@ static void ieee80211_tasklet_handler(unsigned long data)
                         /* Clear skb->pkt_type in order to not confuse kernel
                          * netstack. */
                         skb->pkt_type = 0;
-                        ieee80211_rx(local_to_hw(local), skb);
+                        ieee80211_rx(&local->hw, skb);
                         break;
                 case IEEE80211_TX_STATUS_MSG:
                         skb->pkt_type = 0;
-                        ieee80211_tx_status(local_to_hw(local), skb);
+                        ieee80211_tx_status(&local->hw, skb);
                         break;
                 case IEEE80211_EOSP_MSG:
                         eosp_data = (void *)skb->cb;
@@ -534,6 +526,9 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         int priv_size, i;
         struct wiphy *wiphy;
 
+        if (WARN_ON(ops->sta_state && (ops->sta_add || ops->sta_remove)))
+                return NULL;
+
         /* Ensure 32-byte alignment of our private data and hw private data.
          * We use the wiphy priv data for both our ieee80211_local and for
          * the driver's private data
@@ -564,8 +559,10 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                         WIPHY_FLAG_4ADDR_AP |
                         WIPHY_FLAG_4ADDR_STATION |
                         WIPHY_FLAG_REPORTS_OBSS |
-                        WIPHY_FLAG_OFFCHAN_TX |
-                        WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+                        WIPHY_FLAG_OFFCHAN_TX;
+
+        if (ops->remain_on_channel)
+                wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
 
         wiphy->features = NL80211_FEATURE_SK_TX_STATUS |
                           NL80211_FEATURE_HT_IBSS;
@@ -596,11 +593,13 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         local->hw.max_report_rates = 0;
         local->hw.max_rx_aggregation_subframes = IEEE80211_MAX_AMPDU_BUF;
         local->hw.max_tx_aggregation_subframes = IEEE80211_MAX_AMPDU_BUF;
+        local->hw.offchannel_tx_hw_queue = IEEE80211_INVAL_HW_QUEUE;
         local->hw.conf.long_frame_max_tx_count = wiphy->retry_long;
         local->hw.conf.short_frame_max_tx_count = wiphy->retry_short;
+        local->hw.radiotap_mcs_details = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
+                                         IEEE80211_RADIOTAP_MCS_HAVE_GI |
+                                         IEEE80211_RADIOTAP_MCS_HAVE_BW;
         local->user_power_level = -1;
-        local->uapsd_queues = IEEE80211_DEFAULT_UAPSD_QUEUES;
-        local->uapsd_max_sp_len = IEEE80211_DEFAULT_MAX_SP_LEN;
         wiphy->ht_capa_mod_mask = &mac80211_ht_capa_mod_mask;
 
         INIT_LIST_HEAD(&local->interfaces);
@@ -672,7 +671,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         ieee80211_hw_roc_setup(local);
 
-        return local_to_hw(local);
+        return &local->hw;
 }
 EXPORT_SYMBOL(ieee80211_alloc_hw);
 
@@ -694,6 +693,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 WLAN_CIPHER_SUITE_AES_CMAC
         };
 
+        if (hw->flags & IEEE80211_HW_QUEUE_CONTROL &&
+            (local->hw.offchannel_tx_hw_queue == IEEE80211_INVAL_HW_QUEUE ||
+             local->hw.offchannel_tx_hw_queue >= local->hw.queues))
+                return -EINVAL;
+
         if ((hw->wiphy->wowlan.flags || hw->wiphy->wowlan.n_patterns)
 #ifdef CONFIG_PM
             && (!local->ops->suspend || !local->ops->resume)
@@ -701,6 +705,9 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
             )
                 return -EINVAL;
 
+        if ((hw->flags & IEEE80211_HW_SCAN_WHILE_IDLE) && !local->ops->hw_scan)
+                return -EINVAL;
+
         if (hw->max_report_rates == 0)
                 hw->max_report_rates = hw->max_rates;
 
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index c707c8bf6d2c..2913113c5833 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -13,9 +13,6 @@
 #include "ieee80211_i.h"
 #include "mesh.h"
 
-#define MESHCONF_CAPAB_ACCEPT_PLINKS 0x01
-#define MESHCONF_CAPAB_FORWARDING    0x08
-
 #define TMR_RUNNING_HK  0
 #define TMR_RUNNING_MP  1
 #define TMR_RUNNING_MPR 2
@@ -67,16 +64,19 @@ static void ieee80211_mesh_housekeeping_timer(unsigned long data)
 /**
  * mesh_matches_local - check if the config of a mesh point matches ours
  *
- * @ie: information elements of a management frame from the mesh peer
  * @sdata: local mesh subif
+ * @ie: information elements of a management frame from the mesh peer
  *
  * This function checks if the mesh configuration of a mesh point matches the
  * local mesh configuration, i.e. if both nodes belong to the same mesh network.
  */
-bool mesh_matches_local(struct ieee802_11_elems *ie, struct ieee80211_sub_if_data *sdata)
+bool mesh_matches_local(struct ieee80211_sub_if_data *sdata,
+                        struct ieee802_11_elems *ie)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
+        u32 basic_rates = 0;
+        enum nl80211_channel_type sta_channel_type = NL80211_CHAN_NO_HT;
 
         /*
          * As support for each feature is added, check for matching
@@ -97,10 +97,23 @@ bool mesh_matches_local(struct ieee802_11_elems *ie, struct ieee80211_sub_if_dat
              (ifmsh->mesh_auth_id == ie->mesh_config->meshconf_auth)))
                 goto mismatch;
 
-        /* disallow peering with mismatched channel types for now */
-        if (ie->ht_info_elem &&
-            (local->_oper_channel_type !=
-             ieee80211_ht_info_to_channel_type(ie->ht_info_elem)))
+        ieee80211_sta_get_rates(local, ie, local->oper_channel->band,
+                                &basic_rates);
+
+        if (sdata->vif.bss_conf.basic_rates != basic_rates)
+                goto mismatch;
+
+        if (ie->ht_operation)
+                sta_channel_type =
+                        ieee80211_ht_oper_to_channel_type(ie->ht_operation);
+
+        /* Disallow HT40+/- mismatch */
+        if (ie->ht_operation &&
+            (local->_oper_channel_type == NL80211_CHAN_HT40MINUS ||
+            local->_oper_channel_type == NL80211_CHAN_HT40PLUS) &&
+            (sta_channel_type == NL80211_CHAN_HT40MINUS ||
+             sta_channel_type == NL80211_CHAN_HT40PLUS) &&
+            local->_oper_channel_type != sta_channel_type)
                 goto mismatch;
 
         return true;
@@ -204,7 +217,7 @@ int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
                         kmem_cache_free(rm_cache, p);
                         --entries;
                 } else if ((seqnum == p->seqnum) &&
-                           (memcmp(sa, p->sa, ETH_ALEN) == 0))
+                           (ether_addr_equal(sa, p->sa)))
                         return -1;
         }
 
@@ -251,8 +264,10 @@ mesh_add_meshconf_ie(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
         /* Mesh capability */
         ifmsh->accepting_plinks = mesh_plink_availables(sdata);
         *pos = MESHCONF_CAPAB_FORWARDING;
-        *pos++ |= ifmsh->accepting_plinks ?
+        *pos |= ifmsh->accepting_plinks ?
             MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
+        *pos++ |= ifmsh->adjusting_tbtt ?
+            MESHCONF_CAPAB_TBTT_ADJUSTING : 0x00;
         *pos++ = 0x00;
 
         return 0;
@@ -371,7 +386,7 @@ int mesh_add_ht_cap_ie(struct sk_buff *skb,
         return 0;
 }
 
-int mesh_add_ht_info_ie(struct sk_buff *skb,
+int mesh_add_ht_oper_ie(struct sk_buff *skb,
                         struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
@@ -385,11 +400,12 @@ int mesh_add_ht_info_ie(struct sk_buff *skb,
         if (!ht_cap->ht_supported || channel_type == NL80211_CHAN_NO_HT)
                 return 0;
 
-        if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_ht_info))
+        if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_ht_operation))
                 return -ENOMEM;
 
-        pos = skb_put(skb, 2 + sizeof(struct ieee80211_ht_info));
-        ieee80211_ie_build_ht_info(pos, ht_cap, channel, channel_type);
+        pos = skb_put(skb, 2 + sizeof(struct ieee80211_ht_operation));
+        ieee80211_ie_build_ht_oper(pos, ht_cap, channel, channel_type,
+                                   sdata->vif.bss_conf.ht_operation_mode);
 
         return 0;
 }
@@ -573,14 +589,24 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         ieee80211_configure_filter(local);
 
         ifmsh->mesh_cc_id = 0;  /* Disabled */
-        ifmsh->mesh_sp_id = 0;  /* Neighbor Offset */
         ifmsh->mesh_auth_id = 0;        /* Disabled */
+        /* register sync ops from extensible synchronization framework */
+        ifmsh->sync_ops = ieee80211_mesh_sync_ops_get(ifmsh->mesh_sp_id);
+        ifmsh->adjusting_tbtt = false;
+        ifmsh->sync_offset_clockdrift_max = 0;
         set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
         ieee80211_mesh_root_setup(ifmsh);
         ieee80211_queue_work(&local->hw, &sdata->work);
+        sdata->vif.bss_conf.ht_operation_mode =
+                                ifmsh->mshcfg.ht_opmode;
         sdata->vif.bss_conf.beacon_int = MESH_DEFAULT_BEACON_INTERVAL;
+        sdata->vif.bss_conf.basic_rates =
+                ieee80211_mandatory_rates(sdata->local,
+                                          sdata->local->hw.conf.channel->band);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
                                                 BSS_CHANGED_BEACON_ENABLED |
+                                                BSS_CHANGED_HT |
+                                                BSS_CHANGED_BASIC_RATES |
                                                 BSS_CHANGED_BEACON_INT);
 }
 
@@ -616,16 +642,16 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
                                         struct ieee80211_rx_status *rx_status)
 {
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee802_11_elems elems;
         struct ieee80211_channel *channel;
-        u32 supp_rates = 0;
         size_t baselen;
         int freq;
         enum ieee80211_band band = rx_status->band;
 
         /* ignore ProbeResp to foreign address */
         if (stype == IEEE80211_STYPE_PROBE_RESP &&
-            compare_ether_addr(mgmt->da, sdata->vif.addr))
+            !ether_addr_equal(mgmt->da, sdata->vif.addr))
                 return;
 
         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
@@ -650,10 +676,12 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
                 return;
 
         if (elems.mesh_id && elems.mesh_config &&
-            mesh_matches_local(&elems, sdata)) {
-                supp_rates = ieee80211_sta_get_rates(local, &elems, band);
-                mesh_neighbour_update(mgmt->sa, supp_rates, sdata, &elems);
-        }
+            mesh_matches_local(sdata, &elems))
+                mesh_neighbour_update(sdata, mgmt->sa, &elems);
+
+        if (ifmsh->sync_ops)
+                ifmsh->sync_ops->rx_bcn_presp(sdata,
+                        stype, mgmt, &elems, rx_status);
 }
 
 static void ieee80211_mesh_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
@@ -721,6 +749,9 @@ void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata)
 
         if (test_and_clear_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags))
                 ieee80211_mesh_rootpath(sdata);
+
+        if (test_and_clear_bit(MESH_WORK_DRIFT_ADJUST, &ifmsh->wrkq_flags))
+                mesh_sync_adjust_tbtt(sdata);
 }
 
 void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
@@ -761,4 +792,5 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
                     (unsigned long) sdata);
         INIT_LIST_HEAD(&ifmsh->preq_queue.list);
         spin_lock_init(&ifmsh->mesh_preq_queue_lock);
+        spin_lock_init(&ifmsh->sync_offset_lock);
 }
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index bd14bd26a2b6..e3642756f8f4 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -13,13 +13,26 @@
 
 #include <linux/types.h>
 #include <linux/jhash.h>
-#include <asm/unaligned.h>
 #include "ieee80211_i.h"
 
 
 /* Data structures */
 
 /**
+ * enum mesh_config_capab_flags - mesh config IE capability flags
+ *
+ * @MESHCONF_CAPAB_ACCEPT_PLINKS: STA is willing to establish
+ * additional mesh peerings with other mesh STAs
+ * @MESHCONF_CAPAB_FORWARDING: the STA forwards MSDUs
+ * @MESHCONF_CAPAB_TBTT_ADJUSTING: TBTT adjustment procedure is ongoing
+ */
+enum mesh_config_capab_flags {
+        MESHCONF_CAPAB_ACCEPT_PLINKS = BIT(0),
+        MESHCONF_CAPAB_FORWARDING = BIT(3),
+        MESHCONF_CAPAB_TBTT_ADJUSTING = BIT(5),
+};
+
+/**
  * enum mesh_path_flags - mac80211 mesh path flags
  *
  *
@@ -57,12 +70,15 @@ enum mesh_path_flags {
  * @MESH_WORK_GROW_MPP_TABLE: the mesh portals table is full and needs to
  * grow
  * @MESH_WORK_ROOT: the mesh root station needs to send a frame
+ * @MESH_WORK_DRIFT_ADJUST: time to compensate for clock drift relative to other
+ * mesh nodes
  */
 enum mesh_deferred_task_flags {
         MESH_WORK_HOUSEKEEPING,
         MESH_WORK_GROW_MPATH_TABLE,
         MESH_WORK_GROW_MPP_TABLE,
         MESH_WORK_ROOT,
+        MESH_WORK_DRIFT_ADJUST,
 };
 
 /**
@@ -86,6 +102,9 @@ enum mesh_deferred_task_flags {
  * @state_lock: mesh path state lock used to protect changes to the
  * mpath itself.  No need to take this lock when adding or removing
  * an mpath to a hash bucket on a path table.
+ * @rann_snd_addr: the RANN sender address
+ * @rann_metric: the aggregated path metric towards the root node
+ * @is_root: the destination station of this path is a root node
  * @is_gate: the destination station of this path is a mesh gate
  *
  *
@@ -110,6 +129,9 @@ struct mesh_path {
         u8 discovery_retries;
         enum mesh_path_flags flags;
         spinlock_t state_lock;
+        u8 rann_snd_addr[ETH_ALEN];
+        u32 rann_metric;
+        bool is_root;
         bool is_gate;
 };
 
@@ -200,8 +222,8 @@ int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
                 char *addr6);
 int mesh_rmc_check(u8 *addr, struct ieee80211s_hdr *mesh_hdr,
                 struct ieee80211_sub_if_data *sdata);
-bool mesh_matches_local(struct ieee802_11_elems *ie,
-                struct ieee80211_sub_if_data *sdata);
+bool mesh_matches_local(struct ieee80211_sub_if_data *sdata,
+                        struct ieee802_11_elems *ie);
 void mesh_ids_set_default(struct ieee80211_if_mesh *mesh);
 void mesh_mgmt_ies_add(struct sk_buff *skb,
                 struct ieee80211_sub_if_data *sdata);
@@ -217,7 +239,7 @@ int mesh_add_ds_params_ie(struct sk_buff *skb,
                           struct ieee80211_sub_if_data *sdata);
 int mesh_add_ht_cap_ie(struct sk_buff *skb,
                        struct ieee80211_sub_if_data *sdata);
-int mesh_add_ht_info_ie(struct sk_buff *skb,
+int mesh_add_ht_oper_ie(struct sk_buff *skb,
                         struct ieee80211_sub_if_data *sdata);
 void mesh_rmc_free(struct ieee80211_sub_if_data *sdata);
 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata);
@@ -229,6 +251,7 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata);
 void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata);
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mesh_root_setup(struct ieee80211_if_mesh *ifmsh);
+struct ieee80211_mesh_sync_ops *ieee80211_mesh_sync_ops_get(u8 method);
 
 /* Mesh paths */
 int mesh_nexthop_lookup(struct sk_buff *skb,
@@ -253,9 +276,9 @@ int mesh_path_add_gate(struct mesh_path *mpath);
 int mesh_path_send_to_gates(struct mesh_path *mpath);
 int mesh_gate_num(struct ieee80211_sub_if_data *sdata);
 /* Mesh plinks */
-void mesh_neighbour_update(u8 *hw_addr, u32 rates,
-                struct ieee80211_sub_if_data *sdata,
-                struct ieee802_11_elems *ie);
+void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
+                           u8 *hw_addr,
+                           struct ieee802_11_elems *ie);
 bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie);
 void mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata);
 void mesh_plink_broken(struct sta_info *sta);
@@ -281,7 +304,6 @@ void mesh_pathtbl_unregister(void);
 int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata);
 void mesh_path_timer(unsigned long data);
 void mesh_path_flush_by_nexthop(struct sta_info *sta);
-void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata);
 void mesh_path_discard_frame(struct sk_buff *skb,
                 struct ieee80211_sub_if_data *sdata);
 void mesh_path_quiesce(struct ieee80211_sub_if_data *sdata);
@@ -322,6 +344,8 @@ void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mesh_restart(struct ieee80211_sub_if_data *sdata);
 void mesh_plink_quiesce(struct sta_info *sta);
 void mesh_plink_restart(struct sta_info *sta);
+void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata);
+void mesh_sync_adjust_tbtt(struct ieee80211_sub_if_data *sdata);
 #else
 #define mesh_allocated  0
 static inline void
@@ -334,6 +358,8 @@ static inline void mesh_plink_quiesce(struct sta_info *sta) {}
 static inline void mesh_plink_restart(struct sta_info *sta) {}
 static inline bool mesh_path_sel_is_hwmp(struct ieee80211_sub_if_data *sdata)
 { return false; }
+static inline void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata)
+{}
 #endif
 
 #endif /* IEEE80211S_H */
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 54df1b2bafd2..9b59658e8650 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -8,6 +8,8 @@
  */
 
 #include <linux/slab.h>
+#include <linux/etherdevice.h>
+#include <asm/unaligned.h>
 #include "wme.h"
 #include "mesh.h"
 
@@ -84,8 +86,8 @@ static inline u32 u16_field_get(u8 *preq_elem, int offset, bool ae)
 #define PERR_IE_TARGET_RCODE(x) u16_field_get(x, 13, 0)
 
 #define MSEC_TO_TU(x) (x*1000/1024)
-#define SN_GT(x, y) ((long) (y) - (long) (x) < 0)
-#define SN_LT(x, y) ((long) (x) - (long) (y) < 0)
+#define SN_GT(x, y) ((s32)(y - x) < 0)
+#define SN_LT(x, y) ((s32)(x - y) < 0)
 
 #define net_traversal_jiffies(s) \
         msecs_to_jiffies(s->u.mesh.mshcfg.dot11MeshHWMPnetDiameterTraversalTime)
@@ -322,6 +324,7 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
                                    struct sta_info *sta)
 {
         struct ieee80211_supported_band *sband;
+        struct rate_info rinfo;
         /* This should be adjusted for each device */
         int device_constant = 1 << ARITH_SHIFT;
         int test_frame_len = TEST_FRAME_LEN << ARITH_SHIFT;
@@ -335,7 +338,9 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
         if (sta->fail_avg >= 100)
                 return MAX_METRIC;
 
-        if (sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS)
+        sta_set_rate_info_tx(sta, &sta->last_tx_rate, &rinfo);
+        rate = cfg80211_calculate_bitrate(&rinfo);
+        if (WARN_ON(!rate))
                 return MAX_METRIC;
 
         err = (sta->fail_avg << ARITH_SHIFT) / 100;
@@ -343,7 +348,6 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
         /* bitrate is in units of 100 Kbps, while we need rate in units of
          * 1Mbps. This will be corrected on tx_time computation.
          */
-        rate = sband->bitrates[sta->last_tx_rate.idx].bitrate;
         tx_time = (device_constant + 10 * test_frame_len / rate);
         estimated_retx = ((1 << (2 * ARITH_SHIFT)) / (s_unit - err));
         result = (tx_time * estimated_retx) >> (2 * ARITH_SHIFT) ;
@@ -418,7 +422,7 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
                 new_metric = MAX_METRIC;
         exp_time = TU_TO_EXP_TIME(orig_lifetime);
 
-        if (memcmp(orig_addr, sdata->vif.addr, ETH_ALEN) == 0) {
+        if (ether_addr_equal(orig_addr, sdata->vif.addr)) {
                 /* This MP is the originator, we are not interested in this
                  * frame, except for updating transmitter's path info.
                  */
@@ -468,7 +472,7 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
 
         /* Update and check transmitter routing info */
         ta = mgmt->sa;
-        if (memcmp(orig_addr, ta, ETH_ALEN) == 0)
+        if (ether_addr_equal(orig_addr, ta))
                 fresh_info = false;
         else {
                 fresh_info = true;
@@ -512,8 +516,9 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                                     u8 *preq_elem, u32 metric)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-        struct mesh_path *mpath;
+        struct mesh_path *mpath = NULL;
         u8 *target_addr, *orig_addr;
+        const u8 *da;
         u8 target_flags, ttl;
         u32 orig_sn, target_sn, lifetime;
         bool reply = false;
@@ -528,7 +533,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
 
         mhwmp_dbg("received PREQ from %pM", orig_addr);
 
-        if (memcmp(target_addr, sdata->vif.addr, ETH_ALEN) == 0) {
+        if (ether_addr_equal(target_addr, sdata->vif.addr)) {
                 mhwmp_dbg("PREQ is for us");
                 forward = false;
                 reply = true;
@@ -575,7 +580,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                         ifmsh->mshstats.dropped_frames_ttl++;
         }
 
-        if (forward) {
+        if (forward && ifmsh->mshcfg.dot11MeshForwarding) {
                 u32 preq_id;
                 u8 hopcount, flags;
 
@@ -590,13 +595,18 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                 flags = PREQ_IE_FLAGS(preq_elem);
                 preq_id = PREQ_IE_PREQ_ID(preq_elem);
                 hopcount = PREQ_IE_HOPCOUNT(preq_elem) + 1;
+                da = (mpath && mpath->is_root) ?
+                        mpath->rann_snd_addr : broadcast_addr;
                 mesh_path_sel_frame_tx(MPATH_PREQ, flags, orig_addr,
                                 cpu_to_le32(orig_sn), target_flags, target_addr,
-                                cpu_to_le32(target_sn), broadcast_addr,
+                                cpu_to_le32(target_sn), da,
                                 hopcount, ttl, cpu_to_le32(lifetime),
                                 cpu_to_le32(metric), cpu_to_le32(preq_id),
                                 sdata);
-                ifmsh->mshstats.fwded_mcast++;
+                if (!is_multicast_ether_addr(da))
+                        ifmsh->mshstats.fwded_unicast++;
+                else
+                        ifmsh->mshstats.fwded_mcast++;
                 ifmsh->mshstats.fwded_frames++;
         }
 }
@@ -614,6 +624,7 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_mgmt *mgmt,
                                     u8 *prep_elem, u32 metric)
 {
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_path *mpath;
         u8 *target_addr, *orig_addr;
         u8 ttl, hopcount, flags;
@@ -623,10 +634,13 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
         mhwmp_dbg("received PREP from %pM", PREP_IE_ORIG_ADDR(prep_elem));
 
         orig_addr = PREP_IE_ORIG_ADDR(prep_elem);
-        if (memcmp(orig_addr, sdata->vif.addr, ETH_ALEN) == 0)
+        if (ether_addr_equal(orig_addr, sdata->vif.addr))
                 /* destination, no forwarding required */
                 return;
 
+        if (!ifmsh->mshcfg.dot11MeshForwarding)
+                return;
+
         ttl = PREP_IE_TTL(prep_elem);
         if (ttl <= 1) {
                 sdata->u.mesh.mshstats.dropped_frames_ttl++;
@@ -693,21 +707,26 @@ static void hwmp_perr_frame_process(struct ieee80211_sub_if_data *sdata,
         rcu_read_lock();
         mpath = mesh_path_lookup(target_addr, sdata);
         if (mpath) {
+                struct sta_info *sta;
+
                 spin_lock_bh(&mpath->state_lock);
+                sta = next_hop_deref_protected(mpath);
                 if (mpath->flags & MESH_PATH_ACTIVE &&
-                    memcmp(ta, next_hop_deref_protected(mpath)->sta.addr,
-                                                        ETH_ALEN) == 0 &&
+                    ether_addr_equal(ta, sta->sta.addr) &&
                     (!(mpath->flags & MESH_PATH_SN_VALID) ||
                     SN_GT(target_sn, mpath->sn))) {
                         mpath->flags &= ~MESH_PATH_ACTIVE;
                         mpath->sn = target_sn;
                         spin_unlock_bh(&mpath->state_lock);
+                        if (!ifmsh->mshcfg.dot11MeshForwarding)
+                                goto endperr;
                         mesh_path_error_tx(ttl, target_addr, cpu_to_le32(target_sn),
                                            cpu_to_le16(target_rcode),
                                            broadcast_addr, sdata);
                 } else
                         spin_unlock_bh(&mpath->state_lock);
         }
+endperr:
         rcu_read_unlock();
 }
 
@@ -716,11 +735,12 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
                                 struct ieee80211_rann_ie *rann)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
         struct mesh_path *mpath;
         u8 ttl, flags, hopcount;
         u8 *orig_addr;
-        u32 orig_sn, metric;
-        u32 interval = ifmsh->mshcfg.dot11MeshHWMPRannInterval;
+        u32 orig_sn, metric, metric_txsta, interval;
         bool root_is_gate;
 
         ttl = rann->rann_ttl;
@@ -732,19 +752,28 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
         flags = rann->rann_flags;
         root_is_gate = !!(flags & RANN_FLAG_IS_GATE);
         orig_addr = rann->rann_addr;
-        orig_sn = rann->rann_seq;
+        orig_sn = le32_to_cpu(rann->rann_seq);
+        interval = le32_to_cpu(rann->rann_interval);
         hopcount = rann->rann_hopcount;
         hopcount++;
-        metric = rann->rann_metric;
+        metric = le32_to_cpu(rann->rann_metric);
 
         /*  Ignore our own RANNs */
-        if (memcmp(orig_addr, sdata->vif.addr, ETH_ALEN) == 0)
+        if (ether_addr_equal(orig_addr, sdata->vif.addr))
                 return;
 
-        mhwmp_dbg("received RANN from %pM (is_gate=%d)", orig_addr,
-                        root_is_gate);
+        mhwmp_dbg("received RANN from %pM via neighbour %pM (is_gate=%d)",
+                        orig_addr, mgmt->sa, root_is_gate);
 
         rcu_read_lock();
+        sta = sta_info_get(sdata, mgmt->sa);
+        if (!sta) {
+                rcu_read_unlock();
+                return;
+        }
+
+        metric_txsta = airtime_link_metric_get(local, sta);
+
         mpath = mesh_path_lookup(orig_addr, sdata);
         if (!mpath) {
                 mesh_path_add(orig_addr, sdata);
@@ -764,15 +793,23 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
                 mesh_queue_preq(mpath, PREQ_Q_F_START | PREQ_Q_F_REFRESH);
         }
 
-        if (mpath->sn < orig_sn) {
+        if ((SN_LT(mpath->sn, orig_sn) || (mpath->sn == orig_sn &&
+           metric < mpath->rann_metric)) && ifmsh->mshcfg.dot11MeshForwarding) {
                 mesh_path_sel_frame_tx(MPATH_RANN, flags, orig_addr,
                                        cpu_to_le32(orig_sn),
                                        0, NULL, 0, broadcast_addr,
                                        hopcount, ttl, cpu_to_le32(interval),
-                                       cpu_to_le32(metric + mpath->metric),
+                                       cpu_to_le32(metric + metric_txsta),
                                        0, sdata);
                 mpath->sn = orig_sn;
+                mpath->rann_metric = metric + metric_txsta;
+                /* Recording RANNs sender address to send individually
+                 * addressed PREQs destined for root mesh STA */
+                memcpy(mpath->rann_snd_addr, mgmt->sa, ETH_ALEN);
         }
+
+        mpath->is_root = true;
+
         if (root_is_gate)
                 mesh_path_add_gate(mpath);
 
@@ -908,6 +945,7 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
         struct mesh_preq_queue *preq_node;
         struct mesh_path *mpath;
         u8 ttl, target_flags;
+        const u8 *da;
         u32 lifetime;
 
         spin_lock_bh(&ifmsh->mesh_preq_queue_lock);
@@ -970,9 +1008,10 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
                 target_flags = MP_F_RF;
 
         spin_unlock_bh(&mpath->state_lock);
+        da = (mpath->is_root) ? mpath->rann_snd_addr : broadcast_addr;
         mesh_path_sel_frame_tx(MPATH_PREQ, 0, sdata->vif.addr,
                         cpu_to_le32(ifmsh->sn), target_flags, mpath->dst,
-                        cpu_to_le32(mpath->sn), broadcast_addr, 0,
+                        cpu_to_le32(mpath->sn), da, 0,
                         ttl, cpu_to_le32(lifetime), 0,
                         cpu_to_le32(ifmsh->preq_id++), sdata);
         mod_timer(&mpath->timer, jiffies + mpath->discovery_timeout);
@@ -1063,7 +1102,7 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
         if (time_after(jiffies,
                        mpath->exp_time -
                        msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time)) &&
-            !memcmp(sdata->vif.addr, hdr->addr4, ETH_ALEN) &&
+            ether_addr_equal(sdata->vif.addr, hdr->addr4) &&
             !(mpath->flags & MESH_PATH_RESOLVING) &&
             !(mpath->flags & MESH_PATH_FIXED))
                 mesh_queue_preq(mpath, PREQ_Q_F_START | PREQ_Q_F_REFRESH);
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index edf167e3b8f3..b39224d8255c 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -336,7 +336,7 @@ static void mesh_path_move_to_queue(struct mesh_path *gate_mpath,
 }
 
 
-static struct mesh_path *path_lookup(struct mesh_table *tbl, u8 *dst,
+static struct mesh_path *mpath_lookup(struct mesh_table *tbl, u8 *dst,
                                           struct ieee80211_sub_if_data *sdata)
 {
         struct mesh_path *mpath;
@@ -348,7 +348,7 @@ static struct mesh_path *path_lookup(struct mesh_table *tbl, u8 *dst,
         hlist_for_each_entry_rcu(node, n, bucket, list) {
                 mpath = node->mpath;
                 if (mpath->sdata == sdata &&
-                                memcmp(dst, mpath->dst, ETH_ALEN) == 0) {
+                    ether_addr_equal(dst, mpath->dst)) {
                         if (MPATH_EXPIRED(mpath)) {
                                 spin_lock_bh(&mpath->state_lock);
                                 mpath->flags &= ~MESH_PATH_ACTIVE;
@@ -371,12 +371,12 @@ static struct mesh_path *path_lookup(struct mesh_table *tbl, u8 *dst,
  */
 struct mesh_path *mesh_path_lookup(u8 *dst, struct ieee80211_sub_if_data *sdata)
 {
-        return path_lookup(rcu_dereference(mesh_paths), dst, sdata);
+        return mpath_lookup(rcu_dereference(mesh_paths), dst, sdata);
 }
 
 struct mesh_path *mpp_path_lookup(u8 *dst, struct ieee80211_sub_if_data *sdata)
 {
-        return path_lookup(rcu_dereference(mpp_paths), dst, sdata);
+        return mpath_lookup(rcu_dereference(mpp_paths), dst, sdata);
 }
 
 
@@ -413,12 +413,6 @@ struct mesh_path *mesh_path_lookup_by_idx(int idx, struct ieee80211_sub_if_data
         return NULL;
 }
 
-static void mesh_gate_node_reclaim(struct rcu_head *rp)
-{
-        struct mpath_node *node = container_of(rp, struct mpath_node, rcu);
-        kfree(node);
-}
-
 /**
  * mesh_path_add_gate - add the given mpath to a mesh gate to our path table
  * @mpath: gate path to add to table
@@ -479,7 +473,7 @@ static int mesh_gate_del(struct mesh_table *tbl, struct mesh_path *mpath)
                 if (gate->mpath == mpath) {
                         spin_lock_bh(&tbl->gates_lock);
                         hlist_del_rcu(&gate->list);
-                        call_rcu(&gate->rcu, mesh_gate_node_reclaim);
+                        kfree_rcu(gate, rcu);
                         spin_unlock_bh(&tbl->gates_lock);
                         mpath->sdata->u.mesh.num_gates--;
                         mpath->is_gate = false;
@@ -523,7 +517,7 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
-        if (memcmp(dst, sdata->vif.addr, ETH_ALEN) == 0)
+        if (ether_addr_equal(dst, sdata->vif.addr))
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
 
@@ -544,6 +538,8 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
 
         read_lock_bh(&pathtbl_resize_lock);
         memcpy(new_mpath->dst, dst, ETH_ALEN);
+        memset(new_mpath->rann_snd_addr, 0xff, ETH_ALEN);
+        new_mpath->is_root = false;
         new_mpath->sdata = sdata;
         new_mpath->flags = 0;
         skb_queue_head_init(&new_mpath->frame_queue);
@@ -559,12 +555,13 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         hash_idx = mesh_table_hash(dst, sdata, tbl);
         bucket = &tbl->hash_buckets[hash_idx];
 
-        spin_lock_bh(&tbl->hashwlock[hash_idx]);
+        spin_lock(&tbl->hashwlock[hash_idx]);
 
         err = -EEXIST;
         hlist_for_each_entry(node, n, bucket, list) {
                 mpath = node->mpath;
-                if (mpath->sdata == sdata && memcmp(dst, mpath->dst, ETH_ALEN) == 0)
+                if (mpath->sdata == sdata &&
+                    ether_addr_equal(dst, mpath->dst))
                         goto err_exists;
         }
 
@@ -575,7 +572,7 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
 
         mesh_paths_generation++;
 
-        spin_unlock_bh(&tbl->hashwlock[hash_idx]);
+        spin_unlock(&tbl->hashwlock[hash_idx]);
         read_unlock_bh(&pathtbl_resize_lock);
         if (grow) {
                 set_bit(MESH_WORK_GROW_MPATH_TABLE,  &ifmsh->wrkq_flags);
@@ -584,7 +581,7 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         return 0;
 
 err_exists:
-        spin_unlock_bh(&tbl->hashwlock[hash_idx]);
+        spin_unlock(&tbl->hashwlock[hash_idx]);
         read_unlock_bh(&pathtbl_resize_lock);
         kfree(new_node);
 err_node_alloc:
@@ -655,7 +652,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
-        if (memcmp(dst, sdata->vif.addr, ETH_ALEN) == 0)
+        if (ether_addr_equal(dst, sdata->vif.addr))
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
 
@@ -687,12 +684,13 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         hash_idx = mesh_table_hash(dst, sdata, tbl);
         bucket = &tbl->hash_buckets[hash_idx];
 
-        spin_lock_bh(&tbl->hashwlock[hash_idx]);
+        spin_lock(&tbl->hashwlock[hash_idx]);
 
         err = -EEXIST;
         hlist_for_each_entry(node, n, bucket, list) {
                 mpath = node->mpath;
-                if (mpath->sdata == sdata && memcmp(dst, mpath->dst, ETH_ALEN) == 0)
+                if (mpath->sdata == sdata &&
+                    ether_addr_equal(dst, mpath->dst))
                         goto err_exists;
         }
 
@@ -701,7 +699,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
             tbl->mean_chain_len * (tbl->hash_mask + 1))
                 grow = 1;
 
-        spin_unlock_bh(&tbl->hashwlock[hash_idx]);
+        spin_unlock(&tbl->hashwlock[hash_idx]);
         read_unlock_bh(&pathtbl_resize_lock);
         if (grow) {
                 set_bit(MESH_WORK_GROW_MPP_TABLE,  &ifmsh->wrkq_flags);
@@ -710,7 +708,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         return 0;
 
 err_exists:
-        spin_unlock_bh(&tbl->hashwlock[hash_idx]);
+        spin_unlock(&tbl->hashwlock[hash_idx]);
         read_unlock_bh(&pathtbl_resize_lock);
         kfree(new_node);
 err_node_alloc:
@@ -809,9 +807,9 @@ void mesh_path_flush_by_nexthop(struct sta_info *sta)
         for_each_mesh_entry(tbl, p, node, i) {
                 mpath = node->mpath;
                 if (rcu_dereference(mpath->next_hop) == sta) {
-                        spin_lock_bh(&tbl->hashwlock[i]);
+                        spin_lock(&tbl->hashwlock[i]);
                         __mesh_path_del(tbl, node);
-                        spin_unlock_bh(&tbl->hashwlock[i]);
+                        spin_unlock(&tbl->hashwlock[i]);
                 }
         }
         read_unlock_bh(&pathtbl_resize_lock);
@@ -882,11 +880,11 @@ int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata)
         hash_idx = mesh_table_hash(addr, sdata, tbl);
         bucket = &tbl->hash_buckets[hash_idx];
 
-        spin_lock_bh(&tbl->hashwlock[hash_idx]);
+        spin_lock(&tbl->hashwlock[hash_idx]);
         hlist_for_each_entry(node, n, bucket, list) {
                 mpath = node->mpath;
                 if (mpath->sdata == sdata &&
-                    memcmp(addr, mpath->dst, ETH_ALEN) == 0) {
+                    ether_addr_equal(addr, mpath->dst)) {
                         __mesh_path_del(tbl, node);
                         goto enddel;
                 }
@@ -895,7 +893,7 @@ int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata)
         err = -ENXIO;
 enddel:
         mesh_paths_generation++;
-        spin_unlock_bh(&tbl->hashwlock[hash_idx]);
+        spin_unlock(&tbl->hashwlock[hash_idx]);
         read_unlock_bh(&pathtbl_resize_lock);
         return err;
 }
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index a17251730b9e..60ef235c9d9b 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -31,6 +31,12 @@
 #define dot11MeshHoldingTimeout(s) (s->u.mesh.mshcfg.dot11MeshHoldingTimeout)
 #define dot11MeshMaxPeerLinks(s) (s->u.mesh.mshcfg.dot11MeshMaxPeerLinks)
 
+/* We only need a valid sta if user configured a minimum rssi_threshold. */
+#define rssi_threshold_check(sta, sdata) \
+                (sdata->u.mesh.mshcfg.rssi_threshold == 0 ||\
+                (sta && (s8) -ewma_read(&sta->avg_signal) > \
+                sdata->u.mesh.mshcfg.rssi_threshold))
+
 enum plink_event {
         PLINK_UNDEFINED,
         OPN_ACPT,
@@ -76,42 +82,91 @@ static inline void mesh_plink_fsm_restart(struct sta_info *sta)
 }
 
 /*
- * NOTE: This is just an alias for sta_info_alloc(), see notes
- *       on it in the lifecycle management section!
+ * Allocate mesh sta entry and insert into station table
  */
 static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
-                                         u8 *hw_addr, u32 rates,
-                                         struct ieee802_11_elems *elems)
+                                         u8 *hw_addr)
 {
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_supported_band *sband;
         struct sta_info *sta;
 
-        sband = local->hw.wiphy->bands[local->oper_channel->band];
-
-        if (local->num_sta >= MESH_MAX_PLINKS)
+        if (sdata->local->num_sta >= MESH_MAX_PLINKS)
                 return NULL;
 
         sta = sta_info_alloc(sdata, hw_addr, GFP_KERNEL);
         if (!sta)
                 return NULL;
 
-        sta_info_move_state(sta, IEEE80211_STA_AUTH);
-        sta_info_move_state(sta, IEEE80211_STA_ASSOC);
-        sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
+        sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
+        sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
+        sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 
         set_sta_flag(sta, WLAN_STA_WME);
 
-        sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
-        if (elems->ht_cap_elem)
-                ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
-                                                  elems->ht_cap_elem,
-                                                  &sta->sta.ht_cap);
-        rate_control_rate_init(sta);
-
         return sta;
 }
 
+/*
+ * mesh_set_ht_prot_mode - set correct HT protection mode
+ *
+ * Section 9.23.3.5 of IEEE 80211-2012 describes the protection rules for HT
+ * mesh STA in a MBSS. Three HT protection modes are supported for now, non-HT
+ * mixed mode, 20MHz-protection and no-protection mode. non-HT mixed mode is
+ * selected if any non-HT peers are present in our MBSS.  20MHz-protection mode
+ * is selected if all peers in our 20/40MHz MBSS support HT and atleast one
+ * HT20 peer is present. Otherwise no-protection mode is selected.
+ */
+static u32 mesh_set_ht_prot_mode(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+        u32 changed = 0;
+        u16 ht_opmode;
+        bool non_ht_sta = false, ht20_sta = false;
+
+        if (local->_oper_channel_type == NL80211_CHAN_NO_HT)
+                return 0;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                if (sdata != sta->sdata ||
+                    sta->plink_state != NL80211_PLINK_ESTAB)
+                        continue;
+
+                switch (sta->ch_type) {
+                case NL80211_CHAN_NO_HT:
+                        mpl_dbg("mesh_plink %pM: nonHT sta (%pM) is present",
+                                sdata->vif.addr, sta->sta.addr);
+                        non_ht_sta = true;
+                        goto out;
+                case NL80211_CHAN_HT20:
+                        mpl_dbg("mesh_plink %pM: HT20 sta (%pM) is present",
+                                sdata->vif.addr, sta->sta.addr);
+                        ht20_sta = true;
+                default:
+                        break;
+                }
+        }
+out:
+        rcu_read_unlock();
+
+        if (non_ht_sta)
+                ht_opmode = IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED;
+        else if (ht20_sta && local->_oper_channel_type > NL80211_CHAN_HT20)
+                ht_opmode = IEEE80211_HT_OP_MODE_PROTECTION_20MHZ;
+        else
+                ht_opmode = IEEE80211_HT_OP_MODE_PROTECTION_NONE;
+
+        if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
+                sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
+                sdata->u.mesh.mshcfg.ht_opmode = ht_opmode;
+                changed = BSS_CHANGED_HT;
+                mpl_dbg("mesh_plink %pM: protection mode changed to %d",
+                        sdata->vif.addr, ht_opmode);
+        }
+
+        return changed;
+}
+
 /**
  * __mesh_plink_deactivate - deactivate mesh peer link
  *
@@ -181,7 +236,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                             2 + sdata->u.mesh.mesh_id_len +
                             2 + sizeof(struct ieee80211_meshconf_ie) +
                             2 + sizeof(struct ieee80211_ht_cap) +
-                            2 + sizeof(struct ieee80211_ht_info) +
+                            2 + sizeof(struct ieee80211_ht_operation) +
                             2 + 8 + /* peering IE */
                             sdata->u.mesh.ie_len);
         if (!skb)
@@ -206,8 +261,8 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                         pos = skb_put(skb, 2);
                         memcpy(pos + 2, &plid, 2);
                 }
-                if (ieee80211_add_srates_ie(&sdata->vif, skb) ||
-                    ieee80211_add_ext_srates_ie(&sdata->vif, skb) ||
+                if (ieee80211_add_srates_ie(&sdata->vif, skb, true) ||
+                    ieee80211_add_ext_srates_ie(&sdata->vif, skb, true) ||
                     mesh_add_rsn_ie(skb, sdata) ||
                     mesh_add_meshid_ie(skb, sdata) ||
                     mesh_add_meshconf_ie(skb, sdata))
@@ -257,7 +312,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
 
         if (action != WLAN_SP_MESH_PEERING_CLOSE) {
                 if (mesh_add_ht_cap_ie(skb, sdata) ||
-                    mesh_add_ht_info_ie(skb, sdata))
+                    mesh_add_ht_oper_ie(skb, sdata))
                         return -1;
         }
 
@@ -268,42 +323,93 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-void mesh_neighbour_update(u8 *hw_addr, u32 rates,
-                struct ieee80211_sub_if_data *sdata,
-                struct ieee802_11_elems *elems)
+/* mesh_peer_init - initialize new mesh peer and return resulting sta_info
+ *
+ * @sdata: local meshif
+ * @addr: peer's address
+ * @elems: IEs from beacon or mesh peering frame
+ *
+ * call under RCU
+ */
+static struct sta_info *mesh_peer_init(struct ieee80211_sub_if_data *sdata,
+                                       u8 *addr,
+                                       struct ieee802_11_elems *elems)
 {
         struct ieee80211_local *local = sdata->local;
+        enum ieee80211_band band = local->oper_channel->band;
+        struct ieee80211_supported_band *sband;
+        u32 rates, basic_rates = 0;
         struct sta_info *sta;
+        bool insert = false;
 
-        rcu_read_lock();
+        sband = local->hw.wiphy->bands[band];
+        rates = ieee80211_sta_get_rates(local, elems, band, &basic_rates);
 
-        sta = sta_info_get(sdata, hw_addr);
+        sta = sta_info_get(sdata, addr);
         if (!sta) {
-                rcu_read_unlock();
-                /* Userspace handles peer allocation when security is enabled
-                 * */
-                if (sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED)
-                        cfg80211_notify_new_peer_candidate(sdata->dev, hw_addr,
-                                        elems->ie_start, elems->total_len,
-                                        GFP_KERNEL);
-                else
-                        sta = mesh_plink_alloc(sdata, hw_addr, rates, elems);
-                if (!sta)
-                        return;
-                if (sta_info_insert_rcu(sta)) {
-                        rcu_read_unlock();
-                        return;
+                /* Userspace handles peer allocation when security is enabled */
+                if (sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED) {
+                        cfg80211_notify_new_peer_candidate(sdata->dev, addr,
+                                                           elems->ie_start,
+                                                           elems->total_len,
+                                                           GFP_ATOMIC);
+                        return NULL;
                 }
+
+                sta = mesh_plink_alloc(sdata, addr);
+                if (!sta)
+                        return NULL;
+                insert = true;
         }
 
+        spin_lock_bh(&sta->lock);
         sta->last_rx = jiffies;
-        sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
+        sta->sta.supp_rates[band] = rates;
+        if (elems->ht_cap_elem &&
+            sdata->local->_oper_channel_type != NL80211_CHAN_NO_HT)
+                ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
+                                                  elems->ht_cap_elem,
+                                                  &sta->sta.ht_cap);
+        else
+                memset(&sta->sta.ht_cap, 0, sizeof(sta->sta.ht_cap));
+
+        if (elems->ht_operation) {
+                if (!(elems->ht_operation->ht_param &
+                      IEEE80211_HT_PARAM_CHAN_WIDTH_ANY))
+                        sta->sta.ht_cap.cap &=
+                                            ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                sta->ch_type =
+                        ieee80211_ht_oper_to_channel_type(elems->ht_operation);
+        }
+
+        rate_control_rate_init(sta);
+        spin_unlock_bh(&sta->lock);
+
+        if (insert && sta_info_insert(sta))
+                return NULL;
+
+        return sta;
+}
+
+void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
+                           u8 *hw_addr,
+                           struct ieee802_11_elems *elems)
+{
+        struct sta_info *sta;
+
+        rcu_read_lock();
+        sta = mesh_peer_init(sdata, hw_addr, elems);
+        if (!sta)
+                goto out;
+
         if (mesh_peer_accepts_plinks(elems) &&
-                        sta->plink_state == NL80211_PLINK_LISTEN &&
-                        sdata->u.mesh.accepting_plinks &&
-                        sdata->u.mesh.mshcfg.auto_open_plinks)
+            sta->plink_state == NL80211_PLINK_LISTEN &&
+            sdata->u.mesh.accepting_plinks &&
+            sdata->u.mesh.mshcfg.auto_open_plinks &&
+            rssi_threshold_check(sta, sdata))
                 mesh_plink_open(sta);
 
+out:
         rcu_read_unlock();
 }
 
@@ -449,15 +555,15 @@ void mesh_plink_block(struct sta_info *sta)
 void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt,
                          size_t len, struct ieee80211_rx_status *rx_status)
 {
-        struct ieee80211_local *local = sdata->local;
         struct ieee802_11_elems elems;
         struct sta_info *sta;
         enum plink_event event;
         enum ieee80211_self_protected_actioncode ftype;
         size_t baselen;
-        bool deactivated, matches_local = true;
+        bool matches_local = true;
         u8 ie_len;
         u8 *baseaddr;
+        u32 changed = 0;
         __le16 plid, llid, reason;
 #ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
         static const char *mplstates[] = {
@@ -531,6 +637,14 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 return;
         }
 
+        if (ftype == WLAN_SP_MESH_PEERING_OPEN &&
+            !rssi_threshold_check(sta, sdata)) {
+                mpl_dbg("Mesh plink: %pM does not meet rssi threshold\n",
+                        mgmt->sa);
+                rcu_read_unlock();
+                return;
+        }
+
         if (sta && !test_sta_flag(sta, WLAN_STA_AUTH)) {
                 mpl_dbg("Mesh plink: Action frame from non-authed peer\n");
                 rcu_read_unlock();
@@ -545,7 +659,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         /* Now we will figure out the appropriate event... */
         event = PLINK_UNDEFINED;
         if (ftype != WLAN_SP_MESH_PEERING_CLOSE &&
-            (!mesh_matches_local(&elems, sdata))) {
+            !mesh_matches_local(sdata, &elems)) {
                 matches_local = false;
                 switch (ftype) {
                 case WLAN_SP_MESH_PEERING_OPEN:
@@ -568,29 +682,13 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 return;
         } else if (!sta) {
                 /* ftype == WLAN_SP_MESH_PEERING_OPEN */
-                u32 rates;
-
-                rcu_read_unlock();
-
                 if (!mesh_plink_free_count(sdata)) {
                         mpl_dbg("Mesh plink error: no more free plinks\n");
-                        return;
-                }
-
-                rates = ieee80211_sta_get_rates(local, &elems, rx_status->band);
-                sta = mesh_plink_alloc(sdata, mgmt->sa, rates, &elems);
-                if (!sta) {
-                        mpl_dbg("Mesh plink error: plink table full\n");
-                        return;
-                }
-                if (sta_info_insert_rcu(sta)) {
                         rcu_read_unlock();
                         return;
                 }
                 event = OPN_ACPT;
-                spin_lock_bh(&sta->lock);
         } else if (matches_local) {
-                spin_lock_bh(&sta->lock);
                 switch (ftype) {
                 case WLAN_SP_MESH_PEERING_OPEN:
                         if (!mesh_plink_free_count(sdata) ||
@@ -627,12 +725,19 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         break;
                 default:
                         mpl_dbg("Mesh plink: unknown frame subtype\n");
-                        spin_unlock_bh(&sta->lock);
                         rcu_read_unlock();
                         return;
                 }
-        } else {
-                spin_lock_bh(&sta->lock);
+        }
+
+        if (event == OPN_ACPT) {
+                /* allocate sta entry if necessary and update info */
+                sta = mesh_peer_init(sdata, mgmt->sa, &elems);
+                if (!sta) {
+                        mpl_dbg("Mesh plink: failed to init peer!\n");
+                        rcu_read_unlock();
+                        return;
+                }
         }
 
         mpl_dbg("Mesh plink (peer, state, llid, plid, event): %pM %s %d %d %d\n",
@@ -640,6 +745,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 le16_to_cpu(sta->llid), le16_to_cpu(sta->plid),
                 event);
         reason = 0;
+        spin_lock_bh(&sta->lock);
         switch (sta->plink_state) {
                 /* spin_unlock as soon as state is updated at each case */
         case NL80211_PLINK_LISTEN:
@@ -743,7 +849,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         sta->plink_state = NL80211_PLINK_ESTAB;
                         spin_unlock_bh(&sta->lock);
                         mesh_plink_inc_estab_count(sdata);
-                        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+                        changed |= mesh_set_ht_prot_mode(sdata);
+                        changed |= BSS_CHANGED_BEACON;
                         mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
                                 sta->sta.addr);
                         break;
@@ -778,7 +885,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         sta->plink_state = NL80211_PLINK_ESTAB;
                         spin_unlock_bh(&sta->lock);
                         mesh_plink_inc_estab_count(sdata);
-                        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+                        changed |= mesh_set_ht_prot_mode(sdata);
+                        changed |= BSS_CHANGED_BEACON;
                         mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
                                 sta->sta.addr);
                         mesh_plink_frame_tx(sdata,
@@ -796,13 +904,13 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 case CLS_ACPT:
                         reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
                         sta->reason = reason;
-                        deactivated = __mesh_plink_deactivate(sta);
+                        __mesh_plink_deactivate(sta);
                         sta->plink_state = NL80211_PLINK_HOLDING;
                         llid = sta->llid;
                         mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
                         spin_unlock_bh(&sta->lock);
-                        if (deactivated)
-                                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+                        changed |= mesh_set_ht_prot_mode(sdata);
+                        changed |= BSS_CHANGED_BEACON;
                         mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
                                             sta->sta.addr, llid, plid, reason);
                         break;
@@ -849,4 +957,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         }
 
         rcu_read_unlock();
+
+        if (changed)
+                ieee80211_bss_info_change_notify(sdata, changed);
 }
diff --git a/net/mac80211/mesh_sync.c b/net/mac80211/mesh_sync.c
new file mode 100644
index 000000000000..38d30e8ce6dc
--- /dev/null
+++ b/net/mac80211/mesh_sync.c
@@ -0,0 +1,316 @@
+/*
+ * Copyright 2011-2012, Pavel Zubarev <pavel.zubarev@gmail.com>
+ * Copyright 2011-2012, Marco Porsch <marco.porsch@s2005.tu-chemnitz.de>
+ * Copyright 2011-2012, cozybit Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "ieee80211_i.h"
+#include "mesh.h"
+#include "driver-ops.h"
+
+#ifdef CONFIG_MAC80211_VERBOSE_MESH_SYNC_DEBUG
+#define msync_dbg(fmt, args...) \
+        printk(KERN_DEBUG "Mesh sync (%s): " fmt "\n", sdata->name, ##args)
+#else
+#define msync_dbg(fmt, args...)   do { (void)(0); } while (0)
+#endif
+
+/* This is not in the standard.  It represents a tolerable tbtt drift below
+ * which we do no TSF adjustment.
+ */
+#define TOFFSET_MINIMUM_ADJUSTMENT 10
+
+/* This is not in the standard. It is a margin added to the
+ * Toffset setpoint to mitigate TSF overcorrection
+ * introduced by TSF adjustment latency.
+ */
+#define TOFFSET_SET_MARGIN 20
+
+/* This is not in the standard.  It represents the maximum Toffset jump above
+ * which we'll invalidate the Toffset setpoint and choose a new setpoint.  This
+ * could be, for instance, in case a neighbor is restarted and its TSF counter
+ * reset.
+ */
+#define TOFFSET_MAXIMUM_ADJUSTMENT 30000                /* 30 ms */
+
+struct sync_method {
+        u8 method;
+        struct ieee80211_mesh_sync_ops ops;
+};
+
+/**
+ * mesh_peer_tbtt_adjusting - check if an mp is currently adjusting its TBTT
+ *
+ * @ie: information elements of a management frame from the mesh peer
+ */
+static bool mesh_peer_tbtt_adjusting(struct ieee802_11_elems *ie)
+{
+        return (ie->mesh_config->meshconf_cap &
+            MESHCONF_CAPAB_TBTT_ADJUSTING) != 0;
+}
+
+void mesh_sync_adjust_tbtt(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        /* sdata->vif.bss_conf.beacon_int in 1024us units, 0.04% */
+        u64 beacon_int_fraction = sdata->vif.bss_conf.beacon_int * 1024 / 2500;
+        u64 tsf;
+        u64 tsfdelta;
+
+        spin_lock_bh(&ifmsh->sync_offset_lock);
+
+        if (ifmsh->sync_offset_clockdrift_max < beacon_int_fraction) {
+                msync_dbg("TBTT : max clockdrift=%lld; adjusting",
+                        (long long) ifmsh->sync_offset_clockdrift_max);
+                tsfdelta = -ifmsh->sync_offset_clockdrift_max;
+                ifmsh->sync_offset_clockdrift_max = 0;
+        } else {
+                msync_dbg("TBTT : max clockdrift=%lld; adjusting by %llu",
+                        (long long) ifmsh->sync_offset_clockdrift_max,
+                        (unsigned long long) beacon_int_fraction);
+                tsfdelta = -beacon_int_fraction;
+                ifmsh->sync_offset_clockdrift_max -= beacon_int_fraction;
+        }
+
+        tsf = drv_get_tsf(local, sdata);
+        if (tsf != -1ULL)
+                drv_set_tsf(local, sdata, tsf + tsfdelta);
+        spin_unlock_bh(&ifmsh->sync_offset_lock);
+}
+
+static void mesh_sync_offset_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
+                                   u16 stype,
+                                   struct ieee80211_mgmt *mgmt,
+                                   struct ieee802_11_elems *elems,
+                                   struct ieee80211_rx_status *rx_status)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+        u64 t_t, t_r;
+
+        WARN_ON(ifmsh->mesh_sp_id != IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET);
+
+        /* standard mentions only beacons */
+        if (stype != IEEE80211_STYPE_BEACON)
+                return;
+
+        /* The current tsf is a first approximation for the timestamp
+         * for the received beacon.  Further down we try to get a
+         * better value from the rx_status->mactime field if
+         * available. Also we have to call drv_get_tsf() before
+         * entering the rcu-read section.*/
+        t_r = drv_get_tsf(local, sdata);
+
+        rcu_read_lock();
+        sta = sta_info_get(sdata, mgmt->sa);
+        if (!sta)
+                goto no_sync;
+
+        /* check offset sync conditions (13.13.2.2.1)
+         *
+         * TODO also sync to
+         * dot11MeshNbrOffsetMaxNeighbor non-peer non-MBSS neighbors
+         */
+
+        if (elems->mesh_config && mesh_peer_tbtt_adjusting(elems)) {
+                clear_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN);
+                msync_dbg("STA %pM : is adjusting TBTT", sta->sta.addr);
+                goto no_sync;
+        }
+
+        if (rx_status->flag & RX_FLAG_MACTIME_MPDU && rx_status->mactime) {
+                /*
+                 * The mactime is defined as the time the first data symbol
+                 * of the frame hits the PHY, and the timestamp of the beacon
+                 * is defined as "the time that the data symbol containing the
+                 * first bit of the timestamp is transmitted to the PHY plus
+                 * the transmitting STA's delays through its local PHY from the
+                 * MAC-PHY interface to its interface with the WM" (802.11
+                 * 11.1.2)
+                 *
+                 * T_r, in 13.13.2.2.2, is just defined as "the frame reception
+                 * time" but we unless we interpret that time to be the same
+                 * time of the beacon timestamp, the offset calculation will be
+                 * off.  Below we adjust t_r to be "the time at which the first
+                 * symbol of the timestamp element in the beacon is received".
+                 * This correction depends on the rate.
+                 *
+                 * Based on similar code in ibss.c
+                 */
+                int rate;
+
+                if (rx_status->flag & RX_FLAG_HT) {
+                        /* TODO:
+                         * In principle there could be HT-beacons (Dual Beacon
+                         * HT Operation options), but for now ignore them and
+                         * just use the primary (i.e. non-HT) beacons for
+                         * synchronization.
+                         * */
+                        goto no_sync;
+                } else
+                        rate = local->hw.wiphy->bands[rx_status->band]->
+                                bitrates[rx_status->rate_idx].bitrate;
+
+                /* 24 bytes of header * 8 bits/byte *
+                 * 10*(100 Kbps)/Mbps / rate (100 Kbps)*/
+                t_r = rx_status->mactime + (24 * 8 * 10 / rate);
+        }
+
+        /* Timing offset calculation (see 13.13.2.2.2) */
+        t_t = le64_to_cpu(mgmt->u.beacon.timestamp);
+        sta->t_offset = t_t - t_r;
+
+        if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
+                s64 t_clockdrift = sta->t_offset_setpoint
+                                   - sta->t_offset;
+                msync_dbg("STA %pM : sta->t_offset=%lld, sta->t_offset_setpoint=%lld, t_clockdrift=%lld",
+                          sta->sta.addr,
+                          (long long) sta->t_offset,
+                          (long long)
+                          sta->t_offset_setpoint,
+                          (long long) t_clockdrift);
+
+                if (t_clockdrift > TOFFSET_MAXIMUM_ADJUSTMENT ||
+                        t_clockdrift < -TOFFSET_MAXIMUM_ADJUSTMENT) {
+                        msync_dbg("STA %pM : t_clockdrift=%lld too large, setpoint reset",
+                                  sta->sta.addr,
+                                  (long long) t_clockdrift);
+                        clear_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN);
+                        goto no_sync;
+                }
+
+                rcu_read_unlock();
+
+                spin_lock_bh(&ifmsh->sync_offset_lock);
+                if (t_clockdrift >
+                    ifmsh->sync_offset_clockdrift_max)
+                        ifmsh->sync_offset_clockdrift_max
+                                = t_clockdrift;
+                spin_unlock_bh(&ifmsh->sync_offset_lock);
+
+        } else {
+                sta->t_offset_setpoint = sta->t_offset - TOFFSET_SET_MARGIN;
+                set_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN);
+                msync_dbg("STA %pM : offset was invalid, "
+                          " sta->t_offset=%lld",
+                          sta->sta.addr,
+                          (long long) sta->t_offset);
+                rcu_read_unlock();
+        }
+        return;
+
+no_sync:
+        rcu_read_unlock();
+}
+
+static void mesh_sync_offset_adjust_tbtt(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+
+        WARN_ON(ifmsh->mesh_sp_id
+                != IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET);
+        BUG_ON(!rcu_read_lock_held());
+
+        spin_lock_bh(&ifmsh->sync_offset_lock);
+
+        if (ifmsh->sync_offset_clockdrift_max >
+                TOFFSET_MINIMUM_ADJUSTMENT) {
+                /* Since ajusting the tsf here would
+                 * require a possibly blocking call
+                 * to the driver tsf setter, we punt
+                 * the tsf adjustment to the mesh tasklet
+                 */
+                msync_dbg("TBTT : kicking off TBTT "
+                          "adjustment with "
+                          "clockdrift_max=%lld",
+                  ifmsh->sync_offset_clockdrift_max);
+                set_bit(MESH_WORK_DRIFT_ADJUST,
+                        &ifmsh->wrkq_flags);
+        } else {
+                msync_dbg("TBTT : max clockdrift=%lld; "
+                          "too small to adjust",
+                          (long long)
+                       ifmsh->sync_offset_clockdrift_max);
+                ifmsh->sync_offset_clockdrift_max = 0;
+        }
+        spin_unlock_bh(&ifmsh->sync_offset_lock);
+}
+
+static const u8 *mesh_get_vendor_oui(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        u8 offset;
+
+        if (!ifmsh->ie || !ifmsh->ie_len)
+                return NULL;
+
+        offset = ieee80211_ie_split_vendor(ifmsh->ie,
+                                        ifmsh->ie_len, 0);
+
+        if (!offset)
+                return NULL;
+
+        return ifmsh->ie + offset + 2;
+}
+
+static void mesh_sync_vendor_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
+                                   u16 stype,
+                                   struct ieee80211_mgmt *mgmt,
+                                   struct ieee802_11_elems *elems,
+                                   struct ieee80211_rx_status *rx_status)
+{
+        const u8 *oui;
+
+        WARN_ON(sdata->u.mesh.mesh_sp_id != IEEE80211_SYNC_METHOD_VENDOR);
+        msync_dbg("called mesh_sync_vendor_rx_bcn_presp");
+        oui = mesh_get_vendor_oui(sdata);
+        /*  here you would implement the vendor offset tracking for this oui */
+}
+
+static void mesh_sync_vendor_adjust_tbtt(struct ieee80211_sub_if_data *sdata)
+{
+        const u8 *oui;
+
+        WARN_ON(sdata->u.mesh.mesh_sp_id != IEEE80211_SYNC_METHOD_VENDOR);
+        msync_dbg("called mesh_sync_vendor_adjust_tbtt");
+        oui = mesh_get_vendor_oui(sdata);
+        /*  here you would implement the vendor tsf adjustment for this oui */
+}
+
+/* global variable */
+static struct sync_method sync_methods[] = {
+        {
+                .method = IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET,
+                .ops = {
+                        .rx_bcn_presp = &mesh_sync_offset_rx_bcn_presp,
+                        .adjust_tbtt = &mesh_sync_offset_adjust_tbtt,
+                }
+        },
+        {
+                .method = IEEE80211_SYNC_METHOD_VENDOR,
+                .ops = {
+                        .rx_bcn_presp = &mesh_sync_vendor_rx_bcn_presp,
+                        .adjust_tbtt = &mesh_sync_vendor_adjust_tbtt,
+                }
+        },
+};
+
+struct ieee80211_mesh_sync_ops *ieee80211_mesh_sync_ops_get(u8 method)
+{
+        struct ieee80211_mesh_sync_ops *ops = NULL;
+        u8 i;
+
+        for (i = 0 ; i < ARRAY_SIZE(sync_methods); ++i) {
+                if (sync_methods[i].method == method) {
+                        ops = &sync_methods[i].ops;
+                        break;
+                }
+        }
+        return ops;
+}
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 295be92f7c77..04c306308987 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -30,6 +30,12 @@
 #include "rate.h"
 #include "led.h"
 
+#define IEEE80211_AUTH_TIMEOUT (HZ / 5)
+#define IEEE80211_AUTH_MAX_TRIES 3
+#define IEEE80211_AUTH_WAIT_ASSOC (HZ * 5)
+#define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
+#define IEEE80211_ASSOC_MAX_TRIES 3
+
 static int max_nullfunc_tries = 2;
 module_param(max_nullfunc_tries, int, 0644);
 MODULE_PARM_DESC(max_nullfunc_tries,
@@ -82,6 +88,8 @@ MODULE_PARM_DESC(probe_wait_ms,
 #define TMR_RUNNING_TIMER       0
 #define TMR_RUNNING_CHANSW      1
 
+#define DEAUTH_DISASSOC_LEN     (24 /* hdr */ + 2 /* reason */)
+
 /*
  * All cfg80211 functions have to be called outside a locked
  * section so that they can acquire a lock themselves... This
@@ -97,6 +105,15 @@ enum rx_mgmt_action {
 
         /* caller must call cfg80211_send_disassoc() */
         RX_MGMT_CFG80211_DISASSOC,
+
+        /* caller must call cfg80211_send_rx_auth() */
+        RX_MGMT_CFG80211_RX_AUTH,
+
+        /* caller must call cfg80211_send_rx_assoc() */
+        RX_MGMT_CFG80211_RX_ASSOC,
+
+        /* caller must call cfg80211_send_assoc_timeout() */
+        RX_MGMT_CFG80211_ASSOC_TIMEOUT,
 };
 
 /* utils */
@@ -115,8 +132,7 @@ static inline void ASSERT_MGD_MTX(struct ieee80211_if_managed *ifmgd)
  * has happened -- the work that runs from this timer will
  * do that.
  */
-static void run_again(struct ieee80211_if_managed *ifmgd,
-                             unsigned long timeout)
+static void run_again(struct ieee80211_if_managed *ifmgd, unsigned long timeout)
 {
         ASSERT_MGD_MTX(ifmgd);
 
@@ -127,7 +143,7 @@ static void run_again(struct ieee80211_if_managed *ifmgd,
 
 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
 {
-        if (sdata->local->hw.flags & IEEE80211_HW_BEACON_FILTER)
+        if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
                 return;
 
         mod_timer(&sdata->u.mgd.bcn_mon_timer,
@@ -155,177 +171,426 @@ static int ecw2cw(int ecw)
         return (1 << ecw) - 1;
 }
 
-/*
- * ieee80211_enable_ht should be called only after the operating band
- * has been determined as ht configuration depends on the hw's
- * HT abilities for a specific band.
- */
-static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
-                               struct ieee80211_ht_info *hti,
-                               const u8 *bssid, u16 ap_ht_cap_flags,
-                               bool beacon_htcap_ie)
+static u32 ieee80211_config_ht_tx(struct ieee80211_sub_if_data *sdata,
+                                  struct ieee80211_ht_operation *ht_oper,
+                                  const u8 *bssid, bool reconfig)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
         struct sta_info *sta;
         u32 changed = 0;
-        int hti_cfreq;
         u16 ht_opmode;
-        bool enable_ht = true;
-        enum nl80211_channel_type prev_chantype;
-        enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
+        bool disable_40 = false;
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
-        prev_chantype = sdata->vif.bss_conf.channel_type;
+        switch (sdata->vif.bss_conf.channel_type) {
+        case NL80211_CHAN_HT40PLUS:
+                if (local->hw.conf.channel->flags & IEEE80211_CHAN_NO_HT40PLUS)
+                        disable_40 = true;
+                break;
+        case NL80211_CHAN_HT40MINUS:
+                if (local->hw.conf.channel->flags & IEEE80211_CHAN_NO_HT40MINUS)
+                        disable_40 = true;
+                break;
+        default:
+                break;
+        }
 
-        /* HT is not supported */
-        if (!sband->ht_cap.ht_supported)
-                enable_ht = false;
+        /* This can change during the lifetime of the BSS */
+        if (!(ht_oper->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY))
+                disable_40 = true;
 
-        if (enable_ht) {
-                hti_cfreq = ieee80211_channel_to_frequency(hti->control_chan,
-                                                           sband->band);
-                /* check that channel matches the right operating channel */
-                if (local->hw.conf.channel->center_freq != hti_cfreq) {
-                        /* Some APs mess this up, evidently.
-                         * Netgear WNDR3700 sometimes reports 4 higher than
-                         * the actual channel, for instance.
-                         */
-                        printk(KERN_DEBUG
-                               "%s: Wrong control channel in association"
-                               " response: configured center-freq: %d"
-                               " hti-cfreq: %d  hti->control_chan: %d"
-                               " band: %d.  Disabling HT.\n",
-                               sdata->name,
-                               local->hw.conf.channel->center_freq,
-                               hti_cfreq, hti->control_chan,
-                               sband->band);
-                        enable_ht = false;
-                }
+        mutex_lock(&local->sta_mtx);
+        sta = sta_info_get(sdata, bssid);
+
+        WARN_ON_ONCE(!sta);
+
+        if (sta && !sta->supports_40mhz)
+                disable_40 = true;
+
+        if (sta && (!reconfig ||
+                    (disable_40 != !(sta->sta.ht_cap.cap &
+                                        IEEE80211_HT_CAP_SUP_WIDTH_20_40)))) {
+
+                if (disable_40)
+                        sta->sta.ht_cap.cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                else
+                        sta->sta.ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+
+                rate_control_rate_update(local, sband, sta,
+                                         IEEE80211_RC_BW_CHANGED);
         }
+        mutex_unlock(&local->sta_mtx);
 
-        if (enable_ht) {
-                channel_type = NL80211_CHAN_HT20;
+        ht_opmode = le16_to_cpu(ht_oper->operation_mode);
 
-                if (!(ap_ht_cap_flags & IEEE80211_HT_CAP_40MHZ_INTOLERANT) &&
-                    !ieee80111_cfg_override_disables_ht40(sdata) &&
-                    (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) &&
-                    (hti->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY)) {
-                        switch(hti->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
-                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                                if (!(local->hw.conf.channel->flags &
-                                    IEEE80211_CHAN_NO_HT40PLUS))
-                                        channel_type = NL80211_CHAN_HT40PLUS;
-                                break;
-                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                                if (!(local->hw.conf.channel->flags &
-                                    IEEE80211_CHAN_NO_HT40MINUS))
-                                        channel_type = NL80211_CHAN_HT40MINUS;
+        /* if bss configuration changed store the new one */
+        if (!reconfig || (sdata->vif.bss_conf.ht_operation_mode != ht_opmode)) {
+                changed |= BSS_CHANGED_HT;
+                sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
+        }
+
+        return changed;
+}
+
+/* frame sending functions */
+
+static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len,
+                                      struct ieee80211_supported_band *sband,
+                                      u32 *rates)
+{
+        int i, j, count;
+        *rates = 0;
+        count = 0;
+        for (i = 0; i < supp_rates_len; i++) {
+                int rate = (supp_rates[i] & 0x7F) * 5;
+
+                for (j = 0; j < sband->n_bitrates; j++)
+                        if (sband->bitrates[j].bitrate == rate) {
+                                *rates |= BIT(j);
+                                count++;
                                 break;
                         }
-                }
         }
 
-        if (local->tmp_channel)
-                local->tmp_channel_type = channel_type;
+        return count;
+}
 
-        if (!ieee80211_set_channel_type(local, sdata, channel_type)) {
-                /* can only fail due to HT40+/- mismatch */
-                channel_type = NL80211_CHAN_HT20;
-                WARN_ON(!ieee80211_set_channel_type(local, sdata, channel_type));
-        }
+static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
+                                struct sk_buff *skb, const u8 *ht_oper_ie,
+                                struct ieee80211_supported_band *sband,
+                                struct ieee80211_channel *channel,
+                                enum ieee80211_smps_mode smps)
+{
+        struct ieee80211_ht_operation *ht_oper;
+        u8 *pos;
+        u32 flags = channel->flags;
+        u16 cap;
+        struct ieee80211_sta_ht_cap ht_cap;
 
-        if (beacon_htcap_ie && (prev_chantype != channel_type)) {
-                /*
-                 * Whenever the AP announces the HT mode change that can be
-                 * 40MHz intolerant or etc., it would be safer to stop tx
-                 * queues before doing hw config to avoid buffer overflow.
-                 */
-                ieee80211_stop_queues_by_reason(&sdata->local->hw,
-                                IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE);
+        BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
 
-                /* flush out all packets */
-                synchronize_net();
+        if (!ht_oper_ie)
+                return;
 
-                drv_flush(local, false);
-        }
+        if (ht_oper_ie[1] < sizeof(struct ieee80211_ht_operation))
+                return;
 
-        /* channel_type change automatically detected */
-        ieee80211_hw_config(local, 0);
+        memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
+        ieee80211_apply_htcap_overrides(sdata, &ht_cap);
 
-        if (prev_chantype != channel_type) {
-                rcu_read_lock();
-                sta = sta_info_get(sdata, bssid);
-                if (sta)
-                        rate_control_rate_update(local, sband, sta,
-                                                 IEEE80211_RC_HT_CHANGED,
-                                                 channel_type);
-                rcu_read_unlock();
+        ht_oper = (struct ieee80211_ht_operation *)(ht_oper_ie + 2);
 
-                if (beacon_htcap_ie)
-                        ieee80211_wake_queues_by_reason(&sdata->local->hw,
-                                IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE);
-        }
+        /* determine capability flags */
+        cap = ht_cap.cap;
 
-        ht_opmode = le16_to_cpu(hti->operation_mode);
+        switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
+                        cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        cap &= ~IEEE80211_HT_CAP_SGI_40;
+                }
+                break;
+        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
+                        cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        cap &= ~IEEE80211_HT_CAP_SGI_40;
+                }
+                break;
+        }
 
-        /* if bss configuration changed store the new one */
-        if (sdata->ht_opmode_valid != enable_ht ||
-            sdata->vif.bss_conf.ht_operation_mode != ht_opmode ||
-            prev_chantype != channel_type) {
-                changed |= BSS_CHANGED_HT;
-                sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
-                sdata->ht_opmode_valid = enable_ht;
+        /*
+         * If 40 MHz was disabled associate as though we weren't
+         * capable of 40 MHz -- some broken APs will never fall
+         * back to trying to transmit in 20 MHz.
+         */
+        if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
+                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                cap &= ~IEEE80211_HT_CAP_SGI_40;
+        }
+
+        /* set SM PS mode properly */
+        cap &= ~IEEE80211_HT_CAP_SM_PS;
+        switch (smps) {
+        case IEEE80211_SMPS_AUTOMATIC:
+        case IEEE80211_SMPS_NUM_MODES:
+                WARN_ON(1);
+        case IEEE80211_SMPS_OFF:
+                cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
+                        IEEE80211_HT_CAP_SM_PS_SHIFT;
+                break;
+        case IEEE80211_SMPS_STATIC:
+                cap |= WLAN_HT_CAP_SM_PS_STATIC <<
+                        IEEE80211_HT_CAP_SM_PS_SHIFT;
+                break;
+        case IEEE80211_SMPS_DYNAMIC:
+                cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
+                        IEEE80211_HT_CAP_SM_PS_SHIFT;
+                break;
         }
 
-        return changed;
+        /* reserve and fill IE */
+        pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
+        ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
 }
 
-/* frame sending functions */
-
-static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
-                                           const u8 *bssid, u16 stype, u16 reason,
-                                           void *cookie, bool send_frame)
+static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
+        u8 *pos, qos_info;
+        size_t offset = 0, noffset;
+        int i, count, rates_len, supp_rates_len;
+        u16 capab;
+        struct ieee80211_supported_band *sband;
+        u32 rates = 0;
+
+        lockdep_assert_held(&ifmgd->mtx);
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
+        sband = local->hw.wiphy->bands[local->oper_channel->band];
+
+        if (assoc_data->supp_rates_len) {
+                /*
+                 * Get all rates supported by the device and the AP as
+                 * some APs don't like getting a superset of their rates
+                 * in the association request (e.g. D-Link DAP 1353 in
+                 * b-only mode)...
+                 */
+                rates_len = ieee80211_compatible_rates(assoc_data->supp_rates,
+                                                       assoc_data->supp_rates_len,
+                                                       sband, &rates);
+        } else {
+                /*
+                 * In case AP not provide any supported rates information
+                 * before association, we send information element(s) with
+                 * all rates that we support.
+                 */
+                rates = ~0;
+                rates_len = sband->n_bitrates;
+        }
+
+        skb = alloc_skb(local->hw.extra_tx_headroom +
+                        sizeof(*mgmt) + /* bit too much but doesn't matter */
+                        2 + assoc_data->ssid_len + /* SSID */
+                        4 + rates_len + /* (extended) rates */
+                        4 + /* power capability */
+                        2 + 2 * sband->n_channels + /* supported channels */
+                        2 + sizeof(struct ieee80211_ht_cap) + /* HT */
+                        assoc_data->ie_len + /* extra IEs */
+                        9, /* WMM */
+                        GFP_KERNEL);
         if (!skb)
                 return;
 
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
+        capab = WLAN_CAPABILITY_ESS;
+
+        if (sband->band == IEEE80211_BAND_2GHZ) {
+                if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
+                        capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
+                if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
+                        capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
+        }
+
+        if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
+                capab |= WLAN_CAPABILITY_PRIVACY;
+
+        if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
+            (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
+                capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
+
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
+        memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
+        memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);
+
+        if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
+                skb_put(skb, 10);
+                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                                  IEEE80211_STYPE_REASSOC_REQ);
+                mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
+                mgmt->u.reassoc_req.listen_interval =
+                                cpu_to_le16(local->hw.conf.listen_interval);
+                memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
+                       ETH_ALEN);
+        } else {
+                skb_put(skb, 4);
+                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                                  IEEE80211_STYPE_ASSOC_REQ);
+                mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
+                mgmt->u.assoc_req.listen_interval =
+                                cpu_to_le16(local->hw.conf.listen_interval);
+        }
+
+        /* SSID */
+        pos = skb_put(skb, 2 + assoc_data->ssid_len);
+        *pos++ = WLAN_EID_SSID;
+        *pos++ = assoc_data->ssid_len;
+        memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
+
+        /* add all rates which were marked to be used above */
+        supp_rates_len = rates_len;
+        if (supp_rates_len > 8)
+                supp_rates_len = 8;
+
+        pos = skb_put(skb, supp_rates_len + 2);
+        *pos++ = WLAN_EID_SUPP_RATES;
+        *pos++ = supp_rates_len;
+
+        count = 0;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                if (BIT(i) & rates) {
+                        int rate = sband->bitrates[i].bitrate;
+                        *pos++ = (u8) (rate / 5);
+                        if (++count == 8)
+                                break;
+                }
+        }
+
+        if (rates_len > count) {
+                pos = skb_put(skb, rates_len - count + 2);
+                *pos++ = WLAN_EID_EXT_SUPP_RATES;
+                *pos++ = rates_len - count;
+
+                for (i++; i < sband->n_bitrates; i++) {
+                        if (BIT(i) & rates) {
+                                int rate = sband->bitrates[i].bitrate;
+                                *pos++ = (u8) (rate / 5);
+                        }
+                }
+        }
+
+        if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
+                /* 1. power capabilities */
+                pos = skb_put(skb, 4);
+                *pos++ = WLAN_EID_PWR_CAPABILITY;
+                *pos++ = 2;
+                *pos++ = 0; /* min tx power */
+                *pos++ = local->oper_channel->max_power; /* max tx power */
+
+                /* 2. supported channels */
+                /* TODO: get this in reg domain format */
+                pos = skb_put(skb, 2 * sband->n_channels + 2);
+                *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
+                *pos++ = 2 * sband->n_channels;
+                for (i = 0; i < sband->n_channels; i++) {
+                        *pos++ = ieee80211_frequency_to_channel(
+                                        sband->channels[i].center_freq);
+                        *pos++ = 1; /* one channel in the subband*/
+                }
+        }
+
+        /* if present, add any custom IEs that go before HT */
+        if (assoc_data->ie_len && assoc_data->ie) {
+                static const u8 before_ht[] = {
+                        WLAN_EID_SSID,
+                        WLAN_EID_SUPP_RATES,
+                        WLAN_EID_EXT_SUPP_RATES,
+                        WLAN_EID_PWR_CAPABILITY,
+                        WLAN_EID_SUPPORTED_CHANNELS,
+                        WLAN_EID_RSN,
+                        WLAN_EID_QOS_CAPA,
+                        WLAN_EID_RRM_ENABLED_CAPABILITIES,
+                        WLAN_EID_MOBILITY_DOMAIN,
+                        WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
+                };
+                noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
+                                             before_ht, ARRAY_SIZE(before_ht),
+                                             offset);
+                pos = skb_put(skb, noffset - offset);
+                memcpy(pos, assoc_data->ie + offset, noffset - offset);
+                offset = noffset;
+        }
+
+        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
+                ieee80211_add_ht_ie(sdata, skb, assoc_data->ht_operation_ie,
+                                    sband, local->oper_channel, ifmgd->ap_smps);
+
+        /* if present, add any custom non-vendor IEs that go after HT */
+        if (assoc_data->ie_len && assoc_data->ie) {
+                noffset = ieee80211_ie_split_vendor(assoc_data->ie,
+                                                    assoc_data->ie_len,
+                                                    offset);
+                pos = skb_put(skb, noffset - offset);
+                memcpy(pos, assoc_data->ie + offset, noffset - offset);
+                offset = noffset;
+        }
+
+        if (assoc_data->wmm) {
+                if (assoc_data->uapsd) {
+                        qos_info = ifmgd->uapsd_queues;
+                        qos_info |= (ifmgd->uapsd_max_sp_len <<
+                                     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
+                } else {
+                        qos_info = 0;
+                }
+
+                pos = skb_put(skb, 9);
+                *pos++ = WLAN_EID_VENDOR_SPECIFIC;
+                *pos++ = 7; /* len */
+                *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
+                *pos++ = 0x50;
+                *pos++ = 0xf2;
+                *pos++ = 2; /* WME */
+                *pos++ = 0; /* WME info */
+                *pos++ = 1; /* WME ver */
+                *pos++ = qos_info;
+        }
+
+        /* add any remaining custom (i.e. vendor specific here) IEs */
+        if (assoc_data->ie_len && assoc_data->ie) {
+                noffset = assoc_data->ie_len;
+                pos = skb_put(skb, noffset - offset);
+                memcpy(pos, assoc_data->ie + offset, noffset - offset);
+        }
+
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        ieee80211_tx_skb(sdata, skb);
+}
+
+static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
+                                           const u8 *bssid, u16 stype,
+                                           u16 reason, bool send_frame,
+                                           u8 *frame_buf)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt = (void *)frame_buf;
+
+        /* build frame */
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
+        mgmt->duration = 0; /* initialize only */
+        mgmt->seq_ctrl = 0; /* initialize only */
         memcpy(mgmt->da, bssid, ETH_ALEN);
         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         memcpy(mgmt->bssid, bssid, ETH_ALEN);
-        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
-        skb_put(skb, 2);
         /* u.deauth.reason_code == u.disassoc.reason_code */
         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 
-        if (stype == IEEE80211_STYPE_DEAUTH)
-                if (cookie)
-                        __cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
-                else
-                        cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
-        else
-                if (cookie)
-                        __cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
-                else
-                        cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
-        if (!(ifmgd->flags & IEEE80211_STA_MFP_ENABLED))
-                IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        if (send_frame) {
+                skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+                                    DEAUTH_DISASSOC_LEN);
+                if (!skb)
+                        return;
+
+                skb_reserve(skb, local->hw.extra_tx_headroom);
+
+                /* copy in frame */
+                memcpy(skb_put(skb, DEAUTH_DISASSOC_LEN),
+                       mgmt, DEAUTH_DISASSOC_LEN);
 
-        if (send_frame)
+                if (!(ifmgd->flags & IEEE80211_STA_MFP_ENABLED))
+                        IEEE80211_SKB_CB(skb)->flags |=
+                                IEEE80211_TX_INTFL_DONT_ENCRYPT;
                 ieee80211_tx_skb(sdata, skb);
-        else
-                kfree_skb(skb);
+        }
 }
 
 void ieee80211_send_pspoll(struct ieee80211_local *local,
@@ -547,7 +812,7 @@ static void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
         if (pwr_constr_elem_len != 1)
                 return;
 
-        if ((*pwr_constr_elem <= conf->channel->max_power) &&
+        if ((*pwr_constr_elem <= conf->channel->max_reg_power) &&
             (*pwr_constr_elem != sdata->local->power_constr_level)) {
                 sdata->local->power_constr_level = *pwr_constr_elem;
                 ieee80211_hw_config(sdata->local, 0);
@@ -869,7 +1134,7 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         if (!local->ops->conf_tx)
                 return;
 
-        if (local->hw.queues < 4)
+        if (local->hw.queues < IEEE80211_NUM_ACS)
                 return;
 
         if (!wmm_param)
@@ -879,7 +1144,7 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
                 return;
 
         if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
-                uapsd_queues = local->uapsd_queues;
+                uapsd_queues = ifmgd->uapsd_queues;
 
         count = wmm_param[6] & 0x0f;
         if (count == ifmgd->wmm_last_param_set)
@@ -953,7 +1218,6 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
 
         /* enable WMM or activate new settings */
         sdata->vif.bss_conf.qos = true;
-        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
 }
 
 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
@@ -1006,7 +1270,7 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         bss_info_changed |= BSS_CHANGED_ASSOC;
         /* set timing information */
         bss_conf->beacon_int = cbss->beacon_interval;
-        bss_conf->timestamp = cbss->tsf;
+        bss_conf->last_tsf = cbss->tsf;
 
         bss_info_changed |= BSS_CHANGED_BEACON_INT;
         bss_info_changed |= ieee80211_handle_bss_capability(sdata,
@@ -1032,18 +1296,9 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
                 bss_conf->dtim_period = 0;
 
         bss_conf->assoc = 1;
-        /*
-         * For now just always ask the driver to update the basic rateset
-         * when we have associated, we aren't checking whether it actually
-         * changed or not.
-         */
-        bss_info_changed |= BSS_CHANGED_BASIC_RATES;
-
-        /* And the BSSID changed - we're associated now */
-        bss_info_changed |= BSS_CHANGED_BSSID;
 
         /* Tell the driver to monitor connection quality (if supported) */
-        if ((local->hw.flags & IEEE80211_HW_SUPPORTS_CQM_RSSI) &&
+        if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
             bss_conf->cqm_rssi_thold)
                 bss_info_changed |= BSS_CHANGED_CQM;
 
@@ -1065,16 +1320,20 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 }
 
 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
-                                   bool remove_sta, bool tx)
+                                   u16 stype, u16 reason, bool tx,
+                                   u8 *frame_buf)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
-        u32 changed = 0, config_changed = 0;
+        u32 changed = 0;
         u8 bssid[ETH_ALEN];
 
         ASSERT_MGD_MTX(ifmgd);
 
+        if (WARN_ON_ONCE(tx && !frame_buf))
+                return;
+
         if (WARN_ON(!ifmgd->associated))
                 return;
 
@@ -1108,19 +1367,26 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         }
         mutex_unlock(&local->sta_mtx);
 
+        /* deauthenticate/disassociate now */
+        if (tx || frame_buf)
+                ieee80211_send_deauth_disassoc(sdata, bssid, stype, reason,
+                                               tx, frame_buf);
+
+        /* flush out frame */
+        if (tx)
+                drv_flush(local, false);
+
+        /* remove AP and TDLS peers */
+        sta_info_flush(local, sdata);
+
+        /* finally reset all BSS / config parameters */
         changed |= ieee80211_reset_erp_info(sdata);
 
         ieee80211_led_assoc(local, 0);
         changed |= BSS_CHANGED_ASSOC;
         sdata->vif.bss_conf.assoc = false;
 
-        ieee80211_set_wmm_default(sdata);
-
-        /* channel(_type) changes are handled by ieee80211_hw_config */
-        WARN_ON(!ieee80211_set_channel_type(local, sdata, NL80211_CHAN_NO_HT));
-
         /* on the next assoc, re-program HT parameters */
-        sdata->ht_opmode_valid = false;
         memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
         memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
 
@@ -1131,25 +1397,29 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
-                config_changed |= IEEE80211_CONF_CHANGE_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
         }
         local->ps_sdata = NULL;
 
-        ieee80211_hw_config(local, config_changed);
-
         /* Disable ARP filtering */
         if (sdata->vif.bss_conf.arp_filter_enabled) {
                 sdata->vif.bss_conf.arp_filter_enabled = false;
                 changed |= BSS_CHANGED_ARP_FILTER;
         }
 
+        sdata->vif.bss_conf.qos = false;
+        changed |= BSS_CHANGED_QOS;
+
         /* The BSSID (not really interesting) and HT changed */
         changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
         ieee80211_bss_info_change_notify(sdata, changed);
 
-        /* remove AP and TDLS peers */
-        if (remove_sta)
-                sta_info_flush(local, sdata);
+        /* channel(_type) changes are handled by ieee80211_hw_config */
+        WARN_ON(!ieee80211_set_channel_type(local, sdata, NL80211_CHAN_NO_HT));
+        ieee80211_hw_config(local, 0);
+
+        /* disassociated - set to defaults now */
+        ieee80211_set_wmm_default(sdata, false);
 
         del_timer_sync(&sdata->u.mgd.conn_mon_timer);
         del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
@@ -1177,19 +1447,24 @@ void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_local *local = sdata->local;
 
+        mutex_lock(&local->mtx);
         if (!(ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
-                              IEEE80211_STA_CONNECTION_POLL)))
-            return;
+                              IEEE80211_STA_CONNECTION_POLL))) {
+                mutex_unlock(&local->mtx);
+                return;
+        }
 
         ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
                           IEEE80211_STA_BEACON_POLL);
-        mutex_lock(&sdata->local->iflist_mtx);
-        ieee80211_recalc_ps(sdata->local, -1);
-        mutex_unlock(&sdata->local->iflist_mtx);
+
+        mutex_lock(&local->iflist_mtx);
+        ieee80211_recalc_ps(local, -1);
+        mutex_unlock(&local->iflist_mtx);
 
         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
-                return;
+                goto out;
 
         /*
          * We've received a probe response, but are not sure whether
@@ -1201,6 +1476,9 @@ static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
         mod_timer(&ifmgd->conn_mon_timer,
                   round_jiffies_up(jiffies +
                                    IEEE80211_CONNECTION_IDLE_TIME));
+out:
+        ieee80211_run_deferred_scan(local);
+        mutex_unlock(&local->mtx);
 }
 
 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
@@ -1244,18 +1522,28 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
          * anymore. The timeout will be reset if the frame is ACKed by
          * the AP.
          */
+        ifmgd->probe_send_count++;
+
         if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
                 ifmgd->nullfunc_failed = false;
                 ieee80211_send_nullfunc(sdata->local, sdata, 0);
         } else {
+                int ssid_len;
+
                 ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
-                ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid[1], NULL, 0,
-                                         (u32) -1, true, false);
+                if (WARN_ON_ONCE(ssid == NULL))
+                        ssid_len = 0;
+                else
+                        ssid_len = ssid[1];
+
+                ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL,
+                                         0, (u32) -1, true, false);
         }
 
-        ifmgd->probe_send_count++;
         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
         run_again(ifmgd, ifmgd->probe_timeout);
+        if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                drv_flush(sdata->local, false);
 }
 
 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
@@ -1267,21 +1555,22 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
         if (!ieee80211_sdata_running(sdata))
                 return;
 
-        if (sdata->local->scanning)
-                return;
-
-        if (sdata->local->tmp_channel)
-                return;
-
         mutex_lock(&ifmgd->mtx);
 
         if (!ifmgd->associated)
                 goto out;
 
+        mutex_lock(&sdata->local->mtx);
+
+        if (sdata->local->tmp_channel || sdata->local->scanning) {
+                mutex_unlock(&sdata->local->mtx);
+                goto out;
+        }
+
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        if (beacon && net_ratelimit())
-                printk(KERN_DEBUG "%s: detected beacon loss from AP "
-                       "- sending probe request\n", sdata->name);
+        if (beacon)
+                net_dbg_ratelimited("%s: detected beacon loss from AP - sending probe request\n",
+                                    sdata->name);
 #endif
 
         /*
@@ -1304,6 +1593,8 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
         else
                 ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
 
+        mutex_unlock(&sdata->local->mtx);
+
         if (already)
                 goto out;
 
@@ -1324,6 +1615,7 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct sk_buff *skb;
         const u8 *ssid;
+        int ssid_len;
 
         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
                 return NULL;
@@ -1334,8 +1626,13 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
                 return NULL;
 
         ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
+        if (WARN_ON_ONCE(ssid == NULL))
+                ssid_len = 0;
+        else
+                ssid_len = ssid[1];
+
         skb = ieee80211_build_probe_req(sdata, ifmgd->associated->bssid,
-                                        (u32) -1, ssid + 2, ssid[1],
+                                        (u32) -1, ssid + 2, ssid_len,
                                         NULL, 0, true);
 
         return skb;
@@ -1347,6 +1644,7 @@ static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         u8 bssid[ETH_ALEN];
+        u8 frame_buf[DEAUTH_DISASSOC_LEN];
 
         mutex_lock(&ifmgd->mtx);
         if (!ifmgd->associated) {
@@ -1359,17 +1657,16 @@ static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
         printk(KERN_DEBUG "%s: Connection to AP %pM lost.\n",
                sdata->name, bssid);
 
-        ieee80211_set_disassoc(sdata, true, true);
+        ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+                               WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
+                               false, frame_buf);
         mutex_unlock(&ifmgd->mtx);
 
         /*
          * must be outside lock due to cfg80211,
          * but that's not a problem.
          */
-        ieee80211_send_deauth_disassoc(sdata, bssid,
-                                       IEEE80211_STYPE_DEAUTH,
-                                       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
-                                       NULL, true);
+        cfg80211_send_deauth(sdata->dev, frame_buf, DEAUTH_DISASSOC_LEN);
 
         mutex_lock(&local->mtx);
         ieee80211_recalc_idle(local);
@@ -1423,6 +1720,126 @@ void ieee80211_connection_loss(struct ieee80211_vif *vif)
 EXPORT_SYMBOL(ieee80211_connection_loss);
 
 
+static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
+                                        bool assoc)
+{
+        struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
+
+        lockdep_assert_held(&sdata->u.mgd.mtx);
+
+        if (!assoc) {
+                sta_info_destroy_addr(sdata, auth_data->bss->bssid);
+
+                memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
+        }
+
+        cfg80211_put_bss(auth_data->bss);
+        kfree(auth_data);
+        sdata->u.mgd.auth_data = NULL;
+}
+
+static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_mgmt *mgmt, size_t len)
+{
+        struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
+        u8 *pos;
+        struct ieee802_11_elems elems;
+
+        pos = mgmt->u.auth.variable;
+        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
+        if (!elems.challenge)
+                return;
+        auth_data->expected_transaction = 4;
+        ieee80211_send_auth(sdata, 3, auth_data->algorithm,
+                            elems.challenge - 2, elems.challenge_len + 2,
+                            auth_data->bss->bssid, auth_data->bss->bssid,
+                            auth_data->key, auth_data->key_len,
+                            auth_data->key_idx);
+}
+
+static enum rx_mgmt_action __must_check
+ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
+                       struct ieee80211_mgmt *mgmt, size_t len)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        u8 bssid[ETH_ALEN];
+        u16 auth_alg, auth_transaction, status_code;
+        struct sta_info *sta;
+
+        lockdep_assert_held(&ifmgd->mtx);
+
+        if (len < 24 + 6)
+                return RX_MGMT_NONE;
+
+        if (!ifmgd->auth_data || ifmgd->auth_data->done)
+                return RX_MGMT_NONE;
+
+        memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
+
+        if (!ether_addr_equal(bssid, mgmt->bssid))
+                return RX_MGMT_NONE;
+
+        auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
+        auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
+        status_code = le16_to_cpu(mgmt->u.auth.status_code);
+
+        if (auth_alg != ifmgd->auth_data->algorithm ||
+            auth_transaction != ifmgd->auth_data->expected_transaction)
+                return RX_MGMT_NONE;
+
+        if (status_code != WLAN_STATUS_SUCCESS) {
+                printk(KERN_DEBUG "%s: %pM denied authentication (status %d)\n",
+                       sdata->name, mgmt->sa, status_code);
+                goto out;
+        }
+
+        switch (ifmgd->auth_data->algorithm) {
+        case WLAN_AUTH_OPEN:
+        case WLAN_AUTH_LEAP:
+        case WLAN_AUTH_FT:
+                break;
+        case WLAN_AUTH_SHARED_KEY:
+                if (ifmgd->auth_data->expected_transaction != 4) {
+                        ieee80211_auth_challenge(sdata, mgmt, len);
+                        /* need another frame */
+                        return RX_MGMT_NONE;
+                }
+                break;
+        default:
+                WARN_ONCE(1, "invalid auth alg %d",
+                          ifmgd->auth_data->algorithm);
+                return RX_MGMT_NONE;
+        }
+
+        printk(KERN_DEBUG "%s: authenticated\n", sdata->name);
+ out:
+        ifmgd->auth_data->done = true;
+        ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
+        run_again(ifmgd, ifmgd->auth_data->timeout);
+
+        /* move station state to auth */
+        mutex_lock(&sdata->local->sta_mtx);
+        sta = sta_info_get(sdata, bssid);
+        if (!sta) {
+                WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
+                goto out_err;
+        }
+        if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
+                printk(KERN_DEBUG "%s: failed moving %pM to auth\n",
+                       sdata->name, bssid);
+                goto out_err;
+        }
+        mutex_unlock(&sdata->local->sta_mtx);
+
+        return RX_MGMT_CFG80211_RX_AUTH;
+ out_err:
+        mutex_unlock(&sdata->local->sta_mtx);
+        /* ignore frame -- wait for timeout */
+        return RX_MGMT_NONE;
+}
+
+
 static enum rx_mgmt_action __must_check
 ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
                          struct ieee80211_mgmt *mgmt, size_t len)
@@ -1431,10 +1848,14 @@ ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
         const u8 *bssid = NULL;
         u16 reason_code;
 
+        lockdep_assert_held(&ifmgd->mtx);
+
         if (len < 24 + 2)
                 return RX_MGMT_NONE;
 
-        ASSERT_MGD_MTX(ifmgd);
+        if (!ifmgd->associated ||
+            !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
+                return RX_MGMT_NONE;
 
         bssid = ifmgd->associated->bssid;
 
@@ -1443,7 +1864,8 @@ ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
         printk(KERN_DEBUG "%s: deauthenticated from %pM (Reason: %u)\n",
                         sdata->name, bssid, reason_code);
 
-        ieee80211_set_disassoc(sdata, true, false);
+        ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
+
         mutex_lock(&sdata->local->mtx);
         ieee80211_recalc_idle(sdata->local);
         mutex_unlock(&sdata->local->mtx);
@@ -1459,15 +1881,13 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u16 reason_code;
 
-        if (len < 24 + 2)
-                return RX_MGMT_NONE;
-
-        ASSERT_MGD_MTX(ifmgd);
+        lockdep_assert_held(&ifmgd->mtx);
 
-        if (WARN_ON(!ifmgd->associated))
+        if (len < 24 + 2)
                 return RX_MGMT_NONE;
 
-        if (WARN_ON(memcmp(ifmgd->associated->bssid, mgmt->sa, ETH_ALEN)))
+        if (!ifmgd->associated ||
+            !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
                 return RX_MGMT_NONE;
 
         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
@@ -1475,10 +1895,12 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
         printk(KERN_DEBUG "%s: disassociated from %pM (Reason: %u)\n",
                         sdata->name, mgmt->sa, reason_code);
 
-        ieee80211_set_disassoc(sdata, true, false);
+        ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
+
         mutex_lock(&sdata->local->mtx);
         ieee80211_recalc_idle(sdata->local);
         mutex_unlock(&sdata->local->mtx);
+
         return RX_MGMT_CFG80211_DISASSOC;
 }
 
@@ -1524,25 +1946,38 @@ static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
         }
 }
 
-static bool ieee80211_assoc_success(struct ieee80211_work *wk,
+static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
+                                         bool assoc)
+{
+        struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
+
+        lockdep_assert_held(&sdata->u.mgd.mtx);
+
+        if (!assoc) {
+                sta_info_destroy_addr(sdata, assoc_data->bss->bssid);
+
+                memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
+        }
+
+        kfree(assoc_data);
+        sdata->u.mgd.assoc_data = NULL;
+}
+
+static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
+                                    struct cfg80211_bss *cbss,
                                     struct ieee80211_mgmt *mgmt, size_t len)
 {
-        struct ieee80211_sub_if_data *sdata = wk->sdata;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
         struct sta_info *sta;
-        struct cfg80211_bss *cbss = wk->assoc.bss;
         u8 *pos;
-        u32 rates, basic_rates;
         u16 capab_info, aid;
         struct ieee802_11_elems elems;
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
         u32 changed = 0;
         int err;
-        bool have_higher_than_11mbit = false;
-        u16 ap_ht_cap_flags;
-        int min_rate = INT_MAX, min_rate_index = -1;
 
         /* AssocResp and ReassocResp have identical structure */
 
@@ -1581,55 +2016,20 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
          * station info was already allocated and inserted before
          * the association and should be available to us
          */
-        sta = sta_info_get_rx(sdata, cbss->bssid);
+        sta = sta_info_get(sdata, cbss->bssid);
         if (WARN_ON(!sta)) {
                 mutex_unlock(&sdata->local->sta_mtx);
                 return false;
         }
 
-        sta_info_move_state(sta, IEEE80211_STA_AUTH);
-        sta_info_move_state(sta, IEEE80211_STA_ASSOC);
-        if (!(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
-                sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
-
-        rates = 0;
-        basic_rates = 0;
-        sband = local->hw.wiphy->bands[wk->chan->band];
-
-        ieee80211_get_rates(sband, elems.supp_rates, elems.supp_rates_len,
-                            &rates, &basic_rates, &have_higher_than_11mbit,
-                            &min_rate, &min_rate_index);
-
-        ieee80211_get_rates(sband, elems.ext_supp_rates,
-                            elems.ext_supp_rates_len, &rates, &basic_rates,
-                            &have_higher_than_11mbit,
-                            &min_rate, &min_rate_index);
-
-        /*
-         * some buggy APs don't advertise basic_rates. use the lowest
-         * supported rate instead.
-         */
-        if (unlikely(!basic_rates) && min_rate_index >= 0) {
-                printk(KERN_DEBUG "%s: No basic rates in AssocResp. "
-                       "Using min supported rate instead.\n", sdata->name);
-                basic_rates = BIT(min_rate_index);
-        }
-
-        sta->sta.supp_rates[wk->chan->band] = rates;
-        sdata->vif.bss_conf.basic_rates = basic_rates;
-
-        /* cf. IEEE 802.11 9.2.12 */
-        if (wk->chan->band == IEEE80211_BAND_2GHZ &&
-            have_higher_than_11mbit)
-                sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
-        else
-                sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
+        sband = local->hw.wiphy->bands[local->oper_channel->band];
 
         if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
                                 elems.ht_cap_elem, &sta->sta.ht_cap);
 
-        ap_ht_cap_flags = sta->sta.ht_cap.cap;
+        sta->supports_40mhz =
+                sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 
         rate_control_rate_init(sta);
 
@@ -1639,15 +2039,22 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
         if (elems.wmm_param)
                 set_sta_flag(sta, WLAN_STA_WME);
 
-        /* sta_info_reinsert will also unlock the mutex lock */
-        err = sta_info_reinsert(sta);
-        sta = NULL;
+        err = sta_info_move_state(sta, IEEE80211_STA_AUTH);
+        if (!err)
+                err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
+        if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
+                err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
         if (err) {
-                printk(KERN_DEBUG "%s: failed to insert STA entry for"
-                       " the AP (error %d)\n", sdata->name, err);
+                printk(KERN_DEBUG
+                       "%s: failed to move station %pM to desired state\n",
+                       sdata->name, sta->sta.addr);
+                WARN_ON(__sta_info_destroy(sta));
+                mutex_unlock(&sdata->local->sta_mtx);
                 return false;
         }
 
+        mutex_unlock(&sdata->local->sta_mtx);
+
         /*
          * Always handle WMM once after association regardless
          * of the first value the AP uses. Setting -1 here has
@@ -1660,16 +2067,13 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
                 ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
                                          elems.wmm_param_len);
         else
-                ieee80211_set_wmm_default(sdata);
-
-        local->oper_channel = wk->chan;
+                ieee80211_set_wmm_default(sdata, false);
+        changed |= BSS_CHANGED_QOS;
 
-        if (elems.ht_info_elem && elems.wmm_param &&
-            (sdata->local->hw.queues >= 4) &&
+        if (elems.ht_operation && elems.wmm_param &&
             !(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
-                changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
-                                               cbss->bssid, ap_ht_cap_flags,
-                                               false);
+                changed |= ieee80211_config_ht_tx(sdata, elems.ht_operation,
+                                                  cbss->bssid, false);
 
         /* set AID and assoc capability,
          * ieee80211_set_associated() will tell the driver */
@@ -1694,7 +2098,88 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
         return true;
 }
 
+static enum rx_mgmt_action __must_check
+ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
+                             struct ieee80211_mgmt *mgmt, size_t len,
+                             struct cfg80211_bss **bss)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
+        u16 capab_info, status_code, aid;
+        struct ieee802_11_elems elems;
+        u8 *pos;
+        bool reassoc;
+
+        lockdep_assert_held(&ifmgd->mtx);
+
+        if (!assoc_data)
+                return RX_MGMT_NONE;
+        if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
+                return RX_MGMT_NONE;
+
+        /*
+         * AssocResp and ReassocResp have identical structure, so process both
+         * of them in this function.
+         */
+
+        if (len < 24 + 6)
+                return RX_MGMT_NONE;
+
+        reassoc = ieee80211_is_reassoc_req(mgmt->frame_control);
+        capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
+        status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
+        aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
+
+        printk(KERN_DEBUG "%s: RX %sssocResp from %pM (capab=0x%x "
+               "status=%d aid=%d)\n",
+               sdata->name, reassoc ? "Rea" : "A", mgmt->sa,
+               capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
+
+        pos = mgmt->u.assoc_resp.variable;
+        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
+
+        if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
+            elems.timeout_int && elems.timeout_int_len == 5 &&
+            elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
+                u32 tu, ms;
+                tu = get_unaligned_le32(elems.timeout_int + 1);
+                ms = tu * 1024 / 1000;
+                printk(KERN_DEBUG "%s: %pM rejected association temporarily; "
+                       "comeback duration %u TU (%u ms)\n",
+                       sdata->name, mgmt->sa, tu, ms);
+                assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
+                if (ms > IEEE80211_ASSOC_TIMEOUT)
+                        run_again(ifmgd, assoc_data->timeout);
+                return RX_MGMT_NONE;
+        }
+
+        *bss = assoc_data->bss;
+
+        if (status_code != WLAN_STATUS_SUCCESS) {
+                printk(KERN_DEBUG "%s: %pM denied association (code=%d)\n",
+                       sdata->name, mgmt->sa, status_code);
+                ieee80211_destroy_assoc_data(sdata, false);
+        } else {
+                printk(KERN_DEBUG "%s: associated\n", sdata->name);
+
+                if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
+                        /* oops -- internal error -- send timeout for now */
+                        ieee80211_destroy_assoc_data(sdata, true);
+                        sta_info_destroy_addr(sdata, mgmt->bssid);
+                        cfg80211_put_bss(*bss);
+                        return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
+                }
 
+                /*
+                 * destroy assoc_data afterwards, as otherwise an idle
+                 * recalc after assoc_data is NULL but before associated
+                 * is set can cause the interface to go idle
+                 */
+                ieee80211_destroy_assoc_data(sdata, true);
+        }
+
+        return RX_MGMT_CFG80211_RX_ASSOC;
+}
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                   struct ieee80211_mgmt *mgmt,
                                   size_t len,
@@ -1708,7 +2193,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_channel *channel;
         bool need_ps = false;
 
-        if (sdata->u.mgd.associated) {
+        if (sdata->u.mgd.associated &&
+            ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) {
                 bss = (void *)sdata->u.mgd.associated->priv;
                 /* not previously set so we may need to recalc */
                 need_ps = !bss->dtim_period;
@@ -1763,7 +2249,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
 
         ASSERT_MGD_MTX(ifmgd);
 
-        if (memcmp(mgmt->da, sdata->vif.addr, ETH_ALEN))
+        if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
                 return; /* ignore ProbeResp to foreign address */
 
         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
@@ -1776,8 +2262,17 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
 
         if (ifmgd->associated &&
-            memcmp(mgmt->bssid, ifmgd->associated->bssid, ETH_ALEN) == 0)
+            ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
                 ieee80211_reset_ap_probe(sdata);
+
+        if (ifmgd->auth_data && !ifmgd->auth_data->bss->proberesp_ies &&
+            ether_addr_equal(mgmt->bssid, ifmgd->auth_data->bss->bssid)) {
+                /* got probe response, continue with auth */
+                printk(KERN_DEBUG "%s: direct probe responded\n", sdata->name);
+                ifmgd->auth_data->tries = 0;
+                ifmgd->auth_data->timeout = jiffies;
+                run_again(ifmgd, ifmgd->auth_data->timeout);
+        }
 }
 
 /*
@@ -1799,7 +2294,7 @@ static const u64 care_about_ies =
         (1ULL << WLAN_EID_CHANNEL_SWITCH) |
         (1ULL << WLAN_EID_PWR_CONSTRAINT) |
         (1ULL << WLAN_EID_HT_CAPABILITY) |
-        (1ULL << WLAN_EID_HT_INFORMATION);
+        (1ULL << WLAN_EID_HT_OPERATION);
 
 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_mgmt *mgmt,
@@ -1817,7 +2312,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         u32 ncrc;
         u8 *bssid;
 
-        ASSERT_MGD_MTX(ifmgd);
+        lockdep_assert_held(&ifmgd->mtx);
 
         /* Process beacon from the current BSS */
         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
@@ -1827,21 +2322,25 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         if (rx_status->freq != local->hw.conf.channel->center_freq)
                 return;
 
-        /*
-         * We might have received a number of frames, among them a
-         * disassoc frame and a beacon...
-         */
-        if (!ifmgd->associated)
-                return;
+        if (ifmgd->assoc_data && !ifmgd->assoc_data->have_beacon &&
+            ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
+                ieee802_11_parse_elems(mgmt->u.beacon.variable,
+                                       len - baselen, &elems);
 
-        bssid = ifmgd->associated->bssid;
+                ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems,
+                                      false);
+                ifmgd->assoc_data->have_beacon = true;
+                ifmgd->assoc_data->sent_assoc = false;
+                /* continue assoc process */
+                ifmgd->assoc_data->timeout = jiffies;
+                run_again(ifmgd, ifmgd->assoc_data->timeout);
+                return;
+        }
 
-        /*
-         * And in theory even frames from a different AP we were just
-         * associated to a split-second ago!
-         */
-        if (memcmp(bssid, mgmt->bssid, ETH_ALEN) != 0)
+        if (!ifmgd->associated ||
+            !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
                 return;
+        bssid = ifmgd->associated->bssid;
 
         /* Track average RSSI from the Beacon frames of the current AP */
         ifmgd->last_beacon_signal = rx_status->signal;
@@ -1882,7 +2381,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 
         if (bss_conf->cqm_rssi_thold &&
             ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
-            !(local->hw.flags & IEEE80211_HW_SUPPORTS_CQM_RSSI)) {
+            !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
                 int sig = ifmgd->ave_beacon_signal / 16;
                 int last_event = ifmgd->last_cqm_event_signal;
                 int thold = bss_conf->cqm_rssi_thold;
@@ -1906,10 +2405,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 
         if (ifmgd->flags & IEEE80211_STA_BEACON_POLL) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: cancelling probereq poll due "
-                               "to a received beacon\n", sdata->name);
-                }
+                net_dbg_ratelimited("%s: cancelling probereq poll due to a received beacon\n",
+                                    sdata->name);
 #endif
                 ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
                 mutex_lock(&local->iflist_mtx);
@@ -1943,11 +2440,13 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
                 if (directed_tim) {
                         if (local->hw.conf.dynamic_ps_timeout > 0) {
-                                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
-                                ieee80211_hw_config(local,
-                                                    IEEE80211_CONF_CHANGE_PS);
+                                if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+                                        local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+                                        ieee80211_hw_config(local,
+                                                            IEEE80211_CONF_CHANGE_PS);
+                                }
                                 ieee80211_send_nullfunc(local, sdata, 0);
-                        } else {
+                        } else if (!local->pspolling && sdata->u.mgd.powersave) {
                                 local->pspolling = true;
 
                                 /*
@@ -1979,31 +2478,14 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                         erp_valid, erp_value);
 
 
-        if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
+        if (elems.ht_cap_elem && elems.ht_operation && elems.wmm_param &&
             !(ifmgd->flags & IEEE80211_STA_DISABLE_11N)) {
-                struct sta_info *sta;
                 struct ieee80211_supported_band *sband;
-                u16 ap_ht_cap_flags;
-
-                rcu_read_lock();
-
-                sta = sta_info_get(sdata, bssid);
-                if (WARN_ON(!sta)) {
-                        rcu_read_unlock();
-                        return;
-                }
 
                 sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
-                ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
-                                elems.ht_cap_elem, &sta->sta.ht_cap);
-
-                ap_ht_cap_flags = sta->sta.ht_cap.cap;
-
-                rcu_read_unlock();
-
-                changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
-                                               bssid, ap_ht_cap_flags, true);
+                changed |= ieee80211_config_ht_tx(sdata, elems.ht_operation,
+                                                  bssid, true);
         }
 
         /* Note: country IE parsing is done for us by cfg80211 */
@@ -2025,6 +2507,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_rx_status *rx_status;
         struct ieee80211_mgmt *mgmt;
+        struct cfg80211_bss *bss = NULL;
         enum rx_mgmt_action rma = RX_MGMT_NONE;
         u16 fc;
 
@@ -2034,92 +2517,59 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 
         mutex_lock(&ifmgd->mtx);
 
-        if (ifmgd->associated &&
-            memcmp(ifmgd->associated->bssid, mgmt->bssid, ETH_ALEN) == 0) {
-                switch (fc & IEEE80211_FCTL_STYPE) {
-                case IEEE80211_STYPE_BEACON:
-                        ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
-                                                 rx_status);
-                        break;
-                case IEEE80211_STYPE_PROBE_RESP:
-                        ieee80211_rx_mgmt_probe_resp(sdata, skb);
-                        break;
-                case IEEE80211_STYPE_DEAUTH:
-                        rma = ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
-                        break;
-                case IEEE80211_STYPE_DISASSOC:
-                        rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
-                        break;
-                case IEEE80211_STYPE_ACTION:
-                        switch (mgmt->u.action.category) {
-                        case WLAN_CATEGORY_SPECTRUM_MGMT:
-                                ieee80211_sta_process_chanswitch(sdata,
-                                                &mgmt->u.action.u.chan_switch.sw_elem,
-                                                (void *)ifmgd->associated->priv,
-                                                rx_status->mactime);
-                                break;
-                        }
-                }
-                mutex_unlock(&ifmgd->mtx);
-
-                switch (rma) {
-                case RX_MGMT_NONE:
-                        /* no action */
-                        break;
-                case RX_MGMT_CFG80211_DEAUTH:
-                        cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
-                        break;
-                case RX_MGMT_CFG80211_DISASSOC:
-                        cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
+        switch (fc & IEEE80211_FCTL_STYPE) {
+        case IEEE80211_STYPE_BEACON:
+                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
+                break;
+        case IEEE80211_STYPE_PROBE_RESP:
+                ieee80211_rx_mgmt_probe_resp(sdata, skb);
+                break;
+        case IEEE80211_STYPE_AUTH:
+                rma = ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
+                break;
+        case IEEE80211_STYPE_DEAUTH:
+                rma = ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
+                break;
+        case IEEE80211_STYPE_DISASSOC:
+                rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
+                break;
+        case IEEE80211_STYPE_ASSOC_RESP:
+        case IEEE80211_STYPE_REASSOC_RESP:
+                rma = ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, &bss);
+                break;
+        case IEEE80211_STYPE_ACTION:
+                switch (mgmt->u.action.category) {
+                case WLAN_CATEGORY_SPECTRUM_MGMT:
+                        ieee80211_sta_process_chanswitch(sdata,
+                                        &mgmt->u.action.u.chan_switch.sw_elem,
+                                        (void *)ifmgd->associated->priv,
+                                        rx_status->mactime);
                         break;
-                default:
-                        WARN(1, "unexpected: %d", rma);
                 }
-                return;
         }
-
         mutex_unlock(&ifmgd->mtx);
 
-        if (skb->len >= 24 + 2 /* mgmt + deauth reason */ &&
-            (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH) {
-                struct ieee80211_local *local = sdata->local;
-                struct ieee80211_work *wk;
-
-                mutex_lock(&local->mtx);
-                list_for_each_entry(wk, &local->work_list, list) {
-                        if (wk->sdata != sdata)
-                                continue;
-
-                        if (wk->type != IEEE80211_WORK_ASSOC &&
-                            wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
-                                continue;
-
-                        if (memcmp(mgmt->bssid, wk->filter_ta, ETH_ALEN))
-                                continue;
-                        if (memcmp(mgmt->sa, wk->filter_ta, ETH_ALEN))
-                                continue;
-
-                        /*
-                         * Printing the message only here means we can't
-                         * spuriously print it, but it also means that it
-                         * won't be printed when the frame comes in before
-                         * we even tried to associate or in similar cases.
-                         *
-                         * Ultimately, I suspect cfg80211 should print the
-                         * messages instead.
-                         */
-                        printk(KERN_DEBUG
-                               "%s: deauthenticated from %pM (Reason: %u)\n",
-                               sdata->name, mgmt->bssid,
-                               le16_to_cpu(mgmt->u.deauth.reason_code));
-
-                        list_del_rcu(&wk->list);
-                        free_work(wk);
-                        break;
-                }
-                mutex_unlock(&local->mtx);
-
+        switch (rma) {
+        case RX_MGMT_NONE:
+                /* no action */
+                break;
+        case RX_MGMT_CFG80211_DEAUTH:
                 cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
+                break;
+        case RX_MGMT_CFG80211_DISASSOC:
+                cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
+                break;
+        case RX_MGMT_CFG80211_RX_AUTH:
+                cfg80211_send_rx_auth(sdata->dev, (u8 *)mgmt, skb->len);
+                break;
+        case RX_MGMT_CFG80211_RX_ASSOC:
+                cfg80211_send_rx_assoc(sdata->dev, bss, (u8 *)mgmt, skb->len);
+                break;
+        case RX_MGMT_CFG80211_ASSOC_TIMEOUT:
+                cfg80211_send_assoc_timeout(sdata->dev, mgmt->bssid);
+                break;
+        default:
+                WARN(1, "unexpected: %d", rma);
         }
 }
 
@@ -2143,19 +2593,20 @@ static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        u8 frame_buf[DEAUTH_DISASSOC_LEN];
 
         ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
                           IEEE80211_STA_BEACON_POLL);
 
-        ieee80211_set_disassoc(sdata, true, true);
+        ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
+                               false, frame_buf);
         mutex_unlock(&ifmgd->mtx);
+
         /*
          * must be outside lock due to cfg80211,
          * but that's not a problem.
          */
-        ieee80211_send_deauth_disassoc(sdata, bssid,
-                        IEEE80211_STYPE_DEAUTH, reason,
-                        NULL, true);
+        cfg80211_send_deauth(sdata->dev, frame_buf, DEAUTH_DISASSOC_LEN);
 
         mutex_lock(&local->mtx);
         ieee80211_recalc_idle(local);
@@ -2164,14 +2615,144 @@ static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
         mutex_lock(&ifmgd->mtx);
 }
 
+static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
+
+        lockdep_assert_held(&ifmgd->mtx);
+
+        if (WARN_ON_ONCE(!auth_data))
+                return -EINVAL;
+
+        auth_data->tries++;
+
+        if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
+                printk(KERN_DEBUG "%s: authentication with %pM timed out\n",
+                       sdata->name, auth_data->bss->bssid);
+
+                /*
+                 * Most likely AP is not in the range so remove the
+                 * bss struct for that AP.
+                 */
+                cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);
+
+                return -ETIMEDOUT;
+        }
+
+        if (auth_data->bss->proberesp_ies) {
+                printk(KERN_DEBUG "%s: send auth to %pM (try %d/%d)\n",
+                       sdata->name, auth_data->bss->bssid, auth_data->tries,
+                       IEEE80211_AUTH_MAX_TRIES);
+
+                auth_data->expected_transaction = 2;
+                ieee80211_send_auth(sdata, 1, auth_data->algorithm,
+                                    auth_data->ie, auth_data->ie_len,
+                                    auth_data->bss->bssid,
+                                    auth_data->bss->bssid, NULL, 0, 0);
+        } else {
+                const u8 *ssidie;
+
+                printk(KERN_DEBUG "%s: direct probe to %pM (try %d/%i)\n",
+                       sdata->name, auth_data->bss->bssid, auth_data->tries,
+                       IEEE80211_AUTH_MAX_TRIES);
+
+                ssidie = ieee80211_bss_get_ie(auth_data->bss, WLAN_EID_SSID);
+                if (!ssidie)
+                        return -EINVAL;
+                /*
+                 * Direct probe is sent to broadcast address as some APs
+                 * will not answer to direct packet in unassociated state.
+                 */
+                ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1],
+                                         NULL, 0, (u32) -1, true, false);
+        }
+
+        auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+        run_again(ifmgd, auth_data->timeout);
+
+        return 0;
+}
+
+static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
+        struct ieee80211_local *local = sdata->local;
+
+        lockdep_assert_held(&sdata->u.mgd.mtx);
+
+        assoc_data->tries++;
+        if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
+                printk(KERN_DEBUG "%s: association with %pM timed out\n",
+                       sdata->name, assoc_data->bss->bssid);
+
+                /*
+                 * Most likely AP is not in the range so remove the
+                 * bss struct for that AP.
+                 */
+                cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);
+
+                return -ETIMEDOUT;
+        }
+
+        printk(KERN_DEBUG "%s: associate with %pM (try %d/%d)\n",
+               sdata->name, assoc_data->bss->bssid, assoc_data->tries,
+               IEEE80211_ASSOC_MAX_TRIES);
+        ieee80211_send_assoc(sdata);
+
+        assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
+        run_again(&sdata->u.mgd, assoc_data->timeout);
+
+        return 0;
+}
+
 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        /* then process the rest of the work */
         mutex_lock(&ifmgd->mtx);
 
+        if (ifmgd->auth_data &&
+            time_after(jiffies, ifmgd->auth_data->timeout)) {
+                if (ifmgd->auth_data->done) {
+                        /*
+                         * ok ... we waited for assoc but userspace didn't,
+                         * so let's just kill the auth data
+                         */
+                        ieee80211_destroy_auth_data(sdata, false);
+                } else if (ieee80211_probe_auth(sdata)) {
+                        u8 bssid[ETH_ALEN];
+
+                        memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
+
+                        ieee80211_destroy_auth_data(sdata, false);
+
+                        mutex_unlock(&ifmgd->mtx);
+                        cfg80211_send_auth_timeout(sdata->dev, bssid);
+                        mutex_lock(&ifmgd->mtx);
+                }
+        } else if (ifmgd->auth_data)
+                run_again(ifmgd, ifmgd->auth_data->timeout);
+
+        if (ifmgd->assoc_data &&
+            time_after(jiffies, ifmgd->assoc_data->timeout)) {
+                if (!ifmgd->assoc_data->have_beacon ||
+                    ieee80211_do_assoc(sdata)) {
+                        u8 bssid[ETH_ALEN];
+
+                        memcpy(bssid, ifmgd->assoc_data->bss->bssid, ETH_ALEN);
+
+                        ieee80211_destroy_assoc_data(sdata, false);
+
+                        mutex_unlock(&ifmgd->mtx);
+                        cfg80211_send_assoc_timeout(sdata->dev, bssid);
+                        mutex_lock(&ifmgd->mtx);
+                }
+        } else if (ifmgd->assoc_data)
+                run_again(ifmgd, ifmgd->assoc_data->timeout);
+
         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
                             IEEE80211_STA_CONNECTION_POLL) &&
             ifmgd->associated) {
@@ -2247,6 +2828,10 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
         }
 
         mutex_unlock(&ifmgd->mtx);
+
+        mutex_lock(&local->mtx);
+        ieee80211_recalc_idle(local);
+        mutex_unlock(&local->mtx);
 }
 
 static void ieee80211_sta_bcn_mon_timer(unsigned long data)
@@ -2286,13 +2871,17 @@ static void ieee80211_sta_monitor_work(struct work_struct *work)
 
 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
 {
+        u32 flags;
+
         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 sdata->u.mgd.flags &= ~(IEEE80211_STA_BEACON_POLL |
                                         IEEE80211_STA_CONNECTION_POLL);
 
                 /* let's probe the connection once */
-                ieee80211_queue_work(&sdata->local->hw,
-                           &sdata->u.mgd.monitor_work);
+                flags = sdata->local->hw.flags;
+                if (!(flags & IEEE80211_HW_CONNECTION_MONITOR))
+                        ieee80211_queue_work(&sdata->local->hw,
+                                             &sdata->u.mgd.monitor_work);
                 /* and do all the other regular work too */
                 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
         }
@@ -2356,7 +2945,6 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
                 add_timer(&ifmgd->chswitch_timer);
         ieee80211_sta_reset_beacon_monitor(sdata);
         ieee80211_restart_sta_timer(sdata);
-        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.monitor_work);
 }
 #endif
 
@@ -2382,6 +2970,8 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
 
         ifmgd->flags = 0;
         ifmgd->powersave = sdata->wdev.ps;
+        ifmgd->uapsd_queues = IEEE80211_DEFAULT_UAPSD_QUEUES;
+        ifmgd->uapsd_max_sp_len = IEEE80211_DEFAULT_MAX_SP_LEN;
 
         mutex_init(&ifmgd->mtx);
 
@@ -2418,54 +3008,183 @@ int ieee80211_max_network_latency(struct notifier_block *nb,
         return 0;
 }
 
-/* config hooks */
-static enum work_done_result
-ieee80211_probe_auth_done(struct ieee80211_work *wk,
-                          struct sk_buff *skb)
+static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
+                                     struct cfg80211_bss *cbss, bool assoc)
 {
-        struct ieee80211_local *local = wk->sdata->local;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_bss *bss = (void *)cbss->priv;
+        struct sta_info *sta;
+        bool have_sta = false;
+        int err;
+        int ht_cfreq;
+        enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
+        const u8 *ht_oper_ie;
+        const struct ieee80211_ht_operation *ht_oper = NULL;
+        struct ieee80211_supported_band *sband;
+
+        if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
+                return -EINVAL;
+
+        if (assoc) {
+                rcu_read_lock();
+                have_sta = sta_info_get(sdata, cbss->bssid);
+                rcu_read_unlock();
+        }
+
+        if (!have_sta) {
+                sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
+                if (!sta)
+                        return -ENOMEM;
+        }
+
+        mutex_lock(&local->mtx);
+        ieee80211_recalc_idle(sdata->local);
+        mutex_unlock(&local->mtx);
+
+        /* switch to the right channel */
+        sband = local->hw.wiphy->bands[cbss->channel->band];
+
+        ifmgd->flags &= ~IEEE80211_STA_DISABLE_40MHZ;
+
+        if (sband->ht_cap.ht_supported) {
+                ht_oper_ie = cfg80211_find_ie(WLAN_EID_HT_OPERATION,
+                                              cbss->information_elements,
+                                              cbss->len_information_elements);
+                if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
+                        ht_oper = (void *)(ht_oper_ie + 2);
+        }
 
-        if (!skb) {
-                cfg80211_send_auth_timeout(wk->sdata->dev, wk->filter_ta);
-                goto destroy;
+        if (ht_oper) {
+                ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
+                                                          cbss->channel->band);
+                /* check that channel matches the right operating channel */
+                if (cbss->channel->center_freq != ht_cfreq) {
+                        /*
+                         * It's possible that some APs are confused here;
+                         * Netgear WNDR3700 sometimes reports 4 higher than
+                         * the actual channel in association responses, but
+                         * since we look at probe response/beacon data here
+                         * it should be OK.
+                         */
+                        printk(KERN_DEBUG
+                               "%s: Wrong control channel: center-freq: %d"
+                               " ht-cfreq: %d ht->primary_chan: %d"
+                               " band: %d. Disabling HT.\n",
+                               sdata->name, cbss->channel->center_freq,
+                               ht_cfreq, ht_oper->primary_chan,
+                               cbss->channel->band);
+                        ht_oper = NULL;
+                }
+        }
+
+        if (ht_oper) {
+                channel_type = NL80211_CHAN_HT20;
+
+                if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
+                        switch (ht_oper->ht_param &
+                                        IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                                channel_type = NL80211_CHAN_HT40PLUS;
+                                break;
+                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                                channel_type = NL80211_CHAN_HT40MINUS;
+                                break;
+                        }
+                }
         }
 
-        if (wk->type == IEEE80211_WORK_AUTH) {
-                cfg80211_send_rx_auth(wk->sdata->dev, skb->data, skb->len);
-                goto destroy;
+        if (!ieee80211_set_channel_type(local, sdata, channel_type)) {
+                /* can only fail due to HT40+/- mismatch */
+                channel_type = NL80211_CHAN_HT20;
+                printk(KERN_DEBUG
+                       "%s: disabling 40 MHz due to multi-vif mismatch\n",
+                       sdata->name);
+                ifmgd->flags |= IEEE80211_STA_DISABLE_40MHZ;
+                WARN_ON(!ieee80211_set_channel_type(local, sdata,
+                                                    channel_type));
         }
 
-        mutex_lock(&wk->sdata->u.mgd.mtx);
-        ieee80211_rx_mgmt_probe_resp(wk->sdata, skb);
-        mutex_unlock(&wk->sdata->u.mgd.mtx);
+        local->oper_channel = cbss->channel;
+        ieee80211_hw_config(local, 0);
+
+        if (!have_sta) {
+                u32 rates = 0, basic_rates = 0;
+                bool have_higher_than_11mbit;
+                int min_rate = INT_MAX, min_rate_index = -1;
+
+                ieee80211_get_rates(sband, bss->supp_rates,
+                                    bss->supp_rates_len,
+                                    &rates, &basic_rates,
+                                    &have_higher_than_11mbit,
+                                    &min_rate, &min_rate_index);
+
+                /*
+                 * This used to be a workaround for basic rates missing
+                 * in the association response frame. Now that we no
+                 * longer use the basic rates from there, it probably
+                 * doesn't happen any more, but keep the workaround so
+                 * in case some *other* APs are buggy in different ways
+                 * we can connect -- with a warning.
+                 */
+                if (!basic_rates && min_rate_index >= 0) {
+                        printk(KERN_DEBUG
+                               "%s: No basic rates, using min rate instead.\n",
+                               sdata->name);
+                        basic_rates = BIT(min_rate_index);
+                }
+
+                sta->sta.supp_rates[cbss->channel->band] = rates;
+                sdata->vif.bss_conf.basic_rates = basic_rates;
 
-        wk->type = IEEE80211_WORK_AUTH;
-        wk->probe_auth.tries = 0;
-        return WORK_DONE_REQUEUE;
- destroy:
-        if (wk->probe_auth.synced)
-                drv_finish_tx_sync(local, wk->sdata, wk->filter_ta,
-                                   IEEE80211_TX_SYNC_AUTH);
+                /* cf. IEEE 802.11 9.2.12 */
+                if (local->oper_channel->band == IEEE80211_BAND_2GHZ &&
+                    have_higher_than_11mbit)
+                        sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
+                else
+                        sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
+
+                memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);
+
+                /* tell driver about BSSID and basic rates */
+                ieee80211_bss_info_change_notify(sdata,
+                        BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES);
+
+                if (assoc)
+                        sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
+
+                err = sta_info_insert(sta);
+                sta = NULL;
+                if (err) {
+                        printk(KERN_DEBUG
+                               "%s: failed to insert STA entry for the AP (error %d)\n",
+                               sdata->name, err);
+                        return err;
+                }
+        } else
+                WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
 
-        return WORK_DONE_DESTROY;
+        return 0;
 }
 
+/* config hooks */
 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
                        struct cfg80211_auth_request *req)
 {
-        const u8 *ssid;
-        struct ieee80211_work *wk;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_mgd_auth_data *auth_data;
         u16 auth_alg;
+        int err;
 
-        if (req->local_state_change)
-                return 0; /* no need to update mac80211 state */
+        /* prepare auth data structure */
 
         switch (req->auth_type) {
         case NL80211_AUTHTYPE_OPEN_SYSTEM:
                 auth_alg = WLAN_AUTH_OPEN;
                 break;
         case NL80211_AUTHTYPE_SHARED_KEY:
-                if (IS_ERR(sdata->local->wep_tx_tfm))
+                if (IS_ERR(local->wep_tx_tfm))
                         return -EOPNOTSUPP;
                 auth_alg = WLAN_AUTH_SHARED_KEY;
                 break;
@@ -2479,201 +3198,154 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
                 return -EOPNOTSUPP;
         }
 
-        wk = kzalloc(sizeof(*wk) + req->ie_len, GFP_KERNEL);
-        if (!wk)
+        auth_data = kzalloc(sizeof(*auth_data) + req->ie_len, GFP_KERNEL);
+        if (!auth_data)
                 return -ENOMEM;
 
-        memcpy(wk->filter_ta, req->bss->bssid, ETH_ALEN);
+        auth_data->bss = req->bss;
 
         if (req->ie && req->ie_len) {
-                memcpy(wk->ie, req->ie, req->ie_len);
-                wk->ie_len = req->ie_len;
+                memcpy(auth_data->ie, req->ie, req->ie_len);
+                auth_data->ie_len = req->ie_len;
         }
 
         if (req->key && req->key_len) {
-                wk->probe_auth.key_len = req->key_len;
-                wk->probe_auth.key_idx = req->key_idx;
-                memcpy(wk->probe_auth.key, req->key, req->key_len);
+                auth_data->key_len = req->key_len;
+                auth_data->key_idx = req->key_idx;
+                memcpy(auth_data->key, req->key, req->key_len);
         }
 
-        ssid = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
-        memcpy(wk->probe_auth.ssid, ssid + 2, ssid[1]);
-        wk->probe_auth.ssid_len = ssid[1];
-
-        wk->probe_auth.algorithm = auth_alg;
-        wk->probe_auth.privacy = req->bss->capability & WLAN_CAPABILITY_PRIVACY;
-
-        /* if we already have a probe, don't probe again */
-        if (req->bss->proberesp_ies)
-                wk->type = IEEE80211_WORK_AUTH;
-        else
-                wk->type = IEEE80211_WORK_DIRECT_PROBE;
-        wk->chan = req->bss->channel;
-        wk->chan_type = NL80211_CHAN_NO_HT;
-        wk->sdata = sdata;
-        wk->done = ieee80211_probe_auth_done;
-
-        ieee80211_add_work(wk);
-        return 0;
-}
-
-/* create and insert a dummy station entry */
-static int ieee80211_pre_assoc(struct ieee80211_sub_if_data *sdata,
-                                u8 *bssid) {
-        struct sta_info *sta;
-        int err;
-
-        sta = sta_info_alloc(sdata, bssid, GFP_KERNEL);
-        if (!sta)
-                return -ENOMEM;
-
-        sta->dummy = true;
+        auth_data->algorithm = auth_alg;
 
-        err = sta_info_insert(sta);
-        sta = NULL;
-        if (err) {
-                printk(KERN_DEBUG "%s: failed to insert Dummy STA entry for"
-                       " the AP (error %d)\n", sdata->name, err);
-                return err;
-        }
-
-        return 0;
-}
+        /* try to authenticate/probe */
 
-static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
-                                                  struct sk_buff *skb)
-{
-        struct ieee80211_local *local = wk->sdata->local;
-        struct ieee80211_mgmt *mgmt;
-        struct ieee80211_rx_status *rx_status;
-        struct ieee802_11_elems elems;
-        struct cfg80211_bss *cbss = wk->assoc.bss;
-        u16 status;
+        mutex_lock(&ifmgd->mtx);
 
-        if (!skb) {
-                sta_info_destroy_addr(wk->sdata, cbss->bssid);
-                cfg80211_send_assoc_timeout(wk->sdata->dev, wk->filter_ta);
-                goto destroy;
+        if ((ifmgd->auth_data && !ifmgd->auth_data->done) ||
+            ifmgd->assoc_data) {
+                err = -EBUSY;
+                goto err_free;
         }
 
-        if (wk->type == IEEE80211_WORK_ASSOC_BEACON_WAIT) {
-                mutex_lock(&wk->sdata->u.mgd.mtx);
-                rx_status = (void *) skb->cb;
-                ieee802_11_parse_elems(skb->data + 24 + 12, skb->len - 24 - 12, &elems);
-                ieee80211_rx_bss_info(wk->sdata, (void *)skb->data, skb->len, rx_status,
-                                      &elems, true);
-                mutex_unlock(&wk->sdata->u.mgd.mtx);
+        if (ifmgd->auth_data)
+                ieee80211_destroy_auth_data(sdata, false);
 
-                wk->type = IEEE80211_WORK_ASSOC;
-                /* not really done yet */
-                return WORK_DONE_REQUEUE;
-        }
+        /* prep auth_data so we don't go into idle on disassoc */
+        ifmgd->auth_data = auth_data;
 
-        mgmt = (void *)skb->data;
-        status = le16_to_cpu(mgmt->u.assoc_resp.status_code);
+        if (ifmgd->associated)
+                ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
 
-        if (status == WLAN_STATUS_SUCCESS) {
-                if (wk->assoc.synced)
-                        drv_finish_tx_sync(local, wk->sdata, wk->filter_ta,
-                                           IEEE80211_TX_SYNC_ASSOC);
+        printk(KERN_DEBUG "%s: authenticate with %pM\n",
+               sdata->name, req->bss->bssid);
 
-                mutex_lock(&wk->sdata->u.mgd.mtx);
-                if (!ieee80211_assoc_success(wk, mgmt, skb->len)) {
-                        mutex_unlock(&wk->sdata->u.mgd.mtx);
-                        /* oops -- internal error -- send timeout for now */
-                        sta_info_destroy_addr(wk->sdata, cbss->bssid);
-                        cfg80211_send_assoc_timeout(wk->sdata->dev,
-                                                    wk->filter_ta);
-                        return WORK_DONE_DESTROY;
-                }
+        err = ieee80211_prep_connection(sdata, req->bss, false);
+        if (err)
+                goto err_clear;
 
-                mutex_unlock(&wk->sdata->u.mgd.mtx);
-        } else {
-                /* assoc failed - destroy the dummy station entry */
-                sta_info_destroy_addr(wk->sdata, cbss->bssid);
+        err = ieee80211_probe_auth(sdata);
+        if (err) {
+                sta_info_destroy_addr(sdata, req->bss->bssid);
+                goto err_clear;
         }
 
-        cfg80211_send_rx_assoc(wk->sdata->dev, skb->data, skb->len);
- destroy:
-        if (wk->assoc.synced)
-                drv_finish_tx_sync(local, wk->sdata, wk->filter_ta,
-                                   IEEE80211_TX_SYNC_ASSOC);
+        /* hold our own reference */
+        cfg80211_ref_bss(auth_data->bss);
+        err = 0;
+        goto out_unlock;
+
+ err_clear:
+        ifmgd->auth_data = NULL;
+ err_free:
+        kfree(auth_data);
+ out_unlock:
+        mutex_unlock(&ifmgd->mtx);
 
-        return WORK_DONE_DESTROY;
+        return err;
 }
 
 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                         struct cfg80211_assoc_request *req)
 {
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_bss *bss = (void *)req->bss->priv;
-        struct ieee80211_work *wk;
-        const u8 *ssid;
+        struct ieee80211_mgd_assoc_data *assoc_data;
+        struct ieee80211_supported_band *sband;
+        const u8 *ssidie;
         int i, err;
 
+        ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
+        if (!ssidie)
+                return -EINVAL;
+
+        assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
+        if (!assoc_data)
+                return -ENOMEM;
+
         mutex_lock(&ifmgd->mtx);
-        if (ifmgd->associated) {
-                if (!req->prev_bssid ||
-                    memcmp(req->prev_bssid, ifmgd->associated->bssid,
-                           ETH_ALEN)) {
-                        /*
-                         * We are already associated and the request was not a
-                         * reassociation request from the current BSS, so
-                         * reject it.
-                         */
-                        mutex_unlock(&ifmgd->mtx);
-                        return -EALREADY;
-                }
 
-                /* Trying to reassociate - clear previous association state */
-                ieee80211_set_disassoc(sdata, true, false);
+        if (ifmgd->associated)
+                ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
+
+        if (ifmgd->auth_data && !ifmgd->auth_data->done) {
+                err = -EBUSY;
+                goto err_free;
         }
-        mutex_unlock(&ifmgd->mtx);
 
-        wk = kzalloc(sizeof(*wk) + req->ie_len, GFP_KERNEL);
-        if (!wk)
-                return -ENOMEM;
+        if (ifmgd->assoc_data) {
+                err = -EBUSY;
+                goto err_free;
+        }
 
-        /*
-         * create a dummy station info entry in order
-         * to start accepting incoming EAPOL packets from the station
-         */
-        err = ieee80211_pre_assoc(sdata, req->bss->bssid);
-        if (err) {
-                kfree(wk);
-                return err;
+        if (ifmgd->auth_data) {
+                bool match;
+
+                /* keep sta info, bssid if matching */
+                match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
+                ieee80211_destroy_auth_data(sdata, match);
         }
 
+        /* prepare assoc data */
+
         ifmgd->flags &= ~IEEE80211_STA_DISABLE_11N;
         ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
 
         ifmgd->beacon_crc_valid = false;
 
+        /*
+         * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
+         * We still associate in non-HT mode (11a/b/g) if any one of these
+         * ciphers is configured as pairwise.
+         * We can set this to true for non-11n hardware, that'll be checked
+         * separately along with the peer capabilities.
+         */
         for (i = 0; i < req->crypto.n_ciphers_pairwise; i++)
                 if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104)
                         ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
 
-
         if (req->flags & ASSOC_REQ_DISABLE_HT)
                 ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
 
+        /* Also disable HT if we don't support it or the AP doesn't use WMM */
+        sband = local->hw.wiphy->bands[req->bss->channel->band];
+        if (!sband->ht_cap.ht_supported ||
+            local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used)
+                ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
+
         memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
         memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
                sizeof(ifmgd->ht_capa_mask));
 
         if (req->ie && req->ie_len) {
-                memcpy(wk->ie, req->ie, req->ie_len);
-                wk->ie_len = req->ie_len;
-        } else
-                wk->ie_len = 0;
-
-        wk->assoc.bss = req->bss;
+                memcpy(assoc_data->ie, req->ie, req->ie_len);
+                assoc_data->ie_len = req->ie_len;
+        }
 
-        memcpy(wk->filter_ta, req->bss->bssid, ETH_ALEN);
+        assoc_data->bss = req->bss;
 
-        /* new association always uses requested smps mode */
         if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
                 if (ifmgd->powersave)
                         ifmgd->ap_smps = IEEE80211_SMPS_DYNAMIC;
@@ -2682,47 +3354,28 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         } else
                 ifmgd->ap_smps = ifmgd->req_smps;
 
-        wk->assoc.smps = ifmgd->ap_smps;
-        /*
-         * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
-         * We still associate in non-HT mode (11a/b/g) if any one of these
-         * ciphers is configured as pairwise.
-         * We can set this to true for non-11n hardware, that'll be checked
-         * separately along with the peer capabilities.
-         */
-        wk->assoc.use_11n = !(ifmgd->flags & IEEE80211_STA_DISABLE_11N);
-        wk->assoc.capability = req->bss->capability;
-        wk->assoc.wmm_used = bss->wmm_used;
-        wk->assoc.supp_rates = bss->supp_rates;
-        wk->assoc.supp_rates_len = bss->supp_rates_len;
-        wk->assoc.ht_information_ie =
-                ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_INFORMATION);
+        assoc_data->capability = req->bss->capability;
+        assoc_data->wmm = bss->wmm_used &&
+                          (local->hw.queues >= IEEE80211_NUM_ACS);
+        assoc_data->supp_rates = bss->supp_rates;
+        assoc_data->supp_rates_len = bss->supp_rates_len;
+        assoc_data->ht_operation_ie =
+                ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
 
         if (bss->wmm_used && bss->uapsd_supported &&
             (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
-                wk->assoc.uapsd_used = true;
+                assoc_data->uapsd = true;
                 ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
         } else {
-                wk->assoc.uapsd_used = false;
+                assoc_data->uapsd = false;
                 ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
         }
 
-        ssid = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
-        memcpy(wk->assoc.ssid, ssid + 2, ssid[1]);
-        wk->assoc.ssid_len = ssid[1];
+        memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
+        assoc_data->ssid_len = ssidie[1];
 
         if (req->prev_bssid)
-                memcpy(wk->assoc.prev_bssid, req->prev_bssid, ETH_ALEN);
-
-        wk->chan = req->bss->channel;
-        wk->chan_type = NL80211_CHAN_NO_HT;
-        wk->sdata = sdata;
-        wk->done = ieee80211_assoc_done;
-        if (!bss->dtim_period &&
-            sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD)
-                wk->type = IEEE80211_WORK_ASSOC_BEACON_WAIT;
-        else
-                wk->type = IEEE80211_WORK_ASSOC;
+                memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
 
         if (req->use_mfp) {
                 ifmgd->mfp = IEEE80211_MFP_REQUIRED;
@@ -2740,91 +3393,86 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         sdata->control_port_protocol = req->crypto.control_port_ethertype;
         sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
 
-        ieee80211_add_work(wk);
-        return 0;
+        /* kick off associate process */
+
+        ifmgd->assoc_data = assoc_data;
+
+        err = ieee80211_prep_connection(sdata, req->bss, true);
+        if (err)
+                goto err_clear;
+
+        if (!bss->dtim_period &&
+            sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) {
+                /*
+                 * Wait up to one beacon interval ...
+                 * should this be more if we miss one?
+                 */
+                printk(KERN_DEBUG "%s: waiting for beacon from %pM\n",
+                       sdata->name, ifmgd->bssid);
+                assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
+        } else {
+                assoc_data->have_beacon = true;
+                assoc_data->sent_assoc = false;
+                assoc_data->timeout = jiffies;
+        }
+        run_again(ifmgd, assoc_data->timeout);
+
+        if (bss->corrupt_data) {
+                char *corrupt_type = "data";
+                if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
+                        if (bss->corrupt_data &
+                                        IEEE80211_BSS_CORRUPT_PROBE_RESP)
+                                corrupt_type = "beacon and probe response";
+                        else
+                                corrupt_type = "beacon";
+                } else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
+                        corrupt_type = "probe response";
+                printk(KERN_DEBUG "%s: associating with AP with corrupt %s\n",
+                       sdata->name, corrupt_type);
+        }
+
+        err = 0;
+        goto out;
+ err_clear:
+        ifmgd->assoc_data = NULL;
+ err_free:
+        kfree(assoc_data);
+ out:
+        mutex_unlock(&ifmgd->mtx);
+
+        return err;
 }
 
 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
-                         struct cfg80211_deauth_request *req,
-                         void *cookie)
+                         struct cfg80211_deauth_request *req)
 {
-        struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        u8 bssid[ETH_ALEN];
-        bool assoc_bss = false;
+        u8 frame_buf[DEAUTH_DISASSOC_LEN];
 
         mutex_lock(&ifmgd->mtx);
 
-        memcpy(bssid, req->bss->bssid, ETH_ALEN);
-        if (ifmgd->associated == req->bss) {
-                ieee80211_set_disassoc(sdata, false, true);
+        if (ifmgd->auth_data) {
+                ieee80211_destroy_auth_data(sdata, false);
                 mutex_unlock(&ifmgd->mtx);
-                assoc_bss = true;
-        } else {
-                bool not_auth_yet = false;
-                struct ieee80211_work *tmp, *wk = NULL;
-
-                mutex_unlock(&ifmgd->mtx);
-
-                mutex_lock(&local->mtx);
-                list_for_each_entry(tmp, &local->work_list, list) {
-                        if (tmp->sdata != sdata)
-                                continue;
-
-                        if (tmp->type != IEEE80211_WORK_DIRECT_PROBE &&
-                            tmp->type != IEEE80211_WORK_AUTH &&
-                            tmp->type != IEEE80211_WORK_ASSOC &&
-                            tmp->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
-                                continue;
-
-                        if (memcmp(req->bss->bssid, tmp->filter_ta, ETH_ALEN))
-                                continue;
-
-                        not_auth_yet = tmp->type == IEEE80211_WORK_DIRECT_PROBE;
-                        list_del_rcu(&tmp->list);
-                        synchronize_rcu();
-                        wk = tmp;
-                        break;
-                }
-                mutex_unlock(&local->mtx);
-
-                if (wk && wk->type == IEEE80211_WORK_ASSOC) {
-                        /* clean up dummy sta & TX sync */
-                        sta_info_destroy_addr(wk->sdata, wk->filter_ta);
-                        if (wk->assoc.synced)
-                                drv_finish_tx_sync(local, wk->sdata,
-                                                   wk->filter_ta,
-                                                   IEEE80211_TX_SYNC_ASSOC);
-                } else if (wk && wk->type == IEEE80211_WORK_AUTH) {
-                        if (wk->probe_auth.synced)
-                                drv_finish_tx_sync(local, wk->sdata,
-                                                   wk->filter_ta,
-                                                   IEEE80211_TX_SYNC_AUTH);
-                }
-                kfree(wk);
-
-                /*
-                 * If somebody requests authentication and we haven't
-                 * sent out an auth frame yet there's no need to send
-                 * out a deauth frame either. If the state was PROBE,
-                 * then this is the case. If it's AUTH we have sent a
-                 * frame, and if it's IDLE we have completed the auth
-                 * process already.
-                 */
-                if (not_auth_yet) {
-                        __cfg80211_auth_canceled(sdata->dev, bssid);
-                        return 0;
-                }
+                return 0;
         }
 
-        printk(KERN_DEBUG "%s: deauthenticating from %pM by local choice (reason=%d)\n",
-               sdata->name, bssid, req->reason_code);
+        printk(KERN_DEBUG
+               "%s: deauthenticating from %pM by local choice (reason=%d)\n",
+               sdata->name, req->bssid, req->reason_code);
 
-        ieee80211_send_deauth_disassoc(sdata, bssid, IEEE80211_STYPE_DEAUTH,
-                                       req->reason_code, cookie,
-                                       !req->local_state_change);
-        if (assoc_bss)
-                sta_info_flush(sdata->local, sdata);
+        if (ifmgd->associated &&
+            ether_addr_equal(ifmgd->associated->bssid, req->bssid))
+                ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+                                       req->reason_code, true, frame_buf);
+        else
+                ieee80211_send_deauth_disassoc(sdata, req->bssid,
+                                               IEEE80211_STYPE_DEAUTH,
+                                               req->reason_code, true,
+                                               frame_buf);
+        mutex_unlock(&ifmgd->mtx);
+
+        __cfg80211_send_deauth(sdata->dev, frame_buf, DEAUTH_DISASSOC_LEN);
 
         mutex_lock(&sdata->local->mtx);
         ieee80211_recalc_idle(sdata->local);
@@ -2834,11 +3482,11 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
 }
 
 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
-                           struct cfg80211_disassoc_request *req,
-                           void *cookie)
+                           struct cfg80211_disassoc_request *req)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 bssid[ETH_ALEN];
+        u8 frame_buf[DEAUTH_DISASSOC_LEN];
 
         mutex_lock(&ifmgd->mtx);
 
@@ -2857,14 +3505,12 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
                sdata->name, req->bss->bssid, req->reason_code);
 
         memcpy(bssid, req->bss->bssid, ETH_ALEN);
-        ieee80211_set_disassoc(sdata, false, true);
-
+        ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
+                               req->reason_code, !req->local_state_change,
+                               frame_buf);
         mutex_unlock(&ifmgd->mtx);
 
-        ieee80211_send_deauth_disassoc(sdata, req->bss->bssid,
-                        IEEE80211_STYPE_DISASSOC, req->reason_code,
-                        cookie, !req->local_state_change);
-        sta_info_flush(sdata->local, sdata);
+        __cfg80211_send_disassoc(sdata->dev, frame_buf, DEAUTH_DISASSOC_LEN);
 
         mutex_lock(&sdata->local->mtx);
         ieee80211_recalc_idle(sdata->local);
@@ -2873,6 +3519,19 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
+void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        mutex_lock(&ifmgd->mtx);
+        if (ifmgd->assoc_data)
+                ieee80211_destroy_assoc_data(sdata, false);
+        if (ifmgd->auth_data)
+                ieee80211_destroy_auth_data(sdata, false);
+        del_timer_sync(&ifmgd->timer);
+        mutex_unlock(&ifmgd->mtx);
+}
+
 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
                                enum nl80211_cqm_rssi_threshold_event rssi_event,
                                gfp_t gfp)
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 596efaf50e09..af1c4e26e965 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -98,13 +98,12 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         mutex_lock(&local->sta_mtx);
         list_for_each_entry(sta, &local->sta_list, list) {
                 if (sta->uploaded) {
-                        sdata = sta->sdata;
-                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                                sdata = container_of(sdata->bss,
-                                             struct ieee80211_sub_if_data,
-                                             u.ap);
+                        enum ieee80211_sta_state state;
 
-                        drv_sta_remove(local, sdata, &sta->sta);
+                        state = sta->sta_state;
+                        for (; state > IEEE80211_STA_NOTEXIST; state--)
+                                WARN_ON(drv_sta_state(local, sta->sdata, sta,
+                                                      state, state - 1));
                 }
 
                 mesh_plink_quiesce(sta);
@@ -128,6 +127,10 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                 drv_remove_interface(local, sdata);
         }
 
+        sdata = rtnl_dereference(local->monitor_sdata);
+        if (sdata)
+                drv_remove_interface(local, sdata);
+
         /* stop hardware - this must stop RX */
         if (local->open_count)
                 ieee80211_stop_device(local);
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index f9b8e819ca63..3313c117b322 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -145,7 +145,7 @@ static ssize_t rcname_read(struct file *file, char __user *userbuf,
 
 static const struct file_operations rcname_ops = {
         .read = rcname_read,
-        .open = mac80211_open_file_generic,
+        .open = simple_open,
         .llseek = default_llseek,
 };
 #endif
@@ -159,7 +159,6 @@ static struct rate_control_ref *rate_control_alloc(const char *name,
         ref = kmalloc(sizeof(struct rate_control_ref), GFP_KERNEL);
         if (!ref)
                 goto fail_ref;
-        kref_init(&ref->kref);
         ref->local = local;
         ref->ops = ieee80211_rate_control_ops_get(name);
         if (!ref->ops)
@@ -184,11 +183,8 @@ fail_ref:
         return NULL;
 }
 
-static void rate_control_release(struct kref *kref)
+static void rate_control_free(struct rate_control_ref *ctrl_ref)
 {
-        struct rate_control_ref *ctrl_ref;
-
-        ctrl_ref = container_of(kref, struct rate_control_ref, kref);
         ctrl_ref->ops->free(ctrl_ref->priv);
 
 #ifdef CONFIG_MAC80211_DEBUGFS
@@ -293,8 +289,8 @@ bool rate_control_send_low(struct ieee80211_sta *sta,
 }
 EXPORT_SYMBOL(rate_control_send_low);
 
-static void rate_idx_match_mask(struct ieee80211_tx_rate *rate,
-                                int n_bitrates, u32 mask)
+static bool rate_idx_match_legacy_mask(struct ieee80211_tx_rate *rate,
+                                       int n_bitrates, u32 mask)
 {
         int j;
 
@@ -303,7 +299,7 @@ static void rate_idx_match_mask(struct ieee80211_tx_rate *rate,
                 if (mask & (1 << j)) {
                         /* Okay, found a suitable rate. Use it. */
                         rate->idx = j;
-                        return;
+                        return true;
                 }
         }
 
@@ -312,6 +308,112 @@ static void rate_idx_match_mask(struct ieee80211_tx_rate *rate,
                 if (mask & (1 << j)) {
                         /* Okay, found a suitable rate. Use it. */
                         rate->idx = j;
+                        return true;
+                }
+        }
+        return false;
+}
+
+static bool rate_idx_match_mcs_mask(struct ieee80211_tx_rate *rate,
+                                    u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN])
+{
+        int i, j;
+        int ridx, rbit;
+
+        ridx = rate->idx / 8;
+        rbit = rate->idx % 8;
+
+        /* sanity check */
+        if (ridx < 0 || ridx >= IEEE80211_HT_MCS_MASK_LEN)
+                return false;
+
+        /* See whether the selected rate or anything below it is allowed. */
+        for (i = ridx; i >= 0; i--) {
+                for (j = rbit; j >= 0; j--)
+                        if (mcs_mask[i] & BIT(j)) {
+                                rate->idx = i * 8 + j;
+                                return true;
+                        }
+                rbit = 7;
+        }
+
+        /* Try to find a higher rate that would be allowed */
+        ridx = (rate->idx + 1) / 8;
+        rbit = (rate->idx + 1) % 8;
+
+        for (i = ridx; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
+                for (j = rbit; j < 8; j++)
+                        if (mcs_mask[i] & BIT(j)) {
+                                rate->idx = i * 8 + j;
+                                return true;
+                        }
+                rbit = 0;
+        }
+        return false;
+}
+
+
+
+static void rate_idx_match_mask(struct ieee80211_tx_rate *rate,
+                                struct ieee80211_tx_rate_control *txrc,
+                                u32 mask,
+                                u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN])
+{
+        struct ieee80211_tx_rate alt_rate;
+
+        /* handle HT rates */
+        if (rate->flags & IEEE80211_TX_RC_MCS) {
+                if (rate_idx_match_mcs_mask(rate, mcs_mask))
+                        return;
+
+                /* also try the legacy rates. */
+                alt_rate.idx = 0;
+                /* keep protection flags */
+                alt_rate.flags = rate->flags &
+                                 (IEEE80211_TX_RC_USE_RTS_CTS |
+                                  IEEE80211_TX_RC_USE_CTS_PROTECT |
+                                  IEEE80211_TX_RC_USE_SHORT_PREAMBLE);
+                alt_rate.count = rate->count;
+                if (rate_idx_match_legacy_mask(&alt_rate,
+                                               txrc->sband->n_bitrates,
+                                               mask)) {
+                        *rate = alt_rate;
+                        return;
+                }
+        } else {
+                struct sk_buff *skb = txrc->skb;
+                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+                __le16 fc;
+
+                /* handle legacy rates */
+                if (rate_idx_match_legacy_mask(rate, txrc->sband->n_bitrates,
+                                               mask))
+                        return;
+
+                /* if HT BSS, and we handle a data frame, also try HT rates */
+                if (txrc->bss_conf->channel_type == NL80211_CHAN_NO_HT)
+                        return;
+
+                fc = hdr->frame_control;
+                if (!ieee80211_is_data(fc))
+                        return;
+
+                alt_rate.idx = 0;
+                /* keep protection flags */
+                alt_rate.flags = rate->flags &
+                                 (IEEE80211_TX_RC_USE_RTS_CTS |
+                                  IEEE80211_TX_RC_USE_CTS_PROTECT |
+                                  IEEE80211_TX_RC_USE_SHORT_PREAMBLE);
+                alt_rate.count = rate->count;
+
+                alt_rate.flags |= IEEE80211_TX_RC_MCS;
+
+                if ((txrc->bss_conf->channel_type == NL80211_CHAN_HT40MINUS) ||
+                    (txrc->bss_conf->channel_type == NL80211_CHAN_HT40PLUS))
+                        alt_rate.flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
+
+                if (rate_idx_match_mcs_mask(&alt_rate, mcs_mask)) {
+                        *rate = alt_rate;
                         return;
                 }
         }
@@ -335,6 +437,7 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
         int i;
         u32 mask;
+        u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
 
         if (sta && test_sta_flag(sta, WLAN_STA_RATE_CONTROL)) {
                 ista = &sta->sta;
@@ -358,10 +461,14 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
          * the common case.
          */
         mask = sdata->rc_rateidx_mask[info->band];
+        memcpy(mcs_mask, sdata->rc_rateidx_mcs_mask[info->band],
+               sizeof(mcs_mask));
         if (mask != (1 << txrc->sband->n_bitrates) - 1) {
                 if (sta) {
                         /* Filter out rates that the STA does not support */
                         mask &= sta->sta.supp_rates[info->band];
+                        for (i = 0; i < sizeof(mcs_mask); i++)
+                                mcs_mask[i] &= sta->sta.ht_cap.mcs.rx_mask[i];
                 }
                 /*
                  * Make sure the rate index selected for each TX rate is
@@ -372,32 +479,18 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                         /* Skip invalid rates */
                         if (info->control.rates[i].idx < 0)
                                 break;
-                        /* Rate masking supports only legacy rates for now */
-                        if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS)
-                                continue;
-                        rate_idx_match_mask(&info->control.rates[i],
-                                            txrc->sband->n_bitrates, mask);
+                        rate_idx_match_mask(&info->control.rates[i], txrc,
+                                            mask, mcs_mask);
                 }
         }
 
         BUG_ON(info->control.rates[0].idx < 0);
 }
 
-struct rate_control_ref *rate_control_get(struct rate_control_ref *ref)
-{
-        kref_get(&ref->kref);
-        return ref;
-}
-
-void rate_control_put(struct rate_control_ref *ref)
-{
-        kref_put(&ref->kref, rate_control_release);
-}
-
 int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
                                  const char *name)
 {
-        struct rate_control_ref *ref, *old;
+        struct rate_control_ref *ref;
 
         ASSERT_RTNL();
 
@@ -417,12 +510,8 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
                 return -ENOENT;
         }
 
-        old = local->rate_ctrl;
+        WARN_ON(local->rate_ctrl);
         local->rate_ctrl = ref;
-        if (old) {
-                rate_control_put(old);
-                sta_info_flush(local, NULL);
-        }
 
         wiphy_debug(local->hw.wiphy, "Selected rate control algorithm '%s'\n",
                     ref->ops->name);
@@ -440,6 +529,6 @@ void rate_control_deinitialize(struct ieee80211_local *local)
                 return;
 
         local->rate_ctrl = NULL;
-        rate_control_put(ref);
+        rate_control_free(ref);
 }
 
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index 80cfc006dd74..6e4fd32c6617 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -14,23 +14,20 @@
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <linux/types.h>
-#include <linux/kref.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
 #include "sta_info.h"
+#include "driver-ops.h"
 
 struct rate_control_ref {
         struct ieee80211_local *local;
         struct rate_control_ops *ops;
         void *priv;
-        struct kref kref;
 };
 
 void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                            struct sta_info *sta,
                            struct ieee80211_tx_rate_control *txrc);
-struct rate_control_ref *rate_control_get(struct rate_control_ref *ref);
-void rate_control_put(struct rate_control_ref *ref);
 
 static inline void rate_control_tx_status(struct ieee80211_local *local,
                                           struct ieee80211_supported_band *sband,
@@ -67,8 +64,7 @@ static inline void rate_control_rate_init(struct sta_info *sta)
 
 static inline void rate_control_rate_update(struct ieee80211_local *local,
                                     struct ieee80211_supported_band *sband,
-                                    struct sta_info *sta, u32 changed,
-                                    enum nl80211_channel_type oper_chan_type)
+                                    struct sta_info *sta, u32 changed)
 {
         struct rate_control_ref *ref = local->rate_ctrl;
         struct ieee80211_sta *ista = &sta->sta;
@@ -76,7 +72,8 @@ static inline void rate_control_rate_update(struct ieee80211_local *local,
 
         if (ref && ref->ops->rate_update)
                 ref->ops->rate_update(ref->priv, sband, ista,
-                                      priv_sta, changed, oper_chan_type);
+                                      priv_sta, changed);
+        drv_sta_rc_update(local, sta->sdata, &sta->sta, changed);
 }
 
 static inline void *rate_control_alloc_sta(struct rate_control_ref *ref,
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index b39dda523f39..79633ae06fd6 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -334,14 +334,15 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
 
 
 static void
-calc_rate_durations(struct ieee80211_local *local, struct minstrel_rate *d,
+calc_rate_durations(enum ieee80211_band band,
+                    struct minstrel_rate *d,
                     struct ieee80211_rate *rate)
 {
         int erp = !!(rate->flags & IEEE80211_RATE_ERP_G);
 
-        d->perfect_tx_time = ieee80211_frame_duration(local, 1200,
+        d->perfect_tx_time = ieee80211_frame_duration(band, 1200,
                         rate->bitrate, erp, 1);
-        d->ack_time = ieee80211_frame_duration(local, 10,
+        d->ack_time = ieee80211_frame_duration(band, 10,
                         rate->bitrate, erp, 1);
 }
 
@@ -379,14 +380,14 @@ minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
 {
         struct minstrel_sta_info *mi = priv_sta;
         struct minstrel_priv *mp = priv;
-        struct ieee80211_local *local = hw_to_local(mp->hw);
         struct ieee80211_rate *ctl_rate;
         unsigned int i, n = 0;
         unsigned int t_slot = 9; /* FIXME: get real slot time */
 
         mi->lowest_rix = rate_lowest_index(sband, sta);
         ctl_rate = &sband->bitrates[mi->lowest_rix];
-        mi->sp_ack_dur = ieee80211_frame_duration(local, 10, ctl_rate->bitrate,
+        mi->sp_ack_dur = ieee80211_frame_duration(sband->band, 10,
+                                ctl_rate->bitrate,
                                 !!(ctl_rate->flags & IEEE80211_RATE_ERP_G), 1);
 
         for (i = 0; i < sband->n_bitrates; i++) {
@@ -402,7 +403,7 @@ minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
 
                 mr->rix = i;
                 mr->bitrate = sband->bitrates[i].bitrate / 5;
-                calc_rate_durations(local, mr, &sband->bitrates[i]);
+                calc_rate_durations(sband->band, mr, &sband->bitrates[i]);
 
                 /* calculate maximum number of retransmissions before
                  * fallback (based on maximum segment size) */
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index ff5f7b84e825..2d1acc6c5445 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -568,6 +568,13 @@ minstrel_get_sample_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
         minstrel_next_sample_idx(mi);
 
         /*
+         * Sampling might add some overhead (RTS, no aggregation)
+         * to the frame. Hence, don't use sampling for the currently
+         * used max TP rate.
+         */
+        if (sample_idx == mi->max_tp_rate)
+                return -1;
+        /*
          * When not using MRR, do not sample if the probability is already
          * higher than 95% to avoid wasting airtime
          */
@@ -679,19 +686,18 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
 
 static void
 minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
-                        struct ieee80211_sta *sta, void *priv_sta,
-                        enum nl80211_channel_type oper_chan_type)
+                        struct ieee80211_sta *sta, void *priv_sta)
 {
         struct minstrel_priv *mp = priv;
         struct minstrel_ht_sta_priv *msp = priv_sta;
         struct minstrel_ht_sta *mi = &msp->ht;
         struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
-        struct ieee80211_local *local = hw_to_local(mp->hw);
         u16 sta_cap = sta->ht_cap.cap;
         int n_supported = 0;
         int ack_dur;
         int stbc;
         int i;
+        unsigned int smps;
 
         /* fall back to the old minstrel for legacy stations */
         if (!sta->ht_cap.ht_supported)
@@ -704,8 +710,8 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
         memset(mi, 0, sizeof(*mi));
         mi->stats_update = jiffies;
 
-        ack_dur = ieee80211_frame_duration(local, 10, 60, 1, 1);
-        mi->overhead = ieee80211_frame_duration(local, 0, 60, 1, 1) + ack_dur;
+        ack_dur = ieee80211_frame_duration(sband->band, 10, 60, 1, 1);
+        mi->overhead = ieee80211_frame_duration(sband->band, 0, 60, 1, 1) + ack_dur;
         mi->overhead_rtscts = mi->overhead + 2 * ack_dur;
 
         mi->avg_ampdu_len = MINSTREL_FRAC(1, 1);
@@ -727,9 +733,8 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
         if (sta_cap & IEEE80211_HT_CAP_LDPC_CODING)
                 mi->tx_flags |= IEEE80211_TX_CTL_LDPC;
 
-        if (oper_chan_type != NL80211_CHAN_HT40MINUS &&
-            oper_chan_type != NL80211_CHAN_HT40PLUS)
-                sta_cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+        smps = (sta_cap & IEEE80211_HT_CAP_SM_PS) >>
+                IEEE80211_HT_CAP_SM_PS_SHIFT;
 
         for (i = 0; i < ARRAY_SIZE(mi->groups); i++) {
                 u16 req = 0;
@@ -748,6 +753,11 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
                 if ((sta_cap & req) != req)
                         continue;
 
+                /* Mark MCS > 7 as unsupported if STA is in static SMPS mode */
+                if (smps == WLAN_HT_CAP_SM_PS_STATIC &&
+                    minstrel_mcs_groups[i].streams > 1)
+                        continue;
+
                 mi->groups[i].supported =
                         mcs->rx_mask[minstrel_mcs_groups[i].streams - 1];
 
@@ -772,17 +782,15 @@ static void
 minstrel_ht_rate_init(void *priv, struct ieee80211_supported_band *sband,
                       struct ieee80211_sta *sta, void *priv_sta)
 {
-        struct minstrel_priv *mp = priv;
-
-        minstrel_ht_update_caps(priv, sband, sta, priv_sta, mp->hw->conf.channel_type);
+        minstrel_ht_update_caps(priv, sband, sta, priv_sta);
 }
 
 static void
 minstrel_ht_rate_update(void *priv, struct ieee80211_supported_band *sband,
                         struct ieee80211_sta *sta, void *priv_sta,
-                        u32 changed, enum nl80211_channel_type oper_chan_type)
+                        u32 changed)
 {
-        minstrel_ht_update_caps(priv, sband, sta, priv_sta, oper_chan_type);
+        minstrel_ht_update_caps(priv, sband, sta, priv_sta);
 }
 
 static void *
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 5a5e504a8ffb..7bcecf73aafb 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -19,6 +19,7 @@
 #include <linux/export.h>
 #include <net/mac80211.h>
 #include <net/ieee80211_radiotap.h>
+#include <asm/unaligned.h>
 
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -102,7 +103,7 @@ static void
 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                                  struct sk_buff *skb,
                                  struct ieee80211_rate *rate,
-                                 int rtap_len)
+                                 int rtap_len, bool has_fcs)
 {
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_radiotap_header *rthdr;
@@ -133,7 +134,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         }
 
         /* IEEE80211_RADIOTAP_FLAGS */
-        if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
+        if (has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS))
                 *pos |= IEEE80211_RADIOTAP_F_FCS;
         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
                 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
@@ -176,7 +177,8 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         pos += 2;
 
         /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
-        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM &&
+            !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
                 *pos = status->signal;
                 rthdr->it_present |=
                         cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
@@ -202,14 +204,14 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
 
         if (status->flag & RX_FLAG_HT) {
                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
-                *pos++ = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
-                         IEEE80211_RADIOTAP_MCS_HAVE_GI |
-                         IEEE80211_RADIOTAP_MCS_HAVE_BW;
+                *pos++ = local->hw.radiotap_mcs_details;
                 *pos = 0;
                 if (status->flag & RX_FLAG_SHORT_GI)
                         *pos |= IEEE80211_RADIOTAP_MCS_SGI;
                 if (status->flag & RX_FLAG_40MHZ)
                         *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
+                if (status->flag & RX_FLAG_HT_GF)
+                        *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
                 pos++;
                 *pos++ = status->rate_idx;
         }
@@ -226,7 +228,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 {
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
         struct ieee80211_sub_if_data *sdata;
-        int needed_headroom = 0;
+        int needed_headroom;
         struct sk_buff *skb, *skb2;
         struct net_device *prev_dev = NULL;
         int present_fcs_len = 0;
@@ -292,7 +294,8 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
         }
 
         /* prepend radiotap information */
-        ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
+        ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
+                                         true);
 
         skb_reset_mac_header(skb);
         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -423,6 +426,7 @@ ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
 
         if (test_bit(SCAN_HW_SCANNING, &local->scanning) ||
             test_bit(SCAN_SW_SCANNING, &local->scanning) ||
+            test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning) ||
             local->sched_scanning)
                 return ieee80211_scan_rx(rx->sdata, skb);
 
@@ -488,12 +492,12 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
                         if (ieee80211_has_tods(hdr->frame_control) ||
                                 !ieee80211_has_fromds(hdr->frame_control))
                                 return RX_DROP_MONITOR;
-                        if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
+                        if (ether_addr_equal(hdr->addr3, dev_addr))
                                 return RX_DROP_MONITOR;
                 } else {
                         if (!ieee80211_has_a4(hdr->frame_control))
                                 return RX_DROP_MONITOR;
-                        if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
+                        if (ether_addr_equal(hdr->addr4, dev_addr))
                                 return RX_DROP_MONITOR;
                 }
         }
@@ -791,8 +795,7 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
 
         /* reset session timer */
         if (tid_agg_rx->timeout)
-                mod_timer(&tid_agg_rx->session_timer,
-                          TU_TO_EXP_TIME(tid_agg_rx->timeout));
+                tid_agg_rx->last_rx = jiffies;
 
         /* if this mpdu is fragmented - terminate rx aggregation session */
         sc = le16_to_cpu(hdr->seq_ctrl);
@@ -859,7 +862,12 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
                      rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
                      rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
                      (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
-                if (rx->sta && rx->sta->dummy &&
+                /*
+                 * accept port control frames from the AP even when it's not
+                 * yet marked ASSOC to prevent a race where we don't set the
+                 * assoc bit quickly enough before it sends the first frame
+                 */
+                if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
                     ieee80211_is_data_present(hdr->frame_control)) {
                         u16 ethertype;
                         u8 *payload;
@@ -1056,20 +1064,9 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
                 return RX_DROP_MONITOR;
         }
 
-        if (skb_linearize(rx->skb))
-                return RX_DROP_UNUSABLE;
-        /* the hdr variable is invalid now! */
-
         switch (rx->key->conf.cipher) {
         case WLAN_CIPHER_SUITE_WEP40:
         case WLAN_CIPHER_SUITE_WEP104:
-                /* Check for weak IVs if possible */
-                if (rx->sta && ieee80211_is_data(fc) &&
-                    (!(status->flag & RX_FLAG_IV_STRIPPED) ||
-                     !(status->flag & RX_FLAG_DECRYPTED)) &&
-                    ieee80211_wep_is_weak_iv(rx->skb, rx->key))
-                        rx->sta->wep_weak_iv_count++;
-
                 result = ieee80211_crypto_wep_decrypt(rx);
                 break;
         case WLAN_CIPHER_SUITE_TKIP:
@@ -1089,6 +1086,8 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
                 return RX_DROP_UNUSABLE;
         }
 
+        /* the hdr variable is invalid after the decrypt handlers */
+
         /* either the frame has been decrypted or will be dropped */
         status->flag |= RX_FLAG_DECRYPTED;
 
@@ -1145,19 +1144,15 @@ static void ap_sta_ps_start(struct sta_info *sta)
 
 static void ap_sta_ps_end(struct sta_info *sta)
 {
-        struct ieee80211_sub_if_data *sdata = sta->sdata;
-
-        atomic_dec(&sdata->bss->num_sta_ps);
-
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
-               sdata->name, sta->sta.addr, sta->sta.aid);
+               sta->sdata->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 
         if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
-                       sdata->name, sta->sta.addr, sta->sta.aid);
+                       sta->sdata->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
                 return;
         }
@@ -1280,7 +1275,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
                                                 NL80211_IFTYPE_ADHOC);
-                if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0) {
+                if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid)) {
                         sta->last_rx = jiffies;
                         if (ieee80211_is_data(hdr->frame_control)) {
                                 sta->last_rx_rate_idx = status->rate_idx;
@@ -1307,8 +1302,10 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
 
         sta->rx_fragments++;
         sta->rx_bytes += rx->skb->len;
-        sta->last_signal = status->signal;
-        ewma_add(&sta->avg_signal, -status->signal);
+        if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
+                sta->last_signal = status->signal;
+                ewma_add(&sta->avg_signal, -status->signal);
+        }
 
         /*
          * Change STA power saving mode only at the end of a frame
@@ -1441,8 +1438,8 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
                  */
                 if (((hdr->frame_control ^ f_hdr->frame_control) &
                      cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
-                    compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
-                    compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
+                    !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
+                    !ether_addr_equal(hdr->addr2, f_hdr->addr2))
                         continue;
 
                 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
@@ -1717,8 +1714,8 @@ static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
          * of whether the frame was encrypted or not.
          */
         if (ehdr->h_proto == rx->sdata->control_port_protocol &&
-            (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
-             compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
+            (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
+             ether_addr_equal(ehdr->h_dest, pae_group_addr)))
                 return true;
 
         if (ieee80211_802_1x_port_control(rx) ||
@@ -1755,9 +1752,9 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
                          * local net stack and back to the wireless medium
                          */
                         xmit_skb = skb_copy(skb, GFP_ATOMIC);
-                        if (!xmit_skb && net_ratelimit())
-                                printk(KERN_DEBUG "%s: failed to clone "
-                                       "multicast frame\n", dev->name);
+                        if (!xmit_skb)
+                                net_dbg_ratelimited("%s: failed to clone multicast frame\n",
+                                                    dev->name);
                 } else {
                         dsta = sta_info_get(sdata, skb->data);
                         if (dsta) {
@@ -1928,7 +1925,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                         mpp_path_add(proxied_addr, mpp_addr, sdata);
                 } else {
                         spin_lock_bh(&mppath->state_lock);
-                        if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
+                        if (!ether_addr_equal(mppath->mpp, mpp_addr))
                                 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
                         spin_unlock_bh(&mppath->state_lock);
                 }
@@ -1937,7 +1934,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
 
         /* Frame has reached destination.  Don't forward */
         if (!is_multicast_ether_addr(hdr->addr1) &&
-            compare_ether_addr(sdata->vif.addr, hdr->addr3) == 0)
+            ether_addr_equal(sdata->vif.addr, hdr->addr3))
                 return RX_CONTINUE;
 
         q = ieee80211_select_queue_80211(local, skb, hdr);
@@ -1955,11 +1952,13 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 return RX_DROP_MONITOR;
         }
 
+        if (!ifmsh->mshcfg.dot11MeshForwarding)
+                goto out;
+
         fwd_skb = skb_copy(skb, GFP_ATOMIC);
         if (!fwd_skb) {
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
-                                        sdata->name);
+                net_dbg_ratelimited("%s: failed to clone mesh frame\n",
+                                    sdata->name);
                 goto out;
         }
 
@@ -2122,13 +2121,13 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
         struct sk_buff *skb;
         struct ieee80211_mgmt *resp;
 
-        if (compare_ether_addr(mgmt->da, sdata->vif.addr) != 0) {
+        if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
                 /* Not to own unicast address */
                 return;
         }
 
-        if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
-            compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
+        if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) ||
+            !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) {
                 /* Not from the current AP or not associated yet. */
                 return;
         }
@@ -2180,12 +2179,14 @@ ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
         if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
             ieee80211_is_beacon(mgmt->frame_control) &&
             !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
-                struct ieee80211_rx_status *status;
+                int sig = 0;
+
+                if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
+                        sig = status->signal;
 
-                status = IEEE80211_SKB_RXCB(rx->skb);
                 cfg80211_report_obss_beacon(rx->local->hw.wiphy,
                                             rx->skb->data, rx->skb->len,
-                                            status->freq, GFP_ATOMIC);
+                                            status->freq, sig, GFP_ATOMIC);
                 rx->flags |= IEEE80211_RX_BEACON_REPORTED;
         }
 
@@ -2269,8 +2270,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                         sband = rx->local->hw.wiphy->bands[status->band];
 
                         rate_control_rate_update(local, sband, rx->sta,
-                                                 IEEE80211_RC_SMPS_CHANGED,
-                                                 local->_oper_channel_type);
+                                                 IEEE80211_RC_SMPS_CHANGED);
                         goto handled;
                 }
                 default:
@@ -2337,7 +2337,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                                 break;
 
-                        if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
+                        if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
                                 break;
 
                         goto queue;
@@ -2409,6 +2409,7 @@ static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
+        int sig = 0;
 
         /* skip known-bad action frames and return them in the next handler */
         if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
@@ -2421,7 +2422,10 @@ ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
          * it transmitted were processed or returned.
          */
 
-        if (cfg80211_rx_mgmt(rx->sdata->dev, status->freq,
+        if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
+                sig = status->signal;
+
+        if (cfg80211_rx_mgmt(rx->sdata->dev, status->freq, sig,
                              rx->skb->data, rx->skb->len,
                              GFP_ATOMIC)) {
                 if (rx->sta)
@@ -2486,14 +2490,9 @@ static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_sub_if_data *sdata = rx->sdata;
-        ieee80211_rx_result rxs;
         struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
         __le16 stype;
 
-        rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb);
-        if (rxs != RX_CONTINUE)
-                return rxs;
-
         stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
 
         if (!ieee80211_vif_is_mesh(&sdata->vif) &&
@@ -2502,10 +2501,13 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
                 return RX_DROP_MONITOR;
 
         switch (stype) {
+        case cpu_to_le16(IEEE80211_STYPE_AUTH):
         case cpu_to_le16(IEEE80211_STYPE_BEACON):
         case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
                 /* process for all: mesh, mlme, ibss */
                 break;
+        case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
+        case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
         case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
         case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
                 if (is_multicast_ether_addr(mgmt->da) &&
@@ -2517,7 +2519,6 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
                         return RX_DROP_MONITOR;
                 break;
         case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
-        case cpu_to_le16(IEEE80211_STYPE_AUTH):
                 /* process only for ibss */
                 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
                         return RX_DROP_MONITOR;
@@ -2542,16 +2543,10 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
 {
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_local *local = rx->local;
-        struct ieee80211_rtap_hdr {
-                struct ieee80211_radiotap_header hdr;
-                u8 flags;
-                u8 rate_or_pad;
-                __le16 chan_freq;
-                __le16 chan_flags;
-        } __packed *rthdr;
         struct sk_buff *skb = rx->skb, *skb2;
         struct net_device *prev_dev = NULL;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+        int needed_headroom;
 
         /*
          * If cooked monitor has been processed already, then
@@ -2565,30 +2560,16 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
         if (!local->cooked_mntrs)
                 goto out_free_skb;
 
-        if (skb_headroom(skb) < sizeof(*rthdr) &&
-            pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
-                goto out_free_skb;
-
-        rthdr = (void *)skb_push(skb, sizeof(*rthdr));
-        memset(rthdr, 0, sizeof(*rthdr));
-        rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
-        rthdr->hdr.it_present =
-                cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
-                            (1 << IEEE80211_RADIOTAP_CHANNEL));
+        /* room for the radiotap header based on driver features */
+        needed_headroom = ieee80211_rx_radiotap_len(local, status);
 
-        if (rate) {
-                rthdr->rate_or_pad = rate->bitrate / 5;
-                rthdr->hdr.it_present |=
-                        cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
-        }
-        rthdr->chan_freq = cpu_to_le16(status->freq);
+        if (skb_headroom(skb) < needed_headroom &&
+            pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
+                goto out_free_skb;
 
-        if (status->band == IEEE80211_BAND_5GHZ)
-                rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
-                                                IEEE80211_CHAN_5GHZ);
-        else
-                rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
-                                                IEEE80211_CHAN_2GHZ);
+        /* prepend radiotap information */
+        ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
+                                         false);
 
         skb_set_mac_header(skb, 0);
         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -2790,7 +2771,7 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                 if (!bssid && !sdata->u.mgd.use_4addr)
                         return 0;
                 if (!multicast &&
-                    compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
+                    !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
                         if (!(sdata->dev->flags & IFF_PROMISC) ||
                             sdata->u.mgd.use_4addr)
                                 return 0;
@@ -2808,8 +2789,7 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                                 return 0;
                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
                 } else if (!multicast &&
-                           compare_ether_addr(sdata->vif.addr,
-                                              hdr->addr1) != 0) {
+                           !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
                         if (!(sdata->dev->flags & IFF_PROMISC))
                                 return 0;
                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
@@ -2825,8 +2805,7 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                 break;
         case NL80211_IFTYPE_MESH_POINT:
                 if (!multicast &&
-                    compare_ether_addr(sdata->vif.addr,
-                                       hdr->addr1) != 0) {
+                    !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
                         if (!(sdata->dev->flags & IFF_PROMISC))
                                 return 0;
 
@@ -2836,8 +2815,7 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_AP:
                 if (!bssid) {
-                        if (compare_ether_addr(sdata->vif.addr,
-                                               hdr->addr1))
+                        if (!ether_addr_equal(sdata->vif.addr, hdr->addr1))
                                 return 0;
                 } else if (!ieee80211_bssid_match(bssid,
                                         sdata->vif.addr)) {
@@ -2859,7 +2837,7 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
         case NL80211_IFTYPE_WDS:
                 if (bssid || !ieee80211_is_data(hdr->frame_control))
                         return 0;
-                if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
+                if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
                         return 0;
                 break;
         default:
@@ -2936,6 +2914,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                 local->dot11ReceivedFragmentCount++;
 
         if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
+                     test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning) ||
                      test_bit(SCAN_SW_SCANNING, &local->scanning)))
                 status->rx_flags |= IEEE80211_RX_IN_SCAN;
 
@@ -2956,7 +2935,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         if (ieee80211_is_data(fc)) {
                 prev_sta = NULL;
 
-                for_each_sta_info_rx(local, hdr->addr2, sta, tmp) {
+                for_each_sta_info(local, hdr->addr2, sta, tmp) {
                         if (!prev_sta) {
                                 prev_sta = sta;
                                 continue;
@@ -3000,7 +2979,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                         continue;
                 }
 
-                rx.sta = sta_info_get_bss_rx(prev, hdr->addr2);
+                rx.sta = sta_info_get_bss(prev, hdr->addr2);
                 rx.sdata = prev;
                 ieee80211_prepare_and_rx_handle(&rx, skb, false);
 
@@ -3008,7 +2987,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         }
 
         if (prev) {
-                rx.sta = sta_info_get_bss_rx(prev, hdr->addr2);
+                rx.sta = sta_info_get_bss(prev, hdr->addr2);
                 rx.sdata = prev;
 
                 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 9270771702fe..169da0742c81 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -13,6 +13,7 @@
  */
 
 #include <linux/if_arp.h>
+#include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
 #include <linux/pm_qos.h>
 #include <net/sch_generic.h>
@@ -28,20 +29,6 @@
 #define IEEE80211_CHANNEL_TIME (HZ / 33)
 #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 8)
 
-struct ieee80211_bss *
-ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
-                     u8 *ssid, u8 ssid_len)
-{
-        struct cfg80211_bss *cbss;
-
-        cbss = cfg80211_get_bss(local->hw.wiphy,
-                                ieee80211_get_channel(local->hw.wiphy, freq),
-                                bssid, ssid, ssid_len, 0, 0);
-        if (!cbss)
-                return NULL;
-        return (void *)cbss->priv;
-}
-
 static void ieee80211_rx_bss_free(struct cfg80211_bss *cbss)
 {
         struct ieee80211_bss *bss = (void *)cbss->priv;
@@ -103,16 +90,35 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
         cbss->free_priv = ieee80211_rx_bss_free;
         bss = (void *)cbss->priv;
 
+        if (elems->parse_error) {
+                if (beacon)
+                        bss->corrupt_data |= IEEE80211_BSS_CORRUPT_BEACON;
+                else
+                        bss->corrupt_data |= IEEE80211_BSS_CORRUPT_PROBE_RESP;
+        } else {
+                if (beacon)
+                        bss->corrupt_data &= ~IEEE80211_BSS_CORRUPT_BEACON;
+                else
+                        bss->corrupt_data &= ~IEEE80211_BSS_CORRUPT_PROBE_RESP;
+        }
+
         /* save the ERP value so that it is available at association time */
-        if (elems->erp_info && elems->erp_info_len >= 1) {
+        if (elems->erp_info && elems->erp_info_len >= 1 &&
+                        (!elems->parse_error ||
+                         !(bss->valid_data & IEEE80211_BSS_VALID_ERP))) {
                 bss->erp_value = elems->erp_info[0];
                 bss->has_erp_value = true;
+                if (!elems->parse_error)
+                        bss->valid_data |= IEEE80211_BSS_VALID_ERP;
         }
 
-        if (elems->tim) {
+        if (elems->tim && (!elems->parse_error ||
+                           !(bss->valid_data & IEEE80211_BSS_VALID_DTIM))) {
                 struct ieee80211_tim_ie *tim_ie =
                         (struct ieee80211_tim_ie *)elems->tim;
                 bss->dtim_period = tim_ie->dtim_period;
+                if (!elems->parse_error)
+                                bss->valid_data |= IEEE80211_BSS_VALID_DTIM;
         }
 
         /* If the beacon had no TIM IE, or it was invalid, use 1 */
@@ -120,26 +126,38 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                 bss->dtim_period = 1;
 
         /* replace old supported rates if we get new values */
-        srlen = 0;
-        if (elems->supp_rates) {
-                clen = IEEE80211_MAX_SUPP_RATES;
-                if (clen > elems->supp_rates_len)
-                        clen = elems->supp_rates_len;
-                memcpy(bss->supp_rates, elems->supp_rates, clen);
-                srlen += clen;
-        }
-        if (elems->ext_supp_rates) {
-                clen = IEEE80211_MAX_SUPP_RATES - srlen;
-                if (clen > elems->ext_supp_rates_len)
-                        clen = elems->ext_supp_rates_len;
-                memcpy(bss->supp_rates + srlen, elems->ext_supp_rates, clen);
-                srlen += clen;
+        if (!elems->parse_error ||
+            !(bss->valid_data & IEEE80211_BSS_VALID_RATES)) {
+                srlen = 0;
+                if (elems->supp_rates) {
+                        clen = IEEE80211_MAX_SUPP_RATES;
+                        if (clen > elems->supp_rates_len)
+                                clen = elems->supp_rates_len;
+                        memcpy(bss->supp_rates, elems->supp_rates, clen);
+                        srlen += clen;
+                }
+                if (elems->ext_supp_rates) {
+                        clen = IEEE80211_MAX_SUPP_RATES - srlen;
+                        if (clen > elems->ext_supp_rates_len)
+                                clen = elems->ext_supp_rates_len;
+                        memcpy(bss->supp_rates + srlen, elems->ext_supp_rates,
+                               clen);
+                        srlen += clen;
+                }
+                if (srlen) {
+                        bss->supp_rates_len = srlen;
+                        if (!elems->parse_error)
+                                bss->valid_data |= IEEE80211_BSS_VALID_RATES;
+                }
         }
-        if (srlen)
-                bss->supp_rates_len = srlen;
 
-        bss->wmm_used = elems->wmm_param || elems->wmm_info;
-        bss->uapsd_supported = is_uapsd_supported(elems);
+        if (!elems->parse_error ||
+            !(bss->valid_data & IEEE80211_BSS_VALID_WMM)) {
+                bss->wmm_used = elems->wmm_param || elems->wmm_info;
+                bss->uapsd_supported = is_uapsd_supported(elems);
+                if (!elems->parse_error)
+                        bss->valid_data |= IEEE80211_BSS_VALID_WMM;
+        }
 
         if (!beacon)
                 bss->last_probe_resp = jiffies;
@@ -176,7 +194,7 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         presp = ieee80211_is_probe_resp(fc);
         if (presp) {
                 /* ignore ProbeResp to foreign address */
-                if (memcmp(mgmt->da, sdata->vif.addr, ETH_ALEN))
+                if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
                         return RX_DROP_MONITOR;
 
                 presp = true;
@@ -338,7 +356,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
          */
         drv_sw_scan_start(local);
 
-        local->leave_oper_channel_time = 0;
+        local->leave_oper_channel_time = jiffies;
         local->next_scan_state = SCAN_DECISION;
         local->scan_channel_idx = 0;
 
@@ -355,6 +373,57 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
         return 0;
 }
 
+static bool ieee80211_can_scan(struct ieee80211_local *local,
+                               struct ieee80211_sub_if_data *sdata)
+{
+        if (!list_empty(&local->work_list))
+                return false;
+
+        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+            sdata->u.mgd.flags & (IEEE80211_STA_BEACON_POLL |
+                                  IEEE80211_STA_CONNECTION_POLL))
+                return false;
+
+        return true;
+}
+
+void ieee80211_run_deferred_scan(struct ieee80211_local *local)
+{
+        lockdep_assert_held(&local->mtx);
+
+        if (!local->scan_req || local->scanning)
+                return;
+
+        if (!ieee80211_can_scan(local, local->scan_sdata))
+                return;
+
+        ieee80211_queue_delayed_work(&local->hw, &local->scan_work,
+                                     round_jiffies_relative(0));
+}
+
+static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
+                                            unsigned long *next_delay)
+{
+        int i;
+        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
+        enum ieee80211_band band = local->hw.conf.channel->band;
+
+        for (i = 0; i < local->scan_req->n_ssids; i++)
+                ieee80211_send_probe_req(
+                        sdata, NULL,
+                        local->scan_req->ssids[i].ssid,
+                        local->scan_req->ssids[i].ssid_len,
+                        local->scan_req->ie, local->scan_req->ie_len,
+                        local->scan_req->rates[band], false,
+                        local->scan_req->no_cck);
+
+        /*
+         * After sending probe requests, wait for probe responses
+         * on the channel.
+         */
+        *next_delay = IEEE80211_CHANNEL_TIME;
+        local->next_scan_state = SCAN_DECISION;
+}
 
 static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
                                   struct cfg80211_scan_request *req)
@@ -367,7 +436,7 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         if (local->scan_req)
                 return -EBUSY;
 
-        if (!list_empty(&local->work_list)) {
+        if (!ieee80211_can_scan(local, sdata)) {
                 /* wait for the work to finish/time out */
                 local->scan_req = req;
                 local->scan_sdata = sdata;
@@ -406,10 +475,47 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         local->scan_req = req;
         local->scan_sdata = sdata;
 
-        if (local->ops->hw_scan)
+        if (local->ops->hw_scan) {
                 __set_bit(SCAN_HW_SCANNING, &local->scanning);
-        else
+        } else if ((req->n_channels == 1) &&
+                   (req->channels[0]->center_freq ==
+                    local->hw.conf.channel->center_freq)) {
+
+                /* If we are scanning only on the current channel, then
+                 * we do not need to stop normal activities
+                 */
+                unsigned long next_delay;
+
+                __set_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning);
+
+                ieee80211_recalc_idle(local);
+
+                /* Notify driver scan is starting, keep order of operations
+                 * same as normal software scan, in case that matters. */
+                drv_sw_scan_start(local);
+
+                ieee80211_configure_filter(local); /* accept probe-responses */
+
+                /* We need to ensure power level is at max for scanning. */
+                ieee80211_hw_config(local, 0);
+
+                if ((req->channels[0]->flags &
+                     IEEE80211_CHAN_PASSIVE_SCAN) ||
+                    !local->scan_req->n_ssids) {
+                        next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
+                } else {
+                        ieee80211_scan_state_send_probe(local, &next_delay);
+                        next_delay = IEEE80211_CHANNEL_TIME;
+                }
+
+                /* Now, just wait a bit and we are all done! */
+                ieee80211_queue_delayed_work(&local->hw, &local->scan_work,
+                                             next_delay);
+                return 0;
+        } else {
+                /* Do normal software scan */
                 __set_bit(SCAN_SW_SCANNING, &local->scanning);
+        }
 
         ieee80211_recalc_idle(local);
 
@@ -566,30 +672,6 @@ static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
         local->next_scan_state = SCAN_SEND_PROBE;
 }
 
-static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
-                                            unsigned long *next_delay)
-{
-        int i;
-        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
-        enum ieee80211_band band = local->hw.conf.channel->band;
-
-        for (i = 0; i < local->scan_req->n_ssids; i++)
-                ieee80211_send_probe_req(
-                        sdata, NULL,
-                        local->scan_req->ssids[i].ssid,
-                        local->scan_req->ssids[i].ssid_len,
-                        local->scan_req->ie, local->scan_req->ie_len,
-                        local->scan_req->rates[band], false,
-                        local->scan_req->no_cck);
-
-        /*
-         * After sending probe requests, wait for probe responses
-         * on the channel.
-         */
-        *next_delay = IEEE80211_CHANNEL_TIME;
-        local->next_scan_state = SCAN_DECISION;
-}
-
 static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
                                          unsigned long *next_delay)
 {
@@ -640,6 +722,12 @@ void ieee80211_scan_work(struct work_struct *work)
 
         sdata = local->scan_sdata;
 
+        /* When scanning on-channel, the first-callback means completed. */
+        if (test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning)) {
+                aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning);
+                goto out_complete;
+        }
+
         if (test_and_clear_bit(SCAN_COMPLETED, &local->scanning)) {
                 aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning);
                 goto out_complete;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index ff11f6bf8266..f5b1638fbf80 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -9,6 +9,7 @@
 
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/etherdevice.h>
 #include <linux/netdevice.h>
 #include <linux/types.h>
 #include <linux/slab.h>
@@ -100,27 +101,8 @@ struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
         sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
                                     lockdep_is_held(&local->sta_mtx));
         while (sta) {
-                if (sta->sdata == sdata && !sta->dummy &&
-                    memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
-                        break;
-                sta = rcu_dereference_check(sta->hnext,
-                                            lockdep_is_held(&local->sta_mtx));
-        }
-        return sta;
-}
-
-/* get a station info entry even if it is a dummy station*/
-struct sta_info *sta_info_get_rx(struct ieee80211_sub_if_data *sdata,
-                              const u8 *addr)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-
-        sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
-                                    lockdep_is_held(&local->sta_mtx));
-        while (sta) {
                 if (sta->sdata == sdata &&
-                    memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
+                    ether_addr_equal(sta->sta.addr, addr))
                         break;
                 sta = rcu_dereference_check(sta->hnext,
                                             lockdep_is_held(&local->sta_mtx));
@@ -143,31 +125,7 @@ struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
         while (sta) {
                 if ((sta->sdata == sdata ||
                      (sta->sdata->bss && sta->sdata->bss == sdata->bss)) &&
-                    !sta->dummy &&
-                    memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
-                        break;
-                sta = rcu_dereference_check(sta->hnext,
-                                            lockdep_is_held(&local->sta_mtx));
-        }
-        return sta;
-}
-
-/*
- * Get sta info either from the specified interface
- * or from one of its vlans (including dummy stations)
- */
-struct sta_info *sta_info_get_bss_rx(struct ieee80211_sub_if_data *sdata,
-                                  const u8 *addr)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-
-        sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
-                                    lockdep_is_held(&local->sta_mtx));
-        while (sta) {
-                if ((sta->sdata == sdata ||
-                     (sta->sdata->bss && sta->sdata->bss == sdata->bss)) &&
-                    memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
+                    ether_addr_equal(sta->sta.addr, addr))
                         break;
                 sta = rcu_dereference_check(sta->hnext,
                                             lockdep_is_held(&local->sta_mtx));
@@ -208,10 +166,8 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,
  */
 void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
 {
-        if (sta->rate_ctrl) {
+        if (sta->rate_ctrl)
                 rate_control_free_sta(sta);
-                rate_control_put(sta->rate_ctrl);
-        }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         wiphy_debug(local->hw.wiphy, "Destroyed STA %pM\n", sta->sta.addr);
@@ -264,13 +220,11 @@ static int sta_prepare_rate_control(struct ieee80211_local *local,
         if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
                 return 0;
 
-        sta->rate_ctrl = rate_control_get(local->rate_ctrl);
+        sta->rate_ctrl = local->rate_ctrl;
         sta->rate_ctrl_priv = rate_control_alloc_sta(sta->rate_ctrl,
                                                      &sta->sta, gfp);
-        if (!sta->rate_ctrl_priv) {
-                rate_control_put(sta->rate_ctrl);
+        if (!sta->rate_ctrl_priv)
                 return -ENOMEM;
-        }
 
         return 0;
 }
@@ -297,6 +251,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         sta->sdata = sdata;
         sta->last_rx = jiffies;
 
+        sta->sta_state = IEEE80211_STA_NONE;
+
         do_posix_clock_monotonic_gettime(&uptime);
         sta->last_connected = uptime.tv_sec;
         ewma_init(&sta->avg_signal, 1024, 8);
@@ -346,13 +302,50 @@ static int sta_info_insert_check(struct sta_info *sta)
         if (unlikely(!ieee80211_sdata_running(sdata)))
                 return -ENETDOWN;
 
-        if (WARN_ON(compare_ether_addr(sta->sta.addr, sdata->vif.addr) == 0 ||
+        if (WARN_ON(ether_addr_equal(sta->sta.addr, sdata->vif.addr) ||
                     is_multicast_ether_addr(sta->sta.addr)))
                 return -EINVAL;
 
         return 0;
 }
 
+static int sta_info_insert_drv_state(struct ieee80211_local *local,
+                                     struct ieee80211_sub_if_data *sdata,
+                                     struct sta_info *sta)
+{
+        enum ieee80211_sta_state state;
+        int err = 0;
+
+        for (state = IEEE80211_STA_NOTEXIST; state < sta->sta_state; state++) {
+                err = drv_sta_state(local, sdata, sta, state, state + 1);
+                if (err)
+                        break;
+        }
+
+        if (!err) {
+                /*
+                 * Drivers using legacy sta_add/sta_remove callbacks only
+                 * get uploaded set to true after sta_add is called.
+                 */
+                if (!local->ops->sta_add)
+                        sta->uploaded = true;
+                return 0;
+        }
+
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                printk(KERN_DEBUG
+                       "%s: failed to move IBSS STA %pM to state %d (%d) - keeping it anyway.\n",
+                       sdata->name, sta->sta.addr, state + 1, err);
+                err = 0;
+        }
+
+        /* unwind on error */
+        for (; state > IEEE80211_STA_NOTEXIST; state--)
+                WARN_ON(drv_sta_state(local, sdata, sta, state, state - 1));
+
+        return err;
+}
+
 /*
  * should be called with sta_mtx locked
  * this function replaces the mutex lock
@@ -362,70 +355,43 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
 {
         struct ieee80211_local *local = sta->local;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
-        struct sta_info *exist_sta;
-        bool dummy_reinsert = false;
+        struct station_info sinfo;
         int err = 0;
 
         lockdep_assert_held(&local->sta_mtx);
 
-        /*
-         * check if STA exists already.
-         * only accept a scenario of a second call to sta_info_insert_finish
-         * with a dummy station entry that was inserted earlier
-         * in that case - assume that the dummy station flag should
-         * be removed.
-         */
-        exist_sta = sta_info_get_bss_rx(sdata, sta->sta.addr);
-        if (exist_sta) {
-                if (exist_sta == sta && sta->dummy) {
-                        dummy_reinsert = true;
-                } else {
-                        err = -EEXIST;
-                        goto out_err;
-                }
+        /* check if STA exists already */
+        if (sta_info_get_bss(sdata, sta->sta.addr)) {
+                err = -EEXIST;
+                goto out_err;
         }
 
-        if (!sta->dummy || dummy_reinsert) {
-                /* notify driver */
-                err = drv_sta_add(local, sdata, &sta->sta);
-                if (err) {
-                        if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
-                                goto out_err;
-                        printk(KERN_DEBUG "%s: failed to add IBSS STA %pM to "
-                                          "driver (%d) - keeping it anyway.\n",
-                               sdata->name, sta->sta.addr, err);
-                } else
-                        sta->uploaded = true;
-        }
+        /* notify driver */
+        err = sta_info_insert_drv_state(local, sdata, sta);
+        if (err)
+                goto out_err;
 
-        if (!dummy_reinsert) {
-                local->num_sta++;
-                local->sta_generation++;
-                smp_mb();
+        local->num_sta++;
+        local->sta_generation++;
+        smp_mb();
 
-                /* make the station visible */
-                sta_info_hash_add(local, sta);
+        /* make the station visible */
+        sta_info_hash_add(local, sta);
 
-                list_add(&sta->list, &local->sta_list);
-        } else {
-                sta->dummy = false;
-        }
+        list_add(&sta->list, &local->sta_list);
 
-        if (!sta->dummy) {
-                struct station_info sinfo;
+        set_sta_flag(sta, WLAN_STA_INSERTED);
 
-                ieee80211_sta_debugfs_add(sta);
-                rate_control_add_sta_debugfs(sta);
+        ieee80211_sta_debugfs_add(sta);
+        rate_control_add_sta_debugfs(sta);
 
-                memset(&sinfo, 0, sizeof(sinfo));
-                sinfo.filled = 0;
-                sinfo.generation = local->sta_generation;
-                cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
-        }
+        memset(&sinfo, 0, sizeof(sinfo));
+        sinfo.filled = 0;
+        sinfo.generation = local->sta_generation;
+        cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        wiphy_debug(local->hw.wiphy, "Inserted %sSTA %pM\n",
-                        sta->dummy ? "dummy " : "", sta->sta.addr);
+        wiphy_debug(local->hw.wiphy, "Inserted STA %pM\n", sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
         /* move reference to rcu-protected */
@@ -477,25 +443,6 @@ int sta_info_insert(struct sta_info *sta)
         return err;
 }
 
-/* Caller must hold sta->local->sta_mtx */
-int sta_info_reinsert(struct sta_info *sta)
-{
-        struct ieee80211_local *local = sta->local;
-        int err = 0;
-
-        err = sta_info_insert_check(sta);
-        if (err) {
-                mutex_unlock(&local->sta_mtx);
-                return err;
-        }
-
-        might_sleep();
-
-        err = sta_info_insert_finish(sta);
-        rcu_read_unlock();
-        return err;
-}
-
 static inline void __bss_tim_set(struct ieee80211_if_ap *bss, u16 aid)
 {
         /*
@@ -711,7 +658,7 @@ static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
         return have_buffered;
 }
 
-static int __must_check __sta_info_destroy(struct sta_info *sta)
+int __must_check __sta_info_destroy(struct sta_info *sta)
 {
         struct ieee80211_local *local;
         struct ieee80211_sub_if_data *sdata;
@@ -726,6 +673,8 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
         local = sta->local;
         sdata = sta->sdata;
 
+        lockdep_assert_held(&local->sta_mtx);
+
         /*
          * Before removing the station from the driver and
          * rate control, it might still start new aggregation
@@ -750,33 +699,24 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
 
         sta->dead = true;
 
-        if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
-            test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
-                BUG_ON(!sdata->bss);
-
-                clear_sta_flag(sta, WLAN_STA_PS_STA);
-                clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
-
-                atomic_dec(&sdata->bss->num_sta_ps);
-                sta_info_recalc_tim(sta);
-        }
-
         local->num_sta--;
         local->sta_generation++;
 
         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 RCU_INIT_POINTER(sdata->u.vlan.sta, NULL);
 
-        while (sta->sta_state > IEEE80211_STA_NONE)
-                sta_info_move_state(sta, sta->sta_state - 1);
+        while (sta->sta_state > IEEE80211_STA_NONE) {
+                ret = sta_info_move_state(sta, sta->sta_state - 1);
+                if (ret) {
+                        WARN_ON_ONCE(1);
+                        break;
+                }
+        }
 
         if (sta->uploaded) {
-                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                        sdata = container_of(sdata->bss,
-                                             struct ieee80211_sub_if_data,
-                                             u.ap);
-                drv_sta_remove(local, sdata, &sta->sta);
-                sdata = sta->sdata;
+                ret = drv_sta_state(local, sdata, sta, IEEE80211_STA_NONE,
+                                    IEEE80211_STA_NOTEXIST);
+                WARN_ON_ONCE(ret != 0);
         }
 
         /*
@@ -787,6 +727,15 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
          */
         synchronize_rcu();
 
+        if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
+                BUG_ON(!sdata->bss);
+
+                clear_sta_flag(sta, WLAN_STA_PS_STA);
+
+                atomic_dec(&sdata->bss->num_sta_ps);
+                sta_info_recalc_tim(sta);
+        }
+
         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
                 local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
                 __skb_queue_purge(&sta->ps_tx_buf[ac]);
@@ -815,35 +764,20 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
         }
 #endif
 
-        /* There could be some memory leaks because of ampdu tx pending queue
-         * not being freed before destroying the station info.
-         *
-         * Make sure that such queues are purged before freeing the station
-         * info.
-         * TODO: We have to somehow postpone the full destruction
-         * until the aggregation stop completes. Refer
-         * http://thread.gmane.org/gmane.linux.kernel.wireless.general/81936
+        /*
+         * Destroy aggregation state here. It would be nice to wait for the
+         * driver to finish aggregation stop and then clean up, but for now
+         * drivers have to handle aggregation stop being requested, followed
+         * directly by station destruction.
          */
-
-        mutex_lock(&sta->ampdu_mlme.mtx);
-
         for (i = 0; i < STA_TID_NUM; i++) {
-                tid_tx = rcu_dereference_protected_tid_tx(sta, i);
+                tid_tx = rcu_dereference_raw(sta->ampdu_mlme.tid_tx[i]);
                 if (!tid_tx)
                         continue;
-                if (skb_queue_len(&tid_tx->pending)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                        wiphy_debug(local->hw.wiphy, "TX A-MPDU  purging %d "
-                                "packets for tid=%d\n",
-                                skb_queue_len(&tid_tx->pending), i);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                        __skb_queue_purge(&tid_tx->pending);
-                }
-                kfree_rcu(tid_tx, rcu_head);
+                __skb_queue_purge(&tid_tx->pending);
+                kfree(tid_tx);
         }
 
-        mutex_unlock(&sta->ampdu_mlme.mtx);
-
         sta_info_free(local, sta);
 
         return 0;
@@ -855,7 +789,7 @@ int sta_info_destroy_addr(struct ieee80211_sub_if_data *sdata, const u8 *addr)
         int ret;
 
         mutex_lock(&sdata->local->sta_mtx);
-        sta = sta_info_get_rx(sdata, addr);
+        sta = sta_info_get(sdata, addr);
         ret = __sta_info_destroy(sta);
         mutex_unlock(&sdata->local->sta_mtx);
 
@@ -869,7 +803,7 @@ int sta_info_destroy_addr_bss(struct ieee80211_sub_if_data *sdata,
         int ret;
 
         mutex_lock(&sdata->local->sta_mtx);
-        sta = sta_info_get_bss_rx(sdata, addr);
+        sta = sta_info_get_bss(sdata, addr);
         ret = __sta_info_destroy(sta);
         mutex_unlock(&sdata->local->sta_mtx);
 
@@ -932,8 +866,10 @@ int sta_info_flush(struct ieee80211_local *local,
 
         mutex_lock(&local->sta_mtx);
         list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
-                if (!sdata || sdata == sta->sdata)
+                if (!sdata || sdata == sta->sdata) {
                         WARN_ON(__sta_info_destroy(sta));
+                        ret++;
+                }
         }
         mutex_unlock(&local->sta_mtx);
 
@@ -976,7 +912,7 @@ struct ieee80211_sta *ieee80211_find_sta_by_ifaddr(struct ieee80211_hw *hw,
          */
         for_each_sta_info(hw_to_local(hw), addr, sta, nxt) {
                 if (localaddr &&
-                    compare_ether_addr(sta->sdata->vif.addr, localaddr) != 0)
+                    !ether_addr_equal(sta->sdata->vif.addr, localaddr))
                         continue;
                 if (!sta->uploaded)
                         return NULL;
@@ -1009,9 +945,11 @@ EXPORT_SYMBOL(ieee80211_find_sta);
 static void clear_sta_ps_flags(void *_sta)
 {
         struct sta_info *sta = _sta;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
 
         clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
-        clear_sta_flag(sta, WLAN_STA_PS_STA);
+        if (test_and_clear_sta_flag(sta, WLAN_STA_PS_STA))
+                atomic_dec(&sdata->bss->num_sta_ps);
 }
 
 /* powersave support code */
@@ -1113,7 +1051,7 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
          * exchange. Also set EOSP to indicate this packet
          * ends the poll/service period.
          */
-        info->flags |= IEEE80211_TX_CTL_POLL_RESPONSE |
+        info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
                        IEEE80211_TX_STATUS_EOSP |
                        IEEE80211_TX_CTL_REQ_TX_STATUS;
 
@@ -1240,7 +1178,7 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
                          * STA may still remain is PS mode after this frame
                          * exchange.
                          */
-                        info->flags |= IEEE80211_TX_CTL_POLL_RESPONSE;
+                        info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
 
                         /*
                          * Use MoreData flag to indicate whether there are
@@ -1257,13 +1195,15 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
                             ieee80211_is_qos_nullfunc(hdr->frame_control))
                                 qoshdr = ieee80211_get_qos_ctl(hdr);
 
-                        /* set EOSP for the frame */
-                        if (reason == IEEE80211_FRAME_RELEASE_UAPSD &&
-                            qoshdr && skb_queue_empty(&frames))
-                                *qoshdr |= IEEE80211_QOS_CTL_EOSP;
+                        /* end service period after last frame */
+                        if (skb_queue_empty(&frames)) {
+                                if (reason == IEEE80211_FRAME_RELEASE_UAPSD &&
+                                    qoshdr)
+                                        *qoshdr |= IEEE80211_QOS_CTL_EOSP;
 
-                        info->flags |= IEEE80211_TX_STATUS_EOSP |
-                                       IEEE80211_TX_CTL_REQ_TX_STATUS;
+                                info->flags |= IEEE80211_TX_STATUS_EOSP |
+                                               IEEE80211_TX_CTL_REQ_TX_STATUS;
+                        }
 
                         if (qoshdr)
                                 tids |= BIT(*qoshdr & IEEE80211_QOS_CTL_TID_MASK);
@@ -1410,54 +1350,93 @@ void ieee80211_sta_set_buffered(struct ieee80211_sta *pubsta,
 }
 EXPORT_SYMBOL(ieee80211_sta_set_buffered);
 
-int sta_info_move_state_checked(struct sta_info *sta,
-                                enum ieee80211_sta_state new_state)
+int sta_info_move_state(struct sta_info *sta,
+                        enum ieee80211_sta_state new_state)
 {
         might_sleep();
 
         if (sta->sta_state == new_state)
                 return 0;
 
+        /* check allowed transitions first */
+
+        switch (new_state) {
+        case IEEE80211_STA_NONE:
+                if (sta->sta_state != IEEE80211_STA_AUTH)
+                        return -EINVAL;
+                break;
+        case IEEE80211_STA_AUTH:
+                if (sta->sta_state != IEEE80211_STA_NONE &&
+                    sta->sta_state != IEEE80211_STA_ASSOC)
+                        return -EINVAL;
+                break;
+        case IEEE80211_STA_ASSOC:
+                if (sta->sta_state != IEEE80211_STA_AUTH &&
+                    sta->sta_state != IEEE80211_STA_AUTHORIZED)
+                        return -EINVAL;
+                break;
+        case IEEE80211_STA_AUTHORIZED:
+                if (sta->sta_state != IEEE80211_STA_ASSOC)
+                        return -EINVAL;
+                break;
+        default:
+                WARN(1, "invalid state %d", new_state);
+                return -EINVAL;
+        }
+
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        printk(KERN_DEBUG "%s: moving STA %pM to state %d\n",
+                sta->sdata->name, sta->sta.addr, new_state);
+#endif
+
+        /*
+         * notify the driver before the actual changes so it can
+         * fail the transition
+         */
+        if (test_sta_flag(sta, WLAN_STA_INSERTED)) {
+                int err = drv_sta_state(sta->local, sta->sdata, sta,
+                                        sta->sta_state, new_state);
+                if (err)
+                        return err;
+        }
+
+        /* reflect the change in all state variables */
+
         switch (new_state) {
         case IEEE80211_STA_NONE:
                 if (sta->sta_state == IEEE80211_STA_AUTH)
                         clear_bit(WLAN_STA_AUTH, &sta->_flags);
-                else
-                        return -EINVAL;
                 break;
         case IEEE80211_STA_AUTH:
                 if (sta->sta_state == IEEE80211_STA_NONE)
                         set_bit(WLAN_STA_AUTH, &sta->_flags);
                 else if (sta->sta_state == IEEE80211_STA_ASSOC)
                         clear_bit(WLAN_STA_ASSOC, &sta->_flags);
-                else
-                        return -EINVAL;
                 break;
         case IEEE80211_STA_ASSOC:
                 if (sta->sta_state == IEEE80211_STA_AUTH) {
                         set_bit(WLAN_STA_ASSOC, &sta->_flags);
                 } else if (sta->sta_state == IEEE80211_STA_AUTHORIZED) {
-                        if (sta->sdata->vif.type == NL80211_IFTYPE_AP)
-                                atomic_dec(&sta->sdata->u.ap.num_sta_authorized);
+                        if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
+                            (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+                             !sta->sdata->u.vlan.sta))
+                                atomic_dec(&sta->sdata->bss->num_mcast_sta);
                         clear_bit(WLAN_STA_AUTHORIZED, &sta->_flags);
-                } else
-                        return -EINVAL;
+                }
                 break;
         case IEEE80211_STA_AUTHORIZED:
                 if (sta->sta_state == IEEE80211_STA_ASSOC) {
-                        if (sta->sdata->vif.type == NL80211_IFTYPE_AP)
-                                atomic_inc(&sta->sdata->u.ap.num_sta_authorized);
+                        if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
+                            (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+                             !sta->sdata->u.vlan.sta))
+                                atomic_inc(&sta->sdata->bss->num_mcast_sta);
                         set_bit(WLAN_STA_AUTHORIZED, &sta->_flags);
-                } else
-                        return -EINVAL;
+                }
                 break;
         default:
-                WARN(1, "invalid state %d", new_state);
-                return -EINVAL;
+                break;
         }
 
-        printk(KERN_DEBUG "%s: moving STA %pM to state %d\n",
-                sta->sdata->name, sta->sta.addr, new_state);
         sta->sta_state = new_state;
 
         return 0;
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index bfed851d0d36..3bb24a121c95 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -14,6 +14,7 @@
 #include <linux/if_ether.h>
 #include <linux/workqueue.h>
 #include <linux/average.h>
+#include <linux/etherdevice.h>
 #include "key.h"
 
 /**
@@ -52,7 +53,9 @@
  * @WLAN_STA_SP: Station is in a service period, so don't try to
  *      reply to other uAPSD trigger frames or PS-Poll.
  * @WLAN_STA_4ADDR_EVENT: 4-addr event was already sent for this frame.
+ * @WLAN_STA_INSERTED: This station is inserted into the hash table.
  * @WLAN_STA_RATE_CONTROL: rate control was initialized for this station.
+ * @WLAN_STA_TOFFSET_KNOWN: toffset calculated for this station is valid.
  */
 enum ieee80211_sta_info_flags {
         WLAN_STA_AUTH,
@@ -72,15 +75,9 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_UAPSD,
         WLAN_STA_SP,
         WLAN_STA_4ADDR_EVENT,
+        WLAN_STA_INSERTED,
         WLAN_STA_RATE_CONTROL,
-};
-
-enum ieee80211_sta_state {
-        /* NOTE: These need to be ordered correctly! */
-        IEEE80211_STA_NONE,
-        IEEE80211_STA_AUTH,
-        IEEE80211_STA_ASSOC,
-        IEEE80211_STA_AUTHORIZED,
+        WLAN_STA_TOFFSET_KNOWN,
 };
 
 #define STA_TID_NUM 16
@@ -106,6 +103,7 @@ enum ieee80211_sta_state {
  * @dialog_token: dialog token for aggregation session
  * @timeout: session timeout value to be filled in ADDBA requests
  * @state: session state (see above)
+ * @last_tx: jiffies of last tx activity
  * @stop_initiator: initiator of a session stop
  * @tx_stop: TX DelBA frame when stopping
  * @buf_size: reorder buffer size at receiver
@@ -127,6 +125,7 @@ struct tid_ampdu_tx {
         struct timer_list addba_resp_timer;
         struct sk_buff_head pending;
         unsigned long state;
+        unsigned long last_tx;
         u16 timeout;
         u8 dialog_token;
         u8 stop_initiator;
@@ -144,6 +143,7 @@ struct tid_ampdu_tx {
  * @reorder_time: jiffies when skb was added
  * @session_timer: check if peer keeps Tx-ing on the TID (by timeout value)
  * @reorder_timer: releases expired frames from the reorder buffer.
+ * @last_rx: jiffies of last rx activity
  * @head_seq_num: head sequence number in reordering buffer.
  * @stored_mpdu_num: number of MPDUs in reordering buffer
  * @ssn: Starting Sequence Number expected to be aggregated.
@@ -168,6 +168,7 @@ struct tid_ampdu_rx {
         unsigned long *reorder_time;
         struct timer_list session_timer;
         struct timer_list reorder_timer;
+        unsigned long last_rx;
         u16 head_seq_num;
         u16 stored_mpdu_num;
         u16 ssn;
@@ -269,12 +270,11 @@ struct sta_ampdu_mlme {
  * @plink_timeout: timeout of peer link
  * @plink_timer: peer link watch timer
  * @plink_timer_was_running: used by suspend/resume to restore timers
+ * @t_offset: timing offset relative to this host
  * @debugfs: debug filesystem info
  * @dead: set to true when sta is unlinked
  * @uploaded: set to true when sta is uploaded to the driver
  * @lost_packets: number of consecutive lost packets
- * @dummy: indicate a dummy station created for receiving
- *      EAP frames before association
  * @sta: station information we share with the driver
  * @sta_state: duplicates information about station state (for debug)
  * @beacon_loss_count: number of times beacon loss has triggered
@@ -360,6 +360,9 @@ struct sta_info {
         enum nl80211_plink_state plink_state;
         u32 plink_timeout;
         struct timer_list plink_timer;
+        s64 t_offset;
+        s64 t_offset_setpoint;
+        enum nl80211_channel_type ch_type;
 #endif
 
 #ifdef CONFIG_MAC80211_DEBUGFS
@@ -372,8 +375,7 @@ struct sta_info {
         unsigned int lost_packets;
         unsigned int beacon_loss_count;
 
-        /* should be right in front of sta to be in the same cache line */
-        bool dummy;
+        bool supports_40mhz;
 
         /* keep last! */
         struct ieee80211_sta sta;
@@ -429,13 +431,17 @@ static inline int test_and_set_sta_flag(struct sta_info *sta,
         return test_and_set_bit(flag, &sta->_flags);
 }
 
-int sta_info_move_state_checked(struct sta_info *sta,
-                                enum ieee80211_sta_state new_state);
+int sta_info_move_state(struct sta_info *sta,
+                        enum ieee80211_sta_state new_state);
 
-static inline void sta_info_move_state(struct sta_info *sta,
-                                       enum ieee80211_sta_state new_state)
+static inline void sta_info_pre_move_state(struct sta_info *sta,
+                                           enum ieee80211_sta_state new_state)
 {
-        int ret = sta_info_move_state_checked(sta, new_state);
+        int ret;
+
+        WARN_ON_ONCE(test_sta_flag(sta, WLAN_STA_INSERTED));
+
+        ret = sta_info_move_state(sta, new_state);
         WARN_ON_ONCE(ret);
 }
 
@@ -472,15 +478,9 @@ rcu_dereference_protected_tid_tx(struct sta_info *sta, int tid)
 struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
                               const u8 *addr);
 
-struct sta_info *sta_info_get_rx(struct ieee80211_sub_if_data *sdata,
-                              const u8 *addr);
-
 struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
                                   const u8 *addr);
 
-struct sta_info *sta_info_get_bss_rx(struct ieee80211_sub_if_data *sdata,
-                                  const u8 *addr);
-
 static inline
 void for_each_sta_info_type_check(struct ieee80211_local *local,
                                   const u8 *addr,
@@ -489,23 +489,7 @@ void for_each_sta_info_type_check(struct ieee80211_local *local,
 {
 }
 
-#define for_each_sta_info(local, _addr, _sta, nxt)                      \
-        for (   /* initialise loop */                                   \
-                _sta = rcu_dereference(local->sta_hash[STA_HASH(_addr)]),\
-                nxt = _sta ? rcu_dereference(_sta->hnext) : NULL;       \
-                /* typecheck */                                         \
-                for_each_sta_info_type_check(local, (_addr), _sta, nxt),\
-                /* continue condition */                                \
-                _sta;                                                   \
-                /* advance loop */                                      \
-                _sta = nxt,                                             \
-                nxt = _sta ? rcu_dereference(_sta->hnext) : NULL        \
-             )                                                          \
-        /* run code only if address matches and it's not a dummy sta */ \
-        if (memcmp(_sta->sta.addr, (_addr), ETH_ALEN) == 0 &&           \
-                !_sta->dummy)
-
-#define for_each_sta_info_rx(local, _addr, _sta, nxt)                   \
+#define for_each_sta_info(local, _addr, _sta, nxt)                      \
         for (   /* initialise loop */                                   \
                 _sta = rcu_dereference(local->sta_hash[STA_HASH(_addr)]),\
                 nxt = _sta ? rcu_dereference(_sta->hnext) : NULL;       \
@@ -518,7 +502,7 @@ void for_each_sta_info_type_check(struct ieee80211_local *local,
                 nxt = _sta ? rcu_dereference(_sta->hnext) : NULL        \
              )                                                          \
         /* compare address and run code only if it matches */           \
-        if (memcmp(_sta->sta.addr, (_addr), ETH_ALEN) == 0)
+        if (ether_addr_equal(_sta->sta.addr, (_addr)))
 
 /*
  * Get STA info by index, BROKEN!
@@ -544,8 +528,8 @@ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta);
  */
 int sta_info_insert(struct sta_info *sta);
 int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU);
-int sta_info_reinsert(struct sta_info *sta);
 
+int __must_check __sta_info_destroy(struct sta_info *sta);
 int sta_info_destroy_addr(struct ieee80211_sub_if_data *sdata,
                           const u8 *addr);
 int sta_info_destroy_addr_bss(struct ieee80211_sub_if_data *sdata,
@@ -557,6 +541,9 @@ void sta_info_init(struct ieee80211_local *local);
 void sta_info_stop(struct ieee80211_local *local);
 int sta_info_flush(struct ieee80211_local *local,
                    struct ieee80211_sub_if_data *sdata);
+void sta_set_rate_info_tx(struct sta_info *sta,
+                          const struct ieee80211_tx_rate *rate,
+                          struct rate_info *rinfo);
 void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
                           unsigned long exp_time);
 
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 30c265c98f73..28cfa981cfb1 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -10,7 +10,9 @@
  */
 
 #include <linux/export.h>
+#include <linux/etherdevice.h>
 #include <net/mac80211.h>
+#include <asm/unaligned.h>
 #include "ieee80211_i.h"
 #include "rate.h"
 #include "mesh.h"
@@ -350,11 +352,16 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         bool send_to_cooked;
         bool acked;
         struct ieee80211_bar *bar;
-        u16 tid;
         int rtap_len;
 
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
-                if (info->status.rates[i].idx < 0) {
+                if ((info->flags & IEEE80211_TX_CTL_AMPDU) &&
+                    !(info->flags & IEEE80211_TX_STAT_AMPDU)) {
+                        /* just the first aggr frame carry status info */
+                        info->status.rates[i].idx = -1;
+                        info->status.rates[i].count = 0;
+                        break;
+                } else if (info->status.rates[i].idx < 0) {
                         break;
                 } else if (i >= hw->max_report_rates) {
                         /* the HW cannot have attempted that rate */
@@ -377,7 +384,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         for_each_sta_info(local, hdr->addr1, sta, tmp) {
                 /* skip wrong virtual interface */
-                if (memcmp(hdr->addr2, sta->sdata->vif.addr, ETH_ALEN))
+                if (!ether_addr_equal(hdr->addr2, sta->sdata->vif.addr))
                         continue;
 
                 if (info->flags & IEEE80211_TX_STATUS_EOSP)
@@ -412,7 +419,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                 }
 
                 if (!acked && ieee80211_is_back_req(fc)) {
-                        u16 control;
+                        u16 tid, control;
 
                         /*
                          * BAR failed, store the last SSN and retry sending
@@ -516,7 +523,8 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 
                 if (ieee80211_is_nullfunc(hdr->frame_control) ||
                     ieee80211_is_qos_nullfunc(hdr->frame_control)) {
-                        bool acked = info->flags & IEEE80211_TX_STAT_ACK;
+                        acked = info->flags & IEEE80211_TX_STAT_ACK;
+
                         cfg80211_probe_status(skb->dev, hdr->addr1,
                                               cookie, acked, GFP_ATOMIC);
                 } else {
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index e05667cd5e76..847215bb2a6f 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -153,13 +153,13 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
 
         /* Don't calculate ACKs for QoS Frames with NoAck Policy set */
         if (ieee80211_is_data_qos(hdr->frame_control) &&
-            *(ieee80211_get_qos_ctl(hdr)) | IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
+            *(ieee80211_get_qos_ctl(hdr)) & IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
                 dur = 0;
         else
                 /* Time needed to transmit ACK
                  * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
                  * to closest integer */
-                dur = ieee80211_frame_duration(local, 10, rate, erp,
+                dur = ieee80211_frame_duration(sband->band, 10, rate, erp,
                                 tx->sdata->vif.bss_conf.use_short_preamble);
 
         if (next_frag_len) {
@@ -167,7 +167,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
                  * transmit next fragment plus ACK and 2 x SIFS. */
                 dur *= 2; /* ACK + SIFS */
                 /* next fragment */
-                dur += ieee80211_frame_duration(local, next_frag_len,
+                dur += ieee80211_frame_duration(sband->band, next_frag_len,
                                 txrate->bitrate, erp,
                                 tx->sdata->vif.bss_conf.use_short_preamble);
         }
@@ -226,13 +226,13 @@ ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx)
          * have correct qos tag for some reason, due the network or the
          * peer application.
          *
-         * Note: local->uapsd_queues access is racy here. If the value is
+         * Note: ifmgd->uapsd_queues access is racy here. If the value is
          * changed via debugfs, user needs to reassociate manually to have
          * everything in sync.
          */
-        if ((ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
-            && (local->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
-            && skb_get_queue_mapping(tx->skb) == 0)
+        if ((ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED) &&
+            (ifmgd->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) &&
+            skb_get_queue_mapping(tx->skb) == IEEE80211_AC_VO)
                 return TX_CONTINUE;
 
         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
@@ -306,7 +306,7 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
                 }
         } else if (unlikely(tx->sdata->vif.type == NL80211_IFTYPE_AP &&
                             ieee80211_is_data(hdr->frame_control) &&
-                            !atomic_read(&tx->sdata->u.ap.num_sta_authorized))) {
+                            !atomic_read(&tx->sdata->u.ap.num_mcast_sta))) {
                 /*
                  * No associated STAs - no need to send multicast
                  * frames.
@@ -400,6 +400,8 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
                 return TX_CONTINUE;
 
         info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
+        if (tx->local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
+                info->hw_queue = tx->sdata->vif.cab_queue;
 
         /* device releases frame after DTIM beacon */
         if (!(tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING))
@@ -411,9 +413,8 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
 
         if (skb_queue_len(&tx->sdata->bss->ps_bc_buf) >= AP_MAX_BC_BUFFER) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "%s: BC TX buffer full - dropping the oldest frame\n",
-                               tx->sdata->name);
+                net_dbg_ratelimited("%s: BC TX buffer full - dropping the oldest frame\n",
+                                    tx->sdata->name);
 #endif
                 dev_kfree_skb(skb_dequeue(&tx->sdata->bss->ps_bc_buf));
         } else
@@ -448,18 +449,23 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
         struct ieee80211_local *local = tx->local;
 
-        if (unlikely(!sta ||
-                     ieee80211_is_probe_resp(hdr->frame_control) ||
-                     ieee80211_is_auth(hdr->frame_control) ||
-                     ieee80211_is_assoc_resp(hdr->frame_control) ||
-                     ieee80211_is_reassoc_resp(hdr->frame_control)))
+        if (unlikely(!sta))
                 return TX_CONTINUE;
 
         if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||
                       test_sta_flag(sta, WLAN_STA_PS_DRIVER)) &&
-                     !(info->flags & IEEE80211_TX_CTL_POLL_RESPONSE))) {
+                     !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
                 int ac = skb_get_queue_mapping(tx->skb);
 
+                /* only deauth, disassoc and action are bufferable MMPDUs */
+                if (ieee80211_is_mgmt(hdr->frame_control) &&
+                    !ieee80211_is_deauth(hdr->frame_control) &&
+                    !ieee80211_is_disassoc(hdr->frame_control) &&
+                    !ieee80211_is_action(hdr->frame_control)) {
+                        info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
+                        return TX_CONTINUE;
+                }
+
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "STA %pM aid %d: PS buffer for AC %d\n",
                        sta->sta.addr, sta->sta.aid, ac);
@@ -469,10 +475,8 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                 if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
                         struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                        if (net_ratelimit())
-                                printk(KERN_DEBUG "%s: STA %pM TX buffer for "
-                                       "AC %d full - dropping oldest frame\n",
-                                       tx->sdata->name, sta->sta.addr, ac);
+                        net_dbg_ratelimited("%s: STA %pM TX buffer for AC %d full - dropping oldest frame\n",
+                                            tx->sdata->name, sta->sta.addr, ac);
 #endif
                         dev_kfree_skb(old);
                 } else
@@ -625,7 +629,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
                          tx->local->hw.wiphy->frag_threshold);
 
         /* set up the tx rate control struct we give the RC algo */
-        txrc.hw = local_to_hw(tx->local);
+        txrc.hw = &tx->local->hw;
         txrc.sband = sband;
         txrc.bss_conf = &tx->sdata->vif.bss_conf;
         txrc.skb = tx->skb;
@@ -635,6 +639,9 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
                 txrc.max_rate_idx = -1;
         else
                 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
+        memcpy(txrc.rate_idx_mcs_mask,
+               tx->sdata->rc_rateidx_mcs_mask[tx->channel->band],
+               sizeof(txrc.rate_idx_mcs_mask));
         txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
                     tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
                     tx->sdata->vif.type == NL80211_IFTYPE_ADHOC);
@@ -1057,6 +1064,7 @@ static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
 {
         bool queued = false;
         bool reset_agg_timer = false;
+        struct sk_buff *purge_skb = NULL;
 
         if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
                 info->flags |= IEEE80211_TX_CTL_AMPDU;
@@ -1098,14 +1106,18 @@ static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
                         info->control.vif = &tx->sdata->vif;
                         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                         __skb_queue_tail(&tid_tx->pending, skb);
+                        if (skb_queue_len(&tid_tx->pending) > STA_MAX_TX_BUFFER)
+                                purge_skb = __skb_dequeue(&tid_tx->pending);
                 }
                 spin_unlock(&tx->sta->lock);
+
+                if (purge_skb)
+                        dev_kfree_skb(purge_skb);
         }
 
         /* reset session timer */
         if (reset_agg_timer && tid_tx->timeout)
-                mod_timer(&tid_tx->session_timer,
-                          TU_TO_EXP_TIME(tid_tx->timeout));
+                tid_tx->last_tx = jiffies;
 
         return queued;
 }
@@ -1144,7 +1156,8 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
                 tx->sta = rcu_dereference(sdata->u.vlan.sta);
                 if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
                         return TX_DROP;
-        } else if (info->flags & IEEE80211_TX_CTL_INJECTED) {
+        } else if (info->flags & IEEE80211_TX_CTL_INJECTED ||
+                   tx->sdata->control_port_protocol == tx->skb->protocol) {
                 tx->sta = sta_info_get_bss(sdata, hdr->addr1);
         }
         if (!tx->sta)
@@ -1201,11 +1214,19 @@ static bool ieee80211_tx_frags(struct ieee80211_local *local,
                                bool txpending)
 {
         struct sk_buff *skb, *tmp;
-        struct ieee80211_tx_info *info;
         unsigned long flags;
 
         skb_queue_walk_safe(skbs, skb, tmp) {
-                int q = skb_get_queue_mapping(skb);
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+                int q = info->hw_queue;
+
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+                if (WARN_ON_ONCE(q >= local->hw.queues)) {
+                        __skb_unlink(skb, skbs);
+                        dev_kfree_skb(skb);
+                        continue;
+                }
+#endif
 
                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
                 if (local->queue_stop_reasons[q] ||
@@ -1227,7 +1248,6 @@ static bool ieee80211_tx_frags(struct ieee80211_local *local,
                 }
                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
-                info = IEEE80211_SKB_CB(skb);
                 info->control.vif = vif;
                 info->control.sta = sta;
 
@@ -1270,8 +1290,16 @@ static bool __ieee80211_tx(struct ieee80211_local *local,
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_MONITOR:
-                sdata = NULL;
-                vif = NULL;
+                sdata = rcu_dereference(local->monitor_sdata);
+                if (sdata) {
+                        vif = &sdata->vif;
+                        info->hw_queue =
+                                vif->hw_queue[skb_get_queue_mapping(skb)];
+                } else if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL) {
+                        dev_kfree_skb(skb);
+                        return true;
+                } else
+                        vif = NULL;
                 break;
         case NL80211_IFTYPE_AP_VLAN:
                 sdata = container_of(sdata->bss,
@@ -1386,6 +1414,12 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
         tx.channel = local->hw.conf.channel;
         info->band = tx.channel->band;
 
+        /* set up hw_queue value early */
+        if (!(info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) ||
+            !(local->hw.flags & IEEE80211_HW_QUEUE_CONTROL))
+                info->hw_queue =
+                        sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
+
         if (!invoke_tx_handlers(&tx))
                 result = __ieee80211_tx(local, &tx.skbs, led_len,
                                         tx.sta, txpending);
@@ -1454,12 +1488,12 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
 
         if (ieee80211_vif_is_mesh(&sdata->vif) &&
             ieee80211_is_data(hdr->frame_control) &&
-                !is_multicast_ether_addr(hdr->addr1))
-                        if (mesh_nexthop_resolve(skb, sdata)) {
-                                /* skb queued: don't free */
-                                rcu_read_unlock();
-                                return;
-                        }
+            !is_multicast_ether_addr(hdr->addr1) &&
+            mesh_nexthop_resolve(skb, sdata)) {
+                /* skb queued: don't free */
+                rcu_read_unlock();
+                return;
+        }
 
         ieee80211_set_qos_hdr(sdata, skb);
         ieee80211_tx(sdata, skb, false);
@@ -1628,7 +1662,7 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
             skb->len >= len_rthdr + hdrlen + sizeof(rfc1042_header) + 2) {
                 u8 *payload = (u8 *)hdr + hdrlen;
 
-                if (compare_ether_addr(payload, rfc1042_header) == 0)
+                if (ether_addr_equal(payload, rfc1042_header))
                         skb->protocol = cpu_to_be16((payload[6] << 8) |
                                                     payload[7]);
         }
@@ -1661,7 +1695,7 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
                     tmp_sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
                     tmp_sdata->vif.type == NL80211_IFTYPE_WDS)
                         continue;
-                if (compare_ether_addr(tmp_sdata->vif.addr, hdr->addr2) == 0) {
+                if (ether_addr_equal(tmp_sdata->vif.addr, hdr->addr2)) {
                         sdata = tmp_sdata;
                         break;
                 }
@@ -1778,9 +1812,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                  * is being proxied by a portal (i.e. portal address
                  * differs from proxied address)
                  */
-                if (compare_ether_addr(sdata->vif.addr,
-                                       skb->data + ETH_ALEN) == 0 &&
-                    !(mppath && compare_ether_addr(mppath->mpp, skb->data))) {
+                if (ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN) &&
+                    !(mppath && !ether_addr_equal(mppath->mpp, skb->data))) {
                         hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
                                         skb->data, skb->data + ETH_ALEN);
                         rcu_read_unlock();
@@ -1915,7 +1948,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 wme_sta = true;
 
         /* receiver and we are QoS enabled, use a QoS type frame */
-        if (wme_sta && local->hw.queues >= 4) {
+        if (wme_sta && local->hw.queues >= IEEE80211_NUM_ACS) {
                 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
                 hdrlen += 2;
         }
@@ -1927,12 +1960,10 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         if (unlikely(!ieee80211_vif_is_mesh(&sdata->vif) &&
                      !is_multicast_ether_addr(hdr.addr1) && !authorized &&
                      (cpu_to_be16(ethertype) != sdata->control_port_protocol ||
-                      compare_ether_addr(sdata->vif.addr, skb->data + ETH_ALEN)))) {
+                      !ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN)))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "%s: dropped frame to %pM"
-                               " (unauthorized port)\n", dev->name,
-                               hdr.addr1);
+                net_dbg_ratelimited("%s: dropped frame to %pM (unauthorized port)\n",
+                                    dev->name, hdr.addr1);
 #endif
 
                 I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
@@ -2156,7 +2187,6 @@ static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
 void ieee80211_tx_pending(unsigned long data)
 {
         struct ieee80211_local *local = (struct ieee80211_local *)data;
-        struct ieee80211_sub_if_data *sdata;
         unsigned long flags;
         int i;
         bool txok;
@@ -2193,8 +2223,7 @@ void ieee80211_tx_pending(unsigned long data)
                 }
 
                 if (skb_queue_empty(&local->pending[i]))
-                        list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                                netif_wake_subqueue(sdata->dev, i);
+                        ieee80211_propagate_queue_wake(local, i);
         }
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
@@ -2203,7 +2232,8 @@ void ieee80211_tx_pending(unsigned long data)
 
 /* functions for drivers to get certain frames */
 
-static void ieee80211_beacon_add_tim(struct ieee80211_if_ap *bss,
+static void ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_if_ap *bss,
                                      struct sk_buff *skb,
                                      struct beacon_data *beacon)
 {
@@ -2220,7 +2250,7 @@ static void ieee80211_beacon_add_tim(struct ieee80211_if_ap *bss,
                                           IEEE80211_MAX_AID+1);
 
         if (bss->dtim_count == 0)
-                bss->dtim_count = beacon->dtim_period - 1;
+                bss->dtim_count = sdata->vif.bss_conf.dtim_period - 1;
         else
                 bss->dtim_count--;
 
@@ -2228,7 +2258,7 @@ static void ieee80211_beacon_add_tim(struct ieee80211_if_ap *bss,
         *pos++ = WLAN_EID_TIM;
         *pos++ = 4;
         *pos++ = bss->dtim_count;
-        *pos++ = beacon->dtim_period;
+        *pos++ = sdata->vif.bss_conf.dtim_period;
 
         if (bss->dtim_count == 0 && !skb_queue_empty(&bss->ps_bc_buf))
                 aid0 = 1;
@@ -2321,12 +2351,14 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                          * of the tim bitmap in mac80211 and the driver.
                          */
                         if (local->tim_in_locked_section) {
-                                ieee80211_beacon_add_tim(ap, skb, beacon);
+                                ieee80211_beacon_add_tim(sdata, ap, skb,
+                                                         beacon);
                         } else {
                                 unsigned long flags;
 
                                 spin_lock_irqsave(&local->tim_lock, flags);
-                                ieee80211_beacon_add_tim(ap, skb, beacon);
+                                ieee80211_beacon_add_tim(sdata, ap, skb,
+                                                         beacon);
                                 spin_unlock_irqrestore(&local->tim_lock, flags);
                         }
 
@@ -2357,6 +2389,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                                                  IEEE80211_STYPE_BEACON);
         } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
                 struct ieee80211_mgmt *mgmt;
+                struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
                 u8 *pos;
                 int hdr_len = offsetof(struct ieee80211_mgmt, u.beacon) +
                               sizeof(mgmt->u.beacon);
@@ -2366,6 +2399,10 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                         goto out;
 #endif
 
+                if (ifmsh->sync_ops)
+                        ifmsh->sync_ops->adjust_tbtt(
+                                                sdata);
+
                 skb = dev_alloc_skb(local->tx_headroom +
                                     hdr_len +
                                     2 + /* NULL SSID */
@@ -2373,7 +2410,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                                     2 + 3 + /* DS params */
                                     2 + (IEEE80211_MAX_SUPP_RATES - 8) +
                                     2 + sizeof(struct ieee80211_ht_cap) +
-                                    2 + sizeof(struct ieee80211_ht_info) +
+                                    2 + sizeof(struct ieee80211_ht_operation) +
                                     2 + sdata->u.mesh.mesh_id_len +
                                     2 + sizeof(struct ieee80211_meshconf_ie) +
                                     sdata->u.mesh.ie_len);
@@ -2397,12 +2434,12 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 *pos++ = WLAN_EID_SSID;
                 *pos++ = 0x0;
 
-                if (ieee80211_add_srates_ie(&sdata->vif, skb) ||
+                if (ieee80211_add_srates_ie(&sdata->vif, skb, true) ||
                     mesh_add_ds_params_ie(skb, sdata) ||
-                    ieee80211_add_ext_srates_ie(&sdata->vif, skb) ||
+                    ieee80211_add_ext_srates_ie(&sdata->vif, skb, true) ||
                     mesh_add_rsn_ie(skb, sdata) ||
                     mesh_add_ht_cap_ie(skb, sdata) ||
-                    mesh_add_ht_info_ie(skb, sdata) ||
+                    mesh_add_ht_oper_ie(skb, sdata) ||
                     mesh_add_meshid_ie(skb, sdata) ||
                     mesh_add_meshconf_ie(skb, sdata) ||
                     mesh_add_vendor_ies(skb, sdata)) {
@@ -2431,6 +2468,8 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 txrc.max_rate_idx = -1;
         else
                 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
+        memcpy(txrc.rate_idx_mcs_mask, sdata->rc_rateidx_mcs_mask[band],
+               sizeof(txrc.rate_idx_mcs_mask));
         txrc.bss = true;
         rate_control_get_rate(sdata, NULL, &txrc);
 
@@ -2584,7 +2623,7 @@ struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
         pos = skb_put(skb, ie_ssid_len);
         *pos++ = WLAN_EID_SSID;
         *pos++ = ssid_len;
-        if (ssid)
+        if (ssid_len)
                 memcpy(pos, ssid, ssid_len);
         pos += ssid_len;
 
@@ -2691,11 +2730,13 @@ EXPORT_SYMBOL(ieee80211_get_buffered_bc);
 void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,
                           struct sk_buff *skb, int tid)
 {
+        int ac = ieee802_1d_to_ac[tid];
+
         skb_set_mac_header(skb, 0);
         skb_set_network_header(skb, 0);
         skb_set_transport_header(skb, 0);
 
-        skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);
+        skb_set_queue_mapping(skb, ac);
         skb->priority = tid;
 
         /*
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 9919892575f4..a44c6807df01 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -106,7 +106,7 @@ void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx)
         }
 }
 
-int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
+int ieee80211_frame_duration(enum ieee80211_band band, size_t len,
                              int rate, int erp, int short_preamble)
 {
         int dur;
@@ -120,7 +120,7 @@ int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
          * DIV_ROUND_UP() operations.
          */
 
-        if (local->hw.conf.channel->band == IEEE80211_BAND_5GHZ || erp) {
+        if (band == IEEE80211_BAND_5GHZ || erp) {
                 /*
                  * OFDM:
                  *
@@ -162,10 +162,10 @@ int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
 /* Exported duration function for driver use */
 __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
                                         struct ieee80211_vif *vif,
+                                        enum ieee80211_band band,
                                         size_t frame_len,
                                         struct ieee80211_rate *rate)
 {
-        struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
         u16 dur;
         int erp;
@@ -179,7 +179,7 @@ __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
                         erp = rate->flags & IEEE80211_RATE_ERP_G;
         }
 
-        dur = ieee80211_frame_duration(local, frame_len, rate->bitrate, erp,
+        dur = ieee80211_frame_duration(band, frame_len, rate->bitrate, erp,
                                        short_preamble);
 
         return cpu_to_le16(dur);
@@ -198,7 +198,7 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
         u16 dur;
         struct ieee80211_supported_band *sband;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sband = local->hw.wiphy->bands[frame_txctl->band];
 
         short_preamble = false;
 
@@ -213,13 +213,13 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
         }
 
         /* CTS duration */
-        dur = ieee80211_frame_duration(local, 10, rate->bitrate,
+        dur = ieee80211_frame_duration(sband->band, 10, rate->bitrate,
                                        erp, short_preamble);
         /* Data frame duration */
-        dur += ieee80211_frame_duration(local, frame_len, rate->bitrate,
+        dur += ieee80211_frame_duration(sband->band, frame_len, rate->bitrate,
                                         erp, short_preamble);
         /* ACK duration */
-        dur += ieee80211_frame_duration(local, 10, rate->bitrate,
+        dur += ieee80211_frame_duration(sband->band, 10, rate->bitrate,
                                         erp, short_preamble);
 
         return cpu_to_le16(dur);
@@ -239,7 +239,7 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
         u16 dur;
         struct ieee80211_supported_band *sband;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sband = local->hw.wiphy->bands[frame_txctl->band];
 
         short_preamble = false;
 
@@ -253,11 +253,11 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
         }
 
         /* Data frame duration */
-        dur = ieee80211_frame_duration(local, frame_len, rate->bitrate,
+        dur = ieee80211_frame_duration(sband->band, frame_len, rate->bitrate,
                                        erp, short_preamble);
         if (!(frame_txctl->flags & IEEE80211_TX_CTL_NO_ACK)) {
                 /* ACK duration */
-                dur += ieee80211_frame_duration(local, 10, rate->bitrate,
+                dur += ieee80211_frame_duration(sband->band, 10, rate->bitrate,
                                                 erp, short_preamble);
         }
 
@@ -265,17 +265,45 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(ieee80211_ctstoself_duration);
 
+void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                int ac;
+
+                if (test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
+                        continue;
+
+                if (sdata->vif.cab_queue != IEEE80211_INVAL_HW_QUEUE &&
+                    local->queue_stop_reasons[sdata->vif.cab_queue] != 0)
+                        continue;
+
+                for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                        int ac_queue = sdata->vif.hw_queue[ac];
+
+                        if (ac_queue == queue ||
+                            (sdata->vif.cab_queue == queue &&
+                             local->queue_stop_reasons[ac_queue] == 0 &&
+                             skb_queue_empty(&local->pending[ac_queue])))
+                                netif_wake_subqueue(sdata->dev, ac);
+                }
+        }
+}
+
 static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
                                    enum queue_stop_reason reason)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_sub_if_data *sdata;
 
         trace_wake_queue(local, queue, reason);
 
         if (WARN_ON(queue >= hw->queues))
                 return;
 
+        if (!test_bit(reason, &local->queue_stop_reasons[queue]))
+                return;
+
         __clear_bit(reason, &local->queue_stop_reasons[queue]);
 
         if (local->queue_stop_reasons[queue] != 0)
@@ -284,11 +312,7 @@ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
 
         if (skb_queue_empty(&local->pending[queue])) {
                 rcu_read_lock();
-                list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                        if (test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
-                                continue;
-                        netif_wake_subqueue(sdata->dev, queue);
-                }
+                ieee80211_propagate_queue_wake(local, queue);
                 rcu_read_unlock();
         } else
                 tasklet_schedule(&local->tx_pending_tasklet);
@@ -323,11 +347,21 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
         if (WARN_ON(queue >= hw->queues))
                 return;
 
+        if (test_bit(reason, &local->queue_stop_reasons[queue]))
+                return;
+
         __set_bit(reason, &local->queue_stop_reasons[queue]);
 
         rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                netif_stop_subqueue(sdata->dev, queue);
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                int ac;
+
+                for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                        if (sdata->vif.hw_queue[ac] == queue ||
+                            sdata->vif.cab_queue == queue)
+                                netif_stop_subqueue(sdata->dev, ac);
+                }
+        }
         rcu_read_unlock();
 }
 
@@ -354,8 +388,8 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
 {
         struct ieee80211_hw *hw = &local->hw;
         unsigned long flags;
-        int queue = skb_get_queue_mapping(skb);
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        int queue = info->hw_queue;
 
         if (WARN_ON(!info->control.vif)) {
                 kfree_skb(skb);
@@ -379,10 +413,6 @@ void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
         int queue, i;
 
         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-        for (i = 0; i < hw->queues; i++)
-                __ieee80211_stop_queue(hw, i,
-                        IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
-
         while ((skb = skb_dequeue(skbs))) {
                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
@@ -391,7 +421,11 @@ void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
                         continue;
                 }
 
-                queue = skb_get_queue_mapping(skb);
+                queue = info->hw_queue;
+
+                __ieee80211_stop_queue(hw, queue,
+                                IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
+
                 __skb_queue_tail(&local->pending[queue], skb);
         }
 
@@ -404,12 +438,6 @@ void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }
 
-void ieee80211_add_pending_skbs(struct ieee80211_local *local,
-                                struct sk_buff_head *skbs)
-{
-        ieee80211_add_pending_skbs_fn(local, skbs, NULL, NULL);
-}
-
 void ieee80211_stop_queues_by_reason(struct ieee80211_hw *hw,
                                     enum queue_stop_reason reason)
 {
@@ -572,24 +600,40 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
         size_t left = len;
         u8 *pos = start;
         bool calc_crc = filter != 0;
+        DECLARE_BITMAP(seen_elems, 256);
 
+        bitmap_zero(seen_elems, 256);
         memset(elems, 0, sizeof(*elems));
         elems->ie_start = start;
         elems->total_len = len;
 
         while (left >= 2) {
                 u8 id, elen;
+                bool elem_parse_failed;
 
                 id = *pos++;
                 elen = *pos++;
                 left -= 2;
 
-                if (elen > left)
+                if (elen > left) {
+                        elems->parse_error = true;
                         break;
+                }
+
+                if (id != WLAN_EID_VENDOR_SPECIFIC &&
+                    id != WLAN_EID_QUIET &&
+                    test_bit(id, seen_elems)) {
+                        elems->parse_error = true;
+                        left -= elen;
+                        pos += elen;
+                        continue;
+                }
 
                 if (calc_crc && id < 64 && (filter & (1ULL << id)))
                         crc = crc32_be(crc, pos - 2, elen + 2);
 
+                elem_parse_failed = false;
+
                 switch (id) {
                 case WLAN_EID_SSID:
                         elems->ssid = pos;
@@ -615,7 +659,8 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                         if (elen >= sizeof(struct ieee80211_tim_ie)) {
                                 elems->tim = (void *)pos;
                                 elems->tim_len = elen;
-                        }
+                        } else
+                                elem_parse_failed = true;
                         break;
                 case WLAN_EID_IBSS_PARAMS:
                         elems->ibss_params = pos;
@@ -664,10 +709,14 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                 case WLAN_EID_HT_CAPABILITY:
                         if (elen >= sizeof(struct ieee80211_ht_cap))
                                 elems->ht_cap_elem = (void *)pos;
+                        else
+                                elem_parse_failed = true;
                         break;
-                case WLAN_EID_HT_INFORMATION:
-                        if (elen >= sizeof(struct ieee80211_ht_info))
-                                elems->ht_info_elem = (void *)pos;
+                case WLAN_EID_HT_OPERATION:
+                        if (elen >= sizeof(struct ieee80211_ht_operation))
+                                elems->ht_operation = (void *)pos;
+                        else
+                                elem_parse_failed = true;
                         break;
                 case WLAN_EID_MESH_ID:
                         elems->mesh_id = pos;
@@ -676,6 +725,8 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                 case WLAN_EID_MESH_CONFIG:
                         if (elen >= sizeof(struct ieee80211_meshconf_ie))
                                 elems->mesh_config = (void *)pos;
+                        else
+                                elem_parse_failed = true;
                         break;
                 case WLAN_EID_PEER_MGMT:
                         elems->peering = pos;
@@ -696,6 +747,8 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                 case WLAN_EID_RANN:
                         if (elen >= sizeof(struct ieee80211_rann_ie))
                                 elems->rann = (void *)pos;
+                        else
+                                elem_parse_failed = true;
                         break;
                 case WLAN_EID_CHANNEL_SWITCH:
                         elems->ch_switch_elem = pos;
@@ -724,10 +777,18 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                         break;
                 }
 
+                if (elem_parse_failed)
+                        elems->parse_error = true;
+                else
+                        set_bit(id, seen_elems);
+
                 left -= elen;
                 pos += elen;
         }
 
+        if (left != 0)
+                elems->parse_error = true;
+
         return crc;
 }
 
@@ -737,23 +798,27 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
         ieee802_11_parse_elems_crc(start, len, elems, 0, 0);
 }
 
-void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
+void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
+                               bool bss_notify)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_tx_queue_params qparam;
-        int queue;
+        int ac;
         bool use_11b;
         int aCWmin, aCWmax;
 
         if (!local->ops->conf_tx)
                 return;
 
+        if (local->hw.queues < IEEE80211_NUM_ACS)
+                return;
+
         memset(&qparam, 0, sizeof(qparam));
 
         use_11b = (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ) &&
                  !(sdata->flags & IEEE80211_SDATA_OPERATING_GMODE);
 
-        for (queue = 0; queue < local_to_hw(local)->queues; queue++) {
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
                 /* Set defaults according to 802.11-2007 Table 7-37 */
                 aCWmax = 1023;
                 if (use_11b)
@@ -761,21 +826,21 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
                 else
                         aCWmin = 15;
 
-                switch (queue) {
-                case 3: /* AC_BK */
+                switch (ac) {
+                case IEEE80211_AC_BK:
                         qparam.cw_max = aCWmax;
                         qparam.cw_min = aCWmin;
                         qparam.txop = 0;
                         qparam.aifs = 7;
                         break;
                 default: /* never happens but let's not leave undefined */
-                case 2: /* AC_BE */
+                case IEEE80211_AC_BE:
                         qparam.cw_max = aCWmax;
                         qparam.cw_min = aCWmin;
                         qparam.txop = 0;
                         qparam.aifs = 3;
                         break;
-                case 1: /* AC_VI */
+                case IEEE80211_AC_VI:
                         qparam.cw_max = aCWmin;
                         qparam.cw_min = (aCWmin + 1) / 2 - 1;
                         if (use_11b)
@@ -784,7 +849,7 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
                                 qparam.txop = 3008/32;
                         qparam.aifs = 2;
                         break;
-                case 0: /* AC_VO */
+                case IEEE80211_AC_VO:
                         qparam.cw_max = (aCWmin + 1) / 2 - 1;
                         qparam.cw_min = (aCWmin + 1) / 4 - 1;
                         if (use_11b)
@@ -797,8 +862,8 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
 
                 qparam.uapsd = false;
 
-                sdata->tx_conf[queue] = qparam;
-                drv_conf_tx(local, sdata, queue, &qparam);
+                sdata->tx_conf[ac] = qparam;
+                drv_conf_tx(local, sdata, ac, &qparam);
         }
 
         /* after reinitialize QoS TX queues setting to default,
@@ -807,7 +872,9 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
         if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
                 sdata->vif.bss_conf.qos =
                         sdata->vif.type != NL80211_IFTYPE_STATION;
-                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
+                if (bss_notify)
+                        ieee80211_bss_info_change_notify(sdata,
+                                                         BSS_CHANGED_QOS);
         }
 }
 
@@ -829,7 +896,7 @@ void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
         else
                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 
-        ieee80211_set_wmm_default(sdata);
+        ieee80211_set_wmm_default(sdata, true);
 }
 
 u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
@@ -842,10 +909,8 @@ u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
         int i;
 
         sband = local->hw.wiphy->bands[band];
-        if (!sband) {
-                WARN_ON(1);
-                sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-        }
+        if (WARN_ON(!sband))
+                return 1;
 
         if (band == IEEE80211_BAND_2GHZ)
                 mandatory_flag = IEEE80211_RATE_MANDATORY_B;
@@ -862,8 +927,8 @@ u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
 
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg,
-                         u8 *extra, size_t extra_len, const u8 *bssid,
-                         const u8 *key, u8 key_len, u8 key_idx)
+                         u8 *extra, size_t extra_len, const u8 *da,
+                         const u8 *bssid, const u8 *key, u8 key_len, u8 key_idx)
 {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
@@ -881,7 +946,7 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
         memset(mgmt, 0, 24 + 6);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_AUTH);
-        memcpy(mgmt->da, bssid, ETH_ALEN);
+        memcpy(mgmt->da, da, ETH_ALEN);
         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         memcpy(mgmt->bssid, bssid, ETH_ALEN);
         mgmt->u.auth.auth_alg = cpu_to_le16(auth_alg);
@@ -1070,7 +1135,7 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
 
 u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
                             struct ieee802_11_elems *elems,
-                            enum ieee80211_band band)
+                            enum ieee80211_band band, u32 *basic_rates)
 {
         struct ieee80211_supported_band *sband;
         struct ieee80211_rate *bitrates;
@@ -1079,10 +1144,8 @@ u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
         int i, j;
         sband = local->hw.wiphy->bands[band];
 
-        if (!sband) {
-                WARN_ON(1);
-                sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-        }
+        if (WARN_ON(!sband))
+                return 1;
 
         bitrates = sband->bitrates;
         num_rates = sband->n_bitrates;
@@ -1091,15 +1154,25 @@ u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
                      elems->ext_supp_rates_len; i++) {
                 u8 rate = 0;
                 int own_rate;
+                bool is_basic;
                 if (i < elems->supp_rates_len)
                         rate = elems->supp_rates[i];
                 else if (elems->ext_supp_rates)
                         rate = elems->ext_supp_rates
                                 [i - elems->supp_rates_len];
                 own_rate = 5 * (rate & 0x7f);
-                for (j = 0; j < num_rates; j++)
-                        if (bitrates[j].bitrate == own_rate)
+                is_basic = !!(rate & 0x80);
+
+                if (is_basic && (rate & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
+                        continue;
+
+                for (j = 0; j < num_rates; j++) {
+                        if (bitrates[j].bitrate == own_rate) {
                                 supp_rates |= BIT(j);
+                                if (basic_rates && is_basic)
+                                        *basic_rates |= BIT(j);
+                        }
+                }
         }
         return supp_rates;
 }
@@ -1174,6 +1247,16 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                                    IEEE80211_TPT_LEDTRIG_FL_RADIO, 0);
 
         /* add interfaces */
+        sdata = rtnl_dereference(local->monitor_sdata);
+        if (sdata) {
+                res = drv_add_interface(local, sdata);
+                if (WARN_ON(res)) {
+                        rcu_assign_pointer(local->monitor_sdata, NULL);
+                        synchronize_net();
+                        kfree(sdata);
+                }
+        }
+
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
                     sdata->vif.type != NL80211_IFTYPE_MONITOR &&
@@ -1185,26 +1268,28 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         mutex_lock(&local->sta_mtx);
         list_for_each_entry(sta, &local->sta_list, list) {
                 if (sta->uploaded) {
-                        sdata = sta->sdata;
-                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                                sdata = container_of(sdata->bss,
-                                             struct ieee80211_sub_if_data,
-                                             u.ap);
+                        enum ieee80211_sta_state state;
 
-                        WARN_ON(drv_sta_add(local, sdata, &sta->sta));
+                        for (state = IEEE80211_STA_NOTEXIST;
+                             state < sta->sta_state - 1; state++)
+                                WARN_ON(drv_sta_state(local, sta->sdata, sta,
+                                                      state, state + 1));
                 }
         }
         mutex_unlock(&local->sta_mtx);
 
         /* reconfigure tx conf */
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
-                    sdata->vif.type == NL80211_IFTYPE_MONITOR ||
-                    !ieee80211_sdata_running(sdata))
-                        continue;
+        if (hw->queues >= IEEE80211_NUM_ACS) {
+                list_for_each_entry(sdata, &local->interfaces, list) {
+                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+                            sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+                            !ieee80211_sdata_running(sdata))
+                                continue;
 
-                for (i = 0; i < hw->queues; i++)
-                        drv_conf_tx(local, sdata, i, &sdata->tx_conf[i]);
+                        for (i = 0; i < IEEE80211_NUM_ACS; i++)
+                                drv_conf_tx(local, sdata, i,
+                                            &sdata->tx_conf[i]);
+                }
         }
 
         /* reconfigure hardware */
@@ -1272,6 +1357,27 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         ieee80211_recalc_ps(local, -1);
 
         /*
+         * The sta might be in psm against the ap (e.g. because
+         * this was the state before a hw restart), so we
+         * explicitly send a null packet in order to make sure
+         * it'll sync against the ap (and get out of psm).
+         */
+        if (!(local->hw.conf.flags & IEEE80211_CONF_PS)) {
+                list_for_each_entry(sdata, &local->interfaces, list) {
+                        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                                continue;
+
+                        ieee80211_send_nullfunc(local, sdata, 0);
+                }
+        }
+
+        /* add back keys */
+        list_for_each_entry(sdata, &local->interfaces, list)
+                if (ieee80211_sdata_running(sdata))
+                        ieee80211_enable_keys(sdata);
+
+ wake_up:
+        /*
          * Clear the WLAN_STA_BLOCK_BA flag so new aggregation
          * sessions can be established after a resume.
          *
@@ -1292,12 +1398,6 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 mutex_unlock(&local->sta_mtx);
         }
 
-        /* add back keys */
-        list_for_each_entry(sdata, &local->interfaces, list)
-                if (ieee80211_sdata_running(sdata))
-                        ieee80211_enable_keys(sdata);
-
- wake_up:
         ieee80211_wake_queues_by_reason(hw,
                         IEEE80211_QUEUE_STOP_REASON_SUSPEND);
 
@@ -1561,57 +1661,55 @@ u8 *ieee80211_ie_build_ht_cap(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
         return pos;
 }
 
-u8 *ieee80211_ie_build_ht_info(u8 *pos,
-                               struct ieee80211_sta_ht_cap *ht_cap,
+u8 *ieee80211_ie_build_ht_oper(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
                                struct ieee80211_channel *channel,
-                               enum nl80211_channel_type channel_type)
+                               enum nl80211_channel_type channel_type,
+                               u16 prot_mode)
 {
-        struct ieee80211_ht_info *ht_info;
+        struct ieee80211_ht_operation *ht_oper;
         /* Build HT Information */
-        *pos++ = WLAN_EID_HT_INFORMATION;
-        *pos++ = sizeof(struct ieee80211_ht_info);
-        ht_info = (struct ieee80211_ht_info *)pos;
-        ht_info->control_chan =
+        *pos++ = WLAN_EID_HT_OPERATION;
+        *pos++ = sizeof(struct ieee80211_ht_operation);
+        ht_oper = (struct ieee80211_ht_operation *)pos;
+        ht_oper->primary_chan =
                         ieee80211_frequency_to_channel(channel->center_freq);
         switch (channel_type) {
         case NL80211_CHAN_HT40MINUS:
-                ht_info->ht_param = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+                ht_oper->ht_param = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
                 break;
         case NL80211_CHAN_HT40PLUS:
-                ht_info->ht_param = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+                ht_oper->ht_param = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
                 break;
         case NL80211_CHAN_HT20:
         default:
-                ht_info->ht_param = IEEE80211_HT_PARAM_CHA_SEC_NONE;
+                ht_oper->ht_param = IEEE80211_HT_PARAM_CHA_SEC_NONE;
                 break;
         }
-        if (ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
-                ht_info->ht_param |= IEEE80211_HT_PARAM_CHAN_WIDTH_ANY;
+        if (ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
+            channel_type != NL80211_CHAN_NO_HT &&
+            channel_type != NL80211_CHAN_HT20)
+                ht_oper->ht_param |= IEEE80211_HT_PARAM_CHAN_WIDTH_ANY;
 
-        /*
-         * Note: According to 802.11n-2009 9.13.3.1, HT Protection field and
-         * RIFS Mode are reserved in IBSS mode, therefore keep them at 0
-         */
-        ht_info->operation_mode = 0x0000;
-        ht_info->stbc_param = 0x0000;
+        ht_oper->operation_mode = cpu_to_le16(prot_mode);
+        ht_oper->stbc_param = 0x0000;
 
         /* It seems that Basic MCS set and Supported MCS set
            are identical for the first 10 bytes */
-        memset(&ht_info->basic_set, 0, 16);
-        memcpy(&ht_info->basic_set, &ht_cap->mcs, 10);
+        memset(&ht_oper->basic_set, 0, 16);
+        memcpy(&ht_oper->basic_set, &ht_cap->mcs, 10);
 
-        return pos + sizeof(struct ieee80211_ht_info);
+        return pos + sizeof(struct ieee80211_ht_operation);
 }
 
 enum nl80211_channel_type
-ieee80211_ht_info_to_channel_type(struct ieee80211_ht_info *ht_info)
+ieee80211_ht_oper_to_channel_type(struct ieee80211_ht_operation *ht_oper)
 {
         enum nl80211_channel_type channel_type;
 
-        if (!ht_info)
+        if (!ht_oper)
                 return NL80211_CHAN_NO_HT;
 
-        switch (ht_info->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+        switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
         case IEEE80211_HT_PARAM_CHA_SEC_NONE:
                 channel_type = NL80211_CHAN_HT20;
                 break;
@@ -1628,13 +1726,15 @@ ieee80211_ht_info_to_channel_type(struct ieee80211_ht_info *ht_info)
         return channel_type;
 }
 
-int ieee80211_add_srates_ie(struct ieee80211_vif *vif, struct sk_buff *skb)
+int ieee80211_add_srates_ie(struct ieee80211_vif *vif,
+                            struct sk_buff *skb, bool need_basic)
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
         int rate;
         u8 i, rates, *pos;
+        u32 basic_rates = vif->bss_conf.basic_rates;
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
         rates = sband->n_bitrates;
@@ -1648,20 +1748,25 @@ int ieee80211_add_srates_ie(struct ieee80211_vif *vif, struct sk_buff *skb)
         *pos++ = WLAN_EID_SUPP_RATES;
         *pos++ = rates;
         for (i = 0; i < rates; i++) {
+                u8 basic = 0;
+                if (need_basic && basic_rates & BIT(i))
+                        basic = 0x80;
                 rate = sband->bitrates[i].bitrate;
-                *pos++ = (u8) (rate / 5);
+                *pos++ = basic | (u8) (rate / 5);
         }
 
         return 0;
 }
 
-int ieee80211_add_ext_srates_ie(struct ieee80211_vif *vif, struct sk_buff *skb)
+int ieee80211_add_ext_srates_ie(struct ieee80211_vif *vif,
+                                struct sk_buff *skb, bool need_basic)
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
         int rate;
         u8 i, exrates, *pos;
+        u32 basic_rates = vif->bss_conf.basic_rates;
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
         exrates = sband->n_bitrates;
@@ -1678,9 +1783,25 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_vif *vif, struct sk_buff *skb)
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
                 *pos++ = exrates;
                 for (i = 8; i < sband->n_bitrates; i++) {
+                        u8 basic = 0;
+                        if (need_basic && basic_rates & BIT(i))
+                                basic = 0x80;
                         rate = sband->bitrates[i].bitrate;
-                        *pos++ = (u8) (rate / 5);
+                        *pos++ = basic | (u8) (rate / 5);
                 }
         }
         return 0;
 }
+
+int ieee80211_ave_rssi(struct ieee80211_vif *vif)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        if (WARN_ON_ONCE(sdata->vif.type != NL80211_IFTYPE_STATION)) {
+                /* non-managed type inferfaces */
+                return 0;
+        }
+        return ifmgd->ave_beacon_signal;
+}
+EXPORT_SYMBOL_GPL(ieee80211_ave_rssi);
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index 68ad351479df..c04d401dae92 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -92,6 +92,7 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
                                 int keylen, int keyidx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         unsigned int hdrlen;
         u8 *newhdr;
 
@@ -104,6 +105,13 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         newhdr = skb_push(skb, WEP_IV_LEN);
         memmove(newhdr, newhdr + WEP_IV_LEN, hdrlen);
+
+        /* the HW only needs room for the IV, but not the actual IV */
+        if (info->control.hw_key &&
+            (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
+                return newhdr + hdrlen;
+
+        skb_set_network_header(skb, skb_network_offset(skb) + WEP_IV_LEN);
         ieee80211_wep_get_iv(local, keylen, keyidx, newhdr + hdrlen);
         return newhdr + hdrlen;
 }
@@ -263,16 +271,14 @@ static int ieee80211_wep_decrypt(struct ieee80211_local *local,
 }
 
 
-bool ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key)
+static bool ieee80211_wep_is_weak_iv(struct sk_buff *skb,
+                                     struct ieee80211_key *key)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         unsigned int hdrlen;
         u8 *ivpos;
         u32 iv;
 
-        if (!ieee80211_has_protected(hdr->frame_control))
-                return false;
-
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         ivpos = skb->data + hdrlen;
         iv = (ivpos[0] << 16) | (ivpos[1] << 8) | ivpos[2];
@@ -286,18 +292,27 @@ ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx)
         struct sk_buff *skb = rx->skb;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        __le16 fc = hdr->frame_control;
 
-        if (!ieee80211_is_data(hdr->frame_control) &&
-            !ieee80211_is_auth(hdr->frame_control))
+        if (!ieee80211_is_data(fc) && !ieee80211_is_auth(fc))
                 return RX_CONTINUE;
 
         if (!(status->flag & RX_FLAG_DECRYPTED)) {
+                if (skb_linearize(rx->skb))
+                        return RX_DROP_UNUSABLE;
+                if (rx->sta && ieee80211_wep_is_weak_iv(rx->skb, rx->key))
+                        rx->sta->wep_weak_iv_count++;
                 if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key))
                         return RX_DROP_UNUSABLE;
         } else if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
+                if (!pskb_may_pull(rx->skb, ieee80211_hdrlen(fc) + WEP_IV_LEN))
+                        return RX_DROP_UNUSABLE;
+                if (rx->sta && ieee80211_wep_is_weak_iv(rx->skb, rx->key))
+                        rx->sta->wep_weak_iv_count++;
                 ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
                 /* remove ICV */
-                skb_trim(rx->skb, rx->skb->len - WEP_ICV_LEN);
+                if (pskb_trim(rx->skb, rx->skb->len - WEP_ICV_LEN))
+                        return RX_DROP_UNUSABLE;
         }
 
         return RX_CONTINUE;
@@ -306,14 +321,15 @@ ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx)
 static int wep_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_key_conf *hw_key = info->control.hw_key;
 
-        if (!info->control.hw_key) {
+        if (!hw_key) {
                 if (ieee80211_wep_encrypt(tx->local, skb, tx->key->conf.key,
                                           tx->key->conf.keylen,
                                           tx->key->conf.keyidx))
                         return -1;
-        } else if (info->control.hw_key->flags &
-                        IEEE80211_KEY_FLAG_GENERATE_IV) {
+        } else if ((hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+                   (hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
                 if (!ieee80211_wep_add_iv(tx->local, skb,
                                           tx->key->conf.keylen,
                                           tx->key->conf.keyidx))
diff --git a/net/mac80211/wep.h b/net/mac80211/wep.h
index 01e54840a628..9615749d1f65 100644
--- a/net/mac80211/wep.h
+++ b/net/mac80211/wep.h
@@ -25,7 +25,6 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local,
                           const u8 *key, int keylen, int keyidx);
 int ieee80211_wep_decrypt_data(struct crypto_cipher *tfm, u8 *rc4key,
                                size_t klen, u8 *data, size_t data_len);
-bool ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key);
 
 ieee80211_rx_result
 ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx);
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 89511be3111e..c3d643a6536c 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -52,6 +52,26 @@ static int wme_downgrade_ac(struct sk_buff *skb)
         }
 }
 
+static u16 ieee80211_downgrade_queue(struct ieee80211_local *local,
+                                     struct sk_buff *skb)
+{
+        /* in case we are a client verify acm is not set for this ac */
+        while (unlikely(local->wmm_acm & BIT(skb->priority))) {
+                if (wme_downgrade_ac(skb)) {
+                        /*
+                         * This should not really happen. The AP has marked all
+                         * lower ACs to require admission control which is not
+                         * a reasonable configuration. Allow the frame to be
+                         * transmitted using AC_BK as a workaround.
+                         */
+                        break;
+                }
+        }
+
+        /* look up which queue to use for frames with this 1d tag */
+        return ieee802_1d_to_ac[skb->priority];
+}
+
 /* Indicate which queue to use for this fully formed 802.11 frame */
 u16 ieee80211_select_queue_80211(struct ieee80211_local *local,
                                  struct sk_buff *skb,
@@ -59,7 +79,7 @@ u16 ieee80211_select_queue_80211(struct ieee80211_local *local,
 {
         u8 *p;
 
-        if (local->hw.queues < 4)
+        if (local->hw.queues < IEEE80211_NUM_ACS)
                 return 0;
 
         if (!ieee80211_is_data(hdr->frame_control)) {
@@ -86,9 +106,9 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
         const u8 *ra = NULL;
         bool qos = false;
 
-        if (local->hw.queues < 4 || skb->len < 6) {
+        if (local->hw.queues < IEEE80211_NUM_ACS || skb->len < 6) {
                 skb->priority = 0; /* required for correct WPA/11i MIC */
-                return min_t(u16, local->hw.queues - 1, IEEE80211_AC_BE);
+                return 0;
         }
 
         rcu_read_lock();
@@ -139,26 +159,6 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
         return ieee80211_downgrade_queue(local, skb);
 }
 
-u16 ieee80211_downgrade_queue(struct ieee80211_local *local,
-                              struct sk_buff *skb)
-{
-        /* in case we are a client verify acm is not set for this ac */
-        while (unlikely(local->wmm_acm & BIT(skb->priority))) {
-                if (wme_downgrade_ac(skb)) {
-                        /*
-                         * This should not really happen. The AP has marked all
-                         * lower ACs to require admission control which is not
-                         * a reasonable configuration. Allow the frame to be
-                         * transmitted using AC_BK as a workaround.
-                         */
-                        break;
-                }
-        }
-
-        /* look up which queue to use for frames with this 1d tag */
-        return ieee802_1d_to_ac[skb->priority];
-}
-
 void ieee80211_set_qos_hdr(struct ieee80211_sub_if_data *sdata,
                            struct sk_buff *skb)
 {
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index 94edceb617ff..ca80818b7b66 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -22,8 +22,5 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
                            struct sk_buff *skb);
 void ieee80211_set_qos_hdr(struct ieee80211_sub_if_data *sdata,
                            struct sk_buff *skb);
-u16 ieee80211_downgrade_queue(struct ieee80211_local *local,
-                              struct sk_buff *skb);
-
 
 #endif /* _WME_H */
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index c6dd01a05291..b2650a9d45ff 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -27,16 +27,9 @@
 #include "rate.h"
 #include "driver-ops.h"
 
-#define IEEE80211_AUTH_TIMEOUT (HZ / 5)
-#define IEEE80211_AUTH_MAX_TRIES 3
-#define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
-#define IEEE80211_ASSOC_MAX_TRIES 3
-
 enum work_action {
-        WORK_ACT_MISMATCH,
         WORK_ACT_NONE,
         WORK_ACT_TIMEOUT,
-        WORK_ACT_DONE,
 };
 
 
@@ -71,464 +64,6 @@ void free_work(struct ieee80211_work *wk)
         kfree_rcu(wk, rcu_head);
 }
 
-static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len,
-                                      struct ieee80211_supported_band *sband,
-                                      u32 *rates)
-{
-        int i, j, count;
-        *rates = 0;
-        count = 0;
-        for (i = 0; i < supp_rates_len; i++) {
-                int rate = (supp_rates[i] & 0x7F) * 5;
-
-                for (j = 0; j < sband->n_bitrates; j++)
-                        if (sband->bitrates[j].bitrate == rate) {
-                                *rates |= BIT(j);
-                                count++;
-                                break;
-                        }
-        }
-
-        return count;
-}
-
-/* frame sending functions */
-
-static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
-                                struct sk_buff *skb, const u8 *ht_info_ie,
-                                struct ieee80211_supported_band *sband,
-                                struct ieee80211_channel *channel,
-                                enum ieee80211_smps_mode smps)
-{
-        struct ieee80211_ht_info *ht_info;
-        u8 *pos;
-        u32 flags = channel->flags;
-        u16 cap;
-        struct ieee80211_sta_ht_cap ht_cap;
-
-        BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
-
-        if (!sband->ht_cap.ht_supported)
-                return;
-
-        if (!ht_info_ie)
-                return;
-
-        if (ht_info_ie[1] < sizeof(struct ieee80211_ht_info))
-                return;
-
-        memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
-        ieee80211_apply_htcap_overrides(sdata, &ht_cap);
-
-        ht_info = (struct ieee80211_ht_info *)(ht_info_ie + 2);
-
-        /* determine capability flags */
-        cap = ht_cap.cap;
-
-        switch (ht_info->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
-        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
-                        cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                        cap &= ~IEEE80211_HT_CAP_SGI_40;
-                }
-                break;
-        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
-                        cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                        cap &= ~IEEE80211_HT_CAP_SGI_40;
-                }
-                break;
-        }
-
-        /* set SM PS mode properly */
-        cap &= ~IEEE80211_HT_CAP_SM_PS;
-        switch (smps) {
-        case IEEE80211_SMPS_AUTOMATIC:
-        case IEEE80211_SMPS_NUM_MODES:
-                WARN_ON(1);
-        case IEEE80211_SMPS_OFF:
-                cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
-                        IEEE80211_HT_CAP_SM_PS_SHIFT;
-                break;
-        case IEEE80211_SMPS_STATIC:
-                cap |= WLAN_HT_CAP_SM_PS_STATIC <<
-                        IEEE80211_HT_CAP_SM_PS_SHIFT;
-                break;
-        case IEEE80211_SMPS_DYNAMIC:
-                cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
-                        IEEE80211_HT_CAP_SM_PS_SHIFT;
-                break;
-        }
-
-        /* reserve and fill IE */
-        pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
-        ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
-}
-
-static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
-                                 struct ieee80211_work *wk)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        u8 *pos, qos_info;
-        size_t offset = 0, noffset;
-        int i, count, rates_len, supp_rates_len;
-        u16 capab;
-        struct ieee80211_supported_band *sband;
-        u32 rates = 0;
-
-        sband = local->hw.wiphy->bands[wk->chan->band];
-
-        if (wk->assoc.supp_rates_len) {
-                /*
-                 * Get all rates supported by the device and the AP as
-                 * some APs don't like getting a superset of their rates
-                 * in the association request (e.g. D-Link DAP 1353 in
-                 * b-only mode)...
-                 */
-                rates_len = ieee80211_compatible_rates(wk->assoc.supp_rates,
-                                                       wk->assoc.supp_rates_len,
-                                                       sband, &rates);
-        } else {
-                /*
-                 * In case AP not provide any supported rates information
-                 * before association, we send information element(s) with
-                 * all rates that we support.
-                 */
-                rates = ~0;
-                rates_len = sband->n_bitrates;
-        }
-
-        skb = alloc_skb(local->hw.extra_tx_headroom +
-                        sizeof(*mgmt) + /* bit too much but doesn't matter */
-                        2 + wk->assoc.ssid_len + /* SSID */
-                        4 + rates_len + /* (extended) rates */
-                        4 + /* power capability */
-                        2 + 2 * sband->n_channels + /* supported channels */
-                        2 + sizeof(struct ieee80211_ht_cap) + /* HT */
-                        wk->ie_len + /* extra IEs */
-                        9, /* WMM */
-                        GFP_KERNEL);
-        if (!skb)
-                return;
-
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        capab = WLAN_CAPABILITY_ESS;
-
-        if (sband->band == IEEE80211_BAND_2GHZ) {
-                if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
-                        capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
-                if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
-                        capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
-        }
-
-        if (wk->assoc.capability & WLAN_CAPABILITY_PRIVACY)
-                capab |= WLAN_CAPABILITY_PRIVACY;
-
-        if ((wk->assoc.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
-            (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
-                capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
-
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        memcpy(mgmt->da, wk->filter_ta, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
-        memcpy(mgmt->bssid, wk->filter_ta, ETH_ALEN);
-
-        if (!is_zero_ether_addr(wk->assoc.prev_bssid)) {
-                skb_put(skb, 10);
-                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                                  IEEE80211_STYPE_REASSOC_REQ);
-                mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
-                mgmt->u.reassoc_req.listen_interval =
-                                cpu_to_le16(local->hw.conf.listen_interval);
-                memcpy(mgmt->u.reassoc_req.current_ap, wk->assoc.prev_bssid,
-                       ETH_ALEN);
-        } else {
-                skb_put(skb, 4);
-                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                                  IEEE80211_STYPE_ASSOC_REQ);
-                mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
-                mgmt->u.assoc_req.listen_interval =
-                                cpu_to_le16(local->hw.conf.listen_interval);
-        }
-
-        /* SSID */
-        pos = skb_put(skb, 2 + wk->assoc.ssid_len);
-        *pos++ = WLAN_EID_SSID;
-        *pos++ = wk->assoc.ssid_len;
-        memcpy(pos, wk->assoc.ssid, wk->assoc.ssid_len);
-
-        /* add all rates which were marked to be used above */
-        supp_rates_len = rates_len;
-        if (supp_rates_len > 8)
-                supp_rates_len = 8;
-
-        pos = skb_put(skb, supp_rates_len + 2);
-        *pos++ = WLAN_EID_SUPP_RATES;
-        *pos++ = supp_rates_len;
-
-        count = 0;
-        for (i = 0; i < sband->n_bitrates; i++) {
-                if (BIT(i) & rates) {
-                        int rate = sband->bitrates[i].bitrate;
-                        *pos++ = (u8) (rate / 5);
-                        if (++count == 8)
-                                break;
-                }
-        }
-
-        if (rates_len > count) {
-                pos = skb_put(skb, rates_len - count + 2);
-                *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                *pos++ = rates_len - count;
-
-                for (i++; i < sband->n_bitrates; i++) {
-                        if (BIT(i) & rates) {
-                                int rate = sband->bitrates[i].bitrate;
-                                *pos++ = (u8) (rate / 5);
-                        }
-                }
-        }
-
-        if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
-                /* 1. power capabilities */
-                pos = skb_put(skb, 4);
-                *pos++ = WLAN_EID_PWR_CAPABILITY;
-                *pos++ = 2;
-                *pos++ = 0; /* min tx power */
-                *pos++ = wk->chan->max_power; /* max tx power */
-
-                /* 2. supported channels */
-                /* TODO: get this in reg domain format */
-                pos = skb_put(skb, 2 * sband->n_channels + 2);
-                *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
-                *pos++ = 2 * sband->n_channels;
-                for (i = 0; i < sband->n_channels; i++) {
-                        *pos++ = ieee80211_frequency_to_channel(
-                                        sband->channels[i].center_freq);
-                        *pos++ = 1; /* one channel in the subband*/
-                }
-        }
-
-        /* if present, add any custom IEs that go before HT */
-        if (wk->ie_len && wk->ie) {
-                static const u8 before_ht[] = {
-                        WLAN_EID_SSID,
-                        WLAN_EID_SUPP_RATES,
-                        WLAN_EID_EXT_SUPP_RATES,
-                        WLAN_EID_PWR_CAPABILITY,
-                        WLAN_EID_SUPPORTED_CHANNELS,
-                        WLAN_EID_RSN,
-                        WLAN_EID_QOS_CAPA,
-                        WLAN_EID_RRM_ENABLED_CAPABILITIES,
-                        WLAN_EID_MOBILITY_DOMAIN,
-                        WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
-                };
-                noffset = ieee80211_ie_split(wk->ie, wk->ie_len,
-                                             before_ht, ARRAY_SIZE(before_ht),
-                                             offset);
-                pos = skb_put(skb, noffset - offset);
-                memcpy(pos, wk->ie + offset, noffset - offset);
-                offset = noffset;
-        }
-
-        if (wk->assoc.use_11n && wk->assoc.wmm_used &&
-            local->hw.queues >= 4)
-                ieee80211_add_ht_ie(sdata, skb, wk->assoc.ht_information_ie,
-                                    sband, wk->chan, wk->assoc.smps);
-
-        /* if present, add any custom non-vendor IEs that go after HT */
-        if (wk->ie_len && wk->ie) {
-                noffset = ieee80211_ie_split_vendor(wk->ie, wk->ie_len,
-                                                    offset);
-                pos = skb_put(skb, noffset - offset);
-                memcpy(pos, wk->ie + offset, noffset - offset);
-                offset = noffset;
-        }
-
-        if (wk->assoc.wmm_used && local->hw.queues >= 4) {
-                if (wk->assoc.uapsd_used) {
-                        qos_info = local->uapsd_queues;
-                        qos_info |= (local->uapsd_max_sp_len <<
-                                     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
-                } else {
-                        qos_info = 0;
-                }
-
-                pos = skb_put(skb, 9);
-                *pos++ = WLAN_EID_VENDOR_SPECIFIC;
-                *pos++ = 7; /* len */
-                *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
-                *pos++ = 0x50;
-                *pos++ = 0xf2;
-                *pos++ = 2; /* WME */
-                *pos++ = 0; /* WME info */
-                *pos++ = 1; /* WME ver */
-                *pos++ = qos_info;
-        }
-
-        /* add any remaining custom (i.e. vendor specific here) IEs */
-        if (wk->ie_len && wk->ie) {
-                noffset = wk->ie_len;
-                pos = skb_put(skb, noffset - offset);
-                memcpy(pos, wk->ie + offset, noffset - offset);
-        }
-
-        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
-        ieee80211_tx_skb(sdata, skb);
-}
-
-static void ieee80211_remove_auth_bss(struct ieee80211_local *local,
-                                      struct ieee80211_work *wk)
-{
-        struct cfg80211_bss *cbss;
-        u16 capa_val = WLAN_CAPABILITY_ESS;
-
-        if (wk->probe_auth.privacy)
-                capa_val |= WLAN_CAPABILITY_PRIVACY;
-
-        cbss = cfg80211_get_bss(local->hw.wiphy, wk->chan, wk->filter_ta,
-                                wk->probe_auth.ssid, wk->probe_auth.ssid_len,
-                                WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_PRIVACY,
-                                capa_val);
-        if (!cbss)
-                return;
-
-        cfg80211_unlink_bss(local->hw.wiphy, cbss);
-        cfg80211_put_bss(cbss);
-}
-
-static enum work_action __must_check
-ieee80211_direct_probe(struct ieee80211_work *wk)
-{
-        struct ieee80211_sub_if_data *sdata = wk->sdata;
-        struct ieee80211_local *local = sdata->local;
-
-        if (!wk->probe_auth.synced) {
-                int ret = drv_tx_sync(local, sdata, wk->filter_ta,
-                                      IEEE80211_TX_SYNC_AUTH);
-                if (ret)
-                        return WORK_ACT_TIMEOUT;
-        }
-        wk->probe_auth.synced = true;
-
-        wk->probe_auth.tries++;
-        if (wk->probe_auth.tries > IEEE80211_AUTH_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: direct probe to %pM timed out\n",
-                       sdata->name, wk->filter_ta);
-
-                /*
-                 * Most likely AP is not in the range so remove the
-                 * bss struct for that AP.
-                 */
-                ieee80211_remove_auth_bss(local, wk);
-
-                return WORK_ACT_TIMEOUT;
-        }
-
-        printk(KERN_DEBUG "%s: direct probe to %pM (try %d/%i)\n",
-               sdata->name, wk->filter_ta, wk->probe_auth.tries,
-               IEEE80211_AUTH_MAX_TRIES);
-
-        /*
-         * Direct probe is sent to broadcast address as some APs
-         * will not answer to direct packet in unassociated state.
-         */
-        ieee80211_send_probe_req(sdata, NULL, wk->probe_auth.ssid,
-                                 wk->probe_auth.ssid_len, NULL, 0,
-                                 (u32) -1, true, false);
-
-        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
-        run_again(local, wk->timeout);
-
-        return WORK_ACT_NONE;
-}
-
-
-static enum work_action __must_check
-ieee80211_authenticate(struct ieee80211_work *wk)
-{
-        struct ieee80211_sub_if_data *sdata = wk->sdata;
-        struct ieee80211_local *local = sdata->local;
-
-        if (!wk->probe_auth.synced) {
-                int ret = drv_tx_sync(local, sdata, wk->filter_ta,
-                                      IEEE80211_TX_SYNC_AUTH);
-                if (ret)
-                        return WORK_ACT_TIMEOUT;
-        }
-        wk->probe_auth.synced = true;
-
-        wk->probe_auth.tries++;
-        if (wk->probe_auth.tries > IEEE80211_AUTH_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: authentication with %pM"
-                       " timed out\n", sdata->name, wk->filter_ta);
-
-                /*
-                 * Most likely AP is not in the range so remove the
-                 * bss struct for that AP.
-                 */
-                ieee80211_remove_auth_bss(local, wk);
-
-                return WORK_ACT_TIMEOUT;
-        }
-
-        printk(KERN_DEBUG "%s: authenticate with %pM (try %d)\n",
-               sdata->name, wk->filter_ta, wk->probe_auth.tries);
-
-        ieee80211_send_auth(sdata, 1, wk->probe_auth.algorithm, wk->ie,
-                            wk->ie_len, wk->filter_ta, NULL, 0, 0);
-        wk->probe_auth.transaction = 2;
-
-        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
-        run_again(local, wk->timeout);
-
-        return WORK_ACT_NONE;
-}
-
-static enum work_action __must_check
-ieee80211_associate(struct ieee80211_work *wk)
-{
-        struct ieee80211_sub_if_data *sdata = wk->sdata;
-        struct ieee80211_local *local = sdata->local;
-
-        if (!wk->assoc.synced) {
-                int ret = drv_tx_sync(local, sdata, wk->filter_ta,
-                                      IEEE80211_TX_SYNC_ASSOC);
-                if (ret)
-                        return WORK_ACT_TIMEOUT;
-        }
-        wk->assoc.synced = true;
-
-        wk->assoc.tries++;
-        if (wk->assoc.tries > IEEE80211_ASSOC_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: association with %pM"
-                       " timed out\n",
-                       sdata->name, wk->filter_ta);
-
-                /*
-                 * Most likely AP is not in the range so remove the
-                 * bss struct for that AP.
-                 */
-                if (wk->assoc.bss)
-                        cfg80211_unlink_bss(local->hw.wiphy, wk->assoc.bss);
-
-                return WORK_ACT_TIMEOUT;
-        }
-
-        printk(KERN_DEBUG "%s: associate with %pM (try %d)\n",
-               sdata->name, wk->filter_ta, wk->assoc.tries);
-        ieee80211_send_assoc(sdata, wk);
-
-        wk->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
-        run_again(local, wk->timeout);
-
-        return WORK_ACT_NONE;
-}
-
 static enum work_action __must_check
 ieee80211_remain_on_channel_timeout(struct ieee80211_work *wk)
 {
@@ -568,300 +103,6 @@ ieee80211_offchannel_tx(struct ieee80211_work *wk)
         return WORK_ACT_TIMEOUT;
 }
 
-static enum work_action __must_check
-ieee80211_assoc_beacon_wait(struct ieee80211_work *wk)
-{
-        if (wk->started)
-                return WORK_ACT_TIMEOUT;
-
-        /*
-         * Wait up to one beacon interval ...
-         * should this be more if we miss one?
-         */
-        printk(KERN_DEBUG "%s: waiting for beacon from %pM\n",
-               wk->sdata->name, wk->filter_ta);
-        wk->timeout = TU_TO_EXP_TIME(wk->assoc.bss->beacon_interval);
-        return WORK_ACT_NONE;
-}
-
-static void ieee80211_auth_challenge(struct ieee80211_work *wk,
-                                     struct ieee80211_mgmt *mgmt,
-                                     size_t len)
-{
-        struct ieee80211_sub_if_data *sdata = wk->sdata;
-        u8 *pos;
-        struct ieee802_11_elems elems;
-
-        pos = mgmt->u.auth.variable;
-        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
-        if (!elems.challenge)
-                return;
-        ieee80211_send_auth(sdata, 3, wk->probe_auth.algorithm,
-                            elems.challenge - 2, elems.challenge_len + 2,
-                            wk->filter_ta, wk->probe_auth.key,
-                            wk->probe_auth.key_len, wk->probe_auth.key_idx);
-        wk->probe_auth.transaction = 4;
-}
-
-static enum work_action __must_check
-ieee80211_rx_mgmt_auth(struct ieee80211_work *wk,
-                       struct ieee80211_mgmt *mgmt, size_t len)
-{
-        u16 auth_alg, auth_transaction, status_code;
-
-        if (wk->type != IEEE80211_WORK_AUTH)
-                return WORK_ACT_MISMATCH;
-
-        if (len < 24 + 6)
-                return WORK_ACT_NONE;
-
-        auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
-        auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
-        status_code = le16_to_cpu(mgmt->u.auth.status_code);
-
-        if (auth_alg != wk->probe_auth.algorithm ||
-            auth_transaction != wk->probe_auth.transaction)
-                return WORK_ACT_NONE;
-
-        if (status_code != WLAN_STATUS_SUCCESS) {
-                printk(KERN_DEBUG "%s: %pM denied authentication (status %d)\n",
-                       wk->sdata->name, mgmt->sa, status_code);
-                return WORK_ACT_DONE;
-        }
-
-        switch (wk->probe_auth.algorithm) {
-        case WLAN_AUTH_OPEN:
-        case WLAN_AUTH_LEAP:
-        case WLAN_AUTH_FT:
-                break;
-        case WLAN_AUTH_SHARED_KEY:
-                if (wk->probe_auth.transaction != 4) {
-                        ieee80211_auth_challenge(wk, mgmt, len);
-                        /* need another frame */
-                        return WORK_ACT_NONE;
-                }
-                break;
-        default:
-                WARN_ON(1);
-                return WORK_ACT_NONE;
-        }
-
-        printk(KERN_DEBUG "%s: authenticated\n", wk->sdata->name);
-        return WORK_ACT_DONE;
-}
-
-static enum work_action __must_check
-ieee80211_rx_mgmt_assoc_resp(struct ieee80211_work *wk,
-                             struct ieee80211_mgmt *mgmt, size_t len,
-                             bool reassoc)
-{
-        struct ieee80211_sub_if_data *sdata = wk->sdata;
-        struct ieee80211_local *local = sdata->local;
-        u16 capab_info, status_code, aid;
-        struct ieee802_11_elems elems;
-        u8 *pos;
-
-        if (wk->type != IEEE80211_WORK_ASSOC)
-                return WORK_ACT_MISMATCH;
-
-        /*
-         * AssocResp and ReassocResp have identical structure, so process both
-         * of them in this function.
-         */
-
-        if (len < 24 + 6)
-                return WORK_ACT_NONE;
-
-        capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
-        status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
-        aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
-
-        printk(KERN_DEBUG "%s: RX %sssocResp from %pM (capab=0x%x "
-               "status=%d aid=%d)\n",
-               sdata->name, reassoc ? "Rea" : "A", mgmt->sa,
-               capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
-
-        pos = mgmt->u.assoc_resp.variable;
-        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
-
-        if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
-            elems.timeout_int && elems.timeout_int_len == 5 &&
-            elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
-                u32 tu, ms;
-                tu = get_unaligned_le32(elems.timeout_int + 1);
-                ms = tu * 1024 / 1000;
-                printk(KERN_DEBUG "%s: %pM rejected association temporarily; "
-                       "comeback duration %u TU (%u ms)\n",
-                       sdata->name, mgmt->sa, tu, ms);
-                wk->timeout = jiffies + msecs_to_jiffies(ms);
-                if (ms > IEEE80211_ASSOC_TIMEOUT)
-                        run_again(local, wk->timeout);
-                return WORK_ACT_NONE;
-        }
-
-        if (status_code != WLAN_STATUS_SUCCESS)
-                printk(KERN_DEBUG "%s: %pM denied association (code=%d)\n",
-                       sdata->name, mgmt->sa, status_code);
-        else
-                printk(KERN_DEBUG "%s: associated\n", sdata->name);
-
-        return WORK_ACT_DONE;
-}
-
-static enum work_action __must_check
-ieee80211_rx_mgmt_probe_resp(struct ieee80211_work *wk,
-                             struct ieee80211_mgmt *mgmt, size_t len,
-                             struct ieee80211_rx_status *rx_status)
-{
-        struct ieee80211_sub_if_data *sdata = wk->sdata;
-        struct ieee80211_local *local = sdata->local;
-        size_t baselen;
-
-        ASSERT_WORK_MTX(local);
-
-        if (wk->type != IEEE80211_WORK_DIRECT_PROBE)
-                return WORK_ACT_MISMATCH;
-
-        if (len < 24 + 12)
-                return WORK_ACT_NONE;
-
-        baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
-        if (baselen > len)
-                return WORK_ACT_NONE;
-
-        printk(KERN_DEBUG "%s: direct probe responded\n", sdata->name);
-        return WORK_ACT_DONE;
-}
-
-static enum work_action __must_check
-ieee80211_rx_mgmt_beacon(struct ieee80211_work *wk,
-                         struct ieee80211_mgmt *mgmt, size_t len)
-{
-        struct ieee80211_sub_if_data *sdata = wk->sdata;
-        struct ieee80211_local *local = sdata->local;
-
-        ASSERT_WORK_MTX(local);
-
-        if (wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
-                return WORK_ACT_MISMATCH;
-
-        if (len < 24 + 12)
-                return WORK_ACT_NONE;
-
-        printk(KERN_DEBUG "%s: beacon received\n", sdata->name);
-        return WORK_ACT_DONE;
-}
-
-static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
-                                          struct sk_buff *skb)
-{
-        struct ieee80211_rx_status *rx_status;
-        struct ieee80211_mgmt *mgmt;
-        struct ieee80211_work *wk;
-        enum work_action rma = WORK_ACT_NONE;
-        u16 fc;
-
-        rx_status = (struct ieee80211_rx_status *) skb->cb;
-        mgmt = (struct ieee80211_mgmt *) skb->data;
-        fc = le16_to_cpu(mgmt->frame_control);
-
-        mutex_lock(&local->mtx);
-
-        list_for_each_entry(wk, &local->work_list, list) {
-                const u8 *bssid = NULL;
-
-                switch (wk->type) {
-                case IEEE80211_WORK_DIRECT_PROBE:
-                case IEEE80211_WORK_AUTH:
-                case IEEE80211_WORK_ASSOC:
-                case IEEE80211_WORK_ASSOC_BEACON_WAIT:
-                        bssid = wk->filter_ta;
-                        break;
-                default:
-                        continue;
-                }
-
-                /*
-                 * Before queuing, we already verified mgmt->sa,
-                 * so this is needed just for matching.
-                 */
-                if (compare_ether_addr(bssid, mgmt->bssid))
-                        continue;
-
-                switch (fc & IEEE80211_FCTL_STYPE) {
-                case IEEE80211_STYPE_BEACON:
-                        rma = ieee80211_rx_mgmt_beacon(wk, mgmt, skb->len);
-                        break;
-                case IEEE80211_STYPE_PROBE_RESP:
-                        rma = ieee80211_rx_mgmt_probe_resp(wk, mgmt, skb->len,
-                                                           rx_status);
-                        break;
-                case IEEE80211_STYPE_AUTH:
-                        rma = ieee80211_rx_mgmt_auth(wk, mgmt, skb->len);
-                        break;
-                case IEEE80211_STYPE_ASSOC_RESP:
-                        rma = ieee80211_rx_mgmt_assoc_resp(wk, mgmt,
-                                                           skb->len, false);
-                        break;
-                case IEEE80211_STYPE_REASSOC_RESP:
-                        rma = ieee80211_rx_mgmt_assoc_resp(wk, mgmt,
-                                                           skb->len, true);
-                        break;
-                default:
-                        WARN_ON(1);
-                        rma = WORK_ACT_NONE;
-                }
-
-                /*
-                 * We've either received an unexpected frame, or we have
-                 * multiple work items and need to match the frame to the
-                 * right one.
-                 */
-                if (rma == WORK_ACT_MISMATCH)
-                        continue;
-
-                /*
-                 * We've processed this frame for that work, so it can't
-                 * belong to another work struct.
-                 * NB: this is also required for correctness for 'rma'!
-                 */
-                break;
-        }
-
-        switch (rma) {
-        case WORK_ACT_MISMATCH:
-                /* ignore this unmatched frame */
-                break;
-        case WORK_ACT_NONE:
-                break;
-        case WORK_ACT_DONE:
-                list_del_rcu(&wk->list);
-                break;
-        default:
-                WARN(1, "unexpected: %d", rma);
-        }
-
-        mutex_unlock(&local->mtx);
-
-        if (rma != WORK_ACT_DONE)
-                goto out;
-
-        switch (wk->done(wk, skb)) {
-        case WORK_DONE_DESTROY:
-                free_work(wk);
-                break;
-        case WORK_DONE_REQUEUE:
-                synchronize_rcu();
-                wk->started = false; /* restart */
-                mutex_lock(&local->mtx);
-                list_add_tail(&wk->list, &local->work_list);
-                mutex_unlock(&local->mtx);
-        }
-
- out:
-        kfree_skb(skb);
-}
-
 static void ieee80211_work_timer(unsigned long data)
 {
         struct ieee80211_local *local = (void *) data;
@@ -876,15 +117,11 @@ static void ieee80211_work_work(struct work_struct *work)
 {
         struct ieee80211_local *local =
                 container_of(work, struct ieee80211_local, work_work);
-        struct sk_buff *skb;
         struct ieee80211_work *wk, *tmp;
         LIST_HEAD(free_work);
         enum work_action rma;
         bool remain_off_channel = false;
 
-        if (local->scanning)
-                return;
-
         /*
          * ieee80211_queue_work() should have picked up most cases,
          * here we'll pick the rest.
@@ -892,12 +129,13 @@ static void ieee80211_work_work(struct work_struct *work)
         if (WARN(local->suspended, "work scheduled while going to suspend\n"))
                 return;
 
-        /* first process frames to avoid timing out while a frame is pending */
-        while ((skb = skb_dequeue(&local->work_skb_queue)))
-                ieee80211_work_rx_queued_mgmt(local, skb);
-
         mutex_lock(&local->mtx);
 
+        if (local->scanning) {
+                mutex_unlock(&local->mtx);
+                return;
+        }
+
         ieee80211_recalc_idle(local);
 
         list_for_each_entry_safe(wk, tmp, &local->work_list, list) {
@@ -946,24 +184,12 @@ static void ieee80211_work_work(struct work_struct *work)
                 case IEEE80211_WORK_ABORT:
                         rma = WORK_ACT_TIMEOUT;
                         break;
-                case IEEE80211_WORK_DIRECT_PROBE:
-                        rma = ieee80211_direct_probe(wk);
-                        break;
-                case IEEE80211_WORK_AUTH:
-                        rma = ieee80211_authenticate(wk);
-                        break;
-                case IEEE80211_WORK_ASSOC:
-                        rma = ieee80211_associate(wk);
-                        break;
                 case IEEE80211_WORK_REMAIN_ON_CHANNEL:
                         rma = ieee80211_remain_on_channel_timeout(wk);
                         break;
                 case IEEE80211_WORK_OFFCHANNEL_TX:
                         rma = ieee80211_offchannel_tx(wk);
                         break;
-                case IEEE80211_WORK_ASSOC_BEACON_WAIT:
-                        rma = ieee80211_assoc_beacon_wait(wk);
-                        break;
                 }
 
                 wk->started = started;
@@ -1002,13 +228,8 @@ static void ieee80211_work_work(struct work_struct *work)
                 run_again(local, jiffies + HZ/2);
         }
 
-        if (list_empty(&local->work_list) && local->scan_req &&
-            !local->scanning)
-                ieee80211_queue_delayed_work(&local->hw,
-                                             &local->scan_work,
-                                             round_jiffies_relative(0));
-
         ieee80211_recalc_idle(local);
+        ieee80211_run_deferred_scan(local);
 
         mutex_unlock(&local->mtx);
 
@@ -1051,7 +272,6 @@ void ieee80211_work_init(struct ieee80211_local *local)
         setup_timer(&local->work_timer, ieee80211_work_timer,
                     (unsigned long)local);
         INIT_WORK(&local->work_work, ieee80211_work_work);
-        skb_queue_head_init(&local->work_skb_queue);
 }
 
 void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata)
@@ -1085,43 +305,6 @@ void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata)
         mutex_unlock(&local->mtx);
 }
 
-ieee80211_rx_result ieee80211_work_rx_mgmt(struct ieee80211_sub_if_data *sdata,
-                                           struct sk_buff *skb)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_mgmt *mgmt;
-        struct ieee80211_work *wk;
-        u16 fc;
-
-        if (skb->len < 24)
-                return RX_DROP_MONITOR;
-
-        mgmt = (struct ieee80211_mgmt *) skb->data;
-        fc = le16_to_cpu(mgmt->frame_control);
-
-        list_for_each_entry_rcu(wk, &local->work_list, list) {
-                if (sdata != wk->sdata)
-                        continue;
-                if (compare_ether_addr(wk->filter_ta, mgmt->sa))
-                        continue;
-                if (compare_ether_addr(wk->filter_ta, mgmt->bssid))
-                        continue;
-
-                switch (fc & IEEE80211_FCTL_STYPE) {
-                case IEEE80211_STYPE_AUTH:
-                case IEEE80211_STYPE_PROBE_RESP:
-                case IEEE80211_STYPE_ASSOC_RESP:
-                case IEEE80211_STYPE_REASSOC_RESP:
-                case IEEE80211_STYPE_BEACON:
-                        skb_queue_tail(&local->work_skb_queue, skb);
-                        ieee80211_queue_work(&local->hw, &local->work_work);
-                        return RX_QUEUED;
-                }
-        }
-
-        return RX_CONTINUE;
-}
-
 static enum work_done_result ieee80211_remain_done(struct ieee80211_work *wk,
                                                    struct sk_buff *skb)
 {
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index b758350919ff..bdb53aba888e 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -138,6 +138,10 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
         if (skb->len < hdrlen + MICHAEL_MIC_LEN)
                 return RX_DROP_UNUSABLE;
 
+        if (skb_linearize(rx->skb))
+                return RX_DROP_UNUSABLE;
+        hdr = (void *)skb->data;
+
         data = skb->data + hdrlen;
         data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
         key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
@@ -179,7 +183,8 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         u8 *pos;
 
         if (info->control.hw_key &&
-            !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
+            !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
+            !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
                 /* hwaccel - with no need for software-generated IV */
                 return 0;
         }
@@ -198,8 +203,14 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 
         pos = skb_push(skb, TKIP_IV_LEN);
         memmove(pos, pos + TKIP_IV_LEN, hdrlen);
+        skb_set_network_header(skb, skb_network_offset(skb) + TKIP_IV_LEN);
         pos += hdrlen;
 
+        /* the HW only needs room for the IV, but not the actual IV */
+        if (info->control.hw_key &&
+            (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
+                return 0;
+
         /* Increase IV for the frame */
         spin_lock_irqsave(&key->u.tkip.txlock, flags);
         key->u.tkip.tx.iv16++;
@@ -253,6 +264,11 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
         if (!rx->sta || skb->len - hdrlen < 12)
                 return RX_DROP_UNUSABLE;
 
+        /* it may be possible to optimize this a bit more */
+        if (skb_linearize(rx->skb))
+                return RX_DROP_UNUSABLE;
+        hdr = (void *)skb->data;
+
         /*
          * Let TKIP code verify IV, but skip decryption.
          * In the case where hardware checks the IV as well,
@@ -413,6 +429,7 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 
         pos = skb_push(skb, CCMP_HDR_LEN);
         memmove(pos, pos + CCMP_HDR_LEN, hdrlen);
+        skb_set_network_header(skb, skb_network_offset(skb) + CCMP_HDR_LEN);
 
         /* the HW only needs room for the IV, but not the actual IV */
         if (info->control.hw_key &&
@@ -484,6 +501,14 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
         if (!rx->sta || data_len < 0)
                 return RX_DROP_UNUSABLE;
 
+        if (status->flag & RX_FLAG_DECRYPTED) {
+                if (!pskb_may_pull(rx->skb, hdrlen + CCMP_HDR_LEN))
+                        return RX_DROP_UNUSABLE;
+        } else {
+                if (skb_linearize(rx->skb))
+                        return RX_DROP_UNUSABLE;
+        }
+
         ccmp_hdr2pn(pn, skb->data + hdrlen);
 
         queue = rx->security_idx;
@@ -509,7 +534,8 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
         memcpy(key->u.ccmp.rx_pn[queue], pn, CCMP_PN_LEN);
 
         /* Remove CCMP header and MIC */
-        skb_trim(skb, skb->len - CCMP_MIC_LEN);
+        if (pskb_trim(skb, skb->len - CCMP_MIC_LEN))
+                return RX_DROP_UNUSABLE;
         memmove(skb->data + CCMP_HDR_LEN, skb->data, hdrlen);
         skb_pull(skb, CCMP_HDR_LEN);
 
@@ -609,6 +635,8 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
         if (!ieee80211_is_mgmt(hdr->frame_control))
                 return RX_CONTINUE;
 
+        /* management frames are already linear */
+
         if (skb->len < 24 + sizeof(*mmie))
                 return RX_DROP_UNUSABLE;
 
diff --git a/net/mac802154/Kconfig b/net/mac802154/Kconfig
new file mode 100644
index 000000000000..a967ddaa4e2f
--- /dev/null
+++ b/net/mac802154/Kconfig
@@ -0,0 +1,16 @@
+config MAC802154
+        tristate "Generic IEEE 802.15.4 Soft Networking Stack (mac802154)"
+        depends on IEEE802154 && EXPERIMENTAL
+        select CRC_CCITT
+        ---help---
+          This option enables the hardware independent IEEE 802.15.4
+          networking stack for SoftMAC devices (the ones implementing
+          only PHY level of IEEE 802.15.4 standard).
+
+          Note: this implementation is neither certified, nor feature
+          complete! Compatibility with other implementations hasn't
+          been tested yet!
+
+          If you plan to use HardMAC IEEE 802.15.4 devices, you can
+          say N here. Alternatievly you can say M to compile it as
+          module.
diff --git a/net/mac802154/Makefile b/net/mac802154/Makefile
new file mode 100644
index 000000000000..ec1bd3fc1273
--- /dev/null
+++ b/net/mac802154/Makefile
@@ -0,0 +1,2 @@
+obj-$(CONFIG_MAC802154) += mac802154.o
+mac802154-objs          := ieee802154_dev.o rx.o tx.o mac_cmd.o mib.o monitor.o
diff --git a/net/mac802154/ieee802154_dev.c b/net/mac802154/ieee802154_dev.c
new file mode 100644
index 000000000000..e3edfb0661b0
--- /dev/null
+++ b/net/mac802154/ieee802154_dev.c
@@ -0,0 +1,294 @@
+/*
+ * Copyright (C) 2007-2012 Siemens AG
+ *
+ * Written by:
+ * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
+ *
+ * Based on the code from 'linux-zigbee.sourceforge.net' project.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+
+#include <net/netlink.h>
+#include <linux/nl802154.h>
+#include <net/mac802154.h>
+#include <net/route.h>
+#include <net/wpan-phy.h>
+
+#include "mac802154.h"
+
+int mac802154_slave_open(struct net_device *dev)
+{
+        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct mac802154_priv *ipriv = priv->hw;
+        int res = 0;
+
+        if (ipriv->open_count++ == 0) {
+                res = ipriv->ops->start(&ipriv->hw);
+                WARN_ON(res);
+                if (res)
+                        goto err;
+        }
+
+        if (ipriv->ops->ieee_addr) {
+                res = ipriv->ops->ieee_addr(&ipriv->hw, dev->dev_addr);
+                WARN_ON(res);
+                if (res)
+                        goto err;
+                mac802154_dev_set_ieee_addr(dev);
+        }
+
+        netif_start_queue(dev);
+        return 0;
+err:
+        priv->hw->open_count--;
+
+        return res;
+}
+
+int mac802154_slave_close(struct net_device *dev)
+{
+        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct mac802154_priv *ipriv = priv->hw;
+
+        netif_stop_queue(dev);
+
+        if (!--ipriv->open_count)
+                ipriv->ops->stop(&ipriv->hw);
+
+        return 0;
+}
+
+static int
+mac802154_netdev_register(struct wpan_phy *phy, struct net_device *dev)
+{
+        struct mac802154_sub_if_data *priv;
+        struct mac802154_priv *ipriv;
+        int err;
+
+        ipriv = wpan_phy_priv(phy);
+
+        priv = netdev_priv(dev);
+        priv->dev = dev;
+        priv->hw = ipriv;
+
+        dev->needed_headroom = ipriv->hw.extra_tx_headroom;
+
+        SET_NETDEV_DEV(dev, &ipriv->phy->dev);
+
+        mutex_lock(&ipriv->slaves_mtx);
+        if (!ipriv->running) {
+                mutex_unlock(&ipriv->slaves_mtx);
+                return -ENODEV;
+        }
+        mutex_unlock(&ipriv->slaves_mtx);
+
+        err = register_netdev(dev);
+        if (err < 0)
+                return err;
+
+        rtnl_lock();
+        mutex_lock(&ipriv->slaves_mtx);
+        list_add_tail_rcu(&priv->list, &ipriv->slaves);
+        mutex_unlock(&ipriv->slaves_mtx);
+        rtnl_unlock();
+
+        return 0;
+}
+
+static void
+mac802154_del_iface(struct wpan_phy *phy, struct net_device *dev)
+{
+        struct mac802154_sub_if_data *sdata;
+        ASSERT_RTNL();
+
+        sdata = netdev_priv(dev);
+
+        BUG_ON(sdata->hw->phy != phy);
+
+        mutex_lock(&sdata->hw->slaves_mtx);
+        list_del_rcu(&sdata->list);
+        mutex_unlock(&sdata->hw->slaves_mtx);
+
+        synchronize_rcu();
+        unregister_netdevice(sdata->dev);
+}
+
+static struct net_device *
+mac802154_add_iface(struct wpan_phy *phy, const char *name, int type)
+{
+        struct net_device *dev;
+        int err = -ENOMEM;
+
+        switch (type) {
+        case IEEE802154_DEV_MONITOR:
+                dev = alloc_netdev(sizeof(struct mac802154_sub_if_data),
+                                   name, mac802154_monitor_setup);
+                break;
+        default:
+                dev = NULL;
+                err = -EINVAL;
+                break;
+        }
+        if (!dev)
+                goto err;
+
+        err = mac802154_netdev_register(phy, dev);
+        if (err)
+                goto err_free;
+
+        dev_hold(dev); /* we return an incremented device refcount */
+        return dev;
+
+err_free:
+        free_netdev(dev);
+err:
+        return ERR_PTR(err);
+}
+
+struct ieee802154_dev *
+ieee802154_alloc_device(size_t priv_data_len, struct ieee802154_ops *ops)
+{
+        struct wpan_phy *phy;
+        struct mac802154_priv *priv;
+        size_t priv_size;
+
+        if (!ops || !ops->xmit || !ops->ed || !ops->start ||
+            !ops->stop || !ops->set_channel) {
+                printk(KERN_ERR
+                       "undefined IEEE802.15.4 device operations\n");
+                return NULL;
+        }
+
+        /* Ensure 32-byte alignment of our private data and hw private data.
+         * We use the wpan_phy priv data for both our mac802154_priv and for
+         * the driver's private data
+         *
+         * in memory it'll be like this:
+         *
+         * +-----------------------+
+         * | struct wpan_phy       |
+         * +-----------------------+
+         * | struct mac802154_priv |
+         * +-----------------------+
+         * | driver's private data |
+         * +-----------------------+
+         *
+         * Due to ieee802154 layer isn't aware of driver and MAC structures,
+         * so lets allign them here.
+         */
+
+        priv_size = ALIGN(sizeof(*priv), NETDEV_ALIGN) + priv_data_len;
+
+        phy = wpan_phy_alloc(priv_size);
+        if (!phy) {
+                printk(KERN_ERR
+                       "failure to allocate master IEEE802.15.4 device\n");
+                return NULL;
+        }
+
+        priv = wpan_phy_priv(phy);
+        priv->hw.phy = priv->phy = phy;
+        priv->hw.priv = (char *)priv + ALIGN(sizeof(*priv), NETDEV_ALIGN);
+        priv->ops = ops;
+
+        INIT_LIST_HEAD(&priv->slaves);
+        mutex_init(&priv->slaves_mtx);
+
+        return &priv->hw;
+}
+EXPORT_SYMBOL(ieee802154_alloc_device);
+
+void ieee802154_free_device(struct ieee802154_dev *hw)
+{
+        struct mac802154_priv *priv = mac802154_to_priv(hw);
+
+        BUG_ON(!list_empty(&priv->slaves));
+
+        wpan_phy_free(priv->phy);
+
+        mutex_destroy(&priv->slaves_mtx);
+}
+EXPORT_SYMBOL(ieee802154_free_device);
+
+int ieee802154_register_device(struct ieee802154_dev *dev)
+{
+        struct mac802154_priv *priv = mac802154_to_priv(dev);
+        int rc = -ENOMEM;
+
+        priv->dev_workqueue =
+                create_singlethread_workqueue(wpan_phy_name(priv->phy));
+        if (!priv->dev_workqueue)
+                goto out;
+
+        wpan_phy_set_dev(priv->phy, priv->hw.parent);
+
+        priv->phy->add_iface = mac802154_add_iface;
+        priv->phy->del_iface = mac802154_del_iface;
+
+        rc = wpan_phy_register(priv->phy);
+        if (rc < 0)
+                goto out_wq;
+
+        rtnl_lock();
+
+        mutex_lock(&priv->slaves_mtx);
+        priv->running = MAC802154_DEVICE_RUN;
+        mutex_unlock(&priv->slaves_mtx);
+
+        rtnl_unlock();
+
+        return 0;
+
+out_wq:
+        destroy_workqueue(priv->dev_workqueue);
+out:
+        return rc;
+}
+EXPORT_SYMBOL(ieee802154_register_device);
+
+void ieee802154_unregister_device(struct ieee802154_dev *dev)
+{
+        struct mac802154_priv *priv = mac802154_to_priv(dev);
+        struct mac802154_sub_if_data *sdata, *next;
+
+        flush_workqueue(priv->dev_workqueue);
+        destroy_workqueue(priv->dev_workqueue);
+
+        rtnl_lock();
+
+        mutex_lock(&priv->slaves_mtx);
+        priv->running = MAC802154_DEVICE_STOPPED;
+        mutex_unlock(&priv->slaves_mtx);
+
+        list_for_each_entry_safe(sdata, next, &priv->slaves, list) {
+                mutex_lock(&sdata->hw->slaves_mtx);
+                list_del(&sdata->list);
+                mutex_unlock(&sdata->hw->slaves_mtx);
+
+                unregister_netdevice(sdata->dev);
+        }
+
+        rtnl_unlock();
+
+        wpan_phy_unregister(priv->phy);
+}
+EXPORT_SYMBOL(ieee802154_unregister_device);
+
+MODULE_DESCRIPTION("IEEE 802.15.4 implementation");
+MODULE_LICENSE("GPL v2");
diff --git a/net/mac802154/mac802154.h b/net/mac802154/mac802154.h
new file mode 100644
index 000000000000..789d9c948aec
--- /dev/null
+++ b/net/mac802154/mac802154.h
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2007-2012 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Pavel Smolenskiy <pavel.smolenskiy@gmail.com>
+ * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
+ */
+#ifndef MAC802154_H
+#define MAC802154_H
+
+/* mac802154 device private data */
+struct mac802154_priv {
+        struct ieee802154_dev hw;
+        struct ieee802154_ops *ops;
+
+        /* ieee802154 phy */
+        struct wpan_phy *phy;
+
+        int open_count;
+
+        /* As in mac80211 slaves list is modified:
+         * 1) under the RTNL
+         * 2) protected by slaves_mtx;
+         * 3) in an RCU manner
+         *
+         * So atomic readers can use any of this protection methods.
+         */
+        struct list_head        slaves;
+        struct mutex            slaves_mtx;
+
+        /* This one is used for scanning and other jobs not to be interfered
+         * with serial driver.
+         */
+        struct workqueue_struct *dev_workqueue;
+
+        /* SoftMAC device is registered and running. One can add subinterfaces.
+         * This flag should be modified under slaves_mtx and RTNL, so you can
+         * read them using any of protection methods.
+         */
+        bool running;
+};
+
+#define MAC802154_DEVICE_STOPPED        0x00
+#define MAC802154_DEVICE_RUN            0x01
+
+/* Slave interface definition.
+ *
+ * Slaves represent typical network interfaces available from userspace.
+ * Each ieee802154 device/transceiver may have several slaves and able
+ * to be associated with several networks at the same time.
+ */
+struct mac802154_sub_if_data {
+        struct list_head list; /* the ieee802154_priv->slaves list */
+
+        struct mac802154_priv *hw;
+        struct net_device *dev;
+
+        int type;
+
+        spinlock_t mib_lock;
+
+        __le16 pan_id;
+        __le16 short_addr;
+
+        u8 chan;
+        u8 page;
+
+        /* MAC BSN field */
+        u8 bsn;
+        /* MAC DSN field */
+        u8 dsn;
+};
+
+#define mac802154_to_priv(_hw)  container_of(_hw, struct mac802154_priv, hw)
+
+#define MAC802154_MAX_XMIT_ATTEMPTS     3
+
+#define MAC802154_CHAN_NONE             (~(u8)0) /* No channel is assigned */
+
+extern struct ieee802154_reduced_mlme_ops mac802154_mlme_reduced;
+
+int mac802154_slave_open(struct net_device *dev);
+int mac802154_slave_close(struct net_device *dev);
+
+void mac802154_monitors_rx(struct mac802154_priv *priv, struct sk_buff *skb);
+void mac802154_monitor_setup(struct net_device *dev);
+
+netdev_tx_t mac802154_tx(struct mac802154_priv *priv, struct sk_buff *skb,
+                         u8 page, u8 chan);
+
+/* MIB callbacks */
+void mac802154_dev_set_ieee_addr(struct net_device *dev);
+
+#endif /* MAC802154_H */
diff --git a/net/mac802154/mac_cmd.c b/net/mac802154/mac_cmd.c
new file mode 100644
index 000000000000..7a5d0e052cd7
--- /dev/null
+++ b/net/mac802154/mac_cmd.c
@@ -0,0 +1,45 @@
+/*
+ * MAC commands interface
+ *
+ * Copyright 2007-2012 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Sergey Lapin <slapin@ossfans.org>
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
+ */
+
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+
+#include <net/ieee802154_netdev.h>
+#include <net/wpan-phy.h>
+#include <net/mac802154.h>
+
+#include "mac802154.h"
+
+struct wpan_phy *mac802154_get_phy(const struct net_device *dev)
+{
+        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+
+        BUG_ON(dev->type != ARPHRD_IEEE802154);
+
+        return to_phy(get_device(&priv->hw->phy->dev));
+}
+
+struct ieee802154_reduced_mlme_ops mac802154_mlme_reduced = {
+        .get_phy = mac802154_get_phy,
+};
diff --git a/net/mac802154/mib.c b/net/mac802154/mib.c
new file mode 100644
index 000000000000..ab59821ec729
--- /dev/null
+++ b/net/mac802154/mib.c
@@ -0,0 +1,93 @@
+/*
+ * Copyright 2007-2012 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ * Sergey Lapin <slapin@ossfans.org>
+ * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
+ * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
+ */
+
+#include <linux/if_arp.h>
+
+#include <net/mac802154.h>
+#include <net/wpan-phy.h>
+
+#include "mac802154.h"
+
+struct hw_addr_filt_notify_work {
+        struct work_struct work;
+        struct net_device *dev;
+        unsigned long changed;
+};
+
+struct mac802154_priv *mac802154_slave_get_priv(struct net_device *dev)
+{
+        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+
+        BUG_ON(dev->type != ARPHRD_IEEE802154);
+
+        return priv->hw;
+}
+
+static void hw_addr_notify(struct work_struct *work)
+{
+        struct hw_addr_filt_notify_work *nw = container_of(work,
+                        struct hw_addr_filt_notify_work, work);
+        struct mac802154_priv *hw = mac802154_slave_get_priv(nw->dev);
+        int res;
+
+        res = hw->ops->set_hw_addr_filt(&hw->hw,
+                                        &hw->hw.hw_filt,
+                                        nw->changed);
+        if (res)
+                pr_debug("failed changed mask %lx\n", nw->changed);
+
+        kfree(nw);
+
+        return;
+}
+
+static void set_hw_addr_filt(struct net_device *dev, unsigned long changed)
+{
+        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct hw_addr_filt_notify_work *work;
+
+        work = kzalloc(sizeof(*work), GFP_ATOMIC);
+        if (!work)
+                return;
+
+        INIT_WORK(&work->work, hw_addr_notify);
+        work->dev = dev;
+        work->changed = changed;
+        queue_work(priv->hw->dev_workqueue, &work->work);
+
+        return;
+}
+
+void mac802154_dev_set_ieee_addr(struct net_device *dev)
+{
+        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct mac802154_priv *mac = priv->hw;
+
+        if (mac->ops->set_hw_addr_filt &&
+            memcmp(mac->hw.hw_filt.ieee_addr,
+                   dev->dev_addr, IEEE802154_ADDR_LEN)) {
+                memcpy(mac->hw.hw_filt.ieee_addr,
+                       dev->dev_addr, IEEE802154_ADDR_LEN);
+                set_hw_addr_filt(dev, IEEE802515_AFILT_IEEEADDR_CHANGED);
+        }
+}
diff --git a/net/mac802154/monitor.c b/net/mac802154/monitor.c
new file mode 100644
index 000000000000..434a26f76a80
--- /dev/null
+++ b/net/mac802154/monitor.c
@@ -0,0 +1,116 @@
+/*
+ * Copyright 2007, 2008, 2009 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ * Sergey Lapin <slapin@ossfans.org>
+ * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
+ * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
+ */
+
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+#include <linux/crc-ccitt.h>
+
+#include <net/ieee802154.h>
+#include <net/mac802154.h>
+#include <net/netlink.h>
+#include <net/wpan-phy.h>
+#include <linux/nl802154.h>
+
+#include "mac802154.h"
+
+static netdev_tx_t mac802154_monitor_xmit(struct sk_buff *skb,
+                                          struct net_device *dev)
+{
+        struct mac802154_sub_if_data *priv;
+        u8 chan, page;
+
+        priv = netdev_priv(dev);
+
+        /* FIXME: locking */
+        chan = priv->hw->phy->current_channel;
+        page = priv->hw->phy->current_page;
+
+        if (chan == MAC802154_CHAN_NONE) /* not initialized */
+                return NETDEV_TX_OK;
+
+        if (WARN_ON(page >= WPAN_NUM_PAGES) ||
+            WARN_ON(chan >= WPAN_NUM_CHANNELS))
+                return NETDEV_TX_OK;
+
+        skb->skb_iif = dev->ifindex;
+        dev->stats.tx_packets++;
+        dev->stats.tx_bytes += skb->len;
+
+        return mac802154_tx(priv->hw, skb, page, chan);
+}
+
+
+void mac802154_monitors_rx(struct mac802154_priv *priv, struct sk_buff *skb)
+{
+        struct sk_buff *skb2;
+        struct mac802154_sub_if_data *sdata;
+        u16 crc = crc_ccitt(0, skb->data, skb->len);
+        u8 *data;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &priv->slaves, list) {
+                if (sdata->type != IEEE802154_DEV_MONITOR)
+                        continue;
+
+                skb2 = skb_clone(skb, GFP_ATOMIC);
+                skb2->dev = sdata->dev;
+                skb2->pkt_type = PACKET_HOST;
+                data = skb_put(skb2, 2);
+                data[0] = crc & 0xff;
+                data[1] = crc >> 8;
+
+                netif_rx_ni(skb2);
+        }
+        rcu_read_unlock();
+}
+
+static const struct net_device_ops mac802154_monitor_ops = {
+        .ndo_open               = mac802154_slave_open,
+        .ndo_stop               = mac802154_slave_close,
+        .ndo_start_xmit         = mac802154_monitor_xmit,
+};
+
+void mac802154_monitor_setup(struct net_device *dev)
+{
+        struct mac802154_sub_if_data *priv;
+
+        dev->addr_len           = 0;
+        dev->hard_header_len    = 0;
+        dev->needed_tailroom    = 2; /* room for FCS */
+        dev->mtu                = IEEE802154_MTU;
+        dev->tx_queue_len       = 10;
+        dev->type               = ARPHRD_IEEE802154_MONITOR;
+        dev->flags              = IFF_NOARP | IFF_BROADCAST;
+        dev->watchdog_timeo     = 0;
+
+        dev->destructor         = free_netdev;
+        dev->netdev_ops         = &mac802154_monitor_ops;
+        dev->ml_priv            = &mac802154_mlme_reduced;
+
+        priv = netdev_priv(dev);
+        priv->type = IEEE802154_DEV_MONITOR;
+
+        priv->chan = MAC802154_CHAN_NONE; /* not initialized */
+        priv->page = 0;
+}
diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
new file mode 100644
index 000000000000..4a7d76d4f8bc
--- /dev/null
+++ b/net/mac802154/rx.c
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2007-2012 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Pavel Smolenskiy <pavel.smolenskiy@gmail.com>
+ * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/workqueue.h>
+#include <linux/netdevice.h>
+#include <linux/crc-ccitt.h>
+
+#include <net/mac802154.h>
+#include <net/ieee802154_netdev.h>
+
+#include "mac802154.h"
+
+/* The IEEE 802.15.4 standard defines 4 MAC packet types:
+ * - beacon frame
+ * - MAC command frame
+ * - acknowledgement frame
+ * - data frame
+ *
+ * and only the data frame should be pushed to the upper layers, other types
+ * are just internal MAC layer management information. So only data packets
+ * are going to be sent to the networking queue, all other will be processed
+ * right here by using the device workqueue.
+ */
+struct rx_work {
+        struct sk_buff *skb;
+        struct work_struct work;
+        struct ieee802154_dev *dev;
+        u8 lqi;
+};
+
+static void
+mac802154_subif_rx(struct ieee802154_dev *hw, struct sk_buff *skb, u8 lqi)
+{
+        struct mac802154_priv *priv = mac802154_to_priv(hw);
+
+        mac_cb(skb)->lqi = lqi;
+        skb->protocol = htons(ETH_P_IEEE802154);
+        skb_reset_mac_header(skb);
+
+        BUILD_BUG_ON(sizeof(struct ieee802154_mac_cb) > sizeof(skb->cb));
+
+        if (!(priv->hw.flags & IEEE802154_HW_OMIT_CKSUM)) {
+                u16 crc;
+
+                if (skb->len < 2) {
+                        pr_debug("got invalid frame\n");
+                        goto out;
+                }
+                crc = crc_ccitt(0, skb->data, skb->len);
+                if (crc) {
+                        pr_debug("CRC mismatch\n");
+                        goto out;
+                }
+                skb_trim(skb, skb->len - 2); /* CRC */
+        }
+
+        mac802154_monitors_rx(priv, skb);
+out:
+        dev_kfree_skb(skb);
+        return;
+}
+
+static void mac802154_rx_worker(struct work_struct *work)
+{
+        struct rx_work *rw = container_of(work, struct rx_work, work);
+        struct sk_buff *skb = rw->skb;
+
+        mac802154_subif_rx(rw->dev, skb, rw->lqi);
+        kfree(rw);
+}
+
+void
+ieee802154_rx_irqsafe(struct ieee802154_dev *dev, struct sk_buff *skb, u8 lqi)
+{
+        struct mac802154_priv *priv = mac802154_to_priv(dev);
+        struct rx_work *work;
+
+        if (!skb)
+                return;
+
+        work = kzalloc(sizeof(struct rx_work), GFP_ATOMIC);
+        if (!work)
+                return;
+
+        INIT_WORK(&work->work, mac802154_rx_worker);
+        work->skb = skb;
+        work->dev = dev;
+        work->lqi = lqi;
+
+        queue_work(priv->dev_workqueue, &work->work);
+}
+EXPORT_SYMBOL(ieee802154_rx_irqsafe);
diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c
new file mode 100644
index 000000000000..8781d8f904d9
--- /dev/null
+++ b/net/mac802154/tx.c
@@ -0,0 +1,116 @@
+/*
+ * Copyright 2007-2012 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ * Sergey Lapin <slapin@ossfans.org>
+ * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
+ * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
+ */
+
+#include <linux/netdevice.h>
+#include <linux/if_arp.h>
+#include <linux/crc-ccitt.h>
+
+#include <net/mac802154.h>
+#include <net/wpan-phy.h>
+
+#include "mac802154.h"
+
+/* IEEE 802.15.4 transceivers can sleep during the xmit session, so process
+ * packets through the workqueue.
+ */
+struct xmit_work {
+        struct sk_buff *skb;
+        struct work_struct work;
+        struct mac802154_priv *priv;
+        u8 chan;
+        u8 page;
+        u8 xmit_attempts;
+};
+
+static void mac802154_xmit_worker(struct work_struct *work)
+{
+        struct xmit_work *xw = container_of(work, struct xmit_work, work);
+        int res;
+
+        mutex_lock(&xw->priv->phy->pib_lock);
+        if (xw->priv->phy->current_channel != xw->chan ||
+            xw->priv->phy->current_page != xw->page) {
+                res = xw->priv->ops->set_channel(&xw->priv->hw,
+                                                  xw->page,
+                                                  xw->chan);
+                if (res) {
+                        pr_debug("set_channel failed\n");
+                        goto out;
+                }
+        }
+
+        res = xw->priv->ops->xmit(&xw->priv->hw, xw->skb);
+
+out:
+        mutex_unlock(&xw->priv->phy->pib_lock);
+
+        if (res) {
+                if (xw->xmit_attempts++ < MAC802154_MAX_XMIT_ATTEMPTS) {
+                        queue_work(xw->priv->dev_workqueue, &xw->work);
+                        return;
+                } else
+                        pr_debug("transmission failed for %d times",
+                                 MAC802154_MAX_XMIT_ATTEMPTS);
+        }
+
+        dev_kfree_skb(xw->skb);
+
+        kfree(xw);
+}
+
+netdev_tx_t mac802154_tx(struct mac802154_priv *priv, struct sk_buff *skb,
+                         u8 page, u8 chan)
+{
+        struct xmit_work *work;
+
+        if (!(priv->phy->channels_supported[page] & (1 << chan)))
+                WARN_ON(1);
+                return NETDEV_TX_OK;
+
+        if (!(priv->hw.flags & IEEE802154_HW_OMIT_CKSUM)) {
+                u16 crc = crc_ccitt(0, skb->data, skb->len);
+                u8 *data = skb_put(skb, 2);
+                data[0] = crc & 0xff;
+                data[1] = crc >> 8;
+        }
+
+        if (skb_cow_head(skb, priv->hw.extra_tx_headroom)) {
+                dev_kfree_skb(skb);
+                return NETDEV_TX_OK;
+        }
+
+        work = kzalloc(sizeof(struct xmit_work), GFP_ATOMIC);
+        if (!work)
+                return NETDEV_TX_BUSY;
+
+        INIT_WORK(&work->work, mac802154_xmit_worker);
+        work->skb = skb;
+        work->priv = priv;
+        work->page = page;
+        work->chan = chan;
+        work->xmit_attempts = 0;
+
+        queue_work(priv->dev_workqueue, &work->work);
+
+        return NETDEV_TX_OK;
+}
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index f8ac4ef0b794..209c1ed43368 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -103,6 +103,16 @@ config NF_CONNTRACK_EVENTS
 
           If unsure, say `N'.
 
+config NF_CONNTRACK_TIMEOUT
+        bool  'Connection tracking timeout'
+        depends on NETFILTER_ADVANCED
+        help
+          This option enables support for connection tracking timeout
+          extension. This allows you to attach timeout policies to flow
+          via the CT target.
+
+          If unsure, say `N'.
+
 config NF_CONNTRACK_TIMESTAMP
         bool  'Connection tracking timestamping'
         depends on NETFILTER_ADVANCED
@@ -314,6 +324,17 @@ config NF_CT_NETLINK
         help
           This option enables support for a netlink-based userspace interface
 
+config NF_CT_NETLINK_TIMEOUT
+        tristate  'Connection tracking timeout tuning via Netlink'
+        select NETFILTER_NETLINK
+        depends on NETFILTER_ADVANCED
+        help
+          This option enables support for connection tracking timeout
+          fine-grain tuning. This allows you to attach specific timeout
+          policies to flows, instead of using the global timeout policy.
+
+          If unsure, say `N'.
+
 endif # NF_CONNTRACK
 
 # transparent proxy support
@@ -488,6 +509,21 @@ config NETFILTER_XT_TARGET_HL
         since you can easily create immortal packets that loop
         forever on the network.
 
+config NETFILTER_XT_TARGET_HMARK
+        tristate '"HMARK" target support'
+        depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
+        depends on NETFILTER_ADVANCED
+        ---help---
+        This option adds the "HMARK" target.
+
+        The target allows you to create rules in the "raw" and "mangle" tables
+        which set the skbuff mark by means of hash calculation within a given
+        range. The nfmark can influence the routing method (see "Use netfilter
+        MARK value as routing key") and can also be used by other subsystems to
+        change their behaviour.
+
+        To compile it as a module, choose M here. If unsure, say N.
+
 config NETFILTER_XT_TARGET_IDLETIMER
         tristate  "IDLETIMER target support"
         depends on NETFILTER_ADVANCED
@@ -524,6 +560,15 @@ config NETFILTER_XT_TARGET_LED
           For more information on the LEDs available on your system, see
           Documentation/leds/leds-class.txt
 
+config NETFILTER_XT_TARGET_LOG
+        tristate "LOG target support"
+        default m if NETFILTER_ADVANCED=n
+        help
+          This option adds a `LOG' target, which allows you to create rules in
+          any iptables table which records the packet header to the syslog.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config NETFILTER_XT_TARGET_MARK
         tristate '"MARK" target support'
         depends on NETFILTER_ADVANCED
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 40f4c3d636c5..4e7960cc7b97 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -1,6 +1,7 @@
 netfilter-objs := core.o nf_log.o nf_queue.o nf_sockopt.o
 
 nf_conntrack-y  := nf_conntrack_core.o nf_conntrack_standalone.o nf_conntrack_expect.o nf_conntrack_helper.o nf_conntrack_proto.o nf_conntrack_l3proto_generic.o nf_conntrack_proto_generic.o nf_conntrack_proto_tcp.o nf_conntrack_proto_udp.o nf_conntrack_extend.o nf_conntrack_acct.o
+nf_conntrack-$(CONFIG_NF_CONNTRACK_TIMEOUT) += nf_conntrack_timeout.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_TIMESTAMP) += nf_conntrack_timestamp.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_EVENTS) += nf_conntrack_ecache.o
 
@@ -22,6 +23,7 @@ obj-$(CONFIG_NF_CT_PROTO_UDPLITE) += nf_conntrack_proto_udplite.o
 
 # netlink interface for nf_conntrack
 obj-$(CONFIG_NF_CT_NETLINK) += nf_conntrack_netlink.o
+obj-$(CONFIG_NF_CT_NETLINK_TIMEOUT) += nfnetlink_cttimeout.o
 
 # connection tracking helpers
 nf_conntrack_h323-objs := nf_conntrack_h323_main.o nf_conntrack_h323_asn1.o
@@ -57,7 +59,9 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_CT) += xt_CT.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_DSCP) += xt_DSCP.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_HL) += xt_HL.o
+obj-$(CONFIG_NETFILTER_XT_TARGET_HMARK) += xt_HMARK.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
+obj-$(CONFIG_NETFILTER_XT_TARGET_LOG) += xt_LOG.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_NFLOG) += xt_NFLOG.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_NFQUEUE) += xt_NFQUEUE.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_NOTRACK) += xt_NOTRACK.o
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index b4e8ff05b301..e19f3653db23 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -56,7 +56,7 @@ struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS] __read_mostly;
 EXPORT_SYMBOL(nf_hooks);
 
 #if defined(CONFIG_JUMP_LABEL)
-struct jump_label_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
+struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
 EXPORT_SYMBOL(nf_hooks_needed);
 #endif
 
@@ -77,7 +77,7 @@ int nf_register_hook(struct nf_hook_ops *reg)
         list_add_rcu(&reg->list, elem->list.prev);
         mutex_unlock(&nf_hook_mutex);
 #if defined(CONFIG_JUMP_LABEL)
-        jump_label_inc(&nf_hooks_needed[reg->pf][reg->hooknum]);
+        static_key_slow_inc(&nf_hooks_needed[reg->pf][reg->hooknum]);
 #endif
         return 0;
 }
@@ -89,7 +89,7 @@ void nf_unregister_hook(struct nf_hook_ops *reg)
         list_del_rcu(&reg->list);
         mutex_unlock(&nf_hook_mutex);
 #if defined(CONFIG_JUMP_LABEL)
-        jump_label_dec(&nf_hooks_needed[reg->pf][reg->hooknum]);
+        static_key_slow_dec(&nf_hooks_needed[reg->pf][reg->hooknum]);
 #endif
         synchronize_net();
 }
@@ -290,12 +290,3 @@ void __init netfilter_init(void)
         if (netfilter_log_init() < 0)
                 panic("cannot initialize nf_log");
 }
-
-#ifdef CONFIG_SYSCTL
-struct ctl_path nf_net_netfilter_sysctl_path[] = {
-        { .procname = "net", },
-        { .procname = "netfilter", },
-        { }
-};
-EXPORT_SYMBOL_GPL(nf_net_netfilter_sysctl_path);
-#endif /* CONFIG_SYSCTL */
diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
index e3e73997c3be..7e1b061aeeba 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -109,8 +109,9 @@ bitmap_ip_list(const struct ip_set *set,
                         } else
                                 goto nla_put_failure;
                 }
-                NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP,
-                                htonl(map->first_ip + id * map->hosts));
+                if (nla_put_ipaddr4(skb, IPSET_ATTR_IP,
+                                    htonl(map->first_ip + id * map->hosts)))
+                        goto nla_put_failure;
                 ipset_nest_end(skb, nested);
         }
         ipset_nest_end(skb, atd);
@@ -194,10 +195,11 @@ bitmap_ip_tlist(const struct ip_set *set,
                         } else
                                 goto nla_put_failure;
                 }
-                NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP,
-                                htonl(map->first_ip + id * map->hosts));
-                NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                              htonl(ip_set_timeout_get(members[id])));
+                if (nla_put_ipaddr4(skb, IPSET_ATTR_IP,
+                                    htonl(map->first_ip + id * map->hosts)) ||
+                    nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
+                                  htonl(ip_set_timeout_get(members[id]))))
+                        goto nla_put_failure;
                 ipset_nest_end(skb, nested);
         }
         ipset_nest_end(skb, adt);
@@ -334,15 +336,16 @@ bitmap_ip_head(struct ip_set *set, struct sk_buff *skb)
         nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
         if (!nested)
                 goto nla_put_failure;
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, htonl(map->first_ip));
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip));
-        if (map->netmask != 32)
-                NLA_PUT_U8(skb, IPSET_ATTR_NETMASK, map->netmask);
-        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
-        NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
-                      htonl(sizeof(*map) + map->memsize));
-        if (with_timeout(map->timeout))
-                NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout));
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, htonl(map->first_ip)) ||
+            nla_put_ipaddr4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip)) ||
+            (map->netmask != 32 &&
+             nla_put_u8(skb, IPSET_ATTR_NETMASK, map->netmask)) ||
+            nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1)) ||
+            nla_put_net32(skb, IPSET_ATTR_MEMSIZE,
+                          htonl(sizeof(*map) + map->memsize)) ||
+            (with_timeout(map->timeout) &&
+             nla_put_net32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout))))
+                goto nla_put_failure;
         ipset_nest_end(skb, nested);
 
         return 0;
@@ -442,7 +445,7 @@ init_map_ip(struct ip_set *set, struct bitmap_ip *map,
         map->timeout = IPSET_NO_TIMEOUT;
 
         set->data = map;
-        set->family = AF_INET;
+        set->family = NFPROTO_IPV4;
 
         return true;
 }
@@ -550,7 +553,7 @@ static struct ip_set_type bitmap_ip_type __read_mostly = {
         .protocol       = IPSET_PROTOCOL,
         .features       = IPSET_TYPE_IP,
         .dimension      = IPSET_DIM_ONE,
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
         .revision_min   = 0,
         .revision_max   = 0,
         .create         = bitmap_ip_create,
diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index 56096f544978..d7eaf10edb6d 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -111,7 +111,7 @@ bitmap_ipmac_test(struct ip_set *set, void *value, u32 timeout, u32 flags)
                 return -EAGAIN;
         case MAC_FILLED:
                 return data->ether == NULL ||
-                       compare_ether_addr(data->ether, elem->ether) == 0;
+                       ether_addr_equal(data->ether, elem->ether);
         }
         return 0;
 }
@@ -186,11 +186,12 @@ bitmap_ipmac_list(const struct ip_set *set,
                         } else
                                 goto nla_put_failure;
                 }
-                NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP,
-                                htonl(map->first_ip + id));
-                if (elem->match == MAC_FILLED)
-                        NLA_PUT(skb, IPSET_ATTR_ETHER, ETH_ALEN,
-                                elem->ether);
+                if (nla_put_ipaddr4(skb, IPSET_ATTR_IP,
+                                    htonl(map->first_ip + id)) ||
+                    (elem->match == MAC_FILLED &&
+                     nla_put(skb, IPSET_ATTR_ETHER, ETH_ALEN,
+                             elem->ether)))
+                        goto nla_put_failure;
                 ipset_nest_end(skb, nested);
         }
         ipset_nest_end(skb, atd);
@@ -224,7 +225,7 @@ bitmap_ipmac_ttest(struct ip_set *set, void *value, u32 timeout, u32 flags)
                 return -EAGAIN;
         case MAC_FILLED:
                 return (data->ether == NULL ||
-                        compare_ether_addr(data->ether, elem->ether) == 0) &&
+                        ether_addr_equal(data->ether, elem->ether)) &&
                        !bitmap_expired(map, data->id);
         }
         return 0;
@@ -314,14 +315,16 @@ bitmap_ipmac_tlist(const struct ip_set *set,
                         } else
                                 goto nla_put_failure;
                 }
-                NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP,
-                                htonl(map->first_ip + id));
-                if (elem->match == MAC_FILLED)
-                        NLA_PUT(skb, IPSET_ATTR_ETHER, ETH_ALEN,
-                                elem->ether);
+                if (nla_put_ipaddr4(skb, IPSET_ATTR_IP,
+                                    htonl(map->first_ip + id)) ||
+                    (elem->match == MAC_FILLED &&
+                     nla_put(skb, IPSET_ATTR_ETHER, ETH_ALEN,
+                             elem->ether)))
+                    goto nla_put_failure;
                 timeout = elem->match == MAC_UNSET ? elem->timeout
                                 : ip_set_timeout_get(elem->timeout);
-                NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(timeout));
+                if (nla_put_net32(skb, IPSET_ATTR_TIMEOUT, htonl(timeout)))
+                    goto nla_put_failure;
                 ipset_nest_end(skb, nested);
         }
         ipset_nest_end(skb, atd);
@@ -438,14 +441,16 @@ bitmap_ipmac_head(struct ip_set *set, struct sk_buff *skb)
         nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
         if (!nested)
                 goto nla_put_failure;
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, htonl(map->first_ip));
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip));
-        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
-        NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
-                      htonl(sizeof(*map)
-                            + (map->last_ip - map->first_ip + 1) * map->dsize));
-        if (with_timeout(map->timeout))
-                NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout));
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, htonl(map->first_ip)) ||
+            nla_put_ipaddr4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip)) ||
+            nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1)) ||
+            nla_put_net32(skb, IPSET_ATTR_MEMSIZE,
+                          htonl(sizeof(*map) +
+                                ((map->last_ip - map->first_ip + 1) *
+                                 map->dsize))) ||
+            (with_timeout(map->timeout) &&
+             nla_put_net32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout))))
+                goto nla_put_failure;
         ipset_nest_end(skb, nested);
 
         return 0;
@@ -543,7 +548,7 @@ init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map,
         map->timeout = IPSET_NO_TIMEOUT;
 
         set->data = map;
-        set->family = AF_INET;
+        set->family = NFPROTO_IPV4;
 
         return true;
 }
@@ -623,7 +628,7 @@ static struct ip_set_type bitmap_ipmac_type = {
         .protocol       = IPSET_PROTOCOL,
         .features       = IPSET_TYPE_IP | IPSET_TYPE_MAC,
         .dimension      = IPSET_DIM_TWO,
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
         .revision_min   = 0,
         .revision_max   = 0,
         .create         = bitmap_ipmac_create,
diff --git a/net/netfilter/ipset/ip_set_bitmap_port.c b/net/netfilter/ipset/ip_set_bitmap_port.c
index 29ba93bb94be..b9f1fce7053b 100644
--- a/net/netfilter/ipset/ip_set_bitmap_port.c
+++ b/net/netfilter/ipset/ip_set_bitmap_port.c
@@ -96,8 +96,9 @@ bitmap_port_list(const struct ip_set *set,
                         } else
                                 goto nla_put_failure;
                 }
-                NLA_PUT_NET16(skb, IPSET_ATTR_PORT,
-                              htons(map->first_port + id));
+                if (nla_put_net16(skb, IPSET_ATTR_PORT,
+                                  htons(map->first_port + id)))
+                        goto nla_put_failure;
                 ipset_nest_end(skb, nested);
         }
         ipset_nest_end(skb, atd);
@@ -183,10 +184,11 @@ bitmap_port_tlist(const struct ip_set *set,
                         } else
                                 goto nla_put_failure;
                 }
-                NLA_PUT_NET16(skb, IPSET_ATTR_PORT,
-                              htons(map->first_port + id));
-                NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                              htonl(ip_set_timeout_get(members[id])));
+                if (nla_put_net16(skb, IPSET_ATTR_PORT,
+                                  htons(map->first_port + id)) ||
+                    nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
+                                  htonl(ip_set_timeout_get(members[id]))))
+                        goto nla_put_failure;
                 ipset_nest_end(skb, nested);
         }
         ipset_nest_end(skb, adt);
@@ -320,13 +322,14 @@ bitmap_port_head(struct ip_set *set, struct sk_buff *skb)
         nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
         if (!nested)
                 goto nla_put_failure;
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, htons(map->first_port));
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT_TO, htons(map->last_port));
-        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
-        NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
-                      htonl(sizeof(*map) + map->memsize));
-        if (with_timeout(map->timeout))
-                NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout));
+        if (nla_put_net16(skb, IPSET_ATTR_PORT, htons(map->first_port)) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT_TO, htons(map->last_port)) ||
+            nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1)) ||
+            nla_put_net32(skb, IPSET_ATTR_MEMSIZE,
+                          htonl(sizeof(*map) + map->memsize)) ||
+            (with_timeout(map->timeout) &&
+             nla_put_net32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout))))
+                goto nla_put_failure;
         ipset_nest_end(skb, nested);
 
         return 0;
@@ -422,7 +425,7 @@ init_map_port(struct ip_set *set, struct bitmap_port *map,
         map->timeout = IPSET_NO_TIMEOUT;
 
         set->data = map;
-        set->family = AF_UNSPEC;
+        set->family = NFPROTO_UNSPEC;
 
         return true;
 }
@@ -483,7 +486,7 @@ static struct ip_set_type bitmap_port_type = {
         .protocol       = IPSET_PROTOCOL,
         .features       = IPSET_TYPE_PORT,
         .dimension      = IPSET_DIM_ONE,
-        .family         = AF_UNSPEC,
+        .family         = NFPROTO_UNSPEC,
         .revision_min   = 0,
         .revision_max   = 0,
         .create         = bitmap_port_create,
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 32dbf0fa89db..819c342f5b30 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -69,7 +69,7 @@ find_set_type(const char *name, u8 family, u8 revision)
 
         list_for_each_entry_rcu(type, &ip_set_type_list, list)
                 if (STREQ(type->name, name) &&
-                    (type->family == family || type->family == AF_UNSPEC) &&
+                    (type->family == family || type->family == NFPROTO_UNSPEC) &&
                     revision >= type->revision_min &&
                     revision <= type->revision_max)
                         return type;
@@ -149,7 +149,7 @@ __find_set_type_minmax(const char *name, u8 family, u8 *min, u8 *max,
         rcu_read_lock();
         list_for_each_entry_rcu(type, &ip_set_type_list, list)
                 if (STREQ(type->name, name) &&
-                    (type->family == family || type->family == AF_UNSPEC)) {
+                    (type->family == family || type->family == NFPROTO_UNSPEC)) {
                         found = true;
                         if (type->revision_min < *min)
                                 *min = type->revision_min;
@@ -164,8 +164,8 @@ __find_set_type_minmax(const char *name, u8 family, u8 *min, u8 *max,
                 __find_set_type_minmax(name, family, min, max, true);
 }
 
-#define family_name(f)  ((f) == AF_INET ? "inet" : \
-                         (f) == AF_INET6 ? "inet6" : "any")
+#define family_name(f)  ((f) == NFPROTO_IPV4 ? "inet" : \
+                         (f) == NFPROTO_IPV6 ? "inet6" : "any")
 
 /* Register a set type structure. The type is identified by
  * the unique triple of name, family and revision.
@@ -354,7 +354,7 @@ ip_set_test(ip_set_id_t index, const struct sk_buff *skb,
         pr_debug("set %s, index %u\n", set->name, index);
 
         if (opt->dim < set->type->dimension ||
-            !(opt->family == set->family || set->family == AF_UNSPEC))
+            !(opt->family == set->family || set->family == NFPROTO_UNSPEC))
                 return 0;
 
         read_lock_bh(&set->lock);
@@ -387,7 +387,7 @@ ip_set_add(ip_set_id_t index, const struct sk_buff *skb,
         pr_debug("set %s, index %u\n", set->name, index);
 
         if (opt->dim < set->type->dimension ||
-            !(opt->family == set->family || set->family == AF_UNSPEC))
+            !(opt->family == set->family || set->family == NFPROTO_UNSPEC))
                 return 0;
 
         write_lock_bh(&set->lock);
@@ -410,7 +410,7 @@ ip_set_del(ip_set_id_t index, const struct sk_buff *skb,
         pr_debug("set %s, index %u\n", set->name, index);
 
         if (opt->dim < set->type->dimension ||
-            !(opt->family == set->family || set->family == AF_UNSPEC))
+            !(opt->family == set->family || set->family == NFPROTO_UNSPEC))
                 return 0;
 
         write_lock_bh(&set->lock);
@@ -575,7 +575,7 @@ start_msg(struct sk_buff *skb, u32 pid, u32 seq, unsigned int flags,
                 return NULL;
 
         nfmsg = nlmsg_data(nlh);
-        nfmsg->nfgen_family = AF_INET;
+        nfmsg->nfgen_family = NFPROTO_IPV4;
         nfmsg->version = NFNETLINK_V0;
         nfmsg->res_id = 0;
 
@@ -1092,19 +1092,21 @@ dump_last:
                         ret = -EMSGSIZE;
                         goto release_refcount;
                 }
-                NLA_PUT_U8(skb, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL);
-                NLA_PUT_STRING(skb, IPSET_ATTR_SETNAME, set->name);
+                if (nla_put_u8(skb, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL) ||
+                    nla_put_string(skb, IPSET_ATTR_SETNAME, set->name))
+                        goto nla_put_failure;
                 if (dump_flags & IPSET_FLAG_LIST_SETNAME)
                         goto next_set;
                 switch (cb->args[2]) {
                 case 0:
                         /* Core header data */
-                        NLA_PUT_STRING(skb, IPSET_ATTR_TYPENAME,
-                                       set->type->name);
-                        NLA_PUT_U8(skb, IPSET_ATTR_FAMILY,
-                                   set->family);
-                        NLA_PUT_U8(skb, IPSET_ATTR_REVISION,
-                                   set->revision);
+                        if (nla_put_string(skb, IPSET_ATTR_TYPENAME,
+                                           set->type->name) ||
+                            nla_put_u8(skb, IPSET_ATTR_FAMILY,
+                                       set->family) ||
+                            nla_put_u8(skb, IPSET_ATTR_REVISION,
+                                       set->revision))
+                                goto nla_put_failure;
                         ret = set->variant->head(set, skb);
                         if (ret < 0)
                                 goto release_refcount;
@@ -1162,9 +1164,13 @@ ip_set_dump(struct sock *ctnl, struct sk_buff *skb,
         if (unlikely(protocol_failed(attr)))
                 return -IPSET_ERR_PROTOCOL;
 
-        return netlink_dump_start(ctnl, skb, nlh,
-                                  ip_set_dump_start,
-                                  ip_set_dump_done, 0);
+        {
+                struct netlink_dump_control c = {
+                        .dump = ip_set_dump_start,
+                        .done = ip_set_dump_done,
+                };
+                return netlink_dump_start(ctnl, skb, nlh, &c);
+        }
 }
 
 /* Add, del and test */
@@ -1406,11 +1412,12 @@ ip_set_header(struct sock *ctnl, struct sk_buff *skb,
                          IPSET_CMD_HEADER);
         if (!nlh2)
                 goto nlmsg_failure;
-        NLA_PUT_U8(skb2, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL);
-        NLA_PUT_STRING(skb2, IPSET_ATTR_SETNAME, set->name);
-        NLA_PUT_STRING(skb2, IPSET_ATTR_TYPENAME, set->type->name);
-        NLA_PUT_U8(skb2, IPSET_ATTR_FAMILY, set->family);
-        NLA_PUT_U8(skb2, IPSET_ATTR_REVISION, set->revision);
+        if (nla_put_u8(skb2, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL) ||
+            nla_put_string(skb2, IPSET_ATTR_SETNAME, set->name) ||
+            nla_put_string(skb2, IPSET_ATTR_TYPENAME, set->type->name) ||
+            nla_put_u8(skb2, IPSET_ATTR_FAMILY, set->family) ||
+            nla_put_u8(skb2, IPSET_ATTR_REVISION, set->revision))
+                goto nla_put_failure;
         nlmsg_end(skb2, nlh2);
 
         ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
@@ -1465,11 +1472,12 @@ ip_set_type(struct sock *ctnl, struct sk_buff *skb,
                          IPSET_CMD_TYPE);
         if (!nlh2)
                 goto nlmsg_failure;
-        NLA_PUT_U8(skb2, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL);
-        NLA_PUT_STRING(skb2, IPSET_ATTR_TYPENAME, typename);
-        NLA_PUT_U8(skb2, IPSET_ATTR_FAMILY, family);
-        NLA_PUT_U8(skb2, IPSET_ATTR_REVISION, max);
-        NLA_PUT_U8(skb2, IPSET_ATTR_REVISION_MIN, min);
+        if (nla_put_u8(skb2, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL) ||
+            nla_put_string(skb2, IPSET_ATTR_TYPENAME, typename) ||
+            nla_put_u8(skb2, IPSET_ATTR_FAMILY, family) ||
+            nla_put_u8(skb2, IPSET_ATTR_REVISION, max) ||
+            nla_put_u8(skb2, IPSET_ATTR_REVISION_MIN, min))
+                goto nla_put_failure;
         nlmsg_end(skb2, nlh2);
 
         pr_debug("Send TYPE, nlmsg_len: %u\n", nlh2->nlmsg_len);
@@ -1513,7 +1521,8 @@ ip_set_protocol(struct sock *ctnl, struct sk_buff *skb,
                          IPSET_CMD_PROTOCOL);
         if (!nlh2)
                 goto nlmsg_failure;
-        NLA_PUT_U8(skb2, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL);
+        if (nla_put_u8(skb2, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL))
+                goto nla_put_failure;
         nlmsg_end(skb2, nlh2);
 
         ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
@@ -1609,7 +1618,7 @@ static struct nfnetlink_subsystem ip_set_netlink_subsys __read_mostly = {
 static int
 ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
 {
-        unsigned *op;
+        unsigned int *op;
         void *data;
         int copylen = *len, ret = 0;
 
@@ -1617,7 +1626,7 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
                 return -EPERM;
         if (optval != SO_IP_SET)
                 return -EBADF;
-        if (*len < sizeof(unsigned))
+        if (*len < sizeof(unsigned int))
                 return -EINVAL;
 
         data = vmalloc(*len);
@@ -1627,7 +1636,7 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
                 ret = -EFAULT;
                 goto done;
         }
-        op = (unsigned *) data;
+        op = (unsigned int *) data;
 
         if (*op < IP_SET_OP_VERSION) {
                 /* Check the version at the beginning of operations */
diff --git a/net/netfilter/ipset/ip_set_getport.c b/net/netfilter/ipset/ip_set_getport.c
index 1f03556666f4..6fdf88ae2353 100644
--- a/net/netfilter/ipset/ip_set_getport.c
+++ b/net/netfilter/ipset/ip_set_getport.c
@@ -136,10 +136,10 @@ ip_set_get_ip_port(const struct sk_buff *skb, u8 pf, bool src, __be16 *port)
         u8 proto;
 
         switch (pf) {
-        case AF_INET:
+        case NFPROTO_IPV4:
                 ret = ip_set_get_ip4_port(skb, src, port, &proto);
                 break;
-        case AF_INET6:
+        case NFPROTO_IPV6:
                 ret = ip_set_get_ip6_port(skb, src, port, &proto);
                 break;
         default:
diff --git a/net/netfilter/ipset/ip_set_hash_ip.c b/net/netfilter/ipset/ip_set_hash_ip.c
index 4015fcaf87bc..a68dbd4f1e4e 100644
--- a/net/netfilter/ipset/ip_set_hash_ip.c
+++ b/net/netfilter/ipset/ip_set_hash_ip.c
@@ -81,7 +81,8 @@ hash_ip4_data_zero_out(struct hash_ip4_elem *elem)
 static inline bool
 hash_ip4_data_list(struct sk_buff *skb, const struct hash_ip4_elem *data)
 {
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, data->ip);
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -94,9 +95,10 @@ hash_ip4_data_tlist(struct sk_buff *skb, const struct hash_ip4_elem *data)
         const struct hash_ip4_telem *tdata =
                 (const struct hash_ip4_telem *)data;
 
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, tdata->ip);
-        NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                      htonl(ip_set_timeout_get(tdata->timeout)));
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, tdata->ip) ||
+            nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
+                          htonl(ip_set_timeout_get(tdata->timeout))))
+                goto nla_put_failure;
 
         return 0;
 
@@ -262,7 +264,8 @@ ip6_netmask(union nf_inet_addr *ip, u8 prefix)
 static bool
 hash_ip6_data_list(struct sk_buff *skb, const struct hash_ip6_elem *data)
 {
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &data->ip);
+        if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip.in6))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -275,9 +278,10 @@ hash_ip6_data_tlist(struct sk_buff *skb, const struct hash_ip6_elem *data)
         const struct hash_ip6_telem *e =
                 (const struct hash_ip6_telem *)data;
 
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &e->ip);
-        NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                      htonl(ip_set_timeout_get(e->timeout)));
+        if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &e->ip.in6) ||
+            nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
+                          htonl(ip_set_timeout_get(e->timeout))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -364,13 +368,14 @@ hash_ip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 {
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 netmask, hbits;
+        size_t hsize;
         struct ip_set_hash *h;
 
-        if (!(set->family == AF_INET || set->family == AF_INET6))
+        if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
-        netmask = set->family == AF_INET ? 32 : 128;
+        netmask = set->family == NFPROTO_IPV4 ? 32 : 128;
         pr_debug("Create set %s with family %s\n",
-                 set->name, set->family == AF_INET ? "inet" : "inet6");
+                 set->name, set->family == NFPROTO_IPV4 ? "inet" : "inet6");
 
         if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
                      !ip_set_optattr_netorder(tb, IPSET_ATTR_MAXELEM) ||
@@ -389,8 +394,8 @@ hash_ip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         if (tb[IPSET_ATTR_NETMASK]) {
                 netmask = nla_get_u8(tb[IPSET_ATTR_NETMASK]);
 
-                if ((set->family == AF_INET && netmask > 32) ||
-                    (set->family == AF_INET6 && netmask > 128) ||
+                if ((set->family == NFPROTO_IPV4 && netmask > 32) ||
+                    (set->family == NFPROTO_IPV6 && netmask > 128) ||
                     netmask == 0)
                         return -IPSET_ERR_INVALID_NETMASK;
         }
@@ -405,9 +410,12 @@ hash_ip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
@@ -419,15 +427,15 @@ hash_ip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         if (tb[IPSET_ATTR_TIMEOUT]) {
                 h->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 
-                set->variant = set->family == AF_INET
+                set->variant = set->family == NFPROTO_IPV4
                         ? &hash_ip4_tvariant : &hash_ip6_tvariant;
 
-                if (set->family == AF_INET)
+                if (set->family == NFPROTO_IPV4)
                         hash_ip4_gc_init(set);
                 else
                         hash_ip6_gc_init(set);
         } else {
-                set->variant = set->family == AF_INET
+                set->variant = set->family == NFPROTO_IPV4
                         ? &hash_ip4_variant : &hash_ip6_variant;
         }
 
@@ -443,7 +451,7 @@ static struct ip_set_type hash_ip_type __read_mostly = {
         .protocol       = IPSET_PROTOCOL,
         .features       = IPSET_TYPE_IP,
         .dimension      = IPSET_DIM_ONE,
-        .family         = AF_UNSPEC,
+        .family         = NFPROTO_UNSPEC,
         .revision_min   = 0,
         .revision_max   = 0,
         .create         = hash_ip_create,
diff --git a/net/netfilter/ipset/ip_set_hash_ipport.c b/net/netfilter/ipset/ip_set_hash_ipport.c
index 37d667e3f6f8..92722bb82eea 100644
--- a/net/netfilter/ipset/ip_set_hash_ipport.c
+++ b/net/netfilter/ipset/ip_set_hash_ipport.c
@@ -93,9 +93,10 @@ static bool
 hash_ipport4_data_list(struct sk_buff *skb,
                        const struct hash_ipport4_elem *data)
 {
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, data->ip);
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
-        NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -109,12 +110,12 @@ hash_ipport4_data_tlist(struct sk_buff *skb,
         const struct hash_ipport4_telem *tdata =
                 (const struct hash_ipport4_telem *)data;
 
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, tdata->ip);
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, tdata->port);
-        NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
-        NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                      htonl(ip_set_timeout_get(tdata->timeout)));
-
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, tdata->ip) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, tdata->port) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
+            nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
+                          htonl(ip_set_timeout_get(tdata->timeout))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -308,9 +309,10 @@ static bool
 hash_ipport6_data_list(struct sk_buff *skb,
                        const struct hash_ipport6_elem *data)
 {
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &data->ip);
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
-        NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
+        if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip.in6) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -324,11 +326,12 @@ hash_ipport6_data_tlist(struct sk_buff *skb,
         const struct hash_ipport6_telem *e =
                 (const struct hash_ipport6_telem *)data;
 
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &e->ip);
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
-        NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
-        NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                      htonl(ip_set_timeout_get(e->timeout)));
+        if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &e->ip.in6) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
+            nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
+                          htonl(ip_set_timeout_get(e->timeout))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -449,8 +452,9 @@ hash_ipport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         struct ip_set_hash *h;
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 hbits;
+        size_t hsize;
 
-        if (!(set->family == AF_INET || set->family == AF_INET6))
+        if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
 
         if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
@@ -476,9 +480,12 @@ hash_ipport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
@@ -490,15 +497,15 @@ hash_ipport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         if (tb[IPSET_ATTR_TIMEOUT]) {
                 h->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 
-                set->variant = set->family == AF_INET
+                set->variant = set->family == NFPROTO_IPV4
                         ? &hash_ipport4_tvariant : &hash_ipport6_tvariant;
 
-                if (set->family == AF_INET)
+                if (set->family == NFPROTO_IPV4)
                         hash_ipport4_gc_init(set);
                 else
                         hash_ipport6_gc_init(set);
         } else {
-                set->variant = set->family == AF_INET
+                set->variant = set->family == NFPROTO_IPV4
                         ? &hash_ipport4_variant : &hash_ipport6_variant;
         }
 
@@ -514,7 +521,7 @@ static struct ip_set_type hash_ipport_type __read_mostly = {
         .protocol       = IPSET_PROTOCOL,
         .features       = IPSET_TYPE_IP | IPSET_TYPE_PORT,
         .dimension      = IPSET_DIM_TWO,
-        .family         = AF_UNSPEC,
+        .family         = NFPROTO_UNSPEC,
         .revision_min   = 0,
         .revision_max   = 1,    /* SCTP and UDPLITE support added */
         .create         = hash_ipport_create,
diff --git a/net/netfilter/ipset/ip_set_hash_ipportip.c b/net/netfilter/ipset/ip_set_hash_ipportip.c
index e69e2718fbe1..0637ce096def 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportip.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportip.c
@@ -94,10 +94,11 @@ static bool
 hash_ipportip4_data_list(struct sk_buff *skb,
                        const struct hash_ipportip4_elem *data)
 {
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, data->ip);
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP2, data->ip2);
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
-        NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) ||
+            nla_put_ipaddr4(skb, IPSET_ATTR_IP2, data->ip2) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -111,13 +112,13 @@ hash_ipportip4_data_tlist(struct sk_buff *skb,
         const struct hash_ipportip4_telem *tdata =
                 (const struct hash_ipportip4_telem *)data;
 
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, tdata->ip);
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP2, tdata->ip2);
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, tdata->port);
-        NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
-        NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                      htonl(ip_set_timeout_get(tdata->timeout)));
-
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, tdata->ip) ||
+            nla_put_ipaddr4(skb, IPSET_ATTR_IP2, tdata->ip2) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, tdata->port) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
+            nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
+                          htonl(ip_set_timeout_get(tdata->timeout))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -319,10 +320,11 @@ static bool
 hash_ipportip6_data_list(struct sk_buff *skb,
                          const struct hash_ipportip6_elem *data)
 {
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &data->ip);
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP2, &data->ip2);
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
-        NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
+        if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip.in6) ||
+            nla_put_ipaddr6(skb, IPSET_ATTR_IP2, &data->ip2.in6) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -336,12 +338,13 @@ hash_ipportip6_data_tlist(struct sk_buff *skb,
         const struct hash_ipportip6_telem *e =
                 (const struct hash_ipportip6_telem *)data;
 
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &e->ip);
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP2, &data->ip2);
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
-        NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
-        NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                      htonl(ip_set_timeout_get(e->timeout)));
+        if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &e->ip.in6) ||
+            nla_put_ipaddr6(skb, IPSET_ATTR_IP2, &data->ip2.in6) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
+            nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
+                          htonl(ip_set_timeout_get(e->timeout))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -467,8 +470,9 @@ hash_ipportip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         struct ip_set_hash *h;
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 hbits;
+        size_t hsize;
 
-        if (!(set->family == AF_INET || set->family == AF_INET6))
+        if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
 
         if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
@@ -494,9 +498,12 @@ hash_ipportip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
@@ -508,15 +515,15 @@ hash_ipportip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         if (tb[IPSET_ATTR_TIMEOUT]) {
                 h->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 
-                set->variant = set->family == AF_INET
+                set->variant = set->family == NFPROTO_IPV4
                         ? &hash_ipportip4_tvariant : &hash_ipportip6_tvariant;
 
-                if (set->family == AF_INET)
+                if (set->family == NFPROTO_IPV4)
                         hash_ipportip4_gc_init(set);
                 else
                         hash_ipportip6_gc_init(set);
         } else {
-                set->variant = set->family == AF_INET
+                set->variant = set->family == NFPROTO_IPV4
                         ? &hash_ipportip4_variant : &hash_ipportip6_variant;
         }
 
@@ -532,7 +539,7 @@ static struct ip_set_type hash_ipportip_type __read_mostly = {
         .protocol       = IPSET_PROTOCOL,
         .features       = IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_TYPE_IP2,
         .dimension      = IPSET_DIM_THREE,
-        .family         = AF_UNSPEC,
+        .family         = NFPROTO_UNSPEC,
         .revision_min   = 0,
         .revision_max   = 1,    /* SCTP and UDPLITE support added */
         .create         = hash_ipportip_create,
diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index 64199b4e93c9..1ce21ca976e1 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -41,12 +41,19 @@ hash_ipportnet_same_set(const struct ip_set *a, const struct ip_set *b);
 
 /* The type variant functions: IPv4 */
 
+/* We squeeze the "nomatch" flag into cidr: we don't support cidr == 0
+ * However this way we have to store internally cidr - 1,
+ * dancing back and forth.
+ */
+#define IP_SET_HASH_WITH_NETS_PACKED
+
 /* Member elements without timeout */
 struct hash_ipportnet4_elem {
         __be32 ip;
         __be32 ip2;
         __be16 port;
-        u8 cidr;
+        u8 cidr:7;
+        u8 nomatch:1;
         u8 proto;
 };
 
@@ -55,7 +62,8 @@ struct hash_ipportnet4_telem {
         __be32 ip;
         __be32 ip2;
         __be16 port;
-        u8 cidr;
+        u8 cidr:7;
+        u8 nomatch:1;
         u8 proto;
         unsigned long timeout;
 };
@@ -86,10 +94,22 @@ hash_ipportnet4_data_copy(struct hash_ipportnet4_elem *dst,
 }
 
 static inline void
+hash_ipportnet4_data_flags(struct hash_ipportnet4_elem *dst, u32 flags)
+{
+        dst->nomatch = !!(flags & IPSET_FLAG_NOMATCH);
+}
+
+static inline bool
+hash_ipportnet4_data_match(const struct hash_ipportnet4_elem *elem)
+{
+        return !elem->nomatch;
+}
+
+static inline void
 hash_ipportnet4_data_netmask(struct hash_ipportnet4_elem *elem, u8 cidr)
 {
         elem->ip2 &= ip_set_netmask(cidr);
-        elem->cidr = cidr;
+        elem->cidr = cidr - 1;
 }
 
 static inline void
@@ -102,11 +122,16 @@ static bool
 hash_ipportnet4_data_list(struct sk_buff *skb,
                           const struct hash_ipportnet4_elem *data)
 {
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, data->ip);
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP2, data->ip2);
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
-        NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
-        NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
+        u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
+
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) ||
+            nla_put_ipaddr4(skb, IPSET_ATTR_IP2, data->ip2) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr + 1) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -119,15 +144,18 @@ hash_ipportnet4_data_tlist(struct sk_buff *skb,
 {
         const struct hash_ipportnet4_telem *tdata =
                 (const struct hash_ipportnet4_telem *)data;
-
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, tdata->ip);
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP2, tdata->ip2);
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, tdata->port);
-        NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
-        NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
-        NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                      htonl(ip_set_timeout_get(tdata->timeout)));
-
+        u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
+
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, tdata->ip) ||
+            nla_put_ipaddr4(skb, IPSET_ATTR_IP2, tdata->ip2) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, tdata->port) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr + 1) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
+            nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
+                          htonl(ip_set_timeout_get(tdata->timeout))) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -158,13 +186,11 @@ hash_ipportnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
         struct hash_ipportnet4_elem data = {
-                .cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+                .cidr = h->nets[0].cidr ? h->nets[0].cidr - 1 : HOST_MASK - 1
         };
 
-        if (data.cidr == 0)
-                return -EINVAL;
         if (adt == IPSET_TEST)
-                data.cidr = HOST_MASK;
+                data.cidr = HOST_MASK - 1;
 
         if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
                                  &data.port, &data.proto))
@@ -172,7 +198,7 @@ hash_ipportnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
 
         ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip);
         ip4addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &data.ip2);
-        data.ip2 &= ip_set_netmask(data.cidr);
+        data.ip2 &= ip_set_netmask(data.cidr + 1);
 
         return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
 }
@@ -183,17 +209,19 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
 {
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
-        struct hash_ipportnet4_elem data = { .cidr = HOST_MASK };
+        struct hash_ipportnet4_elem data = { .cidr = HOST_MASK - 1 };
         u32 ip, ip_to = 0, p = 0, port, port_to;
         u32 ip2_from = 0, ip2_to, ip2_last, ip2;
         u32 timeout = h->timeout;
         bool with_ports = false;
+        u8 cidr;
         int ret;
 
         if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
                      !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
-                     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
                 return -IPSET_ERR_PROTOCOL;
 
         if (tb[IPSET_ATTR_LINENO])
@@ -208,9 +236,10 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
                 return ret;
 
         if (tb[IPSET_ATTR_CIDR2]) {
-                data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
-                if (!data.cidr)
+                cidr = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
+                if (!cidr || cidr > HOST_MASK)
                         return -IPSET_ERR_INVALID_CIDR;
+                data.cidr = cidr - 1;
         }
 
         if (tb[IPSET_ATTR_PORT])
@@ -236,12 +265,18 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
                 timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
         }
 
+        if (tb[IPSET_ATTR_CADT_FLAGS] && adt == IPSET_ADD) {
+                u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
+                if (cadt_flags & IPSET_FLAG_NOMATCH)
+                        flags |= (cadt_flags << 16);
+        }
+
         with_ports = with_ports && tb[IPSET_ATTR_PORT_TO];
         if (adt == IPSET_TEST ||
             !(tb[IPSET_ATTR_CIDR] || tb[IPSET_ATTR_IP_TO] || with_ports ||
               tb[IPSET_ATTR_IP2_TO])) {
                 data.ip = htonl(ip);
-                data.ip2 = htonl(ip2_from & ip_set_hostmask(data.cidr));
+                data.ip2 = htonl(ip2_from & ip_set_hostmask(data.cidr + 1));
                 ret = adtfn(set, &data, timeout, flags);
                 return ip_set_eexist(ret, flags) ? 0 : ret;
         }
@@ -275,7 +310,7 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
                 if (ip2_from + UINT_MAX == ip2_to)
                         return -IPSET_ERR_HASH_RANGE;
         } else {
-                ip_set_mask_from_to(ip2_from, ip2_to, data.cidr);
+                ip_set_mask_from_to(ip2_from, ip2_to, data.cidr + 1);
         }
 
         if (retried)
@@ -290,7 +325,8 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
                         while (!after(ip2, ip2_to)) {
                                 data.ip2 = htonl(ip2);
                                 ip2_last = ip_set_range_to_cidr(ip2, ip2_to,
-                                                                &data.cidr);
+                                                                &cidr);
+                                data.cidr = cidr - 1;
                                 ret = adtfn(set, &data, timeout, flags);
 
                                 if (ret && !ip_set_eexist(ret, flags))
@@ -321,7 +357,8 @@ struct hash_ipportnet6_elem {
         union nf_inet_addr ip;
         union nf_inet_addr ip2;
         __be16 port;
-        u8 cidr;
+        u8 cidr:7;
+        u8 nomatch:1;
         u8 proto;
 };
 
@@ -329,7 +366,8 @@ struct hash_ipportnet6_telem {
         union nf_inet_addr ip;
         union nf_inet_addr ip2;
         __be16 port;
-        u8 cidr;
+        u8 cidr:7;
+        u8 nomatch:1;
         u8 proto;
         unsigned long timeout;
 };
@@ -360,6 +398,18 @@ hash_ipportnet6_data_copy(struct hash_ipportnet6_elem *dst,
 }
 
 static inline void
+hash_ipportnet6_data_flags(struct hash_ipportnet6_elem *dst, u32 flags)
+{
+        dst->nomatch = !!(flags & IPSET_FLAG_NOMATCH);
+}
+
+static inline bool
+hash_ipportnet6_data_match(const struct hash_ipportnet6_elem *elem)
+{
+        return !elem->nomatch;
+}
+
+static inline void
 hash_ipportnet6_data_zero_out(struct hash_ipportnet6_elem *elem)
 {
         elem->proto = 0;
@@ -378,18 +428,23 @@ static inline void
 hash_ipportnet6_data_netmask(struct hash_ipportnet6_elem *elem, u8 cidr)
 {
         ip6_netmask(&elem->ip2, cidr);
-        elem->cidr = cidr;
+        elem->cidr = cidr - 1;
 }
 
 static bool
 hash_ipportnet6_data_list(struct sk_buff *skb,
                           const struct hash_ipportnet6_elem *data)
 {
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &data->ip);
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP2, &data->ip2);
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
-        NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
-        NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
+        u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
+
+        if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip.in6) ||
+            nla_put_ipaddr6(skb, IPSET_ATTR_IP2, &data->ip2.in6) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr + 1) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -402,14 +457,18 @@ hash_ipportnet6_data_tlist(struct sk_buff *skb,
 {
         const struct hash_ipportnet6_telem *e =
                 (const struct hash_ipportnet6_telem *)data;
-
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &e->ip);
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP2, &data->ip2);
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
-        NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
-        NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
-        NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                      htonl(ip_set_timeout_get(e->timeout)));
+        u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
+
+        if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &e->ip.in6) ||
+            nla_put_ipaddr6(skb, IPSET_ATTR_IP2, &data->ip2.in6) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr + 1) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
+            nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
+                          htonl(ip_set_timeout_get(e->timeout))) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -438,13 +497,11 @@ hash_ipportnet6_kadt(struct ip_set *set, const struct sk_buff *skb,
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
         struct hash_ipportnet6_elem data = {
-                .cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+                .cidr = h->nets[0].cidr ? h->nets[0].cidr - 1 : HOST_MASK - 1
         };
 
-        if (data.cidr == 0)
-                return -EINVAL;
         if (adt == IPSET_TEST)
-                data.cidr = HOST_MASK;
+                data.cidr = HOST_MASK - 1;
 
         if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
                                  &data.port, &data.proto))
@@ -452,7 +509,7 @@ hash_ipportnet6_kadt(struct ip_set *set, const struct sk_buff *skb,
 
         ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
         ip6addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &data.ip2.in6);
-        ip6_netmask(&data.ip2, data.cidr);
+        ip6_netmask(&data.ip2, data.cidr + 1);
 
         return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
 }
@@ -463,16 +520,18 @@ hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
 {
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
-        struct hash_ipportnet6_elem data = { .cidr = HOST_MASK };
+        struct hash_ipportnet6_elem data = { .cidr = HOST_MASK - 1 };
         u32 port, port_to;
         u32 timeout = h->timeout;
         bool with_ports = false;
+        u8 cidr;
         int ret;
 
         if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
                      !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
                      !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS) ||
                      tb[IPSET_ATTR_IP_TO] ||
                      tb[IPSET_ATTR_CIDR]))
                 return -IPSET_ERR_PROTOCOL;
@@ -490,13 +549,14 @@ hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
         if (ret)
                 return ret;
 
-        if (tb[IPSET_ATTR_CIDR2])
-                data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
-
-        if (!data.cidr)
-                return -IPSET_ERR_INVALID_CIDR;
+        if (tb[IPSET_ATTR_CIDR2]) {
+                cidr = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
+                if (!cidr || cidr > HOST_MASK)
+                        return -IPSET_ERR_INVALID_CIDR;
+                data.cidr = cidr - 1;
+        }
 
-        ip6_netmask(&data.ip2, data.cidr);
+        ip6_netmask(&data.ip2, data.cidr + 1);
 
         if (tb[IPSET_ATTR_PORT])
                 data.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
@@ -521,6 +581,12 @@ hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
                 timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
         }
 
+        if (tb[IPSET_ATTR_CADT_FLAGS] && adt == IPSET_ADD) {
+                u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
+                if (cadt_flags & IPSET_FLAG_NOMATCH)
+                        flags |= (cadt_flags << 16);
+        }
+
         if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
                 ret = adtfn(set, &data, timeout, flags);
                 return ip_set_eexist(ret, flags) ? 0 : ret;
@@ -553,8 +619,9 @@ hash_ipportnet_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         struct ip_set_hash *h;
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 hbits;
+        size_t hsize;
 
-        if (!(set->family == AF_INET || set->family == AF_INET6))
+        if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
 
         if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
@@ -573,7 +640,7 @@ hash_ipportnet_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 
         h = kzalloc(sizeof(*h)
                     + sizeof(struct ip_set_hash_nets)
-                      * (set->family == AF_INET ? 32 : 128), GFP_KERNEL);
+                      * (set->family == NFPROTO_IPV4 ? 32 : 128), GFP_KERNEL);
         if (!h)
                 return -ENOMEM;
 
@@ -582,9 +649,12 @@ hash_ipportnet_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
@@ -596,16 +666,16 @@ hash_ipportnet_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         if (tb[IPSET_ATTR_TIMEOUT]) {
                 h->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 
-                set->variant = set->family == AF_INET
+                set->variant = set->family == NFPROTO_IPV4
                         ? &hash_ipportnet4_tvariant
                         : &hash_ipportnet6_tvariant;
 
-                if (set->family == AF_INET)
+                if (set->family == NFPROTO_IPV4)
                         hash_ipportnet4_gc_init(set);
                 else
                         hash_ipportnet6_gc_init(set);
         } else {
-                set->variant = set->family == AF_INET
+                set->variant = set->family == NFPROTO_IPV4
                         ? &hash_ipportnet4_variant : &hash_ipportnet6_variant;
         }
 
@@ -621,10 +691,11 @@ static struct ip_set_type hash_ipportnet_type __read_mostly = {
         .protocol       = IPSET_PROTOCOL,
         .features       = IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_TYPE_IP2,
         .dimension      = IPSET_DIM_THREE,
-        .family         = AF_UNSPEC,
+        .family         = NFPROTO_UNSPEC,
         .revision_min   = 0,
         /*                1        SCTP and UDPLITE support added */
-        .revision_max   = 2,    /* Range as input support for IPv4 added */
+        /*                2        Range as input support for IPv4 added */
+        .revision_max   = 3,    /* nomatch flag support added */
         .create         = hash_ipportnet_create,
         .create_policy  = {
                 [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
@@ -643,6 +714,7 @@ static struct ip_set_type hash_ipportnet_type __read_mostly = {
                 [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
                 [IPSET_ATTR_CIDR2]      = { .type = NLA_U8 },
                 [IPSET_ATTR_PROTO]      = { .type = NLA_U8 },
+                [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
                 [IPSET_ATTR_LINENO]     = { .type = NLA_U32 },
         },
diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c
index 28988196775e..c57a6a09906d 100644
--- a/net/netfilter/ipset/ip_set_hash_net.c
+++ b/net/netfilter/ipset/ip_set_hash_net.c
@@ -43,7 +43,7 @@ hash_net_same_set(const struct ip_set *a, const struct ip_set *b);
 struct hash_net4_elem {
         __be32 ip;
         u16 padding0;
-        u8 padding1;
+        u8 nomatch;
         u8 cidr;
 };
 
@@ -51,7 +51,7 @@ struct hash_net4_elem {
 struct hash_net4_telem {
         __be32 ip;
         u16 padding0;
-        u8 padding1;
+        u8 nomatch;
         u8 cidr;
         unsigned long timeout;
 };
@@ -61,7 +61,8 @@ hash_net4_data_equal(const struct hash_net4_elem *ip1,
                      const struct hash_net4_elem *ip2,
                      u32 *multi)
 {
-        return ip1->ip == ip2->ip && ip1->cidr == ip2->cidr;
+        return ip1->ip == ip2->ip &&
+               ip1->cidr == ip2->cidr;
 }
 
 static inline bool
@@ -76,6 +77,19 @@ hash_net4_data_copy(struct hash_net4_elem *dst,
 {
         dst->ip = src->ip;
         dst->cidr = src->cidr;
+        dst->nomatch = src->nomatch;
+}
+
+static inline void
+hash_net4_data_flags(struct hash_net4_elem *dst, u32 flags)
+{
+        dst->nomatch = flags & IPSET_FLAG_NOMATCH;
+}
+
+static inline bool
+hash_net4_data_match(const struct hash_net4_elem *elem)
+{
+        return !elem->nomatch;
 }
 
 static inline void
@@ -95,8 +109,13 @@ hash_net4_data_zero_out(struct hash_net4_elem *elem)
 static bool
 hash_net4_data_list(struct sk_buff *skb, const struct hash_net4_elem *data)
 {
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, data->ip);
-        NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
+        u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
+
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -108,12 +127,15 @@ hash_net4_data_tlist(struct sk_buff *skb, const struct hash_net4_elem *data)
 {
         const struct hash_net4_telem *tdata =
                 (const struct hash_net4_telem *)data;
-
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, tdata->ip);
-        NLA_PUT_U8(skb, IPSET_ATTR_CIDR, tdata->cidr);
-        NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                      htonl(ip_set_timeout_get(tdata->timeout)));
-
+        u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
+
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, tdata->ip) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR, tdata->cidr) ||
+            nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
+                          htonl(ip_set_timeout_get(tdata->timeout))) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -167,7 +189,8 @@ hash_net4_uadt(struct ip_set *set, struct nlattr *tb[],
         int ret;
 
         if (unlikely(!tb[IPSET_ATTR_IP] ||
-                     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
                 return -IPSET_ERR_PROTOCOL;
 
         if (tb[IPSET_ATTR_LINENO])
@@ -179,7 +202,7 @@ hash_net4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (tb[IPSET_ATTR_CIDR]) {
                 data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
-                if (!data.cidr)
+                if (!data.cidr || data.cidr > HOST_MASK)
                         return -IPSET_ERR_INVALID_CIDR;
         }
 
@@ -189,6 +212,12 @@ hash_net4_uadt(struct ip_set *set, struct nlattr *tb[],
                 timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
         }
 
+        if (tb[IPSET_ATTR_CADT_FLAGS] && adt == IPSET_ADD) {
+                u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
+                if (cadt_flags & IPSET_FLAG_NOMATCH)
+                        flags |= (cadt_flags << 16);
+        }
+
         if (adt == IPSET_TEST || !tb[IPSET_ATTR_IP_TO]) {
                 data.ip = htonl(ip & ip_set_hostmask(data.cidr));
                 ret = adtfn(set, &data, timeout, flags);
@@ -236,14 +265,14 @@ hash_net_same_set(const struct ip_set *a, const struct ip_set *b)
 struct hash_net6_elem {
         union nf_inet_addr ip;
         u16 padding0;
-        u8 padding1;
+        u8 nomatch;
         u8 cidr;
 };
 
 struct hash_net6_telem {
         union nf_inet_addr ip;
         u16 padding0;
-        u8 padding1;
+        u8 nomatch;
         u8 cidr;
         unsigned long timeout;
 };
@@ -269,6 +298,19 @@ hash_net6_data_copy(struct hash_net6_elem *dst,
 {
         dst->ip.in6 = src->ip.in6;
         dst->cidr = src->cidr;
+        dst->nomatch = src->nomatch;
+}
+
+static inline void
+hash_net6_data_flags(struct hash_net6_elem *dst, u32 flags)
+{
+        dst->nomatch = flags & IPSET_FLAG_NOMATCH;
+}
+
+static inline bool
+hash_net6_data_match(const struct hash_net6_elem *elem)
+{
+        return !elem->nomatch;
 }
 
 static inline void
@@ -296,8 +338,13 @@ hash_net6_data_netmask(struct hash_net6_elem *elem, u8 cidr)
 static bool
 hash_net6_data_list(struct sk_buff *skb, const struct hash_net6_elem *data)
 {
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &data->ip);
-        NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
+        u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
+
+        if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip.in6) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -309,11 +356,15 @@ hash_net6_data_tlist(struct sk_buff *skb, const struct hash_net6_elem *data)
 {
         const struct hash_net6_telem *e =
                 (const struct hash_net6_telem *)data;
-
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &e->ip);
-        NLA_PUT_U8(skb, IPSET_ATTR_CIDR, e->cidr);
-        NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                      htonl(ip_set_timeout_get(e->timeout)));
+        u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
+
+        if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &e->ip.in6) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR, e->cidr) ||
+            nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
+                          htonl(ip_set_timeout_get(e->timeout))) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -366,7 +417,8 @@ hash_net6_uadt(struct ip_set *set, struct nlattr *tb[],
         int ret;
 
         if (unlikely(!tb[IPSET_ATTR_IP] ||
-                     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
                 return -IPSET_ERR_PROTOCOL;
         if (unlikely(tb[IPSET_ATTR_IP_TO]))
                 return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
@@ -381,7 +433,7 @@ hash_net6_uadt(struct ip_set *set, struct nlattr *tb[],
         if (tb[IPSET_ATTR_CIDR])
                 data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
 
-        if (!data.cidr)
+        if (!data.cidr || data.cidr > HOST_MASK)
                 return -IPSET_ERR_INVALID_CIDR;
 
         ip6_netmask(&data.ip, data.cidr);
@@ -392,6 +444,12 @@ hash_net6_uadt(struct ip_set *set, struct nlattr *tb[],
                 timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
         }
 
+        if (tb[IPSET_ATTR_CADT_FLAGS] && adt == IPSET_ADD) {
+                u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
+                if (cadt_flags & IPSET_FLAG_NOMATCH)
+                        flags |= (cadt_flags << 16);
+        }
+
         ret = adtfn(set, &data, timeout, flags);
 
         return ip_set_eexist(ret, flags) ? 0 : ret;
@@ -405,8 +463,9 @@ hash_net_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         struct ip_set_hash *h;
         u8 hbits;
+        size_t hsize;
 
-        if (!(set->family == AF_INET || set->family == AF_INET6))
+        if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
 
         if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
@@ -425,7 +484,7 @@ hash_net_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 
         h = kzalloc(sizeof(*h)
                     + sizeof(struct ip_set_hash_nets)
-                      * (set->family == AF_INET ? 32 : 128), GFP_KERNEL);
+                      * (set->family == NFPROTO_IPV4 ? 32 : 128), GFP_KERNEL);
         if (!h)
                 return -ENOMEM;
 
@@ -434,9 +493,12 @@ hash_net_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
@@ -448,15 +510,15 @@ hash_net_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         if (tb[IPSET_ATTR_TIMEOUT]) {
                 h->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 
-                set->variant = set->family == AF_INET
+                set->variant = set->family == NFPROTO_IPV4
                         ? &hash_net4_tvariant : &hash_net6_tvariant;
 
-                if (set->family == AF_INET)
+                if (set->family == NFPROTO_IPV4)
                         hash_net4_gc_init(set);
                 else
                         hash_net6_gc_init(set);
         } else {
-                set->variant = set->family == AF_INET
+                set->variant = set->family == NFPROTO_IPV4
                         ? &hash_net4_variant : &hash_net6_variant;
         }
 
@@ -472,9 +534,10 @@ static struct ip_set_type hash_net_type __read_mostly = {
         .protocol       = IPSET_PROTOCOL,
         .features       = IPSET_TYPE_IP,
         .dimension      = IPSET_DIM_ONE,
-        .family         = AF_UNSPEC,
+        .family         = NFPROTO_UNSPEC,
         .revision_min   = 0,
-        .revision_max   = 1,    /* Range as input support for IPv4 added */
+        /*              = 1        Range as input support for IPv4 added */
+        .revision_max   = 2,    /* nomatch flag support added */
         .create         = hash_net_create,
         .create_policy  = {
                 [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
@@ -488,6 +551,7 @@ static struct ip_set_type hash_net_type __read_mostly = {
                 [IPSET_ATTR_IP_TO]      = { .type = NLA_NESTED },
                 [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
+                [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
         },
         .me             = THIS_MODULE,
 };
diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index e13095deb50d..ee863943c826 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -163,7 +163,8 @@ struct hash_netiface4_elem_hashed {
         __be32 ip;
         u8 physdev;
         u8 cidr;
-        u16 padding;
+        u8 nomatch;
+        u8 padding;
 };
 
 #define HKEY_DATALEN    sizeof(struct hash_netiface4_elem_hashed)
@@ -173,7 +174,8 @@ struct hash_netiface4_elem {
         __be32 ip;
         u8 physdev;
         u8 cidr;
-        u16 padding;
+        u8 nomatch;
+        u8 padding;
         const char *iface;
 };
 
@@ -182,7 +184,8 @@ struct hash_netiface4_telem {
         __be32 ip;
         u8 physdev;
         u8 cidr;
-        u16 padding;
+        u8 nomatch;
+        u8 padding;
         const char *iface;
         unsigned long timeout;
 };
@@ -207,11 +210,25 @@ hash_netiface4_data_isnull(const struct hash_netiface4_elem *elem)
 
 static inline void
 hash_netiface4_data_copy(struct hash_netiface4_elem *dst,
-                         const struct hash_netiface4_elem *src) {
+                         const struct hash_netiface4_elem *src)
+{
         dst->ip = src->ip;
         dst->cidr = src->cidr;
         dst->physdev = src->physdev;
         dst->iface = src->iface;
+        dst->nomatch = src->nomatch;
+}
+
+static inline void
+hash_netiface4_data_flags(struct hash_netiface4_elem *dst, u32 flags)
+{
+        dst->nomatch = flags & IPSET_FLAG_NOMATCH;
+}
+
+static inline bool
+hash_netiface4_data_match(const struct hash_netiface4_elem *elem)
+{
+        return !elem->nomatch;
 }
 
 static inline void
@@ -233,11 +250,14 @@ hash_netiface4_data_list(struct sk_buff *skb,
 {
         u32 flags = data->physdev ? IPSET_FLAG_PHYSDEV : 0;
 
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, data->ip);
-        NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
-        NLA_PUT_STRING(skb, IPSET_ATTR_IFACE, data->iface);
-        if (flags)
-                NLA_PUT_NET32(skb, IPSET_ATTR_CADT_FLAGS, flags);
+        if (data->nomatch)
+                flags |= IPSET_FLAG_NOMATCH;
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr) ||
+            nla_put_string(skb, IPSET_ATTR_IFACE, data->iface) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -252,13 +272,16 @@ hash_netiface4_data_tlist(struct sk_buff *skb,
                 (const struct hash_netiface4_telem *)data;
         u32 flags = data->physdev ? IPSET_FLAG_PHYSDEV : 0;
 
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, data->ip);
-        NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
-        NLA_PUT_STRING(skb, IPSET_ATTR_IFACE, data->iface);
-        if (flags)
-                NLA_PUT_NET32(skb, IPSET_ATTR_CADT_FLAGS, flags);
-        NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                      htonl(ip_set_timeout_get(tdata->timeout)));
+        if (data->nomatch)
+                flags |= IPSET_FLAG_NOMATCH;
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr) ||
+            nla_put_string(skb, IPSET_ATTR_IFACE, data->iface) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))) ||
+            nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
+                          htonl(ip_set_timeout_get(tdata->timeout))))
+                goto nla_put_failure;
 
         return 0;
 
@@ -361,7 +384,7 @@ hash_netiface4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (tb[IPSET_ATTR_CIDR]) {
                 data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
-                if (!data.cidr)
+                if (!data.cidr || data.cidr > HOST_MASK)
                         return -IPSET_ERR_INVALID_CIDR;
         }
 
@@ -387,6 +410,8 @@ hash_netiface4_uadt(struct ip_set *set, struct nlattr *tb[],
                 u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
                 if (cadt_flags & IPSET_FLAG_PHYSDEV)
                         data.physdev = 1;
+                if (adt == IPSET_ADD && (cadt_flags & IPSET_FLAG_NOMATCH))
+                        flags |= (cadt_flags << 16);
         }
 
         if (adt == IPSET_TEST || !tb[IPSET_ATTR_IP_TO]) {
@@ -440,7 +465,8 @@ struct hash_netiface6_elem_hashed {
         union nf_inet_addr ip;
         u8 physdev;
         u8 cidr;
-        u16 padding;
+        u8 nomatch;
+        u8 padding;
 };
 
 #define HKEY_DATALEN    sizeof(struct hash_netiface6_elem_hashed)
@@ -449,7 +475,8 @@ struct hash_netiface6_elem {
         union nf_inet_addr ip;
         u8 physdev;
         u8 cidr;
-        u16 padding;
+        u8 nomatch;
+        u8 padding;
         const char *iface;
 };
 
@@ -457,7 +484,8 @@ struct hash_netiface6_telem {
         union nf_inet_addr ip;
         u8 physdev;
         u8 cidr;
-        u16 padding;
+        u8 nomatch;
+        u8 padding;
         const char *iface;
         unsigned long timeout;
 };
@@ -488,8 +516,21 @@ hash_netiface6_data_copy(struct hash_netiface6_elem *dst,
 }
 
 static inline void
+hash_netiface6_data_flags(struct hash_netiface6_elem *dst, u32 flags)
+{
+        dst->nomatch = flags & IPSET_FLAG_NOMATCH;
+}
+
+static inline bool
+hash_netiface6_data_match(const struct hash_netiface6_elem *elem)
+{
+        return !elem->nomatch;
+}
+
+static inline void
 hash_netiface6_data_zero_out(struct hash_netiface6_elem *elem)
 {
+        elem->cidr = 0;
 }
 
 static inline void
@@ -514,11 +555,14 @@ hash_netiface6_data_list(struct sk_buff *skb,
 {
         u32 flags = data->physdev ? IPSET_FLAG_PHYSDEV : 0;
 
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &data->ip);
-        NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
-        NLA_PUT_STRING(skb, IPSET_ATTR_IFACE, data->iface);
-        if (flags)
-                NLA_PUT_NET32(skb, IPSET_ATTR_CADT_FLAGS, flags);
+        if (data->nomatch)
+                flags |= IPSET_FLAG_NOMATCH;
+        if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip.in6) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr) ||
+            nla_put_string(skb, IPSET_ATTR_IFACE, data->iface) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -533,13 +577,16 @@ hash_netiface6_data_tlist(struct sk_buff *skb,
                 (const struct hash_netiface6_telem *)data;
         u32 flags = data->physdev ? IPSET_FLAG_PHYSDEV : 0;
 
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &e->ip);
-        NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
-        NLA_PUT_STRING(skb, IPSET_ATTR_IFACE, data->iface);
-        if (flags)
-                NLA_PUT_NET32(skb, IPSET_ATTR_CADT_FLAGS, flags);
-        NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                      htonl(ip_set_timeout_get(e->timeout)));
+        if (data->nomatch)
+                flags |= IPSET_FLAG_NOMATCH;
+        if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &e->ip.in6) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr) ||
+            nla_put_string(skb, IPSET_ATTR_IFACE, data->iface) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))) ||
+            nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
+                          htonl(ip_set_timeout_get(e->timeout))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -636,7 +683,7 @@ hash_netiface6_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (tb[IPSET_ATTR_CIDR])
                 data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
-        if (!data.cidr)
+        if (!data.cidr || data.cidr > HOST_MASK)
                 return -IPSET_ERR_INVALID_CIDR;
         ip6_netmask(&data.ip, data.cidr);
 
@@ -662,6 +709,8 @@ hash_netiface6_uadt(struct ip_set *set, struct nlattr *tb[],
                 u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
                 if (cadt_flags & IPSET_FLAG_PHYSDEV)
                         data.physdev = 1;
+                if (adt == IPSET_ADD && (cadt_flags & IPSET_FLAG_NOMATCH))
+                        flags |= (cadt_flags << 16);
         }
 
         ret = adtfn(set, &data, timeout, flags);
@@ -677,8 +726,9 @@ hash_netiface_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         struct ip_set_hash *h;
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 hbits;
+        size_t hsize;
 
-        if (!(set->family == AF_INET || set->family == AF_INET6))
+        if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
 
         if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
@@ -697,7 +747,7 @@ hash_netiface_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 
         h = kzalloc(sizeof(*h)
                     + sizeof(struct ip_set_hash_nets)
-                      * (set->family == AF_INET ? 32 : 128), GFP_KERNEL);
+                      * (set->family == NFPROTO_IPV4 ? 32 : 128), GFP_KERNEL);
         if (!h)
                 return -ENOMEM;
 
@@ -707,9 +757,12 @@ hash_netiface_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->ahash_max = AHASH_MAX_SIZE;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
@@ -722,15 +775,15 @@ hash_netiface_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         if (tb[IPSET_ATTR_TIMEOUT]) {
                 h->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 
-                set->variant = set->family == AF_INET
+                set->variant = set->family == NFPROTO_IPV4
                         ? &hash_netiface4_tvariant : &hash_netiface6_tvariant;
 
-                if (set->family == AF_INET)
+                if (set->family == NFPROTO_IPV4)
                         hash_netiface4_gc_init(set);
                 else
                         hash_netiface6_gc_init(set);
         } else {
-                set->variant = set->family == AF_INET
+                set->variant = set->family == NFPROTO_IPV4
                         ? &hash_netiface4_variant : &hash_netiface6_variant;
         }
 
@@ -746,8 +799,9 @@ static struct ip_set_type hash_netiface_type __read_mostly = {
         .protocol       = IPSET_PROTOCOL,
         .features       = IPSET_TYPE_IP | IPSET_TYPE_IFACE,
         .dimension      = IPSET_DIM_TWO,
-        .family         = AF_UNSPEC,
+        .family         = NFPROTO_UNSPEC,
         .revision_min   = 0,
+        .revision_max   = 1,    /* nomatch flag support added */
         .create         = hash_netiface_create,
         .create_policy  = {
                 [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
diff --git a/net/netfilter/ipset/ip_set_hash_netport.c b/net/netfilter/ipset/ip_set_hash_netport.c
index 8f9de7207ec9..fc3143a2d41b 100644
--- a/net/netfilter/ipset/ip_set_hash_netport.c
+++ b/net/netfilter/ipset/ip_set_hash_netport.c
@@ -40,12 +40,19 @@ hash_netport_same_set(const struct ip_set *a, const struct ip_set *b);
 
 /* The type variant functions: IPv4 */
 
+/* We squeeze the "nomatch" flag into cidr: we don't support cidr == 0
+ * However this way we have to store internally cidr - 1,
+ * dancing back and forth.
+ */
+#define IP_SET_HASH_WITH_NETS_PACKED
+
 /* Member elements without timeout */
 struct hash_netport4_elem {
         __be32 ip;
         __be16 port;
         u8 proto;
-        u8 cidr;
+        u8 cidr:7;
+        u8 nomatch:1;
 };
 
 /* Member elements with timeout support */
@@ -53,7 +60,8 @@ struct hash_netport4_telem {
         __be32 ip;
         __be16 port;
         u8 proto;
-        u8 cidr;
+        u8 cidr:7;
+        u8 nomatch:1;
         unsigned long timeout;
 };
 
@@ -82,13 +90,26 @@ hash_netport4_data_copy(struct hash_netport4_elem *dst,
         dst->port = src->port;
         dst->proto = src->proto;
         dst->cidr = src->cidr;
+        dst->nomatch = src->nomatch;
+}
+
+static inline void
+hash_netport4_data_flags(struct hash_netport4_elem *dst, u32 flags)
+{
+        dst->nomatch = !!(flags & IPSET_FLAG_NOMATCH);
+}
+
+static inline bool
+hash_netport4_data_match(const struct hash_netport4_elem *elem)
+{
+        return !elem->nomatch;
 }
 
 static inline void
 hash_netport4_data_netmask(struct hash_netport4_elem *elem, u8 cidr)
 {
         elem->ip &= ip_set_netmask(cidr);
-        elem->cidr = cidr;
+        elem->cidr = cidr - 1;
 }
 
 static inline void
@@ -101,10 +122,15 @@ static bool
 hash_netport4_data_list(struct sk_buff *skb,
                         const struct hash_netport4_elem *data)
 {
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, data->ip);
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
-        NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
-        NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
+        u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
+
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr + 1) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -117,14 +143,17 @@ hash_netport4_data_tlist(struct sk_buff *skb,
 {
         const struct hash_netport4_telem *tdata =
                 (const struct hash_netport4_telem *)data;
-
-        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, tdata->ip);
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, tdata->port);
-        NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
-        NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
-        NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                      htonl(ip_set_timeout_get(tdata->timeout)));
-
+        u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
+
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, tdata->ip) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, tdata->port) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr + 1) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
+            nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
+                          htonl(ip_set_timeout_get(tdata->timeout))) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -154,20 +183,18 @@ hash_netport4_kadt(struct ip_set *set, const struct sk_buff *skb,
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
         struct hash_netport4_elem data = {
-                .cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+                .cidr = h->nets[0].cidr ? h->nets[0].cidr - 1 : HOST_MASK - 1
         };
 
-        if (data.cidr == 0)
-                return -EINVAL;
         if (adt == IPSET_TEST)
-                data.cidr = HOST_MASK;
+                data.cidr = HOST_MASK - 1;
 
         if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
                                  &data.port, &data.proto))
                 return -EINVAL;
 
         ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip);
-        data.ip &= ip_set_netmask(data.cidr);
+        data.ip &= ip_set_netmask(data.cidr + 1);
 
         return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
 }
@@ -178,16 +205,18 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *tb[],
 {
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
-        struct hash_netport4_elem data = { .cidr = HOST_MASK };
+        struct hash_netport4_elem data = { .cidr = HOST_MASK - 1 };
         u32 port, port_to, p = 0, ip = 0, ip_to, last;
         u32 timeout = h->timeout;
         bool with_ports = false;
+        u8 cidr;
         int ret;
 
         if (unlikely(!tb[IPSET_ATTR_IP] ||
                      !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
-                     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
                 return -IPSET_ERR_PROTOCOL;
 
         if (tb[IPSET_ATTR_LINENO])
@@ -198,9 +227,10 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *tb[],
                 return ret;
 
         if (tb[IPSET_ATTR_CIDR]) {
-                data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
-                if (!data.cidr)
+                cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+                if (!cidr || cidr > HOST_MASK)
                         return -IPSET_ERR_INVALID_CIDR;
+                data.cidr = cidr - 1;
         }
 
         if (tb[IPSET_ATTR_PORT])
@@ -227,8 +257,15 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *tb[],
         }
 
         with_ports = with_ports && tb[IPSET_ATTR_PORT_TO];
+
+        if (tb[IPSET_ATTR_CADT_FLAGS] && adt == IPSET_ADD) {
+                u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
+                if (cadt_flags & IPSET_FLAG_NOMATCH)
+                        flags |= (cadt_flags << 16);
+        }
+
         if (adt == IPSET_TEST || !(with_ports || tb[IPSET_ATTR_IP_TO])) {
-                data.ip = htonl(ip & ip_set_hostmask(data.cidr));
+                data.ip = htonl(ip & ip_set_hostmask(data.cidr + 1));
                 ret = adtfn(set, &data, timeout, flags);
                 return ip_set_eexist(ret, flags) ? 0 : ret;
         }
@@ -248,14 +285,15 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *tb[],
                 if (ip + UINT_MAX == ip_to)
                         return -IPSET_ERR_HASH_RANGE;
         } else {
-                ip_set_mask_from_to(ip, ip_to, data.cidr);
+                ip_set_mask_from_to(ip, ip_to, data.cidr + 1);
         }
 
         if (retried)
                 ip = h->next.ip;
         while (!after(ip, ip_to)) {
                 data.ip = htonl(ip);
-                last = ip_set_range_to_cidr(ip, ip_to, &data.cidr);
+                last = ip_set_range_to_cidr(ip, ip_to, &cidr);
+                data.cidr = cidr - 1;
                 p = retried && ip == h->next.ip ? h->next.port : port;
                 for (; p <= port_to; p++) {
                         data.port = htons(p);
@@ -288,14 +326,16 @@ struct hash_netport6_elem {
         union nf_inet_addr ip;
         __be16 port;
         u8 proto;
-        u8 cidr;
+        u8 cidr:7;
+        u8 nomatch:1;
 };
 
 struct hash_netport6_telem {
         union nf_inet_addr ip;
         __be16 port;
         u8 proto;
-        u8 cidr;
+        u8 cidr:7;
+        u8 nomatch:1;
         unsigned long timeout;
 };
 
@@ -324,6 +364,18 @@ hash_netport6_data_copy(struct hash_netport6_elem *dst,
 }
 
 static inline void
+hash_netport6_data_flags(struct hash_netport6_elem *dst, u32 flags)
+{
+        dst->nomatch = !!(flags & IPSET_FLAG_NOMATCH);
+}
+
+static inline bool
+hash_netport6_data_match(const struct hash_netport6_elem *elem)
+{
+        return !elem->nomatch;
+}
+
+static inline void
 hash_netport6_data_zero_out(struct hash_netport6_elem *elem)
 {
         elem->proto = 0;
@@ -342,17 +394,22 @@ static inline void
 hash_netport6_data_netmask(struct hash_netport6_elem *elem, u8 cidr)
 {
         ip6_netmask(&elem->ip, cidr);
-        elem->cidr = cidr;
+        elem->cidr = cidr - 1;
 }
 
 static bool
 hash_netport6_data_list(struct sk_buff *skb,
                         const struct hash_netport6_elem *data)
 {
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &data->ip);
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
-        NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
-        NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
+        u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
+
+        if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip.in6) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr + 1) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -365,13 +422,17 @@ hash_netport6_data_tlist(struct sk_buff *skb,
 {
         const struct hash_netport6_telem *e =
                 (const struct hash_netport6_telem *)data;
-
-        NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &e->ip);
-        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
-        NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
-        NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
-        NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                      htonl(ip_set_timeout_get(e->timeout)));
+        u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
+
+        if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &e->ip.in6) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr + 1) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
+            nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
+                          htonl(ip_set_timeout_get(e->timeout))) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -400,20 +461,18 @@ hash_netport6_kadt(struct ip_set *set, const struct sk_buff *skb,
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
         struct hash_netport6_elem data = {
-                .cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+                .cidr = h->nets[0].cidr ? h->nets[0].cidr - 1 : HOST_MASK - 1,
         };
 
-        if (data.cidr == 0)
-                return -EINVAL;
         if (adt == IPSET_TEST)
-                data.cidr = HOST_MASK;
+                data.cidr = HOST_MASK - 1;
 
         if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
                                  &data.port, &data.proto))
                 return -EINVAL;
 
         ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
-        ip6_netmask(&data.ip, data.cidr);
+        ip6_netmask(&data.ip, data.cidr + 1);
 
         return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
 }
@@ -424,16 +483,18 @@ hash_netport6_uadt(struct ip_set *set, struct nlattr *tb[],
 {
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
-        struct hash_netport6_elem data = { .cidr = HOST_MASK };
+        struct hash_netport6_elem data = { .cidr = HOST_MASK  - 1 };
         u32 port, port_to;
         u32 timeout = h->timeout;
         bool with_ports = false;
+        u8 cidr;
         int ret;
 
         if (unlikely(!tb[IPSET_ATTR_IP] ||
                      !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
-                     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
+                     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
                 return -IPSET_ERR_PROTOCOL;
         if (unlikely(tb[IPSET_ATTR_IP_TO]))
                 return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
@@ -445,11 +506,13 @@ hash_netport6_uadt(struct ip_set *set, struct nlattr *tb[],
         if (ret)
                 return ret;
 
-        if (tb[IPSET_ATTR_CIDR])
-                data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
-        if (!data.cidr)
-                return -IPSET_ERR_INVALID_CIDR;
-        ip6_netmask(&data.ip, data.cidr);
+        if (tb[IPSET_ATTR_CIDR]) {
+                cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+                if (!cidr || cidr > HOST_MASK)
+                        return -IPSET_ERR_INVALID_CIDR;
+                data.cidr = cidr - 1;
+        }
+        ip6_netmask(&data.ip, data.cidr + 1);
 
         if (tb[IPSET_ATTR_PORT])
                 data.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
@@ -474,6 +537,12 @@ hash_netport6_uadt(struct ip_set *set, struct nlattr *tb[],
                 timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
         }
 
+        if (tb[IPSET_ATTR_CADT_FLAGS] && adt == IPSET_ADD) {
+                u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
+                if (cadt_flags & IPSET_FLAG_NOMATCH)
+                        flags |= (cadt_flags << 16);
+        }
+
         if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
                 ret = adtfn(set, &data, timeout, flags);
                 return ip_set_eexist(ret, flags) ? 0 : ret;
@@ -506,8 +575,9 @@ hash_netport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         struct ip_set_hash *h;
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 hbits;
+        size_t hsize;
 
-        if (!(set->family == AF_INET || set->family == AF_INET6))
+        if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
 
         if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
@@ -526,7 +596,7 @@ hash_netport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 
         h = kzalloc(sizeof(*h)
                     + sizeof(struct ip_set_hash_nets)
-                      * (set->family == AF_INET ? 32 : 128), GFP_KERNEL);
+                      * (set->family == NFPROTO_IPV4 ? 32 : 128), GFP_KERNEL);
         if (!h)
                 return -ENOMEM;
 
@@ -535,9 +605,12 @@ hash_netport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
@@ -549,15 +622,15 @@ hash_netport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         if (tb[IPSET_ATTR_TIMEOUT]) {
                 h->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 
-                set->variant = set->family == AF_INET
+                set->variant = set->family == NFPROTO_IPV4
                         ? &hash_netport4_tvariant : &hash_netport6_tvariant;
 
-                if (set->family == AF_INET)
+                if (set->family == NFPROTO_IPV4)
                         hash_netport4_gc_init(set);
                 else
                         hash_netport6_gc_init(set);
         } else {
-                set->variant = set->family == AF_INET
+                set->variant = set->family == NFPROTO_IPV4
                         ? &hash_netport4_variant : &hash_netport6_variant;
         }
 
@@ -573,10 +646,11 @@ static struct ip_set_type hash_netport_type __read_mostly = {
         .protocol       = IPSET_PROTOCOL,
         .features       = IPSET_TYPE_IP | IPSET_TYPE_PORT,
         .dimension      = IPSET_DIM_TWO,
-        .family         = AF_UNSPEC,
+        .family         = NFPROTO_UNSPEC,
         .revision_min   = 0,
         /*                1        SCTP and UDPLITE support added */
-        .revision_max   = 2,    /* Range as input support for IPv4 added */
+        /*                2,       Range as input support for IPv4 added */
+        .revision_max   = 3,    /* nomatch flag support added */
         .create         = hash_netport_create,
         .create_policy  = {
                 [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
@@ -595,6 +669,7 @@ static struct ip_set_type hash_netport_type __read_mostly = {
                 [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
                 [IPSET_ATTR_LINENO]     = { .type = NLA_U32 },
+                [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
         },
         .me             = THIS_MODULE,
 };
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index 4d10819d462e..6cb1225765f9 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -402,12 +402,13 @@ list_set_head(struct ip_set *set, struct sk_buff *skb)
         nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
         if (!nested)
                 goto nla_put_failure;
-        NLA_PUT_NET32(skb, IPSET_ATTR_SIZE, htonl(map->size));
-        if (with_timeout(map->timeout))
-                NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout));
-        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
-        NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
-                      htonl(sizeof(*map) + map->size * map->dsize));
+        if (nla_put_net32(skb, IPSET_ATTR_SIZE, htonl(map->size)) ||
+            (with_timeout(map->timeout) &&
+             nla_put_net32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout))) ||
+            nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1)) ||
+            nla_put_net32(skb, IPSET_ATTR_MEMSIZE,
+                          htonl(sizeof(*map) + map->size * map->dsize)))
+                goto nla_put_failure;
         ipset_nest_end(skb, nested);
 
         return 0;
@@ -442,13 +443,15 @@ list_set_list(const struct ip_set *set,
                         } else
                                 goto nla_put_failure;
                 }
-                NLA_PUT_STRING(skb, IPSET_ATTR_NAME,
-                               ip_set_name_byindex(e->id));
+                if (nla_put_string(skb, IPSET_ATTR_NAME,
+                                   ip_set_name_byindex(e->id)))
+                        goto nla_put_failure;
                 if (with_timeout(map->timeout)) {
                         const struct set_telem *te =
                                 (const struct set_telem *) e;
-                        NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-                                      htonl(ip_set_timeout_get(te->timeout)));
+                        __be32 to = htonl(ip_set_timeout_get(te->timeout));
+                        if (nla_put_net32(skb, IPSET_ATTR_TIMEOUT, to))
+                                goto nla_put_failure;
                 }
                 ipset_nest_end(skb, nested);
         }
@@ -575,7 +578,7 @@ static struct ip_set_type list_set_type __read_mostly = {
         .protocol       = IPSET_PROTOCOL,
         .features       = IPSET_TYPE_NAME | IPSET_DUMP_LAST,
         .dimension      = IPSET_DIM_ONE,
-        .family         = AF_UNSPEC,
+        .family         = NFPROTO_UNSPEC,
         .revision_min   = 0,
         .revision_max   = 0,
         .create         = list_set_create,
diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
index fe6cb4304d72..64f9e8f13207 100644
--- a/net/netfilter/ipvs/ip_vs_app.c
+++ b/net/netfilter/ipvs/ip_vs_app.c
@@ -31,7 +31,6 @@
 #include <net/net_namespace.h>
 #include <net/protocol.h>
 #include <net/tcp.h>
-#include <asm/system.h>
 #include <linux/stat.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
@@ -314,7 +313,7 @@ vs_fix_ack_seq(const struct ip_vs_seq *vseq, struct tcphdr *th)
  *      Assumes already checked proto==IPPROTO_TCP and diff!=0.
  */
 static inline void vs_seq_update(struct ip_vs_conn *cp, struct ip_vs_seq *vseq,
-                                 unsigned flag, __u32 seq, int diff)
+                                 unsigned int flag, __u32 seq, int diff)
 {
         /* spinlock is to keep updating cp->flags atomic */
         spin_lock(&cp->lock);
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 29fa5badde75..1548df9a7524 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -86,42 +86,42 @@ struct ip_vs_aligned_lock
 static struct ip_vs_aligned_lock
 __ip_vs_conntbl_lock_array[CT_LOCKARRAY_SIZE] __cacheline_aligned;
 
-static inline void ct_read_lock(unsigned key)
+static inline void ct_read_lock(unsigned int key)
 {
         read_lock(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
 }
 
-static inline void ct_read_unlock(unsigned key)
+static inline void ct_read_unlock(unsigned int key)
 {
         read_unlock(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
 }
 
-static inline void ct_write_lock(unsigned key)
+static inline void ct_write_lock(unsigned int key)
 {
         write_lock(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
 }
 
-static inline void ct_write_unlock(unsigned key)
+static inline void ct_write_unlock(unsigned int key)
 {
         write_unlock(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
 }
 
-static inline void ct_read_lock_bh(unsigned key)
+static inline void ct_read_lock_bh(unsigned int key)
 {
         read_lock_bh(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
 }
 
-static inline void ct_read_unlock_bh(unsigned key)
+static inline void ct_read_unlock_bh(unsigned int key)
 {
         read_unlock_bh(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
 }
 
-static inline void ct_write_lock_bh(unsigned key)
+static inline void ct_write_lock_bh(unsigned int key)
 {
         write_lock_bh(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
 }
 
-static inline void ct_write_unlock_bh(unsigned key)
+static inline void ct_write_unlock_bh(unsigned int key)
 {
         write_unlock_bh(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
 }
@@ -130,7 +130,7 @@ static inline void ct_write_unlock_bh(unsigned key)
 /*
  *      Returns hash value for IPVS connection entry
  */
-static unsigned int ip_vs_conn_hashkey(struct net *net, int af, unsigned proto,
+static unsigned int ip_vs_conn_hashkey(struct net *net, int af, unsigned int proto,
                                        const union nf_inet_addr *addr,
                                        __be16 port)
 {
@@ -188,7 +188,7 @@ static unsigned int ip_vs_conn_hashkey_conn(const struct ip_vs_conn *cp)
  */
 static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
 {
-        unsigned hash;
+        unsigned int hash;
         int ret;
 
         if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
@@ -224,7 +224,7 @@ static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
  */
 static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp)
 {
-        unsigned hash;
+        unsigned int hash;
         int ret;
 
         /* unhash it and decrease its reference counter */
@@ -257,7 +257,7 @@ static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp)
 static inline struct ip_vs_conn *
 __ip_vs_conn_in_get(const struct ip_vs_conn_param *p)
 {
-        unsigned hash;
+        unsigned int hash;
         struct ip_vs_conn *cp;
         struct hlist_node *n;
 
@@ -344,7 +344,7 @@ EXPORT_SYMBOL_GPL(ip_vs_conn_in_get_proto);
 /* Get reference to connection template */
 struct ip_vs_conn *ip_vs_ct_in_get(const struct ip_vs_conn_param *p)
 {
-        unsigned hash;
+        unsigned int hash;
         struct ip_vs_conn *cp;
         struct hlist_node *n;
 
@@ -394,7 +394,7 @@ struct ip_vs_conn *ip_vs_ct_in_get(const struct ip_vs_conn_param *p)
  *      p->vaddr, p->vport: pkt dest address (foreign host) */
 struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p)
 {
-        unsigned hash;
+        unsigned int hash;
         struct ip_vs_conn *cp, *ret=NULL;
         struct hlist_node *n;
 
@@ -548,6 +548,7 @@ static inline void
 ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
 {
         unsigned int conn_flags;
+        __u32 flags;
 
         /* if dest is NULL, then return directly */
         if (!dest)
@@ -559,17 +560,19 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
         conn_flags = atomic_read(&dest->conn_flags);
         if (cp->protocol != IPPROTO_UDP)
                 conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
+        flags = cp->flags;
         /* Bind with the destination and its corresponding transmitter */
-        if (cp->flags & IP_VS_CONN_F_SYNC) {
+        if (flags & IP_VS_CONN_F_SYNC) {
                 /* if the connection is not template and is created
                  * by sync, preserve the activity flag.
                  */
-                if (!(cp->flags & IP_VS_CONN_F_TEMPLATE))
+                if (!(flags & IP_VS_CONN_F_TEMPLATE))
                         conn_flags &= ~IP_VS_CONN_F_INACTIVE;
                 /* connections inherit forwarding method from dest */
-                cp->flags &= ~IP_VS_CONN_F_FWD_MASK;
+                flags &= ~(IP_VS_CONN_F_FWD_MASK | IP_VS_CONN_F_NOOUTPUT);
         }
-        cp->flags |= conn_flags;
+        flags |= conn_flags;
+        cp->flags = flags;
         cp->dest = dest;
 
         IP_VS_DBG_BUF(7, "Bind-dest %s c:%s:%d v:%s:%d "
@@ -584,12 +587,12 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
                       atomic_read(&dest->refcnt));
 
         /* Update the connection counters */
-        if (!(cp->flags & IP_VS_CONN_F_TEMPLATE)) {
-                /* It is a normal connection, so increase the inactive
-                   connection counter because it is in TCP SYNRECV
-                   state (inactive) or other protocol inacive state */
-                if ((cp->flags & IP_VS_CONN_F_SYNC) &&
-                    (!(cp->flags & IP_VS_CONN_F_INACTIVE)))
+        if (!(flags & IP_VS_CONN_F_TEMPLATE)) {
+                /* It is a normal connection, so modify the counters
+                 * according to the flags, later the protocol can
+                 * update them on state change
+                 */
+                if (!(flags & IP_VS_CONN_F_INACTIVE))
                         atomic_inc(&dest->activeconns);
                 else
                         atomic_inc(&dest->inactconns);
@@ -613,14 +616,40 @@ struct ip_vs_dest *ip_vs_try_bind_dest(struct ip_vs_conn *cp)
 {
         struct ip_vs_dest *dest;
 
-        if ((cp) && (!cp->dest)) {
-                dest = ip_vs_find_dest(ip_vs_conn_net(cp), cp->af, &cp->daddr,
-                                       cp->dport, &cp->vaddr, cp->vport,
-                                       cp->protocol, cp->fwmark, cp->flags);
+        dest = ip_vs_find_dest(ip_vs_conn_net(cp), cp->af, &cp->daddr,
+                               cp->dport, &cp->vaddr, cp->vport,
+                               cp->protocol, cp->fwmark, cp->flags);
+        if (dest) {
+                struct ip_vs_proto_data *pd;
+
+                spin_lock(&cp->lock);
+                if (cp->dest) {
+                        spin_unlock(&cp->lock);
+                        return dest;
+                }
+
+                /* Applications work depending on the forwarding method
+                 * but better to reassign them always when binding dest */
+                if (cp->app)
+                        ip_vs_unbind_app(cp);
+
                 ip_vs_bind_dest(cp, dest);
-                return dest;
-        } else
-                return NULL;
+                spin_unlock(&cp->lock);
+
+                /* Update its packet transmitter */
+                cp->packet_xmit = NULL;
+#ifdef CONFIG_IP_VS_IPV6
+                if (cp->af == AF_INET6)
+                        ip_vs_bind_xmit_v6(cp);
+                else
+#endif
+                        ip_vs_bind_xmit(cp);
+
+                pd = ip_vs_proto_data_get(ip_vs_conn_net(cp), cp->protocol);
+                if (pd && atomic_read(&pd->appcnt))
+                        ip_vs_bind_app(cp, pd->pp);
+        }
+        return dest;
 }
 
 
@@ -743,7 +772,8 @@ int ip_vs_check_template(struct ip_vs_conn *ct)
 static void ip_vs_conn_expire(unsigned long data)
 {
         struct ip_vs_conn *cp = (struct ip_vs_conn *)data;
-        struct netns_ipvs *ipvs = net_ipvs(ip_vs_conn_net(cp));
+        struct net *net = ip_vs_conn_net(cp);
+        struct netns_ipvs *ipvs = net_ipvs(net);
 
         cp->timeout = 60*HZ;
 
@@ -808,6 +838,9 @@ static void ip_vs_conn_expire(unsigned long data)
                   atomic_read(&cp->refcnt)-1,
                   atomic_read(&cp->n_control));
 
+        if (ipvs->sync_state & IP_VS_STATE_MASTER)
+                ip_vs_sync_conn(net, cp, sysctl_sync_threshold(ipvs));
+
         ip_vs_conn_put(cp);
 }
 
@@ -824,7 +857,7 @@ void ip_vs_conn_expire_now(struct ip_vs_conn *cp)
  */
 struct ip_vs_conn *
 ip_vs_conn_new(const struct ip_vs_conn_param *p,
-               const union nf_inet_addr *daddr, __be16 dport, unsigned flags,
+               const union nf_inet_addr *daddr, __be16 dport, unsigned int flags,
                struct ip_vs_dest *dest, __u32 fwmark)
 {
         struct ip_vs_conn *cp;
@@ -881,6 +914,7 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p,
         /* Set its state and timeout */
         cp->state = 0;
         cp->timeout = 3*HZ;
+        cp->sync_endtime = jiffies & ~3UL;
 
         /* Bind its packet transmitter */
 #ifdef CONFIG_IP_VS_IPV6
@@ -1057,7 +1091,7 @@ static const struct file_operations ip_vs_conn_fops = {
         .release = seq_release_net,
 };
 
-static const char *ip_vs_origin_name(unsigned flags)
+static const char *ip_vs_origin_name(unsigned int flags)
 {
         if (flags & IP_VS_CONN_F_SYNC)
                 return "SYNC";
@@ -1169,7 +1203,7 @@ void ip_vs_random_dropentry(struct net *net)
          * Randomly scan 1/32 of the whole table every second
          */
         for (idx = 0; idx < (ip_vs_conn_tab_size>>5); idx++) {
-                unsigned hash = net_random() & ip_vs_conn_tab_mask;
+                unsigned int hash = net_random() & ip_vs_conn_tab_mask;
                 struct hlist_node *n;
 
                 /*
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 2555816e7788..a54b018c6eea 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -80,7 +80,7 @@ static atomic_t ipvs_netns_cnt = ATOMIC_INIT(0);
 #define icmp_id(icmph)          (((icmph)->un).echo.id)
 #define icmpv6_id(icmph)        (icmph->icmp6_dataun.u_echo.identifier)
 
-const char *ip_vs_proto_name(unsigned proto)
+const char *ip_vs_proto_name(unsigned int proto)
 {
         static char buf[20];
 
@@ -1613,34 +1613,8 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
         else
                 pkts = atomic_add_return(1, &cp->in_pkts);
 
-        if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
-            cp->protocol == IPPROTO_SCTP) {
-                if ((cp->state == IP_VS_SCTP_S_ESTABLISHED &&
-                        (pkts % sysctl_sync_period(ipvs)
-                         == sysctl_sync_threshold(ipvs))) ||
-                                (cp->old_state != cp->state &&
-                                 ((cp->state == IP_VS_SCTP_S_CLOSED) ||
-                                  (cp->state == IP_VS_SCTP_S_SHUT_ACK_CLI) ||
-                                  (cp->state == IP_VS_SCTP_S_SHUT_ACK_SER)))) {
-                        ip_vs_sync_conn(net, cp);
-                        goto out;
-                }
-        }
-
-        /* Keep this block last: TCP and others with pp->num_states <= 1 */
-        else if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
-            (((cp->protocol != IPPROTO_TCP ||
-               cp->state == IP_VS_TCP_S_ESTABLISHED) &&
-              (pkts % sysctl_sync_period(ipvs)
-               == sysctl_sync_threshold(ipvs))) ||
-             ((cp->protocol == IPPROTO_TCP) && (cp->old_state != cp->state) &&
-              ((cp->state == IP_VS_TCP_S_FIN_WAIT) ||
-               (cp->state == IP_VS_TCP_S_CLOSE) ||
-               (cp->state == IP_VS_TCP_S_CLOSE_WAIT) ||
-               (cp->state == IP_VS_TCP_S_TIME_WAIT)))))
-                ip_vs_sync_conn(net, cp);
-out:
-        cp->old_state = cp->state;
+        if (ipvs->sync_state & IP_VS_STATE_MASTER)
+                ip_vs_sync_conn(net, cp, pkts);
 
         ip_vs_conn_put(cp);
         return ret;
@@ -1924,6 +1898,7 @@ protocol_fail:
 control_fail:
         ip_vs_estimator_net_cleanup(net);
 estimator_fail:
+        net->ipvs = NULL;
         return -ENOMEM;
 }
 
@@ -1936,6 +1911,7 @@ static void __net_exit __ip_vs_cleanup(struct net *net)
         ip_vs_control_net_cleanup(net);
         ip_vs_estimator_net_cleanup(net);
         IP_VS_DBG(2, "ipvs netns %d released\n", net_ipvs(net)->gen);
+        net->ipvs = NULL;
 }
 
 static void __net_exit __ip_vs_dev_cleanup(struct net *net)
@@ -1993,10 +1969,18 @@ static int __init ip_vs_init(void)
                 goto cleanup_dev;
         }
 
+        ret = ip_vs_register_nl_ioctl();
+        if (ret < 0) {
+                pr_err("can't register netlink/ioctl.\n");
+                goto cleanup_hooks;
+        }
+
         pr_info("ipvs loaded.\n");
 
         return ret;
 
+cleanup_hooks:
+        nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
 cleanup_dev:
         unregister_pernet_device(&ipvs_core_dev_ops);
 cleanup_sub:
@@ -2012,6 +1996,7 @@ exit:
 
 static void __exit ip_vs_cleanup(void)
 {
+        ip_vs_unregister_nl_ioctl();
         nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
         unregister_pernet_device(&ipvs_core_dev_ops);
         unregister_pernet_subsys(&ipvs_core_ops);       /* free ip_vs struct */
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index b3afe189af61..dd811b8dd97c 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -265,11 +265,11 @@ static struct list_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
 /*
  *      Returns hash value for virtual service
  */
-static inline unsigned
-ip_vs_svc_hashkey(struct net *net, int af, unsigned proto,
+static inline unsigned int
+ip_vs_svc_hashkey(struct net *net, int af, unsigned int proto,
                   const union nf_inet_addr *addr, __be16 port)
 {
-        register unsigned porth = ntohs(port);
+        register unsigned int porth = ntohs(port);
         __be32 addr_fold = addr->ip;
 
 #ifdef CONFIG_IP_VS_IPV6
@@ -286,7 +286,7 @@ ip_vs_svc_hashkey(struct net *net, int af, unsigned proto,
 /*
  *      Returns hash value of fwmark for virtual service lookup
  */
-static inline unsigned ip_vs_svc_fwm_hashkey(struct net *net, __u32 fwmark)
+static inline unsigned int ip_vs_svc_fwm_hashkey(struct net *net, __u32 fwmark)
 {
         return (((size_t)net>>8) ^ fwmark) & IP_VS_SVC_TAB_MASK;
 }
@@ -298,7 +298,7 @@ static inline unsigned ip_vs_svc_fwm_hashkey(struct net *net, __u32 fwmark)
  */
 static int ip_vs_svc_hash(struct ip_vs_service *svc)
 {
-        unsigned hash;
+        unsigned int hash;
 
         if (svc->flags & IP_VS_SVC_F_HASHED) {
                 pr_err("%s(): request for already hashed, called from %pF\n",
@@ -361,7 +361,7 @@ static inline struct ip_vs_service *
 __ip_vs_service_find(struct net *net, int af, __u16 protocol,
                      const union nf_inet_addr *vaddr, __be16 vport)
 {
-        unsigned hash;
+        unsigned int hash;
         struct ip_vs_service *svc;
 
         /* Check for "full" addressed entries */
@@ -388,7 +388,7 @@ __ip_vs_service_find(struct net *net, int af, __u16 protocol,
 static inline struct ip_vs_service *
 __ip_vs_svc_fwm_find(struct net *net, int af, __u32 fwmark)
 {
-        unsigned hash;
+        unsigned int hash;
         struct ip_vs_service *svc;
 
         /* Check for fwmark addressed entries */
@@ -489,11 +489,11 @@ __ip_vs_unbind_svc(struct ip_vs_dest *dest)
 /*
  *      Returns hash value for real service
  */
-static inline unsigned ip_vs_rs_hashkey(int af,
+static inline unsigned int ip_vs_rs_hashkey(int af,
                                             const union nf_inet_addr *addr,
                                             __be16 port)
 {
-        register unsigned porth = ntohs(port);
+        register unsigned int porth = ntohs(port);
         __be32 addr_fold = addr->ip;
 
 #ifdef CONFIG_IP_VS_IPV6
@@ -512,7 +512,7 @@ static inline unsigned ip_vs_rs_hashkey(int af,
  */
 static int ip_vs_rs_hash(struct netns_ipvs *ipvs, struct ip_vs_dest *dest)
 {
-        unsigned hash;
+        unsigned int hash;
 
         if (!list_empty(&dest->d_list)) {
                 return 0;
@@ -555,7 +555,7 @@ ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
                           __be16 dport)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
-        unsigned hash;
+        unsigned int hash;
         struct ip_vs_dest *dest;
 
         /*
@@ -842,7 +842,7 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
                struct ip_vs_dest **dest_p)
 {
         struct ip_vs_dest *dest;
-        unsigned atype;
+        unsigned int atype;
 
         EnterFunction(2);
 
@@ -1599,6 +1599,10 @@ static int ip_vs_zero_all(struct net *net)
 }
 
 #ifdef CONFIG_SYSCTL
+
+static int zero;
+static int three = 3;
+
 static int
 proc_do_defense_mode(ctl_table *table, int write,
                      void __user *buffer, size_t *lenp, loff_t *ppos)
@@ -1632,7 +1636,8 @@ proc_do_sync_threshold(ctl_table *table, int write,
         memcpy(val, valp, sizeof(val));
 
         rc = proc_dointvec(table, write, buffer, lenp, ppos);
-        if (write && (valp[0] < 0 || valp[1] < 0 || valp[0] >= valp[1])) {
+        if (write && (valp[0] < 0 || valp[1] < 0 ||
+            (valp[0] >= valp[1] && valp[1]))) {
                 /* Restore the correct value */
                 memcpy(valp, val, sizeof(val));
         }
@@ -1652,9 +1657,24 @@ proc_do_sync_mode(ctl_table *table, int write,
                 if ((*valp < 0) || (*valp > 1)) {
                         /* Restore the correct value */
                         *valp = val;
-                } else {
-                        struct net *net = current->nsproxy->net_ns;
-                        ip_vs_sync_switch_mode(net, val);
+                }
+        }
+        return rc;
+}
+
+static int
+proc_do_sync_ports(ctl_table *table, int write,
+                   void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        int *valp = table->data;
+        int val = *valp;
+        int rc;
+
+        rc = proc_dointvec(table, write, buffer, lenp, ppos);
+        if (write && (*valp != val)) {
+                if (*valp < 1 || !is_power_of_2(*valp)) {
+                        /* Restore the correct value */
+                        *valp = val;
                 }
         }
         return rc;
@@ -1718,6 +1738,24 @@ static struct ctl_table vs_vars[] = {
                 .proc_handler   = &proc_do_sync_mode,
         },
         {
+                .procname       = "sync_ports",
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_do_sync_ports,
+        },
+        {
+                .procname       = "sync_qlen_max",
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {
+                .procname       = "sync_sock_size",
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {
                 .procname       = "cache_bypass",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
@@ -1743,6 +1781,20 @@ static struct ctl_table vs_vars[] = {
                 .proc_handler   = proc_do_sync_threshold,
         },
         {
+                .procname       = "sync_refresh_period",
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_jiffies,
+        },
+        {
+                .procname       = "sync_retries",
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &three,
+        },
+        {
                 .procname       = "nat_icmp_send",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
@@ -1846,13 +1898,6 @@ static struct ctl_table vs_vars[] = {
         { }
 };
 
-const struct ctl_path net_vs_ctl_path[] = {
-        { .procname = "net", },
-        { .procname = "ipv4", },
-        { .procname = "vs", },
-        { }
-};
-EXPORT_SYMBOL_GPL(net_vs_ctl_path);
 #endif
 
 #ifdef CONFIG_PROC_FS
@@ -1867,7 +1912,7 @@ struct ip_vs_iter {
  *      Write the contents of the VS rule table to a PROCfs file.
  *      (It is kept just for backward compatibility)
  */
-static inline const char *ip_vs_fwd_name(unsigned flags)
+static inline const char *ip_vs_fwd_name(unsigned int flags)
 {
         switch (flags & IP_VS_CONN_F_FWD_MASK) {
         case IP_VS_CONN_F_LOCALNODE:
@@ -2816,17 +2861,17 @@ static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
 
         ip_vs_copy_stats(&ustats, stats);
 
-        NLA_PUT_U32(skb, IPVS_STATS_ATTR_CONNS, ustats.conns);
-        NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPKTS, ustats.inpkts);
-        NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPKTS, ustats.outpkts);
-        NLA_PUT_U64(skb, IPVS_STATS_ATTR_INBYTES, ustats.inbytes);
-        NLA_PUT_U64(skb, IPVS_STATS_ATTR_OUTBYTES, ustats.outbytes);
-        NLA_PUT_U32(skb, IPVS_STATS_ATTR_CPS, ustats.cps);
-        NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPPS, ustats.inpps);
-        NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPPS, ustats.outpps);
-        NLA_PUT_U32(skb, IPVS_STATS_ATTR_INBPS, ustats.inbps);
-        NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTBPS, ustats.outbps);
-
+        if (nla_put_u32(skb, IPVS_STATS_ATTR_CONNS, ustats.conns) ||
+            nla_put_u32(skb, IPVS_STATS_ATTR_INPKTS, ustats.inpkts) ||
+            nla_put_u32(skb, IPVS_STATS_ATTR_OUTPKTS, ustats.outpkts) ||
+            nla_put_u64(skb, IPVS_STATS_ATTR_INBYTES, ustats.inbytes) ||
+            nla_put_u64(skb, IPVS_STATS_ATTR_OUTBYTES, ustats.outbytes) ||
+            nla_put_u32(skb, IPVS_STATS_ATTR_CPS, ustats.cps) ||
+            nla_put_u32(skb, IPVS_STATS_ATTR_INPPS, ustats.inpps) ||
+            nla_put_u32(skb, IPVS_STATS_ATTR_OUTPPS, ustats.outpps) ||
+            nla_put_u32(skb, IPVS_STATS_ATTR_INBPS, ustats.inbps) ||
+            nla_put_u32(skb, IPVS_STATS_ATTR_OUTBPS, ustats.outbps))
+                goto nla_put_failure;
         nla_nest_end(skb, nl_stats);
 
         return 0;
@@ -2847,23 +2892,25 @@ static int ip_vs_genl_fill_service(struct sk_buff *skb,
         if (!nl_service)
                 return -EMSGSIZE;
 
-        NLA_PUT_U16(skb, IPVS_SVC_ATTR_AF, svc->af);
-
+        if (nla_put_u16(skb, IPVS_SVC_ATTR_AF, svc->af))
+                goto nla_put_failure;
         if (svc->fwmark) {
-                NLA_PUT_U32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark);
+                if (nla_put_u32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark))
+                        goto nla_put_failure;
         } else {
-                NLA_PUT_U16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol);
-                NLA_PUT(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr);
-                NLA_PUT_U16(skb, IPVS_SVC_ATTR_PORT, svc->port);
+                if (nla_put_u16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol) ||
+                    nla_put(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr) ||
+                    nla_put_u16(skb, IPVS_SVC_ATTR_PORT, svc->port))
+                        goto nla_put_failure;
         }
 
-        NLA_PUT_STRING(skb, IPVS_SVC_ATTR_SCHED_NAME, svc->scheduler->name);
-        if (svc->pe)
-                NLA_PUT_STRING(skb, IPVS_SVC_ATTR_PE_NAME, svc->pe->name);
-        NLA_PUT(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags);
-        NLA_PUT_U32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ);
-        NLA_PUT_U32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask);
-
+        if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, svc->scheduler->name) ||
+            (svc->pe &&
+             nla_put_string(skb, IPVS_SVC_ATTR_PE_NAME, svc->pe->name)) ||
+            nla_put(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags) ||
+            nla_put_u32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ) ||
+            nla_put_u32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask))
+                goto nla_put_failure;
         if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &svc->stats))
                 goto nla_put_failure;
 
@@ -3038,21 +3085,22 @@ static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
         if (!nl_dest)
                 return -EMSGSIZE;
 
-        NLA_PUT(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr);
-        NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
-
-        NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
-                    atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
-        NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
-        NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
-        NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
-        NLA_PUT_U32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
-                    atomic_read(&dest->activeconns));
-        NLA_PUT_U32(skb, IPVS_DEST_ATTR_INACT_CONNS,
-                    atomic_read(&dest->inactconns));
-        NLA_PUT_U32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
-                    atomic_read(&dest->persistconns));
-
+        if (nla_put(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr) ||
+            nla_put_u16(skb, IPVS_DEST_ATTR_PORT, dest->port) ||
+            nla_put_u32(skb, IPVS_DEST_ATTR_FWD_METHOD,
+                        (atomic_read(&dest->conn_flags) &
+                         IP_VS_CONN_F_FWD_MASK)) ||
+            nla_put_u32(skb, IPVS_DEST_ATTR_WEIGHT,
+                        atomic_read(&dest->weight)) ||
+            nla_put_u32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold) ||
+            nla_put_u32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold) ||
+            nla_put_u32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
+                        atomic_read(&dest->activeconns)) ||
+            nla_put_u32(skb, IPVS_DEST_ATTR_INACT_CONNS,
+                        atomic_read(&dest->inactconns)) ||
+            nla_put_u32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
+                        atomic_read(&dest->persistconns)))
+                goto nla_put_failure;
         if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &dest->stats))
                 goto nla_put_failure;
 
@@ -3181,10 +3229,10 @@ static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __be32 state,
         if (!nl_daemon)
                 return -EMSGSIZE;
 
-        NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_STATE, state);
-        NLA_PUT_STRING(skb, IPVS_DAEMON_ATTR_MCAST_IFN, mcast_ifn);
-        NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_SYNC_ID, syncid);
-
+        if (nla_put_u32(skb, IPVS_DAEMON_ATTR_STATE, state) ||
+            nla_put_string(skb, IPVS_DAEMON_ATTR_MCAST_IFN, mcast_ifn) ||
+            nla_put_u32(skb, IPVS_DAEMON_ATTR_SYNC_ID, syncid))
+                goto nla_put_failure;
         nla_nest_end(skb, nl_daemon);
 
         return 0;
@@ -3473,21 +3521,26 @@ static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
 
                 __ip_vs_get_timeouts(net, &t);
 #ifdef CONFIG_IP_VS_PROTO_TCP
-                NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP, t.tcp_timeout);
-                NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
-                            t.tcp_fin_timeout);
+                if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP,
+                                t.tcp_timeout) ||
+                    nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
+                                t.tcp_fin_timeout))
+                        goto nla_put_failure;
 #endif
 #ifdef CONFIG_IP_VS_PROTO_UDP
-                NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout);
+                if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout))
+                        goto nla_put_failure;
 #endif
 
                 break;
         }
 
         case IPVS_CMD_GET_INFO:
-                NLA_PUT_U32(msg, IPVS_INFO_ATTR_VERSION, IP_VS_VERSION_CODE);
-                NLA_PUT_U32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
-                            ip_vs_conn_tab_size);
+                if (nla_put_u32(msg, IPVS_INFO_ATTR_VERSION,
+                                IP_VS_VERSION_CODE) ||
+                    nla_put_u32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
+                                ip_vs_conn_tab_size))
+                        goto nla_put_failure;
                 break;
         }
 
@@ -3654,6 +3707,12 @@ int __net_init ip_vs_control_net_init_sysctl(struct net *net)
         tbl[idx++].data = &ipvs->sysctl_snat_reroute;
         ipvs->sysctl_sync_ver = 1;
         tbl[idx++].data = &ipvs->sysctl_sync_ver;
+        ipvs->sysctl_sync_ports = 1;
+        tbl[idx++].data = &ipvs->sysctl_sync_ports;
+        ipvs->sysctl_sync_qlen_max = nr_free_buffer_pages() / 32;
+        tbl[idx++].data = &ipvs->sysctl_sync_qlen_max;
+        ipvs->sysctl_sync_sock_size = 0;
+        tbl[idx++].data = &ipvs->sysctl_sync_sock_size;
         tbl[idx++].data = &ipvs->sysctl_cache_bypass;
         tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn;
         tbl[idx++].data = &ipvs->sysctl_expire_quiescent_template;
@@ -3661,11 +3720,14 @@ int __net_init ip_vs_control_net_init_sysctl(struct net *net)
         ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
         tbl[idx].data = &ipvs->sysctl_sync_threshold;
         tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold);
+        ipvs->sysctl_sync_refresh_period = DEFAULT_SYNC_REFRESH_PERIOD;
+        tbl[idx++].data = &ipvs->sysctl_sync_refresh_period;
+        ipvs->sysctl_sync_retries = clamp_t(int, DEFAULT_SYNC_RETRIES, 0, 3);
+        tbl[idx++].data = &ipvs->sysctl_sync_retries;
         tbl[idx++].data = &ipvs->sysctl_nat_icmp_send;
 
 
-        ipvs->sysctl_hdr = register_net_sysctl_table(net, net_vs_ctl_path,
-                                                     tbl);
+        ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
         if (ipvs->sysctl_hdr == NULL) {
                 if (!net_eq(net, &init_net))
                         kfree(tbl);
@@ -3680,7 +3742,7 @@ int __net_init ip_vs_control_net_init_sysctl(struct net *net)
         return 0;
 }
 
-void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net)
+void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
@@ -3692,7 +3754,7 @@ void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net)
 #else
 
 int __net_init ip_vs_control_net_init_sysctl(struct net *net) { return 0; }
-void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net) { }
+void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net) { }
 
 #endif
 
@@ -3750,21 +3812,10 @@ void __net_exit ip_vs_control_net_cleanup(struct net *net)
         free_percpu(ipvs->tot_stats.cpustats);
 }
 
-int __init ip_vs_control_init(void)
+int __init ip_vs_register_nl_ioctl(void)
 {
-        int idx;
         int ret;
 
-        EnterFunction(2);
-
-        /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
-        for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++)  {
-                INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
-                INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
-        }
-
-        smp_wmb();      /* Do we really need it now ? */
-
         ret = nf_register_sockopt(&ip_vs_sockopts);
         if (ret) {
                 pr_err("cannot register sockopt.\n");
@@ -3776,28 +3827,47 @@ int __init ip_vs_control_init(void)
                 pr_err("cannot register Generic Netlink interface.\n");
                 goto err_genl;
         }
-
-        ret = register_netdevice_notifier(&ip_vs_dst_notifier);
-        if (ret < 0)
-                goto err_notf;
-
-        LeaveFunction(2);
         return 0;
 
-err_notf:
-        ip_vs_genl_unregister();
 err_genl:
         nf_unregister_sockopt(&ip_vs_sockopts);
 err_sock:
         return ret;
 }
 
+void ip_vs_unregister_nl_ioctl(void)
+{
+        ip_vs_genl_unregister();
+        nf_unregister_sockopt(&ip_vs_sockopts);
+}
+
+int __init ip_vs_control_init(void)
+{
+        int idx;
+        int ret;
+
+        EnterFunction(2);
+
+        /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
+        for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
+                INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
+                INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
+        }
+
+        smp_wmb();      /* Do we really need it now ? */
+
+        ret = register_netdevice_notifier(&ip_vs_dst_notifier);
+        if (ret < 0)
+                return ret;
+
+        LeaveFunction(2);
+        return 0;
+}
+
 
 void ip_vs_control_cleanup(void)
 {
         EnterFunction(2);
         unregister_netdevice_notifier(&ip_vs_dst_notifier);
-        ip_vs_genl_unregister();
-        nf_unregister_sockopt(&ip_vs_sockopts);
         LeaveFunction(2);
 }
diff --git a/net/netfilter/ipvs/ip_vs_dh.c b/net/netfilter/ipvs/ip_vs_dh.c
index 1c269e56200a..8b7dca9ea422 100644
--- a/net/netfilter/ipvs/ip_vs_dh.c
+++ b/net/netfilter/ipvs/ip_vs_dh.c
@@ -68,7 +68,7 @@ struct ip_vs_dh_bucket {
 /*
  *      Returns hash value for IPVS DH entry
  */
-static inline unsigned ip_vs_dh_hashkey(int af, const union nf_inet_addr *addr)
+static inline unsigned int ip_vs_dh_hashkey(int af, const union nf_inet_addr *addr)
 {
         __be32 addr_fold = addr->ip;
 
@@ -149,7 +149,7 @@ static int ip_vs_dh_init_svc(struct ip_vs_service *svc)
 
         /* allocate the DH table for this service */
         tbl = kmalloc(sizeof(struct ip_vs_dh_bucket)*IP_VS_DH_TAB_SIZE,
-                      GFP_ATOMIC);
+                      GFP_KERNEL);
         if (tbl == NULL)
                 return -ENOMEM;
 
diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index 538d74ee4f68..b20b29c903ef 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -177,7 +177,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
         __be16 port;
         struct ip_vs_conn *n_cp;
         char buf[24];           /* xxx.xxx.xxx.xxx,ppp,ppp\000 */
-        unsigned buf_len;
+        unsigned int buf_len;
         int ret = 0;
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct;
@@ -439,6 +439,8 @@ static int __net_init __ip_vs_ftp_init(struct net *net)
         struct ip_vs_app *app;
         struct netns_ipvs *ipvs = net_ipvs(net);
 
+        if (!ipvs)
+                return -ENOENT;
         app = kmemdup(&ip_vs_ftp, sizeof(struct ip_vs_app), GFP_KERNEL);
         if (!app)
                 return -ENOMEM;
@@ -483,7 +485,7 @@ static struct pernet_operations ip_vs_ftp_ops = {
         .exit = __ip_vs_ftp_exit,
 };
 
-int __init ip_vs_ftp_init(void)
+static int __init ip_vs_ftp_init(void)
 {
         int rv;
 
diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
index 0f16283fd058..df646ccf08a7 100644
--- a/net/netfilter/ipvs/ip_vs_lblc.c
+++ b/net/netfilter/ipvs/ip_vs_lblc.c
@@ -142,7 +142,7 @@ static inline void ip_vs_lblc_free(struct ip_vs_lblc_entry *en)
 /*
  *      Returns hash value for IPVS LBLC entry
  */
-static inline unsigned
+static inline unsigned int
 ip_vs_lblc_hashkey(int af, const union nf_inet_addr *addr)
 {
         __be32 addr_fold = addr->ip;
@@ -163,7 +163,7 @@ ip_vs_lblc_hashkey(int af, const union nf_inet_addr *addr)
 static void
 ip_vs_lblc_hash(struct ip_vs_lblc_table *tbl, struct ip_vs_lblc_entry *en)
 {
-        unsigned hash = ip_vs_lblc_hashkey(en->af, &en->addr);
+        unsigned int hash = ip_vs_lblc_hashkey(en->af, &en->addr);
 
         list_add(&en->list, &tbl->bucket[hash]);
         atomic_inc(&tbl->entries);
@@ -178,7 +178,7 @@ static inline struct ip_vs_lblc_entry *
 ip_vs_lblc_get(int af, struct ip_vs_lblc_table *tbl,
                const union nf_inet_addr *addr)
 {
-        unsigned hash = ip_vs_lblc_hashkey(af, addr);
+        unsigned int hash = ip_vs_lblc_hashkey(af, addr);
         struct ip_vs_lblc_entry *en;
 
         list_for_each_entry(en, &tbl->bucket[hash], list)
@@ -342,7 +342,7 @@ static int ip_vs_lblc_init_svc(struct ip_vs_service *svc)
         /*
          *    Allocate the ip_vs_lblc_table for this service
          */
-        tbl = kmalloc(sizeof(*tbl), GFP_ATOMIC);
+        tbl = kmalloc(sizeof(*tbl), GFP_KERNEL);
         if (tbl == NULL)
                 return -ENOMEM;
 
@@ -551,6 +551,9 @@ static int __net_init __ip_vs_lblc_init(struct net *net)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
+        if (!ipvs)
+                return -ENOENT;
+
         if (!net_eq(net, &init_net)) {
                 ipvs->lblc_ctl_table = kmemdup(vs_vars_table,
                                                 sizeof(vs_vars_table),
@@ -563,8 +566,7 @@ static int __net_init __ip_vs_lblc_init(struct net *net)
         ipvs->lblc_ctl_table[0].data = &ipvs->sysctl_lblc_expiration;
 
         ipvs->lblc_ctl_header =
-                register_net_sysctl_table(net, net_vs_ctl_path,
-                                          ipvs->lblc_ctl_table);
+                register_net_sysctl(net, "net/ipv4/vs", ipvs->lblc_ctl_table);
         if (!ipvs->lblc_ctl_header) {
                 if (!net_eq(net, &init_net))
                         kfree(ipvs->lblc_ctl_table);
diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
index eec797f8cce7..570e31ea427a 100644
--- a/net/netfilter/ipvs/ip_vs_lblcr.c
+++ b/net/netfilter/ipvs/ip_vs_lblcr.c
@@ -311,7 +311,7 @@ static inline void ip_vs_lblcr_free(struct ip_vs_lblcr_entry *en)
 /*
  *      Returns hash value for IPVS LBLCR entry
  */
-static inline unsigned
+static inline unsigned int
 ip_vs_lblcr_hashkey(int af, const union nf_inet_addr *addr)
 {
         __be32 addr_fold = addr->ip;
@@ -332,7 +332,7 @@ ip_vs_lblcr_hashkey(int af, const union nf_inet_addr *addr)
 static void
 ip_vs_lblcr_hash(struct ip_vs_lblcr_table *tbl, struct ip_vs_lblcr_entry *en)
 {
-        unsigned hash = ip_vs_lblcr_hashkey(en->af, &en->addr);
+        unsigned int hash = ip_vs_lblcr_hashkey(en->af, &en->addr);
 
         list_add(&en->list, &tbl->bucket[hash]);
         atomic_inc(&tbl->entries);
@@ -347,7 +347,7 @@ static inline struct ip_vs_lblcr_entry *
 ip_vs_lblcr_get(int af, struct ip_vs_lblcr_table *tbl,
                 const union nf_inet_addr *addr)
 {
-        unsigned hash = ip_vs_lblcr_hashkey(af, addr);
+        unsigned int hash = ip_vs_lblcr_hashkey(af, addr);
         struct ip_vs_lblcr_entry *en;
 
         list_for_each_entry(en, &tbl->bucket[hash], list)
@@ -511,7 +511,7 @@ static int ip_vs_lblcr_init_svc(struct ip_vs_service *svc)
         /*
          *    Allocate the ip_vs_lblcr_table for this service
          */
-        tbl = kmalloc(sizeof(*tbl), GFP_ATOMIC);
+        tbl = kmalloc(sizeof(*tbl), GFP_KERNEL);
         if (tbl == NULL)
                 return -ENOMEM;
 
@@ -745,6 +745,9 @@ static int __net_init __ip_vs_lblcr_init(struct net *net)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
+        if (!ipvs)
+                return -ENOENT;
+
         if (!net_eq(net, &init_net)) {
                 ipvs->lblcr_ctl_table = kmemdup(vs_vars_table,
                                                 sizeof(vs_vars_table),
@@ -757,8 +760,7 @@ static int __net_init __ip_vs_lblcr_init(struct net *net)
         ipvs->lblcr_ctl_table[0].data = &ipvs->sysctl_lblcr_expiration;
 
         ipvs->lblcr_ctl_header =
-                register_net_sysctl_table(net, net_vs_ctl_path,
-                                          ipvs->lblcr_ctl_table);
+                register_net_sysctl(net, "net/ipv4/vs", ipvs->lblcr_ctl_table);
         if (!ipvs->lblcr_ctl_header) {
                 if (!net_eq(net, &init_net))
                         kfree(ipvs->lblcr_ctl_table);
diff --git a/net/netfilter/ipvs/ip_vs_proto.c b/net/netfilter/ipvs/ip_vs_proto.c
index 85312939695f..50d82186da87 100644
--- a/net/netfilter/ipvs/ip_vs_proto.c
+++ b/net/netfilter/ipvs/ip_vs_proto.c
@@ -25,7 +25,6 @@
 #include <net/protocol.h>
 #include <net/tcp.h>
 #include <net/udp.h>
-#include <asm/system.h>
 #include <linux/stat.h>
 #include <linux/proc_fs.h>
 
@@ -49,7 +48,7 @@ static struct ip_vs_protocol *ip_vs_proto_table[IP_VS_PROTO_TAB_SIZE];
  */
 static int __used __init register_ip_vs_protocol(struct ip_vs_protocol *pp)
 {
-        unsigned hash = IP_VS_PROTO_HASH(pp->protocol);
+        unsigned int hash = IP_VS_PROTO_HASH(pp->protocol);
 
         pp->next = ip_vs_proto_table[hash];
         ip_vs_proto_table[hash] = pp;
@@ -60,9 +59,6 @@ static int __used __init register_ip_vs_protocol(struct ip_vs_protocol *pp)
         return 0;
 }
 
-#if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP) || \
-    defined(CONFIG_IP_VS_PROTO_SCTP) || defined(CONFIG_IP_VS_PROTO_AH) || \
-    defined(CONFIG_IP_VS_PROTO_ESP)
 /*
  *      register an ipvs protocols netns related data
  */
@@ -70,9 +66,9 @@ static int
 register_ip_vs_proto_netns(struct net *net, struct ip_vs_protocol *pp)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
-        unsigned hash = IP_VS_PROTO_HASH(pp->protocol);
+        unsigned int hash = IP_VS_PROTO_HASH(pp->protocol);
         struct ip_vs_proto_data *pd =
-                        kzalloc(sizeof(struct ip_vs_proto_data), GFP_ATOMIC);
+                        kzalloc(sizeof(struct ip_vs_proto_data), GFP_KERNEL);
 
         if (!pd)
                 return -ENOMEM;
@@ -82,12 +78,18 @@ register_ip_vs_proto_netns(struct net *net, struct ip_vs_protocol *pp)
         ipvs->proto_data_table[hash] = pd;
         atomic_set(&pd->appcnt, 0);     /* Init app counter */
 
-        if (pp->init_netns != NULL)
-                pp->init_netns(net, pd);
+        if (pp->init_netns != NULL) {
+                int ret = pp->init_netns(net, pd);
+                if (ret) {
+                        /* unlink an free proto data */
+                        ipvs->proto_data_table[hash] = pd->next;
+                        kfree(pd);
+                        return ret;
+                }
+        }
 
         return 0;
 }
-#endif
 
 /*
  *      unregister an ipvs protocol
@@ -95,7 +97,7 @@ register_ip_vs_proto_netns(struct net *net, struct ip_vs_protocol *pp)
 static int unregister_ip_vs_protocol(struct ip_vs_protocol *pp)
 {
         struct ip_vs_protocol **pp_p;
-        unsigned hash = IP_VS_PROTO_HASH(pp->protocol);
+        unsigned int hash = IP_VS_PROTO_HASH(pp->protocol);
 
         pp_p = &ip_vs_proto_table[hash];
         for (; *pp_p; pp_p = &(*pp_p)->next) {
@@ -118,7 +120,7 @@ unregister_ip_vs_proto_netns(struct net *net, struct ip_vs_proto_data *pd)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
         struct ip_vs_proto_data **pd_p;
-        unsigned hash = IP_VS_PROTO_HASH(pd->pp->protocol);
+        unsigned int hash = IP_VS_PROTO_HASH(pd->pp->protocol);
 
         pd_p = &ipvs->proto_data_table[hash];
         for (; *pd_p; pd_p = &(*pd_p)->next) {
@@ -140,7 +142,7 @@ unregister_ip_vs_proto_netns(struct net *net, struct ip_vs_proto_data *pd)
 struct ip_vs_protocol * ip_vs_proto_get(unsigned short proto)
 {
         struct ip_vs_protocol *pp;
-        unsigned hash = IP_VS_PROTO_HASH(proto);
+        unsigned int hash = IP_VS_PROTO_HASH(proto);
 
         for (pp = ip_vs_proto_table[hash]; pp; pp = pp->next) {
                 if (pp->protocol == proto)
@@ -154,11 +156,11 @@ EXPORT_SYMBOL(ip_vs_proto_get);
 /*
  *      get ip_vs_protocol object data by netns and proto
  */
-struct ip_vs_proto_data *
+static struct ip_vs_proto_data *
 __ipvs_proto_data_get(struct netns_ipvs *ipvs, unsigned short proto)
 {
         struct ip_vs_proto_data *pd;
-        unsigned hash = IP_VS_PROTO_HASH(proto);
+        unsigned int hash = IP_VS_PROTO_HASH(proto);
 
         for (pd = ipvs->proto_data_table[hash]; pd; pd = pd->next) {
                 if (pd->pp->protocol == proto)
@@ -197,7 +199,7 @@ void ip_vs_protocol_timeout_change(struct netns_ipvs *ipvs, int flags)
 int *
 ip_vs_create_timeout_table(int *table, int size)
 {
-        return kmemdup(table, size, GFP_ATOMIC);
+        return kmemdup(table, size, GFP_KERNEL);
 }
 
 
@@ -317,22 +319,35 @@ ip_vs_tcpudp_debug_packet(int af, struct ip_vs_protocol *pp,
  */
 int __net_init ip_vs_protocol_net_init(struct net *net)
 {
+        int i, ret;
+        static struct ip_vs_protocol *protos[] = {
 #ifdef CONFIG_IP_VS_PROTO_TCP
-        register_ip_vs_proto_netns(net, &ip_vs_protocol_tcp);
+        &ip_vs_protocol_tcp,
 #endif
 #ifdef CONFIG_IP_VS_PROTO_UDP
-        register_ip_vs_proto_netns(net, &ip_vs_protocol_udp);
+        &ip_vs_protocol_udp,
 #endif
 #ifdef CONFIG_IP_VS_PROTO_SCTP
-        register_ip_vs_proto_netns(net, &ip_vs_protocol_sctp);
+        &ip_vs_protocol_sctp,
 #endif
 #ifdef CONFIG_IP_VS_PROTO_AH
-        register_ip_vs_proto_netns(net, &ip_vs_protocol_ah);
+        &ip_vs_protocol_ah,
 #endif
 #ifdef CONFIG_IP_VS_PROTO_ESP
-        register_ip_vs_proto_netns(net, &ip_vs_protocol_esp);
+        &ip_vs_protocol_esp,
 #endif
+        };
+
+        for (i = 0; i < ARRAY_SIZE(protos); i++) {
+                ret = register_ip_vs_proto_netns(net, protos[i]);
+                if (ret < 0)
+                        goto cleanup;
+        }
         return 0;
+
+cleanup:
+        ip_vs_protocol_net_cleanup(net);
+        return ret;
 }
 
 void __net_exit ip_vs_protocol_net_cleanup(struct net *net)
diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index 1fbf7a2816f5..9f3fb751c491 100644
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -1090,7 +1090,7 @@ out:
  *   timeouts is netns related now.
  * ---------------------------------------------
  */
-static void __ip_vs_sctp_init(struct net *net, struct ip_vs_proto_data *pd)
+static int __ip_vs_sctp_init(struct net *net, struct ip_vs_proto_data *pd)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
@@ -1098,6 +1098,9 @@ static void __ip_vs_sctp_init(struct net *net, struct ip_vs_proto_data *pd)
         spin_lock_init(&ipvs->sctp_app_lock);
         pd->timeout_table = ip_vs_create_timeout_table((int *)sctp_timeouts,
                                                         sizeof(sctp_timeouts));
+        if (!pd->timeout_table)
+                return -ENOMEM;
+        return 0;
 }
 
 static void __ip_vs_sctp_exit(struct net *net, struct ip_vs_proto_data *pd)
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index ef8641f7af83..cd609cc62721 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -677,7 +677,7 @@ void ip_vs_tcp_conn_listen(struct net *net, struct ip_vs_conn *cp)
  *   timeouts is netns related now.
  * ---------------------------------------------
  */
-static void __ip_vs_tcp_init(struct net *net, struct ip_vs_proto_data *pd)
+static int __ip_vs_tcp_init(struct net *net, struct ip_vs_proto_data *pd)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
@@ -685,7 +685,10 @@ static void __ip_vs_tcp_init(struct net *net, struct ip_vs_proto_data *pd)
         spin_lock_init(&ipvs->tcp_app_lock);
         pd->timeout_table = ip_vs_create_timeout_table((int *)tcp_timeouts,
                                                         sizeof(tcp_timeouts));
+        if (!pd->timeout_table)
+                return -ENOMEM;
         pd->tcp_state_table =  tcp_states;
+        return 0;
 }
 
 static void __ip_vs_tcp_exit(struct net *net, struct ip_vs_proto_data *pd)
diff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c
index f4b7262896bb..2fedb2dcb3d1 100644
--- a/net/netfilter/ipvs/ip_vs_proto_udp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_udp.c
@@ -467,7 +467,7 @@ udp_state_transition(struct ip_vs_conn *cp, int direction,
         cp->timeout = pd->timeout_table[IP_VS_UDP_S_NORMAL];
 }
 
-static void __udp_init(struct net *net, struct ip_vs_proto_data *pd)
+static int __udp_init(struct net *net, struct ip_vs_proto_data *pd)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
@@ -475,6 +475,9 @@ static void __udp_init(struct net *net, struct ip_vs_proto_data *pd)
         spin_lock_init(&ipvs->udp_app_lock);
         pd->timeout_table = ip_vs_create_timeout_table((int *)udp_timeouts,
                                                         sizeof(udp_timeouts));
+        if (!pd->timeout_table)
+                return -ENOMEM;
+        return 0;
 }
 
 static void __udp_exit(struct net *net, struct ip_vs_proto_data *pd)
diff --git a/net/netfilter/ipvs/ip_vs_sh.c b/net/netfilter/ipvs/ip_vs_sh.c
index 069e8d4d5c01..05126521743e 100644
--- a/net/netfilter/ipvs/ip_vs_sh.c
+++ b/net/netfilter/ipvs/ip_vs_sh.c
@@ -70,7 +70,7 @@ struct ip_vs_sh_bucket {
 /*
  *      Returns hash value for IPVS SH entry
  */
-static inline unsigned ip_vs_sh_hashkey(int af, const union nf_inet_addr *addr)
+static inline unsigned int ip_vs_sh_hashkey(int af, const union nf_inet_addr *addr)
 {
         __be32 addr_fold = addr->ip;
 
@@ -162,7 +162,7 @@ static int ip_vs_sh_init_svc(struct ip_vs_service *svc)
 
         /* allocate the SH table for this service */
         tbl = kmalloc(sizeof(struct ip_vs_sh_bucket)*IP_VS_SH_TAB_SIZE,
-                      GFP_ATOMIC);
+                      GFP_KERNEL);
         if (tbl == NULL)
                 return -ENOMEM;
 
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index 8a0d6d6889f0..effa10c9e4e3 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -196,6 +196,7 @@ struct ip_vs_sync_thread_data {
         struct net *net;
         struct socket *sock;
         char *buf;
+        int id;
 };
 
 /* Version 0 definition of packet sizes */
@@ -271,13 +272,6 @@ struct ip_vs_sync_buff {
         unsigned char           *end;
 };
 
-/* multicast addr */
-static struct sockaddr_in mcast_addr = {
-        .sin_family             = AF_INET,
-        .sin_port               = cpu_to_be16(IP_VS_SYNC_PORT),
-        .sin_addr.s_addr        = cpu_to_be32(IP_VS_SYNC_GROUP),
-};
-
 /*
  * Copy of struct ip_vs_seq
  * From unaligned network order to aligned host order
@@ -300,18 +294,22 @@ static void hton_seq(struct ip_vs_seq *ho, struct ip_vs_seq *no)
         put_unaligned_be32(ho->previous_delta, &no->previous_delta);
 }
 
-static inline struct ip_vs_sync_buff *sb_dequeue(struct netns_ipvs *ipvs)
+static inline struct ip_vs_sync_buff *
+sb_dequeue(struct netns_ipvs *ipvs, struct ipvs_master_sync_state *ms)
 {
         struct ip_vs_sync_buff *sb;
 
         spin_lock_bh(&ipvs->sync_lock);
-        if (list_empty(&ipvs->sync_queue)) {
+        if (list_empty(&ms->sync_queue)) {
                 sb = NULL;
+                __set_current_state(TASK_INTERRUPTIBLE);
         } else {
-                sb = list_entry(ipvs->sync_queue.next,
-                                struct ip_vs_sync_buff,
+                sb = list_entry(ms->sync_queue.next, struct ip_vs_sync_buff,
                                 list);
                 list_del(&sb->list);
+                ms->sync_queue_len--;
+                if (!ms->sync_queue_len)
+                        ms->sync_queue_delay = 0;
         }
         spin_unlock_bh(&ipvs->sync_lock);
 
@@ -334,7 +332,7 @@ ip_vs_sync_buff_create(struct netns_ipvs *ipvs)
                 kfree(sb);
                 return NULL;
         }
-        sb->mesg->reserved = 0;  /* old nr_conns i.e. must be zeo now */
+        sb->mesg->reserved = 0;  /* old nr_conns i.e. must be zero now */
         sb->mesg->version = SYNC_PROTO_VER;
         sb->mesg->syncid = ipvs->master_syncid;
         sb->mesg->size = sizeof(struct ip_vs_sync_mesg);
@@ -353,14 +351,22 @@ static inline void ip_vs_sync_buff_release(struct ip_vs_sync_buff *sb)
         kfree(sb);
 }
 
-static inline void sb_queue_tail(struct netns_ipvs *ipvs)
+static inline void sb_queue_tail(struct netns_ipvs *ipvs,
+                                 struct ipvs_master_sync_state *ms)
 {
-        struct ip_vs_sync_buff *sb = ipvs->sync_buff;
+        struct ip_vs_sync_buff *sb = ms->sync_buff;
 
         spin_lock(&ipvs->sync_lock);
-        if (ipvs->sync_state & IP_VS_STATE_MASTER)
-                list_add_tail(&sb->list, &ipvs->sync_queue);
-        else
+        if (ipvs->sync_state & IP_VS_STATE_MASTER &&
+            ms->sync_queue_len < sysctl_sync_qlen_max(ipvs)) {
+                if (!ms->sync_queue_len)
+                        schedule_delayed_work(&ms->master_wakeup_work,
+                                              max(IPVS_SYNC_SEND_DELAY, 1));
+                ms->sync_queue_len++;
+                list_add_tail(&sb->list, &ms->sync_queue);
+                if ((++ms->sync_queue_delay) == IPVS_SYNC_WAKEUP_RATE)
+                        wake_up_process(ms->master_thread);
+        } else
                 ip_vs_sync_buff_release(sb);
         spin_unlock(&ipvs->sync_lock);
 }
@@ -370,49 +376,26 @@ static inline void sb_queue_tail(struct netns_ipvs *ipvs)
  *      than the specified time or the specified time is zero.
  */
 static inline struct ip_vs_sync_buff *
-get_curr_sync_buff(struct netns_ipvs *ipvs, unsigned long time)
+get_curr_sync_buff(struct netns_ipvs *ipvs, struct ipvs_master_sync_state *ms,
+                   unsigned long time)
 {
         struct ip_vs_sync_buff *sb;
 
         spin_lock_bh(&ipvs->sync_buff_lock);
-        if (ipvs->sync_buff &&
-            time_after_eq(jiffies - ipvs->sync_buff->firstuse, time)) {
-                sb = ipvs->sync_buff;
-                ipvs->sync_buff = NULL;
+        sb = ms->sync_buff;
+        if (sb && time_after_eq(jiffies - sb->firstuse, time)) {
+                ms->sync_buff = NULL;
+                __set_current_state(TASK_RUNNING);
         } else
                 sb = NULL;
         spin_unlock_bh(&ipvs->sync_buff_lock);
         return sb;
 }
 
-/*
- * Switch mode from sending version 0 or 1
- *  - must handle sync_buf
- */
-void ip_vs_sync_switch_mode(struct net *net, int mode)
+static inline int
+select_master_thread_id(struct netns_ipvs *ipvs, struct ip_vs_conn *cp)
 {
-        struct netns_ipvs *ipvs = net_ipvs(net);
-
-        if (!(ipvs->sync_state & IP_VS_STATE_MASTER))
-                return;
-        if (mode == sysctl_sync_ver(ipvs) || !ipvs->sync_buff)
-                return;
-
-        spin_lock_bh(&ipvs->sync_buff_lock);
-        /* Buffer empty ? then let buf_create do the job  */
-        if (ipvs->sync_buff->mesg->size <=  sizeof(struct ip_vs_sync_mesg)) {
-                kfree(ipvs->sync_buff);
-                ipvs->sync_buff = NULL;
-        } else {
-                spin_lock_bh(&ipvs->sync_lock);
-                if (ipvs->sync_state & IP_VS_STATE_MASTER)
-                        list_add_tail(&ipvs->sync_buff->list,
-                                      &ipvs->sync_queue);
-                else
-                        ip_vs_sync_buff_release(ipvs->sync_buff);
-                spin_unlock_bh(&ipvs->sync_lock);
-        }
-        spin_unlock_bh(&ipvs->sync_buff_lock);
+        return ((long) cp >> (1 + ilog2(sizeof(*cp)))) & ipvs->threads_mask;
 }
 
 /*
@@ -442,15 +425,101 @@ ip_vs_sync_buff_create_v0(struct netns_ipvs *ipvs)
         return sb;
 }
 
+/* Check if conn should be synced.
+ * pkts: conn packets, use sysctl_sync_threshold to avoid packet check
+ * - (1) sync_refresh_period: reduce sync rate. Additionally, retry
+ *      sync_retries times with period of sync_refresh_period/8
+ * - (2) if both sync_refresh_period and sync_period are 0 send sync only
+ *      for state changes or only once when pkts matches sync_threshold
+ * - (3) templates: rate can be reduced only with sync_refresh_period or
+ *      with (2)
+ */
+static int ip_vs_sync_conn_needed(struct netns_ipvs *ipvs,
+                                  struct ip_vs_conn *cp, int pkts)
+{
+        unsigned long orig = ACCESS_ONCE(cp->sync_endtime);
+        unsigned long now = jiffies;
+        unsigned long n = (now + cp->timeout) & ~3UL;
+        unsigned int sync_refresh_period;
+        int sync_period;
+        int force;
+
+        /* Check if we sync in current state */
+        if (unlikely(cp->flags & IP_VS_CONN_F_TEMPLATE))
+                force = 0;
+        else if (likely(cp->protocol == IPPROTO_TCP)) {
+                if (!((1 << cp->state) &
+                      ((1 << IP_VS_TCP_S_ESTABLISHED) |
+                       (1 << IP_VS_TCP_S_FIN_WAIT) |
+                       (1 << IP_VS_TCP_S_CLOSE) |
+                       (1 << IP_VS_TCP_S_CLOSE_WAIT) |
+                       (1 << IP_VS_TCP_S_TIME_WAIT))))
+                        return 0;
+                force = cp->state != cp->old_state;
+                if (force && cp->state != IP_VS_TCP_S_ESTABLISHED)
+                        goto set;
+        } else if (unlikely(cp->protocol == IPPROTO_SCTP)) {
+                if (!((1 << cp->state) &
+                      ((1 << IP_VS_SCTP_S_ESTABLISHED) |
+                       (1 << IP_VS_SCTP_S_CLOSED) |
+                       (1 << IP_VS_SCTP_S_SHUT_ACK_CLI) |
+                       (1 << IP_VS_SCTP_S_SHUT_ACK_SER))))
+                        return 0;
+                force = cp->state != cp->old_state;
+                if (force && cp->state != IP_VS_SCTP_S_ESTABLISHED)
+                        goto set;
+        } else {
+                /* UDP or another protocol with single state */
+                force = 0;
+        }
+
+        sync_refresh_period = sysctl_sync_refresh_period(ipvs);
+        if (sync_refresh_period > 0) {
+                long diff = n - orig;
+                long min_diff = max(cp->timeout >> 1, 10UL * HZ);
+
+                /* Avoid sync if difference is below sync_refresh_period
+                 * and below the half timeout.
+                 */
+                if (abs(diff) < min_t(long, sync_refresh_period, min_diff)) {
+                        int retries = orig & 3;
+
+                        if (retries >= sysctl_sync_retries(ipvs))
+                                return 0;
+                        if (time_before(now, orig - cp->timeout +
+                                        (sync_refresh_period >> 3)))
+                                return 0;
+                        n |= retries + 1;
+                }
+        }
+        sync_period = sysctl_sync_period(ipvs);
+        if (sync_period > 0) {
+                if (!(cp->flags & IP_VS_CONN_F_TEMPLATE) &&
+                    pkts % sync_period != sysctl_sync_threshold(ipvs))
+                        return 0;
+        } else if (sync_refresh_period <= 0 &&
+                   pkts != sysctl_sync_threshold(ipvs))
+                return 0;
+
+set:
+        cp->old_state = cp->state;
+        n = cmpxchg(&cp->sync_endtime, orig, n);
+        return n == orig || force;
+}
+
 /*
  *      Version 0 , could be switched in by sys_ctl.
  *      Add an ip_vs_conn information into the current sync_buff.
  */
-void ip_vs_sync_conn_v0(struct net *net, struct ip_vs_conn *cp)
+static void ip_vs_sync_conn_v0(struct net *net, struct ip_vs_conn *cp,
+                               int pkts)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
         struct ip_vs_sync_mesg_v0 *m;
         struct ip_vs_sync_conn_v0 *s;
+        struct ip_vs_sync_buff *buff;
+        struct ipvs_master_sync_state *ms;
+        int id;
         int len;
 
         if (unlikely(cp->af != AF_INET))
@@ -459,21 +528,41 @@ void ip_vs_sync_conn_v0(struct net *net, struct ip_vs_conn *cp)
         if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
                 return;
 
+        if (!ip_vs_sync_conn_needed(ipvs, cp, pkts))
+                return;
+
         spin_lock(&ipvs->sync_buff_lock);
-        if (!ipvs->sync_buff) {
-                ipvs->sync_buff =
-                        ip_vs_sync_buff_create_v0(ipvs);
-                if (!ipvs->sync_buff) {
+        if (!(ipvs->sync_state & IP_VS_STATE_MASTER)) {
+                spin_unlock(&ipvs->sync_buff_lock);
+                return;
+        }
+
+        id = select_master_thread_id(ipvs, cp);
+        ms = &ipvs->ms[id];
+        buff = ms->sync_buff;
+        if (buff) {
+                m = (struct ip_vs_sync_mesg_v0 *) buff->mesg;
+                /* Send buffer if it is for v1 */
+                if (!m->nr_conns) {
+                        sb_queue_tail(ipvs, ms);
+                        ms->sync_buff = NULL;
+                        buff = NULL;
+                }
+        }
+        if (!buff) {
+                buff = ip_vs_sync_buff_create_v0(ipvs);
+                if (!buff) {
                         spin_unlock(&ipvs->sync_buff_lock);
                         pr_err("ip_vs_sync_buff_create failed.\n");
                         return;
                 }
+                ms->sync_buff = buff;
         }
 
         len = (cp->flags & IP_VS_CONN_F_SEQ_MASK) ? FULL_CONN_SIZE :
                 SIMPLE_CONN_SIZE;
-        m = (struct ip_vs_sync_mesg_v0 *)ipvs->sync_buff->mesg;
-        s = (struct ip_vs_sync_conn_v0 *)ipvs->sync_buff->head;
+        m = (struct ip_vs_sync_mesg_v0 *) buff->mesg;
+        s = (struct ip_vs_sync_conn_v0 *) buff->head;
 
         /* copy members */
         s->reserved = 0;
@@ -494,18 +583,24 @@ void ip_vs_sync_conn_v0(struct net *net, struct ip_vs_conn *cp)
 
         m->nr_conns++;
         m->size += len;
-        ipvs->sync_buff->head += len;
+        buff->head += len;
 
         /* check if there is a space for next one */
-        if (ipvs->sync_buff->head + FULL_CONN_SIZE > ipvs->sync_buff->end) {
-                sb_queue_tail(ipvs);
-                ipvs->sync_buff = NULL;
+        if (buff->head + FULL_CONN_SIZE > buff->end) {
+                sb_queue_tail(ipvs, ms);
+                ms->sync_buff = NULL;
         }
         spin_unlock(&ipvs->sync_buff_lock);
 
         /* synchronize its controller if it has */
-        if (cp->control)
-                ip_vs_sync_conn(net, cp->control);
+        cp = cp->control;
+        if (cp) {
+                if (cp->flags & IP_VS_CONN_F_TEMPLATE)
+                        pkts = atomic_add_return(1, &cp->in_pkts);
+                else
+                        pkts = sysctl_sync_threshold(ipvs);
+                ip_vs_sync_conn(net, cp->control, pkts);
+        }
 }
 
 /*
@@ -513,23 +608,29 @@ void ip_vs_sync_conn_v0(struct net *net, struct ip_vs_conn *cp)
  *      Called by ip_vs_in.
  *      Sending Version 1 messages
  */
-void ip_vs_sync_conn(struct net *net, struct ip_vs_conn *cp)
+void ip_vs_sync_conn(struct net *net, struct ip_vs_conn *cp, int pkts)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
         struct ip_vs_sync_mesg *m;
         union ip_vs_sync_conn *s;
+        struct ip_vs_sync_buff *buff;
+        struct ipvs_master_sync_state *ms;
+        int id;
         __u8 *p;
         unsigned int len, pe_name_len, pad;
 
         /* Handle old version of the protocol */
         if (sysctl_sync_ver(ipvs) == 0) {
-                ip_vs_sync_conn_v0(net, cp);
+                ip_vs_sync_conn_v0(net, cp, pkts);
                 return;
         }
         /* Do not sync ONE PACKET */
         if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
                 goto control;
 sloop:
+        if (!ip_vs_sync_conn_needed(ipvs, cp, pkts))
+                goto control;
+
         /* Sanity checks */
         pe_name_len = 0;
         if (cp->pe_data_len) {
@@ -541,6 +642,13 @@ sloop:
         }
 
         spin_lock(&ipvs->sync_buff_lock);
+        if (!(ipvs->sync_state & IP_VS_STATE_MASTER)) {
+                spin_unlock(&ipvs->sync_buff_lock);
+                return;
+        }
+
+        id = select_master_thread_id(ipvs, cp);
+        ms = &ipvs->ms[id];
 
 #ifdef CONFIG_IP_VS_IPV6
         if (cp->af == AF_INET6)
@@ -559,27 +667,32 @@ sloop:
 
         /* check if there is a space for this one  */
         pad = 0;
-        if (ipvs->sync_buff) {
-                pad = (4 - (size_t)ipvs->sync_buff->head) & 3;
-                if (ipvs->sync_buff->head + len + pad > ipvs->sync_buff->end) {
-                        sb_queue_tail(ipvs);
-                        ipvs->sync_buff = NULL;
+        buff = ms->sync_buff;
+        if (buff) {
+                m = buff->mesg;
+                pad = (4 - (size_t) buff->head) & 3;
+                /* Send buffer if it is for v0 */
+                if (buff->head + len + pad > buff->end || m->reserved) {
+                        sb_queue_tail(ipvs, ms);
+                        ms->sync_buff = NULL;
+                        buff = NULL;
                         pad = 0;
                 }
         }
 
-        if (!ipvs->sync_buff) {
-                ipvs->sync_buff = ip_vs_sync_buff_create(ipvs);
-                if (!ipvs->sync_buff) {
+        if (!buff) {
+                buff = ip_vs_sync_buff_create(ipvs);
+                if (!buff) {
                         spin_unlock(&ipvs->sync_buff_lock);
                         pr_err("ip_vs_sync_buff_create failed.\n");
                         return;
                 }
+                ms->sync_buff = buff;
+                m = buff->mesg;
         }
 
-        m = ipvs->sync_buff->mesg;
-        p = ipvs->sync_buff->head;
-        ipvs->sync_buff->head += pad + len;
+        p = buff->head;
+        buff->head += pad + len;
         m->size += pad + len;
         /* Add ev. padding from prev. sync_conn */
         while (pad--)
@@ -644,16 +757,10 @@ control:
         cp = cp->control;
         if (!cp)
                 return;
-        /*
-         * Reduce sync rate for templates
-         * i.e only increment in_pkts for Templates.
-         */
-        if (cp->flags & IP_VS_CONN_F_TEMPLATE) {
-                int pkts = atomic_add_return(1, &cp->in_pkts);
-
-                if (pkts % sysctl_sync_period(ipvs) != 1)
-                        return;
-        }
+        if (cp->flags & IP_VS_CONN_F_TEMPLATE)
+                pkts = atomic_add_return(1, &cp->in_pkts);
+        else
+                pkts = sysctl_sync_threshold(ipvs);
         goto sloop;
 }
 
@@ -731,9 +838,32 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
         else
                 cp = ip_vs_ct_in_get(param);
 
-        if (cp && param->pe_data)       /* Free pe_data */
+        if (cp) {
+                /* Free pe_data */
                 kfree(param->pe_data);
-        if (!cp) {
+
+                dest = cp->dest;
+                spin_lock(&cp->lock);
+                if ((cp->flags ^ flags) & IP_VS_CONN_F_INACTIVE &&
+                    !(flags & IP_VS_CONN_F_TEMPLATE) && dest) {
+                        if (flags & IP_VS_CONN_F_INACTIVE) {
+                                atomic_dec(&dest->activeconns);
+                                atomic_inc(&dest->inactconns);
+                        } else {
+                                atomic_inc(&dest->activeconns);
+                                atomic_dec(&dest->inactconns);
+                        }
+                }
+                flags &= IP_VS_CONN_F_BACKUP_UPD_MASK;
+                flags |= cp->flags & ~IP_VS_CONN_F_BACKUP_UPD_MASK;
+                cp->flags = flags;
+                spin_unlock(&cp->lock);
+                if (!dest) {
+                        dest = ip_vs_try_bind_dest(cp);
+                        if (dest)
+                                atomic_dec(&dest->refcnt);
+                }
+        } else {
                 /*
                  * Find the appropriate destination for the connection.
                  * If it is not found the connection will remain unbound
@@ -742,18 +872,6 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
                 dest = ip_vs_find_dest(net, type, daddr, dport, param->vaddr,
                                        param->vport, protocol, fwmark, flags);
 
-                /*  Set the approprite ativity flag */
-                if (protocol == IPPROTO_TCP) {
-                        if (state != IP_VS_TCP_S_ESTABLISHED)
-                                flags |= IP_VS_CONN_F_INACTIVE;
-                        else
-                                flags &= ~IP_VS_CONN_F_INACTIVE;
-                } else if (protocol == IPPROTO_SCTP) {
-                        if (state != IP_VS_SCTP_S_ESTABLISHED)
-                                flags |= IP_VS_CONN_F_INACTIVE;
-                        else
-                                flags &= ~IP_VS_CONN_F_INACTIVE;
-                }
                 cp = ip_vs_conn_new(param, daddr, dport, flags, dest, fwmark);
                 if (dest)
                         atomic_dec(&dest->refcnt);
@@ -763,34 +881,6 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
                         IP_VS_DBG(2, "BACKUP, add new conn. failed\n");
                         return;
                 }
-        } else if (!cp->dest) {
-                dest = ip_vs_try_bind_dest(cp);
-                if (dest)
-                        atomic_dec(&dest->refcnt);
-        } else if ((cp->dest) && (cp->protocol == IPPROTO_TCP) &&
-                (cp->state != state)) {
-                /* update active/inactive flag for the connection */
-                dest = cp->dest;
-                if (!(cp->flags & IP_VS_CONN_F_INACTIVE) &&
-                        (state != IP_VS_TCP_S_ESTABLISHED)) {
-                        atomic_dec(&dest->activeconns);
-                        atomic_inc(&dest->inactconns);
-                        cp->flags |= IP_VS_CONN_F_INACTIVE;
-                } else if ((cp->flags & IP_VS_CONN_F_INACTIVE) &&
-                        (state == IP_VS_TCP_S_ESTABLISHED)) {
-                        atomic_inc(&dest->activeconns);
-                        atomic_dec(&dest->inactconns);
-                        cp->flags &= ~IP_VS_CONN_F_INACTIVE;
-                }
-        } else if ((cp->dest) && (cp->protocol == IPPROTO_SCTP) &&
-                (cp->state != state)) {
-                dest = cp->dest;
-                if (!(cp->flags & IP_VS_CONN_F_INACTIVE) &&
-                (state != IP_VS_SCTP_S_ESTABLISHED)) {
-                        atomic_dec(&dest->activeconns);
-                        atomic_inc(&dest->inactconns);
-                        cp->flags &= ~IP_VS_CONN_F_INACTIVE;
-                }
         }
 
         if (opt)
@@ -839,7 +929,7 @@ static void ip_vs_process_message_v0(struct net *net, const char *buffer,
 
         p = (char *)buffer + sizeof(struct ip_vs_sync_mesg_v0);
         for (i=0; i<m->nr_conns; i++) {
-                unsigned flags, state;
+                unsigned int flags, state;
 
                 if (p + SIMPLE_CONN_SIZE > buffer+buflen) {
                         IP_VS_ERR_RL("BACKUP v0, bogus conn\n");
@@ -1109,7 +1199,7 @@ static void ip_vs_process_message(struct net *net, __u8 *buffer,
 
                 for (i=0; i<nr_conns; i++) {
                         union ip_vs_sync_conn *s;
-                        unsigned size;
+                        unsigned int size;
                         int retc;
 
                         p = msg_end;
@@ -1149,6 +1239,28 @@ static void ip_vs_process_message(struct net *net, __u8 *buffer,
 
 
 /*
+ *      Setup sndbuf (mode=1) or rcvbuf (mode=0)
+ */
+static void set_sock_size(struct sock *sk, int mode, int val)
+{
+        /* setsockopt(sock, SOL_SOCKET, SO_SNDBUF, &val, sizeof(val)); */
+        /* setsockopt(sock, SOL_SOCKET, SO_RCVBUF, &val, sizeof(val)); */
+        lock_sock(sk);
+        if (mode) {
+                val = clamp_t(int, val, (SOCK_MIN_SNDBUF + 1) / 2,
+                              sysctl_wmem_max);
+                sk->sk_sndbuf = val * 2;
+                sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
+        } else {
+                val = clamp_t(int, val, (SOCK_MIN_RCVBUF + 1) / 2,
+                              sysctl_rmem_max);
+                sk->sk_rcvbuf = val * 2;
+                sk->sk_userlocks |= SOCK_RCVBUF_LOCK;
+        }
+        release_sock(sk);
+}
+
+/*
  *      Setup loopback of outgoing multicasts on a sending socket
  */
 static void set_mcast_loop(struct sock *sk, u_char loop)
@@ -1298,9 +1410,15 @@ static int bind_mcastif_addr(struct socket *sock, char *ifname)
 /*
  *      Set up sending multicast socket over UDP
  */
-static struct socket *make_send_sock(struct net *net)
+static struct socket *make_send_sock(struct net *net, int id)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
+        /* multicast addr */
+        struct sockaddr_in mcast_addr = {
+                .sin_family             = AF_INET,
+                .sin_port               = cpu_to_be16(IP_VS_SYNC_PORT + id),
+                .sin_addr.s_addr        = cpu_to_be32(IP_VS_SYNC_GROUP),
+        };
         struct socket *sock;
         int result;
 
@@ -1324,6 +1442,9 @@ static struct socket *make_send_sock(struct net *net)
 
         set_mcast_loop(sock->sk, 0);
         set_mcast_ttl(sock->sk, 1);
+        result = sysctl_sync_sock_size(ipvs);
+        if (result > 0)
+                set_sock_size(sock->sk, 1, result);
 
         result = bind_mcastif_addr(sock, ipvs->master_mcast_ifn);
         if (result < 0) {
@@ -1349,9 +1470,15 @@ error:
 /*
  *      Set up receiving multicast socket over UDP
  */
-static struct socket *make_receive_sock(struct net *net)
+static struct socket *make_receive_sock(struct net *net, int id)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
+        /* multicast addr */
+        struct sockaddr_in mcast_addr = {
+                .sin_family             = AF_INET,
+                .sin_port               = cpu_to_be16(IP_VS_SYNC_PORT + id),
+                .sin_addr.s_addr        = cpu_to_be32(IP_VS_SYNC_GROUP),
+        };
         struct socket *sock;
         int result;
 
@@ -1368,7 +1495,10 @@ static struct socket *make_receive_sock(struct net *net)
          */
         sk_change_net(sock->sk, net);
         /* it is equivalent to the REUSEADDR option in user-space */
-        sock->sk->sk_reuse = 1;
+        sock->sk->sk_reuse = SK_CAN_REUSE;
+        result = sysctl_sync_sock_size(ipvs);
+        if (result > 0)
+                set_sock_size(sock->sk, 0, result);
 
         result = sock->ops->bind(sock, (struct sockaddr *) &mcast_addr,
                         sizeof(struct sockaddr));
@@ -1411,18 +1541,22 @@ ip_vs_send_async(struct socket *sock, const char *buffer, const size_t length)
         return len;
 }
 
-static void
+static int
 ip_vs_send_sync_msg(struct socket *sock, struct ip_vs_sync_mesg *msg)
 {
         int msize;
+        int ret;
 
         msize = msg->size;
 
         /* Put size in network byte order */
         msg->size = htons(msg->size);
 
-        if (ip_vs_send_async(sock, (char *)msg, msize) != msize)
-                pr_err("ip_vs_send_async error\n");
+        ret = ip_vs_send_async(sock, (char *)msg, msize);
+        if (ret >= 0 || ret == -EAGAIN)
+                return ret;
+        pr_err("ip_vs_send_async error %d\n", ret);
+        return 0;
 }
 
 static int
@@ -1438,48 +1572,90 @@ ip_vs_receive(struct socket *sock, char *buffer, const size_t buflen)
         iov.iov_base     = buffer;
         iov.iov_len      = (size_t)buflen;
 
-        len = kernel_recvmsg(sock, &msg, &iov, 1, buflen, 0);
+        len = kernel_recvmsg(sock, &msg, &iov, 1, buflen, MSG_DONTWAIT);
 
         if (len < 0)
-                return -1;
+                return len;
 
         LeaveFunction(7);
         return len;
 }
 
+/* Wakeup the master thread for sending */
+static void master_wakeup_work_handler(struct work_struct *work)
+{
+        struct ipvs_master_sync_state *ms =
+                container_of(work, struct ipvs_master_sync_state,
+                             master_wakeup_work.work);
+        struct netns_ipvs *ipvs = ms->ipvs;
+
+        spin_lock_bh(&ipvs->sync_lock);
+        if (ms->sync_queue_len &&
+            ms->sync_queue_delay < IPVS_SYNC_WAKEUP_RATE) {
+                ms->sync_queue_delay = IPVS_SYNC_WAKEUP_RATE;
+                wake_up_process(ms->master_thread);
+        }
+        spin_unlock_bh(&ipvs->sync_lock);
+}
+
+/* Get next buffer to send */
+static inline struct ip_vs_sync_buff *
+next_sync_buff(struct netns_ipvs *ipvs, struct ipvs_master_sync_state *ms)
+{
+        struct ip_vs_sync_buff *sb;
+
+        sb = sb_dequeue(ipvs, ms);
+        if (sb)
+                return sb;
+        /* Do not delay entries in buffer for more than 2 seconds */
+        return get_curr_sync_buff(ipvs, ms, IPVS_SYNC_FLUSH_TIME);
+}
 
 static int sync_thread_master(void *data)
 {
         struct ip_vs_sync_thread_data *tinfo = data;
         struct netns_ipvs *ipvs = net_ipvs(tinfo->net);
+        struct ipvs_master_sync_state *ms = &ipvs->ms[tinfo->id];
+        struct sock *sk = tinfo->sock->sk;
         struct ip_vs_sync_buff *sb;
 
         pr_info("sync thread started: state = MASTER, mcast_ifn = %s, "
-                "syncid = %d\n",
-                ipvs->master_mcast_ifn, ipvs->master_syncid);
+                "syncid = %d, id = %d\n",
+                ipvs->master_mcast_ifn, ipvs->master_syncid, tinfo->id);
 
-        while (!kthread_should_stop()) {
-                while ((sb = sb_dequeue(ipvs))) {
-                        ip_vs_send_sync_msg(tinfo->sock, sb->mesg);
-                        ip_vs_sync_buff_release(sb);
+        for (;;) {
+                sb = next_sync_buff(ipvs, ms);
+                if (unlikely(kthread_should_stop()))
+                        break;
+                if (!sb) {
+                        schedule_timeout(IPVS_SYNC_CHECK_PERIOD);
+                        continue;
                 }
-
-                /* check if entries stay in ipvs->sync_buff for 2 seconds */
-                sb = get_curr_sync_buff(ipvs, 2 * HZ);
-                if (sb) {
-                        ip_vs_send_sync_msg(tinfo->sock, sb->mesg);
-                        ip_vs_sync_buff_release(sb);
+                while (ip_vs_send_sync_msg(tinfo->sock, sb->mesg) < 0) {
+                        int ret = 0;
+
+                        __wait_event_interruptible(*sk_sleep(sk),
+                                                   sock_writeable(sk) ||
+                                                   kthread_should_stop(),
+                                                   ret);
+                        if (unlikely(kthread_should_stop()))
+                                goto done;
                 }
-
-                schedule_timeout_interruptible(HZ);
+                ip_vs_sync_buff_release(sb);
         }
 
+done:
+        __set_current_state(TASK_RUNNING);
+        if (sb)
+                ip_vs_sync_buff_release(sb);
+
         /* clean up the sync_buff queue */
-        while ((sb = sb_dequeue(ipvs)))
+        while ((sb = sb_dequeue(ipvs, ms)))
                 ip_vs_sync_buff_release(sb);
+        __set_current_state(TASK_RUNNING);
 
         /* clean up the current sync_buff */
-        sb = get_curr_sync_buff(ipvs, 0);
+        sb = get_curr_sync_buff(ipvs, ms, 0);
         if (sb)
                 ip_vs_sync_buff_release(sb);
 
@@ -1498,8 +1674,8 @@ static int sync_thread_backup(void *data)
         int len;
 
         pr_info("sync thread started: state = BACKUP, mcast_ifn = %s, "
-                "syncid = %d\n",
-                ipvs->backup_mcast_ifn, ipvs->backup_syncid);
+                "syncid = %d, id = %d\n",
+                ipvs->backup_mcast_ifn, ipvs->backup_syncid, tinfo->id);
 
         while (!kthread_should_stop()) {
                 wait_event_interruptible(*sk_sleep(tinfo->sock->sk),
@@ -1511,7 +1687,8 @@ static int sync_thread_backup(void *data)
                         len = ip_vs_receive(tinfo->sock, tinfo->buf,
                                         ipvs->recv_mesg_maxlen);
                         if (len <= 0) {
-                                pr_err("receiving message error\n");
+                                if (len != -EAGAIN)
+                                        pr_err("receiving message error\n");
                                 break;
                         }
 
@@ -1535,86 +1712,140 @@ static int sync_thread_backup(void *data)
 int start_sync_thread(struct net *net, int state, char *mcast_ifn, __u8 syncid)
 {
         struct ip_vs_sync_thread_data *tinfo;
-        struct task_struct **realtask, *task;
+        struct task_struct **array = NULL, *task;
         struct socket *sock;
         struct netns_ipvs *ipvs = net_ipvs(net);
-        char *name, *buf = NULL;
+        char *name;
         int (*threadfn)(void *data);
+        int id, count;
         int result = -ENOMEM;
 
         IP_VS_DBG(7, "%s(): pid %d\n", __func__, task_pid_nr(current));
         IP_VS_DBG(7, "Each ip_vs_sync_conn entry needs %Zd bytes\n",
                   sizeof(struct ip_vs_sync_conn_v0));
 
+        if (!ipvs->sync_state) {
+                count = clamp(sysctl_sync_ports(ipvs), 1, IPVS_SYNC_PORTS_MAX);
+                ipvs->threads_mask = count - 1;
+        } else
+                count = ipvs->threads_mask + 1;
 
         if (state == IP_VS_STATE_MASTER) {
-                if (ipvs->master_thread)
+                if (ipvs->ms)
                         return -EEXIST;
 
                 strlcpy(ipvs->master_mcast_ifn, mcast_ifn,
                         sizeof(ipvs->master_mcast_ifn));
                 ipvs->master_syncid = syncid;
-                realtask = &ipvs->master_thread;
-                name = "ipvs_master:%d";
+                name = "ipvs-m:%d:%d";
                 threadfn = sync_thread_master;
-                sock = make_send_sock(net);
         } else if (state == IP_VS_STATE_BACKUP) {
-                if (ipvs->backup_thread)
+                if (ipvs->backup_threads)
                         return -EEXIST;
 
                 strlcpy(ipvs->backup_mcast_ifn, mcast_ifn,
                         sizeof(ipvs->backup_mcast_ifn));
                 ipvs->backup_syncid = syncid;
-                realtask = &ipvs->backup_thread;
-                name = "ipvs_backup:%d";
+                name = "ipvs-b:%d:%d";
                 threadfn = sync_thread_backup;
-                sock = make_receive_sock(net);
         } else {
                 return -EINVAL;
         }
 
-        if (IS_ERR(sock)) {
-                result = PTR_ERR(sock);
-                goto out;
-        }
+        if (state == IP_VS_STATE_MASTER) {
+                struct ipvs_master_sync_state *ms;
 
-        set_sync_mesg_maxlen(net, state);
-        if (state == IP_VS_STATE_BACKUP) {
-                buf = kmalloc(ipvs->recv_mesg_maxlen, GFP_KERNEL);
-                if (!buf)
-                        goto outsocket;
+                ipvs->ms = kzalloc(count * sizeof(ipvs->ms[0]), GFP_KERNEL);
+                if (!ipvs->ms)
+                        goto out;
+                ms = ipvs->ms;
+                for (id = 0; id < count; id++, ms++) {
+                        INIT_LIST_HEAD(&ms->sync_queue);
+                        ms->sync_queue_len = 0;
+                        ms->sync_queue_delay = 0;
+                        INIT_DELAYED_WORK(&ms->master_wakeup_work,
+                                          master_wakeup_work_handler);
+                        ms->ipvs = ipvs;
+                }
+        } else {
+                array = kzalloc(count * sizeof(struct task_struct *),
+                                GFP_KERNEL);
+                if (!array)
+                        goto out;
         }
+        set_sync_mesg_maxlen(net, state);
 
-        tinfo = kmalloc(sizeof(*tinfo), GFP_KERNEL);
-        if (!tinfo)
-                goto outbuf;
-
-        tinfo->net = net;
-        tinfo->sock = sock;
-        tinfo->buf = buf;
+        tinfo = NULL;
+        for (id = 0; id < count; id++) {
+                if (state == IP_VS_STATE_MASTER)
+                        sock = make_send_sock(net, id);
+                else
+                        sock = make_receive_sock(net, id);
+                if (IS_ERR(sock)) {
+                        result = PTR_ERR(sock);
+                        goto outtinfo;
+                }
+                tinfo = kmalloc(sizeof(*tinfo), GFP_KERNEL);
+                if (!tinfo)
+                        goto outsocket;
+                tinfo->net = net;
+                tinfo->sock = sock;
+                if (state == IP_VS_STATE_BACKUP) {
+                        tinfo->buf = kmalloc(ipvs->recv_mesg_maxlen,
+                                             GFP_KERNEL);
+                        if (!tinfo->buf)
+                                goto outtinfo;
+                }
+                tinfo->id = id;
 
-        task = kthread_run(threadfn, tinfo, name, ipvs->gen);
-        if (IS_ERR(task)) {
-                result = PTR_ERR(task);
-                goto outtinfo;
+                task = kthread_run(threadfn, tinfo, name, ipvs->gen, id);
+                if (IS_ERR(task)) {
+                        result = PTR_ERR(task);
+                        goto outtinfo;
+                }
+                tinfo = NULL;
+                if (state == IP_VS_STATE_MASTER)
+                        ipvs->ms[id].master_thread = task;
+                else
+                        array[id] = task;
         }
 
         /* mark as active */
-        *realtask = task;
+
+        if (state == IP_VS_STATE_BACKUP)
+                ipvs->backup_threads = array;
+        spin_lock_bh(&ipvs->sync_buff_lock);
         ipvs->sync_state |= state;
+        spin_unlock_bh(&ipvs->sync_buff_lock);
 
         /* increase the module use count */
         ip_vs_use_count_inc();
 
         return 0;
 
-outtinfo:
-        kfree(tinfo);
-outbuf:
-        kfree(buf);
 outsocket:
         sk_release_kernel(sock->sk);
+
+outtinfo:
+        if (tinfo) {
+                sk_release_kernel(tinfo->sock->sk);
+                kfree(tinfo->buf);
+                kfree(tinfo);
+        }
+        count = id;
+        while (count-- > 0) {
+                if (state == IP_VS_STATE_MASTER)
+                        kthread_stop(ipvs->ms[count].master_thread);
+                else
+                        kthread_stop(array[count]);
+        }
+        kfree(array);
+
 out:
+        if (!(ipvs->sync_state & IP_VS_STATE_MASTER)) {
+                kfree(ipvs->ms);
+                ipvs->ms = NULL;
+        }
         return result;
 }
 
@@ -1622,38 +1853,60 @@ out:
 int stop_sync_thread(struct net *net, int state)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
+        struct task_struct **array;
+        int id;
         int retc = -EINVAL;
 
         IP_VS_DBG(7, "%s(): pid %d\n", __func__, task_pid_nr(current));
 
         if (state == IP_VS_STATE_MASTER) {
-                if (!ipvs->master_thread)
+                if (!ipvs->ms)
                         return -ESRCH;
 
-                pr_info("stopping master sync thread %d ...\n",
-                        task_pid_nr(ipvs->master_thread));
-
                 /*
                  * The lock synchronizes with sb_queue_tail(), so that we don't
                  * add sync buffers to the queue, when we are already in
                  * progress of stopping the master sync daemon.
                  */
 
-                spin_lock_bh(&ipvs->sync_lock);
+                spin_lock_bh(&ipvs->sync_buff_lock);
+                spin_lock(&ipvs->sync_lock);
                 ipvs->sync_state &= ~IP_VS_STATE_MASTER;
-                spin_unlock_bh(&ipvs->sync_lock);
-                retc = kthread_stop(ipvs->master_thread);
-                ipvs->master_thread = NULL;
+                spin_unlock(&ipvs->sync_lock);
+                spin_unlock_bh(&ipvs->sync_buff_lock);
+
+                retc = 0;
+                for (id = ipvs->threads_mask; id >= 0; id--) {
+                        struct ipvs_master_sync_state *ms = &ipvs->ms[id];
+                        int ret;
+
+                        pr_info("stopping master sync thread %d ...\n",
+                                task_pid_nr(ms->master_thread));
+                        cancel_delayed_work_sync(&ms->master_wakeup_work);
+                        ret = kthread_stop(ms->master_thread);
+                        if (retc >= 0)
+                                retc = ret;
+                }
+                kfree(ipvs->ms);
+                ipvs->ms = NULL;
         } else if (state == IP_VS_STATE_BACKUP) {
-                if (!ipvs->backup_thread)
+                if (!ipvs->backup_threads)
                         return -ESRCH;
 
-                pr_info("stopping backup sync thread %d ...\n",
-                        task_pid_nr(ipvs->backup_thread));
-
                 ipvs->sync_state &= ~IP_VS_STATE_BACKUP;
-                retc = kthread_stop(ipvs->backup_thread);
-                ipvs->backup_thread = NULL;
+                array = ipvs->backup_threads;
+                retc = 0;
+                for (id = ipvs->threads_mask; id >= 0; id--) {
+                        int ret;
+
+                        pr_info("stopping backup sync thread %d ...\n",
+                                task_pid_nr(array[id]));
+                        ret = kthread_stop(array[id]);
+                        if (retc >= 0)
+                                retc = ret;
+                }
+                kfree(array);
+                ipvs->backup_threads = NULL;
         }
 
         /* decrease the module use count */
@@ -1670,13 +1923,8 @@ int __net_init ip_vs_sync_net_init(struct net *net)
         struct netns_ipvs *ipvs = net_ipvs(net);
 
         __mutex_init(&ipvs->sync_mutex, "ipvs->sync_mutex", &__ipvs_sync_key);
-        INIT_LIST_HEAD(&ipvs->sync_queue);
         spin_lock_init(&ipvs->sync_lock);
         spin_lock_init(&ipvs->sync_buff_lock);
-
-        ipvs->sync_mcast_addr.sin_family = AF_INET;
-        ipvs->sync_mcast_addr.sin_port = cpu_to_be16(IP_VS_SYNC_PORT);
-        ipvs->sync_mcast_addr.sin_addr.s_addr = cpu_to_be32(IP_VS_SYNC_GROUP);
         return 0;
 }
 
diff --git a/net/netfilter/ipvs/ip_vs_wrr.c b/net/netfilter/ipvs/ip_vs_wrr.c
index fd0d4e09876a..231be7dd547a 100644
--- a/net/netfilter/ipvs/ip_vs_wrr.c
+++ b/net/netfilter/ipvs/ip_vs_wrr.c
@@ -84,7 +84,7 @@ static int ip_vs_wrr_init_svc(struct ip_vs_service *svc)
         /*
          *    Allocate the mark variable for WRR scheduling
          */
-        mark = kmalloc(sizeof(struct ip_vs_wrr_mark), GFP_ATOMIC);
+        mark = kmalloc(sizeof(struct ip_vs_wrr_mark), GFP_KERNEL);
         if (mark == NULL)
                 return -ENOMEM;
 
diff --git a/net/netfilter/nf_conntrack_acct.c b/net/netfilter/nf_conntrack_acct.c
index f4f8cda05986..d61e0782a797 100644
--- a/net/netfilter/nf_conntrack_acct.c
+++ b/net/netfilter/nf_conntrack_acct.c
@@ -69,8 +69,8 @@ static int nf_conntrack_acct_init_sysctl(struct net *net)
 
         table[0].data = &net->ct.sysctl_acct;
 
-        net->ct.acct_sysctl_header = register_net_sysctl_table(net,
-                        nf_net_netfilter_sysctl_path, table);
+        net->ct.acct_sysctl_header = register_net_sysctl(net, "net/netfilter",
+                                                         table);
         if (!net->ct.acct_sysctl_header) {
                 printk(KERN_ERR "nf_conntrack_acct: can't register to sysctl.\n");
                 goto out_register;
diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index 13fd2c55e329..f2de8c55ac50 100644
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -107,8 +107,7 @@ static int amanda_help(struct sk_buff *skb,
         /* No data? */
         dataoff = protoff + sizeof(struct udphdr);
         if (dataoff >= skb->len) {
-                if (net_ratelimit())
-                        printk(KERN_ERR "amanda_help: skblen = %u\n", skb->len);
+                net_err_ratelimited("amanda_help: skblen = %u\n", skb->len);
                 return NF_ACCEPT;
         }
 
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index fa4b82c8ae80..ac3af97cc468 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -44,6 +44,7 @@
 #include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_timestamp.h>
+#include <net/netfilter/nf_conntrack_timeout.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_core.h>
 
@@ -682,10 +683,7 @@ __nf_conntrack_alloc(struct net *net, u16 zone,
             unlikely(atomic_read(&net->ct.count) > nf_conntrack_max)) {
                 if (!early_drop(net, hash_bucket(hash, net))) {
                         atomic_dec(&net->ct.count);
-                        if (net_ratelimit())
-                                printk(KERN_WARNING
-                                       "nf_conntrack: table full, dropping"
-                                       " packet.\n");
+                        net_warn_ratelimited("nf_conntrack: table full, dropping packet\n");
                         return ERR_PTR(-ENOMEM);
                 }
         }
@@ -734,6 +732,7 @@ __nf_conntrack_alloc(struct net *net, u16 zone,
 
 #ifdef CONFIG_NF_CONNTRACK_ZONES
 out_free:
+        atomic_dec(&net->ct.count);
         kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
         return ERR_PTR(-ENOMEM);
 #endif
@@ -775,6 +774,8 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
         struct nf_conntrack_ecache *ecache;
         struct nf_conntrack_expect *exp;
         u16 zone = tmpl ? nf_ct_zone(tmpl) : NF_CT_DEFAULT_ZONE;
+        struct nf_conn_timeout *timeout_ext;
+        unsigned int *timeouts;
 
         if (!nf_ct_invert_tuple(&repl_tuple, tuple, l3proto, l4proto)) {
                 pr_debug("Can't invert tuple.\n");
@@ -786,12 +787,21 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
         if (IS_ERR(ct))
                 return (struct nf_conntrack_tuple_hash *)ct;
 
-        if (!l4proto->new(ct, skb, dataoff)) {
+        timeout_ext = tmpl ? nf_ct_timeout_find(tmpl) : NULL;
+        if (timeout_ext)
+                timeouts = NF_CT_TIMEOUT_EXT_DATA(timeout_ext);
+        else
+                timeouts = l4proto->get_timeouts(net);
+
+        if (!l4proto->new(ct, skb, dataoff, timeouts)) {
                 nf_conntrack_free(ct);
                 pr_debug("init conntrack: can't track with proto module\n");
                 return NULL;
         }
 
+        if (timeout_ext)
+                nf_ct_timeout_ext_add(ct, timeout_ext->timeout, GFP_ATOMIC);
+
         nf_ct_acct_ext_add(ct, GFP_ATOMIC);
         nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
 
@@ -913,6 +923,8 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
         enum ip_conntrack_info ctinfo;
         struct nf_conntrack_l3proto *l3proto;
         struct nf_conntrack_l4proto *l4proto;
+        struct nf_conn_timeout *timeout_ext;
+        unsigned int *timeouts;
         unsigned int dataoff;
         u_int8_t protonum;
         int set_reply = 0;
@@ -977,7 +989,14 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
 
         NF_CT_ASSERT(skb->nfct);
 
-        ret = l4proto->packet(ct, skb, dataoff, ctinfo, pf, hooknum);
+        /* Decide what timeout policy we want to apply to this flow. */
+        timeout_ext = nf_ct_timeout_find(ct);
+        if (timeout_ext)
+                timeouts = NF_CT_TIMEOUT_EXT_DATA(timeout_ext);
+        else
+                timeouts = l4proto->get_timeouts(net);
+
+        ret = l4proto->packet(ct, skb, dataoff, ctinfo, pf, hooknum, timeouts);
         if (ret <= 0) {
                 /* Invalid: inverse of the return code tells
                  * the netfilter core what to do */
@@ -1130,8 +1149,9 @@ static struct nf_ct_ext_type nf_ct_zone_extend __read_mostly = {
 int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,
                                const struct nf_conntrack_tuple *tuple)
 {
-        NLA_PUT_BE16(skb, CTA_PROTO_SRC_PORT, tuple->src.u.tcp.port);
-        NLA_PUT_BE16(skb, CTA_PROTO_DST_PORT, tuple->dst.u.tcp.port);
+        if (nla_put_be16(skb, CTA_PROTO_SRC_PORT, tuple->src.u.tcp.port) ||
+            nla_put_be16(skb, CTA_PROTO_DST_PORT, tuple->dst.u.tcp.port))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -1313,7 +1333,6 @@ static void nf_conntrack_cleanup_init_net(void)
         while (untrack_refs() > 0)
                 schedule();
 
-        nf_conntrack_helper_fini();
         nf_conntrack_proto_fini();
 #ifdef CONFIG_NF_CONNTRACK_ZONES
         nf_ct_extend_unregister(&nf_ct_zone_extend);
@@ -1331,6 +1350,8 @@ static void nf_conntrack_cleanup_net(struct net *net)
         }
 
         nf_ct_free_hashtable(net->ct.hash, net->ct.htable_size);
+        nf_conntrack_helper_fini(net);
+        nf_conntrack_timeout_fini(net);
         nf_conntrack_ecache_fini(net);
         nf_conntrack_tstamp_fini(net);
         nf_conntrack_acct_fini(net);
@@ -1480,10 +1501,6 @@ static int nf_conntrack_init_init_net(void)
         if (ret < 0)
                 goto err_proto;
 
-        ret = nf_conntrack_helper_init();
-        if (ret < 0)
-                goto err_helper;
-
 #ifdef CONFIG_NF_CONNTRACK_ZONES
         ret = nf_ct_extend_register(&nf_ct_zone_extend);
         if (ret < 0)
@@ -1501,10 +1518,8 @@ static int nf_conntrack_init_init_net(void)
 
 #ifdef CONFIG_NF_CONNTRACK_ZONES
 err_extend:
-        nf_conntrack_helper_fini();
-#endif
-err_helper:
         nf_conntrack_proto_fini();
+#endif
 err_proto:
         return ret;
 }
@@ -1562,9 +1577,19 @@ static int nf_conntrack_init_net(struct net *net)
         ret = nf_conntrack_ecache_init(net);
         if (ret < 0)
                 goto err_ecache;
+        ret = nf_conntrack_timeout_init(net);
+        if (ret < 0)
+                goto err_timeout;
+        ret = nf_conntrack_helper_init(net);
+        if (ret < 0)
+                goto err_helper;
 
         return 0;
 
+err_helper:
+        nf_conntrack_timeout_fini(net);
+err_timeout:
+        nf_conntrack_ecache_fini(net);
 err_ecache:
         nf_conntrack_tstamp_fini(net);
 err_tstamp:
diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
index 14af6329bdda..e7be79e640de 100644
--- a/net/netfilter/nf_conntrack_ecache.c
+++ b/net/netfilter/nf_conntrack_ecache.c
@@ -32,9 +32,11 @@ static DEFINE_MUTEX(nf_ct_ecache_mutex);
 void nf_ct_deliver_cached_events(struct nf_conn *ct)
 {
         struct net *net = nf_ct_net(ct);
-        unsigned long events;
+        unsigned long events, missed;
         struct nf_ct_event_notifier *notify;
         struct nf_conntrack_ecache *e;
+        struct nf_ct_event item;
+        int ret;
 
         rcu_read_lock();
         notify = rcu_dereference(net->ct.nf_conntrack_event_cb);
@@ -47,31 +49,32 @@ void nf_ct_deliver_cached_events(struct nf_conn *ct)
 
         events = xchg(&e->cache, 0);
 
-        if (nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct) && events) {
-                struct nf_ct_event item = {
-                        .ct     = ct,
-                        .pid    = 0,
-                        .report = 0
-                };
-                int ret;
-                /* We make a copy of the missed event cache without taking
-                 * the lock, thus we may send missed events twice. However,
-                 * this does not harm and it happens very rarely. */
-                unsigned long missed = e->missed;
-
-                if (!((events | missed) & e->ctmask))
-                        goto out_unlock;
-
-                ret = notify->fcn(events | missed, &item);
-                if (unlikely(ret < 0 || missed)) {
-                        spin_lock_bh(&ct->lock);
-                        if (ret < 0)
-                                e->missed |= events;
-                        else
-                                e->missed &= ~missed;
-                        spin_unlock_bh(&ct->lock);
-                } 
-        }
+        if (!nf_ct_is_confirmed(ct) || nf_ct_is_dying(ct) || !events)
+                goto out_unlock;
+
+        /* We make a copy of the missed event cache without taking
+         * the lock, thus we may send missed events twice. However,
+         * this does not harm and it happens very rarely. */
+        missed = e->missed;
+
+        if (!((events | missed) & e->ctmask))
+                goto out_unlock;
+
+        item.ct = ct;
+        item.pid = 0;
+        item.report = 0;
+
+        ret = notify->fcn(events | missed, &item);
+
+        if (likely(ret >= 0 && !missed))
+                goto out_unlock;
+
+        spin_lock_bh(&ct->lock);
+        if (ret < 0)
+                e->missed |= events;
+        else
+                e->missed &= ~missed;
+        spin_unlock_bh(&ct->lock);
 
 out_unlock:
         rcu_read_unlock();
@@ -81,7 +84,7 @@ EXPORT_SYMBOL_GPL(nf_ct_deliver_cached_events);
 int nf_conntrack_register_notifier(struct net *net,
                                    struct nf_ct_event_notifier *new)
 {
-        int ret = 0;
+        int ret;
         struct nf_ct_event_notifier *notify;
 
         mutex_lock(&nf_ct_ecache_mutex);
@@ -92,8 +95,7 @@ int nf_conntrack_register_notifier(struct net *net,
                 goto out_unlock;
         }
         rcu_assign_pointer(net->ct.nf_conntrack_event_cb, new);
-        mutex_unlock(&nf_ct_ecache_mutex);
-        return ret;
+        ret = 0;
 
 out_unlock:
         mutex_unlock(&nf_ct_ecache_mutex);
@@ -118,7 +120,7 @@ EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);
 int nf_ct_expect_register_notifier(struct net *net,
                                    struct nf_exp_event_notifier *new)
 {
-        int ret = 0;
+        int ret;
         struct nf_exp_event_notifier *notify;
 
         mutex_lock(&nf_ct_ecache_mutex);
@@ -129,8 +131,7 @@ int nf_ct_expect_register_notifier(struct net *net,
                 goto out_unlock;
         }
         rcu_assign_pointer(net->ct.nf_expect_event_cb, new);
-        mutex_unlock(&nf_ct_ecache_mutex);
-        return ret;
+        ret = 0;
 
 out_unlock:
         mutex_unlock(&nf_ct_ecache_mutex);
@@ -196,8 +197,7 @@ static int nf_conntrack_event_init_sysctl(struct net *net)
         table[1].data = &net->ct.sysctl_events_retry_timeout;
 
         net->ct.event_sysctl_header =
-                register_net_sysctl_table(net,
-                                          nf_net_netfilter_sysctl_path, table);
+                register_net_sysctl(net, "net/netfilter", table);
         if (!net->ct.event_sysctl_header) {
                 printk(KERN_ERR "nf_ct_event: can't register to sysctl.\n");
                 goto out_register;
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 4147ba3f653c..45cf602a76bc 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -424,9 +424,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
         }
 
         if (net->ct.expect_count >= nf_ct_expect_max) {
-                if (net_ratelimit())
-                        printk(KERN_WARNING
-                               "nf_conntrack: expectation table full\n");
+                net_warn_ratelimited("nf_conntrack: expectation table full\n");
                 ret = -EMFILE;
         }
 out:
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 722291f8af72..46d69d7f1bb4 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -605,8 +605,7 @@ static int h245_help(struct sk_buff *skb, unsigned int protoff,
 
       drop:
         spin_unlock_bh(&nf_h323_lock);
-        if (net_ratelimit())
-                pr_info("nf_ct_h245: packet dropped\n");
+        net_info_ratelimited("nf_ct_h245: packet dropped\n");
         return NF_DROP;
 }
 
@@ -1156,8 +1155,7 @@ static int q931_help(struct sk_buff *skb, unsigned int protoff,
 
       drop:
         spin_unlock_bh(&nf_h323_lock);
-        if (net_ratelimit())
-                pr_info("nf_ct_q931: packet dropped\n");
+        net_info_ratelimited("nf_ct_q931: packet dropped\n");
         return NF_DROP;
 }
 
@@ -1230,7 +1228,7 @@ static struct nf_conntrack_expect *find_expect(struct nf_conn *ct,
 
 /****************************************************************************/
 static int set_expect_timeout(struct nf_conntrack_expect *exp,
-                              unsigned timeout)
+                              unsigned int timeout)
 {
         if (!exp || !del_timer(&exp->timeout))
                 return 0;
@@ -1731,8 +1729,7 @@ static int ras_help(struct sk_buff *skb, unsigned int protoff,
 
       drop:
         spin_unlock_bh(&nf_h323_lock);
-        if (net_ratelimit())
-                pr_info("nf_ct_ras: packet dropped\n");
+        net_info_ratelimited("nf_ct_ras: packet dropped\n");
         return NF_DROP;
 }
 
@@ -1833,4 +1830,6 @@ MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>");
 MODULE_DESCRIPTION("H.323 connection tracking helper");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ip_conntrack_h323");
-MODULE_ALIAS_NFCT_HELPER("h323");
+MODULE_ALIAS_NFCT_HELPER("RAS");
+MODULE_ALIAS_NFCT_HELPER("Q.931");
+MODULE_ALIAS_NFCT_HELPER("H.245");
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index bbe23baa19b6..4fa2ff961f5a 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -34,6 +34,67 @@ static struct hlist_head *nf_ct_helper_hash __read_mostly;
 static unsigned int nf_ct_helper_hsize __read_mostly;
 static unsigned int nf_ct_helper_count __read_mostly;
 
+static bool nf_ct_auto_assign_helper __read_mostly = true;
+module_param_named(nf_conntrack_helper, nf_ct_auto_assign_helper, bool, 0644);
+MODULE_PARM_DESC(nf_conntrack_helper,
+                 "Enable automatic conntrack helper assignment (default 1)");
+
+#ifdef CONFIG_SYSCTL
+static struct ctl_table helper_sysctl_table[] = {
+        {
+                .procname       = "nf_conntrack_helper",
+                .data           = &init_net.ct.sysctl_auto_assign_helper,
+                .maxlen         = sizeof(unsigned int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {}
+};
+
+static int nf_conntrack_helper_init_sysctl(struct net *net)
+{
+        struct ctl_table *table;
+
+        table = kmemdup(helper_sysctl_table, sizeof(helper_sysctl_table),
+                        GFP_KERNEL);
+        if (!table)
+                goto out;
+
+        table[0].data = &net->ct.sysctl_auto_assign_helper;
+
+        net->ct.helper_sysctl_header =
+                register_net_sysctl(net, "net/netfilter", table);
+
+        if (!net->ct.helper_sysctl_header) {
+                pr_err("nf_conntrack_helper: can't register to sysctl.\n");
+                goto out_register;
+        }
+        return 0;
+
+out_register:
+        kfree(table);
+out:
+        return -ENOMEM;
+}
+
+static void nf_conntrack_helper_fini_sysctl(struct net *net)
+{
+        struct ctl_table *table;
+
+        table = net->ct.helper_sysctl_header->ctl_table_arg;
+        unregister_net_sysctl_table(net->ct.helper_sysctl_header);
+        kfree(table);
+}
+#else
+static int nf_conntrack_helper_init_sysctl(struct net *net)
+{
+        return 0;
+}
+
+static void nf_conntrack_helper_fini_sysctl(struct net *net)
+{
+}
+#endif /* CONFIG_SYSCTL */
 
 /* Stupid hash, but collision free for the default registrations of the
  * helpers currently in the kernel. */
@@ -118,17 +179,38 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
 {
         struct nf_conntrack_helper *helper = NULL;
         struct nf_conn_help *help;
+        struct net *net = nf_ct_net(ct);
         int ret = 0;
 
+        /* We already got a helper explicitly attached. The function
+         * nf_conntrack_alter_reply - in case NAT is in use - asks for looking
+         * the helper up again. Since now the user is in full control of
+         * making consistent helper configurations, skip this automatic
+         * re-lookup, otherwise we'll lose the helper.
+         */
+        if (test_bit(IPS_HELPER_BIT, &ct->status))
+                return 0;
+
         if (tmpl != NULL) {
                 help = nfct_help(tmpl);
-                if (help != NULL)
+                if (help != NULL) {
                         helper = help->helper;
+                        set_bit(IPS_HELPER_BIT, &ct->status);
+                }
         }
 
         help = nfct_help(ct);
-        if (helper == NULL)
+        if (net->ct.sysctl_auto_assign_helper && helper == NULL) {
                 helper = __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+                if (unlikely(!net->ct.auto_assign_helper_warned && helper)) {
+                        pr_info("nf_conntrack: automatic helper "
+                                "assignment is deprecated and it will "
+                                "be removed soon. Use the iptables CT target "
+                                "to attach helpers instead.\n");
+                        net->ct.auto_assign_helper_warned = true;
+                }
+        }
+
         if (helper == NULL) {
                 if (help)
                         RCU_INIT_POINTER(help->helper, NULL);
@@ -181,6 +263,60 @@ void nf_ct_helper_destroy(struct nf_conn *ct)
         }
 }
 
+static LIST_HEAD(nf_ct_helper_expectfn_list);
+
+void nf_ct_helper_expectfn_register(struct nf_ct_helper_expectfn *n)
+{
+        spin_lock_bh(&nf_conntrack_lock);
+        list_add_rcu(&n->head, &nf_ct_helper_expectfn_list);
+        spin_unlock_bh(&nf_conntrack_lock);
+}
+EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_register);
+
+void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n)
+{
+        spin_lock_bh(&nf_conntrack_lock);
+        list_del_rcu(&n->head);
+        spin_unlock_bh(&nf_conntrack_lock);
+}
+EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_unregister);
+
+struct nf_ct_helper_expectfn *
+nf_ct_helper_expectfn_find_by_name(const char *name)
+{
+        struct nf_ct_helper_expectfn *cur;
+        bool found = false;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(cur, &nf_ct_helper_expectfn_list, head) {
+                if (!strcmp(cur->name, name)) {
+                        found = true;
+                        break;
+                }
+        }
+        rcu_read_unlock();
+        return found ? cur : NULL;
+}
+EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_find_by_name);
+
+struct nf_ct_helper_expectfn *
+nf_ct_helper_expectfn_find_by_symbol(const void *symbol)
+{
+        struct nf_ct_helper_expectfn *cur;
+        bool found = false;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(cur, &nf_ct_helper_expectfn_list, head) {
+                if (cur->expectfn == symbol) {
+                        found = true;
+                        break;
+                }
+        }
+        rcu_read_unlock();
+        return found ? cur : NULL;
+}
+EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_find_by_symbol);
+
 int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
 {
         unsigned int h = helper_hash(&me->tuple);
@@ -261,28 +397,44 @@ static struct nf_ct_ext_type helper_extend __read_mostly = {
         .id     = NF_CT_EXT_HELPER,
 };
 
-int nf_conntrack_helper_init(void)
+int nf_conntrack_helper_init(struct net *net)
 {
         int err;
 
-        nf_ct_helper_hsize = 1; /* gets rounded up to use one page */
-        nf_ct_helper_hash = nf_ct_alloc_hashtable(&nf_ct_helper_hsize, 0);
-        if (!nf_ct_helper_hash)
-                return -ENOMEM;
+        net->ct.auto_assign_helper_warned = false;
+        net->ct.sysctl_auto_assign_helper = nf_ct_auto_assign_helper;
+
+        if (net_eq(net, &init_net)) {
+                nf_ct_helper_hsize = 1; /* gets rounded up to use one page */
+                nf_ct_helper_hash =
+                        nf_ct_alloc_hashtable(&nf_ct_helper_hsize, 0);
+                if (!nf_ct_helper_hash)
+                        return -ENOMEM;
+
+                err = nf_ct_extend_register(&helper_extend);
+                if (err < 0)
+                        goto err1;
+        }
 
-        err = nf_ct_extend_register(&helper_extend);
+        err = nf_conntrack_helper_init_sysctl(net);
         if (err < 0)
-                goto err1;
+                goto out_sysctl;
 
         return 0;
 
+out_sysctl:
+        if (net_eq(net, &init_net))
+                nf_ct_extend_unregister(&helper_extend);
 err1:
         nf_ct_free_hashtable(nf_ct_helper_hash, nf_ct_helper_hsize);
         return err;
 }
 
-void nf_conntrack_helper_fini(void)
+void nf_conntrack_helper_fini(struct net *net)
 {
-        nf_ct_extend_unregister(&helper_extend);
-        nf_ct_free_hashtable(nf_ct_helper_hash, nf_ct_helper_hsize);
+        nf_conntrack_helper_fini_sysctl(net);
+        if (net_eq(net, &init_net)) {
+                nf_ct_extend_unregister(&helper_extend);
+                nf_ct_free_hashtable(nf_ct_helper_hash, nf_ct_helper_hsize);
+        }
 }
diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 4f9390b98697..81366c118271 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -185,11 +185,9 @@ static int help(struct sk_buff *skb, unsigned int protoff,
                         tuple = &ct->tuplehash[dir].tuple;
                         if (tuple->src.u3.ip != dcc_ip &&
                             tuple->dst.u3.ip != dcc_ip) {
-                                if (net_ratelimit())
-                                        printk(KERN_WARNING
-                                                "Forged DCC command from %pI4: %pI4:%u\n",
-                                                &tuple->src.u3.ip,
-                                                &dcc_ip, dcc_port);
+                                net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n",
+                                                     &tuple->src.u3.ip,
+                                                     &dcc_ip, dcc_port);
                                 continue;
                         }
 
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index b49da6c925b3..6f4b00a8fc73 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -66,7 +66,8 @@ ctnetlink_dump_tuples_proto(struct sk_buff *skb,
         nest_parms = nla_nest_start(skb, CTA_TUPLE_PROTO | NLA_F_NESTED);
         if (!nest_parms)
                 goto nla_put_failure;
-        NLA_PUT_U8(skb, CTA_PROTO_NUM, tuple->dst.protonum);
+        if (nla_put_u8(skb, CTA_PROTO_NUM, tuple->dst.protonum))
+                goto nla_put_failure;
 
         if (likely(l4proto->tuple_to_nlattr))
                 ret = l4proto->tuple_to_nlattr(skb, tuple);
@@ -110,22 +111,24 @@ ctnetlink_dump_tuples(struct sk_buff *skb,
         struct nf_conntrack_l3proto *l3proto;
         struct nf_conntrack_l4proto *l4proto;
 
+        rcu_read_lock();
         l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
         ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);
 
-        if (unlikely(ret < 0))
-                return ret;
-
-        l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
-        ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);
-
+        if (ret >= 0) {
+                l4proto = __nf_ct_l4proto_find(tuple->src.l3num,
+                                               tuple->dst.protonum);
+                ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);
+        }
+        rcu_read_unlock();
         return ret;
 }
 
 static inline int
 ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)
 {
-        NLA_PUT_BE32(skb, CTA_STATUS, htonl(ct->status));
+        if (nla_put_be32(skb, CTA_STATUS, htonl(ct->status)))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -140,7 +143,8 @@ ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)
         if (timeout < 0)
                 timeout = 0;
 
-        NLA_PUT_BE32(skb, CTA_TIMEOUT, htonl(timeout));
+        if (nla_put_be32(skb, CTA_TIMEOUT, htonl(timeout)))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -189,7 +193,8 @@ ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct nf_conn *ct)
         nest_helper = nla_nest_start(skb, CTA_HELP | NLA_F_NESTED);
         if (!nest_helper)
                 goto nla_put_failure;
-        NLA_PUT_STRING(skb, CTA_HELP_NAME, helper->name);
+        if (nla_put_string(skb, CTA_HELP_NAME, helper->name))
+                goto nla_put_failure;
 
         if (helper->to_nlattr)
                 helper->to_nlattr(skb, ct);
@@ -213,8 +218,9 @@ dump_counters(struct sk_buff *skb, u64 pkts, u64 bytes,
         if (!nest_count)
                 goto nla_put_failure;
 
-        NLA_PUT_BE64(skb, CTA_COUNTERS_PACKETS, cpu_to_be64(pkts));
-        NLA_PUT_BE64(skb, CTA_COUNTERS_BYTES, cpu_to_be64(bytes));
+        if (nla_put_be64(skb, CTA_COUNTERS_PACKETS, cpu_to_be64(pkts)) ||
+            nla_put_be64(skb, CTA_COUNTERS_BYTES, cpu_to_be64(bytes)))
+                goto nla_put_failure;
 
         nla_nest_end(skb, nest_count);
 
@@ -259,11 +265,10 @@ ctnetlink_dump_timestamp(struct sk_buff *skb, const struct nf_conn *ct)
         if (!nest_count)
                 goto nla_put_failure;
 
-        NLA_PUT_BE64(skb, CTA_TIMESTAMP_START, cpu_to_be64(tstamp->start));
-        if (tstamp->stop != 0) {
-                NLA_PUT_BE64(skb, CTA_TIMESTAMP_STOP,
-                             cpu_to_be64(tstamp->stop));
-        }
+        if (nla_put_be64(skb, CTA_TIMESTAMP_START, cpu_to_be64(tstamp->start)) ||
+            (tstamp->stop != 0 && nla_put_be64(skb, CTA_TIMESTAMP_STOP,
+                                               cpu_to_be64(tstamp->stop))))
+                goto nla_put_failure;
         nla_nest_end(skb, nest_count);
 
         return 0;
@@ -276,7 +281,8 @@ nla_put_failure:
 static inline int
 ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)
 {
-        NLA_PUT_BE32(skb, CTA_MARK, htonl(ct->mark));
+        if (nla_put_be32(skb, CTA_MARK, htonl(ct->mark)))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -303,7 +309,8 @@ ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)
         if (!nest_secctx)
                 goto nla_put_failure;
 
-        NLA_PUT_STRING(skb, CTA_SECCTX_NAME, secctx);
+        if (nla_put_string(skb, CTA_SECCTX_NAME, secctx))
+                goto nla_put_failure;
         nla_nest_end(skb, nest_secctx);
 
         ret = 0;
@@ -348,12 +355,13 @@ dump_nat_seq_adj(struct sk_buff *skb, const struct nf_nat_seq *natseq, int type)
         if (!nest_parms)
                 goto nla_put_failure;
 
-        NLA_PUT_BE32(skb, CTA_NAT_SEQ_CORRECTION_POS,
-                     htonl(natseq->correction_pos));
-        NLA_PUT_BE32(skb, CTA_NAT_SEQ_OFFSET_BEFORE,
-                     htonl(natseq->offset_before));
-        NLA_PUT_BE32(skb, CTA_NAT_SEQ_OFFSET_AFTER,
-                     htonl(natseq->offset_after));
+        if (nla_put_be32(skb, CTA_NAT_SEQ_CORRECTION_POS,
+                         htonl(natseq->correction_pos)) ||
+            nla_put_be32(skb, CTA_NAT_SEQ_OFFSET_BEFORE,
+                         htonl(natseq->offset_before)) ||
+            nla_put_be32(skb, CTA_NAT_SEQ_OFFSET_AFTER,
+                         htonl(natseq->offset_after)))
+                goto nla_put_failure;
 
         nla_nest_end(skb, nest_parms);
 
@@ -389,7 +397,8 @@ ctnetlink_dump_nat_seq_adj(struct sk_buff *skb, const struct nf_conn *ct)
 static inline int
 ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)
 {
-        NLA_PUT_BE32(skb, CTA_ID, htonl((unsigned long)ct));
+        if (nla_put_be32(skb, CTA_ID, htonl((unsigned long)ct)))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -399,7 +408,8 @@ nla_put_failure:
 static inline int
 ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct)
 {
-        NLA_PUT_BE32(skb, CTA_USE, htonl(atomic_read(&ct->ct_general.use)));
+        if (nla_put_be32(skb, CTA_USE, htonl(atomic_read(&ct->ct_general.use))))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -439,8 +449,9 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq, u32 type,
                 goto nla_put_failure;
         nla_nest_end(skb, nest_parms);
 
-        if (nf_ct_zone(ct))
-                NLA_PUT_BE16(skb, CTA_ZONE, htons(nf_ct_zone(ct)));
+        if (nf_ct_zone(ct) &&
+            nla_put_be16(skb, CTA_ZONE, htons(nf_ct_zone(ct))))
+                goto nla_put_failure;
 
         if (ctnetlink_dump_status(skb, ct) < 0 ||
             ctnetlink_dump_timeout(skb, ct) < 0 ||
@@ -616,8 +627,9 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
                 goto nla_put_failure;
         nla_nest_end(skb, nest_parms);
 
-        if (nf_ct_zone(ct))
-                NLA_PUT_BE16(skb, CTA_ZONE, htons(nf_ct_zone(ct)));
+        if (nf_ct_zone(ct) &&
+            nla_put_be16(skb, CTA_ZONE, htons(nf_ct_zone(ct))))
+                goto nla_put_failure;
 
         if (ctnetlink_dump_id(skb, ct) < 0)
                 goto nla_put_failure;
@@ -691,9 +703,18 @@ static int ctnetlink_done(struct netlink_callback *cb)
 {
         if (cb->args[1])
                 nf_ct_put((struct nf_conn *)cb->args[1]);
+        if (cb->data)
+                kfree(cb->data);
         return 0;
 }
 
+struct ctnetlink_dump_filter {
+        struct {
+                u_int32_t val;
+                u_int32_t mask;
+        } mark;
+};
+
 static int
 ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 {
@@ -703,6 +724,10 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         struct hlist_nulls_node *n;
         struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
         u_int8_t l3proto = nfmsg->nfgen_family;
+        int res;
+#ifdef CONFIG_NF_CONNTRACK_MARK
+        const struct ctnetlink_dump_filter *filter = cb->data;
+#endif
 
         spin_lock_bh(&nf_conntrack_lock);
         last = (struct nf_conn *)cb->args[1];
@@ -723,11 +748,20 @@ restart:
                                         continue;
                                 cb->args[1] = 0;
                         }
-                        if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
-                                                cb->nlh->nlmsg_seq,
-                                                NFNL_MSG_TYPE(
-                                                        cb->nlh->nlmsg_type),
-                                                ct) < 0) {
+#ifdef CONFIG_NF_CONNTRACK_MARK
+                        if (filter && !((ct->mark & filter->mark.mask) ==
+                                        filter->mark.val)) {
+                                continue;
+                        }
+#endif
+                        rcu_read_lock();
+                        res =
+                        ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
+                                            cb->nlh->nlmsg_seq,
+                                            NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
+                                            ct);
+                        rcu_read_unlock();
+                        if (res < 0) {
                                 nf_conntrack_get(&ct->ct_general);
                                 cb->args[1] = (unsigned long)ct;
                                 goto out;
@@ -894,6 +928,7 @@ static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {
         [CTA_NAT_DST]           = { .type = NLA_NESTED },
         [CTA_TUPLE_MASTER]      = { .type = NLA_NESTED },
         [CTA_ZONE]              = { .type = NLA_U16 },
+        [CTA_MARK_MASK]         = { .type = NLA_U32 },
 };
 
 static int
@@ -978,9 +1013,28 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
         u16 zone;
         int err;
 
-        if (nlh->nlmsg_flags & NLM_F_DUMP)
-                return netlink_dump_start(ctnl, skb, nlh, ctnetlink_dump_table,
-                                          ctnetlink_done, 0);
+        if (nlh->nlmsg_flags & NLM_F_DUMP) {
+                struct netlink_dump_control c = {
+                        .dump = ctnetlink_dump_table,
+                        .done = ctnetlink_done,
+                };
+#ifdef CONFIG_NF_CONNTRACK_MARK
+                if (cda[CTA_MARK] && cda[CTA_MARK_MASK]) {
+                        struct ctnetlink_dump_filter *filter;
+
+                        filter = kzalloc(sizeof(struct ctnetlink_dump_filter),
+                                         GFP_ATOMIC);
+                        if (filter == NULL)
+                                return -ENOMEM;
+
+                        filter->mark.val = ntohl(nla_get_be32(cda[CTA_MARK]));
+                        filter->mark.mask =
+                                ntohl(nla_get_be32(cda[CTA_MARK_MASK]));
+                        c.data = filter;
+                }
+#endif
+                return netlink_dump_start(ctnl, skb, nlh, &c);
+        }
 
         err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
         if (err < 0)
@@ -1610,14 +1664,16 @@ ctnetlink_exp_dump_mask(struct sk_buff *skb,
         if (!nest_parms)
                 goto nla_put_failure;
 
+        rcu_read_lock();
         l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
         ret = ctnetlink_dump_tuples_ip(skb, &m, l3proto);
-
-        if (unlikely(ret < 0))
-                goto nla_put_failure;
-
-        l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
+        if (ret >= 0) {
+                l4proto = __nf_ct_l4proto_find(tuple->src.l3num,
+                                               tuple->dst.protonum);
         ret = ctnetlink_dump_tuples_proto(skb, &m, l4proto);
+        }
+        rcu_read_unlock();
+
         if (unlikely(ret < 0))
                 goto nla_put_failure;
 
@@ -1636,6 +1692,11 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
         struct nf_conn *master = exp->master;
         long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;
         struct nf_conn_help *help;
+#ifdef CONFIG_NF_NAT_NEEDED
+        struct nlattr *nest_parms;
+        struct nf_conntrack_tuple nat_tuple = {};
+#endif
+        struct nf_ct_helper_expectfn *expfn;
 
         if (timeout < 0)
                 timeout = 0;
@@ -1649,17 +1710,44 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
                                  CTA_EXPECT_MASTER) < 0)
                 goto nla_put_failure;
 
-        NLA_PUT_BE32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout));
-        NLA_PUT_BE32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp));
-        NLA_PUT_BE32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags));
+#ifdef CONFIG_NF_NAT_NEEDED
+        if (exp->saved_ip || exp->saved_proto.all) {
+                nest_parms = nla_nest_start(skb, CTA_EXPECT_NAT | NLA_F_NESTED);
+                if (!nest_parms)
+                        goto nla_put_failure;
+
+                if (nla_put_be32(skb, CTA_EXPECT_NAT_DIR, htonl(exp->dir)))
+                        goto nla_put_failure;
+
+                nat_tuple.src.l3num = nf_ct_l3num(master);
+                nat_tuple.src.u3.ip = exp->saved_ip;
+                nat_tuple.dst.protonum = nf_ct_protonum(master);
+                nat_tuple.src.u = exp->saved_proto;
+
+                if (ctnetlink_exp_dump_tuple(skb, &nat_tuple,
+                                                CTA_EXPECT_NAT_TUPLE) < 0)
+                        goto nla_put_failure;
+                nla_nest_end(skb, nest_parms);
+        }
+#endif
+        if (nla_put_be32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout)) ||
+            nla_put_be32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp)) ||
+            nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) ||
+            nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class)))
+                goto nla_put_failure;
         help = nfct_help(master);
         if (help) {
                 struct nf_conntrack_helper *helper;
 
                 helper = rcu_dereference(help->helper);
-                if (helper)
-                        NLA_PUT_STRING(skb, CTA_EXPECT_HELP_NAME, helper->name);
+                if (helper &&
+                    nla_put_string(skb, CTA_EXPECT_HELP_NAME, helper->name))
+                        goto nla_put_failure;
         }
+        expfn = nf_ct_helper_expectfn_find_by_symbol(exp->expectfn);
+        if (expfn != NULL &&
+            nla_put_string(skb, CTA_EXPECT_FN, expfn->name))
+                goto nla_put_failure;
 
         return 0;
 
@@ -1817,6 +1905,9 @@ static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {
         [CTA_EXPECT_HELP_NAME]  = { .type = NLA_NUL_STRING },
         [CTA_EXPECT_ZONE]       = { .type = NLA_U16 },
         [CTA_EXPECT_FLAGS]      = { .type = NLA_U32 },
+        [CTA_EXPECT_CLASS]      = { .type = NLA_U32 },
+        [CTA_EXPECT_NAT]        = { .type = NLA_NESTED },
+        [CTA_EXPECT_FN]         = { .type = NLA_NUL_STRING },
 };
 
 static int
@@ -1834,9 +1925,11 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
         int err;
 
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
-                return netlink_dump_start(ctnl, skb, nlh,
-                                          ctnetlink_exp_dump_table,
-                                          ctnetlink_exp_done, 0);
+                struct netlink_dump_control c = {
+                        .dump = ctnetlink_exp_dump_table,
+                        .done = ctnetlink_exp_done,
+                };
+                return netlink_dump_start(ctnl, skb, nlh, &c);
         }
 
         err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
@@ -1987,7 +2080,50 @@ static int
 ctnetlink_change_expect(struct nf_conntrack_expect *x,
                         const struct nlattr * const cda[])
 {
+        if (cda[CTA_EXPECT_TIMEOUT]) {
+                if (!del_timer(&x->timeout))
+                        return -ETIME;
+
+                x->timeout.expires = jiffies +
+                        ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;
+                add_timer(&x->timeout);
+        }
+        return 0;
+}
+
+static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = {
+        [CTA_EXPECT_NAT_DIR]    = { .type = NLA_U32 },
+        [CTA_EXPECT_NAT_TUPLE]  = { .type = NLA_NESTED },
+};
+
+static int
+ctnetlink_parse_expect_nat(const struct nlattr *attr,
+                           struct nf_conntrack_expect *exp,
+                           u_int8_t u3)
+{
+#ifdef CONFIG_NF_NAT_NEEDED
+        struct nlattr *tb[CTA_EXPECT_NAT_MAX+1];
+        struct nf_conntrack_tuple nat_tuple = {};
+        int err;
+
+        nla_parse_nested(tb, CTA_EXPECT_NAT_MAX, attr, exp_nat_nla_policy);
+
+        if (!tb[CTA_EXPECT_NAT_DIR] || !tb[CTA_EXPECT_NAT_TUPLE])
+                return -EINVAL;
+
+        err = ctnetlink_parse_tuple((const struct nlattr * const *)tb,
+                                        &nat_tuple, CTA_EXPECT_NAT_TUPLE, u3);
+        if (err < 0)
+                return err;
+
+        exp->saved_ip = nat_tuple.src.u3.ip;
+        exp->saved_proto = nat_tuple.src.u;
+        exp->dir = ntohl(nla_get_be32(tb[CTA_EXPECT_NAT_DIR]));
+
+        return 0;
+#else
         return -EOPNOTSUPP;
+#endif
 }
 
 static int
@@ -2001,6 +2137,8 @@ ctnetlink_create_expect(struct net *net, u16 zone,
         struct nf_conntrack_expect *exp;
         struct nf_conn *ct;
         struct nf_conn_help *help;
+        struct nf_conntrack_helper *helper = NULL;
+        u_int32_t class = 0;
         int err = 0;
 
         /* caller guarantees that those three CTA_EXPECT_* exist */
@@ -2019,6 +2157,40 @@ ctnetlink_create_expect(struct net *net, u16 zone,
         if (!h)
                 return -ENOENT;
         ct = nf_ct_tuplehash_to_ctrack(h);
+
+        /* Look for helper of this expectation */
+        if (cda[CTA_EXPECT_HELP_NAME]) {
+                const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);
+
+                helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
+                                                    nf_ct_protonum(ct));
+                if (helper == NULL) {
+#ifdef CONFIG_MODULES
+                        if (request_module("nfct-helper-%s", helpname) < 0) {
+                                err = -EOPNOTSUPP;
+                                goto out;
+                        }
+
+                        helper = __nf_conntrack_helper_find(helpname,
+                                                            nf_ct_l3num(ct),
+                                                            nf_ct_protonum(ct));
+                        if (helper) {
+                                err = -EAGAIN;
+                                goto out;
+                        }
+#endif
+                        err = -EOPNOTSUPP;
+                        goto out;
+                }
+        }
+
+        if (cda[CTA_EXPECT_CLASS] && helper) {
+                class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS]));
+                if (class > helper->expect_class_max) {
+                        err = -EINVAL;
+                        goto out;
+                }
+        }
         exp = nf_ct_expect_alloc(ct);
         if (!exp) {
                 err = -ENOMEM;
@@ -2045,18 +2217,35 @@ ctnetlink_create_expect(struct net *net, u16 zone,
                 } else
                         exp->flags = 0;
         }
+        if (cda[CTA_EXPECT_FN]) {
+                const char *name = nla_data(cda[CTA_EXPECT_FN]);
+                struct nf_ct_helper_expectfn *expfn;
+
+                expfn = nf_ct_helper_expectfn_find_by_name(name);
+                if (expfn == NULL) {
+                        err = -EINVAL;
+                        goto err_out;
+                }
+                exp->expectfn = expfn->expectfn;
+        } else
+                exp->expectfn = NULL;
 
-        exp->class = 0;
-        exp->expectfn = NULL;
+        exp->class = class;
         exp->master = ct;
-        exp->helper = NULL;
+        exp->helper = helper;
         memcpy(&exp->tuple, &tuple, sizeof(struct nf_conntrack_tuple));
         memcpy(&exp->mask.src.u3, &mask.src.u3, sizeof(exp->mask.src.u3));
         exp->mask.src.u.all = mask.src.u.all;
 
+        if (cda[CTA_EXPECT_NAT]) {
+                err = ctnetlink_parse_expect_nat(cda[CTA_EXPECT_NAT],
+                                                 exp, u3);
+                if (err < 0)
+                        goto err_out;
+        }
         err = nf_ct_expect_related_report(exp, pid, report);
+err_out:
         nf_ct_expect_put(exp);
-
 out:
         nf_ct_put(nf_ct_tuplehash_to_ctrack(h));
         return err;
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index 5701c8dd783c..8b631b07a645 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -36,11 +36,11 @@ static DEFINE_MUTEX(nf_ct_proto_mutex);
 
 #ifdef CONFIG_SYSCTL
 static int
-nf_ct_register_sysctl(struct ctl_table_header **header, struct ctl_path *path,
+nf_ct_register_sysctl(struct ctl_table_header **header, const char *path,
                       struct ctl_table *table, unsigned int *users)
 {
         if (*header == NULL) {
-                *header = register_sysctl_paths(path, table);
+                *header = register_net_sysctl(&init_net, path, table);
                 if (*header == NULL)
                         return -ENOMEM;
         }
@@ -56,7 +56,7 @@ nf_ct_unregister_sysctl(struct ctl_table_header **header,
         if (users != NULL && --*users > 0)
                 return;
 
-        unregister_sysctl_table(*header);
+        unregister_net_sysctl_table(*header);
         *header = NULL;
 }
 #endif
@@ -127,6 +127,27 @@ void nf_ct_l3proto_module_put(unsigned short l3proto)
 }
 EXPORT_SYMBOL_GPL(nf_ct_l3proto_module_put);
 
+struct nf_conntrack_l4proto *
+nf_ct_l4proto_find_get(u_int16_t l3num, u_int8_t l4num)
+{
+        struct nf_conntrack_l4proto *p;
+
+        rcu_read_lock();
+        p = __nf_ct_l4proto_find(l3num, l4num);
+        if (!try_module_get(p->me))
+                p = &nf_conntrack_l4proto_generic;
+        rcu_read_unlock();
+
+        return p;
+}
+EXPORT_SYMBOL_GPL(nf_ct_l4proto_find_get);
+
+void nf_ct_l4proto_put(struct nf_conntrack_l4proto *p)
+{
+        module_put(p->me);
+}
+EXPORT_SYMBOL_GPL(nf_ct_l4proto_put);
+
 static int kill_l3proto(struct nf_conn *i, void *data)
 {
         return nf_ct_l3num(i) == ((struct nf_conntrack_l3proto *)data)->l3proto;
@@ -229,7 +250,7 @@ static int nf_ct_l4proto_register_sysctl(struct nf_conntrack_l4proto *l4proto)
 #ifdef CONFIG_SYSCTL
         if (l4proto->ctl_table != NULL) {
                 err = nf_ct_register_sysctl(l4proto->ctl_table_header,
-                                            nf_net_netfilter_sysctl_path,
+                                            "net/netfilter",
                                             l4proto->ctl_table,
                                             l4proto->ctl_table_users);
                 if (err < 0)
@@ -238,7 +259,7 @@ static int nf_ct_l4proto_register_sysctl(struct nf_conntrack_l4proto *l4proto)
 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
         if (l4proto->ctl_compat_table != NULL) {
                 err = nf_ct_register_sysctl(&l4proto->ctl_compat_table_header,
-                                            nf_net_ipv4_netfilter_sysctl_path,
+                                            "net/ipv4/netfilter",
                                             l4proto->ctl_compat_table, NULL);
                 if (err == 0)
                         goto out;
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index d6dde6dc09e6..ef706a485be1 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -423,7 +423,7 @@ static bool dccp_invert_tuple(struct nf_conntrack_tuple *inv,
 }
 
 static bool dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
-                     unsigned int dataoff)
+                     unsigned int dataoff, unsigned int *timeouts)
 {
         struct net *net = nf_ct_net(ct);
         struct dccp_net *dn;
@@ -472,12 +472,17 @@ static u64 dccp_ack_seq(const struct dccp_hdr *dh)
                      ntohl(dhack->dccph_ack_nr_low);
 }
 
+static unsigned int *dccp_get_timeouts(struct net *net)
+{
+        return dccp_pernet(net)->dccp_timeout;
+}
+
 static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
                        unsigned int dataoff, enum ip_conntrack_info ctinfo,
-                       u_int8_t pf, unsigned int hooknum)
+                       u_int8_t pf, unsigned int hooknum,
+                       unsigned int *timeouts)
 {
         struct net *net = nf_ct_net(ct);
-        struct dccp_net *dn;
         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
         struct dccp_hdr _dh, *dh;
         u_int8_t type, old_state, new_state;
@@ -559,8 +564,7 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
         if (new_state != old_state)
                 nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
 
-        dn = dccp_pernet(net);
-        nf_ct_refresh_acct(ct, ctinfo, skb, dn->dccp_timeout[new_state]);
+        nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[new_state]);
 
         return NF_ACCEPT;
 }
@@ -639,11 +643,12 @@ static int dccp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
         nest_parms = nla_nest_start(skb, CTA_PROTOINFO_DCCP | NLA_F_NESTED);
         if (!nest_parms)
                 goto nla_put_failure;
-        NLA_PUT_U8(skb, CTA_PROTOINFO_DCCP_STATE, ct->proto.dccp.state);
-        NLA_PUT_U8(skb, CTA_PROTOINFO_DCCP_ROLE,
-                   ct->proto.dccp.role[IP_CT_DIR_ORIGINAL]);
-        NLA_PUT_BE64(skb, CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ,
-                     cpu_to_be64(ct->proto.dccp.handshake_seq));
+        if (nla_put_u8(skb, CTA_PROTOINFO_DCCP_STATE, ct->proto.dccp.state) ||
+            nla_put_u8(skb, CTA_PROTOINFO_DCCP_ROLE,
+                       ct->proto.dccp.role[IP_CT_DIR_ORIGINAL]) ||
+            nla_put_be64(skb, CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ,
+                         cpu_to_be64(ct->proto.dccp.handshake_seq)))
+                goto nla_put_failure;
         nla_nest_end(skb, nest_parms);
         spin_unlock_bh(&ct->lock);
         return 0;
@@ -702,8 +707,61 @@ static int dccp_nlattr_size(void)
         return nla_total_size(0)        /* CTA_PROTOINFO_DCCP */
                 + nla_policy_len(dccp_nla_policy, CTA_PROTOINFO_DCCP_MAX + 1);
 }
+
 #endif
 
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nfnetlink_cttimeout.h>
+
+static int dccp_timeout_nlattr_to_obj(struct nlattr *tb[], void *data)
+{
+        struct dccp_net *dn = dccp_pernet(&init_net);
+        unsigned int *timeouts = data;
+        int i;
+
+        /* set default DCCP timeouts. */
+        for (i=0; i<CT_DCCP_MAX; i++)
+                timeouts[i] = dn->dccp_timeout[i];
+
+        /* there's a 1:1 mapping between attributes and protocol states. */
+        for (i=CTA_TIMEOUT_DCCP_UNSPEC+1; i<CTA_TIMEOUT_DCCP_MAX+1; i++) {
+                if (tb[i]) {
+                        timeouts[i] = ntohl(nla_get_be32(tb[i])) * HZ;
+                }
+        }
+        return 0;
+}
+
+static int
+dccp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
+{
+        const unsigned int *timeouts = data;
+        int i;
+
+        for (i=CTA_TIMEOUT_DCCP_UNSPEC+1; i<CTA_TIMEOUT_DCCP_MAX+1; i++) {
+                if (nla_put_be32(skb, i, htonl(timeouts[i] / HZ)))
+                        goto nla_put_failure;
+        }
+        return 0;
+
+nla_put_failure:
+        return -ENOSPC;
+}
+
+static const struct nla_policy
+dccp_timeout_nla_policy[CTA_TIMEOUT_DCCP_MAX+1] = {
+        [CTA_TIMEOUT_DCCP_REQUEST]      = { .type = NLA_U32 },
+        [CTA_TIMEOUT_DCCP_RESPOND]      = { .type = NLA_U32 },
+        [CTA_TIMEOUT_DCCP_PARTOPEN]     = { .type = NLA_U32 },
+        [CTA_TIMEOUT_DCCP_OPEN]         = { .type = NLA_U32 },
+        [CTA_TIMEOUT_DCCP_CLOSEREQ]     = { .type = NLA_U32 },
+        [CTA_TIMEOUT_DCCP_CLOSING]      = { .type = NLA_U32 },
+        [CTA_TIMEOUT_DCCP_TIMEWAIT]     = { .type = NLA_U32 },
+};
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+
 #ifdef CONFIG_SYSCTL
 /* template, data assigned later */
 static struct ctl_table dccp_sysctl_table[] = {
@@ -767,6 +825,7 @@ static struct nf_conntrack_l4proto dccp_proto4 __read_mostly = {
         .invert_tuple           = dccp_invert_tuple,
         .new                    = dccp_new,
         .packet                 = dccp_packet,
+        .get_timeouts           = dccp_get_timeouts,
         .error                  = dccp_error,
         .print_tuple            = dccp_print_tuple,
         .print_conntrack        = dccp_print_conntrack,
@@ -779,6 +838,15 @@ static struct nf_conntrack_l4proto dccp_proto4 __read_mostly = {
         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+        .ctnl_timeout           = {
+                .nlattr_to_obj  = dccp_timeout_nlattr_to_obj,
+                .obj_to_nlattr  = dccp_timeout_obj_to_nlattr,
+                .nlattr_max     = CTA_TIMEOUT_DCCP_MAX,
+                .obj_size       = sizeof(unsigned int) * CT_DCCP_MAX,
+                .nla_policy     = dccp_timeout_nla_policy,
+        },
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
 };
 
 static struct nf_conntrack_l4proto dccp_proto6 __read_mostly = {
@@ -789,6 +857,7 @@ static struct nf_conntrack_l4proto dccp_proto6 __read_mostly = {
         .invert_tuple           = dccp_invert_tuple,
         .new                    = dccp_new,
         .packet                 = dccp_packet,
+        .get_timeouts           = dccp_get_timeouts,
         .error                  = dccp_error,
         .print_tuple            = dccp_print_tuple,
         .print_conntrack        = dccp_print_conntrack,
@@ -801,6 +870,15 @@ static struct nf_conntrack_l4proto dccp_proto6 __read_mostly = {
         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+        .ctnl_timeout           = {
+                .nlattr_to_obj  = dccp_timeout_nlattr_to_obj,
+                .obj_to_nlattr  = dccp_timeout_obj_to_nlattr,
+                .nlattr_max     = CTA_TIMEOUT_DCCP_MAX,
+                .obj_size       = sizeof(unsigned int) * CT_DCCP_MAX,
+                .nla_policy     = dccp_timeout_nla_policy,
+        },
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
 };
 
 static __net_init int dccp_net_init(struct net *net)
@@ -832,8 +910,8 @@ static __net_init int dccp_net_init(struct net *net)
         dn->sysctl_table[6].data = &dn->dccp_timeout[CT_DCCP_TIMEWAIT];
         dn->sysctl_table[7].data = &dn->dccp_loose;
 
-        dn->sysctl_header = register_net_sysctl_table(net,
-                        nf_net_netfilter_sysctl_path, dn->sysctl_table);
+        dn->sysctl_header = register_net_sysctl(net, "net/netfilter",
+                                                dn->sysctl_table);
         if (!dn->sysctl_header) {
                 kfree(dn->sysctl_table);
                 return -ENOMEM;
diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
index e2091d0c7a2f..d8923d54b358 100644
--- a/net/netfilter/nf_conntrack_proto_generic.c
+++ b/net/netfilter/nf_conntrack_proto_generic.c
@@ -40,25 +40,71 @@ static int generic_print_tuple(struct seq_file *s,
         return 0;
 }
 
+static unsigned int *generic_get_timeouts(struct net *net)
+{
+        return &nf_ct_generic_timeout;
+}
+
 /* Returns verdict for packet, or -1 for invalid. */
-static int packet(struct nf_conn *ct,
-                  const struct sk_buff *skb,
-                  unsigned int dataoff,
-                  enum ip_conntrack_info ctinfo,
-                  u_int8_t pf,
-                  unsigned int hooknum)
+static int generic_packet(struct nf_conn *ct,
+                          const struct sk_buff *skb,
+                          unsigned int dataoff,
+                          enum ip_conntrack_info ctinfo,
+                          u_int8_t pf,
+                          unsigned int hooknum,
+                          unsigned int *timeout)
 {
-        nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_generic_timeout);
+        nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
         return NF_ACCEPT;
 }
 
 /* Called when a new connection for this protocol found. */
-static bool new(struct nf_conn *ct, const struct sk_buff *skb,
-                unsigned int dataoff)
+static bool generic_new(struct nf_conn *ct, const struct sk_buff *skb,
+                        unsigned int dataoff, unsigned int *timeouts)
 {
         return true;
 }
 
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nfnetlink_cttimeout.h>
+
+static int generic_timeout_nlattr_to_obj(struct nlattr *tb[], void *data)
+{
+        unsigned int *timeout = data;
+
+        if (tb[CTA_TIMEOUT_GENERIC_TIMEOUT])
+                *timeout =
+                    ntohl(nla_get_be32(tb[CTA_TIMEOUT_GENERIC_TIMEOUT])) * HZ;
+        else {
+                /* Set default generic timeout. */
+                *timeout = nf_ct_generic_timeout;
+        }
+
+        return 0;
+}
+
+static int
+generic_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
+{
+        const unsigned int *timeout = data;
+
+        if (nla_put_be32(skb, CTA_TIMEOUT_GENERIC_TIMEOUT, htonl(*timeout / HZ)))
+                goto nla_put_failure;
+
+        return 0;
+
+nla_put_failure:
+        return -ENOSPC;
+}
+
+static const struct nla_policy
+generic_timeout_nla_policy[CTA_TIMEOUT_GENERIC_MAX+1] = {
+        [CTA_TIMEOUT_GENERIC_TIMEOUT]   = { .type = NLA_U32 },
+};
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+
 #ifdef CONFIG_SYSCTL
 static struct ctl_table_header *generic_sysctl_header;
 static struct ctl_table generic_sysctl_table[] = {
@@ -93,8 +139,18 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_generic __read_mostly =
         .pkt_to_tuple           = generic_pkt_to_tuple,
         .invert_tuple           = generic_invert_tuple,
         .print_tuple            = generic_print_tuple,
-        .packet                 = packet,
-        .new                    = new,
+        .packet                 = generic_packet,
+        .get_timeouts           = generic_get_timeouts,
+        .new                    = generic_new,
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+        .ctnl_timeout           = {
+                .nlattr_to_obj  = generic_timeout_nlattr_to_obj,
+                .obj_to_nlattr  = generic_timeout_obj_to_nlattr,
+                .nlattr_max     = CTA_TIMEOUT_GENERIC_MAX,
+                .obj_size       = sizeof(unsigned int),
+                .nla_policy     = generic_timeout_nla_policy,
+        },
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
 #ifdef CONFIG_SYSCTL
         .ctl_table_header       = &generic_sysctl_header,
         .ctl_table              = generic_sysctl_table,
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index f0338791b822..4bf6b4e4b776 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -41,8 +41,16 @@
 #include <linux/netfilter/nf_conntrack_proto_gre.h>
 #include <linux/netfilter/nf_conntrack_pptp.h>
 
-#define GRE_TIMEOUT             (30 * HZ)
-#define GRE_STREAM_TIMEOUT      (180 * HZ)
+enum grep_conntrack {
+        GRE_CT_UNREPLIED,
+        GRE_CT_REPLIED,
+        GRE_CT_MAX
+};
+
+static unsigned int gre_timeouts[GRE_CT_MAX] = {
+        [GRE_CT_UNREPLIED]      = 30*HZ,
+        [GRE_CT_REPLIED]        = 180*HZ,
+};
 
 static int proto_gre_net_id __read_mostly;
 struct netns_proto_gre {
@@ -227,13 +235,19 @@ static int gre_print_conntrack(struct seq_file *s, struct nf_conn *ct)
                           (ct->proto.gre.stream_timeout / HZ));
 }
 
+static unsigned int *gre_get_timeouts(struct net *net)
+{
+        return gre_timeouts;
+}
+
 /* Returns verdict for packet, and may modify conntrack */
 static int gre_packet(struct nf_conn *ct,
                       const struct sk_buff *skb,
                       unsigned int dataoff,
                       enum ip_conntrack_info ctinfo,
                       u_int8_t pf,
-                      unsigned int hooknum)
+                      unsigned int hooknum,
+                      unsigned int *timeouts)
 {
         /* If we've seen traffic both ways, this is a GRE connection.
          * Extend timeout. */
@@ -252,15 +266,15 @@ static int gre_packet(struct nf_conn *ct,
 
 /* Called when a new connection for this protocol found. */
 static bool gre_new(struct nf_conn *ct, const struct sk_buff *skb,
-                    unsigned int dataoff)
+                    unsigned int dataoff, unsigned int *timeouts)
 {
         pr_debug(": ");
         nf_ct_dump_tuple(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
 
         /* initialize to sane value.  Ideally a conntrack helper
          * (e.g. in case of pptp) is increasing them */
-        ct->proto.gre.stream_timeout = GRE_STREAM_TIMEOUT;
-        ct->proto.gre.timeout = GRE_TIMEOUT;
+        ct->proto.gre.stream_timeout = timeouts[GRE_CT_REPLIED];
+        ct->proto.gre.timeout = timeouts[GRE_CT_UNREPLIED];
 
         return true;
 }
@@ -278,6 +292,53 @@ static void gre_destroy(struct nf_conn *ct)
                 nf_ct_gre_keymap_destroy(master);
 }
 
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nfnetlink_cttimeout.h>
+
+static int gre_timeout_nlattr_to_obj(struct nlattr *tb[], void *data)
+{
+        unsigned int *timeouts = data;
+
+        /* set default timeouts for GRE. */
+        timeouts[GRE_CT_UNREPLIED] = gre_timeouts[GRE_CT_UNREPLIED];
+        timeouts[GRE_CT_REPLIED] = gre_timeouts[GRE_CT_REPLIED];
+
+        if (tb[CTA_TIMEOUT_GRE_UNREPLIED]) {
+                timeouts[GRE_CT_UNREPLIED] =
+                        ntohl(nla_get_be32(tb[CTA_TIMEOUT_GRE_UNREPLIED])) * HZ;
+        }
+        if (tb[CTA_TIMEOUT_GRE_REPLIED]) {
+                timeouts[GRE_CT_REPLIED] =
+                        ntohl(nla_get_be32(tb[CTA_TIMEOUT_GRE_REPLIED])) * HZ;
+        }
+        return 0;
+}
+
+static int
+gre_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
+{
+        const unsigned int *timeouts = data;
+
+        if (nla_put_be32(skb, CTA_TIMEOUT_GRE_UNREPLIED,
+                         htonl(timeouts[GRE_CT_UNREPLIED] / HZ)) ||
+            nla_put_be32(skb, CTA_TIMEOUT_GRE_REPLIED,
+                         htonl(timeouts[GRE_CT_REPLIED] / HZ)))
+                goto nla_put_failure;
+        return 0;
+
+nla_put_failure:
+        return -ENOSPC;
+}
+
+static const struct nla_policy
+gre_timeout_nla_policy[CTA_TIMEOUT_GRE_MAX+1] = {
+        [CTA_TIMEOUT_GRE_UNREPLIED]     = { .type = NLA_U32 },
+        [CTA_TIMEOUT_GRE_REPLIED]       = { .type = NLA_U32 },
+};
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+
 /* protocol helper struct */
 static struct nf_conntrack_l4proto nf_conntrack_l4proto_gre4 __read_mostly = {
         .l3proto         = AF_INET,
@@ -287,6 +348,7 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_gre4 __read_mostly = {
         .invert_tuple    = gre_invert_tuple,
         .print_tuple     = gre_print_tuple,
         .print_conntrack = gre_print_conntrack,
+        .get_timeouts    = gre_get_timeouts,
         .packet          = gre_packet,
         .new             = gre_new,
         .destroy         = gre_destroy,
@@ -297,6 +359,15 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_gre4 __read_mostly = {
         .nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
         .nla_policy      = nf_ct_port_nla_policy,
 #endif
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+        .ctnl_timeout    = {
+                .nlattr_to_obj  = gre_timeout_nlattr_to_obj,
+                .obj_to_nlattr  = gre_timeout_obj_to_nlattr,
+                .nlattr_max     = CTA_TIMEOUT_GRE_MAX,
+                .obj_size       = sizeof(unsigned int) * GRE_CT_MAX,
+                .nla_policy     = gre_timeout_nla_policy,
+        },
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
 };
 
 static int proto_gre_net_init(struct net *net)
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index afa69136061a..996db2fa21f7 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -279,13 +279,19 @@ static int sctp_new_state(enum ip_conntrack_dir dir,
         return sctp_conntracks[dir][i][cur_state];
 }
 
+static unsigned int *sctp_get_timeouts(struct net *net)
+{
+        return sctp_timeouts;
+}
+
 /* Returns verdict for packet, or -NF_ACCEPT for invalid. */
 static int sctp_packet(struct nf_conn *ct,
                        const struct sk_buff *skb,
                        unsigned int dataoff,
                        enum ip_conntrack_info ctinfo,
                        u_int8_t pf,
-                       unsigned int hooknum)
+                       unsigned int hooknum,
+                       unsigned int *timeouts)
 {
         enum sctp_conntrack new_state, old_state;
         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
@@ -370,7 +376,7 @@ static int sctp_packet(struct nf_conn *ct,
         }
         spin_unlock_bh(&ct->lock);
 
-        nf_ct_refresh_acct(ct, ctinfo, skb, sctp_timeouts[new_state]);
+        nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[new_state]);
 
         if (old_state == SCTP_CONNTRACK_COOKIE_ECHOED &&
             dir == IP_CT_DIR_REPLY &&
@@ -390,7 +396,7 @@ out:
 
 /* Called when a new connection for this protocol found. */
 static bool sctp_new(struct nf_conn *ct, const struct sk_buff *skb,
-                     unsigned int dataoff)
+                     unsigned int dataoff, unsigned int *timeouts)
 {
         enum sctp_conntrack new_state;
         const struct sctphdr *sh;
@@ -476,15 +482,12 @@ static int sctp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
         if (!nest_parms)
                 goto nla_put_failure;
 
-        NLA_PUT_U8(skb, CTA_PROTOINFO_SCTP_STATE, ct->proto.sctp.state);
-
-        NLA_PUT_BE32(skb,
-                     CTA_PROTOINFO_SCTP_VTAG_ORIGINAL,
-                     ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL]);
-
-        NLA_PUT_BE32(skb,
-                     CTA_PROTOINFO_SCTP_VTAG_REPLY,
-                     ct->proto.sctp.vtag[IP_CT_DIR_REPLY]);
+        if (nla_put_u8(skb, CTA_PROTOINFO_SCTP_STATE, ct->proto.sctp.state) ||
+            nla_put_be32(skb, CTA_PROTOINFO_SCTP_VTAG_ORIGINAL,
+                         ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL]) ||
+            nla_put_be32(skb, CTA_PROTOINFO_SCTP_VTAG_REPLY,
+                         ct->proto.sctp.vtag[IP_CT_DIR_REPLY]))
+                goto nla_put_failure;
 
         spin_unlock_bh(&ct->lock);
 
@@ -543,6 +546,58 @@ static int sctp_nlattr_size(void)
 }
 #endif
 
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nfnetlink_cttimeout.h>
+
+static int sctp_timeout_nlattr_to_obj(struct nlattr *tb[], void *data)
+{
+        unsigned int *timeouts = data;
+        int i;
+
+        /* set default SCTP timeouts. */
+        for (i=0; i<SCTP_CONNTRACK_MAX; i++)
+                timeouts[i] = sctp_timeouts[i];
+
+        /* there's a 1:1 mapping between attributes and protocol states. */
+        for (i=CTA_TIMEOUT_SCTP_UNSPEC+1; i<CTA_TIMEOUT_SCTP_MAX+1; i++) {
+                if (tb[i]) {
+                        timeouts[i] = ntohl(nla_get_be32(tb[i])) * HZ;
+                }
+        }
+        return 0;
+}
+
+static int
+sctp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
+{
+        const unsigned int *timeouts = data;
+        int i;
+
+        for (i=CTA_TIMEOUT_SCTP_UNSPEC+1; i<CTA_TIMEOUT_SCTP_MAX+1; i++) {
+                if (nla_put_be32(skb, i, htonl(timeouts[i] / HZ)))
+                        goto nla_put_failure;
+        }
+        return 0;
+
+nla_put_failure:
+        return -ENOSPC;
+}
+
+static const struct nla_policy
+sctp_timeout_nla_policy[CTA_TIMEOUT_SCTP_MAX+1] = {
+        [CTA_TIMEOUT_SCTP_CLOSED]               = { .type = NLA_U32 },
+        [CTA_TIMEOUT_SCTP_COOKIE_WAIT]          = { .type = NLA_U32 },
+        [CTA_TIMEOUT_SCTP_COOKIE_ECHOED]        = { .type = NLA_U32 },
+        [CTA_TIMEOUT_SCTP_ESTABLISHED]          = { .type = NLA_U32 },
+        [CTA_TIMEOUT_SCTP_SHUTDOWN_SENT]        = { .type = NLA_U32 },
+        [CTA_TIMEOUT_SCTP_SHUTDOWN_RECD]        = { .type = NLA_U32 },
+        [CTA_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT]    = { .type = NLA_U32 },
+};
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+
+
 #ifdef CONFIG_SYSCTL
 static unsigned int sctp_sysctl_table_users;
 static struct ctl_table_header *sctp_sysctl_header;
@@ -664,6 +719,7 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 __read_mostly = {
         .print_tuple            = sctp_print_tuple,
         .print_conntrack        = sctp_print_conntrack,
         .packet                 = sctp_packet,
+        .get_timeouts           = sctp_get_timeouts,
         .new                    = sctp_new,
         .me                     = THIS_MODULE,
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
@@ -675,6 +731,15 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 __read_mostly = {
         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+        .ctnl_timeout           = {
+                .nlattr_to_obj  = sctp_timeout_nlattr_to_obj,
+                .obj_to_nlattr  = sctp_timeout_obj_to_nlattr,
+                .nlattr_max     = CTA_TIMEOUT_SCTP_MAX,
+                .obj_size       = sizeof(unsigned int) * SCTP_CONNTRACK_MAX,
+                .nla_policy     = sctp_timeout_nla_policy,
+        },
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
 #ifdef CONFIG_SYSCTL
         .ctl_table_users        = &sctp_sysctl_table_users,
         .ctl_table_header       = &sctp_sysctl_header,
@@ -694,6 +759,7 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 __read_mostly = {
         .print_tuple            = sctp_print_tuple,
         .print_conntrack        = sctp_print_conntrack,
         .packet                 = sctp_packet,
+        .get_timeouts           = sctp_get_timeouts,
         .new                    = sctp_new,
         .me                     = THIS_MODULE,
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
@@ -704,6 +770,15 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 __read_mostly = {
         .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
         .nla_policy             = nf_ct_port_nla_policy,
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+        .ctnl_timeout           = {
+                .nlattr_to_obj  = sctp_timeout_nlattr_to_obj,
+                .obj_to_nlattr  = sctp_timeout_obj_to_nlattr,
+                .nlattr_max     = CTA_TIMEOUT_SCTP_MAX,
+                .obj_size       = sizeof(unsigned int) * SCTP_CONNTRACK_MAX,
+                .nla_policy     = sctp_timeout_nla_policy,
+        },
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
 #endif
 #ifdef CONFIG_SYSCTL
         .ctl_table_users        = &sctp_sysctl_table_users,
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 97b9f3ebf28c..21ff1a99f534 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -64,13 +64,7 @@ static const char *const tcp_conntrack_names[] = {
 #define HOURS * 60 MINS
 #define DAYS * 24 HOURS
 
-/* RFC1122 says the R2 limit should be at least 100 seconds.
-   Linux uses 15 packets as limit, which corresponds
-   to ~13-30min depending on RTO. */
-static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly    =   5 MINS;
-static unsigned int nf_ct_tcp_timeout_unacknowledged __read_mostly =   5 MINS;
-
-static unsigned int tcp_timeouts[TCP_CONNTRACK_MAX] __read_mostly = {
+static unsigned int tcp_timeouts[TCP_CONNTRACK_TIMEOUT_MAX] __read_mostly = {
         [TCP_CONNTRACK_SYN_SENT]        = 2 MINS,
         [TCP_CONNTRACK_SYN_RECV]        = 60 SECS,
         [TCP_CONNTRACK_ESTABLISHED]     = 5 DAYS,
@@ -80,6 +74,11 @@ static unsigned int tcp_timeouts[TCP_CONNTRACK_MAX] __read_mostly = {
         [TCP_CONNTRACK_TIME_WAIT]       = 2 MINS,
         [TCP_CONNTRACK_CLOSE]           = 10 SECS,
         [TCP_CONNTRACK_SYN_SENT2]       = 2 MINS,
+/* RFC1122 says the R2 limit should be at least 100 seconds.
+   Linux uses 15 packets as limit, which corresponds
+   to ~13-30min depending on RTO. */
+        [TCP_CONNTRACK_RETRANS]         = 5 MINS,
+        [TCP_CONNTRACK_UNACK]           = 5 MINS,
 };
 
 #define sNO TCP_CONNTRACK_NONE
@@ -585,8 +584,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
                          * Let's try to use the data from the packet.
                          */
                         sender->td_end = end;
-                        win <<= sender->td_scale;
-                        sender->td_maxwin = (win == 0 ? 1 : win);
+                        swin = win << sender->td_scale;
+                        sender->td_maxwin = (swin == 0 ? 1 : swin);
                         sender->td_maxend = end + sender->td_maxwin;
                         /*
                          * We haven't seen traffic in the other direction yet
@@ -814,13 +813,19 @@ static int tcp_error(struct net *net, struct nf_conn *tmpl,
         return NF_ACCEPT;
 }
 
+static unsigned int *tcp_get_timeouts(struct net *net)
+{
+        return tcp_timeouts;
+}
+
 /* Returns verdict for packet, or -1 for invalid. */
 static int tcp_packet(struct nf_conn *ct,
                       const struct sk_buff *skb,
                       unsigned int dataoff,
                       enum ip_conntrack_info ctinfo,
                       u_int8_t pf,
-                      unsigned int hooknum)
+                      unsigned int hooknum,
+                      unsigned int *timeouts)
 {
         struct net *net = nf_ct_net(ct);
         struct nf_conntrack_tuple *tuple;
@@ -947,7 +952,8 @@ static int tcp_packet(struct nf_conn *ct,
                 spin_unlock_bh(&ct->lock);
                 if (LOG_INVALID(net, IPPROTO_TCP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
-                                  "nf_ct_tcp: invalid packet ignored ");
+                                  "nf_ct_tcp: invalid packet ignored in "
+                                  "state %s ", tcp_conntrack_names[old_state]);
                 return NF_ACCEPT;
         case TCP_CONNTRACK_MAX:
                 /* Invalid packet */
@@ -1015,14 +1021,14 @@ static int tcp_packet(struct nf_conn *ct,
                 ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
 
         if (ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans &&
-            tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans)
-                timeout = nf_ct_tcp_timeout_max_retrans;
+            timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
+                timeout = timeouts[TCP_CONNTRACK_RETRANS];
         else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
                  IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
-                 tcp_timeouts[new_state] > nf_ct_tcp_timeout_unacknowledged)
-                timeout = nf_ct_tcp_timeout_unacknowledged;
+                 timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
+                timeout = timeouts[TCP_CONNTRACK_UNACK];
         else
-                timeout = tcp_timeouts[new_state];
+                timeout = timeouts[new_state];
         spin_unlock_bh(&ct->lock);
 
         if (new_state != old_state)
@@ -1054,7 +1060,7 @@ static int tcp_packet(struct nf_conn *ct,
 
 /* Called when a new connection for this protocol found. */
 static bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb,
-                    unsigned int dataoff)
+                    unsigned int dataoff, unsigned int *timeouts)
 {
         enum tcp_conntrack new_state;
         const struct tcphdr *th;
@@ -1142,21 +1148,22 @@ static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
         if (!nest_parms)
                 goto nla_put_failure;
 
-        NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_STATE, ct->proto.tcp.state);
-
-        NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL,
-                   ct->proto.tcp.seen[0].td_scale);
-
-        NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_REPLY,
-                   ct->proto.tcp.seen[1].td_scale);
+        if (nla_put_u8(skb, CTA_PROTOINFO_TCP_STATE, ct->proto.tcp.state) ||
+            nla_put_u8(skb, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL,
+                       ct->proto.tcp.seen[0].td_scale) ||
+            nla_put_u8(skb, CTA_PROTOINFO_TCP_WSCALE_REPLY,
+                       ct->proto.tcp.seen[1].td_scale))
+                goto nla_put_failure;
 
         tmp.flags = ct->proto.tcp.seen[0].flags;
-        NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL,
-                sizeof(struct nf_ct_tcp_flags), &tmp);
+        if (nla_put(skb, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL,
+                    sizeof(struct nf_ct_tcp_flags), &tmp))
+                goto nla_put_failure;
 
         tmp.flags = ct->proto.tcp.seen[1].flags;
-        NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_REPLY,
-                sizeof(struct nf_ct_tcp_flags), &tmp);
+        if (nla_put(skb, CTA_PROTOINFO_TCP_FLAGS_REPLY,
+                    sizeof(struct nf_ct_tcp_flags), &tmp))
+                goto nla_put_failure;
         spin_unlock_bh(&ct->lock);
 
         nla_nest_end(skb, nest_parms);
@@ -1239,6 +1246,114 @@ static int tcp_nlattr_tuple_size(void)
 }
 #endif
 
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nfnetlink_cttimeout.h>
+
+static int tcp_timeout_nlattr_to_obj(struct nlattr *tb[], void *data)
+{
+        unsigned int *timeouts = data;
+        int i;
+
+        /* set default TCP timeouts. */
+        for (i=0; i<TCP_CONNTRACK_TIMEOUT_MAX; i++)
+                timeouts[i] = tcp_timeouts[i];
+
+        if (tb[CTA_TIMEOUT_TCP_SYN_SENT]) {
+                timeouts[TCP_CONNTRACK_SYN_SENT] =
+                        ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_SENT]))*HZ;
+        }
+        if (tb[CTA_TIMEOUT_TCP_SYN_RECV]) {
+                timeouts[TCP_CONNTRACK_SYN_RECV] =
+                        ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_RECV]))*HZ;
+        }
+        if (tb[CTA_TIMEOUT_TCP_ESTABLISHED]) {
+                timeouts[TCP_CONNTRACK_ESTABLISHED] =
+                        ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_ESTABLISHED]))*HZ;
+        }
+        if (tb[CTA_TIMEOUT_TCP_FIN_WAIT]) {
+                timeouts[TCP_CONNTRACK_FIN_WAIT] =
+                        ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_FIN_WAIT]))*HZ;
+        }
+        if (tb[CTA_TIMEOUT_TCP_CLOSE_WAIT]) {
+                timeouts[TCP_CONNTRACK_CLOSE_WAIT] =
+                        ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_CLOSE_WAIT]))*HZ;
+        }
+        if (tb[CTA_TIMEOUT_TCP_LAST_ACK]) {
+                timeouts[TCP_CONNTRACK_LAST_ACK] =
+                        ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_LAST_ACK]))*HZ;
+        }
+        if (tb[CTA_TIMEOUT_TCP_TIME_WAIT]) {
+                timeouts[TCP_CONNTRACK_TIME_WAIT] =
+                        ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_TIME_WAIT]))*HZ;
+        }
+        if (tb[CTA_TIMEOUT_TCP_CLOSE]) {
+                timeouts[TCP_CONNTRACK_CLOSE] =
+                        ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_CLOSE]))*HZ;
+        }
+        if (tb[CTA_TIMEOUT_TCP_SYN_SENT2]) {
+                timeouts[TCP_CONNTRACK_SYN_SENT2] =
+                        ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_SENT2]))*HZ;
+        }
+        if (tb[CTA_TIMEOUT_TCP_RETRANS]) {
+                timeouts[TCP_CONNTRACK_RETRANS] =
+                        ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_RETRANS]))*HZ;
+        }
+        if (tb[CTA_TIMEOUT_TCP_UNACK]) {
+                timeouts[TCP_CONNTRACK_UNACK] =
+                        ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_UNACK]))*HZ;
+        }
+        return 0;
+}
+
+static int
+tcp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
+{
+        const unsigned int *timeouts = data;
+
+        if (nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_SENT,
+                        htonl(timeouts[TCP_CONNTRACK_SYN_SENT] / HZ)) ||
+            nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_RECV,
+                         htonl(timeouts[TCP_CONNTRACK_SYN_RECV] / HZ)) ||
+            nla_put_be32(skb, CTA_TIMEOUT_TCP_ESTABLISHED,
+                         htonl(timeouts[TCP_CONNTRACK_ESTABLISHED] / HZ)) ||
+            nla_put_be32(skb, CTA_TIMEOUT_TCP_FIN_WAIT,
+                         htonl(timeouts[TCP_CONNTRACK_FIN_WAIT] / HZ)) ||
+            nla_put_be32(skb, CTA_TIMEOUT_TCP_CLOSE_WAIT,
+                         htonl(timeouts[TCP_CONNTRACK_CLOSE_WAIT] / HZ)) ||
+            nla_put_be32(skb, CTA_TIMEOUT_TCP_LAST_ACK,
+                         htonl(timeouts[TCP_CONNTRACK_LAST_ACK] / HZ)) ||
+            nla_put_be32(skb, CTA_TIMEOUT_TCP_TIME_WAIT,
+                         htonl(timeouts[TCP_CONNTRACK_TIME_WAIT] / HZ)) ||
+            nla_put_be32(skb, CTA_TIMEOUT_TCP_CLOSE,
+                         htonl(timeouts[TCP_CONNTRACK_CLOSE] / HZ)) ||
+            nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_SENT2,
+                         htonl(timeouts[TCP_CONNTRACK_SYN_SENT2] / HZ)) ||
+            nla_put_be32(skb, CTA_TIMEOUT_TCP_RETRANS,
+                         htonl(timeouts[TCP_CONNTRACK_RETRANS] / HZ)) ||
+            nla_put_be32(skb, CTA_TIMEOUT_TCP_UNACK,
+                         htonl(timeouts[TCP_CONNTRACK_UNACK] / HZ)))
+                goto nla_put_failure;
+        return 0;
+
+nla_put_failure:
+        return -ENOSPC;
+}
+
+static const struct nla_policy tcp_timeout_nla_policy[CTA_TIMEOUT_TCP_MAX+1] = {
+        [CTA_TIMEOUT_TCP_SYN_SENT]      = { .type = NLA_U32 },
+        [CTA_TIMEOUT_TCP_SYN_RECV]      = { .type = NLA_U32 },
+        [CTA_TIMEOUT_TCP_ESTABLISHED]   = { .type = NLA_U32 },
+        [CTA_TIMEOUT_TCP_FIN_WAIT]      = { .type = NLA_U32 },
+        [CTA_TIMEOUT_TCP_CLOSE_WAIT]    = { .type = NLA_U32 },
+        [CTA_TIMEOUT_TCP_LAST_ACK]      = { .type = NLA_U32 },
+        [CTA_TIMEOUT_TCP_TIME_WAIT]     = { .type = NLA_U32 },
+        [CTA_TIMEOUT_TCP_CLOSE]         = { .type = NLA_U32 },
+        [CTA_TIMEOUT_TCP_SYN_SENT2]     = { .type = NLA_U32 },
+};
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+
 #ifdef CONFIG_SYSCTL
 static unsigned int tcp_sysctl_table_users;
 static struct ctl_table_header *tcp_sysctl_header;
@@ -1301,14 +1416,14 @@ static struct ctl_table tcp_sysctl_table[] = {
         },
         {
                 .procname       = "nf_conntrack_tcp_timeout_max_retrans",
-                .data           = &nf_ct_tcp_timeout_max_retrans,
+                .data           = &tcp_timeouts[TCP_CONNTRACK_RETRANS],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_tcp_timeout_unacknowledged",
-                .data           = &nf_ct_tcp_timeout_unacknowledged,
+                .data           = &tcp_timeouts[TCP_CONNTRACK_UNACK],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
@@ -1404,7 +1519,7 @@ static struct ctl_table tcp_compat_sysctl_table[] = {
         },
         {
                 .procname       = "ip_conntrack_tcp_timeout_max_retrans",
-                .data           = &nf_ct_tcp_timeout_max_retrans,
+                .data           = &tcp_timeouts[TCP_CONNTRACK_RETRANS],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
@@ -1445,6 +1560,7 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 __read_mostly =
         .print_tuple            = tcp_print_tuple,
         .print_conntrack        = tcp_print_conntrack,
         .packet                 = tcp_packet,
+        .get_timeouts           = tcp_get_timeouts,
         .new                    = tcp_new,
         .error                  = tcp_error,
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
@@ -1456,6 +1572,16 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 __read_mostly =
         .nlattr_tuple_size      = tcp_nlattr_tuple_size,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+        .ctnl_timeout           = {
+                .nlattr_to_obj  = tcp_timeout_nlattr_to_obj,
+                .obj_to_nlattr  = tcp_timeout_obj_to_nlattr,
+                .nlattr_max     = CTA_TIMEOUT_TCP_MAX,
+                .obj_size       = sizeof(unsigned int) *
+                                        TCP_CONNTRACK_TIMEOUT_MAX,
+                .nla_policy     = tcp_timeout_nla_policy,
+        },
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
 #ifdef CONFIG_SYSCTL
         .ctl_table_users        = &tcp_sysctl_table_users,
         .ctl_table_header       = &tcp_sysctl_header,
@@ -1477,6 +1603,7 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 __read_mostly =
         .print_tuple            = tcp_print_tuple,
         .print_conntrack        = tcp_print_conntrack,
         .packet                 = tcp_packet,
+        .get_timeouts           = tcp_get_timeouts,
         .new                    = tcp_new,
         .error                  = tcp_error,
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
@@ -1488,6 +1615,16 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 __read_mostly =
         .nlattr_tuple_size      = tcp_nlattr_tuple_size,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+        .ctnl_timeout           = {
+                .nlattr_to_obj  = tcp_timeout_nlattr_to_obj,
+                .obj_to_nlattr  = tcp_timeout_obj_to_nlattr,
+                .nlattr_max     = CTA_TIMEOUT_TCP_MAX,
+                .obj_size       = sizeof(unsigned int) *
+                                        TCP_CONNTRACK_TIMEOUT_MAX,
+                .nla_policy     = tcp_timeout_nla_policy,
+        },
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
 #ifdef CONFIG_SYSCTL
         .ctl_table_users        = &tcp_sysctl_table_users,
         .ctl_table_header       = &tcp_sysctl_header,
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 5f35757fbff0..7259a6bdeb49 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -25,8 +25,16 @@
 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
 
-static unsigned int nf_ct_udp_timeout __read_mostly = 30*HZ;
-static unsigned int nf_ct_udp_timeout_stream __read_mostly = 180*HZ;
+enum udp_conntrack {
+        UDP_CT_UNREPLIED,
+        UDP_CT_REPLIED,
+        UDP_CT_MAX
+};
+
+static unsigned int udp_timeouts[UDP_CT_MAX] = {
+        [UDP_CT_UNREPLIED]      = 30*HZ,
+        [UDP_CT_REPLIED]        = 180*HZ,
+};
 
 static bool udp_pkt_to_tuple(const struct sk_buff *skb,
                              unsigned int dataoff,
@@ -63,30 +71,38 @@ static int udp_print_tuple(struct seq_file *s,
                           ntohs(tuple->dst.u.udp.port));
 }
 
+static unsigned int *udp_get_timeouts(struct net *net)
+{
+        return udp_timeouts;
+}
+
 /* Returns verdict for packet, and may modify conntracktype */
 static int udp_packet(struct nf_conn *ct,
                       const struct sk_buff *skb,
                       unsigned int dataoff,
                       enum ip_conntrack_info ctinfo,
                       u_int8_t pf,
-                      unsigned int hooknum)
+                      unsigned int hooknum,
+                      unsigned int *timeouts)
 {
         /* If we've seen traffic both ways, this is some kind of UDP
            stream.  Extend timeout. */
         if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
-                nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout_stream);
+                nf_ct_refresh_acct(ct, ctinfo, skb,
+                                   timeouts[UDP_CT_REPLIED]);
                 /* Also, more likely to be important, and not a probe */
                 if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
                         nf_conntrack_event_cache(IPCT_ASSURED, ct);
-        } else
-                nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout);
-
+        } else {
+                nf_ct_refresh_acct(ct, ctinfo, skb,
+                                   timeouts[UDP_CT_UNREPLIED]);
+        }
         return NF_ACCEPT;
 }
 
 /* Called when a new connection for this protocol found. */
 static bool udp_new(struct nf_conn *ct, const struct sk_buff *skb,
-                    unsigned int dataoff)
+                    unsigned int dataoff, unsigned int *timeouts)
 {
         return true;
 }
@@ -136,20 +152,67 @@ static int udp_error(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
         return NF_ACCEPT;
 }
 
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nfnetlink_cttimeout.h>
+
+static int udp_timeout_nlattr_to_obj(struct nlattr *tb[], void *data)
+{
+        unsigned int *timeouts = data;
+
+        /* set default timeouts for UDP. */
+        timeouts[UDP_CT_UNREPLIED] = udp_timeouts[UDP_CT_UNREPLIED];
+        timeouts[UDP_CT_REPLIED] = udp_timeouts[UDP_CT_REPLIED];
+
+        if (tb[CTA_TIMEOUT_UDP_UNREPLIED]) {
+                timeouts[UDP_CT_UNREPLIED] =
+                        ntohl(nla_get_be32(tb[CTA_TIMEOUT_UDP_UNREPLIED])) * HZ;
+        }
+        if (tb[CTA_TIMEOUT_UDP_REPLIED]) {
+                timeouts[UDP_CT_REPLIED] =
+                        ntohl(nla_get_be32(tb[CTA_TIMEOUT_UDP_REPLIED])) * HZ;
+        }
+        return 0;
+}
+
+static int
+udp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
+{
+        const unsigned int *timeouts = data;
+
+        if (nla_put_be32(skb, CTA_TIMEOUT_UDP_UNREPLIED,
+                         htonl(timeouts[UDP_CT_UNREPLIED] / HZ)) ||
+            nla_put_be32(skb, CTA_TIMEOUT_UDP_REPLIED,
+                         htonl(timeouts[UDP_CT_REPLIED] / HZ)))
+                goto nla_put_failure;
+        return 0;
+
+nla_put_failure:
+        return -ENOSPC;
+}
+
+static const struct nla_policy
+udp_timeout_nla_policy[CTA_TIMEOUT_UDP_MAX+1] = {
+       [CTA_TIMEOUT_UDP_UNREPLIED]      = { .type = NLA_U32 },
+       [CTA_TIMEOUT_UDP_REPLIED]        = { .type = NLA_U32 },
+};
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+
 #ifdef CONFIG_SYSCTL
 static unsigned int udp_sysctl_table_users;
 static struct ctl_table_header *udp_sysctl_header;
 static struct ctl_table udp_sysctl_table[] = {
         {
                 .procname       = "nf_conntrack_udp_timeout",
-                .data           = &nf_ct_udp_timeout,
+                .data           = &udp_timeouts[UDP_CT_UNREPLIED],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_udp_timeout_stream",
-                .data           = &nf_ct_udp_timeout_stream,
+                .data           = &udp_timeouts[UDP_CT_REPLIED],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
@@ -160,14 +223,14 @@ static struct ctl_table udp_sysctl_table[] = {
 static struct ctl_table udp_compat_sysctl_table[] = {
         {
                 .procname       = "ip_conntrack_udp_timeout",
-                .data           = &nf_ct_udp_timeout,
+                .data           = &udp_timeouts[UDP_CT_UNREPLIED],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "ip_conntrack_udp_timeout_stream",
-                .data           = &nf_ct_udp_timeout_stream,
+                .data           = &udp_timeouts[UDP_CT_REPLIED],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
@@ -186,6 +249,7 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_udp4 __read_mostly =
         .invert_tuple           = udp_invert_tuple,
         .print_tuple            = udp_print_tuple,
         .packet                 = udp_packet,
+        .get_timeouts           = udp_get_timeouts,
         .new                    = udp_new,
         .error                  = udp_error,
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
@@ -194,6 +258,15 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_udp4 __read_mostly =
         .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+        .ctnl_timeout           = {
+                .nlattr_to_obj  = udp_timeout_nlattr_to_obj,
+                .obj_to_nlattr  = udp_timeout_obj_to_nlattr,
+                .nlattr_max     = CTA_TIMEOUT_UDP_MAX,
+                .obj_size       = sizeof(unsigned int) * CTA_TIMEOUT_UDP_MAX,
+                .nla_policy     = udp_timeout_nla_policy,
+        },
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
 #ifdef CONFIG_SYSCTL
         .ctl_table_users        = &udp_sysctl_table_users,
         .ctl_table_header       = &udp_sysctl_header,
@@ -214,6 +287,7 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_udp6 __read_mostly =
         .invert_tuple           = udp_invert_tuple,
         .print_tuple            = udp_print_tuple,
         .packet                 = udp_packet,
+        .get_timeouts           = udp_get_timeouts,
         .new                    = udp_new,
         .error                  = udp_error,
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
@@ -222,6 +296,15 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_udp6 __read_mostly =
         .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+        .ctnl_timeout           = {
+                .nlattr_to_obj  = udp_timeout_nlattr_to_obj,
+                .obj_to_nlattr  = udp_timeout_obj_to_nlattr,
+                .nlattr_max     = CTA_TIMEOUT_UDP_MAX,
+                .obj_size       = sizeof(unsigned int) * CTA_TIMEOUT_UDP_MAX,
+                .nla_policy     = udp_timeout_nla_policy,
+        },
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
 #ifdef CONFIG_SYSCTL
         .ctl_table_users        = &udp_sysctl_table_users,
         .ctl_table_header       = &udp_sysctl_header,
diff --git a/net/netfilter/nf_conntrack_proto_udplite.c b/net/netfilter/nf_conntrack_proto_udplite.c
index f52ca1181013..4d60a5376aa6 100644
--- a/net/netfilter/nf_conntrack_proto_udplite.c
+++ b/net/netfilter/nf_conntrack_proto_udplite.c
@@ -24,8 +24,16 @@
 #include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_log.h>
 
-static unsigned int nf_ct_udplite_timeout __read_mostly = 30*HZ;
-static unsigned int nf_ct_udplite_timeout_stream __read_mostly = 180*HZ;
+enum udplite_conntrack {
+        UDPLITE_CT_UNREPLIED,
+        UDPLITE_CT_REPLIED,
+        UDPLITE_CT_MAX
+};
+
+static unsigned int udplite_timeouts[UDPLITE_CT_MAX] = {
+        [UDPLITE_CT_UNREPLIED]  = 30*HZ,
+        [UDPLITE_CT_REPLIED]    = 180*HZ,
+};
 
 static bool udplite_pkt_to_tuple(const struct sk_buff *skb,
                                  unsigned int dataoff,
@@ -60,31 +68,38 @@ static int udplite_print_tuple(struct seq_file *s,
                           ntohs(tuple->dst.u.udp.port));
 }
 
+static unsigned int *udplite_get_timeouts(struct net *net)
+{
+        return udplite_timeouts;
+}
+
 /* Returns verdict for packet, and may modify conntracktype */
 static int udplite_packet(struct nf_conn *ct,
                           const struct sk_buff *skb,
                           unsigned int dataoff,
                           enum ip_conntrack_info ctinfo,
                           u_int8_t pf,
-                          unsigned int hooknum)
+                          unsigned int hooknum,
+                          unsigned int *timeouts)
 {
         /* If we've seen traffic both ways, this is some kind of UDP
            stream.  Extend timeout. */
         if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
                 nf_ct_refresh_acct(ct, ctinfo, skb,
-                                   nf_ct_udplite_timeout_stream);
+                                   timeouts[UDPLITE_CT_REPLIED]);
                 /* Also, more likely to be important, and not a probe */
                 if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
                         nf_conntrack_event_cache(IPCT_ASSURED, ct);
-        } else
-                nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udplite_timeout);
-
+        } else {
+                nf_ct_refresh_acct(ct, ctinfo, skb,
+                                   timeouts[UDPLITE_CT_UNREPLIED]);
+        }
         return NF_ACCEPT;
 }
 
 /* Called when a new connection for this protocol found. */
 static bool udplite_new(struct nf_conn *ct, const struct sk_buff *skb,
-                        unsigned int dataoff)
+                        unsigned int dataoff, unsigned int *timeouts)
 {
         return true;
 }
@@ -141,20 +156,67 @@ static int udplite_error(struct net *net, struct nf_conn *tmpl,
         return NF_ACCEPT;
 }
 
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nfnetlink_cttimeout.h>
+
+static int udplite_timeout_nlattr_to_obj(struct nlattr *tb[], void *data)
+{
+        unsigned int *timeouts = data;
+
+        /* set default timeouts for UDPlite. */
+        timeouts[UDPLITE_CT_UNREPLIED] = udplite_timeouts[UDPLITE_CT_UNREPLIED];
+        timeouts[UDPLITE_CT_REPLIED] = udplite_timeouts[UDPLITE_CT_REPLIED];
+
+        if (tb[CTA_TIMEOUT_UDPLITE_UNREPLIED]) {
+                timeouts[UDPLITE_CT_UNREPLIED] =
+                  ntohl(nla_get_be32(tb[CTA_TIMEOUT_UDPLITE_UNREPLIED])) * HZ;
+        }
+        if (tb[CTA_TIMEOUT_UDPLITE_REPLIED]) {
+                timeouts[UDPLITE_CT_REPLIED] =
+                  ntohl(nla_get_be32(tb[CTA_TIMEOUT_UDPLITE_REPLIED])) * HZ;
+        }
+        return 0;
+}
+
+static int
+udplite_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
+{
+        const unsigned int *timeouts = data;
+
+        if (nla_put_be32(skb, CTA_TIMEOUT_UDPLITE_UNREPLIED,
+                         htonl(timeouts[UDPLITE_CT_UNREPLIED] / HZ)) ||
+            nla_put_be32(skb, CTA_TIMEOUT_UDPLITE_REPLIED,
+                         htonl(timeouts[UDPLITE_CT_REPLIED] / HZ)))
+                goto nla_put_failure;
+        return 0;
+
+nla_put_failure:
+        return -ENOSPC;
+}
+
+static const struct nla_policy
+udplite_timeout_nla_policy[CTA_TIMEOUT_UDPLITE_MAX+1] = {
+        [CTA_TIMEOUT_UDPLITE_UNREPLIED] = { .type = NLA_U32 },
+        [CTA_TIMEOUT_UDPLITE_REPLIED]   = { .type = NLA_U32 },
+};
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+
 #ifdef CONFIG_SYSCTL
 static unsigned int udplite_sysctl_table_users;
 static struct ctl_table_header *udplite_sysctl_header;
 static struct ctl_table udplite_sysctl_table[] = {
         {
                 .procname       = "nf_conntrack_udplite_timeout",
-                .data           = &nf_ct_udplite_timeout,
+                .data           = &udplite_timeouts[UDPLITE_CT_UNREPLIED],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_udplite_timeout_stream",
-                .data           = &nf_ct_udplite_timeout_stream,
+                .data           = &udplite_timeouts[UDPLITE_CT_REPLIED],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
@@ -172,6 +234,7 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite4 __read_mostly =
         .invert_tuple           = udplite_invert_tuple,
         .print_tuple            = udplite_print_tuple,
         .packet                 = udplite_packet,
+        .get_timeouts           = udplite_get_timeouts,
         .new                    = udplite_new,
         .error                  = udplite_error,
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
@@ -180,6 +243,16 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite4 __read_mostly =
         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+        .ctnl_timeout           = {
+                .nlattr_to_obj  = udplite_timeout_nlattr_to_obj,
+                .obj_to_nlattr  = udplite_timeout_obj_to_nlattr,
+                .nlattr_max     = CTA_TIMEOUT_UDPLITE_MAX,
+                .obj_size       = sizeof(unsigned int) *
+                                        CTA_TIMEOUT_UDPLITE_MAX,
+                .nla_policy     = udplite_timeout_nla_policy,
+        },
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
 #ifdef CONFIG_SYSCTL
         .ctl_table_users        = &udplite_sysctl_table_users,
         .ctl_table_header       = &udplite_sysctl_header,
@@ -196,6 +269,7 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6 __read_mostly =
         .invert_tuple           = udplite_invert_tuple,
         .print_tuple            = udplite_print_tuple,
         .packet                 = udplite_packet,
+        .get_timeouts           = udplite_get_timeouts,
         .new                    = udplite_new,
         .error                  = udplite_error,
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
@@ -204,6 +278,16 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6 __read_mostly =
         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+        .ctnl_timeout           = {
+                .nlattr_to_obj  = udplite_timeout_nlattr_to_obj,
+                .obj_to_nlattr  = udplite_timeout_obj_to_nlattr,
+                .nlattr_max     = CTA_TIMEOUT_UDPLITE_MAX,
+                .obj_size       = sizeof(unsigned int) *
+                                        CTA_TIMEOUT_UDPLITE_MAX,
+                .nla_policy     = udplite_timeout_nla_policy,
+        },
+#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
 #ifdef CONFIG_SYSCTL
         .ctl_table_users        = &udplite_sysctl_table_users,
         .ctl_table_header       = &udplite_sysctl_header,
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 885f5ab9bc28..9b3943252a5e 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -468,18 +468,13 @@ static ctl_table nf_ct_netfilter_table[] = {
         { }
 };
 
-static struct ctl_path nf_ct_path[] = {
-        { .procname = "net", },
-        { }
-};
-
 static int nf_conntrack_standalone_init_sysctl(struct net *net)
 {
         struct ctl_table *table;
 
         if (net_eq(net, &init_net)) {
                 nf_ct_netfilter_header =
-                       register_sysctl_paths(nf_ct_path, nf_ct_netfilter_table);
+                       register_net_sysctl(&init_net, "net", nf_ct_netfilter_table);
                 if (!nf_ct_netfilter_header)
                         goto out;
         }
@@ -494,8 +489,7 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
         table[3].data = &net->ct.sysctl_checksum;
         table[4].data = &net->ct.sysctl_log_invalid;
 
-        net->ct.sysctl_header = register_net_sysctl_table(net,
-                                        nf_net_netfilter_sysctl_path, table);
+        net->ct.sysctl_header = register_net_sysctl(net, "net/netfilter", table);
         if (!net->ct.sysctl_header)
                 goto out_unregister_netfilter;
 
@@ -505,7 +499,7 @@ out_unregister_netfilter:
         kfree(table);
 out_kmemdup:
         if (net_eq(net, &init_net))
-                unregister_sysctl_table(nf_ct_netfilter_header);
+                unregister_net_sysctl_table(nf_ct_netfilter_header);
 out:
         printk(KERN_ERR "nf_conntrack: can't register to sysctl.\n");
         return -ENOMEM;
@@ -516,7 +510,7 @@ static void nf_conntrack_standalone_fini_sysctl(struct net *net)
         struct ctl_table *table;
 
         if (net_eq(net, &init_net))
-                unregister_sysctl_table(nf_ct_netfilter_header);
+                unregister_net_sysctl_table(nf_ct_netfilter_header);
         table = net->ct.sysctl_header->ctl_table_arg;
         unregister_net_sysctl_table(net->ct.sysctl_header);
         kfree(table);
diff --git a/net/netfilter/nf_conntrack_timeout.c b/net/netfilter/nf_conntrack_timeout.c
new file mode 100644
index 000000000000..a878ce5b252c
--- /dev/null
+++ b/net/netfilter/nf_conntrack_timeout.c
@@ -0,0 +1,60 @@
+/*
+ * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
+ * (C) 2012 by Vyatta Inc. <http://www.vyatta.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation (or any later at your option).
+ */
+
+#include <linux/types.h>
+#include <linux/netfilter.h>
+#include <linux/skbuff.h>
+#include <linux/vmalloc.h>
+#include <linux/stddef.h>
+#include <linux/err.h>
+#include <linux/percpu.h>
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/slab.h>
+#include <linux/export.h>
+
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/nf_conntrack_extend.h>
+#include <net/netfilter/nf_conntrack_timeout.h>
+
+struct ctnl_timeout *
+(*nf_ct_timeout_find_get_hook)(const char *name) __read_mostly;
+EXPORT_SYMBOL_GPL(nf_ct_timeout_find_get_hook);
+
+void (*nf_ct_timeout_put_hook)(struct ctnl_timeout *timeout) __read_mostly;
+EXPORT_SYMBOL_GPL(nf_ct_timeout_put_hook);
+
+static struct nf_ct_ext_type timeout_extend __read_mostly = {
+        .len    = sizeof(struct nf_conn_timeout),
+        .align  = __alignof__(struct nf_conn_timeout),
+        .id     = NF_CT_EXT_TIMEOUT,
+};
+
+int nf_conntrack_timeout_init(struct net *net)
+{
+        int ret = 0;
+
+        if (net_eq(net, &init_net)) {
+                ret = nf_ct_extend_register(&timeout_extend);
+                if (ret < 0) {
+                        printk(KERN_ERR "nf_ct_timeout: Unable to register "
+                                        "timeout extension.\n");
+                        return ret;
+                }
+        }
+
+        return 0;
+}
+
+void nf_conntrack_timeout_fini(struct net *net)
+{
+        if (net_eq(net, &init_net))
+                nf_ct_extend_unregister(&timeout_extend);
+}
diff --git a/net/netfilter/nf_conntrack_timestamp.c b/net/netfilter/nf_conntrack_timestamp.c
index e8d27afbbdb9..dbb364f62d6f 100644
--- a/net/netfilter/nf_conntrack_timestamp.c
+++ b/net/netfilter/nf_conntrack_timestamp.c
@@ -51,8 +51,8 @@ static int nf_conntrack_tstamp_init_sysctl(struct net *net)
 
         table[0].data = &net->ct.sysctl_tstamp;
 
-        net->ct.tstamp_sysctl_header = register_net_sysctl_table(net,
-                        nf_net_netfilter_sysctl_path, table);
+        net->ct.tstamp_sysctl_header = register_net_sysctl(net, "net/netfilter",
+                                                           table);
         if (!net->ct.tstamp_sysctl_header) {
                 printk(KERN_ERR "nf_ct_tstamp: can't register to sysctl.\n");
                 goto out_register;
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 957374a234d4..703fb26aa48d 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -214,13 +214,6 @@ static const struct file_operations nflog_file_ops = {
 #endif /* PROC_FS */
 
 #ifdef CONFIG_SYSCTL
-static struct ctl_path nf_log_sysctl_path[] = {
-        { .procname = "net", },
-        { .procname = "netfilter", },
-        { .procname = "nf_log", },
-        { }
-};
-
 static char nf_log_sysctl_fnames[NFPROTO_NUMPROTO-NFPROTO_UNSPEC][3];
 static struct ctl_table nf_log_sysctl_table[NFPROTO_NUMPROTO+1];
 static struct ctl_table_header *nf_log_dir_header;
@@ -283,7 +276,7 @@ static __init int netfilter_log_sysctl_init(void)
                 nf_log_sysctl_table[i].extra1 = (void *)(unsigned long) i;
         }
 
-        nf_log_dir_header = register_sysctl_paths(nf_log_sysctl_path,
+        nf_log_dir_header = register_net_sysctl(&init_net, "net/netfilter/nf_log",
                                        nf_log_sysctl_table);
         if (!nf_log_dir_header)
                 return -ENOMEM;
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 4d70785b953d..3e797d1fcb94 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -23,7 +23,6 @@
 #include <linux/net.h>
 #include <linux/skbuff.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <net/sock.h>
 #include <net/netlink.h>
 #include <linux/init.h>
@@ -104,7 +103,7 @@ int nfnetlink_has_listeners(struct net *net, unsigned int group)
 EXPORT_SYMBOL_GPL(nfnetlink_has_listeners);
 
 int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 pid,
-                   unsigned group, int echo, gfp_t flags)
+                   unsigned int group, int echo, gfp_t flags)
 {
         return nlmsg_notify(net->nfnl, skb, pid, group, echo, flags);
 }
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 11ba013e47f6..b2e7310ca0b8 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -10,6 +10,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
+#include <linux/atomic.h>
 #include <linux/netlink.h>
 #include <linux/rculist.h>
 #include <linux/slab.h>
@@ -17,7 +18,6 @@
 #include <linux/errno.h>
 #include <net/netlink.h>
 #include <net/sock.h>
-#include <asm/atomic.h>
 
 #include <linux/netfilter.h>
 #include <linux/netfilter/nfnetlink.h>
@@ -109,7 +109,8 @@ nfnl_acct_fill_info(struct sk_buff *skb, u32 pid, u32 seq, u32 type,
         nfmsg->version = NFNETLINK_V0;
         nfmsg->res_id = 0;
 
-        NLA_PUT_STRING(skb, NFACCT_NAME, acct->name);
+        if (nla_put_string(skb, NFACCT_NAME, acct->name))
+                goto nla_put_failure;
 
         if (type == NFNL_MSG_ACCT_GET_CTRZERO) {
                 pkts = atomic64_xchg(&acct->pkts, 0);
@@ -118,9 +119,10 @@ nfnl_acct_fill_info(struct sk_buff *skb, u32 pid, u32 seq, u32 type,
                 pkts = atomic64_read(&acct->pkts);
                 bytes = atomic64_read(&acct->bytes);
         }
-        NLA_PUT_BE64(skb, NFACCT_PKTS, cpu_to_be64(pkts));
-        NLA_PUT_BE64(skb, NFACCT_BYTES, cpu_to_be64(bytes));
-        NLA_PUT_BE32(skb, NFACCT_USE, htonl(atomic_read(&acct->refcnt)));
+        if (nla_put_be64(skb, NFACCT_PKTS, cpu_to_be64(pkts)) ||
+            nla_put_be64(skb, NFACCT_BYTES, cpu_to_be64(bytes)) ||
+            nla_put_be32(skb, NFACCT_USE, htonl(atomic_read(&acct->refcnt))))
+                goto nla_put_failure;
 
         nlmsg_end(skb, nlh);
         return skb->len;
@@ -171,8 +173,10 @@ nfnl_acct_get(struct sock *nfnl, struct sk_buff *skb,
         char *acct_name;
 
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
-                return netlink_dump_start(nfnl, skb, nlh, nfnl_acct_dump,
-                                          NULL, 0);
+                struct netlink_dump_control c = {
+                        .dump = nfnl_acct_dump,
+                };
+                return netlink_dump_start(nfnl, skb, nlh, &c);
         }
 
         if (!tb[NFACCT_NAME])
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
new file mode 100644
index 000000000000..3e655288d1d6
--- /dev/null
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -0,0 +1,431 @@
+/*
+ * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
+ * (C) 2012 by Vyatta Inc. <http://www.vyatta.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation (or any later at your option).
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/rculist.h>
+#include <linux/rculist_nulls.h>
+#include <linux/types.h>
+#include <linux/timer.h>
+#include <linux/security.h>
+#include <linux/skbuff.h>
+#include <linux/errno.h>
+#include <linux/netlink.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <linux/slab.h>
+
+#include <linux/netfilter.h>
+#include <net/netlink.h>
+#include <net/sock.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/nf_conntrack_l3proto.h>
+#include <net/netfilter/nf_conntrack_l4proto.h>
+#include <net/netfilter/nf_conntrack_tuple.h>
+#include <net/netfilter/nf_conntrack_timeout.h>
+
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nfnetlink_cttimeout.h>
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
+MODULE_DESCRIPTION("cttimeout: Extended Netfilter Connection Tracking timeout tuning");
+
+static LIST_HEAD(cttimeout_list);
+
+static const struct nla_policy cttimeout_nla_policy[CTA_TIMEOUT_MAX+1] = {
+        [CTA_TIMEOUT_NAME]      = { .type = NLA_NUL_STRING },
+        [CTA_TIMEOUT_L3PROTO]   = { .type = NLA_U16 },
+        [CTA_TIMEOUT_L4PROTO]   = { .type = NLA_U8 },
+        [CTA_TIMEOUT_DATA]      = { .type = NLA_NESTED },
+};
+
+static int
+ctnl_timeout_parse_policy(struct ctnl_timeout *timeout,
+                               struct nf_conntrack_l4proto *l4proto,
+                               const struct nlattr *attr)
+{
+        int ret = 0;
+
+        if (likely(l4proto->ctnl_timeout.nlattr_to_obj)) {
+                struct nlattr *tb[l4proto->ctnl_timeout.nlattr_max+1];
+
+                nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,
+                                 attr, l4proto->ctnl_timeout.nla_policy);
+
+                ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, &timeout->data);
+        }
+        return ret;
+}
+
+static int
+cttimeout_new_timeout(struct sock *ctnl, struct sk_buff *skb,
+                      const struct nlmsghdr *nlh,
+                      const struct nlattr * const cda[])
+{
+        __u16 l3num;
+        __u8 l4num;
+        struct nf_conntrack_l4proto *l4proto;
+        struct ctnl_timeout *timeout, *matching = NULL;
+        char *name;
+        int ret;
+
+        if (!cda[CTA_TIMEOUT_NAME] ||
+            !cda[CTA_TIMEOUT_L3PROTO] ||
+            !cda[CTA_TIMEOUT_L4PROTO] ||
+            !cda[CTA_TIMEOUT_DATA])
+                return -EINVAL;
+
+        name = nla_data(cda[CTA_TIMEOUT_NAME]);
+        l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
+        l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
+
+        list_for_each_entry(timeout, &cttimeout_list, head) {
+                if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
+                        continue;
+
+                if (nlh->nlmsg_flags & NLM_F_EXCL)
+                        return -EEXIST;
+
+                matching = timeout;
+                break;
+        }
+
+        l4proto = nf_ct_l4proto_find_get(l3num, l4num);
+
+        /* This protocol is not supportted, skip. */
+        if (l4proto->l4proto != l4num) {
+                ret = -EOPNOTSUPP;
+                goto err_proto_put;
+        }
+
+        if (matching) {
+                if (nlh->nlmsg_flags & NLM_F_REPLACE) {
+                        /* You cannot replace one timeout policy by another of
+                         * different kind, sorry.
+                         */
+                        if (matching->l3num != l3num ||
+                            matching->l4proto->l4proto != l4num) {
+                                ret = -EINVAL;
+                                goto err_proto_put;
+                        }
+
+                        ret = ctnl_timeout_parse_policy(matching, l4proto,
+                                                        cda[CTA_TIMEOUT_DATA]);
+                        return ret;
+                }
+                ret = -EBUSY;
+                goto err_proto_put;
+        }
+
+        timeout = kzalloc(sizeof(struct ctnl_timeout) +
+                          l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
+        if (timeout == NULL) {
+                ret = -ENOMEM;
+                goto err_proto_put;
+        }
+
+        ret = ctnl_timeout_parse_policy(timeout, l4proto,
+                                        cda[CTA_TIMEOUT_DATA]);
+        if (ret < 0)
+                goto err;
+
+        strcpy(timeout->name, nla_data(cda[CTA_TIMEOUT_NAME]));
+        timeout->l3num = l3num;
+        timeout->l4proto = l4proto;
+        atomic_set(&timeout->refcnt, 1);
+        list_add_tail_rcu(&timeout->head, &cttimeout_list);
+
+        return 0;
+err:
+        kfree(timeout);
+err_proto_put:
+        nf_ct_l4proto_put(l4proto);
+        return ret;
+}
+
+static int
+ctnl_timeout_fill_info(struct sk_buff *skb, u32 pid, u32 seq, u32 type,
+                       int event, struct ctnl_timeout *timeout)
+{
+        struct nlmsghdr *nlh;
+        struct nfgenmsg *nfmsg;
+        unsigned int flags = pid ? NLM_F_MULTI : 0;
+        struct nf_conntrack_l4proto *l4proto = timeout->l4proto;
+
+        event |= NFNL_SUBSYS_CTNETLINK_TIMEOUT << 8;
+        nlh = nlmsg_put(skb, pid, seq, event, sizeof(*nfmsg), flags);
+        if (nlh == NULL)
+                goto nlmsg_failure;
+
+        nfmsg = nlmsg_data(nlh);
+        nfmsg->nfgen_family = AF_UNSPEC;
+        nfmsg->version = NFNETLINK_V0;
+        nfmsg->res_id = 0;
+
+        if (nla_put_string(skb, CTA_TIMEOUT_NAME, timeout->name) ||
+            nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(timeout->l3num)) ||
+            nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
+            nla_put_be32(skb, CTA_TIMEOUT_USE,
+                         htonl(atomic_read(&timeout->refcnt))))
+                goto nla_put_failure;
+
+        if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
+                struct nlattr *nest_parms;
+                int ret;
+
+                nest_parms = nla_nest_start(skb,
+                                            CTA_TIMEOUT_DATA | NLA_F_NESTED);
+                if (!nest_parms)
+                        goto nla_put_failure;
+
+                ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
+                if (ret < 0)
+                        goto nla_put_failure;
+
+                nla_nest_end(skb, nest_parms);
+        }
+
+        nlmsg_end(skb, nlh);
+        return skb->len;
+
+nlmsg_failure:
+nla_put_failure:
+        nlmsg_cancel(skb, nlh);
+        return -1;
+}
+
+static int
+ctnl_timeout_dump(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        struct ctnl_timeout *cur, *last;
+
+        if (cb->args[2])
+                return 0;
+
+        last = (struct ctnl_timeout *)cb->args[1];
+        if (cb->args[1])
+                cb->args[1] = 0;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(cur, &cttimeout_list, head) {
+                if (last && cur != last)
+                        continue;
+
+                if (ctnl_timeout_fill_info(skb, NETLINK_CB(cb->skb).pid,
+                                           cb->nlh->nlmsg_seq,
+                                           NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
+                                           IPCTNL_MSG_TIMEOUT_NEW, cur) < 0) {
+                        cb->args[1] = (unsigned long)cur;
+                        break;
+                }
+        }
+        if (!cb->args[1])
+                cb->args[2] = 1;
+        rcu_read_unlock();
+        return skb->len;
+}
+
+static int
+cttimeout_get_timeout(struct sock *ctnl, struct sk_buff *skb,
+                      const struct nlmsghdr *nlh,
+                      const struct nlattr * const cda[])
+{
+        int ret = -ENOENT;
+        char *name;
+        struct ctnl_timeout *cur;
+
+        if (nlh->nlmsg_flags & NLM_F_DUMP) {
+                struct netlink_dump_control c = {
+                        .dump = ctnl_timeout_dump,
+                };
+                return netlink_dump_start(ctnl, skb, nlh, &c);
+        }
+
+        if (!cda[CTA_TIMEOUT_NAME])
+                return -EINVAL;
+        name = nla_data(cda[CTA_TIMEOUT_NAME]);
+
+        list_for_each_entry(cur, &cttimeout_list, head) {
+                struct sk_buff *skb2;
+
+                if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
+                        continue;
+
+                skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+                if (skb2 == NULL) {
+                        ret = -ENOMEM;
+                        break;
+                }
+
+                ret = ctnl_timeout_fill_info(skb2, NETLINK_CB(skb).pid,
+                                             nlh->nlmsg_seq,
+                                             NFNL_MSG_TYPE(nlh->nlmsg_type),
+                                             IPCTNL_MSG_TIMEOUT_NEW, cur);
+                if (ret <= 0) {
+                        kfree_skb(skb2);
+                        break;
+                }
+                ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid,
+                                        MSG_DONTWAIT);
+                if (ret > 0)
+                        ret = 0;
+
+                /* this avoids a loop in nfnetlink. */
+                return ret == -EAGAIN ? -ENOBUFS : ret;
+        }
+        return ret;
+}
+
+/* try to delete object, fail if it is still in use. */
+static int ctnl_timeout_try_del(struct ctnl_timeout *timeout)
+{
+        int ret = 0;
+
+        /* we want to avoid races with nf_ct_timeout_find_get. */
+        if (atomic_dec_and_test(&timeout->refcnt)) {
+                /* We are protected by nfnl mutex. */
+                list_del_rcu(&timeout->head);
+                nf_ct_l4proto_put(timeout->l4proto);
+                kfree_rcu(timeout, rcu_head);
+        } else {
+                /* still in use, restore reference counter. */
+                atomic_inc(&timeout->refcnt);
+                ret = -EBUSY;
+        }
+        return ret;
+}
+
+static int
+cttimeout_del_timeout(struct sock *ctnl, struct sk_buff *skb,
+                      const struct nlmsghdr *nlh,
+                      const struct nlattr * const cda[])
+{
+        char *name;
+        struct ctnl_timeout *cur;
+        int ret = -ENOENT;
+
+        if (!cda[CTA_TIMEOUT_NAME]) {
+                list_for_each_entry(cur, &cttimeout_list, head)
+                        ctnl_timeout_try_del(cur);
+
+                return 0;
+        }
+        name = nla_data(cda[CTA_TIMEOUT_NAME]);
+
+        list_for_each_entry(cur, &cttimeout_list, head) {
+                if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
+                        continue;
+
+                ret = ctnl_timeout_try_del(cur);
+                if (ret < 0)
+                        return ret;
+
+                break;
+        }
+        return ret;
+}
+
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+static struct ctnl_timeout *ctnl_timeout_find_get(const char *name)
+{
+        struct ctnl_timeout *timeout, *matching = NULL;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(timeout, &cttimeout_list, head) {
+                if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
+                        continue;
+
+                if (!try_module_get(THIS_MODULE))
+                        goto err;
+
+                if (!atomic_inc_not_zero(&timeout->refcnt)) {
+                        module_put(THIS_MODULE);
+                        goto err;
+                }
+                matching = timeout;
+                break;
+        }
+err:
+        rcu_read_unlock();
+        return matching;
+}
+
+static void ctnl_timeout_put(struct ctnl_timeout *timeout)
+{
+        atomic_dec(&timeout->refcnt);
+        module_put(THIS_MODULE);
+}
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
+
+static const struct nfnl_callback cttimeout_cb[IPCTNL_MSG_TIMEOUT_MAX] = {
+        [IPCTNL_MSG_TIMEOUT_NEW]        = { .call = cttimeout_new_timeout,
+                                            .attr_count = CTA_TIMEOUT_MAX,
+                                            .policy = cttimeout_nla_policy },
+        [IPCTNL_MSG_TIMEOUT_GET]        = { .call = cttimeout_get_timeout,
+                                            .attr_count = CTA_TIMEOUT_MAX,
+                                            .policy = cttimeout_nla_policy },
+        [IPCTNL_MSG_TIMEOUT_DELETE]     = { .call = cttimeout_del_timeout,
+                                            .attr_count = CTA_TIMEOUT_MAX,
+                                            .policy = cttimeout_nla_policy },
+};
+
+static const struct nfnetlink_subsystem cttimeout_subsys = {
+        .name                           = "conntrack_timeout",
+        .subsys_id                      = NFNL_SUBSYS_CTNETLINK_TIMEOUT,
+        .cb_count                       = IPCTNL_MSG_TIMEOUT_MAX,
+        .cb                             = cttimeout_cb,
+};
+
+MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_TIMEOUT);
+
+static int __init cttimeout_init(void)
+{
+        int ret;
+
+        ret = nfnetlink_subsys_register(&cttimeout_subsys);
+        if (ret < 0) {
+                pr_err("cttimeout_init: cannot register cttimeout with "
+                        "nfnetlink.\n");
+                goto err_out;
+        }
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+        RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, ctnl_timeout_find_get);
+        RCU_INIT_POINTER(nf_ct_timeout_put_hook, ctnl_timeout_put);
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
+        return 0;
+
+err_out:
+        return ret;
+}
+
+static void __exit cttimeout_exit(void)
+{
+        struct ctnl_timeout *cur, *tmp;
+
+        pr_info("cttimeout: unregistering from nfnetlink.\n");
+
+        nfnetlink_subsys_unregister(&cttimeout_subsys);
+        list_for_each_entry_safe(cur, tmp, &cttimeout_list, head) {
+                list_del_rcu(&cur->head);
+                /* We are sure that our objects have no clients at this point,
+                 * it's safe to release them all without checking refcnt.
+                 */
+                nf_ct_l4proto_put(cur->l4proto);
+                kfree_rcu(cur, rcu_head);
+        }
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+        RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
+        RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
+}
+
+module_init(cttimeout_init);
+module_exit(cttimeout_exit);
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 66b2c54c544f..3c3cfc0cc9b5 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -391,67 +391,78 @@ __build_packet_message(struct nfulnl_instance *inst,
         pmsg.hw_protocol        = skb->protocol;
         pmsg.hook               = hooknum;
 
-        NLA_PUT(inst->skb, NFULA_PACKET_HDR, sizeof(pmsg), &pmsg);
+        if (nla_put(inst->skb, NFULA_PACKET_HDR, sizeof(pmsg), &pmsg))
+                goto nla_put_failure;
 
-        if (prefix)
-                NLA_PUT(inst->skb, NFULA_PREFIX, plen, prefix);
+        if (prefix &&
+            nla_put(inst->skb, NFULA_PREFIX, plen, prefix))
+                goto nla_put_failure;
 
         if (indev) {
 #ifndef CONFIG_BRIDGE_NETFILTER
-                NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_INDEV,
-                             htonl(indev->ifindex));
+                if (nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV,
+                                 htonl(indev->ifindex)))
+                        goto nla_put_failure;
 #else
                 if (pf == PF_BRIDGE) {
                         /* Case 1: outdev is physical input device, we need to
                          * look for bridge group (when called from
                          * netfilter_bridge) */
-                        NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_PHYSINDEV,
-                                     htonl(indev->ifindex));
+                        if (nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSINDEV,
+                                         htonl(indev->ifindex)) ||
                         /* this is the bridge group "brX" */
                         /* rcu_read_lock()ed by nf_hook_slow or nf_log_packet */
-                        NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_INDEV,
-                                     htonl(br_port_get_rcu(indev)->br->dev->ifindex));
+                            nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV,
+                                         htonl(br_port_get_rcu(indev)->br->dev->ifindex)))
+                                goto nla_put_failure;
                 } else {
                         /* Case 2: indev is bridge group, we need to look for
                          * physical device (when called from ipv4) */
-                        NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_INDEV,
-                                     htonl(indev->ifindex));
-                        if (skb->nf_bridge && skb->nf_bridge->physindev)
-                                NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_PHYSINDEV,
-                                             htonl(skb->nf_bridge->physindev->ifindex));
+                        if (nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV,
+                                         htonl(indev->ifindex)))
+                                goto nla_put_failure;
+                        if (skb->nf_bridge && skb->nf_bridge->physindev &&
+                            nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSINDEV,
+                                         htonl(skb->nf_bridge->physindev->ifindex)))
+                                goto nla_put_failure;
                 }
 #endif
         }
 
         if (outdev) {
 #ifndef CONFIG_BRIDGE_NETFILTER
-                NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_OUTDEV,
-                             htonl(outdev->ifindex));
+                if (nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV,
+                                 htonl(outdev->ifindex)))
+                        goto nla_put_failure;
 #else
                 if (pf == PF_BRIDGE) {
                         /* Case 1: outdev is physical output device, we need to
                          * look for bridge group (when called from
                          * netfilter_bridge) */
-                        NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
-                                     htonl(outdev->ifindex));
+                        if (nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
+                                         htonl(outdev->ifindex)) ||
                         /* this is the bridge group "brX" */
                         /* rcu_read_lock()ed by nf_hook_slow or nf_log_packet */
-                        NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_OUTDEV,
-                                     htonl(br_port_get_rcu(outdev)->br->dev->ifindex));
+                            nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV,
+                                         htonl(br_port_get_rcu(outdev)->br->dev->ifindex)))
+                                goto nla_put_failure;
                 } else {
                         /* Case 2: indev is a bridge group, we need to look
                          * for physical device (when called from ipv4) */
-                        NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_OUTDEV,
-                                     htonl(outdev->ifindex));
-                        if (skb->nf_bridge && skb->nf_bridge->physoutdev)
-                                NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
-                                             htonl(skb->nf_bridge->physoutdev->ifindex));
+                        if (nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV,
+                                         htonl(outdev->ifindex)))
+                                goto nla_put_failure;
+                        if (skb->nf_bridge && skb->nf_bridge->physoutdev &&
+                            nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
+                                         htonl(skb->nf_bridge->physoutdev->ifindex)))
+                                goto nla_put_failure;
                 }
 #endif
         }
 
-        if (skb->mark)
-                NLA_PUT_BE32(inst->skb, NFULA_MARK, htonl(skb->mark));
+        if (skb->mark &&
+            nla_put_be32(inst->skb, NFULA_MARK, htonl(skb->mark)))
+                goto nla_put_failure;
 
         if (indev && skb->dev &&
             skb->mac_header != skb->network_header) {
@@ -459,16 +470,18 @@ __build_packet_message(struct nfulnl_instance *inst,
                 int len = dev_parse_header(skb, phw.hw_addr);
                 if (len > 0) {
                         phw.hw_addrlen = htons(len);
-                        NLA_PUT(inst->skb, NFULA_HWADDR, sizeof(phw), &phw);
+                        if (nla_put(inst->skb, NFULA_HWADDR, sizeof(phw), &phw))
+                                goto nla_put_failure;
                 }
         }
 
         if (indev && skb_mac_header_was_set(skb)) {
-                NLA_PUT_BE16(inst->skb, NFULA_HWTYPE, htons(skb->dev->type));
-                NLA_PUT_BE16(inst->skb, NFULA_HWLEN,
-                             htons(skb->dev->hard_header_len));
-                NLA_PUT(inst->skb, NFULA_HWHEADER, skb->dev->hard_header_len,
-                        skb_mac_header(skb));
+                if (nla_put_be32(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) ||
+                    nla_put_be16(inst->skb, NFULA_HWLEN,
+                                 htons(skb->dev->hard_header_len)) ||
+                    nla_put(inst->skb, NFULA_HWHEADER, skb->dev->hard_header_len,
+                            skb_mac_header(skb)))
+                        goto nla_put_failure;
         }
 
         if (skb->tstamp.tv64) {
@@ -477,7 +490,8 @@ __build_packet_message(struct nfulnl_instance *inst,
                 ts.sec = cpu_to_be64(tv.tv_sec);
                 ts.usec = cpu_to_be64(tv.tv_usec);
 
-                NLA_PUT(inst->skb, NFULA_TIMESTAMP, sizeof(ts), &ts);
+                if (nla_put(inst->skb, NFULA_TIMESTAMP, sizeof(ts), &ts))
+                        goto nla_put_failure;
         }
 
         /* UID */
@@ -487,22 +501,24 @@ __build_packet_message(struct nfulnl_instance *inst,
                         struct file *file = skb->sk->sk_socket->file;
                         __be32 uid = htonl(file->f_cred->fsuid);
                         __be32 gid = htonl(file->f_cred->fsgid);
-                        /* need to unlock here since NLA_PUT may goto */
                         read_unlock_bh(&skb->sk->sk_callback_lock);
-                        NLA_PUT_BE32(inst->skb, NFULA_UID, uid);
-                        NLA_PUT_BE32(inst->skb, NFULA_GID, gid);
+                        if (nla_put_be32(inst->skb, NFULA_UID, uid) ||
+                            nla_put_be32(inst->skb, NFULA_GID, gid))
+                                goto nla_put_failure;
                 } else
                         read_unlock_bh(&skb->sk->sk_callback_lock);
         }
 
         /* local sequence number */
-        if (inst->flags & NFULNL_CFG_F_SEQ)
-                NLA_PUT_BE32(inst->skb, NFULA_SEQ, htonl(inst->seq++));
+        if ((inst->flags & NFULNL_CFG_F_SEQ) &&
+            nla_put_be32(inst->skb, NFULA_SEQ, htonl(inst->seq++)))
+                goto nla_put_failure;
 
         /* global sequence number */
-        if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
-                NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
-                             htonl(atomic_inc_return(&global_seq)));
+        if ((inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) &&
+            nla_put_be32(inst->skb, NFULA_SEQ_GLOBAL,
+                         htonl(atomic_inc_return(&global_seq))))
+                goto nla_put_failure;
 
         if (data_len) {
                 struct nlattr *nla;
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index a80b0cb03f17..4162437b8361 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -288,58 +288,67 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
         indev = entry->indev;
         if (indev) {
 #ifndef CONFIG_BRIDGE_NETFILTER
-                NLA_PUT_BE32(skb, NFQA_IFINDEX_INDEV, htonl(indev->ifindex));
+                if (nla_put_be32(skb, NFQA_IFINDEX_INDEV, htonl(indev->ifindex)))
+                        goto nla_put_failure;
 #else
                 if (entry->pf == PF_BRIDGE) {
                         /* Case 1: indev is physical input device, we need to
                          * look for bridge group (when called from
                          * netfilter_bridge) */
-                        NLA_PUT_BE32(skb, NFQA_IFINDEX_PHYSINDEV,
-                                     htonl(indev->ifindex));
+                        if (nla_put_be32(skb, NFQA_IFINDEX_PHYSINDEV,
+                                         htonl(indev->ifindex)) ||
                         /* this is the bridge group "brX" */
                         /* rcu_read_lock()ed by __nf_queue */
-                        NLA_PUT_BE32(skb, NFQA_IFINDEX_INDEV,
-                                     htonl(br_port_get_rcu(indev)->br->dev->ifindex));
+                            nla_put_be32(skb, NFQA_IFINDEX_INDEV,
+                                         htonl(br_port_get_rcu(indev)->br->dev->ifindex)))
+                                goto nla_put_failure;
                 } else {
                         /* Case 2: indev is bridge group, we need to look for
                          * physical device (when called from ipv4) */
-                        NLA_PUT_BE32(skb, NFQA_IFINDEX_INDEV,
-                                     htonl(indev->ifindex));
-                        if (entskb->nf_bridge && entskb->nf_bridge->physindev)
-                                NLA_PUT_BE32(skb, NFQA_IFINDEX_PHYSINDEV,
-                                             htonl(entskb->nf_bridge->physindev->ifindex));
+                        if (nla_put_be32(skb, NFQA_IFINDEX_INDEV,
+                                         htonl(indev->ifindex)))
+                                goto nla_put_failure;
+                        if (entskb->nf_bridge && entskb->nf_bridge->physindev &&
+                            nla_put_be32(skb, NFQA_IFINDEX_PHYSINDEV,
+                                         htonl(entskb->nf_bridge->physindev->ifindex)))
+                                goto nla_put_failure;
                 }
 #endif
         }
 
         if (outdev) {
 #ifndef CONFIG_BRIDGE_NETFILTER
-                NLA_PUT_BE32(skb, NFQA_IFINDEX_OUTDEV, htonl(outdev->ifindex));
+                if (nla_put_be32(skb, NFQA_IFINDEX_OUTDEV, htonl(outdev->ifindex)))
+                        goto nla_put_failure;
 #else
                 if (entry->pf == PF_BRIDGE) {
                         /* Case 1: outdev is physical output device, we need to
                          * look for bridge group (when called from
                          * netfilter_bridge) */
-                        NLA_PUT_BE32(skb, NFQA_IFINDEX_PHYSOUTDEV,
-                                     htonl(outdev->ifindex));
+                        if (nla_put_be32(skb, NFQA_IFINDEX_PHYSOUTDEV,
+                                         htonl(outdev->ifindex)) ||
                         /* this is the bridge group "brX" */
                         /* rcu_read_lock()ed by __nf_queue */
-                        NLA_PUT_BE32(skb, NFQA_IFINDEX_OUTDEV,
-                                     htonl(br_port_get_rcu(outdev)->br->dev->ifindex));
+                            nla_put_be32(skb, NFQA_IFINDEX_OUTDEV,
+                                         htonl(br_port_get_rcu(outdev)->br->dev->ifindex)))
+                                goto nla_put_failure;
                 } else {
                         /* Case 2: outdev is bridge group, we need to look for
                          * physical output device (when called from ipv4) */
-                        NLA_PUT_BE32(skb, NFQA_IFINDEX_OUTDEV,
-                                     htonl(outdev->ifindex));
-                        if (entskb->nf_bridge && entskb->nf_bridge->physoutdev)
-                                NLA_PUT_BE32(skb, NFQA_IFINDEX_PHYSOUTDEV,
-                                             htonl(entskb->nf_bridge->physoutdev->ifindex));
+                        if (nla_put_be32(skb, NFQA_IFINDEX_OUTDEV,
+                                         htonl(outdev->ifindex)))
+                                goto nla_put_failure;
+                        if (entskb->nf_bridge && entskb->nf_bridge->physoutdev &&
+                            nla_put_be32(skb, NFQA_IFINDEX_PHYSOUTDEV,
+                                         htonl(entskb->nf_bridge->physoutdev->ifindex)))
+                                goto nla_put_failure;
                 }
 #endif
         }
 
-        if (entskb->mark)
-                NLA_PUT_BE32(skb, NFQA_MARK, htonl(entskb->mark));
+        if (entskb->mark &&
+            nla_put_be32(skb, NFQA_MARK, htonl(entskb->mark)))
+                goto nla_put_failure;
 
         if (indev && entskb->dev &&
             entskb->mac_header != entskb->network_header) {
@@ -347,7 +356,8 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
                 int len = dev_parse_header(entskb, phw.hw_addr);
                 if (len) {
                         phw.hw_addrlen = htons(len);
-                        NLA_PUT(skb, NFQA_HWADDR, sizeof(phw), &phw);
+                        if (nla_put(skb, NFQA_HWADDR, sizeof(phw), &phw))
+                                goto nla_put_failure;
                 }
         }
 
@@ -357,7 +367,8 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
                 ts.sec = cpu_to_be64(tv.tv_sec);
                 ts.usec = cpu_to_be64(tv.tv_usec);
 
-                NLA_PUT(skb, NFQA_TIMESTAMP, sizeof(ts), &ts);
+                if (nla_put(skb, NFQA_TIMESTAMP, sizeof(ts), &ts))
+                        goto nla_put_failure;
         }
 
         if (data_len) {
@@ -384,8 +395,7 @@ nlmsg_failure:
 nla_put_failure:
         if (skb)
                 kfree_skb(skb);
-        if (net_ratelimit())
-                printk(KERN_ERR "nf_queue: error creating packet message\n");
+        net_err_ratelimited("nf_queue: error creating packet message\n");
         return NULL;
 }
 
@@ -422,10 +432,8 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
         }
         if (queue->queue_total >= queue->queue_maxlen) {
                 queue->queue_dropped++;
-                if (net_ratelimit())
-                          printk(KERN_WARNING "nf_queue: full at %d entries, "
-                                 "dropping packets(s).\n",
-                                 queue->queue_total);
+                net_warn_ratelimited("nf_queue: full at %d entries, dropping packets(s)\n",
+                                     queue->queue_total);
                 goto err_out_free_nskb;
         }
         entry->id = ++queue->id_sequence;
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 0221d10de75a..a51de9b052be 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -14,12 +14,14 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/xt_CT.h>
 #include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
+#include <net/netfilter/nf_conntrack_timeout.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 
-static unsigned int xt_ct_target(struct sk_buff *skb,
-                                 const struct xt_action_param *par)
+static unsigned int xt_ct_target_v0(struct sk_buff *skb,
+                                    const struct xt_action_param *par)
 {
         const struct xt_ct_target_info *info = par->targinfo;
         struct nf_conn *ct = info->ct;
@@ -35,6 +37,23 @@ static unsigned int xt_ct_target(struct sk_buff *skb,
         return XT_CONTINUE;
 }
 
+static unsigned int xt_ct_target_v1(struct sk_buff *skb,
+                                    const struct xt_action_param *par)
+{
+        const struct xt_ct_target_info_v1 *info = par->targinfo;
+        struct nf_conn *ct = info->ct;
+
+        /* Previously seen (loopback)? Ignore. */
+        if (skb->nfct != NULL)
+                return XT_CONTINUE;
+
+        atomic_inc(&ct->ct_general.use);
+        skb->nfct = &ct->ct_general;
+        skb->nfctinfo = IP_CT_NEW;
+
+        return XT_CONTINUE;
+}
+
 static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
 {
         if (par->family == NFPROTO_IPV4) {
@@ -53,7 +72,7 @@ static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
                 return 0;
 }
 
-static int xt_ct_tg_check(const struct xt_tgchk_param *par)
+static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
 {
         struct xt_ct_target_info *info = par->targinfo;
         struct nf_conntrack_tuple t;
@@ -130,7 +149,164 @@ err1:
         return ret;
 }
 
-static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout)
+{
+        typeof(nf_ct_timeout_put_hook) timeout_put;
+
+        timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
+        if (timeout_put)
+                timeout_put(timeout);
+}
+#endif
+
+static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
+{
+        struct xt_ct_target_info_v1 *info = par->targinfo;
+        struct nf_conntrack_tuple t;
+        struct nf_conn_help *help;
+        struct nf_conn *ct;
+        int ret = 0;
+        u8 proto;
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+        struct ctnl_timeout *timeout;
+#endif
+        if (info->flags & ~XT_CT_NOTRACK)
+                return -EINVAL;
+
+        if (info->flags & XT_CT_NOTRACK) {
+                ct = nf_ct_untracked_get();
+                atomic_inc(&ct->ct_general.use);
+                goto out;
+        }
+
+#ifndef CONFIG_NF_CONNTRACK_ZONES
+        if (info->zone)
+                goto err1;
+#endif
+
+        ret = nf_ct_l3proto_try_module_get(par->family);
+        if (ret < 0)
+                goto err1;
+
+        memset(&t, 0, sizeof(t));
+        ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
+        ret = PTR_ERR(ct);
+        if (IS_ERR(ct))
+                goto err2;
+
+        ret = 0;
+        if ((info->ct_events || info->exp_events) &&
+            !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
+                                  GFP_KERNEL))
+                goto err3;
+
+        if (info->helper[0]) {
+                ret = -ENOENT;
+                proto = xt_ct_find_proto(par);
+                if (!proto) {
+                        pr_info("You must specify a L4 protocol, "
+                                "and not use inversions on it.\n");
+                        goto err3;
+                }
+
+                ret = -ENOMEM;
+                help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
+                if (help == NULL)
+                        goto err3;
+
+                ret = -ENOENT;
+                help->helper = nf_conntrack_helper_try_module_get(info->helper,
+                                                                  par->family,
+                                                                  proto);
+                if (help->helper == NULL) {
+                        pr_info("No such helper \"%s\"\n", info->helper);
+                        goto err3;
+                }
+        }
+
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+        if (info->timeout[0]) {
+                typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
+                struct nf_conn_timeout *timeout_ext;
+
+                rcu_read_lock();
+                timeout_find_get =
+                        rcu_dereference(nf_ct_timeout_find_get_hook);
+
+                if (timeout_find_get) {
+                        const struct ipt_entry *e = par->entryinfo;
+                        struct nf_conntrack_l4proto *l4proto;
+
+                        if (e->ip.invflags & IPT_INV_PROTO) {
+                                ret = -EINVAL;
+                                pr_info("You cannot use inversion on "
+                                         "L4 protocol\n");
+                                goto err4;
+                        }
+                        timeout = timeout_find_get(info->timeout);
+                        if (timeout == NULL) {
+                                ret = -ENOENT;
+                                pr_info("No such timeout policy \"%s\"\n",
+                                        info->timeout);
+                                goto err4;
+                        }
+                        if (timeout->l3num != par->family) {
+                                ret = -EINVAL;
+                                pr_info("Timeout policy `%s' can only be "
+                                        "used by L3 protocol number %d\n",
+                                        info->timeout, timeout->l3num);
+                                goto err5;
+                        }
+                        /* Make sure the timeout policy matches any existing
+                         * protocol tracker, otherwise default to generic.
+                         */
+                        l4proto = __nf_ct_l4proto_find(par->family,
+                                                       e->ip.proto);
+                        if (timeout->l4proto->l4proto != l4proto->l4proto) {
+                                ret = -EINVAL;
+                                pr_info("Timeout policy `%s' can only be "
+                                        "used by L4 protocol number %d\n",
+                                        info->timeout,
+                                        timeout->l4proto->l4proto);
+                                goto err5;
+                        }
+                        timeout_ext = nf_ct_timeout_ext_add(ct, timeout,
+                                                            GFP_ATOMIC);
+                        if (timeout_ext == NULL) {
+                                ret = -ENOMEM;
+                                goto err5;
+                        }
+                } else {
+                        ret = -ENOENT;
+                        pr_info("Timeout policy base is empty\n");
+                        goto err4;
+                }
+                rcu_read_unlock();
+        }
+#endif
+
+        __set_bit(IPS_TEMPLATE_BIT, &ct->status);
+        __set_bit(IPS_CONFIRMED_BIT, &ct->status);
+out:
+        info->ct = ct;
+        return 0;
+
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+err5:
+        __xt_ct_tg_timeout_put(timeout);
+err4:
+        rcu_read_unlock();
+#endif
+err3:
+        nf_conntrack_free(ct);
+err2:
+        nf_ct_l3proto_module_put(par->family);
+err1:
+        return ret;
+}
+
+static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
 {
         struct xt_ct_target_info *info = par->targinfo;
         struct nf_conn *ct = info->ct;
@@ -146,25 +322,69 @@ static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par)
         nf_ct_put(info->ct);
 }
 
-static struct xt_target xt_ct_tg __read_mostly = {
-        .name           = "CT",
-        .family         = NFPROTO_UNSPEC,
-        .targetsize     = sizeof(struct xt_ct_target_info),
-        .checkentry     = xt_ct_tg_check,
-        .destroy        = xt_ct_tg_destroy,
-        .target         = xt_ct_target,
-        .table          = "raw",
-        .me             = THIS_MODULE,
+static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
+{
+        struct xt_ct_target_info_v1 *info = par->targinfo;
+        struct nf_conn *ct = info->ct;
+        struct nf_conn_help *help;
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+        struct nf_conn_timeout *timeout_ext;
+        typeof(nf_ct_timeout_put_hook) timeout_put;
+#endif
+        if (!nf_ct_is_untracked(ct)) {
+                help = nfct_help(ct);
+                if (help)
+                        module_put(help->helper->me);
+
+                nf_ct_l3proto_module_put(par->family);
+
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+                rcu_read_lock();
+                timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
+
+                if (timeout_put) {
+                        timeout_ext = nf_ct_timeout_find(ct);
+                        if (timeout_ext)
+                                timeout_put(timeout_ext->timeout);
+                }
+                rcu_read_unlock();
+#endif
+        }
+        nf_ct_put(info->ct);
+}
+
+static struct xt_target xt_ct_tg_reg[] __read_mostly = {
+        {
+                .name           = "CT",
+                .family         = NFPROTO_UNSPEC,
+                .targetsize     = sizeof(struct xt_ct_target_info),
+                .checkentry     = xt_ct_tg_check_v0,
+                .destroy        = xt_ct_tg_destroy_v0,
+                .target         = xt_ct_target_v0,
+                .table          = "raw",
+                .me             = THIS_MODULE,
+        },
+        {
+                .name           = "CT",
+                .family         = NFPROTO_UNSPEC,
+                .revision       = 1,
+                .targetsize     = sizeof(struct xt_ct_target_info_v1),
+                .checkentry     = xt_ct_tg_check_v1,
+                .destroy        = xt_ct_tg_destroy_v1,
+                .target         = xt_ct_target_v1,
+                .table          = "raw",
+                .me             = THIS_MODULE,
+        },
 };
 
 static int __init xt_ct_tg_init(void)
 {
-        return xt_register_target(&xt_ct_tg);
+        return xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
 }
 
 static void __exit xt_ct_tg_exit(void)
 {
-        xt_unregister_target(&xt_ct_tg);
+        xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
 }
 
 module_init(xt_ct_tg_init);
diff --git a/net/netfilter/xt_HMARK.c b/net/netfilter/xt_HMARK.c
new file mode 100644
index 000000000000..0a96a43108ed
--- /dev/null
+++ b/net/netfilter/xt_HMARK.c
@@ -0,0 +1,362 @@
+/*
+ * xt_HMARK - Netfilter module to set mark by means of hashing
+ *
+ * (C) 2012 by Hans Schillstrom <hans.schillstrom@ericsson.com>
+ * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/icmp.h>
+
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_HMARK.h>
+
+#include <net/ip.h>
+#if IS_ENABLED(CONFIG_NF_CONNTRACK)
+#include <net/netfilter/nf_conntrack.h>
+#endif
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+#include <net/ipv6.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#endif
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Hans Schillstrom <hans.schillstrom@ericsson.com>");
+MODULE_DESCRIPTION("Xtables: packet marking using hash calculation");
+MODULE_ALIAS("ipt_HMARK");
+MODULE_ALIAS("ip6t_HMARK");
+
+struct hmark_tuple {
+        u32                     src;
+        u32                     dst;
+        union hmark_ports       uports;
+        uint8_t                 proto;
+};
+
+static inline u32 hmark_addr6_mask(const __u32 *addr32, const __u32 *mask)
+{
+        return (addr32[0] & mask[0]) ^
+               (addr32[1] & mask[1]) ^
+               (addr32[2] & mask[2]) ^
+               (addr32[3] & mask[3]);
+}
+
+static inline u32
+hmark_addr_mask(int l3num, const __u32 *addr32, const __u32 *mask)
+{
+        switch (l3num) {
+        case AF_INET:
+                return *addr32 & *mask;
+        case AF_INET6:
+                return hmark_addr6_mask(addr32, mask);
+        }
+        return 0;
+}
+
+static int
+hmark_ct_set_htuple(const struct sk_buff *skb, struct hmark_tuple *t,
+                    const struct xt_hmark_info *info)
+{
+#if IS_ENABLED(CONFIG_NF_CONNTRACK)
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
+        struct nf_conntrack_tuple *otuple;
+        struct nf_conntrack_tuple *rtuple;
+
+        if (ct == NULL || nf_ct_is_untracked(ct))
+                return -1;
+
+        otuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+        rtuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+
+        t->src = hmark_addr_mask(otuple->src.l3num, otuple->src.u3.all,
+                                 info->src_mask.all);
+        t->dst = hmark_addr_mask(otuple->src.l3num, rtuple->src.u3.all,
+                                 info->dst_mask.all);
+
+        if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))
+                return 0;
+
+        t->proto = nf_ct_protonum(ct);
+        if (t->proto != IPPROTO_ICMP) {
+                t->uports.p16.src = otuple->src.u.all;
+                t->uports.p16.dst = rtuple->src.u.all;
+                t->uports.v32 = (t->uports.v32 & info->port_mask.v32) |
+                                info->port_set.v32;
+                if (t->uports.p16.dst < t->uports.p16.src)
+                        swap(t->uports.p16.dst, t->uports.p16.src);
+        }
+
+        return 0;
+#else
+        return -1;
+#endif
+}
+
+static inline u32
+hmark_hash(struct hmark_tuple *t, const struct xt_hmark_info *info)
+{
+        u32 hash;
+
+        if (t->dst < t->src)
+                swap(t->src, t->dst);
+
+        hash = jhash_3words(t->src, t->dst, t->uports.v32, info->hashrnd);
+        hash = hash ^ (t->proto & info->proto_mask);
+
+        return (((u64)hash * info->hmodulus) >> 32) + info->hoffset;
+}
+
+static void
+hmark_set_tuple_ports(const struct sk_buff *skb, unsigned int nhoff,
+                      struct hmark_tuple *t, const struct xt_hmark_info *info)
+{
+        int protoff;
+
+        protoff = proto_ports_offset(t->proto);
+        if (protoff < 0)
+                return;
+
+        nhoff += protoff;
+        if (skb_copy_bits(skb, nhoff, &t->uports, sizeof(t->uports)) < 0)
+                return;
+
+        t->uports.v32 = (t->uports.v32 & info->port_mask.v32) |
+                        info->port_set.v32;
+
+        if (t->uports.p16.dst < t->uports.p16.src)
+                swap(t->uports.p16.dst, t->uports.p16.src);
+}
+
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+static int get_inner6_hdr(const struct sk_buff *skb, int *offset)
+{
+        struct icmp6hdr *icmp6h, _ih6;
+
+        icmp6h = skb_header_pointer(skb, *offset, sizeof(_ih6), &_ih6);
+        if (icmp6h == NULL)
+                return 0;
+
+        if (icmp6h->icmp6_type && icmp6h->icmp6_type < 128) {
+                *offset += sizeof(struct icmp6hdr);
+                return 1;
+        }
+        return 0;
+}
+
+static int
+hmark_pkt_set_htuple_ipv6(const struct sk_buff *skb, struct hmark_tuple *t,
+                          const struct xt_hmark_info *info)
+{
+        struct ipv6hdr *ip6, _ip6;
+        int flag = IP6T_FH_F_AUTH;
+        unsigned int nhoff = 0;
+        u16 fragoff = 0;
+        int nexthdr;
+
+        ip6 = (struct ipv6hdr *) (skb->data + skb_network_offset(skb));
+        nexthdr = ipv6_find_hdr(skb, &nhoff, -1, &fragoff, &flag);
+        if (nexthdr < 0)
+                return 0;
+        /* No need to check for icmp errors on fragments */
+        if ((flag & IP6T_FH_F_FRAG) || (nexthdr != IPPROTO_ICMPV6))
+                goto noicmp;
+        /* Use inner header in case of ICMP errors */
+        if (get_inner6_hdr(skb, &nhoff)) {
+                ip6 = skb_header_pointer(skb, nhoff, sizeof(_ip6), &_ip6);
+                if (ip6 == NULL)
+                        return -1;
+                /* If AH present, use SPI like in ESP. */
+                flag = IP6T_FH_F_AUTH;
+                nexthdr = ipv6_find_hdr(skb, &nhoff, -1, &fragoff, &flag);
+                if (nexthdr < 0)
+                        return -1;
+        }
+noicmp:
+        t->src = hmark_addr6_mask(ip6->saddr.s6_addr32, info->src_mask.all);
+        t->dst = hmark_addr6_mask(ip6->daddr.s6_addr32, info->dst_mask.all);
+
+        if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))
+                return 0;
+
+        t->proto = nexthdr;
+        if (t->proto == IPPROTO_ICMPV6)
+                return 0;
+
+        if (flag & IP6T_FH_F_FRAG)
+                return 0;
+
+        hmark_set_tuple_ports(skb, nhoff, t, info);
+        return 0;
+}
+
+static unsigned int
+hmark_tg_v6(struct sk_buff *skb, const struct xt_action_param *par)
+{
+        const struct xt_hmark_info *info = par->targinfo;
+        struct hmark_tuple t;
+
+        memset(&t, 0, sizeof(struct hmark_tuple));
+
+        if (info->flags & XT_HMARK_FLAG(XT_HMARK_CT)) {
+                if (hmark_ct_set_htuple(skb, &t, info) < 0)
+                        return XT_CONTINUE;
+        } else {
+                if (hmark_pkt_set_htuple_ipv6(skb, &t, info) < 0)
+                        return XT_CONTINUE;
+        }
+
+        skb->mark = hmark_hash(&t, info);
+        return XT_CONTINUE;
+}
+#endif
+
+static int get_inner_hdr(const struct sk_buff *skb, int iphsz, int *nhoff)
+{
+        const struct icmphdr *icmph;
+        struct icmphdr _ih;
+
+        /* Not enough header? */
+        icmph = skb_header_pointer(skb, *nhoff + iphsz, sizeof(_ih), &_ih);
+        if (icmph == NULL || icmph->type > NR_ICMP_TYPES)
+                return 0;
+
+        /* Error message? */
+        if (icmph->type != ICMP_DEST_UNREACH &&
+            icmph->type != ICMP_SOURCE_QUENCH &&
+            icmph->type != ICMP_TIME_EXCEEDED &&
+            icmph->type != ICMP_PARAMETERPROB &&
+            icmph->type != ICMP_REDIRECT)
+                return 0;
+
+        *nhoff += iphsz + sizeof(_ih);
+        return 1;
+}
+
+static int
+hmark_pkt_set_htuple_ipv4(const struct sk_buff *skb, struct hmark_tuple *t,
+                          const struct xt_hmark_info *info)
+{
+        struct iphdr *ip, _ip;
+        int nhoff = skb_network_offset(skb);
+
+        ip = (struct iphdr *) (skb->data + nhoff);
+        if (ip->protocol == IPPROTO_ICMP) {
+                /* Use inner header in case of ICMP errors */
+                if (get_inner_hdr(skb, ip->ihl * 4, &nhoff)) {
+                        ip = skb_header_pointer(skb, nhoff, sizeof(_ip), &_ip);
+                        if (ip == NULL)
+                                return -1;
+                }
+        }
+
+        t->src = (__force u32) ip->saddr;
+        t->dst = (__force u32) ip->daddr;
+
+        t->src &= info->src_mask.ip;
+        t->dst &= info->dst_mask.ip;
+
+        if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))
+                return 0;
+
+        t->proto = ip->protocol;
+
+        /* ICMP has no ports, skip */
+        if (t->proto == IPPROTO_ICMP)
+                return 0;
+
+        /* follow-up fragments don't contain ports, skip all fragments */
+        if (ip->frag_off & htons(IP_MF | IP_OFFSET))
+                return 0;
+
+        hmark_set_tuple_ports(skb, (ip->ihl * 4) + nhoff, t, info);
+
+        return 0;
+}
+
+static unsigned int
+hmark_tg_v4(struct sk_buff *skb, const struct xt_action_param *par)
+{
+        const struct xt_hmark_info *info = par->targinfo;
+        struct hmark_tuple t;
+
+        memset(&t, 0, sizeof(struct hmark_tuple));
+
+        if (info->flags & XT_HMARK_FLAG(XT_HMARK_CT)) {
+                if (hmark_ct_set_htuple(skb, &t, info) < 0)
+                        return XT_CONTINUE;
+        } else {
+                if (hmark_pkt_set_htuple_ipv4(skb, &t, info) < 0)
+                        return XT_CONTINUE;
+        }
+
+        skb->mark = hmark_hash(&t, info);
+        return XT_CONTINUE;
+}
+
+static int hmark_tg_check(const struct xt_tgchk_param *par)
+{
+        const struct xt_hmark_info *info = par->targinfo;
+
+        if (!info->hmodulus) {
+                pr_info("xt_HMARK: hash modulus can't be zero\n");
+                return -EINVAL;
+        }
+        if (info->proto_mask &&
+            (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))) {
+                pr_info("xt_HMARK: proto mask must be zero with L3 mode\n");
+                return -EINVAL;
+        }
+        if (info->flags & XT_HMARK_FLAG(XT_HMARK_SPI_MASK) &&
+            (info->flags & (XT_HMARK_FLAG(XT_HMARK_SPORT_MASK) |
+                             XT_HMARK_FLAG(XT_HMARK_DPORT_MASK)))) {
+                pr_info("xt_HMARK: spi-mask and port-mask can't be combined\n");
+                return -EINVAL;
+        }
+        if (info->flags & XT_HMARK_FLAG(XT_HMARK_SPI) &&
+            (info->flags & (XT_HMARK_FLAG(XT_HMARK_SPORT) |
+                             XT_HMARK_FLAG(XT_HMARK_DPORT)))) {
+                pr_info("xt_HMARK: spi-set and port-set can't be combined\n");
+                return -EINVAL;
+        }
+        return 0;
+}
+
+static struct xt_target hmark_tg_reg[] __read_mostly = {
+        {
+                .name           = "HMARK",
+                .family         = NFPROTO_IPV4,
+                .target         = hmark_tg_v4,
+                .targetsize     = sizeof(struct xt_hmark_info),
+                .checkentry     = hmark_tg_check,
+                .me             = THIS_MODULE,
+        },
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+        {
+                .name           = "HMARK",
+                .family         = NFPROTO_IPV6,
+                .target         = hmark_tg_v6,
+                .targetsize     = sizeof(struct xt_hmark_info),
+                .checkentry     = hmark_tg_check,
+                .me             = THIS_MODULE,
+        },
+#endif
+};
+
+static int __init hmark_tg_init(void)
+{
+        return xt_register_targets(hmark_tg_reg, ARRAY_SIZE(hmark_tg_reg));
+}
+
+static void __exit hmark_tg_exit(void)
+{
+        xt_unregister_targets(hmark_tg_reg, ARRAY_SIZE(hmark_tg_reg));
+}
+
+module_init(hmark_tg_init);
+module_exit(hmark_tg_exit);
diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c
new file mode 100644
index 000000000000..ff5f75fddb15
--- /dev/null
+++ b/net/netfilter/xt_LOG.c
@@ -0,0 +1,925 @@
+/*
+ * This is a module which is used for logging packets.
+ */
+
+/* (C) 1999-2001 Paul `Rusty' Russell
+ * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <linux/module.h>
+#include <linux/spinlock.h>
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+#include <linux/ip.h>
+#include <net/ipv6.h>
+#include <net/icmp.h>
+#include <net/udp.h>
+#include <net/tcp.h>
+#include <net/route.h>
+
+#include <linux/netfilter.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_LOG.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <net/netfilter/nf_log.h>
+#include <net/netfilter/xt_log.h>
+
+static struct nf_loginfo default_loginfo = {
+        .type   = NF_LOG_TYPE_LOG,
+        .u = {
+                .log = {
+                        .level    = 5,
+                        .logflags = NF_LOG_MASK,
+                },
+        },
+};
+
+static int dump_udp_header(struct sbuff *m, const struct sk_buff *skb,
+                           u8 proto, int fragment, unsigned int offset)
+{
+        struct udphdr _udph;
+        const struct udphdr *uh;
+
+        if (proto == IPPROTO_UDP)
+                /* Max length: 10 "PROTO=UDP "     */
+                sb_add(m, "PROTO=UDP ");
+        else    /* Max length: 14 "PROTO=UDPLITE " */
+                sb_add(m, "PROTO=UDPLITE ");
+
+        if (fragment)
+                goto out;
+
+        /* Max length: 25 "INCOMPLETE [65535 bytes] " */
+        uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
+        if (uh == NULL) {
+                sb_add(m, "INCOMPLETE [%u bytes] ", skb->len - offset);
+
+                return 1;
+        }
+
+        /* Max length: 20 "SPT=65535 DPT=65535 " */
+        sb_add(m, "SPT=%u DPT=%u LEN=%u ", ntohs(uh->source), ntohs(uh->dest),
+                ntohs(uh->len));
+
+out:
+        return 0;
+}
+
+static int dump_tcp_header(struct sbuff *m, const struct sk_buff *skb,
+                           u8 proto, int fragment, unsigned int offset,
+                           unsigned int logflags)
+{
+        struct tcphdr _tcph;
+        const struct tcphdr *th;
+
+        /* Max length: 10 "PROTO=TCP " */
+        sb_add(m, "PROTO=TCP ");
+
+        if (fragment)
+                return 0;
+
+        /* Max length: 25 "INCOMPLETE [65535 bytes] " */
+        th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
+        if (th == NULL) {
+                sb_add(m, "INCOMPLETE [%u bytes] ", skb->len - offset);
+                return 1;
+        }
+
+        /* Max length: 20 "SPT=65535 DPT=65535 " */
+        sb_add(m, "SPT=%u DPT=%u ", ntohs(th->source), ntohs(th->dest));
+        /* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */
+        if (logflags & XT_LOG_TCPSEQ)
+                sb_add(m, "SEQ=%u ACK=%u ", ntohl(th->seq), ntohl(th->ack_seq));
+
+        /* Max length: 13 "WINDOW=65535 " */
+        sb_add(m, "WINDOW=%u ", ntohs(th->window));
+        /* Max length: 9 "RES=0x3C " */
+        sb_add(m, "RES=0x%02x ", (u_int8_t)(ntohl(tcp_flag_word(th) &
+                                            TCP_RESERVED_BITS) >> 22));
+        /* Max length: 32 "CWR ECE URG ACK PSH RST SYN FIN " */
+        if (th->cwr)
+                sb_add(m, "CWR ");
+        if (th->ece)
+                sb_add(m, "ECE ");
+        if (th->urg)
+                sb_add(m, "URG ");
+        if (th->ack)
+                sb_add(m, "ACK ");
+        if (th->psh)
+                sb_add(m, "PSH ");
+        if (th->rst)
+                sb_add(m, "RST ");
+        if (th->syn)
+                sb_add(m, "SYN ");
+        if (th->fin)
+                sb_add(m, "FIN ");
+        /* Max length: 11 "URGP=65535 " */
+        sb_add(m, "URGP=%u ", ntohs(th->urg_ptr));
+
+        if ((logflags & XT_LOG_TCPOPT) && th->doff*4 > sizeof(struct tcphdr)) {
+                u_int8_t _opt[60 - sizeof(struct tcphdr)];
+                const u_int8_t *op;
+                unsigned int i;
+                unsigned int optsize = th->doff*4 - sizeof(struct tcphdr);
+
+                op = skb_header_pointer(skb, offset + sizeof(struct tcphdr),
+                                        optsize, _opt);
+                if (op == NULL) {
+                        sb_add(m, "OPT (TRUNCATED)");
+                        return 1;
+                }
+
+                /* Max length: 127 "OPT (" 15*4*2chars ") " */
+                sb_add(m, "OPT (");
+                for (i = 0; i < optsize; i++)
+                        sb_add(m, "%02X", op[i]);
+
+                sb_add(m, ") ");
+        }
+
+        return 0;
+}
+
+/* One level of recursion won't kill us */
+static void dump_ipv4_packet(struct sbuff *m,
+                        const struct nf_loginfo *info,
+                        const struct sk_buff *skb,
+                        unsigned int iphoff)
+{
+        struct iphdr _iph;
+        const struct iphdr *ih;
+        unsigned int logflags;
+
+        if (info->type == NF_LOG_TYPE_LOG)
+                logflags = info->u.log.logflags;
+        else
+                logflags = NF_LOG_MASK;
+
+        ih = skb_header_pointer(skb, iphoff, sizeof(_iph), &_iph);
+        if (ih == NULL) {
+                sb_add(m, "TRUNCATED");
+                return;
+        }
+
+        /* Important fields:
+         * TOS, len, DF/MF, fragment offset, TTL, src, dst, options. */
+        /* Max length: 40 "SRC=255.255.255.255 DST=255.255.255.255 " */
+        sb_add(m, "SRC=%pI4 DST=%pI4 ",
+               &ih->saddr, &ih->daddr);
+
+        /* Max length: 46 "LEN=65535 TOS=0xFF PREC=0xFF TTL=255 ID=65535 " */
+        sb_add(m, "LEN=%u TOS=0x%02X PREC=0x%02X TTL=%u ID=%u ",
+               ntohs(ih->tot_len), ih->tos & IPTOS_TOS_MASK,
+               ih->tos & IPTOS_PREC_MASK, ih->ttl, ntohs(ih->id));
+
+        /* Max length: 6 "CE DF MF " */
+        if (ntohs(ih->frag_off) & IP_CE)
+                sb_add(m, "CE ");
+        if (ntohs(ih->frag_off) & IP_DF)
+                sb_add(m, "DF ");
+        if (ntohs(ih->frag_off) & IP_MF)
+                sb_add(m, "MF ");
+
+        /* Max length: 11 "FRAG:65535 " */
+        if (ntohs(ih->frag_off) & IP_OFFSET)
+                sb_add(m, "FRAG:%u ", ntohs(ih->frag_off) & IP_OFFSET);
+
+        if ((logflags & XT_LOG_IPOPT) &&
+            ih->ihl * 4 > sizeof(struct iphdr)) {
+                const unsigned char *op;
+                unsigned char _opt[4 * 15 - sizeof(struct iphdr)];
+                unsigned int i, optsize;
+
+                optsize = ih->ihl * 4 - sizeof(struct iphdr);
+                op = skb_header_pointer(skb, iphoff+sizeof(_iph),
+                                        optsize, _opt);
+                if (op == NULL) {
+                        sb_add(m, "TRUNCATED");
+                        return;
+                }
+
+                /* Max length: 127 "OPT (" 15*4*2chars ") " */
+                sb_add(m, "OPT (");
+                for (i = 0; i < optsize; i++)
+                        sb_add(m, "%02X", op[i]);
+                sb_add(m, ") ");
+        }
+
+        switch (ih->protocol) {
+        case IPPROTO_TCP:
+                if (dump_tcp_header(m, skb, ih->protocol,
+                                    ntohs(ih->frag_off) & IP_OFFSET,
+                                    iphoff+ih->ihl*4, logflags))
+                        return;
+                break;
+        case IPPROTO_UDP:
+        case IPPROTO_UDPLITE:
+                if (dump_udp_header(m, skb, ih->protocol,
+                                    ntohs(ih->frag_off) & IP_OFFSET,
+                                    iphoff+ih->ihl*4))
+                        return;
+                break;
+        case IPPROTO_ICMP: {
+                struct icmphdr _icmph;
+                const struct icmphdr *ich;
+                static const size_t required_len[NR_ICMP_TYPES+1]
+                        = { [ICMP_ECHOREPLY] = 4,
+                            [ICMP_DEST_UNREACH]
+                            = 8 + sizeof(struct iphdr),
+                            [ICMP_SOURCE_QUENCH]
+                            = 8 + sizeof(struct iphdr),
+                            [ICMP_REDIRECT]
+                            = 8 + sizeof(struct iphdr),
+                            [ICMP_ECHO] = 4,
+                            [ICMP_TIME_EXCEEDED]
+                            = 8 + sizeof(struct iphdr),
+                            [ICMP_PARAMETERPROB]
+                            = 8 + sizeof(struct iphdr),
+                            [ICMP_TIMESTAMP] = 20,
+                            [ICMP_TIMESTAMPREPLY] = 20,
+                            [ICMP_ADDRESS] = 12,
+                            [ICMP_ADDRESSREPLY] = 12 };
+
+                /* Max length: 11 "PROTO=ICMP " */
+                sb_add(m, "PROTO=ICMP ");
+
+                if (ntohs(ih->frag_off) & IP_OFFSET)
+                        break;
+
+                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
+                ich = skb_header_pointer(skb, iphoff + ih->ihl * 4,
+                                         sizeof(_icmph), &_icmph);
+                if (ich == NULL) {
+                        sb_add(m, "INCOMPLETE [%u bytes] ",
+                               skb->len - iphoff - ih->ihl*4);
+                        break;
+                }
+
+                /* Max length: 18 "TYPE=255 CODE=255 " */
+                sb_add(m, "TYPE=%u CODE=%u ", ich->type, ich->code);
+
+                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
+                if (ich->type <= NR_ICMP_TYPES &&
+                    required_len[ich->type] &&
+                    skb->len-iphoff-ih->ihl*4 < required_len[ich->type]) {
+                        sb_add(m, "INCOMPLETE [%u bytes] ",
+                               skb->len - iphoff - ih->ihl*4);
+                        break;
+                }
+
+                switch (ich->type) {
+                case ICMP_ECHOREPLY:
+                case ICMP_ECHO:
+                        /* Max length: 19 "ID=65535 SEQ=65535 " */
+                        sb_add(m, "ID=%u SEQ=%u ",
+                               ntohs(ich->un.echo.id),
+                               ntohs(ich->un.echo.sequence));
+                        break;
+
+                case ICMP_PARAMETERPROB:
+                        /* Max length: 14 "PARAMETER=255 " */
+                        sb_add(m, "PARAMETER=%u ",
+                               ntohl(ich->un.gateway) >> 24);
+                        break;
+                case ICMP_REDIRECT:
+                        /* Max length: 24 "GATEWAY=255.255.255.255 " */
+                        sb_add(m, "GATEWAY=%pI4 ", &ich->un.gateway);
+                        /* Fall through */
+                case ICMP_DEST_UNREACH:
+                case ICMP_SOURCE_QUENCH:
+                case ICMP_TIME_EXCEEDED:
+                        /* Max length: 3+maxlen */
+                        if (!iphoff) { /* Only recurse once. */
+                                sb_add(m, "[");
+                                dump_ipv4_packet(m, info, skb,
+                                            iphoff + ih->ihl*4+sizeof(_icmph));
+                                sb_add(m, "] ");
+                        }
+
+                        /* Max length: 10 "MTU=65535 " */
+                        if (ich->type == ICMP_DEST_UNREACH &&
+                            ich->code == ICMP_FRAG_NEEDED)
+                                sb_add(m, "MTU=%u ", ntohs(ich->un.frag.mtu));
+                }
+                break;
+        }
+        /* Max Length */
+        case IPPROTO_AH: {
+                struct ip_auth_hdr _ahdr;
+                const struct ip_auth_hdr *ah;
+
+                if (ntohs(ih->frag_off) & IP_OFFSET)
+                        break;
+
+                /* Max length: 9 "PROTO=AH " */
+                sb_add(m, "PROTO=AH ");
+
+                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
+                ah = skb_header_pointer(skb, iphoff+ih->ihl*4,
+                                        sizeof(_ahdr), &_ahdr);
+                if (ah == NULL) {
+                        sb_add(m, "INCOMPLETE [%u bytes] ",
+                               skb->len - iphoff - ih->ihl*4);
+                        break;
+                }
+
+                /* Length: 15 "SPI=0xF1234567 " */
+                sb_add(m, "SPI=0x%x ", ntohl(ah->spi));
+                break;
+        }
+        case IPPROTO_ESP: {
+                struct ip_esp_hdr _esph;
+                const struct ip_esp_hdr *eh;
+
+                /* Max length: 10 "PROTO=ESP " */
+                sb_add(m, "PROTO=ESP ");
+
+                if (ntohs(ih->frag_off) & IP_OFFSET)
+                        break;
+
+                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
+                eh = skb_header_pointer(skb, iphoff+ih->ihl*4,
+                                        sizeof(_esph), &_esph);
+                if (eh == NULL) {
+                        sb_add(m, "INCOMPLETE [%u bytes] ",
+                               skb->len - iphoff - ih->ihl*4);
+                        break;
+                }
+
+                /* Length: 15 "SPI=0xF1234567 " */
+                sb_add(m, "SPI=0x%x ", ntohl(eh->spi));
+                break;
+        }
+        /* Max length: 10 "PROTO 255 " */
+        default:
+                sb_add(m, "PROTO=%u ", ih->protocol);
+        }
+
+        /* Max length: 15 "UID=4294967295 " */
+        if ((logflags & XT_LOG_UID) && !iphoff && skb->sk) {
+                read_lock_bh(&skb->sk->sk_callback_lock);
+                if (skb->sk->sk_socket && skb->sk->sk_socket->file)
+                        sb_add(m, "UID=%u GID=%u ",
+                                skb->sk->sk_socket->file->f_cred->fsuid,
+                                skb->sk->sk_socket->file->f_cred->fsgid);
+                read_unlock_bh(&skb->sk->sk_callback_lock);
+        }
+
+        /* Max length: 16 "MARK=0xFFFFFFFF " */
+        if (!iphoff && skb->mark)
+                sb_add(m, "MARK=0x%x ", skb->mark);
+
+        /* Proto    Max log string length */
+        /* IP:      40+46+6+11+127 = 230 */
+        /* TCP:     10+max(25,20+30+13+9+32+11+127) = 252 */
+        /* UDP:     10+max(25,20) = 35 */
+        /* UDPLITE: 14+max(25,20) = 39 */
+        /* ICMP:    11+max(25, 18+25+max(19,14,24+3+n+10,3+n+10)) = 91+n */
+        /* ESP:     10+max(25)+15 = 50 */
+        /* AH:      9+max(25)+15 = 49 */
+        /* unknown: 10 */
+
+        /* (ICMP allows recursion one level deep) */
+        /* maxlen =  IP + ICMP +  IP + max(TCP,UDP,ICMP,unknown) */
+        /* maxlen = 230+   91  + 230 + 252 = 803 */
+}
+
+static void dump_ipv4_mac_header(struct sbuff *m,
+                            const struct nf_loginfo *info,
+                            const struct sk_buff *skb)
+{
+        struct net_device *dev = skb->dev;
+        unsigned int logflags = 0;
+
+        if (info->type == NF_LOG_TYPE_LOG)
+                logflags = info->u.log.logflags;
+
+        if (!(logflags & XT_LOG_MACDECODE))
+                goto fallback;
+
+        switch (dev->type) {
+        case ARPHRD_ETHER:
+                sb_add(m, "MACSRC=%pM MACDST=%pM MACPROTO=%04x ",
+                       eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
+                       ntohs(eth_hdr(skb)->h_proto));
+                return;
+        default:
+                break;
+        }
+
+fallback:
+        sb_add(m, "MAC=");
+        if (dev->hard_header_len &&
+            skb->mac_header != skb->network_header) {
+                const unsigned char *p = skb_mac_header(skb);
+                unsigned int i;
+
+                sb_add(m, "%02x", *p++);
+                for (i = 1; i < dev->hard_header_len; i++, p++)
+                        sb_add(m, ":%02x", *p);
+        }
+        sb_add(m, " ");
+}
+
+static void
+log_packet_common(struct sbuff *m,
+                  u_int8_t pf,
+                  unsigned int hooknum,
+                  const struct sk_buff *skb,
+                  const struct net_device *in,
+                  const struct net_device *out,
+                  const struct nf_loginfo *loginfo,
+                  const char *prefix)
+{
+        sb_add(m, "<%d>%sIN=%s OUT=%s ", loginfo->u.log.level,
+               prefix,
+               in ? in->name : "",
+               out ? out->name : "");
+#ifdef CONFIG_BRIDGE_NETFILTER
+        if (skb->nf_bridge) {
+                const struct net_device *physindev;
+                const struct net_device *physoutdev;
+
+                physindev = skb->nf_bridge->physindev;
+                if (physindev && in != physindev)
+                        sb_add(m, "PHYSIN=%s ", physindev->name);
+                physoutdev = skb->nf_bridge->physoutdev;
+                if (physoutdev && out != physoutdev)
+                        sb_add(m, "PHYSOUT=%s ", physoutdev->name);
+        }
+#endif
+}
+
+
+static void
+ipt_log_packet(u_int8_t pf,
+               unsigned int hooknum,
+               const struct sk_buff *skb,
+               const struct net_device *in,
+               const struct net_device *out,
+               const struct nf_loginfo *loginfo,
+               const char *prefix)
+{
+        struct sbuff *m = sb_open();
+
+        if (!loginfo)
+                loginfo = &default_loginfo;
+
+        log_packet_common(m, pf, hooknum, skb, in, out, loginfo, prefix);
+
+        if (in != NULL)
+                dump_ipv4_mac_header(m, loginfo, skb);
+
+        dump_ipv4_packet(m, loginfo, skb, 0);
+
+        sb_close(m);
+}
+
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+/* One level of recursion won't kill us */
+static void dump_ipv6_packet(struct sbuff *m,
+                        const struct nf_loginfo *info,
+                        const struct sk_buff *skb, unsigned int ip6hoff,
+                        int recurse)
+{
+        u_int8_t currenthdr;
+        int fragment;
+        struct ipv6hdr _ip6h;
+        const struct ipv6hdr *ih;
+        unsigned int ptr;
+        unsigned int hdrlen = 0;
+        unsigned int logflags;
+
+        if (info->type == NF_LOG_TYPE_LOG)
+                logflags = info->u.log.logflags;
+        else
+                logflags = NF_LOG_MASK;
+
+        ih = skb_header_pointer(skb, ip6hoff, sizeof(_ip6h), &_ip6h);
+        if (ih == NULL) {
+                sb_add(m, "TRUNCATED");
+                return;
+        }
+
+        /* Max length: 88 "SRC=0000.0000.0000.0000.0000.0000.0000.0000 DST=0000.0000.0000.0000.0000.0000.0000.0000 " */
+        sb_add(m, "SRC=%pI6 DST=%pI6 ", &ih->saddr, &ih->daddr);
+
+        /* Max length: 44 "LEN=65535 TC=255 HOPLIMIT=255 FLOWLBL=FFFFF " */
+        sb_add(m, "LEN=%Zu TC=%u HOPLIMIT=%u FLOWLBL=%u ",
+               ntohs(ih->payload_len) + sizeof(struct ipv6hdr),
+               (ntohl(*(__be32 *)ih) & 0x0ff00000) >> 20,
+               ih->hop_limit,
+               (ntohl(*(__be32 *)ih) & 0x000fffff));
+
+        fragment = 0;
+        ptr = ip6hoff + sizeof(struct ipv6hdr);
+        currenthdr = ih->nexthdr;
+        while (currenthdr != NEXTHDR_NONE && ip6t_ext_hdr(currenthdr)) {
+                struct ipv6_opt_hdr _hdr;
+                const struct ipv6_opt_hdr *hp;
+
+                hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
+                if (hp == NULL) {
+                        sb_add(m, "TRUNCATED");
+                        return;
+                }
+
+                /* Max length: 48 "OPT (...) " */
+                if (logflags & XT_LOG_IPOPT)
+                        sb_add(m, "OPT ( ");
+
+                switch (currenthdr) {
+                case IPPROTO_FRAGMENT: {
+                        struct frag_hdr _fhdr;
+                        const struct frag_hdr *fh;
+
+                        sb_add(m, "FRAG:");
+                        fh = skb_header_pointer(skb, ptr, sizeof(_fhdr),
+                                                &_fhdr);
+                        if (fh == NULL) {
+                                sb_add(m, "TRUNCATED ");
+                                return;
+                        }
+
+                        /* Max length: 6 "65535 " */
+                        sb_add(m, "%u ", ntohs(fh->frag_off) & 0xFFF8);
+
+                        /* Max length: 11 "INCOMPLETE " */
+                        if (fh->frag_off & htons(0x0001))
+                                sb_add(m, "INCOMPLETE ");
+
+                        sb_add(m, "ID:%08x ", ntohl(fh->identification));
+
+                        if (ntohs(fh->frag_off) & 0xFFF8)
+                                fragment = 1;
+
+                        hdrlen = 8;
+
+                        break;
+                }
+                case IPPROTO_DSTOPTS:
+                case IPPROTO_ROUTING:
+                case IPPROTO_HOPOPTS:
+                        if (fragment) {
+                                if (logflags & XT_LOG_IPOPT)
+                                        sb_add(m, ")");
+                                return;
+                        }
+                        hdrlen = ipv6_optlen(hp);
+                        break;
+                /* Max Length */
+                case IPPROTO_AH:
+                        if (logflags & XT_LOG_IPOPT) {
+                                struct ip_auth_hdr _ahdr;
+                                const struct ip_auth_hdr *ah;
+
+                                /* Max length: 3 "AH " */
+                                sb_add(m, "AH ");
+
+                                if (fragment) {
+                                        sb_add(m, ")");
+                                        return;
+                                }
+
+                                ah = skb_header_pointer(skb, ptr, sizeof(_ahdr),
+                                                        &_ahdr);
+                                if (ah == NULL) {
+                                        /*
+                                         * Max length: 26 "INCOMPLETE [65535
+                                         *  bytes] )"
+                                         */
+                                        sb_add(m, "INCOMPLETE [%u bytes] )",
+                                               skb->len - ptr);
+                                        return;
+                                }
+
+                                /* Length: 15 "SPI=0xF1234567 */
+                                sb_add(m, "SPI=0x%x ", ntohl(ah->spi));
+
+                        }
+
+                        hdrlen = (hp->hdrlen+2)<<2;
+                        break;
+                case IPPROTO_ESP:
+                        if (logflags & XT_LOG_IPOPT) {
+                                struct ip_esp_hdr _esph;
+                                const struct ip_esp_hdr *eh;
+
+                                /* Max length: 4 "ESP " */
+                                sb_add(m, "ESP ");
+
+                                if (fragment) {
+                                        sb_add(m, ")");
+                                        return;
+                                }
+
+                                /*
+                                 * Max length: 26 "INCOMPLETE [65535 bytes] )"
+                                 */
+                                eh = skb_header_pointer(skb, ptr, sizeof(_esph),
+                                                        &_esph);
+                                if (eh == NULL) {
+                                        sb_add(m, "INCOMPLETE [%u bytes] )",
+                                               skb->len - ptr);
+                                        return;
+                                }
+
+                                /* Length: 16 "SPI=0xF1234567 )" */
+                                sb_add(m, "SPI=0x%x )", ntohl(eh->spi));
+
+                        }
+                        return;
+                default:
+                        /* Max length: 20 "Unknown Ext Hdr 255" */
+                        sb_add(m, "Unknown Ext Hdr %u", currenthdr);
+                        return;
+                }
+                if (logflags & XT_LOG_IPOPT)
+                        sb_add(m, ") ");
+
+                currenthdr = hp->nexthdr;
+                ptr += hdrlen;
+        }
+
+        switch (currenthdr) {
+        case IPPROTO_TCP:
+                if (dump_tcp_header(m, skb, currenthdr, fragment, ptr,
+                    logflags))
+                        return;
+                break;
+        case IPPROTO_UDP:
+        case IPPROTO_UDPLITE:
+                if (dump_udp_header(m, skb, currenthdr, fragment, ptr))
+                        return;
+                break;
+        case IPPROTO_ICMPV6: {
+                struct icmp6hdr _icmp6h;
+                const struct icmp6hdr *ic;
+
+                /* Max length: 13 "PROTO=ICMPv6 " */
+                sb_add(m, "PROTO=ICMPv6 ");
+
+                if (fragment)
+                        break;
+
+                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
+                ic = skb_header_pointer(skb, ptr, sizeof(_icmp6h), &_icmp6h);
+                if (ic == NULL) {
+                        sb_add(m, "INCOMPLETE [%u bytes] ", skb->len - ptr);
+                        return;
+                }
+
+                /* Max length: 18 "TYPE=255 CODE=255 " */
+                sb_add(m, "TYPE=%u CODE=%u ", ic->icmp6_type, ic->icmp6_code);
+
+                switch (ic->icmp6_type) {
+                case ICMPV6_ECHO_REQUEST:
+                case ICMPV6_ECHO_REPLY:
+                        /* Max length: 19 "ID=65535 SEQ=65535 " */
+                        sb_add(m, "ID=%u SEQ=%u ",
+                                ntohs(ic->icmp6_identifier),
+                                ntohs(ic->icmp6_sequence));
+                        break;
+                case ICMPV6_MGM_QUERY:
+                case ICMPV6_MGM_REPORT:
+                case ICMPV6_MGM_REDUCTION:
+                        break;
+
+                case ICMPV6_PARAMPROB:
+                        /* Max length: 17 "POINTER=ffffffff " */
+                        sb_add(m, "POINTER=%08x ", ntohl(ic->icmp6_pointer));
+                        /* Fall through */
+                case ICMPV6_DEST_UNREACH:
+                case ICMPV6_PKT_TOOBIG:
+                case ICMPV6_TIME_EXCEED:
+                        /* Max length: 3+maxlen */
+                        if (recurse) {
+                                sb_add(m, "[");
+                                dump_ipv6_packet(m, info, skb,
+                                            ptr + sizeof(_icmp6h), 0);
+                                sb_add(m, "] ");
+                        }
+
+                        /* Max length: 10 "MTU=65535 " */
+                        if (ic->icmp6_type == ICMPV6_PKT_TOOBIG)
+                                sb_add(m, "MTU=%u ", ntohl(ic->icmp6_mtu));
+                }
+                break;
+        }
+        /* Max length: 10 "PROTO=255 " */
+        default:
+                sb_add(m, "PROTO=%u ", currenthdr);
+        }
+
+        /* Max length: 15 "UID=4294967295 " */
+        if ((logflags & XT_LOG_UID) && recurse && skb->sk) {
+                read_lock_bh(&skb->sk->sk_callback_lock);
+                if (skb->sk->sk_socket && skb->sk->sk_socket->file)
+                        sb_add(m, "UID=%u GID=%u ",
+                                skb->sk->sk_socket->file->f_cred->fsuid,
+                                skb->sk->sk_socket->file->f_cred->fsgid);
+                read_unlock_bh(&skb->sk->sk_callback_lock);
+        }
+
+        /* Max length: 16 "MARK=0xFFFFFFFF " */
+        if (!recurse && skb->mark)
+                sb_add(m, "MARK=0x%x ", skb->mark);
+}
+
+static void dump_ipv6_mac_header(struct sbuff *m,
+                            const struct nf_loginfo *info,
+                            const struct sk_buff *skb)
+{
+        struct net_device *dev = skb->dev;
+        unsigned int logflags = 0;
+
+        if (info->type == NF_LOG_TYPE_LOG)
+                logflags = info->u.log.logflags;
+
+        if (!(logflags & XT_LOG_MACDECODE))
+                goto fallback;
+
+        switch (dev->type) {
+        case ARPHRD_ETHER:
+                sb_add(m, "MACSRC=%pM MACDST=%pM MACPROTO=%04x ",
+                       eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
+                       ntohs(eth_hdr(skb)->h_proto));
+                return;
+        default:
+                break;
+        }
+
+fallback:
+        sb_add(m, "MAC=");
+        if (dev->hard_header_len &&
+            skb->mac_header != skb->network_header) {
+                const unsigned char *p = skb_mac_header(skb);
+                unsigned int len = dev->hard_header_len;
+                unsigned int i;
+
+                if (dev->type == ARPHRD_SIT) {
+                        p -= ETH_HLEN;
+
+                        if (p < skb->head)
+                                p = NULL;
+                }
+
+                if (p != NULL) {
+                        sb_add(m, "%02x", *p++);
+                        for (i = 1; i < len; i++)
+                                sb_add(m, ":%02x", *p++);
+                }
+                sb_add(m, " ");
+
+                if (dev->type == ARPHRD_SIT) {
+                        const struct iphdr *iph =
+                                (struct iphdr *)skb_mac_header(skb);
+                        sb_add(m, "TUNNEL=%pI4->%pI4 ", &iph->saddr,
+                               &iph->daddr);
+                }
+        } else
+                sb_add(m, " ");
+}
+
+static void
+ip6t_log_packet(u_int8_t pf,
+                unsigned int hooknum,
+                const struct sk_buff *skb,
+                const struct net_device *in,
+                const struct net_device *out,
+                const struct nf_loginfo *loginfo,
+                const char *prefix)
+{
+        struct sbuff *m = sb_open();
+
+        if (!loginfo)
+                loginfo = &default_loginfo;
+
+        log_packet_common(m, pf, hooknum, skb, in, out, loginfo, prefix);
+
+        if (in != NULL)
+                dump_ipv6_mac_header(m, loginfo, skb);
+
+        dump_ipv6_packet(m, loginfo, skb, skb_network_offset(skb), 1);
+
+        sb_close(m);
+}
+#endif
+
+static unsigned int
+log_tg(struct sk_buff *skb, const struct xt_action_param *par)
+{
+        const struct xt_log_info *loginfo = par->targinfo;
+        struct nf_loginfo li;
+
+        li.type = NF_LOG_TYPE_LOG;
+        li.u.log.level = loginfo->level;
+        li.u.log.logflags = loginfo->logflags;
+
+        if (par->family == NFPROTO_IPV4)
+                ipt_log_packet(NFPROTO_IPV4, par->hooknum, skb, par->in,
+                               par->out, &li, loginfo->prefix);
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+        else if (par->family == NFPROTO_IPV6)
+                ip6t_log_packet(NFPROTO_IPV6, par->hooknum, skb, par->in,
+                                par->out, &li, loginfo->prefix);
+#endif
+        else
+                WARN_ON_ONCE(1);
+
+        return XT_CONTINUE;
+}
+
+static int log_tg_check(const struct xt_tgchk_param *par)
+{
+        const struct xt_log_info *loginfo = par->targinfo;
+
+        if (par->family != NFPROTO_IPV4 && par->family != NFPROTO_IPV6)
+                return -EINVAL;
+
+        if (loginfo->level >= 8) {
+                pr_debug("level %u >= 8\n", loginfo->level);
+                return -EINVAL;
+        }
+
+        if (loginfo->prefix[sizeof(loginfo->prefix)-1] != '\0') {
+                pr_debug("prefix is not null-terminated\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static struct xt_target log_tg_regs[] __read_mostly = {
+        {
+                .name           = "LOG",
+                .family         = NFPROTO_IPV4,
+                .target         = log_tg,
+                .targetsize     = sizeof(struct xt_log_info),
+                .checkentry     = log_tg_check,
+                .me             = THIS_MODULE,
+        },
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+        {
+                .name           = "LOG",
+                .family         = NFPROTO_IPV6,
+                .target         = log_tg,
+                .targetsize     = sizeof(struct xt_log_info),
+                .checkentry     = log_tg_check,
+                .me             = THIS_MODULE,
+        },
+#endif
+};
+
+static struct nf_logger ipt_log_logger __read_mostly = {
+        .name           = "ipt_LOG",
+        .logfn          = &ipt_log_packet,
+        .me             = THIS_MODULE,
+};
+
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+static struct nf_logger ip6t_log_logger __read_mostly = {
+        .name           = "ip6t_LOG",
+        .logfn          = &ip6t_log_packet,
+        .me             = THIS_MODULE,
+};
+#endif
+
+static int __init log_tg_init(void)
+{
+        int ret;
+
+        ret = xt_register_targets(log_tg_regs, ARRAY_SIZE(log_tg_regs));
+        if (ret < 0)
+                return ret;
+
+        nf_log_register(NFPROTO_IPV4, &ipt_log_logger);
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+        nf_log_register(NFPROTO_IPV6, &ip6t_log_logger);
+#endif
+        return 0;
+}
+
+static void __exit log_tg_exit(void)
+{
+        nf_log_unregister(&ipt_log_logger);
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+        nf_log_unregister(&ip6t_log_logger);
+#endif
+        xt_unregister_targets(log_tg_regs, ARRAY_SIZE(log_tg_regs));
+}
+
+module_init(log_tg_init);
+module_exit(log_tg_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
+MODULE_AUTHOR("Jan Rekorajski <baggins@pld.org.pl>");
+MODULE_DESCRIPTION("Xtables: IPv4/IPv6 packet logging");
+MODULE_ALIAS("ipt_LOG");
+MODULE_ALIAS("ip6t_LOG");
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index 190ad37c5cf8..71a266de5fb4 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -67,15 +67,13 @@ tcpmss_mangle_packet(struct sk_buff *skb,
 
         if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
                 if (dst_mtu(skb_dst(skb)) <= minlen) {
-                        if (net_ratelimit())
-                                pr_err("unknown or invalid path-MTU (%u)\n",
-                                       dst_mtu(skb_dst(skb)));
+                        net_err_ratelimited("unknown or invalid path-MTU (%u)\n",
+                                            dst_mtu(skb_dst(skb)));
                         return -1;
                 }
                 if (in_mtu <= minlen) {
-                        if (net_ratelimit())
-                                pr_err("unknown or invalid path-MTU (%u)\n",
-                                       in_mtu);
+                        net_err_ratelimited("unknown or invalid path-MTU (%u)\n",
+                                            in_mtu);
                         return -1;
                 }
                 newmss = min(dst_mtu(skb_dst(skb)), in_mtu) - minlen;
diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
index 4d5057902839..ee2e5bc5a8c7 100644
--- a/net/netfilter/xt_TEE.c
+++ b/net/netfilter/xt_TEE.c
@@ -87,7 +87,7 @@ tee_tg4(struct sk_buff *skb, const struct xt_action_param *par)
         const struct xt_tee_tginfo *info = par->targinfo;
         struct iphdr *iph;
 
-        if (percpu_read(tee_active))
+        if (__this_cpu_read(tee_active))
                 return XT_CONTINUE;
         /*
          * Copy the skb, and route the copy. Will later return %XT_CONTINUE for
@@ -124,9 +124,9 @@ tee_tg4(struct sk_buff *skb, const struct xt_action_param *par)
         ip_send_check(iph);
 
         if (tee_tg_route4(skb, info)) {
-                percpu_write(tee_active, true);
+                __this_cpu_write(tee_active, true);
                 ip_local_out(skb);
-                percpu_write(tee_active, false);
+                __this_cpu_write(tee_active, false);
         } else {
                 kfree_skb(skb);
         }
@@ -168,7 +168,7 @@ tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 {
         const struct xt_tee_tginfo *info = par->targinfo;
 
-        if (percpu_read(tee_active))
+        if (__this_cpu_read(tee_active))
                 return XT_CONTINUE;
         skb = pskb_copy(skb, GFP_ATOMIC);
         if (skb == NULL)
@@ -186,9 +186,9 @@ tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)
                 --iph->hop_limit;
         }
         if (tee_tg_route6(skb, info)) {
-                percpu_write(tee_active, true);
+                __this_cpu_write(tee_active, true);
                 ip6_local_out(skb);
-                percpu_write(tee_active, false);
+                __this_cpu_write(tee_active, false);
         } else {
                 kfree_skb(skb);
         }
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index 35a959a096e0..146033a86de8 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -282,10 +282,10 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)
         struct sock *sk;
         const struct in6_addr *laddr;
         __be16 lport;
-        int thoff;
+        int thoff = 0;
         int tproto;
 
-        tproto = ipv6_find_hdr(skb, &thoff, -1, NULL);
+        tproto = ipv6_find_hdr(skb, &thoff, -1, NULL, NULL);
         if (tproto < 0) {
                 pr_debug("unable to find transport header in IPv6 packet, dropping\n");
                 return NF_DROP;
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index d95f9c963cde..26a668a84aa2 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -171,8 +171,7 @@ dsthash_alloc_init(struct xt_hashlimit_htable *ht,
 
         if (ht->cfg.max && ht->count >= ht->cfg.max) {
                 /* FIXME: do something. question is what.. */
-                if (net_ratelimit())
-                        pr_err("max count of %u reached\n", ht->cfg.max);
+                net_err_ratelimited("max count of %u reached\n", ht->cfg.max);
                 ent = NULL;
         } else
                 ent = kmem_cache_alloc(hashlimit_cachep, GFP_ATOMIC);
@@ -388,9 +387,20 @@ static void htable_put(struct xt_hashlimit_htable *hinfo)
 
 #define CREDITS_PER_JIFFY POW2_BELOW32(MAX_CPJ)
 
+/* in byte mode, the lowest possible rate is one packet/second.
+ * credit_cap is used as a counter that tells us how many times we can
+ * refill the "credits available" counter when it becomes empty.
+ */
+#define MAX_CPJ_BYTES (0xFFFFFFFF / HZ)
+#define CREDITS_PER_JIFFY_BYTES POW2_BELOW32(MAX_CPJ_BYTES)
+
+static u32 xt_hashlimit_len_to_chunks(u32 len)
+{
+        return (len >> XT_HASHLIMIT_BYTE_SHIFT) + 1;
+}
+
 /* Precision saver. */
-static inline u_int32_t
-user2credits(u_int32_t user)
+static u32 user2credits(u32 user)
 {
         /* If multiplying would overflow... */
         if (user > 0xFFFFFFFF / (HZ*CREDITS_PER_JIFFY))
@@ -400,12 +410,53 @@ user2credits(u_int32_t user)
         return (user * HZ * CREDITS_PER_JIFFY) / XT_HASHLIMIT_SCALE;
 }
 
-static inline void rateinfo_recalc(struct dsthash_ent *dh, unsigned long now)
+static u32 user2credits_byte(u32 user)
 {
-        dh->rateinfo.credit += (now - dh->rateinfo.prev) * CREDITS_PER_JIFFY;
-        if (dh->rateinfo.credit > dh->rateinfo.credit_cap)
-                dh->rateinfo.credit = dh->rateinfo.credit_cap;
+        u64 us = user;
+        us *= HZ * CREDITS_PER_JIFFY_BYTES;
+        return (u32) (us >> 32);
+}
+
+static void rateinfo_recalc(struct dsthash_ent *dh, unsigned long now, u32 mode)
+{
+        unsigned long delta = now - dh->rateinfo.prev;
+        u32 cap;
+
+        if (delta == 0)
+                return;
+
         dh->rateinfo.prev = now;
+
+        if (mode & XT_HASHLIMIT_BYTES) {
+                u32 tmp = dh->rateinfo.credit;
+                dh->rateinfo.credit += CREDITS_PER_JIFFY_BYTES * delta;
+                cap = CREDITS_PER_JIFFY_BYTES * HZ;
+                if (tmp >= dh->rateinfo.credit) {/* overflow */
+                        dh->rateinfo.credit = cap;
+                        return;
+                }
+        } else {
+                dh->rateinfo.credit += delta * CREDITS_PER_JIFFY;
+                cap = dh->rateinfo.credit_cap;
+        }
+        if (dh->rateinfo.credit > cap)
+                dh->rateinfo.credit = cap;
+}
+
+static void rateinfo_init(struct dsthash_ent *dh,
+                          struct xt_hashlimit_htable *hinfo)
+{
+        dh->rateinfo.prev = jiffies;
+        if (hinfo->cfg.mode & XT_HASHLIMIT_BYTES) {
+                dh->rateinfo.credit = CREDITS_PER_JIFFY_BYTES * HZ;
+                dh->rateinfo.cost = user2credits_byte(hinfo->cfg.avg);
+                dh->rateinfo.credit_cap = hinfo->cfg.burst;
+        } else {
+                dh->rateinfo.credit = user2credits(hinfo->cfg.avg *
+                                                   hinfo->cfg.burst);
+                dh->rateinfo.cost = user2credits(hinfo->cfg.avg);
+                dh->rateinfo.credit_cap = dh->rateinfo.credit;
+        }
 }
 
 static inline __be32 maskl(__be32 a, unsigned int l)
@@ -511,6 +562,21 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
         return 0;
 }
 
+static u32 hashlimit_byte_cost(unsigned int len, struct dsthash_ent *dh)
+{
+        u64 tmp = xt_hashlimit_len_to_chunks(len);
+        tmp = tmp * dh->rateinfo.cost;
+
+        if (unlikely(tmp > CREDITS_PER_JIFFY_BYTES * HZ))
+                tmp = CREDITS_PER_JIFFY_BYTES * HZ;
+
+        if (dh->rateinfo.credit < tmp && dh->rateinfo.credit_cap) {
+                dh->rateinfo.credit_cap--;
+                dh->rateinfo.credit = CREDITS_PER_JIFFY_BYTES * HZ;
+        }
+        return (u32) tmp;
+}
+
 static bool
 hashlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
 {
@@ -519,6 +585,7 @@ hashlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
         unsigned long now = jiffies;
         struct dsthash_ent *dh;
         struct dsthash_dst dst;
+        u32 cost;
 
         if (hashlimit_init_dst(hinfo, &dst, skb, par->thoff) < 0)
                 goto hotdrop;
@@ -532,21 +599,21 @@ hashlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
                         goto hotdrop;
                 }
                 dh->expires = jiffies + msecs_to_jiffies(hinfo->cfg.expire);
-                dh->rateinfo.prev = jiffies;
-                dh->rateinfo.credit = user2credits(hinfo->cfg.avg *
-                                      hinfo->cfg.burst);
-                dh->rateinfo.credit_cap = user2credits(hinfo->cfg.avg *
-                                          hinfo->cfg.burst);
-                dh->rateinfo.cost = user2credits(hinfo->cfg.avg);
+                rateinfo_init(dh, hinfo);
         } else {
                 /* update expiration timeout */
                 dh->expires = now + msecs_to_jiffies(hinfo->cfg.expire);
-                rateinfo_recalc(dh, now);
+                rateinfo_recalc(dh, now, hinfo->cfg.mode);
         }
 
-        if (dh->rateinfo.credit >= dh->rateinfo.cost) {
+        if (info->cfg.mode & XT_HASHLIMIT_BYTES)
+                cost = hashlimit_byte_cost(skb->len, dh);
+        else
+                cost = dh->rateinfo.cost;
+
+        if (dh->rateinfo.credit >= cost) {
                 /* below the limit */
-                dh->rateinfo.credit -= dh->rateinfo.cost;
+                dh->rateinfo.credit -= cost;
                 spin_unlock(&dh->lock);
                 rcu_read_unlock_bh();
                 return !(info->cfg.mode & XT_HASHLIMIT_INVERT);
@@ -568,14 +635,6 @@ static int hashlimit_mt_check(const struct xt_mtchk_param *par)
         struct xt_hashlimit_mtinfo1 *info = par->matchinfo;
         int ret;
 
-        /* Check for overflow. */
-        if (info->cfg.burst == 0 ||
-            user2credits(info->cfg.avg * info->cfg.burst) <
-            user2credits(info->cfg.avg)) {
-                pr_info("overflow, try lower: %u/%u\n",
-                        info->cfg.avg, info->cfg.burst);
-                return -ERANGE;
-        }
         if (info->cfg.gc_interval == 0 || info->cfg.expire == 0)
                 return -EINVAL;
         if (info->name[sizeof(info->name)-1] != '\0')
@@ -588,6 +647,26 @@ static int hashlimit_mt_check(const struct xt_mtchk_param *par)
                         return -EINVAL;
         }
 
+        if (info->cfg.mode & ~XT_HASHLIMIT_ALL) {
+                pr_info("Unknown mode mask %X, kernel too old?\n",
+                                                info->cfg.mode);
+                return -EINVAL;
+        }
+
+        /* Check for overflow. */
+        if (info->cfg.mode & XT_HASHLIMIT_BYTES) {
+                if (user2credits_byte(info->cfg.avg) == 0) {
+                        pr_info("overflow, rate too high: %u\n", info->cfg.avg);
+                        return -EINVAL;
+                }
+        } else if (info->cfg.burst == 0 ||
+                    user2credits(info->cfg.avg * info->cfg.burst) <
+                    user2credits(info->cfg.avg)) {
+                        pr_info("overflow, try lower: %u/%u\n",
+                                info->cfg.avg, info->cfg.burst);
+                        return -ERANGE;
+        }
+
         mutex_lock(&hashlimit_mutex);
         info->hinfo = htable_find_get(net, info->name, par->family);
         if (info->hinfo == NULL) {
@@ -680,10 +759,11 @@ static int dl_seq_real_show(struct dsthash_ent *ent, u_int8_t family,
                                    struct seq_file *s)
 {
         int res;
+        const struct xt_hashlimit_htable *ht = s->private;
 
         spin_lock(&ent->lock);
         /* recalculate to show accurate numbers */
-        rateinfo_recalc(ent, jiffies);
+        rateinfo_recalc(ent, jiffies, ht->cfg.mode);
 
         switch (family) {
         case NFPROTO_IPV4:
diff --git a/net/netfilter/xt_limit.c b/net/netfilter/xt_limit.c
index 32b7a579a032..5c22ce8ab309 100644
--- a/net/netfilter/xt_limit.c
+++ b/net/netfilter/xt_limit.c
@@ -88,8 +88,7 @@ limit_mt(const struct sk_buff *skb, struct xt_action_param *par)
 }
 
 /* Precision saver. */
-static u_int32_t
-user2credits(u_int32_t user)
+static u32 user2credits(u32 user)
 {
         /* If multiplying would overflow... */
         if (user > 0xFFFFFFFF / (HZ*CREDITS_PER_JIFFY))
@@ -123,7 +122,7 @@ static int limit_mt_check(const struct xt_mtchk_param *par)
                    128. */
                 priv->prev = jiffies;
                 priv->credit = user2credits(r->avg * r->burst); /* Credits full. */
-                r->credit_cap = user2credits(r->avg * r->burst); /* Credits full. */
+                r->credit_cap = priv->credit; /* Credits full. */
                 r->cost = user2credits(r->avg);
         }
         return 0;
diff --git a/net/netfilter/xt_mac.c b/net/netfilter/xt_mac.c
index 8160f6b1435d..d5b4fd4f91ed 100644
--- a/net/netfilter/xt_mac.c
+++ b/net/netfilter/xt_mac.c
@@ -36,7 +36,7 @@ static bool mac_mt(const struct sk_buff *skb, struct xt_action_param *par)
                 return false;
         if (skb_mac_header(skb) + ETH_HLEN > skb->data)
                 return false;
-        ret  = compare_ether_addr(eth_hdr(skb)->h_source, info->srcaddr) == 0;
+        ret  = ether_addr_equal(eth_hdr(skb)->h_source, info->srcaddr);
         ret ^= info->invert;
         return ret;
 }
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index d2ff15a2412b..fc0d6dbe5d17 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -314,7 +314,7 @@ static int recent_mt_check(const struct xt_mtchk_param *par)
 #ifdef CONFIG_PROC_FS
         struct proc_dir_entry *pde;
 #endif
-        unsigned i;
+        unsigned int i;
         int ret = -EINVAL;
 
         if (unlikely(!hash_rnd_inited)) {
diff --git a/net/netfilter/xt_set.c b/net/netfilter/xt_set.c
index 0ec8138aa470..035960ec5cb9 100644
--- a/net/netfilter/xt_set.c
+++ b/net/netfilter/xt_set.c
@@ -44,6 +44,14 @@ const struct ip_set_adt_opt n = {	\
         .cmdflags = cfs,                \
         .timeout = t,                   \
 }
+#define ADT_MOPT(n, f, d, fs, cfs, t)   \
+struct ip_set_adt_opt n = {             \
+        .family = f,                    \
+        .dim = d,                       \
+        .flags = fs,                    \
+        .cmdflags = cfs,                \
+        .timeout = t,                   \
+}
 
 /* Revision 0 interface: backward compatible with netfilter/iptables */
 
@@ -296,11 +304,14 @@ static unsigned int
 set_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
 {
         const struct xt_set_info_target_v2 *info = par->targinfo;
-        ADT_OPT(add_opt, par->family, info->add_set.dim,
-                info->add_set.flags, info->flags, info->timeout);
+        ADT_MOPT(add_opt, par->family, info->add_set.dim,
+                 info->add_set.flags, info->flags, info->timeout);
         ADT_OPT(del_opt, par->family, info->del_set.dim,
                 info->del_set.flags, 0, UINT_MAX);
 
+        /* Normalize to fit into jiffies */
+        if (add_opt.timeout > UINT_MAX/MSEC_PER_SEC)
+                add_opt.timeout = UINT_MAX/MSEC_PER_SEC;
         if (info->add_set.index != IPSET_INVALID_ID)
                 ip_set_add(info->add_set.index, skb, par, &add_opt);
         if (info->del_set.index != IPSET_INVALID_ID)
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 72bb07f57f97..9ea482d08cf7 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -263,10 +263,10 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
         struct sock *sk;
         struct in6_addr *daddr, *saddr;
         __be16 dport, sport;
-        int thoff, tproto;
+        int thoff = 0, tproto;
         const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
 
-        tproto = ipv6_find_hdr(skb, &thoff, -1, NULL);
+        tproto = ipv6_find_hdr(skb, &thoff, -1, NULL, NULL);
         if (tproto < 0) {
                 pr_debug("unable to find transport header in IPv6 packet, dropping\n");
                 return NF_DROP;
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 2560e7b441c6..7c94aedd0912 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -597,7 +597,7 @@ int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap,
                         iter = iter->next;
                         iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE;
                 }
-                ret_val = netlbl_secattr_catmap_setbit(iter, spot, GFP_ATOMIC);
+                ret_val = netlbl_secattr_catmap_setbit(iter, spot, flags);
         }
 
         return ret_val;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 629b06182f3f..b3025a603d56 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -104,27 +104,27 @@ static inline int netlink_is_kernel(struct sock *sk)
 }
 
 struct nl_pid_hash {
-        struct hlist_head *table;
-        unsigned long rehash_time;
+        struct hlist_head       *table;
+        unsigned long           rehash_time;
 
-        unsigned int mask;
-        unsigned int shift;
+        unsigned int            mask;
+        unsigned int            shift;
 
-        unsigned int entries;
-        unsigned int max_shift;
+        unsigned int            entries;
+        unsigned int            max_shift;
 
-        u32 rnd;
+        u32                     rnd;
 };
 
 struct netlink_table {
-        struct nl_pid_hash hash;
-        struct hlist_head mc_list;
-        struct listeners __rcu *listeners;
-        unsigned int nl_nonroot;
-        unsigned int groups;
-        struct mutex *cb_mutex;
-        struct module *module;
-        int registered;
+        struct nl_pid_hash      hash;
+        struct hlist_head       mc_list;
+        struct listeners __rcu  *listeners;
+        unsigned int            nl_nonroot;
+        unsigned int            groups;
+        struct mutex            *cb_mutex;
+        struct module           *module;
+        int                     registered;
 };
 
 static struct netlink_table *nl_table;
@@ -132,7 +132,6 @@ static struct netlink_table *nl_table;
 static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait);
 
 static int netlink_dump(struct sock *sk);
-static void netlink_destroy_callback(struct netlink_callback *cb);
 
 static DEFINE_RWLOCK(nl_table_lock);
 static atomic_t nl_table_users = ATOMIC_INIT(0);
@@ -149,6 +148,18 @@ static inline struct hlist_head *nl_pid_hashfn(struct nl_pid_hash *hash, u32 pid
         return &hash->table[jhash_1word(pid, hash->rnd) & hash->mask];
 }
 
+static void netlink_destroy_callback(struct netlink_callback *cb)
+{
+        kfree_skb(cb->skb);
+        kfree(cb);
+}
+
+static void netlink_consume_callback(struct netlink_callback *cb)
+{
+        consume_skb(cb->skb);
+        kfree(cb);
+}
+
 static void netlink_sock_destruct(struct sock *sk)
 {
         struct netlink_sock *nlk = nlk_sk(sk);
@@ -414,9 +425,9 @@ static int __netlink_create(struct net *net, struct socket *sock,
         sock_init_data(sock, sk);
 
         nlk = nlk_sk(sk);
-        if (cb_mutex)
+        if (cb_mutex) {
                 nlk->cb_mutex = cb_mutex;
-        else {
+        } else {
                 nlk->cb_mutex = &nlk->cb_def_mutex;
                 mutex_init(nlk->cb_mutex);
         }
@@ -522,8 +533,9 @@ static int netlink_release(struct socket *sock)
                         nl_table[sk->sk_protocol].module = NULL;
                         nl_table[sk->sk_protocol].registered = 0;
                 }
-        } else if (nlk->subscriptions)
+        } else if (nlk->subscriptions) {
                 netlink_update_listeners(sk);
+        }
         netlink_table_ungrab();
 
         kfree(nlk->groups);
@@ -829,12 +841,19 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
         return 0;
 }
 
-int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
+static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
 {
         int len = skb->len;
 
         skb_queue_tail(&sk->sk_receive_queue, skb);
         sk->sk_data_ready(sk, len);
+        return len;
+}
+
+int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
+{
+        int len = __netlink_sendskb(sk, skb);
+
         sock_put(sk);
         return len;
 }
@@ -859,7 +878,7 @@ static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation)
                 struct sk_buff *nskb = skb_clone(skb, allocation);
                 if (!nskb)
                         return skb;
-                kfree_skb(skb);
+                consume_skb(skb);
                 skb = nskb;
         }
 
@@ -889,8 +908,10 @@ static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb)
                 ret = skb->len;
                 skb_set_owner_r(skb, sk);
                 nlk->netlink_rcv(skb);
+                consume_skb(skb);
+        } else {
+                kfree_skb(skb);
         }
-        kfree_skb(skb);
         sock_put(sk);
         return ret;
 }
@@ -957,8 +978,7 @@ static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb)
         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
             !test_bit(0, &nlk->state)) {
                 skb_set_owner_r(skb, sk);
-                skb_queue_tail(&sk->sk_receive_queue, skb);
-                sk->sk_data_ready(sk, skb->len);
+                __netlink_sendskb(sk, skb);
                 return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1);
         }
         return -1;
@@ -1080,8 +1100,8 @@ int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 pid,
         if (info.delivery_failure) {
                 kfree_skb(info.skb2);
                 return -ENOBUFS;
-        } else
-                consume_skb(info.skb2);
+        }
+        consume_skb(info.skb2);
 
         if (info.delivered) {
                 if (info.congested && (allocation & __GFP_WAIT))
@@ -1234,8 +1254,9 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
                         nlk->flags |= NETLINK_RECV_NO_ENOBUFS;
                         clear_bit(0, &nlk->state);
                         wake_up_interruptible(&nlk->wait);
-                } else
+                } else {
                         nlk->flags &= ~NETLINK_RECV_NO_ENOBUFS;
+                }
                 err = 0;
                 break;
         default:
@@ -1639,11 +1660,23 @@ void netlink_set_nonroot(int protocol, unsigned int flags)
 }
 EXPORT_SYMBOL(netlink_set_nonroot);
 
-static void netlink_destroy_callback(struct netlink_callback *cb)
+struct nlmsghdr *
+__nlmsg_put(struct sk_buff *skb, u32 pid, u32 seq, int type, int len, int flags)
 {
-        kfree_skb(cb->skb);
-        kfree(cb);
+        struct nlmsghdr *nlh;
+        int size = NLMSG_LENGTH(len);
+
+        nlh = (struct nlmsghdr*)skb_put(skb, NLMSG_ALIGN(size));
+        nlh->nlmsg_type = type;
+        nlh->nlmsg_len = size;
+        nlh->nlmsg_flags = flags;
+        nlh->nlmsg_pid = pid;
+        nlh->nlmsg_seq = seq;
+        if (!__builtin_constant_p(size) || NLMSG_ALIGN(size) - size != 0)
+                memset(NLMSG_DATA(nlh) + len, 0, NLMSG_ALIGN(size) - size);
+        return nlh;
 }
+EXPORT_SYMBOL(__nlmsg_put);
 
 /*
  * It looks a bit ugly.
@@ -1680,10 +1713,8 @@ static int netlink_dump(struct sock *sk)
 
                 if (sk_filter(sk, skb))
                         kfree_skb(skb);
-                else {
-                        skb_queue_tail(&sk->sk_receive_queue, skb);
-                        sk->sk_data_ready(sk, skb->len);
-                }
+                else
+                        __netlink_sendskb(sk, skb);
                 return 0;
         }
 
@@ -1697,17 +1728,15 @@ static int netlink_dump(struct sock *sk)
 
         if (sk_filter(sk, skb))
                 kfree_skb(skb);
-        else {
-                skb_queue_tail(&sk->sk_receive_queue, skb);
-                sk->sk_data_ready(sk, skb->len);
-        }
+        else
+                __netlink_sendskb(sk, skb);
 
         if (cb->done)
                 cb->done(cb);
         nlk->cb = NULL;
         mutex_unlock(nlk->cb_mutex);
 
-        netlink_destroy_callback(cb);
+        netlink_consume_callback(cb);
         return 0;
 
 errout_skb:
@@ -1718,10 +1747,7 @@ errout_skb:
 
 int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
                        const struct nlmsghdr *nlh,
-                       int (*dump)(struct sk_buff *skb,
-                                   struct netlink_callback *),
-                       int (*done)(struct netlink_callback *),
-                       u16 min_dump_alloc)
+                       struct netlink_dump_control *control)
 {
         struct netlink_callback *cb;
         struct sock *sk;
@@ -1732,10 +1758,11 @@ int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
         if (cb == NULL)
                 return -ENOBUFS;
 
-        cb->dump = dump;
-        cb->done = done;
+        cb->dump = control->dump;
+        cb->done = control->done;
         cb->nlh = nlh;
-        cb->min_dump_alloc = min_dump_alloc;
+        cb->data = control->data;
+        cb->min_dump_alloc = control->min_dump_alloc;
         atomic_inc(&skb->users);
         cb->skb = skb;
 
@@ -1978,11 +2005,11 @@ static void netlink_seq_stop(struct seq_file *seq, void *v)
 
 static int netlink_seq_show(struct seq_file *seq, void *v)
 {
-        if (v == SEQ_START_TOKEN)
+        if (v == SEQ_START_TOKEN) {
                 seq_puts(seq,
                          "sk       Eth Pid    Groups   "
                          "Rmem     Wmem     Dump     Locks     Drops     Inode\n");
-        else {
+        } else {
                 struct sock *s = v;
                 struct netlink_sock *nlk = nlk_sk(s);
 
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index c29d2568c9e0..2cc7c1ee7690 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -498,6 +498,37 @@ int genl_unregister_family(struct genl_family *family)
 }
 EXPORT_SYMBOL(genl_unregister_family);
 
+/**
+ * genlmsg_put - Add generic netlink header to netlink message
+ * @skb: socket buffer holding the message
+ * @pid: netlink pid the message is addressed to
+ * @seq: sequence number (usually the one of the sender)
+ * @family: generic netlink family
+ * @flags netlink message flags
+ * @cmd: generic netlink command
+ *
+ * Returns pointer to user specific header
+ */
+void *genlmsg_put(struct sk_buff *skb, u32 pid, u32 seq,
+                                struct genl_family *family, int flags, u8 cmd)
+{
+        struct nlmsghdr *nlh;
+        struct genlmsghdr *hdr;
+
+        nlh = nlmsg_put(skb, pid, seq, family->id, GENL_HDRLEN +
+                        family->hdrsize, flags);
+        if (nlh == NULL)
+                return NULL;
+
+        hdr = nlmsg_data(nlh);
+        hdr->cmd = cmd;
+        hdr->version = family->version;
+        hdr->reserved = 0;
+
+        return (char *) hdr + GENL_HDRLEN;
+}
+EXPORT_SYMBOL(genlmsg_put);
+
 static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         struct genl_ops *ops;
@@ -532,8 +563,13 @@ static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                         return -EOPNOTSUPP;
 
                 genl_unlock();
-                err = netlink_dump_start(net->genl_sock, skb, nlh,
-                                         ops->dumpit, ops->done, 0);
+                {
+                        struct netlink_dump_control c = {
+                                .dump = ops->dumpit,
+                                .done = ops->done,
+                        };
+                        err = netlink_dump_start(net->genl_sock, skb, nlh, &c);
+                }
                 genl_lock();
                 return err;
         }
@@ -599,11 +635,12 @@ static int ctrl_fill_info(struct genl_family *family, u32 pid, u32 seq,
         if (hdr == NULL)
                 return -1;
 
-        NLA_PUT_STRING(skb, CTRL_ATTR_FAMILY_NAME, family->name);
-        NLA_PUT_U16(skb, CTRL_ATTR_FAMILY_ID, family->id);
-        NLA_PUT_U32(skb, CTRL_ATTR_VERSION, family->version);
-        NLA_PUT_U32(skb, CTRL_ATTR_HDRSIZE, family->hdrsize);
-        NLA_PUT_U32(skb, CTRL_ATTR_MAXATTR, family->maxattr);
+        if (nla_put_string(skb, CTRL_ATTR_FAMILY_NAME, family->name) ||
+            nla_put_u16(skb, CTRL_ATTR_FAMILY_ID, family->id) ||
+            nla_put_u32(skb, CTRL_ATTR_VERSION, family->version) ||
+            nla_put_u32(skb, CTRL_ATTR_HDRSIZE, family->hdrsize) ||
+            nla_put_u32(skb, CTRL_ATTR_MAXATTR, family->maxattr))
+                goto nla_put_failure;
 
         if (!list_empty(&family->ops_list)) {
                 struct nlattr *nla_ops;
@@ -621,8 +658,9 @@ static int ctrl_fill_info(struct genl_family *family, u32 pid, u32 seq,
                         if (nest == NULL)
                                 goto nla_put_failure;
 
-                        NLA_PUT_U32(skb, CTRL_ATTR_OP_ID, ops->cmd);
-                        NLA_PUT_U32(skb, CTRL_ATTR_OP_FLAGS, ops->flags);
+                        if (nla_put_u32(skb, CTRL_ATTR_OP_ID, ops->cmd) ||
+                            nla_put_u32(skb, CTRL_ATTR_OP_FLAGS, ops->flags))
+                                goto nla_put_failure;
 
                         nla_nest_end(skb, nest);
                 }
@@ -646,9 +684,10 @@ static int ctrl_fill_info(struct genl_family *family, u32 pid, u32 seq,
                         if (nest == NULL)
                                 goto nla_put_failure;
 
-                        NLA_PUT_U32(skb, CTRL_ATTR_MCAST_GRP_ID, grp->id);
-                        NLA_PUT_STRING(skb, CTRL_ATTR_MCAST_GRP_NAME,
-                                       grp->name);
+                        if (nla_put_u32(skb, CTRL_ATTR_MCAST_GRP_ID, grp->id) ||
+                            nla_put_string(skb, CTRL_ATTR_MCAST_GRP_NAME,
+                                           grp->name))
+                                goto nla_put_failure;
 
                         nla_nest_end(skb, nest);
                 }
@@ -674,8 +713,9 @@ static int ctrl_fill_mcgrp_info(struct genl_multicast_group *grp, u32 pid,
         if (hdr == NULL)
                 return -1;
 
-        NLA_PUT_STRING(skb, CTRL_ATTR_FAMILY_NAME, grp->family->name);
-        NLA_PUT_U16(skb, CTRL_ATTR_FAMILY_ID, grp->family->id);
+        if (nla_put_string(skb, CTRL_ATTR_FAMILY_NAME, grp->family->name) ||
+            nla_put_u16(skb, CTRL_ATTR_FAMILY_ID, grp->family->id))
+                goto nla_put_failure;
 
         nla_grps = nla_nest_start(skb, CTRL_ATTR_MCAST_GROUPS);
         if (nla_grps == NULL)
@@ -685,9 +725,10 @@ static int ctrl_fill_mcgrp_info(struct genl_multicast_group *grp, u32 pid,
         if (nest == NULL)
                 goto nla_put_failure;
 
-        NLA_PUT_U32(skb, CTRL_ATTR_MCAST_GRP_ID, grp->id);
-        NLA_PUT_STRING(skb, CTRL_ATTR_MCAST_GRP_NAME,
-                       grp->name);
+        if (nla_put_u32(skb, CTRL_ATTR_MCAST_GRP_ID, grp->id) ||
+            nla_put_string(skb, CTRL_ATTR_MCAST_GRP_NAME,
+                           grp->name))
+                goto nla_put_failure;
 
         nla_nest_end(skb, nest);
         nla_nest_end(skb, nla_grps);
@@ -795,7 +836,7 @@ static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
 #ifdef CONFIG_MODULES
                 if (res == NULL) {
                         genl_unlock();
-                        request_module("net-pf-%d-proto-%d-type-%s",
+                        request_module("net-pf-%d-proto-%d-family-%s",
                                        PF_NETLINK, NETLINK_GENERIC, name);
                         genl_lock();
                         res = genl_family_find_byname(name);
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 7dab229bfbcc..06592d8b4a2b 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -31,7 +31,6 @@
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/termios.h>      /* For TIOCINQ/OUTQ */
 #include <linux/mm.h>
diff --git a/net/netrom/nr_dev.c b/net/netrom/nr_dev.c
index 64e6dde9749d..743262becd6e 100644
--- a/net/netrom/nr_dev.c
+++ b/net/netrom/nr_dev.c
@@ -21,7 +21,6 @@
 #include <linux/if_ether.h>     /* For the statistics structure. */
 #include <linux/slab.h>
 
-#include <asm/system.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
 
@@ -98,7 +97,7 @@ static int nr_rebuild_header(struct sk_buff *skb)
 
 static int nr_header(struct sk_buff *skb, struct net_device *dev,
                      unsigned short type,
-                     const void *daddr, const void *saddr, unsigned len)
+                     const void *daddr, const void *saddr, unsigned int len)
 {
         unsigned char *buff = skb_push(skb, NR_NETWORK_LEN + NR_TRANSPORT_LEN);
 
diff --git a/net/netrom/nr_in.c b/net/netrom/nr_in.c
index 6d4ef6d65b3d..c3073a2ef634 100644
--- a/net/netrom/nr_in.c
+++ b/net/netrom/nr_in.c
@@ -24,7 +24,6 @@
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/netrom/nr_out.c b/net/netrom/nr_out.c
index 607fddb4fdbb..0b4bcb2bf38f 100644
--- a/net/netrom/nr_out.c
+++ b/net/netrom/nr_out.c
@@ -23,7 +23,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index 2cf330162d7e..70ffff76a967 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -26,7 +26,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/termios.h>      /* For TIOCINQ/OUTQ */
 #include <linux/mm.h>
diff --git a/net/netrom/nr_subr.c b/net/netrom/nr_subr.c
index 6a947ae50dbd..ca40e2298f5a 100644
--- a/net/netrom/nr_subr.c
+++ b/net/netrom/nr_subr.c
@@ -23,7 +23,6 @@
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c
index 1cb98e88f5e1..ff2c1b142f57 100644
--- a/net/netrom/nr_timer.c
+++ b/net/netrom/nr_timer.c
@@ -24,7 +24,6 @@
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <asm/uaccess.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/netrom/sysctl_net_netrom.c b/net/netrom/sysctl_net_netrom.c
index 1e0fa9e57aac..42f630b9a698 100644
--- a/net/netrom/sysctl_net_netrom.c
+++ b/net/netrom/sysctl_net_netrom.c
@@ -146,18 +146,12 @@ static ctl_table nr_table[] = {
         { }
 };
 
-static struct ctl_path nr_path[] = {
-        { .procname = "net", },
-        { .procname = "netrom", },
-        { }
-};
-
 void __init nr_register_sysctl(void)
 {
-        nr_table_header = register_sysctl_paths(nr_path, nr_table);
+        nr_table_header = register_net_sysctl(&init_net, "net/netrom", nr_table);
 }
 
 void nr_unregister_sysctl(void)
 {
-        unregister_sysctl_table(nr_table_header);
+        unregister_net_sysctl_table(nr_table_header);
 }
diff --git a/net/nfc/Kconfig b/net/nfc/Kconfig
index 44c865b86d6f..8d8d9bc4b6ff 100644
--- a/net/nfc/Kconfig
+++ b/net/nfc/Kconfig
@@ -14,6 +14,7 @@ menuconfig NFC
           be called nfc.
 
 source "net/nfc/nci/Kconfig"
+source "net/nfc/hci/Kconfig"
 source "net/nfc/llcp/Kconfig"
 
 source "drivers/nfc/Kconfig"
diff --git a/net/nfc/Makefile b/net/nfc/Makefile
index 7b4a6dcfa566..d1a117c2c401 100644
--- a/net/nfc/Makefile
+++ b/net/nfc/Makefile
@@ -4,6 +4,7 @@
 
 obj-$(CONFIG_NFC) += nfc.o
 obj-$(CONFIG_NFC_NCI) += nci/
+obj-$(CONFIG_NFC_HCI) += hci/
 
 nfc-objs := core.o netlink.o af_nfc.o rawsock.o
 nfc-$(CONFIG_NFC_LLCP)  += llcp/llcp.o llcp/commands.o llcp/sock.o
diff --git a/net/nfc/af_nfc.c b/net/nfc/af_nfc.c
index da67756425ce..9d68441e2a5a 100644
--- a/net/nfc/af_nfc.c
+++ b/net/nfc/af_nfc.c
@@ -30,7 +30,7 @@ static DEFINE_RWLOCK(proto_tab_lock);
 static const struct nfc_protocol *proto_tab[NFC_SOCKPROTO_MAX];
 
 static int nfc_sock_create(struct net *net, struct socket *sock, int proto,
-                                                                int kern)
+                           int kern)
 {
         int rc = -EPROTONOSUPPORT;
 
diff --git a/net/nfc/core.c b/net/nfc/core.c
index 3ddf6e698df0..9f6ce011d35d 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -33,6 +33,8 @@
 
 #define VERSION "0.1"
 
+#define NFC_CHECK_PRES_FREQ_MS  2000
+
 int nfc_devlist_generation;
 DEFINE_MUTEX(nfc_devlist_mutex);
 
@@ -95,7 +97,7 @@ int nfc_dev_down(struct nfc_dev *dev)
                 goto error;
         }
 
-        if (dev->polling || dev->remote_activated) {
+        if (dev->polling || dev->active_target) {
                 rc = -EBUSY;
                 goto error;
         }
@@ -181,13 +183,29 @@ error:
         return rc;
 }
 
-int nfc_dep_link_up(struct nfc_dev *dev, int target_index,
-                                        u8 comm_mode, u8 rf_mode)
+static struct nfc_target *nfc_find_target(struct nfc_dev *dev, u32 target_idx)
+{
+        int i;
+
+        if (dev->n_targets == 0)
+                return NULL;
+
+        for (i = 0; i < dev->n_targets ; i++) {
+                if (dev->targets[i].idx == target_idx)
+                        return &dev->targets[i];
+        }
+
+        return NULL;
+}
+
+int nfc_dep_link_up(struct nfc_dev *dev, int target_index, u8 comm_mode)
 {
         int rc = 0;
+        u8 *gb;
+        size_t gb_len;
+        struct nfc_target *target;
 
-        pr_debug("dev_name=%s comm:%d rf:%d\n",
-                        dev_name(&dev->dev), comm_mode, rf_mode);
+        pr_debug("dev_name=%s comm %d\n", dev_name(&dev->dev), comm_mode);
 
         if (!dev->ops->dep_link_up)
                 return -EOPNOTSUPP;
@@ -204,7 +222,21 @@ int nfc_dep_link_up(struct nfc_dev *dev, int target_index,
                 goto error;
         }
 
-        rc = dev->ops->dep_link_up(dev, target_index, comm_mode, rf_mode);
+        gb = nfc_llcp_general_bytes(dev, &gb_len);
+        if (gb_len > NFC_MAX_GT_LEN) {
+                rc = -EINVAL;
+                goto error;
+        }
+
+        target = nfc_find_target(dev, target_index);
+        if (target == NULL) {
+                rc = -ENOTCONN;
+                goto error;
+        }
+
+        rc = dev->ops->dep_link_up(dev, target, comm_mode, gb, gb_len);
+        if (!rc)
+                dev->active_target = target;
 
 error:
         device_unlock(&dev->dev);
@@ -240,6 +272,7 @@ int nfc_dep_link_down(struct nfc_dev *dev)
         rc = dev->ops->dep_link_down(dev);
         if (!rc) {
                 dev->dep_link_up = false;
+                dev->active_target = NULL;
                 nfc_llcp_mac_is_down(dev);
                 nfc_genl_dep_link_down_event(dev);
         }
@@ -250,7 +283,7 @@ error:
 }
 
 int nfc_dep_link_is_up(struct nfc_dev *dev, u32 target_idx,
-                                        u8 comm_mode, u8 rf_mode)
+                       u8 comm_mode, u8 rf_mode)
 {
         dev->dep_link_up = true;
         dev->dep_rf_mode = rf_mode;
@@ -271,6 +304,7 @@ EXPORT_SYMBOL(nfc_dep_link_is_up);
 int nfc_activate_target(struct nfc_dev *dev, u32 target_idx, u32 protocol)
 {
         int rc;
+        struct nfc_target *target;
 
         pr_debug("dev_name=%s target_idx=%u protocol=%u\n",
                  dev_name(&dev->dev), target_idx, protocol);
@@ -282,9 +316,25 @@ int nfc_activate_target(struct nfc_dev *dev, u32 target_idx, u32 protocol)
                 goto error;
         }
 
-        rc = dev->ops->activate_target(dev, target_idx, protocol);
-        if (!rc)
-                dev->remote_activated = true;
+        if (dev->active_target) {
+                rc = -EBUSY;
+                goto error;
+        }
+
+        target = nfc_find_target(dev, target_idx);
+        if (target == NULL) {
+                rc = -ENOTCONN;
+                goto error;
+        }
+
+        rc = dev->ops->activate_target(dev, target, protocol);
+        if (!rc) {
+                dev->active_target = target;
+
+                if (dev->ops->check_presence)
+                        mod_timer(&dev->check_pres_timer, jiffies +
+                                  msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
+        }
 
 error:
         device_unlock(&dev->dev);
@@ -311,8 +361,21 @@ int nfc_deactivate_target(struct nfc_dev *dev, u32 target_idx)
                 goto error;
         }
 
-        dev->ops->deactivate_target(dev, target_idx);
-        dev->remote_activated = false;
+        if (dev->active_target == NULL) {
+                rc = -ENOTCONN;
+                goto error;
+        }
+
+        if (dev->active_target->idx != target_idx) {
+                rc = -ENOTCONN;
+                goto error;
+        }
+
+        if (dev->ops->check_presence)
+                del_timer_sync(&dev->check_pres_timer);
+
+        dev->ops->deactivate_target(dev, dev->active_target);
+        dev->active_target = NULL;
 
 error:
         device_unlock(&dev->dev);
@@ -330,10 +393,8 @@ error:
  *
  * The user must wait for the callback before calling this function again.
  */
-int nfc_data_exchange(struct nfc_dev *dev, u32 target_idx,
-                                        struct sk_buff *skb,
-                                        data_exchange_cb_t cb,
-                                        void *cb_context)
+int nfc_data_exchange(struct nfc_dev *dev, u32 target_idx, struct sk_buff *skb,
+                      data_exchange_cb_t cb, void *cb_context)
 {
         int rc;
 
@@ -348,7 +409,27 @@ int nfc_data_exchange(struct nfc_dev *dev, u32 target_idx,
                 goto error;
         }
 
-        rc = dev->ops->data_exchange(dev, target_idx, skb, cb, cb_context);
+        if (dev->active_target == NULL) {
+                rc = -ENOTCONN;
+                kfree_skb(skb);
+                goto error;
+        }
+
+        if (dev->active_target->idx != target_idx) {
+                rc = -EADDRNOTAVAIL;
+                kfree_skb(skb);
+                goto error;
+        }
+
+        if (dev->ops->check_presence)
+                del_timer_sync(&dev->check_pres_timer);
+
+        rc = dev->ops->data_exchange(dev, dev->active_target, skb, cb,
+                                     cb_context);
+
+        if (!rc && dev->ops->check_presence)
+                mod_timer(&dev->check_pres_timer, jiffies +
+                          msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
 
 error:
         device_unlock(&dev->dev);
@@ -357,8 +438,7 @@ error:
 
 int nfc_set_remote_general_bytes(struct nfc_dev *dev, u8 *gb, u8 gb_len)
 {
-        pr_debug("dev_name=%s gb_len=%d\n",
-                        dev_name(&dev->dev), gb_len);
+        pr_debug("dev_name=%s gb_len=%d\n", dev_name(&dev->dev), gb_len);
 
         if (gb_len > NFC_MAX_GT_LEN)
                 return -EINVAL;
@@ -367,12 +447,6 @@ int nfc_set_remote_general_bytes(struct nfc_dev *dev, u8 *gb, u8 gb_len)
 }
 EXPORT_SYMBOL(nfc_set_remote_general_bytes);
 
-u8 *nfc_get_local_general_bytes(struct nfc_dev *dev, u8 *gt_len)
-{
-        return nfc_llcp_general_bytes(dev, gt_len);
-}
-EXPORT_SYMBOL(nfc_get_local_general_bytes);
-
 /**
  * nfc_alloc_send_skb - allocate a skb for data exchange responses
  *
@@ -380,8 +454,8 @@ EXPORT_SYMBOL(nfc_get_local_general_bytes);
  * @gfp: gfp flags
  */
 struct sk_buff *nfc_alloc_send_skb(struct nfc_dev *dev, struct sock *sk,
-                                        unsigned int flags, unsigned int size,
-                                        unsigned int *err)
+                                   unsigned int flags, unsigned int size,
+                                   unsigned int *err)
 {
         struct sk_buff *skb;
         unsigned int total_size;
@@ -427,9 +501,12 @@ EXPORT_SYMBOL(nfc_alloc_recv_skb);
  * The device driver must call this function when one or many nfc targets
  * are found. After calling this function, the device driver must stop
  * polling for targets.
+ * IMPORTANT: this function must not be called from an atomic context.
+ * In addition, it must also not be called from a context that would prevent
+ * the NFC Core to call other nfc ops entry point concurrently.
  */
-int nfc_targets_found(struct nfc_dev *dev, struct nfc_target *targets,
-                                                        int n_targets)
+int nfc_targets_found(struct nfc_dev *dev,
+                      struct nfc_target *targets, int n_targets)
 {
         int i;
 
@@ -438,24 +515,24 @@ int nfc_targets_found(struct nfc_dev *dev, struct nfc_target *targets,
         dev->polling = false;
 
         for (i = 0; i < n_targets; i++)
-                targets[i].idx = dev->target_idx++;
+                targets[i].idx = dev->target_next_idx++;
 
-        spin_lock_bh(&dev->targets_lock);
+        device_lock(&dev->dev);
 
         dev->targets_generation++;
 
         kfree(dev->targets);
         dev->targets = kmemdup(targets, n_targets * sizeof(struct nfc_target),
-                                                                GFP_ATOMIC);
+                               GFP_ATOMIC);
 
         if (!dev->targets) {
                 dev->n_targets = 0;
-                spin_unlock_bh(&dev->targets_lock);
+                device_unlock(&dev->dev);
                 return -ENOMEM;
         }
 
         dev->n_targets = n_targets;
-        spin_unlock_bh(&dev->targets_lock);
+        device_unlock(&dev->dev);
 
         nfc_genl_targets_found(dev);
 
@@ -463,17 +540,105 @@ int nfc_targets_found(struct nfc_dev *dev, struct nfc_target *targets,
 }
 EXPORT_SYMBOL(nfc_targets_found);
 
+/**
+ * nfc_target_lost - inform that an activated target went out of field
+ *
+ * @dev: The nfc device that had the activated target in field
+ * @target_idx: the nfc index of the target
+ *
+ * The device driver must call this function when the activated target
+ * goes out of the field.
+ * IMPORTANT: this function must not be called from an atomic context.
+ * In addition, it must also not be called from a context that would prevent
+ * the NFC Core to call other nfc ops entry point concurrently.
+ */
+int nfc_target_lost(struct nfc_dev *dev, u32 target_idx)
+{
+        struct nfc_target *tg;
+        int i;
+
+        pr_debug("dev_name %s n_target %d\n", dev_name(&dev->dev), target_idx);
+
+        device_lock(&dev->dev);
+
+        for (i = 0; i < dev->n_targets; i++) {
+                tg = &dev->targets[i];
+                if (tg->idx == target_idx)
+                        break;
+        }
+
+        if (i == dev->n_targets) {
+                device_unlock(&dev->dev);
+                return -EINVAL;
+        }
+
+        dev->targets_generation++;
+        dev->n_targets--;
+        dev->active_target = NULL;
+
+        if (dev->n_targets) {
+                memcpy(&dev->targets[i], &dev->targets[i + 1],
+                       (dev->n_targets - i) * sizeof(struct nfc_target));
+        } else {
+                kfree(dev->targets);
+                dev->targets = NULL;
+        }
+
+        device_unlock(&dev->dev);
+
+        nfc_genl_target_lost(dev, target_idx);
+
+        return 0;
+}
+EXPORT_SYMBOL(nfc_target_lost);
+
 static void nfc_release(struct device *d)
 {
         struct nfc_dev *dev = to_nfc_dev(d);
 
         pr_debug("dev_name=%s\n", dev_name(&dev->dev));
 
+        if (dev->ops->check_presence) {
+                del_timer_sync(&dev->check_pres_timer);
+                destroy_workqueue(dev->check_pres_wq);
+        }
+
         nfc_genl_data_exit(&dev->genl_data);
         kfree(dev->targets);
         kfree(dev);
 }
 
+static void nfc_check_pres_work(struct work_struct *work)
+{
+        struct nfc_dev *dev = container_of(work, struct nfc_dev,
+                                           check_pres_work);
+        int rc;
+
+        device_lock(&dev->dev);
+
+        if (dev->active_target && timer_pending(&dev->check_pres_timer) == 0) {
+                rc = dev->ops->check_presence(dev, dev->active_target);
+                if (!rc) {
+                        mod_timer(&dev->check_pres_timer, jiffies +
+                                  msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
+                } else {
+                        u32 active_target_idx = dev->active_target->idx;
+                        device_unlock(&dev->dev);
+                        nfc_target_lost(dev, active_target_idx);
+                        return;
+                }
+        }
+
+        device_unlock(&dev->dev);
+}
+
+static void nfc_check_pres_timeout(unsigned long data)
+{
+        struct nfc_dev *dev = (struct nfc_dev *)data;
+
+        queue_work(dev->check_pres_wq, &dev->check_pres_work);
+}
+
 struct class nfc_class = {
         .name = "nfc",
         .dev_release = nfc_release,
@@ -483,12 +648,12 @@ EXPORT_SYMBOL(nfc_class);
 static int match_idx(struct device *d, void *data)
 {
         struct nfc_dev *dev = to_nfc_dev(d);
-        unsigned *idx = data;
+        unsigned int *idx = data;
 
         return dev->idx == *idx;
 }
 
-struct nfc_dev *nfc_get_device(unsigned idx)
+struct nfc_dev *nfc_get_device(unsigned int idx)
 {
         struct device *d;
 
@@ -506,15 +671,14 @@ struct nfc_dev *nfc_get_device(unsigned idx)
  * @supported_protocols: NFC protocols supported by the device
  */
 struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
-                                        u32 supported_protocols,
-                                        int tx_headroom,
-                                        int tx_tailroom)
+                                    u32 supported_protocols,
+                                    int tx_headroom, int tx_tailroom)
 {
         static atomic_t dev_no = ATOMIC_INIT(0);
         struct nfc_dev *dev;
 
         if (!ops->start_poll || !ops->stop_poll || !ops->activate_target ||
-                !ops->deactivate_target || !ops->data_exchange)
+            !ops->deactivate_target || !ops->data_exchange)
                 return NULL;
 
         if (!supported_protocols)
@@ -534,12 +698,29 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
         dev->tx_headroom = tx_headroom;
         dev->tx_tailroom = tx_tailroom;
 
-        spin_lock_init(&dev->targets_lock);
         nfc_genl_data_init(&dev->genl_data);
 
+
         /* first generation must not be 0 */
         dev->targets_generation = 1;
 
+        if (ops->check_presence) {
+                char name[32];
+                init_timer(&dev->check_pres_timer);
+                dev->check_pres_timer.data = (unsigned long)dev;
+                dev->check_pres_timer.function = nfc_check_pres_timeout;
+
+                INIT_WORK(&dev->check_pres_work, nfc_check_pres_work);
+                snprintf(name, sizeof(name), "nfc%d_check_pres_wq", dev->idx);
+                dev->check_pres_wq = alloc_workqueue(name, WQ_NON_REENTRANT |
+                                                     WQ_UNBOUND |
+                                                     WQ_MEM_RECLAIM, 1);
+                if (dev->check_pres_wq == NULL) {
+                        kfree(dev);
+                        return NULL;
+                }
+        }
+
         return dev;
 }
 EXPORT_SYMBOL(nfc_allocate_device);
diff --git a/net/nfc/hci/Kconfig b/net/nfc/hci/Kconfig
new file mode 100644
index 000000000000..fd67f51d18e9
--- /dev/null
+++ b/net/nfc/hci/Kconfig
@@ -0,0 +1,17 @@
+config NFC_HCI
+       depends on NFC
+       tristate "NFC HCI implementation"
+       default n
+       help
+         Say Y here if you want to build support for a kernel NFC HCI
+         implementation. This is mostly needed for devices that only process
+         HCI frames, like for example the NXP pn544.
+
+config NFC_SHDLC
+        depends on NFC_HCI
+        select CRC_CCITT
+        bool "SHDLC link layer for HCI based NFC drivers"
+        default n
+        ---help---
+          Say yes if you use an NFC HCI driver that requires SHDLC link layer.
+          If unsure, say N here.
diff --git a/net/nfc/hci/Makefile b/net/nfc/hci/Makefile
new file mode 100644
index 000000000000..f9c44b2fb065
--- /dev/null
+++ b/net/nfc/hci/Makefile
@@ -0,0 +1,8 @@
+#
+# Makefile for the Linux NFC HCI layer.
+#
+
+obj-$(CONFIG_NFC_HCI) += hci.o
+
+hci-y                   := core.o hcp.o command.o
+hci-$(CONFIG_NFC_SHDLC) += shdlc.o
diff --git a/net/nfc/hci/command.c b/net/nfc/hci/command.c
new file mode 100644
index 000000000000..8729abf5f18b
--- /dev/null
+++ b/net/nfc/hci/command.c
@@ -0,0 +1,354 @@
+/*
+ * Copyright (C) 2012  Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the
+ * Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#define pr_fmt(fmt) "hci: %s: " fmt, __func__
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/module.h>
+
+#include <net/nfc/hci.h>
+
+#include "hci.h"
+
+static int nfc_hci_result_to_errno(u8 result)
+{
+        switch (result) {
+        case NFC_HCI_ANY_OK:
+                return 0;
+        case NFC_HCI_ANY_E_TIMEOUT:
+                return -ETIMEDOUT;
+        default:
+                return -1;
+        }
+}
+
+static void nfc_hci_execute_cb(struct nfc_hci_dev *hdev, u8 result,
+                               struct sk_buff *skb, void *cb_data)
+{
+        struct hcp_exec_waiter *hcp_ew = (struct hcp_exec_waiter *)cb_data;
+
+        pr_debug("HCI Cmd completed with HCI result=%d\n", result);
+
+        hcp_ew->exec_result = nfc_hci_result_to_errno(result);
+        if (hcp_ew->exec_result == 0)
+                hcp_ew->result_skb = skb;
+        else
+                kfree_skb(skb);
+        hcp_ew->exec_complete = true;
+
+        wake_up(hcp_ew->wq);
+}
+
+static int nfc_hci_execute_cmd(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
+                               const u8 *param, size_t param_len,
+                               struct sk_buff **skb)
+{
+        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(ew_wq);
+        struct hcp_exec_waiter hcp_ew;
+        hcp_ew.wq = &ew_wq;
+        hcp_ew.exec_complete = false;
+        hcp_ew.result_skb = NULL;
+
+        pr_debug("through pipe=%d, cmd=%d, plen=%zd\n", pipe, cmd, param_len);
+
+        /* TODO: Define hci cmd execution delay. Should it be the same
+         * for all commands?
+         */
+        hcp_ew.exec_result = nfc_hci_hcp_message_tx(hdev, pipe,
+                                                    NFC_HCI_HCP_COMMAND, cmd,
+                                                    param, param_len,
+                                                    nfc_hci_execute_cb, &hcp_ew,
+                                                    3000);
+        if (hcp_ew.exec_result < 0)
+                return hcp_ew.exec_result;
+
+        wait_event(ew_wq, hcp_ew.exec_complete == true);
+
+        if (hcp_ew.exec_result == 0) {
+                if (skb)
+                        *skb = hcp_ew.result_skb;
+                else
+                        kfree_skb(hcp_ew.result_skb);
+        }
+
+        return hcp_ew.exec_result;
+}
+
+int nfc_hci_send_event(struct nfc_hci_dev *hdev, u8 gate, u8 event,
+                       const u8 *param, size_t param_len)
+{
+        u8 pipe;
+
+        pr_debug("%d to gate %d\n", event, gate);
+
+        pipe = hdev->gate2pipe[gate];
+        if (pipe == NFC_HCI_INVALID_PIPE)
+                return -EADDRNOTAVAIL;
+
+        return nfc_hci_hcp_message_tx(hdev, pipe, NFC_HCI_HCP_EVENT, event,
+                                      param, param_len, NULL, NULL, 0);
+}
+EXPORT_SYMBOL(nfc_hci_send_event);
+
+int nfc_hci_send_response(struct nfc_hci_dev *hdev, u8 gate, u8 response,
+                          const u8 *param, size_t param_len)
+{
+        u8 pipe;
+
+        pr_debug("\n");
+
+        pipe = hdev->gate2pipe[gate];
+        if (pipe == NFC_HCI_INVALID_PIPE)
+                return -EADDRNOTAVAIL;
+
+        return nfc_hci_hcp_message_tx(hdev, pipe, NFC_HCI_HCP_RESPONSE,
+                                      response, param, param_len, NULL, NULL,
+                                      0);
+}
+EXPORT_SYMBOL(nfc_hci_send_response);
+
+/*
+ * Execute an hci command sent to gate.
+ * skb will contain response data if success. skb can be NULL if you are not
+ * interested by the response.
+ */
+int nfc_hci_send_cmd(struct nfc_hci_dev *hdev, u8 gate, u8 cmd,
+                     const u8 *param, size_t param_len, struct sk_buff **skb)
+{
+        u8 pipe;
+
+        pr_debug("\n");
+
+        pipe = hdev->gate2pipe[gate];
+        if (pipe == NFC_HCI_INVALID_PIPE)
+                return -EADDRNOTAVAIL;
+
+        return nfc_hci_execute_cmd(hdev, pipe, cmd, param, param_len, skb);
+}
+EXPORT_SYMBOL(nfc_hci_send_cmd);
+
+int nfc_hci_set_param(struct nfc_hci_dev *hdev, u8 gate, u8 idx,
+                      const u8 *param, size_t param_len)
+{
+        int r;
+        u8 *tmp;
+
+        /* TODO ELa: reg idx must be inserted before param, but we don't want
+         * to ask the caller to do it to keep a simpler API.
+         * For now, just create a new temporary param buffer. This is far from
+         * optimal though, and the plan is to modify APIs to pass idx down to
+         * nfc_hci_hcp_message_tx where the frame is actually built, thereby
+         * eliminating the need for the temp allocation-copy here.
+         */
+
+        pr_debug("idx=%d to gate %d\n", idx, gate);
+
+        tmp = kmalloc(1 + param_len, GFP_KERNEL);
+        if (tmp == NULL)
+                return -ENOMEM;
+
+        *tmp = idx;
+        memcpy(tmp + 1, param, param_len);
+
+        r = nfc_hci_send_cmd(hdev, gate, NFC_HCI_ANY_SET_PARAMETER,
+                             tmp, param_len + 1, NULL);
+
+        kfree(tmp);
+
+        return r;
+}
+EXPORT_SYMBOL(nfc_hci_set_param);
+
+int nfc_hci_get_param(struct nfc_hci_dev *hdev, u8 gate, u8 idx,
+                      struct sk_buff **skb)
+{
+        pr_debug("gate=%d regidx=%d\n", gate, idx);
+
+        return nfc_hci_send_cmd(hdev, gate, NFC_HCI_ANY_GET_PARAMETER,
+                                &idx, 1, skb);
+}
+EXPORT_SYMBOL(nfc_hci_get_param);
+
+static int nfc_hci_open_pipe(struct nfc_hci_dev *hdev, u8 pipe)
+{
+        struct sk_buff *skb;
+        int r;
+
+        pr_debug("pipe=%d\n", pipe);
+
+        r = nfc_hci_execute_cmd(hdev, pipe, NFC_HCI_ANY_OPEN_PIPE,
+                                NULL, 0, &skb);
+        if (r == 0) {
+                /* dest host other than host controller will send
+                 * number of pipes already open on this gate before
+                 * execution. The number can be found in skb->data[0]
+                 */
+                kfree_skb(skb);
+        }
+
+        return r;
+}
+
+static int nfc_hci_close_pipe(struct nfc_hci_dev *hdev, u8 pipe)
+{
+        pr_debug("\n");
+
+        return nfc_hci_execute_cmd(hdev, pipe, NFC_HCI_ANY_CLOSE_PIPE,
+                                   NULL, 0, NULL);
+}
+
+static u8 nfc_hci_create_pipe(struct nfc_hci_dev *hdev, u8 dest_host,
+                              u8 dest_gate, int *result)
+{
+        struct sk_buff *skb;
+        struct hci_create_pipe_params params;
+        struct hci_create_pipe_resp *resp;
+        u8 pipe;
+
+        pr_debug("gate=%d\n", dest_gate);
+
+        params.src_gate = NFC_HCI_ADMIN_GATE;
+        params.dest_host = dest_host;
+        params.dest_gate = dest_gate;
+
+        *result = nfc_hci_execute_cmd(hdev, NFC_HCI_ADMIN_PIPE,
+                                      NFC_HCI_ADM_CREATE_PIPE,
+                                      (u8 *) &params, sizeof(params), &skb);
+        if (*result == 0) {
+                resp = (struct hci_create_pipe_resp *)skb->data;
+                pipe = resp->pipe;
+                kfree_skb(skb);
+
+                pr_debug("pipe created=%d\n", pipe);
+
+                return pipe;
+        } else
+                return NFC_HCI_INVALID_PIPE;
+}
+
+static int nfc_hci_delete_pipe(struct nfc_hci_dev *hdev, u8 pipe)
+{
+        pr_debug("\n");
+
+        return nfc_hci_execute_cmd(hdev, NFC_HCI_ADMIN_PIPE,
+                                   NFC_HCI_ADM_DELETE_PIPE, &pipe, 1, NULL);
+}
+
+static int nfc_hci_clear_all_pipes(struct nfc_hci_dev *hdev)
+{
+        int r;
+
+        u8 param[2];
+
+        /* TODO: Find out what the identity reference data is
+         * and fill param with it. HCI spec 6.1.3.5 */
+
+        pr_debug("\n");
+
+        r = nfc_hci_execute_cmd(hdev, NFC_HCI_ADMIN_PIPE,
+                                NFC_HCI_ADM_CLEAR_ALL_PIPE, param, 2, NULL);
+
+        return 0;
+}
+
+int nfc_hci_disconnect_gate(struct nfc_hci_dev *hdev, u8 gate)
+{
+        int r;
+        u8 pipe = hdev->gate2pipe[gate];
+
+        pr_debug("\n");
+
+        if (pipe == NFC_HCI_INVALID_PIPE)
+                return -EADDRNOTAVAIL;
+
+        r = nfc_hci_close_pipe(hdev, pipe);
+        if (r < 0)
+                return r;
+
+        if (pipe != NFC_HCI_LINK_MGMT_PIPE && pipe != NFC_HCI_ADMIN_PIPE) {
+                r = nfc_hci_delete_pipe(hdev, pipe);
+                if (r < 0)
+                        return r;
+        }
+
+        hdev->gate2pipe[gate] = NFC_HCI_INVALID_PIPE;
+
+        return 0;
+}
+EXPORT_SYMBOL(nfc_hci_disconnect_gate);
+
+int nfc_hci_disconnect_all_gates(struct nfc_hci_dev *hdev)
+{
+        int r;
+
+        pr_debug("\n");
+
+        r = nfc_hci_clear_all_pipes(hdev);
+        if (r < 0)
+                return r;
+
+        memset(hdev->gate2pipe, NFC_HCI_INVALID_PIPE, sizeof(hdev->gate2pipe));
+
+        return 0;
+}
+EXPORT_SYMBOL(nfc_hci_disconnect_all_gates);
+
+int nfc_hci_connect_gate(struct nfc_hci_dev *hdev, u8 dest_host, u8 dest_gate)
+{
+        u8 pipe = NFC_HCI_INVALID_PIPE;
+        bool pipe_created = false;
+        int r;
+
+        pr_debug("\n");
+
+        if (hdev->gate2pipe[dest_gate] != NFC_HCI_INVALID_PIPE)
+                return -EADDRINUSE;
+
+        switch (dest_gate) {
+        case NFC_HCI_LINK_MGMT_GATE:
+                pipe = NFC_HCI_LINK_MGMT_PIPE;
+                break;
+        case NFC_HCI_ADMIN_GATE:
+                pipe = NFC_HCI_ADMIN_PIPE;
+                break;
+        default:
+                pipe = nfc_hci_create_pipe(hdev, dest_host, dest_gate, &r);
+                if (pipe == NFC_HCI_INVALID_PIPE)
+                        return r;
+                pipe_created = true;
+                break;
+        }
+
+        r = nfc_hci_open_pipe(hdev, pipe);
+        if (r < 0) {
+                if (pipe_created)
+                        if (nfc_hci_delete_pipe(hdev, pipe) < 0) {
+                                /* TODO: Cannot clean by deleting pipe...
+                                 * -> inconsistent state */
+                        }
+                return r;
+        }
+
+        hdev->gate2pipe[dest_gate] = pipe;
+
+        return 0;
+}
+EXPORT_SYMBOL(nfc_hci_connect_gate);
diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
new file mode 100644
index 000000000000..e1a640d2b588
--- /dev/null
+++ b/net/nfc/hci/core.c
@@ -0,0 +1,798 @@
+/*
+ * Copyright (C) 2012  Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the
+ * Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#define pr_fmt(fmt) "hci: %s: " fmt, __func__
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/nfc.h>
+
+#include <net/nfc/nfc.h>
+#include <net/nfc/hci.h>
+
+#include "hci.h"
+
+/* Largest headroom needed for outgoing HCI commands */
+#define HCI_CMDS_HEADROOM 1
+
+static void nfc_hci_msg_tx_work(struct work_struct *work)
+{
+        struct nfc_hci_dev *hdev = container_of(work, struct nfc_hci_dev,
+                                                msg_tx_work);
+        struct hci_msg *msg;
+        struct sk_buff *skb;
+        int r = 0;
+
+        mutex_lock(&hdev->msg_tx_mutex);
+
+        if (hdev->cmd_pending_msg) {
+                if (timer_pending(&hdev->cmd_timer) == 0) {
+                        if (hdev->cmd_pending_msg->cb)
+                                hdev->cmd_pending_msg->cb(hdev,
+                                                          NFC_HCI_ANY_E_TIMEOUT,
+                                                          NULL,
+                                                          hdev->
+                                                          cmd_pending_msg->
+                                                          cb_context);
+                        kfree(hdev->cmd_pending_msg);
+                        hdev->cmd_pending_msg = NULL;
+                } else
+                        goto exit;
+        }
+
+next_msg:
+        if (list_empty(&hdev->msg_tx_queue))
+                goto exit;
+
+        msg = list_first_entry(&hdev->msg_tx_queue, struct hci_msg, msg_l);
+        list_del(&msg->msg_l);
+
+        pr_debug("msg_tx_queue has a cmd to send\n");
+        while ((skb = skb_dequeue(&msg->msg_frags)) != NULL) {
+                r = hdev->ops->xmit(hdev, skb);
+                if (r < 0) {
+                        kfree_skb(skb);
+                        skb_queue_purge(&msg->msg_frags);
+                        if (msg->cb)
+                                msg->cb(hdev, NFC_HCI_ANY_E_NOK, NULL,
+                                        msg->cb_context);
+                        kfree(msg);
+                        break;
+                }
+        }
+
+        if (r)
+                goto next_msg;
+
+        if (msg->wait_response == false) {
+                kfree(msg);
+                goto next_msg;
+        }
+
+        hdev->cmd_pending_msg = msg;
+        mod_timer(&hdev->cmd_timer, jiffies +
+                  msecs_to_jiffies(hdev->cmd_pending_msg->completion_delay));
+
+exit:
+        mutex_unlock(&hdev->msg_tx_mutex);
+}
+
+static void nfc_hci_msg_rx_work(struct work_struct *work)
+{
+        struct nfc_hci_dev *hdev = container_of(work, struct nfc_hci_dev,
+                                                msg_rx_work);
+        struct sk_buff *skb;
+        struct hcp_message *message;
+        u8 pipe;
+        u8 type;
+        u8 instruction;
+
+        while ((skb = skb_dequeue(&hdev->msg_rx_queue)) != NULL) {
+                pipe = skb->data[0];
+                skb_pull(skb, NFC_HCI_HCP_PACKET_HEADER_LEN);
+                message = (struct hcp_message *)skb->data;
+                type = HCP_MSG_GET_TYPE(message->header);
+                instruction = HCP_MSG_GET_CMD(message->header);
+                skb_pull(skb, NFC_HCI_HCP_MESSAGE_HEADER_LEN);
+
+                nfc_hci_hcp_message_rx(hdev, pipe, type, instruction, skb);
+        }
+}
+
+void nfc_hci_resp_received(struct nfc_hci_dev *hdev, u8 result,
+                           struct sk_buff *skb)
+{
+        mutex_lock(&hdev->msg_tx_mutex);
+
+        if (hdev->cmd_pending_msg == NULL) {
+                kfree_skb(skb);
+                goto exit;
+        }
+
+        del_timer_sync(&hdev->cmd_timer);
+
+        if (hdev->cmd_pending_msg->cb)
+                hdev->cmd_pending_msg->cb(hdev, result, skb,
+                                          hdev->cmd_pending_msg->cb_context);
+        else
+                kfree_skb(skb);
+
+        kfree(hdev->cmd_pending_msg);
+        hdev->cmd_pending_msg = NULL;
+
+        queue_work(hdev->msg_tx_wq, &hdev->msg_tx_work);
+
+exit:
+        mutex_unlock(&hdev->msg_tx_mutex);
+}
+
+void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
+                          struct sk_buff *skb)
+{
+        kfree_skb(skb);
+}
+
+static u32 nfc_hci_sak_to_protocol(u8 sak)
+{
+        switch (NFC_HCI_TYPE_A_SEL_PROT(sak)) {
+        case NFC_HCI_TYPE_A_SEL_PROT_MIFARE:
+                return NFC_PROTO_MIFARE_MASK;
+        case NFC_HCI_TYPE_A_SEL_PROT_ISO14443:
+                return NFC_PROTO_ISO14443_MASK;
+        case NFC_HCI_TYPE_A_SEL_PROT_DEP:
+                return NFC_PROTO_NFC_DEP_MASK;
+        case NFC_HCI_TYPE_A_SEL_PROT_ISO14443_DEP:
+                return NFC_PROTO_ISO14443_MASK | NFC_PROTO_NFC_DEP_MASK;
+        default:
+                return 0xffffffff;
+        }
+}
+
+static int nfc_hci_target_discovered(struct nfc_hci_dev *hdev, u8 gate)
+{
+        struct nfc_target *targets;
+        struct sk_buff *atqa_skb = NULL;
+        struct sk_buff *sak_skb = NULL;
+        int r;
+
+        pr_debug("from gate %d\n", gate);
+
+        targets = kzalloc(sizeof(struct nfc_target), GFP_KERNEL);
+        if (targets == NULL)
+                return -ENOMEM;
+
+        switch (gate) {
+        case NFC_HCI_RF_READER_A_GATE:
+                r = nfc_hci_get_param(hdev, NFC_HCI_RF_READER_A_GATE,
+                                      NFC_HCI_RF_READER_A_ATQA, &atqa_skb);
+                if (r < 0)
+                        goto exit;
+
+                r = nfc_hci_get_param(hdev, NFC_HCI_RF_READER_A_GATE,
+                                      NFC_HCI_RF_READER_A_SAK, &sak_skb);
+                if (r < 0)
+                        goto exit;
+
+                if (atqa_skb->len != 2 || sak_skb->len != 1) {
+                        r = -EPROTO;
+                        goto exit;
+                }
+
+                targets->supported_protocols =
+                                nfc_hci_sak_to_protocol(sak_skb->data[0]);
+                if (targets->supported_protocols == 0xffffffff) {
+                        r = -EPROTO;
+                        goto exit;
+                }
+
+                targets->sens_res = be16_to_cpu(*(u16 *)atqa_skb->data);
+                targets->sel_res = sak_skb->data[0];
+
+                if (hdev->ops->complete_target_discovered) {
+                        r = hdev->ops->complete_target_discovered(hdev, gate,
+                                                                  targets);
+                        if (r < 0)
+                                goto exit;
+                }
+                break;
+        case NFC_HCI_RF_READER_B_GATE:
+                targets->supported_protocols = NFC_PROTO_ISO14443_MASK;
+                break;
+        default:
+                if (hdev->ops->target_from_gate)
+                        r = hdev->ops->target_from_gate(hdev, gate, targets);
+                else
+                        r = -EPROTO;
+                if (r < 0)
+                        goto exit;
+
+                if (hdev->ops->complete_target_discovered) {
+                        r = hdev->ops->complete_target_discovered(hdev, gate,
+                                                                  targets);
+                        if (r < 0)
+                                goto exit;
+                }
+                break;
+        }
+
+        targets->hci_reader_gate = gate;
+
+        r = nfc_targets_found(hdev->ndev, targets, 1);
+
+exit:
+        kfree(targets);
+        kfree_skb(atqa_skb);
+        kfree_skb(sak_skb);
+
+        return r;
+}
+
+void nfc_hci_event_received(struct nfc_hci_dev *hdev, u8 pipe, u8 event,
+                            struct sk_buff *skb)
+{
+        int r = 0;
+
+        switch (event) {
+        case NFC_HCI_EVT_TARGET_DISCOVERED:
+                if (skb->len < 1) {     /* no status data? */
+                        r = -EPROTO;
+                        goto exit;
+                }
+
+                if (skb->data[0] == 3) {
+                        /* TODO: Multiple targets in field, none activated
+                         * poll is supposedly stopped, but there is no
+                         * single target to activate, so nothing to report
+                         * up.
+                         * if we need to restart poll, we must save the
+                         * protocols from the initial poll and reuse here.
+                         */
+                }
+
+                if (skb->data[0] != 0) {
+                        r = -EPROTO;
+                        goto exit;
+                }
+
+                r = nfc_hci_target_discovered(hdev,
+                                              nfc_hci_pipe2gate(hdev, pipe));
+                break;
+        default:
+                /* TODO: Unknown events are hardware specific
+                 * pass them to the driver (needs a new hci_ops) */
+                break;
+        }
+
+exit:
+        kfree_skb(skb);
+
+        if (r) {
+                /* TODO: There was an error dispatching the event,
+                 * how to propagate up to nfc core?
+                 */
+        }
+}
+
+static void nfc_hci_cmd_timeout(unsigned long data)
+{
+        struct nfc_hci_dev *hdev = (struct nfc_hci_dev *)data;
+
+        queue_work(hdev->msg_tx_wq, &hdev->msg_tx_work);
+}
+
+static int hci_dev_connect_gates(struct nfc_hci_dev *hdev, u8 gate_count,
+                                 u8 gates[])
+{
+        int r;
+        u8 *p = gates;
+        while (gate_count--) {
+                r = nfc_hci_connect_gate(hdev, NFC_HCI_HOST_CONTROLLER_ID, *p);
+                if (r < 0)
+                        return r;
+                p++;
+        }
+
+        return 0;
+}
+
+static int hci_dev_session_init(struct nfc_hci_dev *hdev)
+{
+        struct sk_buff *skb = NULL;
+        int r;
+        u8 hci_gates[] = {      /* NFC_HCI_ADMIN_GATE MUST be first */
+                NFC_HCI_ADMIN_GATE, NFC_HCI_LOOPBACK_GATE,
+                NFC_HCI_ID_MGMT_GATE, NFC_HCI_LINK_MGMT_GATE,
+                NFC_HCI_RF_READER_B_GATE, NFC_HCI_RF_READER_A_GATE
+        };
+
+        r = nfc_hci_connect_gate(hdev, NFC_HCI_HOST_CONTROLLER_ID,
+                                 NFC_HCI_ADMIN_GATE);
+        if (r < 0)
+                goto exit;
+
+        r = nfc_hci_get_param(hdev, NFC_HCI_ADMIN_GATE,
+                              NFC_HCI_ADMIN_SESSION_IDENTITY, &skb);
+        if (r < 0)
+                goto disconnect_all;
+
+        if (skb->len && skb->len == strlen(hdev->init_data.session_id))
+                if (memcmp(hdev->init_data.session_id, skb->data,
+                           skb->len) == 0) {
+                        /* TODO ELa: restore gate<->pipe table from
+                         * some TBD location.
+                         * note: it doesn't seem possible to get the chip
+                         * currently open gate/pipe table.
+                         * It is only possible to obtain the supported
+                         * gate list.
+                         */
+
+                        /* goto exit
+                         * For now, always do a full initialization */
+                }
+
+        r = nfc_hci_disconnect_all_gates(hdev);
+        if (r < 0)
+                goto exit;
+
+        r = hci_dev_connect_gates(hdev, sizeof(hci_gates), hci_gates);
+        if (r < 0)
+                goto disconnect_all;
+
+        r = hci_dev_connect_gates(hdev, hdev->init_data.gate_count,
+                                  hdev->init_data.gates);
+        if (r < 0)
+                goto disconnect_all;
+
+        r = nfc_hci_set_param(hdev, NFC_HCI_ADMIN_GATE,
+                              NFC_HCI_ADMIN_SESSION_IDENTITY,
+                              hdev->init_data.session_id,
+                              strlen(hdev->init_data.session_id));
+        if (r == 0)
+                goto exit;
+
+disconnect_all:
+        nfc_hci_disconnect_all_gates(hdev);
+
+exit:
+        if (skb)
+                kfree_skb(skb);
+
+        return r;
+}
+
+static int hci_dev_version(struct nfc_hci_dev *hdev)
+{
+        int r;
+        struct sk_buff *skb;
+
+        r = nfc_hci_get_param(hdev, NFC_HCI_ID_MGMT_GATE,
+                              NFC_HCI_ID_MGMT_VERSION_SW, &skb);
+        if (r < 0)
+                return r;
+
+        if (skb->len != 3) {
+                kfree_skb(skb);
+                return -EINVAL;
+        }
+
+        hdev->sw_romlib = (skb->data[0] & 0xf0) >> 4;
+        hdev->sw_patch = skb->data[0] & 0x0f;
+        hdev->sw_flashlib_major = skb->data[1];
+        hdev->sw_flashlib_minor = skb->data[2];
+
+        kfree_skb(skb);
+
+        r = nfc_hci_get_param(hdev, NFC_HCI_ID_MGMT_GATE,
+                              NFC_HCI_ID_MGMT_VERSION_HW, &skb);
+        if (r < 0)
+                return r;
+
+        if (skb->len != 3) {
+                kfree_skb(skb);
+                return -EINVAL;
+        }
+
+        hdev->hw_derivative = (skb->data[0] & 0xe0) >> 5;
+        hdev->hw_version = skb->data[0] & 0x1f;
+        hdev->hw_mpw = (skb->data[1] & 0xc0) >> 6;
+        hdev->hw_software = skb->data[1] & 0x3f;
+        hdev->hw_bsid = skb->data[2];
+
+        kfree_skb(skb);
+
+        pr_info("SOFTWARE INFO:\n");
+        pr_info("RomLib         : %d\n", hdev->sw_romlib);
+        pr_info("Patch          : %d\n", hdev->sw_patch);
+        pr_info("FlashLib Major : %d\n", hdev->sw_flashlib_major);
+        pr_info("FlashLib Minor : %d\n", hdev->sw_flashlib_minor);
+        pr_info("HARDWARE INFO:\n");
+        pr_info("Derivative     : %d\n", hdev->hw_derivative);
+        pr_info("HW Version     : %d\n", hdev->hw_version);
+        pr_info("#MPW           : %d\n", hdev->hw_mpw);
+        pr_info("Software       : %d\n", hdev->hw_software);
+        pr_info("BSID Version   : %d\n", hdev->hw_bsid);
+
+        return 0;
+}
+
+static int hci_dev_up(struct nfc_dev *nfc_dev)
+{
+        struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
+        int r = 0;
+
+        if (hdev->ops->open) {
+                r = hdev->ops->open(hdev);
+                if (r < 0)
+                        return r;
+        }
+
+        r = hci_dev_session_init(hdev);
+        if (r < 0)
+                goto exit;
+
+        r = nfc_hci_send_event(hdev, NFC_HCI_RF_READER_A_GATE,
+                               NFC_HCI_EVT_END_OPERATION, NULL, 0);
+        if (r < 0)
+                goto exit;
+
+        if (hdev->ops->hci_ready) {
+                r = hdev->ops->hci_ready(hdev);
+                if (r < 0)
+                        goto exit;
+        }
+
+        r = hci_dev_version(hdev);
+        if (r < 0)
+                goto exit;
+
+exit:
+        if (r < 0)
+                if (hdev->ops->close)
+                        hdev->ops->close(hdev);
+        return r;
+}
+
+static int hci_dev_down(struct nfc_dev *nfc_dev)
+{
+        struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
+
+        if (hdev->ops->close)
+                hdev->ops->close(hdev);
+
+        memset(hdev->gate2pipe, NFC_HCI_INVALID_PIPE, sizeof(hdev->gate2pipe));
+
+        return 0;
+}
+
+static int hci_start_poll(struct nfc_dev *nfc_dev, u32 protocols)
+{
+        struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
+
+        if (hdev->ops->start_poll)
+                return hdev->ops->start_poll(hdev, protocols);
+        else
+                return nfc_hci_send_event(hdev, NFC_HCI_RF_READER_A_GATE,
+                                       NFC_HCI_EVT_READER_REQUESTED, NULL, 0);
+}
+
+static void hci_stop_poll(struct nfc_dev *nfc_dev)
+{
+        struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
+
+        nfc_hci_send_event(hdev, NFC_HCI_RF_READER_A_GATE,
+                           NFC_HCI_EVT_END_OPERATION, NULL, 0);
+}
+
+static int hci_activate_target(struct nfc_dev *nfc_dev,
+                               struct nfc_target *target, u32 protocol)
+{
+        return 0;
+}
+
+static void hci_deactivate_target(struct nfc_dev *nfc_dev,
+                                  struct nfc_target *target)
+{
+}
+
+static int hci_data_exchange(struct nfc_dev *nfc_dev, struct nfc_target *target,
+                             struct sk_buff *skb, data_exchange_cb_t cb,
+                             void *cb_context)
+{
+        struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
+        int r;
+        struct sk_buff *res_skb = NULL;
+
+        pr_debug("target_idx=%d\n", target->idx);
+
+        switch (target->hci_reader_gate) {
+        case NFC_HCI_RF_READER_A_GATE:
+        case NFC_HCI_RF_READER_B_GATE:
+                if (hdev->ops->data_exchange) {
+                        r = hdev->ops->data_exchange(hdev, target, skb,
+                                                     &res_skb);
+                        if (r <= 0)     /* handled */
+                                break;
+                }
+
+                *skb_push(skb, 1) = 0;  /* CTR, see spec:10.2.2.1 */
+                r = nfc_hci_send_cmd(hdev, target->hci_reader_gate,
+                                     NFC_HCI_WR_XCHG_DATA,
+                                     skb->data, skb->len, &res_skb);
+                /*
+                 * TODO: Check RF Error indicator to make sure data is valid.
+                 * It seems that HCI cmd can complete without error, but data
+                 * can be invalid if an RF error occured? Ignore for now.
+                 */
+                if (r == 0)
+                        skb_trim(res_skb, res_skb->len - 1); /* RF Err ind */
+                break;
+        default:
+                if (hdev->ops->data_exchange) {
+                        r = hdev->ops->data_exchange(hdev, target, skb,
+                                                     &res_skb);
+                        if (r == 1)
+                                r = -ENOTSUPP;
+                }
+                else
+                        r = -ENOTSUPP;
+        }
+
+        kfree_skb(skb);
+
+        cb(cb_context, res_skb, r);
+
+        return 0;
+}
+
+static int hci_check_presence(struct nfc_dev *nfc_dev,
+                              struct nfc_target *target)
+{
+        struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
+
+        if (hdev->ops->check_presence)
+                return hdev->ops->check_presence(hdev, target);
+
+        return 0;
+}
+
+static struct nfc_ops hci_nfc_ops = {
+        .dev_up = hci_dev_up,
+        .dev_down = hci_dev_down,
+        .start_poll = hci_start_poll,
+        .stop_poll = hci_stop_poll,
+        .activate_target = hci_activate_target,
+        .deactivate_target = hci_deactivate_target,
+        .data_exchange = hci_data_exchange,
+        .check_presence = hci_check_presence,
+};
+
+struct nfc_hci_dev *nfc_hci_allocate_device(struct nfc_hci_ops *ops,
+                                            struct nfc_hci_init_data *init_data,
+                                            u32 protocols,
+                                            int tx_headroom,
+                                            int tx_tailroom,
+                                            int max_link_payload)
+{
+        struct nfc_hci_dev *hdev;
+
+        if (ops->xmit == NULL)
+                return NULL;
+
+        if (protocols == 0)
+                return NULL;
+
+        hdev = kzalloc(sizeof(struct nfc_hci_dev), GFP_KERNEL);
+        if (hdev == NULL)
+                return NULL;
+
+        hdev->ndev = nfc_allocate_device(&hci_nfc_ops, protocols,
+                                         tx_headroom + HCI_CMDS_HEADROOM,
+                                         tx_tailroom);
+        if (!hdev->ndev) {
+                kfree(hdev);
+                return NULL;
+        }
+
+        hdev->ops = ops;
+        hdev->max_data_link_payload = max_link_payload;
+        hdev->init_data = *init_data;
+
+        nfc_set_drvdata(hdev->ndev, hdev);
+
+        memset(hdev->gate2pipe, NFC_HCI_INVALID_PIPE, sizeof(hdev->gate2pipe));
+
+        return hdev;
+}
+EXPORT_SYMBOL(nfc_hci_allocate_device);
+
+void nfc_hci_free_device(struct nfc_hci_dev *hdev)
+{
+        nfc_free_device(hdev->ndev);
+        kfree(hdev);
+}
+EXPORT_SYMBOL(nfc_hci_free_device);
+
+int nfc_hci_register_device(struct nfc_hci_dev *hdev)
+{
+        struct device *dev = &hdev->ndev->dev;
+        const char *devname = dev_name(dev);
+        char name[32];
+        int r = 0;
+
+        mutex_init(&hdev->msg_tx_mutex);
+
+        INIT_LIST_HEAD(&hdev->msg_tx_queue);
+
+        INIT_WORK(&hdev->msg_tx_work, nfc_hci_msg_tx_work);
+        snprintf(name, sizeof(name), "%s_hci_msg_tx_wq", devname);
+        hdev->msg_tx_wq = alloc_workqueue(name, WQ_NON_REENTRANT | WQ_UNBOUND |
+                                          WQ_MEM_RECLAIM, 1);
+        if (hdev->msg_tx_wq == NULL) {
+                r = -ENOMEM;
+                goto exit;
+        }
+
+        init_timer(&hdev->cmd_timer);
+        hdev->cmd_timer.data = (unsigned long)hdev;
+        hdev->cmd_timer.function = nfc_hci_cmd_timeout;
+
+        skb_queue_head_init(&hdev->rx_hcp_frags);
+
+        INIT_WORK(&hdev->msg_rx_work, nfc_hci_msg_rx_work);
+        snprintf(name, sizeof(name), "%s_hci_msg_rx_wq", devname);
+        hdev->msg_rx_wq = alloc_workqueue(name, WQ_NON_REENTRANT | WQ_UNBOUND |
+                                          WQ_MEM_RECLAIM, 1);
+        if (hdev->msg_rx_wq == NULL) {
+                r = -ENOMEM;
+                goto exit;
+        }
+
+        skb_queue_head_init(&hdev->msg_rx_queue);
+
+        r = nfc_register_device(hdev->ndev);
+
+exit:
+        if (r < 0) {
+                if (hdev->msg_tx_wq)
+                        destroy_workqueue(hdev->msg_tx_wq);
+                if (hdev->msg_rx_wq)
+                        destroy_workqueue(hdev->msg_rx_wq);
+        }
+
+        return r;
+}
+EXPORT_SYMBOL(nfc_hci_register_device);
+
+void nfc_hci_unregister_device(struct nfc_hci_dev *hdev)
+{
+        struct hci_msg *msg;
+
+        skb_queue_purge(&hdev->rx_hcp_frags);
+        skb_queue_purge(&hdev->msg_rx_queue);
+
+        while ((msg = list_first_entry(&hdev->msg_tx_queue, struct hci_msg,
+                                       msg_l)) != NULL) {
+                list_del(&msg->msg_l);
+                skb_queue_purge(&msg->msg_frags);
+                kfree(msg);
+        }
+
+        del_timer_sync(&hdev->cmd_timer);
+
+        nfc_unregister_device(hdev->ndev);
+
+        destroy_workqueue(hdev->msg_tx_wq);
+
+        destroy_workqueue(hdev->msg_rx_wq);
+}
+EXPORT_SYMBOL(nfc_hci_unregister_device);
+
+void nfc_hci_set_clientdata(struct nfc_hci_dev *hdev, void *clientdata)
+{
+        hdev->clientdata = clientdata;
+}
+EXPORT_SYMBOL(nfc_hci_set_clientdata);
+
+void *nfc_hci_get_clientdata(struct nfc_hci_dev *hdev)
+{
+        return hdev->clientdata;
+}
+EXPORT_SYMBOL(nfc_hci_get_clientdata);
+
+void nfc_hci_recv_frame(struct nfc_hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hcp_packet *packet;
+        u8 type;
+        u8 instruction;
+        struct sk_buff *hcp_skb;
+        u8 pipe;
+        struct sk_buff *frag_skb;
+        int msg_len;
+
+        if (skb == NULL) {
+                /* TODO ELa: lower layer had permanent failure, need to
+                 * propagate that up
+                 */
+
+                skb_queue_purge(&hdev->rx_hcp_frags);
+
+                return;
+        }
+
+        packet = (struct hcp_packet *)skb->data;
+        if ((packet->header & ~NFC_HCI_FRAGMENT) == 0) {
+                skb_queue_tail(&hdev->rx_hcp_frags, skb);
+                return;
+        }
+
+        /* it's the last fragment. Does it need re-aggregation? */
+        if (skb_queue_len(&hdev->rx_hcp_frags)) {
+                pipe = packet->header & NFC_HCI_FRAGMENT;
+                skb_queue_tail(&hdev->rx_hcp_frags, skb);
+
+                msg_len = 0;
+                skb_queue_walk(&hdev->rx_hcp_frags, frag_skb) {
+                        msg_len += (frag_skb->len -
+                                    NFC_HCI_HCP_PACKET_HEADER_LEN);
+                }
+
+                hcp_skb = nfc_alloc_recv_skb(NFC_HCI_HCP_PACKET_HEADER_LEN +
+                                             msg_len, GFP_KERNEL);
+                if (hcp_skb == NULL) {
+                        /* TODO ELa: cannot deliver HCP message. How to
+                         * propagate error up?
+                         */
+                }
+
+                *skb_put(hcp_skb, NFC_HCI_HCP_PACKET_HEADER_LEN) = pipe;
+
+                skb_queue_walk(&hdev->rx_hcp_frags, frag_skb) {
+                        msg_len = frag_skb->len - NFC_HCI_HCP_PACKET_HEADER_LEN;
+                        memcpy(skb_put(hcp_skb, msg_len),
+                               frag_skb->data + NFC_HCI_HCP_PACKET_HEADER_LEN,
+                               msg_len);
+                }
+
+                skb_queue_purge(&hdev->rx_hcp_frags);
+        } else {
+                packet->header &= NFC_HCI_FRAGMENT;
+                hcp_skb = skb;
+        }
+
+        /* if this is a response, dispatch immediately to
+         * unblock waiting cmd context. Otherwise, enqueue to dispatch
+         * in separate context where handler can also execute command.
+         */
+        packet = (struct hcp_packet *)hcp_skb->data;
+        type = HCP_MSG_GET_TYPE(packet->message.header);
+        if (type == NFC_HCI_HCP_RESPONSE) {
+                pipe = packet->header;
+                instruction = HCP_MSG_GET_CMD(packet->message.header);
+                skb_pull(hcp_skb, NFC_HCI_HCP_PACKET_HEADER_LEN +
+                         NFC_HCI_HCP_MESSAGE_HEADER_LEN);
+                nfc_hci_hcp_message_rx(hdev, pipe, type, instruction, hcp_skb);
+        } else {
+                skb_queue_tail(&hdev->msg_rx_queue, hcp_skb);
+                queue_work(hdev->msg_rx_wq, &hdev->msg_rx_work);
+        }
+}
+EXPORT_SYMBOL(nfc_hci_recv_frame);
+
+MODULE_LICENSE("GPL");
diff --git a/net/nfc/hci/hci.h b/net/nfc/hci/hci.h
new file mode 100644
index 000000000000..45f2fe4fd486
--- /dev/null
+++ b/net/nfc/hci/hci.h
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2012  Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the
+ * Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#ifndef __LOCAL_HCI_H
+#define __LOCAL_HCI_H
+
+struct gate_pipe_map {
+        u8 gate;
+        u8 pipe;
+};
+
+struct hcp_message {
+        u8 header;              /* type -cmd,evt,rsp- + instruction */
+        u8 data[];
+} __packed;
+
+struct hcp_packet {
+        u8 header;              /* cbit+pipe */
+        struct hcp_message message;
+} __packed;
+
+/*
+ * HCI command execution completion callback.
+ * result will be one of the HCI response codes.
+ * skb contains the response data and must be disposed.
+ */
+typedef void (*hci_cmd_cb_t) (struct nfc_hci_dev *hdev, u8 result,
+                              struct sk_buff *skb, void *cb_data);
+
+struct hcp_exec_waiter {
+        wait_queue_head_t *wq;
+        bool exec_complete;
+        int exec_result;
+        struct sk_buff *result_skb;
+};
+
+struct hci_msg {
+        struct list_head msg_l;
+        struct sk_buff_head msg_frags;
+        bool wait_response;
+        hci_cmd_cb_t cb;
+        void *cb_context;
+        unsigned long completion_delay;
+};
+
+struct hci_create_pipe_params {
+        u8 src_gate;
+        u8 dest_host;
+        u8 dest_gate;
+} __packed;
+
+struct hci_create_pipe_resp {
+        u8 src_host;
+        u8 src_gate;
+        u8 dest_host;
+        u8 dest_gate;
+        u8 pipe;
+} __packed;
+
+#define NFC_HCI_FRAGMENT        0x7f
+
+#define HCP_HEADER(type, instr) ((((type) & 0x03) << 6) | ((instr) & 0x3f))
+#define HCP_MSG_GET_TYPE(header) ((header & 0xc0) >> 6)
+#define HCP_MSG_GET_CMD(header) (header & 0x3f)
+
+int nfc_hci_hcp_message_tx(struct nfc_hci_dev *hdev, u8 pipe,
+                           u8 type, u8 instruction,
+                           const u8 *payload, size_t payload_len,
+                           hci_cmd_cb_t cb, void *cb_data,
+                           unsigned long completion_delay);
+
+u8 nfc_hci_pipe2gate(struct nfc_hci_dev *hdev, u8 pipe);
+
+void nfc_hci_hcp_message_rx(struct nfc_hci_dev *hdev, u8 pipe, u8 type,
+                            u8 instruction, struct sk_buff *skb);
+
+/* HCP headers */
+#define NFC_HCI_HCP_PACKET_HEADER_LEN   1
+#define NFC_HCI_HCP_MESSAGE_HEADER_LEN  1
+#define NFC_HCI_HCP_HEADER_LEN          2
+
+/* HCP types */
+#define NFC_HCI_HCP_COMMAND     0x00
+#define NFC_HCI_HCP_EVENT       0x01
+#define NFC_HCI_HCP_RESPONSE    0x02
+
+/* Generic commands */
+#define NFC_HCI_ANY_SET_PARAMETER       0x01
+#define NFC_HCI_ANY_GET_PARAMETER       0x02
+#define NFC_HCI_ANY_OPEN_PIPE           0x03
+#define NFC_HCI_ANY_CLOSE_PIPE          0x04
+
+/* Reader RF commands */
+#define NFC_HCI_WR_XCHG_DATA            0x10
+
+/* Admin commands */
+#define NFC_HCI_ADM_CREATE_PIPE                 0x10
+#define NFC_HCI_ADM_DELETE_PIPE                 0x11
+#define NFC_HCI_ADM_NOTIFY_PIPE_CREATED         0x12
+#define NFC_HCI_ADM_NOTIFY_PIPE_DELETED         0x13
+#define NFC_HCI_ADM_CLEAR_ALL_PIPE              0x14
+#define NFC_HCI_ADM_NOTIFY_ALL_PIPE_CLEARED     0x15
+
+/* Generic responses */
+#define NFC_HCI_ANY_OK                          0x00
+#define NFC_HCI_ANY_E_NOT_CONNECTED             0x01
+#define NFC_HCI_ANY_E_CMD_PAR_UNKNOWN           0x02
+#define NFC_HCI_ANY_E_NOK                       0x03
+#define NFC_HCI_ANY_E_PIPES_FULL                0x04
+#define NFC_HCI_ANY_E_REG_PAR_UNKNOWN           0x05
+#define NFC_HCI_ANY_E_PIPE_NOT_OPENED           0x06
+#define NFC_HCI_ANY_E_CMD_NOT_SUPPORTED         0x07
+#define NFC_HCI_ANY_E_INHIBITED                 0x08
+#define NFC_HCI_ANY_E_TIMEOUT                   0x09
+#define NFC_HCI_ANY_E_REG_ACCESS_DENIED         0x0a
+#define NFC_HCI_ANY_E_PIPE_ACCESS_DENIED        0x0b
+
+/* Pipes */
+#define NFC_HCI_INVALID_PIPE    0x80
+#define NFC_HCI_LINK_MGMT_PIPE  0x00
+#define NFC_HCI_ADMIN_PIPE      0x01
+
+#endif /* __LOCAL_HCI_H */
diff --git a/net/nfc/hci/hcp.c b/net/nfc/hci/hcp.c
new file mode 100644
index 000000000000..7212cf2c5785
--- /dev/null
+++ b/net/nfc/hci/hcp.c
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2012  Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the
+ * Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#define pr_fmt(fmt) "hci: %s: " fmt, __func__
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+
+#include <net/nfc/hci.h>
+
+#include "hci.h"
+
+/*
+ * Payload is the HCP message data only. Instruction will be prepended.
+ * Guarantees that cb will be called upon completion or timeout delay
+ * counted from the moment the cmd is sent to the transport.
+ */
+int nfc_hci_hcp_message_tx(struct nfc_hci_dev *hdev, u8 pipe,
+                           u8 type, u8 instruction,
+                           const u8 *payload, size_t payload_len,
+                           hci_cmd_cb_t cb, void *cb_data,
+                           unsigned long completion_delay)
+{
+        struct nfc_dev *ndev = hdev->ndev;
+        struct hci_msg *cmd;
+        const u8 *ptr = payload;
+        int hci_len, err;
+        bool firstfrag = true;
+
+        cmd = kzalloc(sizeof(struct hci_msg), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+
+        INIT_LIST_HEAD(&cmd->msg_l);
+        skb_queue_head_init(&cmd->msg_frags);
+        cmd->wait_response = (type == NFC_HCI_HCP_COMMAND) ? true : false;
+        cmd->cb = cb;
+        cmd->cb_context = cb_data;
+        cmd->completion_delay = completion_delay;
+
+        hci_len = payload_len + 1;
+        while (hci_len > 0) {
+                struct sk_buff *skb;
+                int skb_len, data_link_len;
+                struct hcp_packet *packet;
+
+                if (NFC_HCI_HCP_PACKET_HEADER_LEN + hci_len <=
+                    hdev->max_data_link_payload)
+                        data_link_len = hci_len;
+                else
+                        data_link_len = hdev->max_data_link_payload -
+                                        NFC_HCI_HCP_PACKET_HEADER_LEN;
+
+                skb_len = ndev->tx_headroom + NFC_HCI_HCP_PACKET_HEADER_LEN +
+                          data_link_len + ndev->tx_tailroom;
+                hci_len -= data_link_len;
+
+                skb = alloc_skb(skb_len, GFP_KERNEL);
+                if (skb == NULL) {
+                        err = -ENOMEM;
+                        goto out_skb_err;
+                }
+                skb_reserve(skb, ndev->tx_headroom);
+
+                skb_put(skb, NFC_HCI_HCP_PACKET_HEADER_LEN + data_link_len);
+
+                /* Only the last fragment will have the cb bit set to 1 */
+                packet = (struct hcp_packet *)skb->data;
+                packet->header = pipe;
+                if (firstfrag) {
+                        firstfrag = false;
+                        packet->message.header = HCP_HEADER(type, instruction);
+                        if (ptr) {
+                                memcpy(packet->message.data, ptr,
+                                       data_link_len - 1);
+                                ptr += data_link_len - 1;
+                        }
+                } else {
+                        memcpy(&packet->message, ptr, data_link_len);
+                        ptr += data_link_len;
+                }
+
+                /* This is the last fragment, set the cb bit */
+                if (hci_len == 0)
+                        packet->header |= ~NFC_HCI_FRAGMENT;
+
+                skb_queue_tail(&cmd->msg_frags, skb);
+        }
+
+        mutex_lock(&hdev->msg_tx_mutex);
+        list_add_tail(&hdev->msg_tx_queue, &cmd->msg_l);
+        mutex_unlock(&hdev->msg_tx_mutex);
+
+        queue_work(hdev->msg_tx_wq, &hdev->msg_tx_work);
+
+        return 0;
+
+out_skb_err:
+        skb_queue_purge(&cmd->msg_frags);
+        kfree(cmd);
+
+        return err;
+}
+
+u8 nfc_hci_pipe2gate(struct nfc_hci_dev *hdev, u8 pipe)
+{
+        int gate;
+
+        for (gate = 0; gate < NFC_HCI_MAX_GATES; gate++)
+                if (hdev->gate2pipe[gate] == pipe)
+                        return gate;
+
+        return 0xff;
+}
+
+/*
+ * Receive hcp message for pipe, with type and cmd.
+ * skb contains optional message data only.
+ */
+void nfc_hci_hcp_message_rx(struct nfc_hci_dev *hdev, u8 pipe, u8 type,
+                            u8 instruction, struct sk_buff *skb)
+{
+        switch (type) {
+        case NFC_HCI_HCP_RESPONSE:
+                nfc_hci_resp_received(hdev, instruction, skb);
+                break;
+        case NFC_HCI_HCP_COMMAND:
+                nfc_hci_cmd_received(hdev, pipe, instruction, skb);
+                break;
+        case NFC_HCI_HCP_EVENT:
+                nfc_hci_event_received(hdev, pipe, instruction, skb);
+                break;
+        default:
+                pr_err("UNKNOWN MSG Type %d, instruction=%d\n",
+                       type, instruction);
+                kfree_skb(skb);
+                break;
+        }
+}
diff --git a/net/nfc/hci/shdlc.c b/net/nfc/hci/shdlc.c
new file mode 100644
index 000000000000..5665dc6d893a
--- /dev/null
+++ b/net/nfc/hci/shdlc.c
@@ -0,0 +1,957 @@
+/*
+ * Copyright (C) 2012  Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the
+ * Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#define pr_fmt(fmt) "shdlc: %s: " fmt, __func__
+
+#include <linux/sched.h>
+#include <linux/export.h>
+#include <linux/wait.h>
+#include <linux/crc-ccitt.h>
+#include <linux/slab.h>
+#include <linux/skbuff.h>
+
+#include <net/nfc/hci.h>
+#include <net/nfc/shdlc.h>
+
+#define SHDLC_LLC_HEAD_ROOM     2
+#define SHDLC_LLC_TAIL_ROOM     2
+
+#define SHDLC_MAX_WINDOW        4
+#define SHDLC_SREJ_SUPPORT      false
+
+#define SHDLC_CONTROL_HEAD_MASK 0xe0
+#define SHDLC_CONTROL_HEAD_I    0x80
+#define SHDLC_CONTROL_HEAD_I2   0xa0
+#define SHDLC_CONTROL_HEAD_S    0xc0
+#define SHDLC_CONTROL_HEAD_U    0xe0
+
+#define SHDLC_CONTROL_NS_MASK   0x38
+#define SHDLC_CONTROL_NR_MASK   0x07
+#define SHDLC_CONTROL_TYPE_MASK 0x18
+
+#define SHDLC_CONTROL_M_MASK    0x1f
+
+enum sframe_type {
+        S_FRAME_RR = 0x00,
+        S_FRAME_REJ = 0x01,
+        S_FRAME_RNR = 0x02,
+        S_FRAME_SREJ = 0x03
+};
+
+enum uframe_modifier {
+        U_FRAME_UA = 0x06,
+        U_FRAME_RSET = 0x19
+};
+
+#define SHDLC_CONNECT_VALUE_MS  5
+#define SHDLC_T1_VALUE_MS(w)    ((5 * w) / 4)
+#define SHDLC_T2_VALUE_MS       300
+
+#define SHDLC_DUMP_SKB(info, skb)                                 \
+do {                                                              \
+        pr_debug("%s:\n", info);                                  \
+        print_hex_dump(KERN_DEBUG, "shdlc: ", DUMP_PREFIX_OFFSET, \
+                       16, 1, skb->data, skb->len, 0);            \
+} while (0)
+
+/* checks x < y <= z modulo 8 */
+static bool nfc_shdlc_x_lt_y_lteq_z(int x, int y, int z)
+{
+        if (x < z)
+                return ((x < y) && (y <= z)) ? true : false;
+        else
+                return ((y > x) || (y <= z)) ? true : false;
+}
+
+/* checks x <= y < z modulo 8 */
+static bool nfc_shdlc_x_lteq_y_lt_z(int x, int y, int z)
+{
+        if (x <= z)
+                return ((x <= y) && (y < z)) ? true : false;
+        else                    /* x > z -> z+8 > x */
+                return ((y >= x) || (y < z)) ? true : false;
+}
+
+static struct sk_buff *nfc_shdlc_alloc_skb(struct nfc_shdlc *shdlc,
+                                           int payload_len)
+{
+        struct sk_buff *skb;
+
+        skb = alloc_skb(shdlc->client_headroom + SHDLC_LLC_HEAD_ROOM +
+                        shdlc->client_tailroom + SHDLC_LLC_TAIL_ROOM +
+                        payload_len, GFP_KERNEL);
+        if (skb)
+                skb_reserve(skb, shdlc->client_headroom + SHDLC_LLC_HEAD_ROOM);
+
+        return skb;
+}
+
+static void nfc_shdlc_add_len_crc(struct sk_buff *skb)
+{
+        u16 crc;
+        int len;
+
+        len = skb->len + 2;
+        *skb_push(skb, 1) = len;
+
+        crc = crc_ccitt(0xffff, skb->data, skb->len);
+        crc = ~crc;
+        *skb_put(skb, 1) = crc & 0xff;
+        *skb_put(skb, 1) = crc >> 8;
+}
+
+/* immediately sends an S frame. */
+static int nfc_shdlc_send_s_frame(struct nfc_shdlc *shdlc,
+                                  enum sframe_type sframe_type, int nr)
+{
+        int r;
+        struct sk_buff *skb;
+
+        pr_debug("sframe_type=%d nr=%d\n", sframe_type, nr);
+
+        skb = nfc_shdlc_alloc_skb(shdlc, 0);
+        if (skb == NULL)
+                return -ENOMEM;
+
+        *skb_push(skb, 1) = SHDLC_CONTROL_HEAD_S | (sframe_type << 3) | nr;
+
+        nfc_shdlc_add_len_crc(skb);
+
+        r = shdlc->ops->xmit(shdlc, skb);
+
+        kfree_skb(skb);
+
+        return r;
+}
+
+/* immediately sends an U frame. skb may contain optional payload */
+static int nfc_shdlc_send_u_frame(struct nfc_shdlc *shdlc,
+                                  struct sk_buff *skb,
+                                  enum uframe_modifier uframe_modifier)
+{
+        int r;
+
+        pr_debug("uframe_modifier=%d\n", uframe_modifier);
+
+        *skb_push(skb, 1) = SHDLC_CONTROL_HEAD_U | uframe_modifier;
+
+        nfc_shdlc_add_len_crc(skb);
+
+        r = shdlc->ops->xmit(shdlc, skb);
+
+        kfree_skb(skb);
+
+        return r;
+}
+
+/*
+ * Free ack_pending frames until y_nr - 1, and reset t2 according to
+ * the remaining oldest ack_pending frame sent time
+ */
+static void nfc_shdlc_reset_t2(struct nfc_shdlc *shdlc, int y_nr)
+{
+        struct sk_buff *skb;
+        int dnr = shdlc->dnr;   /* MUST initially be < y_nr */
+
+        pr_debug("release ack pending up to frame %d excluded\n", y_nr);
+
+        while (dnr != y_nr) {
+                pr_debug("release ack pending frame %d\n", dnr);
+
+                skb = skb_dequeue(&shdlc->ack_pending_q);
+                kfree_skb(skb);
+
+                dnr = (dnr + 1) % 8;
+        }
+
+        if (skb_queue_empty(&shdlc->ack_pending_q)) {
+                if (shdlc->t2_active) {
+                        del_timer_sync(&shdlc->t2_timer);
+                        shdlc->t2_active = false;
+
+                        pr_debug
+                            ("All sent frames acked. Stopped T2(retransmit)\n");
+                }
+        } else {
+                skb = skb_peek(&shdlc->ack_pending_q);
+
+                mod_timer(&shdlc->t2_timer, *(unsigned long *)skb->cb +
+                          msecs_to_jiffies(SHDLC_T2_VALUE_MS));
+                shdlc->t2_active = true;
+
+                pr_debug
+                    ("Start T2(retransmit) for remaining unacked sent frames\n");
+        }
+}
+
+/*
+ * Receive validated frames from lower layer. skb contains HCI payload only.
+ * Handle according to algorithm at spec:10.8.2
+ */
+static void nfc_shdlc_rcv_i_frame(struct nfc_shdlc *shdlc,
+                                  struct sk_buff *skb, int ns, int nr)
+{
+        int x_ns = ns;
+        int y_nr = nr;
+
+        pr_debug("recvd I-frame %d, remote waiting frame %d\n", ns, nr);
+
+        if (shdlc->state != SHDLC_CONNECTED)
+                goto exit;
+
+        if (x_ns != shdlc->nr) {
+                nfc_shdlc_send_s_frame(shdlc, S_FRAME_REJ, shdlc->nr);
+                goto exit;
+        }
+
+        if (shdlc->t1_active == false) {
+                shdlc->t1_active = true;
+                mod_timer(&shdlc->t1_timer,
+                          msecs_to_jiffies(SHDLC_T1_VALUE_MS(shdlc->w)));
+                pr_debug("(re)Start T1(send ack)\n");
+        }
+
+        if (skb->len) {
+                nfc_hci_recv_frame(shdlc->hdev, skb);
+                skb = NULL;
+        }
+
+        shdlc->nr = (shdlc->nr + 1) % 8;
+
+        if (nfc_shdlc_x_lt_y_lteq_z(shdlc->dnr, y_nr, shdlc->ns)) {
+                nfc_shdlc_reset_t2(shdlc, y_nr);
+
+                shdlc->dnr = y_nr;
+        }
+
+exit:
+        if (skb)
+                kfree_skb(skb);
+}
+
+static void nfc_shdlc_rcv_ack(struct nfc_shdlc *shdlc, int y_nr)
+{
+        pr_debug("remote acked up to frame %d excluded\n", y_nr);
+
+        if (nfc_shdlc_x_lt_y_lteq_z(shdlc->dnr, y_nr, shdlc->ns)) {
+                nfc_shdlc_reset_t2(shdlc, y_nr);
+                shdlc->dnr = y_nr;
+        }
+}
+
+static void nfc_shdlc_requeue_ack_pending(struct nfc_shdlc *shdlc)
+{
+        struct sk_buff *skb;
+
+        pr_debug("ns reset to %d\n", shdlc->dnr);
+
+        while ((skb = skb_dequeue_tail(&shdlc->ack_pending_q))) {
+                skb_pull(skb, 2);       /* remove len+control */
+                skb_trim(skb, skb->len - 2);    /* remove crc */
+                skb_queue_head(&shdlc->send_q, skb);
+        }
+        shdlc->ns = shdlc->dnr;
+}
+
+static void nfc_shdlc_rcv_rej(struct nfc_shdlc *shdlc, int y_nr)
+{
+        struct sk_buff *skb;
+
+        pr_debug("remote asks retransmition from frame %d\n", y_nr);
+
+        if (nfc_shdlc_x_lteq_y_lt_z(shdlc->dnr, y_nr, shdlc->ns)) {
+                if (shdlc->t2_active) {
+                        del_timer_sync(&shdlc->t2_timer);
+                        shdlc->t2_active = false;
+                        pr_debug("Stopped T2(retransmit)\n");
+                }
+
+                if (shdlc->dnr != y_nr) {
+                        while ((shdlc->dnr = ((shdlc->dnr + 1) % 8)) != y_nr) {
+                                skb = skb_dequeue(&shdlc->ack_pending_q);
+                                kfree_skb(skb);
+                        }
+                }
+
+                nfc_shdlc_requeue_ack_pending(shdlc);
+        }
+}
+
+/* See spec RR:10.8.3 REJ:10.8.4 */
+static void nfc_shdlc_rcv_s_frame(struct nfc_shdlc *shdlc,
+                                  enum sframe_type s_frame_type, int nr)
+{
+        struct sk_buff *skb;
+
+        if (shdlc->state != SHDLC_CONNECTED)
+                return;
+
+        switch (s_frame_type) {
+        case S_FRAME_RR:
+                nfc_shdlc_rcv_ack(shdlc, nr);
+                if (shdlc->rnr == true) {       /* see SHDLC 10.7.7 */
+                        shdlc->rnr = false;
+                        if (shdlc->send_q.qlen == 0) {
+                                skb = nfc_shdlc_alloc_skb(shdlc, 0);
+                                if (skb)
+                                        skb_queue_tail(&shdlc->send_q, skb);
+                        }
+                }
+                break;
+        case S_FRAME_REJ:
+                nfc_shdlc_rcv_rej(shdlc, nr);
+                break;
+        case S_FRAME_RNR:
+                nfc_shdlc_rcv_ack(shdlc, nr);
+                shdlc->rnr = true;
+                break;
+        default:
+                break;
+        }
+}
+
+static void nfc_shdlc_connect_complete(struct nfc_shdlc *shdlc, int r)
+{
+        pr_debug("result=%d\n", r);
+
+        del_timer_sync(&shdlc->connect_timer);
+
+        if (r == 0) {
+                shdlc->ns = 0;
+                shdlc->nr = 0;
+                shdlc->dnr = 0;
+
+                shdlc->state = SHDLC_CONNECTED;
+        } else {
+                shdlc->state = SHDLC_DISCONNECTED;
+
+                /*
+                 * TODO: Could it be possible that there are pending
+                 * executing commands that are waiting for connect to complete
+                 * before they can be carried? As connect is a blocking
+                 * operation, it would require that the userspace process can
+                 * send commands on the same device from a second thread before
+                 * the device is up. I don't think that is possible, is it?
+                 */
+        }
+
+        shdlc->connect_result = r;
+
+        wake_up(shdlc->connect_wq);
+}
+
+static int nfc_shdlc_connect_initiate(struct nfc_shdlc *shdlc)
+{
+        struct sk_buff *skb;
+
+        pr_debug("\n");
+
+        skb = nfc_shdlc_alloc_skb(shdlc, 2);
+        if (skb == NULL)
+                return -ENOMEM;
+
+        *skb_put(skb, 1) = SHDLC_MAX_WINDOW;
+        *skb_put(skb, 1) = SHDLC_SREJ_SUPPORT ? 1 : 0;
+
+        return nfc_shdlc_send_u_frame(shdlc, skb, U_FRAME_RSET);
+}
+
+static int nfc_shdlc_connect_send_ua(struct nfc_shdlc *shdlc)
+{
+        struct sk_buff *skb;
+
+        pr_debug("\n");
+
+        skb = nfc_shdlc_alloc_skb(shdlc, 0);
+        if (skb == NULL)
+                return -ENOMEM;
+
+        return nfc_shdlc_send_u_frame(shdlc, skb, U_FRAME_UA);
+}
+
+static void nfc_shdlc_rcv_u_frame(struct nfc_shdlc *shdlc,
+                                  struct sk_buff *skb,
+                                  enum uframe_modifier u_frame_modifier)
+{
+        u8 w = SHDLC_MAX_WINDOW;
+        bool srej_support = SHDLC_SREJ_SUPPORT;
+        int r;
+
+        pr_debug("u_frame_modifier=%d\n", u_frame_modifier);
+
+        switch (u_frame_modifier) {
+        case U_FRAME_RSET:
+                if (shdlc->state == SHDLC_NEGOCIATING) {
+                        /* we sent RSET, but chip wants to negociate */
+                        if (skb->len > 0)
+                                w = skb->data[0];
+
+                        if (skb->len > 1)
+                                srej_support = skb->data[1] & 0x01 ? true :
+                                               false;
+
+                        if ((w <= SHDLC_MAX_WINDOW) &&
+                            (SHDLC_SREJ_SUPPORT || (srej_support == false))) {
+                                shdlc->w = w;
+                                shdlc->srej_support = srej_support;
+                                r = nfc_shdlc_connect_send_ua(shdlc);
+                                nfc_shdlc_connect_complete(shdlc, r);
+                        }
+                } else if (shdlc->state > SHDLC_NEGOCIATING) {
+                        /*
+                         * TODO: Chip wants to reset link
+                         * send ua, empty skb lists, reset counters
+                         * propagate info to HCI layer
+                         */
+                }
+                break;
+        case U_FRAME_UA:
+                if ((shdlc->state == SHDLC_CONNECTING &&
+                     shdlc->connect_tries > 0) ||
+                    (shdlc->state == SHDLC_NEGOCIATING))
+                        nfc_shdlc_connect_complete(shdlc, 0);
+                break;
+        default:
+                break;
+        }
+
+        kfree_skb(skb);
+}
+
+static void nfc_shdlc_handle_rcv_queue(struct nfc_shdlc *shdlc)
+{
+        struct sk_buff *skb;
+        u8 control;
+        int nr;
+        int ns;
+        enum sframe_type s_frame_type;
+        enum uframe_modifier u_frame_modifier;
+
+        if (shdlc->rcv_q.qlen)
+                pr_debug("rcvQlen=%d\n", shdlc->rcv_q.qlen);
+
+        while ((skb = skb_dequeue(&shdlc->rcv_q)) != NULL) {
+                control = skb->data[0];
+                skb_pull(skb, 1);
+                switch (control & SHDLC_CONTROL_HEAD_MASK) {
+                case SHDLC_CONTROL_HEAD_I:
+                case SHDLC_CONTROL_HEAD_I2:
+                        ns = (control & SHDLC_CONTROL_NS_MASK) >> 3;
+                        nr = control & SHDLC_CONTROL_NR_MASK;
+                        nfc_shdlc_rcv_i_frame(shdlc, skb, ns, nr);
+                        break;
+                case SHDLC_CONTROL_HEAD_S:
+                        s_frame_type = (control & SHDLC_CONTROL_TYPE_MASK) >> 3;
+                        nr = control & SHDLC_CONTROL_NR_MASK;
+                        nfc_shdlc_rcv_s_frame(shdlc, s_frame_type, nr);
+                        kfree_skb(skb);
+                        break;
+                case SHDLC_CONTROL_HEAD_U:
+                        u_frame_modifier = control & SHDLC_CONTROL_M_MASK;
+                        nfc_shdlc_rcv_u_frame(shdlc, skb, u_frame_modifier);
+                        break;
+                default:
+                        pr_err("UNKNOWN Control=%d\n", control);
+                        kfree_skb(skb);
+                        break;
+                }
+        }
+}
+
+static int nfc_shdlc_w_used(int ns, int dnr)
+{
+        int unack_count;
+
+        if (dnr <= ns)
+                unack_count = ns - dnr;
+        else
+                unack_count = 8 - dnr + ns;
+
+        return unack_count;
+}
+
+/* Send frames according to algorithm at spec:10.8.1 */
+static void nfc_shdlc_handle_send_queue(struct nfc_shdlc *shdlc)
+{
+        struct sk_buff *skb;
+        int r;
+        unsigned long time_sent;
+
+        if (shdlc->send_q.qlen)
+                pr_debug
+                    ("sendQlen=%d ns=%d dnr=%d rnr=%s w_room=%d unackQlen=%d\n",
+                     shdlc->send_q.qlen, shdlc->ns, shdlc->dnr,
+                     shdlc->rnr == false ? "false" : "true",
+                     shdlc->w - nfc_shdlc_w_used(shdlc->ns, shdlc->dnr),
+                     shdlc->ack_pending_q.qlen);
+
+        while (shdlc->send_q.qlen && shdlc->ack_pending_q.qlen < shdlc->w &&
+               (shdlc->rnr == false)) {
+
+                if (shdlc->t1_active) {
+                        del_timer_sync(&shdlc->t1_timer);
+                        shdlc->t1_active = false;
+                        pr_debug("Stopped T1(send ack)\n");
+                }
+
+                skb = skb_dequeue(&shdlc->send_q);
+
+                *skb_push(skb, 1) = SHDLC_CONTROL_HEAD_I | (shdlc->ns << 3) |
+                                    shdlc->nr;
+
+                pr_debug("Sending I-Frame %d, waiting to rcv %d\n", shdlc->ns,
+                         shdlc->nr);
+        /*      SHDLC_DUMP_SKB("shdlc frame written", skb); */
+
+                nfc_shdlc_add_len_crc(skb);
+
+                r = shdlc->ops->xmit(shdlc, skb);
+                if (r < 0) {
+                        /*
+                         * TODO: Cannot send, shdlc machine is dead, we
+                         * must propagate the information up to HCI.
+                         */
+                        shdlc->hard_fault = r;
+                        break;
+                }
+
+                shdlc->ns = (shdlc->ns + 1) % 8;
+
+                time_sent = jiffies;
+                *(unsigned long *)skb->cb = time_sent;
+
+                skb_queue_tail(&shdlc->ack_pending_q, skb);
+
+                if (shdlc->t2_active == false) {
+                        shdlc->t2_active = true;
+                        mod_timer(&shdlc->t2_timer, time_sent +
+                                  msecs_to_jiffies(SHDLC_T2_VALUE_MS));
+                        pr_debug("Started T2 (retransmit)\n");
+                }
+        }
+}
+
+static void nfc_shdlc_connect_timeout(unsigned long data)
+{
+        struct nfc_shdlc *shdlc = (struct nfc_shdlc *)data;
+
+        pr_debug("\n");
+
+        queue_work(shdlc->sm_wq, &shdlc->sm_work);
+}
+
+static void nfc_shdlc_t1_timeout(unsigned long data)
+{
+        struct nfc_shdlc *shdlc = (struct nfc_shdlc *)data;
+
+        pr_debug("SoftIRQ: need to send ack\n");
+
+        queue_work(shdlc->sm_wq, &shdlc->sm_work);
+}
+
+static void nfc_shdlc_t2_timeout(unsigned long data)
+{
+        struct nfc_shdlc *shdlc = (struct nfc_shdlc *)data;
+
+        pr_debug("SoftIRQ: need to retransmit\n");
+
+        queue_work(shdlc->sm_wq, &shdlc->sm_work);
+}
+
+static void nfc_shdlc_sm_work(struct work_struct *work)
+{
+        struct nfc_shdlc *shdlc = container_of(work, struct nfc_shdlc, sm_work);
+        int r;
+
+        pr_debug("\n");
+
+        mutex_lock(&shdlc->state_mutex);
+
+        switch (shdlc->state) {
+        case SHDLC_DISCONNECTED:
+                skb_queue_purge(&shdlc->rcv_q);
+                skb_queue_purge(&shdlc->send_q);
+                skb_queue_purge(&shdlc->ack_pending_q);
+                break;
+        case SHDLC_CONNECTING:
+                if (shdlc->connect_tries++ < 5)
+                        r = nfc_shdlc_connect_initiate(shdlc);
+                else
+                        r = -ETIME;
+                if (r < 0)
+                        nfc_shdlc_connect_complete(shdlc, r);
+                else {
+                        mod_timer(&shdlc->connect_timer, jiffies +
+                                  msecs_to_jiffies(SHDLC_CONNECT_VALUE_MS));
+
+                        shdlc->state = SHDLC_NEGOCIATING;
+                }
+                break;
+        case SHDLC_NEGOCIATING:
+                if (timer_pending(&shdlc->connect_timer) == 0) {
+                        shdlc->state = SHDLC_CONNECTING;
+                        queue_work(shdlc->sm_wq, &shdlc->sm_work);
+                }
+
+                nfc_shdlc_handle_rcv_queue(shdlc);
+                break;
+        case SHDLC_CONNECTED:
+                nfc_shdlc_handle_rcv_queue(shdlc);
+                nfc_shdlc_handle_send_queue(shdlc);
+
+                if (shdlc->t1_active && timer_pending(&shdlc->t1_timer) == 0) {
+                        pr_debug
+                            ("Handle T1(send ack) elapsed (T1 now inactive)\n");
+
+                        shdlc->t1_active = false;
+                        r = nfc_shdlc_send_s_frame(shdlc, S_FRAME_RR,
+                                                   shdlc->nr);
+                        if (r < 0)
+                                shdlc->hard_fault = r;
+                }
+
+                if (shdlc->t2_active && timer_pending(&shdlc->t2_timer) == 0) {
+                        pr_debug
+                            ("Handle T2(retransmit) elapsed (T2 inactive)\n");
+
+                        shdlc->t2_active = false;
+
+                        nfc_shdlc_requeue_ack_pending(shdlc);
+                        nfc_shdlc_handle_send_queue(shdlc);
+                }
+
+                if (shdlc->hard_fault) {
+                        /*
+                         * TODO: Handle hard_fault that occured during
+                         * this invocation of the shdlc worker
+                         */
+                }
+                break;
+        default:
+                break;
+        }
+        mutex_unlock(&shdlc->state_mutex);
+}
+
+/*
+ * Called from syscall context to establish shdlc link. Sleeps until
+ * link is ready or failure.
+ */
+static int nfc_shdlc_connect(struct nfc_shdlc *shdlc)
+{
+        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(connect_wq);
+
+        pr_debug("\n");
+
+        mutex_lock(&shdlc->state_mutex);
+
+        shdlc->state = SHDLC_CONNECTING;
+        shdlc->connect_wq = &connect_wq;
+        shdlc->connect_tries = 0;
+        shdlc->connect_result = 1;
+
+        mutex_unlock(&shdlc->state_mutex);
+
+        queue_work(shdlc->sm_wq, &shdlc->sm_work);
+
+        wait_event(connect_wq, shdlc->connect_result != 1);
+
+        return shdlc->connect_result;
+}
+
+static void nfc_shdlc_disconnect(struct nfc_shdlc *shdlc)
+{
+        pr_debug("\n");
+
+        mutex_lock(&shdlc->state_mutex);
+
+        shdlc->state = SHDLC_DISCONNECTED;
+
+        mutex_unlock(&shdlc->state_mutex);
+
+        queue_work(shdlc->sm_wq, &shdlc->sm_work);
+}
+
+/*
+ * Receive an incoming shdlc frame. Frame has already been crc-validated.
+ * skb contains only LLC header and payload.
+ * If skb == NULL, it is a notification that the link below is dead.
+ */
+void nfc_shdlc_recv_frame(struct nfc_shdlc *shdlc, struct sk_buff *skb)
+{
+        if (skb == NULL) {
+                pr_err("NULL Frame -> link is dead\n");
+                shdlc->hard_fault = -EREMOTEIO;
+        } else {
+                SHDLC_DUMP_SKB("incoming frame", skb);
+                skb_queue_tail(&shdlc->rcv_q, skb);
+        }
+
+        queue_work(shdlc->sm_wq, &shdlc->sm_work);
+}
+EXPORT_SYMBOL(nfc_shdlc_recv_frame);
+
+static int nfc_shdlc_open(struct nfc_hci_dev *hdev)
+{
+        struct nfc_shdlc *shdlc = nfc_hci_get_clientdata(hdev);
+        int r;
+
+        pr_debug("\n");
+
+        if (shdlc->ops->open) {
+                r = shdlc->ops->open(shdlc);
+                if (r < 0)
+                        return r;
+        }
+
+        r = nfc_shdlc_connect(shdlc);
+        if (r < 0 && shdlc->ops->close)
+                shdlc->ops->close(shdlc);
+
+        return r;
+}
+
+static void nfc_shdlc_close(struct nfc_hci_dev *hdev)
+{
+        struct nfc_shdlc *shdlc = nfc_hci_get_clientdata(hdev);
+
+        pr_debug("\n");
+
+        nfc_shdlc_disconnect(shdlc);
+
+        if (shdlc->ops->close)
+                shdlc->ops->close(shdlc);
+}
+
+static int nfc_shdlc_hci_ready(struct nfc_hci_dev *hdev)
+{
+        struct nfc_shdlc *shdlc = nfc_hci_get_clientdata(hdev);
+        int r = 0;
+
+        pr_debug("\n");
+
+        if (shdlc->ops->hci_ready)
+                r = shdlc->ops->hci_ready(shdlc);
+
+        return r;
+}
+
+static int nfc_shdlc_xmit(struct nfc_hci_dev *hdev, struct sk_buff *skb)
+{
+        struct nfc_shdlc *shdlc = nfc_hci_get_clientdata(hdev);
+
+        SHDLC_DUMP_SKB("queuing HCP packet to shdlc", skb);
+
+        skb_queue_tail(&shdlc->send_q, skb);
+
+        queue_work(shdlc->sm_wq, &shdlc->sm_work);
+
+        return 0;
+}
+
+static int nfc_shdlc_start_poll(struct nfc_hci_dev *hdev, u32 protocols)
+{
+        struct nfc_shdlc *shdlc = nfc_hci_get_clientdata(hdev);
+
+        pr_debug("\n");
+
+        if (shdlc->ops->start_poll)
+                return shdlc->ops->start_poll(shdlc, protocols);
+
+        return 0;
+}
+
+static int nfc_shdlc_target_from_gate(struct nfc_hci_dev *hdev, u8 gate,
+                                      struct nfc_target *target)
+{
+        struct nfc_shdlc *shdlc = nfc_hci_get_clientdata(hdev);
+
+        if (shdlc->ops->target_from_gate)
+                return shdlc->ops->target_from_gate(shdlc, gate, target);
+
+        return -EPERM;
+}
+
+static int nfc_shdlc_complete_target_discovered(struct nfc_hci_dev *hdev,
+                                                u8 gate,
+                                                struct nfc_target *target)
+{
+        struct nfc_shdlc *shdlc = nfc_hci_get_clientdata(hdev);
+
+        pr_debug("\n");
+
+        if (shdlc->ops->complete_target_discovered)
+                return shdlc->ops->complete_target_discovered(shdlc, gate,
+                                                              target);
+
+        return 0;
+}
+
+static int nfc_shdlc_data_exchange(struct nfc_hci_dev *hdev,
+                                   struct nfc_target *target,
+                                   struct sk_buff *skb,
+                                   struct sk_buff **res_skb)
+{
+        struct nfc_shdlc *shdlc = nfc_hci_get_clientdata(hdev);
+
+        if (shdlc->ops->data_exchange)
+                return shdlc->ops->data_exchange(shdlc, target, skb, res_skb);
+
+        return -EPERM;
+}
+
+static int nfc_shdlc_check_presence(struct nfc_hci_dev *hdev,
+                                    struct nfc_target *target)
+{
+        struct nfc_shdlc *shdlc = nfc_hci_get_clientdata(hdev);
+
+        if (shdlc->ops->check_presence)
+                return shdlc->ops->check_presence(shdlc, target);
+
+        return 0;
+}
+
+static struct nfc_hci_ops shdlc_ops = {
+        .open = nfc_shdlc_open,
+        .close = nfc_shdlc_close,
+        .hci_ready = nfc_shdlc_hci_ready,
+        .xmit = nfc_shdlc_xmit,
+        .start_poll = nfc_shdlc_start_poll,
+        .target_from_gate = nfc_shdlc_target_from_gate,
+        .complete_target_discovered = nfc_shdlc_complete_target_discovered,
+        .data_exchange = nfc_shdlc_data_exchange,
+        .check_presence = nfc_shdlc_check_presence,
+};
+
+struct nfc_shdlc *nfc_shdlc_allocate(struct nfc_shdlc_ops *ops,
+                                     struct nfc_hci_init_data *init_data,
+                                     u32 protocols,
+                                     int tx_headroom, int tx_tailroom,
+                                     int max_link_payload, const char *devname)
+{
+        struct nfc_shdlc *shdlc;
+        int r;
+        char name[32];
+
+        if (ops->xmit == NULL)
+                return NULL;
+
+        shdlc = kzalloc(sizeof(struct nfc_shdlc), GFP_KERNEL);
+        if (shdlc == NULL)
+                return NULL;
+
+        mutex_init(&shdlc->state_mutex);
+        shdlc->ops = ops;
+        shdlc->state = SHDLC_DISCONNECTED;
+
+        init_timer(&shdlc->connect_timer);
+        shdlc->connect_timer.data = (unsigned long)shdlc;
+        shdlc->connect_timer.function = nfc_shdlc_connect_timeout;
+
+        init_timer(&shdlc->t1_timer);
+        shdlc->t1_timer.data = (unsigned long)shdlc;
+        shdlc->t1_timer.function = nfc_shdlc_t1_timeout;
+
+        init_timer(&shdlc->t2_timer);
+        shdlc->t2_timer.data = (unsigned long)shdlc;
+        shdlc->t2_timer.function = nfc_shdlc_t2_timeout;
+
+        shdlc->w = SHDLC_MAX_WINDOW;
+        shdlc->srej_support = SHDLC_SREJ_SUPPORT;
+
+        skb_queue_head_init(&shdlc->rcv_q);
+        skb_queue_head_init(&shdlc->send_q);
+        skb_queue_head_init(&shdlc->ack_pending_q);
+
+        INIT_WORK(&shdlc->sm_work, nfc_shdlc_sm_work);
+        snprintf(name, sizeof(name), "%s_shdlc_sm_wq", devname);
+        shdlc->sm_wq = alloc_workqueue(name, WQ_NON_REENTRANT | WQ_UNBOUND |
+                                       WQ_MEM_RECLAIM, 1);
+        if (shdlc->sm_wq == NULL)
+                goto err_allocwq;
+
+        shdlc->client_headroom = tx_headroom;
+        shdlc->client_tailroom = tx_tailroom;
+
+        shdlc->hdev = nfc_hci_allocate_device(&shdlc_ops, init_data, protocols,
+                                              tx_headroom + SHDLC_LLC_HEAD_ROOM,
+                                              tx_tailroom + SHDLC_LLC_TAIL_ROOM,
+                                              max_link_payload);
+        if (shdlc->hdev == NULL)
+                goto err_allocdev;
+
+        nfc_hci_set_clientdata(shdlc->hdev, shdlc);
+
+        r = nfc_hci_register_device(shdlc->hdev);
+        if (r < 0)
+                goto err_regdev;
+
+        return shdlc;
+
+err_regdev:
+        nfc_hci_free_device(shdlc->hdev);
+
+err_allocdev:
+        destroy_workqueue(shdlc->sm_wq);
+
+err_allocwq:
+        kfree(shdlc);
+
+        return NULL;
+}
+EXPORT_SYMBOL(nfc_shdlc_allocate);
+
+void nfc_shdlc_free(struct nfc_shdlc *shdlc)
+{
+        pr_debug("\n");
+
+        /* TODO: Check that this cannot be called while still in use */
+
+        nfc_hci_unregister_device(shdlc->hdev);
+        nfc_hci_free_device(shdlc->hdev);
+
+        destroy_workqueue(shdlc->sm_wq);
+
+        skb_queue_purge(&shdlc->rcv_q);
+        skb_queue_purge(&shdlc->send_q);
+        skb_queue_purge(&shdlc->ack_pending_q);
+
+        kfree(shdlc);
+}
+EXPORT_SYMBOL(nfc_shdlc_free);
+
+void nfc_shdlc_set_clientdata(struct nfc_shdlc *shdlc, void *clientdata)
+{
+        pr_debug("\n");
+
+        shdlc->clientdata = clientdata;
+}
+EXPORT_SYMBOL(nfc_shdlc_set_clientdata);
+
+void *nfc_shdlc_get_clientdata(struct nfc_shdlc *shdlc)
+{
+        return shdlc->clientdata;
+}
+EXPORT_SYMBOL(nfc_shdlc_get_clientdata);
+
+struct nfc_hci_dev *nfc_shdlc_get_hci_dev(struct nfc_shdlc *shdlc)
+{
+        return shdlc->hdev;
+}
+EXPORT_SYMBOL(nfc_shdlc_get_hci_dev);
diff --git a/net/nfc/llcp/commands.c b/net/nfc/llcp/commands.c
index 151f2ef429c4..bf8ae4f0b90c 100644
--- a/net/nfc/llcp/commands.c
+++ b/net/nfc/llcp/commands.c
@@ -102,7 +102,7 @@ u8 *nfc_llcp_build_tlv(u8 type, u8 *value, u8 value_length, u8 *tlv_length)
         length = llcp_tlv_length[type];
         if (length == 0 && value_length == 0)
                 return NULL;
-        else
+        else if (length == 0)
                 length = value_length;
 
         *tlv_length = 2 + length;
@@ -118,7 +118,7 @@ u8 *nfc_llcp_build_tlv(u8 type, u8 *value, u8 value_length, u8 *tlv_length)
 }
 
 int nfc_llcp_parse_tlv(struct nfc_llcp_local *local,
-                        u8 *tlv_array, u16 tlv_array_len)
+                       u8 *tlv_array, u16 tlv_array_len)
 {
         u8 *tlv = tlv_array, type, length, offset = 0;
 
@@ -152,6 +152,8 @@ int nfc_llcp_parse_tlv(struct nfc_llcp_local *local,
                 case LLCP_TLV_RW:
                         local->remote_rw = llcp_tlv_rw(tlv);
                         break;
+                case LLCP_TLV_SN:
+                        break;
                 default:
                         pr_err("Invalid gt tlv value 0x%x\n", type);
                         break;
@@ -162,15 +164,15 @@ int nfc_llcp_parse_tlv(struct nfc_llcp_local *local,
         }
 
         pr_debug("version 0x%x miu %d lto %d opt 0x%x wks 0x%x rw %d\n",
-                local->remote_version, local->remote_miu,
-                local->remote_lto, local->remote_opt,
-                local->remote_wks, local->remote_rw);
+                 local->remote_version, local->remote_miu,
+                 local->remote_lto, local->remote_opt,
+                 local->remote_wks, local->remote_rw);
 
         return 0;
 }
 
 static struct sk_buff *llcp_add_header(struct sk_buff *pdu,
-                                        u8 dsap, u8 ssap, u8 ptype)
+                                       u8 dsap, u8 ssap, u8 ptype)
 {
         u8 header[2];
 
@@ -186,7 +188,8 @@ static struct sk_buff *llcp_add_header(struct sk_buff *pdu,
         return pdu;
 }
 
-static struct sk_buff *llcp_add_tlv(struct sk_buff *pdu, u8 *tlv, u8 tlv_length)
+static struct sk_buff *llcp_add_tlv(struct sk_buff *pdu, u8 *tlv,
+                                    u8 tlv_length)
 {
         /* XXX Add an skb length check */
 
@@ -199,7 +202,7 @@ static struct sk_buff *llcp_add_tlv(struct sk_buff *pdu, u8 *tlv, u8 tlv_length)
 }
 
 static struct sk_buff *llcp_allocate_pdu(struct nfc_llcp_sock *sock,
-                                                        u8 cmd, u16 size)
+                                         u8 cmd, u16 size)
 {
         struct sk_buff *skb;
         int err;
@@ -208,7 +211,7 @@ static struct sk_buff *llcp_allocate_pdu(struct nfc_llcp_sock *sock,
                 return NULL;
 
         skb = nfc_alloc_send_skb(sock->dev, &sock->sk, MSG_DONTWAIT,
-                                        size + LLCP_HEADER_SIZE, &err);
+                                 size + LLCP_HEADER_SIZE, &err);
         if (skb == NULL) {
                 pr_err("Could not allocate PDU\n");
                 return NULL;
@@ -245,7 +248,7 @@ int nfc_llcp_disconnect(struct nfc_llcp_sock *sock)
 
         skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE);
 
-        skb = llcp_add_header(skb, sock->ssap, sock->dsap, LLCP_PDU_DISC);
+        skb = llcp_add_header(skb, sock->dsap, sock->ssap, LLCP_PDU_DISC);
 
         skb_queue_tail(&local->tx_queue, skb);
 
@@ -276,7 +279,7 @@ int nfc_llcp_send_symm(struct nfc_dev *dev)
         skb = llcp_add_header(skb, 0, 0, LLCP_PDU_SYMM);
 
         return nfc_data_exchange(dev, local->target_idx, skb,
-                                        nfc_llcp_recv, local);
+                                 nfc_llcp_recv, local);
 }
 
 int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
@@ -284,6 +287,9 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
         struct nfc_llcp_local *local;
         struct sk_buff *skb;
         u8 *service_name_tlv = NULL, service_name_tlv_length;
+        u8 *miux_tlv = NULL, miux_tlv_length;
+        u8 *rw_tlv = NULL, rw_tlv_length, rw;
+        __be16 miux;
         int err;
         u16 size = 0;
 
@@ -295,12 +301,21 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
 
         if (sock->service_name != NULL) {
                 service_name_tlv = nfc_llcp_build_tlv(LLCP_TLV_SN,
-                                        sock->service_name,
-                                        sock->service_name_len,
-                                        &service_name_tlv_length);
+                                                      sock->service_name,
+                                                      sock->service_name_len,
+                                                      &service_name_tlv_length);
                 size += service_name_tlv_length;
         }
 
+        miux = cpu_to_be16(LLCP_MAX_MIUX);
+        miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0,
+                                      &miux_tlv_length);
+        size += miux_tlv_length;
+
+        rw = LLCP_MAX_RW;
+        rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length);
+        size += rw_tlv_length;
+
         pr_debug("SKB size %d SN length %zu\n", size, sock->service_name_len);
 
         skb = llcp_allocate_pdu(sock, LLCP_PDU_CONNECT, size);
@@ -311,7 +326,10 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
 
         if (service_name_tlv != NULL)
                 skb = llcp_add_tlv(skb, service_name_tlv,
-                                        service_name_tlv_length);
+                                   service_name_tlv_length);
+
+        skb = llcp_add_tlv(skb, miux_tlv, miux_tlv_length);
+        skb = llcp_add_tlv(skb, rw_tlv, rw_tlv_length);
 
         skb_queue_tail(&local->tx_queue, skb);
 
@@ -321,6 +339,8 @@ error_tlv:
         pr_err("error %d\n", err);
 
         kfree(service_name_tlv);
+        kfree(miux_tlv);
+        kfree(rw_tlv);
 
         return err;
 }
@@ -329,6 +349,11 @@ int nfc_llcp_send_cc(struct nfc_llcp_sock *sock)
 {
         struct nfc_llcp_local *local;
         struct sk_buff *skb;
+        u8 *miux_tlv = NULL, miux_tlv_length;
+        u8 *rw_tlv = NULL, rw_tlv_length, rw;
+        __be16 miux;
+        int err;
+        u16 size = 0;
 
         pr_debug("Sending CC\n");
 
@@ -336,13 +361,35 @@ int nfc_llcp_send_cc(struct nfc_llcp_sock *sock)
         if (local == NULL)
                 return -ENODEV;
 
-        skb = llcp_allocate_pdu(sock, LLCP_PDU_CC, 0);
-        if (skb == NULL)
-                return -ENOMEM;
+        miux = cpu_to_be16(LLCP_MAX_MIUX);
+        miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0,
+                                      &miux_tlv_length);
+        size += miux_tlv_length;
+
+        rw = LLCP_MAX_RW;
+        rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length);
+        size += rw_tlv_length;
+
+        skb = llcp_allocate_pdu(sock, LLCP_PDU_CC, size);
+        if (skb == NULL) {
+                err = -ENOMEM;
+                goto error_tlv;
+        }
+
+        skb = llcp_add_tlv(skb, miux_tlv, miux_tlv_length);
+        skb = llcp_add_tlv(skb, rw_tlv, rw_tlv_length);
 
         skb_queue_tail(&local->tx_queue, skb);
 
         return 0;
+
+error_tlv:
+        pr_err("error %d\n", err);
+
+        kfree(miux_tlv);
+        kfree(rw_tlv);
+
+        return err;
 }
 
 int nfc_llcp_send_dm(struct nfc_llcp_local *local, u8 ssap, u8 dsap, u8 reason)
@@ -369,7 +416,7 @@ int nfc_llcp_send_dm(struct nfc_llcp_local *local, u8 ssap, u8 dsap, u8 reason)
 
         skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE);
 
-        skb = llcp_add_header(skb, ssap, dsap, LLCP_PDU_DM);
+        skb = llcp_add_header(skb, dsap, ssap, LLCP_PDU_DM);
 
         memcpy(skb_put(skb, 1), &reason, 1);
 
@@ -397,3 +444,87 @@ int nfc_llcp_send_disconnect(struct nfc_llcp_sock *sock)
 
         return 0;
 }
+
+int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
+                          struct msghdr *msg, size_t len)
+{
+        struct sk_buff *pdu;
+        struct sock *sk = &sock->sk;
+        struct nfc_llcp_local *local;
+        size_t frag_len = 0, remaining_len;
+        u8 *msg_data, *msg_ptr;
+
+        pr_debug("Send I frame len %zd\n", len);
+
+        local = sock->local;
+        if (local == NULL)
+                return -ENODEV;
+
+        msg_data = kzalloc(len, GFP_KERNEL);
+        if (msg_data == NULL)
+                return -ENOMEM;
+
+        if (memcpy_fromiovec(msg_data, msg->msg_iov, len)) {
+                kfree(msg_data);
+                return -EFAULT;
+        }
+
+        remaining_len = len;
+        msg_ptr = msg_data;
+
+        while (remaining_len > 0) {
+
+                frag_len = min_t(size_t, local->remote_miu, remaining_len);
+
+                pr_debug("Fragment %zd bytes remaining %zd",
+                         frag_len, remaining_len);
+
+                pdu = llcp_allocate_pdu(sock, LLCP_PDU_I,
+                                        frag_len + LLCP_SEQUENCE_SIZE);
+                if (pdu == NULL)
+                        return -ENOMEM;
+
+                skb_put(pdu, LLCP_SEQUENCE_SIZE);
+
+                memcpy(skb_put(pdu, frag_len), msg_ptr, frag_len);
+
+                skb_queue_tail(&sock->tx_queue, pdu);
+
+                lock_sock(sk);
+
+                nfc_llcp_queue_i_frames(sock);
+
+                release_sock(sk);
+
+                remaining_len -= frag_len;
+                msg_ptr += frag_len;
+        }
+
+        kfree(msg_data);
+
+        return len;
+}
+
+int nfc_llcp_send_rr(struct nfc_llcp_sock *sock)
+{
+        struct sk_buff *skb;
+        struct nfc_llcp_local *local;
+
+        pr_debug("Send rr nr %d\n", sock->recv_n);
+
+        local = sock->local;
+        if (local == NULL)
+                return -ENODEV;
+
+        skb = llcp_allocate_pdu(sock, LLCP_PDU_RR, LLCP_SEQUENCE_SIZE);
+        if (skb == NULL)
+                return -ENOMEM;
+
+        skb_put(skb, LLCP_SEQUENCE_SIZE);
+
+        skb->data[2] = sock->recv_n;
+
+        skb_queue_head(&local->tx_queue, skb);
+
+        return 0;
+}
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index 1d32680807d6..42994fac26d6 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -37,7 +37,6 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local)
         struct sock *sk, *parent_sk;
         int i;
 
-
         mutex_lock(&local->socket_lock);
 
         for (i = 0; i < LLCP_MAX_SAP; i++) {
@@ -47,7 +46,7 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local)
 
                 /* Release all child sockets */
                 list_for_each_entry_safe(s, n, &parent->list, list) {
-                        list_del(&s->list);
+                        list_del_init(&s->list);
                         sk = &s->sk;
 
                         lock_sock(sk);
@@ -56,9 +55,12 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local)
                                 nfc_put_device(s->dev);
 
                         sk->sk_state = LLCP_CLOSED;
-                        sock_set_flag(sk, SOCK_DEAD);
 
                         release_sock(sk);
+
+                        sock_orphan(sk);
+
+                        s->local = NULL;
                 }
 
                 parent_sk = &parent->sk;
@@ -70,18 +72,19 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local)
                         struct sock *accept_sk;
 
                         list_for_each_entry_safe(lsk, n, &parent->accept_queue,
-                                                                accept_queue) {
+                                                 accept_queue) {
                                 accept_sk = &lsk->sk;
                                 lock_sock(accept_sk);
 
                                 nfc_llcp_accept_unlink(accept_sk);
 
                                 accept_sk->sk_state = LLCP_CLOSED;
-                                sock_set_flag(accept_sk, SOCK_DEAD);
 
                                 release_sock(accept_sk);
 
                                 sock_orphan(accept_sk);
+
+                                lsk->local = NULL;
                         }
                 }
 
@@ -89,18 +92,32 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local)
                         nfc_put_device(parent->dev);
 
                 parent_sk->sk_state = LLCP_CLOSED;
-                sock_set_flag(parent_sk, SOCK_DEAD);
 
                 release_sock(parent_sk);
+
+                sock_orphan(parent_sk);
+
+                parent->local = NULL;
         }
 
         mutex_unlock(&local->socket_lock);
 }
 
+static void nfc_llcp_clear_sdp(struct nfc_llcp_local *local)
+{
+        mutex_lock(&local->sdp_lock);
+
+        local->local_wks = 0;
+        local->local_sdp = 0;
+        local->local_sap = 0;
+
+        mutex_unlock(&local->sdp_lock);
+}
+
 static void nfc_llcp_timeout_work(struct work_struct *work)
 {
         struct nfc_llcp_local *local = container_of(work, struct nfc_llcp_local,
-                                                        timeout_work);
+                                                    timeout_work);
 
         nfc_dep_link_down(local->dev);
 }
@@ -146,7 +163,7 @@ static int nfc_llcp_wks_sap(char *service_name, size_t service_name_len)
 
         num_wks = ARRAY_SIZE(wks);
 
-        for (sap = 0 ; sap < num_wks; sap++) {
+        for (sap = 0; sap < num_wks; sap++) {
                 if (wks[sap] == NULL)
                         continue;
 
@@ -158,13 +175,13 @@ static int nfc_llcp_wks_sap(char *service_name, size_t service_name_len)
 }
 
 u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local,
-                                struct nfc_llcp_sock *sock)
+                         struct nfc_llcp_sock *sock)
 {
         mutex_lock(&local->sdp_lock);
 
         if (sock->service_name != NULL && sock->service_name_len > 0) {
                 int ssap = nfc_llcp_wks_sap(sock->service_name,
-                                                sock->service_name_len);
+                                            sock->service_name_len);
 
                 if (ssap > 0) {
                         pr_debug("WKS %d\n", ssap);
@@ -176,7 +193,7 @@ u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local,
                                 return LLCP_SAP_MAX;
                         }
 
-                        set_bit(BIT(ssap), &local->local_wks);
+                        set_bit(ssap, &local->local_wks);
                         mutex_unlock(&local->sdp_lock);
 
                         return ssap;
@@ -195,25 +212,25 @@ u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local,
 
                 pr_debug("SDP ssap %d\n", LLCP_WKS_NUM_SAP + ssap);
 
-                set_bit(BIT(ssap), &local->local_sdp);
+                set_bit(ssap, &local->local_sdp);
                 mutex_unlock(&local->sdp_lock);
 
                 return LLCP_WKS_NUM_SAP + ssap;
 
         } else if (sock->ssap != 0) {
                 if (sock->ssap < LLCP_WKS_NUM_SAP) {
-                        if (!(local->local_wks & BIT(sock->ssap))) {
-                                set_bit(BIT(sock->ssap), &local->local_wks);
+                        if (!test_bit(sock->ssap, &local->local_wks)) {
+                                set_bit(sock->ssap, &local->local_wks);
                                 mutex_unlock(&local->sdp_lock);
 
                                 return sock->ssap;
                         }
 
                 } else if (sock->ssap < LLCP_SDP_NUM_SAP) {
-                        if (!(local->local_sdp &
-                                BIT(sock->ssap - LLCP_WKS_NUM_SAP))) {
-                                set_bit(BIT(sock->ssap - LLCP_WKS_NUM_SAP),
-                                                        &local->local_sdp);
+                        if (!test_bit(sock->ssap - LLCP_WKS_NUM_SAP,
+                                      &local->local_sdp)) {
+                                set_bit(sock->ssap - LLCP_WKS_NUM_SAP,
+                                        &local->local_sdp);
                                 mutex_unlock(&local->sdp_lock);
 
                                 return sock->ssap;
@@ -238,7 +255,7 @@ u8 nfc_llcp_get_local_ssap(struct nfc_llcp_local *local)
                 return LLCP_SAP_MAX;
         }
 
-        set_bit(BIT(local_ssap), &local->local_sap);
+        set_bit(local_ssap, &local->local_sap);
 
         mutex_unlock(&local->sdp_lock);
 
@@ -265,12 +282,12 @@ void nfc_llcp_put_ssap(struct nfc_llcp_local *local, u8 ssap)
 
         mutex_lock(&local->sdp_lock);
 
-        clear_bit(1 << local_ssap, sdp);
+        clear_bit(local_ssap, sdp);
 
         mutex_unlock(&local->sdp_lock);
 }
 
-u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, u8 *general_bytes_len)
+u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
 {
         struct nfc_llcp_local *local;
 
@@ -290,23 +307,30 @@ static int nfc_llcp_build_gb(struct nfc_llcp_local *local)
         u8 *gb_cur, *version_tlv, version, version_length;
         u8 *lto_tlv, lto, lto_length;
         u8 *wks_tlv, wks_length;
+        u8 *miux_tlv, miux_length;
+        __be16 miux;
         u8 gb_len = 0;
 
         version = LLCP_VERSION_11;
         version_tlv = nfc_llcp_build_tlv(LLCP_TLV_VERSION, &version,
-                                                        1, &version_length);
+                                         1, &version_length);
         gb_len += version_length;
 
         /* 1500 ms */
         lto = 150;
-        lto_tlv = nfc_llcp_build_tlv(LLCP_TLV_VERSION, &lto, 1, &lto_length);
+        lto_tlv = nfc_llcp_build_tlv(LLCP_TLV_LTO, &lto, 1, &lto_length);
         gb_len += lto_length;
 
         pr_debug("Local wks 0x%lx\n", local->local_wks);
         wks_tlv = nfc_llcp_build_tlv(LLCP_TLV_WKS, (u8 *)&local->local_wks, 2,
-                                                                &wks_length);
+                                     &wks_length);
         gb_len += wks_length;
 
+        miux = cpu_to_be16(LLCP_MAX_MIUX);
+        miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0,
+                                      &miux_length);
+        gb_len += miux_length;
+
         gb_len += ARRAY_SIZE(llcp_magic);
 
         if (gb_len > NFC_MAX_GT_LEN) {
@@ -328,6 +352,9 @@ static int nfc_llcp_build_gb(struct nfc_llcp_local *local)
         memcpy(gb_cur, wks_tlv, wks_length);
         gb_cur += wks_length;
 
+        memcpy(gb_cur, miux_tlv, miux_length);
+        gb_cur += miux_length;
+
         kfree(version_tlv);
         kfree(lto_tlv);
 
@@ -349,8 +376,7 @@ int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len)
         memcpy(local->remote_gb, gb, gb_len);
         local->remote_gb_len = gb_len;
 
-        if (local->remote_gb == NULL ||
-                        local->remote_gb_len == 0)
+        if (local->remote_gb == NULL || local->remote_gb_len == 0)
                 return -ENODEV;
 
         if (memcmp(local->remote_gb, llcp_magic, 3)) {
@@ -359,26 +385,30 @@ int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len)
         }
 
         return nfc_llcp_parse_tlv(local,
-                        &local->remote_gb[3], local->remote_gb_len - 3);
+                                  &local->remote_gb[3],
+                                  local->remote_gb_len - 3);
 }
 
 static void nfc_llcp_tx_work(struct work_struct *work)
 {
         struct nfc_llcp_local *local = container_of(work, struct nfc_llcp_local,
-                                                        tx_work);
+                                                    tx_work);
         struct sk_buff *skb;
 
         skb = skb_dequeue(&local->tx_queue);
         if (skb != NULL) {
                 pr_debug("Sending pending skb\n");
+                print_hex_dump(KERN_DEBUG, "LLCP Tx: ", DUMP_PREFIX_OFFSET,
+                               16, 1, skb->data, skb->len, true);
+
                 nfc_data_exchange(local->dev, local->target_idx,
-                                        skb, nfc_llcp_recv, local);
+                                  skb, nfc_llcp_recv, local);
         } else {
                 nfc_llcp_send_symm(local->dev);
         }
 
         mod_timer(&local->link_timer,
-                        jiffies + msecs_to_jiffies(local->remote_lto));
+                  jiffies + msecs_to_jiffies(local->remote_lto));
 }
 
 static u8 nfc_llcp_dsap(struct sk_buff *pdu)
@@ -408,16 +438,18 @@ static u8 nfc_llcp_nr(struct sk_buff *pdu)
 
 static void nfc_llcp_set_nrns(struct nfc_llcp_sock *sock, struct sk_buff *pdu)
 {
-        pdu->data[2] = (sock->send_n << 4) | ((sock->recv_n - 1) % 16);
+        pdu->data[2] = (sock->send_n << 4) | (sock->recv_n);
         sock->send_n = (sock->send_n + 1) % 16;
         sock->recv_ack_n = (sock->recv_n - 1) % 16;
 }
 
 static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local,
-                                                u8 ssap, u8 dsap)
+                                               u8 ssap, u8 dsap)
 {
         struct nfc_llcp_sock *sock, *llcp_sock, *n;
 
+        pr_debug("ssap dsap %d %d\n", ssap, dsap);
+
         if (ssap == 0 && dsap == 0)
                 return NULL;
 
@@ -438,7 +470,7 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local,
 
         list_for_each_entry_safe(llcp_sock, n, &sock->list, list) {
                 pr_debug("llcp_sock %p sk %p dsap %d\n", llcp_sock,
-                                &llcp_sock->sk, llcp_sock->dsap);
+                         &llcp_sock->sk, llcp_sock->dsap);
                 if (llcp_sock->dsap == dsap) {
                         sock_hold(&llcp_sock->sk);
                         mutex_unlock(&local->socket_lock);
@@ -482,7 +514,7 @@ static u8 *nfc_llcp_connect_sn(struct sk_buff *skb, size_t *sn_len)
 }
 
 static void nfc_llcp_recv_connect(struct nfc_llcp_local *local,
-                                struct sk_buff *skb)
+                                  struct sk_buff *skb)
 {
         struct sock *new_sk, *parent;
         struct nfc_llcp_sock *sock, *new_sock;
@@ -494,7 +526,7 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local,
         pr_debug("%d %d\n", dsap, ssap);
 
         nfc_llcp_parse_tlv(local, &skb->data[LLCP_HEADER_SIZE],
-                                skb->len - LLCP_HEADER_SIZE);
+                           skb->len - LLCP_HEADER_SIZE);
 
         if (dsap != LLCP_SAP_SDP) {
                 bound_sap = dsap;
@@ -513,7 +545,7 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local,
                 lock_sock(&sock->sk);
 
                 if (sock->dsap == LLCP_SAP_SDP &&
-                                sock->sk.sk_state == LLCP_LISTEN)
+                    sock->sk.sk_state == LLCP_LISTEN)
                         goto enqueue;
         } else {
                 u8 *sn;
@@ -529,23 +561,23 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local,
 
                 mutex_lock(&local->socket_lock);
                 for (bound_sap = 0; bound_sap < LLCP_LOCAL_SAP_OFFSET;
-                                                                bound_sap++) {
+                     bound_sap++) {
                         sock = local->sockets[bound_sap];
                         if (sock == NULL)
                                 continue;
 
                         if (sock->service_name == NULL ||
-                                sock->service_name_len == 0)
+                            sock->service_name_len == 0)
                                         continue;
 
                         if (sock->service_name_len != sn_len)
                                 continue;
 
                         if (sock->dsap == LLCP_SAP_SDP &&
-                                        sock->sk.sk_state == LLCP_LISTEN &&
-                                        !memcmp(sn, sock->service_name, sn_len)) {
+                            sock->sk.sk_state == LLCP_LISTEN &&
+                            !memcmp(sn, sock->service_name, sn_len)) {
                                 pr_debug("Found service name at SAP %d\n",
-                                                                bound_sap);
+                                         bound_sap);
                                 sock_hold(&sock->sk);
                                 mutex_unlock(&local->socket_lock);
 
@@ -570,8 +602,7 @@ enqueue:
                 goto fail;
         }
 
-        new_sk = nfc_llcp_sock_alloc(NULL, parent->sk_type,
-                                     GFP_ATOMIC);
+        new_sk = nfc_llcp_sock_alloc(NULL, parent->sk_type, GFP_ATOMIC);
         if (new_sk == NULL) {
                 reason = LLCP_DM_REJ;
                 release_sock(&sock->sk);
@@ -616,8 +647,39 @@ fail:
 
 }
 
+int nfc_llcp_queue_i_frames(struct nfc_llcp_sock *sock)
+{
+        int nr_frames = 0;
+        struct nfc_llcp_local *local = sock->local;
+
+        pr_debug("Remote ready %d tx queue len %d remote rw %d",
+                 sock->remote_ready, skb_queue_len(&sock->tx_pending_queue),
+                 local->remote_rw);
+
+        /* Try to queue some I frames for transmission */
+        while (sock->remote_ready &&
+               skb_queue_len(&sock->tx_pending_queue) < local->remote_rw) {
+                struct sk_buff *pdu, *pending_pdu;
+
+                pdu = skb_dequeue(&sock->tx_queue);
+                if (pdu == NULL)
+                        break;
+
+                /* Update N(S)/N(R) */
+                nfc_llcp_set_nrns(sock, pdu);
+
+                pending_pdu = skb_clone(pdu, GFP_KERNEL);
+
+                skb_queue_tail(&local->tx_queue, pdu);
+                skb_queue_tail(&sock->tx_pending_queue, pending_pdu);
+                nr_frames++;
+        }
+
+        return nr_frames;
+}
+
 static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local,
-                                struct sk_buff *skb)
+                               struct sk_buff *skb)
 {
         struct nfc_llcp_sock *llcp_sock;
         struct sock *sk;
@@ -644,15 +706,15 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local,
                 nfc_llcp_sock_put(llcp_sock);
         }
 
-        if (ns == llcp_sock->recv_n)
-                llcp_sock->recv_n = (llcp_sock->recv_n + 1) % 16;
-        else
-                pr_err("Received out of sequence I PDU\n");
-
         /* Pass the payload upstream */
         if (ptype == LLCP_PDU_I) {
                 pr_debug("I frame, queueing on %p\n", &llcp_sock->sk);
 
+                if (ns == llcp_sock->recv_n)
+                        llcp_sock->recv_n = (llcp_sock->recv_n + 1) % 16;
+                else
+                        pr_err("Received out of sequence I PDU\n");
+
                 skb_pull(skb, LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE);
                 if (sock_queue_rcv_skb(&llcp_sock->sk, skb)) {
                         pr_err("receive queue is full\n");
@@ -673,30 +735,20 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local,
                         }
         }
 
-        /* Queue some I frames for transmission */
-        while (llcp_sock->remote_ready &&
-                skb_queue_len(&llcp_sock->tx_pending_queue) <= local->remote_rw) {
-                struct sk_buff *pdu, *pending_pdu;
-
-                pdu = skb_dequeue(&llcp_sock->tx_queue);
-                if (pdu == NULL)
-                        break;
-
-                /* Update N(S)/N(R) */
-                nfc_llcp_set_nrns(llcp_sock, pdu);
+        if (ptype == LLCP_PDU_RR)
+                llcp_sock->remote_ready = true;
+        else if (ptype == LLCP_PDU_RNR)
+                llcp_sock->remote_ready = false;
 
-                pending_pdu = skb_clone(pdu, GFP_KERNEL);
-
-                skb_queue_tail(&local->tx_queue, pdu);
-                skb_queue_tail(&llcp_sock->tx_pending_queue, pending_pdu);
-        }
+        if (nfc_llcp_queue_i_frames(llcp_sock) == 0)
+                nfc_llcp_send_rr(llcp_sock);
 
         release_sock(sk);
         nfc_llcp_sock_put(llcp_sock);
 }
 
 static void nfc_llcp_recv_disc(struct nfc_llcp_local *local,
-                                struct sk_buff *skb)
+                               struct sk_buff *skb)
 {
         struct nfc_llcp_sock *llcp_sock;
         struct sock *sk;
@@ -718,7 +770,6 @@ static void nfc_llcp_recv_disc(struct nfc_llcp_local *local,
                 nfc_llcp_sock_put(llcp_sock);
         }
 
-
         if (sk->sk_state == LLCP_CONNECTED) {
                 nfc_put_device(local->dev);
                 sk->sk_state = LLCP_CLOSED;
@@ -731,13 +782,12 @@ static void nfc_llcp_recv_disc(struct nfc_llcp_local *local,
         nfc_llcp_sock_put(llcp_sock);
 }
 
-static void nfc_llcp_recv_cc(struct nfc_llcp_local *local,
-                                struct sk_buff *skb)
+static void nfc_llcp_recv_cc(struct nfc_llcp_local *local, struct sk_buff *skb)
 {
         struct nfc_llcp_sock *llcp_sock;
+        struct sock *sk;
         u8 dsap, ssap;
 
-
         dsap = nfc_llcp_dsap(skb);
         ssap = nfc_llcp_ssap(skb);
 
@@ -754,9 +804,13 @@ static void nfc_llcp_recv_cc(struct nfc_llcp_local *local,
         }
 
         llcp_sock->dsap = ssap;
+        sk = &llcp_sock->sk;
 
         nfc_llcp_parse_tlv(local, &skb->data[LLCP_HEADER_SIZE],
-                                skb->len - LLCP_HEADER_SIZE);
+                           skb->len - LLCP_HEADER_SIZE);
+
+        sk->sk_state = LLCP_CONNECTED;
+        sk->sk_state_change(sk);
 
         nfc_llcp_sock_put(llcp_sock);
 }
@@ -764,7 +818,7 @@ static void nfc_llcp_recv_cc(struct nfc_llcp_local *local,
 static void nfc_llcp_rx_work(struct work_struct *work)
 {
         struct nfc_llcp_local *local = container_of(work, struct nfc_llcp_local,
-                                                                rx_work);
+                                                    rx_work);
         u8 dsap, ssap, ptype;
         struct sk_buff *skb;
 
@@ -780,6 +834,10 @@ static void nfc_llcp_rx_work(struct work_struct *work)
 
         pr_debug("ptype 0x%x dsap 0x%x ssap 0x%x\n", ptype, dsap, ssap);
 
+        if (ptype != LLCP_PDU_SYMM)
+                print_hex_dump(KERN_DEBUG, "LLCP Rx: ", DUMP_PREFIX_OFFSET,
+                               16, 1, skb->data, skb->len, true);
+
         switch (ptype) {
         case LLCP_PDU_SYMM:
                 pr_debug("SYMM\n");
@@ -802,6 +860,7 @@ static void nfc_llcp_rx_work(struct work_struct *work)
 
         case LLCP_PDU_I:
         case LLCP_PDU_RR:
+        case LLCP_PDU_RNR:
                 pr_debug("I frame\n");
                 nfc_llcp_recv_hdlc(local, skb);
                 break;
@@ -821,7 +880,7 @@ void nfc_llcp_recv(void *data, struct sk_buff *skb, int err)
 
         pr_debug("Received an LLCP PDU\n");
         if (err < 0) {
-                pr_err("err %d", err);
+                pr_err("err %d\n", err);
                 return;
         }
 
@@ -840,6 +899,8 @@ void nfc_llcp_mac_is_down(struct nfc_dev *dev)
         if (local == NULL)
                 return;
 
+        nfc_llcp_clear_sdp(local);
+
         /* Close and purge all existing sockets */
         nfc_llcp_socket_release(local);
 }
@@ -865,7 +926,7 @@ void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx,
                 queue_work(local->tx_wq, &local->tx_work);
         } else {
                 mod_timer(&local->link_timer,
-                        jiffies + msecs_to_jiffies(local->remote_lto));
+                          jiffies + msecs_to_jiffies(local->remote_lto));
         }
 }
 
@@ -891,8 +952,10 @@ int nfc_llcp_register_device(struct nfc_dev *ndev)
         skb_queue_head_init(&local->tx_queue);
         INIT_WORK(&local->tx_work, nfc_llcp_tx_work);
         snprintf(name, sizeof(name), "%s_llcp_tx_wq", dev_name(dev));
-        local->tx_wq = alloc_workqueue(name,
-                        WQ_NON_REENTRANT | WQ_UNBOUND | WQ_MEM_RECLAIM, 1);
+        local->tx_wq =
+                alloc_workqueue(name,
+                                WQ_NON_REENTRANT | WQ_UNBOUND | WQ_MEM_RECLAIM,
+                                1);
         if (local->tx_wq == NULL) {
                 err = -ENOMEM;
                 goto err_local;
@@ -901,8 +964,10 @@ int nfc_llcp_register_device(struct nfc_dev *ndev)
         local->rx_pending = NULL;
         INIT_WORK(&local->rx_work, nfc_llcp_rx_work);
         snprintf(name, sizeof(name), "%s_llcp_rx_wq", dev_name(dev));
-        local->rx_wq = alloc_workqueue(name,
-                        WQ_NON_REENTRANT | WQ_UNBOUND | WQ_MEM_RECLAIM, 1);
+        local->rx_wq =
+                alloc_workqueue(name,
+                                WQ_NON_REENTRANT | WQ_UNBOUND | WQ_MEM_RECLAIM,
+                                1);
         if (local->rx_wq == NULL) {
                 err = -ENOMEM;
                 goto err_tx_wq;
@@ -910,8 +975,10 @@ int nfc_llcp_register_device(struct nfc_dev *ndev)
 
         INIT_WORK(&local->timeout_work, nfc_llcp_timeout_work);
         snprintf(name, sizeof(name), "%s_llcp_timeout_wq", dev_name(dev));
-        local->timeout_wq = alloc_workqueue(name,
-                        WQ_NON_REENTRANT | WQ_UNBOUND | WQ_MEM_RECLAIM, 1);
+        local->timeout_wq =
+                alloc_workqueue(name,
+                                WQ_NON_REENTRANT | WQ_UNBOUND | WQ_MEM_RECLAIM,
+                                1);
         if (local->timeout_wq == NULL) {
                 err = -ENOMEM;
                 goto err_rx_wq;
diff --git a/net/nfc/llcp/llcp.h b/net/nfc/llcp/llcp.h
index 0ad2e3361584..50680ce5ae43 100644
--- a/net/nfc/llcp/llcp.h
+++ b/net/nfc/llcp/llcp.h
@@ -28,6 +28,10 @@ enum llcp_state {
 #define LLCP_DEFAULT_RW  1
 #define LLCP_DEFAULT_MIU 128
 
+#define LLCP_MAX_LTO  0xff
+#define LLCP_MAX_RW   15
+#define LLCP_MAX_MIUX 0x7ff
+
 #define LLCP_WKS_NUM_SAP   16
 #define LLCP_SDP_NUM_SAP   16
 #define LLCP_LOCAL_NUM_SAP 32
@@ -162,9 +166,10 @@ struct nfc_llcp_sock {
 
 struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev);
 u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local,
-                                struct nfc_llcp_sock *sock);
+                         struct nfc_llcp_sock *sock);
 u8 nfc_llcp_get_local_ssap(struct nfc_llcp_local *local);
 void nfc_llcp_put_ssap(struct nfc_llcp_local *local, u8 ssap);
+int nfc_llcp_queue_i_frames(struct nfc_llcp_sock *sock);
 
 /* Sock API */
 struct sock *nfc_llcp_sock_alloc(struct socket *sock, int type, gfp_t gfp);
@@ -175,7 +180,7 @@ struct sock *nfc_llcp_accept_dequeue(struct sock *sk, struct socket *newsock);
 
 /* TLV API */
 int nfc_llcp_parse_tlv(struct nfc_llcp_local *local,
-                        u8 *tlv_array, u16 tlv_array_len);
+                       u8 *tlv_array, u16 tlv_array_len);
 
 /* Commands API */
 void nfc_llcp_recv(void *data, struct sk_buff *skb, int err);
@@ -187,6 +192,9 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock);
 int nfc_llcp_send_cc(struct nfc_llcp_sock *sock);
 int nfc_llcp_send_dm(struct nfc_llcp_local *local, u8 ssap, u8 dsap, u8 reason);
 int nfc_llcp_send_disconnect(struct nfc_llcp_sock *sock);
+int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
+                          struct msghdr *msg, size_t len);
+int nfc_llcp_send_rr(struct nfc_llcp_sock *sock);
 
 /* Socket API */
 int __init nfc_llcp_sock_init(void);
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index f738ccd535f1..3f339b19d140 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -27,6 +27,42 @@
 #include "../nfc.h"
 #include "llcp.h"
 
+static int sock_wait_state(struct sock *sk, int state, unsigned long timeo)
+{
+        DECLARE_WAITQUEUE(wait, current);
+        int err = 0;
+
+        pr_debug("sk %p", sk);
+
+        add_wait_queue(sk_sleep(sk), &wait);
+        set_current_state(TASK_INTERRUPTIBLE);
+
+        while (sk->sk_state != state) {
+                if (!timeo) {
+                        err = -EINPROGRESS;
+                        break;
+                }
+
+                if (signal_pending(current)) {
+                        err = sock_intr_errno(timeo);
+                        break;
+                }
+
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                err = sock_error(sk);
+                if (err)
+                        break;
+        }
+
+        __set_current_state(TASK_RUNNING);
+        remove_wait_queue(sk_sleep(sk), &wait);
+        return err;
+}
+
 static struct proto llcp_sock_proto = {
         .name     = "NFC_LLCP",
         .owner    = THIS_MODULE,
@@ -78,9 +114,11 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
         llcp_sock->local = local;
         llcp_sock->nfc_protocol = llcp_addr.nfc_protocol;
         llcp_sock->service_name_len = min_t(unsigned int,
-                        llcp_addr.service_name_len, NFC_LLCP_MAX_SERVICE_NAME);
+                                            llcp_addr.service_name_len,
+                                            NFC_LLCP_MAX_SERVICE_NAME);
         llcp_sock->service_name = kmemdup(llcp_addr.service_name,
-                                llcp_sock->service_name_len, GFP_KERNEL);
+                                          llcp_sock->service_name_len,
+                                          GFP_KERNEL);
 
         llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock);
         if (llcp_sock->ssap == LLCP_MAX_SAP)
@@ -110,7 +148,7 @@ static int llcp_sock_listen(struct socket *sock, int backlog)
         lock_sock(sk);
 
         if ((sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM)
-                        || sk->sk_state != LLCP_BOUND) {
+            || sk->sk_state != LLCP_BOUND) {
                 ret = -EBADFD;
                 goto error;
         }
@@ -149,13 +187,13 @@ void nfc_llcp_accept_enqueue(struct sock *parent, struct sock *sk)
         sock_hold(sk);
 
         list_add_tail(&llcp_sock->accept_queue,
-                        &llcp_sock_parent->accept_queue);
+                      &llcp_sock_parent->accept_queue);
         llcp_sock->parent = parent;
         sk_acceptq_added(parent);
 }
 
 struct sock *nfc_llcp_accept_dequeue(struct sock *parent,
-                                        struct socket *newsock)
+                                     struct socket *newsock)
 {
         struct nfc_llcp_sock *lsk, *n, *llcp_parent;
         struct sock *sk;
@@ -163,7 +201,7 @@ struct sock *nfc_llcp_accept_dequeue(struct sock *parent,
         llcp_parent = nfc_llcp_sock(parent);
 
         list_for_each_entry_safe(lsk, n, &llcp_parent->accept_queue,
-                                                        accept_queue) {
+                                 accept_queue) {
                 sk = &lsk->sk;
                 lock_sock(sk);
 
@@ -192,7 +230,7 @@ struct sock *nfc_llcp_accept_dequeue(struct sock *parent,
 }
 
 static int llcp_sock_accept(struct socket *sock, struct socket *newsock,
-                                                                int flags)
+                            int flags)
 {
         DECLARE_WAITQUEUE(wait, current);
         struct sock *sk = sock->sk, *new_sk;
@@ -248,7 +286,7 @@ error:
 static int llcp_sock_getname(struct socket *sock, struct sockaddr *addr,
                              int *len, int peer)
 {
-        struct sockaddr_nfc_llcp *llcp_addr = (struct sockaddr_nfc_llcp *) addr;
+        struct sockaddr_nfc_llcp *llcp_addr = (struct sockaddr_nfc_llcp *)addr;
         struct sock *sk = sock->sk;
         struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
 
@@ -262,7 +300,7 @@ static int llcp_sock_getname(struct socket *sock, struct sockaddr *addr,
         llcp_addr->ssap = llcp_sock->ssap;
         llcp_addr->service_name_len = llcp_sock->service_name_len;
         memcpy(llcp_addr->service_name, llcp_sock->service_name,
-                                        llcp_addr->service_name_len);
+               llcp_addr->service_name_len);
 
         return 0;
 }
@@ -275,7 +313,7 @@ static inline unsigned int llcp_accept_poll(struct sock *parent)
         parent_sock = nfc_llcp_sock(parent);
 
         list_for_each_entry_safe(llcp_sock, n, &parent_sock->accept_queue,
-                                                                accept_queue) {
+                                 accept_queue) {
                 sk = &llcp_sock->sk;
 
                 if (sk->sk_state == LLCP_CONNECTED)
@@ -286,7 +324,7 @@ static inline unsigned int llcp_accept_poll(struct sock *parent)
 }
 
 static unsigned int llcp_sock_poll(struct file *file, struct socket *sock,
-                                                        poll_table *wait)
+                                   poll_table *wait)
 {
         struct sock *sk = sock->sk;
         unsigned int mask = 0;
@@ -302,11 +340,24 @@ static unsigned int llcp_sock_poll(struct file *file, struct socket *sock,
                 mask |= POLLERR;
 
         if (!skb_queue_empty(&sk->sk_receive_queue))
-                mask |= POLLIN;
+                mask |= POLLIN | POLLRDNORM;
 
         if (sk->sk_state == LLCP_CLOSED)
                 mask |= POLLHUP;
 
+        if (sk->sk_shutdown & RCV_SHUTDOWN)
+                mask |= POLLRDHUP | POLLIN | POLLRDNORM;
+
+        if (sk->sk_shutdown == SHUTDOWN_MASK)
+                mask |= POLLHUP;
+
+        if (sock_writeable(sk))
+                mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
+        else
+                set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
+
+        pr_debug("mask 0x%x\n", mask);
+
         return mask;
 }
 
@@ -315,6 +366,7 @@ static int llcp_sock_release(struct socket *sock)
         struct sock *sk = sock->sk;
         struct nfc_llcp_local *local;
         struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
+        int err = 0;
 
         if (!sk)
                 return 0;
@@ -322,25 +374,17 @@ static int llcp_sock_release(struct socket *sock)
         pr_debug("%p\n", sk);
 
         local = llcp_sock->local;
-        if (local == NULL)
-                return -ENODEV;
+        if (local == NULL) {
+                err = -ENODEV;
+                goto out;
+        }
 
         mutex_lock(&local->socket_lock);
 
-        if (llcp_sock == local->sockets[llcp_sock->ssap]) {
+        if (llcp_sock == local->sockets[llcp_sock->ssap])
                 local->sockets[llcp_sock->ssap] = NULL;
-        } else {
-                struct nfc_llcp_sock *parent, *s, *n;
-
-                parent = local->sockets[llcp_sock->ssap];
-
-                list_for_each_entry_safe(s, n, &parent->list, list)
-                        if (llcp_sock == s) {
-                                list_del(&s->list);
-                                break;
-                        }
-
-        }
+        else
+                list_del_init(&llcp_sock->list);
 
         mutex_unlock(&local->socket_lock);
 
@@ -355,7 +399,7 @@ static int llcp_sock_release(struct socket *sock)
                 struct sock *accept_sk;
 
                 list_for_each_entry_safe(lsk, n, &llcp_sock->accept_queue,
-                                                                accept_queue) {
+                                         accept_queue) {
                         accept_sk = &lsk->sk;
                         lock_sock(accept_sk);
 
@@ -364,31 +408,27 @@ static int llcp_sock_release(struct socket *sock)
 
                         release_sock(accept_sk);
 
-                        sock_set_flag(sk, SOCK_DEAD);
                         sock_orphan(accept_sk);
-                        sock_put(accept_sk);
                 }
         }
 
         /* Freeing the SAP */
         if ((sk->sk_state == LLCP_CONNECTED
-                        && llcp_sock->ssap > LLCP_LOCAL_SAP_OFFSET) ||
-            sk->sk_state == LLCP_BOUND ||
-            sk->sk_state == LLCP_LISTEN)
+             && llcp_sock->ssap > LLCP_LOCAL_SAP_OFFSET) ||
+            sk->sk_state == LLCP_BOUND || sk->sk_state == LLCP_LISTEN)
                 nfc_llcp_put_ssap(llcp_sock->local, llcp_sock->ssap);
 
-        sock_set_flag(sk, SOCK_DEAD);
-
         release_sock(sk);
 
+out:
         sock_orphan(sk);
         sock_put(sk);
 
-        return 0;
+        return err;
 }
 
 static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
-                                                        int len, int flags)
+                             int len, int flags)
 {
         struct sock *sk = sock->sk;
         struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
@@ -400,7 +440,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
         pr_debug("sock %p sk %p flags 0x%x\n", sock, sk, flags);
 
         if (!addr || len < sizeof(struct sockaddr_nfc) ||
-                        addr->sa_family != AF_NFC) {
+            addr->sa_family != AF_NFC) {
                 pr_err("Invalid socket\n");
                 return -EINVAL;
         }
@@ -411,7 +451,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
         }
 
         pr_debug("addr dev_idx=%u target_idx=%u protocol=%u\n", addr->dev_idx,
-                                        addr->target_idx, addr->nfc_protocol);
+                 addr->target_idx, addr->nfc_protocol);
 
         lock_sock(sk);
 
@@ -441,7 +481,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
         device_unlock(&dev->dev);
 
         if (local->rf_mode == NFC_RF_INITIATOR &&
-                        addr->target_idx != local->target_idx) {
+            addr->target_idx != local->target_idx) {
                 ret = -ENOLINK;
                 goto put_dev;
         }
@@ -459,9 +499,11 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
                 llcp_sock->dsap = LLCP_SAP_SDP;
         llcp_sock->nfc_protocol = addr->nfc_protocol;
         llcp_sock->service_name_len = min_t(unsigned int,
-                        addr->service_name_len, NFC_LLCP_MAX_SERVICE_NAME);
+                                            addr->service_name_len,
+                                            NFC_LLCP_MAX_SERVICE_NAME);
         llcp_sock->service_name = kmemdup(addr->service_name,
-                                 llcp_sock->service_name_len, GFP_KERNEL);
+                                          llcp_sock->service_name_len,
+                                          GFP_KERNEL);
 
         local->sockets[llcp_sock->ssap] = llcp_sock;
 
@@ -469,9 +511,13 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
         if (ret)
                 goto put_dev;
 
-        sk->sk_state = LLCP_CONNECTED;
+        ret = sock_wait_state(sk, LLCP_CONNECTED,
+                              sock_sndtimeo(sk, flags & O_NONBLOCK));
+        if (ret)
+                goto put_dev;
 
         release_sock(sk);
+
         return 0;
 
 put_dev:
@@ -482,6 +528,34 @@ error:
         return ret;
 }
 
+static int llcp_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
+                             struct msghdr *msg, size_t len)
+{
+        struct sock *sk = sock->sk;
+        struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
+        int ret;
+
+        pr_debug("sock %p sk %p", sock, sk);
+
+        ret = sock_error(sk);
+        if (ret)
+                return ret;
+
+        if (msg->msg_flags & MSG_OOB)
+                return -EOPNOTSUPP;
+
+        lock_sock(sk);
+
+        if (sk->sk_state != LLCP_CONNECTED) {
+                release_sock(sk);
+                return -ENOTCONN;
+        }
+
+        release_sock(sk);
+
+        return nfc_llcp_send_i_frame(llcp_sock, msg, len);
+}
+
 static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                              struct msghdr *msg, size_t len, int flags)
 {
@@ -496,7 +570,7 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         lock_sock(sk);
 
         if (sk->sk_state == LLCP_CLOSED &&
-                        skb_queue_empty(&sk->sk_receive_queue)) {
+            skb_queue_empty(&sk->sk_receive_queue)) {
                 release_sock(sk);
                 return 0;
         }
@@ -509,7 +583,7 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb) {
                 pr_err("Recv datagram failed state %d %d %d",
-                                sk->sk_state, err, sock_error(sk));
+                       sk->sk_state, err, sock_error(sk));
 
                 if (sk->sk_shutdown & RCV_SHUTDOWN)
                         return 0;
@@ -517,7 +591,7 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                 return err;
         }
 
-        rlen   = skb->len;              /* real length of skb */
+        rlen = skb->len;                /* real length of skb */
         copied = min_t(unsigned int, rlen, len);
 
         cskb = skb;
@@ -567,7 +641,7 @@ static const struct proto_ops llcp_sock_ops = {
         .shutdown       = sock_no_shutdown,
         .setsockopt     = sock_no_setsockopt,
         .getsockopt     = sock_no_getsockopt,
-        .sendmsg        = sock_no_sendmsg,
+        .sendmsg        = llcp_sock_sendmsg,
         .recvmsg        = llcp_sock_recvmsg,
         .mmap           = sock_no_mmap,
 };
@@ -627,6 +701,8 @@ struct sock *nfc_llcp_sock_alloc(struct socket *sock, int type, gfp_t gfp)
 
 void nfc_llcp_sock_free(struct nfc_llcp_sock *sock)
 {
+        struct nfc_llcp_local *local = sock->local;
+
         kfree(sock->service_name);
 
         skb_queue_purge(&sock->tx_queue);
@@ -635,11 +711,16 @@ void nfc_llcp_sock_free(struct nfc_llcp_sock *sock)
 
         list_del_init(&sock->accept_queue);
 
+        if (local != NULL && sock == local->sockets[sock->ssap])
+                local->sockets[sock->ssap] = NULL;
+        else
+                list_del_init(&sock->list);
+
         sock->parent = NULL;
 }
 
 static int llcp_sock_create(struct net *net, struct socket *sock,
-                                const struct nfc_protocol *nfc_proto)
+                            const struct nfc_protocol *nfc_proto)
 {
         struct sock *sk;
 
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 7650139a1a05..d560e6f13072 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -66,9 +66,8 @@ static void nci_req_cancel(struct nci_dev *ndev, int err)
 
 /* Execute request and wait for completion. */
 static int __nci_request(struct nci_dev *ndev,
-        void (*req)(struct nci_dev *ndev, unsigned long opt),
-        unsigned long opt,
-        __u32 timeout)
+                         void (*req)(struct nci_dev *ndev, unsigned long opt),
+                         unsigned long opt, __u32 timeout)
 {
         int rc = 0;
         long completion_rc;
@@ -77,9 +76,9 @@ static int __nci_request(struct nci_dev *ndev,
 
         init_completion(&ndev->req_completion);
         req(ndev, opt);
-        completion_rc = wait_for_completion_interruptible_timeout(
-                                                        &ndev->req_completion,
-                                                        timeout);
+        completion_rc =
+                wait_for_completion_interruptible_timeout(&ndev->req_completion,
+                                                          timeout);
 
         pr_debug("wait_for_completion return %ld\n", completion_rc);
 
@@ -110,8 +109,9 @@ static int __nci_request(struct nci_dev *ndev,
 }
 
 static inline int nci_request(struct nci_dev *ndev,
-                void (*req)(struct nci_dev *ndev, unsigned long opt),
-                unsigned long opt, __u32 timeout)
+                              void (*req)(struct nci_dev *ndev,
+                                          unsigned long opt),
+                              unsigned long opt, __u32 timeout)
 {
         int rc;
 
@@ -152,14 +152,14 @@ static void nci_init_complete_req(struct nci_dev *ndev, unsigned long opt)
         /* by default mapping is set to NCI_RF_INTERFACE_FRAME */
         for (i = 0; i < ndev->num_supported_rf_interfaces; i++) {
                 if (ndev->supported_rf_interfaces[i] ==
-                        NCI_RF_INTERFACE_ISO_DEP) {
+                    NCI_RF_INTERFACE_ISO_DEP) {
                         cfg[*num].rf_protocol = NCI_RF_PROTOCOL_ISO_DEP;
                         cfg[*num].mode = NCI_DISC_MAP_MODE_POLL |
                                 NCI_DISC_MAP_MODE_LISTEN;
                         cfg[*num].rf_interface = NCI_RF_INTERFACE_ISO_DEP;
                         (*num)++;
                 } else if (ndev->supported_rf_interfaces[i] ==
-                        NCI_RF_INTERFACE_NFC_DEP) {
+                           NCI_RF_INTERFACE_NFC_DEP) {
                         cfg[*num].rf_protocol = NCI_RF_PROTOCOL_NFC_DEP;
                         cfg[*num].mode = NCI_DISC_MAP_MODE_POLL |
                                 NCI_DISC_MAP_MODE_LISTEN;
@@ -172,8 +172,7 @@ static void nci_init_complete_req(struct nci_dev *ndev, unsigned long opt)
         }
 
         nci_send_cmd(ndev, NCI_OP_RF_DISCOVER_MAP_CMD,
-                (1 + ((*num)*sizeof(struct disc_map_config))),
-                &cmd);
+                     (1 + ((*num) * sizeof(struct disc_map_config))), &cmd);
 }
 
 static void nci_rf_discover_req(struct nci_dev *ndev, unsigned long opt)
@@ -184,36 +183,68 @@ static void nci_rf_discover_req(struct nci_dev *ndev, unsigned long opt)
         cmd.num_disc_configs = 0;
 
         if ((cmd.num_disc_configs < NCI_MAX_NUM_RF_CONFIGS) &&
-                (protocols & NFC_PROTO_JEWEL_MASK
-                || protocols & NFC_PROTO_MIFARE_MASK
-                || protocols & NFC_PROTO_ISO14443_MASK
-                || protocols & NFC_PROTO_NFC_DEP_MASK)) {
+            (protocols & NFC_PROTO_JEWEL_MASK
+             || protocols & NFC_PROTO_MIFARE_MASK
+             || protocols & NFC_PROTO_ISO14443_MASK
+             || protocols & NFC_PROTO_NFC_DEP_MASK)) {
                 cmd.disc_configs[cmd.num_disc_configs].rf_tech_and_mode =
-                NCI_NFC_A_PASSIVE_POLL_MODE;
+                        NCI_NFC_A_PASSIVE_POLL_MODE;
                 cmd.disc_configs[cmd.num_disc_configs].frequency = 1;
                 cmd.num_disc_configs++;
         }
 
         if ((cmd.num_disc_configs < NCI_MAX_NUM_RF_CONFIGS) &&
-                (protocols & NFC_PROTO_ISO14443_MASK)) {
+            (protocols & NFC_PROTO_ISO14443_MASK)) {
                 cmd.disc_configs[cmd.num_disc_configs].rf_tech_and_mode =
-                NCI_NFC_B_PASSIVE_POLL_MODE;
+                        NCI_NFC_B_PASSIVE_POLL_MODE;
                 cmd.disc_configs[cmd.num_disc_configs].frequency = 1;
                 cmd.num_disc_configs++;
         }
 
         if ((cmd.num_disc_configs < NCI_MAX_NUM_RF_CONFIGS) &&
-                (protocols & NFC_PROTO_FELICA_MASK
-                || protocols & NFC_PROTO_NFC_DEP_MASK)) {
+            (protocols & NFC_PROTO_FELICA_MASK
+             || protocols & NFC_PROTO_NFC_DEP_MASK)) {
                 cmd.disc_configs[cmd.num_disc_configs].rf_tech_and_mode =
-                NCI_NFC_F_PASSIVE_POLL_MODE;
+                        NCI_NFC_F_PASSIVE_POLL_MODE;
                 cmd.disc_configs[cmd.num_disc_configs].frequency = 1;
                 cmd.num_disc_configs++;
         }
 
         nci_send_cmd(ndev, NCI_OP_RF_DISCOVER_CMD,
-                (1 + (cmd.num_disc_configs*sizeof(struct disc_config))),
-                &cmd);
+                     (1 + (cmd.num_disc_configs * sizeof(struct disc_config))),
+                     &cmd);
+}
+
+struct nci_rf_discover_select_param {
+        __u8    rf_discovery_id;
+        __u8    rf_protocol;
+};
+
+static void nci_rf_discover_select_req(struct nci_dev *ndev, unsigned long opt)
+{
+        struct nci_rf_discover_select_param *param =
+                (struct nci_rf_discover_select_param *)opt;
+        struct nci_rf_discover_select_cmd cmd;
+
+        cmd.rf_discovery_id = param->rf_discovery_id;
+        cmd.rf_protocol = param->rf_protocol;
+
+        switch (cmd.rf_protocol) {
+        case NCI_RF_PROTOCOL_ISO_DEP:
+                cmd.rf_interface = NCI_RF_INTERFACE_ISO_DEP;
+                break;
+
+        case NCI_RF_PROTOCOL_NFC_DEP:
+                cmd.rf_interface = NCI_RF_INTERFACE_NFC_DEP;
+                break;
+
+        default:
+                cmd.rf_interface = NCI_RF_INTERFACE_FRAME;
+                break;
+        }
+
+        nci_send_cmd(ndev, NCI_OP_RF_DISCOVER_SELECT_CMD,
+                     sizeof(struct nci_rf_discover_select_cmd), &cmd);
 }
 
 static void nci_rf_deactivate_req(struct nci_dev *ndev, unsigned long opt)
@@ -223,8 +254,7 @@ static void nci_rf_deactivate_req(struct nci_dev *ndev, unsigned long opt)
         cmd.type = NCI_DEACTIVATE_TYPE_IDLE_MODE;
 
         nci_send_cmd(ndev, NCI_OP_RF_DEACTIVATE_CMD,
-                        sizeof(struct nci_rf_deactivate_cmd),
-                        &cmd);
+                     sizeof(struct nci_rf_deactivate_cmd), &cmd);
 }
 
 static int nci_open_device(struct nci_dev *ndev)
@@ -248,22 +278,24 @@ static int nci_open_device(struct nci_dev *ndev)
         set_bit(NCI_INIT, &ndev->flags);
 
         rc = __nci_request(ndev, nci_reset_req, 0,
-                                msecs_to_jiffies(NCI_RESET_TIMEOUT));
+                           msecs_to_jiffies(NCI_RESET_TIMEOUT));
 
         if (!rc) {
                 rc = __nci_request(ndev, nci_init_req, 0,
-                                msecs_to_jiffies(NCI_INIT_TIMEOUT));
+                                   msecs_to_jiffies(NCI_INIT_TIMEOUT));
         }
 
         if (!rc) {
                 rc = __nci_request(ndev, nci_init_complete_req, 0,
-                                msecs_to_jiffies(NCI_INIT_TIMEOUT));
+                                   msecs_to_jiffies(NCI_INIT_TIMEOUT));
         }
 
         clear_bit(NCI_INIT, &ndev->flags);
 
         if (!rc) {
                 set_bit(NCI_UP, &ndev->flags);
+                nci_clear_target_list(ndev);
+                atomic_set(&ndev->state, NCI_IDLE);
         } else {
                 /* Init failed, cleanup */
                 skb_queue_purge(&ndev->cmd_q);
@@ -286,6 +318,7 @@ static int nci_close_device(struct nci_dev *ndev)
 
         if (!test_and_clear_bit(NCI_UP, &ndev->flags)) {
                 del_timer_sync(&ndev->cmd_timer);
+                del_timer_sync(&ndev->data_timer);
                 mutex_unlock(&ndev->req_lock);
                 return 0;
         }
@@ -304,7 +337,7 @@ static int nci_close_device(struct nci_dev *ndev)
 
         set_bit(NCI_INIT, &ndev->flags);
         __nci_request(ndev, nci_reset_req, 0,
-                                msecs_to_jiffies(NCI_RESET_TIMEOUT));
+                      msecs_to_jiffies(NCI_RESET_TIMEOUT));
         clear_bit(NCI_INIT, &ndev->flags);
 
         /* Flush cmd wq */
@@ -331,6 +364,15 @@ static void nci_cmd_timer(unsigned long arg)
         queue_work(ndev->cmd_wq, &ndev->cmd_work);
 }
 
+/* NCI data exchange timer function */
+static void nci_data_timer(unsigned long arg)
+{
+        struct nci_dev *ndev = (void *) arg;
+
+        set_bit(NCI_DATA_EXCHANGE_TO, &ndev->flags);
+        queue_work(ndev->rx_wq, &ndev->rx_work);
+}
+
 static int nci_dev_up(struct nfc_dev *nfc_dev)
 {
         struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
@@ -350,7 +392,8 @@ static int nci_start_poll(struct nfc_dev *nfc_dev, __u32 protocols)
         struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
         int rc;
 
-        if (test_bit(NCI_DISCOVERY, &ndev->flags)) {
+        if ((atomic_read(&ndev->state) == NCI_DISCOVERY) ||
+            (atomic_read(&ndev->state) == NCI_W4_ALL_DISCOVERIES)) {
                 pr_err("unable to start poll, since poll is already active\n");
                 return -EBUSY;
         }
@@ -360,17 +403,18 @@ static int nci_start_poll(struct nfc_dev *nfc_dev, __u32 protocols)
                 return -EBUSY;
         }
 
-        if (test_bit(NCI_POLL_ACTIVE, &ndev->flags)) {
-                pr_debug("target is active, implicitly deactivate...\n");
+        if ((atomic_read(&ndev->state) == NCI_W4_HOST_SELECT) ||
+            (atomic_read(&ndev->state) == NCI_POLL_ACTIVE)) {
+                pr_debug("target active or w4 select, implicitly deactivate\n");
 
                 rc = nci_request(ndev, nci_rf_deactivate_req, 0,
-                        msecs_to_jiffies(NCI_RF_DEACTIVATE_TIMEOUT));
+                                 msecs_to_jiffies(NCI_RF_DEACTIVATE_TIMEOUT));
                 if (rc)
                         return -EBUSY;
         }
 
         rc = nci_request(ndev, nci_rf_discover_req, protocols,
-                msecs_to_jiffies(NCI_RF_DISC_TIMEOUT));
+                         msecs_to_jiffies(NCI_RF_DISC_TIMEOUT));
 
         if (!rc)
                 ndev->poll_prots = protocols;
@@ -382,23 +426,29 @@ static void nci_stop_poll(struct nfc_dev *nfc_dev)
 {
         struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
 
-        if (!test_bit(NCI_DISCOVERY, &ndev->flags)) {
+        if ((atomic_read(&ndev->state) != NCI_DISCOVERY) &&
+            (atomic_read(&ndev->state) != NCI_W4_ALL_DISCOVERIES)) {
                 pr_err("unable to stop poll, since poll is not active\n");
                 return;
         }
 
         nci_request(ndev, nci_rf_deactivate_req, 0,
-                msecs_to_jiffies(NCI_RF_DEACTIVATE_TIMEOUT));
+                    msecs_to_jiffies(NCI_RF_DEACTIVATE_TIMEOUT));
 }
 
-static int nci_activate_target(struct nfc_dev *nfc_dev, __u32 target_idx,
-                                __u32 protocol)
+static int nci_activate_target(struct nfc_dev *nfc_dev,
+                               struct nfc_target *target, __u32 protocol)
 {
         struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
+        struct nci_rf_discover_select_param param;
+        struct nfc_target *nci_target = NULL;
+        int i;
+        int rc = 0;
 
-        pr_debug("target_idx %d, protocol 0x%x\n", target_idx, protocol);
+        pr_debug("target_idx %d, protocol 0x%x\n", target->idx, protocol);
 
-        if (!test_bit(NCI_POLL_ACTIVE, &ndev->flags)) {
+        if ((atomic_read(&ndev->state) != NCI_W4_HOST_SELECT) &&
+            (atomic_read(&ndev->state) != NCI_POLL_ACTIVE)) {
                 pr_err("there is no available target to activate\n");
                 return -EINVAL;
         }
@@ -408,23 +458,55 @@ static int nci_activate_target(struct nfc_dev *nfc_dev, __u32 target_idx,
                 return -EBUSY;
         }
 
-        if (!(ndev->target_available_prots & (1 << protocol))) {
+        for (i = 0; i < ndev->n_targets; i++) {
+                if (ndev->targets[i].idx == target->idx) {
+                        nci_target = &ndev->targets[i];
+                        break;
+                }
+        }
+
+        if (!nci_target) {
+                pr_err("unable to find the selected target\n");
+                return -EINVAL;
+        }
+
+        if (!(nci_target->supported_protocols & (1 << protocol))) {
                 pr_err("target does not support the requested protocol 0x%x\n",
                        protocol);
                 return -EINVAL;
         }
 
-        ndev->target_active_prot = protocol;
-        ndev->target_available_prots = 0;
+        if (atomic_read(&ndev->state) == NCI_W4_HOST_SELECT) {
+                param.rf_discovery_id = nci_target->logical_idx;
 
-        return 0;
+                if (protocol == NFC_PROTO_JEWEL)
+                        param.rf_protocol = NCI_RF_PROTOCOL_T1T;
+                else if (protocol == NFC_PROTO_MIFARE)
+                        param.rf_protocol = NCI_RF_PROTOCOL_T2T;
+                else if (protocol == NFC_PROTO_FELICA)
+                        param.rf_protocol = NCI_RF_PROTOCOL_T3T;
+                else if (protocol == NFC_PROTO_ISO14443)
+                        param.rf_protocol = NCI_RF_PROTOCOL_ISO_DEP;
+                else
+                        param.rf_protocol = NCI_RF_PROTOCOL_NFC_DEP;
+
+                rc = nci_request(ndev, nci_rf_discover_select_req,
+                                 (unsigned long)&param,
+                                 msecs_to_jiffies(NCI_RF_DISC_SELECT_TIMEOUT));
+        }
+
+        if (!rc)
+                ndev->target_active_prot = protocol;
+
+        return rc;
 }
 
-static void nci_deactivate_target(struct nfc_dev *nfc_dev, __u32 target_idx)
+static void nci_deactivate_target(struct nfc_dev *nfc_dev,
+                                  struct nfc_target *target)
 {
         struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
 
-        pr_debug("target_idx %d\n", target_idx);
+        pr_debug("target_idx %d\n", target->idx);
 
         if (!ndev->target_active_prot) {
                 pr_err("unable to deactivate target, no active target\n");
@@ -433,21 +515,20 @@ static void nci_deactivate_target(struct nfc_dev *nfc_dev, __u32 target_idx)
 
         ndev->target_active_prot = 0;
 
-        if (test_bit(NCI_POLL_ACTIVE, &ndev->flags)) {
+        if (atomic_read(&ndev->state) == NCI_POLL_ACTIVE) {
                 nci_request(ndev, nci_rf_deactivate_req, 0,
-                        msecs_to_jiffies(NCI_RF_DEACTIVATE_TIMEOUT));
+                            msecs_to_jiffies(NCI_RF_DEACTIVATE_TIMEOUT));
         }
 }
 
-static int nci_data_exchange(struct nfc_dev *nfc_dev, __u32 target_idx,
-                                                struct sk_buff *skb,
-                                                data_exchange_cb_t cb,
-                                                void *cb_context)
+static int nci_data_exchange(struct nfc_dev *nfc_dev, struct nfc_target *target,
+                             struct sk_buff *skb,
+                             data_exchange_cb_t cb, void *cb_context)
 {
         struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
         int rc;
 
-        pr_debug("target_idx %d, len %d\n", target_idx, skb->len);
+        pr_debug("target_idx %d, len %d\n", target->idx, skb->len);
 
         if (!ndev->target_active_prot) {
                 pr_err("unable to exchange data, no active target\n");
@@ -487,9 +568,8 @@ static struct nfc_ops nci_nfc_ops = {
  * @supported_protocols: NFC protocols supported by the device
  */
 struct nci_dev *nci_allocate_device(struct nci_ops *ops,
-                                        __u32 supported_protocols,
-                                        int tx_headroom,
-                                        int tx_tailroom)
+                                    __u32 supported_protocols,
+                                    int tx_headroom, int tx_tailroom)
 {
         struct nci_dev *ndev;
 
@@ -510,9 +590,9 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops,
         ndev->tx_tailroom = tx_tailroom;
 
         ndev->nfc_dev = nfc_allocate_device(&nci_nfc_ops,
-                                                supported_protocols,
-                                                tx_headroom + NCI_DATA_HDR_SIZE,
-                                                tx_tailroom);
+                                            supported_protocols,
+                                            tx_headroom + NCI_DATA_HDR_SIZE,
+                                            tx_tailroom);
         if (!ndev->nfc_dev)
                 goto free_exit;
 
@@ -584,7 +664,9 @@ int nci_register_device(struct nci_dev *ndev)
         skb_queue_head_init(&ndev->tx_q);
 
         setup_timer(&ndev->cmd_timer, nci_cmd_timer,
-                        (unsigned long) ndev);
+                    (unsigned long) ndev);
+        setup_timer(&ndev->data_timer, nci_data_timer,
+                    (unsigned long) ndev);
 
         mutex_init(&ndev->req_lock);
 
@@ -633,7 +715,7 @@ int nci_recv_frame(struct sk_buff *skb)
         pr_debug("len %d\n", skb->len);
 
         if (!ndev || (!test_bit(NCI_UP, &ndev->flags)
-                && !test_bit(NCI_INIT, &ndev->flags))) {
+                      && !test_bit(NCI_INIT, &ndev->flags))) {
                 kfree_skb(skb);
                 return -ENXIO;
         }
@@ -713,7 +795,7 @@ static void nci_tx_work(struct work_struct *work)
 
                 /* Check if data flow control is used */
                 if (atomic_read(&ndev->credits_cnt) !=
-                                NCI_DATA_FLOW_CONTROL_NOT_USED)
+                    NCI_DATA_FLOW_CONTROL_NOT_USED)
                         atomic_dec(&ndev->credits_cnt);
 
                 pr_debug("NCI TX: MT=data, PBF=%d, conn_id=%d, plen=%d\n",
@@ -722,6 +804,9 @@ static void nci_tx_work(struct work_struct *work)
                          nci_plen(skb->data));
 
                 nci_send_frame(skb);
+
+                mod_timer(&ndev->data_timer,
+                          jiffies + msecs_to_jiffies(NCI_DATA_TIMEOUT));
         }
 }
 
@@ -753,6 +838,15 @@ static void nci_rx_work(struct work_struct *work)
                         break;
                 }
         }
+
+        /* check if a data exchange timout has occurred */
+        if (test_bit(NCI_DATA_EXCHANGE_TO, &ndev->flags)) {
+                /* complete the data exchange transaction, if exists */
+                if (test_bit(NCI_DATA_EXCHANGE, &ndev->flags))
+                        nci_data_exchange_complete(ndev, NULL, -ETIMEDOUT);
+
+                clear_bit(NCI_DATA_EXCHANGE_TO, &ndev->flags);
+        }
 }
 
 /* ----- NCI TX CMD worker thread ----- */
@@ -781,6 +875,6 @@ static void nci_cmd_work(struct work_struct *work)
                 nci_send_frame(skb);
 
                 mod_timer(&ndev->cmd_timer,
-                        jiffies + msecs_to_jiffies(NCI_CMD_TIMEOUT));
+                          jiffies + msecs_to_jiffies(NCI_CMD_TIMEOUT));
         }
 }
diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c
index e5756b30e602..76c48c5324f8 100644
--- a/net/nfc/nci/data.c
+++ b/net/nfc/nci/data.c
@@ -35,8 +35,7 @@
 #include <linux/nfc.h>
 
 /* Complete data exchange transaction and forward skb to nfc core */
-void nci_data_exchange_complete(struct nci_dev *ndev,
-                                struct sk_buff *skb,
+void nci_data_exchange_complete(struct nci_dev *ndev, struct sk_buff *skb,
                                 int err)
 {
         data_exchange_cb_t cb = ndev->data_exchange_cb;
@@ -44,9 +43,13 @@ void nci_data_exchange_complete(struct nci_dev *ndev,
 
         pr_debug("len %d, err %d\n", skb ? skb->len : 0, err);
 
+        /* data exchange is complete, stop the data timer */
+        del_timer_sync(&ndev->data_timer);
+        clear_bit(NCI_DATA_EXCHANGE_TO, &ndev->flags);
+
         if (cb) {
                 ndev->data_exchange_cb = NULL;
-                ndev->data_exchange_cb_context = 0;
+                ndev->data_exchange_cb_context = NULL;
 
                 /* forward skb to nfc core */
                 cb(cb_context, skb, err);
@@ -63,9 +66,9 @@ void nci_data_exchange_complete(struct nci_dev *ndev,
 /* ----------------- NCI TX Data ----------------- */
 
 static inline void nci_push_data_hdr(struct nci_dev *ndev,
-                                        __u8 conn_id,
-                                        struct sk_buff *skb,
-                                        __u8 pbf)
+                                     __u8 conn_id,
+                                     struct sk_buff *skb,
+                                     __u8 pbf)
 {
         struct nci_data_hdr *hdr;
         int plen = skb->len;
@@ -82,8 +85,8 @@ static inline void nci_push_data_hdr(struct nci_dev *ndev,
 }
 
 static int nci_queue_tx_data_frags(struct nci_dev *ndev,
-                                        __u8 conn_id,
-                                        struct sk_buff *skb) {
+                                   __u8 conn_id,
+                                   struct sk_buff *skb) {
         int total_len = skb->len;
         unsigned char *data = skb->data;
         unsigned long flags;
@@ -101,8 +104,8 @@ static int nci_queue_tx_data_frags(struct nci_dev *ndev,
                         min_t(int, total_len, ndev->max_data_pkt_payload_size);
 
                 skb_frag = nci_skb_alloc(ndev,
-                                        (NCI_DATA_HDR_SIZE + frag_len),
-                                        GFP_KERNEL);
+                                         (NCI_DATA_HDR_SIZE + frag_len),
+                                         GFP_KERNEL);
                 if (skb_frag == NULL) {
                         rc = -ENOMEM;
                         goto free_exit;
@@ -114,7 +117,8 @@ static int nci_queue_tx_data_frags(struct nci_dev *ndev,
 
                 /* second, set the header */
                 nci_push_data_hdr(ndev, conn_id, skb_frag,
-                ((total_len == frag_len) ? (NCI_PBF_LAST) : (NCI_PBF_CONT)));
+                                  ((total_len == frag_len) ?
+                                   (NCI_PBF_LAST) : (NCI_PBF_CONT)));
 
                 __skb_queue_tail(&frags_q, skb_frag);
 
@@ -182,8 +186,8 @@ exit:
 /* ----------------- NCI RX Data ----------------- */
 
 static void nci_add_rx_data_frag(struct nci_dev *ndev,
-                                struct sk_buff *skb,
-                                __u8 pbf)
+                                 struct sk_buff *skb,
+                                 __u8 pbf)
 {
         int reassembly_len;
         int err = 0;
@@ -196,10 +200,10 @@ static void nci_add_rx_data_frag(struct nci_dev *ndev,
                         pr_err("error adding room for accumulated rx data\n");
 
                         kfree_skb(skb);
-                        skb = 0;
+                        skb = NULL;
 
                         kfree_skb(ndev->rx_data_reassembly);
-                        ndev->rx_data_reassembly = 0;
+                        ndev->rx_data_reassembly = NULL;
 
                         err = -ENOMEM;
                         goto exit;
@@ -207,12 +211,12 @@ static void nci_add_rx_data_frag(struct nci_dev *ndev,
 
                 /* second, combine the two fragments */
                 memcpy(skb_push(skb, reassembly_len),
-                                ndev->rx_data_reassembly->data,
-                                reassembly_len);
+                       ndev->rx_data_reassembly->data,
+                       reassembly_len);
 
                 /* third, free old reassembly */
                 kfree_skb(ndev->rx_data_reassembly);
-                ndev->rx_data_reassembly = 0;
+                ndev->rx_data_reassembly = NULL;
         }
 
         if (pbf == NCI_PBF_CONT) {
diff --git a/net/nfc/nci/lib.c b/net/nfc/nci/lib.c
index 6a63e5eb483d..6b7fd26c68d9 100644
--- a/net/nfc/nci/lib.c
+++ b/net/nfc/nci/lib.c
@@ -31,6 +31,7 @@
 #include <linux/errno.h>
 
 #include <net/nfc/nci.h>
+#include <net/nfc/nci_core.h>
 
 /* NCI status codes to Unix errno mapping */
 int nci_to_errno(__u8 code)
diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c
index b16a8dc2afbe..cb2646179e5f 100644
--- a/net/nfc/nci/ntf.c
+++ b/net/nfc/nci/ntf.c
@@ -40,7 +40,7 @@
 /* Handle NCI Notification packets */
 
 static void nci_core_conn_credits_ntf_packet(struct nci_dev *ndev,
-                                                struct sk_buff *skb)
+                                             struct sk_buff *skb)
 {
         struct nci_core_conn_credit_ntf *ntf = (void *) skb->data;
         int i;
@@ -62,7 +62,7 @@ static void nci_core_conn_credits_ntf_packet(struct nci_dev *ndev,
                 if (ntf->conn_entries[i].conn_id == NCI_STATIC_RF_CONN_ID) {
                         /* found static rf connection */
                         atomic_add(ntf->conn_entries[i].credits,
-                                &ndev->credits_cnt);
+                                   &ndev->credits_cnt);
                 }
         }
 
@@ -71,6 +71,20 @@ static void nci_core_conn_credits_ntf_packet(struct nci_dev *ndev,
                 queue_work(ndev->tx_wq, &ndev->tx_work);
 }
 
+static void nci_core_generic_error_ntf_packet(struct nci_dev *ndev,
+                                              struct sk_buff *skb)
+{
+        __u8 status = skb->data[0];
+
+        pr_debug("status 0x%x\n", status);
+
+        if (atomic_read(&ndev->state) == NCI_W4_HOST_SELECT) {
+                /* Activation failed, so complete the request
+                   (the state remains the same) */
+                nci_req_complete(ndev, status);
+        }
+}
+
 static void nci_core_conn_intf_error_ntf_packet(struct nci_dev *ndev,
                                                 struct sk_buff *skb)
 {
@@ -86,12 +100,9 @@ static void nci_core_conn_intf_error_ntf_packet(struct nci_dev *ndev,
 }
 
 static __u8 *nci_extract_rf_params_nfca_passive_poll(struct nci_dev *ndev,
-                        struct nci_rf_intf_activated_ntf *ntf, __u8 *data)
+                        struct rf_tech_specific_params_nfca_poll *nfca_poll,
+                                                     __u8 *data)
 {
-        struct rf_tech_specific_params_nfca_poll *nfca_poll;
-
-        nfca_poll = &ntf->rf_tech_specific_params.nfca_poll;
-
         nfca_poll->sens_res = __le16_to_cpu(*((__u16 *)data));
         data += 2;
 
@@ -115,79 +126,267 @@ static __u8 *nci_extract_rf_params_nfca_passive_poll(struct nci_dev *ndev,
         return data;
 }
 
+static __u8 *nci_extract_rf_params_nfcb_passive_poll(struct nci_dev *ndev,
+                        struct rf_tech_specific_params_nfcb_poll *nfcb_poll,
+                                                     __u8 *data)
+{
+        nfcb_poll->sensb_res_len = *data++;
+
+        pr_debug("sensb_res_len %d\n", nfcb_poll->sensb_res_len);
+
+        memcpy(nfcb_poll->sensb_res, data, nfcb_poll->sensb_res_len);
+        data += nfcb_poll->sensb_res_len;
+
+        return data;
+}
+
+static __u8 *nci_extract_rf_params_nfcf_passive_poll(struct nci_dev *ndev,
+                        struct rf_tech_specific_params_nfcf_poll *nfcf_poll,
+                                                     __u8 *data)
+{
+        nfcf_poll->bit_rate = *data++;
+        nfcf_poll->sensf_res_len = *data++;
+
+        pr_debug("bit_rate %d, sensf_res_len %d\n",
+                 nfcf_poll->bit_rate, nfcf_poll->sensf_res_len);
+
+        memcpy(nfcf_poll->sensf_res, data, nfcf_poll->sensf_res_len);
+        data += nfcf_poll->sensf_res_len;
+
+        return data;
+}
+
+static int nci_add_new_protocol(struct nci_dev *ndev,
+                                struct nfc_target *target,
+                                __u8 rf_protocol,
+                                __u8 rf_tech_and_mode,
+                                void *params)
+{
+        struct rf_tech_specific_params_nfca_poll *nfca_poll;
+        struct rf_tech_specific_params_nfcb_poll *nfcb_poll;
+        struct rf_tech_specific_params_nfcf_poll *nfcf_poll;
+        __u32 protocol;
+
+        if (rf_protocol == NCI_RF_PROTOCOL_T2T)
+                protocol = NFC_PROTO_MIFARE_MASK;
+        else if (rf_protocol == NCI_RF_PROTOCOL_ISO_DEP)
+                protocol = NFC_PROTO_ISO14443_MASK;
+        else if (rf_protocol == NCI_RF_PROTOCOL_T3T)
+                protocol = NFC_PROTO_FELICA_MASK;
+        else
+                protocol = 0;
+
+        if (!(protocol & ndev->poll_prots)) {
+                pr_err("the target found does not have the desired protocol\n");
+                return -EPROTO;
+        }
+
+        if (rf_tech_and_mode == NCI_NFC_A_PASSIVE_POLL_MODE) {
+                nfca_poll = (struct rf_tech_specific_params_nfca_poll *)params;
+
+                target->sens_res = nfca_poll->sens_res;
+                target->sel_res = nfca_poll->sel_res;
+                target->nfcid1_len = nfca_poll->nfcid1_len;
+                if (target->nfcid1_len > 0) {
+                        memcpy(target->nfcid1, nfca_poll->nfcid1,
+                               target->nfcid1_len);
+                }
+        } else if (rf_tech_and_mode == NCI_NFC_B_PASSIVE_POLL_MODE) {
+                nfcb_poll = (struct rf_tech_specific_params_nfcb_poll *)params;
+
+                target->sensb_res_len = nfcb_poll->sensb_res_len;
+                if (target->sensb_res_len > 0) {
+                        memcpy(target->sensb_res, nfcb_poll->sensb_res,
+                               target->sensb_res_len);
+                }
+        } else if (rf_tech_and_mode == NCI_NFC_F_PASSIVE_POLL_MODE) {
+                nfcf_poll = (struct rf_tech_specific_params_nfcf_poll *)params;
+
+                target->sensf_res_len = nfcf_poll->sensf_res_len;
+                if (target->sensf_res_len > 0) {
+                        memcpy(target->sensf_res, nfcf_poll->sensf_res,
+                               target->sensf_res_len);
+                }
+        } else {
+                pr_err("unsupported rf_tech_and_mode 0x%x\n", rf_tech_and_mode);
+                return -EPROTO;
+        }
+
+        target->supported_protocols |= protocol;
+
+        pr_debug("protocol 0x%x\n", protocol);
+
+        return 0;
+}
+
+static void nci_add_new_target(struct nci_dev *ndev,
+                               struct nci_rf_discover_ntf *ntf)
+{
+        struct nfc_target *target;
+        int i, rc;
+
+        for (i = 0; i < ndev->n_targets; i++) {
+                target = &ndev->targets[i];
+                if (target->logical_idx == ntf->rf_discovery_id) {
+                        /* This target already exists, add the new protocol */
+                        nci_add_new_protocol(ndev, target, ntf->rf_protocol,
+                                             ntf->rf_tech_and_mode,
+                                             &ntf->rf_tech_specific_params);
+                        return;
+                }
+        }
+
+        /* This is a new target, check if we've enough room */
+        if (ndev->n_targets == NCI_MAX_DISCOVERED_TARGETS) {
+                pr_debug("not enough room, ignoring new target...\n");
+                return;
+        }
+
+        target = &ndev->targets[ndev->n_targets];
+
+        rc = nci_add_new_protocol(ndev, target, ntf->rf_protocol,
+                                  ntf->rf_tech_and_mode,
+                                  &ntf->rf_tech_specific_params);
+        if (!rc) {
+                target->logical_idx = ntf->rf_discovery_id;
+                ndev->n_targets++;
+
+                pr_debug("logical idx %d, n_targets %d\n", target->logical_idx,
+                         ndev->n_targets);
+        }
+}
+
+void nci_clear_target_list(struct nci_dev *ndev)
+{
+        memset(ndev->targets, 0,
+               (sizeof(struct nfc_target)*NCI_MAX_DISCOVERED_TARGETS));
+
+        ndev->n_targets = 0;
+}
+
+static void nci_rf_discover_ntf_packet(struct nci_dev *ndev,
+                                       struct sk_buff *skb)
+{
+        struct nci_rf_discover_ntf ntf;
+        __u8 *data = skb->data;
+        bool add_target = true;
+
+        ntf.rf_discovery_id = *data++;
+        ntf.rf_protocol = *data++;
+        ntf.rf_tech_and_mode = *data++;
+        ntf.rf_tech_specific_params_len = *data++;
+
+        pr_debug("rf_discovery_id %d\n", ntf.rf_discovery_id);
+        pr_debug("rf_protocol 0x%x\n", ntf.rf_protocol);
+        pr_debug("rf_tech_and_mode 0x%x\n", ntf.rf_tech_and_mode);
+        pr_debug("rf_tech_specific_params_len %d\n",
+                 ntf.rf_tech_specific_params_len);
+
+        if (ntf.rf_tech_specific_params_len > 0) {
+                switch (ntf.rf_tech_and_mode) {
+                case NCI_NFC_A_PASSIVE_POLL_MODE:
+                        data = nci_extract_rf_params_nfca_passive_poll(ndev,
+                                &(ntf.rf_tech_specific_params.nfca_poll), data);
+                        break;
+
+                case NCI_NFC_B_PASSIVE_POLL_MODE:
+                        data = nci_extract_rf_params_nfcb_passive_poll(ndev,
+                                &(ntf.rf_tech_specific_params.nfcb_poll), data);
+                        break;
+
+                case NCI_NFC_F_PASSIVE_POLL_MODE:
+                        data = nci_extract_rf_params_nfcf_passive_poll(ndev,
+                                &(ntf.rf_tech_specific_params.nfcf_poll), data);
+                        break;
+
+                default:
+                        pr_err("unsupported rf_tech_and_mode 0x%x\n",
+                               ntf.rf_tech_and_mode);
+                        data += ntf.rf_tech_specific_params_len;
+                        add_target = false;
+                }
+        }
+
+        ntf.ntf_type = *data++;
+        pr_debug("ntf_type %d\n", ntf.ntf_type);
+
+        if (add_target == true)
+                nci_add_new_target(ndev, &ntf);
+
+        if (ntf.ntf_type == NCI_DISCOVER_NTF_TYPE_MORE) {
+                atomic_set(&ndev->state, NCI_W4_ALL_DISCOVERIES);
+        } else {
+                atomic_set(&ndev->state, NCI_W4_HOST_SELECT);
+                nfc_targets_found(ndev->nfc_dev, ndev->targets,
+                                  ndev->n_targets);
+        }
+}
+
 static int nci_extract_activation_params_iso_dep(struct nci_dev *ndev,
                         struct nci_rf_intf_activated_ntf *ntf, __u8 *data)
 {
         struct activation_params_nfca_poll_iso_dep *nfca_poll;
+        struct activation_params_nfcb_poll_iso_dep *nfcb_poll;
 
         switch (ntf->activation_rf_tech_and_mode) {
         case NCI_NFC_A_PASSIVE_POLL_MODE:
                 nfca_poll = &ntf->activation_params.nfca_poll_iso_dep;
                 nfca_poll->rats_res_len = *data++;
+                pr_debug("rats_res_len %d\n", nfca_poll->rats_res_len);
                 if (nfca_poll->rats_res_len > 0) {
                         memcpy(nfca_poll->rats_res,
-                                data,
-                                nfca_poll->rats_res_len);
+                               data, nfca_poll->rats_res_len);
+                }
+                break;
+
+        case NCI_NFC_B_PASSIVE_POLL_MODE:
+                nfcb_poll = &ntf->activation_params.nfcb_poll_iso_dep;
+                nfcb_poll->attrib_res_len = *data++;
+                pr_debug("attrib_res_len %d\n", nfcb_poll->attrib_res_len);
+                if (nfcb_poll->attrib_res_len > 0) {
+                        memcpy(nfcb_poll->attrib_res,
+                               data, nfcb_poll->attrib_res_len);
                 }
                 break;
 
         default:
                 pr_err("unsupported activation_rf_tech_and_mode 0x%x\n",
                        ntf->activation_rf_tech_and_mode);
-                return -EPROTO;
+                return NCI_STATUS_RF_PROTOCOL_ERROR;
         }
 
-        return 0;
+        return NCI_STATUS_OK;
 }
 
-static void nci_target_found(struct nci_dev *ndev,
-                                struct nci_rf_intf_activated_ntf *ntf)
+static void nci_target_auto_activated(struct nci_dev *ndev,
+                                      struct nci_rf_intf_activated_ntf *ntf)
 {
-        struct nfc_target nfc_tgt;
+        struct nfc_target *target;
+        int rc;
 
-        if (ntf->rf_protocol == NCI_RF_PROTOCOL_T2T)    /* T2T MifareUL */
-                nfc_tgt.supported_protocols = NFC_PROTO_MIFARE_MASK;
-        else if (ntf->rf_protocol == NCI_RF_PROTOCOL_ISO_DEP)   /* 4A */
-                nfc_tgt.supported_protocols = NFC_PROTO_ISO14443_MASK;
-        else
-                nfc_tgt.supported_protocols = 0;
-
-        nfc_tgt.sens_res = ntf->rf_tech_specific_params.nfca_poll.sens_res;
-        nfc_tgt.sel_res = ntf->rf_tech_specific_params.nfca_poll.sel_res;
-        nfc_tgt.nfcid1_len = ntf->rf_tech_specific_params.nfca_poll.nfcid1_len;
-        if (nfc_tgt.nfcid1_len > 0) {
-                memcpy(nfc_tgt.nfcid1,
-                        ntf->rf_tech_specific_params.nfca_poll.nfcid1,
-                        nfc_tgt.nfcid1_len);
-        }
+        target = &ndev->targets[ndev->n_targets];
 
-        if (!(nfc_tgt.supported_protocols & ndev->poll_prots)) {
-                pr_debug("the target found does not have the desired protocol\n");
+        rc = nci_add_new_protocol(ndev, target, ntf->rf_protocol,
+                                  ntf->activation_rf_tech_and_mode,
+                                  &ntf->rf_tech_specific_params);
+        if (rc)
                 return;
-        }
 
-        pr_debug("new target found,  supported_protocols 0x%x\n",
-                 nfc_tgt.supported_protocols);
+        target->logical_idx = ntf->rf_discovery_id;
+        ndev->n_targets++;
 
-        ndev->target_available_prots = nfc_tgt.supported_protocols;
-        ndev->max_data_pkt_payload_size = ntf->max_data_pkt_payload_size;
-        ndev->initial_num_credits = ntf->initial_num_credits;
+        pr_debug("logical idx %d, n_targets %d\n",
+                 target->logical_idx, ndev->n_targets);
 
-        /* set the available credits to initial value */
-        atomic_set(&ndev->credits_cnt, ndev->initial_num_credits);
-
-        nfc_targets_found(ndev->nfc_dev, &nfc_tgt, 1);
+        nfc_targets_found(ndev->nfc_dev, ndev->targets, ndev->n_targets);
 }
 
 static void nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
-                                                struct sk_buff *skb)
+                                             struct sk_buff *skb)
 {
         struct nci_rf_intf_activated_ntf ntf;
         __u8 *data = skb->data;
-        int err = 0;
-
-        clear_bit(NCI_DISCOVERY, &ndev->flags);
-        set_bit(NCI_POLL_ACTIVE, &ndev->flags);
+        int err = NCI_STATUS_OK;
 
         ntf.rf_discovery_id = *data++;
         ntf.rf_interface = *data++;
@@ -204,7 +403,8 @@ static void nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
                  ntf.activation_rf_tech_and_mode);
         pr_debug("max_data_pkt_payload_size 0x%x\n",
                  ntf.max_data_pkt_payload_size);
-        pr_debug("initial_num_credits 0x%x\n", ntf.initial_num_credits);
+        pr_debug("initial_num_credits 0x%x\n",
+                 ntf.initial_num_credits);
         pr_debug("rf_tech_specific_params_len %d\n",
                  ntf.rf_tech_specific_params_len);
 
@@ -212,13 +412,24 @@ static void nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
                 switch (ntf.activation_rf_tech_and_mode) {
                 case NCI_NFC_A_PASSIVE_POLL_MODE:
                         data = nci_extract_rf_params_nfca_passive_poll(ndev,
-                                &ntf, data);
+                                &(ntf.rf_tech_specific_params.nfca_poll), data);
+                        break;
+
+                case NCI_NFC_B_PASSIVE_POLL_MODE:
+                        data = nci_extract_rf_params_nfcb_passive_poll(ndev,
+                                &(ntf.rf_tech_specific_params.nfcb_poll), data);
+                        break;
+
+                case NCI_NFC_F_PASSIVE_POLL_MODE:
+                        data = nci_extract_rf_params_nfcf_passive_poll(ndev,
+                                &(ntf.rf_tech_specific_params.nfcf_poll), data);
                         break;
 
                 default:
                         pr_err("unsupported activation_rf_tech_and_mode 0x%x\n",
                                ntf.activation_rf_tech_and_mode);
-                        return;
+                        err = NCI_STATUS_RF_PROTOCOL_ERROR;
+                        goto exit;
                 }
         }
 
@@ -229,18 +440,15 @@ static void nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
 
         pr_debug("data_exch_rf_tech_and_mode 0x%x\n",
                  ntf.data_exch_rf_tech_and_mode);
-        pr_debug("data_exch_tx_bit_rate 0x%x\n",
-                 ntf.data_exch_tx_bit_rate);
-        pr_debug("data_exch_rx_bit_rate 0x%x\n",
-                 ntf.data_exch_rx_bit_rate);
-        pr_debug("activation_params_len %d\n",
-                 ntf.activation_params_len);
+        pr_debug("data_exch_tx_bit_rate 0x%x\n", ntf.data_exch_tx_bit_rate);
+        pr_debug("data_exch_rx_bit_rate 0x%x\n", ntf.data_exch_rx_bit_rate);
+        pr_debug("activation_params_len %d\n", ntf.activation_params_len);
 
         if (ntf.activation_params_len > 0) {
                 switch (ntf.rf_interface) {
                 case NCI_RF_INTERFACE_ISO_DEP:
                         err = nci_extract_activation_params_iso_dep(ndev,
-                                &ntf, data);
+                                                                    &ntf, data);
                         break;
 
                 case NCI_RF_INTERFACE_FRAME:
@@ -250,36 +458,55 @@ static void nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
                 default:
                         pr_err("unsupported rf_interface 0x%x\n",
                                ntf.rf_interface);
-                        return;
+                        err = NCI_STATUS_RF_PROTOCOL_ERROR;
+                        break;
                 }
         }
 
-        if (!err)
-                nci_target_found(ndev, &ntf);
+exit:
+        if (err == NCI_STATUS_OK) {
+                ndev->max_data_pkt_payload_size = ntf.max_data_pkt_payload_size;
+                ndev->initial_num_credits = ntf.initial_num_credits;
+
+                /* set the available credits to initial value */
+                atomic_set(&ndev->credits_cnt, ndev->initial_num_credits);
+        }
+
+        if (atomic_read(&ndev->state) == NCI_DISCOVERY) {
+                /* A single target was found and activated automatically */
+                atomic_set(&ndev->state, NCI_POLL_ACTIVE);
+                if (err == NCI_STATUS_OK)
+                        nci_target_auto_activated(ndev, &ntf);
+        } else {        /* ndev->state == NCI_W4_HOST_SELECT */
+                /* A selected target was activated, so complete the request */
+                atomic_set(&ndev->state, NCI_POLL_ACTIVE);
+                nci_req_complete(ndev, err);
+        }
 }
 
 static void nci_rf_deactivate_ntf_packet(struct nci_dev *ndev,
-                                        struct sk_buff *skb)
+                                         struct sk_buff *skb)
 {
         struct nci_rf_deactivate_ntf *ntf = (void *) skb->data;
 
         pr_debug("entry, type 0x%x, reason 0x%x\n", ntf->type, ntf->reason);
 
-        clear_bit(NCI_POLL_ACTIVE, &ndev->flags);
-        ndev->target_active_prot = 0;
-
         /* drop tx data queue */
         skb_queue_purge(&ndev->tx_q);
 
         /* drop partial rx data packet */
         if (ndev->rx_data_reassembly) {
                 kfree_skb(ndev->rx_data_reassembly);
-                ndev->rx_data_reassembly = 0;
+                ndev->rx_data_reassembly = NULL;
         }
 
         /* complete the data exchange transaction, if exists */
         if (test_bit(NCI_DATA_EXCHANGE, &ndev->flags))
                 nci_data_exchange_complete(ndev, NULL, -EIO);
+
+        nci_clear_target_list(ndev);
+        atomic_set(&ndev->state, NCI_IDLE);
+        nci_req_complete(ndev, NCI_STATUS_OK);
 }
 
 void nci_ntf_packet(struct nci_dev *ndev, struct sk_buff *skb)
@@ -300,10 +527,18 @@ void nci_ntf_packet(struct nci_dev *ndev, struct sk_buff *skb)
                 nci_core_conn_credits_ntf_packet(ndev, skb);
                 break;
 
+        case NCI_OP_CORE_GENERIC_ERROR_NTF:
+                nci_core_generic_error_ntf_packet(ndev, skb);
+                break;
+
         case NCI_OP_CORE_INTF_ERROR_NTF:
                 nci_core_conn_intf_error_ntf_packet(ndev, skb);
                 break;
 
+        case NCI_OP_RF_DISCOVER_NTF:
+                nci_rf_discover_ntf_packet(ndev, skb);
+                break;
+
         case NCI_OP_RF_INTF_ACTIVATED_NTF:
                 nci_rf_intf_activated_ntf_packet(ndev, skb);
                 break;
diff --git a/net/nfc/nci/rsp.c b/net/nfc/nci/rsp.c
index 2840ae2f3615..3003c3390e49 100644
--- a/net/nfc/nci/rsp.c
+++ b/net/nfc/nci/rsp.c
@@ -67,19 +67,18 @@ static void nci_core_init_rsp_packet(struct nci_dev *ndev, struct sk_buff *skb)
         ndev->num_supported_rf_interfaces = rsp_1->num_supported_rf_interfaces;
 
         if (ndev->num_supported_rf_interfaces >
-                        NCI_MAX_SUPPORTED_RF_INTERFACES) {
+            NCI_MAX_SUPPORTED_RF_INTERFACES) {
                 ndev->num_supported_rf_interfaces =
                         NCI_MAX_SUPPORTED_RF_INTERFACES;
         }
 
         memcpy(ndev->supported_rf_interfaces,
-                rsp_1->supported_rf_interfaces,
-                ndev->num_supported_rf_interfaces);
+               rsp_1->supported_rf_interfaces,
+               ndev->num_supported_rf_interfaces);
 
         rsp_2 = (void *) (skb->data + 6 + rsp_1->num_supported_rf_interfaces);
 
-        ndev->max_logical_connections =
-                rsp_2->max_logical_connections;
+        ndev->max_logical_connections = rsp_2->max_logical_connections;
         ndev->max_routing_table_size =
                 __le16_to_cpu(rsp_2->max_routing_table_size);
         ndev->max_ctrl_pkt_payload_len =
@@ -121,7 +120,7 @@ exit:
 }
 
 static void nci_rf_disc_map_rsp_packet(struct nci_dev *ndev,
-                                        struct sk_buff *skb)
+                                       struct sk_buff *skb)
 {
         __u8 status = skb->data[0];
 
@@ -137,21 +136,37 @@ static void nci_rf_disc_rsp_packet(struct nci_dev *ndev, struct sk_buff *skb)
         pr_debug("status 0x%x\n", status);
 
         if (status == NCI_STATUS_OK)
-                set_bit(NCI_DISCOVERY, &ndev->flags);
+                atomic_set(&ndev->state, NCI_DISCOVERY);
 
         nci_req_complete(ndev, status);
 }
 
-static void nci_rf_deactivate_rsp_packet(struct nci_dev *ndev,
-                                        struct sk_buff *skb)
+static void nci_rf_disc_select_rsp_packet(struct nci_dev *ndev,
+                                          struct sk_buff *skb)
 {
         __u8 status = skb->data[0];
 
         pr_debug("status 0x%x\n", status);
 
-        clear_bit(NCI_DISCOVERY, &ndev->flags);
+        /* Complete the request on intf_activated_ntf or generic_error_ntf */
+        if (status != NCI_STATUS_OK)
+                nci_req_complete(ndev, status);
+}
 
-        nci_req_complete(ndev, status);
+static void nci_rf_deactivate_rsp_packet(struct nci_dev *ndev,
+                                         struct sk_buff *skb)
+{
+        __u8 status = skb->data[0];
+
+        pr_debug("status 0x%x\n", status);
+
+        /* If target was active, complete the request only in deactivate_ntf */
+        if ((status != NCI_STATUS_OK) ||
+            (atomic_read(&ndev->state) != NCI_POLL_ACTIVE)) {
+                nci_clear_target_list(ndev);
+                atomic_set(&ndev->state, NCI_IDLE);
+                nci_req_complete(ndev, status);
+        }
 }
 
 void nci_rsp_packet(struct nci_dev *ndev, struct sk_buff *skb)
@@ -187,6 +202,10 @@ void nci_rsp_packet(struct nci_dev *ndev, struct sk_buff *skb)
                 nci_rf_disc_rsp_packet(ndev, skb);
                 break;
 
+        case NCI_OP_RF_DISCOVER_SELECT_RSP:
+                nci_rf_disc_select_rsp_packet(ndev, skb);
+                break;
+
         case NCI_OP_RF_DEACTIVATE_RSP:
                 nci_rf_deactivate_rsp_packet(ndev, skb);
                 break;
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index 6989dfa28ee2..581d419083aa 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -33,7 +33,7 @@ static struct genl_multicast_group nfc_genl_event_mcgrp = {
         .name = NFC_GENL_MCAST_EVENT_NAME,
 };
 
-struct genl_family nfc_genl_family = {
+static struct genl_family nfc_genl_family = {
         .id = GENL_ID_GENERATE,
         .hdrsize = 0,
         .name = NFC_GENL_NAME,
@@ -48,28 +48,38 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = {
         [NFC_ATTR_PROTOCOLS] = { .type = NLA_U32 },
         [NFC_ATTR_COMM_MODE] = { .type = NLA_U8 },
         [NFC_ATTR_RF_MODE] = { .type = NLA_U8 },
+        [NFC_ATTR_DEVICE_POWERED] = { .type = NLA_U8 },
 };
 
 static int nfc_genl_send_target(struct sk_buff *msg, struct nfc_target *target,
-                                        struct netlink_callback *cb, int flags)
+                                struct netlink_callback *cb, int flags)
 {
         void *hdr;
 
         hdr = genlmsg_put(msg, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
-                                &nfc_genl_family, flags, NFC_CMD_GET_TARGET);
+                          &nfc_genl_family, flags, NFC_CMD_GET_TARGET);
         if (!hdr)
                 return -EMSGSIZE;
 
         genl_dump_check_consistent(cb, hdr, &nfc_genl_family);
 
-        NLA_PUT_U32(msg, NFC_ATTR_TARGET_INDEX, target->idx);
-        NLA_PUT_U32(msg, NFC_ATTR_PROTOCOLS,
-                                target->supported_protocols);
-        NLA_PUT_U16(msg, NFC_ATTR_TARGET_SENS_RES, target->sens_res);
-        NLA_PUT_U8(msg, NFC_ATTR_TARGET_SEL_RES, target->sel_res);
-        if (target->nfcid1_len > 0)
-                NLA_PUT(msg, NFC_ATTR_TARGET_NFCID1, target->nfcid1_len,
-                                target->nfcid1);
+        if (nla_put_u32(msg, NFC_ATTR_TARGET_INDEX, target->idx) ||
+            nla_put_u32(msg, NFC_ATTR_PROTOCOLS, target->supported_protocols) ||
+            nla_put_u16(msg, NFC_ATTR_TARGET_SENS_RES, target->sens_res) ||
+            nla_put_u8(msg, NFC_ATTR_TARGET_SEL_RES, target->sel_res))
+                goto nla_put_failure;
+        if (target->nfcid1_len > 0 &&
+            nla_put(msg, NFC_ATTR_TARGET_NFCID1, target->nfcid1_len,
+                    target->nfcid1))
+                goto nla_put_failure;
+        if (target->sensb_res_len > 0 &&
+            nla_put(msg, NFC_ATTR_TARGET_SENSB_RES, target->sensb_res_len,
+                    target->sensb_res))
+                goto nla_put_failure;
+        if (target->sensf_res_len > 0 &&
+            nla_put(msg, NFC_ATTR_TARGET_SENSF_RES, target->sensf_res_len,
+                    target->sensf_res))
+                goto nla_put_failure;
 
         return genlmsg_end(msg, hdr);
 
@@ -85,9 +95,9 @@ static struct nfc_dev *__get_device_from_cb(struct netlink_callback *cb)
         u32 idx;
 
         rc = nlmsg_parse(cb->nlh, GENL_HDRLEN + nfc_genl_family.hdrsize,
-                                                nfc_genl_family.attrbuf,
-                                                nfc_genl_family.maxattr,
-                                                nfc_genl_policy);
+                         nfc_genl_family.attrbuf,
+                         nfc_genl_family.maxattr,
+                         nfc_genl_policy);
         if (rc < 0)
                 return ERR_PTR(rc);
 
@@ -104,7 +114,7 @@ static struct nfc_dev *__get_device_from_cb(struct netlink_callback *cb)
 }
 
 static int nfc_genl_dump_targets(struct sk_buff *skb,
-                                struct netlink_callback *cb)
+                                 struct netlink_callback *cb)
 {
         int i = cb->args[0];
         struct nfc_dev *dev = (struct nfc_dev *) cb->args[1];
@@ -118,20 +128,20 @@ static int nfc_genl_dump_targets(struct sk_buff *skb,
                 cb->args[1] = (long) dev;
         }
 
-        spin_lock_bh(&dev->targets_lock);
+        device_lock(&dev->dev);
 
         cb->seq = dev->targets_generation;
 
         while (i < dev->n_targets) {
                 rc = nfc_genl_send_target(skb, &dev->targets[i], cb,
-                                                                NLM_F_MULTI);
+                                          NLM_F_MULTI);
                 if (rc < 0)
                         break;
 
                 i++;
         }
 
-        spin_unlock_bh(&dev->targets_lock);
+        device_unlock(&dev->dev);
 
         cb->args[0] = i;
 
@@ -160,11 +170,12 @@ int nfc_genl_targets_found(struct nfc_dev *dev)
                 return -ENOMEM;
 
         hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
-                                NFC_EVENT_TARGETS_FOUND);
+                          NFC_EVENT_TARGETS_FOUND);
         if (!hdr)
                 goto free_msg;
 
-        NLA_PUT_U32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx);
+        if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -177,6 +188,37 @@ free_msg:
         return -EMSGSIZE;
 }
 
+int nfc_genl_target_lost(struct nfc_dev *dev, u32 target_idx)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
+                          NFC_EVENT_TARGET_LOST);
+        if (!hdr)
+                goto free_msg;
+
+        if (nla_put_string(msg, NFC_ATTR_DEVICE_NAME, nfc_device_name(dev)) ||
+            nla_put_u32(msg, NFC_ATTR_TARGET_INDEX, target_idx))
+                goto nla_put_failure;
+
+        genlmsg_end(msg, hdr);
+
+        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+
+        return 0;
+
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+free_msg:
+        nlmsg_free(msg);
+        return -EMSGSIZE;
+}
+
 int nfc_genl_device_added(struct nfc_dev *dev)
 {
         struct sk_buff *msg;
@@ -187,13 +229,15 @@ int nfc_genl_device_added(struct nfc_dev *dev)
                 return -ENOMEM;
 
         hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
-                                NFC_EVENT_DEVICE_ADDED);
+                          NFC_EVENT_DEVICE_ADDED);
         if (!hdr)
                 goto free_msg;
 
-        NLA_PUT_STRING(msg, NFC_ATTR_DEVICE_NAME, nfc_device_name(dev));
-        NLA_PUT_U32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx);
-        NLA_PUT_U32(msg, NFC_ATTR_PROTOCOLS, dev->supported_protocols);
+        if (nla_put_string(msg, NFC_ATTR_DEVICE_NAME, nfc_device_name(dev)) ||
+            nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx) ||
+            nla_put_u32(msg, NFC_ATTR_PROTOCOLS, dev->supported_protocols) ||
+            nla_put_u8(msg, NFC_ATTR_DEVICE_POWERED, dev->dev_up))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -218,11 +262,12 @@ int nfc_genl_device_removed(struct nfc_dev *dev)
                 return -ENOMEM;
 
         hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
-                                NFC_EVENT_DEVICE_REMOVED);
+                          NFC_EVENT_DEVICE_REMOVED);
         if (!hdr)
                 goto free_msg;
 
-        NLA_PUT_U32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx);
+        if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -238,23 +283,25 @@ free_msg:
 }
 
 static int nfc_genl_send_device(struct sk_buff *msg, struct nfc_dev *dev,
-                                                u32 pid, u32 seq,
-                                                struct netlink_callback *cb,
-                                                int flags)
+                                u32 pid, u32 seq,
+                                struct netlink_callback *cb,
+                                int flags)
 {
         void *hdr;
 
         hdr = genlmsg_put(msg, pid, seq, &nfc_genl_family, flags,
-                                                        NFC_CMD_GET_DEVICE);
+                          NFC_CMD_GET_DEVICE);
         if (!hdr)
                 return -EMSGSIZE;
 
         if (cb)
                 genl_dump_check_consistent(cb, hdr, &nfc_genl_family);
 
-        NLA_PUT_STRING(msg, NFC_ATTR_DEVICE_NAME, nfc_device_name(dev));
-        NLA_PUT_U32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx);
-        NLA_PUT_U32(msg, NFC_ATTR_PROTOCOLS, dev->supported_protocols);
+        if (nla_put_string(msg, NFC_ATTR_DEVICE_NAME, nfc_device_name(dev)) ||
+            nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx) ||
+            nla_put_u32(msg, NFC_ATTR_PROTOCOLS, dev->supported_protocols) ||
+            nla_put_u8(msg, NFC_ATTR_DEVICE_POWERED, dev->dev_up))
+                goto nla_put_failure;
 
         return genlmsg_end(msg, hdr);
 
@@ -264,7 +311,7 @@ nla_put_failure:
 }
 
 static int nfc_genl_dump_devices(struct sk_buff *skb,
-                                struct netlink_callback *cb)
+                                 struct netlink_callback *cb)
 {
         struct class_dev_iter *iter = (struct class_dev_iter *) cb->args[0];
         struct nfc_dev *dev = (struct nfc_dev *) cb->args[1];
@@ -291,8 +338,7 @@ static int nfc_genl_dump_devices(struct sk_buff *skb,
                 int rc;
 
                 rc = nfc_genl_send_device(skb, dev, NETLINK_CB(cb->skb).pid,
-                                                        cb->nlh->nlmsg_seq,
-                                                        cb, NLM_F_MULTI);
+                                          cb->nlh->nlmsg_seq, cb, NLM_F_MULTI);
                 if (rc < 0)
                         break;
 
@@ -317,7 +363,7 @@ static int nfc_genl_dump_devices_done(struct netlink_callback *cb)
 }
 
 int nfc_genl_dep_link_up_event(struct nfc_dev *dev, u32 target_idx,
-                                                u8 comm_mode, u8 rf_mode)
+                               u8 comm_mode, u8 rf_mode)
 {
         struct sk_buff *msg;
         void *hdr;
@@ -328,16 +374,18 @@ int nfc_genl_dep_link_up_event(struct nfc_dev *dev, u32 target_idx,
         if (!msg)
                 return -ENOMEM;
 
-        hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
-                                NFC_CMD_DEP_LINK_UP);
+        hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0, NFC_CMD_DEP_LINK_UP);
         if (!hdr)
                 goto free_msg;
 
-        NLA_PUT_U32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx);
-        if (rf_mode == NFC_RF_INITIATOR)
-                NLA_PUT_U32(msg, NFC_ATTR_TARGET_INDEX, target_idx);
-        NLA_PUT_U8(msg, NFC_ATTR_COMM_MODE, comm_mode);
-        NLA_PUT_U8(msg, NFC_ATTR_RF_MODE, rf_mode);
+        if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx))
+                goto nla_put_failure;
+        if (rf_mode == NFC_RF_INITIATOR &&
+            nla_put_u32(msg, NFC_ATTR_TARGET_INDEX, target_idx))
+                goto nla_put_failure;
+        if (nla_put_u8(msg, NFC_ATTR_COMM_MODE, comm_mode) ||
+            nla_put_u8(msg, NFC_ATTR_RF_MODE, rf_mode))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -366,11 +414,12 @@ int nfc_genl_dep_link_down_event(struct nfc_dev *dev)
                 return -ENOMEM;
 
         hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
-                                NFC_CMD_DEP_LINK_DOWN);
+                          NFC_CMD_DEP_LINK_DOWN);
         if (!hdr)
                 goto free_msg;
 
-        NLA_PUT_U32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx);
+        if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -408,7 +457,7 @@ static int nfc_genl_get_device(struct sk_buff *skb, struct genl_info *info)
         }
 
         rc = nfc_genl_send_device(msg, dev, info->snd_pid, info->snd_seq,
-                                                                NULL, 0);
+                                  NULL, 0);
         if (rc < 0)
                 goto out_free;
 
@@ -475,7 +524,7 @@ static int nfc_genl_start_poll(struct sk_buff *skb, struct genl_info *info)
         pr_debug("Poll start\n");
 
         if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
-                !info->attrs[NFC_ATTR_PROTOCOLS])
+            !info->attrs[NFC_ATTR_PROTOCOLS])
                 return -EINVAL;
 
         idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
@@ -533,13 +582,12 @@ static int nfc_genl_dep_link_up(struct sk_buff *skb, struct genl_info *info)
         struct nfc_dev *dev;
         int rc, tgt_idx;
         u32 idx;
-        u8 comm, rf;
+        u8 comm;
 
         pr_debug("DEP link up\n");
 
         if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
-                        !info->attrs[NFC_ATTR_COMM_MODE] ||
-                        !info->attrs[NFC_ATTR_RF_MODE])
+            !info->attrs[NFC_ATTR_COMM_MODE])
                 return -EINVAL;
 
         idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
@@ -549,19 +597,15 @@ static int nfc_genl_dep_link_up(struct sk_buff *skb, struct genl_info *info)
                 tgt_idx = nla_get_u32(info->attrs[NFC_ATTR_TARGET_INDEX]);
 
         comm = nla_get_u8(info->attrs[NFC_ATTR_COMM_MODE]);
-        rf = nla_get_u8(info->attrs[NFC_ATTR_RF_MODE]);
 
         if (comm != NFC_COMM_ACTIVE && comm != NFC_COMM_PASSIVE)
                 return -EINVAL;
 
-        if (rf != NFC_RF_INITIATOR && comm != NFC_RF_TARGET)
-                return -EINVAL;
-
         dev = nfc_get_device(idx);
         if (!dev)
                 return -ENODEV;
 
-        rc = nfc_dep_link_up(dev, tgt_idx, comm, rf);
+        rc = nfc_dep_link_up(dev, tgt_idx, comm);
 
         nfc_put_device(dev);
 
@@ -636,7 +680,7 @@ static struct genl_ops nfc_genl_ops[] = {
 };
 
 static int nfc_genl_rcv_nl_event(struct notifier_block *this,
-                                                unsigned long event, void *ptr)
+                                 unsigned long event, void *ptr)
 {
         struct netlink_notify *n = ptr;
         struct class_dev_iter iter;
@@ -689,7 +733,7 @@ int __init nfc_genl_init(void)
         int rc;
 
         rc = genl_register_family_with_ops(&nfc_genl_family, nfc_genl_ops,
-                                        ARRAY_SIZE(nfc_genl_ops));
+                                           ARRAY_SIZE(nfc_genl_ops));
         if (rc)
                 return rc;
 
diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h
index 6d28d75995b0..3dd4232ae664 100644
--- a/net/nfc/nfc.h
+++ b/net/nfc/nfc.h
@@ -32,7 +32,7 @@ struct nfc_protocol {
         struct proto *proto;
         struct module *owner;
         int (*create)(struct net *net, struct socket *sock,
-                        const struct nfc_protocol *nfc_proto);
+                      const struct nfc_protocol *nfc_proto);
 };
 
 struct nfc_rawsock {
@@ -54,7 +54,7 @@ void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx,
 int nfc_llcp_register_device(struct nfc_dev *dev);
 void nfc_llcp_unregister_device(struct nfc_dev *dev);
 int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len);
-u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, u8 *general_bytes_len);
+u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len);
 int __init nfc_llcp_init(void);
 void nfc_llcp_exit(void);
 
@@ -65,7 +65,7 @@ static inline void nfc_llcp_mac_is_down(struct nfc_dev *dev)
 }
 
 static inline void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx,
-                        u8 comm_mode, u8 rf_mode)
+                                      u8 comm_mode, u8 rf_mode)
 {
 }
 
@@ -78,12 +78,13 @@ static inline void nfc_llcp_unregister_device(struct nfc_dev *dev)
 {
 }
 
-static inline int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len)
+static inline int nfc_llcp_set_remote_gb(struct nfc_dev *dev,
+                                         u8 *gb, u8 gb_len)
 {
         return 0;
 }
 
-static inline u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, u8 *gb_len)
+static inline u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *gb_len)
 {
         *gb_len = 0;
         return NULL;
@@ -118,6 +119,7 @@ void nfc_genl_data_init(struct nfc_genl_data *genl_data);
 void nfc_genl_data_exit(struct nfc_genl_data *genl_data);
 
 int nfc_genl_targets_found(struct nfc_dev *dev);
+int nfc_genl_target_lost(struct nfc_dev *dev, u32 target_idx);
 
 int nfc_genl_device_added(struct nfc_dev *dev);
 int nfc_genl_device_removed(struct nfc_dev *dev);
@@ -126,7 +128,7 @@ int nfc_genl_dep_link_up_event(struct nfc_dev *dev, u32 target_idx,
                                u8 comm_mode, u8 rf_mode);
 int nfc_genl_dep_link_down_event(struct nfc_dev *dev);
 
-struct nfc_dev *nfc_get_device(unsigned idx);
+struct nfc_dev *nfc_get_device(unsigned int idx);
 
 static inline void nfc_put_device(struct nfc_dev *dev)
 {
@@ -160,8 +162,7 @@ int nfc_start_poll(struct nfc_dev *dev, u32 protocols);
 
 int nfc_stop_poll(struct nfc_dev *dev);
 
-int nfc_dep_link_up(struct nfc_dev *dev, int target_idx,
-                                u8 comm_mode, u8 rf_mode);
+int nfc_dep_link_up(struct nfc_dev *dev, int target_idx, u8 comm_mode);
 
 int nfc_dep_link_down(struct nfc_dev *dev);
 
@@ -169,9 +170,7 @@ int nfc_activate_target(struct nfc_dev *dev, u32 target_idx, u32 protocol);
 
 int nfc_deactivate_target(struct nfc_dev *dev, u32 target_idx);
 
-int nfc_data_exchange(struct nfc_dev *dev, u32 target_idx,
-                                        struct sk_buff *skb,
-                                        data_exchange_cb_t cb,
-                                        void *cb_context);
+int nfc_data_exchange(struct nfc_dev *dev, u32 target_idx, struct sk_buff *skb,
+                      data_exchange_cb_t cb, void *cb_context);
 
 #endif /* __LOCAL_NFC_H */
diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
index 2e2f8c6a61fe..ec1134c9e07f 100644
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -63,7 +63,7 @@ static int rawsock_release(struct socket *sock)
 }
 
 static int rawsock_connect(struct socket *sock, struct sockaddr *_addr,
-                                                        int len, int flags)
+                           int len, int flags)
 {
         struct sock *sk = sock->sk;
         struct sockaddr_nfc *addr = (struct sockaddr_nfc *)_addr;
@@ -73,7 +73,7 @@ static int rawsock_connect(struct socket *sock, struct sockaddr *_addr,
         pr_debug("sock=%p sk=%p flags=%d\n", sock, sk, flags);
 
         if (!addr || len < sizeof(struct sockaddr_nfc) ||
-                addr->sa_family != AF_NFC)
+            addr->sa_family != AF_NFC)
                 return -EINVAL;
 
         pr_debug("addr dev_idx=%u target_idx=%u protocol=%u\n",
@@ -92,14 +92,8 @@ static int rawsock_connect(struct socket *sock, struct sockaddr *_addr,
                 goto error;
         }
 
-        if (addr->target_idx > dev->target_idx - 1 ||
-                addr->target_idx < dev->target_idx - dev->n_targets) {
-                rc = -EINVAL;
-                goto error;
-        }
-
-        if (addr->target_idx > dev->target_idx - 1 ||
-                addr->target_idx < dev->target_idx - dev->n_targets) {
+        if (addr->target_idx > dev->target_next_idx - 1 ||
+            addr->target_idx < dev->target_next_idx - dev->n_targets) {
                 rc = -EINVAL;
                 goto error;
         }
@@ -132,7 +126,7 @@ static int rawsock_add_header(struct sk_buff *skb)
 }
 
 static void rawsock_data_exchange_complete(void *context, struct sk_buff *skb,
-                                                                int err)
+                                           int err)
 {
         struct sock *sk = (struct sock *) context;
 
@@ -185,7 +179,7 @@ static void rawsock_tx_work(struct work_struct *work)
 
         sock_hold(sk);
         rc = nfc_data_exchange(dev, target_idx, skb,
-                                rawsock_data_exchange_complete, sk);
+                               rawsock_data_exchange_complete, sk);
         if (rc) {
                 rawsock_report_error(sk, rc);
                 sock_put(sk);
@@ -193,7 +187,7 @@ static void rawsock_tx_work(struct work_struct *work)
 }
 
 static int rawsock_sendmsg(struct kiocb *iocb, struct socket *sock,
-                                        struct msghdr *msg, size_t len)
+                           struct msghdr *msg, size_t len)
 {
         struct sock *sk = sock->sk;
         struct nfc_dev *dev = nfc_rawsock(sk)->dev;
@@ -230,7 +224,7 @@ static int rawsock_sendmsg(struct kiocb *iocb, struct socket *sock,
 }
 
 static int rawsock_recvmsg(struct kiocb *iocb, struct socket *sock,
-                                struct msghdr *msg, size_t len, int flags)
+                           struct msghdr *msg, size_t len, int flags)
 {
         int noblock = flags & MSG_DONTWAIT;
         struct sock *sk = sock->sk;
@@ -286,7 +280,7 @@ static void rawsock_destruct(struct sock *sk)
 
         if (sk->sk_state == TCP_ESTABLISHED) {
                 nfc_deactivate_target(nfc_rawsock(sk)->dev,
-                                        nfc_rawsock(sk)->target_idx);
+                                      nfc_rawsock(sk)->target_idx);
                 nfc_put_device(nfc_rawsock(sk)->dev);
         }
 
@@ -299,7 +293,7 @@ static void rawsock_destruct(struct sock *sk)
 }
 
 static int rawsock_create(struct net *net, struct socket *sock,
-                                const struct nfc_protocol *nfc_proto)
+                          const struct nfc_protocol *nfc_proto)
 {
         struct sock *sk;
 
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 2c030505b335..2c74daa5aca5 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -38,7 +38,6 @@
 #include <linux/udp.h>
 #include <linux/ethtool.h>
 #include <linux/wait.h>
-#include <asm/system.h>
 #include <asm/div64.h>
 #include <linux/highmem.h>
 #include <linux/netfilter_bridge.h>
@@ -322,7 +321,7 @@ static int queue_userspace_packet(int dp_ifindex, struct sk_buff *skb,
                         return -ENOMEM;
 
                 nskb = __vlan_put_tag(nskb, vlan_tx_tag_get(nskb));
-                if (!skb)
+                if (!nskb)
                         return -ENOMEM;
 
                 nskb->vlan_tci = 0;
@@ -422,6 +421,19 @@ static int validate_sample(const struct nlattr *attr,
         return validate_actions(actions, key, depth + 1);
 }
 
+static int validate_tp_port(const struct sw_flow_key *flow_key)
+{
+        if (flow_key->eth.type == htons(ETH_P_IP)) {
+                if (flow_key->ipv4.tp.src && flow_key->ipv4.tp.dst)
+                        return 0;
+        } else if (flow_key->eth.type == htons(ETH_P_IPV6)) {
+                if (flow_key->ipv6.tp.src && flow_key->ipv6.tp.dst)
+                        return 0;
+        }
+
+        return -EINVAL;
+}
+
 static int validate_set(const struct nlattr *a,
                         const struct sw_flow_key *flow_key)
 {
@@ -463,18 +475,13 @@ static int validate_set(const struct nlattr *a,
                 if (flow_key->ip.proto != IPPROTO_TCP)
                         return -EINVAL;
 
-                if (!flow_key->ipv4.tp.src || !flow_key->ipv4.tp.dst)
-                        return -EINVAL;
-
-                break;
+                return validate_tp_port(flow_key);
 
         case OVS_KEY_ATTR_UDP:
                 if (flow_key->ip.proto != IPPROTO_UDP)
                         return -EINVAL;
 
-                if (!flow_key->ipv4.tp.src || !flow_key->ipv4.tp.dst)
-                        return -EINVAL;
-                break;
+                return validate_tp_port(flow_key);
 
         default:
                 return -EINVAL;
@@ -779,15 +786,18 @@ static int ovs_flow_cmd_fill_info(struct sw_flow *flow, struct datapath *dp,
         tcp_flags = flow->tcp_flags;
         spin_unlock_bh(&flow->lock);
 
-        if (used)
-                NLA_PUT_U64(skb, OVS_FLOW_ATTR_USED, ovs_flow_used_time(used));
+        if (used &&
+            nla_put_u64(skb, OVS_FLOW_ATTR_USED, ovs_flow_used_time(used)))
+                goto nla_put_failure;
 
-        if (stats.n_packets)
-                NLA_PUT(skb, OVS_FLOW_ATTR_STATS,
-                        sizeof(struct ovs_flow_stats), &stats);
+        if (stats.n_packets &&
+            nla_put(skb, OVS_FLOW_ATTR_STATS,
+                    sizeof(struct ovs_flow_stats), &stats))
+                goto nla_put_failure;
 
-        if (tcp_flags)
-                NLA_PUT_U8(skb, OVS_FLOW_ATTR_TCP_FLAGS, tcp_flags);
+        if (tcp_flags &&
+            nla_put_u8(skb, OVS_FLOW_ATTR_TCP_FLAGS, tcp_flags))
+                goto nla_put_failure;
 
         /* If OVS_FLOW_ATTR_ACTIONS doesn't fit, skip dumping the actions if
          * this is the first flow to be dumped into 'skb'.  This is unusual for
@@ -1169,7 +1179,8 @@ static int ovs_dp_cmd_fill_info(struct datapath *dp, struct sk_buff *skb,
                 goto nla_put_failure;
 
         get_dp_stats(dp, &dp_stats);
-        NLA_PUT(skb, OVS_DP_ATTR_STATS, sizeof(struct ovs_dp_stats), &dp_stats);
+        if (nla_put(skb, OVS_DP_ATTR_STATS, sizeof(struct ovs_dp_stats), &dp_stats))
+                goto nla_put_failure;
 
         return genlmsg_end(skb, ovs_header);
 
@@ -1469,14 +1480,16 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb,
 
         ovs_header->dp_ifindex = get_dpifindex(vport->dp);
 
-        NLA_PUT_U32(skb, OVS_VPORT_ATTR_PORT_NO, vport->port_no);
-        NLA_PUT_U32(skb, OVS_VPORT_ATTR_TYPE, vport->ops->type);
-        NLA_PUT_STRING(skb, OVS_VPORT_ATTR_NAME, vport->ops->get_name(vport));
-        NLA_PUT_U32(skb, OVS_VPORT_ATTR_UPCALL_PID, vport->upcall_pid);
+        if (nla_put_u32(skb, OVS_VPORT_ATTR_PORT_NO, vport->port_no) ||
+            nla_put_u32(skb, OVS_VPORT_ATTR_TYPE, vport->ops->type) ||
+            nla_put_string(skb, OVS_VPORT_ATTR_NAME, vport->ops->get_name(vport)) ||
+            nla_put_u32(skb, OVS_VPORT_ATTR_UPCALL_PID, vport->upcall_pid))
+                goto nla_put_failure;
 
         ovs_vport_get_stats(vport, &vport_stats);
-        NLA_PUT(skb, OVS_VPORT_ATTR_STATS, sizeof(struct ovs_vport_stats),
-                &vport_stats);
+        if (nla_put(skb, OVS_VPORT_ATTR_STATS, sizeof(struct ovs_vport_stats),
+                    &vport_stats))
+                goto nla_put_failure;
 
         err = ovs_vport_get_options(vport, skb);
         if (err == -EMSGSIZE)
@@ -1642,10 +1655,9 @@ static int ovs_vport_cmd_set(struct sk_buff *skb, struct genl_info *info)
         reply = ovs_vport_cmd_build_info(vport, info->snd_pid, info->snd_seq,
                                          OVS_VPORT_CMD_NEW);
         if (IS_ERR(reply)) {
-                err = PTR_ERR(reply);
                 netlink_set_err(init_net.genl_sock, 0,
-                                ovs_dp_vport_multicast_group.id, err);
-                return 0;
+                                ovs_dp_vport_multicast_group.id, PTR_ERR(reply));
+                goto exit_unlock;
         }
 
         genl_notify(reply, genl_info_net(info), info->snd_pid,
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 1252c3081ef1..6d4d8097cf96 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -183,7 +183,8 @@ void ovs_flow_used(struct sw_flow *flow, struct sk_buff *skb)
         u8 tcp_flags = 0;
 
         if (flow->key.eth.type == htons(ETH_P_IP) &&
-            flow->key.ip.proto == IPPROTO_TCP) {
+            flow->key.ip.proto == IPPROTO_TCP &&
+            likely(skb->len >= skb_transport_offset(skb) + sizeof(struct tcphdr))) {
                 u8 *tcp = (u8 *)tcp_hdr(skb);
                 tcp_flags = *(tcp + TCP_FLAGS_OFFSET) & TCP_FLAG_MASK;
         }
@@ -1174,11 +1175,13 @@ int ovs_flow_to_nlattrs(const struct sw_flow_key *swkey, struct sk_buff *skb)
         struct ovs_key_ethernet *eth_key;
         struct nlattr *nla, *encap;
 
-        if (swkey->phy.priority)
-                NLA_PUT_U32(skb, OVS_KEY_ATTR_PRIORITY, swkey->phy.priority);
+        if (swkey->phy.priority &&
+            nla_put_u32(skb, OVS_KEY_ATTR_PRIORITY, swkey->phy.priority))
+                goto nla_put_failure;
 
-        if (swkey->phy.in_port != USHRT_MAX)
-                NLA_PUT_U32(skb, OVS_KEY_ATTR_IN_PORT, swkey->phy.in_port);
+        if (swkey->phy.in_port != USHRT_MAX &&
+            nla_put_u32(skb, OVS_KEY_ATTR_IN_PORT, swkey->phy.in_port))
+                goto nla_put_failure;
 
         nla = nla_reserve(skb, OVS_KEY_ATTR_ETHERNET, sizeof(*eth_key));
         if (!nla)
@@ -1188,8 +1191,9 @@ int ovs_flow_to_nlattrs(const struct sw_flow_key *swkey, struct sk_buff *skb)
         memcpy(eth_key->eth_dst, swkey->eth.dst, ETH_ALEN);
 
         if (swkey->eth.tci || swkey->eth.type == htons(ETH_P_8021Q)) {
-                NLA_PUT_BE16(skb, OVS_KEY_ATTR_ETHERTYPE, htons(ETH_P_8021Q));
-                NLA_PUT_BE16(skb, OVS_KEY_ATTR_VLAN, swkey->eth.tci);
+                if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, htons(ETH_P_8021Q)) ||
+                    nla_put_be16(skb, OVS_KEY_ATTR_VLAN, swkey->eth.tci))
+                        goto nla_put_failure;
                 encap = nla_nest_start(skb, OVS_KEY_ATTR_ENCAP);
                 if (!swkey->eth.tci)
                         goto unencap;
@@ -1200,7 +1204,8 @@ int ovs_flow_to_nlattrs(const struct sw_flow_key *swkey, struct sk_buff *skb)
         if (swkey->eth.type == htons(ETH_P_802_2))
                 goto unencap;
 
-        NLA_PUT_BE16(skb, OVS_KEY_ATTR_ETHERTYPE, swkey->eth.type);
+        if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, swkey->eth.type))
+                goto nla_put_failure;
 
         if (swkey->eth.type == htons(ETH_P_IP)) {
                 struct ovs_key_ipv4 *ipv4_key;
diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
index 322b8d206693..b6b1d7daa3cb 100644
--- a/net/openvswitch/vport-internal_dev.c
+++ b/net/openvswitch/vport-internal_dev.c
@@ -66,6 +66,7 @@ static int internal_dev_mac_addr(struct net_device *dev, void *p)
 
         if (!is_valid_ether_addr(addr->sa_data))
                 return -EADDRNOTAVAIL;
+        dev->addr_assign_type &= ~NET_ADDR_RANDOM;
         memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
         return 0;
 }
@@ -145,7 +146,7 @@ static void do_setup(struct net_device *netdev)
         netdev->vlan_features = netdev->features;
         netdev->features |= NETIF_F_HW_VLAN_TX;
         netdev->hw_features = netdev->features & ~NETIF_F_LLTX;
-        random_ether_addr(netdev->dev_addr);
+        eth_hw_addr_random(netdev);
 }
 
 static struct vport *internal_dev_create(const struct vport_parms *parms)
diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c
index c1068aed03d1..3fd6c0d88e12 100644
--- a/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -140,9 +140,9 @@ int ovs_netdev_get_ifindex(const struct vport *vport)
         return netdev_vport->dev->ifindex;
 }
 
-static unsigned packet_length(const struct sk_buff *skb)
+static unsigned int packet_length(const struct sk_buff *skb)
 {
-        unsigned length = skb->len - ETH_HLEN;
+        unsigned int length = skb->len - ETH_HLEN;
 
         if (skb->protocol == htons(ETH_P_8021Q))
                 length -= VLAN_HLEN;
@@ -157,9 +157,9 @@ static int netdev_send(struct vport *vport, struct sk_buff *skb)
         int len;
 
         if (unlikely(packet_length(skb) > mtu && !skb_is_gso(skb))) {
-                if (net_ratelimit())
-                        pr_warn("%s: dropped over-mtu packet: %d > %d\n",
-                                ovs_dp_name(vport->dp), packet_length(skb), mtu);
+                net_warn_ratelimited("%s: dropped over-mtu packet: %d > %d\n",
+                                     ovs_dp_name(vport->dp),
+                                     packet_length(skb), mtu);
                 goto error;
         }
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 2dbb32b988c4..0f661745df0f 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -73,7 +73,6 @@
 #include <net/sock.h>
 #include <linux/errno.h>
 #include <linux/timer.h>
-#include <asm/system.h>
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
 #include <asm/page.h>
@@ -1459,6 +1458,7 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
         struct net_device *dev;
         __be16 proto = 0;
         int err;
+        int extra_len = 0;
 
         /*
          *      Get and verify the address.
@@ -1493,8 +1493,16 @@ retry:
          * raw protocol and you must do your own fragmentation at this level.
          */
 
+        if (unlikely(sock_flag(sk, SOCK_NOFCS))) {
+                if (!netif_supports_nofcs(dev)) {
+                        err = -EPROTONOSUPPORT;
+                        goto out_unlock;
+                }
+                extra_len = 4; /* We're doing our own CRC */
+        }
+
         err = -EMSGSIZE;
-        if (len > dev->mtu + dev->hard_header_len + VLAN_HLEN)
+        if (len > dev->mtu + dev->hard_header_len + VLAN_HLEN + extra_len)
                 goto out_unlock;
 
         if (!skb) {
@@ -1526,7 +1534,7 @@ retry:
                 goto retry;
         }
 
-        if (len > (dev->mtu + dev->hard_header_len)) {
+        if (len > (dev->mtu + dev->hard_header_len + extra_len)) {
                 /* Earlier code assumed this would be a VLAN pkt,
                  * double-check this now that we have the actual
                  * packet in hand.
@@ -1548,6 +1556,9 @@ retry:
         if (err < 0)
                 goto out_unlock;
 
+        if (unlikely(extra_len == 4))
+                skb->no_fcs = 1;
+
         dev_queue_xmit(skb);
         rcu_read_unlock();
         return len;
@@ -1643,7 +1654,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
                         skb->data = skb_head;
                         skb->len = skb_len;
                 }
-                kfree_skb(skb);
+                consume_skb(skb);
                 skb = nskb;
         }
 
@@ -1753,7 +1764,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
                 macoff = netoff = TPACKET_ALIGN(po->tp_hdrlen) + 16 +
                                   po->tp_reserve;
         } else {
-                unsigned maclen = skb_network_offset(skb);
+                unsigned int maclen = skb_network_offset(skb);
                 netoff = TPACKET_ALIGN(po->tp_hdrlen +
                                        (maclen < 16 ? 16 : maclen)) +
                         po->tp_reserve;
@@ -2209,6 +2220,7 @@ static int packet_snd(struct socket *sock,
         struct packet_sock *po = pkt_sk(sk);
         unsigned short gso_type = 0;
         int hlen, tlen;
+        int extra_len = 0;
 
         /*
          *      Get and verify the address.
@@ -2288,8 +2300,16 @@ static int packet_snd(struct socket *sock,
                 }
         }
 
+        if (unlikely(sock_flag(sk, SOCK_NOFCS))) {
+                if (!netif_supports_nofcs(dev)) {
+                        err = -EPROTONOSUPPORT;
+                        goto out_unlock;
+                }
+                extra_len = 4; /* We're doing our own CRC */
+        }
+
         err = -EMSGSIZE;
-        if (!gso_type && (len > dev->mtu + reserve + VLAN_HLEN))
+        if (!gso_type && (len > dev->mtu + reserve + VLAN_HLEN + extra_len))
                 goto out_unlock;
 
         err = -ENOBUFS;
@@ -2315,7 +2335,7 @@ static int packet_snd(struct socket *sock,
         if (err < 0)
                 goto out_free;
 
-        if (!gso_type && (len > dev->mtu + reserve)) {
+        if (!gso_type && (len > dev->mtu + reserve + extra_len)) {
                 /* Earlier code assumed this would be a VLAN pkt,
                  * double-check this now that we have the actual
                  * packet in hand.
@@ -2353,6 +2373,9 @@ static int packet_snd(struct socket *sock,
                 len += vnet_hdr_len;
         }
 
+        if (unlikely(extra_len == 4))
+                skb->no_fcs = 1;
+
         /*
          *      Now send it
          */
@@ -3201,10 +3224,10 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
                              char __user *optval, int __user *optlen)
 {
         int len;
-        int val;
+        int val, lv = sizeof(val);
         struct sock *sk = sock->sk;
         struct packet_sock *po = pkt_sk(sk);
-        void *data;
+        void *data = &val;
         struct tpacket_stats st;
         union tpacket_stats_u st_u;
 
@@ -3219,21 +3242,17 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
 
         switch (optname) {
         case PACKET_STATISTICS:
-                if (po->tp_version == TPACKET_V3) {
-                        len = sizeof(struct tpacket_stats_v3);
-                } else {
-                        if (len > sizeof(struct tpacket_stats))
-                                len = sizeof(struct tpacket_stats);
-                }
                 spin_lock_bh(&sk->sk_receive_queue.lock);
                 if (po->tp_version == TPACKET_V3) {
+                        lv = sizeof(struct tpacket_stats_v3);
                         memcpy(&st_u.stats3, &po->stats,
-                        sizeof(struct tpacket_stats));
+                               sizeof(struct tpacket_stats));
                         st_u.stats3.tp_freeze_q_cnt =
-                        po->stats_u.stats3.tp_freeze_q_cnt;
+                                        po->stats_u.stats3.tp_freeze_q_cnt;
                         st_u.stats3.tp_packets += po->stats.tp_drops;
                         data = &st_u.stats3;
                 } else {
+                        lv = sizeof(struct tpacket_stats);
                         st = po->stats;
                         st.tp_packets += st.tp_drops;
                         data = &st;
@@ -3242,31 +3261,16 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
                 spin_unlock_bh(&sk->sk_receive_queue.lock);
                 break;
         case PACKET_AUXDATA:
-                if (len > sizeof(int))
-                        len = sizeof(int);
                 val = po->auxdata;
-
-                data = &val;
                 break;
         case PACKET_ORIGDEV:
-                if (len > sizeof(int))
-                        len = sizeof(int);
                 val = po->origdev;
-
-                data = &val;
                 break;
         case PACKET_VNET_HDR:
-                if (len > sizeof(int))
-                        len = sizeof(int);
                 val = po->has_vnet_hdr;
-
-                data = &val;
                 break;
         case PACKET_VERSION:
-                if (len > sizeof(int))
-                        len = sizeof(int);
                 val = po->tp_version;
-                data = &val;
                 break;
         case PACKET_HDRLEN:
                 if (len > sizeof(int))
@@ -3286,39 +3290,28 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
                 default:
                         return -EINVAL;
                 }
-                data = &val;
                 break;
         case PACKET_RESERVE:
-                if (len > sizeof(unsigned int))
-                        len = sizeof(unsigned int);
                 val = po->tp_reserve;
-                data = &val;
                 break;
         case PACKET_LOSS:
-                if (len > sizeof(unsigned int))
-                        len = sizeof(unsigned int);
                 val = po->tp_loss;
-                data = &val;
                 break;
         case PACKET_TIMESTAMP:
-                if (len > sizeof(int))
-                        len = sizeof(int);
                 val = po->tp_tstamp;
-                data = &val;
                 break;
         case PACKET_FANOUT:
-                if (len > sizeof(int))
-                        len = sizeof(int);
                 val = (po->fanout ?
                        ((u32)po->fanout->id |
                         ((u32)po->fanout->type << 16)) :
                        0);
-                data = &val;
                 break;
         default:
                 return -ENOPROTOOPT;
         }
 
+        if (len > lv)
+                len = lv;
         if (put_user(len, optlen))
                 return -EFAULT;
         if (copy_to_user(optval, data, len))
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index d65f699fbf34..779ce4ff92ec 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -129,7 +129,7 @@ static const struct net_proto_family phonet_proto_family = {
 /* Phonet device header operations */
 static int pn_header_create(struct sk_buff *skb, struct net_device *dev,
                                 unsigned short type, const void *daddr,
-                                const void *saddr, unsigned len)
+                                const void *saddr, unsigned int len)
 {
         u8 *media = skb_push(skb, 1);
 
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 9f60008740e3..9dd4f926f7d1 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -273,7 +273,7 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
         hdr = pnp_hdr(skb);
         if (hdr->data[0] != PN_PEP_TYPE_COMMON) {
                 LIMIT_NETDEBUG(KERN_DEBUG"Phonet unknown PEP type: %u\n",
-                                (unsigned)hdr->data[0]);
+                                (unsigned int)hdr->data[0]);
                 return -EOPNOTSUPP;
         }
 
@@ -305,7 +305,7 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
 
         default:
                 LIMIT_NETDEBUG(KERN_DEBUG"Phonet unknown PEP indication: %u\n",
-                                (unsigned)hdr->data[1]);
+                                (unsigned int)hdr->data[1]);
                 return -EOPNOTSUPP;
         }
         if (wake)
@@ -478,9 +478,9 @@ static void pipe_destruct(struct sock *sk)
         skb_queue_purge(&pn->ctrlreq_queue);
 }
 
-static u8 pipe_negotiate_fc(const u8 *fcs, unsigned n)
+static u8 pipe_negotiate_fc(const u8 *fcs, unsigned int n)
 {
-        unsigned i;
+        unsigned int i;
         u8 final_fc = PN_NO_FLOW_CONTROL;
 
         for (i = 0; i < n; i++) {
@@ -1130,6 +1130,9 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
         int flags = msg->msg_flags;
         int err, done;
 
+        if (len > USHRT_MAX)
+                return -EMSGSIZE;
+
         if ((msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL|
                                 MSG_CMSG_COMPAT)) ||
                         !(msg->msg_flags & MSG_EOR))
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 9b9a85ecc4c7..36f75a9e2c3d 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -44,7 +44,7 @@ struct phonet_net {
         struct phonet_routes routes;
 };
 
-int phonet_net_id __read_mostly;
+static int phonet_net_id __read_mostly;
 
 static struct phonet_net *phonet_pernet(struct net *net)
 {
@@ -268,7 +268,7 @@ static int phonet_device_autoconf(struct net_device *dev)
 static void phonet_route_autodel(struct net_device *dev)
 {
         struct phonet_net *pnn = phonet_pernet(dev_net(dev));
-        unsigned i;
+        unsigned int i;
         DECLARE_BITMAP(deleted, 64);
 
         /* Remove left-over Phonet routes */
@@ -331,23 +331,6 @@ static int __net_init phonet_init_net(struct net *net)
 
 static void __net_exit phonet_exit_net(struct net *net)
 {
-        struct phonet_net *pnn = phonet_pernet(net);
-        struct net_device *dev;
-        unsigned i;
-
-        rtnl_lock();
-        for_each_netdev(net, dev)
-                phonet_device_destroy(dev);
-
-        for (i = 0; i < 64; i++) {
-                dev = pnn->routes.table[i];
-                if (dev) {
-                        rtm_phonet_notify(RTM_DELROUTE, dev, i);
-                        dev_put(dev);
-                }
-        }
-        rtnl_unlock();
-
         proc_net_remove(net, "phonet");
 }
 
@@ -361,7 +344,7 @@ static struct pernet_operations phonet_net_ops = {
 /* Initialize Phonet devices list */
 int __init phonet_device_init(void)
 {
-        int err = register_pernet_device(&phonet_net_ops);
+        int err = register_pernet_subsys(&phonet_net_ops);
         if (err)
                 return err;
 
@@ -377,7 +360,7 @@ void phonet_device_exit(void)
 {
         rtnl_unregister_all(PF_PHONET);
         unregister_netdevice_notifier(&phonet_device_notifier);
-        unregister_pernet_device(&phonet_net_ops);
+        unregister_pernet_subsys(&phonet_net_ops);
         proc_net_remove(&init_net, "pnresource");
 }
 
diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
index d61f6761777d..cfdf135fcd69 100644
--- a/net/phonet/pn_netlink.c
+++ b/net/phonet/pn_netlink.c
@@ -116,7 +116,8 @@ static int fill_addr(struct sk_buff *skb, struct net_device *dev, u8 addr,
         ifm->ifa_flags = IFA_F_PERMANENT;
         ifm->ifa_scope = RT_SCOPE_LINK;
         ifm->ifa_index = dev->ifindex;
-        NLA_PUT_U8(skb, IFA_LOCAL, addr);
+        if (nla_put_u8(skb, IFA_LOCAL, addr))
+                goto nla_put_failure;
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
@@ -183,8 +184,9 @@ static int fill_route(struct sk_buff *skb, struct net_device *dev, u8 dst,
         rtm->rtm_scope = RT_SCOPE_UNIVERSE;
         rtm->rtm_type = RTN_UNICAST;
         rtm->rtm_flags = 0;
-        NLA_PUT_U8(skb, RTA_DST, dst);
-        NLA_PUT_U32(skb, RTA_OIF, dev->ifindex);
+        if (nla_put_u8(skb, RTA_DST, dst) ||
+            nla_put_u32(skb, RTA_OIF, dev->ifindex))
+                goto nla_put_failure;
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 4c7eff30dfa9..89cfa9ce4939 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -58,7 +58,7 @@ static struct  {
 
 void __init pn_sock_init(void)
 {
-        unsigned i;
+        unsigned int i;
 
         for (i = 0; i < PN_HASHSIZE; i++)
                 INIT_HLIST_HEAD(pnsocks.hlist + i);
@@ -116,7 +116,7 @@ struct sock *pn_find_sock_by_sa(struct net *net, const struct sockaddr_pn *spn)
 void pn_deliver_sock_broadcast(struct net *net, struct sk_buff *skb)
 {
         struct hlist_head *hlist = pnsocks.hlist;
-        unsigned h;
+        unsigned int h;
 
         rcu_read_lock();
         for (h = 0; h < PN_HASHSIZE; h++) {
@@ -545,7 +545,7 @@ static struct sock *pn_sock_get_idx(struct seq_file *seq, loff_t pos)
         struct hlist_head *hlist = pnsocks.hlist;
         struct hlist_node *node;
         struct sock *sknode;
-        unsigned h;
+        unsigned int h;
 
         for (h = 0; h < PN_HASHSIZE; h++) {
                 sk_for_each_rcu(sknode, node, hlist) {
@@ -710,7 +710,7 @@ int pn_sock_unbind_res(struct sock *sk, u8 res)
 
 void pn_sock_unbind_all_res(struct sock *sk)
 {
-        unsigned res, match = 0;
+        unsigned int res, match = 0;
 
         mutex_lock(&resource_mutex);
         for (res = 0; res < 256; res++) {
@@ -732,7 +732,7 @@ void pn_sock_unbind_all_res(struct sock *sk)
 static struct sock **pn_res_get_idx(struct seq_file *seq, loff_t pos)
 {
         struct net *net = seq_file_net(seq);
-        unsigned i;
+        unsigned int i;
 
         if (!net_eq(net, &init_net))
                 return NULL;
@@ -750,7 +750,7 @@ static struct sock **pn_res_get_idx(struct seq_file *seq, loff_t pos)
 static struct sock **pn_res_get_next(struct seq_file *seq, struct sock **sk)
 {
         struct net *net = seq_file_net(seq);
-        unsigned i;
+        unsigned int i;
 
         BUG_ON(!net_eq(net, &init_net));
 
diff --git a/net/phonet/sysctl.c b/net/phonet/sysctl.c
index cea1c7dbdae2..696348fd31a1 100644
--- a/net/phonet/sysctl.c
+++ b/net/phonet/sysctl.c
@@ -27,6 +27,10 @@
 #include <linux/errno.h>
 #include <linux/init.h>
 
+#include <net/sock.h>
+#include <linux/phonet.h>
+#include <net/phonet/phonet.h>
+
 #define DYNAMIC_PORT_MIN        0x40
 #define DYNAMIC_PORT_MAX        0x7f
 
@@ -46,7 +50,8 @@ static void set_local_port_range(int range[2])
 
 void phonet_get_local_port_range(int *min, int *max)
 {
-        unsigned seq;
+        unsigned int seq;
+
         do {
                 seq = read_seqbegin(&local_port_range_lock);
                 if (min)
@@ -93,19 +98,13 @@ static struct ctl_table phonet_table[] = {
         { }
 };
 
-static struct ctl_path phonet_ctl_path[] = {
-        { .procname = "net", },
-        { .procname = "phonet", },
-        { },
-};
-
 int __init phonet_sysctl_init(void)
 {
-        phonet_table_hrd = register_sysctl_paths(phonet_ctl_path, phonet_table);
+        phonet_table_hrd = register_net_sysctl(&init_net, "net/phonet", phonet_table);
         return phonet_table_hrd == NULL ? -ENOMEM : 0;
 }
 
 void phonet_sysctl_exit(void)
 {
-        unregister_sysctl_table(phonet_table_hrd);
+        unregister_net_sysctl_table(phonet_table_hrd);
 }
diff --git a/net/rds/ib.h b/net/rds/ib.h
index edfaaaf164eb..8d2b3d5a7c21 100644
--- a/net/rds/ib.h
+++ b/net/rds/ib.h
@@ -186,8 +186,7 @@ struct rds_ib_device {
         struct work_struct      free_work;
 };
 
-#define pcidev_to_node(pcidev) pcibus_to_node(pcidev->bus)
-#define ibdev_to_node(ibdev) pcidev_to_node(to_pci_dev(ibdev->dma_device))
+#define ibdev_to_node(ibdev) dev_to_node(ibdev->dma_device)
 #define rdsibdev_to_node(rdsibdev) ibdev_to_node(rdsibdev->dev)
 
 /* bits for i_ack_flags */
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 51c868923f64..a1e116277477 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -749,7 +749,7 @@ int rds_ib_conn_alloc(struct rds_connection *conn, gfp_t gfp)
         int ret;
 
         /* XXX too lazy? */
-        ic = kzalloc(sizeof(struct rds_ib_connection), GFP_KERNEL);
+        ic = kzalloc(sizeof(struct rds_ib_connection), gfp);
         if (!ic)
                 return -ENOMEM;
 
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index e29e0ca32f74..8d194912c695 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -763,7 +763,7 @@ static void rds_ib_cong_recv(struct rds_connection *conn,
                 to_copy = min(RDS_FRAG_SIZE - frag_off, PAGE_SIZE - map_off);
                 BUG_ON(to_copy & 7); /* Must be 64bit aligned. */
 
-                addr = kmap_atomic(sg_page(&frag->f_sg), KM_SOFTIRQ0);
+                addr = kmap_atomic(sg_page(&frag->f_sg));
 
                 src = addr + frag_off;
                 dst = (void *)map->m_page_addrs[map_page] + map_off;
@@ -773,7 +773,7 @@ static void rds_ib_cong_recv(struct rds_connection *conn,
                         uncongested |= ~(*src) & *dst;
                         *dst++ = *src++;
                 }
-                kunmap_atomic(addr, KM_SOFTIRQ0);
+                kunmap_atomic(addr);
 
                 copied += to_copy;
 
@@ -826,7 +826,7 @@ static void rds_ib_process_recv(struct rds_connection *conn,
 
         if (data_len < sizeof(struct rds_header)) {
                 rds_ib_conn_error(conn, "incoming message "
-                       "from %pI4 didn't inclue a "
+                       "from %pI4 didn't include a "
                        "header, disconnecting and "
                        "reconnecting\n",
                        &conn->c_faddr);
@@ -919,8 +919,7 @@ static void rds_ib_process_recv(struct rds_connection *conn,
                         rds_ib_cong_recv(conn, ibinc);
                 else {
                         rds_recv_incoming(conn, conn->c_faddr, conn->c_laddr,
-                                          &ibinc->ii_inc, GFP_ATOMIC,
-                                          KM_SOFTIRQ0);
+                                          &ibinc->ii_inc, GFP_ATOMIC);
                         state->ack_next = be64_to_cpu(hdr->h_sequence);
                         state->ack_next_valid = 1;
                 }
diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
index 1253b006efdb..7e643bafb4af 100644
--- a/net/rds/ib_sysctl.c
+++ b/net/rds/ib_sysctl.c
@@ -106,22 +106,15 @@ static ctl_table rds_ib_sysctl_table[] = {
         { }
 };
 
-static struct ctl_path rds_ib_sysctl_path[] = {
-        { .procname = "net", },
-        { .procname = "rds", },
-        { .procname = "ib", },
-        { }
-};
-
 void rds_ib_sysctl_exit(void)
 {
         if (rds_ib_sysctl_hdr)
-                unregister_sysctl_table(rds_ib_sysctl_hdr);
+                unregister_net_sysctl_table(rds_ib_sysctl_hdr);
 }
 
 int rds_ib_sysctl_init(void)
 {
-        rds_ib_sysctl_hdr = register_sysctl_paths(rds_ib_sysctl_path, rds_ib_sysctl_table);
+        rds_ib_sysctl_hdr = register_net_sysctl(&init_net, "net/rds/ib", rds_ib_sysctl_table);
         if (!rds_ib_sysctl_hdr)
                 return -ENOMEM;
         return 0;
diff --git a/net/rds/info.c b/net/rds/info.c
index f1c016c4146e..9a6b4f66187c 100644
--- a/net/rds/info.c
+++ b/net/rds/info.c
@@ -104,7 +104,7 @@ EXPORT_SYMBOL_GPL(rds_info_deregister_func);
 void rds_info_iter_unmap(struct rds_info_iterator *iter)
 {
         if (iter->addr) {
-                kunmap_atomic(iter->addr, KM_USER0);
+                kunmap_atomic(iter->addr);
                 iter->addr = NULL;
         }
 }
@@ -119,7 +119,7 @@ void rds_info_copy(struct rds_info_iterator *iter, void *data,
 
         while (bytes) {
                 if (!iter->addr)
-                        iter->addr = kmap_atomic(*iter->pages, KM_USER0);
+                        iter->addr = kmap_atomic(*iter->pages);
 
                 this = min(bytes, PAGE_SIZE - iter->offset);
 
@@ -134,7 +134,7 @@ void rds_info_copy(struct rds_info_iterator *iter, void *data,
                 iter->offset += this;
 
                 if (iter->offset == PAGE_SIZE) {
-                        kunmap_atomic(iter->addr, KM_USER0);
+                        kunmap_atomic(iter->addr);
                         iter->addr = NULL;
                         iter->offset = 0;
                         iter->pages++;
diff --git a/net/rds/iw_cm.c b/net/rds/iw_cm.c
index 9556d2895f7a..a91e1db62ee6 100644
--- a/net/rds/iw_cm.c
+++ b/net/rds/iw_cm.c
@@ -694,7 +694,7 @@ int rds_iw_conn_alloc(struct rds_connection *conn, gfp_t gfp)
         unsigned long flags;
 
         /* XXX too lazy? */
-        ic = kzalloc(sizeof(struct rds_iw_connection), GFP_KERNEL);
+        ic = kzalloc(sizeof(struct rds_iw_connection), gfp);
         if (!ic)
                 return -ENOMEM;
 
diff --git a/net/rds/iw_recv.c b/net/rds/iw_recv.c
index 5e57347f49ff..45033358358e 100644
--- a/net/rds/iw_recv.c
+++ b/net/rds/iw_recv.c
@@ -598,7 +598,7 @@ static void rds_iw_cong_recv(struct rds_connection *conn,
                 to_copy = min(RDS_FRAG_SIZE - frag_off, PAGE_SIZE - map_off);
                 BUG_ON(to_copy & 7); /* Must be 64bit aligned. */
 
-                addr = kmap_atomic(frag->f_page, KM_SOFTIRQ0);
+                addr = kmap_atomic(frag->f_page);
 
                 src = addr + frag_off;
                 dst = (void *)map->m_page_addrs[map_page] + map_off;
@@ -608,7 +608,7 @@ static void rds_iw_cong_recv(struct rds_connection *conn,
                         uncongested |= ~(*src) & *dst;
                         *dst++ = *src++;
                 }
-                kunmap_atomic(addr, KM_SOFTIRQ0);
+                kunmap_atomic(addr);
 
                 copied += to_copy;
 
@@ -661,7 +661,7 @@ static void rds_iw_process_recv(struct rds_connection *conn,
 
         if (byte_len < sizeof(struct rds_header)) {
                 rds_iw_conn_error(conn, "incoming message "
-                       "from %pI4 didn't inclue a "
+                       "from %pI4 didn't include a "
                        "header, disconnecting and "
                        "reconnecting\n",
                        &conn->c_faddr);
@@ -754,8 +754,7 @@ static void rds_iw_process_recv(struct rds_connection *conn,
                         rds_iw_cong_recv(conn, iwinc);
                 else {
                         rds_recv_incoming(conn, conn->c_faddr, conn->c_laddr,
-                                          &iwinc->ii_inc, GFP_ATOMIC,
-                                          KM_SOFTIRQ0);
+                                          &iwinc->ii_inc, GFP_ATOMIC);
                         state->ack_next = be64_to_cpu(hdr->h_sequence);
                         state->ack_next_valid = 1;
                 }
diff --git a/net/rds/iw_sysctl.c b/net/rds/iw_sysctl.c
index e2e47176e729..5d5ebd576f3f 100644
--- a/net/rds/iw_sysctl.c
+++ b/net/rds/iw_sysctl.c
@@ -109,22 +109,15 @@ static ctl_table rds_iw_sysctl_table[] = {
         { }
 };
 
-static struct ctl_path rds_iw_sysctl_path[] = {
-        { .procname = "net", },
-        { .procname = "rds", },
-        { .procname = "iw", },
-        { }
-};
-
 void rds_iw_sysctl_exit(void)
 {
         if (rds_iw_sysctl_hdr)
-                unregister_sysctl_table(rds_iw_sysctl_hdr);
+                unregister_net_sysctl_table(rds_iw_sysctl_hdr);
 }
 
 int rds_iw_sysctl_init(void)
 {
-        rds_iw_sysctl_hdr = register_sysctl_paths(rds_iw_sysctl_path, rds_iw_sysctl_table);
+        rds_iw_sysctl_hdr = register_net_sysctl(&init_net, "net/rds/iw", rds_iw_sysctl_table);
         if (!rds_iw_sysctl_hdr)
                 return -ENOMEM;
         return 0;
diff --git a/net/rds/loop.c b/net/rds/loop.c
index bca6761a3ca2..6b12b68541ae 100644
--- a/net/rds/loop.c
+++ b/net/rds/loop.c
@@ -79,7 +79,7 @@ static int rds_loop_xmit(struct rds_connection *conn, struct rds_message *rm,
         rds_message_addref(rm);
 
         rds_recv_incoming(conn, conn->c_laddr, conn->c_faddr, &rm->m_inc,
-                          GFP_KERNEL, KM_USER0);
+                          GFP_KERNEL);
 
         rds_send_drop_acked(conn, be64_to_cpu(rm->m_inc.i_hdr.h_sequence),
                             NULL);
@@ -121,7 +121,7 @@ static int rds_loop_conn_alloc(struct rds_connection *conn, gfp_t gfp)
         struct rds_loop_connection *lc;
         unsigned long flags;
 
-        lc = kzalloc(sizeof(struct rds_loop_connection), GFP_KERNEL);
+        lc = kzalloc(sizeof(struct rds_loop_connection), gfp);
         if (!lc)
                 return -ENOMEM;
 
diff --git a/net/rds/rds.h b/net/rds/rds.h
index 7eaba1831f0d..ec1d731ecff0 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -704,7 +704,7 @@ void rds_inc_init(struct rds_incoming *inc, struct rds_connection *conn,
                   __be32 saddr);
 void rds_inc_put(struct rds_incoming *inc);
 void rds_recv_incoming(struct rds_connection *conn, __be32 saddr, __be32 daddr,
-                       struct rds_incoming *inc, gfp_t gfp, enum km_type km);
+                       struct rds_incoming *inc, gfp_t gfp);
 int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
                 size_t size, int msg_flags);
 void rds_clear_recv_queue(struct rds_sock *rs);
diff --git a/net/rds/recv.c b/net/rds/recv.c
index bc3f8cd6d070..5c6e9f132026 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -155,7 +155,7 @@ static void rds_recv_incoming_exthdrs(struct rds_incoming *inc, struct rds_sock
  * tell us which roles the addrs in the conn are playing for this message.
  */
 void rds_recv_incoming(struct rds_connection *conn, __be32 saddr, __be32 daddr,
-                       struct rds_incoming *inc, gfp_t gfp, enum km_type km)
+                       struct rds_incoming *inc, gfp_t gfp)
 {
         struct rds_sock *rs = NULL;
         struct sock *sk;
diff --git a/net/rds/send.c b/net/rds/send.c
index e2d63c59e7c2..96531d4033a2 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -935,7 +935,6 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         /* Mirror Linux UDP mirror of BSD error message compatibility */
         /* XXX: Perhaps MSG_MORE someday */
         if (msg->msg_flags & ~(MSG_DONTWAIT | MSG_CMSG_COMPAT)) {
-                printk(KERN_INFO "msg_flags 0x%08X\n", msg->msg_flags);
                 ret = -EOPNOTSUPP;
                 goto out;
         }
diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
index 25ad0c77a26c..907214b4c4d0 100644
--- a/net/rds/sysctl.c
+++ b/net/rds/sysctl.c
@@ -92,17 +92,10 @@ static ctl_table rds_sysctl_rds_table[] = {
         { }
 };
 
-static struct ctl_path rds_sysctl_path[] = {
-        { .procname = "net", },
-        { .procname = "rds", },
-        { }
-};
-
-
 void rds_sysctl_exit(void)
 {
         if (rds_sysctl_reg_table)
-                unregister_sysctl_table(rds_sysctl_reg_table);
+                unregister_net_sysctl_table(rds_sysctl_reg_table);
 }
 
 int rds_sysctl_init(void)
@@ -110,7 +103,7 @@ int rds_sysctl_init(void)
         rds_sysctl_reconnect_min = msecs_to_jiffies(1);
         rds_sysctl_reconnect_min_jiffies = rds_sysctl_reconnect_min;
 
-        rds_sysctl_reg_table = register_sysctl_paths(rds_sysctl_path, rds_sysctl_rds_table);
+        rds_sysctl_reg_table = register_net_sysctl(&init_net,"net/rds", rds_sysctl_rds_table);
         if (!rds_sysctl_reg_table)
                 return -ENOMEM;
         return 0;
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 8b5cc4aa8868..72981375f47c 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -145,7 +145,7 @@ int rds_tcp_listen_init(void)
         if (ret < 0)
                 goto out;
 
-        sock->sk->sk_reuse = 1;
+        sock->sk->sk_reuse = SK_CAN_REUSE;
         rds_tcp_nonagle(sock);
 
         write_lock_bh(&sock->sk->sk_callback_lock);
diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c
index 78205e25500a..6243258f840f 100644
--- a/net/rds/tcp_recv.c
+++ b/net/rds/tcp_recv.c
@@ -169,7 +169,6 @@ static void rds_tcp_cong_recv(struct rds_connection *conn,
 struct rds_tcp_desc_arg {
         struct rds_connection *conn;
         gfp_t gfp;
-        enum km_type km;
 };
 
 static int rds_tcp_data_recv(read_descriptor_t *desc, struct sk_buff *skb,
@@ -255,7 +254,7 @@ static int rds_tcp_data_recv(read_descriptor_t *desc, struct sk_buff *skb,
                         else
                                 rds_recv_incoming(conn, conn->c_faddr,
                                                   conn->c_laddr, &tinc->ti_inc,
-                                                  arg->gfp, arg->km);
+                                                  arg->gfp);
 
                         tc->t_tinc_hdr_rem = sizeof(struct rds_header);
                         tc->t_tinc_data_rem = 0;
@@ -272,8 +271,7 @@ out:
 }
 
 /* the caller has to hold the sock lock */
-static int rds_tcp_read_sock(struct rds_connection *conn, gfp_t gfp,
-                             enum km_type km)
+static int rds_tcp_read_sock(struct rds_connection *conn, gfp_t gfp)
 {
         struct rds_tcp_connection *tc = conn->c_transport_data;
         struct socket *sock = tc->t_sock;
@@ -283,7 +281,6 @@ static int rds_tcp_read_sock(struct rds_connection *conn, gfp_t gfp,
         /* It's like glib in the kernel! */
         arg.conn = conn;
         arg.gfp = gfp;
-        arg.km = km;
         desc.arg.data = &arg;
         desc.error = 0;
         desc.count = 1; /* give more than one skb per call */
@@ -311,7 +308,7 @@ int rds_tcp_recv(struct rds_connection *conn)
         rdsdebug("recv worker conn %p tc %p sock %p\n", conn, tc, sock);
 
         lock_sock(sock->sk);
-        ret = rds_tcp_read_sock(conn, GFP_KERNEL, KM_USER0);
+        ret = rds_tcp_read_sock(conn, GFP_KERNEL);
         release_sock(sock->sk);
 
         return ret;
@@ -336,7 +333,7 @@ void rds_tcp_data_ready(struct sock *sk, int bytes)
         ready = tc->t_orig_data_ready;
         rds_tcp_stats_inc(s_tcp_data_ready_calls);
 
-        if (rds_tcp_read_sock(conn, GFP_ATOMIC, KM_SOFTIRQ0) == -ENOMEM)
+        if (rds_tcp_read_sock(conn, GFP_ATOMIC) == -ENOMEM)
                 queue_delayed_work(rds_wq, &conn->c_recv_w, 0);
 out:
         read_unlock_bh(&sk->sk_callback_lock);
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 354760ebbbd2..f974961754ca 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -29,6 +29,7 @@
 #include <linux/rfkill.h>
 #include <linux/sched.h>
 #include <linux/spinlock.h>
+#include <linux/device.h>
 #include <linux/miscdevice.h>
 #include <linux/wait.h>
 #include <linux/poll.h>
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index f9ea925ad9cb..c4719ce604c2 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -34,7 +34,6 @@
 #include <linux/if_arp.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <asm/system.h>
 #include <asm/uaccess.h>
 #include <linux/fcntl.h>
 #include <linux/termios.h>
diff --git a/net/rose/rose_dev.c b/net/rose/rose_dev.c
index 178ff4f73c85..28dbdb911b85 100644
--- a/net/rose/rose_dev.c
+++ b/net/rose/rose_dev.c
@@ -21,7 +21,6 @@
 #include <linux/if_ether.h>
 #include <linux/slab.h>
 
-#include <asm/system.h>
 #include <asm/io.h>
 
 #include <linux/inet.h>
@@ -38,7 +37,7 @@
 
 static int rose_header(struct sk_buff *skb, struct net_device *dev,
                        unsigned short type,
-                       const void *daddr, const void *saddr, unsigned len)
+                       const void *daddr, const void *saddr, unsigned int len)
 {
         unsigned char *buff = skb_push(skb, ROSE_MIN_LEN + 2);
 
@@ -96,11 +95,11 @@ static int rose_set_mac_address(struct net_device *dev, void *addr)
         struct sockaddr *sa = addr;
         int err;
 
-        if (!memcpy(dev->dev_addr, sa->sa_data, dev->addr_len))
+        if (!memcmp(dev->dev_addr, sa->sa_data, dev->addr_len))
                 return 0;
 
         if (dev->flags & IFF_UP) {
-                err = rose_add_loopback_node((rose_address *)dev->dev_addr);
+                err = rose_add_loopback_node((rose_address *)sa->sa_data);
                 if (err)
                         return err;
 
diff --git a/net/rose/rose_in.c b/net/rose/rose_in.c
index 7f7fcb46b4fa..79c4abcfa6b4 100644
--- a/net/rose/rose_in.c
+++ b/net/rose/rose_in.c
@@ -26,7 +26,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <net/tcp_states.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/rose/rose_link.c b/net/rose/rose_link.c
index 7a02bd1cc5a0..bc5514211b0c 100644
--- a/net/rose/rose_link.c
+++ b/net/rose/rose_link.c
@@ -22,7 +22,6 @@
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/rose/rose_out.c b/net/rose/rose_out.c
index 4ebf33afbe47..9ad98b524646 100644
--- a/net/rose/rose_out.c
+++ b/net/rose/rose_out.c
@@ -21,7 +21,6 @@
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index cd9b7ee60f3e..40148932c8a4 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -25,7 +25,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <net/tcp_states.h>
-#include <asm/system.h>
 #include <asm/uaccess.h>
 #include <linux/fcntl.h>
 #include <linux/termios.h>      /* For TIOCINQ/OUTQ */
diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c
index f6c71caa94b9..7ca57741b2fb 100644
--- a/net/rose/rose_subr.c
+++ b/net/rose/rose_subr.c
@@ -22,7 +22,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <net/tcp_states.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
@@ -400,7 +399,7 @@ int rose_parse_facilities(unsigned char *p, unsigned packet_len,
 
         facilities_len = *p++;
 
-        if (facilities_len == 0 || (unsigned)facilities_len > packet_len)
+        if (facilities_len == 0 || (unsigned int)facilities_len > packet_len)
                 return 0;
 
         while (facilities_len >= 3 && *p == 0x00) {
diff --git a/net/rose/rose_timer.c b/net/rose/rose_timer.c
index b6c8f38cc26c..bc5469d6d9cb 100644
--- a/net/rose/rose_timer.c
+++ b/net/rose/rose_timer.c
@@ -23,7 +23,6 @@
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <net/tcp_states.h>
-#include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
diff --git a/net/rose/sysctl_net_rose.c b/net/rose/sysctl_net_rose.c
index df6d9dac2186..94ca9c2ccd69 100644
--- a/net/rose/sysctl_net_rose.c
+++ b/net/rose/sysctl_net_rose.c
@@ -118,18 +118,12 @@ static ctl_table rose_table[] = {
         { }
 };
 
-static struct ctl_path rose_path[] = {
-        { .procname = "net", },
-        { .procname = "rose", },
-        { }
-};
-
 void __init rose_register_sysctl(void)
 {
-        rose_table_header = register_sysctl_paths(rose_path, rose_table);
+        rose_table_header = register_net_sysctl(&init_net, "net/rose", rose_table);
 }
 
 void rose_unregister_sysctl(void)
 {
-        unregister_sysctl_table(rose_table_header);
+        unregister_net_sysctl_table(rose_table_header);
 }
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 74c064c0dfdd..05996d0dd828 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -26,7 +26,7 @@ MODULE_AUTHOR("Red Hat, Inc.");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_NETPROTO(PF_RXRPC);
 
-unsigned rxrpc_debug; // = RXRPC_DEBUG_KPROTO;
+unsigned int rxrpc_debug; // = RXRPC_DEBUG_KPROTO;
 module_param_named(debug, rxrpc_debug, uint, S_IWUSR | S_IRUGO);
 MODULE_PARM_DESC(debug, "RxRPC debugging mask");
 
@@ -513,7 +513,7 @@ static int rxrpc_setsockopt(struct socket *sock, int level, int optname,
                             char __user *optval, unsigned int optlen)
 {
         struct rxrpc_sock *rx = rxrpc_sk(sock->sk);
-        unsigned min_sec_level;
+        unsigned int min_sec_level;
         int ret;
 
         _enter(",%d,%d,,%d", level, optname, optlen);
@@ -555,13 +555,13 @@ static int rxrpc_setsockopt(struct socket *sock, int level, int optname,
 
                 case RXRPC_MIN_SECURITY_LEVEL:
                         ret = -EINVAL;
-                        if (optlen != sizeof(unsigned))
+                        if (optlen != sizeof(unsigned int))
                                 goto error;
                         ret = -EISCONN;
                         if (rx->sk.sk_state != RXRPC_UNCONNECTED)
                                 goto error;
                         ret = get_user(min_sec_level,
-                                       (unsigned __user *) optval);
+                                       (unsigned int __user *) optval);
                         if (ret < 0)
                                 goto error;
                         ret = -EINVAL;
diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
index c3126e864f3c..e4d9cbcff402 100644
--- a/net/rxrpc/ar-ack.c
+++ b/net/rxrpc/ar-ack.c
@@ -19,7 +19,7 @@
 #include <net/af_rxrpc.h>
 #include "ar-internal.h"
 
-static unsigned rxrpc_ack_defer = 1;
+static unsigned int rxrpc_ack_defer = 1;
 
 static const char *const rxrpc_acks[] = {
         "---", "REQ", "DUP", "OOS", "WIN", "MEM", "PNG", "PNR", "DLY", "IDL",
@@ -548,11 +548,11 @@ static void rxrpc_zap_tx_window(struct rxrpc_call *call)
  * process the extra information that may be appended to an ACK packet
  */
 static void rxrpc_extract_ackinfo(struct rxrpc_call *call, struct sk_buff *skb,
-                                  unsigned latest, int nAcks)
+                                  unsigned int latest, int nAcks)
 {
         struct rxrpc_ackinfo ackinfo;
         struct rxrpc_peer *peer;
-        unsigned mtu;
+        unsigned int mtu;
 
         if (skb_copy_bits(skb, nAcks + 3, &ackinfo, sizeof(ackinfo)) < 0) {
                 _leave(" [no ackinfo]");
diff --git a/net/rxrpc/ar-call.c b/net/rxrpc/ar-call.c
index bf656c230ba9..a3bbb360a3f9 100644
--- a/net/rxrpc/ar-call.c
+++ b/net/rxrpc/ar-call.c
@@ -38,8 +38,8 @@ const char *const rxrpc_call_states[] = {
 struct kmem_cache *rxrpc_call_jar;
 LIST_HEAD(rxrpc_calls);
 DEFINE_RWLOCK(rxrpc_call_lock);
-static unsigned rxrpc_call_max_lifetime = 60;
-static unsigned rxrpc_dead_call_timeout = 2;
+static unsigned int rxrpc_call_max_lifetime = 60;
+static unsigned int rxrpc_dead_call_timeout = 2;
 
 static void rxrpc_destroy_call(struct work_struct *work);
 static void rxrpc_call_life_expired(unsigned long _call);
diff --git a/net/rxrpc/ar-input.c b/net/rxrpc/ar-input.c
index 1a2b0633fece..529572f18d1f 100644
--- a/net/rxrpc/ar-input.c
+++ b/net/rxrpc/ar-input.c
@@ -76,7 +76,7 @@ int rxrpc_queue_rcv_skb(struct rxrpc_call *call, struct sk_buff *skb,
                  * --ANK */
 //              ret = -ENOBUFS;
 //              if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
-//                  (unsigned) sk->sk_rcvbuf)
+//                  (unsigned int) sk->sk_rcvbuf)
 //                      goto out;
 
                 ret = sk_filter(sk, skb);
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 8e22bd345e71..a693aca2ae2e 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -83,7 +83,7 @@ struct rxrpc_skb_priv {
         struct rxrpc_call       *call;          /* call with which associated */
         unsigned long           resend_at;      /* time in jiffies at which to resend */
         union {
-                unsigned        offset;         /* offset into buffer of next read */
+                unsigned int    offset;         /* offset into buffer of next read */
                 int             remain;         /* amount of space remaining for next write */
                 u32             error;          /* network error code */
                 bool            need_resend;    /* T if needs resending */
@@ -176,9 +176,9 @@ struct rxrpc_peer {
         struct list_head        error_targets;  /* targets for net error distribution */
         spinlock_t              lock;           /* access lock */
         atomic_t                usage;
-        unsigned                if_mtu;         /* interface MTU for this peer */
-        unsigned                mtu;            /* network MTU for this peer */
-        unsigned                maxdata;        /* data size (MTU - hdrsize) */
+        unsigned int            if_mtu;         /* interface MTU for this peer */
+        unsigned int            mtu;            /* network MTU for this peer */
+        unsigned int            maxdata;        /* data size (MTU - hdrsize) */
         unsigned short          hdrsize;        /* header size (IP + UDP + RxRPC) */
         int                     debug_id;       /* debug ID for printks */
         int                     net_error;      /* network error distributed */
@@ -187,8 +187,8 @@ struct rxrpc_peer {
         /* calculated RTT cache */
 #define RXRPC_RTT_CACHE_SIZE 32
         suseconds_t             rtt;            /* current RTT estimate (in uS) */
-        unsigned                rtt_point;      /* next entry at which to insert */
-        unsigned                rtt_usage;      /* amount of cache actually used */
+        unsigned int            rtt_point;      /* next entry at which to insert */
+        unsigned int            rtt_usage;      /* amount of cache actually used */
         suseconds_t             rtt_cache[RXRPC_RTT_CACHE_SIZE]; /* calculated RTT cache */
 };
 
@@ -271,7 +271,7 @@ struct rxrpc_connection {
         } state;
         int                     error;          /* error code for local abort */
         int                     debug_id;       /* debug ID for printks */
-        unsigned                call_counter;   /* call ID counter */
+        unsigned int            call_counter;   /* call ID counter */
         atomic_t                serial;         /* packet serial number counter */
         atomic_t                hi_serial;      /* highest serial number received */
         u8                      avail_calls;    /* number of calls available */
@@ -592,7 +592,7 @@ extern struct rxrpc_transport *rxrpc_find_transport(struct rxrpc_local *,
 /*
  * debug tracing
  */
-extern unsigned rxrpc_debug;
+extern unsigned int rxrpc_debug;
 
 #define dbgprintk(FMT,...) \
         printk("[%-6.6s] "FMT"\n", current->comm ,##__VA_ARGS__)
diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
index ae3a035f5390..8b1f9f49960f 100644
--- a/net/rxrpc/ar-key.c
+++ b/net/rxrpc/ar-key.c
@@ -82,7 +82,7 @@ static int rxrpc_vet_description_s(const char *desc)
  * - the caller guarantees we have at least 4 words
  */
 static int rxrpc_instantiate_xdr_rxkad(struct key *key, const __be32 *xdr,
-                                       unsigned toklen)
+                                       unsigned int toklen)
 {
         struct rxrpc_key_token *token, **pptoken;
         size_t plen;
@@ -210,10 +210,10 @@ static void rxrpc_rxk5_free(struct rxk5_key *rxk5)
  */
 static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
                                        const __be32 **_xdr,
-                                       unsigned *_toklen)
+                                       unsigned int *_toklen)
 {
         const __be32 *xdr = *_xdr;
-        unsigned toklen = *_toklen, n_parts, loop, tmp;
+        unsigned int toklen = *_toklen, n_parts, loop, tmp;
 
         /* there must be at least one name, and at least #names+1 length
          * words */
@@ -286,10 +286,10 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
 static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td,
                                          size_t max_data_size,
                                          const __be32 **_xdr,
-                                         unsigned *_toklen)
+                                         unsigned int *_toklen)
 {
         const __be32 *xdr = *_xdr;
-        unsigned toklen = *_toklen, len;
+        unsigned int toklen = *_toklen, len;
 
         /* there must be at least one tag and one length word */
         if (toklen <= 8)
@@ -330,11 +330,11 @@ static int rxrpc_krb5_decode_tagged_array(struct krb5_tagged_data **_td,
                                           u8 max_n_elem,
                                           size_t max_elem_size,
                                           const __be32 **_xdr,
-                                          unsigned *_toklen)
+                                          unsigned int *_toklen)
 {
         struct krb5_tagged_data *td;
         const __be32 *xdr = *_xdr;
-        unsigned toklen = *_toklen, n_elem, loop;
+        unsigned int toklen = *_toklen, n_elem, loop;
         int ret;
 
         /* there must be at least one count */
@@ -380,10 +380,10 @@ static int rxrpc_krb5_decode_tagged_array(struct krb5_tagged_data **_td,
  * extract a krb5 ticket
  */
 static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
-                                    const __be32 **_xdr, unsigned *_toklen)
+                                    const __be32 **_xdr, unsigned int *_toklen)
 {
         const __be32 *xdr = *_xdr;
-        unsigned toklen = *_toklen, len;
+        unsigned int toklen = *_toklen, len;
 
         /* there must be at least one length word */
         if (toklen <= 4)
@@ -419,7 +419,7 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
  * - the caller guarantees we have at least 4 words
  */
 static int rxrpc_instantiate_xdr_rxk5(struct key *key, const __be32 *xdr,
-                                      unsigned toklen)
+                                      unsigned int toklen)
 {
         struct rxrpc_key_token *token, **pptoken;
         struct rxk5_key *rxk5;
@@ -549,7 +549,7 @@ static int rxrpc_instantiate_xdr(struct key *key, const void *data, size_t datal
 {
         const __be32 *xdr = data, *token;
         const char *cp;
-        unsigned len, tmp, loop, ntoken, toklen, sec_ix;
+        unsigned int len, tmp, loop, ntoken, toklen, sec_ix;
         int ret;
 
         _enter(",{%x,%x,%x,%x},%zu",
diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index 7635107726ce..f226709ebd8f 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -31,7 +31,7 @@
 #define REALM_SZ                        40      /* size of principal's auth domain */
 #define SNAME_SZ                        40      /* size of service name */
 
-unsigned rxrpc_debug;
+unsigned int rxrpc_debug;
 module_param_named(debug, rxrpc_debug, uint, S_IWUSR | S_IRUGO);
 MODULE_PARM_DESC(debug, "rxkad debugging mask");
 
@@ -207,7 +207,7 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
         struct rxrpc_crypt iv;
         struct scatterlist sg[16];
         struct sk_buff *trailer;
-        unsigned len;
+        unsigned int len;
         u16 check;
         int nsg;
 
@@ -826,7 +826,7 @@ static int rxkad_decrypt_ticket(struct rxrpc_connection *conn,
         struct rxrpc_crypt iv, key;
         struct scatterlist sg[1];
         struct in_addr addr;
-        unsigned life;
+        unsigned int life;
         time_t issue, now;
         bool little_endian;
         int ret;
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index 2590e91b3289..e7a8976bf25c 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -250,6 +250,28 @@ config NET_SCH_QFQ
 
           If unsure, say N.
 
+config NET_SCH_CODEL
+        tristate "Controlled Delay AQM (CODEL)"
+        help
+          Say Y here if you want to use the Controlled Delay (CODEL)
+          packet scheduling algorithm.
+
+          To compile this driver as a module, choose M here: the module
+          will be called sch_codel.
+
+          If unsure, say N.
+
+config NET_SCH_FQ_CODEL
+        tristate "Fair Queue Controlled Delay AQM (FQ_CODEL)"
+        help
+          Say Y here if you want to use the FQ Controlled Delay (FQ_CODEL)
+          packet scheduling algorithm.
+
+          To compile this driver as a module, choose M here: the module
+          will be called sch_fq_codel.
+
+          If unsure, say N.
+
 config NET_SCH_INGRESS
         tristate "Ingress Qdisc"
         depends on NET_CLS_ACT
@@ -260,6 +282,32 @@ config NET_SCH_INGRESS
           To compile this code as a module, choose M here: the
           module will be called sch_ingress.
 
+config NET_SCH_PLUG
+        tristate "Plug network traffic until release (PLUG)"
+        ---help---
+
+          This queuing discipline allows userspace to plug/unplug a network
+          output queue, using the netlink interface.  When it receives an
+          enqueue command it inserts a plug into the outbound queue that
+          causes following packets to enqueue until a dequeue command arrives
+          over netlink, causing the plug to be removed and resuming the normal
+          packet flow.
+
+          This module also provides a generic "network output buffering"
+          functionality (aka output commit), wherein upon arrival of a dequeue
+          command, only packets up to the first plug are released for delivery.
+          The Remus HA project uses this module to enable speculative execution
+          of virtual machines by allowing the generated network output to be rolled
+          back if needed.
+
+          For more information, please refer to http://wiki.xensource.com/xenwiki/Remus
+
+          Say Y here if you are using this kernel for Xen dom0 and
+          want to protect Xen guests with Remus.
+
+          To compile this code as a module, choose M here: the
+          module will be called sch_plug.
+
 comment "Classification"
 
 config NET_CLS
diff --git a/net/sched/Makefile b/net/sched/Makefile
index dc5889c0a15a..5940a1992f0d 100644
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -33,9 +33,12 @@ obj-$(CONFIG_NET_SCH_MULTIQ)	+= sch_multiq.o
 obj-$(CONFIG_NET_SCH_ATM)       += sch_atm.o
 obj-$(CONFIG_NET_SCH_NETEM)     += sch_netem.o
 obj-$(CONFIG_NET_SCH_DRR)       += sch_drr.o
+obj-$(CONFIG_NET_SCH_PLUG)      += sch_plug.o
 obj-$(CONFIG_NET_SCH_MQPRIO)    += sch_mqprio.o
 obj-$(CONFIG_NET_SCH_CHOKE)     += sch_choke.o
 obj-$(CONFIG_NET_SCH_QFQ)       += sch_qfq.o
+obj-$(CONFIG_NET_SCH_CODEL)     += sch_codel.o
+obj-$(CONFIG_NET_SCH_FQ_CODEL)  += sch_fq_codel.o
 
 obj-$(CONFIG_NET_CLS_U32)       += cls_u32.o
 obj-$(CONFIG_NET_CLS_ROUTE4)    += cls_route.o
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 93fdf131bd75..5cfb160df063 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -127,7 +127,8 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a,
         nest = nla_nest_start(skb, a->order);
         if (nest == NULL)
                 goto nla_put_failure;
-        NLA_PUT_STRING(skb, TCA_KIND, a->ops->kind);
+        if (nla_put_string(skb, TCA_KIND, a->ops->kind))
+                goto nla_put_failure;
         for (i = 0; i < (hinfo->hmask + 1); i++) {
                 p = hinfo->htab[tcf_hash(i, hinfo->hmask)];
 
@@ -139,7 +140,8 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a,
                         p = s_p;
                 }
         }
-        NLA_PUT_U32(skb, TCA_FCNT, n_i);
+        if (nla_put_u32(skb, TCA_FCNT, n_i))
+                goto nla_put_failure;
         nla_nest_end(skb, nest);
 
         return n_i;
@@ -437,7 +439,8 @@ tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
         if (a->ops == NULL || a->ops->dump == NULL)
                 return err;
 
-        NLA_PUT_STRING(skb, TCA_KIND, a->ops->kind);
+        if (nla_put_string(skb, TCA_KIND, a->ops->kind))
+                goto nla_put_failure;
         if (tcf_action_copy_stats(skb, a, 0))
                 goto nla_put_failure;
         nest = nla_nest_start(skb, TCA_OPTIONS);
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 453a73431ac4..2c8ad7c86e43 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -397,7 +397,7 @@ static int tcf_csum_ipv6_hopopts(struct ipv6_opt_hdr *ip6xh,
 
         while (len > 1) {
                 switch (xh[off]) {
-                case IPV6_TLV_PAD0:
+                case IPV6_TLV_PAD1:
                         optlen = 1;
                         break;
                 case IPV6_TLV_JUMBO:
@@ -550,11 +550,13 @@ static int tcf_csum_dump(struct sk_buff *skb,
         };
         struct tcf_t t;
 
-        NLA_PUT(skb, TCA_CSUM_PARMS, sizeof(opt), &opt);
+        if (nla_put(skb, TCA_CSUM_PARMS, sizeof(opt), &opt))
+                goto nla_put_failure;
         t.install = jiffies_to_clock_t(jiffies - p->tcf_tm.install);
         t.lastuse = jiffies_to_clock_t(jiffies - p->tcf_tm.lastuse);
         t.expires = jiffies_to_clock_t(p->tcf_tm.expires);
-        NLA_PUT(skb, TCA_CSUM_TM, sizeof(t), &t);
+        if (nla_put(skb, TCA_CSUM_TM, sizeof(t), &t))
+                goto nla_put_failure;
 
         return skb->len;
 
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index b77f5a06a658..f10fb8256442 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -162,7 +162,8 @@ static int tcf_gact_dump(struct sk_buff *skb, struct tc_action *a, int bind, int
         };
         struct tcf_t t;
 
-        NLA_PUT(skb, TCA_GACT_PARMS, sizeof(opt), &opt);
+        if (nla_put(skb, TCA_GACT_PARMS, sizeof(opt), &opt))
+                goto nla_put_failure;
 #ifdef CONFIG_GACT_PROB
         if (gact->tcfg_ptype) {
                 struct tc_gact_p p_opt = {
@@ -171,13 +172,15 @@ static int tcf_gact_dump(struct sk_buff *skb, struct tc_action *a, int bind, int
                         .ptype   = gact->tcfg_ptype,
                 };
 
-                NLA_PUT(skb, TCA_GACT_PROB, sizeof(p_opt), &p_opt);
+                if (nla_put(skb, TCA_GACT_PROB, sizeof(p_opt), &p_opt))
+                        goto nla_put_failure;
         }
 #endif
         t.install = jiffies_to_clock_t(jiffies - gact->tcf_tm.install);
         t.lastuse = jiffies_to_clock_t(jiffies - gact->tcf_tm.lastuse);
         t.expires = jiffies_to_clock_t(gact->tcf_tm.expires);
-        NLA_PUT(skb, TCA_GACT_TM, sizeof(t), &t);
+        if (nla_put(skb, TCA_GACT_TM, sizeof(t), &t))
+                goto nla_put_failure;
         return skb->len;
 
 nla_put_failure:
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 60f8f616e8fa..60e281ad0f07 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -1,5 +1,5 @@
 /*
- * net/sched/ipt.c      iptables target interface
+ * net/sched/ipt.c     iptables target interface
  *
  *TODO: Add other tables. For now we only support the ipv4 table targets
  *
@@ -235,9 +235,8 @@ static int tcf_ipt(struct sk_buff *skb, const struct tc_action *a,
                 result = TC_ACT_PIPE;
                 break;
         default:
-                if (net_ratelimit())
-                        pr_notice("tc filter: Bogus netfilter code"
-                                  " %d assume ACCEPT\n", ret);
+                net_notice_ratelimited("tc filter: Bogus netfilter code %d assume ACCEPT\n",
+                                       ret);
                 result = TC_POLICE_OK;
                 break;
         }
@@ -267,15 +266,17 @@ static int tcf_ipt_dump(struct sk_buff *skb, struct tc_action *a, int bind, int
         c.refcnt = ipt->tcf_refcnt - ref;
         strcpy(t->u.user.name, ipt->tcfi_t->u.kernel.target->name);
 
-        NLA_PUT(skb, TCA_IPT_TARG, ipt->tcfi_t->u.user.target_size, t);
-        NLA_PUT_U32(skb, TCA_IPT_INDEX, ipt->tcf_index);
-        NLA_PUT_U32(skb, TCA_IPT_HOOK, ipt->tcfi_hook);
-        NLA_PUT(skb, TCA_IPT_CNT, sizeof(struct tc_cnt), &c);
-        NLA_PUT_STRING(skb, TCA_IPT_TABLE, ipt->tcfi_tname);
+        if (nla_put(skb, TCA_IPT_TARG, ipt->tcfi_t->u.user.target_size, t) ||
+            nla_put_u32(skb, TCA_IPT_INDEX, ipt->tcf_index) ||
+            nla_put_u32(skb, TCA_IPT_HOOK, ipt->tcfi_hook) ||
+            nla_put(skb, TCA_IPT_CNT, sizeof(struct tc_cnt), &c) ||
+            nla_put_string(skb, TCA_IPT_TABLE, ipt->tcfi_tname))
+                goto nla_put_failure;
         tm.install = jiffies_to_clock_t(jiffies - ipt->tcf_tm.install);
         tm.lastuse = jiffies_to_clock_t(jiffies - ipt->tcf_tm.lastuse);
         tm.expires = jiffies_to_clock_t(ipt->tcf_tm.expires);
-        NLA_PUT(skb, TCA_IPT_TM, sizeof (tm), &tm);
+        if (nla_put(skb, TCA_IPT_TM, sizeof (tm), &tm))
+                goto nla_put_failure;
         kfree(t);
         return skb->len;
 
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index e051398fdf6b..fe81cc18e9e0 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -174,9 +174,8 @@ static int tcf_mirred(struct sk_buff *skb, const struct tc_action *a,
         }
 
         if (!(dev->flags & IFF_UP)) {
-                if (net_ratelimit())
-                        pr_notice("tc mirred to Houston: device %s is down\n",
-                                  dev->name);
+                net_notice_ratelimited("tc mirred to Houston: device %s is down\n",
+                                       dev->name);
                 goto out;
         }
 
@@ -227,11 +226,13 @@ static int tcf_mirred_dump(struct sk_buff *skb, struct tc_action *a, int bind, i
         };
         struct tcf_t t;
 
-        NLA_PUT(skb, TCA_MIRRED_PARMS, sizeof(opt), &opt);
+        if (nla_put(skb, TCA_MIRRED_PARMS, sizeof(opt), &opt))
+                goto nla_put_failure;
         t.install = jiffies_to_clock_t(jiffies - m->tcf_tm.install);
         t.lastuse = jiffies_to_clock_t(jiffies - m->tcf_tm.lastuse);
         t.expires = jiffies_to_clock_t(m->tcf_tm.expires);
-        NLA_PUT(skb, TCA_MIRRED_TM, sizeof(t), &t);
+        if (nla_put(skb, TCA_MIRRED_TM, sizeof(t), &t))
+                goto nla_put_failure;
         return skb->len;
 
 nla_put_failure:
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 001d1b354869..b5d029eb44f2 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -284,11 +284,13 @@ static int tcf_nat_dump(struct sk_buff *skb, struct tc_action *a,
         };
         struct tcf_t t;
 
-        NLA_PUT(skb, TCA_NAT_PARMS, sizeof(opt), &opt);
+        if (nla_put(skb, TCA_NAT_PARMS, sizeof(opt), &opt))
+                goto nla_put_failure;
         t.install = jiffies_to_clock_t(jiffies - p->tcf_tm.install);
         t.lastuse = jiffies_to_clock_t(jiffies - p->tcf_tm.lastuse);
         t.expires = jiffies_to_clock_t(p->tcf_tm.expires);
-        NLA_PUT(skb, TCA_NAT_TM, sizeof(t), &t);
+        if (nla_put(skb, TCA_NAT_TM, sizeof(t), &t))
+                goto nla_put_failure;
 
         return skb->len;
 
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 10d3aed86560..26aa2f6ce257 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -215,11 +215,13 @@ static int tcf_pedit_dump(struct sk_buff *skb, struct tc_action *a,
         opt->refcnt = p->tcf_refcnt - ref;
         opt->bindcnt = p->tcf_bindcnt - bind;
 
-        NLA_PUT(skb, TCA_PEDIT_PARMS, s, opt);
+        if (nla_put(skb, TCA_PEDIT_PARMS, s, opt))
+                goto nla_put_failure;
         t.install = jiffies_to_clock_t(jiffies - p->tcf_tm.install);
         t.lastuse = jiffies_to_clock_t(jiffies - p->tcf_tm.lastuse);
         t.expires = jiffies_to_clock_t(p->tcf_tm.expires);
-        NLA_PUT(skb, TCA_PEDIT_TM, sizeof(t), &t);
+        if (nla_put(skb, TCA_PEDIT_TM, sizeof(t), &t))
+                goto nla_put_failure;
         kfree(opt);
         return skb->len;
 
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 6fb3f5af0f85..a9de23297d47 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -356,11 +356,14 @@ tcf_act_police_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
                 opt.rate = police->tcfp_R_tab->rate;
         if (police->tcfp_P_tab)
                 opt.peakrate = police->tcfp_P_tab->rate;
-        NLA_PUT(skb, TCA_POLICE_TBF, sizeof(opt), &opt);
-        if (police->tcfp_result)
-                NLA_PUT_U32(skb, TCA_POLICE_RESULT, police->tcfp_result);
-        if (police->tcfp_ewma_rate)
-                NLA_PUT_U32(skb, TCA_POLICE_AVRATE, police->tcfp_ewma_rate);
+        if (nla_put(skb, TCA_POLICE_TBF, sizeof(opt), &opt))
+                goto nla_put_failure;
+        if (police->tcfp_result &&
+            nla_put_u32(skb, TCA_POLICE_RESULT, police->tcfp_result))
+                goto nla_put_failure;
+        if (police->tcfp_ewma_rate &&
+            nla_put_u32(skb, TCA_POLICE_AVRATE, police->tcfp_ewma_rate))
+                goto nla_put_failure;
         return skb->len;
 
 nla_put_failure:
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 73e0a3ab4d55..3922f2a2821b 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -172,12 +172,14 @@ static int tcf_simp_dump(struct sk_buff *skb, struct tc_action *a,
         };
         struct tcf_t t;
 
-        NLA_PUT(skb, TCA_DEF_PARMS, sizeof(opt), &opt);
-        NLA_PUT_STRING(skb, TCA_DEF_DATA, d->tcfd_defdata);
+        if (nla_put(skb, TCA_DEF_PARMS, sizeof(opt), &opt) ||
+            nla_put_string(skb, TCA_DEF_DATA, d->tcfd_defdata))
+                goto nla_put_failure;
         t.install = jiffies_to_clock_t(jiffies - d->tcf_tm.install);
         t.lastuse = jiffies_to_clock_t(jiffies - d->tcf_tm.lastuse);
         t.expires = jiffies_to_clock_t(d->tcf_tm.expires);
-        NLA_PUT(skb, TCA_DEF_TM, sizeof(t), &t);
+        if (nla_put(skb, TCA_DEF_TM, sizeof(t), &t))
+                goto nla_put_failure;
         return skb->len;
 
 nla_put_failure:
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index 35dbbe91027e..476e0fac6712 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -166,20 +166,25 @@ static int tcf_skbedit_dump(struct sk_buff *skb, struct tc_action *a,
         };
         struct tcf_t t;
 
-        NLA_PUT(skb, TCA_SKBEDIT_PARMS, sizeof(opt), &opt);
-        if (d->flags & SKBEDIT_F_PRIORITY)
-                NLA_PUT(skb, TCA_SKBEDIT_PRIORITY, sizeof(d->priority),
-                        &d->priority);
-        if (d->flags & SKBEDIT_F_QUEUE_MAPPING)
-                NLA_PUT(skb, TCA_SKBEDIT_QUEUE_MAPPING,
-                        sizeof(d->queue_mapping), &d->queue_mapping);
-        if (d->flags & SKBEDIT_F_MARK)
-                NLA_PUT(skb, TCA_SKBEDIT_MARK, sizeof(d->mark),
-                        &d->mark);
+        if (nla_put(skb, TCA_SKBEDIT_PARMS, sizeof(opt), &opt))
+                goto nla_put_failure;
+        if ((d->flags & SKBEDIT_F_PRIORITY) &&
+            nla_put(skb, TCA_SKBEDIT_PRIORITY, sizeof(d->priority),
+                    &d->priority))
+                goto nla_put_failure;
+        if ((d->flags & SKBEDIT_F_QUEUE_MAPPING) &&
+            nla_put(skb, TCA_SKBEDIT_QUEUE_MAPPING,
+                    sizeof(d->queue_mapping), &d->queue_mapping))
+                goto nla_put_failure;
+        if ((d->flags & SKBEDIT_F_MARK) &&
+            nla_put(skb, TCA_SKBEDIT_MARK, sizeof(d->mark),
+                    &d->mark))
+                goto nla_put_failure;
         t.install = jiffies_to_clock_t(jiffies - d->tcf_tm.install);
         t.lastuse = jiffies_to_clock_t(jiffies - d->tcf_tm.lastuse);
         t.expires = jiffies_to_clock_t(d->tcf_tm.expires);
-        NLA_PUT(skb, TCA_SKBEDIT_TM, sizeof(t), &t);
+        if (nla_put(skb, TCA_SKBEDIT_TM, sizeof(t), &t))
+                goto nla_put_failure;
         return skb->len;
 
 nla_put_failure:
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index a69d44f1dac5..f452f696b4b3 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -357,7 +357,8 @@ static int tcf_fill_node(struct sk_buff *skb, struct tcf_proto *tp,
         tcm->tcm_ifindex = qdisc_dev(tp->q)->ifindex;
         tcm->tcm_parent = tp->classid;
         tcm->tcm_info = TC_H_MAKE(tp->prio, tp->protocol);
-        NLA_PUT_STRING(skb, TCA_KIND, tp->ops->kind);
+        if (nla_put_string(skb, TCA_KIND, tp->ops->kind))
+                goto nla_put_failure;
         tcm->tcm_handle = fh;
         if (RTM_DELTFILTER != event) {
                 tcm->tcm_handle = 0;
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index ea1f70b5a5f4..590960a22a77 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -257,8 +257,9 @@ static int basic_dump(struct tcf_proto *tp, unsigned long fh,
         if (nest == NULL)
                 goto nla_put_failure;
 
-        if (f->res.classid)
-                NLA_PUT_U32(skb, TCA_BASIC_CLASSID, f->res.classid);
+        if (f->res.classid &&
+            nla_put_u32(skb, TCA_BASIC_CLASSID, f->res.classid))
+                goto nla_put_failure;
 
         if (tcf_exts_dump(skb, &f->exts, &basic_ext_map) < 0 ||
             tcf_em_tree_dump(skb, &f->ematches, TCA_BASIC_EMATCHES) < 0)
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index f84fdc3a7f27..7743ea8d1d38 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -22,23 +22,6 @@
 #include <net/sock.h>
 #include <net/cls_cgroup.h>
 
-static struct cgroup_subsys_state *cgrp_create(struct cgroup_subsys *ss,
-                                               struct cgroup *cgrp);
-static void cgrp_destroy(struct cgroup_subsys *ss, struct cgroup *cgrp);
-static int cgrp_populate(struct cgroup_subsys *ss, struct cgroup *cgrp);
-
-struct cgroup_subsys net_cls_subsys = {
-        .name           = "net_cls",
-        .create         = cgrp_create,
-        .destroy        = cgrp_destroy,
-        .populate       = cgrp_populate,
-#ifdef CONFIG_NET_CLS_CGROUP
-        .subsys_id      = net_cls_subsys_id,
-#endif
-        .module         = THIS_MODULE,
-};
-
-
 static inline struct cgroup_cls_state *cgrp_cls_state(struct cgroup *cgrp)
 {
         return container_of(cgroup_subsys_state(cgrp, net_cls_subsys_id),
@@ -51,8 +34,7 @@ static inline struct cgroup_cls_state *task_cls_state(struct task_struct *p)
                             struct cgroup_cls_state, css);
 }
 
-static struct cgroup_subsys_state *cgrp_create(struct cgroup_subsys *ss,
-                                                 struct cgroup *cgrp)
+static struct cgroup_subsys_state *cgrp_create(struct cgroup *cgrp)
 {
         struct cgroup_cls_state *cs;
 
@@ -66,7 +48,7 @@ static struct cgroup_subsys_state *cgrp_create(struct cgroup_subsys *ss,
         return &cs->css;
 }
 
-static void cgrp_destroy(struct cgroup_subsys *ss, struct cgroup *cgrp)
+static void cgrp_destroy(struct cgroup *cgrp)
 {
         kfree(cgrp_cls_state(cgrp));
 }
@@ -88,12 +70,19 @@ static struct cftype ss_files[] = {
                 .read_u64 = read_classid,
                 .write_u64 = write_classid,
         },
+        { }     /* terminate */
 };
 
-static int cgrp_populate(struct cgroup_subsys *ss, struct cgroup *cgrp)
-{
-        return cgroup_add_files(cgrp, ss, ss_files, ARRAY_SIZE(ss_files));
-}
+struct cgroup_subsys net_cls_subsys = {
+        .name           = "net_cls",
+        .create         = cgrp_create,
+        .destroy        = cgrp_destroy,
+#ifdef CONFIG_NET_CLS_CGROUP
+        .subsys_id      = net_cls_subsys_id,
+#endif
+        .base_cftypes   = ss_files,
+        .module         = THIS_MODULE,
+};
 
 struct cls_cgroup_head {
         u32                     handle;
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 1d8bd0dbcd1f..ccd08c8dc6a7 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -572,25 +572,32 @@ static int flow_dump(struct tcf_proto *tp, unsigned long fh,
         if (nest == NULL)
                 goto nla_put_failure;
 
-        NLA_PUT_U32(skb, TCA_FLOW_KEYS, f->keymask);
-        NLA_PUT_U32(skb, TCA_FLOW_MODE, f->mode);
+        if (nla_put_u32(skb, TCA_FLOW_KEYS, f->keymask) ||
+            nla_put_u32(skb, TCA_FLOW_MODE, f->mode))
+                goto nla_put_failure;
 
         if (f->mask != ~0 || f->xor != 0) {
-                NLA_PUT_U32(skb, TCA_FLOW_MASK, f->mask);
-                NLA_PUT_U32(skb, TCA_FLOW_XOR, f->xor);
+                if (nla_put_u32(skb, TCA_FLOW_MASK, f->mask) ||
+                    nla_put_u32(skb, TCA_FLOW_XOR, f->xor))
+                        goto nla_put_failure;
         }
-        if (f->rshift)
-                NLA_PUT_U32(skb, TCA_FLOW_RSHIFT, f->rshift);
-        if (f->addend)
-                NLA_PUT_U32(skb, TCA_FLOW_ADDEND, f->addend);
+        if (f->rshift &&
+            nla_put_u32(skb, TCA_FLOW_RSHIFT, f->rshift))
+                goto nla_put_failure;
+        if (f->addend &&
+            nla_put_u32(skb, TCA_FLOW_ADDEND, f->addend))
+                goto nla_put_failure;
 
-        if (f->divisor)
-                NLA_PUT_U32(skb, TCA_FLOW_DIVISOR, f->divisor);
-        if (f->baseclass)
-                NLA_PUT_U32(skb, TCA_FLOW_BASECLASS, f->baseclass);
+        if (f->divisor &&
+            nla_put_u32(skb, TCA_FLOW_DIVISOR, f->divisor))
+                goto nla_put_failure;
+        if (f->baseclass &&
+            nla_put_u32(skb, TCA_FLOW_BASECLASS, f->baseclass))
+                goto nla_put_failure;
 
-        if (f->perturb_period)
-                NLA_PUT_U32(skb, TCA_FLOW_PERTURB, f->perturb_period / HZ);
+        if (f->perturb_period &&
+            nla_put_u32(skb, TCA_FLOW_PERTURB, f->perturb_period / HZ))
+                goto nla_put_failure;
 
         if (tcf_exts_dump(skb, &f->exts, &flow_ext_map) < 0)
                 goto nla_put_failure;
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 389af152ec45..8384a4797240 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -346,14 +346,17 @@ static int fw_dump(struct tcf_proto *tp, unsigned long fh,
         if (nest == NULL)
                 goto nla_put_failure;
 
-        if (f->res.classid)
-                NLA_PUT_U32(skb, TCA_FW_CLASSID, f->res.classid);
+        if (f->res.classid &&
+            nla_put_u32(skb, TCA_FW_CLASSID, f->res.classid))
+                goto nla_put_failure;
 #ifdef CONFIG_NET_CLS_IND
-        if (strlen(f->indev))
-                NLA_PUT_STRING(skb, TCA_FW_INDEV, f->indev);
+        if (strlen(f->indev) &&
+            nla_put_string(skb, TCA_FW_INDEV, f->indev))
+                goto nla_put_failure;
 #endif /* CONFIG_NET_CLS_IND */
-        if (head->mask != 0xFFFFFFFF)
-                NLA_PUT_U32(skb, TCA_FW_MASK, head->mask);
+        if (head->mask != 0xFFFFFFFF &&
+            nla_put_u32(skb, TCA_FW_MASK, head->mask))
+                goto nla_put_failure;
 
         if (tcf_exts_dump(skb, &f->exts, &fw_ext_map) < 0)
                 goto nla_put_failure;
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index 13ab66e9df58..36fec4227401 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -571,17 +571,21 @@ static int route4_dump(struct tcf_proto *tp, unsigned long fh,
 
         if (!(f->handle & 0x8000)) {
                 id = f->id & 0xFF;
-                NLA_PUT_U32(skb, TCA_ROUTE4_TO, id);
+                if (nla_put_u32(skb, TCA_ROUTE4_TO, id))
+                        goto nla_put_failure;
         }
         if (f->handle & 0x80000000) {
-                if ((f->handle >> 16) != 0xFFFF)
-                        NLA_PUT_U32(skb, TCA_ROUTE4_IIF, f->iif);
+                if ((f->handle >> 16) != 0xFFFF &&
+                    nla_put_u32(skb, TCA_ROUTE4_IIF, f->iif))
+                        goto nla_put_failure;
         } else {
                 id = f->id >> 16;
-                NLA_PUT_U32(skb, TCA_ROUTE4_FROM, id);
+                if (nla_put_u32(skb, TCA_ROUTE4_FROM, id))
+                        goto nla_put_failure;
         }
-        if (f->res.classid)
-                NLA_PUT_U32(skb, TCA_ROUTE4_CLASSID, f->res.classid);
+        if (f->res.classid &&
+            nla_put_u32(skb, TCA_ROUTE4_CLASSID, f->res.classid))
+                goto nla_put_failure;
 
         if (tcf_exts_dump(skb, &f->exts, &route_ext_map) < 0)
                 goto nla_put_failure;
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index b01427924f81..18ab93ec8d7e 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -615,18 +615,22 @@ static int rsvp_dump(struct tcf_proto *tp, unsigned long fh,
         if (nest == NULL)
                 goto nla_put_failure;
 
-        NLA_PUT(skb, TCA_RSVP_DST, sizeof(s->dst), &s->dst);
+        if (nla_put(skb, TCA_RSVP_DST, sizeof(s->dst), &s->dst))
+                goto nla_put_failure;
         pinfo.dpi = s->dpi;
         pinfo.spi = f->spi;
         pinfo.protocol = s->protocol;
         pinfo.tunnelid = s->tunnelid;
         pinfo.tunnelhdr = f->tunnelhdr;
         pinfo.pad = 0;
-        NLA_PUT(skb, TCA_RSVP_PINFO, sizeof(pinfo), &pinfo);
-        if (f->res.classid)
-                NLA_PUT_U32(skb, TCA_RSVP_CLASSID, f->res.classid);
-        if (((f->handle >> 8) & 0xFF) != 16)
-                NLA_PUT(skb, TCA_RSVP_SRC, sizeof(f->src), f->src);
+        if (nla_put(skb, TCA_RSVP_PINFO, sizeof(pinfo), &pinfo))
+                goto nla_put_failure;
+        if (f->res.classid &&
+            nla_put_u32(skb, TCA_RSVP_CLASSID, f->res.classid))
+                goto nla_put_failure;
+        if (((f->handle >> 8) & 0xFF) != 16 &&
+            nla_put(skb, TCA_RSVP_SRC, sizeof(f->src), f->src))
+                goto nla_put_failure;
 
         if (tcf_exts_dump(skb, &f->exts, &rsvp_ext_map) < 0)
                 goto nla_put_failure;
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index dbe199234c63..fe29420d0b0e 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -438,10 +438,11 @@ static int tcindex_dump(struct tcf_proto *tp, unsigned long fh,
 
         if (!fh) {
                 t->tcm_handle = ~0; /* whatever ... */
-                NLA_PUT_U32(skb, TCA_TCINDEX_HASH, p->hash);
-                NLA_PUT_U16(skb, TCA_TCINDEX_MASK, p->mask);
-                NLA_PUT_U32(skb, TCA_TCINDEX_SHIFT, p->shift);
-                NLA_PUT_U32(skb, TCA_TCINDEX_FALL_THROUGH, p->fall_through);
+                if (nla_put_u32(skb, TCA_TCINDEX_HASH, p->hash) ||
+                    nla_put_u16(skb, TCA_TCINDEX_MASK, p->mask) ||
+                    nla_put_u32(skb, TCA_TCINDEX_SHIFT, p->shift) ||
+                    nla_put_u32(skb, TCA_TCINDEX_FALL_THROUGH, p->fall_through))
+                        goto nla_put_failure;
                 nla_nest_end(skb, nest);
         } else {
                 if (p->perfect) {
@@ -460,8 +461,9 @@ static int tcindex_dump(struct tcf_proto *tp, unsigned long fh,
                         }
                 }
                 pr_debug("handle = %d\n", t->tcm_handle);
-                if (r->res.class)
-                        NLA_PUT_U32(skb, TCA_TCINDEX_CLASSID, r->res.classid);
+                if (r->res.class &&
+                    nla_put_u32(skb, TCA_TCINDEX_CLASSID, r->res.classid))
+                        goto nla_put_failure;
 
                 if (tcf_exts_dump(skb, &r->exts, &tcindex_ext_map) < 0)
                         goto nla_put_failure;
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 939b627b4795..d45373fb00b9 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -234,8 +234,7 @@ out:
         return -1;
 
 deadloop:
-        if (net_ratelimit())
-                pr_warning("cls_u32: dead loop\n");
+        net_warn_ratelimited("cls_u32: dead loop\n");
         return -1;
 }
 
@@ -733,36 +732,44 @@ static int u32_dump(struct tcf_proto *tp, unsigned long fh,
                 struct tc_u_hnode *ht = (struct tc_u_hnode *)fh;
                 u32 divisor = ht->divisor + 1;
 
-                NLA_PUT_U32(skb, TCA_U32_DIVISOR, divisor);
+                if (nla_put_u32(skb, TCA_U32_DIVISOR, divisor))
+                        goto nla_put_failure;
         } else {
-                NLA_PUT(skb, TCA_U32_SEL,
-                        sizeof(n->sel) + n->sel.nkeys*sizeof(struct tc_u32_key),
-                        &n->sel);
+                if (nla_put(skb, TCA_U32_SEL,
+                            sizeof(n->sel) + n->sel.nkeys*sizeof(struct tc_u32_key),
+                            &n->sel))
+                        goto nla_put_failure;
                 if (n->ht_up) {
                         u32 htid = n->handle & 0xFFFFF000;
-                        NLA_PUT_U32(skb, TCA_U32_HASH, htid);
+                        if (nla_put_u32(skb, TCA_U32_HASH, htid))
+                                goto nla_put_failure;
                 }
-                if (n->res.classid)
-                        NLA_PUT_U32(skb, TCA_U32_CLASSID, n->res.classid);
-                if (n->ht_down)
-                        NLA_PUT_U32(skb, TCA_U32_LINK, n->ht_down->handle);
+                if (n->res.classid &&
+                    nla_put_u32(skb, TCA_U32_CLASSID, n->res.classid))
+                        goto nla_put_failure;
+                if (n->ht_down &&
+                    nla_put_u32(skb, TCA_U32_LINK, n->ht_down->handle))
+                        goto nla_put_failure;
 
 #ifdef CONFIG_CLS_U32_MARK
-                if (n->mark.val || n->mark.mask)
-                        NLA_PUT(skb, TCA_U32_MARK, sizeof(n->mark), &n->mark);
+                if ((n->mark.val || n->mark.mask) &&
+                    nla_put(skb, TCA_U32_MARK, sizeof(n->mark), &n->mark))
+                        goto nla_put_failure;
 #endif
 
                 if (tcf_exts_dump(skb, &n->exts, &u32_ext_map) < 0)
                         goto nla_put_failure;
 
 #ifdef CONFIG_NET_CLS_IND
-                if (strlen(n->indev))
-                        NLA_PUT_STRING(skb, TCA_U32_INDEV, n->indev);
+                if (strlen(n->indev) &&
+                    nla_put_string(skb, TCA_U32_INDEV, n->indev))
+                        goto nla_put_failure;
 #endif
 #ifdef CONFIG_CLS_U32_PERF
-                NLA_PUT(skb, TCA_U32_PCNT,
-                sizeof(struct tc_u32_pcnt) + n->sel.nkeys*sizeof(u64),
-                        n->pf);
+                if (nla_put(skb, TCA_U32_PCNT,
+                            sizeof(struct tc_u32_pcnt) + n->sel.nkeys*sizeof(u64),
+                            n->pf))
+                        goto nla_put_failure;
 #endif
         }
 
diff --git a/net/sched/em_meta.c b/net/sched/em_meta.c
index 1363bf14e61b..4790c696cbce 100644
--- a/net/sched/em_meta.c
+++ b/net/sched/em_meta.c
@@ -585,8 +585,9 @@ static void meta_var_apply_extras(struct meta_value *v,
 
 static int meta_var_dump(struct sk_buff *skb, struct meta_value *v, int tlv)
 {
-        if (v->val && v->len)
-                NLA_PUT(skb, tlv, v->len, (void *) v->val);
+        if (v->val && v->len &&
+            nla_put(skb, tlv, v->len, (void *) v->val))
+                goto nla_put_failure;
         return 0;
 
 nla_put_failure:
@@ -636,10 +637,13 @@ static void meta_int_apply_extras(struct meta_value *v,
 
 static int meta_int_dump(struct sk_buff *skb, struct meta_value *v, int tlv)
 {
-        if (v->len == sizeof(unsigned long))
-                NLA_PUT(skb, tlv, sizeof(unsigned long), &v->val);
-        else if (v->len == sizeof(u32))
-                NLA_PUT_U32(skb, tlv, v->val);
+        if (v->len == sizeof(unsigned long)) {
+                if (nla_put(skb, tlv, sizeof(unsigned long), &v->val))
+                        goto nla_put_failure;
+        } else if (v->len == sizeof(u32)) {
+                if (nla_put_u32(skb, tlv, v->val))
+                        goto nla_put_failure;
+        }
 
         return 0;
 
@@ -831,7 +835,8 @@ static int em_meta_dump(struct sk_buff *skb, struct tcf_ematch *em)
         memcpy(&hdr.left, &meta->lvalue.hdr, sizeof(hdr.left));
         memcpy(&hdr.right, &meta->rvalue.hdr, sizeof(hdr.right));
 
-        NLA_PUT(skb, TCA_EM_META_HDR, sizeof(hdr), &hdr);
+        if (nla_put(skb, TCA_EM_META_HDR, sizeof(hdr), &hdr))
+                goto nla_put_failure;
 
         ops = meta_type_ops(&meta->lvalue);
         if (ops->dump(skb, &meta->lvalue, TCA_EM_META_LVALUE) < 0 ||
diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index 88d93eb92507..3a633debb6df 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -441,7 +441,8 @@ int tcf_em_tree_dump(struct sk_buff *skb, struct tcf_ematch_tree *tree, int tlv)
         if (top_start == NULL)
                 goto nla_put_failure;
 
-        NLA_PUT(skb, TCA_EMATCH_TREE_HDR, sizeof(tree->hdr), &tree->hdr);
+        if (nla_put(skb, TCA_EMATCH_TREE_HDR, sizeof(tree->hdr), &tree->hdr))
+                goto nla_put_failure;
 
         list_start = nla_nest_start(skb, TCA_EMATCH_TREE_LIST);
         if (list_start == NULL)
@@ -457,7 +458,8 @@ int tcf_em_tree_dump(struct sk_buff *skb, struct tcf_ematch_tree *tree, int tlv)
                         .flags = em->flags
                 };
 
-                NLA_PUT(skb, i + 1, sizeof(em_hdr), &em_hdr);
+                if (nla_put(skb, i + 1, sizeof(em_hdr), &em_hdr))
+                        goto nla_put_failure;
 
                 if (em->ops && em->ops->dump) {
                         if (em->ops->dump(skb, em) < 0)
@@ -535,9 +537,7 @@ pop_stack:
         return res;
 
 stack_overflow:
-        if (net_ratelimit())
-                pr_warning("tc ematch: local stack overflow,"
-                           " increase NET_EMATCH_STACK\n");
+        net_warn_ratelimited("tc ematch: local stack overflow, increase NET_EMATCH_STACK\n");
         return -1;
 }
 EXPORT_SYMBOL(__tcf_em_tree_match);
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 3d8981fde301..085ce53d570a 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -426,7 +426,8 @@ static int qdisc_dump_stab(struct sk_buff *skb, struct qdisc_size_table *stab)
         nest = nla_nest_start(skb, TCA_STAB);
         if (nest == NULL)
                 goto nla_put_failure;
-        NLA_PUT(skb, TCA_STAB_BASE, sizeof(stab->szopts), &stab->szopts);
+        if (nla_put(skb, TCA_STAB_BASE, sizeof(stab->szopts), &stab->szopts))
+                goto nla_put_failure;
         nla_nest_end(skb, nest);
 
         return skb->len;
@@ -1201,7 +1202,8 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
         tcm->tcm_parent = clid;
         tcm->tcm_handle = q->handle;
         tcm->tcm_info = atomic_read(&q->refcnt);
-        NLA_PUT_STRING(skb, TCA_KIND, q->ops->id);
+        if (nla_put_string(skb, TCA_KIND, q->ops->id))
+                goto nla_put_failure;
         if (q->ops->dump && q->ops->dump(q, skb) < 0)
                 goto nla_put_failure;
         q->qstats.qlen = q->q.qlen;
@@ -1505,7 +1507,8 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
         tcm->tcm_parent = q->handle;
         tcm->tcm_handle = q->handle;
         tcm->tcm_info = 0;
-        NLA_PUT_STRING(skb, TCA_KIND, q->ops->id);
+        if (nla_put_string(skb, TCA_KIND, q->ops->id))
+                goto nla_put_failure;
         if (cl_ops->dump && cl_ops->dump(q, cl, skb, tcm) < 0)
                 goto nla_put_failure;
 
@@ -1688,12 +1691,10 @@ reclassify:
                 tp = otp;
 
                 if (verd++ >= MAX_REC_LOOP) {
-                        if (net_ratelimit())
-                                pr_notice("%s: packet reclassify loop"
-                                          " rule prio %u protocol %02x\n",
-                                          tp->q->ops->id,
-                                          tp->prio & 0xffff,
-                                          ntohs(tp->protocol));
+                        net_notice_ratelimited("%s: packet reclassify loop rule prio %u protocol %02x\n",
+                                               tp->q->ops->id,
+                                               tp->prio & 0xffff,
+                                               ntohs(tp->protocol));
                         return TC_ACT_SHOT;
                 }
                 skb->tc_verd = SET_TC_VERD(skb->tc_verd, verd);
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index e25e49061a0d..ca8e0a57d945 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -16,8 +16,6 @@
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
 
-extern struct socket *sockfd_lookup(int fd, int *err);  /* @@@ fix this */
-
 /*
  * The ATM queuing discipline provides a framework for invoking classifiers
  * (aka "filters"), which in turn select classes of this queuing discipline.
@@ -423,8 +421,6 @@ drop: __maybe_unused
                 }
                 return ret;
         }
-        qdisc_bstats_update(sch, skb);
-        bstats_update(&flow->bstats, skb);
         /*
          * Okay, this may seem weird. We pretend we've dropped the packet if
          * it goes via ATM. The reason for this is that the outer qdisc
@@ -472,6 +468,8 @@ static void sch_atm_dequeue(unsigned long data)
                         if (unlikely(!skb))
                                 break;
 
+                        qdisc_bstats_update(sch, skb);
+                        bstats_update(&flow->bstats, skb);
                         pr_debug("atm_tc_dequeue: sending on class %p\n", flow);
                         /* remove any LL header somebody else has attached */
                         skb_pull(skb, skb_network_offset(skb));
@@ -601,7 +599,8 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
         if (nest == NULL)
                 goto nla_put_failure;
 
-        NLA_PUT(skb, TCA_ATM_HDR, flow->hdr_len, flow->hdr);
+        if (nla_put(skb, TCA_ATM_HDR, flow->hdr_len, flow->hdr))
+                goto nla_put_failure;
         if (flow->vcc) {
                 struct sockaddr_atmpvc pvc;
                 int state;
@@ -610,15 +609,19 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
                 pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1;
                 pvc.sap_addr.vpi = flow->vcc->vpi;
                 pvc.sap_addr.vci = flow->vcc->vci;
-                NLA_PUT(skb, TCA_ATM_ADDR, sizeof(pvc), &pvc);
+                if (nla_put(skb, TCA_ATM_ADDR, sizeof(pvc), &pvc))
+                        goto nla_put_failure;
                 state = ATM_VF2VS(flow->vcc->flags);
-                NLA_PUT_U32(skb, TCA_ATM_STATE, state);
+                if (nla_put_u32(skb, TCA_ATM_STATE, state))
+                        goto nla_put_failure;
+        }
+        if (flow->excess) {
+                if (nla_put_u32(skb, TCA_ATM_EXCESS, flow->classid))
+                        goto nla_put_failure;
+        } else {
+                if (nla_put_u32(skb, TCA_ATM_EXCESS, 0))
+                        goto nla_put_failure;
         }
-        if (flow->excess)
-                NLA_PUT_U32(skb, TCA_ATM_EXCESS, flow->classid);
-        else
-                NLA_PUT_U32(skb, TCA_ATM_EXCESS, 0);
-
         nla_nest_end(skb, nest);
         return skb->len;
 
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 24d94c097b35..6aabd77d1cfd 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1425,7 +1425,8 @@ static int cbq_dump_rate(struct sk_buff *skb, struct cbq_class *cl)
 {
         unsigned char *b = skb_tail_pointer(skb);
 
-        NLA_PUT(skb, TCA_CBQ_RATE, sizeof(cl->R_tab->rate), &cl->R_tab->rate);
+        if (nla_put(skb, TCA_CBQ_RATE, sizeof(cl->R_tab->rate), &cl->R_tab->rate))
+                goto nla_put_failure;
         return skb->len;
 
 nla_put_failure:
@@ -1450,7 +1451,8 @@ static int cbq_dump_lss(struct sk_buff *skb, struct cbq_class *cl)
         opt.minidle = (u32)(-cl->minidle);
         opt.offtime = cl->offtime;
         opt.change = ~0;
-        NLA_PUT(skb, TCA_CBQ_LSSOPT, sizeof(opt), &opt);
+        if (nla_put(skb, TCA_CBQ_LSSOPT, sizeof(opt), &opt))
+                goto nla_put_failure;
         return skb->len;
 
 nla_put_failure:
@@ -1468,7 +1470,8 @@ static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
         opt.priority = cl->priority + 1;
         opt.cpriority = cl->cpriority + 1;
         opt.weight = cl->weight;
-        NLA_PUT(skb, TCA_CBQ_WRROPT, sizeof(opt), &opt);
+        if (nla_put(skb, TCA_CBQ_WRROPT, sizeof(opt), &opt))
+                goto nla_put_failure;
         return skb->len;
 
 nla_put_failure:
@@ -1485,7 +1488,8 @@ static int cbq_dump_ovl(struct sk_buff *skb, struct cbq_class *cl)
         opt.priority2 = cl->priority2 + 1;
         opt.pad = 0;
         opt.penalty = cl->penalty;
-        NLA_PUT(skb, TCA_CBQ_OVL_STRATEGY, sizeof(opt), &opt);
+        if (nla_put(skb, TCA_CBQ_OVL_STRATEGY, sizeof(opt), &opt))
+                goto nla_put_failure;
         return skb->len;
 
 nla_put_failure:
@@ -1502,7 +1506,8 @@ static int cbq_dump_fopt(struct sk_buff *skb, struct cbq_class *cl)
                 opt.split = cl->split ? cl->split->common.classid : 0;
                 opt.defmap = cl->defmap;
                 opt.defchange = ~0;
-                NLA_PUT(skb, TCA_CBQ_FOPT, sizeof(opt), &opt);
+                if (nla_put(skb, TCA_CBQ_FOPT, sizeof(opt), &opt))
+                        goto nla_put_failure;
         }
         return skb->len;
 
@@ -1521,7 +1526,8 @@ static int cbq_dump_police(struct sk_buff *skb, struct cbq_class *cl)
                 opt.police = cl->police;
                 opt.__res1 = 0;
                 opt.__res2 = 0;
-                NLA_PUT(skb, TCA_CBQ_POLICE, sizeof(opt), &opt);
+                if (nla_put(skb, TCA_CBQ_POLICE, sizeof(opt), &opt))
+                        goto nla_put_failure;
         }
         return skb->len;
 
diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
index 7e267d7b9c75..cc37dd52ecf9 100644
--- a/net/sched/sch_choke.c
+++ b/net/sched/sch_choke.c
@@ -332,15 +332,13 @@ static int choke_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         }
 
         q->stats.pdrop++;
-        sch->qstats.drops++;
-        kfree_skb(skb);
-        return NET_XMIT_DROP;
+        return qdisc_drop(skb, sch);
 
- congestion_drop:
+congestion_drop:
         qdisc_drop(skb, sch);
         return NET_XMIT_CN;
 
- other_drop:
+other_drop:
         if (ret & __NET_XMIT_BYPASS)
                 sch->qstats.drops++;
         kfree_skb(skb);
@@ -515,8 +513,9 @@ static int choke_dump(struct Qdisc *sch, struct sk_buff *skb)
         if (opts == NULL)
                 goto nla_put_failure;
 
-        NLA_PUT(skb, TCA_CHOKE_PARMS, sizeof(opt), &opt);
-        NLA_PUT_U32(skb, TCA_CHOKE_MAX_P, q->parms.max_P);
+        if (nla_put(skb, TCA_CHOKE_PARMS, sizeof(opt), &opt) ||
+            nla_put_u32(skb, TCA_CHOKE_MAX_P, q->parms.max_P))
+                goto nla_put_failure;
         return nla_nest_end(skb, opts);
 
 nla_put_failure:
diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c
new file mode 100644
index 000000000000..2f9ab17db85a
--- /dev/null
+++ b/net/sched/sch_codel.c
@@ -0,0 +1,276 @@
+/*
+ * Codel - The Controlled-Delay Active Queue Management algorithm
+ *
+ *  Copyright (C) 2011-2012 Kathleen Nichols <nichols@pollere.com>
+ *  Copyright (C) 2011-2012 Van Jacobson <van@pollere.net>
+ *
+ *  Implemented on linux by :
+ *  Copyright (C) 2012 Michael D. Taht <dave.taht@bufferbloat.net>
+ *  Copyright (C) 2012 Eric Dumazet <edumazet@google.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the authors may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * Alternatively, provided that this notice is retained in full, this
+ * software may be distributed under the terms of the GNU General
+ * Public License ("GPL") version 2, in which case the provisions of the
+ * GPL apply INSTEAD OF those given above.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/skbuff.h>
+#include <linux/prefetch.h>
+#include <net/pkt_sched.h>
+#include <net/codel.h>
+
+
+#define DEFAULT_CODEL_LIMIT 1000
+
+struct codel_sched_data {
+        struct codel_params     params;
+        struct codel_vars       vars;
+        struct codel_stats      stats;
+        u32                     drop_overlimit;
+};
+
+/* This is the specific function called from codel_dequeue()
+ * to dequeue a packet from queue. Note: backlog is handled in
+ * codel, we dont need to reduce it here.
+ */
+static struct sk_buff *dequeue(struct codel_vars *vars, struct Qdisc *sch)
+{
+        struct sk_buff *skb = __skb_dequeue(&sch->q);
+
+        prefetch(&skb->end); /* we'll need skb_shinfo() */
+        return skb;
+}
+
+static struct sk_buff *codel_qdisc_dequeue(struct Qdisc *sch)
+{
+        struct codel_sched_data *q = qdisc_priv(sch);
+        struct sk_buff *skb;
+
+        skb = codel_dequeue(sch, &q->params, &q->vars, &q->stats, dequeue);
+
+        /* We cant call qdisc_tree_decrease_qlen() if our qlen is 0,
+         * or HTB crashes. Defer it for next round.
+         */
+        if (q->stats.drop_count && sch->q.qlen) {
+                qdisc_tree_decrease_qlen(sch, q->stats.drop_count);
+                q->stats.drop_count = 0;
+        }
+        if (skb)
+                qdisc_bstats_update(sch, skb);
+        return skb;
+}
+
+static int codel_qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+{
+        struct codel_sched_data *q;
+
+        if (likely(qdisc_qlen(sch) < sch->limit)) {
+                codel_set_enqueue_time(skb);
+                return qdisc_enqueue_tail(skb, sch);
+        }
+        q = qdisc_priv(sch);
+        q->drop_overlimit++;
+        return qdisc_drop(skb, sch);
+}
+
+static const struct nla_policy codel_policy[TCA_CODEL_MAX + 1] = {
+        [TCA_CODEL_TARGET]      = { .type = NLA_U32 },
+        [TCA_CODEL_LIMIT]       = { .type = NLA_U32 },
+        [TCA_CODEL_INTERVAL]    = { .type = NLA_U32 },
+        [TCA_CODEL_ECN]         = { .type = NLA_U32 },
+};
+
+static int codel_change(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct codel_sched_data *q = qdisc_priv(sch);
+        struct nlattr *tb[TCA_CODEL_MAX + 1];
+        unsigned int qlen;
+        int err;
+
+        if (!opt)
+                return -EINVAL;
+
+        err = nla_parse_nested(tb, TCA_CODEL_MAX, opt, codel_policy);
+        if (err < 0)
+                return err;
+
+        sch_tree_lock(sch);
+
+        if (tb[TCA_CODEL_TARGET]) {
+                u32 target = nla_get_u32(tb[TCA_CODEL_TARGET]);
+
+                q->params.target = ((u64)target * NSEC_PER_USEC) >> CODEL_SHIFT;
+        }
+
+        if (tb[TCA_CODEL_INTERVAL]) {
+                u32 interval = nla_get_u32(tb[TCA_CODEL_INTERVAL]);
+
+                q->params.interval = ((u64)interval * NSEC_PER_USEC) >> CODEL_SHIFT;
+        }
+
+        if (tb[TCA_CODEL_LIMIT])
+                sch->limit = nla_get_u32(tb[TCA_CODEL_LIMIT]);
+
+        if (tb[TCA_CODEL_ECN])
+                q->params.ecn = !!nla_get_u32(tb[TCA_CODEL_ECN]);
+
+        qlen = sch->q.qlen;
+        while (sch->q.qlen > sch->limit) {
+                struct sk_buff *skb = __skb_dequeue(&sch->q);
+
+                sch->qstats.backlog -= qdisc_pkt_len(skb);
+                qdisc_drop(skb, sch);
+        }
+        qdisc_tree_decrease_qlen(sch, qlen - sch->q.qlen);
+
+        sch_tree_unlock(sch);
+        return 0;
+}
+
+static int codel_init(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct codel_sched_data *q = qdisc_priv(sch);
+
+        sch->limit = DEFAULT_CODEL_LIMIT;
+
+        codel_params_init(&q->params);
+        codel_vars_init(&q->vars);
+        codel_stats_init(&q->stats);
+
+        if (opt) {
+                int err = codel_change(sch, opt);
+
+                if (err)
+                        return err;
+        }
+
+        if (sch->limit >= 1)
+                sch->flags |= TCQ_F_CAN_BYPASS;
+        else
+                sch->flags &= ~TCQ_F_CAN_BYPASS;
+
+        return 0;
+}
+
+static int codel_dump(struct Qdisc *sch, struct sk_buff *skb)
+{
+        struct codel_sched_data *q = qdisc_priv(sch);
+        struct nlattr *opts;
+
+        opts = nla_nest_start(skb, TCA_OPTIONS);
+        if (opts == NULL)
+                goto nla_put_failure;
+
+        if (nla_put_u32(skb, TCA_CODEL_TARGET,
+                        codel_time_to_us(q->params.target)) ||
+            nla_put_u32(skb, TCA_CODEL_LIMIT,
+                        sch->limit) ||
+            nla_put_u32(skb, TCA_CODEL_INTERVAL,
+                        codel_time_to_us(q->params.interval)) ||
+            nla_put_u32(skb, TCA_CODEL_ECN,
+                        q->params.ecn))
+                goto nla_put_failure;
+
+        return nla_nest_end(skb, opts);
+
+nla_put_failure:
+        nla_nest_cancel(skb, opts);
+        return -1;
+}
+
+static int codel_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
+{
+        const struct codel_sched_data *q = qdisc_priv(sch);
+        struct tc_codel_xstats st = {
+                .maxpacket      = q->stats.maxpacket,
+                .count          = q->vars.count,
+                .lastcount      = q->vars.lastcount,
+                .drop_overlimit = q->drop_overlimit,
+                .ldelay         = codel_time_to_us(q->vars.ldelay),
+                .dropping       = q->vars.dropping,
+                .ecn_mark       = q->stats.ecn_mark,
+        };
+
+        if (q->vars.dropping) {
+                codel_tdiff_t delta = q->vars.drop_next - codel_get_time();
+
+                if (delta >= 0)
+                        st.drop_next = codel_time_to_us(delta);
+                else
+                        st.drop_next = -codel_time_to_us(-delta);
+        }
+
+        return gnet_stats_copy_app(d, &st, sizeof(st));
+}
+
+static void codel_reset(struct Qdisc *sch)
+{
+        struct codel_sched_data *q = qdisc_priv(sch);
+
+        qdisc_reset_queue(sch);
+        codel_vars_init(&q->vars);
+}
+
+static struct Qdisc_ops codel_qdisc_ops __read_mostly = {
+        .id             =       "codel",
+        .priv_size      =       sizeof(struct codel_sched_data),
+
+        .enqueue        =       codel_qdisc_enqueue,
+        .dequeue        =       codel_qdisc_dequeue,
+        .peek           =       qdisc_peek_dequeued,
+        .init           =       codel_init,
+        .reset          =       codel_reset,
+        .change         =       codel_change,
+        .dump           =       codel_dump,
+        .dump_stats     =       codel_dump_stats,
+        .owner          =       THIS_MODULE,
+};
+
+static int __init codel_module_init(void)
+{
+        return register_qdisc(&codel_qdisc_ops);
+}
+
+static void __exit codel_module_exit(void)
+{
+        unregister_qdisc(&codel_qdisc_ops);
+}
+
+module_init(codel_module_init)
+module_exit(codel_module_exit)
+
+MODULE_DESCRIPTION("Controlled Delay queue discipline");
+MODULE_AUTHOR("Dave Taht");
+MODULE_AUTHOR("Eric Dumazet");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 6b7fe4a84f13..9ce0b4fe23ff 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -260,7 +260,8 @@ static int drr_dump_class(struct Qdisc *sch, unsigned long arg,
         nest = nla_nest_start(skb, TCA_OPTIONS);
         if (nest == NULL)
                 goto nla_put_failure;
-        NLA_PUT_U32(skb, TCA_DRR_QUANTUM, cl->quantum);
+        if (nla_put_u32(skb, TCA_DRR_QUANTUM, cl->quantum))
+                goto nla_put_failure;
         return nla_nest_end(skb, nest);
 
 nla_put_failure:
@@ -375,8 +376,6 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 cl->deficit = cl->quantum;
         }
 
-        bstats_update(&cl->bstats, skb);
-
         sch->q.qlen++;
         return err;
 }
@@ -402,6 +401,8 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
                         skb = qdisc_dequeue_peeked(cl->qdisc);
                         if (cl->qdisc->q.qlen == 0)
                                 list_del(&cl->alist);
+
+                        bstats_update(&cl->bstats, skb);
                         qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
                         return skb;
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 2c790204d042..3886365cc207 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -265,8 +265,7 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         return NET_XMIT_SUCCESS;
 
 drop:
-        kfree_skb(skb);
-        sch->qstats.drops++;
+        qdisc_drop(skb, sch);
         return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
 }
 
@@ -429,8 +428,9 @@ static int dsmark_dump_class(struct Qdisc *sch, unsigned long cl,
         opts = nla_nest_start(skb, TCA_OPTIONS);
         if (opts == NULL)
                 goto nla_put_failure;
-        NLA_PUT_U8(skb, TCA_DSMARK_MASK, p->mask[cl - 1]);
-        NLA_PUT_U8(skb, TCA_DSMARK_VALUE, p->value[cl - 1]);
+        if (nla_put_u8(skb, TCA_DSMARK_MASK, p->mask[cl - 1]) ||
+            nla_put_u8(skb, TCA_DSMARK_VALUE, p->value[cl - 1]))
+                goto nla_put_failure;
 
         return nla_nest_end(skb, opts);
 
@@ -447,13 +447,16 @@ static int dsmark_dump(struct Qdisc *sch, struct sk_buff *skb)
         opts = nla_nest_start(skb, TCA_OPTIONS);
         if (opts == NULL)
                 goto nla_put_failure;
-        NLA_PUT_U16(skb, TCA_DSMARK_INDICES, p->indices);
+        if (nla_put_u16(skb, TCA_DSMARK_INDICES, p->indices))
+                goto nla_put_failure;
 
-        if (p->default_index != NO_DEFAULT_INDEX)
-                NLA_PUT_U16(skb, TCA_DSMARK_DEFAULT_INDEX, p->default_index);
+        if (p->default_index != NO_DEFAULT_INDEX &&
+            nla_put_u16(skb, TCA_DSMARK_DEFAULT_INDEX, p->default_index))
+                goto nla_put_failure;
 
-        if (p->set_tc_index)
-                NLA_PUT_FLAG(skb, TCA_DSMARK_SET_TC_INDEX);
+        if (p->set_tc_index &&
+            nla_put_flag(skb, TCA_DSMARK_SET_TC_INDEX))
+                goto nla_put_failure;
 
         return nla_nest_end(skb, opts);
 
diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
index 66effe2da8e0..e15a9eb29087 100644
--- a/net/sched/sch_fifo.c
+++ b/net/sched/sch_fifo.c
@@ -85,7 +85,8 @@ static int fifo_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct tc_fifo_qopt opt = { .limit = sch->limit };
 
-        NLA_PUT(skb, TCA_OPTIONS, sizeof(opt), &opt);
+        if (nla_put(skb, TCA_OPTIONS, sizeof(opt), &opt))
+                goto nla_put_failure;
         return skb->len;
 
 nla_put_failure:
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
new file mode 100644
index 000000000000..9fc1c62ec80e
--- /dev/null
+++ b/net/sched/sch_fq_codel.c
@@ -0,0 +1,626 @@
+/*
+ * Fair Queue CoDel discipline
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ *  Copyright (C) 2012 Eric Dumazet <edumazet@google.com>
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/jiffies.h>
+#include <linux/string.h>
+#include <linux/in.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/skbuff.h>
+#include <linux/jhash.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <net/netlink.h>
+#include <net/pkt_sched.h>
+#include <net/flow_keys.h>
+#include <net/codel.h>
+
+/*      Fair Queue CoDel.
+ *
+ * Principles :
+ * Packets are classified (internal classifier or external) on flows.
+ * This is a Stochastic model (as we use a hash, several flows
+ *                             might be hashed on same slot)
+ * Each flow has a CoDel managed queue.
+ * Flows are linked onto two (Round Robin) lists,
+ * so that new flows have priority on old ones.
+ *
+ * For a given flow, packets are not reordered (CoDel uses a FIFO)
+ * head drops only.
+ * ECN capability is on by default.
+ * Low memory footprint (64 bytes per flow)
+ */
+
+struct fq_codel_flow {
+        struct sk_buff    *head;
+        struct sk_buff    *tail;
+        struct list_head  flowchain;
+        int               deficit;
+        u32               dropped; /* number of drops (or ECN marks) on this flow */
+        struct codel_vars cvars;
+}; /* please try to keep this structure <= 64 bytes */
+
+struct fq_codel_sched_data {
+        struct tcf_proto *filter_list;  /* optional external classifier */
+        struct fq_codel_flow *flows;    /* Flows table [flows_cnt] */
+        u32             *backlogs;      /* backlog table [flows_cnt] */
+        u32             flows_cnt;      /* number of flows */
+        u32             perturbation;   /* hash perturbation */
+        u32             quantum;        /* psched_mtu(qdisc_dev(sch)); */
+        struct codel_params cparams;
+        struct codel_stats cstats;
+        u32             drop_overlimit;
+        u32             new_flow_count;
+
+        struct list_head new_flows;     /* list of new flows */
+        struct list_head old_flows;     /* list of old flows */
+};
+
+static unsigned int fq_codel_hash(const struct fq_codel_sched_data *q,
+                                  const struct sk_buff *skb)
+{
+        struct flow_keys keys;
+        unsigned int hash;
+
+        skb_flow_dissect(skb, &keys);
+        hash = jhash_3words((__force u32)keys.dst,
+                            (__force u32)keys.src ^ keys.ip_proto,
+                            (__force u32)keys.ports, q->perturbation);
+        return ((u64)hash * q->flows_cnt) >> 32;
+}
+
+static unsigned int fq_codel_classify(struct sk_buff *skb, struct Qdisc *sch,
+                                      int *qerr)
+{
+        struct fq_codel_sched_data *q = qdisc_priv(sch);
+        struct tcf_result res;
+        int result;
+
+        if (TC_H_MAJ(skb->priority) == sch->handle &&
+            TC_H_MIN(skb->priority) > 0 &&
+            TC_H_MIN(skb->priority) <= q->flows_cnt)
+                return TC_H_MIN(skb->priority);
+
+        if (!q->filter_list)
+                return fq_codel_hash(q, skb) + 1;
+
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
+        result = tc_classify(skb, q->filter_list, &res);
+        if (result >= 0) {
+#ifdef CONFIG_NET_CLS_ACT
+                switch (result) {
+                case TC_ACT_STOLEN:
+                case TC_ACT_QUEUED:
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
+                case TC_ACT_SHOT:
+                        return 0;
+                }
+#endif
+                if (TC_H_MIN(res.classid) <= q->flows_cnt)
+                        return TC_H_MIN(res.classid);
+        }
+        return 0;
+}
+
+/* helper functions : might be changed when/if skb use a standard list_head */
+
+/* remove one skb from head of slot queue */
+static inline struct sk_buff *dequeue_head(struct fq_codel_flow *flow)
+{
+        struct sk_buff *skb = flow->head;
+
+        flow->head = skb->next;
+        skb->next = NULL;
+        return skb;
+}
+
+/* add skb to flow queue (tail add) */
+static inline void flow_queue_add(struct fq_codel_flow *flow,
+                                  struct sk_buff *skb)
+{
+        if (flow->head == NULL)
+                flow->head = skb;
+        else
+                flow->tail->next = skb;
+        flow->tail = skb;
+        skb->next = NULL;
+}
+
+static unsigned int fq_codel_drop(struct Qdisc *sch)
+{
+        struct fq_codel_sched_data *q = qdisc_priv(sch);
+        struct sk_buff *skb;
+        unsigned int maxbacklog = 0, idx = 0, i, len;
+        struct fq_codel_flow *flow;
+
+        /* Queue is full! Find the fat flow and drop packet from it.
+         * This might sound expensive, but with 1024 flows, we scan
+         * 4KB of memory, and we dont need to handle a complex tree
+         * in fast path (packet queue/enqueue) with many cache misses.
+         */
+        for (i = 0; i < q->flows_cnt; i++) {
+                if (q->backlogs[i] > maxbacklog) {
+                        maxbacklog = q->backlogs[i];
+                        idx = i;
+                }
+        }
+        flow = &q->flows[idx];
+        skb = dequeue_head(flow);
+        len = qdisc_pkt_len(skb);
+        q->backlogs[idx] -= len;
+        kfree_skb(skb);
+        sch->q.qlen--;
+        sch->qstats.drops++;
+        sch->qstats.backlog -= len;
+        flow->dropped++;
+        return idx;
+}
+
+static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+{
+        struct fq_codel_sched_data *q = qdisc_priv(sch);
+        unsigned int idx;
+        struct fq_codel_flow *flow;
+        int uninitialized_var(ret);
+
+        idx = fq_codel_classify(skb, sch, &ret);
+        if (idx == 0) {
+                if (ret & __NET_XMIT_BYPASS)
+                        sch->qstats.drops++;
+                kfree_skb(skb);
+                return ret;
+        }
+        idx--;
+
+        codel_set_enqueue_time(skb);
+        flow = &q->flows[idx];
+        flow_queue_add(flow, skb);
+        q->backlogs[idx] += qdisc_pkt_len(skb);
+        sch->qstats.backlog += qdisc_pkt_len(skb);
+
+        if (list_empty(&flow->flowchain)) {
+                list_add_tail(&flow->flowchain, &q->new_flows);
+                codel_vars_init(&flow->cvars);
+                q->new_flow_count++;
+                flow->deficit = q->quantum;
+                flow->dropped = 0;
+        }
+        if (++sch->q.qlen < sch->limit)
+                return NET_XMIT_SUCCESS;
+
+        q->drop_overlimit++;
+        /* Return Congestion Notification only if we dropped a packet
+         * from this flow.
+         */
+        if (fq_codel_drop(sch) == idx)
+                return NET_XMIT_CN;
+
+        /* As we dropped a packet, better let upper stack know this */
+        qdisc_tree_decrease_qlen(sch, 1);
+        return NET_XMIT_SUCCESS;
+}
+
+/* This is the specific function called from codel_dequeue()
+ * to dequeue a packet from queue. Note: backlog is handled in
+ * codel, we dont need to reduce it here.
+ */
+static struct sk_buff *dequeue(struct codel_vars *vars, struct Qdisc *sch)
+{
+        struct fq_codel_sched_data *q = qdisc_priv(sch);
+        struct fq_codel_flow *flow;
+        struct sk_buff *skb = NULL;
+
+        flow = container_of(vars, struct fq_codel_flow, cvars);
+        if (flow->head) {
+                skb = dequeue_head(flow);
+                q->backlogs[flow - q->flows] -= qdisc_pkt_len(skb);
+                sch->q.qlen--;
+        }
+        return skb;
+}
+
+static struct sk_buff *fq_codel_dequeue(struct Qdisc *sch)
+{
+        struct fq_codel_sched_data *q = qdisc_priv(sch);
+        struct sk_buff *skb;
+        struct fq_codel_flow *flow;
+        struct list_head *head;
+        u32 prev_drop_count, prev_ecn_mark;
+
+begin:
+        head = &q->new_flows;
+        if (list_empty(head)) {
+                head = &q->old_flows;
+                if (list_empty(head))
+                        return NULL;
+        }
+        flow = list_first_entry(head, struct fq_codel_flow, flowchain);
+
+        if (flow->deficit <= 0) {
+                flow->deficit += q->quantum;
+                list_move_tail(&flow->flowchain, &q->old_flows);
+                goto begin;
+        }
+
+        prev_drop_count = q->cstats.drop_count;
+        prev_ecn_mark = q->cstats.ecn_mark;
+
+        skb = codel_dequeue(sch, &q->cparams, &flow->cvars, &q->cstats,
+                            dequeue);
+
+        flow->dropped += q->cstats.drop_count - prev_drop_count;
+        flow->dropped += q->cstats.ecn_mark - prev_ecn_mark;
+
+        if (!skb) {
+                /* force a pass through old_flows to prevent starvation */
+                if ((head == &q->new_flows) && !list_empty(&q->old_flows))
+                        list_move_tail(&flow->flowchain, &q->old_flows);
+                else
+                        list_del_init(&flow->flowchain);
+                goto begin;
+        }
+        qdisc_bstats_update(sch, skb);
+        flow->deficit -= qdisc_pkt_len(skb);
+        /* We cant call qdisc_tree_decrease_qlen() if our qlen is 0,
+         * or HTB crashes. Defer it for next round.
+         */
+        if (q->cstats.drop_count && sch->q.qlen) {
+                qdisc_tree_decrease_qlen(sch, q->cstats.drop_count);
+                q->cstats.drop_count = 0;
+        }
+        return skb;
+}
+
+static void fq_codel_reset(struct Qdisc *sch)
+{
+        struct sk_buff *skb;
+
+        while ((skb = fq_codel_dequeue(sch)) != NULL)
+                kfree_skb(skb);
+}
+
+static const struct nla_policy fq_codel_policy[TCA_FQ_CODEL_MAX + 1] = {
+        [TCA_FQ_CODEL_TARGET]   = { .type = NLA_U32 },
+        [TCA_FQ_CODEL_LIMIT]    = { .type = NLA_U32 },
+        [TCA_FQ_CODEL_INTERVAL] = { .type = NLA_U32 },
+        [TCA_FQ_CODEL_ECN]      = { .type = NLA_U32 },
+        [TCA_FQ_CODEL_FLOWS]    = { .type = NLA_U32 },
+        [TCA_FQ_CODEL_QUANTUM]  = { .type = NLA_U32 },
+};
+
+static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct fq_codel_sched_data *q = qdisc_priv(sch);
+        struct nlattr *tb[TCA_FQ_CODEL_MAX + 1];
+        int err;
+
+        if (!opt)
+                return -EINVAL;
+
+        err = nla_parse_nested(tb, TCA_FQ_CODEL_MAX, opt, fq_codel_policy);
+        if (err < 0)
+                return err;
+        if (tb[TCA_FQ_CODEL_FLOWS]) {
+                if (q->flows)
+                        return -EINVAL;
+                q->flows_cnt = nla_get_u32(tb[TCA_FQ_CODEL_FLOWS]);
+                if (!q->flows_cnt ||
+                    q->flows_cnt > 65536)
+                        return -EINVAL;
+        }
+        sch_tree_lock(sch);
+
+        if (tb[TCA_FQ_CODEL_TARGET]) {
+                u64 target = nla_get_u32(tb[TCA_FQ_CODEL_TARGET]);
+
+                q->cparams.target = (target * NSEC_PER_USEC) >> CODEL_SHIFT;
+        }
+
+        if (tb[TCA_FQ_CODEL_INTERVAL]) {
+                u64 interval = nla_get_u32(tb[TCA_FQ_CODEL_INTERVAL]);
+
+                q->cparams.interval = (interval * NSEC_PER_USEC) >> CODEL_SHIFT;
+        }
+
+        if (tb[TCA_FQ_CODEL_LIMIT])
+                sch->limit = nla_get_u32(tb[TCA_FQ_CODEL_LIMIT]);
+
+        if (tb[TCA_FQ_CODEL_ECN])
+                q->cparams.ecn = !!nla_get_u32(tb[TCA_FQ_CODEL_ECN]);
+
+        if (tb[TCA_FQ_CODEL_QUANTUM])
+                q->quantum = max(256U, nla_get_u32(tb[TCA_FQ_CODEL_QUANTUM]));
+
+        while (sch->q.qlen > sch->limit) {
+                struct sk_buff *skb = fq_codel_dequeue(sch);
+
+                kfree_skb(skb);
+                q->cstats.drop_count++;
+        }
+        qdisc_tree_decrease_qlen(sch, q->cstats.drop_count);
+        q->cstats.drop_count = 0;
+
+        sch_tree_unlock(sch);
+        return 0;
+}
+
+static void *fq_codel_zalloc(size_t sz)
+{
+        void *ptr = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN);
+
+        if (!ptr)
+                ptr = vzalloc(sz);
+        return ptr;
+}
+
+static void fq_codel_free(void *addr)
+{
+        if (addr) {
+                if (is_vmalloc_addr(addr))
+                        vfree(addr);
+                else
+                        kfree(addr);
+        }
+}
+
+static void fq_codel_destroy(struct Qdisc *sch)
+{
+        struct fq_codel_sched_data *q = qdisc_priv(sch);
+
+        tcf_destroy_chain(&q->filter_list);
+        fq_codel_free(q->backlogs);
+        fq_codel_free(q->flows);
+}
+
+static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct fq_codel_sched_data *q = qdisc_priv(sch);
+        int i;
+
+        sch->limit = 10*1024;
+        q->flows_cnt = 1024;
+        q->quantum = psched_mtu(qdisc_dev(sch));
+        q->perturbation = net_random();
+        INIT_LIST_HEAD(&q->new_flows);
+        INIT_LIST_HEAD(&q->old_flows);
+        codel_params_init(&q->cparams);
+        codel_stats_init(&q->cstats);
+        q->cparams.ecn = true;
+
+        if (opt) {
+                int err = fq_codel_change(sch, opt);
+                if (err)
+                        return err;
+        }
+
+        if (!q->flows) {
+                q->flows = fq_codel_zalloc(q->flows_cnt *
+                                           sizeof(struct fq_codel_flow));
+                if (!q->flows)
+                        return -ENOMEM;
+                q->backlogs = fq_codel_zalloc(q->flows_cnt * sizeof(u32));
+                if (!q->backlogs) {
+                        fq_codel_free(q->flows);
+                        return -ENOMEM;
+                }
+                for (i = 0; i < q->flows_cnt; i++) {
+                        struct fq_codel_flow *flow = q->flows + i;
+
+                        INIT_LIST_HEAD(&flow->flowchain);
+                }
+        }
+        if (sch->limit >= 1)
+                sch->flags |= TCQ_F_CAN_BYPASS;
+        else
+                sch->flags &= ~TCQ_F_CAN_BYPASS;
+        return 0;
+}
+
+static int fq_codel_dump(struct Qdisc *sch, struct sk_buff *skb)
+{
+        struct fq_codel_sched_data *q = qdisc_priv(sch);
+        struct nlattr *opts;
+
+        opts = nla_nest_start(skb, TCA_OPTIONS);
+        if (opts == NULL)
+                goto nla_put_failure;
+
+        if (nla_put_u32(skb, TCA_FQ_CODEL_TARGET,
+                        codel_time_to_us(q->cparams.target)) ||
+            nla_put_u32(skb, TCA_FQ_CODEL_LIMIT,
+                        sch->limit) ||
+            nla_put_u32(skb, TCA_FQ_CODEL_INTERVAL,
+                        codel_time_to_us(q->cparams.interval)) ||
+            nla_put_u32(skb, TCA_FQ_CODEL_ECN,
+                        q->cparams.ecn) ||
+            nla_put_u32(skb, TCA_FQ_CODEL_QUANTUM,
+                        q->quantum) ||
+            nla_put_u32(skb, TCA_FQ_CODEL_FLOWS,
+                        q->flows_cnt))
+                goto nla_put_failure;
+
+        nla_nest_end(skb, opts);
+        return skb->len;
+
+nla_put_failure:
+        return -1;
+}
+
+static int fq_codel_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
+{
+        struct fq_codel_sched_data *q = qdisc_priv(sch);
+        struct tc_fq_codel_xstats st = {
+                .type                           = TCA_FQ_CODEL_XSTATS_QDISC,
+        };
+        struct list_head *pos;
+
+        st.qdisc_stats.maxpacket = q->cstats.maxpacket;
+        st.qdisc_stats.drop_overlimit = q->drop_overlimit;
+        st.qdisc_stats.ecn_mark = q->cstats.ecn_mark;
+        st.qdisc_stats.new_flow_count = q->new_flow_count;
+
+        list_for_each(pos, &q->new_flows)
+                st.qdisc_stats.new_flows_len++;
+
+        list_for_each(pos, &q->old_flows)
+                st.qdisc_stats.old_flows_len++;
+
+        return gnet_stats_copy_app(d, &st, sizeof(st));
+}
+
+static struct Qdisc *fq_codel_leaf(struct Qdisc *sch, unsigned long arg)
+{
+        return NULL;
+}
+
+static unsigned long fq_codel_get(struct Qdisc *sch, u32 classid)
+{
+        return 0;
+}
+
+static unsigned long fq_codel_bind(struct Qdisc *sch, unsigned long parent,
+                              u32 classid)
+{
+        /* we cannot bypass queue discipline anymore */
+        sch->flags &= ~TCQ_F_CAN_BYPASS;
+        return 0;
+}
+
+static void fq_codel_put(struct Qdisc *q, unsigned long cl)
+{
+}
+
+static struct tcf_proto **fq_codel_find_tcf(struct Qdisc *sch, unsigned long cl)
+{
+        struct fq_codel_sched_data *q = qdisc_priv(sch);
+
+        if (cl)
+                return NULL;
+        return &q->filter_list;
+}
+
+static int fq_codel_dump_class(struct Qdisc *sch, unsigned long cl,
+                          struct sk_buff *skb, struct tcmsg *tcm)
+{
+        tcm->tcm_handle |= TC_H_MIN(cl);
+        return 0;
+}
+
+static int fq_codel_dump_class_stats(struct Qdisc *sch, unsigned long cl,
+                                     struct gnet_dump *d)
+{
+        struct fq_codel_sched_data *q = qdisc_priv(sch);
+        u32 idx = cl - 1;
+        struct gnet_stats_queue qs = { 0 };
+        struct tc_fq_codel_xstats xstats;
+
+        if (idx < q->flows_cnt) {
+                const struct fq_codel_flow *flow = &q->flows[idx];
+                const struct sk_buff *skb = flow->head;
+
+                memset(&xstats, 0, sizeof(xstats));
+                xstats.type = TCA_FQ_CODEL_XSTATS_CLASS;
+                xstats.class_stats.deficit = flow->deficit;
+                xstats.class_stats.ldelay =
+                        codel_time_to_us(flow->cvars.ldelay);
+                xstats.class_stats.count = flow->cvars.count;
+                xstats.class_stats.lastcount = flow->cvars.lastcount;
+                xstats.class_stats.dropping = flow->cvars.dropping;
+                if (flow->cvars.dropping) {
+                        codel_tdiff_t delta = flow->cvars.drop_next -
+                                              codel_get_time();
+
+                        xstats.class_stats.drop_next = (delta >= 0) ?
+                                codel_time_to_us(delta) :
+                                -codel_time_to_us(-delta);
+                }
+                while (skb) {
+                        qs.qlen++;
+                        skb = skb->next;
+                }
+                qs.backlog = q->backlogs[idx];
+                qs.drops = flow->dropped;
+        }
+        if (gnet_stats_copy_queue(d, &qs) < 0)
+                return -1;
+        if (idx < q->flows_cnt)
+                return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
+        return 0;
+}
+
+static void fq_codel_walk(struct Qdisc *sch, struct qdisc_walker *arg)
+{
+        struct fq_codel_sched_data *q = qdisc_priv(sch);
+        unsigned int i;
+
+        if (arg->stop)
+                return;
+
+        for (i = 0; i < q->flows_cnt; i++) {
+                if (list_empty(&q->flows[i].flowchain) ||
+                    arg->count < arg->skip) {
+                        arg->count++;
+                        continue;
+                }
+                if (arg->fn(sch, i + 1, arg) < 0) {
+                        arg->stop = 1;
+                        break;
+                }
+                arg->count++;
+        }
+}
+
+static const struct Qdisc_class_ops fq_codel_class_ops = {
+        .leaf           =       fq_codel_leaf,
+        .get            =       fq_codel_get,
+        .put            =       fq_codel_put,
+        .tcf_chain      =       fq_codel_find_tcf,
+        .bind_tcf       =       fq_codel_bind,
+        .unbind_tcf     =       fq_codel_put,
+        .dump           =       fq_codel_dump_class,
+        .dump_stats     =       fq_codel_dump_class_stats,
+        .walk           =       fq_codel_walk,
+};
+
+static struct Qdisc_ops fq_codel_qdisc_ops __read_mostly = {
+        .cl_ops         =       &fq_codel_class_ops,
+        .id             =       "fq_codel",
+        .priv_size      =       sizeof(struct fq_codel_sched_data),
+        .enqueue        =       fq_codel_enqueue,
+        .dequeue        =       fq_codel_dequeue,
+        .peek           =       qdisc_peek_dequeued,
+        .drop           =       fq_codel_drop,
+        .init           =       fq_codel_init,
+        .reset          =       fq_codel_reset,
+        .destroy        =       fq_codel_destroy,
+        .change         =       fq_codel_change,
+        .dump           =       fq_codel_dump,
+        .dump_stats =   fq_codel_dump_stats,
+        .owner          =       THIS_MODULE,
+};
+
+static int __init fq_codel_module_init(void)
+{
+        return register_qdisc(&fq_codel_qdisc_ops);
+}
+
+static void __exit fq_codel_module_exit(void)
+{
+        unregister_qdisc(&fq_codel_qdisc_ops);
+}
+
+module_init(fq_codel_module_init)
+module_exit(fq_codel_module_exit)
+MODULE_AUTHOR("Eric Dumazet");
+MODULE_LICENSE("GPL");
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 67fc573e013a..511323e89cec 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -86,9 +86,8 @@ static inline int handle_dev_cpu_collision(struct sk_buff *skb,
                  * deadloop is detected. Return OK to try the next skb.
                  */
                 kfree_skb(skb);
-                if (net_ratelimit())
-                        pr_warning("Dead loop on netdevice %s, fix it urgently!\n",
-                                   dev_queue->dev->name);
+                net_warn_ratelimited("Dead loop on netdevice %s, fix it urgently!\n",
+                                     dev_queue->dev->name);
                 ret = qdisc_qlen(q);
         } else {
                 /*
@@ -136,9 +135,9 @@ int sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,
                 ret = handle_dev_cpu_collision(skb, txq, q);
         } else {
                 /* Driver returned NETDEV_TX_BUSY - requeue skb */
-                if (unlikely (ret != NETDEV_TX_BUSY && net_ratelimit()))
-                        pr_warning("BUG %s code %d qlen %d\n",
-                                   dev->name, ret, q->q.qlen);
+                if (unlikely(ret != NETDEV_TX_BUSY))
+                        net_warn_ratelimited("BUG %s code %d qlen %d\n",
+                                             dev->name, ret, q->q.qlen);
 
                 ret = dev_requeue_skb(skb, q);
         }
@@ -512,7 +511,8 @@ static int pfifo_fast_dump(struct Qdisc *qdisc, struct sk_buff *skb)
         struct tc_prio_qopt opt = { .bands = PFIFO_FAST_BANDS };
 
         memcpy(&opt.priomap, prio2band, TC_PRIO_MAX + 1);
-        NLA_PUT(skb, TCA_OPTIONS, sizeof(opt), &opt);
+        if (nla_put(skb, TCA_OPTIONS, sizeof(opt), &opt))
+                goto nla_put_failure;
         return skb->len;
 
 nla_put_failure:
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index 0b15236be7b6..e901583e4ea5 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -255,10 +255,8 @@ static struct sk_buff *gred_dequeue(struct Qdisc *sch)
                 u16 dp = tc_index_to_dp(skb);
 
                 if (dp >= t->DPs || (q = t->tab[dp]) == NULL) {
-                        if (net_ratelimit())
-                                pr_warning("GRED: Unable to relocate VQ 0x%x "
-                                           "after dequeue, screwing up "
-                                           "backlog.\n", tc_index_to_dp(skb));
+                        net_warn_ratelimited("GRED: Unable to relocate VQ 0x%x after dequeue, screwing up backlog\n",
+                                             tc_index_to_dp(skb));
                 } else {
                         q->backlog -= qdisc_pkt_len(skb);
 
@@ -287,10 +285,8 @@ static unsigned int gred_drop(struct Qdisc *sch)
                 u16 dp = tc_index_to_dp(skb);
 
                 if (dp >= t->DPs || (q = t->tab[dp]) == NULL) {
-                        if (net_ratelimit())
-                                pr_warning("GRED: Unable to relocate VQ 0x%x "
-                                           "while dropping, screwing up "
-                                           "backlog.\n", tc_index_to_dp(skb));
+                        net_warn_ratelimited("GRED: Unable to relocate VQ 0x%x while dropping, screwing up backlog\n",
+                                             tc_index_to_dp(skb));
                 } else {
                         q->backlog -= len;
                         q->stats.other++;
@@ -521,14 +517,16 @@ static int gred_dump(struct Qdisc *sch, struct sk_buff *skb)
         opts = nla_nest_start(skb, TCA_OPTIONS);
         if (opts == NULL)
                 goto nla_put_failure;
-        NLA_PUT(skb, TCA_GRED_DPS, sizeof(sopt), &sopt);
+        if (nla_put(skb, TCA_GRED_DPS, sizeof(sopt), &sopt))
+                goto nla_put_failure;
 
         for (i = 0; i < MAX_DPs; i++) {
                 struct gred_sched_data *q = table->tab[i];
 
                 max_p[i] = q ? q->parms.max_P : 0;
         }
-        NLA_PUT(skb, TCA_GRED_MAX_P, sizeof(max_p), max_p);
+        if (nla_put(skb, TCA_GRED_MAX_P, sizeof(max_p), max_p))
+                goto nla_put_failure;
 
         parms = nla_nest_start(skb, TCA_GRED_PARMS);
         if (parms == NULL)
@@ -565,11 +563,8 @@ static int gred_dump(struct Qdisc *sch, struct sk_buff *skb)
                 opt.packets     = q->packetsin;
                 opt.bytesin     = q->bytesin;
 
-                if (gred_wred_mode(table)) {
-                        q->vars.qidlestart =
-                                table->tab[table->def]->vars.qidlestart;
-                        q->vars.qavg = table->tab[table->def]->vars.qavg;
-                }
+                if (gred_wred_mode(table))
+                        gred_load_wred_set(table, q);
 
                 opt.qave = red_calc_qavg(&q->parms, &q->vars, q->vars.qavg);
 
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 9bdca2e011e9..6c2ec4510540 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1305,7 +1305,8 @@ hfsc_dump_sc(struct sk_buff *skb, int attr, struct internal_sc *sc)
         tsc.m1 = sm2m(sc->sm1);
         tsc.d  = dx2d(sc->dx);
         tsc.m2 = sm2m(sc->sm2);
-        NLA_PUT(skb, attr, sizeof(tsc), &tsc);
+        if (nla_put(skb, attr, sizeof(tsc), &tsc))
+                goto nla_put_failure;
 
         return skb->len;
 
@@ -1573,7 +1574,8 @@ hfsc_dump_qdisc(struct Qdisc *sch, struct sk_buff *skb)
         }
 
         qopt.defcls = q->defcls;
-        NLA_PUT(skb, TCA_OPTIONS, sizeof(qopt), &qopt);
+        if (nla_put(skb, TCA_OPTIONS, sizeof(qopt), &qopt))
+                goto nla_put_failure;
         return skb->len;
 
  nla_put_failure:
@@ -1607,7 +1609,6 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         if (cl->qdisc->q.qlen == 1)
                 set_active(cl, qdisc_pkt_len(skb));
 
-        bstats_update(&cl->bstats, skb);
         sch->q.qlen++;
 
         return NET_XMIT_SUCCESS;
@@ -1655,6 +1656,7 @@ hfsc_dequeue(struct Qdisc *sch)
                 return NULL;
         }
 
+        bstats_update(&cl->bstats, skb);
         update_vf(cl, qdisc_pkt_len(skb), cur_time);
         if (realtime)
                 cl->cl_cumul += qdisc_pkt_len(skb);
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 29b942ce9e82..9d75b7761313 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -558,9 +558,7 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                         __skb_queue_tail(&q->direct_queue, skb);
                         q->direct_pkts++;
                 } else {
-                        kfree_skb(skb);
-                        sch->qstats.drops++;
-                        return NET_XMIT_DROP;
+                        return qdisc_drop(skb, sch);
                 }
 #ifdef CONFIG_NET_CLS_ACT
         } else if (!cl) {
@@ -576,7 +574,6 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 }
                 return ret;
         } else {
-                bstats_update(&cl->bstats, skb);
                 htb_activate(q, cl);
         }
 
@@ -837,6 +834,7 @@ next:
         } while (cl != start);
 
         if (likely(skb != NULL)) {
+                bstats_update(&cl->bstats, skb);
                 cl->un.leaf.deficit[level] -= qdisc_pkt_len(skb);
                 if (cl->un.leaf.deficit[level] < 0) {
                         cl->un.leaf.deficit[level] += cl->quantum;
@@ -1051,7 +1049,8 @@ static int htb_dump(struct Qdisc *sch, struct sk_buff *skb)
         nest = nla_nest_start(skb, TCA_OPTIONS);
         if (nest == NULL)
                 goto nla_put_failure;
-        NLA_PUT(skb, TCA_HTB_INIT, sizeof(gopt), &gopt);
+        if (nla_put(skb, TCA_HTB_INIT, sizeof(gopt), &gopt))
+                goto nla_put_failure;
         nla_nest_end(skb, nest);
 
         spin_unlock_bh(root_lock);
@@ -1090,7 +1089,8 @@ static int htb_dump_class(struct Qdisc *sch, unsigned long arg,
         opt.quantum = cl->quantum;
         opt.prio = cl->prio;
         opt.level = cl->level;
-        NLA_PUT(skb, TCA_HTB_PARMS, sizeof(opt), &opt);
+        if (nla_put(skb, TCA_HTB_PARMS, sizeof(opt), &opt))
+                goto nla_put_failure;
 
         nla_nest_end(skb, nest);
         spin_unlock_bh(root_lock);
diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index 28de43092330..d1831ca966d4 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -247,7 +247,8 @@ static int mqprio_dump(struct Qdisc *sch, struct sk_buff *skb)
                 opt.offset[i] = dev->tc_to_txq[i].offset;
         }
 
-        NLA_PUT(skb, TCA_OPTIONS, sizeof(opt), &opt);
+        if (nla_put(skb, TCA_OPTIONS, sizeof(opt), &opt))
+                goto nla_put_failure;
 
         return skb->len;
 nla_put_failure:
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
index 49131d7a7446..2a2b096d9a66 100644
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -284,7 +284,8 @@ static int multiq_dump(struct Qdisc *sch, struct sk_buff *skb)
         opt.bands = q->bands;
         opt.max_bands = q->max_bands;
 
-        NLA_PUT(skb, TCA_OPTIONS, sizeof(opt), &opt);
+        if (nla_put(skb, TCA_OPTIONS, sizeof(opt), &opt))
+                goto nla_put_failure;
 
         return skb->len;
 
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 5da548fa7ae9..a2a95aabf9c2 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -26,6 +26,7 @@
 
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
+#include <net/inet_ecn.h>
 
 #define VERSION "1.3"
 
@@ -78,6 +79,7 @@ struct netem_sched_data {
         psched_tdiff_t jitter;
 
         u32 loss;
+        u32 ecn;
         u32 limit;
         u32 counter;
         u32 gap;
@@ -374,9 +376,12 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 ++count;
 
         /* Drop packet? */
-        if (loss_event(q))
-                --count;
-
+        if (loss_event(q)) {
+                if (q->ecn && INET_ECN_set_ce(skb))
+                        sch->qstats.drops++; /* mark packet */
+                else
+                        --count;
+        }
         if (count == 0) {
                 sch->qstats.drops++;
                 kfree_skb(skb);
@@ -408,10 +413,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) {
                 if (!(skb = skb_unshare(skb, GFP_ATOMIC)) ||
                     (skb->ip_summed == CHECKSUM_PARTIAL &&
-                     skb_checksum_help(skb))) {
-                        sch->qstats.drops++;
-                        return NET_XMIT_DROP;
-                }
+                     skb_checksum_help(skb)))
+                        return qdisc_drop(skb, sch);
 
                 skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() % 8);
         }
@@ -706,6 +709,7 @@ static const struct nla_policy netem_policy[TCA_NETEM_MAX + 1] = {
         [TCA_NETEM_CORRUPT]     = { .len = sizeof(struct tc_netem_corrupt) },
         [TCA_NETEM_RATE]        = { .len = sizeof(struct tc_netem_rate) },
         [TCA_NETEM_LOSS]        = { .type = NLA_NESTED },
+        [TCA_NETEM_ECN]         = { .type = NLA_U32 },
 };
 
 static int parse_attr(struct nlattr *tb[], int maxtype, struct nlattr *nla,
@@ -776,6 +780,9 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt)
         if (tb[TCA_NETEM_RATE])
                 get_rate(sch, tb[TCA_NETEM_RATE]);
 
+        if (tb[TCA_NETEM_ECN])
+                q->ecn = nla_get_u32(tb[TCA_NETEM_ECN]);
+
         q->loss_model = CLG_RANDOM;
         if (tb[TCA_NETEM_LOSS])
                 ret = get_loss_clg(sch, tb[TCA_NETEM_LOSS]);
@@ -834,7 +841,8 @@ static int dump_loss_model(const struct netem_sched_data *q,
                         .p23 = q->clg.a5,
                 };
 
-                NLA_PUT(skb, NETEM_LOSS_GI, sizeof(gi), &gi);
+                if (nla_put(skb, NETEM_LOSS_GI, sizeof(gi), &gi))
+                        goto nla_put_failure;
                 break;
         }
         case CLG_GILB_ELL: {
@@ -845,7 +853,8 @@ static int dump_loss_model(const struct netem_sched_data *q,
                         .k1 = q->clg.a4,
                 };
 
-                NLA_PUT(skb, NETEM_LOSS_GE, sizeof(ge), &ge);
+                if (nla_put(skb, NETEM_LOSS_GE, sizeof(ge), &ge))
+                        goto nla_put_failure;
                 break;
         }
         }
@@ -874,26 +883,34 @@ static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)
         qopt.loss = q->loss;
         qopt.gap = q->gap;
         qopt.duplicate = q->duplicate;
-        NLA_PUT(skb, TCA_OPTIONS, sizeof(qopt), &qopt);
+        if (nla_put(skb, TCA_OPTIONS, sizeof(qopt), &qopt))
+                goto nla_put_failure;
 
         cor.delay_corr = q->delay_cor.rho;
         cor.loss_corr = q->loss_cor.rho;
         cor.dup_corr = q->dup_cor.rho;
-        NLA_PUT(skb, TCA_NETEM_CORR, sizeof(cor), &cor);
+        if (nla_put(skb, TCA_NETEM_CORR, sizeof(cor), &cor))
+                goto nla_put_failure;
 
         reorder.probability = q->reorder;
         reorder.correlation = q->reorder_cor.rho;
-        NLA_PUT(skb, TCA_NETEM_REORDER, sizeof(reorder), &reorder);
+        if (nla_put(skb, TCA_NETEM_REORDER, sizeof(reorder), &reorder))
+                goto nla_put_failure;
 
         corrupt.probability = q->corrupt;
         corrupt.correlation = q->corrupt_cor.rho;
-        NLA_PUT(skb, TCA_NETEM_CORRUPT, sizeof(corrupt), &corrupt);
+        if (nla_put(skb, TCA_NETEM_CORRUPT, sizeof(corrupt), &corrupt))
+                goto nla_put_failure;
 
         rate.rate = q->rate;
         rate.packet_overhead = q->packet_overhead;
         rate.cell_size = q->cell_size;
         rate.cell_overhead = q->cell_overhead;
-        NLA_PUT(skb, TCA_NETEM_RATE, sizeof(rate), &rate);
+        if (nla_put(skb, TCA_NETEM_RATE, sizeof(rate), &rate))
+                goto nla_put_failure;
+
+        if (q->ecn && nla_put_u32(skb, TCA_NETEM_ECN, q->ecn))
+                goto nla_put_failure;
 
         if (dump_loss_model(q, skb) != 0)
                 goto nla_put_failure;
diff --git a/net/sched/sch_plug.c b/net/sched/sch_plug.c
new file mode 100644
index 000000000000..89f8fcf73f18
--- /dev/null
+++ b/net/sched/sch_plug.c
@@ -0,0 +1,233 @@
+/*
+ * sch_plug.c Queue traffic until an explicit release command
+ *
+ *             This program is free software; you can redistribute it and/or
+ *             modify it under the terms of the GNU General Public License
+ *             as published by the Free Software Foundation; either version
+ *             2 of the License, or (at your option) any later version.
+ *
+ * There are two ways to use this qdisc:
+ * 1. A simple "instantaneous" plug/unplug operation, by issuing an alternating
+ *    sequence of TCQ_PLUG_BUFFER & TCQ_PLUG_RELEASE_INDEFINITE commands.
+ *
+ * 2. For network output buffering (a.k.a output commit) functionality.
+ *    Output commit property is commonly used by applications using checkpoint
+ *    based fault-tolerance to ensure that the checkpoint from which a system
+ *    is being restored is consistent w.r.t outside world.
+ *
+ *    Consider for e.g. Remus - a Virtual Machine checkpointing system,
+ *    wherein a VM is checkpointed, say every 50ms. The checkpoint is replicated
+ *    asynchronously to the backup host, while the VM continues executing the
+ *    next epoch speculatively.
+ *
+ *    The following is a typical sequence of output buffer operations:
+ *       1.At epoch i, start_buffer(i)
+ *       2. At end of epoch i (i.e. after 50ms):
+ *          2.1 Stop VM and take checkpoint(i).
+ *          2.2 start_buffer(i+1) and Resume VM
+ *       3. While speculatively executing epoch(i+1), asynchronously replicate
+ *          checkpoint(i) to backup host.
+ *       4. When checkpoint_ack(i) is received from backup, release_buffer(i)
+ *    Thus, this Qdisc would receive the following sequence of commands:
+ *       TCQ_PLUG_BUFFER (epoch i)
+ *       .. TCQ_PLUG_BUFFER (epoch i+1)
+ *       ....TCQ_PLUG_RELEASE_ONE (epoch i)
+ *       ......TCQ_PLUG_BUFFER (epoch i+2)
+ *       ........
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <net/pkt_sched.h>
+
+/*
+ * State of the queue, when used for network output buffering:
+ *
+ *                 plug(i+1)            plug(i)          head
+ * ------------------+--------------------+---------------->
+ *                   |                    |
+ *                   |                    |
+ * pkts_current_epoch| pkts_last_epoch    |pkts_to_release
+ * ----------------->|<--------+--------->|+--------------->
+ *                   v                    v
+ *
+ */
+
+struct plug_sched_data {
+        /* If true, the dequeue function releases all packets
+         * from head to end of the queue. The queue turns into
+         * a pass-through queue for newly arriving packets.
+         */
+        bool unplug_indefinite;
+
+        /* Queue Limit in bytes */
+        u32 limit;
+
+        /* Number of packets (output) from the current speculatively
+         * executing epoch.
+         */
+        u32 pkts_current_epoch;
+
+        /* Number of packets corresponding to the recently finished
+         * epoch. These will be released when we receive a
+         * TCQ_PLUG_RELEASE_ONE command. This command is typically
+         * issued after committing a checkpoint at the target.
+         */
+        u32 pkts_last_epoch;
+
+        /*
+         * Number of packets from the head of the queue, that can
+         * be released (committed checkpoint).
+         */
+        u32 pkts_to_release;
+};
+
+static int plug_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+{
+        struct plug_sched_data *q = qdisc_priv(sch);
+
+        if (likely(sch->qstats.backlog + skb->len <= q->limit)) {
+                if (!q->unplug_indefinite)
+                        q->pkts_current_epoch++;
+                return qdisc_enqueue_tail(skb, sch);
+        }
+
+        return qdisc_reshape_fail(skb, sch);
+}
+
+static struct sk_buff *plug_dequeue(struct Qdisc *sch)
+{
+        struct plug_sched_data *q = qdisc_priv(sch);
+
+        if (qdisc_is_throttled(sch))
+                return NULL;
+
+        if (!q->unplug_indefinite) {
+                if (!q->pkts_to_release) {
+                        /* No more packets to dequeue. Block the queue
+                         * and wait for the next release command.
+                         */
+                        qdisc_throttled(sch);
+                        return NULL;
+                }
+                q->pkts_to_release--;
+        }
+
+        return qdisc_dequeue_head(sch);
+}
+
+static int plug_init(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct plug_sched_data *q = qdisc_priv(sch);
+
+        q->pkts_current_epoch = 0;
+        q->pkts_last_epoch = 0;
+        q->pkts_to_release = 0;
+        q->unplug_indefinite = false;
+
+        if (opt == NULL) {
+                /* We will set a default limit of 100 pkts (~150kB)
+                 * in case tx_queue_len is not available. The
+                 * default value is completely arbitrary.
+                 */
+                u32 pkt_limit = qdisc_dev(sch)->tx_queue_len ? : 100;
+                q->limit = pkt_limit * psched_mtu(qdisc_dev(sch));
+        } else {
+                struct tc_plug_qopt *ctl = nla_data(opt);
+
+                if (nla_len(opt) < sizeof(*ctl))
+                        return -EINVAL;
+
+                q->limit = ctl->limit;
+        }
+
+        qdisc_throttled(sch);
+        return 0;
+}
+
+/* Receives 4 types of messages:
+ * TCQ_PLUG_BUFFER: Inset a plug into the queue and
+ *  buffer any incoming packets
+ * TCQ_PLUG_RELEASE_ONE: Dequeue packets from queue head
+ *   to beginning of the next plug.
+ * TCQ_PLUG_RELEASE_INDEFINITE: Dequeue all packets from queue.
+ *   Stop buffering packets until the next TCQ_PLUG_BUFFER
+ *   command is received (just act as a pass-thru queue).
+ * TCQ_PLUG_LIMIT: Increase/decrease queue size
+ */
+static int plug_change(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct plug_sched_data *q = qdisc_priv(sch);
+        struct tc_plug_qopt *msg;
+
+        if (opt == NULL)
+                return -EINVAL;
+
+        msg = nla_data(opt);
+        if (nla_len(opt) < sizeof(*msg))
+                return -EINVAL;
+
+        switch (msg->action) {
+        case TCQ_PLUG_BUFFER:
+                /* Save size of the current buffer */
+                q->pkts_last_epoch = q->pkts_current_epoch;
+                q->pkts_current_epoch = 0;
+                if (q->unplug_indefinite)
+                        qdisc_throttled(sch);
+                q->unplug_indefinite = false;
+                break;
+        case TCQ_PLUG_RELEASE_ONE:
+                /* Add packets from the last complete buffer to the
+                 * packets to be released set.
+                 */
+                q->pkts_to_release += q->pkts_last_epoch;
+                q->pkts_last_epoch = 0;
+                qdisc_unthrottled(sch);
+                netif_schedule_queue(sch->dev_queue);
+                break;
+        case TCQ_PLUG_RELEASE_INDEFINITE:
+                q->unplug_indefinite = true;
+                q->pkts_to_release = 0;
+                q->pkts_last_epoch = 0;
+                q->pkts_current_epoch = 0;
+                qdisc_unthrottled(sch);
+                netif_schedule_queue(sch->dev_queue);
+                break;
+        case TCQ_PLUG_LIMIT:
+                /* Limit is supplied in bytes */
+                q->limit = msg->limit;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static struct Qdisc_ops plug_qdisc_ops __read_mostly = {
+        .id          =       "plug",
+        .priv_size   =       sizeof(struct plug_sched_data),
+        .enqueue     =       plug_enqueue,
+        .dequeue     =       plug_dequeue,
+        .peek        =       qdisc_peek_head,
+        .init        =       plug_init,
+        .change      =       plug_change,
+        .owner       =       THIS_MODULE,
+};
+
+static int __init plug_module_init(void)
+{
+        return register_qdisc(&plug_qdisc_ops);
+}
+
+static void __exit plug_module_exit(void)
+{
+        unregister_qdisc(&plug_qdisc_ops);
+}
+module_init(plug_module_init)
+module_exit(plug_module_exit)
+MODULE_LICENSE("GPL");
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index b5d56a22b1d2..79359b69ad8d 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -247,7 +247,8 @@ static int prio_dump(struct Qdisc *sch, struct sk_buff *skb)
         opt.bands = q->bands;
         memcpy(&opt.priomap, q->prio2band, TC_PRIO_MAX + 1);
 
-        NLA_PUT(skb, TCA_OPTIONS, sizeof(opt), &opt);
+        if (nla_put(skb, TCA_OPTIONS, sizeof(opt), &opt))
+                goto nla_put_failure;
 
         return skb->len;
 
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index e68cb440756a..9af01f3df18c 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -429,8 +429,9 @@ static int qfq_dump_class(struct Qdisc *sch, unsigned long arg,
         nest = nla_nest_start(skb, TCA_OPTIONS);
         if (nest == NULL)
                 goto nla_put_failure;
-        NLA_PUT_U32(skb, TCA_QFQ_WEIGHT, ONE_FP/cl->inv_w);
-        NLA_PUT_U32(skb, TCA_QFQ_LMAX, cl->lmax);
+        if (nla_put_u32(skb, TCA_QFQ_WEIGHT, ONE_FP/cl->inv_w) ||
+            nla_put_u32(skb, TCA_QFQ_LMAX, cl->lmax))
+                goto nla_put_failure;
         return nla_nest_end(skb, nest);
 
 nla_put_failure:
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index a5cc3012cf42..633e32defdcc 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -272,8 +272,9 @@ static int red_dump(struct Qdisc *sch, struct sk_buff *skb)
         opts = nla_nest_start(skb, TCA_OPTIONS);
         if (opts == NULL)
                 goto nla_put_failure;
-        NLA_PUT(skb, TCA_RED_PARMS, sizeof(opt), &opt);
-        NLA_PUT_U32(skb, TCA_RED_MAX_P, q->parms.max_P);
+        if (nla_put(skb, TCA_RED_PARMS, sizeof(opt), &opt) ||
+            nla_put_u32(skb, TCA_RED_MAX_P, q->parms.max_P))
+                goto nla_put_failure;
         return nla_nest_end(skb, opts);
 
 nla_put_failure:
diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
index d7eea99333e9..74305c883bd3 100644
--- a/net/sched/sch_sfb.c
+++ b/net/sched/sch_sfb.c
@@ -570,7 +570,8 @@ static int sfb_dump(struct Qdisc *sch, struct sk_buff *skb)
 
         sch->qstats.backlog = q->qdisc->qstats.backlog;
         opts = nla_nest_start(skb, TCA_OPTIONS);
-        NLA_PUT(skb, TCA_SFB_PARMS, sizeof(opt), &opt);
+        if (nla_put(skb, TCA_SFB_PARMS, sizeof(opt), &opt))
+                goto nla_put_failure;
         return nla_nest_end(skb, opts);
 
 nla_put_failure:
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 02a21abea65e..d3a1bc26dbfc 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -812,7 +812,8 @@ static int sfq_dump(struct Qdisc *sch, struct sk_buff *skb)
         memcpy(&opt.stats, &q->stats, sizeof(opt.stats));
         opt.flags       = q->flags;
 
-        NLA_PUT(skb, TCA_OPTIONS, sizeof(opt), &opt);
+        if (nla_put(skb, TCA_OPTIONS, sizeof(opt), &opt))
+                goto nla_put_failure;
 
         return skb->len;
 
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index b8e156319d7b..4b056c15e90c 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -359,7 +359,8 @@ static int tbf_dump(struct Qdisc *sch, struct sk_buff *skb)
                 memset(&opt.peakrate, 0, sizeof(opt.peakrate));
         opt.mtu = q->mtu;
         opt.buffer = q->buffer;
-        NLA_PUT(skb, TCA_TBF_PARMS, sizeof(opt), &opt);
+        if (nla_put(skb, TCA_TBF_PARMS, sizeof(opt), &opt))
+                goto nla_put_failure;
 
         nla_nest_end(skb, nest);
         return skb->len;
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 45326599fda3..ca0c29695d51 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -88,9 +88,7 @@ teql_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 return NET_XMIT_SUCCESS;
         }
 
-        kfree_skb(skb);
-        sch->qstats.drops++;
-        return NET_XMIT_DROP;
+        return qdisc_drop(skb, sch);
 }
 
 static struct sk_buff *
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index acd2edbc073e..5bc9ab161b37 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1408,7 +1408,7 @@ static inline int sctp_peer_needs_update(struct sctp_association *asoc)
 }
 
 /* Increase asoc's rwnd by len and send any window update SACK if needed. */
-void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned len)
+void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned int len)
 {
         struct sctp_chunk *sack;
         struct timer_list *timer;
@@ -1465,7 +1465,7 @@ void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned len)
 }
 
 /* Decrease asoc's rwnd by len. */
-void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned len)
+void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned int len)
 {
         int rx_count;
         int over = 0;
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 80f71af71384..80564fe03024 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -342,7 +342,7 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
                 sctp_bh_lock_sock(sk);
 
                 if (sock_owned_by_user(sk)) {
-                        if (sk_add_backlog(sk, skb))
+                        if (sk_add_backlog(sk, skb, sk->sk_rcvbuf))
                                 sctp_chunk_free(chunk);
                         else
                                 backloged = 1;
@@ -376,7 +376,7 @@ static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
         struct sctp_ep_common *rcvr = chunk->rcvr;
         int ret;
 
-        ret = sk_add_backlog(sk, skb);
+        ret = sk_add_backlog(sk, skb, sk->sk_rcvbuf);
         if (!ret) {
                 /* Hold the assoc/ep while hanging on the backlog queue.
                  * This way, we know structures we need will not disappear
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 817174eb5f41..f1b7d4bb591e 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -377,9 +377,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
          */
         skb_set_owner_w(nskb, sk);
 
-        /* The 'obsolete' field of dst is set to 2 when a dst is freed. */
-        if (!dst || (dst->obsolete > 1)) {
-                dst_release(dst);
+        if (!sctp_transport_dst_check(tp)) {
                 sctp_transport_route(tp, NULL, sctp_sk(sk));
                 if (asoc && (asoc->param_flags & SPP_PMTUD_ENABLE)) {
                         sctp_assoc_sync_pmtu(asoc);
@@ -663,8 +661,8 @@ static sctp_xmit_t sctp_packet_can_append_data(struct sctp_packet *packet,
          */
         if (!sctp_sk(asoc->base.sk)->nodelay && sctp_packet_empty(packet) &&
             inflight && sctp_state(asoc, ESTABLISHED)) {
-                unsigned max = transport->pathmtu - packet->overhead;
-                unsigned len = chunk->skb->len + q->out_qlen;
+                unsigned int max = transport->pathmtu - packet->overhead;
+                unsigned int len = chunk->skb->len + q->out_qlen;
 
                 /* Check whether this chunk and all the rest of pending
                  * data will fit or delay in hopes of bundling a full
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index cfeb1d4a1ee6..a0fa19f5650c 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -1147,7 +1147,7 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_sackhdr *sack)
         __u32 sack_ctsn, ctsn, tsn;
         __u32 highest_tsn, highest_new_tsn;
         __u32 sack_a_rwnd;
-        unsigned outstanding;
+        unsigned int outstanding;
         struct sctp_transport *primary = asoc->peer.primary_path;
         int count_of_newacks = 0;
         int gap_ack_blocks;
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 1ff51c9d18d5..c96d1a81cf42 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -524,7 +524,7 @@ static void sctp_do_8_2_transport_strike(struct sctp_association *asoc,
 /* Worker routine to handle INIT command failure.  */
 static void sctp_cmd_init_failed(sctp_cmd_seq_t *commands,
                                  struct sctp_association *asoc,
-                                 unsigned error)
+                                 unsigned int error)
 {
         struct sctp_ulpevent *event;
 
@@ -550,7 +550,7 @@ static void sctp_cmd_assoc_failed(sctp_cmd_seq_t *commands,
                                   sctp_event_t event_type,
                                   sctp_subtype_t subtype,
                                   struct sctp_chunk *chunk,
-                                  unsigned error)
+                                  unsigned int error)
 {
         struct sctp_ulpevent *event;
 
@@ -1161,9 +1161,8 @@ static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype,
                 break;
 
         case SCTP_DISPOSITION_VIOLATION:
-                if (net_ratelimit())
-                        pr_err("protocol violation state %d chunkid %d\n",
-                               state, subtype.chunk);
+                net_err_ratelimited("protocol violation state %d chunkid %d\n",
+                                    state, subtype.chunk);
                 break;
 
         case SCTP_DISPOSITION_NOT_IMPL:
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 891f5db8cc31..9fca10357350 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -1129,17 +1129,15 @@ sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
         /* This should never happen, but lets log it if so.  */
         if (unlikely(!link)) {
                 if (from_addr.sa.sa_family == AF_INET6) {
-                        if (net_ratelimit())
-                                pr_warn("%s association %p could not find address %pI6\n",
-                                        __func__,
-                                        asoc,
-                                        &from_addr.v6.sin6_addr);
+                        net_warn_ratelimited("%s association %p could not find address %pI6\n",
+                                             __func__,
+                                             asoc,
+                                             &from_addr.v6.sin6_addr);
                 } else {
-                        if (net_ratelimit())
-                                pr_warn("%s association %p could not find address %pI4\n",
-                                        __func__,
-                                        asoc,
-                                        &from_addr.v4.sin_addr.s_addr);
+                        net_warn_ratelimited("%s association %p could not find address %pI4\n",
+                                             __func__,
+                                             asoc,
+                                             &from_addr.v4.sin_addr.s_addr);
                 }
                 return SCTP_DISPOSITION_DISCARD;
         }
@@ -2410,7 +2408,7 @@ static sctp_disposition_t __sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
                                         sctp_cmd_seq_t *commands)
 {
         struct sctp_chunk *chunk = arg;
-        unsigned len;
+        unsigned int len;
         __be16 error = SCTP_ERROR_NO_ERROR;
 
         /* See if we have an error cause code in the chunk.  */
@@ -2446,7 +2444,7 @@ sctp_disposition_t sctp_sf_cookie_wait_abort(const struct sctp_endpoint *ep,
                                      sctp_cmd_seq_t *commands)
 {
         struct sctp_chunk *chunk = arg;
-        unsigned len;
+        unsigned int len;
         __be16 error = SCTP_ERROR_NO_ERROR;
 
         if (!sctp_vtag_verify_either(chunk, asoc))
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 408ebd0e7330..b3b8a8d813eb 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4133,9 +4133,10 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
 static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
                                   int __user *optlen)
 {
-        if (len < sizeof(struct sctp_event_subscribe))
+        if (len <= 0)
                 return -EINVAL;
-        len = sizeof(struct sctp_event_subscribe);
+        if (len > sizeof(struct sctp_event_subscribe))
+                len = sizeof(struct sctp_event_subscribe);
         if (put_user(len, optlen))
                 return -EFAULT;
         if (copy_to_user(optval, &sctp_sk(sk)->subscribe, len))
@@ -4170,14 +4171,16 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
 }
 
 /* Helper routine to branch off an association to a new socket.  */
-SCTP_STATIC int sctp_do_peeloff(struct sctp_association *asoc,
-                                struct socket **sockp)
+int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp)
 {
-        struct sock *sk = asoc->base.sk;
+        struct sctp_association *asoc = sctp_id2assoc(sk, id);
         struct socket *sock;
         struct sctp_af *af;
         int err = 0;
 
+        if (!asoc)
+                return -EINVAL;
+
         /* An association cannot be branched off from an already peeled-off
          * socket, nor is this supported for tcp style sockets.
          */
@@ -4206,13 +4209,13 @@ SCTP_STATIC int sctp_do_peeloff(struct sctp_association *asoc,
 
         return err;
 }
+EXPORT_SYMBOL(sctp_do_peeloff);
 
 static int sctp_getsockopt_peeloff(struct sock *sk, int len, char __user *optval, int __user *optlen)
 {
         sctp_peeloff_arg_t peeloff;
         struct socket *newsock;
         int retval = 0;
-        struct sctp_association *asoc;
 
         if (len < sizeof(sctp_peeloff_arg_t))
                 return -EINVAL;
@@ -4220,15 +4223,7 @@ static int sctp_getsockopt_peeloff(struct sock *sk, int len, char __user *optval
         if (copy_from_user(&peeloff, optval, len))
                 return -EFAULT;
 
-        asoc = sctp_id2assoc(sk, peeloff.associd);
-        if (!asoc) {
-                retval = -EINVAL;
-                goto out;
-        }
-
-        SCTP_DEBUG_PRINTK("%s: sk: %p asoc: %p\n", __func__, sk, asoc);
-
-        retval = sctp_do_peeloff(asoc, &newsock);
+        retval = sctp_do_peeloff(sk, peeloff.associd, &newsock);
         if (retval < 0)
                 goto out;
 
@@ -4239,8 +4234,8 @@ static int sctp_getsockopt_peeloff(struct sock *sk, int len, char __user *optval
                 goto out;
         }
 
-        SCTP_DEBUG_PRINTK("%s: sk: %p asoc: %p newsk: %p sd: %d\n",
-                          __func__, sk, asoc, newsock->sk, retval);
+        SCTP_DEBUG_PRINTK("%s: sk: %p newsk: %p sd: %d\n",
+                          __func__, sk, newsock->sk, retval);
 
         /* Return the fd mapped to the new socket.  */
         peeloff.sd = retval;
@@ -5845,10 +5840,8 @@ SCTP_STATIC int sctp_listen_start(struct sock *sk, int backlog)
         if (!sctp_sk(sk)->hmac && sctp_hmac_alg) {
                 tfm = crypto_alloc_hash(sctp_hmac_alg, 0, CRYPTO_ALG_ASYNC);
                 if (IS_ERR(tfm)) {
-                        if (net_ratelimit()) {
-                                pr_info("failed to load transform for %s: %ld\n",
-                                        sctp_hmac_alg, PTR_ERR(tfm));
-                        }
+                        net_info_ratelimited("failed to load transform for %s: %ld\n",
+                                             sctp_hmac_alg, PTR_ERR(tfm));
                         return -ENOSYS;
                 }
                 sctp_sk(sk)->hmac = tfm;
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 60ffbd067ff7..e5fe639c89e7 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -275,22 +275,16 @@ static ctl_table sctp_table[] = {
         { /* sentinel */ }
 };
 
-static struct ctl_path sctp_path[] = {
-        { .procname = "net", },
-        { .procname = "sctp", },
-        { }
-};
-
 static struct ctl_table_header * sctp_sysctl_header;
 
 /* Sysctl registration.  */
 void sctp_sysctl_register(void)
 {
-        sctp_sysctl_header = register_sysctl_paths(sctp_path, sctp_table);
+        sctp_sysctl_header = register_net_sysctl(&init_net, "net/sctp", sctp_table);
 }
 
 /* Sysctl deregistration.  */
 void sctp_sysctl_unregister(void)
 {
-        unregister_sysctl_table(sctp_sysctl_header);
+        unregister_net_sysctl_table(sctp_sysctl_header);
 }
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 3889330b7b04..b026ba0c6992 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -226,23 +226,6 @@ void sctp_transport_pmtu(struct sctp_transport *transport, struct sock *sk)
                 transport->pathmtu = SCTP_DEFAULT_MAXSEGMENT;
 }
 
-/* this is a complete rip-off from __sk_dst_check
- * the cookie is always 0 since this is how it's used in the
- * pmtu code
- */
-static struct dst_entry *sctp_transport_dst_check(struct sctp_transport *t)
-{
-        struct dst_entry *dst = t->dst;
-
-        if (dst && dst->obsolete && dst->ops->check(dst, 0) == NULL) {
-                dst_release(t->dst);
-                t->dst = NULL;
-                return NULL;
-        }
-
-        return dst;
-}
-
 void sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu)
 {
         struct dst_entry *dst;
diff --git a/net/socket.c b/net/socket.c
index 28a96af484b4..6e0ccc09b313 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -181,7 +181,7 @@ static DEFINE_PER_CPU(int, sockets_in_use);
  *      invalid addresses -EFAULT is returned. On a success 0 is returned.
  */
 
-int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr *kaddr)
+int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
 {
         if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
                 return -EINVAL;
@@ -209,7 +209,7 @@ int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr *kaddr)
  *      specified. Zero is returned for a success.
  */
 
-static int move_addr_to_user(struct sockaddr *kaddr, int klen,
+static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
                              void __user *uaddr, int __user *ulen)
 {
         int err;
@@ -479,7 +479,7 @@ static struct socket *sock_alloc(void)
         inode->i_uid = current_fsuid();
         inode->i_gid = current_fsgid();
 
-        percpu_add(sockets_in_use, 1);
+        this_cpu_add(sockets_in_use, 1);
         return sock;
 }
 
@@ -522,7 +522,7 @@ void sock_release(struct socket *sock)
         if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
                 printk(KERN_ERR "sock_release: fasync list not empty!\n");
 
-        percpu_sub(sockets_in_use, 1);
+        this_cpu_sub(sockets_in_use, 1);
         if (!sock->file) {
                 iput(SOCK_INODE(sock));
                 return;
@@ -811,9 +811,9 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
 
         sock = file->private_data;
 
-        flags = !(file->f_flags & O_NONBLOCK) ? 0 : MSG_DONTWAIT;
-        if (more)
-                flags |= MSG_MORE;
+        flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
+        /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
+        flags |= more;
 
         return kernel_sendpage(sock, page, offset, size, flags);
 }
@@ -1234,8 +1234,7 @@ int __sock_create(struct net *net, int family, int type, int protocol,
          */
         sock = sock_alloc();
         if (!sock) {
-                if (net_ratelimit())
-                        printk(KERN_WARNING "socket: no more sockets\n");
+                net_warn_ratelimited("socket: no more sockets\n");
                 return -ENFILE; /* Not exactly a match, but its the
                                    closest posix thing */
         }
@@ -1449,7 +1448,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
 
         sock = sockfd_lookup_light(fd, &err, &fput_needed);
         if (sock) {
-                err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
+                err = move_addr_to_kernel(umyaddr, addrlen, &address);
                 if (err >= 0) {
                         err = security_socket_bind(sock,
                                                    (struct sockaddr *)&address,
@@ -1479,7 +1478,7 @@ SYSCALL_DEFINE2(listen, int, fd, int, backlog)
         sock = sockfd_lookup_light(fd, &err, &fput_needed);
         if (sock) {
                 somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
-                if ((unsigned)backlog > somaxconn)
+                if ((unsigned int)backlog > somaxconn)
                         backlog = somaxconn;
 
                 err = security_socket_listen(sock, backlog);
@@ -1556,7 +1555,7 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
                         err = -ECONNABORTED;
                         goto out_fd;
                 }
-                err = move_addr_to_user((struct sockaddr *)&address,
+                err = move_addr_to_user(&address,
                                         len, upeer_sockaddr, upeer_addrlen);
                 if (err < 0)
                         goto out_fd;
@@ -1605,7 +1604,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
         sock = sockfd_lookup_light(fd, &err, &fput_needed);
         if (!sock)
                 goto out;
-        err = move_addr_to_kernel(uservaddr, addrlen, (struct sockaddr *)&address);
+        err = move_addr_to_kernel(uservaddr, addrlen, &address);
         if (err < 0)
                 goto out_put;
 
@@ -1645,7 +1644,7 @@ SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
         err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
         if (err)
                 goto out_put;
-        err = move_addr_to_user((struct sockaddr *)&address, len, usockaddr, usockaddr_len);
+        err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
 
 out_put:
         fput_light(sock->file, fput_needed);
@@ -1677,7 +1676,7 @@ SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
                     sock->ops->getname(sock, (struct sockaddr *)&address, &len,
                                        1);
                 if (!err)
-                        err = move_addr_to_user((struct sockaddr *)&address, len, usockaddr,
+                        err = move_addr_to_user(&address, len, usockaddr,
                                                 usockaddr_len);
                 fput_light(sock->file, fput_needed);
         }
@@ -1691,7 +1690,7 @@ SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
  */
 
 SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
-                unsigned, flags, struct sockaddr __user *, addr,
+                unsigned int, flags, struct sockaddr __user *, addr,
                 int, addr_len)
 {
         struct socket *sock;
@@ -1716,7 +1715,7 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
         msg.msg_controllen = 0;
         msg.msg_namelen = 0;
         if (addr) {
-                err = move_addr_to_kernel(addr, addr_len, (struct sockaddr *)&address);
+                err = move_addr_to_kernel(addr, addr_len, &address);
                 if (err < 0)
                         goto out_put;
                 msg.msg_name = (struct sockaddr *)&address;
@@ -1738,7 +1737,7 @@ out:
  */
 
 SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
-                unsigned, flags)
+                unsigned int, flags)
 {
         return sys_sendto(fd, buff, len, flags, NULL, 0);
 }
@@ -1750,7 +1749,7 @@ SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
  */
 
 SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
-                unsigned, flags, struct sockaddr __user *, addr,
+                unsigned int, flags, struct sockaddr __user *, addr,
                 int __user *, addr_len)
 {
         struct socket *sock;
@@ -1779,7 +1778,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
         err = sock_recvmsg(sock, &msg, size, flags);
 
         if (err >= 0 && addr != NULL) {
-                err2 = move_addr_to_user((struct sockaddr *)&address,
+                err2 = move_addr_to_user(&address,
                                          msg.msg_namelen, addr, addr_len);
                 if (err2 < 0)
                         err = err2;
@@ -1795,7 +1794,7 @@ out:
  */
 
 asmlinkage long sys_recv(int fd, void __user *ubuf, size_t size,
-                         unsigned flags)
+                         unsigned int flags)
 {
         return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
 }
@@ -1897,7 +1896,7 @@ struct used_address {
 };
 
 static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
-                         struct msghdr *msg_sys, unsigned flags,
+                         struct msghdr *msg_sys, unsigned int flags,
                          struct used_address *used_address)
 {
         struct compat_msghdr __user *msg_compat =
@@ -1908,7 +1907,7 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
             __attribute__ ((aligned(sizeof(__kernel_size_t))));
         /* 20 is size of ipv6_pktinfo */
         unsigned char *ctl_buf = ctl;
-        int err, ctl_len, iov_size, total_len;
+        int err, ctl_len, total_len;
 
         err = -EFAULT;
         if (MSG_CMSG_COMPAT & flags) {
@@ -1917,29 +1916,22 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
         } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
                 return -EFAULT;
 
-        /* do not move before msg_sys is valid */
-        err = -EMSGSIZE;
-        if (msg_sys->msg_iovlen > UIO_MAXIOV)
-                goto out;
-
-        /* Check whether to allocate the iovec area */
-        err = -ENOMEM;
-        iov_size = msg_sys->msg_iovlen * sizeof(struct iovec);
         if (msg_sys->msg_iovlen > UIO_FASTIOV) {
-                iov = sock_kmalloc(sock->sk, iov_size, GFP_KERNEL);
+                err = -EMSGSIZE;
+                if (msg_sys->msg_iovlen > UIO_MAXIOV)
+                        goto out;
+                err = -ENOMEM;
+                iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
+                              GFP_KERNEL);
                 if (!iov)
                         goto out;
         }
 
         /* This will also move the address data into kernel space */
         if (MSG_CMSG_COMPAT & flags) {
-                err = verify_compat_iovec(msg_sys, iov,
-                                          (struct sockaddr *)&address,
-                                          VERIFY_READ);
+                err = verify_compat_iovec(msg_sys, iov, &address, VERIFY_READ);
         } else
-                err = verify_iovec(msg_sys, iov,
-                                   (struct sockaddr *)&address,
-                                   VERIFY_READ);
+                err = verify_iovec(msg_sys, iov, &address, VERIFY_READ);
         if (err < 0)
                 goto out_freeiov;
         total_len = err;
@@ -2009,7 +2001,7 @@ out_freectl:
                 sock_kfree_s(sock->sk, ctl_buf, ctl_len);
 out_freeiov:
         if (iov != iovstack)
-                sock_kfree_s(sock->sk, iov, iov_size);
+                kfree(iov);
 out:
         return err;
 }
@@ -2018,7 +2010,7 @@ out:
  *      BSD sendmsg interface
  */
 
-SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
+SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
 {
         int fput_needed, err;
         struct msghdr msg_sys;
@@ -2100,14 +2092,14 @@ SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
 }
 
 static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
-                         struct msghdr *msg_sys, unsigned flags, int nosec)
+                         struct msghdr *msg_sys, unsigned int flags, int nosec)
 {
         struct compat_msghdr __user *msg_compat =
             (struct compat_msghdr __user *)msg;
         struct iovec iovstack[UIO_FASTIOV];
         struct iovec *iov = iovstack;
         unsigned long cmsg_ptr;
-        int err, iov_size, total_len, len;
+        int err, total_len, len;
 
         /* kernel mode address */
         struct sockaddr_storage addr;
@@ -2122,15 +2114,13 @@ static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
         } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
                 return -EFAULT;
 
-        err = -EMSGSIZE;
-        if (msg_sys->msg_iovlen > UIO_MAXIOV)
-                goto out;
-
-        /* Check whether to allocate the iovec area */
-        err = -ENOMEM;
-        iov_size = msg_sys->msg_iovlen * sizeof(struct iovec);
         if (msg_sys->msg_iovlen > UIO_FASTIOV) {
-                iov = sock_kmalloc(sock->sk, iov_size, GFP_KERNEL);
+                err = -EMSGSIZE;
+                if (msg_sys->msg_iovlen > UIO_MAXIOV)
+                        goto out;
+                err = -ENOMEM;
+                iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
+                              GFP_KERNEL);
                 if (!iov)
                         goto out;
         }
@@ -2143,13 +2133,9 @@ static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
         uaddr = (__force void __user *)msg_sys->msg_name;
         uaddr_len = COMPAT_NAMELEN(msg);
         if (MSG_CMSG_COMPAT & flags) {
-                err = verify_compat_iovec(msg_sys, iov,
-                                          (struct sockaddr *)&addr,
-                                          VERIFY_WRITE);
+                err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
         } else
-                err = verify_iovec(msg_sys, iov,
-                                   (struct sockaddr *)&addr,
-                                   VERIFY_WRITE);
+                err = verify_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
         if (err < 0)
                 goto out_freeiov;
         total_len = err;
@@ -2166,7 +2152,7 @@ static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
         len = err;
 
         if (uaddr != NULL) {
-                err = move_addr_to_user((struct sockaddr *)&addr,
+                err = move_addr_to_user(&addr,
                                         msg_sys->msg_namelen, uaddr,
                                         uaddr_len);
                 if (err < 0)
@@ -2188,7 +2174,7 @@ static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
 
 out_freeiov:
         if (iov != iovstack)
-                sock_kfree_s(sock->sk, iov, iov_size);
+                kfree(iov);
 out:
         return err;
 }
@@ -2532,6 +2518,12 @@ EXPORT_SYMBOL(sock_unregister);
 static int __init sock_init(void)
 {
         int err;
+        /*
+         *      Initialize the network sysctl infrastructure.
+         */
+        err = net_sysctl_init();
+        if (err)
+                goto out;
 
         /*
          *      Initialize sock SLAB cache.
@@ -2600,7 +2592,7 @@ void socket_seq_show(struct seq_file *seq)
 
 #ifdef CONFIG_COMPAT
 static int do_siocgstamp(struct net *net, struct socket *sock,
-                         unsigned int cmd, struct compat_timeval __user *up)
+                         unsigned int cmd, void __user *up)
 {
         mm_segment_t old_fs = get_fs();
         struct timeval ktv;
@@ -2609,15 +2601,14 @@ static int do_siocgstamp(struct net *net, struct socket *sock,
         set_fs(KERNEL_DS);
         err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
         set_fs(old_fs);
-        if (!err) {
-                err = put_user(ktv.tv_sec, &up->tv_sec);
-                err |= __put_user(ktv.tv_usec, &up->tv_usec);
-        }
+        if (!err)
+                err = compat_put_timeval(up, &ktv);
+
         return err;
 }
 
 static int do_siocgstampns(struct net *net, struct socket *sock,
-                         unsigned int cmd, struct compat_timespec __user *up)
+                           unsigned int cmd, void __user *up)
 {
         mm_segment_t old_fs = get_fs();
         struct timespec kts;
@@ -2626,10 +2617,9 @@ static int do_siocgstampns(struct net *net, struct socket *sock,
         set_fs(KERNEL_DS);
         err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
         set_fs(old_fs);
-        if (!err) {
-                err = put_user(kts.tv_sec, &up->tv_sec);
-                err |= __put_user(kts.tv_nsec, &up->tv_nsec);
-        }
+        if (!err)
+                err = compat_put_timespec(up, &kts);
+
         return err;
 }
 
@@ -3233,7 +3223,7 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
         return -ENOIOCTLCMD;
 }
 
-static long compat_sock_ioctl(struct file *file, unsigned cmd,
+static long compat_sock_ioctl(struct file *file, unsigned int cmd,
                               unsigned long arg)
 {
         struct socket *sock = file->private_data;
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
index ffd243d09188..9fe8857d8d59 100644
--- a/net/sunrpc/Kconfig
+++ b/net/sunrpc/Kconfig
@@ -39,3 +39,16 @@ config RPCSEC_GSS_KRB5
           Kerberos support should be installed.
 
           If unsure, say Y.
+
+config SUNRPC_DEBUG
+        bool "RPC: Enable dprintk debugging"
+        depends on SUNRPC && SYSCTL
+        help
+          This option enables a sysctl-based debugging interface
+          that is be used by the 'rpcdebug' utility to turn on or off
+          logging of different aspects of the kernel RPC activity.
+
+          Disabling this option will make your kernel slightly smaller,
+          but makes troubleshooting NFS issues significantly harder.
+
+          If unsure, say Y.
diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
index ee77742e0ed6..d11418f97f1f 100644
--- a/net/sunrpc/addr.c
+++ b/net/sunrpc/addr.c
@@ -156,8 +156,9 @@ static size_t rpc_pton4(const char *buf, const size_t buflen,
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
-static int rpc_parse_scope_id(const char *buf, const size_t buflen,
-                              const char *delim, struct sockaddr_in6 *sin6)
+static int rpc_parse_scope_id(struct net *net, const char *buf,
+                              const size_t buflen, const char *delim,
+                              struct sockaddr_in6 *sin6)
 {
         char *p;
         size_t len;
@@ -177,7 +178,7 @@ static int rpc_parse_scope_id(const char *buf, const size_t buflen,
                 unsigned long scope_id = 0;
                 struct net_device *dev;
 
-                dev = dev_get_by_name(&init_net, p);
+                dev = dev_get_by_name(net, p);
                 if (dev != NULL) {
                         scope_id = dev->ifindex;
                         dev_put(dev);
@@ -197,7 +198,7 @@ static int rpc_parse_scope_id(const char *buf, const size_t buflen,
         return 0;
 }
 
-static size_t rpc_pton6(const char *buf, const size_t buflen,
+static size_t rpc_pton6(struct net *net, const char *buf, const size_t buflen,
                         struct sockaddr *sap, const size_t salen)
 {
         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sap;
@@ -213,14 +214,14 @@ static size_t rpc_pton6(const char *buf, const size_t buflen,
         if (in6_pton(buf, buflen, addr, IPV6_SCOPE_DELIMITER, &delim) == 0)
                 return 0;
 
-        if (!rpc_parse_scope_id(buf, buflen, delim, sin6))
+        if (!rpc_parse_scope_id(net, buf, buflen, delim, sin6))
                 return 0;
 
         sin6->sin6_family = AF_INET6;
         return sizeof(struct sockaddr_in6);
 }
 #else
-static size_t rpc_pton6(const char *buf, const size_t buflen,
+static size_t rpc_pton6(struct net *net, const char *buf, const size_t buflen,
                         struct sockaddr *sap, const size_t salen)
 {
         return 0;
@@ -229,6 +230,7 @@ static size_t rpc_pton6(const char *buf, const size_t buflen,
 
 /**
  * rpc_pton - Construct a sockaddr in @sap
+ * @net: applicable network namespace
  * @buf: C string containing presentation format IP address
  * @buflen: length of presentation address in bytes
  * @sap: buffer into which to plant socket address
@@ -241,14 +243,14 @@ static size_t rpc_pton6(const char *buf, const size_t buflen,
  * socket address, if successful.  Returns zero if an error
  * occurred.
  */
-size_t rpc_pton(const char *buf, const size_t buflen,
+size_t rpc_pton(struct net *net, const char *buf, const size_t buflen,
                 struct sockaddr *sap, const size_t salen)
 {
         unsigned int i;
 
         for (i = 0; i < buflen; i++)
                 if (buf[i] == ':')
-                        return rpc_pton6(buf, buflen, sap, salen);
+                        return rpc_pton6(net, buf, buflen, sap, salen);
         return rpc_pton4(buf, buflen, sap, salen);
 }
 EXPORT_SYMBOL_GPL(rpc_pton);
@@ -295,6 +297,7 @@ char *rpc_sockaddr2uaddr(const struct sockaddr *sap, gfp_t gfp_flags)
 
 /**
  * rpc_uaddr2sockaddr - convert a universal address to a socket address.
+ * @net: applicable network namespace
  * @uaddr: C string containing universal address to convert
  * @uaddr_len: length of universal address string
  * @sap: buffer into which to plant socket address
@@ -306,8 +309,9 @@ char *rpc_sockaddr2uaddr(const struct sockaddr *sap, gfp_t gfp_flags)
  * Returns the size of the socket address if successful; otherwise
  * zero is returned.
  */
-size_t rpc_uaddr2sockaddr(const char *uaddr, const size_t uaddr_len,
-                          struct sockaddr *sap, const size_t salen)
+size_t rpc_uaddr2sockaddr(struct net *net, const char *uaddr,
+                          const size_t uaddr_len, struct sockaddr *sap,
+                          const size_t salen)
 {
         char *c, buf[RPCBIND_MAXUADDRLEN + sizeof('\0')];
         unsigned long portlo, porthi;
@@ -339,7 +343,7 @@ size_t rpc_uaddr2sockaddr(const char *uaddr, const size_t uaddr_len,
         port = (unsigned short)((porthi << 8) | portlo);
 
         *c = '\0';
-        if (rpc_pton(buf, strlen(buf), sap, salen) == 0)
+        if (rpc_pton(net, buf, strlen(buf), sap, salen) == 0)
                 return 0;
 
         switch (sap->sa_family) {
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index 75762f346975..6ed6f201b022 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -160,8 +160,8 @@ generic_match(struct auth_cred *acred, struct rpc_cred *cred, int flags)
         if (gcred->acred.group_info->ngroups != acred->group_info->ngroups)
                 goto out_nomatch;
         for (i = 0; i < gcred->acred.group_info->ngroups; i++) {
-                if (GROUP_AT(gcred->acred.group_info, i) !=
-                                GROUP_AT(acred->group_info, i))
+                if (!gid_eq(GROUP_AT(gcred->acred.group_info, i),
+                                GROUP_AT(acred->group_info, i)))
                         goto out_nomatch;
         }
 out_match:
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index affa631ac1ab..d3ad81f8da5b 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -81,7 +81,7 @@ struct gss_auth {
          * mechanism (for example, "krb5") and exists for
          * backwards-compatibility with older gssd's.
          */
-        struct dentry *dentry[2];
+        struct rpc_pipe *pipe[2];
 };
 
 /* pipe_version >= 0 if and only if someone has a pipe open. */
@@ -112,7 +112,7 @@ gss_put_ctx(struct gss_cl_ctx *ctx)
 /* gss_cred_set_ctx:
  * called by gss_upcall_callback and gss_create_upcall in order
  * to set the gss context. The actual exchange of an old context
- * and a new one is protected by the inode->i_lock.
+ * and a new one is protected by the pipe->lock.
  */
 static void
 gss_cred_set_ctx(struct rpc_cred *cred, struct gss_cl_ctx *ctx)
@@ -251,7 +251,7 @@ struct gss_upcall_msg {
         struct rpc_pipe_msg msg;
         struct list_head list;
         struct gss_auth *auth;
-        struct rpc_inode *inode;
+        struct rpc_pipe *pipe;
         struct rpc_wait_queue rpc_waitqueue;
         wait_queue_head_t waitqueue;
         struct gss_cl_ctx *ctx;
@@ -294,10 +294,10 @@ gss_release_msg(struct gss_upcall_msg *gss_msg)
 }
 
 static struct gss_upcall_msg *
-__gss_find_upcall(struct rpc_inode *rpci, uid_t uid)
+__gss_find_upcall(struct rpc_pipe *pipe, uid_t uid)
 {
         struct gss_upcall_msg *pos;
-        list_for_each_entry(pos, &rpci->in_downcall, list) {
+        list_for_each_entry(pos, &pipe->in_downcall, list) {
                 if (pos->uid != uid)
                         continue;
                 atomic_inc(&pos->count);
@@ -315,18 +315,17 @@ __gss_find_upcall(struct rpc_inode *rpci, uid_t uid)
 static inline struct gss_upcall_msg *
 gss_add_msg(struct gss_upcall_msg *gss_msg)
 {
-        struct rpc_inode *rpci = gss_msg->inode;
-        struct inode *inode = &rpci->vfs_inode;
+        struct rpc_pipe *pipe = gss_msg->pipe;
         struct gss_upcall_msg *old;
 
-        spin_lock(&inode->i_lock);
-        old = __gss_find_upcall(rpci, gss_msg->uid);
+        spin_lock(&pipe->lock);
+        old = __gss_find_upcall(pipe, gss_msg->uid);
         if (old == NULL) {
                 atomic_inc(&gss_msg->count);
-                list_add(&gss_msg->list, &rpci->in_downcall);
+                list_add(&gss_msg->list, &pipe->in_downcall);
         } else
                 gss_msg = old;
-        spin_unlock(&inode->i_lock);
+        spin_unlock(&pipe->lock);
         return gss_msg;
 }
 
@@ -342,14 +341,14 @@ __gss_unhash_msg(struct gss_upcall_msg *gss_msg)
 static void
 gss_unhash_msg(struct gss_upcall_msg *gss_msg)
 {
-        struct inode *inode = &gss_msg->inode->vfs_inode;
+        struct rpc_pipe *pipe = gss_msg->pipe;
 
         if (list_empty(&gss_msg->list))
                 return;
-        spin_lock(&inode->i_lock);
+        spin_lock(&pipe->lock);
         if (!list_empty(&gss_msg->list))
                 __gss_unhash_msg(gss_msg);
-        spin_unlock(&inode->i_lock);
+        spin_unlock(&pipe->lock);
 }
 
 static void
@@ -376,11 +375,11 @@ gss_upcall_callback(struct rpc_task *task)
         struct gss_cred *gss_cred = container_of(task->tk_rqstp->rq_cred,
                         struct gss_cred, gc_base);
         struct gss_upcall_msg *gss_msg = gss_cred->gc_upcall;
-        struct inode *inode = &gss_msg->inode->vfs_inode;
+        struct rpc_pipe *pipe = gss_msg->pipe;
 
-        spin_lock(&inode->i_lock);
+        spin_lock(&pipe->lock);
         gss_handle_downcall_result(gss_cred, gss_msg);
-        spin_unlock(&inode->i_lock);
+        spin_unlock(&pipe->lock);
         task->tk_status = gss_msg->msg.errno;
         gss_release_msg(gss_msg);
 }
@@ -450,7 +449,7 @@ gss_alloc_msg(struct gss_auth *gss_auth, struct rpc_clnt *clnt,
                 kfree(gss_msg);
                 return ERR_PTR(vers);
         }
-        gss_msg->inode = RPC_I(gss_auth->dentry[vers]->d_inode);
+        gss_msg->pipe = gss_auth->pipe[vers];
         INIT_LIST_HEAD(&gss_msg->list);
         rpc_init_wait_queue(&gss_msg->rpc_waitqueue, "RPCSEC_GSS upcall waitq");
         init_waitqueue_head(&gss_msg->waitqueue);
@@ -474,8 +473,7 @@ gss_setup_upcall(struct rpc_clnt *clnt, struct gss_auth *gss_auth, struct rpc_cr
                 return gss_new;
         gss_msg = gss_add_msg(gss_new);
         if (gss_msg == gss_new) {
-                struct inode *inode = &gss_new->inode->vfs_inode;
-                int res = rpc_queue_upcall(inode, &gss_new->msg);
+                int res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
                 if (res) {
                         gss_unhash_msg(gss_new);
                         gss_msg = ERR_PTR(res);
@@ -506,7 +504,7 @@ gss_refresh_upcall(struct rpc_task *task)
         struct gss_cred *gss_cred = container_of(cred,
                         struct gss_cred, gc_base);
         struct gss_upcall_msg *gss_msg;
-        struct inode *inode;
+        struct rpc_pipe *pipe;
         int err = 0;
 
         dprintk("RPC: %5u gss_refresh_upcall for uid %u\n", task->tk_pid,
@@ -524,8 +522,8 @@ gss_refresh_upcall(struct rpc_task *task)
                 err = PTR_ERR(gss_msg);
                 goto out;
         }
-        inode = &gss_msg->inode->vfs_inode;
-        spin_lock(&inode->i_lock);
+        pipe = gss_msg->pipe;
+        spin_lock(&pipe->lock);
         if (gss_cred->gc_upcall != NULL)
                 rpc_sleep_on(&gss_cred->gc_upcall->rpc_waitqueue, task, NULL);
         else if (gss_msg->ctx == NULL && gss_msg->msg.errno >= 0) {
@@ -538,7 +536,7 @@ gss_refresh_upcall(struct rpc_task *task)
                 gss_handle_downcall_result(gss_cred, gss_msg);
                 err = gss_msg->msg.errno;
         }
-        spin_unlock(&inode->i_lock);
+        spin_unlock(&pipe->lock);
         gss_release_msg(gss_msg);
 out:
         dprintk("RPC: %5u gss_refresh_upcall for uid %u result %d\n",
@@ -549,7 +547,7 @@ out:
 static inline int
 gss_create_upcall(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
 {
-        struct inode *inode;
+        struct rpc_pipe *pipe;
         struct rpc_cred *cred = &gss_cred->gc_base;
         struct gss_upcall_msg *gss_msg;
         DEFINE_WAIT(wait);
@@ -573,14 +571,14 @@ retry:
                 err = PTR_ERR(gss_msg);
                 goto out;
         }
-        inode = &gss_msg->inode->vfs_inode;
+        pipe = gss_msg->pipe;
         for (;;) {
                 prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_KILLABLE);
-                spin_lock(&inode->i_lock);
+                spin_lock(&pipe->lock);
                 if (gss_msg->ctx != NULL || gss_msg->msg.errno < 0) {
                         break;
                 }
-                spin_unlock(&inode->i_lock);
+                spin_unlock(&pipe->lock);
                 if (fatal_signal_pending(current)) {
                         err = -ERESTARTSYS;
                         goto out_intr;
@@ -591,7 +589,7 @@ retry:
                 gss_cred_set_ctx(cred, gss_msg->ctx);
         else
                 err = gss_msg->msg.errno;
-        spin_unlock(&inode->i_lock);
+        spin_unlock(&pipe->lock);
 out_intr:
         finish_wait(&gss_msg->waitqueue, &wait);
         gss_release_msg(gss_msg);
@@ -609,7 +607,7 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
         const void *p, *end;
         void *buf;
         struct gss_upcall_msg *gss_msg;
-        struct inode *inode = filp->f_path.dentry->d_inode;
+        struct rpc_pipe *pipe = RPC_I(filp->f_dentry->d_inode)->pipe;
         struct gss_cl_ctx *ctx;
         uid_t uid;
         ssize_t err = -EFBIG;
@@ -639,14 +637,14 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 
         err = -ENOENT;
         /* Find a matching upcall */
-        spin_lock(&inode->i_lock);
-        gss_msg = __gss_find_upcall(RPC_I(inode), uid);
+        spin_lock(&pipe->lock);
+        gss_msg = __gss_find_upcall(pipe, uid);
         if (gss_msg == NULL) {
-                spin_unlock(&inode->i_lock);
+                spin_unlock(&pipe->lock);
                 goto err_put_ctx;
         }
         list_del_init(&gss_msg->list);
-        spin_unlock(&inode->i_lock);
+        spin_unlock(&pipe->lock);
 
         p = gss_fill_context(p, end, ctx, gss_msg->auth->mech);
         if (IS_ERR(p)) {
@@ -674,9 +672,9 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
         err = mlen;
 
 err_release_msg:
-        spin_lock(&inode->i_lock);
+        spin_lock(&pipe->lock);
         __gss_unhash_msg(gss_msg);
-        spin_unlock(&inode->i_lock);
+        spin_unlock(&pipe->lock);
         gss_release_msg(gss_msg);
 err_put_ctx:
         gss_put_ctx(ctx);
@@ -722,23 +720,23 @@ static int gss_pipe_open_v1(struct inode *inode)
 static void
 gss_pipe_release(struct inode *inode)
 {
-        struct rpc_inode *rpci = RPC_I(inode);
+        struct rpc_pipe *pipe = RPC_I(inode)->pipe;
         struct gss_upcall_msg *gss_msg;
 
 restart:
-        spin_lock(&inode->i_lock);
-        list_for_each_entry(gss_msg, &rpci->in_downcall, list) {
+        spin_lock(&pipe->lock);
+        list_for_each_entry(gss_msg, &pipe->in_downcall, list) {
 
                 if (!list_empty(&gss_msg->msg.list))
                         continue;
                 gss_msg->msg.errno = -EPIPE;
                 atomic_inc(&gss_msg->count);
                 __gss_unhash_msg(gss_msg);
-                spin_unlock(&inode->i_lock);
+                spin_unlock(&pipe->lock);
                 gss_release_msg(gss_msg);
                 goto restart;
         }
-        spin_unlock(&inode->i_lock);
+        spin_unlock(&pipe->lock);
 
         put_pipe_version();
 }
@@ -759,6 +757,75 @@ gss_pipe_destroy_msg(struct rpc_pipe_msg *msg)
         }
 }
 
+static void gss_pipes_dentries_destroy(struct rpc_auth *auth)
+{
+        struct gss_auth *gss_auth;
+
+        gss_auth = container_of(auth, struct gss_auth, rpc_auth);
+        if (gss_auth->pipe[0]->dentry)
+                rpc_unlink(gss_auth->pipe[0]->dentry);
+        if (gss_auth->pipe[1]->dentry)
+                rpc_unlink(gss_auth->pipe[1]->dentry);
+}
+
+static int gss_pipes_dentries_create(struct rpc_auth *auth)
+{
+        int err;
+        struct gss_auth *gss_auth;
+        struct rpc_clnt *clnt;
+
+        gss_auth = container_of(auth, struct gss_auth, rpc_auth);
+        clnt = gss_auth->client;
+
+        gss_auth->pipe[1]->dentry = rpc_mkpipe_dentry(clnt->cl_dentry,
+                                                      "gssd",
+                                                      clnt, gss_auth->pipe[1]);
+        if (IS_ERR(gss_auth->pipe[1]->dentry))
+                return PTR_ERR(gss_auth->pipe[1]->dentry);
+        gss_auth->pipe[0]->dentry = rpc_mkpipe_dentry(clnt->cl_dentry,
+                                                      gss_auth->mech->gm_name,
+                                                      clnt, gss_auth->pipe[0]);
+        if (IS_ERR(gss_auth->pipe[0]->dentry)) {
+                err = PTR_ERR(gss_auth->pipe[0]->dentry);
+                goto err_unlink_pipe_1;
+        }
+        return 0;
+
+err_unlink_pipe_1:
+        rpc_unlink(gss_auth->pipe[1]->dentry);
+        return err;
+}
+
+static void gss_pipes_dentries_destroy_net(struct rpc_clnt *clnt,
+                                           struct rpc_auth *auth)
+{
+        struct net *net = rpc_net_ns(clnt);
+        struct super_block *sb;
+
+        sb = rpc_get_sb_net(net);
+        if (sb) {
+                if (clnt->cl_dentry)
+                        gss_pipes_dentries_destroy(auth);
+                rpc_put_sb_net(net);
+        }
+}
+
+static int gss_pipes_dentries_create_net(struct rpc_clnt *clnt,
+                                         struct rpc_auth *auth)
+{
+        struct net *net = rpc_net_ns(clnt);
+        struct super_block *sb;
+        int err = 0;
+
+        sb = rpc_get_sb_net(net);
+        if (sb) {
+                if (clnt->cl_dentry)
+                        err = gss_pipes_dentries_create(auth);
+                rpc_put_sb_net(net);
+        }
+        return err;
+}
+
 /*
  * NOTE: we have the opportunity to use different
  * parameters based on the input flavor (which must be a pseudoflavor)
@@ -801,32 +868,33 @@ gss_create(struct rpc_clnt *clnt, rpc_authflavor_t flavor)
          * that we supported only the old pipe.  So we instead create
          * the new pipe first.
          */
-        gss_auth->dentry[1] = rpc_mkpipe(clnt->cl_path.dentry,
-                                         "gssd",
-                                         clnt, &gss_upcall_ops_v1,
-                                         RPC_PIPE_WAIT_FOR_OPEN);
-        if (IS_ERR(gss_auth->dentry[1])) {
-                err = PTR_ERR(gss_auth->dentry[1]);
+        gss_auth->pipe[1] = rpc_mkpipe_data(&gss_upcall_ops_v1,
+                                            RPC_PIPE_WAIT_FOR_OPEN);
+        if (IS_ERR(gss_auth->pipe[1])) {
+                err = PTR_ERR(gss_auth->pipe[1]);
                 goto err_put_mech;
         }
 
-        gss_auth->dentry[0] = rpc_mkpipe(clnt->cl_path.dentry,
-                                         gss_auth->mech->gm_name,
-                                         clnt, &gss_upcall_ops_v0,
-                                         RPC_PIPE_WAIT_FOR_OPEN);
-        if (IS_ERR(gss_auth->dentry[0])) {
-                err = PTR_ERR(gss_auth->dentry[0]);
-                goto err_unlink_pipe_1;
+        gss_auth->pipe[0] = rpc_mkpipe_data(&gss_upcall_ops_v0,
+                                            RPC_PIPE_WAIT_FOR_OPEN);
+        if (IS_ERR(gss_auth->pipe[0])) {
+                err = PTR_ERR(gss_auth->pipe[0]);
+                goto err_destroy_pipe_1;
         }
+        err = gss_pipes_dentries_create_net(clnt, auth);
+        if (err)
+                goto err_destroy_pipe_0;
         err = rpcauth_init_credcache(auth);
         if (err)
-                goto err_unlink_pipe_0;
+                goto err_unlink_pipes;
 
         return auth;
-err_unlink_pipe_0:
-        rpc_unlink(gss_auth->dentry[0]);
-err_unlink_pipe_1:
-        rpc_unlink(gss_auth->dentry[1]);
+err_unlink_pipes:
+        gss_pipes_dentries_destroy_net(clnt, auth);
+err_destroy_pipe_0:
+        rpc_destroy_pipe_data(gss_auth->pipe[0]);
+err_destroy_pipe_1:
+        rpc_destroy_pipe_data(gss_auth->pipe[1]);
 err_put_mech:
         gss_mech_put(gss_auth->mech);
 err_free:
@@ -839,8 +907,9 @@ out_dec:
 static void
 gss_free(struct gss_auth *gss_auth)
 {
-        rpc_unlink(gss_auth->dentry[1]);
-        rpc_unlink(gss_auth->dentry[0]);
+        gss_pipes_dentries_destroy_net(gss_auth->client, &gss_auth->rpc_auth);
+        rpc_destroy_pipe_data(gss_auth->pipe[0]);
+        rpc_destroy_pipe_data(gss_auth->pipe[1]);
         gss_mech_put(gss_auth->mech);
 
         kfree(gss_auth);
@@ -1547,7 +1616,9 @@ static const struct rpc_authops authgss_ops = {
         .create         = gss_create,
         .destroy        = gss_destroy,
         .lookup_cred    = gss_lookup_cred,
-        .crcreate       = gss_create_cred
+        .crcreate       = gss_create_cred,
+        .pipes_create   = gss_pipes_dentries_create,
+        .pipes_destroy  = gss_pipes_dentries_destroy,
 };
 
 static const struct rpc_credops gss_credops = {
@@ -1591,6 +1662,21 @@ static const struct rpc_pipe_ops gss_upcall_ops_v1 = {
         .release_pipe   = gss_pipe_release,
 };
 
+static __net_init int rpcsec_gss_init_net(struct net *net)
+{
+        return gss_svc_init_net(net);
+}
+
+static __net_exit void rpcsec_gss_exit_net(struct net *net)
+{
+        gss_svc_shutdown_net(net);
+}
+
+static struct pernet_operations rpcsec_gss_net_ops = {
+        .init = rpcsec_gss_init_net,
+        .exit = rpcsec_gss_exit_net,
+};
+
 /*
  * Initialize RPCSEC_GSS module
  */
@@ -1604,8 +1690,13 @@ static int __init init_rpcsec_gss(void)
         err = gss_svc_init();
         if (err)
                 goto out_unregister;
+        err = register_pernet_subsys(&rpcsec_gss_net_ops);
+        if (err)
+                goto out_svc_exit;
         rpc_init_wait_queue(&pipe_version_rpc_waitqueue, "gss pipe version");
         return 0;
+out_svc_exit:
+        gss_svc_shutdown();
 out_unregister:
         rpcauth_unregister(&authgss_ops);
 out:
@@ -1614,6 +1705,7 @@ out:
 
 static void __exit exit_rpcsec_gss(void)
 {
+        unregister_pernet_subsys(&rpcsec_gss_net_ops);
         gss_svc_shutdown();
         rpcauth_unregister(&authgss_ops);
         rcu_barrier(); /* Wait for completion of call_rcu()'s */
diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index 9576f35ab701..0f43e894bc0a 100644
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -600,11 +600,14 @@ gss_krb5_cts_crypt(struct crypto_blkcipher *cipher, struct xdr_buf *buf,
         u32 ret;
         struct scatterlist sg[1];
         struct blkcipher_desc desc = { .tfm = cipher, .info = iv };
-        u8 data[crypto_blkcipher_blocksize(cipher) * 2];
+        u8 data[GSS_KRB5_MAX_BLOCKSIZE * 2];
         struct page **save_pages;
         u32 len = buf->len - offset;
 
-        BUG_ON(len > crypto_blkcipher_blocksize(cipher) * 2);
+        if (len > ARRAY_SIZE(data)) {
+                WARN_ON(0);
+                return -ENOMEM;
+        }
 
         /*
          * For encryption, we want to read from the cleartext
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index 8c67890de427..d3611f11a8df 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -344,7 +344,7 @@ out_err:
         return PTR_ERR(p);
 }
 
-struct crypto_blkcipher *
+static struct crypto_blkcipher *
 context_v2_alloc_cipher(struct krb5_ctx *ctx, const char *cname, u8 *key)
 {
         struct crypto_blkcipher *cp;
@@ -624,7 +624,7 @@ gss_import_v2_context(const void *p, const void *end, struct krb5_ctx *ctx,
         ctx->seq_send = ctx->seq_send64;
         if (ctx->seq_send64 != ctx->seq_send) {
                 dprintk("%s: seq_send64 %lx, seq_send %x overflow?\n", __func__,
-                        (long unsigned)ctx->seq_send64, ctx->seq_send);
+                        (unsigned long)ctx->seq_send64, ctx->seq_send);
                 p = ERR_PTR(-EINVAL);
                 goto out_err;
         }
diff --git a/net/sunrpc/auth_gss/gss_krb5_seal.c b/net/sunrpc/auth_gss/gss_krb5_seal.c
index d7941eab7796..62ae3273186c 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seal.c
@@ -159,7 +159,7 @@ gss_get_mic_v1(struct krb5_ctx *ctx, struct xdr_buf *text,
         return (ctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE;
 }
 
-u32
+static u32
 gss_get_mic_v2(struct krb5_ctx *ctx, struct xdr_buf *text,
                 struct xdr_netobj *token)
 {
diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c
index 2763e3e48db4..107c4528654f 100644
--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c
+++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
@@ -82,9 +82,9 @@ gss_krb5_remove_padding(struct xdr_buf *buf, int blocksize)
                                         >>PAGE_CACHE_SHIFT;
                 unsigned int offset = (buf->page_base + len - 1)
                                         & (PAGE_CACHE_SIZE - 1);
-                ptr = kmap_atomic(buf->pages[last], KM_USER0);
+                ptr = kmap_atomic(buf->pages[last]);
                 pad = *(ptr + offset);
-                kunmap_atomic(ptr, KM_USER0);
+                kunmap_atomic(ptr);
                 goto out;
         } else
                 len -= buf->page_len;
@@ -381,21 +381,53 @@ gss_unwrap_kerberos_v1(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf)
 }
 
 /*
- * We cannot currently handle tokens with rotated data.  We need a
- * generalized routine to rotate the data in place.  It is anticipated
- * that we won't encounter rotated data in the general case.
+ * We can shift data by up to LOCAL_BUF_LEN bytes in a pass.  If we need
+ * to do more than that, we shift repeatedly.  Kevin Coffman reports
+ * seeing 28 bytes as the value used by Microsoft clients and servers
+ * with AES, so this constant is chosen to allow handling 28 in one pass
+ * without using too much stack space.
+ *
+ * If that proves to a problem perhaps we could use a more clever
+ * algorithm.
  */
-static u32
-rotate_left(struct krb5_ctx *kctx, u32 offset, struct xdr_buf *buf, u16 rrc)
+#define LOCAL_BUF_LEN 32u
+
+static void rotate_buf_a_little(struct xdr_buf *buf, unsigned int shift)
 {
-        unsigned int realrrc = rrc % (buf->len - offset - GSS_KRB5_TOK_HDR_LEN);
+        char head[LOCAL_BUF_LEN];
+        char tmp[LOCAL_BUF_LEN];
+        unsigned int this_len, i;
+
+        BUG_ON(shift > LOCAL_BUF_LEN);
 
-        if (realrrc == 0)
-                return 0;
+        read_bytes_from_xdr_buf(buf, 0, head, shift);
+        for (i = 0; i + shift < buf->len; i += LOCAL_BUF_LEN) {
+                this_len = min(LOCAL_BUF_LEN, buf->len - (i + shift));
+                read_bytes_from_xdr_buf(buf, i+shift, tmp, this_len);
+                write_bytes_to_xdr_buf(buf, i, tmp, this_len);
+        }
+        write_bytes_to_xdr_buf(buf, buf->len - shift, head, shift);
+}
 
-        dprintk("%s: cannot process token with rotated data: "
-                "rrc %u, realrrc %u\n", __func__, rrc, realrrc);
-        return 1;
+static void _rotate_left(struct xdr_buf *buf, unsigned int shift)
+{
+        int shifted = 0;
+        int this_shift;
+
+        shift %= buf->len;
+        while (shifted < shift) {
+                this_shift = min(shift - shifted, LOCAL_BUF_LEN);
+                rotate_buf_a_little(buf, this_shift);
+                shifted += this_shift;
+        }
+}
+
+static void rotate_left(u32 base, struct xdr_buf *buf, unsigned int shift)
+{
+        struct xdr_buf subbuf;
+
+        xdr_buf_subsegment(buf, &subbuf, base, buf->len - base);
+        _rotate_left(&subbuf, shift);
 }
 
 static u32
@@ -495,11 +527,8 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf)
 
         seqnum = be64_to_cpup((__be64 *)(ptr + 8));
 
-        if (rrc != 0) {
-                err = rotate_left(kctx, offset, buf, rrc);
-                if (err)
-                        return GSS_S_FAILURE;
-        }
+        if (rrc != 0)
+                rotate_left(offset + 16, buf, rrc);
 
         err = (*kctx->gk5e->decrypt_v2)(kctx, offset, buf,
                                         &headskip, &tailskip);
diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c
index ca8cad8251c7..782bfe1b6465 100644
--- a/net/sunrpc/auth_gss/gss_mech_switch.c
+++ b/net/sunrpc/auth_gss/gss_mech_switch.c
@@ -242,12 +242,13 @@ EXPORT_SYMBOL_GPL(gss_mech_get_by_pseudoflavor);
 int gss_mech_list_pseudoflavors(rpc_authflavor_t *array_ptr)
 {
         struct gss_api_mech *pos = NULL;
-        int i = 0;
+        int j, i = 0;
 
         spin_lock(&registered_mechs_lock);
         list_for_each_entry(pos, &registered_mechs, gm_list) {
-                array_ptr[i] = pos->gm_pfs->pseudoflavor;
-                i++;
+                for (j=0; j < pos->gm_pf_num; j++) {
+                        array_ptr[i++] = pos->gm_pfs[j].pseudoflavor;
+                }
         }
         spin_unlock(&registered_mechs_lock);
         return i;
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 8d0f7d3c71c8..73e957386600 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -41,6 +41,7 @@
 #include <linux/types.h>
 #include <linux/module.h>
 #include <linux/pagemap.h>
+#include <linux/user_namespace.h>
 
 #include <linux/sunrpc/auth_gss.h>
 #include <linux/sunrpc/gss_err.h>
@@ -48,6 +49,8 @@
 #include <linux/sunrpc/svcauth_gss.h>
 #include <linux/sunrpc/cache.h>
 
+#include "../netns.h"
+
 #ifdef RPC_DEBUG
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
@@ -75,10 +78,8 @@ struct rsi {
         int                     major_status, minor_status;
 };
 
-static struct cache_head *rsi_table[RSI_HASHMAX];
-static struct cache_detail rsi_cache;
-static struct rsi *rsi_update(struct rsi *new, struct rsi *old);
-static struct rsi *rsi_lookup(struct rsi *item);
+static struct rsi *rsi_update(struct cache_detail *cd, struct rsi *new, struct rsi *old);
+static struct rsi *rsi_lookup(struct cache_detail *cd, struct rsi *item);
 
 static void rsi_free(struct rsi *rsii)
 {
@@ -216,7 +217,7 @@ static int rsi_parse(struct cache_detail *cd,
         if (dup_to_netobj(&rsii.in_token, buf, len))
                 goto out;
 
-        rsip = rsi_lookup(&rsii);
+        rsip = rsi_lookup(cd, &rsii);
         if (!rsip)
                 goto out;
 
@@ -258,21 +259,20 @@ static int rsi_parse(struct cache_detail *cd,
         if (dup_to_netobj(&rsii.out_token, buf, len))
                 goto out;
         rsii.h.expiry_time = expiry;
-        rsip = rsi_update(&rsii, rsip);
+        rsip = rsi_update(cd, &rsii, rsip);
         status = 0;
 out:
         rsi_free(&rsii);
         if (rsip)
-                cache_put(&rsip->h, &rsi_cache);
+                cache_put(&rsip->h, cd);
         else
                 status = -ENOMEM;
         return status;
 }
 
-static struct cache_detail rsi_cache = {
+static struct cache_detail rsi_cache_template = {
         .owner          = THIS_MODULE,
         .hash_size      = RSI_HASHMAX,
-        .hash_table     = rsi_table,
         .name           = "auth.rpcsec.init",
         .cache_put      = rsi_put,
         .cache_upcall   = rsi_upcall,
@@ -283,24 +283,24 @@ static struct cache_detail rsi_cache = {
         .alloc          = rsi_alloc,
 };
 
-static struct rsi *rsi_lookup(struct rsi *item)
+static struct rsi *rsi_lookup(struct cache_detail *cd, struct rsi *item)
 {
         struct cache_head *ch;
         int hash = rsi_hash(item);
 
-        ch = sunrpc_cache_lookup(&rsi_cache, &item->h, hash);
+        ch = sunrpc_cache_lookup(cd, &item->h, hash);
         if (ch)
                 return container_of(ch, struct rsi, h);
         else
                 return NULL;
 }
 
-static struct rsi *rsi_update(struct rsi *new, struct rsi *old)
+static struct rsi *rsi_update(struct cache_detail *cd, struct rsi *new, struct rsi *old)
 {
         struct cache_head *ch;
         int hash = rsi_hash(new);
 
-        ch = sunrpc_cache_update(&rsi_cache, &new->h,
+        ch = sunrpc_cache_update(cd, &new->h,
                                  &old->h, hash);
         if (ch)
                 return container_of(ch, struct rsi, h);
@@ -336,22 +336,17 @@ struct rsc {
         struct svc_cred         cred;
         struct gss_svc_seq_data seqdata;
         struct gss_ctx          *mechctx;
-        char                    *client_name;
 };
 
-static struct cache_head *rsc_table[RSC_HASHMAX];
-static struct cache_detail rsc_cache;
-static struct rsc *rsc_update(struct rsc *new, struct rsc *old);
-static struct rsc *rsc_lookup(struct rsc *item);
+static struct rsc *rsc_update(struct cache_detail *cd, struct rsc *new, struct rsc *old);
+static struct rsc *rsc_lookup(struct cache_detail *cd, struct rsc *item);
 
 static void rsc_free(struct rsc *rsci)
 {
         kfree(rsci->handle.data);
         if (rsci->mechctx)
                 gss_delete_sec_context(&rsci->mechctx);
-        if (rsci->cred.cr_group_info)
-                put_group_info(rsci->cred.cr_group_info);
-        kfree(rsci->client_name);
+        free_svc_cred(&rsci->cred);
 }
 
 static void rsc_put(struct kref *ref)
@@ -389,7 +384,7 @@ rsc_init(struct cache_head *cnew, struct cache_head *ctmp)
         tmp->handle.data = NULL;
         new->mechctx = NULL;
         new->cred.cr_group_info = NULL;
-        new->client_name = NULL;
+        new->cred.cr_principal = NULL;
 }
 
 static void
@@ -404,8 +399,8 @@ update_rsc(struct cache_head *cnew, struct cache_head *ctmp)
         spin_lock_init(&new->seqdata.sd_lock);
         new->cred = tmp->cred;
         tmp->cred.cr_group_info = NULL;
-        new->client_name = tmp->client_name;
-        tmp->client_name = NULL;
+        new->cred.cr_principal = tmp->cred.cr_principal;
+        tmp->cred.cr_principal = NULL;
 }
 
 static struct cache_head *
@@ -444,7 +439,7 @@ static int rsc_parse(struct cache_detail *cd,
         if (expiry == 0)
                 goto out;
 
-        rscp = rsc_lookup(&rsci);
+        rscp = rsc_lookup(cd, &rsci);
         if (!rscp)
                 goto out;
 
@@ -473,9 +468,13 @@ static int rsc_parse(struct cache_detail *cd,
                 status = -EINVAL;
                 for (i=0; i<N; i++) {
                         gid_t gid;
+                        kgid_t kgid;
                         if (get_int(&mesg, &gid))
                                 goto out;
-                        GROUP_AT(rsci.cred.cr_group_info, i) = gid;
+                        kgid = make_kgid(&init_user_ns, gid);
+                        if (!gid_valid(kgid))
+                                goto out;
+                        GROUP_AT(rsci.cred.cr_group_info, i) = kgid;
                 }
 
                 /* mech name */
@@ -499,29 +498,28 @@ static int rsc_parse(struct cache_detail *cd,
                 /* get client name */
                 len = qword_get(&mesg, buf, mlen);
                 if (len > 0) {
-                        rsci.client_name = kstrdup(buf, GFP_KERNEL);
-                        if (!rsci.client_name)
+                        rsci.cred.cr_principal = kstrdup(buf, GFP_KERNEL);
+                        if (!rsci.cred.cr_principal)
                                 goto out;
                 }
 
         }
         rsci.h.expiry_time = expiry;
-        rscp = rsc_update(&rsci, rscp);
+        rscp = rsc_update(cd, &rsci, rscp);
         status = 0;
 out:
         gss_mech_put(gm);
         rsc_free(&rsci);
         if (rscp)
-                cache_put(&rscp->h, &rsc_cache);
+                cache_put(&rscp->h, cd);
         else
                 status = -ENOMEM;
         return status;
 }
 
-static struct cache_detail rsc_cache = {
+static struct cache_detail rsc_cache_template = {
         .owner          = THIS_MODULE,
         .hash_size      = RSC_HASHMAX,
-        .hash_table     = rsc_table,
         .name           = "auth.rpcsec.context",
         .cache_put      = rsc_put,
         .cache_parse    = rsc_parse,
@@ -531,24 +529,24 @@ static struct cache_detail rsc_cache = {
         .alloc          = rsc_alloc,
 };
 
-static struct rsc *rsc_lookup(struct rsc *item)
+static struct rsc *rsc_lookup(struct cache_detail *cd, struct rsc *item)
 {
         struct cache_head *ch;
         int hash = rsc_hash(item);
 
-        ch = sunrpc_cache_lookup(&rsc_cache, &item->h, hash);
+        ch = sunrpc_cache_lookup(cd, &item->h, hash);
         if (ch)
                 return container_of(ch, struct rsc, h);
         else
                 return NULL;
 }
 
-static struct rsc *rsc_update(struct rsc *new, struct rsc *old)
+static struct rsc *rsc_update(struct cache_detail *cd, struct rsc *new, struct rsc *old)
 {
         struct cache_head *ch;
         int hash = rsc_hash(new);
 
-        ch = sunrpc_cache_update(&rsc_cache, &new->h,
+        ch = sunrpc_cache_update(cd, &new->h,
                                  &old->h, hash);
         if (ch)
                 return container_of(ch, struct rsc, h);
@@ -558,7 +556,7 @@ static struct rsc *rsc_update(struct rsc *new, struct rsc *old)
 
 
 static struct rsc *
-gss_svc_searchbyctx(struct xdr_netobj *handle)
+gss_svc_searchbyctx(struct cache_detail *cd, struct xdr_netobj *handle)
 {
         struct rsc rsci;
         struct rsc *found;
@@ -566,11 +564,11 @@ gss_svc_searchbyctx(struct xdr_netobj *handle)
         memset(&rsci, 0, sizeof(rsci));
         if (dup_to_netobj(&rsci.handle, handle->data, handle->len))
                 return NULL;
-        found = rsc_lookup(&rsci);
+        found = rsc_lookup(cd, &rsci);
         rsc_free(&rsci);
         if (!found)
                 return NULL;
-        if (cache_check(&rsc_cache, &found->h, NULL))
+        if (cache_check(cd, &found->h, NULL))
                 return NULL;
         return found;
 }
@@ -931,16 +929,6 @@ struct gss_svc_data {
         struct rsc                      *rsci;
 };
 
-char *svc_gss_principal(struct svc_rqst *rqstp)
-{
-        struct gss_svc_data *gd = (struct gss_svc_data *)rqstp->rq_auth_data;
-
-        if (gd && gd->rsci)
-                return gd->rsci->client_name;
-        return NULL;
-}
-EXPORT_SYMBOL_GPL(svc_gss_principal);
-
 static int
 svcauth_gss_set_client(struct svc_rqst *rqstp)
 {
@@ -968,38 +956,31 @@ svcauth_gss_set_client(struct svc_rqst *rqstp)
 }
 
 static inline int
-gss_write_init_verf(struct svc_rqst *rqstp, struct rsi *rsip)
+gss_write_init_verf(struct cache_detail *cd, struct svc_rqst *rqstp,
+                struct xdr_netobj *out_handle, int *major_status)
 {
         struct rsc *rsci;
         int        rc;
 
-        if (rsip->major_status != GSS_S_COMPLETE)
+        if (*major_status != GSS_S_COMPLETE)
                 return gss_write_null_verf(rqstp);
-        rsci = gss_svc_searchbyctx(&rsip->out_handle);
+        rsci = gss_svc_searchbyctx(cd, out_handle);
         if (rsci == NULL) {
-                rsip->major_status = GSS_S_NO_CONTEXT;
+                *major_status = GSS_S_NO_CONTEXT;
                 return gss_write_null_verf(rqstp);
         }
         rc = gss_write_verf(rqstp, rsci->mechctx, GSS_SEQ_WIN);
-        cache_put(&rsci->h, &rsc_cache);
+        cache_put(&rsci->h, cd);
         return rc;
 }
 
-/*
- * Having read the cred already and found we're in the context
- * initiation case, read the verifier and initiate (or check the results
- * of) upcalls to userspace for help with context initiation.  If
- * the upcall results are available, write the verifier and result.
- * Otherwise, drop the request pending an answer to the upcall.
- */
-static int svcauth_gss_handle_init(struct svc_rqst *rqstp,
-                        struct rpc_gss_wire_cred *gc, __be32 *authp)
+static inline int
+gss_read_verf(struct rpc_gss_wire_cred *gc,
+              struct kvec *argv, __be32 *authp,
+              struct xdr_netobj *in_handle,
+              struct xdr_netobj *in_token)
 {
-        struct kvec *argv = &rqstp->rq_arg.head[0];
-        struct kvec *resv = &rqstp->rq_res.head[0];
         struct xdr_netobj tmpobj;
-        struct rsi *rsip, rsikey;
-        int ret;
 
         /* Read the verifier; should be NULL: */
         *authp = rpc_autherr_badverf;
@@ -1009,53 +990,89 @@ static int svcauth_gss_handle_init(struct svc_rqst *rqstp,
                 return SVC_DENIED;
         if (svc_getnl(argv) != 0)
                 return SVC_DENIED;
-
         /* Martial context handle and token for upcall: */
         *authp = rpc_autherr_badcred;
         if (gc->gc_proc == RPC_GSS_PROC_INIT && gc->gc_ctx.len != 0)
                 return SVC_DENIED;
-        memset(&rsikey, 0, sizeof(rsikey));
-        if (dup_netobj(&rsikey.in_handle, &gc->gc_ctx))
+        if (dup_netobj(in_handle, &gc->gc_ctx))
                 return SVC_CLOSE;
         *authp = rpc_autherr_badverf;
         if (svc_safe_getnetobj(argv, &tmpobj)) {
-                kfree(rsikey.in_handle.data);
+                kfree(in_handle->data);
                 return SVC_DENIED;
         }
-        if (dup_netobj(&rsikey.in_token, &tmpobj)) {
-                kfree(rsikey.in_handle.data);
+        if (dup_netobj(in_token, &tmpobj)) {
+                kfree(in_handle->data);
                 return SVC_CLOSE;
         }
 
+        return 0;
+}
+
+static inline int
+gss_write_resv(struct kvec *resv, size_t size_limit,
+               struct xdr_netobj *out_handle, struct xdr_netobj *out_token,
+               int major_status, int minor_status)
+{
+        if (resv->iov_len + 4 > size_limit)
+                return -1;
+        svc_putnl(resv, RPC_SUCCESS);
+        if (svc_safe_putnetobj(resv, out_handle))
+                return -1;
+        if (resv->iov_len + 3 * 4 > size_limit)
+                return -1;
+        svc_putnl(resv, major_status);
+        svc_putnl(resv, minor_status);
+        svc_putnl(resv, GSS_SEQ_WIN);
+        if (svc_safe_putnetobj(resv, out_token))
+                return -1;
+        return 0;
+}
+
+/*
+ * Having read the cred already and found we're in the context
+ * initiation case, read the verifier and initiate (or check the results
+ * of) upcalls to userspace for help with context initiation.  If
+ * the upcall results are available, write the verifier and result.
+ * Otherwise, drop the request pending an answer to the upcall.
+ */
+static int svcauth_gss_handle_init(struct svc_rqst *rqstp,
+                        struct rpc_gss_wire_cred *gc, __be32 *authp)
+{
+        struct kvec *argv = &rqstp->rq_arg.head[0];
+        struct kvec *resv = &rqstp->rq_res.head[0];
+        struct rsi *rsip, rsikey;
+        int ret;
+        struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id);
+
+        memset(&rsikey, 0, sizeof(rsikey));
+        ret = gss_read_verf(gc, argv, authp,
+                            &rsikey.in_handle, &rsikey.in_token);
+        if (ret)
+                return ret;
+
         /* Perform upcall, or find upcall result: */
-        rsip = rsi_lookup(&rsikey);
+        rsip = rsi_lookup(sn->rsi_cache, &rsikey);
         rsi_free(&rsikey);
         if (!rsip)
                 return SVC_CLOSE;
-        if (cache_check(&rsi_cache, &rsip->h, &rqstp->rq_chandle) < 0)
+        if (cache_check(sn->rsi_cache, &rsip->h, &rqstp->rq_chandle) < 0)
                 /* No upcall result: */
                 return SVC_CLOSE;
 
         ret = SVC_CLOSE;
         /* Got an answer to the upcall; use it: */
-        if (gss_write_init_verf(rqstp, rsip))
-                goto out;
-        if (resv->iov_len + 4 > PAGE_SIZE)
-                goto out;
-        svc_putnl(resv, RPC_SUCCESS);
-        if (svc_safe_putnetobj(resv, &rsip->out_handle))
+        if (gss_write_init_verf(sn->rsc_cache, rqstp,
+                                &rsip->out_handle, &rsip->major_status))
                 goto out;
-        if (resv->iov_len + 3 * 4 > PAGE_SIZE)
-                goto out;
-        svc_putnl(resv, rsip->major_status);
-        svc_putnl(resv, rsip->minor_status);
-        svc_putnl(resv, GSS_SEQ_WIN);
-        if (svc_safe_putnetobj(resv, &rsip->out_token))
+        if (gss_write_resv(resv, PAGE_SIZE,
+                           &rsip->out_handle, &rsip->out_token,
+                           rsip->major_status, rsip->minor_status))
                 goto out;
 
         ret = SVC_COMPLETE;
 out:
-        cache_put(&rsip->h, &rsi_cache);
+        cache_put(&rsip->h, sn->rsi_cache);
         return ret;
 }
 
@@ -1079,6 +1096,7 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
         __be32          *rpcstart;
         __be32          *reject_stat = resv->iov_base + resv->iov_len;
         int             ret;
+        struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id);
 
         dprintk("RPC:       svcauth_gss: argv->iov_len = %zd\n",
                         argv->iov_len);
@@ -1129,7 +1147,7 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
         case RPC_GSS_PROC_DESTROY:
                 /* Look up the context, and check the verifier: */
                 *authp = rpcsec_gsserr_credproblem;
-                rsci = gss_svc_searchbyctx(&gc->gc_ctx);
+                rsci = gss_svc_searchbyctx(sn->rsc_cache, &gc->gc_ctx);
                 if (!rsci)
                         goto auth_err;
                 switch (gss_verify_header(rqstp, rsci, rpcstart, gc, authp)) {
@@ -1189,7 +1207,7 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
                 }
                 svcdata->rsci = rsci;
                 cache_get(&rsci->h);
-                rqstp->rq_flavor = gss_svc_to_pseudoflavor(
+                rqstp->rq_cred.cr_flavor = gss_svc_to_pseudoflavor(
                                         rsci->mechctx->mech_type, gc->gc_svc);
                 ret = SVC_OK;
                 goto out;
@@ -1209,7 +1227,7 @@ drop:
         ret = SVC_DROP;
 out:
         if (rsci)
-                cache_put(&rsci->h, &rsc_cache);
+                cache_put(&rsci->h, sn->rsc_cache);
         return ret;
 }
 
@@ -1362,6 +1380,7 @@ svcauth_gss_release(struct svc_rqst *rqstp)
         struct rpc_gss_wire_cred *gc = &gsd->clcred;
         struct xdr_buf *resbuf = &rqstp->rq_res;
         int stat = -EINVAL;
+        struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id);
 
         if (gc->gc_proc != RPC_GSS_PROC_DATA)
                 goto out;
@@ -1404,7 +1423,7 @@ out_err:
                 put_group_info(rqstp->rq_cred.cr_group_info);
         rqstp->rq_cred.cr_group_info = NULL;
         if (gsd->rsci)
-                cache_put(&gsd->rsci->h, &rsc_cache);
+                cache_put(&gsd->rsci->h, sn->rsc_cache);
         gsd->rsci = NULL;
 
         return stat;
@@ -1429,30 +1448,96 @@ static struct auth_ops svcauthops_gss = {
         .set_client     = svcauth_gss_set_client,
 };
 
+static int rsi_cache_create_net(struct net *net)
+{
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+        struct cache_detail *cd;
+        int err;
+
+        cd = cache_create_net(&rsi_cache_template, net);
+        if (IS_ERR(cd))
+                return PTR_ERR(cd);
+        err = cache_register_net(cd, net);
+        if (err) {
+                cache_destroy_net(cd, net);
+                return err;
+        }
+        sn->rsi_cache = cd;
+        return 0;
+}
+
+static void rsi_cache_destroy_net(struct net *net)
+{
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+        struct cache_detail *cd = sn->rsi_cache;
+
+        sn->rsi_cache = NULL;
+        cache_purge(cd);
+        cache_unregister_net(cd, net);
+        cache_destroy_net(cd, net);
+}
+
+static int rsc_cache_create_net(struct net *net)
+{
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+        struct cache_detail *cd;
+        int err;
+
+        cd = cache_create_net(&rsc_cache_template, net);
+        if (IS_ERR(cd))
+                return PTR_ERR(cd);
+        err = cache_register_net(cd, net);
+        if (err) {
+                cache_destroy_net(cd, net);
+                return err;
+        }
+        sn->rsc_cache = cd;
+        return 0;
+}
+
+static void rsc_cache_destroy_net(struct net *net)
+{
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+        struct cache_detail *cd = sn->rsc_cache;
+
+        sn->rsc_cache = NULL;
+        cache_purge(cd);
+        cache_unregister_net(cd, net);
+        cache_destroy_net(cd, net);
+}
+
 int
-gss_svc_init(void)
+gss_svc_init_net(struct net *net)
 {
-        int rv = svc_auth_register(RPC_AUTH_GSS, &svcauthops_gss);
+        int rv;
+
+        rv = rsc_cache_create_net(net);
         if (rv)
                 return rv;
-        rv = cache_register(&rsc_cache);
+        rv = rsi_cache_create_net(net);
         if (rv)
                 goto out1;
-        rv = cache_register(&rsi_cache);
-        if (rv)
-                goto out2;
         return 0;
-out2:
-        cache_unregister(&rsc_cache);
 out1:
-        svc_auth_unregister(RPC_AUTH_GSS);
+        rsc_cache_destroy_net(net);
         return rv;
 }
 
 void
+gss_svc_shutdown_net(struct net *net)
+{
+        rsi_cache_destroy_net(net);
+        rsc_cache_destroy_net(net);
+}
+
+int
+gss_svc_init(void)
+{
+        return svc_auth_register(RPC_AUTH_GSS, &svcauthops_gss);
+}
+
+void
 gss_svc_shutdown(void)
 {
-        cache_unregister(&rsc_cache);
-        cache_unregister(&rsi_cache);
         svc_auth_unregister(RPC_AUTH_GSS);
 }
diff --git a/net/sunrpc/auth_unix.c b/net/sunrpc/auth_unix.c
index e50502d8ceb7..52c5abdee211 100644
--- a/net/sunrpc/auth_unix.c
+++ b/net/sunrpc/auth_unix.c
@@ -12,6 +12,7 @@
 #include <linux/module.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/auth.h>
+#include <linux/user_namespace.h>
 
 #define NFS_NGROUPS     16
 
@@ -78,8 +79,11 @@ unx_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
                 groups = NFS_NGROUPS;
 
         cred->uc_gid = acred->gid;
-        for (i = 0; i < groups; i++)
-                cred->uc_gids[i] = GROUP_AT(acred->group_info, i);
+        for (i = 0; i < groups; i++) {
+                gid_t gid;
+                gid = from_kgid(&init_user_ns, GROUP_AT(acred->group_info, i));
+                cred->uc_gids[i] = gid;
+        }
         if (i < NFS_NGROUPS)
                 cred->uc_gids[i] = NOGROUP;
 
@@ -126,9 +130,12 @@ unx_match(struct auth_cred *acred, struct rpc_cred *rcred, int flags)
                 groups = acred->group_info->ngroups;
         if (groups > NFS_NGROUPS)
                 groups = NFS_NGROUPS;
-        for (i = 0; i < groups ; i++)
-                if (cred->uc_gids[i] != GROUP_AT(acred->group_info, i))
+        for (i = 0; i < groups ; i++) {
+                gid_t gid;
+                gid = from_kgid(&init_user_ns, GROUP_AT(acred->group_info, i));
+                if (cred->uc_gids[i] != gid)
                         return 0;
+        }
         if (groups < NFS_NGROUPS &&
             cred->uc_gids[groups] != NOGROUP)
                 return 0;
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 3ad435a14ada..31def68a0f6e 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -25,6 +25,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #include <linux/slab.h>
 #include <linux/sunrpc/xprt.h>
 #include <linux/export.h>
+#include <linux/sunrpc/bc_xprt.h>
 
 #ifdef RPC_DEBUG
 #define RPCDBG_FACILITY RPCDBG_TRANS
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 465df9ae1046..47ad2666fdf6 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -344,7 +344,7 @@ static int current_index;
 static void do_cache_clean(struct work_struct *work);
 static struct delayed_work cache_cleaner;
 
-static void sunrpc_init_cache_detail(struct cache_detail *cd)
+void sunrpc_init_cache_detail(struct cache_detail *cd)
 {
         rwlock_init(&cd->hash_lock);
         INIT_LIST_HEAD(&cd->queue);
@@ -360,8 +360,9 @@ static void sunrpc_init_cache_detail(struct cache_detail *cd)
         /* start the cleaning process */
         schedule_delayed_work(&cache_cleaner, 0);
 }
+EXPORT_SYMBOL_GPL(sunrpc_init_cache_detail);
 
-static void sunrpc_destroy_cache_detail(struct cache_detail *cd)
+void sunrpc_destroy_cache_detail(struct cache_detail *cd)
 {
         cache_purge(cd);
         spin_lock(&cache_list_lock);
@@ -384,6 +385,7 @@ static void sunrpc_destroy_cache_detail(struct cache_detail *cd)
 out:
         printk(KERN_ERR "nfsd: failed to unregister %s cache\n", cd->name);
 }
+EXPORT_SYMBOL_GPL(sunrpc_destroy_cache_detail);
 
 /* clean cache tries to find something to clean
  * and cleans it.
@@ -828,6 +830,8 @@ static ssize_t cache_do_downcall(char *kaddr, const char __user *buf,
 {
         ssize_t ret;
 
+        if (count == 0)
+                return -EINVAL;
         if (copy_from_user(kaddr, buf, count))
                 return -EFAULT;
         kaddr[count] = '\0';
@@ -1269,7 +1273,7 @@ static void *c_start(struct seq_file *m, loff_t *pos)
         __acquires(cd->hash_lock)
 {
         loff_t n = *pos;
-        unsigned hash, entry;
+        unsigned int hash, entry;
         struct cache_head *ch;
         struct cache_detail *cd = ((struct handle*)m->private)->cd;
 
@@ -1643,12 +1647,6 @@ int cache_register_net(struct cache_detail *cd, struct net *net)
 }
 EXPORT_SYMBOL_GPL(cache_register_net);
 
-int cache_register(struct cache_detail *cd)
-{
-        return cache_register_net(cd, &init_net);
-}
-EXPORT_SYMBOL_GPL(cache_register);
-
 void cache_unregister_net(struct cache_detail *cd, struct net *net)
 {
         remove_cache_proc_entries(cd, net);
@@ -1656,11 +1654,31 @@ void cache_unregister_net(struct cache_detail *cd, struct net *net)
 }
 EXPORT_SYMBOL_GPL(cache_unregister_net);
 
-void cache_unregister(struct cache_detail *cd)
+struct cache_detail *cache_create_net(struct cache_detail *tmpl, struct net *net)
+{
+        struct cache_detail *cd;
+
+        cd = kmemdup(tmpl, sizeof(struct cache_detail), GFP_KERNEL);
+        if (cd == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        cd->hash_table = kzalloc(cd->hash_size * sizeof(struct cache_head *),
+                                 GFP_KERNEL);
+        if (cd->hash_table == NULL) {
+                kfree(cd);
+                return ERR_PTR(-ENOMEM);
+        }
+        cd->net = net;
+        return cd;
+}
+EXPORT_SYMBOL_GPL(cache_create_net);
+
+void cache_destroy_net(struct cache_detail *cd, struct net *net)
 {
-        cache_unregister_net(cd, &init_net);
+        kfree(cd->hash_table);
+        kfree(cd);
 }
-EXPORT_SYMBOL_GPL(cache_unregister);
+EXPORT_SYMBOL_GPL(cache_destroy_net);
 
 static ssize_t cache_read_pipefs(struct file *filp, char __user *buf,
                                  size_t count, loff_t *ppos)
@@ -1787,17 +1805,14 @@ int sunrpc_cache_register_pipefs(struct dentry *parent,
         struct dentry *dir;
         int ret = 0;
 
-        sunrpc_init_cache_detail(cd);
         q.name = name;
         q.len = strlen(name);
         q.hash = full_name_hash(q.name, q.len);
         dir = rpc_create_cache_dir(parent, &q, umode, cd);
         if (!IS_ERR(dir))
                 cd->u.pipefs.dir = dir;
-        else {
-                sunrpc_destroy_cache_detail(cd);
+        else
                 ret = PTR_ERR(dir);
-        }
         return ret;
 }
 EXPORT_SYMBOL_GPL(sunrpc_cache_register_pipefs);
@@ -1806,7 +1821,6 @@ void sunrpc_cache_unregister_pipefs(struct cache_detail *cd)
 {
         rpc_remove_cache_dir(cd->u.pipefs.dir);
         cd->u.pipefs.dir = NULL;
-        sunrpc_destroy_cache_detail(cd);
 }
 EXPORT_SYMBOL_GPL(sunrpc_cache_unregister_pipefs);
 
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index f0268ea7e711..f56f045778ae 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -17,7 +17,6 @@
  *  Copyright (C) 1995,1996 Olaf Kirch <okir@monad.swb.de>
  */
 
-#include <asm/system.h>
 
 #include <linux/module.h>
 #include <linux/types.h>
@@ -31,13 +30,16 @@
 #include <linux/in.h>
 #include <linux/in6.h>
 #include <linux/un.h>
+#include <linux/rcupdate.h>
 
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/rpc_pipe_fs.h>
 #include <linux/sunrpc/metrics.h>
 #include <linux/sunrpc/bc_xprt.h>
+#include <trace/events/sunrpc.h>
 
 #include "sunrpc.h"
+#include "netns.h"
 
 #ifdef RPC_DEBUG
 # define RPCDBG_FACILITY        RPCDBG_CALL
@@ -50,8 +52,6 @@
 /*
  * All RPC clients are linked into this list
  */
-static LIST_HEAD(all_clients);
-static DEFINE_SPINLOCK(rpc_client_lock);
 
 static DECLARE_WAIT_QUEUE_HEAD(destroy_wait);
 
@@ -81,82 +81,219 @@ static int	rpc_ping(struct rpc_clnt *clnt);
 
 static void rpc_register_client(struct rpc_clnt *clnt)
 {
-        spin_lock(&rpc_client_lock);
-        list_add(&clnt->cl_clients, &all_clients);
-        spin_unlock(&rpc_client_lock);
+        struct net *net = rpc_net_ns(clnt);
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+
+        spin_lock(&sn->rpc_client_lock);
+        list_add(&clnt->cl_clients, &sn->all_clients);
+        spin_unlock(&sn->rpc_client_lock);
 }
 
 static void rpc_unregister_client(struct rpc_clnt *clnt)
 {
-        spin_lock(&rpc_client_lock);
+        struct net *net = rpc_net_ns(clnt);
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+
+        spin_lock(&sn->rpc_client_lock);
         list_del(&clnt->cl_clients);
-        spin_unlock(&rpc_client_lock);
+        spin_unlock(&sn->rpc_client_lock);
 }
 
-static int
-rpc_setup_pipedir(struct rpc_clnt *clnt, char *dir_name)
+static void __rpc_clnt_remove_pipedir(struct rpc_clnt *clnt)
+{
+        if (clnt->cl_dentry) {
+                if (clnt->cl_auth && clnt->cl_auth->au_ops->pipes_destroy)
+                        clnt->cl_auth->au_ops->pipes_destroy(clnt->cl_auth);
+                rpc_remove_client_dir(clnt->cl_dentry);
+        }
+        clnt->cl_dentry = NULL;
+}
+
+static void rpc_clnt_remove_pipedir(struct rpc_clnt *clnt)
+{
+        struct net *net = rpc_net_ns(clnt);
+        struct super_block *pipefs_sb;
+
+        pipefs_sb = rpc_get_sb_net(net);
+        if (pipefs_sb) {
+                __rpc_clnt_remove_pipedir(clnt);
+                rpc_put_sb_net(net);
+        }
+}
+
+static struct dentry *rpc_setup_pipedir_sb(struct super_block *sb,
+                                    struct rpc_clnt *clnt,
+                                    const char *dir_name)
 {
         static uint32_t clntid;
-        struct path path, dir;
         char name[15];
-        struct qstr q = {
-                .name = name,
-        };
+        struct qstr q = { .name = name };
+        struct dentry *dir, *dentry;
         int error;
 
-        clnt->cl_path.mnt = ERR_PTR(-ENOENT);
-        clnt->cl_path.dentry = ERR_PTR(-ENOENT);
-        if (dir_name == NULL)
-                return 0;
-
-        path.mnt = rpc_get_mount();
-        if (IS_ERR(path.mnt))
-                return PTR_ERR(path.mnt);
-        error = vfs_path_lookup(path.mnt->mnt_root, path.mnt, dir_name, 0, &dir);
-        if (error)
-                goto err;
-
+        dir = rpc_d_lookup_sb(sb, dir_name);
+        if (dir == NULL)
+                return dir;
         for (;;) {
                 q.len = snprintf(name, sizeof(name), "clnt%x", (unsigned int)clntid++);
                 name[sizeof(name) - 1] = '\0';
                 q.hash = full_name_hash(q.name, q.len);
-                path.dentry = rpc_create_client_dir(dir.dentry, &q, clnt);
-                if (!IS_ERR(path.dentry))
+                dentry = rpc_create_client_dir(dir, &q, clnt);
+                if (!IS_ERR(dentry))
                         break;
-                error = PTR_ERR(path.dentry);
+                error = PTR_ERR(dentry);
                 if (error != -EEXIST) {
                         printk(KERN_INFO "RPC: Couldn't create pipefs entry"
                                         " %s/%s, error %d\n",
                                         dir_name, name, error);
-                        goto err_path_put;
+                        break;
                 }
         }
-        path_put(&dir);
-        clnt->cl_path = path;
+        dput(dir);
+        return dentry;
+}
+
+static int
+rpc_setup_pipedir(struct rpc_clnt *clnt, const char *dir_name)
+{
+        struct net *net = rpc_net_ns(clnt);
+        struct super_block *pipefs_sb;
+        struct dentry *dentry;
+
+        clnt->cl_dentry = NULL;
+        if (dir_name == NULL)
+                return 0;
+        pipefs_sb = rpc_get_sb_net(net);
+        if (!pipefs_sb)
+                return 0;
+        dentry = rpc_setup_pipedir_sb(pipefs_sb, clnt, dir_name);
+        rpc_put_sb_net(net);
+        if (IS_ERR(dentry))
+                return PTR_ERR(dentry);
+        clnt->cl_dentry = dentry;
         return 0;
-err_path_put:
-        path_put(&dir);
-err:
-        rpc_put_mount();
+}
+
+static inline int rpc_clnt_skip_event(struct rpc_clnt *clnt, unsigned long event)
+{
+        if (((event == RPC_PIPEFS_MOUNT) && clnt->cl_dentry) ||
+            ((event == RPC_PIPEFS_UMOUNT) && !clnt->cl_dentry))
+                return 1;
+        return 0;
+}
+
+static int __rpc_clnt_handle_event(struct rpc_clnt *clnt, unsigned long event,
+                                   struct super_block *sb)
+{
+        struct dentry *dentry;
+        int err = 0;
+
+        switch (event) {
+        case RPC_PIPEFS_MOUNT:
+                dentry = rpc_setup_pipedir_sb(sb, clnt,
+                                              clnt->cl_program->pipe_dir_name);
+                BUG_ON(dentry == NULL);
+                if (IS_ERR(dentry))
+                        return PTR_ERR(dentry);
+                clnt->cl_dentry = dentry;
+                if (clnt->cl_auth->au_ops->pipes_create) {
+                        err = clnt->cl_auth->au_ops->pipes_create(clnt->cl_auth);
+                        if (err)
+                                __rpc_clnt_remove_pipedir(clnt);
+                }
+                break;
+        case RPC_PIPEFS_UMOUNT:
+                __rpc_clnt_remove_pipedir(clnt);
+                break;
+        default:
+                printk(KERN_ERR "%s: unknown event: %ld\n", __func__, event);
+                return -ENOTSUPP;
+        }
+        return err;
+}
+
+static int __rpc_pipefs_event(struct rpc_clnt *clnt, unsigned long event,
+                                struct super_block *sb)
+{
+        int error = 0;
+
+        for (;; clnt = clnt->cl_parent) {
+                if (!rpc_clnt_skip_event(clnt, event))
+                        error = __rpc_clnt_handle_event(clnt, event, sb);
+                if (error || clnt == clnt->cl_parent)
+                        break;
+        }
         return error;
 }
 
+static struct rpc_clnt *rpc_get_client_for_event(struct net *net, int event)
+{
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+        struct rpc_clnt *clnt;
+
+        spin_lock(&sn->rpc_client_lock);
+        list_for_each_entry(clnt, &sn->all_clients, cl_clients) {
+                if (clnt->cl_program->pipe_dir_name == NULL)
+                        break;
+                if (rpc_clnt_skip_event(clnt, event))
+                        continue;
+                if (atomic_inc_not_zero(&clnt->cl_count) == 0)
+                        continue;
+                spin_unlock(&sn->rpc_client_lock);
+                return clnt;
+        }
+        spin_unlock(&sn->rpc_client_lock);
+        return NULL;
+}
+
+static int rpc_pipefs_event(struct notifier_block *nb, unsigned long event,
+                            void *ptr)
+{
+        struct super_block *sb = ptr;
+        struct rpc_clnt *clnt;
+        int error = 0;
+
+        while ((clnt = rpc_get_client_for_event(sb->s_fs_info, event))) {
+                error = __rpc_pipefs_event(clnt, event, sb);
+                rpc_release_client(clnt);
+                if (error)
+                        break;
+        }
+        return error;
+}
+
+static struct notifier_block rpc_clients_block = {
+        .notifier_call  = rpc_pipefs_event,
+        .priority       = SUNRPC_PIPEFS_RPC_PRIO,
+};
+
+int rpc_clients_notifier_register(void)
+{
+        return rpc_pipefs_notifier_register(&rpc_clients_block);
+}
+
+void rpc_clients_notifier_unregister(void)
+{
+        return rpc_pipefs_notifier_unregister(&rpc_clients_block);
+}
+
+static void rpc_clnt_set_nodename(struct rpc_clnt *clnt, const char *nodename)
+{
+        clnt->cl_nodelen = strlen(nodename);
+        if (clnt->cl_nodelen > UNX_MAXNODENAME)
+                clnt->cl_nodelen = UNX_MAXNODENAME;
+        memcpy(clnt->cl_nodename, nodename, clnt->cl_nodelen);
+}
+
 static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, struct rpc_xprt *xprt)
 {
-        struct rpc_program      *program = args->program;
-        struct rpc_version      *version;
+        const struct rpc_program *program = args->program;
+        const struct rpc_version *version;
         struct rpc_clnt         *clnt = NULL;
         struct rpc_auth         *auth;
         int err;
-        size_t len;
 
         /* sanity check the name before trying to print it */
-        err = -EINVAL;
-        len = strlen(args->servername);
-        if (len > RPC_MAXNETNAMELEN)
-                goto out_no_rpciod;
-        len++;
-
         dprintk("RPC:       creating %s client for %s (xprt %p)\n",
                         program->name, args->servername, xprt);
 
@@ -179,17 +316,7 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
                 goto out_err;
         clnt->cl_parent = clnt;
 
-        clnt->cl_server = clnt->cl_inline_name;
-        if (len > sizeof(clnt->cl_inline_name)) {
-                char *buf = kmalloc(len, GFP_KERNEL);
-                if (buf != NULL)
-                        clnt->cl_server = buf;
-                else
-                        len = sizeof(clnt->cl_inline_name);
-        }
-        strlcpy(clnt->cl_server, args->servername, len);
-
-        clnt->cl_xprt     = xprt;
+        rcu_assign_pointer(clnt->cl_xprt, xprt);
         clnt->cl_procinfo = version->procs;
         clnt->cl_maxproc  = version->nrprocs;
         clnt->cl_protname = program->name;
@@ -204,7 +331,7 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
         INIT_LIST_HEAD(&clnt->cl_tasks);
         spin_lock_init(&clnt->cl_lock);
 
-        if (!xprt_bound(clnt->cl_xprt))
+        if (!xprt_bound(xprt))
                 clnt->cl_autobind = 1;
 
         clnt->cl_timeout = xprt->timeout;
@@ -238,25 +365,17 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
         }
 
         /* save the nodename */
-        clnt->cl_nodelen = strlen(init_utsname()->nodename);
-        if (clnt->cl_nodelen > UNX_MAXNODENAME)
-                clnt->cl_nodelen = UNX_MAXNODENAME;
-        memcpy(clnt->cl_nodename, init_utsname()->nodename, clnt->cl_nodelen);
+        rpc_clnt_set_nodename(clnt, utsname()->nodename);
         rpc_register_client(clnt);
         return clnt;
 
 out_no_auth:
-        if (!IS_ERR(clnt->cl_path.dentry)) {
-                rpc_remove_client_dir(clnt->cl_path.dentry);
-                rpc_put_mount();
-        }
+        rpc_clnt_remove_pipedir(clnt);
 out_no_path:
         kfree(clnt->cl_principal);
 out_no_principal:
         rpc_free_iostats(clnt->cl_metrics);
 out_no_stats:
-        if (clnt->cl_server != clnt->cl_inline_name)
-                kfree(clnt->cl_server);
         kfree(clnt);
 out_err:
         xprt_put(xprt);
@@ -286,6 +405,7 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
                 .srcaddr = args->saddress,
                 .dstaddr = args->address,
                 .addrlen = args->addrsize,
+                .servername = args->servername,
                 .bc_xprt = args->bc_xprt,
         };
         char servername[48];
@@ -294,7 +414,7 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
          * If the caller chooses not to specify a hostname, whip
          * up a string representation of the passed-in address.
          */
-        if (args->servername == NULL) {
+        if (xprtargs.servername == NULL) {
                 struct sockaddr_un *sun =
                                 (struct sockaddr_un *)args->address;
                 struct sockaddr_in *sin =
@@ -321,7 +441,7 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
                          * address family isn't recognized. */
                         return ERR_PTR(-EINVAL);
                 }
-                args->servername = servername;
+                xprtargs.servername = servername;
         }
 
         xprt = xprt_create_transport(&xprtargs);
@@ -374,6 +494,7 @@ struct rpc_clnt *
 rpc_clone_client(struct rpc_clnt *clnt)
 {
         struct rpc_clnt *new;
+        struct rpc_xprt *xprt;
         int err = -ENOMEM;
 
         new = kmemdup(clnt, sizeof(*new), GFP_KERNEL);
@@ -393,18 +514,26 @@ rpc_clone_client(struct rpc_clnt *clnt)
                 if (new->cl_principal == NULL)
                         goto out_no_principal;
         }
+        rcu_read_lock();
+        xprt = xprt_get(rcu_dereference(clnt->cl_xprt));
+        rcu_read_unlock();
+        if (xprt == NULL)
+                goto out_no_transport;
+        rcu_assign_pointer(new->cl_xprt, xprt);
         atomic_set(&new->cl_count, 1);
         err = rpc_setup_pipedir(new, clnt->cl_program->pipe_dir_name);
         if (err != 0)
                 goto out_no_path;
+        rpc_clnt_set_nodename(new, utsname()->nodename);
         if (new->cl_auth)
                 atomic_inc(&new->cl_auth->au_count);
-        xprt_get(clnt->cl_xprt);
         atomic_inc(&clnt->cl_count);
         rpc_register_client(new);
         rpciod_up();
         return new;
 out_no_path:
+        xprt_put(xprt);
+out_no_transport:
         kfree(new->cl_principal);
 out_no_principal:
         rpc_free_iostats(new->cl_metrics);
@@ -453,8 +582,9 @@ EXPORT_SYMBOL_GPL(rpc_killall_tasks);
  */
 void rpc_shutdown_client(struct rpc_clnt *clnt)
 {
-        dprintk("RPC:       shutting down %s client for %s\n",
-                        clnt->cl_protname, clnt->cl_server);
+        dprintk_rcu("RPC:       shutting down %s client for %s\n",
+                        clnt->cl_protname,
+                        rcu_dereference(clnt->cl_xprt)->servername);
 
         while (!list_empty(&clnt->cl_tasks)) {
                 rpc_killall_tasks(clnt);
@@ -472,24 +602,17 @@ EXPORT_SYMBOL_GPL(rpc_shutdown_client);
 static void
 rpc_free_client(struct rpc_clnt *clnt)
 {
-        dprintk("RPC:       destroying %s client for %s\n",
-                        clnt->cl_protname, clnt->cl_server);
-        if (!IS_ERR(clnt->cl_path.dentry)) {
-                rpc_remove_client_dir(clnt->cl_path.dentry);
-                rpc_put_mount();
-        }
-        if (clnt->cl_parent != clnt) {
+        dprintk_rcu("RPC:       destroying %s client for %s\n",
+                        clnt->cl_protname,
+                        rcu_dereference(clnt->cl_xprt)->servername);
+        if (clnt->cl_parent != clnt)
                 rpc_release_client(clnt->cl_parent);
-                goto out_free;
-        }
-        if (clnt->cl_server != clnt->cl_inline_name)
-                kfree(clnt->cl_server);
-out_free:
         rpc_unregister_client(clnt);
+        rpc_clnt_remove_pipedir(clnt);
         rpc_free_iostats(clnt->cl_metrics);
         kfree(clnt->cl_principal);
         clnt->cl_metrics = NULL;
-        xprt_put(clnt->cl_xprt);
+        xprt_put(rcu_dereference_raw(clnt->cl_xprt));
         rpciod_down();
         kfree(clnt);
 }
@@ -542,11 +665,11 @@ rpc_release_client(struct rpc_clnt *clnt)
  * The Sun NFSv2/v3 ACL protocol can do this.
  */
 struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *old,
-                                      struct rpc_program *program,
+                                      const struct rpc_program *program,
                                       u32 vers)
 {
         struct rpc_clnt *clnt;
-        struct rpc_version *version;
+        const struct rpc_version *version;
         int err;
 
         BUG_ON(vers >= program->nrvers || !program->version[vers]);
@@ -778,13 +901,18 @@ EXPORT_SYMBOL_GPL(rpc_call_start);
 size_t rpc_peeraddr(struct rpc_clnt *clnt, struct sockaddr *buf, size_t bufsize)
 {
         size_t bytes;
-        struct rpc_xprt *xprt = clnt->cl_xprt;
+        struct rpc_xprt *xprt;
+
+        rcu_read_lock();
+        xprt = rcu_dereference(clnt->cl_xprt);
 
-        bytes = sizeof(xprt->addr);
+        bytes = xprt->addrlen;
         if (bytes > bufsize)
                 bytes = bufsize;
-        memcpy(buf, &clnt->cl_xprt->addr, bytes);
-        return xprt->addrlen;
+        memcpy(buf, &xprt->addr, bytes);
+        rcu_read_unlock();
+
+        return bytes;
 }
 EXPORT_SYMBOL_GPL(rpc_peeraddr);
 
@@ -793,11 +921,16 @@ EXPORT_SYMBOL_GPL(rpc_peeraddr);
  * @clnt: RPC client structure
  * @format: address format
  *
+ * NB: the lifetime of the memory referenced by the returned pointer is
+ * the same as the rpc_xprt itself.  As long as the caller uses this
+ * pointer, it must hold the RCU read lock.
  */
 const char *rpc_peeraddr2str(struct rpc_clnt *clnt,
                              enum rpc_display_format_t format)
 {
-        struct rpc_xprt *xprt = clnt->cl_xprt;
+        struct rpc_xprt *xprt;
+
+        xprt = rcu_dereference(clnt->cl_xprt);
 
         if (xprt->address_strings[format] != NULL)
                 return xprt->address_strings[format];
@@ -806,17 +939,203 @@ const char *rpc_peeraddr2str(struct rpc_clnt *clnt,
 }
 EXPORT_SYMBOL_GPL(rpc_peeraddr2str);
 
+static const struct sockaddr_in rpc_inaddr_loopback = {
+        .sin_family             = AF_INET,
+        .sin_addr.s_addr        = htonl(INADDR_ANY),
+};
+
+static const struct sockaddr_in6 rpc_in6addr_loopback = {
+        .sin6_family            = AF_INET6,
+        .sin6_addr              = IN6ADDR_ANY_INIT,
+};
+
+/*
+ * Try a getsockname() on a connected datagram socket.  Using a
+ * connected datagram socket prevents leaving a socket in TIME_WAIT.
+ * This conserves the ephemeral port number space.
+ *
+ * Returns zero and fills in "buf" if successful; otherwise, a
+ * negative errno is returned.
+ */
+static int rpc_sockname(struct net *net, struct sockaddr *sap, size_t salen,
+                        struct sockaddr *buf, int buflen)
+{
+        struct socket *sock;
+        int err;
+
+        err = __sock_create(net, sap->sa_family,
+                                SOCK_DGRAM, IPPROTO_UDP, &sock, 1);
+        if (err < 0) {
+                dprintk("RPC:       can't create UDP socket (%d)\n", err);
+                goto out;
+        }
+
+        switch (sap->sa_family) {
+        case AF_INET:
+                err = kernel_bind(sock,
+                                (struct sockaddr *)&rpc_inaddr_loopback,
+                                sizeof(rpc_inaddr_loopback));
+                break;
+        case AF_INET6:
+                err = kernel_bind(sock,
+                                (struct sockaddr *)&rpc_in6addr_loopback,
+                                sizeof(rpc_in6addr_loopback));
+                break;
+        default:
+                err = -EAFNOSUPPORT;
+                goto out;
+        }
+        if (err < 0) {
+                dprintk("RPC:       can't bind UDP socket (%d)\n", err);
+                goto out_release;
+        }
+
+        err = kernel_connect(sock, sap, salen, 0);
+        if (err < 0) {
+                dprintk("RPC:       can't connect UDP socket (%d)\n", err);
+                goto out_release;
+        }
+
+        err = kernel_getsockname(sock, buf, &buflen);
+        if (err < 0) {
+                dprintk("RPC:       getsockname failed (%d)\n", err);
+                goto out_release;
+        }
+
+        err = 0;
+        if (buf->sa_family == AF_INET6) {
+                struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)buf;
+                sin6->sin6_scope_id = 0;
+        }
+        dprintk("RPC:       %s succeeded\n", __func__);
+
+out_release:
+        sock_release(sock);
+out:
+        return err;
+}
+
+/*
+ * Scraping a connected socket failed, so we don't have a useable
+ * local address.  Fallback: generate an address that will prevent
+ * the server from calling us back.
+ *
+ * Returns zero and fills in "buf" if successful; otherwise, a
+ * negative errno is returned.
+ */
+static int rpc_anyaddr(int family, struct sockaddr *buf, size_t buflen)
+{
+        switch (family) {
+        case AF_INET:
+                if (buflen < sizeof(rpc_inaddr_loopback))
+                        return -EINVAL;
+                memcpy(buf, &rpc_inaddr_loopback,
+                                sizeof(rpc_inaddr_loopback));
+                break;
+        case AF_INET6:
+                if (buflen < sizeof(rpc_in6addr_loopback))
+                        return -EINVAL;
+                memcpy(buf, &rpc_in6addr_loopback,
+                                sizeof(rpc_in6addr_loopback));
+        default:
+                dprintk("RPC:       %s: address family not supported\n",
+                        __func__);
+                return -EAFNOSUPPORT;
+        }
+        dprintk("RPC:       %s: succeeded\n", __func__);
+        return 0;
+}
+
+/**
+ * rpc_localaddr - discover local endpoint address for an RPC client
+ * @clnt: RPC client structure
+ * @buf: target buffer
+ * @buflen: size of target buffer, in bytes
+ *
+ * Returns zero and fills in "buf" and "buflen" if successful;
+ * otherwise, a negative errno is returned.
+ *
+ * This works even if the underlying transport is not currently connected,
+ * or if the upper layer never previously provided a source address.
+ *
+ * The result of this function call is transient: multiple calls in
+ * succession may give different results, depending on how local
+ * networking configuration changes over time.
+ */
+int rpc_localaddr(struct rpc_clnt *clnt, struct sockaddr *buf, size_t buflen)
+{
+        struct sockaddr_storage address;
+        struct sockaddr *sap = (struct sockaddr *)&address;
+        struct rpc_xprt *xprt;
+        struct net *net;
+        size_t salen;
+        int err;
+
+        rcu_read_lock();
+        xprt = rcu_dereference(clnt->cl_xprt);
+        salen = xprt->addrlen;
+        memcpy(sap, &xprt->addr, salen);
+        net = get_net(xprt->xprt_net);
+        rcu_read_unlock();
+
+        rpc_set_port(sap, 0);
+        err = rpc_sockname(net, sap, salen, buf, buflen);
+        put_net(net);
+        if (err != 0)
+                /* Couldn't discover local address, return ANYADDR */
+                return rpc_anyaddr(sap->sa_family, buf, buflen);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rpc_localaddr);
+
 void
 rpc_setbufsize(struct rpc_clnt *clnt, unsigned int sndsize, unsigned int rcvsize)
 {
-        struct rpc_xprt *xprt = clnt->cl_xprt;
+        struct rpc_xprt *xprt;
+
+        rcu_read_lock();
+        xprt = rcu_dereference(clnt->cl_xprt);
         if (xprt->ops->set_buffer_size)
                 xprt->ops->set_buffer_size(xprt, sndsize, rcvsize);
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL_GPL(rpc_setbufsize);
 
-/*
- * Return size of largest payload RPC client can support, in bytes
+/**
+ * rpc_protocol - Get transport protocol number for an RPC client
+ * @clnt: RPC client to query
+ *
+ */
+int rpc_protocol(struct rpc_clnt *clnt)
+{
+        int protocol;
+
+        rcu_read_lock();
+        protocol = rcu_dereference(clnt->cl_xprt)->prot;
+        rcu_read_unlock();
+        return protocol;
+}
+EXPORT_SYMBOL_GPL(rpc_protocol);
+
+/**
+ * rpc_net_ns - Get the network namespace for this RPC client
+ * @clnt: RPC client to query
+ *
+ */
+struct net *rpc_net_ns(struct rpc_clnt *clnt)
+{
+        struct net *ret;
+
+        rcu_read_lock();
+        ret = rcu_dereference(clnt->cl_xprt)->xprt_net;
+        rcu_read_unlock();
+        return ret;
+}
+EXPORT_SYMBOL_GPL(rpc_net_ns);
+
+/**
+ * rpc_max_payload - Get maximum payload size for a transport, in bytes
+ * @clnt: RPC client to query
  *
  * For stream transports, this is one RPC record fragment (see RFC
  * 1831), as we don't support multi-record requests yet.  For datagram
@@ -825,7 +1144,12 @@ EXPORT_SYMBOL_GPL(rpc_setbufsize);
  */
 size_t rpc_max_payload(struct rpc_clnt *clnt)
 {
-        return clnt->cl_xprt->max_payload;
+        size_t ret;
+
+        rcu_read_lock();
+        ret = rcu_dereference(clnt->cl_xprt)->max_payload;
+        rcu_read_unlock();
+        return ret;
 }
 EXPORT_SYMBOL_GPL(rpc_max_payload);
 
@@ -836,8 +1160,11 @@ EXPORT_SYMBOL_GPL(rpc_max_payload);
  */
 void rpc_force_rebind(struct rpc_clnt *clnt)
 {
-        if (clnt->cl_autobind)
-                xprt_clear_bound(clnt->cl_xprt);
+        if (clnt->cl_autobind) {
+                rcu_read_lock();
+                xprt_clear_bound(rcu_dereference(clnt->cl_xprt));
+                rcu_read_unlock();
+        }
 }
 EXPORT_SYMBOL_GPL(rpc_force_rebind);
 
@@ -959,6 +1286,8 @@ call_reserveresult(struct rpc_task *task)
         }
 
         switch (status) {
+        case -ENOMEM:
+                rpc_delay(task, HZ >> 2);
         case -EAGAIN:   /* woken up; retry */
                 task->tk_action = call_reserve;
                 return;
@@ -1163,6 +1492,7 @@ call_bind_status(struct rpc_task *task)
                 return;
         }
 
+        trace_rpc_bind_status(task);
         switch (task->tk_status) {
         case -ENOMEM:
                 dprintk("RPC: %5u rpcbind out of memory\n", task->tk_pid);
@@ -1262,6 +1592,7 @@ call_connect_status(struct rpc_task *task)
                 return;
         }
 
+        trace_rpc_connect_status(task, status);
         switch (status) {
                 /* if soft mounted, test if we've timed out */
         case -ETIMEDOUT:
@@ -1450,6 +1781,7 @@ call_status(struct rpc_task *task)
                 return;
         }
 
+        trace_rpc_call_status(task);
         task->tk_status = 0;
         switch(status) {
         case -EHOSTDOWN:
@@ -1513,8 +1845,11 @@ call_timeout(struct rpc_task *task)
         }
         if (RPC_IS_SOFT(task)) {
                 if (clnt->cl_chatty)
+                        rcu_read_lock();
                         printk(KERN_NOTICE "%s: server %s not responding, timed out\n",
-                                clnt->cl_protname, clnt->cl_server);
+                                clnt->cl_protname,
+                                rcu_dereference(clnt->cl_xprt)->servername);
+                        rcu_read_unlock();
                 if (task->tk_flags & RPC_TASK_TIMEOUT)
                         rpc_exit(task, -ETIMEDOUT);
                 else
@@ -1524,9 +1859,13 @@ call_timeout(struct rpc_task *task)
 
         if (!(task->tk_flags & RPC_CALL_MAJORSEEN)) {
                 task->tk_flags |= RPC_CALL_MAJORSEEN;
-                if (clnt->cl_chatty)
+                if (clnt->cl_chatty) {
+                        rcu_read_lock();
                         printk(KERN_NOTICE "%s: server %s not responding, still trying\n",
-                        clnt->cl_protname, clnt->cl_server);
+                        clnt->cl_protname,
+                        rcu_dereference(clnt->cl_xprt)->servername);
+                        rcu_read_unlock();
+                }
         }
         rpc_force_rebind(clnt);
         /*
@@ -1555,9 +1894,13 @@ call_decode(struct rpc_task *task)
         dprint_status(task);
 
         if (task->tk_flags & RPC_CALL_MAJORSEEN) {
-                if (clnt->cl_chatty)
+                if (clnt->cl_chatty) {
+                        rcu_read_lock();
                         printk(KERN_NOTICE "%s: server %s OK\n",
-                                clnt->cl_protname, clnt->cl_server);
+                                clnt->cl_protname,
+                                rcu_dereference(clnt->cl_xprt)->servername);
+                        rcu_read_unlock();
+                }
                 task->tk_flags &= ~RPC_CALL_MAJORSEEN;
         }
 
@@ -1635,6 +1978,7 @@ rpc_encode_header(struct rpc_task *task)
 static __be32 *
 rpc_verify_header(struct rpc_task *task)
 {
+        struct rpc_clnt *clnt = task->tk_client;
         struct kvec *iov = &task->tk_rqstp->rq_rcv_buf.head[0];
         int len = task->tk_rqstp->rq_rcv_buf.len >> 2;
         __be32  *p = iov->iov_base;
@@ -1707,8 +2051,11 @@ rpc_verify_header(struct rpc_task *task)
                         task->tk_action = call_bind;
                         goto out_retry;
                 case RPC_AUTH_TOOWEAK:
+                        rcu_read_lock();
                         printk(KERN_NOTICE "RPC: server %s requires stronger "
-                               "authentication.\n", task->tk_client->cl_server);
+                               "authentication.\n",
+                               rcu_dereference(clnt->cl_xprt)->servername);
+                        rcu_read_unlock();
                         break;
                 default:
                         dprintk("RPC: %5u %s: unknown auth error: %x\n",
@@ -1731,28 +2078,27 @@ rpc_verify_header(struct rpc_task *task)
         case RPC_SUCCESS:
                 return p;
         case RPC_PROG_UNAVAIL:
-                dprintk("RPC: %5u %s: program %u is unsupported by server %s\n",
-                                task->tk_pid, __func__,
-                                (unsigned int)task->tk_client->cl_prog,
-                                task->tk_client->cl_server);
+                dprintk_rcu("RPC: %5u %s: program %u is unsupported "
+                                "by server %s\n", task->tk_pid, __func__,
+                                (unsigned int)clnt->cl_prog,
+                                rcu_dereference(clnt->cl_xprt)->servername);
                 error = -EPFNOSUPPORT;
                 goto out_err;
         case RPC_PROG_MISMATCH:
-                dprintk("RPC: %5u %s: program %u, version %u unsupported by "
-                                "server %s\n", task->tk_pid, __func__,
-                                (unsigned int)task->tk_client->cl_prog,
-                                (unsigned int)task->tk_client->cl_vers,
-                                task->tk_client->cl_server);
+                dprintk_rcu("RPC: %5u %s: program %u, version %u unsupported "
+                                "by server %s\n", task->tk_pid, __func__,
+                                (unsigned int)clnt->cl_prog,
+                                (unsigned int)clnt->cl_vers,
+                                rcu_dereference(clnt->cl_xprt)->servername);
                 error = -EPROTONOSUPPORT;
                 goto out_err;
         case RPC_PROC_UNAVAIL:
-                dprintk("RPC: %5u %s: proc %s unsupported by program %u, "
+                dprintk_rcu("RPC: %5u %s: proc %s unsupported by program %u, "
                                 "version %u on server %s\n",
                                 task->tk_pid, __func__,
                                 rpc_proc_name(task),
-                                task->tk_client->cl_prog,
-                                task->tk_client->cl_vers,
-                                task->tk_client->cl_server);
+                                clnt->cl_prog, clnt->cl_vers,
+                                rcu_dereference(clnt->cl_xprt)->servername);
                 error = -EOPNOTSUPP;
                 goto out_err;
         case RPC_GARBAGE_ARGS:
@@ -1766,7 +2112,7 @@ rpc_verify_header(struct rpc_task *task)
         }
 
 out_garbage:
-        task->tk_client->cl_stats->rpcgarbage++;
+        clnt->cl_stats->rpcgarbage++;
         if (task->tk_garb_retry) {
                 task->tk_garb_retry--;
                 dprintk("RPC: %5u %s: retrying\n",
@@ -1852,14 +2198,15 @@ static void rpc_show_task(const struct rpc_clnt *clnt,
                 task->tk_action, rpc_waitq);
 }
 
-void rpc_show_tasks(void)
+void rpc_show_tasks(struct net *net)
 {
         struct rpc_clnt *clnt;
         struct rpc_task *task;
         int header = 0;
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 
-        spin_lock(&rpc_client_lock);
-        list_for_each_entry(clnt, &all_clients, cl_clients) {
+        spin_lock(&sn->rpc_client_lock);
+        list_for_each_entry(clnt, &sn->all_clients, cl_clients) {
                 spin_lock(&clnt->cl_lock);
                 list_for_each_entry(task, &clnt->cl_tasks, tk_task) {
                         if (!header) {
@@ -1870,6 +2217,6 @@ void rpc_show_tasks(void)
                 }
                 spin_unlock(&clnt->cl_lock);
         }
-        spin_unlock(&rpc_client_lock);
+        spin_unlock(&sn->rpc_client_lock);
 }
 #endif
diff --git a/net/sunrpc/netns.h b/net/sunrpc/netns.h
index d013bf211cae..ce7bd449173d 100644
--- a/net/sunrpc/netns.h
+++ b/net/sunrpc/netns.h
@@ -9,6 +9,20 @@ struct cache_detail;
 struct sunrpc_net {
         struct proc_dir_entry *proc_net_rpc;
         struct cache_detail *ip_map_cache;
+        struct cache_detail *unix_gid_cache;
+        struct cache_detail *rsc_cache;
+        struct cache_detail *rsi_cache;
+
+        struct super_block *pipefs_sb;
+        struct mutex pipefs_sb_lock;
+
+        struct list_head all_clients;
+        spinlock_t rpc_client_lock;
+
+        struct rpc_clnt *rpcb_local_clnt;
+        struct rpc_clnt *rpcb_local_clnt4;
+        spinlock_t rpcb_clnt_lock;
+        unsigned int rpcb_users;
 };
 
 extern int sunrpc_net_id;
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 63a7a7add21e..04040476082e 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -16,9 +16,9 @@
 #include <linux/namei.h>
 #include <linux/fsnotify.h>
 #include <linux/kernel.h>
+#include <linux/rcupdate.h>
 
 #include <asm/ioctls.h>
-#include <linux/fs.h>
 #include <linux/poll.h>
 #include <linux/wait.h>
 #include <linux/seq_file.h>
@@ -27,9 +27,15 @@
 #include <linux/workqueue.h>
 #include <linux/sunrpc/rpc_pipe_fs.h>
 #include <linux/sunrpc/cache.h>
+#include <linux/nsproxy.h>
+#include <linux/notifier.h>
 
-static struct vfsmount *rpc_mnt __read_mostly;
-static int rpc_mount_count;
+#include "netns.h"
+#include "sunrpc.h"
+
+#define RPCDBG_FACILITY RPCDBG_DEBUG
+
+#define NET_NAME(net)   ((net == &init_net) ? " (init_net)" : "")
 
 static struct file_system_type rpc_pipe_fs_type;
 
@@ -38,7 +44,21 @@ static struct kmem_cache *rpc_inode_cachep __read_mostly;
 
 #define RPC_UPCALL_TIMEOUT (30*HZ)
 
-static void rpc_purge_list(struct rpc_inode *rpci, struct list_head *head,
+static BLOCKING_NOTIFIER_HEAD(rpc_pipefs_notifier_list);
+
+int rpc_pipefs_notifier_register(struct notifier_block *nb)
+{
+        return blocking_notifier_chain_cond_register(&rpc_pipefs_notifier_list, nb);
+}
+EXPORT_SYMBOL_GPL(rpc_pipefs_notifier_register);
+
+void rpc_pipefs_notifier_unregister(struct notifier_block *nb)
+{
+        blocking_notifier_chain_unregister(&rpc_pipefs_notifier_list, nb);
+}
+EXPORT_SYMBOL_GPL(rpc_pipefs_notifier_unregister);
+
+static void rpc_purge_list(wait_queue_head_t *waitq, struct list_head *head,
                 void (*destroy_msg)(struct rpc_pipe_msg *), int err)
 {
         struct rpc_pipe_msg *msg;
@@ -51,30 +71,31 @@ static void rpc_purge_list(struct rpc_inode *rpci, struct list_head *head,
                 msg->errno = err;
                 destroy_msg(msg);
         } while (!list_empty(head));
-        wake_up(&rpci->waitq);
+        wake_up(waitq);
 }
 
 static void
 rpc_timeout_upcall_queue(struct work_struct *work)
 {
         LIST_HEAD(free_list);
-        struct rpc_inode *rpci =
-                container_of(work, struct rpc_inode, queue_timeout.work);
-        struct inode *inode = &rpci->vfs_inode;
+        struct rpc_pipe *pipe =
+                container_of(work, struct rpc_pipe, queue_timeout.work);
         void (*destroy_msg)(struct rpc_pipe_msg *);
+        struct dentry *dentry;
 
-        spin_lock(&inode->i_lock);
-        if (rpci->ops == NULL) {
-                spin_unlock(&inode->i_lock);
-                return;
+        spin_lock(&pipe->lock);
+        destroy_msg = pipe->ops->destroy_msg;
+        if (pipe->nreaders == 0) {
+                list_splice_init(&pipe->pipe, &free_list);
+                pipe->pipelen = 0;
         }
-        destroy_msg = rpci->ops->destroy_msg;
-        if (rpci->nreaders == 0) {
-                list_splice_init(&rpci->pipe, &free_list);
-                rpci->pipelen = 0;
+        dentry = dget(pipe->dentry);
+        spin_unlock(&pipe->lock);
+        if (dentry) {
+                rpc_purge_list(&RPC_I(dentry->d_inode)->waitq,
+                               &free_list, destroy_msg, -ETIMEDOUT);
+                dput(dentry);
         }
-        spin_unlock(&inode->i_lock);
-        rpc_purge_list(rpci, &free_list, destroy_msg, -ETIMEDOUT);
 }
 
 ssize_t rpc_pipe_generic_upcall(struct file *filp, struct rpc_pipe_msg *msg,
@@ -99,7 +120,7 @@ EXPORT_SYMBOL_GPL(rpc_pipe_generic_upcall);
 
 /**
  * rpc_queue_upcall - queue an upcall message to userspace
- * @inode: inode of upcall pipe on which to queue given message
+ * @pipe: upcall pipe on which to queue given message
  * @msg: message to queue
  *
  * Call with an @inode created by rpc_mkpipe() to queue an upcall.
@@ -108,30 +129,31 @@ EXPORT_SYMBOL_GPL(rpc_pipe_generic_upcall);
  * initialize the fields of @msg (other than @msg->list) appropriately.
  */
 int
-rpc_queue_upcall(struct inode *inode, struct rpc_pipe_msg *msg)
+rpc_queue_upcall(struct rpc_pipe *pipe, struct rpc_pipe_msg *msg)
 {
-        struct rpc_inode *rpci = RPC_I(inode);
         int res = -EPIPE;
+        struct dentry *dentry;
 
-        spin_lock(&inode->i_lock);
-        if (rpci->ops == NULL)
-                goto out;
-        if (rpci->nreaders) {
-                list_add_tail(&msg->list, &rpci->pipe);
-                rpci->pipelen += msg->len;
+        spin_lock(&pipe->lock);
+        if (pipe->nreaders) {
+                list_add_tail(&msg->list, &pipe->pipe);
+                pipe->pipelen += msg->len;
                 res = 0;
-        } else if (rpci->flags & RPC_PIPE_WAIT_FOR_OPEN) {
-                if (list_empty(&rpci->pipe))
+        } else if (pipe->flags & RPC_PIPE_WAIT_FOR_OPEN) {
+                if (list_empty(&pipe->pipe))
                         queue_delayed_work(rpciod_workqueue,
-                                        &rpci->queue_timeout,
+                                        &pipe->queue_timeout,
                                         RPC_UPCALL_TIMEOUT);
-                list_add_tail(&msg->list, &rpci->pipe);
-                rpci->pipelen += msg->len;
+                list_add_tail(&msg->list, &pipe->pipe);
+                pipe->pipelen += msg->len;
                 res = 0;
         }
-out:
-        spin_unlock(&inode->i_lock);
-        wake_up(&rpci->waitq);
+        dentry = dget(pipe->dentry);
+        spin_unlock(&pipe->lock);
+        if (dentry) {
+                wake_up(&RPC_I(dentry->d_inode)->waitq);
+                dput(dentry);
+        }
         return res;
 }
 EXPORT_SYMBOL_GPL(rpc_queue_upcall);
@@ -145,29 +167,26 @@ rpc_inode_setowner(struct inode *inode, void *private)
 static void
 rpc_close_pipes(struct inode *inode)
 {
-        struct rpc_inode *rpci = RPC_I(inode);
-        const struct rpc_pipe_ops *ops;
+        struct rpc_pipe *pipe = RPC_I(inode)->pipe;
         int need_release;
+        LIST_HEAD(free_list);
 
         mutex_lock(&inode->i_mutex);
-        ops = rpci->ops;
-        if (ops != NULL) {
-                LIST_HEAD(free_list);
-                spin_lock(&inode->i_lock);
-                need_release = rpci->nreaders != 0 || rpci->nwriters != 0;
-                rpci->nreaders = 0;
-                list_splice_init(&rpci->in_upcall, &free_list);
-                list_splice_init(&rpci->pipe, &free_list);
-                rpci->pipelen = 0;
-                rpci->ops = NULL;
-                spin_unlock(&inode->i_lock);
-                rpc_purge_list(rpci, &free_list, ops->destroy_msg, -EPIPE);
-                rpci->nwriters = 0;
-                if (need_release && ops->release_pipe)
-                        ops->release_pipe(inode);
-                cancel_delayed_work_sync(&rpci->queue_timeout);
-        }
+        spin_lock(&pipe->lock);
+        need_release = pipe->nreaders != 0 || pipe->nwriters != 0;
+        pipe->nreaders = 0;
+        list_splice_init(&pipe->in_upcall, &free_list);
+        list_splice_init(&pipe->pipe, &free_list);
+        pipe->pipelen = 0;
+        pipe->dentry = NULL;
+        spin_unlock(&pipe->lock);
+        rpc_purge_list(&RPC_I(inode)->waitq, &free_list, pipe->ops->destroy_msg, -EPIPE);
+        pipe->nwriters = 0;
+        if (need_release && pipe->ops->release_pipe)
+                pipe->ops->release_pipe(inode);
+        cancel_delayed_work_sync(&pipe->queue_timeout);
         rpc_inode_setowner(inode, NULL);
+        RPC_I(inode)->pipe = NULL;
         mutex_unlock(&inode->i_mutex);
 }
 
@@ -197,23 +216,24 @@ rpc_destroy_inode(struct inode *inode)
 static int
 rpc_pipe_open(struct inode *inode, struct file *filp)
 {
-        struct rpc_inode *rpci = RPC_I(inode);
+        struct rpc_pipe *pipe;
         int first_open;
         int res = -ENXIO;
 
         mutex_lock(&inode->i_mutex);
-        if (rpci->ops == NULL)
+        pipe = RPC_I(inode)->pipe;
+        if (pipe == NULL)
                 goto out;
-        first_open = rpci->nreaders == 0 && rpci->nwriters == 0;
-        if (first_open && rpci->ops->open_pipe) {
-                res = rpci->ops->open_pipe(inode);
+        first_open = pipe->nreaders == 0 && pipe->nwriters == 0;
+        if (first_open && pipe->ops->open_pipe) {
+                res = pipe->ops->open_pipe(inode);
                 if (res)
                         goto out;
         }
         if (filp->f_mode & FMODE_READ)
-                rpci->nreaders++;
+                pipe->nreaders++;
         if (filp->f_mode & FMODE_WRITE)
-                rpci->nwriters++;
+                pipe->nwriters++;
         res = 0;
 out:
         mutex_unlock(&inode->i_mutex);
@@ -223,38 +243,39 @@ out:
 static int
 rpc_pipe_release(struct inode *inode, struct file *filp)
 {
-        struct rpc_inode *rpci = RPC_I(inode);
+        struct rpc_pipe *pipe;
         struct rpc_pipe_msg *msg;
         int last_close;
 
         mutex_lock(&inode->i_mutex);
-        if (rpci->ops == NULL)
+        pipe = RPC_I(inode)->pipe;
+        if (pipe == NULL)
                 goto out;
         msg = filp->private_data;
         if (msg != NULL) {
-                spin_lock(&inode->i_lock);
+                spin_lock(&pipe->lock);
                 msg->errno = -EAGAIN;
                 list_del_init(&msg->list);
-                spin_unlock(&inode->i_lock);
-                rpci->ops->destroy_msg(msg);
+                spin_unlock(&pipe->lock);
+                pipe->ops->destroy_msg(msg);
         }
         if (filp->f_mode & FMODE_WRITE)
-                rpci->nwriters --;
+                pipe->nwriters --;
         if (filp->f_mode & FMODE_READ) {
-                rpci->nreaders --;
-                if (rpci->nreaders == 0) {
+                pipe->nreaders --;
+                if (pipe->nreaders == 0) {
                         LIST_HEAD(free_list);
-                        spin_lock(&inode->i_lock);
-                        list_splice_init(&rpci->pipe, &free_list);
-                        rpci->pipelen = 0;
-                        spin_unlock(&inode->i_lock);
-                        rpc_purge_list(rpci, &free_list,
-                                        rpci->ops->destroy_msg, -EAGAIN);
+                        spin_lock(&pipe->lock);
+                        list_splice_init(&pipe->pipe, &free_list);
+                        pipe->pipelen = 0;
+                        spin_unlock(&pipe->lock);
+                        rpc_purge_list(&RPC_I(inode)->waitq, &free_list,
+                                        pipe->ops->destroy_msg, -EAGAIN);
                 }
         }
-        last_close = rpci->nwriters == 0 && rpci->nreaders == 0;
-        if (last_close && rpci->ops->release_pipe)
-                rpci->ops->release_pipe(inode);
+        last_close = pipe->nwriters == 0 && pipe->nreaders == 0;
+        if (last_close && pipe->ops->release_pipe)
+                pipe->ops->release_pipe(inode);
 out:
         mutex_unlock(&inode->i_mutex);
         return 0;
@@ -264,39 +285,40 @@ static ssize_t
 rpc_pipe_read(struct file *filp, char __user *buf, size_t len, loff_t *offset)
 {
         struct inode *inode = filp->f_path.dentry->d_inode;
-        struct rpc_inode *rpci = RPC_I(inode);
+        struct rpc_pipe *pipe;
         struct rpc_pipe_msg *msg;
         int res = 0;
 
         mutex_lock(&inode->i_mutex);
-        if (rpci->ops == NULL) {
+        pipe = RPC_I(inode)->pipe;
+        if (pipe == NULL) {
                 res = -EPIPE;
                 goto out_unlock;
         }
         msg = filp->private_data;
         if (msg == NULL) {
-                spin_lock(&inode->i_lock);
-                if (!list_empty(&rpci->pipe)) {
-                        msg = list_entry(rpci->pipe.next,
+                spin_lock(&pipe->lock);
+                if (!list_empty(&pipe->pipe)) {
+                        msg = list_entry(pipe->pipe.next,
                                         struct rpc_pipe_msg,
                                         list);
-                        list_move(&msg->list, &rpci->in_upcall);
-                        rpci->pipelen -= msg->len;
+                        list_move(&msg->list, &pipe->in_upcall);
+                        pipe->pipelen -= msg->len;
                         filp->private_data = msg;
                         msg->copied = 0;
                 }
-                spin_unlock(&inode->i_lock);
+                spin_unlock(&pipe->lock);
                 if (msg == NULL)
                         goto out_unlock;
         }
         /* NOTE: it is up to the callback to update msg->copied */
-        res = rpci->ops->upcall(filp, msg, buf, len);
+        res = pipe->ops->upcall(filp, msg, buf, len);
         if (res < 0 || msg->len == msg->copied) {
                 filp->private_data = NULL;
-                spin_lock(&inode->i_lock);
+                spin_lock(&pipe->lock);
                 list_del_init(&msg->list);
-                spin_unlock(&inode->i_lock);
-                rpci->ops->destroy_msg(msg);
+                spin_unlock(&pipe->lock);
+                pipe->ops->destroy_msg(msg);
         }
 out_unlock:
         mutex_unlock(&inode->i_mutex);
@@ -307,13 +329,12 @@ static ssize_t
 rpc_pipe_write(struct file *filp, const char __user *buf, size_t len, loff_t *offset)
 {
         struct inode *inode = filp->f_path.dentry->d_inode;
-        struct rpc_inode *rpci = RPC_I(inode);
         int res;
 
         mutex_lock(&inode->i_mutex);
         res = -EPIPE;
-        if (rpci->ops != NULL)
-                res = rpci->ops->downcall(filp, buf, len);
+        if (RPC_I(inode)->pipe != NULL)
+                res = RPC_I(inode)->pipe->ops->downcall(filp, buf, len);
         mutex_unlock(&inode->i_mutex);
         return res;
 }
@@ -321,17 +342,18 @@ rpc_pipe_write(struct file *filp, const char __user *buf, size_t len, loff_t *of
 static unsigned int
 rpc_pipe_poll(struct file *filp, struct poll_table_struct *wait)
 {
-        struct rpc_inode *rpci;
-        unsigned int mask = 0;
+        struct inode *inode = filp->f_path.dentry->d_inode;
+        struct rpc_inode *rpci = RPC_I(inode);
+        unsigned int mask = POLLOUT | POLLWRNORM;
 
-        rpci = RPC_I(filp->f_path.dentry->d_inode);
         poll_wait(filp, &rpci->waitq, wait);
 
-        mask = POLLOUT | POLLWRNORM;
-        if (rpci->ops == NULL)
+        mutex_lock(&inode->i_mutex);
+        if (rpci->pipe == NULL)
                 mask |= POLLERR | POLLHUP;
-        if (filp->private_data || !list_empty(&rpci->pipe))
+        else if (filp->private_data || !list_empty(&rpci->pipe->pipe))
                 mask |= POLLIN | POLLRDNORM;
+        mutex_unlock(&inode->i_mutex);
         return mask;
 }
 
@@ -339,23 +361,26 @@ static long
 rpc_pipe_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
         struct inode *inode = filp->f_path.dentry->d_inode;
-        struct rpc_inode *rpci = RPC_I(inode);
+        struct rpc_pipe *pipe;
         int len;
 
         switch (cmd) {
         case FIONREAD:
-                spin_lock(&inode->i_lock);
-                if (rpci->ops == NULL) {
-                        spin_unlock(&inode->i_lock);
+                mutex_lock(&inode->i_mutex);
+                pipe = RPC_I(inode)->pipe;
+                if (pipe == NULL) {
+                        mutex_unlock(&inode->i_mutex);
                         return -EPIPE;
                 }
-                len = rpci->pipelen;
+                spin_lock(&pipe->lock);
+                len = pipe->pipelen;
                 if (filp->private_data) {
                         struct rpc_pipe_msg *msg;
                         msg = filp->private_data;
                         len += msg->len - msg->copied;
                 }
-                spin_unlock(&inode->i_lock);
+                spin_unlock(&pipe->lock);
+                mutex_unlock(&inode->i_mutex);
                 return put_user(len, (int __user *)arg);
         default:
                 return -EINVAL;
@@ -378,12 +403,15 @@ rpc_show_info(struct seq_file *m, void *v)
 {
         struct rpc_clnt *clnt = m->private;
 
-        seq_printf(m, "RPC server: %s\n", clnt->cl_server);
+        rcu_read_lock();
+        seq_printf(m, "RPC server: %s\n",
+                        rcu_dereference(clnt->cl_xprt)->servername);
         seq_printf(m, "service: %s (%d) version %d\n", clnt->cl_protname,
                         clnt->cl_prog, clnt->cl_vers);
         seq_printf(m, "address: %s\n", rpc_peeraddr2str(clnt, RPC_DISPLAY_ADDR));
         seq_printf(m, "protocol: %s\n", rpc_peeraddr2str(clnt, RPC_DISPLAY_PROTO));
         seq_printf(m, "port: %s\n", rpc_peeraddr2str(clnt, RPC_DISPLAY_PORT));
+        rcu_read_unlock();
         return 0;
 }
 
@@ -440,23 +468,6 @@ struct rpc_filelist {
         umode_t mode;
 };
 
-struct vfsmount *rpc_get_mount(void)
-{
-        int err;
-
-        err = simple_pin_fs(&rpc_pipe_fs_type, &rpc_mnt, &rpc_mount_count);
-        if (err != 0)
-                return ERR_PTR(err);
-        return rpc_mnt;
-}
-EXPORT_SYMBOL_GPL(rpc_get_mount);
-
-void rpc_put_mount(void)
-{
-        simple_release_fs(&rpc_mnt, &rpc_mount_count);
-}
-EXPORT_SYMBOL_GPL(rpc_put_mount);
-
 static int rpc_delete_dentry(const struct dentry *dentry)
 {
         return 1;
@@ -540,12 +551,47 @@ static int __rpc_mkdir(struct inode *dir, struct dentry *dentry,
         return 0;
 }
 
-static int __rpc_mkpipe(struct inode *dir, struct dentry *dentry,
-                        umode_t mode,
-                        const struct file_operations *i_fop,
-                        void *private,
-                        const struct rpc_pipe_ops *ops,
-                        int flags)
+static void
+init_pipe(struct rpc_pipe *pipe)
+{
+        pipe->nreaders = 0;
+        pipe->nwriters = 0;
+        INIT_LIST_HEAD(&pipe->in_upcall);
+        INIT_LIST_HEAD(&pipe->in_downcall);
+        INIT_LIST_HEAD(&pipe->pipe);
+        pipe->pipelen = 0;
+        INIT_DELAYED_WORK(&pipe->queue_timeout,
+                            rpc_timeout_upcall_queue);
+        pipe->ops = NULL;
+        spin_lock_init(&pipe->lock);
+        pipe->dentry = NULL;
+}
+
+void rpc_destroy_pipe_data(struct rpc_pipe *pipe)
+{
+        kfree(pipe);
+}
+EXPORT_SYMBOL_GPL(rpc_destroy_pipe_data);
+
+struct rpc_pipe *rpc_mkpipe_data(const struct rpc_pipe_ops *ops, int flags)
+{
+        struct rpc_pipe *pipe;
+
+        pipe = kzalloc(sizeof(struct rpc_pipe), GFP_KERNEL);
+        if (!pipe)
+                return ERR_PTR(-ENOMEM);
+        init_pipe(pipe);
+        pipe->ops = ops;
+        pipe->flags = flags;
+        return pipe;
+}
+EXPORT_SYMBOL_GPL(rpc_mkpipe_data);
+
+static int __rpc_mkpipe_dentry(struct inode *dir, struct dentry *dentry,
+                               umode_t mode,
+                               const struct file_operations *i_fop,
+                               void *private,
+                               struct rpc_pipe *pipe)
 {
         struct rpc_inode *rpci;
         int err;
@@ -554,10 +600,8 @@ static int __rpc_mkpipe(struct inode *dir, struct dentry *dentry,
         if (err)
                 return err;
         rpci = RPC_I(dentry->d_inode);
-        rpci->nkern_readwriters = 1;
         rpci->private = private;
-        rpci->flags = flags;
-        rpci->ops = ops;
+        rpci->pipe = pipe;
         fsnotify_create(dir, dentry);
         return 0;
 }
@@ -573,6 +617,22 @@ static int __rpc_rmdir(struct inode *dir, struct dentry *dentry)
         return ret;
 }
 
+int rpc_rmdir(struct dentry *dentry)
+{
+        struct dentry *parent;
+        struct inode *dir;
+        int error;
+
+        parent = dget_parent(dentry);
+        dir = parent->d_inode;
+        mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
+        error = __rpc_rmdir(dir, dentry);
+        mutex_unlock(&dir->i_mutex);
+        dput(parent);
+        return error;
+}
+EXPORT_SYMBOL_GPL(rpc_rmdir);
+
 static int __rpc_unlink(struct inode *dir, struct dentry *dentry)
 {
         int ret;
@@ -587,16 +647,12 @@ static int __rpc_unlink(struct inode *dir, struct dentry *dentry)
 static int __rpc_rmpipe(struct inode *dir, struct dentry *dentry)
 {
         struct inode *inode = dentry->d_inode;
-        struct rpc_inode *rpci = RPC_I(inode);
 
-        rpci->nkern_readwriters--;
-        if (rpci->nkern_readwriters != 0)
-                return 0;
         rpc_close_pipes(inode);
         return __rpc_unlink(dir, dentry);
 }
 
-static struct dentry *__rpc_lookup_create(struct dentry *parent,
+static struct dentry *__rpc_lookup_create_exclusive(struct dentry *parent,
                                           struct qstr *name)
 {
         struct dentry *dentry;
@@ -604,27 +660,13 @@ static struct dentry *__rpc_lookup_create(struct dentry *parent,
         dentry = d_lookup(parent, name);
         if (!dentry) {
                 dentry = d_alloc(parent, name);
-                if (!dentry) {
-                        dentry = ERR_PTR(-ENOMEM);
-                        goto out_err;
-                }
+                if (!dentry)
+                        return ERR_PTR(-ENOMEM);
         }
-        if (!dentry->d_inode)
+        if (dentry->d_inode == NULL) {
                 d_set_d_op(dentry, &rpc_dentry_operations);
-out_err:
-        return dentry;
-}
-
-static struct dentry *__rpc_lookup_create_exclusive(struct dentry *parent,
-                                          struct qstr *name)
-{
-        struct dentry *dentry;
-
-        dentry = __rpc_lookup_create(parent, name);
-        if (IS_ERR(dentry))
-                return dentry;
-        if (dentry->d_inode == NULL)
                 return dentry;
+        }
         dput(dentry);
         return ERR_PTR(-EEXIST);
 }
@@ -777,9 +819,7 @@ static int rpc_rmdir_depopulate(struct dentry *dentry,
  * @parent: dentry of directory to create new "pipe" in
  * @name: name of pipe
  * @private: private data to associate with the pipe, for the caller's use
- * @ops: operations defining the behavior of the pipe: upcall, downcall,
- *      release_pipe, open_pipe, and destroy_msg.
- * @flags: rpc_inode flags
+ * @pipe: &rpc_pipe containing input parameters
  *
  * Data is made available for userspace to read by calls to
  * rpc_queue_upcall().  The actual reads will result in calls to
@@ -792,9 +832,8 @@ static int rpc_rmdir_depopulate(struct dentry *dentry,
  * The @private argument passed here will be available to all these methods
  * from the file pointer, via RPC_I(file->f_dentry->d_inode)->private.
  */
-struct dentry *rpc_mkpipe(struct dentry *parent, const char *name,
-                          void *private, const struct rpc_pipe_ops *ops,
-                          int flags)
+struct dentry *rpc_mkpipe_dentry(struct dentry *parent, const char *name,
+                                 void *private, struct rpc_pipe *pipe)
 {
         struct dentry *dentry;
         struct inode *dir = parent->d_inode;
@@ -802,9 +841,9 @@ struct dentry *rpc_mkpipe(struct dentry *parent, const char *name,
         struct qstr q;
         int err;
 
-        if (ops->upcall == NULL)
+        if (pipe->ops->upcall == NULL)
                 umode &= ~S_IRUGO;
-        if (ops->downcall == NULL)
+        if (pipe->ops->downcall == NULL)
                 umode &= ~S_IWUGO;
 
         q.name = name;
@@ -812,24 +851,11 @@ struct dentry *rpc_mkpipe(struct dentry *parent, const char *name,
         q.hash = full_name_hash(q.name, q.len),
 
         mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
-        dentry = __rpc_lookup_create(parent, &q);
+        dentry = __rpc_lookup_create_exclusive(parent, &q);
         if (IS_ERR(dentry))
                 goto out;
-        if (dentry->d_inode) {
-                struct rpc_inode *rpci = RPC_I(dentry->d_inode);
-                if (rpci->private != private ||
-                                rpci->ops != ops ||
-                                rpci->flags != flags) {
-                        dput (dentry);
-                        err = -EBUSY;
-                        goto out_err;
-                }
-                rpci->nkern_readwriters++;
-                goto out;
-        }
-
-        err = __rpc_mkpipe(dir, dentry, umode, &rpc_pipe_fops,
-                           private, ops, flags);
+        err = __rpc_mkpipe_dentry(dir, dentry, umode, &rpc_pipe_fops,
+                                  private, pipe);
         if (err)
                 goto out_err;
 out:
@@ -842,7 +868,7 @@ out_err:
                         err);
         goto out;
 }
-EXPORT_SYMBOL_GPL(rpc_mkpipe);
+EXPORT_SYMBOL_GPL(rpc_mkpipe_dentry);
 
 /**
  * rpc_unlink - remove a pipe
@@ -915,7 +941,7 @@ struct dentry *rpc_create_client_dir(struct dentry *dentry,
 
 /**
  * rpc_remove_client_dir - Remove a directory created with rpc_create_client_dir()
- * @dentry: directory to remove
+ * @dentry: dentry for the pipe
  */
 int rpc_remove_client_dir(struct dentry *dentry)
 {
@@ -986,6 +1012,7 @@ enum {
         RPCAUTH_statd,
         RPCAUTH_nfsd4_cb,
         RPCAUTH_cache,
+        RPCAUTH_nfsd,
         RPCAUTH_RootEOF
 };
 
@@ -1018,13 +1045,67 @@ static const struct rpc_filelist files[] = {
                 .name = "cache",
                 .mode = S_IFDIR | S_IRUGO | S_IXUGO,
         },
+        [RPCAUTH_nfsd] = {
+                .name = "nfsd",
+                .mode = S_IFDIR | S_IRUGO | S_IXUGO,
+        },
 };
 
+/*
+ * This call can be used only in RPC pipefs mount notification hooks.
+ */
+struct dentry *rpc_d_lookup_sb(const struct super_block *sb,
+                               const unsigned char *dir_name)
+{
+        struct qstr dir = QSTR_INIT(dir_name, strlen(dir_name));
+
+        dir.hash = full_name_hash(dir.name, dir.len);
+        return d_lookup(sb->s_root, &dir);
+}
+EXPORT_SYMBOL_GPL(rpc_d_lookup_sb);
+
+void rpc_pipefs_init_net(struct net *net)
+{
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+
+        mutex_init(&sn->pipefs_sb_lock);
+}
+
+/*
+ * This call will be used for per network namespace operations calls.
+ * Note: Function will be returned with pipefs_sb_lock taken if superblock was
+ * found. This lock have to be released by rpc_put_sb_net() when all operations
+ * will be completed.
+ */
+struct super_block *rpc_get_sb_net(const struct net *net)
+{
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+
+        mutex_lock(&sn->pipefs_sb_lock);
+        if (sn->pipefs_sb)
+                return sn->pipefs_sb;
+        mutex_unlock(&sn->pipefs_sb_lock);
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(rpc_get_sb_net);
+
+void rpc_put_sb_net(const struct net *net)
+{
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+
+        BUG_ON(sn->pipefs_sb == NULL);
+        mutex_unlock(&sn->pipefs_sb_lock);
+}
+EXPORT_SYMBOL_GPL(rpc_put_sb_net);
+
 static int
 rpc_fill_super(struct super_block *sb, void *data, int silent)
 {
         struct inode *inode;
         struct dentry *root;
+        struct net *net = data;
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+        int err;
 
         sb->s_blocksize = PAGE_CACHE_SIZE;
         sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
@@ -1032,31 +1113,61 @@ rpc_fill_super(struct super_block *sb, void *data, int silent)
         sb->s_op = &s_ops;
         sb->s_time_gran = 1;
 
-        inode = rpc_get_inode(sb, S_IFDIR | 0755);
-        if (!inode)
-                return -ENOMEM;
-        sb->s_root = root = d_alloc_root(inode);
-        if (!root) {
-                iput(inode);
+        inode = rpc_get_inode(sb, S_IFDIR | S_IRUGO | S_IXUGO);
+        sb->s_root = root = d_make_root(inode);
+        if (!root)
                 return -ENOMEM;
-        }
         if (rpc_populate(root, files, RPCAUTH_lockd, RPCAUTH_RootEOF, NULL))
                 return -ENOMEM;
+        dprintk("RPC:   sending pipefs MOUNT notification for net %p%s\n", net,
+                                                                NET_NAME(net));
+        sn->pipefs_sb = sb;
+        err = blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
+                                           RPC_PIPEFS_MOUNT,
+                                           sb);
+        if (err)
+                goto err_depopulate;
+        sb->s_fs_info = get_net(net);
         return 0;
+
+err_depopulate:
+        blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
+                                           RPC_PIPEFS_UMOUNT,
+                                           sb);
+        sn->pipefs_sb = NULL;
+        __rpc_depopulate(root, files, RPCAUTH_lockd, RPCAUTH_RootEOF);
+        return err;
 }
 
 static struct dentry *
 rpc_mount(struct file_system_type *fs_type,
                 int flags, const char *dev_name, void *data)
 {
-        return mount_single(fs_type, flags, data, rpc_fill_super);
+        return mount_ns(fs_type, flags, current->nsproxy->net_ns, rpc_fill_super);
+}
+
+static void rpc_kill_sb(struct super_block *sb)
+{
+        struct net *net = sb->s_fs_info;
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+
+        mutex_lock(&sn->pipefs_sb_lock);
+        sn->pipefs_sb = NULL;
+        mutex_unlock(&sn->pipefs_sb_lock);
+        put_net(net);
+        dprintk("RPC:   sending pipefs UMOUNT notification for net %p%s\n", net,
+                                                                NET_NAME(net));
+        blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
+                                           RPC_PIPEFS_UMOUNT,
+                                           sb);
+        kill_litter_super(sb);
 }
 
 static struct file_system_type rpc_pipe_fs_type = {
         .owner          = THIS_MODULE,
         .name           = "rpc_pipefs",
         .mount          = rpc_mount,
-        .kill_sb        = kill_litter_super,
+        .kill_sb        = rpc_kill_sb,
 };
 
 static void
@@ -1066,16 +1177,8 @@ init_once(void *foo)
 
         inode_init_once(&rpci->vfs_inode);
         rpci->private = NULL;
-        rpci->nreaders = 0;
-        rpci->nwriters = 0;
-        INIT_LIST_HEAD(&rpci->in_upcall);
-        INIT_LIST_HEAD(&rpci->in_downcall);
-        INIT_LIST_HEAD(&rpci->pipe);
-        rpci->pipelen = 0;
+        rpci->pipe = NULL;
         init_waitqueue_head(&rpci->waitq);
-        INIT_DELAYED_WORK(&rpci->queue_timeout,
-                            rpc_timeout_upcall_queue);
-        rpci->ops = NULL;
 }
 
 int register_rpc_pipefs(void)
@@ -1089,17 +1192,24 @@ int register_rpc_pipefs(void)
                                 init_once);
         if (!rpc_inode_cachep)
                 return -ENOMEM;
+        err = rpc_clients_notifier_register();
+        if (err)
+                goto err_notifier;
         err = register_filesystem(&rpc_pipe_fs_type);
-        if (err) {
-                kmem_cache_destroy(rpc_inode_cachep);
-                return err;
-        }
-
+        if (err)
+                goto err_register;
         return 0;
+
+err_register:
+        rpc_clients_notifier_unregister();
+err_notifier:
+        kmem_cache_destroy(rpc_inode_cachep);
+        return err;
 }
 
 void unregister_rpc_pipefs(void)
 {
+        rpc_clients_notifier_unregister();
         kmem_cache_destroy(rpc_inode_cachep);
         unregister_filesystem(&rpc_pipe_fs_type);
 }
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 8761bf8e36fc..92509ffe15fc 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -23,12 +23,15 @@
 #include <linux/errno.h>
 #include <linux/mutex.h>
 #include <linux/slab.h>
+#include <linux/nsproxy.h>
 #include <net/ipv6.h>
 
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/sched.h>
 #include <linux/sunrpc/xprtsock.h>
 
+#include "netns.h"
+
 #ifdef RPC_DEBUG
 # define RPCDBG_FACILITY        RPCDBG_BIND
 #endif
@@ -109,13 +112,7 @@ enum {
 
 static void                     rpcb_getport_done(struct rpc_task *, void *);
 static void                     rpcb_map_release(void *data);
-static struct rpc_program       rpcb_program;
-
-static struct rpc_clnt *        rpcb_local_clnt;
-static struct rpc_clnt *        rpcb_local_clnt4;
-
-DEFINE_SPINLOCK(rpcb_clnt_lock);
-unsigned int                    rpcb_users;
+static const struct rpc_program rpcb_program;
 
 struct rpcbind_args {
         struct rpc_xprt *       r_xprt;
@@ -140,8 +137,8 @@ struct rpcb_info {
         struct rpc_procinfo *   rpc_proc;
 };
 
-static struct rpcb_info rpcb_next_version[];
-static struct rpcb_info rpcb_next_version6[];
+static const struct rpcb_info rpcb_next_version[];
+static const struct rpcb_info rpcb_next_version6[];
 
 static const struct rpc_call_ops rpcb_getport_ops = {
         .rpc_call_done          = rpcb_getport_done,
@@ -164,32 +161,36 @@ static void rpcb_map_release(void *data)
         kfree(map);
 }
 
-static int rpcb_get_local(void)
+static int rpcb_get_local(struct net *net)
 {
         int cnt;
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 
-        spin_lock(&rpcb_clnt_lock);
-        if (rpcb_users)
-                rpcb_users++;
-        cnt = rpcb_users;
-        spin_unlock(&rpcb_clnt_lock);
+        spin_lock(&sn->rpcb_clnt_lock);
+        if (sn->rpcb_users)
+                sn->rpcb_users++;
+        cnt = sn->rpcb_users;
+        spin_unlock(&sn->rpcb_clnt_lock);
 
         return cnt;
 }
 
-void rpcb_put_local(void)
+void rpcb_put_local(struct net *net)
 {
-        struct rpc_clnt *clnt = rpcb_local_clnt;
-        struct rpc_clnt *clnt4 = rpcb_local_clnt4;
-        int shutdown;
-
-        spin_lock(&rpcb_clnt_lock);
-        if (--rpcb_users == 0) {
-                rpcb_local_clnt = NULL;
-                rpcb_local_clnt4 = NULL;
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+        struct rpc_clnt *clnt = sn->rpcb_local_clnt;
+        struct rpc_clnt *clnt4 = sn->rpcb_local_clnt4;
+        int shutdown = 0;
+
+        spin_lock(&sn->rpcb_clnt_lock);
+        if (sn->rpcb_users) {
+                if (--sn->rpcb_users == 0) {
+                        sn->rpcb_local_clnt = NULL;
+                        sn->rpcb_local_clnt4 = NULL;
+                }
+                shutdown = !sn->rpcb_users;
         }
-        shutdown = !rpcb_users;
-        spin_unlock(&rpcb_clnt_lock);
+        spin_unlock(&sn->rpcb_clnt_lock);
 
         if (shutdown) {
                 /*
@@ -202,30 +203,34 @@ void rpcb_put_local(void)
         }
 }
 
-static void rpcb_set_local(struct rpc_clnt *clnt, struct rpc_clnt *clnt4)
+static void rpcb_set_local(struct net *net, struct rpc_clnt *clnt,
+                        struct rpc_clnt *clnt4)
 {
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+
         /* Protected by rpcb_create_local_mutex */
-        rpcb_local_clnt = clnt;
-        rpcb_local_clnt4 = clnt4;
+        sn->rpcb_local_clnt = clnt;
+        sn->rpcb_local_clnt4 = clnt4;
         smp_wmb(); 
-        rpcb_users = 1;
+        sn->rpcb_users = 1;
         dprintk("RPC:       created new rpcb local clients (rpcb_local_clnt: "
-                        "%p, rpcb_local_clnt4: %p)\n", rpcb_local_clnt,
-                        rpcb_local_clnt4);
+                        "%p, rpcb_local_clnt4: %p) for net %p%s\n",
+                        sn->rpcb_local_clnt, sn->rpcb_local_clnt4,
+                        net, (net == &init_net) ? " (init_net)" : "");
 }
 
 /*
  * Returns zero on success, otherwise a negative errno value
  * is returned.
  */
-static int rpcb_create_local_unix(void)
+static int rpcb_create_local_unix(struct net *net)
 {
         static const struct sockaddr_un rpcb_localaddr_rpcbind = {
                 .sun_family             = AF_LOCAL,
                 .sun_path               = RPCBIND_SOCK_PATHNAME,
         };
         struct rpc_create_args args = {
-                .net            = &init_net,
+                .net            = net,
                 .protocol       = XPRT_TRANSPORT_LOCAL,
                 .address        = (struct sockaddr *)&rpcb_localaddr_rpcbind,
                 .addrsize       = sizeof(rpcb_localaddr_rpcbind),
@@ -258,7 +263,7 @@ static int rpcb_create_local_unix(void)
                 clnt4 = NULL;
         }
 
-        rpcb_set_local(clnt, clnt4);
+        rpcb_set_local(net, clnt, clnt4);
 
 out:
         return result;
@@ -268,7 +273,7 @@ out:
  * Returns zero on success, otherwise a negative errno value
  * is returned.
  */
-static int rpcb_create_local_net(void)
+static int rpcb_create_local_net(struct net *net)
 {
         static const struct sockaddr_in rpcb_inaddr_loopback = {
                 .sin_family             = AF_INET,
@@ -276,7 +281,7 @@ static int rpcb_create_local_net(void)
                 .sin_port               = htons(RPCBIND_PORT),
         };
         struct rpc_create_args args = {
-                .net            = &init_net,
+                .net            = net,
                 .protocol       = XPRT_TRANSPORT_TCP,
                 .address        = (struct sockaddr *)&rpcb_inaddr_loopback,
                 .addrsize       = sizeof(rpcb_inaddr_loopback),
@@ -310,7 +315,7 @@ static int rpcb_create_local_net(void)
                 clnt4 = NULL;
         }
 
-        rpcb_set_local(clnt, clnt4);
+        rpcb_set_local(net, clnt, clnt4);
 
 out:
         return result;
@@ -320,31 +325,32 @@ out:
  * Returns zero on success, otherwise a negative errno value
  * is returned.
  */
-int rpcb_create_local(void)
+int rpcb_create_local(struct net *net)
 {
         static DEFINE_MUTEX(rpcb_create_local_mutex);
         int result = 0;
 
-        if (rpcb_get_local())
+        if (rpcb_get_local(net))
                 return result;
 
         mutex_lock(&rpcb_create_local_mutex);
-        if (rpcb_get_local())
+        if (rpcb_get_local(net))
                 goto out;
 
-        if (rpcb_create_local_unix() != 0)
-                result = rpcb_create_local_net();
+        if (rpcb_create_local_unix(net) != 0)
+                result = rpcb_create_local_net(net);
 
 out:
         mutex_unlock(&rpcb_create_local_mutex);
         return result;
 }
 
-static struct rpc_clnt *rpcb_create(char *hostname, struct sockaddr *srvaddr,
-                                    size_t salen, int proto, u32 version)
+static struct rpc_clnt *rpcb_create(struct net *net, const char *hostname,
+                                    struct sockaddr *srvaddr, size_t salen,
+                                    int proto, u32 version)
 {
         struct rpc_create_args args = {
-                .net            = &init_net,
+                .net            = net,
                 .protocol       = proto,
                 .address        = srvaddr,
                 .addrsize       = salen,
@@ -390,6 +396,7 @@ static int rpcb_register_call(struct rpc_clnt *clnt, struct rpc_message *msg)
 
 /**
  * rpcb_register - set or unset a port registration with the local rpcbind svc
+ * @net: target network namespace
  * @prog: RPC program number to bind
  * @vers: RPC version number to bind
  * @prot: transport protocol to register
@@ -420,7 +427,7 @@ static int rpcb_register_call(struct rpc_clnt *clnt, struct rpc_message *msg)
  * IN6ADDR_ANY (ie available for all AF_INET and AF_INET6
  * addresses).
  */
-int rpcb_register(u32 prog, u32 vers, int prot, unsigned short port)
+int rpcb_register(struct net *net, u32 prog, u32 vers, int prot, unsigned short port)
 {
         struct rpcbind_args map = {
                 .r_prog         = prog,
@@ -431,6 +438,7 @@ int rpcb_register(u32 prog, u32 vers, int prot, unsigned short port)
         struct rpc_message msg = {
                 .rpc_argp       = &map,
         };
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 
         dprintk("RPC:       %sregistering (%u, %u, %d, %u) with local "
                         "rpcbind\n", (port ? "" : "un"),
@@ -440,13 +448,14 @@ int rpcb_register(u32 prog, u32 vers, int prot, unsigned short port)
         if (port)
                 msg.rpc_proc = &rpcb_procedures2[RPCBPROC_SET];
 
-        return rpcb_register_call(rpcb_local_clnt, &msg);
+        return rpcb_register_call(sn->rpcb_local_clnt, &msg);
 }
 
 /*
  * Fill in AF_INET family-specific arguments to register
  */
-static int rpcb_register_inet4(const struct sockaddr *sap,
+static int rpcb_register_inet4(struct sunrpc_net *sn,
+                               const struct sockaddr *sap,
                                struct rpc_message *msg)
 {
         const struct sockaddr_in *sin = (const struct sockaddr_in *)sap;
@@ -465,7 +474,7 @@ static int rpcb_register_inet4(const struct sockaddr *sap,
         if (port)
                 msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
 
-        result = rpcb_register_call(rpcb_local_clnt4, msg);
+        result = rpcb_register_call(sn->rpcb_local_clnt4, msg);
         kfree(map->r_addr);
         return result;
 }
@@ -473,7 +482,8 @@ static int rpcb_register_inet4(const struct sockaddr *sap,
 /*
  * Fill in AF_INET6 family-specific arguments to register
  */
-static int rpcb_register_inet6(const struct sockaddr *sap,
+static int rpcb_register_inet6(struct sunrpc_net *sn,
+                               const struct sockaddr *sap,
                                struct rpc_message *msg)
 {
         const struct sockaddr_in6 *sin6 = (const struct sockaddr_in6 *)sap;
@@ -492,12 +502,13 @@ static int rpcb_register_inet6(const struct sockaddr *sap,
         if (port)
                 msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
 
-        result = rpcb_register_call(rpcb_local_clnt4, msg);
+        result = rpcb_register_call(sn->rpcb_local_clnt4, msg);
         kfree(map->r_addr);
         return result;
 }
 
-static int rpcb_unregister_all_protofamilies(struct rpc_message *msg)
+static int rpcb_unregister_all_protofamilies(struct sunrpc_net *sn,
+                                             struct rpc_message *msg)
 {
         struct rpcbind_args *map = msg->rpc_argp;
 
@@ -508,11 +519,12 @@ static int rpcb_unregister_all_protofamilies(struct rpc_message *msg)
         map->r_addr = "";
         msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
 
-        return rpcb_register_call(rpcb_local_clnt4, msg);
+        return rpcb_register_call(sn->rpcb_local_clnt4, msg);
 }
 
 /**
  * rpcb_v4_register - set or unset a port registration with the local rpcbind
+ * @net: target network namespace
  * @program: RPC program number of service to (un)register
  * @version: RPC version number of service to (un)register
  * @address: address family, IP address, and port to (un)register
@@ -554,7 +566,7 @@ static int rpcb_unregister_all_protofamilies(struct rpc_message *msg)
  * service on any IPv4 address, but not on IPv6.  The latter
  * advertises the service on all IPv4 and IPv6 addresses.
  */
-int rpcb_v4_register(const u32 program, const u32 version,
+int rpcb_v4_register(struct net *net, const u32 program, const u32 version,
                      const struct sockaddr *address, const char *netid)
 {
         struct rpcbind_args map = {
@@ -566,18 +578,19 @@ int rpcb_v4_register(const u32 program, const u32 version,
         struct rpc_message msg = {
                 .rpc_argp       = &map,
         };
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 
-        if (rpcb_local_clnt4 == NULL)
+        if (sn->rpcb_local_clnt4 == NULL)
                 return -EPROTONOSUPPORT;
 
         if (address == NULL)
-                return rpcb_unregister_all_protofamilies(&msg);
+                return rpcb_unregister_all_protofamilies(sn, &msg);
 
         switch (address->sa_family) {
         case AF_INET:
-                return rpcb_register_inet4(address, &msg);
+                return rpcb_register_inet4(sn, address, &msg);
         case AF_INET6:
-                return rpcb_register_inet6(address, &msg);
+                return rpcb_register_inet6(sn, address, &msg);
         }
 
         return -EAFNOSUPPORT;
@@ -611,9 +624,10 @@ static struct rpc_task *rpcb_call_async(struct rpc_clnt *rpcb_clnt, struct rpcbi
 static struct rpc_clnt *rpcb_find_transport_owner(struct rpc_clnt *clnt)
 {
         struct rpc_clnt *parent = clnt->cl_parent;
+        struct rpc_xprt *xprt = rcu_dereference(clnt->cl_xprt);
 
         while (parent != clnt) {
-                if (parent->cl_xprt != clnt->cl_xprt)
+                if (rcu_dereference(parent->cl_xprt) != xprt)
                         break;
                 if (clnt->cl_autobind)
                         break;
@@ -644,12 +658,16 @@ void rpcb_getport_async(struct rpc_task *task)
         size_t salen;
         int status;
 
-        clnt = rpcb_find_transport_owner(task->tk_client);
-        xprt = clnt->cl_xprt;
+        rcu_read_lock();
+        do {
+                clnt = rpcb_find_transport_owner(task->tk_client);
+                xprt = xprt_get(rcu_dereference(clnt->cl_xprt));
+        } while (xprt == NULL);
+        rcu_read_unlock();
 
         dprintk("RPC: %5u %s(%s, %u, %u, %d)\n",
                 task->tk_pid, __func__,
-                clnt->cl_server, clnt->cl_prog, clnt->cl_vers, xprt->prot);
+                xprt->servername, clnt->cl_prog, clnt->cl_vers, xprt->prot);
 
         /* Put self on the wait queue to ensure we get notified if
          * some other task is already attempting to bind the port */
@@ -658,6 +676,7 @@ void rpcb_getport_async(struct rpc_task *task)
         if (xprt_test_and_set_binding(xprt)) {
                 dprintk("RPC: %5u %s: waiting for another binder\n",
                         task->tk_pid, __func__);
+                xprt_put(xprt);
                 return;
         }
 
@@ -699,8 +718,8 @@ void rpcb_getport_async(struct rpc_task *task)
         dprintk("RPC: %5u %s: trying rpcbind version %u\n",
                 task->tk_pid, __func__, bind_version);
 
-        rpcb_clnt = rpcb_create(clnt->cl_server, sap, salen, xprt->prot,
-                                bind_version);
+        rpcb_clnt = rpcb_create(xprt->xprt_net, xprt->servername, sap, salen,
+                                xprt->prot, bind_version);
         if (IS_ERR(rpcb_clnt)) {
                 status = PTR_ERR(rpcb_clnt);
                 dprintk("RPC: %5u %s: rpcb_create failed, error %ld\n",
@@ -719,13 +738,13 @@ void rpcb_getport_async(struct rpc_task *task)
         map->r_vers = clnt->cl_vers;
         map->r_prot = xprt->prot;
         map->r_port = 0;
-        map->r_xprt = xprt_get(xprt);
+        map->r_xprt = xprt;
         map->r_status = -EIO;
 
         switch (bind_version) {
         case RPCBVERS_4:
         case RPCBVERS_3:
-                map->r_netid = rpc_peeraddr2str(clnt, RPC_DISPLAY_NETID);
+                map->r_netid = xprt->address_strings[RPC_DISPLAY_NETID];
                 map->r_addr = rpc_sockaddr2uaddr(sap, GFP_ATOMIC);
                 map->r_owner = "";
                 break;
@@ -754,6 +773,7 @@ bailout_release_client:
 bailout_nofree:
         rpcb_wake_rpcbind_waiters(xprt, status);
         task->tk_status = status;
+        xprt_put(xprt);
 }
 EXPORT_SYMBOL_GPL(rpcb_getport_async);
 
@@ -801,11 +821,11 @@ static void rpcb_getport_done(struct rpc_task *child, void *data)
 static void rpcb_enc_mapping(struct rpc_rqst *req, struct xdr_stream *xdr,
                              const struct rpcbind_args *rpcb)
 {
-        struct rpc_task *task = req->rq_task;
         __be32 *p;
 
         dprintk("RPC: %5u encoding PMAP_%s call (%u, %u, %d, %u)\n",
-                        task->tk_pid, task->tk_msg.rpc_proc->p_name,
+                        req->rq_task->tk_pid,
+                        req->rq_task->tk_msg.rpc_proc->p_name,
                         rpcb->r_prog, rpcb->r_vers, rpcb->r_prot, rpcb->r_port);
 
         p = xdr_reserve_space(xdr, RPCB_mappingargs_sz << 2);
@@ -818,7 +838,6 @@ static void rpcb_enc_mapping(struct rpc_rqst *req, struct xdr_stream *xdr,
 static int rpcb_dec_getport(struct rpc_rqst *req, struct xdr_stream *xdr,
                             struct rpcbind_args *rpcb)
 {
-        struct rpc_task *task = req->rq_task;
         unsigned long port;
         __be32 *p;
 
@@ -829,8 +848,8 @@ static int rpcb_dec_getport(struct rpc_rqst *req, struct xdr_stream *xdr,
                 return -EIO;
 
         port = be32_to_cpup(p);
-        dprintk("RPC: %5u PMAP_%s result: %lu\n", task->tk_pid,
-                        task->tk_msg.rpc_proc->p_name, port);
+        dprintk("RPC: %5u PMAP_%s result: %lu\n", req->rq_task->tk_pid,
+                        req->rq_task->tk_msg.rpc_proc->p_name, port);
         if (unlikely(port > USHRT_MAX))
                 return -EIO;
 
@@ -841,7 +860,6 @@ static int rpcb_dec_getport(struct rpc_rqst *req, struct xdr_stream *xdr,
 static int rpcb_dec_set(struct rpc_rqst *req, struct xdr_stream *xdr,
                         unsigned int *boolp)
 {
-        struct rpc_task *task = req->rq_task;
         __be32 *p;
 
         p = xdr_inline_decode(xdr, 4);
@@ -853,7 +871,8 @@ static int rpcb_dec_set(struct rpc_rqst *req, struct xdr_stream *xdr,
                 *boolp = 1;
 
         dprintk("RPC: %5u RPCB_%s call %s\n",
-                        task->tk_pid, task->tk_msg.rpc_proc->p_name,
+                        req->rq_task->tk_pid,
+                        req->rq_task->tk_msg.rpc_proc->p_name,
                         (*boolp ? "succeeded" : "failed"));
         return 0;
 }
@@ -873,11 +892,11 @@ static void encode_rpcb_string(struct xdr_stream *xdr, const char *string,
 static void rpcb_enc_getaddr(struct rpc_rqst *req, struct xdr_stream *xdr,
                              const struct rpcbind_args *rpcb)
 {
-        struct rpc_task *task = req->rq_task;
         __be32 *p;
 
         dprintk("RPC: %5u encoding RPCB_%s call (%u, %u, '%s', '%s')\n",
-                        task->tk_pid, task->tk_msg.rpc_proc->p_name,
+                        req->rq_task->tk_pid,
+                        req->rq_task->tk_msg.rpc_proc->p_name,
                         rpcb->r_prog, rpcb->r_vers,
                         rpcb->r_netid, rpcb->r_addr);
 
@@ -895,7 +914,6 @@ static int rpcb_dec_getaddr(struct rpc_rqst *req, struct xdr_stream *xdr,
 {
         struct sockaddr_storage address;
         struct sockaddr *sap = (struct sockaddr *)&address;
-        struct rpc_task *task = req->rq_task;
         __be32 *p;
         u32 len;
 
@@ -912,7 +930,7 @@ static int rpcb_dec_getaddr(struct rpc_rqst *req, struct xdr_stream *xdr,
          */
         if (len == 0) {
                 dprintk("RPC: %5u RPCB reply: program not registered\n",
-                                task->tk_pid);
+                                req->rq_task->tk_pid);
                 return 0;
         }
 
@@ -922,10 +940,11 @@ static int rpcb_dec_getaddr(struct rpc_rqst *req, struct xdr_stream *xdr,
         p = xdr_inline_decode(xdr, len);
         if (unlikely(p == NULL))
                 goto out_fail;
-        dprintk("RPC: %5u RPCB_%s reply: %s\n", task->tk_pid,
-                        task->tk_msg.rpc_proc->p_name, (char *)p);
+        dprintk("RPC: %5u RPCB_%s reply: %s\n", req->rq_task->tk_pid,
+                        req->rq_task->tk_msg.rpc_proc->p_name, (char *)p);
 
-        if (rpc_uaddr2sockaddr((char *)p, len, sap, sizeof(address)) == 0)
+        if (rpc_uaddr2sockaddr(req->rq_xprt->xprt_net, (char *)p, len,
+                                sap, sizeof(address)) == 0)
                 goto out_fail;
         rpcb->r_port = rpc_get_port(sap);
 
@@ -933,7 +952,8 @@ static int rpcb_dec_getaddr(struct rpc_rqst *req, struct xdr_stream *xdr,
 
 out_fail:
         dprintk("RPC: %5u malformed RPCB_%s reply\n",
-                        task->tk_pid, task->tk_msg.rpc_proc->p_name);
+                        req->rq_task->tk_pid,
+                        req->rq_task->tk_msg.rpc_proc->p_name);
         return -EIO;
 }
 
@@ -1041,7 +1061,7 @@ static struct rpc_procinfo rpcb_procedures4[] = {
         },
 };
 
-static struct rpcb_info rpcb_next_version[] = {
+static const struct rpcb_info rpcb_next_version[] = {
         {
                 .rpc_vers       = RPCBVERS_2,
                 .rpc_proc       = &rpcb_procedures2[RPCBPROC_GETPORT],
@@ -1051,7 +1071,7 @@ static struct rpcb_info rpcb_next_version[] = {
         },
 };
 
-static struct rpcb_info rpcb_next_version6[] = {
+static const struct rpcb_info rpcb_next_version6[] = {
         {
                 .rpc_vers       = RPCBVERS_4,
                 .rpc_proc       = &rpcb_procedures4[RPCBPROC_GETADDR],
@@ -1065,25 +1085,25 @@ static struct rpcb_info rpcb_next_version6[] = {
         },
 };
 
-static struct rpc_version rpcb_version2 = {
+static const struct rpc_version rpcb_version2 = {
         .number         = RPCBVERS_2,
         .nrprocs        = ARRAY_SIZE(rpcb_procedures2),
         .procs          = rpcb_procedures2
 };
 
-static struct rpc_version rpcb_version3 = {
+static const struct rpc_version rpcb_version3 = {
         .number         = RPCBVERS_3,
         .nrprocs        = ARRAY_SIZE(rpcb_procedures3),
         .procs          = rpcb_procedures3
 };
 
-static struct rpc_version rpcb_version4 = {
+static const struct rpc_version rpcb_version4 = {
         .number         = RPCBVERS_4,
         .nrprocs        = ARRAY_SIZE(rpcb_procedures4),
         .procs          = rpcb_procedures4
 };
 
-static struct rpc_version *rpcb_version[] = {
+static const struct rpc_version *rpcb_version[] = {
         NULL,
         NULL,
         &rpcb_version2,
@@ -1093,7 +1113,7 @@ static struct rpc_version *rpcb_version[] = {
 
 static struct rpc_stat rpcb_stats;
 
-static struct rpc_program rpcb_program = {
+static const struct rpc_program rpcb_program = {
         .name           = "rpcbind",
         .number         = RPCBIND_PROGRAM,
         .nrvers         = ARRAY_SIZE(rpcb_version),
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 3341d8962786..994cfea2bad6 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -28,6 +28,9 @@
 #define RPCDBG_FACILITY         RPCDBG_SCHED
 #endif
 
+#define CREATE_TRACE_POINTS
+#include <trace/events/sunrpc.h>
+
 /*
  * RPC slabs and memory pools
  */
@@ -205,9 +208,7 @@ static void __rpc_init_priority_wait_queue(struct rpc_wait_queue *queue, const c
         queue->qlen = 0;
         setup_timer(&queue->timer_list.timer, __rpc_queue_timer_fn, (unsigned long)queue);
         INIT_LIST_HEAD(&queue->timer_list.list);
-#ifdef RPC_DEBUG
-        queue->name = qname;
-#endif
+        rpc_assign_waitqueue_name(queue, qname);
 }
 
 void rpc_init_priority_wait_queue(struct rpc_wait_queue *queue, const char *qname)
@@ -251,6 +252,8 @@ static inline void rpc_task_set_debuginfo(struct rpc_task *task)
 
 static void rpc_set_active(struct rpc_task *task)
 {
+        trace_rpc_task_begin(task->tk_client, task, NULL);
+
         rpc_task_set_debuginfo(task);
         set_bit(RPC_TASK_ACTIVE, &task->tk_runstate);
 }
@@ -267,6 +270,8 @@ static int rpc_complete_task(struct rpc_task *task)
         unsigned long flags;
         int ret;
 
+        trace_rpc_task_complete(task->tk_client, task, NULL);
+
         spin_lock_irqsave(&wq->lock, flags);
         clear_bit(RPC_TASK_ACTIVE, &task->tk_runstate);
         ret = atomic_dec_and_test(&task->tk_count);
@@ -324,6 +329,8 @@ static void __rpc_sleep_on_priority(struct rpc_wait_queue *q,
         dprintk("RPC: %5u sleep_on(queue \"%s\" time %lu)\n",
                         task->tk_pid, rpc_qname(q), jiffies);
 
+        trace_rpc_task_sleep(task->tk_client, task, q);
+
         __rpc_add_wait_queue(q, task, queue_priority);
 
         BUG_ON(task->tk_callback != NULL);
@@ -378,6 +385,8 @@ static void __rpc_do_wake_up_task(struct rpc_wait_queue *queue, struct rpc_task
                 return;
         }
 
+        trace_rpc_task_wakeup(task->tk_client, task, queue);
+
         __rpc_remove_wait_queue(queue, task);
 
         rpc_make_runnable(task);
@@ -422,7 +431,7 @@ EXPORT_SYMBOL_GPL(rpc_wake_up_queued_task);
 /*
  * Wake up the next task on a priority queue.
  */
-static struct rpc_task * __rpc_wake_up_next_priority(struct rpc_wait_queue *queue)
+static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *queue)
 {
         struct list_head *q;
         struct rpc_task *task;
@@ -467,30 +476,54 @@ new_queue:
 new_owner:
         rpc_set_waitqueue_owner(queue, task->tk_owner);
 out:
-        rpc_wake_up_task_queue_locked(queue, task);
         return task;
 }
 
+static struct rpc_task *__rpc_find_next_queued(struct rpc_wait_queue *queue)
+{
+        if (RPC_IS_PRIORITY(queue))
+                return __rpc_find_next_queued_priority(queue);
+        if (!list_empty(&queue->tasks[0]))
+                return list_first_entry(&queue->tasks[0], struct rpc_task, u.tk_wait.list);
+        return NULL;
+}
+
 /*
- * Wake up the next task on the wait queue.
+ * Wake up the first task on the wait queue.
  */
-struct rpc_task * rpc_wake_up_next(struct rpc_wait_queue *queue)
+struct rpc_task *rpc_wake_up_first(struct rpc_wait_queue *queue,
+                bool (*func)(struct rpc_task *, void *), void *data)
 {
         struct rpc_task *task = NULL;
 
-        dprintk("RPC:       wake_up_next(%p \"%s\")\n",
+        dprintk("RPC:       wake_up_first(%p \"%s\")\n",
                         queue, rpc_qname(queue));
         spin_lock_bh(&queue->lock);
-        if (RPC_IS_PRIORITY(queue))
-                task = __rpc_wake_up_next_priority(queue);
-        else {
-                task_for_first(task, &queue->tasks[0])
+        task = __rpc_find_next_queued(queue);
+        if (task != NULL) {
+                if (func(task, data))
                         rpc_wake_up_task_queue_locked(queue, task);
+                else
+                        task = NULL;
         }
         spin_unlock_bh(&queue->lock);
 
         return task;
 }
+EXPORT_SYMBOL_GPL(rpc_wake_up_first);
+
+static bool rpc_wake_up_next_func(struct rpc_task *task, void *data)
+{
+        return true;
+}
+
+/*
+ * Wake up the next task on the wait queue.
+*/
+struct rpc_task *rpc_wake_up_next(struct rpc_wait_queue *queue)
+{
+        return rpc_wake_up_first(queue, rpc_wake_up_next_func, NULL);
+}
 EXPORT_SYMBOL_GPL(rpc_wake_up_next);
 
 /**
@@ -501,14 +534,18 @@ EXPORT_SYMBOL_GPL(rpc_wake_up_next);
  */
 void rpc_wake_up(struct rpc_wait_queue *queue)
 {
-        struct rpc_task *task, *next;
         struct list_head *head;
 
         spin_lock_bh(&queue->lock);
         head = &queue->tasks[queue->maxpriority];
         for (;;) {
-                list_for_each_entry_safe(task, next, head, u.tk_wait.list)
+                while (!list_empty(head)) {
+                        struct rpc_task *task;
+                        task = list_first_entry(head,
+                                        struct rpc_task,
+                                        u.tk_wait.list);
                         rpc_wake_up_task_queue_locked(queue, task);
+                }
                 if (head == &queue->tasks[0])
                         break;
                 head--;
@@ -526,13 +563,16 @@ EXPORT_SYMBOL_GPL(rpc_wake_up);
  */
 void rpc_wake_up_status(struct rpc_wait_queue *queue, int status)
 {
-        struct rpc_task *task, *next;
         struct list_head *head;
 
         spin_lock_bh(&queue->lock);
         head = &queue->tasks[queue->maxpriority];
         for (;;) {
-                list_for_each_entry_safe(task, next, head, u.tk_wait.list) {
+                while (!list_empty(head)) {
+                        struct rpc_task *task;
+                        task = list_first_entry(head,
+                                        struct rpc_task,
+                                        u.tk_wait.list);
                         task->tk_status = status;
                         rpc_wake_up_task_queue_locked(queue, task);
                 }
@@ -677,6 +717,7 @@ static void __rpc_execute(struct rpc_task *task)
                         if (do_action == NULL)
                                 break;
                 }
+                trace_rpc_task_run_action(task->tk_client, task, task->tk_action);
                 do_action(task);
 
                 /*
diff --git a/net/sunrpc/socklib.c b/net/sunrpc/socklib.c
index 145e6784f508..0a648c502fc3 100644
--- a/net/sunrpc/socklib.c
+++ b/net/sunrpc/socklib.c
@@ -114,7 +114,7 @@ ssize_t xdr_partial_copy_from_skb(struct xdr_buf *xdr, unsigned int base, struct
                 }
 
                 len = PAGE_CACHE_SIZE;
-                kaddr = kmap_atomic(*ppage, KM_SKB_SUNRPC_DATA);
+                kaddr = kmap_atomic(*ppage);
                 if (base) {
                         len -= base;
                         if (pglen < len)
@@ -127,7 +127,7 @@ ssize_t xdr_partial_copy_from_skb(struct xdr_buf *xdr, unsigned int base, struct
                         ret = copy_actor(desc, kaddr, len);
                 }
                 flush_dcache_page(*ppage);
-                kunmap_atomic(kaddr, KM_SKB_SUNRPC_DATA);
+                kunmap_atomic(kaddr);
                 copied += ret;
                 if (ret != len || !desc->count)
                         goto out;
diff --git a/net/sunrpc/stats.c b/net/sunrpc/stats.c
index 80df89d957ba..bc2068ee795b 100644
--- a/net/sunrpc/stats.c
+++ b/net/sunrpc/stats.c
@@ -22,6 +22,7 @@
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/svcsock.h>
 #include <linux/sunrpc/metrics.h>
+#include <linux/rcupdate.h>
 
 #include "netns.h"
 
@@ -133,20 +134,19 @@ EXPORT_SYMBOL_GPL(rpc_free_iostats);
 /**
  * rpc_count_iostats - tally up per-task stats
  * @task: completed rpc_task
+ * @stats: array of stat structures
  *
  * Relies on the caller for serialization.
  */
-void rpc_count_iostats(struct rpc_task *task)
+void rpc_count_iostats(const struct rpc_task *task, struct rpc_iostats *stats)
 {
         struct rpc_rqst *req = task->tk_rqstp;
-        struct rpc_iostats *stats;
         struct rpc_iostats *op_metrics;
         ktime_t delta;
 
-        if (!task->tk_client || !task->tk_client->cl_metrics || !req)
+        if (!stats || !req)
                 return;
 
-        stats = task->tk_client->cl_metrics;
         op_metrics = &stats[task->tk_msg.rpc_proc->p_statidx];
 
         op_metrics->om_ops++;
@@ -164,6 +164,7 @@ void rpc_count_iostats(struct rpc_task *task)
         delta = ktime_sub(ktime_get(), task->tk_start);
         op_metrics->om_execute = ktime_add(op_metrics->om_execute, delta);
 }
+EXPORT_SYMBOL_GPL(rpc_count_iostats);
 
 static void _print_name(struct seq_file *seq, unsigned int op,
                         struct rpc_procinfo *procs)
@@ -179,7 +180,7 @@ static void _print_name(struct seq_file *seq, unsigned int op,
 void rpc_print_iostats(struct seq_file *seq, struct rpc_clnt *clnt)
 {
         struct rpc_iostats *stats = clnt->cl_metrics;
-        struct rpc_xprt *xprt = clnt->cl_xprt;
+        struct rpc_xprt *xprt;
         unsigned int op, maxproc = clnt->cl_maxproc;
 
         if (!stats)
@@ -189,8 +190,11 @@ void rpc_print_iostats(struct seq_file *seq, struct rpc_clnt *clnt)
         seq_printf(seq, "p/v: %u/%u (%s)\n",
                         clnt->cl_prog, clnt->cl_vers, clnt->cl_protname);
 
+        rcu_read_lock();
+        xprt = rcu_dereference(clnt->cl_xprt);
         if (xprt)
                 xprt->ops->print_stats(xprt, seq);
+        rcu_read_unlock();
 
         seq_printf(seq, "\tper-op statistics\n");
         for (op = 0; op < maxproc; op++) {
@@ -213,45 +217,46 @@ EXPORT_SYMBOL_GPL(rpc_print_iostats);
  * Register/unregister RPC proc files
  */
 static inline struct proc_dir_entry *
-do_register(const char *name, void *data, const struct file_operations *fops)
+do_register(struct net *net, const char *name, void *data,
+            const struct file_operations *fops)
 {
         struct sunrpc_net *sn;
 
         dprintk("RPC:       registering /proc/net/rpc/%s\n", name);
-        sn = net_generic(&init_net, sunrpc_net_id);
+        sn = net_generic(net, sunrpc_net_id);
         return proc_create_data(name, 0, sn->proc_net_rpc, fops, data);
 }
 
 struct proc_dir_entry *
-rpc_proc_register(struct rpc_stat *statp)
+rpc_proc_register(struct net *net, struct rpc_stat *statp)
 {
-        return do_register(statp->program->name, statp, &rpc_proc_fops);
+        return do_register(net, statp->program->name, statp, &rpc_proc_fops);
 }
 EXPORT_SYMBOL_GPL(rpc_proc_register);
 
 void
-rpc_proc_unregister(const char *name)
+rpc_proc_unregister(struct net *net, const char *name)
 {
         struct sunrpc_net *sn;
 
-        sn = net_generic(&init_net, sunrpc_net_id);
+        sn = net_generic(net, sunrpc_net_id);
         remove_proc_entry(name, sn->proc_net_rpc);
 }
 EXPORT_SYMBOL_GPL(rpc_proc_unregister);
 
 struct proc_dir_entry *
-svc_proc_register(struct svc_stat *statp, const struct file_operations *fops)
+svc_proc_register(struct net *net, struct svc_stat *statp, const struct file_operations *fops)
 {
-        return do_register(statp->program->pg_name, statp, fops);
+        return do_register(net, statp->program->pg_name, statp, fops);
 }
 EXPORT_SYMBOL_GPL(svc_proc_register);
 
 void
-svc_proc_unregister(const char *name)
+svc_proc_unregister(struct net *net, const char *name)
 {
         struct sunrpc_net *sn;
 
-        sn = net_generic(&init_net, sunrpc_net_id);
+        sn = net_generic(net, sunrpc_net_id);
         remove_proc_entry(name, sn->proc_net_rpc);
 }
 EXPORT_SYMBOL_GPL(svc_proc_unregister);
diff --git a/net/sunrpc/sunrpc.h b/net/sunrpc/sunrpc.h
index 90c292e2738b..14c9f6d1c5ff 100644
--- a/net/sunrpc/sunrpc.h
+++ b/net/sunrpc/sunrpc.h
@@ -47,5 +47,7 @@ int svc_send_common(struct socket *sock, struct xdr_buf *xdr,
                     struct page *headpage, unsigned long headoffset,
                     struct page *tailpage, unsigned long tailoffset);
 
+int rpc_clients_notifier_register(void);
+void rpc_clients_notifier_unregister(void);
 #endif /* _NET_SUNRPC_SUNRPC_H */
 
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index 8ec9778c3f4a..3d6498af9adc 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -25,10 +25,12 @@
 #include "netns.h"
 
 int sunrpc_net_id;
+EXPORT_SYMBOL_GPL(sunrpc_net_id);
 
 static __net_init int sunrpc_init_net(struct net *net)
 {
         int err;
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 
         err = rpc_proc_init(net);
         if (err)
@@ -38,8 +40,18 @@ static __net_init int sunrpc_init_net(struct net *net)
         if (err)
                 goto err_ipmap;
 
+        err = unix_gid_cache_create(net);
+        if (err)
+                goto err_unixgid;
+
+        rpc_pipefs_init_net(net);
+        INIT_LIST_HEAD(&sn->all_clients);
+        spin_lock_init(&sn->rpc_client_lock);
+        spin_lock_init(&sn->rpcb_clnt_lock);
         return 0;
 
+err_unixgid:
+        ip_map_cache_destroy(net);
 err_ipmap:
         rpc_proc_exit(net);
 err_proc:
@@ -48,6 +60,7 @@ err_proc:
 
 static __net_exit void sunrpc_exit_net(struct net *net)
 {
+        unix_gid_cache_destroy(net);
         ip_map_cache_destroy(net);
         rpc_proc_exit(net);
 }
@@ -59,40 +72,38 @@ static struct pernet_operations sunrpc_net_ops = {
         .size = sizeof(struct sunrpc_net),
 };
 
-extern struct cache_detail unix_gid_cache;
-
 static int __init
 init_sunrpc(void)
 {
-        int err = register_rpc_pipefs();
+        int err = rpc_init_mempool();
         if (err)
                 goto out;
-        err = rpc_init_mempool();
-        if (err)
-                goto out2;
         err = rpcauth_init_module();
         if (err)
-                goto out3;
+                goto out2;
 
         cache_initialize();
 
         err = register_pernet_subsys(&sunrpc_net_ops);
         if (err)
+                goto out3;
+
+        err = register_rpc_pipefs();
+        if (err)
                 goto out4;
 #ifdef RPC_DEBUG
         rpc_register_sysctl();
 #endif
-        cache_register(&unix_gid_cache);
         svc_init_xprt_sock();   /* svc sock transport */
         init_socket_xprt();     /* clnt sock transport */
         return 0;
 
 out4:
-        rpcauth_remove_module();
+        unregister_pernet_subsys(&sunrpc_net_ops);
 out3:
-        rpc_destroy_mempool();
+        rpcauth_remove_module();
 out2:
-        unregister_rpc_pipefs();
+        rpc_destroy_mempool();
 out:
         return err;
 }
@@ -105,7 +116,6 @@ cleanup_sunrpc(void)
         svc_cleanup_xprt_sock();
         unregister_rpc_pipefs();
         rpc_destroy_mempool();
-        cache_unregister(&unix_gid_cache);
         unregister_pernet_subsys(&sunrpc_net_ops);
 #ifdef RPC_DEBUG
         rpc_unregister_sysctl();
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index e4aabc02368b..7e9baaa1e543 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -20,6 +20,7 @@
 #include <linux/module.h>
 #include <linux/kthread.h>
 #include <linux/slab.h>
+#include <linux/nsproxy.h>
 
 #include <linux/sunrpc/types.h>
 #include <linux/sunrpc/xdr.h>
@@ -30,7 +31,7 @@
 
 #define RPCDBG_FACILITY RPCDBG_SVCDSP
 
-static void svc_unregister(const struct svc_serv *serv);
+static void svc_unregister(const struct svc_serv *serv, struct net *net);
 
 #define svc_serv_is_pooled(serv)    ((serv)->sv_function)
 
@@ -368,23 +369,24 @@ svc_pool_for_cpu(struct svc_serv *serv, int cpu)
         return &serv->sv_pools[pidx % serv->sv_nrpools];
 }
 
-static int svc_rpcb_setup(struct svc_serv *serv)
+int svc_rpcb_setup(struct svc_serv *serv, struct net *net)
 {
         int err;
 
-        err = rpcb_create_local();
+        err = rpcb_create_local(net);
         if (err)
                 return err;
 
         /* Remove any stale portmap registrations */
-        svc_unregister(serv);
+        svc_unregister(serv, net);
         return 0;
 }
+EXPORT_SYMBOL_GPL(svc_rpcb_setup);
 
-void svc_rpcb_cleanup(struct svc_serv *serv)
+void svc_rpcb_cleanup(struct svc_serv *serv, struct net *net)
 {
-        svc_unregister(serv);
-        rpcb_put_local();
+        svc_unregister(serv, net);
+        rpcb_put_local(net);
 }
 EXPORT_SYMBOL_GPL(svc_rpcb_cleanup);
 
@@ -405,12 +407,20 @@ static int svc_uses_rpcbind(struct svc_serv *serv)
         return 0;
 }
 
+int svc_bind(struct svc_serv *serv, struct net *net)
+{
+        if (!svc_uses_rpcbind(serv))
+                return 0;
+        return svc_rpcb_setup(serv, net);
+}
+EXPORT_SYMBOL_GPL(svc_bind);
+
 /*
  * Create an RPC service
  */
 static struct svc_serv *
 __svc_create(struct svc_program *prog, unsigned int bufsize, int npools,
-             void (*shutdown)(struct svc_serv *serv))
+             void (*shutdown)(struct svc_serv *serv, struct net *net))
 {
         struct svc_serv *serv;
         unsigned int vers;
@@ -469,22 +479,15 @@ __svc_create(struct svc_program *prog, unsigned int bufsize, int npools,
                 spin_lock_init(&pool->sp_lock);
         }
 
-        if (svc_uses_rpcbind(serv)) {
-                if (svc_rpcb_setup(serv) < 0) {
-                        kfree(serv->sv_pools);
-                        kfree(serv);
-                        return NULL;
-                }
-                if (!serv->sv_shutdown)
-                        serv->sv_shutdown = svc_rpcb_cleanup;
-        }
+        if (svc_uses_rpcbind(serv) && (!serv->sv_shutdown))
+                serv->sv_shutdown = svc_rpcb_cleanup;
 
         return serv;
 }
 
 struct svc_serv *
 svc_create(struct svc_program *prog, unsigned int bufsize,
-           void (*shutdown)(struct svc_serv *serv))
+           void (*shutdown)(struct svc_serv *serv, struct net *net))
 {
         return __svc_create(prog, bufsize, /*npools*/1, shutdown);
 }
@@ -492,7 +495,7 @@ EXPORT_SYMBOL_GPL(svc_create);
 
 struct svc_serv *
 svc_create_pooled(struct svc_program *prog, unsigned int bufsize,
-                  void (*shutdown)(struct svc_serv *serv),
+                  void (*shutdown)(struct svc_serv *serv, struct net *net),
                   svc_thread_fn func, struct module *mod)
 {
         struct svc_serv *serv;
@@ -509,6 +512,24 @@ svc_create_pooled(struct svc_program *prog, unsigned int bufsize,
 }
 EXPORT_SYMBOL_GPL(svc_create_pooled);
 
+void svc_shutdown_net(struct svc_serv *serv, struct net *net)
+{
+        /*
+         * The set of xprts (contained in the sv_tempsocks and
+         * sv_permsocks lists) is now constant, since it is modified
+         * only by accepting new sockets (done by service threads in
+         * svc_recv) or aging old ones (done by sv_temptimer), or
+         * configuration changes (excluded by whatever locking the
+         * caller is using--nfsd_mutex in the case of nfsd).  So it's
+         * safe to traverse those lists and shut everything down:
+         */
+        svc_close_net(serv, net);
+
+        if (serv->sv_shutdown)
+                serv->sv_shutdown(serv, net);
+}
+EXPORT_SYMBOL_GPL(svc_shutdown_net);
+
 /*
  * Destroy an RPC service. Should be called with appropriate locking to
  * protect the sv_nrthreads, sv_permsocks and sv_tempsocks.
@@ -529,19 +550,13 @@ svc_destroy(struct svc_serv *serv)
                 printk("svc_destroy: no threads for serv=%p!\n", serv);
 
         del_timer_sync(&serv->sv_temptimer);
+
         /*
-         * The set of xprts (contained in the sv_tempsocks and
-         * sv_permsocks lists) is now constant, since it is modified
-         * only by accepting new sockets (done by service threads in
-         * svc_recv) or aging old ones (done by sv_temptimer), or
-         * configuration changes (excluded by whatever locking the
-         * caller is using--nfsd_mutex in the case of nfsd).  So it's
-         * safe to traverse those lists and shut everything down:
+         * The last user is gone and thus all sockets have to be destroyed to
+         * the point. Check this.
          */
-        svc_close_all(serv);
-
-        if (serv->sv_shutdown)
-                serv->sv_shutdown(serv);
+        BUG_ON(!list_empty(&serv->sv_permsocks));
+        BUG_ON(!list_empty(&serv->sv_tempsocks));
 
         cache_clean_deferred(serv);
 
@@ -795,7 +810,8 @@ EXPORT_SYMBOL_GPL(svc_exit_thread);
  * Returns zero on success; a negative errno value is returned
  * if any error occurs.
  */
-static int __svc_rpcb_register4(const u32 program, const u32 version,
+static int __svc_rpcb_register4(struct net *net, const u32 program,
+                                const u32 version,
                                 const unsigned short protocol,
                                 const unsigned short port)
 {
@@ -818,7 +834,7 @@ static int __svc_rpcb_register4(const u32 program, const u32 version,
                 return -ENOPROTOOPT;
         }
 
-        error = rpcb_v4_register(program, version,
+        error = rpcb_v4_register(net, program, version,
                                         (const struct sockaddr *)&sin, netid);
 
         /*
@@ -826,7 +842,7 @@ static int __svc_rpcb_register4(const u32 program, const u32 version,
          * registration request with the legacy rpcbind v2 protocol.
          */
         if (error == -EPROTONOSUPPORT)
-                error = rpcb_register(program, version, protocol, port);
+                error = rpcb_register(net, program, version, protocol, port);
 
         return error;
 }
@@ -842,7 +858,8 @@ static int __svc_rpcb_register4(const u32 program, const u32 version,
  * Returns zero on success; a negative errno value is returned
  * if any error occurs.
  */
-static int __svc_rpcb_register6(const u32 program, const u32 version,
+static int __svc_rpcb_register6(struct net *net, const u32 program,
+                                const u32 version,
                                 const unsigned short protocol,
                                 const unsigned short port)
 {
@@ -865,7 +882,7 @@ static int __svc_rpcb_register6(const u32 program, const u32 version,
                 return -ENOPROTOOPT;
         }
 
-        error = rpcb_v4_register(program, version,
+        error = rpcb_v4_register(net, program, version,
                                         (const struct sockaddr *)&sin6, netid);
 
         /*
@@ -885,7 +902,7 @@ static int __svc_rpcb_register6(const u32 program, const u32 version,
  * Returns zero on success; a negative errno value is returned
  * if any error occurs.
  */
-static int __svc_register(const char *progname,
+static int __svc_register(struct net *net, const char *progname,
                           const u32 program, const u32 version,
                           const int family,
                           const unsigned short protocol,
@@ -895,12 +912,12 @@ static int __svc_register(const char *progname,
 
         switch (family) {
         case PF_INET:
-                error = __svc_rpcb_register4(program, version,
+                error = __svc_rpcb_register4(net, program, version,
                                                 protocol, port);
                 break;
 #if IS_ENABLED(CONFIG_IPV6)
         case PF_INET6:
-                error = __svc_rpcb_register6(program, version,
+                error = __svc_rpcb_register6(net, program, version,
                                                 protocol, port);
 #endif
         }
@@ -914,14 +931,16 @@ static int __svc_register(const char *progname,
 /**
  * svc_register - register an RPC service with the local portmapper
  * @serv: svc_serv struct for the service to register
+ * @net: net namespace for the service to register
  * @family: protocol family of service's listener socket
  * @proto: transport protocol number to advertise
  * @port: port to advertise
  *
  * Service is registered for any address in the passed-in protocol family
  */
-int svc_register(const struct svc_serv *serv, const int family,
-                 const unsigned short proto, const unsigned short port)
+int svc_register(const struct svc_serv *serv, struct net *net,
+                 const int family, const unsigned short proto,
+                 const unsigned short port)
 {
         struct svc_program      *progp;
         unsigned int            i;
@@ -946,7 +965,7 @@ int svc_register(const struct svc_serv *serv, const int family,
                         if (progp->pg_vers[i]->vs_hidden)
                                 continue;
 
-                        error = __svc_register(progp->pg_name, progp->pg_prog,
+                        error = __svc_register(net, progp->pg_name, progp->pg_prog,
                                                 i, family, proto, port);
                         if (error < 0)
                                 break;
@@ -963,19 +982,19 @@ int svc_register(const struct svc_serv *serv, const int family,
  * any "inet6" entries anyway.  So a PMAP_UNSET should be sufficient
  * in this case to clear all existing entries for [program, version].
  */
-static void __svc_unregister(const u32 program, const u32 version,
+static void __svc_unregister(struct net *net, const u32 program, const u32 version,
                              const char *progname)
 {
         int error;
 
-        error = rpcb_v4_register(program, version, NULL, "");
+        error = rpcb_v4_register(net, program, version, NULL, "");
 
         /*
          * User space didn't support rpcbind v4, so retry this
          * request with the legacy rpcbind v2 protocol.
          */
         if (error == -EPROTONOSUPPORT)
-                error = rpcb_register(program, version, 0, 0);
+                error = rpcb_register(net, program, version, 0, 0);
 
         dprintk("svc: %s(%sv%u), error %d\n",
                         __func__, progname, version, error);
@@ -989,7 +1008,7 @@ static void __svc_unregister(const u32 program, const u32 version,
  * The result of unregistration is reported via dprintk for those who want
  * verification of the result, but is otherwise not important.
  */
-static void svc_unregister(const struct svc_serv *serv)
+static void svc_unregister(const struct svc_serv *serv, struct net *net)
 {
         struct svc_program *progp;
         unsigned long flags;
@@ -1006,7 +1025,7 @@ static void svc_unregister(const struct svc_serv *serv)
 
                         dprintk("svc: attempting to unregister %sv%u\n",
                                 progp->pg_name, i);
-                        __svc_unregister(progp->pg_prog, i, progp->pg_name);
+                        __svc_unregister(net, progp->pg_prog, i, progp->pg_name);
                 }
         }
 
@@ -1019,23 +1038,21 @@ static void svc_unregister(const struct svc_serv *serv)
  * Printk the given error with the address of the client that caused it.
  */
 static __printf(2, 3)
-int svc_printk(struct svc_rqst *rqstp, const char *fmt, ...)
+void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...)
 {
+        struct va_format vaf;
         va_list args;
-        int     r;
         char    buf[RPC_MAX_ADDRBUFLEN];
 
-        if (!net_ratelimit())
-                return 0;
+        va_start(args, fmt);
 
-        printk(KERN_WARNING "svc: %s: ",
-                svc_print_addr(rqstp, buf, sizeof(buf)));
+        vaf.fmt = fmt;
+        vaf.va = &args;
 
-        va_start(args, fmt);
-        r = vprintk(fmt, args);
-        va_end(args);
+        net_warn_ratelimited("svc: %s: %pV",
+                             svc_print_addr(rqstp, buf, sizeof(buf)), &vaf);
 
-        return r;
+        va_end(args);
 }
 
 /*
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 74cb0d8e9ca1..88f2bf671960 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -544,14 +544,11 @@ static void svc_check_conn_limits(struct svc_serv *serv)
                 struct svc_xprt *xprt = NULL;
                 spin_lock_bh(&serv->sv_lock);
                 if (!list_empty(&serv->sv_tempsocks)) {
-                        if (net_ratelimit()) {
-                                /* Try to help the admin */
-                                printk(KERN_NOTICE "%s: too many open  "
-                                       "connections, consider increasing %s\n",
-                                       serv->sv_name, serv->sv_maxconn ?
-                                       "the max number of connections." :
-                                       "the number of threads.");
-                        }
+                        /* Try to help the admin */
+                        net_notice_ratelimited("%s: too many open connections, consider increasing the %s\n",
+                                               serv->sv_name, serv->sv_maxconn ?
+                                               "max number of connections" :
+                                               "number of threads");
                         /*
                          * Always select the oldest connection. It's not fair,
                          * but so is life
@@ -601,6 +598,7 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
 
         /* now allocate needed pages.  If we get a failure, sleep briefly */
         pages = (serv->sv_max_mesg + PAGE_SIZE) / PAGE_SIZE;
+        BUG_ON(pages >= RPCSVC_MAXPAGES);
         for (i = 0; i < pages ; i++)
                 while (rqstp->rq_pages[i] == NULL) {
                         struct page *p = alloc_page(GFP_KERNEL);
@@ -615,7 +613,6 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                         rqstp->rq_pages[i] = p;
                 }
         rqstp->rq_pages[i++] = NULL; /* this might be seen in nfs_read_actor */
-        BUG_ON(pages >= RPCSVC_MAXPAGES);
 
         /* Make arg->head point to first page and arg->pages point to rest */
         arg = &rqstp->rq_arg;
@@ -922,48 +919,65 @@ void svc_close_xprt(struct svc_xprt *xprt)
 }
 EXPORT_SYMBOL_GPL(svc_close_xprt);
 
-static void svc_close_list(struct list_head *xprt_list)
+static void svc_close_list(struct list_head *xprt_list, struct net *net)
 {
         struct svc_xprt *xprt;
 
         list_for_each_entry(xprt, xprt_list, xpt_list) {
+                if (xprt->xpt_net != net)
+                        continue;
                 set_bit(XPT_CLOSE, &xprt->xpt_flags);
                 set_bit(XPT_BUSY, &xprt->xpt_flags);
         }
 }
 
-void svc_close_all(struct svc_serv *serv)
+static void svc_clear_pools(struct svc_serv *serv, struct net *net)
 {
         struct svc_pool *pool;
         struct svc_xprt *xprt;
         struct svc_xprt *tmp;
         int i;
 
-        svc_close_list(&serv->sv_tempsocks);
-        svc_close_list(&serv->sv_permsocks);
-
         for (i = 0; i < serv->sv_nrpools; i++) {
                 pool = &serv->sv_pools[i];
 
                 spin_lock_bh(&pool->sp_lock);
-                while (!list_empty(&pool->sp_sockets)) {
-                        xprt = list_first_entry(&pool->sp_sockets, struct svc_xprt, xpt_ready);
+                list_for_each_entry_safe(xprt, tmp, &pool->sp_sockets, xpt_ready) {
+                        if (xprt->xpt_net != net)
+                                continue;
                         list_del_init(&xprt->xpt_ready);
                 }
                 spin_unlock_bh(&pool->sp_lock);
         }
+}
+
+static void svc_clear_list(struct list_head *xprt_list, struct net *net)
+{
+        struct svc_xprt *xprt;
+        struct svc_xprt *tmp;
+
+        list_for_each_entry_safe(xprt, tmp, xprt_list, xpt_list) {
+                if (xprt->xpt_net != net)
+                        continue;
+                svc_delete_xprt(xprt);
+        }
+        list_for_each_entry(xprt, xprt_list, xpt_list)
+                BUG_ON(xprt->xpt_net == net);
+}
+
+void svc_close_net(struct svc_serv *serv, struct net *net)
+{
+        svc_close_list(&serv->sv_tempsocks, net);
+        svc_close_list(&serv->sv_permsocks, net);
+
+        svc_clear_pools(serv, net);
         /*
          * At this point the sp_sockets lists will stay empty, since
-         * svc_enqueue will not add new entries without taking the
+         * svc_xprt_enqueue will not add new entries without taking the
          * sp_lock and checking XPT_BUSY.
          */
-        list_for_each_entry_safe(xprt, tmp, &serv->sv_tempsocks, xpt_list)
-                svc_delete_xprt(xprt);
-        list_for_each_entry_safe(xprt, tmp, &serv->sv_permsocks, xpt_list)
-                svc_delete_xprt(xprt);
-
-        BUG_ON(!list_empty(&serv->sv_permsocks));
-        BUG_ON(!list_empty(&serv->sv_tempsocks));
+        svc_clear_list(&serv->sv_tempsocks, net);
+        svc_clear_list(&serv->sv_permsocks, net);
 }
 
 /*
@@ -1089,6 +1103,7 @@ static struct svc_deferred_req *svc_deferred_dequeue(struct svc_xprt *xprt)
  * svc_find_xprt - find an RPC transport instance
  * @serv: pointer to svc_serv to search
  * @xcl_name: C string containing transport's class name
+ * @net: owner net pointer
  * @af: Address family of transport's local address
  * @port: transport's IP port number
  *
@@ -1101,7 +1116,8 @@ static struct svc_deferred_req *svc_deferred_dequeue(struct svc_xprt *xprt)
  * service's list that has a matching class name.
  */
 struct svc_xprt *svc_find_xprt(struct svc_serv *serv, const char *xcl_name,
-                               const sa_family_t af, const unsigned short port)
+                               struct net *net, const sa_family_t af,
+                               const unsigned short port)
 {
         struct svc_xprt *xprt;
         struct svc_xprt *found = NULL;
@@ -1112,6 +1128,8 @@ struct svc_xprt *svc_find_xprt(struct svc_serv *serv, const char *xcl_name,
 
         spin_lock_bh(&serv->sv_lock);
         list_for_each_entry(xprt, &serv->sv_permsocks, xpt_list) {
+                if (xprt->xpt_net != net)
+                        continue;
                 if (strcmp(xprt->xpt_class->xcl_name, xcl_name))
                         continue;
                 if (af != AF_UNSPEC && af != xprt->xpt_local.ss_family)
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 01153ead1dba..2777fa896645 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -14,6 +14,7 @@
 #include <net/sock.h>
 #include <net/ipv6.h>
 #include <linux/kernel.h>
+#include <linux/user_namespace.h>
 #define RPCDBG_FACILITY RPCDBG_AUTH
 
 #include <linux/sunrpc/clnt.h>
@@ -211,7 +212,7 @@ static int ip_map_parse(struct cache_detail *cd,
         len = qword_get(&mesg, buf, mlen);
         if (len <= 0) return -EINVAL;
 
-        if (rpc_pton(buf, len, &address.sa, sizeof(address)) == 0)
+        if (rpc_pton(cd->net, buf, len, &address.sa, sizeof(address)) == 0)
                 return -EINVAL;
         switch (address.sa.sa_family) {
         case AF_INET:
@@ -346,17 +347,12 @@ static inline int ip_map_update(struct net *net, struct ip_map *ipm,
         return __ip_map_update(sn->ip_map_cache, ipm, udom, expiry);
 }
 
-
-void svcauth_unix_purge(void)
+void svcauth_unix_purge(struct net *net)
 {
-        struct net *net;
-
-        for_each_net(net) {
-                struct sunrpc_net *sn;
+        struct sunrpc_net *sn;
 
-                sn = net_generic(net, sunrpc_net_id);
-                cache_purge(sn->ip_map_cache);
-        }
+        sn = net_generic(net, sunrpc_net_id);
+        cache_purge(sn->ip_map_cache);
 }
 EXPORT_SYMBOL_GPL(svcauth_unix_purge);
 
@@ -436,7 +432,6 @@ struct unix_gid {
         uid_t                   uid;
         struct group_info       *gi;
 };
-static struct cache_head        *gid_table[GID_HASHMAX];
 
 static void unix_gid_put(struct kref *kref)
 {
@@ -494,8 +489,7 @@ static int unix_gid_upcall(struct cache_detail *cd, struct cache_head *h)
         return sunrpc_cache_pipe_upcall(cd, h, unix_gid_request);
 }
 
-static struct unix_gid *unix_gid_lookup(uid_t uid);
-extern struct cache_detail unix_gid_cache;
+static struct unix_gid *unix_gid_lookup(struct cache_detail *cd, uid_t uid);
 
 static int unix_gid_parse(struct cache_detail *cd,
                         char *mesg, int mlen)
@@ -509,7 +503,7 @@ static int unix_gid_parse(struct cache_detail *cd,
         time_t expiry;
         struct unix_gid ug, *ugp;
 
-        if (mlen <= 0 || mesg[mlen-1] != '\n')
+        if (mesg[mlen - 1] != '\n')
                 return -EINVAL;
         mesg[mlen-1] = 0;
 
@@ -532,26 +526,30 @@ static int unix_gid_parse(struct cache_detail *cd,
 
         for (i = 0 ; i < gids ; i++) {
                 int gid;
+                kgid_t kgid;
                 rv = get_int(&mesg, &gid);
                 err = -EINVAL;
                 if (rv)
                         goto out;
-                GROUP_AT(ug.gi, i) = gid;
+                kgid = make_kgid(&init_user_ns, gid);
+                if (!gid_valid(kgid))
+                        goto out;
+                GROUP_AT(ug.gi, i) = kgid;
         }
 
-        ugp = unix_gid_lookup(uid);
+        ugp = unix_gid_lookup(cd, uid);
         if (ugp) {
                 struct cache_head *ch;
                 ug.h.flags = 0;
                 ug.h.expiry_time = expiry;
-                ch = sunrpc_cache_update(&unix_gid_cache,
+                ch = sunrpc_cache_update(cd,
                                          &ug.h, &ugp->h,
                                          hash_long(uid, GID_HASHBITS));
                 if (!ch)
                         err = -ENOMEM;
                 else {
                         err = 0;
-                        cache_put(ch, &unix_gid_cache);
+                        cache_put(ch, cd);
                 }
         } else
                 err = -ENOMEM;
@@ -565,6 +563,7 @@ static int unix_gid_show(struct seq_file *m,
                          struct cache_detail *cd,
                          struct cache_head *h)
 {
+        struct user_namespace *user_ns = current_user_ns();
         struct unix_gid *ug;
         int i;
         int glen;
@@ -582,15 +581,14 @@ static int unix_gid_show(struct seq_file *m,
 
         seq_printf(m, "%u %d:", ug->uid, glen);
         for (i = 0; i < glen; i++)
-                seq_printf(m, " %d", GROUP_AT(ug->gi, i));
+                seq_printf(m, " %d", from_kgid_munged(user_ns, GROUP_AT(ug->gi, i)));
         seq_printf(m, "\n");
         return 0;
 }
 
-struct cache_detail unix_gid_cache = {
+static struct cache_detail unix_gid_cache_template = {
         .owner          = THIS_MODULE,
         .hash_size      = GID_HASHMAX,
-        .hash_table     = gid_table,
         .name           = "auth.unix.gid",
         .cache_put      = unix_gid_put,
         .cache_upcall   = unix_gid_upcall,
@@ -602,14 +600,42 @@ struct cache_detail unix_gid_cache = {
         .alloc          = unix_gid_alloc,
 };
 
-static struct unix_gid *unix_gid_lookup(uid_t uid)
+int unix_gid_cache_create(struct net *net)
+{
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+        struct cache_detail *cd;
+        int err;
+
+        cd = cache_create_net(&unix_gid_cache_template, net);
+        if (IS_ERR(cd))
+                return PTR_ERR(cd);
+        err = cache_register_net(cd, net);
+        if (err) {
+                cache_destroy_net(cd, net);
+                return err;
+        }
+        sn->unix_gid_cache = cd;
+        return 0;
+}
+
+void unix_gid_cache_destroy(struct net *net)
+{
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+        struct cache_detail *cd = sn->unix_gid_cache;
+
+        sn->unix_gid_cache = NULL;
+        cache_purge(cd);
+        cache_unregister_net(cd, net);
+        cache_destroy_net(cd, net);
+}
+
+static struct unix_gid *unix_gid_lookup(struct cache_detail *cd, uid_t uid)
 {
         struct unix_gid ug;
         struct cache_head *ch;
 
         ug.uid = uid;
-        ch = sunrpc_cache_lookup(&unix_gid_cache, &ug.h,
-                                 hash_long(uid, GID_HASHBITS));
+        ch = sunrpc_cache_lookup(cd, &ug.h, hash_long(uid, GID_HASHBITS));
         if (ch)
                 return container_of(ch, struct unix_gid, h);
         else
@@ -621,11 +647,13 @@ static struct group_info *unix_gid_find(uid_t uid, struct svc_rqst *rqstp)
         struct unix_gid *ug;
         struct group_info *gi;
         int ret;
+        struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net,
+                                            sunrpc_net_id);
 
-        ug = unix_gid_lookup(uid);
+        ug = unix_gid_lookup(sn->unix_gid_cache, uid);
         if (!ug)
                 return ERR_PTR(-EAGAIN);
-        ret = cache_check(&unix_gid_cache, &ug->h, &rqstp->rq_chandle);
+        ret = cache_check(sn->unix_gid_cache, &ug->h, &rqstp->rq_chandle);
         switch (ret) {
         case -ENOENT:
                 return ERR_PTR(-ENOENT);
@@ -633,7 +661,7 @@ static struct group_info *unix_gid_find(uid_t uid, struct svc_rqst *rqstp)
                 return ERR_PTR(-ESHUTDOWN);
         case 0:
                 gi = get_group_info(ug->gi);
-                cache_put(&ug->h, &unix_gid_cache);
+                cache_put(&ug->h, sn->unix_gid_cache);
                 return gi;
         default:
                 return ERR_PTR(-EAGAIN);
@@ -718,6 +746,7 @@ svcauth_null_accept(struct svc_rqst *rqstp, __be32 *authp)
         struct svc_cred *cred = &rqstp->rq_cred;
 
         cred->cr_group_info = NULL;
+        cred->cr_principal = NULL;
         rqstp->rq_client = NULL;
 
         if (argv->iov_len < 3*4)
@@ -745,7 +774,7 @@ svcauth_null_accept(struct svc_rqst *rqstp, __be32 *authp)
         svc_putnl(resv, RPC_AUTH_NULL);
         svc_putnl(resv, 0);
 
-        rqstp->rq_flavor = RPC_AUTH_NULL;
+        rqstp->rq_cred.cr_flavor = RPC_AUTH_NULL;
         return SVC_OK;
 }
 
@@ -783,6 +812,7 @@ svcauth_unix_accept(struct svc_rqst *rqstp, __be32 *authp)
         int             len   = argv->iov_len;
 
         cred->cr_group_info = NULL;
+        cred->cr_principal = NULL;
         rqstp->rq_client = NULL;
 
         if ((len -= 3*4) < 0)
@@ -804,8 +834,12 @@ svcauth_unix_accept(struct svc_rqst *rqstp, __be32 *authp)
         cred->cr_group_info = groups_alloc(slen);
         if (cred->cr_group_info == NULL)
                 return SVC_CLOSE;
-        for (i = 0; i < slen; i++)
-                GROUP_AT(cred->cr_group_info, i) = svc_getnl(argv);
+        for (i = 0; i < slen; i++) {
+                kgid_t kgid = make_kgid(&init_user_ns, svc_getnl(argv));
+                if (!gid_valid(kgid))
+                        goto badcred;
+                GROUP_AT(cred->cr_group_info, i) = kgid;
+        }
         if (svc_getu32(argv) != htonl(RPC_AUTH_NULL) || svc_getu32(argv) != 0) {
                 *authp = rpc_autherr_badverf;
                 return SVC_DENIED;
@@ -815,7 +849,7 @@ svcauth_unix_accept(struct svc_rqst *rqstp, __be32 *authp)
         svc_putnl(resv, RPC_AUTH_NULL);
         svc_putnl(resv, 0);
 
-        rqstp->rq_flavor = RPC_AUTH_UNIX;
+        rqstp->rq_cred.cr_flavor = RPC_AUTH_UNIX;
         return SVC_OK;
 
 badcred:
@@ -849,56 +883,45 @@ struct auth_ops svcauth_unix = {
         .set_client     = svcauth_unix_set_client,
 };
 
+static struct cache_detail ip_map_cache_template = {
+        .owner          = THIS_MODULE,
+        .hash_size      = IP_HASHMAX,
+        .name           = "auth.unix.ip",
+        .cache_put      = ip_map_put,
+        .cache_upcall   = ip_map_upcall,
+        .cache_parse    = ip_map_parse,
+        .cache_show     = ip_map_show,
+        .match          = ip_map_match,
+        .init           = ip_map_init,
+        .update         = update,
+        .alloc          = ip_map_alloc,
+};
+
 int ip_map_cache_create(struct net *net)
 {
-        int err = -ENOMEM;
-        struct cache_detail *cd;
-        struct cache_head **tbl;
         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+        struct cache_detail *cd;
+        int err;
 
-        cd = kzalloc(sizeof(struct cache_detail), GFP_KERNEL);
-        if (cd == NULL)
-                goto err_cd;
-
-        tbl = kzalloc(IP_HASHMAX * sizeof(struct cache_head *), GFP_KERNEL);
-        if (tbl == NULL)
-                goto err_tbl;
-
-        cd->owner = THIS_MODULE,
-        cd->hash_size = IP_HASHMAX,
-        cd->hash_table = tbl,
-        cd->name = "auth.unix.ip",
-        cd->cache_put = ip_map_put,
-        cd->cache_upcall = ip_map_upcall,
-        cd->cache_parse = ip_map_parse,
-        cd->cache_show = ip_map_show,
-        cd->match = ip_map_match,
-        cd->init = ip_map_init,
-        cd->update = update,
-        cd->alloc = ip_map_alloc,
-
+        cd = cache_create_net(&ip_map_cache_template, net);
+        if (IS_ERR(cd))
+                return PTR_ERR(cd);
         err = cache_register_net(cd, net);
-        if (err)
-                goto err_reg;
-
+        if (err) {
+                cache_destroy_net(cd, net);
+                return err;
+        }
         sn->ip_map_cache = cd;
         return 0;
-
-err_reg:
-        kfree(tbl);
-err_tbl:
-        kfree(cd);
-err_cd:
-        return err;
 }
 
 void ip_map_cache_destroy(struct net *net)
 {
-        struct sunrpc_net *sn;
+        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+        struct cache_detail *cd = sn->ip_map_cache;
 
-        sn = net_generic(net, sunrpc_net_id);
-        cache_purge(sn->ip_map_cache);
-        cache_unregister_net(sn->ip_map_cache, net);
-        kfree(sn->ip_map_cache->hash_table);
-        kfree(sn->ip_map_cache);
+        sn->ip_map_cache = NULL;
+        cache_purge(cd);
+        cache_unregister_net(cd, net);
+        cache_destroy_net(cd, net);
 }
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 464570906f80..a6de09de5d21 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -396,7 +396,7 @@ static int svc_partial_recvfrom(struct svc_rqst *rqstp,
                                 int buflen, unsigned int base)
 {
         size_t save_iovlen;
-        void __user *save_iovbase;
+        void *save_iovbase;
         unsigned int i;
         int ret;
 
@@ -617,11 +617,8 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
         rqstp->rq_prot = IPPROTO_UDP;
 
         if (!svc_udp_get_dest_address(rqstp, cmh)) {
-                if (net_ratelimit())
-                        printk(KERN_WARNING
-                                "svc: received unknown control message %d/%d; "
-                                "dropping RPC reply datagram\n",
-                                        cmh->cmsg_level, cmh->cmsg_type);
+                net_warn_ratelimited("svc: received unknown control message %d/%d; dropping RPC reply datagram\n",
+                                     cmh->cmsg_level, cmh->cmsg_type);
                 skb_free_datagram_locked(svsk->sk_sk, skb);
                 return 0;
         }
@@ -871,18 +868,17 @@ static struct svc_xprt *svc_tcp_accept(struct svc_xprt *xprt)
                 if (err == -ENOMEM)
                         printk(KERN_WARNING "%s: no more sockets!\n",
                                serv->sv_name);
-                else if (err != -EAGAIN && net_ratelimit())
-                        printk(KERN_WARNING "%s: accept failed (err %d)!\n",
-                                   serv->sv_name, -err);
+                else if (err != -EAGAIN)
+                        net_warn_ratelimited("%s: accept failed (err %d)!\n",
+                                             serv->sv_name, -err);
                 return NULL;
         }
         set_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags);
 
         err = kernel_getpeername(newsock, sin, &slen);
         if (err < 0) {
-                if (net_ratelimit())
-                        printk(KERN_WARNING "%s: peername failed (err %d)!\n",
-                                   serv->sv_name, -err);
+                net_warn_ratelimited("%s: peername failed (err %d)!\n",
+                                     serv->sv_name, -err);
                 goto failed;            /* aborted connection or whatever */
         }
 
@@ -1012,19 +1008,15 @@ static int svc_tcp_recv_record(struct svc_sock *svsk, struct svc_rqst *rqstp)
                          *  bit set in the fragment length header.
                          *  But apparently no known nfs clients send fragmented
                          *  records. */
-                        if (net_ratelimit())
-                                printk(KERN_NOTICE "RPC: multiple fragments "
-                                        "per record not supported\n");
+                        net_notice_ratelimited("RPC: multiple fragments per record not supported\n");
                         goto err_delete;
                 }
 
                 svsk->sk_reclen &= RPC_FRAGMENT_SIZE_MASK;
                 dprintk("svc: TCP record, %d bytes\n", svsk->sk_reclen);
                 if (svsk->sk_reclen > serv->sv_max_mesg) {
-                        if (net_ratelimit())
-                                printk(KERN_NOTICE "RPC: "
-                                        "fragment too large: 0x%08lx\n",
-                                        (unsigned long)svsk->sk_reclen);
+                        net_notice_ratelimited("RPC: fragment too large: 0x%08lx\n",
+                                               (unsigned long)svsk->sk_reclen);
                         goto err_delete;
                 }
         }
@@ -1381,8 +1373,6 @@ void svc_sock_update_bufs(struct svc_serv *serv)
         spin_lock_bh(&serv->sv_lock);
         list_for_each_entry(svsk, &serv->sv_permsocks, sk_xprt.xpt_list)
                 set_bit(XPT_CHNGBUF, &svsk->sk_xprt.xpt_flags);
-        list_for_each_entry(svsk, &serv->sv_tempsocks, sk_xprt.xpt_list)
-                set_bit(XPT_CHNGBUF, &svsk->sk_xprt.xpt_flags);
         spin_unlock_bh(&serv->sv_lock);
 }
 EXPORT_SYMBOL_GPL(svc_sock_update_bufs);
@@ -1409,7 +1399,8 @@ static struct svc_sock *svc_setup_socket(struct svc_serv *serv,
 
         /* Register socket with portmapper */
         if (*errp >= 0 && pmap_register)
-                *errp = svc_register(serv, inet->sk_family, inet->sk_protocol,
+                *errp = svc_register(serv, sock_net(sock->sk), inet->sk_family,
+                                     inet->sk_protocol,
                                      ntohs(inet_sk(inet)->inet_sport));
 
         if (*errp < 0) {
@@ -1557,7 +1548,7 @@ static struct svc_xprt *svc_create_socket(struct svc_serv *serv,
                                         (char *)&val, sizeof(val));
 
         if (type == SOCK_STREAM)
-                sock->sk->sk_reuse = 1;         /* allow address reuse */
+                sock->sk->sk_reuse = SK_CAN_REUSE; /* allow address reuse */
         error = kernel_bind(sock, sin, len);
         if (error < 0)
                 goto bummer;
diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
index e65dcc613339..af7d339add9d 100644
--- a/net/sunrpc/sysctl.c
+++ b/net/sunrpc/sysctl.c
@@ -20,6 +20,8 @@
 #include <linux/sunrpc/stats.h>
 #include <linux/sunrpc/svc_xprt.h>
 
+#include "netns.h"
+
 /*
  * Declare the debug flags here
  */
@@ -110,7 +112,7 @@ proc_dodebug(ctl_table *table, int write,
                 *(unsigned int *) table->data = value;
                 /* Display the RPC tasks on writing to rpc_debug */
                 if (strcmp(table->procname, "rpc_debug") == 0)
-                        rpc_show_tasks();
+                        rpc_show_tasks(&init_net);
         } else {
                 if (!access_ok(VERIFY_WRITE, buffer, left))
                         return -EFAULT;
diff --git a/net/sunrpc/timer.c b/net/sunrpc/timer.c
index dd824341c349..08881d0c9672 100644
--- a/net/sunrpc/timer.c
+++ b/net/sunrpc/timer.c
@@ -34,7 +34,7 @@
 void rpc_init_rtt(struct rpc_rtt *rt, unsigned long timeo)
 {
         unsigned long init = 0;
-        unsigned i;
+        unsigned int i;
 
         rt->timeo = timeo;
 
@@ -57,7 +57,7 @@ EXPORT_SYMBOL_GPL(rpc_init_rtt);
  * NB: When computing the smoothed RTT and standard deviation,
  *     be careful not to produce negative intermediate results.
  */
-void rpc_update_rtt(struct rpc_rtt *rt, unsigned timer, long m)
+void rpc_update_rtt(struct rpc_rtt *rt, unsigned int timer, long m)
 {
         long *srtt, *sdrtt;
 
@@ -106,7 +106,7 @@ EXPORT_SYMBOL_GPL(rpc_update_rtt);
  * read, write, commit     - A+4D
  * other                   - timeo
  */
-unsigned long rpc_calc_rto(struct rpc_rtt *rt, unsigned timer)
+unsigned long rpc_calc_rto(struct rpc_rtt *rt, unsigned int timer)
 {
         unsigned long res;
 
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 593f4c605305..fddcccfcdf76 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -122,9 +122,9 @@ xdr_terminate_string(struct xdr_buf *buf, const u32 len)
 {
         char *kaddr;
 
-        kaddr = kmap_atomic(buf->pages[0], KM_USER0);
+        kaddr = kmap_atomic(buf->pages[0]);
         kaddr[buf->page_base + len] = '\0';
-        kunmap_atomic(kaddr, KM_USER0);
+        kunmap_atomic(kaddr);
 }
 EXPORT_SYMBOL_GPL(xdr_terminate_string);
 
@@ -232,12 +232,12 @@ _shift_data_right_pages(struct page **pages, size_t pgto_base,
                 pgto_base -= copy;
                 pgfrom_base -= copy;
 
-                vto = kmap_atomic(*pgto, KM_USER0);
-                vfrom = kmap_atomic(*pgfrom, KM_USER1);
+                vto = kmap_atomic(*pgto);
+                vfrom = kmap_atomic(*pgfrom);
                 memmove(vto + pgto_base, vfrom + pgfrom_base, copy);
                 flush_dcache_page(*pgto);
-                kunmap_atomic(vfrom, KM_USER1);
-                kunmap_atomic(vto, KM_USER0);
+                kunmap_atomic(vfrom);
+                kunmap_atomic(vto);
 
         } while ((len -= copy) != 0);
 }
@@ -267,9 +267,9 @@ _copy_to_pages(struct page **pages, size_t pgbase, const char *p, size_t len)
                 if (copy > len)
                         copy = len;
 
-                vto = kmap_atomic(*pgto, KM_USER0);
+                vto = kmap_atomic(*pgto);
                 memcpy(vto + pgbase, p, copy);
-                kunmap_atomic(vto, KM_USER0);
+                kunmap_atomic(vto);
 
                 len -= copy;
                 if (len == 0)
@@ -311,9 +311,9 @@ _copy_from_pages(char *p, struct page **pages, size_t pgbase, size_t len)
                 if (copy > len)
                         copy = len;
 
-                vfrom = kmap_atomic(*pgfrom, KM_USER0);
+                vfrom = kmap_atomic(*pgfrom);
                 memcpy(p, vfrom + pgbase, copy);
-                kunmap_atomic(vfrom, KM_USER0);
+                kunmap_atomic(vfrom);
 
                 pgbase += copy;
                 if (pgbase == PAGE_CACHE_SIZE) {
@@ -1204,7 +1204,7 @@ xdr_process_buf(struct xdr_buf *buf, unsigned int offset, unsigned int len,
                 int (*actor)(struct scatterlist *, void *), void *data)
 {
         int i, ret = 0;
-        unsigned page_len, thislen, page_offset;
+        unsigned int page_len, thislen, page_offset;
         struct scatterlist      sg[1];
 
         sg_init_table(sg, 1);
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index c64c0ef519b5..3c83035cdaa9 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -66,6 +66,7 @@ static void	 xprt_init(struct rpc_xprt *xprt, struct net *net);
 static void     xprt_request_init(struct rpc_task *, struct rpc_xprt *);
 static void     xprt_connect_status(struct rpc_task *task);
 static int      __xprt_get_cong(struct rpc_xprt *, struct rpc_task *);
+static void      xprt_destroy(struct rpc_xprt *xprt);
 
 static DEFINE_SPINLOCK(xprt_list_lock);
 static LIST_HEAD(xprt_list);
@@ -292,54 +293,57 @@ static inline int xprt_lock_write(struct rpc_xprt *xprt, struct rpc_task *task)
         return retval;
 }
 
-static void __xprt_lock_write_next(struct rpc_xprt *xprt)
+static bool __xprt_lock_write_func(struct rpc_task *task, void *data)
 {
-        struct rpc_task *task;
+        struct rpc_xprt *xprt = data;
         struct rpc_rqst *req;
 
-        if (test_and_set_bit(XPRT_LOCKED, &xprt->state))
-                return;
-
-        task = rpc_wake_up_next(&xprt->sending);
-        if (task == NULL)
-                goto out_unlock;
-
         req = task->tk_rqstp;
         xprt->snd_task = task;
         if (req) {
                 req->rq_bytes_sent = 0;
                 req->rq_ntrans++;
         }
-        return;
+        return true;
+}
 
-out_unlock:
+static void __xprt_lock_write_next(struct rpc_xprt *xprt)
+{
+        if (test_and_set_bit(XPRT_LOCKED, &xprt->state))
+                return;
+
+        if (rpc_wake_up_first(&xprt->sending, __xprt_lock_write_func, xprt))
+                return;
         xprt_clear_locked(xprt);
 }
 
-static void __xprt_lock_write_next_cong(struct rpc_xprt *xprt)
+static bool __xprt_lock_write_cong_func(struct rpc_task *task, void *data)
 {
-        struct rpc_task *task;
+        struct rpc_xprt *xprt = data;
         struct rpc_rqst *req;
 
-        if (test_and_set_bit(XPRT_LOCKED, &xprt->state))
-                return;
-        if (RPCXPRT_CONGESTED(xprt))
-                goto out_unlock;
-        task = rpc_wake_up_next(&xprt->sending);
-        if (task == NULL)
-                goto out_unlock;
-
         req = task->tk_rqstp;
         if (req == NULL) {
                 xprt->snd_task = task;
-                return;
+                return true;
         }
         if (__xprt_get_cong(xprt, task)) {
                 xprt->snd_task = task;
                 req->rq_bytes_sent = 0;
                 req->rq_ntrans++;
-                return;
+                return true;
         }
+        return false;
+}
+
+static void __xprt_lock_write_next_cong(struct rpc_xprt *xprt)
+{
+        if (test_and_set_bit(XPRT_LOCKED, &xprt->state))
+                return;
+        if (RPCXPRT_CONGESTED(xprt))
+                goto out_unlock;
+        if (rpc_wake_up_first(&xprt->sending, __xprt_lock_write_cong_func, xprt))
+                return;
 out_unlock:
         xprt_clear_locked(xprt);
 }
@@ -712,9 +716,7 @@ void xprt_connect(struct rpc_task *task)
         if (xprt_connected(xprt))
                 xprt_release_write(xprt, task);
         else {
-                if (task->tk_rqstp)
-                        task->tk_rqstp->rq_bytes_sent = 0;
-
+                task->tk_rqstp->rq_bytes_sent = 0;
                 task->tk_timeout = task->tk_rqstp->rq_timeout;
                 rpc_sleep_on(&xprt->pending, task, xprt_connect_status);
 
@@ -750,7 +752,7 @@ static void xprt_connect_status(struct rpc_task *task)
         default:
                 dprintk("RPC: %5u xprt_connect_status: error %d connecting to "
                                 "server %s\n", task->tk_pid, -task->tk_status,
-                                task->tk_client->cl_server);
+                                xprt->servername);
                 xprt_release_write(xprt, task);
                 task->tk_status = -EIO;
         }
@@ -781,7 +783,7 @@ static void xprt_update_rtt(struct rpc_task *task)
 {
         struct rpc_rqst *req = task->tk_rqstp;
         struct rpc_rtt *rtt = task->tk_client->cl_rtt;
-        unsigned timer = task->tk_msg.rpc_proc->p_timer;
+        unsigned int timer = task->tk_msg.rpc_proc->p_timer;
         long m = usecs_to_jiffies(ktime_to_us(req->rq_rtt));
 
         if (timer) {
@@ -884,7 +886,7 @@ void xprt_transmit(struct rpc_task *task)
 {
         struct rpc_rqst *req = task->tk_rqstp;
         struct rpc_xprt *xprt = req->rq_xprt;
-        int status;
+        int status, numreqs;
 
         dprintk("RPC: %5u xprt_transmit(%u)\n", task->tk_pid, req->rq_slen);
 
@@ -921,9 +923,14 @@ void xprt_transmit(struct rpc_task *task)
 
         xprt->ops->set_retrans_timeout(task);
 
+        numreqs = atomic_read(&xprt->num_reqs);
+        if (numreqs > xprt->stat.max_slots)
+                xprt->stat.max_slots = numreqs;
         xprt->stat.sends++;
         xprt->stat.req_u += xprt->stat.sends - xprt->stat.recvs;
         xprt->stat.bklog_u += xprt->backlog.qlen;
+        xprt->stat.sending_u += xprt->sending.qlen;
+        xprt->stat.pending_u += xprt->pending.qlen;
 
         /* Don't race with disconnect */
         if (!xprt_connected(xprt))
@@ -972,20 +979,21 @@ static void xprt_alloc_slot(struct rpc_task *task)
                 list_del(&req->rq_list);
                 goto out_init_req;
         }
-        req = xprt_dynamic_alloc_slot(xprt, GFP_NOWAIT);
+        req = xprt_dynamic_alloc_slot(xprt, GFP_NOWAIT|__GFP_NOWARN);
         if (!IS_ERR(req))
                 goto out_init_req;
         switch (PTR_ERR(req)) {
         case -ENOMEM:
-                rpc_delay(task, HZ >> 2);
                 dprintk("RPC:       dynamic allocation of request slot "
                                 "failed! Retrying\n");
+                task->tk_status = -ENOMEM;
                 break;
         case -EAGAIN:
                 rpc_sleep_on(&xprt->backlog, task, NULL);
                 dprintk("RPC:       waiting for request slot\n");
+        default:
+                task->tk_status = -EAGAIN;
         }
-        task->tk_status = -EAGAIN;
         return;
 out_init_req:
         task->tk_status = 0;
@@ -1131,7 +1139,10 @@ void xprt_release(struct rpc_task *task)
                 return;
 
         xprt = req->rq_xprt;
-        rpc_count_iostats(task);
+        if (task->tk_ops->rpc_count_stats != NULL)
+                task->tk_ops->rpc_count_stats(task, task->tk_calldata);
+        else if (task->tk_client)
+                rpc_count_iostats(task, task->tk_client->cl_metrics);
         spin_lock_bh(&xprt->transport_lock);
         xprt->ops->release_xprt(xprt, task);
         if (xprt->ops->release_request)
@@ -1220,6 +1231,17 @@ found:
                             (unsigned long)xprt);
         else
                 init_timer(&xprt->timer);
+
+        if (strlen(args->servername) > RPC_MAXNETNAMELEN) {
+                xprt_destroy(xprt);
+                return ERR_PTR(-EINVAL);
+        }
+        xprt->servername = kstrdup(args->servername, GFP_KERNEL);
+        if (xprt->servername == NULL) {
+                xprt_destroy(xprt);
+                return ERR_PTR(-ENOMEM);
+        }
+
         dprintk("RPC:       created transport %p with %u slots\n", xprt,
                         xprt->max_reqs);
 out:
@@ -1242,6 +1264,7 @@ static void xprt_destroy(struct rpc_xprt *xprt)
         rpc_destroy_wait_queue(&xprt->sending);
         rpc_destroy_wait_queue(&xprt->backlog);
         cancel_work_sync(&xprt->task_cleanup);
+        kfree(xprt->servername);
         /*
          * Tear down transport state and free the rpc_xprt
          */
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 554d0814c875..558fbab574f0 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -338,9 +338,9 @@ rpcrdma_inline_pullup(struct rpc_rqst *rqst, int pad)
                         curlen = copy_len;
                 dprintk("RPC:       %s: page %d destp 0x%p len %d curlen %d\n",
                         __func__, i, destp, copy_len, curlen);
-                srcp = kmap_atomic(ppages[i], KM_SKB_SUNRPC_DATA);
+                srcp = kmap_atomic(ppages[i]);
                 memcpy(destp, srcp+page_base, curlen);
-                kunmap_atomic(srcp, KM_SKB_SUNRPC_DATA);
+                kunmap_atomic(srcp);
                 rqst->rq_svec[0].iov_len += curlen;
                 destp += curlen;
                 copy_len -= curlen;
@@ -639,10 +639,10 @@ rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len, int pad)
                         dprintk("RPC:       %s: page %d"
                                 " srcp 0x%p len %d curlen %d\n",
                                 __func__, i, srcp, copy_len, curlen);
-                        destp = kmap_atomic(ppages[i], KM_SKB_SUNRPC_DATA);
+                        destp = kmap_atomic(ppages[i]);
                         memcpy(destp + page_base, srcp, curlen);
                         flush_dcache_page(ppages[i]);
-                        kunmap_atomic(destp, KM_SKB_SUNRPC_DATA);
+                        kunmap_atomic(destp);
                         srcp += curlen;
                         copy_len -= curlen;
                         if (copy_len == 0)
@@ -771,13 +771,18 @@ repost:
 
         /* get request object */
         req = rpcr_to_rdmar(rqst);
+        if (req->rl_reply) {
+                spin_unlock(&xprt->transport_lock);
+                dprintk("RPC:       %s: duplicate reply 0x%p to RPC "
+                        "request 0x%p: xid 0x%08x\n", __func__, rep, req,
+                        headerp->rm_xid);
+                goto repost;
+        }
 
         dprintk("RPC:       %s: reply 0x%p completes request 0x%p\n"
                 "                   RPC request 0x%p xid 0x%08x\n",
                         __func__, rep, req, rqst, headerp->rm_xid);
 
-        BUG_ON(!req || req->rl_reply);
-
         /* from here on, the reply is no longer an orphan */
         req->rl_reply = rep;
 
diff --git a/net/sunrpc/xprtrdma/svc_rdma.c b/net/sunrpc/xprtrdma/svc_rdma.c
index 09af4fab1a45..8343737e85f4 100644
--- a/net/sunrpc/xprtrdma/svc_rdma.c
+++ b/net/sunrpc/xprtrdma/svc_rdma.c
@@ -47,6 +47,7 @@
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/sched.h>
 #include <linux/sunrpc/svc_rdma.h>
+#include "xprt_rdma.h"
 
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
 
diff --git a/net/sunrpc/xprtrdma/svc_rdma_marshal.c b/net/sunrpc/xprtrdma/svc_rdma_marshal.c
index 9530ef2d40dc..8d2edddf48cf 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_marshal.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_marshal.c
@@ -60,21 +60,11 @@ static u32 *decode_read_list(u32 *va, u32 *vaend)
         struct rpcrdma_read_chunk *ch = (struct rpcrdma_read_chunk *)va;
 
         while (ch->rc_discrim != xdr_zero) {
-                u64 ch_offset;
-
                 if (((unsigned long)ch + sizeof(struct rpcrdma_read_chunk)) >
                     (unsigned long)vaend) {
                         dprintk("svcrdma: vaend=%p, ch=%p\n", vaend, ch);
                         return NULL;
                 }
-
-                ch->rc_discrim = ntohl(ch->rc_discrim);
-                ch->rc_position = ntohl(ch->rc_position);
-                ch->rc_target.rs_handle = ntohl(ch->rc_target.rs_handle);
-                ch->rc_target.rs_length = ntohl(ch->rc_target.rs_length);
-                va = (u32 *)&ch->rc_target.rs_offset;
-                xdr_decode_hyper(va, &ch_offset);
-                put_unaligned(ch_offset, (u64 *)va);
                 ch++;
         }
         return (u32 *)&ch->rc_position;
@@ -91,7 +81,7 @@ void svc_rdma_rcl_chunk_counts(struct rpcrdma_read_chunk *ch,
         *byte_count = 0;
         *ch_count = 0;
         for (; ch->rc_discrim != 0; ch++) {
-                *byte_count = *byte_count + ch->rc_target.rs_length;
+                *byte_count = *byte_count + ntohl(ch->rc_target.rs_length);
                 *ch_count = *ch_count + 1;
         }
 }
@@ -108,7 +98,8 @@ void svc_rdma_rcl_chunk_counts(struct rpcrdma_read_chunk *ch,
  */
 static u32 *decode_write_list(u32 *va, u32 *vaend)
 {
-        int ch_no;
+        int nchunks;
+
         struct rpcrdma_write_array *ary =
                 (struct rpcrdma_write_array *)va;
 
@@ -121,37 +112,24 @@ static u32 *decode_write_list(u32 *va, u32 *vaend)
                 dprintk("svcrdma: ary=%p, vaend=%p\n", ary, vaend);
                 return NULL;
         }
-        ary->wc_discrim = ntohl(ary->wc_discrim);
-        ary->wc_nchunks = ntohl(ary->wc_nchunks);
+        nchunks = ntohl(ary->wc_nchunks);
         if (((unsigned long)&ary->wc_array[0] +
-             (sizeof(struct rpcrdma_write_chunk) * ary->wc_nchunks)) >
+             (sizeof(struct rpcrdma_write_chunk) * nchunks)) >
             (unsigned long)vaend) {
                 dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n",
-                        ary, ary->wc_nchunks, vaend);
+                        ary, nchunks, vaend);
                 return NULL;
         }
-        for (ch_no = 0; ch_no < ary->wc_nchunks; ch_no++) {
-                u64 ch_offset;
-
-                ary->wc_array[ch_no].wc_target.rs_handle =
-                        ntohl(ary->wc_array[ch_no].wc_target.rs_handle);
-                ary->wc_array[ch_no].wc_target.rs_length =
-                        ntohl(ary->wc_array[ch_no].wc_target.rs_length);
-                va = (u32 *)&ary->wc_array[ch_no].wc_target.rs_offset;
-                xdr_decode_hyper(va, &ch_offset);
-                put_unaligned(ch_offset, (u64 *)va);
-        }
-
         /*
          * rs_length is the 2nd 4B field in wc_target and taking its
          * address skips the list terminator
          */
-        return (u32 *)&ary->wc_array[ch_no].wc_target.rs_length;
+        return (u32 *)&ary->wc_array[nchunks].wc_target.rs_length;
 }
 
 static u32 *decode_reply_array(u32 *va, u32 *vaend)
 {
-        int ch_no;
+        int nchunks;
         struct rpcrdma_write_array *ary =
                 (struct rpcrdma_write_array *)va;
 
@@ -164,28 +142,15 @@ static u32 *decode_reply_array(u32 *va, u32 *vaend)
                 dprintk("svcrdma: ary=%p, vaend=%p\n", ary, vaend);
                 return NULL;
         }
-        ary->wc_discrim = ntohl(ary->wc_discrim);
-        ary->wc_nchunks = ntohl(ary->wc_nchunks);
+        nchunks = ntohl(ary->wc_nchunks);
         if (((unsigned long)&ary->wc_array[0] +
-             (sizeof(struct rpcrdma_write_chunk) * ary->wc_nchunks)) >
+             (sizeof(struct rpcrdma_write_chunk) * nchunks)) >
             (unsigned long)vaend) {
                 dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n",
-                        ary, ary->wc_nchunks, vaend);
+                        ary, nchunks, vaend);
                 return NULL;
         }
-        for (ch_no = 0; ch_no < ary->wc_nchunks; ch_no++) {
-                u64 ch_offset;
-
-                ary->wc_array[ch_no].wc_target.rs_handle =
-                        ntohl(ary->wc_array[ch_no].wc_target.rs_handle);
-                ary->wc_array[ch_no].wc_target.rs_length =
-                        ntohl(ary->wc_array[ch_no].wc_target.rs_length);
-                va = (u32 *)&ary->wc_array[ch_no].wc_target.rs_offset;
-                xdr_decode_hyper(va, &ch_offset);
-                put_unaligned(ch_offset, (u64 *)va);
-        }
-
-        return (u32 *)&ary->wc_array[ch_no];
+        return (u32 *)&ary->wc_array[nchunks];
 }
 
 int svc_rdma_xdr_decode_req(struct rpcrdma_msg **rdma_req,
@@ -386,13 +351,14 @@ void svc_rdma_xdr_encode_reply_array(struct rpcrdma_write_array *ary,
 
 void svc_rdma_xdr_encode_array_chunk(struct rpcrdma_write_array *ary,
                                      int chunk_no,
-                                     u32 rs_handle, u64 rs_offset,
+                                     __be32 rs_handle,
+                                     __be64 rs_offset,
                                      u32 write_len)
 {
         struct rpcrdma_segment *seg = &ary->wc_array[chunk_no].wc_target;
-        seg->rs_handle = htonl(rs_handle);
+        seg->rs_handle = rs_handle;
+        seg->rs_offset = rs_offset;
         seg->rs_length = htonl(write_len);
-        xdr_encode_hyper((u32 *) &seg->rs_offset, rs_offset);
 }
 
 void svc_rdma_xdr_encode_reply_header(struct svcxprt_rdma *xprt,
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index df67211c4baf..41cb63b623df 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -147,7 +147,7 @@ static int map_read_chunks(struct svcxprt_rdma *xprt,
         page_off = 0;
         ch = (struct rpcrdma_read_chunk *)&rmsgp->rm_body.rm_chunks[0];
         ch_no = 0;
-        ch_bytes = ch->rc_target.rs_length;
+        ch_bytes = ntohl(ch->rc_target.rs_length);
         head->arg.head[0] = rqstp->rq_arg.head[0];
         head->arg.tail[0] = rqstp->rq_arg.tail[0];
         head->arg.pages = &head->pages[head->count];
@@ -183,7 +183,7 @@ static int map_read_chunks(struct svcxprt_rdma *xprt,
                         ch_no++;
                         ch++;
                         chl_map->ch[ch_no].start = sge_no;
-                        ch_bytes = ch->rc_target.rs_length;
+                        ch_bytes = ntohl(ch->rc_target.rs_length);
                         /* If bytes remaining account for next chunk */
                         if (byte_count) {
                                 head->arg.page_len += ch_bytes;
@@ -281,11 +281,12 @@ static int fast_reg_read_chunks(struct svcxprt_rdma *xprt,
         offset = 0;
         ch = (struct rpcrdma_read_chunk *)&rmsgp->rm_body.rm_chunks[0];
         for (ch_no = 0; ch_no < ch_count; ch_no++) {
+                int len = ntohl(ch->rc_target.rs_length);
                 rpl_map->sge[ch_no].iov_base = frmr->kva + offset;
-                rpl_map->sge[ch_no].iov_len = ch->rc_target.rs_length;
+                rpl_map->sge[ch_no].iov_len = len;
                 chl_map->ch[ch_no].count = 1;
                 chl_map->ch[ch_no].start = ch_no;
-                offset += ch->rc_target.rs_length;
+                offset += len;
                 ch++;
         }
 
@@ -316,7 +317,7 @@ static int rdma_set_ctxt_sge(struct svcxprt_rdma *xprt,
         for (i = 0; i < count; i++) {
                 ctxt->sge[i].length = 0; /* in case map fails */
                 if (!frmr) {
-                        BUG_ON(0 == virt_to_page(vec[i].iov_base));
+                        BUG_ON(!virt_to_page(vec[i].iov_base));
                         off = (unsigned long)vec[i].iov_base & ~PAGE_MASK;
                         ctxt->sge[i].addr =
                                 ib_dma_map_page(xprt->sc_cm_id->device,
@@ -426,6 +427,7 @@ static int rdma_read_xdr(struct svcxprt_rdma *xprt,
 
         for (ch = (struct rpcrdma_read_chunk *)&rmsgp->rm_body.rm_chunks[0];
              ch->rc_discrim != 0; ch++, ch_no++) {
+                u64 rs_offset;
 next_sge:
                 ctxt = svc_rdma_get_context(xprt);
                 ctxt->direction = DMA_FROM_DEVICE;
@@ -440,10 +442,10 @@ next_sge:
                 read_wr.opcode = IB_WR_RDMA_READ;
                 ctxt->wr_op = read_wr.opcode;
                 read_wr.send_flags = IB_SEND_SIGNALED;
-                read_wr.wr.rdma.rkey = ch->rc_target.rs_handle;
-                read_wr.wr.rdma.remote_addr =
-                        get_unaligned(&(ch->rc_target.rs_offset)) +
-                        sgl_offset;
+                read_wr.wr.rdma.rkey = ntohl(ch->rc_target.rs_handle);
+                xdr_decode_hyper((__be32 *)&ch->rc_target.rs_offset,
+                                 &rs_offset);
+                read_wr.wr.rdma.remote_addr = rs_offset + sgl_offset;
                 read_wr.sg_list = ctxt->sge;
                 read_wr.num_sge =
                         rdma_read_max_sge(xprt, chl_map->ch[ch_no].count);
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index 249a835b703f..42eb7ba0b903 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -409,21 +409,21 @@ static int send_write_chunks(struct svcxprt_rdma *xprt,
                 u64 rs_offset;
 
                 arg_ch = &arg_ary->wc_array[chunk_no].wc_target;
-                write_len = min(xfer_len, arg_ch->rs_length);
+                write_len = min(xfer_len, ntohl(arg_ch->rs_length));
 
                 /* Prepare the response chunk given the length actually
                  * written */
-                rs_offset = get_unaligned(&(arg_ch->rs_offset));
+                xdr_decode_hyper((__be32 *)&arg_ch->rs_offset, &rs_offset);
                 svc_rdma_xdr_encode_array_chunk(res_ary, chunk_no,
-                                            arg_ch->rs_handle,
-                                            rs_offset,
-                                            write_len);
+                                                arg_ch->rs_handle,
+                                                arg_ch->rs_offset,
+                                                write_len);
                 chunk_off = 0;
                 while (write_len) {
                         int this_write;
                         this_write = min(write_len, max_write);
                         ret = send_write(xprt, rqstp,
-                                         arg_ch->rs_handle,
+                                         ntohl(arg_ch->rs_handle),
                                          rs_offset + chunk_off,
                                          xdr_off,
                                          this_write,
@@ -457,6 +457,7 @@ static int send_reply_chunks(struct svcxprt_rdma *xprt,
         u32 xdr_off;
         int chunk_no;
         int chunk_off;
+        int nchunks;
         struct rpcrdma_segment *ch;
         struct rpcrdma_write_array *arg_ary;
         struct rpcrdma_write_array *res_ary;
@@ -476,26 +477,27 @@ static int send_reply_chunks(struct svcxprt_rdma *xprt,
                 max_write = xprt->sc_max_sge * PAGE_SIZE;
 
         /* xdr offset starts at RPC message */
+        nchunks = ntohl(arg_ary->wc_nchunks);
         for (xdr_off = 0, chunk_no = 0;
-             xfer_len && chunk_no < arg_ary->wc_nchunks;
+             xfer_len && chunk_no < nchunks;
              chunk_no++) {
                 u64 rs_offset;
                 ch = &arg_ary->wc_array[chunk_no].wc_target;
-                write_len = min(xfer_len, ch->rs_length);
+                write_len = min(xfer_len, htonl(ch->rs_length));
 
                 /* Prepare the reply chunk given the length actually
                  * written */
-                rs_offset = get_unaligned(&(ch->rs_offset));
+                xdr_decode_hyper((__be32 *)&ch->rs_offset, &rs_offset);
                 svc_rdma_xdr_encode_array_chunk(res_ary, chunk_no,
-                                            ch->rs_handle, rs_offset,
-                                            write_len);
+                                                ch->rs_handle, ch->rs_offset,
+                                                write_len);
                 chunk_off = 0;
                 while (write_len) {
                         int this_write;
 
                         this_write = min(write_len, max_write);
                         ret = send_write(xprt, rqstp,
-                                         ch->rs_handle,
+                                         ntohl(ch->rs_handle),
                                          rs_offset + chunk_off,
                                          xdr_off,
                                          this_write,
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 894cb42db91d..73b428bef598 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -51,6 +51,7 @@
 #include <rdma/rdma_cm.h>
 #include <linux/sunrpc/svc_rdma.h>
 #include <linux/export.h>
+#include "xprt_rdma.h"
 
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
 
@@ -90,12 +91,6 @@ struct svc_xprt_class svc_rdma_class = {
         .xcl_max_payload = RPCSVC_MAXPAYLOAD_TCP,
 };
 
-/* WR context cache. Created in svc_rdma.c  */
-extern struct kmem_cache *svc_rdma_ctxt_cachep;
-
-/* Workqueue created in svc_rdma.c */
-extern struct workqueue_struct *svc_rdma_wq;
-
 struct svc_rdma_op_ctxt *svc_rdma_get_context(struct svcxprt_rdma *xprt)
 {
         struct svc_rdma_op_ctxt *ctxt;
@@ -150,9 +145,6 @@ void svc_rdma_put_context(struct svc_rdma_op_ctxt *ctxt, int free_pages)
         atomic_dec(&xprt->sc_ctxt_used);
 }
 
-/* Temporary NFS request map cache. Created in svc_rdma.c  */
-extern struct kmem_cache *svc_rdma_map_cachep;
-
 /*
  * Temporary NFS req mappings are shared across all transport
  * instances. These are short lived and should be bounded by the number
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 28236bab57f9..745973b729af 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -1490,6 +1490,9 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg,
         u8 key;
         int len, pageoff;
         int i, rc;
+        int seg_len;
+        u64 pa;
+        int page_no;
 
         pageoff = offset_in_page(seg1->mr_offset);
         seg1->mr_offset -= pageoff;     /* start of page */
@@ -1497,11 +1500,15 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg,
         len = -pageoff;
         if (*nsegs > RPCRDMA_MAX_DATA_SEGS)
                 *nsegs = RPCRDMA_MAX_DATA_SEGS;
-        for (i = 0; i < *nsegs;) {
+        for (page_no = i = 0; i < *nsegs;) {
                 rpcrdma_map_one(ia, seg, writing);
-                seg1->mr_chunk.rl_mw->r.frmr.fr_pgl->page_list[i] = seg->mr_dma;
+                pa = seg->mr_dma;
+                for (seg_len = seg->mr_len; seg_len > 0; seg_len -= PAGE_SIZE) {
+                        seg1->mr_chunk.rl_mw->r.frmr.fr_pgl->
+                                page_list[page_no++] = pa;
+                        pa += PAGE_SIZE;
+                }
                 len += seg->mr_len;
-                BUG_ON(seg->mr_len > PAGE_SIZE);
                 ++seg;
                 ++i;
                 /* Check for holes */
@@ -1540,9 +1547,9 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg,
         frmr_wr.send_flags = IB_SEND_SIGNALED;
         frmr_wr.wr.fast_reg.iova_start = seg1->mr_dma;
         frmr_wr.wr.fast_reg.page_list = seg1->mr_chunk.rl_mw->r.frmr.fr_pgl;
-        frmr_wr.wr.fast_reg.page_list_len = i;
+        frmr_wr.wr.fast_reg.page_list_len = page_no;
         frmr_wr.wr.fast_reg.page_shift = PAGE_SHIFT;
-        frmr_wr.wr.fast_reg.length = i << PAGE_SHIFT;
+        frmr_wr.wr.fast_reg.length = page_no << PAGE_SHIFT;
         BUG_ON(frmr_wr.wr.fast_reg.length < len);
         frmr_wr.wr.fast_reg.access_flags = (writing ?
                                 IB_ACCESS_REMOTE_WRITE | IB_ACCESS_LOCAL_WRITE :
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index 08c5d5a128fc..9a66c95b5837 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -343,4 +343,11 @@ void rpcrdma_reply_handler(struct rpcrdma_rep *);
  */
 int rpcrdma_marshal_req(struct rpc_rqst *);
 
+/* Temporary NFS request map cache. Created in svc_rdma.c  */
+extern struct kmem_cache *svc_rdma_map_cachep;
+/* WR context cache. Created in svc_rdma.c  */
+extern struct kmem_cache *svc_rdma_ctxt_cachep;
+/* Workqueue created in svc_rdma.c */
+extern struct workqueue_struct *svc_rdma_wq;
+
 #endif                          /* _LINUX_SUNRPC_XPRT_RDMA_H */
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 55472c48825e..890b03f8d877 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -53,12 +53,12 @@ static void xs_close(struct rpc_xprt *xprt);
 /*
  * xprtsock tunables
  */
-unsigned int xprt_udp_slot_table_entries = RPC_DEF_SLOT_TABLE;
-unsigned int xprt_tcp_slot_table_entries = RPC_MIN_SLOT_TABLE;
-unsigned int xprt_max_tcp_slot_table_entries = RPC_MAX_SLOT_TABLE;
+static unsigned int xprt_udp_slot_table_entries = RPC_DEF_SLOT_TABLE;
+static unsigned int xprt_tcp_slot_table_entries = RPC_MIN_SLOT_TABLE;
+static unsigned int xprt_max_tcp_slot_table_entries = RPC_MAX_SLOT_TABLE;
 
-unsigned int xprt_min_resvport = RPC_DEF_MIN_RESVPORT;
-unsigned int xprt_max_resvport = RPC_DEF_MAX_RESVPORT;
+static unsigned int xprt_min_resvport = RPC_DEF_MIN_RESVPORT;
+static unsigned int xprt_max_resvport = RPC_DEF_MAX_RESVPORT;
 
 #define XS_TCP_LINGER_TO        (15U * HZ)
 static unsigned int xs_tcp_fin_timeout __read_mostly = XS_TCP_LINGER_TO;
@@ -2227,7 +2227,7 @@ static void xs_local_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
                 idle_time = (long)(jiffies - xprt->last_used) / HZ;
 
         seq_printf(seq, "\txprt:\tlocal %lu %lu %lu %ld %lu %lu %lu "
-                        "%llu %llu\n",
+                        "%llu %llu %lu %llu %llu\n",
                         xprt->stat.bind_count,
                         xprt->stat.connect_count,
                         xprt->stat.connect_time,
@@ -2236,7 +2236,10 @@ static void xs_local_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
                         xprt->stat.recvs,
                         xprt->stat.bad_xids,
                         xprt->stat.req_u,
-                        xprt->stat.bklog_u);
+                        xprt->stat.bklog_u,
+                        xprt->stat.max_slots,
+                        xprt->stat.sending_u,
+                        xprt->stat.pending_u);
 }
 
 /**
@@ -2249,14 +2252,18 @@ static void xs_udp_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
 {
         struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
 
-        seq_printf(seq, "\txprt:\tudp %u %lu %lu %lu %lu %Lu %Lu\n",
+        seq_printf(seq, "\txprt:\tudp %u %lu %lu %lu %lu %llu %llu "
+                        "%lu %llu %llu\n",
                         transport->srcport,
                         xprt->stat.bind_count,
                         xprt->stat.sends,
                         xprt->stat.recvs,
                         xprt->stat.bad_xids,
                         xprt->stat.req_u,
-                        xprt->stat.bklog_u);
+                        xprt->stat.bklog_u,
+                        xprt->stat.max_slots,
+                        xprt->stat.sending_u,
+                        xprt->stat.pending_u);
 }
 
 /**
@@ -2273,7 +2280,8 @@ static void xs_tcp_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
         if (xprt_connected(xprt))
                 idle_time = (long)(jiffies - xprt->last_used) / HZ;
 
-        seq_printf(seq, "\txprt:\ttcp %u %lu %lu %lu %ld %lu %lu %lu %Lu %Lu\n",
+        seq_printf(seq, "\txprt:\ttcp %u %lu %lu %lu %ld %lu %lu %lu "
+                        "%llu %llu %lu %llu %llu\n",
                         transport->srcport,
                         xprt->stat.bind_count,
                         xprt->stat.connect_count,
@@ -2283,7 +2291,10 @@ static void xs_tcp_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
                         xprt->stat.recvs,
                         xprt->stat.bad_xids,
                         xprt->stat.req_u,
-                        xprt->stat.bklog_u);
+                        xprt->stat.bklog_u,
+                        xprt->stat.max_slots,
+                        xprt->stat.sending_u,
+                        xprt->stat.pending_u);
 }
 
 /*
@@ -2464,6 +2475,7 @@ static struct rpc_xprt_ops xs_tcp_ops = {
 static struct rpc_xprt_ops bc_tcp_ops = {
         .reserve_xprt           = xprt_reserve_xprt,
         .release_xprt           = xprt_release_xprt,
+        .rpcbind                = xs_local_rpcbind,
         .buf_alloc              = bc_malloc,
         .buf_free               = bc_free,
         .send_request           = bc_send_request,
diff --git a/net/sysctl_net.c b/net/sysctl_net.c
index e75813904f26..e3a6e37cd1c5 100644
--- a/net/sysctl_net.c
+++ b/net/sysctl_net.c
@@ -26,10 +26,6 @@
 #include <linux/if_ether.h>
 #endif
 
-#ifdef CONFIG_TR
-#include <linux/if_tr.h>
-#endif
-
 static struct ctl_table_set *
 net_ctl_header_lookup(struct ctl_table_root *root, struct nsproxy *namespaces)
 {
@@ -59,30 +55,15 @@ static struct ctl_table_root net_sysctl_root = {
         .permissions = net_ctl_permissions,
 };
 
-static int net_ctl_ro_header_perms(struct ctl_table_root *root,
-                struct nsproxy *namespaces, struct ctl_table *table)
-{
-        if (net_eq(namespaces->net_ns, &init_net))
-                return table->mode;
-        else
-                return table->mode & ~0222;
-}
-
-static struct ctl_table_root net_sysctl_ro_root = {
-        .permissions = net_ctl_ro_header_perms,
-};
-
 static int __net_init sysctl_net_init(struct net *net)
 {
-        setup_sysctl_set(&net->sysctls,
-                         &net_sysctl_ro_root.default_set,
-                         is_seen);
+        setup_sysctl_set(&net->sysctls, &net_sysctl_root, is_seen);
         return 0;
 }
 
 static void __net_exit sysctl_net_exit(struct net *net)
 {
-        WARN_ON(!list_empty(&net->sysctls.list));
+        retire_sysctl_set(&net->sysctls);
 }
 
 static struct pernet_operations sysctl_pernet_ops = {
@@ -90,38 +71,32 @@ static struct pernet_operations sysctl_pernet_ops = {
         .exit = sysctl_net_exit,
 };
 
-static __init int sysctl_init(void)
+static struct ctl_table_header *net_header;
+__init int net_sysctl_init(void)
 {
-        int ret;
+        static struct ctl_table empty[1];
+        int ret = -ENOMEM;
+        /* Avoid limitations in the sysctl implementation by
+         * registering "/proc/sys/net" as an empty directory not in a
+         * network namespace.
+         */
+        net_header = register_sysctl("net", empty);
+        if (!net_header)
+                goto out;
         ret = register_pernet_subsys(&sysctl_pernet_ops);
         if (ret)
                 goto out;
         register_sysctl_root(&net_sysctl_root);
-        setup_sysctl_set(&net_sysctl_ro_root.default_set, NULL, NULL);
-        register_sysctl_root(&net_sysctl_ro_root);
 out:
         return ret;
 }
-subsys_initcall(sysctl_init);
-
-struct ctl_table_header *register_net_sysctl_table(struct net *net,
-        const struct ctl_path *path, struct ctl_table *table)
-{
-        struct nsproxy namespaces;
-        namespaces = *current->nsproxy;
-        namespaces.net_ns = net;
-        return __register_sysctl_paths(&net_sysctl_root,
-                                        &namespaces, path, table);
-}
-EXPORT_SYMBOL_GPL(register_net_sysctl_table);
 
-struct ctl_table_header *register_net_sysctl_rotable(const
-                struct ctl_path *path, struct ctl_table *table)
+struct ctl_table_header *register_net_sysctl(struct net *net,
+        const char *path, struct ctl_table *table)
 {
-        return __register_sysctl_paths(&net_sysctl_ro_root,
-                        &init_nsproxy, path, table);
+        return __register_sysctl_table(&net->sysctls, path, table);
 }
-EXPORT_SYMBOL_GPL(register_net_sysctl_rotable);
+EXPORT_SYMBOL_GPL(register_net_sysctl);
 
 void unregister_net_sysctl_table(struct ctl_table_header *header)
 {
diff --git a/net/tipc/Makefile b/net/tipc/Makefile
index 521d24d04ab2..6cd55d671d3a 100644
--- a/net/tipc/Makefile
+++ b/net/tipc/Makefile
@@ -9,5 +9,3 @@ tipc-y	+= addr.o bcast.o bearer.o config.o \
            name_distr.o  subscr.o name_table.o net.o  \
            netlink.o node.o node_subscr.o port.o ref.o  \
            socket.o log.o eth_media.o
-
-# End of file
diff --git a/net/tipc/addr.c b/net/tipc/addr.c
index a6fdab33877e..357b74b26f9e 100644
--- a/net/tipc/addr.c
+++ b/net/tipc/addr.c
@@ -45,7 +45,6 @@
  *
  * Returns 1 if domain address is valid, otherwise 0
  */
-
 int tipc_addr_domain_valid(u32 addr)
 {
         u32 n = tipc_node(addr);
@@ -66,7 +65,6 @@ int tipc_addr_domain_valid(u32 addr)
  *
  * Returns 1 if address can be used, otherwise 0
  */
-
 int tipc_addr_node_valid(u32 addr)
 {
         return tipc_addr_domain_valid(addr) && tipc_node(addr);
@@ -86,7 +84,6 @@ int tipc_in_scope(u32 domain, u32 addr)
 /**
  * tipc_addr_scope - convert message lookup domain to a 2-bit scope value
  */
-
 int tipc_addr_scope(u32 domain)
 {
         if (likely(!domain))
diff --git a/net/tipc/addr.h b/net/tipc/addr.h
index e4f35afe3207..60b00ab93d74 100644
--- a/net/tipc/addr.h
+++ b/net/tipc/addr.h
@@ -50,18 +50,33 @@ static inline u32 tipc_cluster_mask(u32 addr)
         return addr & TIPC_CLUSTER_MASK;
 }
 
-static inline int in_own_cluster(u32 addr)
+static inline int in_own_cluster_exact(u32 addr)
 {
         return !((addr ^ tipc_own_addr) >> 12);
 }
 
 /**
+ * in_own_node - test for node inclusion; <0.0.0> always matches
+ */
+static inline int in_own_node(u32 addr)
+{
+        return (addr == tipc_own_addr) || !addr;
+}
+
+/**
+ * in_own_cluster - test for cluster inclusion; <0.0.0> always matches
+ */
+static inline int in_own_cluster(u32 addr)
+{
+        return in_own_cluster_exact(addr) || !addr;
+}
+
+/**
  * addr_domain - convert 2-bit scope value to equivalent message lookup domain
  *
  * Needed when address of a named message must be looked up a second time
  * after a network hop.
  */
-
 static inline u32 addr_domain(u32 sc)
 {
         if (likely(sc == TIPC_NODE_SCOPE))
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index 8eb87b11d100..2625f5ebe3e8 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -73,7 +73,6 @@ struct tipc_bcbearer_pair {
  * large local variables within multicast routines.  Concurrent access is
  * prevented through use of the spinlock "bc_lock".
  */
-
 struct tipc_bcbearer {
         struct tipc_bearer bearer;
         struct tipc_media media;
@@ -92,7 +91,6 @@ struct tipc_bcbearer {
  *
  * Handles sequence numbering, fragmentation, bundling, etc.
  */
-
 struct tipc_bclink {
         struct tipc_link link;
         struct tipc_node node;
@@ -157,44 +155,18 @@ u32 tipc_bclink_get_last_sent(void)
         return bcl->fsm_msg_cnt;
 }
 
-/**
- * bclink_set_gap - set gap according to contents of current deferred pkt queue
- *
- * Called with 'node' locked, bc_lock unlocked
- */
-
-static void bclink_set_gap(struct tipc_node *n_ptr)
-{
-        struct sk_buff *buf = n_ptr->bclink.deferred_head;
-
-        n_ptr->bclink.gap_after = n_ptr->bclink.gap_to =
-                mod(n_ptr->bclink.last_in);
-        if (unlikely(buf != NULL))
-                n_ptr->bclink.gap_to = mod(buf_seqno(buf) - 1);
-}
-
-/**
- * bclink_ack_allowed - test if ACK or NACK message can be sent at this moment
- *
- * This mechanism endeavours to prevent all nodes in network from trying
- * to ACK or NACK at the same time.
- *
- * Note: TIPC uses a different trigger to distribute ACKs than it does to
- *       distribute NACKs, but tries to use the same spacing (divide by 16).
- */
-
-static int bclink_ack_allowed(u32 n)
+static void bclink_update_last_sent(struct tipc_node *node, u32 seqno)
 {
-        return (n % TIPC_MIN_LINK_WIN) == tipc_own_tag;
+        node->bclink.last_sent = less_eq(node->bclink.last_sent, seqno) ?
+                                                seqno : node->bclink.last_sent;
 }
 
 
-/**
+/*
  * tipc_bclink_retransmit_to - get most recent node to request retransmission
  *
  * Called with bc_lock locked
  */
-
 struct tipc_node *tipc_bclink_retransmit_to(void)
 {
         return bclink->retransmit_to;
@@ -207,7 +179,6 @@ struct tipc_node *tipc_bclink_retransmit_to(void)
  *
  * Called with bc_lock locked
  */
-
 static void bclink_retransmit_pkt(u32 after, u32 to)
 {
         struct sk_buff *buf;
@@ -225,7 +196,6 @@ static void bclink_retransmit_pkt(u32 after, u32 to)
  *
  * Node is locked, bc_lock unlocked.
  */
-
 void tipc_bclink_acknowledge(struct tipc_node *n_ptr, u32 acked)
 {
         struct sk_buff *crs;
@@ -281,7 +251,7 @@ void tipc_bclink_acknowledge(struct tipc_node *n_ptr, u32 acked)
                 if (bcbuf_acks(crs) == 0) {
                         bcl->first_out = next;
                         bcl->out_queue_size--;
-                        buf_discard(crs);
+                        kfree_skb(crs);
                         released = 1;
                 }
                 crs = next;
@@ -300,143 +270,94 @@ exit:
         spin_unlock_bh(&bc_lock);
 }
 
-/**
- * bclink_send_ack - unicast an ACK msg
+/*
+ * tipc_bclink_update_link_state - update broadcast link state
  *
  * tipc_net_lock and node lock set
  */
-
-static void bclink_send_ack(struct tipc_node *n_ptr)
+void tipc_bclink_update_link_state(struct tipc_node *n_ptr, u32 last_sent)
 {
-        struct tipc_link *l_ptr = n_ptr->active_links[n_ptr->addr & 1];
+        struct sk_buff *buf;
 
-        if (l_ptr != NULL)
-                tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
-}
+        /* Ignore "stale" link state info */
 
-/**
- * bclink_send_nack- broadcast a NACK msg
- *
- * tipc_net_lock and node lock set
- */
+        if (less_eq(last_sent, n_ptr->bclink.last_in))
+                return;
 
-static void bclink_send_nack(struct tipc_node *n_ptr)
-{
-        struct sk_buff *buf;
-        struct tipc_msg *msg;
+        /* Update link synchronization state; quit if in sync */
+
+        bclink_update_last_sent(n_ptr, last_sent);
+
+        if (n_ptr->bclink.last_sent == n_ptr->bclink.last_in)
+                return;
+
+        /* Update out-of-sync state; quit if loss is still unconfirmed */
 
-        if (!less(n_ptr->bclink.gap_after, n_ptr->bclink.gap_to))
+        if ((++n_ptr->bclink.oos_state) == 1) {
+                if (n_ptr->bclink.deferred_size < (TIPC_MIN_LINK_WIN / 2))
+                        return;
+                n_ptr->bclink.oos_state++;
+        }
+
+        /* Don't NACK if one has been recently sent (or seen) */
+
+        if (n_ptr->bclink.oos_state & 0x1)
                 return;
 
+        /* Send NACK */
+
         buf = tipc_buf_acquire(INT_H_SIZE);
         if (buf) {
-                msg = buf_msg(buf);
+                struct tipc_msg *msg = buf_msg(buf);
+
                 tipc_msg_init(msg, BCAST_PROTOCOL, STATE_MSG,
-                         INT_H_SIZE, n_ptr->addr);
+                              INT_H_SIZE, n_ptr->addr);
                 msg_set_non_seq(msg, 1);
                 msg_set_mc_netid(msg, tipc_net_id);
-                msg_set_bcast_ack(msg, mod(n_ptr->bclink.last_in));
-                msg_set_bcgap_after(msg, n_ptr->bclink.gap_after);
-                msg_set_bcgap_to(msg, n_ptr->bclink.gap_to);
-                msg_set_bcast_tag(msg, tipc_own_tag);
+                msg_set_bcast_ack(msg, n_ptr->bclink.last_in);
+                msg_set_bcgap_after(msg, n_ptr->bclink.last_in);
+                msg_set_bcgap_to(msg, n_ptr->bclink.deferred_head
+                                 ? buf_seqno(n_ptr->bclink.deferred_head) - 1
+                                 : n_ptr->bclink.last_sent);
 
+                spin_lock_bh(&bc_lock);
                 tipc_bearer_send(&bcbearer->bearer, buf, NULL);
                 bcl->stats.sent_nacks++;
-                buf_discard(buf);
-
-                /*
-                 * Ensure we doesn't send another NACK msg to the node
-                 * until 16 more deferred messages arrive from it
-                 * (i.e. helps prevent all nodes from NACK'ing at same time)
-                 */
+                spin_unlock_bh(&bc_lock);
+                kfree_skb(buf);
 
-                n_ptr->bclink.nack_sync = tipc_own_tag;
+                n_ptr->bclink.oos_state++;
         }
 }
 
-/**
- * tipc_bclink_check_gap - send a NACK if a sequence gap exists
+/*
+ * bclink_peek_nack - monitor retransmission requests sent by other nodes
  *
- * tipc_net_lock and node lock set
- */
-
-void tipc_bclink_check_gap(struct tipc_node *n_ptr, u32 last_sent)
-{
-        if (!n_ptr->bclink.supported ||
-            less_eq(last_sent, mod(n_ptr->bclink.last_in)))
-                return;
-
-        bclink_set_gap(n_ptr);
-        if (n_ptr->bclink.gap_after == n_ptr->bclink.gap_to)
-                n_ptr->bclink.gap_to = last_sent;
-        bclink_send_nack(n_ptr);
-}
-
-/**
- * tipc_bclink_peek_nack - process a NACK msg meant for another node
+ * Delay any upcoming NACK by this node if another node has already
+ * requested the first message this node is going to ask for.
  *
  * Only tipc_net_lock set.
  */
-
-static void tipc_bclink_peek_nack(u32 dest, u32 sender_tag, u32 gap_after, u32 gap_to)
+static void bclink_peek_nack(struct tipc_msg *msg)
 {
-        struct tipc_node *n_ptr = tipc_node_find(dest);
-        u32 my_after, my_to;
+        struct tipc_node *n_ptr = tipc_node_find(msg_destnode(msg));
 
-        if (unlikely(!n_ptr || !tipc_node_is_up(n_ptr)))
+        if (unlikely(!n_ptr))
                 return;
+
         tipc_node_lock(n_ptr);
-        /*
-         * Modify gap to suppress unnecessary NACKs from this node
-         */
-        my_after = n_ptr->bclink.gap_after;
-        my_to = n_ptr->bclink.gap_to;
-
-        if (less_eq(gap_after, my_after)) {
-                if (less(my_after, gap_to) && less(gap_to, my_to))
-                        n_ptr->bclink.gap_after = gap_to;
-                else if (less_eq(my_to, gap_to))
-                        n_ptr->bclink.gap_to = n_ptr->bclink.gap_after;
-        } else if (less_eq(gap_after, my_to)) {
-                if (less_eq(my_to, gap_to))
-                        n_ptr->bclink.gap_to = gap_after;
-        } else {
-                /*
-                 * Expand gap if missing bufs not in deferred queue:
-                 */
-                struct sk_buff *buf = n_ptr->bclink.deferred_head;
-                u32 prev = n_ptr->bclink.gap_to;
 
-                for (; buf; buf = buf->next) {
-                        u32 seqno = buf_seqno(buf);
+        if (n_ptr->bclink.supported &&
+            (n_ptr->bclink.last_in != n_ptr->bclink.last_sent) &&
+            (n_ptr->bclink.last_in == msg_bcgap_after(msg)))
+                n_ptr->bclink.oos_state = 2;
 
-                        if (mod(seqno - prev) != 1) {
-                                buf = NULL;
-                                break;
-                        }
-                        if (seqno == gap_after)
-                                break;
-                        prev = seqno;
-                }
-                if (buf == NULL)
-                        n_ptr->bclink.gap_to = gap_after;
-        }
-        /*
-         * Some nodes may send a complementary NACK now:
-         */
-        if (bclink_ack_allowed(sender_tag + 1)) {
-                if (n_ptr->bclink.gap_to != n_ptr->bclink.gap_after) {
-                        bclink_send_nack(n_ptr);
-                        bclink_set_gap(n_ptr);
-                }
-        }
         tipc_node_unlock(n_ptr);
 }
 
-/**
+/*
  * tipc_bclink_send_msg - broadcast a packet to all nodes in cluster
  */
-
 int tipc_bclink_send_msg(struct sk_buff *buf)
 {
         int res;
@@ -445,7 +366,7 @@ int tipc_bclink_send_msg(struct sk_buff *buf)
 
         if (!bclink->bcast_nodes.count) {
                 res = msg_data_sz(buf_msg(buf));
-                buf_discard(buf);
+                kfree_skb(buf);
                 goto exit;
         }
 
@@ -460,19 +381,43 @@ exit:
         return res;
 }
 
-/**
+/*
+ * bclink_accept_pkt - accept an incoming, in-sequence broadcast packet
+ *
+ * Called with both sending node's lock and bc_lock taken.
+ */
+static void bclink_accept_pkt(struct tipc_node *node, u32 seqno)
+{
+        bclink_update_last_sent(node, seqno);
+        node->bclink.last_in = seqno;
+        node->bclink.oos_state = 0;
+        bcl->stats.recv_info++;
+
+        /*
+         * Unicast an ACK periodically, ensuring that
+         * all nodes in the cluster don't ACK at the same time
+         */
+
+        if (((seqno - tipc_own_addr) % TIPC_MIN_LINK_WIN) == 0) {
+                tipc_link_send_proto_msg(
+                        node->active_links[node->addr & 1],
+                        STATE_MSG, 0, 0, 0, 0, 0);
+                bcl->stats.sent_acks++;
+        }
+}
+
+/*
  * tipc_bclink_recv_pkt - receive a broadcast packet, and deliver upwards
  *
  * tipc_net_lock is read_locked, no other locks set
  */
-
 void tipc_bclink_recv_pkt(struct sk_buff *buf)
 {
         struct tipc_msg *msg = buf_msg(buf);
         struct tipc_node *node;
         u32 next_in;
         u32 seqno;
-        struct sk_buff *deferred;
+        int deferred;
 
         /* Screen out unwanted broadcast messages */
 
@@ -487,6 +432,8 @@ void tipc_bclink_recv_pkt(struct sk_buff *buf)
         if (unlikely(!node->bclink.supported))
                 goto unlock;
 
+        /* Handle broadcast protocol message */
+
         if (unlikely(msg_user(msg) == BCAST_PROTOCOL)) {
                 if (msg_type(msg) != STATE_MSG)
                         goto unlock;
@@ -501,89 +448,118 @@ void tipc_bclink_recv_pkt(struct sk_buff *buf)
                         spin_unlock_bh(&bc_lock);
                 } else {
                         tipc_node_unlock(node);
-                        tipc_bclink_peek_nack(msg_destnode(msg),
-                                              msg_bcast_tag(msg),
-                                              msg_bcgap_after(msg),
-                                              msg_bcgap_to(msg));
+                        bclink_peek_nack(msg);
                 }
                 goto exit;
         }
 
         /* Handle in-sequence broadcast message */
 
-receive:
-        next_in = mod(node->bclink.last_in + 1);
         seqno = msg_seqno(msg);
+        next_in = mod(node->bclink.last_in + 1);
 
         if (likely(seqno == next_in)) {
-                bcl->stats.recv_info++;
-                node->bclink.last_in++;
-                bclink_set_gap(node);
-                if (unlikely(bclink_ack_allowed(seqno))) {
-                        bclink_send_ack(node);
-                        bcl->stats.sent_acks++;
-                }
+receive:
+                /* Deliver message to destination */
+
                 if (likely(msg_isdata(msg))) {
+                        spin_lock_bh(&bc_lock);
+                        bclink_accept_pkt(node, seqno);
+                        spin_unlock_bh(&bc_lock);
                         tipc_node_unlock(node);
                         if (likely(msg_mcast(msg)))
                                 tipc_port_recv_mcast(buf, NULL);
                         else
-                                buf_discard(buf);
+                                kfree_skb(buf);
                 } else if (msg_user(msg) == MSG_BUNDLER) {
+                        spin_lock_bh(&bc_lock);
+                        bclink_accept_pkt(node, seqno);
                         bcl->stats.recv_bundles++;
                         bcl->stats.recv_bundled += msg_msgcnt(msg);
+                        spin_unlock_bh(&bc_lock);
                         tipc_node_unlock(node);
                         tipc_link_recv_bundle(buf);
                 } else if (msg_user(msg) == MSG_FRAGMENTER) {
+                        int ret = tipc_link_recv_fragment(&node->bclink.defragm,
+                                                      &buf, &msg);
+                        if (ret < 0)
+                                goto unlock;
+                        spin_lock_bh(&bc_lock);
+                        bclink_accept_pkt(node, seqno);
                         bcl->stats.recv_fragments++;
-                        if (tipc_link_recv_fragment(&node->bclink.defragm,
-                                                    &buf, &msg))
+                        if (ret > 0)
                                 bcl->stats.recv_fragmented++;
+                        spin_unlock_bh(&bc_lock);
                         tipc_node_unlock(node);
                         tipc_net_route_msg(buf);
                 } else if (msg_user(msg) == NAME_DISTRIBUTOR) {
+                        spin_lock_bh(&bc_lock);
+                        bclink_accept_pkt(node, seqno);
+                        spin_unlock_bh(&bc_lock);
                         tipc_node_unlock(node);
                         tipc_named_recv(buf);
                 } else {
+                        spin_lock_bh(&bc_lock);
+                        bclink_accept_pkt(node, seqno);
+                        spin_unlock_bh(&bc_lock);
                         tipc_node_unlock(node);
-                        buf_discard(buf);
+                        kfree_skb(buf);
                 }
                 buf = NULL;
+
+                /* Determine new synchronization state */
+
                 tipc_node_lock(node);
-                deferred = node->bclink.deferred_head;
-                if (deferred && (buf_seqno(deferred) == mod(next_in + 1))) {
-                        buf = deferred;
-                        msg = buf_msg(buf);
-                        node->bclink.deferred_head = deferred->next;
-                        goto receive;
-                }
-        } else if (less(next_in, seqno)) {
-                u32 gap_after = node->bclink.gap_after;
-                u32 gap_to = node->bclink.gap_to;
-
-                if (tipc_link_defer_pkt(&node->bclink.deferred_head,
-                                        &node->bclink.deferred_tail,
-                                        buf)) {
-                        node->bclink.nack_sync++;
-                        bcl->stats.deferred_recv++;
-                        if (seqno == mod(gap_after + 1))
-                                node->bclink.gap_after = seqno;
-                        else if (less(gap_after, seqno) && less(seqno, gap_to))
-                                node->bclink.gap_to = seqno;
+                if (unlikely(!tipc_node_is_up(node)))
+                        goto unlock;
+
+                if (node->bclink.last_in == node->bclink.last_sent)
+                        goto unlock;
+
+                if (!node->bclink.deferred_head) {
+                        node->bclink.oos_state = 1;
+                        goto unlock;
                 }
+
+                msg = buf_msg(node->bclink.deferred_head);
+                seqno = msg_seqno(msg);
+                next_in = mod(next_in + 1);
+                if (seqno != next_in)
+                        goto unlock;
+
+                /* Take in-sequence message from deferred queue & deliver it */
+
+                buf = node->bclink.deferred_head;
+                node->bclink.deferred_head = buf->next;
+                node->bclink.deferred_size--;
+                goto receive;
+        }
+
+        /* Handle out-of-sequence broadcast message */
+
+        if (less(next_in, seqno)) {
+                deferred = tipc_link_defer_pkt(&node->bclink.deferred_head,
+                                               &node->bclink.deferred_tail,
+                                               buf);
+                node->bclink.deferred_size += deferred;
+                bclink_update_last_sent(node, seqno);
                 buf = NULL;
-                if (bclink_ack_allowed(node->bclink.nack_sync)) {
-                        if (gap_to != gap_after)
-                                bclink_send_nack(node);
-                        bclink_set_gap(node);
-                }
-        } else {
+        } else
+                deferred = 0;
+
+        spin_lock_bh(&bc_lock);
+
+        if (deferred)
+                bcl->stats.deferred_recv++;
+        else
                 bcl->stats.duplicates++;
-        }
+
+        spin_unlock_bh(&bc_lock);
+
 unlock:
         tipc_node_unlock(node);
 exit:
-        buf_discard(buf);
+        kfree_skb(buf);
 }
 
 u32 tipc_bclink_acks_missing(struct tipc_node *n_ptr)
@@ -602,7 +578,6 @@ u32 tipc_bclink_acks_missing(struct tipc_node *n_ptr)
  * Returns 0 (packet sent successfully) under all circumstances,
  * since the broadcast link's pseudo-bearer never blocks
  */
-
 static int tipc_bcbearer_send(struct sk_buff *buf,
                               struct tipc_bearer *unused1,
                               struct tipc_media_addr *unused2)
@@ -615,7 +590,6 @@ static int tipc_bcbearer_send(struct sk_buff *buf,
          * preparation is skipped for broadcast link protocol messages
          * since they are sent in an unreliable manner and don't need it
          */
-
         if (likely(!msg_non_seq(buf_msg(buf)))) {
                 struct tipc_msg *msg;
 
@@ -632,7 +606,6 @@ static int tipc_bcbearer_send(struct sk_buff *buf,
         }
 
         /* Send buffer over bearers until all targets reached */
-
         bcbearer->remains = bclink->bcast_nodes;
 
         for (bp_index = 0; bp_index < MAX_BEARERS; bp_index++) {
@@ -674,7 +647,6 @@ static int tipc_bcbearer_send(struct sk_buff *buf,
 /**
  * tipc_bcbearer_sort - create sets of bearer pairs used by broadcast bearer
  */
-
 void tipc_bcbearer_sort(void)
 {
         struct tipc_bcbearer_pair *bp_temp = bcbearer->bpairs_temp;
@@ -685,7 +657,6 @@ void tipc_bcbearer_sort(void)
         spin_lock_bh(&bc_lock);
 
         /* Group bearers by priority (can assume max of two per priority) */
-
         memset(bp_temp, 0, sizeof(bcbearer->bpairs_temp));
 
         for (b_index = 0; b_index < MAX_BEARERS; b_index++) {
@@ -701,7 +672,6 @@ void tipc_bcbearer_sort(void)
         }
 
         /* Create array of bearer pairs for broadcasting */
-
         bp_curr = bcbearer->bpairs;
         memset(bcbearer->bpairs, 0, sizeof(bcbearer->bpairs));
 
@@ -831,7 +801,6 @@ void tipc_bclink_stop(void)
 /**
  * tipc_nmap_add - add a node to a node map
  */
-
 void tipc_nmap_add(struct tipc_node_map *nm_ptr, u32 node)
 {
         int n = tipc_node(node);
@@ -847,7 +816,6 @@ void tipc_nmap_add(struct tipc_node_map *nm_ptr, u32 node)
 /**
  * tipc_nmap_remove - remove a node from a node map
  */
-
 void tipc_nmap_remove(struct tipc_node_map *nm_ptr, u32 node)
 {
         int n = tipc_node(node);
@@ -866,7 +834,6 @@ void tipc_nmap_remove(struct tipc_node_map *nm_ptr, u32 node)
  * @nm_b: input node map B
  * @nm_diff: output node map A-B (i.e. nodes of A that are not in B)
  */
-
 static void tipc_nmap_diff(struct tipc_node_map *nm_a,
                            struct tipc_node_map *nm_b,
                            struct tipc_node_map *nm_diff)
@@ -892,7 +859,6 @@ static void tipc_nmap_diff(struct tipc_node_map *nm_a,
 /**
  * tipc_port_list_add - add a port to a port list, ensuring no duplicates
  */
-
 void tipc_port_list_add(struct tipc_port_list *pl_ptr, u32 port)
 {
         struct tipc_port_list *item = pl_ptr;
@@ -926,7 +892,6 @@ void tipc_port_list_add(struct tipc_port_list *pl_ptr, u32 port)
  * tipc_port_list_free - free dynamically created entries in port_list chain
  *
  */
-
 void tipc_port_list_free(struct tipc_port_list *pl_ptr)
 {
         struct tipc_port_list *item;
@@ -937,4 +902,3 @@ void tipc_port_list_free(struct tipc_port_list *pl_ptr)
                 kfree(item);
         }
 }
-
diff --git a/net/tipc/bcast.h b/net/tipc/bcast.h
index b009666c60b0..a93306557e00 100644
--- a/net/tipc/bcast.h
+++ b/net/tipc/bcast.h
@@ -45,7 +45,6 @@
  * @count: # of nodes in set
  * @map: bitmap of node identifiers that are in the set
  */
-
 struct tipc_node_map {
         u32 count;
         u32 map[MAX_NODES / WSIZE];
@@ -59,7 +58,6 @@ struct tipc_node_map {
  * @next: pointer to next entry in list
  * @ports: array of port references
  */
-
 struct tipc_port_list {
         int count;
         struct tipc_port_list *next;
@@ -77,7 +75,6 @@ void tipc_nmap_remove(struct tipc_node_map *nm_ptr, u32 node);
 /**
  * tipc_nmap_equal - test for equality of node maps
  */
-
 static inline int tipc_nmap_equal(struct tipc_node_map *nm_a, struct tipc_node_map *nm_b)
 {
         return !memcmp(nm_a, nm_b, sizeof(*nm_a));
@@ -96,7 +93,7 @@ int  tipc_bclink_send_msg(struct sk_buff *buf);
 void tipc_bclink_recv_pkt(struct sk_buff *buf);
 u32  tipc_bclink_get_last_sent(void);
 u32  tipc_bclink_acks_missing(struct tipc_node *n_ptr);
-void tipc_bclink_check_gap(struct tipc_node *n_ptr, u32 seqno);
+void tipc_bclink_update_link_state(struct tipc_node *n_ptr, u32 last_sent);
 int  tipc_bclink_stats(char *stats_buf, const u32 buf_size);
 int  tipc_bclink_reset_stats(void);
 int  tipc_bclink_set_queue_limits(u32 limit);
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 329fb659fae4..a297e3a2e3e7 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -53,7 +53,6 @@ static void bearer_disable(struct tipc_bearer *b_ptr);
  *
  * Returns 1 if media name is valid, otherwise 0.
  */
-
 static int media_name_valid(const char *name)
 {
         u32 len;
@@ -67,7 +66,6 @@ static int media_name_valid(const char *name)
 /**
  * tipc_media_find - locates specified media object by name
  */
-
 struct tipc_media *tipc_media_find(const char *name)
 {
         u32 i;
@@ -82,7 +80,6 @@ struct tipc_media *tipc_media_find(const char *name)
 /**
  * media_find_id - locates specified media object by type identifier
  */
-
 static struct tipc_media *media_find_id(u8 type)
 {
         u32 i;
@@ -99,7 +96,6 @@ static struct tipc_media *media_find_id(u8 type)
  *
  * Bearers for this media type must be activated separately at a later stage.
  */
-
 int tipc_register_media(struct tipc_media *m_ptr)
 {
         int res = -EINVAL;
@@ -134,7 +130,6 @@ exit:
 /**
  * tipc_media_addr_printf - record media address in print buffer
  */
-
 void tipc_media_addr_printf(struct print_buf *pb, struct tipc_media_addr *a)
 {
         char addr_str[MAX_ADDR_STR];
@@ -156,7 +151,6 @@ void tipc_media_addr_printf(struct print_buf *pb, struct tipc_media_addr *a)
 /**
  * tipc_media_get_names - record names of registered media in buffer
  */
-
 struct sk_buff *tipc_media_get_names(void)
 {
         struct sk_buff *buf;
@@ -183,7 +177,6 @@ struct sk_buff *tipc_media_get_names(void)
  *
  * Returns 1 if bearer name is valid, otherwise 0.
  */
-
 static int bearer_name_validate(const char *name,
                                 struct tipc_bearer_names *name_parts)
 {
@@ -194,7 +187,6 @@ static int bearer_name_validate(const char *name,
         u32 if_len;
 
         /* copy bearer name & ensure length is OK */
-
         name_copy[TIPC_MAX_BEARER_NAME - 1] = 0;
         /* need above in case non-Posix strncpy() doesn't pad with nulls */
         strncpy(name_copy, name, TIPC_MAX_BEARER_NAME);
@@ -202,7 +194,6 @@ static int bearer_name_validate(const char *name,
                 return 0;
 
         /* ensure all component parts of bearer name are present */
-
         media_name = name_copy;
         if_name = strchr(media_name, ':');
         if (if_name == NULL)
@@ -212,7 +203,6 @@ static int bearer_name_validate(const char *name,
         if_len = strlen(if_name) + 1;
 
         /* validate component parts of bearer name */
-
         if ((media_len <= 1) || (media_len > TIPC_MAX_MEDIA_NAME) ||
             (if_len <= 1) || (if_len > TIPC_MAX_IF_NAME) ||
             (strspn(media_name, tipc_alphabet) != (media_len - 1)) ||
@@ -220,7 +210,6 @@ static int bearer_name_validate(const char *name,
                 return 0;
 
         /* return bearer name components, if necessary */
-
         if (name_parts) {
                 strcpy(name_parts->media_name, media_name);
                 strcpy(name_parts->if_name, if_name);
@@ -231,7 +220,6 @@ static int bearer_name_validate(const char *name,
 /**
  * tipc_bearer_find - locates bearer object with matching bearer name
  */
-
 struct tipc_bearer *tipc_bearer_find(const char *name)
 {
         struct tipc_bearer *b_ptr;
@@ -247,7 +235,6 @@ struct tipc_bearer *tipc_bearer_find(const char *name)
 /**
  * tipc_bearer_find_interface - locates bearer object with matching interface name
  */
-
 struct tipc_bearer *tipc_bearer_find_interface(const char *if_name)
 {
         struct tipc_bearer *b_ptr;
@@ -267,7 +254,6 @@ struct tipc_bearer *tipc_bearer_find_interface(const char *if_name)
 /**
  * tipc_bearer_get_names - record names of bearers in buffer
  */
-
 struct sk_buff *tipc_bearer_get_names(void)
 {
         struct sk_buff *buf;
@@ -363,7 +349,6 @@ void tipc_continue(struct tipc_bearer *b_ptr)
  * the bearer is congested. 'tipc_net_lock' is in read_lock here
  * bearer.lock is busy
  */
-
 static void tipc_bearer_schedule_unlocked(struct tipc_bearer *b_ptr,
                                                 struct tipc_link *l_ptr)
 {
@@ -377,7 +362,6 @@ static void tipc_bearer_schedule_unlocked(struct tipc_bearer *b_ptr,
  * the bearer is congested. 'tipc_net_lock' is in read_lock here,
  * bearer.lock is free
  */
-
 void tipc_bearer_schedule(struct tipc_bearer *b_ptr, struct tipc_link *l_ptr)
 {
         spin_lock_bh(&b_ptr->lock);
@@ -410,7 +394,6 @@ int tipc_bearer_resolve_congestion(struct tipc_bearer *b_ptr,
 /**
  * tipc_bearer_congested - determines if bearer is currently congested
  */
-
 int tipc_bearer_congested(struct tipc_bearer *b_ptr, struct tipc_link *l_ptr)
 {
         if (unlikely(b_ptr->blocked))
@@ -423,7 +406,6 @@ int tipc_bearer_congested(struct tipc_bearer *b_ptr, struct tipc_link *l_ptr)
 /**
  * tipc_enable_bearer - enable bearer with the given name
  */
-
 int tipc_enable_bearer(const char *name, u32 disc_domain, u32 priority)
 {
         struct tipc_bearer *b_ptr;
@@ -435,7 +417,7 @@ int tipc_enable_bearer(const char *name, u32 disc_domain, u32 priority)
         u32 i;
         int res = -EINVAL;
 
-        if (tipc_mode != TIPC_NET_MODE) {
+        if (!tipc_own_addr) {
                 warn("Bearer <%s> rejected, not supported in standalone mode\n",
                      name);
                 return -ENOPROTOOPT;
@@ -449,15 +431,14 @@ int tipc_enable_bearer(const char *name, u32 disc_domain, u32 priority)
                 if (tipc_in_scope(disc_domain, tipc_own_addr)) {
                         disc_domain = tipc_own_addr & TIPC_CLUSTER_MASK;
                         res = 0;   /* accept any node in own cluster */
-                } else if (in_own_cluster(disc_domain))
+                } else if (in_own_cluster_exact(disc_domain))
                         res = 0;   /* accept specified node in own cluster */
         }
         if (res) {
                 warn("Bearer <%s> rejected, illegal discovery domain\n", name);
                 return -EINVAL;
         }
-        if ((priority < TIPC_MIN_LINK_PRI ||
-             priority > TIPC_MAX_LINK_PRI) &&
+        if ((priority > TIPC_MAX_LINK_PRI) &&
             (priority != TIPC_MEDIA_LINK_PRI)) {
                 warn("Bearer <%s> rejected, illegal priority\n", name);
                 return -EINVAL;
@@ -542,7 +523,6 @@ exit:
  * tipc_block_bearer(): Block the bearer with the given name,
  *                      and reset all its links
  */
-
 int tipc_block_bearer(const char *name)
 {
         struct tipc_bearer *b_ptr = NULL;
@@ -574,11 +554,10 @@ int tipc_block_bearer(const char *name)
 }
 
 /**
- * bearer_disable -
+ * bearer_disable
  *
  * Note: This routine assumes caller holds tipc_net_lock.
  */
-
 static void bearer_disable(struct tipc_bearer *b_ptr)
 {
         struct tipc_link *l_ptr;
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index d3eac56b8c21..e3b2be37fb31 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -49,7 +49,6 @@
  * - media type identifier located at offset 3
  * - remaining bytes vary according to media type
  */
-
 #define TIPC_MEDIA_ADDR_SIZE    20
 #define TIPC_MEDIA_TYPE_OFFSET  3
 
@@ -64,7 +63,6 @@
  * @media_id: TIPC media type identifier
  * @broadcast: non-zero if address is a broadcast address
  */
-
 struct tipc_media_addr {
         u8 value[TIPC_MEDIA_ADDR_SIZE];
         u8 media_id;
@@ -89,7 +87,6 @@ struct tipc_bearer;
  * @type_id: TIPC media identifier
  * @name: media name
  */
-
 struct tipc_media {
         int (*send_msg)(struct sk_buff *buf,
                         struct tipc_bearer *b_ptr,
@@ -216,7 +213,6 @@ void tipc_bearer_lock_push(struct tipc_bearer *b_ptr);
  * send routine always returns success -- even if the buffer was not sent --
  * and let TIPC's link code deal with the undelivered message.
  */
-
 static inline int tipc_bearer_send(struct tipc_bearer *b_ptr,
                                    struct sk_buff *buf,
                                    struct tipc_media_addr *dest)
diff --git a/net/tipc/config.c b/net/tipc/config.c
index 4785bf26cdf4..c5712a343810 100644
--- a/net/tipc/config.c
+++ b/net/tipc/config.c
@@ -131,7 +131,6 @@ static struct sk_buff *tipc_show_stats(void)
         tipc_printf(&pb, "TIPC version " TIPC_MOD_VER "\n");
 
         /* Use additional tipc_printf()'s to return more info ... */
-
         str_len = tipc_printbuf_validate(&pb);
         skb_put(buf, TLV_SPACE(str_len));
         TLV_SET(rep_tlv, TIPC_TLV_ULTRA_STRING, NULL, str_len);
@@ -179,7 +178,7 @@ static struct sk_buff *cfg_set_own_addr(void)
         if (!tipc_addr_node_valid(addr))
                 return tipc_cfg_reply_error_string(TIPC_CFG_INVALID_VALUE
                                                    " (node address)");
-        if (tipc_mode == TIPC_NET_MODE)
+        if (tipc_own_addr)
                 return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
                                                    " (cannot change node address once assigned)");
 
@@ -191,7 +190,6 @@ static struct sk_buff *cfg_set_own_addr(void)
          * configuration commands can't be received until a local configuration
          * command to enable the first bearer is received and processed.
          */
-
         spin_unlock_bh(&config_lock);
         tipc_core_start_net(addr);
         spin_lock_bh(&config_lock);
@@ -218,7 +216,7 @@ static struct sk_buff *cfg_set_max_publications(void)
                 return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
 
         value = ntohl(*(__be32 *)TLV_DATA(req_tlv_area));
-        if (value != delimit(value, 1, 65535))
+        if (value < 1 || value > 65535)
                 return tipc_cfg_reply_error_string(TIPC_CFG_INVALID_VALUE
                                                    " (max publications must be 1-65535)");
         tipc_max_publications = value;
@@ -233,7 +231,7 @@ static struct sk_buff *cfg_set_max_subscriptions(void)
                 return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
 
         value = ntohl(*(__be32 *)TLV_DATA(req_tlv_area));
-        if (value != delimit(value, 1, 65535))
+        if (value < 1 || value > 65535)
                 return tipc_cfg_reply_error_string(TIPC_CFG_INVALID_VALUE
                                                    " (max subscriptions must be 1-65535");
         tipc_max_subscriptions = value;
@@ -249,14 +247,11 @@ static struct sk_buff *cfg_set_max_ports(void)
         value = ntohl(*(__be32 *)TLV_DATA(req_tlv_area));
         if (value == tipc_max_ports)
                 return tipc_cfg_reply_none();
-        if (value != delimit(value, 127, 65535))
+        if (value < 127 || value > 65535)
                 return tipc_cfg_reply_error_string(TIPC_CFG_INVALID_VALUE
                                                    " (max ports must be 127-65535)");
-        if (tipc_mode != TIPC_NOT_RUNNING)
-                return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
-                        " (cannot change max ports while TIPC is active)");
-        tipc_max_ports = value;
-        return tipc_cfg_reply_none();
+        return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
+                " (cannot change max ports while TIPC is active)");
 }
 
 static struct sk_buff *cfg_set_netid(void)
@@ -268,10 +263,10 @@ static struct sk_buff *cfg_set_netid(void)
         value = ntohl(*(__be32 *)TLV_DATA(req_tlv_area));
         if (value == tipc_net_id)
                 return tipc_cfg_reply_none();
-        if (value != delimit(value, 1, 9999))
+        if (value < 1 || value > 9999)
                 return tipc_cfg_reply_error_string(TIPC_CFG_INVALID_VALUE
                                                    " (network id must be 1-9999)");
-        if (tipc_mode == TIPC_NET_MODE)
+        if (tipc_own_addr)
                 return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
                         " (cannot change network id once TIPC has joined a network)");
         tipc_net_id = value;
@@ -286,14 +281,12 @@ struct sk_buff *tipc_cfg_do_cmd(u32 orig_node, u16 cmd, const void *request_area
         spin_lock_bh(&config_lock);
 
         /* Save request and reply details in a well-known location */
-
         req_tlv_area = request_area;
         req_tlv_space = request_space;
         rep_headroom = reply_headroom;
 
         /* Check command authorization */
-
-        if (likely(orig_node == tipc_own_addr)) {
+        if (likely(in_own_node(orig_node))) {
                 /* command is permitted */
         } else if (cmd >= 0x8000) {
                 rep_tlv_buf = tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
@@ -313,7 +306,6 @@ struct sk_buff *tipc_cfg_do_cmd(u32 orig_node, u16 cmd, const void *request_area
         }
 
         /* Call appropriate processing routine */
-
         switch (cmd) {
         case TIPC_CMD_NOOP:
                 rep_tlv_buf = tipc_cfg_reply_none();
@@ -436,7 +428,6 @@ static void cfg_named_msg_event(void *userdata,
         struct sk_buff *rep_buf;
 
         /* Validate configuration message header (ignore invalid message) */
-
         req_hdr = (struct tipc_cfg_msg_hdr *)msg;
         if ((size < sizeof(*req_hdr)) ||
             (size != TCM_ALIGN(ntohl(req_hdr->tcm_len))) ||
@@ -446,7 +437,6 @@ static void cfg_named_msg_event(void *userdata,
         }
 
         /* Generate reply for request (if can't, return request) */
-
         rep_buf = tipc_cfg_do_cmd(orig->node,
                                   ntohs(req_hdr->tcm_type),
                                   msg + sizeof(*req_hdr),
@@ -481,7 +471,7 @@ int tipc_cfg_init(void)
 
         seq.type = TIPC_CFG_SRV;
         seq.lower = seq.upper = tipc_own_addr;
-        res = tipc_nametbl_publish_rsv(config_port_ref, TIPC_ZONE_SCOPE, &seq);
+        res = tipc_publish(config_port_ref, TIPC_ZONE_SCOPE, &seq);
         if (res)
                 goto failed;
 
@@ -492,10 +482,23 @@ failed:
         return res;
 }
 
+void tipc_cfg_reinit(void)
+{
+        struct tipc_name_seq seq;
+        int res;
+
+        seq.type = TIPC_CFG_SRV;
+        seq.lower = seq.upper = 0;
+        tipc_withdraw(config_port_ref, TIPC_ZONE_SCOPE, &seq);
+
+        seq.lower = seq.upper = tipc_own_addr;
+        res = tipc_publish(config_port_ref, TIPC_ZONE_SCOPE, &seq);
+        if (res)
+                err("Unable to reinitialize configuration service\n");
+}
+
 void tipc_cfg_stop(void)
 {
-        if (config_port_ref) {
-                tipc_deleteport(config_port_ref);
-                config_port_ref = 0;
-        }
+        tipc_deleteport(config_port_ref);
+        config_port_ref = 0;
 }
diff --git a/net/tipc/config.h b/net/tipc/config.h
index 80da6ebc2785..1f252f3fa058 100644
--- a/net/tipc/config.h
+++ b/net/tipc/config.h
@@ -66,6 +66,7 @@ struct sk_buff *tipc_cfg_do_cmd(u32 orig_node, u16 cmd,
                                 int headroom);
 
 int  tipc_cfg_init(void);
+void tipc_cfg_reinit(void);
 void tipc_cfg_stop(void);
 
 #endif
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 2691cd57b8a8..f7b95239ebda 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -52,15 +52,12 @@
 #endif
 
 /* global variables used by multiple sub-systems within TIPC */
-
-int tipc_mode = TIPC_NOT_RUNNING;
 int tipc_random;
 
 const char tipc_alphabet[] =
         "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_.";
 
 /* configurable TIPC parameters */
-
 u32 tipc_own_addr;
 int tipc_max_ports;
 int tipc_max_subscriptions;
@@ -78,7 +75,6 @@ int tipc_remote_management;
  * NOTE: Headroom is reserved to allow prepending of a data link header.
  *       There may also be unrequested tailroom present at the buffer's end.
  */
-
 struct sk_buff *tipc_buf_acquire(u32 size)
 {
         struct sk_buff *skb;
@@ -96,7 +92,6 @@ struct sk_buff *tipc_buf_acquire(u32 size)
 /**
  * tipc_core_stop_net - shut down TIPC networking sub-systems
  */
-
 static void tipc_core_stop_net(void)
 {
         tipc_net_stop();
@@ -106,7 +101,6 @@ static void tipc_core_stop_net(void)
 /**
  * start_net - start TIPC networking sub-systems
  */
-
 int tipc_core_start_net(unsigned long addr)
 {
         int res;
@@ -122,14 +116,8 @@ int tipc_core_start_net(unsigned long addr)
 /**
  * tipc_core_stop - switch TIPC from SINGLE NODE to NOT RUNNING mode
  */
-
 static void tipc_core_stop(void)
 {
-        if (tipc_mode != TIPC_NODE_MODE)
-                return;
-
-        tipc_mode = TIPC_NOT_RUNNING;
-
         tipc_netlink_stop();
         tipc_handler_stop();
         tipc_cfg_stop();
@@ -143,16 +131,11 @@ static void tipc_core_stop(void)
 /**
  * tipc_core_start - switch TIPC from NOT RUNNING to SINGLE NODE mode
  */
-
 static int tipc_core_start(void)
 {
         int res;
 
-        if (tipc_mode != TIPC_NOT_RUNNING)
-                return -ENOPROTOOPT;
-
         get_random_bytes(&tipc_random, sizeof(tipc_random));
-        tipc_mode = TIPC_NODE_MODE;
 
         res = tipc_handler_start();
         if (!res)
@@ -160,9 +143,9 @@ static int tipc_core_start(void)
         if (!res)
                 res = tipc_nametbl_init();
         if (!res)
-                res = tipc_k_signal((Handler)tipc_subscr_start, 0);
+                res = tipc_subscr_start();
         if (!res)
-                res = tipc_k_signal((Handler)tipc_cfg_init, 0);
+                res = tipc_cfg_init();
         if (!res)
                 res = tipc_netlink_start();
         if (!res)
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 2761af36d141..2a9bb99537b3 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -85,7 +85,6 @@ void tipc_printf(struct print_buf *, const char *fmt, ...);
 /*
  * TIPC_OUTPUT is the destination print buffer for system messages.
  */
-
 #ifndef TIPC_OUTPUT
 #define TIPC_OUTPUT TIPC_LOG
 #endif
@@ -102,7 +101,6 @@ void tipc_printf(struct print_buf *, const char *fmt, ...);
 /*
  * DBG_OUTPUT is the destination print buffer for debug messages.
  */
-
 #ifndef DBG_OUTPUT
 #define DBG_OUTPUT TIPC_LOG
 #endif
@@ -126,20 +124,11 @@ void tipc_msg_dbg(struct print_buf *, struct tipc_msg *, const char *);
 /*
  * TIPC-specific error codes
  */
-
 #define ELINKCONG EAGAIN        /* link congestion <=> resource unavailable */
 
 /*
- * TIPC operating mode routines
- */
-#define TIPC_NOT_RUNNING  0
-#define TIPC_NODE_MODE    1
-#define TIPC_NET_MODE     2
-
-/*
  * Global configuration variables
  */
-
 extern u32 tipc_own_addr;
 extern int tipc_max_ports;
 extern int tipc_max_subscriptions;
@@ -150,8 +139,6 @@ extern int tipc_remote_management;
 /*
  * Other global variables
  */
-
-extern int tipc_mode;
 extern int tipc_random;
 extern const char tipc_alphabet[];
 
@@ -159,7 +146,6 @@ extern const char tipc_alphabet[];
 /*
  * Routines available to privileged subsystems
  */
-
 extern int tipc_core_start_net(unsigned long);
 extern int  tipc_handler_start(void);
 extern void tipc_handler_stop(void);
@@ -168,20 +154,9 @@ extern void tipc_netlink_stop(void);
 extern int  tipc_socket_init(void);
 extern void tipc_socket_stop(void);
 
-static inline int delimit(int val, int min, int max)
-{
-        if (val > max)
-                return max;
-        if (val < min)
-                return min;
-        return val;
-}
-
-
 /*
  * TIPC timer and signal code
  */
-
 typedef void (*Handler) (unsigned long);
 
 u32 tipc_k_signal(Handler routine, unsigned long argument);
@@ -194,7 +169,6 @@ u32 tipc_k_signal(Handler routine, unsigned long argument);
  *
  * Timer must be initialized before use (and terminated when no longer needed).
  */
-
 static inline void k_init_timer(struct timer_list *timer, Handler routine,
                                 unsigned long argument)
 {
@@ -214,7 +188,6 @@ static inline void k_init_timer(struct timer_list *timer, Handler routine,
  * then an additional jiffy is added to account for the fact that
  * the starting time may be in the middle of the current jiffy.
  */
-
 static inline void k_start_timer(struct timer_list *timer, unsigned long msec)
 {
         mod_timer(timer, jiffies + msecs_to_jiffies(msec) + 1);
@@ -230,7 +203,6 @@ static inline void k_start_timer(struct timer_list *timer, unsigned long msec)
  * WARNING: Must not be called when holding locks required by the timer's
  *          timeout routine, otherwise deadlock can occur on SMP systems!
  */
-
 static inline void k_cancel_timer(struct timer_list *timer)
 {
         del_timer_sync(timer);
@@ -247,12 +219,10 @@ static inline void k_cancel_timer(struct timer_list *timer)
  * (Do not "enhance" this routine to automatically cancel an active timer,
  * otherwise deadlock can arise when a timeout routine calls k_term_timer.)
  */
-
 static inline void k_term_timer(struct timer_list *timer)
 {
 }
 
-
 /*
  * TIPC message buffer code
  *
@@ -262,7 +232,6 @@ static inline void k_term_timer(struct timer_list *timer)
  * Note: Headroom should be a multiple of 4 to ensure the TIPC header fields
  *       are word aligned for quicker access
  */
-
 #define BUF_HEADROOM LL_MAX_HEADER
 
 struct tipc_skb_cb {
@@ -271,7 +240,6 @@ struct tipc_skb_cb {
 
 #define TIPC_SKB_CB(__skb) ((struct tipc_skb_cb *)&((__skb)->cb[0]))
 
-
 static inline struct tipc_msg *buf_msg(struct sk_buff *skb)
 {
         return (struct tipc_msg *)skb->data;
@@ -279,28 +247,4 @@ static inline struct tipc_msg *buf_msg(struct sk_buff *skb)
 
 extern struct sk_buff *tipc_buf_acquire(u32 size);
 
-/**
- * buf_discard - frees a TIPC message buffer
- * @skb: message buffer
- *
- * Frees a message buffer.  If passed NULL, just returns.
- */
-
-static inline void buf_discard(struct sk_buff *skb)
-{
-        kfree_skb(skb);
-}
-
-/**
- * buf_linearize - convert a TIPC message buffer into a single contiguous piece
- * @skb: message buffer
- *
- * Returns 0 on success.
- */
-
-static inline int buf_linearize(struct sk_buff *skb)
-{
-        return skb_linearize(skb);
-}
-
 #endif
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index a00e5f811569..ae054cfe179f 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -70,7 +70,6 @@ struct tipc_link_req {
  * @dest_domain: network domain of node(s) which should respond to message
  * @b_ptr: ptr to bearer issuing message
  */
-
 static struct sk_buff *tipc_disc_init_msg(u32 type,
                                           u32 dest_domain,
                                           struct tipc_bearer *b_ptr)
@@ -82,6 +81,7 @@ static struct sk_buff *tipc_disc_init_msg(u32 type,
                 msg = buf_msg(buf);
                 tipc_msg_init(msg, LINK_CONFIG, type, INT_H_SIZE, dest_domain);
                 msg_set_non_seq(msg, 1);
+                msg_set_node_sig(msg, tipc_random);
                 msg_set_dest_domain(msg, dest_domain);
                 msg_set_bc_netid(msg, tipc_net_id);
                 b_ptr->media->addr2msg(&b_ptr->addr, msg_media_addr(msg));
@@ -95,7 +95,6 @@ static struct sk_buff *tipc_disc_init_msg(u32 type,
  * @node_addr: duplicated node address
  * @media_addr: media address advertised by duplicated node
  */
-
 static void disc_dupl_alert(struct tipc_bearer *b_ptr, u32 node_addr,
                             struct tipc_media_addr *media_addr)
 {
@@ -116,25 +115,26 @@ static void disc_dupl_alert(struct tipc_bearer *b_ptr, u32 node_addr,
  * @buf: buffer containing message
  * @b_ptr: bearer that message arrived on
  */
-
 void tipc_disc_recv_msg(struct sk_buff *buf, struct tipc_bearer *b_ptr)
 {
         struct tipc_node *n_ptr;
         struct tipc_link *link;
-        struct tipc_media_addr media_addr, *addr;
+        struct tipc_media_addr media_addr;
         struct sk_buff *rbuf;
         struct tipc_msg *msg = buf_msg(buf);
         u32 dest = msg_dest_domain(msg);
         u32 orig = msg_prevnode(msg);
         u32 net_id = msg_bc_netid(msg);
         u32 type = msg_type(msg);
+        u32 signature = msg_node_sig(msg);
+        int addr_mismatch;
         int link_fully_up;
 
         media_addr.broadcast = 1;
         b_ptr->media->msg2addr(&media_addr, msg_media_addr(msg));
-        buf_discard(buf);
+        kfree_skb(buf);
 
-        /* Validate discovery message from requesting node */
+        /* Ensure message from node is valid and communication is permitted */
         if (net_id != tipc_net_id)
                 return;
         if (media_addr.broadcast)
@@ -162,15 +162,50 @@ void tipc_disc_recv_msg(struct sk_buff *buf, struct tipc_bearer *b_ptr)
         }
         tipc_node_lock(n_ptr);
 
+        /* Prepare to validate requesting node's signature and media address */
         link = n_ptr->links[b_ptr->identity];
+        addr_mismatch = (link != NULL) &&
+                memcmp(&link->media_addr, &media_addr, sizeof(media_addr));
 
-        /* Create a link endpoint for this bearer, if necessary */
-        if (!link) {
-                link = tipc_link_create(n_ptr, b_ptr, &media_addr);
-                if (!link) {
+        /*
+         * Ensure discovery message's signature is correct
+         *
+         * If signature is incorrect and there is no working link to the node,
+         * accept the new signature but invalidate all existing links to the
+         * node so they won't re-activate without a new discovery message.
+         *
+         * If signature is incorrect and the requested link to the node is
+         * working, accept the new signature. (This is an instance of delayed
+         * rediscovery, where a link endpoint was able to re-establish contact
+         * with its peer endpoint on a node that rebooted before receiving a
+         * discovery message from that node.)
+         *
+         * If signature is incorrect and there is a working link to the node
+         * that is not the requested link, reject the request (must be from
+         * a duplicate node).
+         */
+        if (signature != n_ptr->signature) {
+                if (n_ptr->working_links == 0) {
+                        struct tipc_link *curr_link;
+                        int i;
+
+                        for (i = 0; i < MAX_BEARERS; i++) {
+                                curr_link = n_ptr->links[i];
+                                if (curr_link) {
+                                        memset(&curr_link->media_addr, 0,
+                                               sizeof(media_addr));
+                                        tipc_link_reset(curr_link);
+                                }
+                        }
+                        addr_mismatch = (link != NULL);
+                } else if (tipc_link_is_up(link) && !addr_mismatch) {
+                        /* delayed rediscovery */
+                } else {
+                        disc_dupl_alert(b_ptr, orig, &media_addr);
                         tipc_node_unlock(n_ptr);
                         return;
                 }
+                n_ptr->signature = signature;
         }
 
         /*
@@ -183,17 +218,25 @@ void tipc_disc_recv_msg(struct sk_buff *buf, struct tipc_bearer *b_ptr)
          * the new media address and reset the link to ensure it starts up
          * cleanly.
          */
-        addr = &link->media_addr;
-        if (memcmp(addr, &media_addr, sizeof(*addr))) {
-                if (tipc_link_is_up(link) || (!link->started)) {
+        if (addr_mismatch) {
+                if (tipc_link_is_up(link)) {
                         disc_dupl_alert(b_ptr, orig, &media_addr);
                         tipc_node_unlock(n_ptr);
                         return;
+                } else {
+                        memcpy(&link->media_addr, &media_addr,
+                               sizeof(media_addr));
+                        tipc_link_reset(link);
+                }
+        }
+
+        /* Create a link endpoint for this bearer, if necessary */
+        if (!link) {
+                link = tipc_link_create(n_ptr, b_ptr, &media_addr);
+                if (!link) {
+                        tipc_node_unlock(n_ptr);
+                        return;
                 }
-                warn("Resetting link <%s>, peer interface address changed\n",
-                     link->name);
-                memcpy(addr, &media_addr, sizeof(*addr));
-                tipc_link_reset(link);
         }
 
         /* Accept discovery message & send response, if necessary */
@@ -203,7 +246,7 @@ void tipc_disc_recv_msg(struct sk_buff *buf, struct tipc_bearer *b_ptr)
                 rbuf = tipc_disc_init_msg(DSC_RESP_MSG, orig, b_ptr);
                 if (rbuf) {
                         b_ptr->media->send_msg(rbuf, b_ptr, &media_addr);
-                        buf_discard(rbuf);
+                        kfree_skb(rbuf);
                 }
         }
 
@@ -217,7 +260,6 @@ void tipc_disc_recv_msg(struct sk_buff *buf, struct tipc_bearer *b_ptr)
  * Reinitiates discovery process if discovery object has no associated nodes
  * and is either not currently searching or is searching at a slow rate
  */
-
 static void disc_update(struct tipc_link_req *req)
 {
         if (!req->num_nodes) {
@@ -233,7 +275,6 @@ static void disc_update(struct tipc_link_req *req)
  * tipc_disc_add_dest - increment set of discovered nodes
  * @req: ptr to link request structure
  */
-
 void tipc_disc_add_dest(struct tipc_link_req *req)
 {
         req->num_nodes++;
@@ -243,7 +284,6 @@ void tipc_disc_add_dest(struct tipc_link_req *req)
  * tipc_disc_remove_dest - decrement set of discovered nodes
  * @req: ptr to link request structure
  */
-
 void tipc_disc_remove_dest(struct tipc_link_req *req)
 {
         req->num_nodes--;
@@ -254,7 +294,6 @@ void tipc_disc_remove_dest(struct tipc_link_req *req)
  * disc_send_msg - send link setup request message
  * @req: ptr to link request structure
  */
-
 static void disc_send_msg(struct tipc_link_req *req)
 {
         if (!req->bearer->blocked)
@@ -267,7 +306,6 @@ static void disc_send_msg(struct tipc_link_req *req)
  *
  * Called whenever a link setup request timer associated with a bearer expires.
  */
-
 static void disc_timeout(struct tipc_link_req *req)
 {
         int max_delay;
@@ -275,7 +313,6 @@ static void disc_timeout(struct tipc_link_req *req)
         spin_lock_bh(&req->bearer->lock);
 
         /* Stop searching if only desired node has been found */
-
         if (tipc_node(req->domain) && req->num_nodes) {
                 req->timer_intv = TIPC_LINK_REQ_INACTIVE;
                 goto exit;
@@ -288,7 +325,6 @@ static void disc_timeout(struct tipc_link_req *req)
          * hold at fast polling rate if don't have any associated nodes,
          * otherwise hold at slow polling rate
          */
-
         disc_send_msg(req);
 
         req->timer_intv *= 2;
@@ -312,7 +348,6 @@ exit:
  *
  * Returns 0 if successful, otherwise -errno.
  */
-
 int tipc_disc_create(struct tipc_bearer *b_ptr,
                      struct tipc_media_addr *dest, u32 dest_domain)
 {
@@ -344,12 +379,10 @@ int tipc_disc_create(struct tipc_bearer *b_ptr,
  * tipc_disc_delete - destroy object sending periodic link setup requests
  * @req: ptr to link request structure
  */
-
 void tipc_disc_delete(struct tipc_link_req *req)
 {
         k_cancel_timer(&req->timer);
         k_term_timer(&req->timer);
-        buf_discard(req->buf);
+        kfree_skb(req->buf);
         kfree(req);
 }
-
diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
index 527e3f0e165d..90ac9bfa7abb 100644
--- a/net/tipc/eth_media.c
+++ b/net/tipc/eth_media.c
@@ -48,7 +48,6 @@
  * @tipc_packet_type: used in binding TIPC to Ethernet driver
  * @cleanup: work item used when disabling bearer
  */
-
 struct eth_bearer {
         struct tipc_bearer *bearer;
         struct net_device *dev;
@@ -67,7 +66,6 @@ static struct notifier_block notifier;
  * Media-dependent "value" field stores MAC address in first 6 bytes
  * and zeroes out the remaining bytes.
  */
-
 static void eth_media_addr_set(struct tipc_media_addr *a, char *mac)
 {
         memcpy(a->value, mac, ETH_ALEN);
@@ -79,7 +77,6 @@ static void eth_media_addr_set(struct tipc_media_addr *a, char *mac)
 /**
  * send_msg - send a TIPC message out over an Ethernet interface
  */
-
 static int send_msg(struct sk_buff *buf, struct tipc_bearer *tb_ptr,
                     struct tipc_media_addr *dest)
 {
@@ -115,7 +112,6 @@ static int send_msg(struct sk_buff *buf, struct tipc_bearer *tb_ptr,
  * ignores packets sent using Ethernet multicast, and traffic sent to other
  * nodes (which can happen if interface is running in promiscuous mode).
  */
-
 static int recv_msg(struct sk_buff *buf, struct net_device *dev,
                     struct packet_type *pt, struct net_device *orig_dev)
 {
@@ -140,7 +136,6 @@ static int recv_msg(struct sk_buff *buf, struct net_device *dev,
 /**
  * enable_bearer - attach TIPC bearer to an Ethernet interface
  */
-
 static int enable_bearer(struct tipc_bearer *tb_ptr)
 {
         struct net_device *dev = NULL;
@@ -151,7 +146,6 @@ static int enable_bearer(struct tipc_bearer *tb_ptr)
         int pending_dev = 0;
 
         /* Find unused Ethernet bearer structure */
-
         while (eb_ptr->dev) {
                 if (!eb_ptr->bearer)
                         pending_dev++;
@@ -160,7 +154,6 @@ static int enable_bearer(struct tipc_bearer *tb_ptr)
         }
 
         /* Find device with specified name */
-
         read_lock(&dev_base_lock);
         for_each_netdev(&init_net, pdev) {
                 if (!strncmp(pdev->name, driver_name, IFNAMSIZ)) {
@@ -174,7 +167,6 @@ static int enable_bearer(struct tipc_bearer *tb_ptr)
                 return -ENODEV;
 
         /* Create Ethernet bearer for device */
-
         eb_ptr->dev = dev;
         eb_ptr->tipc_packet_type.type = htons(ETH_P_TIPC);
         eb_ptr->tipc_packet_type.dev = dev;
@@ -184,7 +176,6 @@ static int enable_bearer(struct tipc_bearer *tb_ptr)
         dev_add_pack(&eb_ptr->tipc_packet_type);
 
         /* Associate TIPC bearer with Ethernet bearer */
-
         eb_ptr->bearer = tb_ptr;
         tb_ptr->usr_handle = (void *)eb_ptr;
         tb_ptr->mtu = dev->mtu;
@@ -198,7 +189,6 @@ static int enable_bearer(struct tipc_bearer *tb_ptr)
  *
  * This routine must be invoked from a work queue because it can sleep.
  */
-
 static void cleanup_bearer(struct work_struct *work)
 {
         struct eth_bearer *eb_ptr =
@@ -216,7 +206,6 @@ static void cleanup_bearer(struct work_struct *work)
  * then get worker thread to complete bearer cleanup.  (Can't do cleanup
  * here because cleanup code needs to sleep and caller holds spinlocks.)
  */
-
 static void disable_bearer(struct tipc_bearer *tb_ptr)
 {
         struct eth_bearer *eb_ptr = (struct eth_bearer *)tb_ptr->usr_handle;
@@ -232,7 +221,6 @@ static void disable_bearer(struct tipc_bearer *tb_ptr)
  * Change the state of the Ethernet bearer (if any) associated with the
  * specified device.
  */
-
 static int recv_notification(struct notifier_block *nb, unsigned long evt,
                              void *dv)
 {
@@ -281,7 +269,6 @@ static int recv_notification(struct notifier_block *nb, unsigned long evt,
 /**
  * eth_addr2str - convert Ethernet address to string
  */
-
 static int eth_addr2str(struct tipc_media_addr *a, char *str_buf, int str_size)
 {
         if (str_size < 18)      /* 18 = strlen("aa:bb:cc:dd:ee:ff\0") */
@@ -294,7 +281,6 @@ static int eth_addr2str(struct tipc_media_addr *a, char *str_buf, int str_size)
 /**
  * eth_str2addr - convert string to Ethernet address
  */
-
 static int eth_str2addr(struct tipc_media_addr *a, char *str_buf)
 {
         char mac[ETH_ALEN];
@@ -314,7 +300,6 @@ static int eth_str2addr(struct tipc_media_addr *a, char *str_buf)
 /**
  * eth_str2addr - convert Ethernet address format to message header format
  */
-
 static int eth_addr2msg(struct tipc_media_addr *a, char *msg_area)
 {
         memset(msg_area, 0, TIPC_MEDIA_ADDR_SIZE);
@@ -326,7 +311,6 @@ static int eth_addr2msg(struct tipc_media_addr *a, char *msg_area)
 /**
  * eth_str2addr - convert message header address format to Ethernet format
  */
-
 static int eth_msg2addr(struct tipc_media_addr *a, char *msg_area)
 {
         if (msg_area[TIPC_MEDIA_TYPE_OFFSET] != TIPC_MEDIA_TYPE_ETH)
@@ -339,7 +323,6 @@ static int eth_msg2addr(struct tipc_media_addr *a, char *msg_area)
 /*
  * Ethernet media registration info
  */
-
 static struct tipc_media eth_media_info = {
         .send_msg       = send_msg,
         .enable_bearer  = enable_bearer,
@@ -363,7 +346,6 @@ static struct tipc_media eth_media_info = {
  * Register Ethernet media type with TIPC bearer code.  Also register
  * with OS for notifications about device state changes.
  */
-
 int tipc_eth_media_start(void)
 {
         int res;
@@ -386,7 +368,6 @@ int tipc_eth_media_start(void)
 /**
  * tipc_eth_media_stop - deactivate Ethernet bearer support
  */
-
 void tipc_eth_media_stop(void)
 {
         if (!eth_started)
diff --git a/net/tipc/handler.c b/net/tipc/handler.c
index 274c98e164b7..9c6f22ff1c6d 100644
--- a/net/tipc/handler.c
+++ b/net/tipc/handler.c
@@ -129,4 +129,3 @@ void tipc_handler_stop(void)
 
         kmem_cache_destroy(tipc_queue_item_cache);
 }
-
diff --git a/net/tipc/link.c b/net/tipc/link.c
index ac1832a66f8a..7a614f43549d 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -45,13 +45,11 @@
 /*
  * Out-of-range value for link session numbers
  */
-
 #define INVALID_SESSION 0x10000
 
 /*
  * Link state events:
  */
-
 #define  STARTING_EVT    856384768      /* link processing trigger */
 #define  TRAFFIC_MSG_EVT 560815u        /* rx'd ??? */
 #define  TIMEOUT_EVT     560817u        /* link timer expired */
@@ -67,7 +65,6 @@
 /*
  * State value stored in 'exp_msg_count'
  */
-
 #define START_CHANGEOVER 100000u
 
 /**
@@ -77,7 +74,6 @@
  * @addr_peer: network address of node at far end
  * @if_peer: name of interface at far end
  */
-
 struct tipc_link_name {
         u32 addr_local;
         char if_local[TIPC_MAX_IF_NAME];
@@ -105,7 +101,6 @@ static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf);
 /*
  *  Simple link routines
  */
-
 static unsigned int align(unsigned int i)
 {
         return (i + 3) & ~3u;
@@ -143,7 +138,6 @@ static u32 link_last_sent(struct tipc_link *l_ptr)
 /*
  *  Simple non-static link routines (i.e. referenced outside this file)
  */
-
 int tipc_link_is_up(struct tipc_link *l_ptr)
 {
         if (!l_ptr)
@@ -164,7 +158,6 @@ int tipc_link_is_active(struct tipc_link *l_ptr)
  *
  * Returns 1 if link name is valid, otherwise 0.
  */
-
 static int link_name_validate(const char *name,
                                 struct tipc_link_name *name_parts)
 {
@@ -180,7 +173,6 @@ static int link_name_validate(const char *name,
         u32 if_peer_len;
 
         /* copy link name & ensure length is OK */
-
         name_copy[TIPC_MAX_LINK_NAME - 1] = 0;
         /* need above in case non-Posix strncpy() doesn't pad with nulls */
         strncpy(name_copy, name, TIPC_MAX_LINK_NAME);
@@ -188,7 +180,6 @@ static int link_name_validate(const char *name,
                 return 0;
 
         /* ensure all component parts of link name are present */
-
         addr_local = name_copy;
         if_local = strchr(addr_local, ':');
         if (if_local == NULL)
@@ -206,7 +197,6 @@ static int link_name_validate(const char *name,
         if_peer_len = strlen(if_peer) + 1;
 
         /* validate component parts of link name */
-
         if ((sscanf(addr_local, "%u.%u.%u%c",
                     &z_local, &c_local, &n_local, &dummy) != 3) ||
             (sscanf(addr_peer, "%u.%u.%u%c",
@@ -220,7 +210,6 @@ static int link_name_validate(const char *name,
                 return 0;
 
         /* return link name components, if necessary */
-
         if (name_parts) {
                 name_parts->addr_local = tipc_addr(z_local, c_local, n_local);
                 strcpy(name_parts->if_local, if_local);
@@ -239,13 +228,11 @@ static int link_name_validate(const char *name,
  * another thread because tipc_link_delete() always cancels the link timer before
  * tipc_node_delete() is called.)
  */
-
 static void link_timeout(struct tipc_link *l_ptr)
 {
         tipc_node_lock(l_ptr->owner);
 
         /* update counters used in statistical profiling of send traffic */
-
         l_ptr->stats.accu_queue_sz += l_ptr->out_queue_size;
         l_ptr->stats.queue_sz_counts++;
 
@@ -278,7 +265,6 @@ static void link_timeout(struct tipc_link *l_ptr)
         }
 
         /* do all other link processing performed on a periodic basis */
-
         link_check_defragm_bufs(l_ptr);
 
         link_state_event(l_ptr, TIMEOUT_EVT);
@@ -302,7 +288,6 @@ static void link_set_timer(struct tipc_link *l_ptr, u32 time)
  *
  * Returns pointer to link.
  */
-
 struct tipc_link *tipc_link_create(struct tipc_node *n_ptr,
                               struct tipc_bearer *b_ptr,
                               const struct tipc_media_addr *media_addr)
@@ -383,7 +368,6 @@ struct tipc_link *tipc_link_create(struct tipc_node *n_ptr,
  * This routine must not grab the node lock until after link timer cancellation
  * to avoid a potential deadlock situation.
  */
-
 void tipc_link_delete(struct tipc_link *l_ptr)
 {
         if (!l_ptr) {
@@ -419,7 +403,6 @@ static void link_start(struct tipc_link *l_ptr)
  * Schedules port for renewed sending of messages after link congestion
  * has abated.
  */
-
 static int link_schedule_port(struct tipc_link *l_ptr, u32 origport, u32 sz)
 {
         struct tipc_port *p_ptr;
@@ -476,7 +459,6 @@ exit:
  * link_release_outqueue - purge link's outbound message queue
  * @l_ptr: pointer to link
  */
-
 static void link_release_outqueue(struct tipc_link *l_ptr)
 {
         struct sk_buff *buf = l_ptr->first_out;
@@ -484,7 +466,7 @@ static void link_release_outqueue(struct tipc_link *l_ptr)
 
         while (buf) {
                 next = buf->next;
-                buf_discard(buf);
+                kfree_skb(buf);
                 buf = next;
         }
         l_ptr->first_out = NULL;
@@ -495,7 +477,6 @@ static void link_release_outqueue(struct tipc_link *l_ptr)
  * tipc_link_reset_fragments - purge link's inbound message fragments queue
  * @l_ptr: pointer to link
  */
-
 void tipc_link_reset_fragments(struct tipc_link *l_ptr)
 {
         struct sk_buff *buf = l_ptr->defragm_buf;
@@ -503,7 +484,7 @@ void tipc_link_reset_fragments(struct tipc_link *l_ptr)
 
         while (buf) {
                 next = buf->next;
-                buf_discard(buf);
+                kfree_skb(buf);
                 buf = next;
         }
         l_ptr->defragm_buf = NULL;
@@ -513,7 +494,6 @@ void tipc_link_reset_fragments(struct tipc_link *l_ptr)
  * tipc_link_stop - purge all inbound and outbound messages associated with link
  * @l_ptr: pointer to link
  */
-
 void tipc_link_stop(struct tipc_link *l_ptr)
 {
         struct sk_buff *buf;
@@ -522,20 +502,20 @@ void tipc_link_stop(struct tipc_link *l_ptr)
         buf = l_ptr->oldest_deferred_in;
         while (buf) {
                 next = buf->next;
-                buf_discard(buf);
+                kfree_skb(buf);
                 buf = next;
         }
 
         buf = l_ptr->first_out;
         while (buf) {
                 next = buf->next;
-                buf_discard(buf);
+                kfree_skb(buf);
                 buf = next;
         }
 
         tipc_link_reset_fragments(l_ptr);
 
-        buf_discard(l_ptr->proto_msg_queue);
+        kfree_skb(l_ptr->proto_msg_queue);
         l_ptr->proto_msg_queue = NULL;
 }
 
@@ -569,14 +549,13 @@ void tipc_link_reset(struct tipc_link *l_ptr)
         }
 
         /* Clean up all queues: */
-
         link_release_outqueue(l_ptr);
-        buf_discard(l_ptr->proto_msg_queue);
+        kfree_skb(l_ptr->proto_msg_queue);
         l_ptr->proto_msg_queue = NULL;
         buf = l_ptr->oldest_deferred_in;
         while (buf) {
                 struct sk_buff *next = buf->next;
-                buf_discard(buf);
+                kfree_skb(buf);
                 buf = next;
         }
         if (!list_empty(&l_ptr->waiting_ports))
@@ -611,8 +590,7 @@ static void link_activate(struct tipc_link *l_ptr)
  * @l_ptr: pointer to link
  * @event: state machine event to process
  */
-
-static void link_state_event(struct tipc_link *l_ptr, unsigned event)
+static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
 {
         struct tipc_link *other;
         u32 cont_intv = l_ptr->continuity_interval;
@@ -785,7 +763,6 @@ static void link_state_event(struct tipc_link *l_ptr, unsigned event)
  * link_bundle_buf(): Append contents of a buffer to
  * the tail of an existing one.
  */
-
 static int link_bundle_buf(struct tipc_link *l_ptr,
                            struct sk_buff *bundler,
                            struct sk_buff *buf)
@@ -810,7 +787,7 @@ static int link_bundle_buf(struct tipc_link *l_ptr,
         skb_copy_to_linear_data_offset(bundler, to_pos, buf->data, size);
         msg_set_size(bundler_msg, to_pos + size);
         msg_set_msgcnt(bundler_msg, msg_msgcnt(bundler_msg) + 1);
-        buf_discard(buf);
+        kfree_skb(buf);
         l_ptr->stats.sent_bundled++;
         return 1;
 }
@@ -860,7 +837,6 @@ static void link_add_chain_to_outqueue(struct tipc_link *l_ptr,
  * inside TIPC when the 'fast path' in tipc_send_buf
  * has failed, and from link_send()
  */
-
 int tipc_link_send_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
 {
         struct tipc_msg *msg = buf_msg(buf);
@@ -871,17 +847,14 @@ int tipc_link_send_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
         u32 queue_limit = l_ptr->queue_limit[imp];
         u32 max_packet = l_ptr->max_pkt;
 
-        msg_set_prevnode(msg, tipc_own_addr);   /* If routed message */
-
         /* Match msg importance against queue limits: */
-
         if (unlikely(queue_size >= queue_limit)) {
                 if (imp <= TIPC_CRITICAL_IMPORTANCE) {
                         link_schedule_port(l_ptr, msg_origport(msg), size);
-                        buf_discard(buf);
+                        kfree_skb(buf);
                         return -ELINKCONG;
                 }
-                buf_discard(buf);
+                kfree_skb(buf);
                 if (imp > CONN_MANAGER) {
                         warn("Resetting link <%s>, send queue full", l_ptr->name);
                         tipc_link_reset(l_ptr);
@@ -890,12 +863,10 @@ int tipc_link_send_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
         }
 
         /* Fragmentation needed ? */
-
         if (size > max_packet)
                 return link_send_long_buf(l_ptr, buf);
 
-        /* Packet can be queued or sent: */
-
+        /* Packet can be queued or sent. */
         if (likely(!tipc_bearer_congested(l_ptr->b_ptr, l_ptr) &&
                    !link_congested(l_ptr))) {
                 link_add_to_outqueue(l_ptr, buf, msg);
@@ -909,13 +880,11 @@ int tipc_link_send_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
                 }
                 return dsz;
         }
-        /* Congestion: can message be bundled ?: */
-
+        /* Congestion: can message be bundled ? */
         if ((msg_user(msg) != CHANGEOVER_PROTOCOL) &&
             (msg_user(msg) != MSG_FRAGMENTER)) {
 
                 /* Try adding message to an existing bundle */
-
                 if (l_ptr->next_out &&
                     link_bundle_buf(l_ptr, l_ptr->last_out, buf)) {
                         tipc_bearer_resolve_congestion(l_ptr->b_ptr, l_ptr);
@@ -923,7 +892,6 @@ int tipc_link_send_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
                 }
 
                 /* Try creating a new bundle */
-
                 if (size <= max_packet * 2 / 3) {
                         struct sk_buff *bundler = tipc_buf_acquire(max_packet);
                         struct tipc_msg bundler_hdr;
@@ -953,7 +921,6 @@ int tipc_link_send_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
  * not been selected yet, and the the owner node is not locked
  * Called by TIPC internal users, e.g. the name distributor
  */
-
 int tipc_link_send(struct sk_buff *buf, u32 dest, u32 selector)
 {
         struct tipc_link *l_ptr;
@@ -968,10 +935,10 @@ int tipc_link_send(struct sk_buff *buf, u32 dest, u32 selector)
                 if (l_ptr)
                         res = tipc_link_send_buf(l_ptr, buf);
                 else
-                        buf_discard(buf);
+                        kfree_skb(buf);
                 tipc_node_unlock(n_ptr);
         } else {
-                buf_discard(buf);
+                kfree_skb(buf);
         }
         read_unlock_bh(&tipc_net_lock);
         return res;
@@ -986,7 +953,6 @@ int tipc_link_send(struct sk_buff *buf, u32 dest, u32 selector)
  * small enough not to require fragmentation.
  * Called without any locks held.
  */
-
 void tipc_link_send_names(struct list_head *message_list, u32 dest)
 {
         struct tipc_node *n_ptr;
@@ -1015,10 +981,9 @@ void tipc_link_send_names(struct list_head *message_list, u32 dest)
         read_unlock_bh(&tipc_net_lock);
 
         /* discard the messages if they couldn't be sent */
-
         list_for_each_safe(buf, temp_buf, ((struct sk_buff *)message_list)) {
                 list_del((struct list_head *)buf);
-                buf_discard(buf);
+                kfree_skb(buf);
         }
 }
 
@@ -1028,7 +993,6 @@ void tipc_link_send_names(struct list_head *message_list, u32 dest)
  * inclusive total message length. Very time critical.
  * Link is locked. Returns user data length.
  */
-
 static int link_send_buf_fast(struct tipc_link *l_ptr, struct sk_buff *buf,
                               u32 *used_max_pkt)
 {
@@ -1113,7 +1077,6 @@ again:
          * Try building message using port's max_pkt hint.
          * (Must not hold any locks while building message.)
          */
-
         res = tipc_msg_build(hdr, msg_sect, num_sect, total_len,
                              sender->max_pkt, !sender->user_port, &buf);
 
@@ -1133,12 +1096,10 @@ exit:
                         }
 
                         /* Exit if build request was invalid */
-
                         if (unlikely(res < 0))
                                 goto exit;
 
                         /* Exit if link (or bearer) is congested */
-
                         if (link_congested(l_ptr) ||
                             !list_empty(&l_ptr->b_ptr->cong_links)) {
                                 res = link_schedule_port(l_ptr,
@@ -1150,7 +1111,6 @@ exit:
                          * Message size exceeds max_pkt hint; update hint,
                          * then re-try fast path or fragment the message
                          */
-
                         sender->max_pkt = l_ptr->max_pkt;
                         tipc_node_unlock(node);
                         read_unlock_bh(&tipc_net_lock);
@@ -1168,7 +1128,6 @@ exit:
         read_unlock_bh(&tipc_net_lock);
 
         /* Couldn't find a link to the destination node */
-
         if (buf)
                 return tipc_reject_msg(buf, TIPC_ERR_NO_NODE);
         if (res >= 0)
@@ -1222,15 +1181,13 @@ again:
         sect_crs = NULL;
         curr_sect = -1;
 
-        /* Prepare reusable fragment header: */
-
+        /* Prepare reusable fragment header */
         tipc_msg_init(&fragm_hdr, MSG_FRAGMENTER, FIRST_FRAGMENT,
                  INT_H_SIZE, msg_destnode(hdr));
         msg_set_size(&fragm_hdr, max_pkt);
         msg_set_fragm_no(&fragm_hdr, 1);
 
-        /* Prepare header of first fragment: */
-
+        /* Prepare header of first fragment */
         buf_chain = buf = tipc_buf_acquire(max_pkt);
         if (!buf)
                 return -ENOMEM;
@@ -1239,8 +1196,7 @@ again:
         hsz = msg_hdr_sz(hdr);
         skb_copy_to_linear_data_offset(buf, INT_H_SIZE, hdr, hsz);
 
-        /* Chop up message: */
-
+        /* Chop up message */
         fragm_crs = INT_H_SIZE + hsz;
         fragm_rest = fragm_sz - hsz;
 
@@ -1262,7 +1218,7 @@ again:
 error:
                                 for (; buf_chain; buf_chain = buf) {
                                         buf = buf_chain->next;
-                                        buf_discard(buf_chain);
+                                        kfree_skb(buf_chain);
                                 }
                                 return -EFAULT;
                         }
@@ -1316,7 +1272,7 @@ error:
                         tipc_node_unlock(node);
                         for (; buf_chain; buf_chain = buf) {
                                 buf = buf_chain->next;
-                                buf_discard(buf_chain);
+                                kfree_skb(buf_chain);
                         }
                         goto again;
                 }
@@ -1324,14 +1280,13 @@ error:
 reject:
                 for (; buf_chain; buf_chain = buf) {
                         buf = buf_chain->next;
-                        buf_discard(buf_chain);
+                        kfree_skb(buf_chain);
                 }
                 return tipc_port_reject_sections(sender, hdr, msg_sect, num_sect,
                                                  total_len, TIPC_ERR_NO_NODE);
         }
 
         /* Append chain of fragments to send queue & send them */
-
         l_ptr->long_msg_seq_no++;
         link_add_chain_to_outqueue(l_ptr, buf_chain, l_ptr->long_msg_seq_no);
         l_ptr->stats.sent_fragments += fragm_no;
@@ -1352,7 +1307,6 @@ u32 tipc_link_push_packet(struct tipc_link *l_ptr)
 
         /* Step to position where retransmission failed, if any,    */
         /* consider that buffers may have been released in meantime */
-
         if (r_q_size && buf) {
                 u32 last = lesser(mod(r_q_head + r_q_size),
                                   link_last_sent(l_ptr));
@@ -1367,7 +1321,6 @@ u32 tipc_link_push_packet(struct tipc_link *l_ptr)
         }
 
         /* Continue retransmission now, if there is anything: */
-
         if (r_q_size && buf) {
                 msg_set_ack(buf_msg(buf), mod(l_ptr->next_in_no - 1));
                 msg_set_bcast_ack(buf_msg(buf), l_ptr->owner->bclink.last_in);
@@ -1383,14 +1336,13 @@ u32 tipc_link_push_packet(struct tipc_link *l_ptr)
         }
 
         /* Send deferred protocol message, if any: */
-
         buf = l_ptr->proto_msg_queue;
         if (buf) {
                 msg_set_ack(buf_msg(buf), mod(l_ptr->next_in_no - 1));
                 msg_set_bcast_ack(buf_msg(buf), l_ptr->owner->bclink.last_in);
                 if (tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr)) {
                         l_ptr->unacked_window = 0;
-                        buf_discard(buf);
+                        kfree_skb(buf);
                         l_ptr->proto_msg_queue = NULL;
                         return 0;
                 } else {
@@ -1400,7 +1352,6 @@ u32 tipc_link_push_packet(struct tipc_link *l_ptr)
         }
 
         /* Send one deferred data message, if send window not full: */
-
         buf = l_ptr->next_out;
         if (buf) {
                 struct tipc_msg *msg = buf_msg(buf);
@@ -1480,16 +1431,12 @@ static void link_retransmit_failure(struct tipc_link *l_ptr,
         warn("Retransmission failure on link <%s>\n", l_ptr->name);
 
         if (l_ptr->addr) {
-
                 /* Handle failure on standard link */
-
                 link_print(l_ptr, "Resetting link\n");
                 tipc_link_reset(l_ptr);
 
         } else {
-
                 /* Handle failure on broadcast link */
-
                 struct tipc_node *n_ptr;
                 char addr_string[16];
 
@@ -1501,13 +1448,13 @@ static void link_retransmit_failure(struct tipc_link *l_ptr,
                 tipc_node_lock(n_ptr);
 
                 tipc_addr_string_fill(addr_string, n_ptr->addr);
-                info("Multicast link info for %s\n", addr_string);
+                info("Broadcast link info for %s\n", addr_string);
+                info("Supportable: %d,  ", n_ptr->bclink.supportable);
                 info("Supported: %d,  ", n_ptr->bclink.supported);
                 info("Acked: %u\n", n_ptr->bclink.acked);
                 info("Last in: %u,  ", n_ptr->bclink.last_in);
-                info("Gap after: %u,  ", n_ptr->bclink.gap_after);
-                info("Gap to: %u\n", n_ptr->bclink.gap_to);
-                info("Nack sync: %u\n\n", n_ptr->bclink.nack_sync);
+                info("Oos state: %u,  ", n_ptr->bclink.oos_state);
+                info("Last sent: %u\n", n_ptr->bclink.last_sent);
 
                 tipc_k_signal((Handler)link_reset_all, (unsigned long)n_ptr->addr);
 
@@ -1538,7 +1485,6 @@ void tipc_link_retransmit(struct tipc_link *l_ptr, struct sk_buff *buf,
                 return;
         } else {
                 /* Detect repeated retransmit failures on uncongested bearer */
-
                 if (l_ptr->last_retransmitted == msg_seqno(msg)) {
                         if (++l_ptr->stale_count > 100) {
                                 link_retransmit_failure(l_ptr, buf);
@@ -1573,7 +1519,6 @@ void tipc_link_retransmit(struct tipc_link *l_ptr, struct sk_buff *buf,
 /**
  * link_insert_deferred_queue - insert deferred messages back into receive chain
  */
-
 static struct sk_buff *link_insert_deferred_queue(struct tipc_link *l_ptr,
                                                   struct sk_buff *buf)
 {
@@ -1604,7 +1549,6 @@ static struct sk_buff *link_insert_deferred_queue(struct tipc_link *l_ptr,
  * TIPC will ignore the excess, under the assumption that it is optional info
  * introduced by a later release of the protocol.
  */
-
 static int link_recv_buf_validate(struct sk_buff *buf)
 {
         static u32 min_data_hdr_size[8] = {
@@ -1650,7 +1594,6 @@ static int link_recv_buf_validate(struct sk_buff *buf)
  * Invoked with no locks held.  Bearer pointer must point to a valid bearer
  * structure (i.e. cannot be NULL), but bearer can be inactive.
  */
-
 void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *b_ptr)
 {
         read_lock_bh(&tipc_net_lock);
@@ -1668,22 +1611,18 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *b_ptr)
                 head = head->next;
 
                 /* Ensure bearer is still enabled */
-
                 if (unlikely(!b_ptr->active))
                         goto cont;
 
                 /* Ensure message is well-formed */
-
                 if (unlikely(!link_recv_buf_validate(buf)))
                         goto cont;
 
                 /* Ensure message data is a single contiguous unit */
-
-                if (unlikely(buf_linearize(buf)))
+                if (unlikely(skb_linearize(buf)))
                         goto cont;
 
                 /* Handle arrival of a non-unicast link message */
-
                 msg = buf_msg(buf);
 
                 if (unlikely(msg_non_seq(msg))) {
@@ -1695,20 +1634,17 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *b_ptr)
                 }
 
                 /* Discard unicast link messages destined for another node */
-
                 if (unlikely(!msg_short(msg) &&
                              (msg_destnode(msg) != tipc_own_addr)))
                         goto cont;
 
                 /* Locate neighboring node that sent message */
-
                 n_ptr = tipc_node_find(msg_prevnode(msg));
                 if (unlikely(!n_ptr))
                         goto cont;
                 tipc_node_lock(n_ptr);
 
                 /* Locate unicast link endpoint that should handle message */
-
                 l_ptr = n_ptr->links[b_ptr->identity];
                 if (unlikely(!l_ptr)) {
                         tipc_node_unlock(n_ptr);
@@ -1716,7 +1652,6 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *b_ptr)
                 }
 
                 /* Verify that communication with node is currently allowed */
-
                 if ((n_ptr->block_setup & WAIT_PEER_DOWN) &&
                         msg_user(msg) == LINK_PROTOCOL &&
                         (msg_type(msg) == RESET_MSG ||
@@ -1730,13 +1665,11 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *b_ptr)
                 }
 
                 /* Validate message sequence number info */
-
                 seq_no = msg_seqno(msg);
                 ackd = msg_ack(msg);
 
                 /* Release acked messages */
-
-                if (tipc_node_is_up(n_ptr) && n_ptr->bclink.supported)
+                if (n_ptr->bclink.supported)
                         tipc_bclink_acknowledge(n_ptr, msg_bcast_ack(msg));
 
                 crs = l_ptr->first_out;
@@ -1744,7 +1677,7 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *b_ptr)
                        less_eq(buf_seqno(crs), ackd)) {
                         struct sk_buff *next = crs->next;
 
-                        buf_discard(crs);
+                        kfree_skb(crs);
                         crs = next;
                         released++;
                 }
@@ -1754,7 +1687,6 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *b_ptr)
                 }
 
                 /* Try sending any messages link endpoint has pending */
-
                 if (unlikely(l_ptr->next_out))
                         tipc_link_push_queue(l_ptr);
                 if (unlikely(!list_empty(&l_ptr->waiting_ports)))
@@ -1765,7 +1697,6 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *b_ptr)
                 }
 
                 /* Now (finally!) process the incoming message */
-
 protocol_check:
                 if (likely(link_working_working(l_ptr))) {
                         if (likely(seq_no == mod(l_ptr->next_in_no))) {
@@ -1773,52 +1704,56 @@ protocol_check:
                                 if (unlikely(l_ptr->oldest_deferred_in))
                                         head = link_insert_deferred_queue(l_ptr,
                                                                           head);
-                                if (likely(msg_is_dest(msg, tipc_own_addr))) {
 deliver:
-                                        if (likely(msg_isdata(msg))) {
-                                                tipc_node_unlock(n_ptr);
-                                                tipc_port_recv_msg(buf);
-                                                continue;
+                                if (likely(msg_isdata(msg))) {
+                                        tipc_node_unlock(n_ptr);
+                                        tipc_port_recv_msg(buf);
+                                        continue;
+                                }
+                                switch (msg_user(msg)) {
+                                        int ret;
+                                case MSG_BUNDLER:
+                                        l_ptr->stats.recv_bundles++;
+                                        l_ptr->stats.recv_bundled +=
+                                                msg_msgcnt(msg);
+                                        tipc_node_unlock(n_ptr);
+                                        tipc_link_recv_bundle(buf);
+                                        continue;
+                                case NAME_DISTRIBUTOR:
+                                        tipc_node_unlock(n_ptr);
+                                        tipc_named_recv(buf);
+                                        continue;
+                                case CONN_MANAGER:
+                                        tipc_node_unlock(n_ptr);
+                                        tipc_port_recv_proto_msg(buf);
+                                        continue;
+                                case MSG_FRAGMENTER:
+                                        l_ptr->stats.recv_fragments++;
+                                        ret = tipc_link_recv_fragment(
+                                                &l_ptr->defragm_buf,
+                                                &buf, &msg);
+                                        if (ret == 1) {
+                                                l_ptr->stats.recv_fragmented++;
+                                                goto deliver;
                                         }
-                                        switch (msg_user(msg)) {
-                                        case MSG_BUNDLER:
-                                                l_ptr->stats.recv_bundles++;
-                                                l_ptr->stats.recv_bundled +=
-                                                        msg_msgcnt(msg);
-                                                tipc_node_unlock(n_ptr);
-                                                tipc_link_recv_bundle(buf);
-                                                continue;
-                                        case NAME_DISTRIBUTOR:
-                                                tipc_node_unlock(n_ptr);
-                                                tipc_named_recv(buf);
-                                                continue;
-                                        case CONN_MANAGER:
-                                                tipc_node_unlock(n_ptr);
-                                                tipc_port_recv_proto_msg(buf);
-                                                continue;
-                                        case MSG_FRAGMENTER:
-                                                l_ptr->stats.recv_fragments++;
-                                                if (tipc_link_recv_fragment(&l_ptr->defragm_buf,
-                                                                            &buf, &msg)) {
-                                                        l_ptr->stats.recv_fragmented++;
+                                        if (ret == -1)
+                                                l_ptr->next_in_no--;
+                                        break;
+                                case CHANGEOVER_PROTOCOL:
+                                        type = msg_type(msg);
+                                        if (link_recv_changeover_msg(&l_ptr,
+                                                                     &buf)) {
+                                                msg = buf_msg(buf);
+                                                seq_no = msg_seqno(msg);
+                                                if (type == ORIGINAL_MSG)
                                                         goto deliver;
-                                                }
-                                                break;
-                                        case CHANGEOVER_PROTOCOL:
-                                                type = msg_type(msg);
-                                                if (link_recv_changeover_msg(&l_ptr, &buf)) {
-                                                        msg = buf_msg(buf);
-                                                        seq_no = msg_seqno(msg);
-                                                        if (type == ORIGINAL_MSG)
-                                                                goto deliver;
-                                                        goto protocol_check;
-                                                }
-                                                break;
-                                        default:
-                                                buf_discard(buf);
-                                                buf = NULL;
-                                                break;
+                                                goto protocol_check;
                                         }
+                                        break;
+                                default:
+                                        kfree_skb(buf);
+                                        buf = NULL;
+                                        break;
                                 }
                                 tipc_node_unlock(n_ptr);
                                 tipc_net_route_msg(buf);
@@ -1847,23 +1782,21 @@ deliver:
                 }
                 tipc_node_unlock(n_ptr);
 cont:
-                buf_discard(buf);
+                kfree_skb(buf);
         }
         read_unlock_bh(&tipc_net_lock);
 }
 
 /*
- * link_defer_buf(): Sort a received out-of-sequence packet
- *                   into the deferred reception queue.
- * Returns the increase of the queue length,i.e. 0 or 1
+ * tipc_link_defer_pkt - Add out-of-sequence message to deferred reception queue
+ *
+ * Returns increase in queue length (i.e. 0 or 1)
  */
-
-u32 tipc_link_defer_pkt(struct sk_buff **head,
-                        struct sk_buff **tail,
+u32 tipc_link_defer_pkt(struct sk_buff **head, struct sk_buff **tail,
                         struct sk_buff *buf)
 {
-        struct sk_buff *prev = NULL;
-        struct sk_buff *crs = *head;
+        struct sk_buff *queue_buf;
+        struct sk_buff **prev;
         u32 seq_no = buf_seqno(buf);
 
         buf->next = NULL;
@@ -1881,34 +1814,32 @@ u32 tipc_link_defer_pkt(struct sk_buff **head,
                 return 1;
         }
 
-        /* Scan through queue and sort it in */
-        do {
-                struct tipc_msg *msg = buf_msg(crs);
+        /* Locate insertion point in queue, then insert; discard if duplicate */
+        prev = head;
+        queue_buf = *head;
+        for (;;) {
+                u32 curr_seqno = buf_seqno(queue_buf);
 
-                if (less(seq_no, msg_seqno(msg))) {
-                        buf->next = crs;
-                        if (prev)
-                                prev->next = buf;
-                        else
-                                *head = buf;
-                        return 1;
+                if (seq_no == curr_seqno) {
+                        kfree_skb(buf);
+                        return 0;
                 }
-                if (seq_no == msg_seqno(msg))
+
+                if (less(seq_no, curr_seqno))
                         break;
-                prev = crs;
-                crs = crs->next;
-        } while (crs);
 
-        /* Message is a duplicate of an existing message */
+                prev = &queue_buf->next;
+                queue_buf = queue_buf->next;
+        }
 
-        buf_discard(buf);
-        return 0;
+        buf->next = queue_buf;
+        *prev = buf;
+        return 1;
 }
 
-/**
+/*
  * link_handle_out_of_seq_msg - handle arrival of out-of-sequence packet
  */
-
 static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
                                        struct sk_buff *buf)
 {
@@ -1920,17 +1851,15 @@ static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
         }
 
         /* Record OOS packet arrival (force mismatch on next timeout) */
-
         l_ptr->checkpoint--;
 
         /*
          * Discard packet if a duplicate; otherwise add it to deferred queue
          * and notify peer of gap as per protocol specification
          */
-
         if (less(seq_no, mod(l_ptr->next_in_no))) {
                 l_ptr->stats.duplicates++;
-                buf_discard(buf);
+                kfree_skb(buf);
                 return;
         }
 
@@ -1956,17 +1885,23 @@ void tipc_link_send_proto_msg(struct tipc_link *l_ptr, u32 msg_typ,
         u32 msg_size = sizeof(l_ptr->proto_msg);
         int r_flag;
 
+        /* Discard any previous message that was deferred due to congestion */
+        if (l_ptr->proto_msg_queue) {
+                kfree_skb(l_ptr->proto_msg_queue);
+                l_ptr->proto_msg_queue = NULL;
+        }
+
         if (link_blocked(l_ptr))
                 return;
 
         /* Abort non-RESET send if communication with node is prohibited */
-
         if ((l_ptr->owner->block_setup) && (msg_typ != RESET_MSG))
                 return;
 
+        /* Create protocol message with "out-of-sequence" sequence number */
         msg_set_type(msg, msg_typ);
         msg_set_net_plane(msg, l_ptr->b_ptr->net_plane);
-        msg_set_bcast_ack(msg, mod(l_ptr->owner->bclink.last_in));
+        msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
         msg_set_last_bcast(msg, tipc_bclink_get_last_sent());
 
         if (msg_typ == STATE_MSG) {
@@ -2020,44 +1955,33 @@ void tipc_link_send_proto_msg(struct tipc_link *l_ptr, u32 msg_typ,
         r_flag = (l_ptr->owner->working_links > tipc_link_is_up(l_ptr));
         msg_set_redundant_link(msg, r_flag);
         msg_set_linkprio(msg, l_ptr->priority);
-
-        /* Ensure sequence number will not fit : */
+        msg_set_size(msg, msg_size);
 
         msg_set_seqno(msg, mod(l_ptr->next_out_no + (0xffff/2)));
 
-        /* Congestion? */
-
-        if (tipc_bearer_congested(l_ptr->b_ptr, l_ptr)) {
-                if (!l_ptr->proto_msg_queue) {
-                        l_ptr->proto_msg_queue =
-                                tipc_buf_acquire(sizeof(l_ptr->proto_msg));
-                }
-                buf = l_ptr->proto_msg_queue;
-                if (!buf)
-                        return;
-                skb_copy_to_linear_data(buf, msg, sizeof(l_ptr->proto_msg));
-                return;
-        }
-
-        /* Message can be sent */
-
         buf = tipc_buf_acquire(msg_size);
         if (!buf)
                 return;
 
         skb_copy_to_linear_data(buf, msg, sizeof(l_ptr->proto_msg));
-        msg_set_size(buf_msg(buf), msg_size);
 
-        if (tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr)) {
-                l_ptr->unacked_window = 0;
-                buf_discard(buf);
+        /* Defer message if bearer is already congested */
+        if (tipc_bearer_congested(l_ptr->b_ptr, l_ptr)) {
+                l_ptr->proto_msg_queue = buf;
+                return;
+        }
+
+        /* Defer message if attempting to send results in bearer congestion */
+        if (!tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr)) {
+                tipc_bearer_schedule(l_ptr->b_ptr, l_ptr);
+                l_ptr->proto_msg_queue = buf;
+                l_ptr->stats.bearer_congs++;
                 return;
         }
 
-        /* New congestion */
-        tipc_bearer_schedule(l_ptr->b_ptr, l_ptr);
-        l_ptr->proto_msg_queue = buf;
-        l_ptr->stats.bearer_congs++;
+        /* Discard message if it was sent successfully */
+        l_ptr->unacked_window = 0;
+        kfree_skb(buf);
 }
 
 /*
@@ -2065,7 +1989,6 @@ void tipc_link_send_proto_msg(struct tipc_link *l_ptr, u32 msg_typ,
  * Note that network plane id propagates through the network, and may
  * change at any time. The node with lowest address rules
  */
-
 static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf)
 {
         u32 rec_gap = 0;
@@ -2078,7 +2001,6 @@ static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf)
                 goto exit;
 
         /* record unnumbered packet arrival (force mismatch on next timeout) */
-
         l_ptr->checkpoint--;
 
         if (l_ptr->b_ptr->net_plane != msg_net_plane(msg))
@@ -2105,10 +2027,11 @@ static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf)
                         l_ptr->owner->block_setup = WAIT_NODE_DOWN;
                 }
 
+                link_state_event(l_ptr, RESET_MSG);
+
                 /* fall thru' */
         case ACTIVATE_MSG:
                 /* Update link settings according other endpoint's values */
-
                 strcpy((strrchr(l_ptr->name, ':') + 1), (char *)msg_data(msg));
 
                 msg_tol = msg_link_tolerance(msg);
@@ -2127,16 +2050,21 @@ static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf)
                 } else {
                         l_ptr->max_pkt = l_ptr->max_pkt_target;
                 }
-                l_ptr->owner->bclink.supported = (max_pkt_info != 0);
+                l_ptr->owner->bclink.supportable = (max_pkt_info != 0);
 
-                link_state_event(l_ptr, msg_type(msg));
+                /* Synchronize broadcast link info, if not done previously */
+                if (!tipc_node_is_up(l_ptr->owner)) {
+                        l_ptr->owner->bclink.last_sent =
+                                l_ptr->owner->bclink.last_in =
+                                msg_last_bcast(msg);
+                        l_ptr->owner->bclink.oos_state = 0;
+                }
 
                 l_ptr->peer_session = msg_session(msg);
                 l_ptr->peer_bearer_id = msg_bearer_id(msg);
 
-                /* Synchronize broadcast sequence numbers */
-                if (!tipc_node_redundant_links(l_ptr->owner))
-                        l_ptr->owner->bclink.last_in = mod(msg_last_bcast(msg));
+                if (msg_type(msg) == ACTIVATE_MSG)
+                        link_state_event(l_ptr, ACTIVATE_MSG);
                 break;
         case STATE_MSG:
 
@@ -2176,8 +2104,9 @@ static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf)
                 }
 
                 /* Protocol message before retransmits, reduce loss risk */
-
-                tipc_bclink_check_gap(l_ptr->owner, msg_last_bcast(msg));
+                if (l_ptr->owner->bclink.supported)
+                        tipc_bclink_update_link_state(l_ptr->owner,
+                                                      msg_last_bcast(msg));
 
                 if (rec_gap || (msg_probe(msg))) {
                         tipc_link_send_proto_msg(l_ptr, STATE_MSG,
@@ -2191,7 +2120,7 @@ static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf)
                 break;
         }
 exit:
-        buf_discard(buf);
+        kfree_skb(buf);
 }
 
 
@@ -2232,7 +2161,6 @@ static void tipc_link_tunnel(struct tipc_link *l_ptr,
  * changeover(): Send whole message queue via the remaining link
  *               Owner node is locked.
  */
-
 void tipc_link_changeover(struct tipc_link *l_ptr)
 {
         u32 msgcount = l_ptr->out_queue_size;
@@ -2332,8 +2260,6 @@ void tipc_link_send_duplicate(struct tipc_link *l_ptr, struct tipc_link *tunnel)
         }
 }
 
-
-
 /**
  * buf_extract - extracts embedded TIPC message from another message
  * @skb: encapsulating message buffer
@@ -2342,7 +2268,6 @@ void tipc_link_send_duplicate(struct tipc_link *l_ptr, struct tipc_link *tunnel)
  * Returns a new message buffer containing an embedded message.  The
  * encapsulating message itself is left unchanged.
  */
-
 static struct sk_buff *buf_extract(struct sk_buff *skb, u32 from_pos)
 {
         struct tipc_msg *msg = (struct tipc_msg *)(skb->data + from_pos);
@@ -2359,7 +2284,6 @@ static struct sk_buff *buf_extract(struct sk_buff *skb, u32 from_pos)
  *  link_recv_changeover_msg(): Receive tunneled packet sent
  *  via other link. Node is locked. Return extracted buffer.
  */
-
 static int link_recv_changeover_msg(struct tipc_link **l_ptr,
                                     struct sk_buff **buf)
 {
@@ -2389,12 +2313,11 @@ static int link_recv_changeover_msg(struct tipc_link **l_ptr,
                         warn("Link changeover error, duplicate msg dropped\n");
                         goto exit;
                 }
-                buf_discard(tunnel_buf);
+                kfree_skb(tunnel_buf);
                 return 1;
         }
 
         /* First original message ?: */
-
         if (tipc_link_is_up(dest_link)) {
                 info("Resetting link <%s>, changeover initiated by peer\n",
                      dest_link->name);
@@ -2409,7 +2332,6 @@ static int link_recv_changeover_msg(struct tipc_link **l_ptr,
         }
 
         /* Receive original message */
-
         if (dest_link->exp_msg_count == 0) {
                 warn("Link switchover error, "
                      "got too many tunnelled messages\n");
@@ -2421,7 +2343,7 @@ static int link_recv_changeover_msg(struct tipc_link **l_ptr,
         } else {
                 *buf = buf_extract(tunnel_buf, INT_H_SIZE);
                 if (*buf != NULL) {
-                        buf_discard(tunnel_buf);
+                        kfree_skb(tunnel_buf);
                         return 1;
                 } else {
                         warn("Link changeover error, original msg dropped\n");
@@ -2429,7 +2351,7 @@ static int link_recv_changeover_msg(struct tipc_link **l_ptr,
         }
 exit:
         *buf = NULL;
-        buf_discard(tunnel_buf);
+        kfree_skb(tunnel_buf);
         return 0;
 }
 
@@ -2451,14 +2373,13 @@ void tipc_link_recv_bundle(struct sk_buff *buf)
                 pos += align(msg_size(buf_msg(obuf)));
                 tipc_net_route_msg(obuf);
         }
-        buf_discard(buf);
+        kfree_skb(buf);
 }
 
 /*
  *  Fragmentation/defragmentation:
  */
 
-
 /*
  * link_send_long_buf: Entry for buffers needing fragmentation.
  * The buffer is complete, inclusive total message length.
@@ -2485,12 +2406,10 @@ static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
                 destaddr = msg_destnode(inmsg);
 
         /* Prepare reusable fragment header: */
-
         tipc_msg_init(&fragm_hdr, MSG_FRAGMENTER, FIRST_FRAGMENT,
                  INT_H_SIZE, destaddr);
 
         /* Chop up message: */
-
         while (rest > 0) {
                 struct sk_buff *fragm;
 
@@ -2500,11 +2419,11 @@ static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
                 }
                 fragm = tipc_buf_acquire(fragm_sz + INT_H_SIZE);
                 if (fragm == NULL) {
-                        buf_discard(buf);
+                        kfree_skb(buf);
                         while (buf_chain) {
                                 buf = buf_chain;
                                 buf_chain = buf_chain->next;
-                                buf_discard(buf);
+                                kfree_skb(buf);
                         }
                         return -ENOMEM;
                 }
@@ -2521,10 +2440,9 @@ static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
                 crs += fragm_sz;
                 msg_set_type(&fragm_hdr, FRAGMENT);
         }
-        buf_discard(buf);
+        kfree_skb(buf);
 
         /* Append chain of fragments to send queue & send them */
-
         l_ptr->long_msg_seq_no++;
         link_add_chain_to_outqueue(l_ptr, buf_chain, l_ptr->long_msg_seq_no);
         l_ptr->stats.sent_fragments += fragm_no;
@@ -2540,7 +2458,6 @@ static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
  * help storing these values in unused, available fields in the
  * pending message. This makes dynamic memory allocation unnecessary.
  */
-
 static void set_long_msg_seqno(struct sk_buff *buf, u32 seqno)
 {
         msg_set_seqno(buf_msg(buf), seqno);
@@ -2592,7 +2509,6 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
         *fb = NULL;
 
         /* Is there an incomplete message waiting for this fragment? */
-
         while (pbuf && ((buf_seqno(pbuf) != long_msg_seq_no) ||
                         (msg_orignode(fragm) != msg_orignode(buf_msg(pbuf))))) {
                 prev = pbuf;
@@ -2608,7 +2524,7 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
                 if (msg_type(imsg) == TIPC_MCAST_MSG)
                         max = TIPC_MAX_USER_MSG_SIZE + MCAST_H_SIZE;
                 if (msg_size(imsg) > max) {
-                        buf_discard(fbuf);
+                        kfree_skb(fbuf);
                         return 0;
                 }
                 pbuf = tipc_buf_acquire(msg_size(imsg));
@@ -2618,14 +2534,15 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
                         skb_copy_to_linear_data(pbuf, imsg,
                                                 msg_data_sz(fragm));
                         /*  Prepare buffer for subsequent fragments. */
-
                         set_long_msg_seqno(pbuf, long_msg_seq_no);
                         set_fragm_size(pbuf, fragm_sz);
                         set_expected_frags(pbuf, exp_fragm_cnt - 1);
                 } else {
-                        warn("Link unable to reassemble fragmented message\n");
+                        dbg("Link unable to reassemble fragmented message\n");
+                        kfree_skb(fbuf);
+                        return -1;
                 }
-                buf_discard(fbuf);
+                kfree_skb(fbuf);
                 return 0;
         } else if (pbuf && (msg_type(fragm) != FIRST_FRAGMENT)) {
                 u32 dsz = msg_data_sz(fragm);
@@ -2634,10 +2551,9 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
                 u32 exp_frags = get_expected_frags(pbuf) - 1;
                 skb_copy_to_linear_data_offset(pbuf, crs,
                                                msg_data(fragm), dsz);
-                buf_discard(fbuf);
+                kfree_skb(fbuf);
 
                 /* Is message complete? */
-
                 if (exp_frags == 0) {
                         if (prev)
                                 prev->next = pbuf->next;
@@ -2651,7 +2567,7 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
                 set_expected_frags(pbuf, exp_frags);
                 return 0;
         }
-        buf_discard(fbuf);
+        kfree_skb(fbuf);
         return 0;
 }
 
@@ -2659,7 +2575,6 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
  * link_check_defragm_bufs - flush stale incoming message fragments
  * @l_ptr: pointer to link
  */
-
 static void link_check_defragm_bufs(struct tipc_link *l_ptr)
 {
         struct sk_buff *prev = NULL;
@@ -2682,14 +2597,12 @@ static void link_check_defragm_bufs(struct tipc_link *l_ptr)
                                 prev->next = buf->next;
                         else
                                 l_ptr->defragm_buf = buf->next;
-                        buf_discard(buf);
+                        kfree_skb(buf);
                 }
                 buf = next;
         }
 }
 
-
-
 static void link_set_supervision_props(struct tipc_link *l_ptr, u32 tolerance)
 {
         if ((tolerance < TIPC_MIN_LINK_TOL) || (tolerance > TIPC_MAX_LINK_TOL))
@@ -2701,7 +2614,6 @@ static void link_set_supervision_props(struct tipc_link *l_ptr, u32 tolerance)
         l_ptr->abort_limit = tolerance / (l_ptr->continuity_interval / 4);
 }
 
-
 void tipc_link_set_queue_limits(struct tipc_link *l_ptr, u32 window)
 {
         /* Data messages from this node, inclusive FIRST_FRAGM */
@@ -2731,7 +2643,6 @@ void tipc_link_set_queue_limits(struct tipc_link *l_ptr, u32 window)
  *
  * Returns pointer to link (or 0 if invalid link name).
  */
-
 static struct tipc_link *link_find_link(const char *name,
                                         struct tipc_node **node)
 {
@@ -2765,7 +2676,6 @@ static struct tipc_link *link_find_link(const char *name,
  *
  * Returns 1 if value is within range, 0 if not.
  */
-
 static int link_value_is_valid(u16 cmd, u32 new_value)
 {
         switch (cmd) {
@@ -2781,7 +2691,6 @@ static int link_value_is_valid(u16 cmd, u32 new_value)
         return 0;
 }
 
-
 /**
  * link_cmd_set_value - change priority/tolerance/window for link/bearer/media
  * @name - ptr to link, bearer, or media name
@@ -2792,7 +2701,6 @@ static int link_value_is_valid(u16 cmd, u32 new_value)
  *
  * Returns 0 if value updated and negative value on error.
  */
-
 static int link_cmd_set_value(const char *name, u32 new_value, u16 cmd)
 {
         struct tipc_node *node;
@@ -2897,7 +2805,6 @@ struct sk_buff *tipc_link_cmd_config(const void *req_tlv_area, int req_tlv_space
  * link_reset_statistics - reset link statistics
  * @l_ptr: pointer to link
  */
-
 static void link_reset_statistics(struct tipc_link *l_ptr)
 {
         memset(&l_ptr->stats, 0, sizeof(l_ptr->stats));
@@ -2938,7 +2845,6 @@ struct sk_buff *tipc_link_cmd_reset_stats(const void *req_tlv_area, int req_tlv_
 /**
  * percent - convert count to a percentage of total (rounding up or down)
  */
-
 static u32 percent(u32 count, u32 total)
 {
         return (count * 100 + (total / 2)) / total;
@@ -2952,7 +2858,6 @@ static u32 percent(u32 count, u32 total)
  *
  * Returns length of print buffer data string (or 0 if error)
  */
-
 static int tipc_link_stats(const char *name, char *buf, const u32 buf_size)
 {
         struct print_buf pb;
@@ -3057,7 +2962,7 @@ struct sk_buff *tipc_link_cmd_show_stats(const void *req_tlv_area, int req_tlv_s
         str_len = tipc_link_stats((char *)TLV_DATA(req_tlv_area),
                                   (char *)TLV_DATA(rep_tlv), MAX_LINK_STATS_INFO);
         if (!str_len) {
-                buf_discard(buf);
+                kfree_skb(buf);
                 return tipc_cfg_reply_error_string("link not found");
         }
 
@@ -3074,7 +2979,6 @@ struct sk_buff *tipc_link_cmd_show_stats(const void *req_tlv_area, int req_tlv_s
  *
  * If no active link can be found, uses default maximum packet size.
  */
-
 u32 tipc_link_get_max_pkt(u32 dest, u32 selector)
 {
         struct tipc_node *n_ptr;
@@ -3158,4 +3062,3 @@ print_state:
         tipc_printbuf_validate(buf);
         info("%s", print_area);
 }
-
diff --git a/net/tipc/link.h b/net/tipc/link.h
index 73c18c140e1d..d6a60a963ce6 100644
--- a/net/tipc/link.h
+++ b/net/tipc/link.h
@@ -47,13 +47,11 @@
 /*
  * Out-of-range value for link sequence numbers
  */
-
 #define INVALID_LINK_SEQ 0x10000
 
 /*
  * Link states
  */
-
 #define WORKING_WORKING 560810u
 #define WORKING_UNKNOWN 560811u
 #define RESET_UNKNOWN   560812u
@@ -63,7 +61,6 @@
  * Starting value for maximum packet size negotiation on unicast links
  * (unless bearer MTU is less)
  */
-
 #define MAX_PKT_DEFAULT 1500
 
 /**
@@ -114,7 +111,6 @@
  * @defragm_buf: list of partially reassembled inbound message fragments
  * @stats: collects statistics regarding link activity
  */
-
 struct tipc_link {
         u32 addr;
         char name[TIPC_MAX_LINK_NAME];
@@ -255,7 +251,6 @@ void tipc_link_retransmit(struct tipc_link *l_ptr,
 /*
  * Link sequence number manipulation routines (uses modulo 2**16 arithmetic)
  */
-
 static inline u32 buf_seqno(struct sk_buff *buf)
 {
         return msg_seqno(buf_msg(buf));
@@ -294,7 +289,6 @@ static inline u32 lesser(u32 left, u32 right)
 /*
  * Link status checking routines
  */
-
 static inline int link_working_working(struct tipc_link *l_ptr)
 {
         return l_ptr->state == WORKING_WORKING;
diff --git a/net/tipc/log.c b/net/tipc/log.c
index 952c39f643e6..026733f24919 100644
--- a/net/tipc/log.c
+++ b/net/tipc/log.c
@@ -47,7 +47,6 @@
  *
  * Additional user-defined print buffers are also permitted.
  */
-
 static struct print_buf null_buf = { NULL, 0, NULL, 0 };
 struct print_buf *const TIPC_NULL = &null_buf;
 
@@ -72,7 +71,6 @@ struct print_buf *const TIPC_LOG = &log_buf;
  * on the caller to prevent simultaneous use of the print buffer(s) being
  * manipulated.
  */
-
 static char print_string[TIPC_PB_MAX_STR];
 static DEFINE_SPINLOCK(print_lock);
 
@@ -97,7 +95,6 @@ static void tipc_printbuf_move(struct print_buf *pb_to,
  * Note: If the character array is too small (or absent), the print buffer
  * becomes a null device that discards anything written to it.
  */
-
 void tipc_printbuf_init(struct print_buf *pb, char *raw, u32 size)
 {
         pb->buf = raw;
@@ -117,7 +114,6 @@ void tipc_printbuf_init(struct print_buf *pb, char *raw, u32 size)
  * tipc_printbuf_reset - reinitialize print buffer to empty state
  * @pb: pointer to print buffer structure
  */
-
 static void tipc_printbuf_reset(struct print_buf *pb)
 {
         if (pb->buf) {
@@ -133,7 +129,6 @@ static void tipc_printbuf_reset(struct print_buf *pb)
  *
  * Returns non-zero if print buffer is empty.
  */
-
 static int tipc_printbuf_empty(struct print_buf *pb)
 {
         return !pb->buf || (pb->crs == pb->buf);
@@ -148,7 +143,6 @@ static int tipc_printbuf_empty(struct print_buf *pb)
  *
  * Returns length of print buffer data string (including trailing NUL)
  */
-
 int tipc_printbuf_validate(struct print_buf *pb)
 {
         char *err = "\n\n*** PRINT BUFFER OVERFLOW ***\n\n";
@@ -182,14 +176,12 @@ int tipc_printbuf_validate(struct print_buf *pb)
  * Current contents of destination print buffer (if any) are discarded.
  * Source print buffer becomes empty if a successful move occurs.
  */
-
 static void tipc_printbuf_move(struct print_buf *pb_to,
                                struct print_buf *pb_from)
 {
         int len;
 
         /* Handle the cases where contents can't be moved */
-
         if (!pb_to->buf)
                 return;
 
@@ -206,7 +198,6 @@ static void tipc_printbuf_move(struct print_buf *pb_to,
         }
 
         /* Copy data from char after cursor to end (if used) */
-
         len = pb_from->buf + pb_from->size - pb_from->crs - 2;
         if ((pb_from->buf[pb_from->size - 1] == 0) && (len > 0)) {
                 strcpy(pb_to->buf, pb_from->crs + 1);
@@ -215,7 +206,6 @@ static void tipc_printbuf_move(struct print_buf *pb_to,
                 pb_to->crs = pb_to->buf;
 
         /* Copy data from start to cursor (always) */
-
         len = pb_from->crs - pb_from->buf;
         strcpy(pb_to->crs, pb_from->buf);
         pb_to->crs += len;
@@ -228,7 +218,6 @@ static void tipc_printbuf_move(struct print_buf *pb_to,
  * @pb: pointer to print buffer
  * @fmt: formatted info to be printed
  */
-
 void tipc_printf(struct print_buf *pb, const char *fmt, ...)
 {
         int chars_to_add;
@@ -270,7 +259,6 @@ void tipc_printf(struct print_buf *pb, const char *fmt, ...)
  * tipc_log_resize - change the size of the TIPC log buffer
  * @log_size: print buffer size to use
  */
-
 int tipc_log_resize(int log_size)
 {
         int res = 0;
@@ -295,7 +283,6 @@ int tipc_log_resize(int log_size)
 /**
  * tipc_log_resize_cmd - reconfigure size of TIPC log buffer
  */
-
 struct sk_buff *tipc_log_resize_cmd(const void *req_tlv_area, int req_tlv_space)
 {
         u32 value;
@@ -304,7 +291,7 @@ struct sk_buff *tipc_log_resize_cmd(const void *req_tlv_area, int req_tlv_space)
                 return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
 
         value = ntohl(*(__be32 *)TLV_DATA(req_tlv_area));
-        if (value != delimit(value, 0, 32768))
+        if (value > 32768)
                 return tipc_cfg_reply_error_string(TIPC_CFG_INVALID_VALUE
                                                    " (log size must be 0-32768)");
         if (tipc_log_resize(value))
@@ -316,7 +303,6 @@ struct sk_buff *tipc_log_resize_cmd(const void *req_tlv_area, int req_tlv_space)
 /**
  * tipc_log_dump - capture TIPC log buffer contents in configuration message
  */
-
 struct sk_buff *tipc_log_dump(void)
 {
         struct sk_buff *reply;
diff --git a/net/tipc/log.h b/net/tipc/log.h
index 2248d96238e6..d1f5eb967fd8 100644
--- a/net/tipc/log.h
+++ b/net/tipc/log.h
@@ -44,7 +44,6 @@
  * @crs: pointer to first unused space in character array (i.e. final NUL)
  * @echo: echo output to system console if non-zero
  */
-
 struct print_buf {
         char *buf;
         u32 size;
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 3e4d3e29be61..deea0d232dca 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -72,7 +72,6 @@ void tipc_msg_init(struct tipc_msg *m, u32 user, u32 type,
  *
  * Returns message data size or errno
  */
-
 int tipc_msg_build(struct tipc_msg *hdr, struct iovec const *msg_sect,
                    u32 num_sect, unsigned int total_len,
                             int max_size, int usrmem, struct sk_buff **buf)
@@ -106,13 +105,12 @@ int tipc_msg_build(struct tipc_msg *hdr, struct iovec const *msg_sect,
         if (likely(res))
                 return dsz;
 
-        buf_discard(*buf);
+        kfree_skb(*buf);
         *buf = NULL;
         return -EFAULT;
 }
 
 #ifdef CONFIG_TIPC_DEBUG
-
 void tipc_msg_dbg(struct print_buf *buf, struct tipc_msg *msg, const char *str)
 {
         u32 usr = msg_user(msg);
@@ -352,5 +350,4 @@ void tipc_msg_dbg(struct print_buf *buf, struct tipc_msg *msg, const char *str)
         if ((usr == MSG_FRAGMENTER) && (msg_type(msg) == FIRST_FRAGMENT))
                 tipc_msg_dbg(buf, msg_get_wrapped(msg), "      /");
 }
-
 #endif
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index 7b0cda167107..ba2a72beea68 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -44,7 +44,6 @@
  *
  * Note: Some items are also used with TIPC internal message headers
  */
-
 #define TIPC_VERSION              2
 
 /*
@@ -58,7 +57,6 @@
 /*
  * Payload message types
  */
-
 #define TIPC_CONN_MSG           0
 #define TIPC_MCAST_MSG          1
 #define TIPC_NAMED_MSG          2
@@ -67,7 +65,6 @@
 /*
  * Message header sizes
  */
-
 #define SHORT_H_SIZE              24    /* In-cluster basic payload message */
 #define BASIC_H_SIZE              32    /* Basic payload message */
 #define NAMED_H_SIZE              40    /* Named payload message */
@@ -121,7 +118,6 @@ static inline void msg_swap_words(struct tipc_msg *msg, u32 a, u32 b)
 /*
  * Word 0
  */
-
 static inline u32 msg_version(struct tipc_msg *m)
 {
         return msg_bits(m, 0, 29, 7);
@@ -216,7 +212,6 @@ static inline void msg_set_size(struct tipc_msg *m, u32 sz)
 /*
  * Word 1
  */
-
 static inline u32 msg_type(struct tipc_msg *m)
 {
         return msg_bits(m, 1, 29, 0x7);
@@ -291,7 +286,6 @@ static inline void msg_set_bcast_ack(struct tipc_msg *m, u32 n)
 /*
  * Word 2
  */
-
 static inline u32 msg_ack(struct tipc_msg *m)
 {
         return msg_bits(m, 2, 16, 0xffff);
@@ -315,8 +309,6 @@ static inline void msg_set_seqno(struct tipc_msg *m, u32 n)
 /*
  * Words 3-10
  */
-
-
 static inline u32 msg_prevnode(struct tipc_msg *m)
 {
         return msg_word(m, 3);
@@ -384,11 +376,6 @@ static inline void msg_set_destnode(struct tipc_msg *m, u32 a)
         msg_set_word(m, 7, a);
 }
 
-static inline int msg_is_dest(struct tipc_msg *m, u32 d)
-{
-        return msg_short(m) || (msg_destnode(m) == d);
-}
-
 static inline u32 msg_nametype(struct tipc_msg *m)
 {
         return msg_word(m, 8);
@@ -439,7 +426,6 @@ static inline struct tipc_msg *msg_get_wrapped(struct tipc_msg *m)
         return (struct tipc_msg *)msg_data(m);
 }
 
-
 /*
  * Constants and routines used to read and write TIPC internal message headers
  */
@@ -447,7 +433,6 @@ static inline struct tipc_msg *msg_get_wrapped(struct tipc_msg *m)
 /*
  * Internal message users
  */
-
 #define  BCAST_PROTOCOL       5
 #define  MSG_BUNDLER          6
 #define  LINK_PROTOCOL        7
@@ -461,7 +446,6 @@ static inline struct tipc_msg *msg_get_wrapped(struct tipc_msg *m)
 /*
  *  Connection management protocol message types
  */
-
 #define CONN_PROBE        0
 #define CONN_PROBE_REPLY  1
 #define CONN_ACK          2
@@ -469,14 +453,12 @@ static inline struct tipc_msg *msg_get_wrapped(struct tipc_msg *m)
 /*
  * Name distributor message types
  */
-
 #define PUBLICATION       0
 #define WITHDRAWAL        1
 
 /*
  * Segmentation message types
  */
-
 #define FIRST_FRAGMENT          0
 #define FRAGMENT                1
 #define LAST_FRAGMENT           2
@@ -484,7 +466,6 @@ static inline struct tipc_msg *msg_get_wrapped(struct tipc_msg *m)
 /*
  * Link management protocol message types
  */
-
 #define STATE_MSG               0
 #define RESET_MSG               1
 #define ACTIVATE_MSG            2
@@ -498,7 +479,6 @@ static inline struct tipc_msg *msg_get_wrapped(struct tipc_msg *m)
 /*
  * Config protocol message types
  */
-
 #define DSC_REQ_MSG             0
 #define DSC_RESP_MSG            1
 
@@ -506,7 +486,6 @@ static inline struct tipc_msg *msg_get_wrapped(struct tipc_msg *m)
 /*
  * Word 1
  */
-
 static inline u32 msg_seq_gap(struct tipc_msg *m)
 {
         return msg_bits(m, 1, 16, 0x1fff);
@@ -517,11 +496,20 @@ static inline void msg_set_seq_gap(struct tipc_msg *m, u32 n)
         msg_set_bits(m, 1, 16, 0x1fff, n);
 }
 
+static inline u32 msg_node_sig(struct tipc_msg *m)
+{
+        return msg_bits(m, 1, 0, 0xffff);
+}
+
+static inline void msg_set_node_sig(struct tipc_msg *m, u32 n)
+{
+        msg_set_bits(m, 1, 0, 0xffff, n);
+}
+
 
 /*
  * Word 2
  */
-
 static inline u32 msg_dest_domain(struct tipc_msg *m)
 {
         return msg_word(m, 2);
@@ -556,7 +544,6 @@ static inline void msg_set_bcgap_to(struct tipc_msg *m, u32 n)
 /*
  * Word 4
  */
-
 static inline u32 msg_last_bcast(struct tipc_msg *m)
 {
         return msg_bits(m, 4, 16, 0xffff);
@@ -623,7 +610,6 @@ static inline void msg_set_link_selector(struct tipc_msg *m, u32 n)
 /*
  * Word 5
  */
-
 static inline u32 msg_session(struct tipc_msg *m)
 {
         return msg_bits(m, 5, 16, 0xffff);
@@ -692,7 +678,6 @@ static inline char *msg_media_addr(struct tipc_msg *m)
 /*
  * Word 9
  */
-
 static inline u32 msg_msgcnt(struct tipc_msg *m)
 {
         return msg_bits(m, 9, 16, 0xffff);
@@ -739,5 +724,4 @@ void tipc_msg_init(struct tipc_msg *m, u32 user, u32 type,
 int tipc_msg_build(struct tipc_msg *hdr, struct iovec const *msg_sect,
                    u32 num_sect, unsigned int total_len,
                             int max_size, int usrmem, struct sk_buff **buf);
-
 #endif
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index 98ebb37f1808..158318e67b08 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -58,7 +58,6 @@
  * Note: There is no field that identifies the publishing node because it is
  * the same for all items contained within a publication message.
  */
-
 struct distr_item {
         __be32 type;
         __be32 lower;
@@ -68,17 +67,41 @@ struct distr_item {
 };
 
 /**
- * List of externally visible publications by this node --
- * that is, all publications having scope > TIPC_NODE_SCOPE.
+ * struct publ_list - list of publications made by this node
+ * @list: circular list of publications
+ * @list_size: number of entries in list
  */
+struct publ_list {
+        struct list_head list;
+        u32 size;
+};
+
+static struct publ_list publ_zone = {
+        .list = LIST_HEAD_INIT(publ_zone.list),
+        .size = 0,
+};
+
+static struct publ_list publ_cluster = {
+        .list = LIST_HEAD_INIT(publ_cluster.list),
+        .size = 0,
+};
+
+static struct publ_list publ_node = {
+        .list = LIST_HEAD_INIT(publ_node.list),
+        .size = 0,
+};
+
+static struct publ_list *publ_lists[] = {
+        NULL,
+        &publ_zone,     /* publ_lists[TIPC_ZONE_SCOPE]          */
+        &publ_cluster,  /* publ_lists[TIPC_CLUSTER_SCOPE]       */
+        &publ_node      /* publ_lists[TIPC_NODE_SCOPE]          */
+};
 
-static LIST_HEAD(publ_root);
-static u32 publ_cnt;
 
 /**
  * publ_to_item - add publication info to a publication message
  */
-
 static void publ_to_item(struct distr_item *i, struct publication *p)
 {
         i->type = htonl(p->type);
@@ -91,7 +114,6 @@ static void publ_to_item(struct distr_item *i, struct publication *p)
 /**
  * named_prepare_buf - allocate & initialize a publication message
  */
-
 static struct sk_buff *named_prepare_buf(u32 type, u32 size, u32 dest)
 {
         struct sk_buff *buf = tipc_buf_acquire(INT_H_SIZE + size);
@@ -120,20 +142,22 @@ static void named_cluster_distribute(struct sk_buff *buf)
                 }
         }
 
-        buf_discard(buf);
+        kfree_skb(buf);
 }
 
 /**
  * tipc_named_publish - tell other nodes about a new publication by this node
  */
-
 void tipc_named_publish(struct publication *publ)
 {
         struct sk_buff *buf;
         struct distr_item *item;
 
-        list_add_tail(&publ->local_list, &publ_root);
-        publ_cnt++;
+        list_add_tail(&publ->local_list, &publ_lists[publ->scope]->list);
+        publ_lists[publ->scope]->size++;
+
+        if (publ->scope == TIPC_NODE_SCOPE)
+                return;
 
         buf = named_prepare_buf(PUBLICATION, ITEM_SIZE, 0);
         if (!buf) {
@@ -149,14 +173,16 @@ void tipc_named_publish(struct publication *publ)
 /**
  * tipc_named_withdraw - tell other nodes about a withdrawn publication by this node
  */
-
 void tipc_named_withdraw(struct publication *publ)
 {
         struct sk_buff *buf;
         struct distr_item *item;
 
         list_del(&publ->local_list);
-        publ_cnt--;
+        publ_lists[publ->scope]->size--;
+
+        if (publ->scope == TIPC_NODE_SCOPE)
+                return;
 
         buf = named_prepare_buf(WITHDRAWAL, ITEM_SIZE, 0);
         if (!buf) {
@@ -169,25 +195,51 @@ void tipc_named_withdraw(struct publication *publ)
         named_cluster_distribute(buf);
 }
 
+/*
+ * named_distribute - prepare name info for bulk distribution to another node
+ */
+static void named_distribute(struct list_head *message_list, u32 node,
+                             struct publ_list *pls, u32 max_item_buf)
+{
+        struct publication *publ;
+        struct sk_buff *buf = NULL;
+        struct distr_item *item = NULL;
+        u32 left = 0;
+        u32 rest = pls->size * ITEM_SIZE;
+
+        list_for_each_entry(publ, &pls->list, local_list) {
+                if (!buf) {
+                        left = (rest <= max_item_buf) ? rest : max_item_buf;
+                        rest -= left;
+                        buf = named_prepare_buf(PUBLICATION, left, node);
+                        if (!buf) {
+                                warn("Bulk publication failure\n");
+                                return;
+                        }
+                        item = (struct distr_item *)msg_data(buf_msg(buf));
+                }
+                publ_to_item(item, publ);
+                item++;
+                left -= ITEM_SIZE;
+                if (!left) {
+                        list_add_tail((struct list_head *)buf, message_list);
+                        buf = NULL;
+                }
+        }
+}
+
 /**
  * tipc_named_node_up - tell specified node about all publications by this node
  */
-
 void tipc_named_node_up(unsigned long nodearg)
 {
         struct tipc_node *n_ptr;
         struct tipc_link *l_ptr;
-        struct publication *publ;
-        struct distr_item *item = NULL;
-        struct sk_buff *buf = NULL;
         struct list_head message_list;
         u32 node = (u32)nodearg;
-        u32 left = 0;
-        u32 rest;
         u32 max_item_buf = 0;
 
         /* compute maximum amount of publication data to send per message */
-
         read_lock_bh(&tipc_net_lock);
         n_ptr = tipc_node_find(node);
         if (n_ptr) {
@@ -203,32 +255,11 @@ void tipc_named_node_up(unsigned long nodearg)
                 return;
 
         /* create list of publication messages, then send them as a unit */
-
         INIT_LIST_HEAD(&message_list);
 
         read_lock_bh(&tipc_nametbl_lock);
-        rest = publ_cnt * ITEM_SIZE;
-
-        list_for_each_entry(publ, &publ_root, local_list) {
-                if (!buf) {
-                        left = (rest <= max_item_buf) ? rest : max_item_buf;
-                        rest -= left;
-                        buf = named_prepare_buf(PUBLICATION, left, node);
-                        if (!buf) {
-                                warn("Bulk publication distribution failure\n");
-                                goto exit;
-                        }
-                        item = (struct distr_item *)msg_data(buf_msg(buf));
-                }
-                publ_to_item(item, publ);
-                item++;
-                left -= ITEM_SIZE;
-                if (!left) {
-                        list_add_tail((struct list_head *)buf, &message_list);
-                        buf = NULL;
-                }
-        }
-exit:
+        named_distribute(&message_list, node, &publ_cluster, max_item_buf);
+        named_distribute(&message_list, node, &publ_zone, max_item_buf);
         read_unlock_bh(&tipc_nametbl_lock);
 
         tipc_link_send_names(&message_list, (u32)node);
@@ -239,17 +270,12 @@ exit:
  *
  * Invoked for each publication issued by a newly failed node.
  * Removes publication structure from name table & deletes it.
- * In rare cases the link may have come back up again when this
- * function is called, and we have two items representing the same
- * publication. Nudge this item's key to distinguish it from the other.
  */
-
 static void named_purge_publ(struct publication *publ)
 {
         struct publication *p;
 
         write_lock_bh(&tipc_nametbl_lock);
-        publ->key += 1222345;
         p = tipc_nametbl_remove_publ(publ->type, publ->lower,
                                      publ->node, publ->ref, publ->key);
         if (p)
@@ -268,7 +294,6 @@ static void named_purge_publ(struct publication *publ)
 /**
  * tipc_named_recv - process name table update message sent by another node
  */
-
 void tipc_named_recv(struct sk_buff *buf)
 {
         struct publication *publ;
@@ -316,25 +341,26 @@ void tipc_named_recv(struct sk_buff *buf)
                 item++;
         }
         write_unlock_bh(&tipc_nametbl_lock);
-        buf_discard(buf);
+        kfree_skb(buf);
 }
 
 /**
- * tipc_named_reinit - re-initialize local publication list
+ * tipc_named_reinit - re-initialize local publications
  *
  * This routine is called whenever TIPC networking is enabled.
- * All existing publications by this node that have "cluster" or "zone" scope
- * are updated to reflect the node's new network address.
+ * All name table entries published by this node are updated to reflect
+ * the node's new network address.
  */
-
 void tipc_named_reinit(void)
 {
         struct publication *publ;
+        int scope;
 
         write_lock_bh(&tipc_nametbl_lock);
 
-        list_for_each_entry(publ, &publ_root, local_list)
-                publ->node = tipc_own_addr;
+        for (scope = TIPC_ZONE_SCOPE; scope <= TIPC_NODE_SCOPE; scope++)
+                list_for_each_entry(publ, &publ_lists[scope]->list, local_list)
+                        publ->node = tipc_own_addr;
 
         write_unlock_bh(&tipc_nametbl_lock);
 }
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index 89eb5621ebba..010f24a59da2 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -56,7 +56,6 @@ static int tipc_nametbl_size = 1024;		/* must be a power of 2 */
  *       publications of the associated name sequence belong to it.
  *       (The cluster and node lists may be empty.)
  */
-
 struct name_info {
         struct list_head node_list;
         struct list_head cluster_list;
@@ -72,7 +71,6 @@ struct name_info {
  * @upper: name sequence upper bound
  * @info: pointer to name sequence publication info
  */
-
 struct sub_seq {
         u32 lower;
         u32 upper;
@@ -90,7 +88,6 @@ struct sub_seq {
  * @subscriptions: list of subscriptions for this 'type'
  * @lock: spinlock controlling access to publication lists of all sub-sequences
  */
-
 struct name_seq {
         u32 type;
         struct sub_seq *sseqs;
@@ -107,17 +104,14 @@ struct name_seq {
  *         accessed via hashing on 'type'; name sequence lists are *not* sorted
  * @local_publ_count: number of publications issued by this node
  */
-
 struct name_table {
         struct hlist_head *types;
         u32 local_publ_count;
 };
 
 static struct name_table table;
-static atomic_t rsv_publ_ok = ATOMIC_INIT(0);
 DEFINE_RWLOCK(tipc_nametbl_lock);
 
-
 static int hash(int x)
 {
         return x & (tipc_nametbl_size - 1);
@@ -126,7 +120,6 @@ static int hash(int x)
 /**
  * publ_create - create a publication structure
  */
-
 static struct publication *publ_create(u32 type, u32 lower, u32 upper,
                                        u32 scope, u32 node, u32 port_ref,
                                        u32 key)
@@ -153,7 +146,6 @@ static struct publication *publ_create(u32 type, u32 lower, u32 upper,
 /**
  * tipc_subseq_alloc - allocate a specified number of sub-sequence structures
  */
-
 static struct sub_seq *tipc_subseq_alloc(u32 cnt)
 {
         struct sub_seq *sseq = kcalloc(cnt, sizeof(struct sub_seq), GFP_ATOMIC);
@@ -165,7 +157,6 @@ static struct sub_seq *tipc_subseq_alloc(u32 cnt)
  *
  * Allocates a single sub-sequence structure and sets it to all 0's.
  */
-
 static struct name_seq *tipc_nameseq_create(u32 type, struct hlist_head *seq_head)
 {
         struct name_seq *nseq = kzalloc(sizeof(*nseq), GFP_ATOMIC);
@@ -188,12 +179,23 @@ static struct name_seq *tipc_nameseq_create(u32 type, struct hlist_head *seq_hea
         return nseq;
 }
 
-/**
+/*
+ * nameseq_delete_empty - deletes a name sequence structure if now unused
+ */
+static void nameseq_delete_empty(struct name_seq *seq)
+{
+        if (!seq->first_free && list_empty(&seq->subscriptions)) {
+                hlist_del_init(&seq->ns_list);
+                kfree(seq->sseqs);
+                kfree(seq);
+        }
+}
+
+/*
  * nameseq_find_subseq - find sub-sequence (if any) matching a name instance
  *
  * Very time-critical, so binary searches through sub-sequence array.
  */
-
 static struct sub_seq *nameseq_find_subseq(struct name_seq *nseq,
                                            u32 instance)
 {
@@ -223,7 +225,6 @@ static struct sub_seq *nameseq_find_subseq(struct name_seq *nseq,
  *
  * Note: Similar to binary search code for locating a sub-sequence.
  */
-
 static u32 nameseq_locate_subseq(struct name_seq *nseq, u32 instance)
 {
         struct sub_seq *sseqs = nseq->sseqs;
@@ -244,9 +245,8 @@ static u32 nameseq_locate_subseq(struct name_seq *nseq, u32 instance)
 }
 
 /**
- * tipc_nameseq_insert_publ -
+ * tipc_nameseq_insert_publ
  */
-
 static struct publication *tipc_nameseq_insert_publ(struct name_seq *nseq,
                                                     u32 type, u32 lower, u32 upper,
                                                     u32 scope, u32 node, u32 port, u32 key)
@@ -262,7 +262,6 @@ static struct publication *tipc_nameseq_insert_publ(struct name_seq *nseq,
         if (sseq) {
 
                 /* Lower end overlaps existing entry => need an exact match */
-
                 if ((sseq->lower != lower) || (sseq->upper != upper)) {
                         warn("Cannot publish {%u,%u,%u}, overlap error\n",
                              type, lower, upper);
@@ -270,16 +269,21 @@ static struct publication *tipc_nameseq_insert_publ(struct name_seq *nseq,
                 }
 
                 info = sseq->info;
+
+                /* Check if an identical publication already exists */
+                list_for_each_entry(publ, &info->zone_list, zone_list) {
+                        if ((publ->ref == port) && (publ->key == key) &&
+                            (!publ->node || (publ->node == node)))
+                                return NULL;
+                }
         } else {
                 u32 inspos;
                 struct sub_seq *freesseq;
 
                 /* Find where lower end should be inserted */
-
                 inspos = nameseq_locate_subseq(nseq, lower);
 
                 /* Fail if upper end overlaps into an existing entry */
-
                 if ((inspos < nseq->first_free) &&
                     (upper >= nseq->sseqs[inspos].lower)) {
                         warn("Cannot publish {%u,%u,%u}, overlap error\n",
@@ -288,7 +292,6 @@ static struct publication *tipc_nameseq_insert_publ(struct name_seq *nseq,
                 }
 
                 /* Ensure there is space for new sub-sequence */
-
                 if (nseq->first_free == nseq->alloc) {
                         struct sub_seq *sseqs = tipc_subseq_alloc(nseq->alloc * 2);
 
@@ -316,7 +319,6 @@ static struct publication *tipc_nameseq_insert_publ(struct name_seq *nseq,
                 INIT_LIST_HEAD(&info->zone_list);
 
                 /* Insert new sub-sequence */
-
                 sseq = &nseq->sseqs[inspos];
                 freesseq = &nseq->sseqs[nseq->first_free];
                 memmove(sseq + 1, sseq, (freesseq - sseq) * sizeof(*sseq));
@@ -328,8 +330,7 @@ static struct publication *tipc_nameseq_insert_publ(struct name_seq *nseq,
                 created_subseq = 1;
         }
 
-        /* Insert a publication: */
-
+        /* Insert a publication */
         publ = publ_create(type, lower, upper, scope, node, port, key);
         if (!publ)
                 return NULL;
@@ -342,14 +343,12 @@ static struct publication *tipc_nameseq_insert_publ(struct name_seq *nseq,
                 info->cluster_list_size++;
         }
 
-        if (node == tipc_own_addr) {
+        if (in_own_node(node)) {
                 list_add(&publ->node_list, &info->node_list);
                 info->node_list_size++;
         }
 
-        /*
-         * Any subscriptions waiting for notification?
-         */
+        /* Any subscriptions waiting for notification?  */
         list_for_each_entry_safe(s, st, &nseq->subscriptions, nameseq_list) {
                 tipc_subscr_report_overlap(s,
                                            publ->lower,
@@ -363,7 +362,7 @@ static struct publication *tipc_nameseq_insert_publ(struct name_seq *nseq,
 }
 
 /**
- * tipc_nameseq_remove_publ -
+ * tipc_nameseq_remove_publ
  *
  * NOTE: There may be cases where TIPC is asked to remove a publication
  * that is not in the name table.  For example, if another node issues a
@@ -373,7 +372,6 @@ static struct publication *tipc_nameseq_insert_publ(struct name_seq *nseq,
  * A failed withdraw request simply returns a failure indication and lets the
  * caller issue any error or warning messages associated with such a problem.
  */
-
 static struct publication *tipc_nameseq_remove_publ(struct name_seq *nseq, u32 inst,
                                                     u32 node, u32 ref, u32 key)
 {
@@ -390,7 +388,6 @@ static struct publication *tipc_nameseq_remove_publ(struct name_seq *nseq, u32 i
         info = sseq->info;
 
         /* Locate publication, if it exists */
-
         list_for_each_entry(publ, &info->zone_list, zone_list) {
                 if ((publ->key == key) && (publ->ref == ref) &&
                     (!publ->node || (publ->node == node)))
@@ -400,26 +397,22 @@ static struct publication *tipc_nameseq_remove_publ(struct name_seq *nseq, u32 i
 
 found:
         /* Remove publication from zone scope list */
-
         list_del(&publ->zone_list);
         info->zone_list_size--;
 
         /* Remove publication from cluster scope list, if present */
-
         if (in_own_cluster(node)) {
                 list_del(&publ->cluster_list);
                 info->cluster_list_size--;
         }
 
         /* Remove publication from node scope list, if present */
-
-        if (node == tipc_own_addr) {
+        if (in_own_node(node)) {
                 list_del(&publ->node_list);
                 info->node_list_size--;
         }
 
         /* Contract subseq list if no more publications for that subseq */
-
         if (list_empty(&info->zone_list)) {
                 kfree(info);
                 free = &nseq->sseqs[nseq->first_free--];
@@ -428,7 +421,6 @@ found:
         }
 
         /* Notify any waiting subscriptions */
-
         list_for_each_entry_safe(s, st, &nseq->subscriptions, nameseq_list) {
                 tipc_subscr_report_overlap(s,
                                            publ->lower,
@@ -447,7 +439,6 @@ found:
  * the prescribed number of events if there is any sub-
  * sequence overlapping with the requested sequence
  */
-
 static void tipc_nameseq_subscribe(struct name_seq *nseq,
                                         struct tipc_subscription *s)
 {
@@ -499,9 +490,10 @@ struct publication *tipc_nametbl_insert_publ(u32 type, u32 lower, u32 upper,
 {
         struct name_seq *seq = nametbl_find_seq(type);
 
-        if (lower > upper) {
-                warn("Failed to publish illegal {%u,%u,%u}\n",
-                     type, lower, upper);
+        if ((scope < TIPC_ZONE_SCOPE) || (scope > TIPC_NODE_SCOPE) ||
+            (lower > upper)) {
+                dbg("Failed to publish illegal {%u,%u,%u} with scope %u\n",
+                     type, lower, upper, scope);
                 return NULL;
         }
 
@@ -524,22 +516,23 @@ struct publication *tipc_nametbl_remove_publ(u32 type, u32 lower,
                 return NULL;
 
         publ = tipc_nameseq_remove_publ(seq, lower, node, ref, key);
-
-        if (!seq->first_free && list_empty(&seq->subscriptions)) {
-                hlist_del_init(&seq->ns_list);
-                kfree(seq->sseqs);
-                kfree(seq);
-        }
+        nameseq_delete_empty(seq);
         return publ;
 }
 
 /*
- * tipc_nametbl_translate - translate name to port id
+ * tipc_nametbl_translate - perform name translation
+ *
+ * On entry, 'destnode' is the search domain used during translation.
  *
- * Note: on entry 'destnode' is the search domain used during translation;
- *       on exit it passes back the node address of the matching port (if any)
+ * On exit:
+ * - if name translation is deferred to another node/cluster/zone,
+ *   leaves 'destnode' unchanged (will be non-zero) and returns 0
+ * - if name translation is attempted and succeeds, sets 'destnode'
+ *   to publishing node and returns port reference (will be non-zero)
+ * - if name translation is attempted and fails, sets 'destnode' to 0
+ *   and returns 0
  */
-
 u32 tipc_nametbl_translate(u32 type, u32 instance, u32 *destnode)
 {
         struct sub_seq *sseq;
@@ -547,6 +540,7 @@ u32 tipc_nametbl_translate(u32 type, u32 instance, u32 *destnode)
         struct publication *publ;
         struct name_seq *seq;
         u32 ref = 0;
+        u32 node = 0;
 
         if (!tipc_in_scope(*destnode, tipc_own_addr))
                 return 0;
@@ -561,7 +555,7 @@ u32 tipc_nametbl_translate(u32 type, u32 instance, u32 *destnode)
         spin_lock_bh(&seq->lock);
         info = sseq->info;
 
-        /* Closest-First Algorithm: */
+        /* Closest-First Algorithm */
         if (likely(!*destnode)) {
                 if (!list_empty(&info->node_list)) {
                         publ = list_first_entry(&info->node_list,
@@ -584,14 +578,14 @@ u32 tipc_nametbl_translate(u32 type, u32 instance, u32 *destnode)
                 }
         }
 
-        /* Round-Robin Algorithm: */
+        /* Round-Robin Algorithm */
         else if (*destnode == tipc_own_addr) {
                 if (list_empty(&info->node_list))
                         goto no_match;
                 publ = list_first_entry(&info->node_list, struct publication,
                                         node_list);
                 list_move_tail(&publ->node_list, &info->node_list);
-        } else if (in_own_cluster(*destnode)) {
+        } else if (in_own_cluster_exact(*destnode)) {
                 if (list_empty(&info->cluster_list))
                         goto no_match;
                 publ = list_first_entry(&info->cluster_list, struct publication,
@@ -604,11 +598,12 @@ u32 tipc_nametbl_translate(u32 type, u32 instance, u32 *destnode)
         }
 
         ref = publ->ref;
-        *destnode = publ->node;
+        node = publ->node;
 no_match:
         spin_unlock_bh(&seq->lock);
 not_found:
         read_unlock_bh(&tipc_nametbl_lock);
+        *destnode = node;
         return ref;
 }
 
@@ -624,7 +619,6 @@ not_found:
  *
  * Returns non-zero if any off-node ports overlap
  */
-
 int tipc_nametbl_mc_translate(u32 type, u32 lower, u32 upper, u32 limit,
                               struct tipc_port_list *dports)
 {
@@ -665,25 +659,9 @@ exit:
         return res;
 }
 
-/**
- * tipc_nametbl_publish_rsv - publish port name using a reserved name type
- */
-
-int tipc_nametbl_publish_rsv(u32 ref, unsigned int scope,
-                        struct tipc_name_seq const *seq)
-{
-        int res;
-
-        atomic_inc(&rsv_publ_ok);
-        res = tipc_publish(ref, scope, seq);
-        atomic_dec(&rsv_publ_ok);
-        return res;
-}
-
-/**
+/*
  * tipc_nametbl_publish - add name publication to network name tables
  */
-
 struct publication *tipc_nametbl_publish(u32 type, u32 lower, u32 upper,
                                     u32 scope, u32 port_ref, u32 key)
 {
@@ -694,18 +672,14 @@ struct publication *tipc_nametbl_publish(u32 type, u32 lower, u32 upper,
                      tipc_max_publications);
                 return NULL;
         }
-        if ((type < TIPC_RESERVED_TYPES) && !atomic_read(&rsv_publ_ok)) {
-                warn("Publication failed, reserved name {%u,%u,%u}\n",
-                     type, lower, upper);
-                return NULL;
-        }
 
         write_lock_bh(&tipc_nametbl_lock);
-        table.local_publ_count++;
         publ = tipc_nametbl_insert_publ(type, lower, upper, scope,
                                    tipc_own_addr, port_ref, key);
-        if (publ && (scope != TIPC_NODE_SCOPE))
+        if (likely(publ)) {
+                table.local_publ_count++;
                 tipc_named_publish(publ);
+        }
         write_unlock_bh(&tipc_nametbl_lock);
         return publ;
 }
@@ -713,7 +687,6 @@ struct publication *tipc_nametbl_publish(u32 type, u32 lower, u32 upper,
 /**
  * tipc_nametbl_withdraw - withdraw name publication from network name tables
  */
-
 int tipc_nametbl_withdraw(u32 type, u32 lower, u32 ref, u32 key)
 {
         struct publication *publ;
@@ -722,8 +695,7 @@ int tipc_nametbl_withdraw(u32 type, u32 lower, u32 ref, u32 key)
         publ = tipc_nametbl_remove_publ(type, lower, tipc_own_addr, ref, key);
         if (likely(publ)) {
                 table.local_publ_count--;
-                if (publ->scope != TIPC_NODE_SCOPE)
-                        tipc_named_withdraw(publ);
+                tipc_named_withdraw(publ);
                 write_unlock_bh(&tipc_nametbl_lock);
                 list_del_init(&publ->pport_list);
                 kfree(publ);
@@ -739,7 +711,6 @@ int tipc_nametbl_withdraw(u32 type, u32 lower, u32 ref, u32 key)
 /**
  * tipc_nametbl_subscribe - add a subscription object to the name table
  */
-
 void tipc_nametbl_subscribe(struct tipc_subscription *s)
 {
         u32 type = s->seq.type;
@@ -763,7 +734,6 @@ void tipc_nametbl_subscribe(struct tipc_subscription *s)
 /**
  * tipc_nametbl_unsubscribe - remove a subscription object from name table
  */
-
 void tipc_nametbl_unsubscribe(struct tipc_subscription *s)
 {
         struct name_seq *seq;
@@ -774,11 +744,7 @@ void tipc_nametbl_unsubscribe(struct tipc_subscription *s)
                 spin_lock_bh(&seq->lock);
                 list_del_init(&s->nameseq_list);
                 spin_unlock_bh(&seq->lock);
-                if ((seq->first_free == 0) && list_empty(&seq->subscriptions)) {
-                        hlist_del_init(&seq->ns_list);
-                        kfree(seq->sseqs);
-                        kfree(seq);
-                }
+                nameseq_delete_empty(seq);
         }
         write_unlock_bh(&tipc_nametbl_lock);
 }
@@ -787,7 +753,6 @@ void tipc_nametbl_unsubscribe(struct tipc_subscription *s)
 /**
  * subseq_list: print specified sub-sequence contents into the given buffer
  */
-
 static void subseq_list(struct sub_seq *sseq, struct print_buf *buf, u32 depth,
                         u32 index)
 {
@@ -824,7 +789,6 @@ static void subseq_list(struct sub_seq *sseq, struct print_buf *buf, u32 depth,
 /**
  * nameseq_list: print specified name sequence contents into the given buffer
  */
-
 static void nameseq_list(struct name_seq *seq, struct print_buf *buf, u32 depth,
                          u32 type, u32 lowbound, u32 upbound, u32 index)
 {
@@ -855,7 +819,6 @@ static void nameseq_list(struct name_seq *seq, struct print_buf *buf, u32 depth,
 /**
  * nametbl_header - print name table header into the given buffer
  */
-
 static void nametbl_header(struct print_buf *buf, u32 depth)
 {
         const char *header[] = {
@@ -877,7 +840,6 @@ static void nametbl_header(struct print_buf *buf, u32 depth)
 /**
  * nametbl_list - print specified name table contents into the given buffer
  */
-
 static void nametbl_list(struct print_buf *buf, u32 depth_info,
                          u32 type, u32 lowbound, u32 upbound)
 {
@@ -976,7 +938,6 @@ void tipc_nametbl_stop(void)
                 return;
 
         /* Verify name table is empty, then release it */
-
         write_lock_bh(&tipc_nametbl_lock);
         for (i = 0; i < tipc_nametbl_size; i++) {
                 if (!hlist_empty(&table.types[i]))
@@ -986,4 +947,3 @@ void tipc_nametbl_stop(void)
         table.types = NULL;
         write_unlock_bh(&tipc_nametbl_lock);
 }
-
diff --git a/net/tipc/name_table.h b/net/tipc/name_table.h
index 8086b42f92ad..71cb4dc712df 100644
--- a/net/tipc/name_table.h
+++ b/net/tipc/name_table.h
@@ -45,10 +45,8 @@ struct tipc_port_list;
 /*
  * TIPC name types reserved for internal TIPC use (both current and planned)
  */
-
 #define TIPC_ZM_SRV 3           /* zone master service name type */
 
-
 /**
  * struct publication - info about a published (name or) name sequence
  * @type: name sequence type
@@ -67,7 +65,6 @@ struct tipc_port_list;
  *
  * Note that the node list, cluster list, and zone list are circular lists.
  */
-
 struct publication {
         u32 type;
         u32 lower;
@@ -91,8 +88,6 @@ struct sk_buff *tipc_nametbl_get(const void *req_tlv_area, int req_tlv_space);
 u32 tipc_nametbl_translate(u32 type, u32 instance, u32 *node);
 int tipc_nametbl_mc_translate(u32 type, u32 lower, u32 upper, u32 limit,
                          struct tipc_port_list *dports);
-int tipc_nametbl_publish_rsv(u32 ref, unsigned int scope,
-                        struct tipc_name_seq const *seq);
 struct publication *tipc_nametbl_publish(u32 type, u32 lower, u32 upper,
                                     u32 scope, u32 port_ref, u32 key);
 int tipc_nametbl_withdraw(u32 type, u32 lower, u32 ref, u32 key);
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 61afee7e8291..7c236c89cf5e 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -117,7 +117,7 @@ static void net_route_named_msg(struct sk_buff *buf)
         u32 dport;
 
         if (!msg_named(msg)) {
-                buf_discard(buf);
+                kfree_skb(buf);
                 return;
         }
 
@@ -161,7 +161,7 @@ void tipc_net_route_msg(struct sk_buff *buf)
                         tipc_port_recv_proto_msg(buf);
                         break;
                 default:
-                        buf_discard(buf);
+                        kfree_skb(buf);
                 }
                 return;
         }
@@ -175,21 +175,14 @@ int tipc_net_start(u32 addr)
 {
         char addr_string[16];
 
-        if (tipc_mode != TIPC_NODE_MODE)
-                return -ENOPROTOOPT;
-
-        tipc_subscr_stop();
-        tipc_cfg_stop();
-
+        write_lock_bh(&tipc_net_lock);
         tipc_own_addr = addr;
-        tipc_mode = TIPC_NET_MODE;
         tipc_named_reinit();
         tipc_port_reinit();
-
         tipc_bclink_init();
+        write_unlock_bh(&tipc_net_lock);
 
-        tipc_k_signal((Handler)tipc_subscr_start, 0);
-        tipc_k_signal((Handler)tipc_cfg_init, 0);
+        tipc_cfg_reinit();
 
         info("Started in network mode\n");
         info("Own node address %s, network identity %u\n",
@@ -201,10 +194,9 @@ void tipc_net_stop(void)
 {
         struct tipc_node *node, *t_node;
 
-        if (tipc_mode != TIPC_NET_MODE)
+        if (!tipc_own_addr)
                 return;
         write_lock_bh(&tipc_net_lock);
-        tipc_mode = TIPC_NODE_MODE;
         tipc_bearer_stop();
         tipc_bclink_stop();
         list_for_each_entry_safe(node, t_node, &tipc_node_list, list)
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 6b226faad89f..d4fd341e6e0d 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -39,6 +39,8 @@
 #include "node.h"
 #include "name_distr.h"
 
+#define NODE_HTABLE_SIZE 512
+
 static void node_lost_contact(struct tipc_node *n_ptr);
 static void node_established_contact(struct tipc_node *n_ptr);
 
@@ -49,18 +51,27 @@ LIST_HEAD(tipc_node_list);
 static u32 tipc_num_nodes;
 
 static atomic_t tipc_num_links = ATOMIC_INIT(0);
-u32 tipc_own_tag;
 
-/**
- * tipc_node_find - locate specified node object, if it exists
+/*
+ * A trivial power-of-two bitmask technique is used for speed, since this
+ * operation is done for every incoming TIPC packet. The number of hash table
+ * entries has been chosen so that no hash chain exceeds 8 nodes and will
+ * usually be much smaller (typically only a single node).
  */
+static unsigned int tipc_hashfn(u32 addr)
+{
+        return addr & (NODE_HTABLE_SIZE - 1);
+}
 
+/*
+ * tipc_node_find - locate specified node object, if it exists
+ */
 struct tipc_node *tipc_node_find(u32 addr)
 {
         struct tipc_node *node;
         struct hlist_node *pos;
 
-        if (unlikely(!in_own_cluster(addr)))
+        if (unlikely(!in_own_cluster_exact(addr)))
                 return NULL;
 
         hlist_for_each_entry(node, pos, &node_htable[tipc_hashfn(addr)], hash) {
@@ -79,7 +90,6 @@ struct tipc_node *tipc_node_find(u32 addr)
  * time.  (It would be preferable to switch to holding net_lock in write mode,
  * but this is a non-trivial change.)
  */
-
 struct tipc_node *tipc_node_create(u32 addr)
 {
         struct tipc_node *n_ptr, *temp_node;
@@ -113,6 +123,7 @@ struct tipc_node *tipc_node_create(u32 addr)
         }
         list_add_tail(&n_ptr->list, &temp_node->list);
         n_ptr->block_setup = WAIT_PEER_DOWN;
+        n_ptr->signature = INVALID_NODE_SIG;
 
         tipc_num_nodes++;
 
@@ -129,13 +140,11 @@ void tipc_node_delete(struct tipc_node *n_ptr)
         tipc_num_nodes--;
 }
 
-
 /**
  * tipc_node_link_up - handle addition of link
  *
  * Link becomes active (alone or shared) or standby, depending on its priority.
  */
-
 void tipc_node_link_up(struct tipc_node *n_ptr, struct tipc_link *l_ptr)
 {
         struct tipc_link **active = &n_ptr->active_links[0];
@@ -168,7 +177,6 @@ void tipc_node_link_up(struct tipc_node *n_ptr, struct tipc_link *l_ptr)
 /**
  * node_select_active_links - select active link
  */
-
 static void node_select_active_links(struct tipc_node *n_ptr)
 {
         struct tipc_link **active = &n_ptr->active_links[0];
@@ -196,7 +204,6 @@ static void node_select_active_links(struct tipc_node *n_ptr)
 /**
  * tipc_node_link_down - handle loss of link
  */
-
 void tipc_node_link_down(struct tipc_node *n_ptr, struct tipc_link *l_ptr)
 {
         struct tipc_link **active;
@@ -253,63 +260,14 @@ void tipc_node_detach_link(struct tipc_node *n_ptr, struct tipc_link *l_ptr)
         n_ptr->link_cnt--;
 }
 
-/*
- * Routing table management - five cases to handle:
- *
- * 1: A link towards a zone/cluster external node comes up.
- *    => Send a multicast message updating routing tables of all
- *    system nodes within own cluster that the new destination
- *    can be reached via this node.
- *    (node.establishedContact()=>cluster.multicastNewRoute())
- *
- * 2: A link towards a slave node comes up.
- *    => Send a multicast message updating routing tables of all
- *    system nodes within own cluster that the new destination
- *    can be reached via this node.
- *    (node.establishedContact()=>cluster.multicastNewRoute())
- *    => Send a  message to the slave node about existence
- *    of all system nodes within cluster:
- *    (node.establishedContact()=>cluster.sendLocalRoutes())
- *
- * 3: A new cluster local system node becomes available.
- *    => Send message(s) to this particular node containing
- *    information about all cluster external and slave
- *     nodes which can be reached via this node.
- *    (node.establishedContact()==>network.sendExternalRoutes())
- *    (node.establishedContact()==>network.sendSlaveRoutes())
- *    => Send messages to all directly connected slave nodes
- *    containing information about the existence of the new node
- *    (node.establishedContact()=>cluster.multicastNewRoute())
- *
- * 4: The link towards a zone/cluster external node or slave
- *    node goes down.
- *    => Send a multcast message updating routing tables of all
- *    nodes within cluster that the new destination can not any
- *    longer be reached via this node.
- *    (node.lostAllLinks()=>cluster.bcastLostRoute())
- *
- * 5: A cluster local system node becomes unavailable.
- *    => Remove all references to this node from the local
- *    routing tables. Note: This is a completely node
- *    local operation.
- *    (node.lostAllLinks()=>network.removeAsRouter())
- *    => Send messages to all directly connected slave nodes
- *    containing information about loss of the node
- *    (node.establishedContact()=>cluster.multicastLostRoute())
- *
- */
-
 static void node_established_contact(struct tipc_node *n_ptr)
 {
         tipc_k_signal((Handler)tipc_named_node_up, n_ptr->addr);
 
-        /* Syncronize broadcast acks */
-        n_ptr->bclink.acked = tipc_bclink_get_last_sent();
-
-        if (n_ptr->bclink.supported) {
+        if (n_ptr->bclink.supportable) {
+                n_ptr->bclink.acked = tipc_bclink_get_last_sent();
                 tipc_bclink_add_node(n_ptr->addr);
-                if (n_ptr->addr < tipc_own_addr)
-                        tipc_own_tag++;
+                n_ptr->bclink.supported = 1;
         }
 }
 
@@ -336,24 +294,21 @@ static void node_lost_contact(struct tipc_node *n_ptr)
              tipc_addr_string_fill(addr_string, n_ptr->addr));
 
         /* Flush broadcast link info associated with lost node */
-
         if (n_ptr->bclink.supported) {
-                n_ptr->bclink.gap_after = n_ptr->bclink.gap_to = 0;
                 while (n_ptr->bclink.deferred_head) {
                         struct sk_buff *buf = n_ptr->bclink.deferred_head;
                         n_ptr->bclink.deferred_head = buf->next;
-                        buf_discard(buf);
+                        kfree_skb(buf);
                 }
+                n_ptr->bclink.deferred_size = 0;
 
                 if (n_ptr->bclink.defragm) {
-                        buf_discard(n_ptr->bclink.defragm);
+                        kfree_skb(n_ptr->bclink.defragm);
                         n_ptr->bclink.defragm = NULL;
                 }
 
                 tipc_bclink_remove_node(n_ptr->addr);
                 tipc_bclink_acknowledge(n_ptr, INVALID_LINK_SEQ);
-                if (n_ptr->addr < tipc_own_addr)
-                        tipc_own_tag--;
 
                 n_ptr->bclink.supported = 0;
         }
@@ -372,7 +327,6 @@ static void node_lost_contact(struct tipc_node *n_ptr)
         tipc_nodesub_notify(n_ptr);
 
         /* Prevent re-contact with node until cleanup is done */
-
         n_ptr->block_setup = WAIT_PEER_DOWN | WAIT_NAMES_GONE;
         tipc_k_signal((Handler)node_name_purge_complete, n_ptr->addr);
 }
@@ -400,7 +354,6 @@ struct sk_buff *tipc_node_get_nodes(const void *req_tlv_area, int req_tlv_space)
         }
 
         /* For now, get space for all other nodes */
-
         payload_size = TLV_SPACE(sizeof(node_info)) * tipc_num_nodes;
         if (payload_size > 32768u) {
                 read_unlock_bh(&tipc_net_lock);
@@ -414,7 +367,6 @@ struct sk_buff *tipc_node_get_nodes(const void *req_tlv_area, int req_tlv_space)
         }
 
         /* Add TLVs for all nodes in scope */
-
         list_for_each_entry(n_ptr, &tipc_node_list, list) {
                 if (!tipc_in_scope(domain, n_ptr->addr))
                         continue;
@@ -444,13 +396,12 @@ struct sk_buff *tipc_node_get_links(const void *req_tlv_area, int req_tlv_space)
                 return tipc_cfg_reply_error_string(TIPC_CFG_INVALID_VALUE
                                                    " (network address)");
 
-        if (tipc_mode != TIPC_NET_MODE)
+        if (!tipc_own_addr)
                 return tipc_cfg_reply_none();
 
         read_lock_bh(&tipc_net_lock);
 
-        /* Get space for all unicast links + multicast link */
-
+        /* Get space for all unicast links + broadcast link */
         payload_size = TLV_SPACE(sizeof(link_info)) *
                 (atomic_read(&tipc_num_links) + 1);
         if (payload_size > 32768u) {
@@ -465,14 +416,12 @@ struct sk_buff *tipc_node_get_links(const void *req_tlv_area, int req_tlv_space)
         }
 
         /* Add TLV for broadcast link */
-
         link_info.dest = htonl(tipc_cluster_mask(tipc_own_addr));
         link_info.up = htonl(1);
         strlcpy(link_info.str, tipc_bclink_name, TIPC_MAX_LINK_NAME);
         tipc_cfg_append_tlv(buf, TIPC_TLV_LINK_INFO, &link_info, sizeof(link_info));
 
         /* Add TLVs for any other links in scope */
-
         list_for_each_entry(n_ptr, &tipc_node_list, list) {
                 u32 i;
 
diff --git a/net/tipc/node.h b/net/tipc/node.h
index 0b1c5f8b6996..cfcaf4d6e480 100644
--- a/net/tipc/node.h
+++ b/net/tipc/node.h
@@ -42,8 +42,12 @@
 #include "net.h"
 #include "bearer.h"
 
-/* Flags used to block (re)establishment of contact with a neighboring node */
+/*
+ * Out-of-range value for node signature
+ */
+#define INVALID_NODE_SIG 0x10000
 
+/* Flags used to block (re)establishment of contact with a neighboring node */
 #define WAIT_PEER_DOWN  0x0001  /* wait to see that peer's links are down */
 #define WAIT_NAMES_GONE 0x0002  /* wait for peer's publications to be purged */
 #define WAIT_NODE_DOWN  0x0004  /* wait until peer node is declared down */
@@ -61,18 +65,19 @@
  * @block_setup: bit mask of conditions preventing link establishment to node
  * @link_cnt: number of links to node
  * @permit_changeover: non-zero if node has redundant links to this system
+ * @signature: node instance identifier
  * @bclink: broadcast-related info
+ *    @supportable: non-zero if node supports TIPC b'cast link capability
  *    @supported: non-zero if node supports TIPC b'cast capability
  *    @acked: sequence # of last outbound b'cast message acknowledged by node
  *    @last_in: sequence # of last in-sequence b'cast message received from node
- *    @gap_after: sequence # of last message not requiring a NAK request
- *    @gap_to: sequence # of last message requiring a NAK request
- *    @nack_sync: counter that determines when NAK requests should be sent
+ *    @last_sent: sequence # of last b'cast message sent by node
+ *    @oos_state: state tracker for handling OOS b'cast messages
+ *    @deferred_size: number of OOS b'cast messages in deferred queue
  *    @deferred_head: oldest OOS b'cast message received from node
  *    @deferred_tail: newest OOS b'cast message received from node
  *    @defragm: list of partially reassembled b'cast message fragments from node
  */
-
 struct tipc_node {
         u32 addr;
         spinlock_t lock;
@@ -85,35 +90,23 @@ struct tipc_node {
         int working_links;
         int block_setup;
         int permit_changeover;
+        u32 signature;
         struct {
-                int supported;
+                u8 supportable;
+                u8 supported;
                 u32 acked;
                 u32 last_in;
-                u32 gap_after;
-                u32 gap_to;
-                u32 nack_sync;
+                u32 last_sent;
+                u32 oos_state;
+                u32 deferred_size;
                 struct sk_buff *deferred_head;
                 struct sk_buff *deferred_tail;
                 struct sk_buff *defragm;
         } bclink;
 };
 
-#define NODE_HTABLE_SIZE 512
 extern struct list_head tipc_node_list;
 
-/*
- * A trivial power-of-two bitmask technique is used for speed, since this
- * operation is done for every incoming TIPC packet. The number of hash table
- * entries has been chosen so that no hash chain exceeds 8 nodes and will
- * usually be much smaller (typically only a single node).
- */
-static inline unsigned int tipc_hashfn(u32 addr)
-{
-        return addr & (NODE_HTABLE_SIZE - 1);
-}
-
-extern u32 tipc_own_tag;
-
 struct tipc_node *tipc_node_find(u32 addr);
 struct tipc_node *tipc_node_create(u32 addr);
 void tipc_node_delete(struct tipc_node *n_ptr);
diff --git a/net/tipc/node_subscr.c b/net/tipc/node_subscr.c
index c3c2815ae630..7a27344108fe 100644
--- a/net/tipc/node_subscr.c
+++ b/net/tipc/node_subscr.c
@@ -41,11 +41,10 @@
 /**
  * tipc_nodesub_subscribe - create "node down" subscription for specified node
  */
-
 void tipc_nodesub_subscribe(struct tipc_node_subscr *node_sub, u32 addr,
                        void *usr_handle, net_ev_handler handle_down)
 {
-        if (addr == tipc_own_addr) {
+        if (in_own_node(addr)) {
                 node_sub->node = NULL;
                 return;
         }
@@ -66,7 +65,6 @@ void tipc_nodesub_subscribe(struct tipc_node_subscr *node_sub, u32 addr,
 /**
  * tipc_nodesub_unsubscribe - cancel "node down" subscription (if any)
  */
-
 void tipc_nodesub_unsubscribe(struct tipc_node_subscr *node_sub)
 {
         if (!node_sub->node)
@@ -82,7 +80,6 @@ void tipc_nodesub_unsubscribe(struct tipc_node_subscr *node_sub)
  *
  * Note: node is locked by caller
  */
-
 void tipc_nodesub_notify(struct tipc_node *node)
 {
         struct tipc_node_subscr *ns;
diff --git a/net/tipc/node_subscr.h b/net/tipc/node_subscr.h
index 4bc2ca0867a1..c95d20727ded 100644
--- a/net/tipc/node_subscr.h
+++ b/net/tipc/node_subscr.h
@@ -48,7 +48,6 @@ typedef void (*net_ev_handler) (void *usr_handle);
  * @usr_handle: argument to pass to routine when node fails
  * @nodesub_list: adjacent entries in list of subscriptions for the node
  */
-
 struct tipc_node_subscr {
         struct tipc_node *node;
         net_ev_handler handle_node_down;
diff --git a/net/tipc/port.c b/net/tipc/port.c
index d91efc69e6f9..2ad37a4db376 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -69,10 +69,30 @@ static u32 port_peerport(struct tipc_port *p_ptr)
         return msg_destport(&p_ptr->phdr);
 }
 
+/*
+ * tipc_port_peer_msg - verify message was sent by connected port's peer
+ *
+ * Handles cases where the node's network address has changed from
+ * the default of <0.0.0> to its configured setting.
+ */
+int tipc_port_peer_msg(struct tipc_port *p_ptr, struct tipc_msg *msg)
+{
+        u32 peernode;
+        u32 orignode;
+
+        if (msg_origport(msg) != port_peerport(p_ptr))
+                return 0;
+
+        orignode = msg_orignode(msg);
+        peernode = port_peernode(p_ptr);
+        return (orignode == peernode) ||
+                (!orignode && (peernode == tipc_own_addr)) ||
+                (!peernode && (orignode == tipc_own_addr));
+}
+
 /**
  * tipc_multicast - send a multicast message to local and remote destinations
  */
-
 int tipc_multicast(u32 ref, struct tipc_name_seq const *seq,
                    u32 num_sect, struct iovec const *msg_sect,
                    unsigned int total_len)
@@ -89,7 +109,6 @@ int tipc_multicast(u32 ref, struct tipc_name_seq const *seq,
                 return -EINVAL;
 
         /* Create multicast message */
-
         hdr = &oport->phdr;
         msg_set_type(hdr, TIPC_MCAST_MSG);
         msg_set_lookup_scope(hdr, TIPC_CLUSTER_SCOPE);
@@ -105,24 +124,22 @@ int tipc_multicast(u32 ref, struct tipc_name_seq const *seq,
                 return res;
 
         /* Figure out where to send multicast message */
-
         ext_targets = tipc_nametbl_mc_translate(seq->type, seq->lower, seq->upper,
                                                 TIPC_NODE_SCOPE, &dports);
 
         /* Send message to destinations (duplicate it only if necessary) */
-
         if (ext_targets) {
                 if (dports.count != 0) {
                         ibuf = skb_copy(buf, GFP_ATOMIC);
                         if (ibuf == NULL) {
                                 tipc_port_list_free(&dports);
-                                buf_discard(buf);
+                                kfree_skb(buf);
                                 return -ENOMEM;
                         }
                 }
                 res = tipc_bclink_send_msg(buf);
                 if ((res < 0) && (dports.count != 0))
-                        buf_discard(ibuf);
+                        kfree_skb(ibuf);
         } else {
                 ibuf = buf;
         }
@@ -141,7 +158,6 @@ int tipc_multicast(u32 ref, struct tipc_name_seq const *seq,
  *
  * If there is no port list, perform a lookup to create one
  */
-
 void tipc_port_recv_mcast(struct sk_buff *buf, struct tipc_port_list *dp)
 {
         struct tipc_msg *msg;
@@ -152,7 +168,6 @@ void tipc_port_recv_mcast(struct sk_buff *buf, struct tipc_port_list *dp)
         msg = buf_msg(buf);
 
         /* Create destination port list, if one wasn't supplied */
-
         if (dp == NULL) {
                 tipc_nametbl_mc_translate(msg_nametype(msg),
                                      msg_namelower(msg),
@@ -163,7 +178,6 @@ void tipc_port_recv_mcast(struct sk_buff *buf, struct tipc_port_list *dp)
         }
 
         /* Deliver a copy of message to each destination port */
-
         if (dp->count != 0) {
                 msg_set_destnode(msg, tipc_own_addr);
                 if (dp->count == 1) {
@@ -187,7 +201,7 @@ void tipc_port_recv_mcast(struct sk_buff *buf, struct tipc_port_list *dp)
                 }
         }
 exit:
-        buf_discard(buf);
+        kfree_skb(buf);
         tipc_port_list_free(dp);
 }
 
@@ -196,7 +210,6 @@ exit:
  *
  * Returns pointer to (locked) TIPC port, or NULL if unable to create it
  */
-
 struct tipc_port *tipc_createport_raw(void *usr_handle,
                         u32 (*dispatcher)(struct tipc_port *, struct sk_buff *),
                         void (*wakeup)(struct tipc_port *),
@@ -221,18 +234,24 @@ struct tipc_port *tipc_createport_raw(void *usr_handle,
         p_ptr->usr_handle = usr_handle;
         p_ptr->max_pkt = MAX_PKT_DEFAULT;
         p_ptr->ref = ref;
-        msg = &p_ptr->phdr;
-        tipc_msg_init(msg, importance, TIPC_NAMED_MSG, NAMED_H_SIZE, 0);
-        msg_set_origport(msg, ref);
         INIT_LIST_HEAD(&p_ptr->wait_list);
         INIT_LIST_HEAD(&p_ptr->subscription.nodesub_list);
         p_ptr->dispatcher = dispatcher;
         p_ptr->wakeup = wakeup;
         p_ptr->user_port = NULL;
         k_init_timer(&p_ptr->timer, (Handler)port_timeout, ref);
-        spin_lock_bh(&tipc_port_list_lock);
         INIT_LIST_HEAD(&p_ptr->publications);
         INIT_LIST_HEAD(&p_ptr->port_list);
+
+        /*
+         * Must hold port list lock while initializing message header template
+         * to ensure a change to node's own network address doesn't result
+         * in template containing out-dated network address information
+         */
+        spin_lock_bh(&tipc_port_list_lock);
+        msg = &p_ptr->phdr;
+        tipc_msg_init(msg, importance, TIPC_NAMED_MSG, NAMED_H_SIZE, 0);
+        msg_set_origport(msg, ref);
         list_add_tail(&p_ptr->port_list, &ports);
         spin_unlock_bh(&tipc_port_list_lock);
         return p_ptr;
@@ -361,7 +380,6 @@ int tipc_reject_msg(struct sk_buff *buf, u32 err)
         u32 rmsg_sz;
 
         /* discard rejected message if it shouldn't be returned to sender */
-
         if (WARN(!msg_isdata(msg),
                  "attempt to reject message with user=%u", msg_user(msg))) {
                 dump_stack();
@@ -374,7 +392,6 @@ int tipc_reject_msg(struct sk_buff *buf, u32 err)
          * construct returned message by copying rejected message header and
          * data (or subset), then updating header fields that need adjusting
          */
-
         hdr_sz = msg_hdr_sz(msg);
         rmsg_sz = hdr_sz + min_t(u32, data_sz, MAX_REJECT_SIZE);
 
@@ -400,26 +417,26 @@ int tipc_reject_msg(struct sk_buff *buf, u32 err)
 
         /* send self-abort message when rejecting on a connected port */
         if (msg_connected(msg)) {
-                struct sk_buff *abuf = NULL;
                 struct tipc_port *p_ptr = tipc_port_lock(msg_destport(msg));
 
                 if (p_ptr) {
+                        struct sk_buff *abuf = NULL;
+
                         if (p_ptr->connected)
                                 abuf = port_build_self_abort_msg(p_ptr, err);
                         tipc_port_unlock(p_ptr);
+                        tipc_net_route_msg(abuf);
                 }
-                tipc_net_route_msg(abuf);
         }
 
         /* send returned message & dispose of rejected message */
-
         src_node = msg_prevnode(msg);
-        if (src_node == tipc_own_addr)
+        if (in_own_node(src_node))
                 tipc_port_recv_msg(rbuf);
         else
                 tipc_link_send(rbuf, src_node, msg_link_selector(rmsg));
 exit:
-        buf_discard(buf);
+        kfree_skb(buf);
         return data_sz;
 }
 
@@ -518,25 +535,20 @@ void tipc_port_recv_proto_msg(struct sk_buff *buf)
         struct tipc_msg *msg = buf_msg(buf);
         struct tipc_port *p_ptr;
         struct sk_buff *r_buf = NULL;
-        u32 orignode = msg_orignode(msg);
-        u32 origport = msg_origport(msg);
         u32 destport = msg_destport(msg);
         int wakeable;
 
         /* Validate connection */
-
         p_ptr = tipc_port_lock(destport);
-        if (!p_ptr || !p_ptr->connected ||
-            (port_peernode(p_ptr) != orignode) ||
-            (port_peerport(p_ptr) != origport)) {
+        if (!p_ptr || !p_ptr->connected || !tipc_port_peer_msg(p_ptr, msg)) {
                 r_buf = tipc_buf_acquire(BASIC_H_SIZE);
                 if (r_buf) {
                         msg = buf_msg(r_buf);
                         tipc_msg_init(msg, TIPC_HIGH_IMPORTANCE, TIPC_CONN_MSG,
-                                      BASIC_H_SIZE, orignode);
+                                      BASIC_H_SIZE, msg_orignode(msg));
                         msg_set_errcode(msg, TIPC_ERR_NO_PORT);
                         msg_set_origport(msg, destport);
-                        msg_set_destport(msg, origport);
+                        msg_set_destport(msg, msg_origport(msg));
                 }
                 if (p_ptr)
                         tipc_port_unlock(p_ptr);
@@ -544,7 +556,6 @@ void tipc_port_recv_proto_msg(struct sk_buff *buf)
         }
 
         /* Process protocol message sent by peer */
-
         switch (msg_type(msg)) {
         case CONN_ACK:
                 wakeable = tipc_port_congested(p_ptr) && p_ptr->congested &&
@@ -567,7 +578,7 @@ void tipc_port_recv_proto_msg(struct sk_buff *buf)
         tipc_port_unlock(p_ptr);
 exit:
         tipc_net_route_msg(r_buf);
-        buf_discard(buf);
+        kfree_skb(buf);
 }
 
 static void port_print(struct tipc_port *p_ptr, struct print_buf *buf, int full_id)
@@ -645,8 +656,6 @@ void tipc_port_reinit(void)
         spin_lock_bh(&tipc_port_list_lock);
         list_for_each_entry(p_ptr, &ports, port_list) {
                 msg = &p_ptr->phdr;
-                if (msg_orignode(msg) == tipc_own_addr)
-                        break;
                 msg_set_prevnode(msg, tipc_own_addr);
                 msg_set_orignode(msg, tipc_own_addr);
         }
@@ -658,7 +667,6 @@ void tipc_port_reinit(void)
  *  port_dispatcher_sigh(): Signal handler for messages destinated
  *                          to the tipc_port interface.
  */
-
 static void port_dispatcher_sigh(void *dummy)
 {
         struct sk_buff *buf;
@@ -675,6 +683,7 @@ static void port_dispatcher_sigh(void *dummy)
                 struct tipc_name_seq dseq;
                 void *usr_handle;
                 int connected;
+                int peer_invalid;
                 int published;
                 u32 message_type;
 
@@ -695,6 +704,7 @@ static void port_dispatcher_sigh(void *dummy)
                 up_ptr = p_ptr->user_port;
                 usr_handle = up_ptr->usr_handle;
                 connected = p_ptr->connected;
+                peer_invalid = connected && !tipc_port_peer_msg(p_ptr, msg);
                 published = p_ptr->published;
 
                 if (unlikely(msg_errcode(msg)))
@@ -704,8 +714,6 @@ static void port_dispatcher_sigh(void *dummy)
 
                 case TIPC_CONN_MSG:{
                                 tipc_conn_msg_event cb = up_ptr->conn_msg_cb;
-                                u32 peer_port = port_peerport(p_ptr);
-                                u32 peer_node = port_peernode(p_ptr);
                                 u32 dsz;
 
                                 tipc_port_unlock(p_ptr);
@@ -714,8 +722,7 @@ static void port_dispatcher_sigh(void *dummy)
                                 if (unlikely(!connected)) {
                                         if (tipc_connect2port(dref, &orig))
                                                 goto reject;
-                                } else if ((msg_origport(msg) != peer_port) ||
-                                           (msg_orignode(msg) != peer_node))
+                                } else if (peer_invalid)
                                         goto reject;
                                 dsz = msg_data_sz(msg);
                                 if (unlikely(dsz &&
@@ -758,7 +765,7 @@ static void port_dispatcher_sigh(void *dummy)
                         }
                 }
                 if (buf)
-                        buf_discard(buf);
+                        kfree_skb(buf);
                 buf = next;
                 continue;
 err:
@@ -767,14 +774,9 @@ err:
                 case TIPC_CONN_MSG:{
                                 tipc_conn_shutdown_event cb =
                                         up_ptr->conn_err_cb;
-                                u32 peer_port = port_peerport(p_ptr);
-                                u32 peer_node = port_peernode(p_ptr);
 
                                 tipc_port_unlock(p_ptr);
-                                if (!cb || !connected)
-                                        break;
-                                if ((msg_origport(msg) != peer_port) ||
-                                    (msg_orignode(msg) != peer_node))
+                                if (!cb || !connected || peer_invalid)
                                         break;
                                 tipc_disconnect(dref);
                                 skb_pull(buf, msg_hdr_sz(msg));
@@ -812,7 +814,7 @@ err:
                         }
                 }
                 if (buf)
-                        buf_discard(buf);
+                        kfree_skb(buf);
                 buf = next;
                 continue;
 reject:
@@ -825,7 +827,6 @@ reject:
  *  port_dispatcher(): Dispatcher for messages destinated
  *  to the tipc_port interface. Called with port locked.
  */
-
 static u32 port_dispatcher(struct tipc_port *dummy, struct sk_buff *buf)
 {
         buf->next = NULL;
@@ -842,10 +843,8 @@ static u32 port_dispatcher(struct tipc_port *dummy, struct sk_buff *buf)
 }
 
 /*
- * Wake up port after congestion: Called with port locked,
- *
+ * Wake up port after congestion: Called with port locked
  */
-
 static void port_wakeup_sh(unsigned long ref)
 {
         struct tipc_port *p_ptr;
@@ -891,7 +890,6 @@ void tipc_acknowledge(u32 ref, u32 ack)
 /*
  * tipc_createport(): user level call.
  */
-
 int tipc_createport(void *usr_handle,
                     unsigned int importance,
                     tipc_msg_err_event error_cb,
@@ -900,7 +898,7 @@ int tipc_createport(void *usr_handle,
                     tipc_msg_event msg_cb,
                     tipc_named_msg_event named_msg_cb,
                     tipc_conn_msg_event conn_msg_cb,
-                    tipc_continue_event continue_event_cb,/* May be zero */
+                    tipc_continue_event continue_event_cb, /* May be zero */
                     u32 *portref)
 {
         struct user_port *up_ptr;
@@ -974,10 +972,6 @@ int tipc_publish(u32 ref, unsigned int scope, struct tipc_name_seq const *seq)
 
         if (p_ptr->connected)
                 goto exit;
-        if (seq->lower > seq->upper)
-                goto exit;
-        if ((scope < TIPC_ZONE_SCOPE) || (scope > TIPC_NODE_SCOPE))
-                goto exit;
         key = ref + p_ptr->pub_count + 1;
         if (key == ref) {
                 res = -EADDRINUSE;
@@ -1053,8 +1047,6 @@ int tipc_connect2port(u32 ref, struct tipc_portid const *peer)
         msg = &p_ptr->phdr;
         msg_set_destnode(msg, peer->node);
         msg_set_destport(msg, peer->ref);
-        msg_set_orignode(msg, tipc_own_addr);
-        msg_set_origport(msg, p_ptr->ref);
         msg_set_type(msg, TIPC_CONN_MSG);
         msg_set_lookup_scope(msg, 0);
         msg_set_hdr_sz(msg, SHORT_H_SIZE);
@@ -1079,7 +1071,6 @@ exit:
  *
  * Port must be locked.
  */
-
 int tipc_disconnect_port(struct tipc_port *tp_ptr)
 {
         int res;
@@ -1100,7 +1091,6 @@ int tipc_disconnect_port(struct tipc_port *tp_ptr)
  * tipc_disconnect(): Disconnect port form peer.
  *                    This is a node local operation.
  */
-
 int tipc_disconnect(u32 ref)
 {
         struct tipc_port *p_ptr;
@@ -1132,11 +1122,41 @@ int tipc_shutdown(u32 ref)
         return tipc_disconnect(ref);
 }
 
+/**
+ * tipc_port_recv_msg - receive message from lower layer and deliver to port user
+ */
+int tipc_port_recv_msg(struct sk_buff *buf)
+{
+        struct tipc_port *p_ptr;
+        struct tipc_msg *msg = buf_msg(buf);
+        u32 destport = msg_destport(msg);
+        u32 dsz = msg_data_sz(msg);
+        u32 err;
+
+        /* forward unresolved named message */
+        if (unlikely(!destport)) {
+                tipc_net_route_msg(buf);
+                return dsz;
+        }
+
+        /* validate destination & pass to port, otherwise reject message */
+        p_ptr = tipc_port_lock(destport);
+        if (likely(p_ptr)) {
+                err = p_ptr->dispatcher(p_ptr, buf);
+                tipc_port_unlock(p_ptr);
+                if (likely(!err))
+                        return dsz;
+        } else {
+                err = TIPC_ERR_NO_PORT;
+        }
+
+        return tipc_reject_msg(buf, err);
+}
+
 /*
  *  tipc_port_recv_sections(): Concatenate and deliver sectioned
  *                        message for this node.
  */
-
 static int tipc_port_recv_sections(struct tipc_port *sender, unsigned int num_sect,
                                    struct iovec const *msg_sect,
                                    unsigned int total_len)
@@ -1154,7 +1174,6 @@ static int tipc_port_recv_sections(struct tipc_port *sender, unsigned int num_se
 /**
  * tipc_send - send message sections on connection
  */
-
 int tipc_send(u32 ref, unsigned int num_sect, struct iovec const *msg_sect,
               unsigned int total_len)
 {
@@ -1169,7 +1188,7 @@ int tipc_send(u32 ref, unsigned int num_sect, struct iovec const *msg_sect,
         p_ptr->congested = 1;
         if (!tipc_port_congested(p_ptr)) {
                 destnode = port_peernode(p_ptr);
-                if (likely(destnode != tipc_own_addr))
+                if (likely(!in_own_node(destnode)))
                         res = tipc_link_send_sections_fast(p_ptr, msg_sect, num_sect,
                                                            total_len, destnode);
                 else
@@ -1193,7 +1212,6 @@ int tipc_send(u32 ref, unsigned int num_sect, struct iovec const *msg_sect,
 /**
  * tipc_send2name - send message sections to port name
  */
-
 int tipc_send2name(u32 ref, struct tipc_name const *name, unsigned int domain,
                    unsigned int num_sect, struct iovec const *msg_sect,
                    unsigned int total_len)
@@ -1210,8 +1228,6 @@ int tipc_send2name(u32 ref, struct tipc_name const *name, unsigned int domain,
 
         msg = &p_ptr->phdr;
         msg_set_type(msg, TIPC_NAMED_MSG);
-        msg_set_orignode(msg, tipc_own_addr);
-        msg_set_origport(msg, ref);
         msg_set_hdr_sz(msg, NAMED_H_SIZE);
         msg_set_nametype(msg, name->type);
         msg_set_nameinst(msg, name->instance);
@@ -1220,14 +1236,18 @@ int tipc_send2name(u32 ref, struct tipc_name const *name, unsigned int domain,
         msg_set_destnode(msg, destnode);
         msg_set_destport(msg, destport);
 
-        if (likely(destport)) {
-                if (likely(destnode == tipc_own_addr))
+        if (likely(destport || destnode)) {
+                if (likely(in_own_node(destnode)))
                         res = tipc_port_recv_sections(p_ptr, num_sect,
                                                       msg_sect, total_len);
-                else
+                else if (tipc_own_addr)
                         res = tipc_link_send_sections_fast(p_ptr, msg_sect,
                                                            num_sect, total_len,
                                                            destnode);
+                else
+                        res = tipc_port_reject_sections(p_ptr, msg, msg_sect,
+                                                        num_sect, total_len,
+                                                        TIPC_ERR_NO_NODE);
                 if (likely(res != -ELINKCONG)) {
                         if (res > 0)
                                 p_ptr->sent++;
@@ -1245,7 +1265,6 @@ int tipc_send2name(u32 ref, struct tipc_name const *name, unsigned int domain,
 /**
  * tipc_send2port - send message sections to port identity
  */
-
 int tipc_send2port(u32 ref, struct tipc_portid const *dest,
                    unsigned int num_sect, struct iovec const *msg_sect,
                    unsigned int total_len)
@@ -1261,18 +1280,19 @@ int tipc_send2port(u32 ref, struct tipc_portid const *dest,
         msg = &p_ptr->phdr;
         msg_set_type(msg, TIPC_DIRECT_MSG);
         msg_set_lookup_scope(msg, 0);
-        msg_set_orignode(msg, tipc_own_addr);
-        msg_set_origport(msg, ref);
         msg_set_destnode(msg, dest->node);
         msg_set_destport(msg, dest->ref);
         msg_set_hdr_sz(msg, BASIC_H_SIZE);
 
-        if (dest->node == tipc_own_addr)
+        if (in_own_node(dest->node))
                 res =  tipc_port_recv_sections(p_ptr, num_sect, msg_sect,
                                                total_len);
-        else
+        else if (tipc_own_addr)
                 res = tipc_link_send_sections_fast(p_ptr, msg_sect, num_sect,
                                                    total_len, dest->node);
+        else
+                res = tipc_port_reject_sections(p_ptr, msg, msg_sect, num_sect,
+                                                total_len, TIPC_ERR_NO_NODE);
         if (likely(res != -ELINKCONG)) {
                 if (res > 0)
                         p_ptr->sent++;
@@ -1287,7 +1307,6 @@ int tipc_send2port(u32 ref, struct tipc_portid const *dest,
 /**
  * tipc_send_buf2port - send message buffer to port identity
  */
-
 int tipc_send_buf2port(u32 ref, struct tipc_portid const *dest,
                struct sk_buff *buf, unsigned int dsz)
 {
@@ -1301,8 +1320,6 @@ int tipc_send_buf2port(u32 ref, struct tipc_portid const *dest,
 
         msg = &p_ptr->phdr;
         msg_set_type(msg, TIPC_DIRECT_MSG);
-        msg_set_orignode(msg, tipc_own_addr);
-        msg_set_origport(msg, ref);
         msg_set_destnode(msg, dest->node);
         msg_set_destport(msg, dest->ref);
         msg_set_hdr_sz(msg, BASIC_H_SIZE);
@@ -1313,7 +1330,7 @@ int tipc_send_buf2port(u32 ref, struct tipc_portid const *dest,
         skb_push(buf, BASIC_H_SIZE);
         skb_copy_to_linear_data(buf, msg, BASIC_H_SIZE);
 
-        if (dest->node == tipc_own_addr)
+        if (in_own_node(dest->node))
                 res = tipc_port_recv_msg(buf);
         else
                 res = tipc_send_buf_fast(buf, dest->node);
@@ -1326,4 +1343,3 @@ int tipc_send_buf2port(u32 ref, struct tipc_portid const *dest,
                 return dsz;
         return -ELINKCONG;
 }
-
diff --git a/net/tipc/port.h b/net/tipc/port.h
index f751807e2a91..98cbec9c4532 100644
--- a/net/tipc/port.h
+++ b/net/tipc/port.h
@@ -81,7 +81,6 @@ typedef void (*tipc_continue_event) (void *usr_handle, u32 portref);
  * @ref: object reference to associated TIPC port
  * <various callback routines>
  */
-
 struct user_port {
         void *usr_handle;
         u32 ref;
@@ -201,10 +200,12 @@ int tipc_shutdown(u32 ref);
  * The following routines require that the port be locked on entry
  */
 int tipc_disconnect_port(struct tipc_port *tp_ptr);
+int tipc_port_peer_msg(struct tipc_port *p_ptr, struct tipc_msg *msg);
 
 /*
  * TIPC messaging routines
  */
+int tipc_port_recv_msg(struct sk_buff *buf);
 int tipc_send(u32 portref, unsigned int num_sect, struct iovec const *msg_sect,
               unsigned int total_len);
 
@@ -234,7 +235,6 @@ void tipc_port_reinit(void);
 /**
  * tipc_port_lock - lock port instance referred to and return its pointer
  */
-
 static inline struct tipc_port *tipc_port_lock(u32 ref)
 {
         return (struct tipc_port *)tipc_ref_lock(ref);
@@ -245,7 +245,6 @@ static inline struct tipc_port *tipc_port_lock(u32 ref)
  *
  * Can use pointer instead of tipc_ref_unlock() since port is already locked.
  */
-
 static inline void tipc_port_unlock(struct tipc_port *p_ptr)
 {
         spin_unlock_bh(p_ptr->lock);
@@ -256,60 +255,9 @@ static inline struct tipc_port *tipc_port_deref(u32 ref)
         return (struct tipc_port *)tipc_ref_deref(ref);
 }
 
-static inline u32 tipc_peer_port(struct tipc_port *p_ptr)
-{
-        return msg_destport(&p_ptr->phdr);
-}
-
-static inline u32 tipc_peer_node(struct tipc_port *p_ptr)
-{
-        return msg_destnode(&p_ptr->phdr);
-}
-
 static inline int tipc_port_congested(struct tipc_port *p_ptr)
 {
         return (p_ptr->sent - p_ptr->acked) >= (TIPC_FLOW_CONTROL_WIN * 2);
 }
 
-/**
- * tipc_port_recv_msg - receive message from lower layer and deliver to port user
- */
-
-static inline int tipc_port_recv_msg(struct sk_buff *buf)
-{
-        struct tipc_port *p_ptr;
-        struct tipc_msg *msg = buf_msg(buf);
-        u32 destport = msg_destport(msg);
-        u32 dsz = msg_data_sz(msg);
-        u32 err;
-
-        /* forward unresolved named message */
-        if (unlikely(!destport)) {
-                tipc_net_route_msg(buf);
-                return dsz;
-        }
-
-        /* validate destination & pass to port, otherwise reject message */
-        p_ptr = tipc_port_lock(destport);
-        if (likely(p_ptr)) {
-                if (likely(p_ptr->connected)) {
-                        if ((unlikely(msg_origport(msg) != tipc_peer_port(p_ptr))) ||
-                            (unlikely(msg_orignode(msg) != tipc_peer_node(p_ptr))) ||
-                            (unlikely(!msg_connected(msg)))) {
-                                err = TIPC_ERR_NO_PORT;
-                                tipc_port_unlock(p_ptr);
-                                goto reject;
-                        }
-                }
-                err = p_ptr->dispatcher(p_ptr, buf);
-                tipc_port_unlock(p_ptr);
-                if (likely(!err))
-                        return dsz;
-        } else {
-                err = TIPC_ERR_NO_PORT;
-        }
-reject:
-        return tipc_reject_msg(buf, err);
-}
-
 #endif
diff --git a/net/tipc/ref.c b/net/tipc/ref.c
index 9e37b7812c3c..5cada0e38e03 100644
--- a/net/tipc/ref.c
+++ b/net/tipc/ref.c
@@ -43,7 +43,6 @@
  * @lock: spinlock controlling access to object
  * @ref: reference value for object (combines instance & array index info)
  */
-
 struct reference {
         void *object;
         spinlock_t lock;
@@ -60,7 +59,6 @@ struct reference {
  * @index_mask: bitmask for array index portion of reference values
  * @start_mask: initial value for instance value portion of reference values
  */
-
 struct ref_table {
         struct reference *entries;
         u32 capacity;
@@ -96,7 +94,6 @@ static DEFINE_RWLOCK(ref_table_lock);
 /**
  * tipc_ref_table_init - create reference table for objects
  */
-
 int tipc_ref_table_init(u32 requested_size, u32 start)
 {
         struct reference *table;
@@ -109,7 +106,6 @@ int tipc_ref_table_init(u32 requested_size, u32 start)
                 /* do nothing */ ;
 
         /* allocate table & mark all entries as uninitialized */
-
         table = vzalloc(actual_size * sizeof(struct reference));
         if (table == NULL)
                 return -ENOMEM;
@@ -128,7 +124,6 @@ int tipc_ref_table_init(u32 requested_size, u32 start)
 /**
  * tipc_ref_table_stop - destroy reference table for objects
  */
-
 void tipc_ref_table_stop(void)
 {
         if (!tipc_ref_table.entries)
@@ -149,7 +144,6 @@ void tipc_ref_table_stop(void)
  * register a partially initialized object, without running the risk that
  * the object will be accessed before initialization is complete.
  */
-
 u32 tipc_ref_acquire(void *object, spinlock_t **lock)
 {
         u32 index;
@@ -168,7 +162,6 @@ u32 tipc_ref_acquire(void *object, spinlock_t **lock)
         }
 
         /* take a free entry, if available; otherwise initialize a new entry */
-
         write_lock_bh(&ref_table_lock);
         if (tipc_ref_table.first_free) {
                 index = tipc_ref_table.first_free;
@@ -211,7 +204,6 @@ u32 tipc_ref_acquire(void *object, spinlock_t **lock)
  * Disallow future references to an object and free up the entry for re-use.
  * Note: The entry's spin_lock may still be busy after discard
  */
-
 void tipc_ref_discard(u32 ref)
 {
         struct reference *entry;
@@ -242,12 +234,10 @@ void tipc_ref_discard(u32 ref)
          * mark entry as unused; increment instance part of entry's reference
          * to invalidate any subsequent references
          */
-
         entry->object = NULL;
         entry->ref = (ref & ~index_mask) + (index_mask + 1);
 
         /* append entry to free entry list */
-
         if (tipc_ref_table.first_free == 0)
                 tipc_ref_table.first_free = index;
         else
@@ -261,7 +251,6 @@ exit:
 /**
  * tipc_ref_lock - lock referenced object and return pointer to it
  */
-
 void *tipc_ref_lock(u32 ref)
 {
         if (likely(tipc_ref_table.entries)) {
@@ -283,7 +272,6 @@ void *tipc_ref_lock(u32 ref)
 /**
  * tipc_ref_deref - return pointer referenced object (without locking it)
  */
-
 void *tipc_ref_deref(u32 ref)
 {
         if (likely(tipc_ref_table.entries)) {
@@ -296,4 +284,3 @@ void *tipc_ref_deref(u32 ref)
         }
         return NULL;
 }
-
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index e2f7c5d370ba..5577a447f531 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -123,10 +123,9 @@ static atomic_t tipc_queue_size = ATOMIC_INIT(0);
  *
  * Caller must hold socket lock
  */
-
 static void advance_rx_queue(struct sock *sk)
 {
-        buf_discard(__skb_dequeue(&sk->sk_receive_queue));
+        kfree_skb(__skb_dequeue(&sk->sk_receive_queue));
         atomic_dec(&tipc_queue_size);
 }
 
@@ -135,14 +134,13 @@ static void advance_rx_queue(struct sock *sk)
  *
  * Caller must hold socket lock
  */
-
 static void discard_rx_queue(struct sock *sk)
 {
         struct sk_buff *buf;
 
         while ((buf = __skb_dequeue(&sk->sk_receive_queue))) {
                 atomic_dec(&tipc_queue_size);
-                buf_discard(buf);
+                kfree_skb(buf);
         }
 }
 
@@ -151,7 +149,6 @@ static void discard_rx_queue(struct sock *sk)
  *
  * Caller must hold socket lock
  */
-
 static void reject_rx_queue(struct sock *sk)
 {
         struct sk_buff *buf;
@@ -174,7 +171,6 @@ static void reject_rx_queue(struct sock *sk)
  *
  * Returns 0 on success, errno otherwise
  */
-
 static int tipc_create(struct net *net, struct socket *sock, int protocol,
                        int kern)
 {
@@ -184,7 +180,6 @@ static int tipc_create(struct net *net, struct socket *sock, int protocol,
         struct tipc_port *tp_ptr;
 
         /* Validate arguments */
-
         if (unlikely(protocol != 0))
                 return -EPROTONOSUPPORT;
 
@@ -207,13 +202,11 @@ static int tipc_create(struct net *net, struct socket *sock, int protocol,
         }
 
         /* Allocate socket's protocol area */
-
         sk = sk_alloc(net, AF_TIPC, GFP_KERNEL, &tipc_proto);
         if (sk == NULL)
                 return -ENOMEM;
 
         /* Allocate TIPC port for socket to use */
-
         tp_ptr = tipc_createport_raw(sk, &dispatch, &wakeupdispatch,
                                      TIPC_LOW_IMPORTANCE);
         if (unlikely(!tp_ptr)) {
@@ -222,7 +215,6 @@ static int tipc_create(struct net *net, struct socket *sock, int protocol,
         }
 
         /* Finish initializing socket data structures */
-
         sock->ops = ops;
         sock->state = state;
 
@@ -258,7 +250,6 @@ static int tipc_create(struct net *net, struct socket *sock, int protocol,
  *
  * Returns 0 on success, errno otherwise
  */
-
 static int release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
@@ -270,7 +261,6 @@ static int release(struct socket *sock)
          * Exit if socket isn't fully initialized (occurs when a failed accept()
          * releases a pre-allocated child socket that was never used)
          */
-
         if (sk == NULL)
                 return 0;
 
@@ -281,14 +271,13 @@ static int release(struct socket *sock)
          * Reject all unreceived messages, except on an active connection
          * (which disconnects locally & sends a 'FIN+' to peer)
          */
-
         while (sock->state != SS_DISCONNECTING) {
                 buf = __skb_dequeue(&sk->sk_receive_queue);
                 if (buf == NULL)
                         break;
                 atomic_dec(&tipc_queue_size);
                 if (TIPC_SKB_CB(buf)->handle != 0)
-                        buf_discard(buf);
+                        kfree_skb(buf);
                 else {
                         if ((sock->state == SS_CONNECTING) ||
                             (sock->state == SS_CONNECTED)) {
@@ -303,15 +292,12 @@ static int release(struct socket *sock)
          * Delete TIPC port; this ensures no more messages are queued
          * (also disconnects an active connection & sends a 'FIN-' to peer)
          */
-
         res = tipc_deleteport(tport->ref);
 
         /* Discard any remaining (connection-based) messages in receive queue */
-
         discard_rx_queue(sk);
 
         /* Reject any messages that accumulated in backlog queue */
-
         sock->state = SS_DISCONNECTING;
         release_sock(sk);
 
@@ -336,7 +322,6 @@ static int release(struct socket *sock)
  * NOTE: This routine doesn't need to take the socket lock since it doesn't
  *       access any non-constant socket information.
  */
-
 static int bind(struct socket *sock, struct sockaddr *uaddr, int uaddr_len)
 {
         struct sockaddr_tipc *addr = (struct sockaddr_tipc *)uaddr;
@@ -355,6 +340,9 @@ static int bind(struct socket *sock, struct sockaddr *uaddr, int uaddr_len)
         else if (addr->addrtype != TIPC_ADDR_NAMESEQ)
                 return -EAFNOSUPPORT;
 
+        if (addr->addr.nameseq.type < TIPC_RESERVED_TYPES)
+                return -EACCES;
+
         return (addr->scope > 0) ?
                 tipc_publish(portref, addr->scope, &addr->addr.nameseq) :
                 tipc_withdraw(portref, -addr->scope, &addr->addr.nameseq);
@@ -373,7 +361,6 @@ static int bind(struct socket *sock, struct sockaddr *uaddr, int uaddr_len)
  *       accesses socket information that is unchanging (or which changes in
  *       a completely predictable manner).
  */
-
 static int get_name(struct socket *sock, struct sockaddr *uaddr,
                     int *uaddr_len, int peer)
 {
@@ -441,7 +428,6 @@ static int get_name(struct socket *sock, struct sockaddr *uaddr,
  * imply that the operation will succeed, merely that it should be performed
  * and will not block.
  */
-
 static unsigned int poll(struct file *file, struct socket *sock,
                          poll_table *wait)
 {
@@ -479,7 +465,6 @@ static unsigned int poll(struct file *file, struct socket *sock,
  *
  * Returns 0 if permission is granted, otherwise errno
  */
-
 static int dest_name_check(struct sockaddr_tipc *dest, struct msghdr *m)
 {
         struct tipc_cfg_msg_hdr hdr;
@@ -515,7 +500,6 @@ static int dest_name_check(struct sockaddr_tipc *dest, struct msghdr *m)
  *
  * Returns the number of bytes sent on success, or errno otherwise
  */
-
 static int send_msg(struct kiocb *iocb, struct socket *sock,
                     struct msghdr *m, size_t total_len)
 {
@@ -532,7 +516,7 @@ static int send_msg(struct kiocb *iocb, struct socket *sock,
                      (dest->family != AF_TIPC)))
                 return -EINVAL;
         if ((total_len > TIPC_MAX_USER_MSG_SIZE) ||
-            (m->msg_iovlen > (unsigned)INT_MAX))
+            (m->msg_iovlen > (unsigned int)INT_MAX))
                 return -EMSGSIZE;
 
         if (iocb)
@@ -559,7 +543,6 @@ static int send_msg(struct kiocb *iocb, struct socket *sock,
                 }
 
                 /* Abort any pending connection attempts (very unlikely) */
-
                 reject_rx_queue(sk);
         }
 
@@ -628,7 +611,6 @@ exit:
  *
  * Returns the number of bytes sent on success, or errno otherwise
  */
-
 static int send_packet(struct kiocb *iocb, struct socket *sock,
                        struct msghdr *m, size_t total_len)
 {
@@ -639,12 +621,11 @@ static int send_packet(struct kiocb *iocb, struct socket *sock,
         int res;
 
         /* Handle implied connection establishment */
-
         if (unlikely(dest))
                 return send_msg(iocb, sock, m, total_len);
 
         if ((total_len > TIPC_MAX_USER_MSG_SIZE) ||
-            (m->msg_iovlen > (unsigned)INT_MAX))
+            (m->msg_iovlen > (unsigned int)INT_MAX))
                 return -EMSGSIZE;
 
         if (iocb)
@@ -692,7 +673,6 @@ static int send_packet(struct kiocb *iocb, struct socket *sock,
  * Returns the number of bytes sent on success (or partial success),
  * or errno if no data sent
  */
-
 static int send_stream(struct kiocb *iocb, struct socket *sock,
                        struct msghdr *m, size_t total_len)
 {
@@ -712,7 +692,6 @@ static int send_stream(struct kiocb *iocb, struct socket *sock,
         lock_sock(sk);
 
         /* Handle special cases where there is no connection */
-
         if (unlikely(sock->state != SS_CONNECTED)) {
                 if (sock->state == SS_UNCONNECTED) {
                         res = send_packet(NULL, sock, m, total_len);
@@ -731,8 +710,8 @@ static int send_stream(struct kiocb *iocb, struct socket *sock,
                 goto exit;
         }
 
-        if ((total_len > (unsigned)INT_MAX) ||
-            (m->msg_iovlen > (unsigned)INT_MAX)) {
+        if ((total_len > (unsigned int)INT_MAX) ||
+            (m->msg_iovlen > (unsigned int)INT_MAX)) {
                 res = -EMSGSIZE;
                 goto exit;
         }
@@ -744,7 +723,6 @@ static int send_stream(struct kiocb *iocb, struct socket *sock,
          * (i.e. one large iovec entry), but could be improved to pass sets
          * of small iovec entries into send_packet().
          */
-
         curr_iov = m->msg_iov;
         curr_iovlen = m->msg_iovlen;
         my_msg.msg_iov = &my_iov;
@@ -793,7 +771,6 @@ exit:
  *
  * Returns 0 on success, errno otherwise
  */
-
 static int auto_connect(struct socket *sock, struct tipc_msg *msg)
 {
         struct tipc_sock *tsock = tipc_sk(sock->sk);
@@ -818,7 +795,6 @@ static int auto_connect(struct socket *sock, struct tipc_msg *msg)
  *
  * Note: Address is not captured if not requested by receiver.
  */
-
 static void set_orig_addr(struct msghdr *m, struct tipc_msg *msg)
 {
         struct sockaddr_tipc *addr = (struct sockaddr_tipc *)m->msg_name;
@@ -844,7 +820,6 @@ static void set_orig_addr(struct msghdr *m, struct tipc_msg *msg)
  *
  * Returns 0 if successful, otherwise errno
  */
-
 static int anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
                                 struct tipc_port *tport)
 {
@@ -858,7 +833,6 @@ static int anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
                 return 0;
 
         /* Optionally capture errored message object(s) */
-
         err = msg ? msg_errcode(msg) : 0;
         if (unlikely(err)) {
                 anc_data[0] = err;
@@ -875,7 +849,6 @@ static int anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
         }
 
         /* Optionally capture message destination object */
-
         dest_type = msg ? msg_type(msg) : TIPC_DIRECT_MSG;
         switch (dest_type) {
         case TIPC_NAMED_MSG:
@@ -920,7 +893,6 @@ static int anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
  *
  * Returns size of returned message data, errno otherwise
  */
-
 static int recv_msg(struct kiocb *iocb, struct socket *sock,
                     struct msghdr *m, size_t buf_len, int flags)
 {
@@ -934,7 +906,6 @@ static int recv_msg(struct kiocb *iocb, struct socket *sock,
         int res;
 
         /* Catch invalid receive requests */
-
         if (unlikely(!buf_len))
                 return -EINVAL;
 
@@ -949,7 +920,6 @@ static int recv_msg(struct kiocb *iocb, struct socket *sock,
 restart:
 
         /* Look for a message in receive queue; wait if necessary */
-
         while (skb_queue_empty(&sk->sk_receive_queue)) {
                 if (sock->state == SS_DISCONNECTING) {
                         res = -ENOTCONN;
@@ -967,14 +937,12 @@ restart:
         }
 
         /* Look at first message in receive queue */
-
         buf = skb_peek(&sk->sk_receive_queue);
         msg = buf_msg(buf);
         sz = msg_data_sz(msg);
         err = msg_errcode(msg);
 
         /* Complete connection setup for an implied connect */
-
         if (unlikely(sock->state == SS_CONNECTING)) {
                 res = auto_connect(sock, msg);
                 if (res)
@@ -982,24 +950,20 @@ restart:
         }
 
         /* Discard an empty non-errored message & try again */
-
         if ((!sz) && (!err)) {
                 advance_rx_queue(sk);
                 goto restart;
         }
 
         /* Capture sender's address (optional) */
-
         set_orig_addr(m, msg);
 
         /* Capture ancillary data (optional) */
-
         res = anc_data_recv(m, msg, tport);
         if (res)
                 goto exit;
 
         /* Capture message data (if valid) & compute return value (always) */
-
         if (!err) {
                 if (unlikely(buf_len < sz)) {
                         sz = buf_len;
@@ -1019,7 +983,6 @@ restart:
         }
 
         /* Consume received message (optional) */
-
         if (likely(!(flags & MSG_PEEK))) {
                 if ((sock->state != SS_READY) &&
                     (++tport->conn_unacked >= TIPC_FLOW_CONTROL_WIN))
@@ -1043,7 +1006,6 @@ exit:
  *
  * Returns size of returned message data, errno otherwise
  */
-
 static int recv_stream(struct kiocb *iocb, struct socket *sock,
                        struct msghdr *m, size_t buf_len, int flags)
 {
@@ -1059,7 +1021,6 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
         int res = 0;
 
         /* Catch invalid receive attempts */
-
         if (unlikely(!buf_len))
                 return -EINVAL;
 
@@ -1073,10 +1034,9 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
 
         target = sock_rcvlowat(sk, flags & MSG_WAITALL, buf_len);
         timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
-restart:
 
+restart:
         /* Look for a message in receive queue; wait if necessary */
-
         while (skb_queue_empty(&sk->sk_receive_queue)) {
                 if (sock->state == SS_DISCONNECTING) {
                         res = -ENOTCONN;
@@ -1094,21 +1054,18 @@ restart:
         }
 
         /* Look at first message in receive queue */
-
         buf = skb_peek(&sk->sk_receive_queue);
         msg = buf_msg(buf);
         sz = msg_data_sz(msg);
         err = msg_errcode(msg);
 
         /* Discard an empty non-errored message & try again */
-
         if ((!sz) && (!err)) {
                 advance_rx_queue(sk);
                 goto restart;
         }
 
         /* Optionally capture sender's address & ancillary data of first msg */
-
         if (sz_copied == 0) {
                 set_orig_addr(m, msg);
                 res = anc_data_recv(m, msg, tport);
@@ -1117,7 +1074,6 @@ restart:
         }
 
         /* Capture message data (if valid) & compute return value (always) */
-
         if (!err) {
                 u32 offset = (u32)(unsigned long)(TIPC_SKB_CB(buf)->handle);
 
@@ -1149,7 +1105,6 @@ restart:
         }
 
         /* Consume received message (optional) */
-
         if (likely(!(flags & MSG_PEEK))) {
                 if (unlikely(++tport->conn_unacked >= TIPC_FLOW_CONTROL_WIN))
                         tipc_acknowledge(tport->ref, tport->conn_unacked);
@@ -1157,7 +1112,6 @@ restart:
         }
 
         /* Loop around if more data is required */
-
         if ((sz_copied < buf_len) &&    /* didn't get all requested data */
             (!skb_queue_empty(&sk->sk_receive_queue) ||
             (sz_copied < target)) &&    /* and more is ready or required */
@@ -1178,7 +1132,6 @@ exit:
  *
  * Returns 1 if queue is unable to accept message, 0 otherwise
  */
-
 static int rx_queue_full(struct tipc_msg *msg, u32 queue_size, u32 base)
 {
         u32 threshold;
@@ -1211,7 +1164,6 @@ static int rx_queue_full(struct tipc_msg *msg, u32 queue_size, u32 base)
  *
  * Returns TIPC error status code (TIPC_OK if message is not to be rejected)
  */
-
 static u32 filter_rcv(struct sock *sk, struct sk_buff *buf)
 {
         struct socket *sock = sk->sk_socket;
@@ -1219,12 +1171,8 @@ static u32 filter_rcv(struct sock *sk, struct sk_buff *buf)
         u32 recv_q_len;
 
         /* Reject message if it is wrong sort of message for socket */
-
-        /*
-         * WOULD IT BE BETTER TO JUST DISCARD THESE MESSAGES INSTEAD?
-         * "NO PORT" ISN'T REALLY THE RIGHT ERROR CODE, AND THERE MAY
-         * BE SECURITY IMPLICATIONS INHERENT IN REJECTING INVALID TRAFFIC
-         */
+        if (msg_type(msg) > TIPC_DIRECT_MSG)
+                return TIPC_ERR_NO_PORT;
 
         if (sock->state == SS_READY) {
                 if (msg_connected(msg))
@@ -1233,7 +1181,8 @@ static u32 filter_rcv(struct sock *sk, struct sk_buff *buf)
                 if (msg_mcast(msg))
                         return TIPC_ERR_NO_PORT;
                 if (sock->state == SS_CONNECTED) {
-                        if (!msg_connected(msg))
+                        if (!msg_connected(msg) ||
+                            !tipc_port_peer_msg(tipc_sk_port(sk), msg))
                                 return TIPC_ERR_NO_PORT;
                 } else if (sock->state == SS_CONNECTING) {
                         if (!msg_connected(msg) && (msg_errcode(msg) == 0))
@@ -1250,7 +1199,6 @@ static u32 filter_rcv(struct sock *sk, struct sk_buff *buf)
         }
 
         /* Reject message if there isn't room to queue it */
-
         recv_q_len = (u32)atomic_read(&tipc_queue_size);
         if (unlikely(recv_q_len >= OVERLOAD_LIMIT_BASE)) {
                 if (rx_queue_full(msg, recv_q_len, OVERLOAD_LIMIT_BASE))
@@ -1263,13 +1211,11 @@ static u32 filter_rcv(struct sock *sk, struct sk_buff *buf)
         }
 
         /* Enqueue message (finally!) */
-
         TIPC_SKB_CB(buf)->handle = 0;
         atomic_inc(&tipc_queue_size);
         __skb_queue_tail(&sk->sk_receive_queue, buf);
 
         /* Initiate connection termination for an incoming 'FIN' */
-
         if (unlikely(msg_errcode(msg) && (sock->state == SS_CONNECTED))) {
                 sock->state = SS_DISCONNECTING;
                 tipc_disconnect_port(tipc_sk_port(sk));
@@ -1289,7 +1235,6 @@ static u32 filter_rcv(struct sock *sk, struct sk_buff *buf)
  *
  * Returns 0
  */
-
 static int backlog_rcv(struct sock *sk, struct sk_buff *buf)
 {
         u32 res;
@@ -1309,7 +1254,6 @@ static int backlog_rcv(struct sock *sk, struct sk_buff *buf)
  *
  * Returns TIPC error status code (TIPC_OK if message is not to be rejected)
  */
-
 static u32 dispatch(struct tipc_port *tport, struct sk_buff *buf)
 {
         struct sock *sk = (struct sock *)tport->usr_handle;
@@ -1321,12 +1265,11 @@ static u32 dispatch(struct tipc_port *tport, struct sk_buff *buf)
          * This code is based on sk_receive_skb(), but must be distinct from it
          * since a TIPC-specific filter/reject mechanism is utilized
          */
-
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk)) {
                 res = filter_rcv(sk, buf);
         } else {
-                if (sk_add_backlog(sk, buf))
+                if (sk_add_backlog(sk, buf, sk->sk_rcvbuf))
                         res = TIPC_ERR_OVERLOAD;
                 else
                         res = TIPC_OK;
@@ -1342,7 +1285,6 @@ static u32 dispatch(struct tipc_port *tport, struct sk_buff *buf)
  *
  * Called with port lock already taken.
  */
-
 static void wakeupdispatch(struct tipc_port *tport)
 {
         struct sock *sk = (struct sock *)tport->usr_handle;
@@ -1360,7 +1302,6 @@ static void wakeupdispatch(struct tipc_port *tport)
  *
  * Returns 0 on success, errno otherwise
  */
-
 static int connect(struct socket *sock, struct sockaddr *dest, int destlen,
                    int flags)
 {
@@ -1375,21 +1316,18 @@ static int connect(struct socket *sock, struct sockaddr *dest, int destlen,
         lock_sock(sk);
 
         /* For now, TIPC does not allow use of connect() with DGRAM/RDM types */
-
         if (sock->state == SS_READY) {
                 res = -EOPNOTSUPP;
                 goto exit;
         }
 
         /* For now, TIPC does not support the non-blocking form of connect() */
-
         if (flags & O_NONBLOCK) {
                 res = -EOPNOTSUPP;
                 goto exit;
         }
 
         /* Issue Posix-compliant error code if socket is in the wrong state */
-
         if (sock->state == SS_LISTENING) {
                 res = -EOPNOTSUPP;
                 goto exit;
@@ -1409,18 +1347,15 @@ static int connect(struct socket *sock, struct sockaddr *dest, int destlen,
          * Note: send_msg() validates the rest of the address fields,
          *       so there's no need to do it here
          */
-
         if (dst->addrtype == TIPC_ADDR_MCAST) {
                 res = -EINVAL;
                 goto exit;
         }
 
         /* Reject any messages already in receive queue (very unlikely) */
-
         reject_rx_queue(sk);
 
         /* Send a 'SYN-' to destination */
-
         m.msg_name = dest;
         m.msg_namelen = destlen;
         res = send_msg(NULL, sock, &m, 0);
@@ -1428,7 +1363,6 @@ static int connect(struct socket *sock, struct sockaddr *dest, int destlen,
                 goto exit;
 
         /* Wait until an 'ACK' or 'RST' arrives, or a timeout occurs */
-
         timeout = tipc_sk(sk)->conn_timeout;
         release_sock(sk);
         res = wait_event_interruptible_timeout(*sk_sleep(sk),
@@ -1473,7 +1407,6 @@ exit:
  *
  * Returns 0 on success, errno otherwise
  */
-
 static int listen(struct socket *sock, int len)
 {
         struct sock *sk = sock->sk;
@@ -1500,7 +1433,6 @@ static int listen(struct socket *sock, int len)
  *
  * Returns 0 on success, errno otherwise
  */
-
 static int accept(struct socket *sock, struct socket *new_sock, int flags)
 {
         struct sock *sk = sock->sk;
@@ -1543,11 +1475,9 @@ static int accept(struct socket *sock, struct socket *new_sock, int flags)
                  * Reject any stray messages received by new socket
                  * before the socket lock was taken (very, very unlikely)
                  */
-
                 reject_rx_queue(new_sk);
 
                 /* Connect new socket to it's peer */
-
                 new_tsock->peer_name.ref = msg_origport(msg);
                 new_tsock->peer_name.node = msg_orignode(msg);
                 tipc_connect2port(new_ref, &new_tsock->peer_name);
@@ -1563,7 +1493,6 @@ static int accept(struct socket *sock, struct socket *new_sock, int flags)
                  * Respond to 'SYN-' by discarding it & returning 'ACK'-.
                  * Respond to 'SYN+' by queuing it on new socket.
                  */
-
                 if (!msg_data_sz(msg)) {
                         struct msghdr m = {NULL,};
 
@@ -1589,7 +1518,6 @@ exit:
  *
  * Returns 0 on success, errno otherwise
  */
-
 static int shutdown(struct socket *sock, int how)
 {
         struct sock *sk = sock->sk;
@@ -1606,13 +1534,13 @@ static int shutdown(struct socket *sock, int how)
         case SS_CONNECTING:
         case SS_CONNECTED:
 
-                /* Disconnect and send a 'FIN+' or 'FIN-' message to peer */
 restart:
+                /* Disconnect and send a 'FIN+' or 'FIN-' message to peer */
                 buf = __skb_dequeue(&sk->sk_receive_queue);
                 if (buf) {
                         atomic_dec(&tipc_queue_size);
                         if (TIPC_SKB_CB(buf)->handle != 0) {
-                                buf_discard(buf);
+                                kfree_skb(buf);
                                 goto restart;
                         }
                         tipc_disconnect(tport->ref);
@@ -1628,7 +1556,6 @@ restart:
         case SS_DISCONNECTING:
 
                 /* Discard any unreceived messages; wake up sleeping tasks */
-
                 discard_rx_queue(sk);
                 if (waitqueue_active(sk_sleep(sk)))
                         wake_up_interruptible(sk_sleep(sk));
@@ -1656,7 +1583,6 @@ restart:
  *
  * Returns 0 on success, errno otherwise
  */
-
 static int setsockopt(struct socket *sock,
                       int lvl, int opt, char __user *ov, unsigned int ol)
 {
@@ -1716,7 +1642,6 @@ static int setsockopt(struct socket *sock,
  *
  * Returns 0 on success, errno otherwise
  */
-
 static int getsockopt(struct socket *sock,
                       int lvl, int opt, char __user *ov, int __user *ol)
 {
@@ -1777,7 +1702,6 @@ static int getsockopt(struct socket *sock,
 /**
  * Protocol switches for the various types of TIPC sockets
  */
-
 static const struct proto_ops msg_ops = {
         .owner          = THIS_MODULE,
         .family         = AF_TIPC,
@@ -1883,7 +1807,6 @@ int tipc_socket_init(void)
 /**
  * tipc_socket_stop - stop TIPC socket interface
  */
-
 void tipc_socket_stop(void)
 {
         if (!sockets_enabled)
@@ -1893,4 +1816,3 @@ void tipc_socket_stop(void)
         sock_unregister(tipc_family_ops.family);
         proto_unregister(&tipc_proto);
 }
-
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 8c49566da8f3..f976e9cd6a72 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -46,7 +46,6 @@
  * @subscriber_list: adjacent subscribers in top. server's list of subscribers
  * @subscription_list: list of subscription objects for this subscriber
  */
-
 struct tipc_subscriber {
         u32 port_ref;
         spinlock_t *lock;
@@ -56,13 +55,11 @@ struct tipc_subscriber {
 
 /**
  * struct top_srv - TIPC network topology subscription service
- * @user_ref: TIPC userid of subscription service
  * @setup_port: reference to TIPC port that handles subscription requests
  * @subscription_count: number of active subscriptions (not subscribers!)
  * @subscriber_list: list of ports subscribing to service
  * @lock: spinlock govering access to subscriber list
  */
-
 struct top_srv {
         u32 setup_port;
         atomic_t subscription_count;
@@ -79,7 +76,6 @@ static struct top_srv topsrv;
  *
  * Returns converted value
  */
-
 static u32 htohl(u32 in, int swap)
 {
         return swap ? swab32(in) : in;
@@ -91,7 +87,6 @@ static u32 htohl(u32 in, int swap)
  * Note: Must not hold subscriber's server port lock, since tipc_send() will
  *       try to take the lock if the message is rejected and returned!
  */
-
 static void subscr_send_event(struct tipc_subscription *sub,
                               u32 found_lower,
                               u32 found_upper,
@@ -117,7 +112,6 @@ static void subscr_send_event(struct tipc_subscription *sub,
  *
  * Returns 1 if there is overlap, otherwise 0.
  */
-
 int tipc_subscr_overlap(struct tipc_subscription *sub,
                         u32 found_lower,
                         u32 found_upper)
@@ -137,7 +131,6 @@ int tipc_subscr_overlap(struct tipc_subscription *sub,
  *
  * Protected by nameseq.lock in name_table.c
  */
-
 void tipc_subscr_report_overlap(struct tipc_subscription *sub,
                                 u32 found_lower,
                                 u32 found_upper,
@@ -157,43 +150,35 @@ void tipc_subscr_report_overlap(struct tipc_subscription *sub,
 /**
  * subscr_timeout - subscription timeout has occurred
  */
-
 static void subscr_timeout(struct tipc_subscription *sub)
 {
         struct tipc_port *server_port;
 
         /* Validate server port reference (in case subscriber is terminating) */
-
         server_port = tipc_port_lock(sub->server_ref);
         if (server_port == NULL)
                 return;
 
         /* Validate timeout (in case subscription is being cancelled) */
-
         if (sub->timeout == TIPC_WAIT_FOREVER) {
                 tipc_port_unlock(server_port);
                 return;
         }
 
         /* Unlink subscription from name table */
-
         tipc_nametbl_unsubscribe(sub);
 
         /* Unlink subscription from subscriber */
-
         list_del(&sub->subscription_list);
 
         /* Release subscriber's server port */
-
         tipc_port_unlock(server_port);
 
         /* Notify subscriber of timeout */
-
         subscr_send_event(sub, sub->evt.s.seq.lower, sub->evt.s.seq.upper,
                           TIPC_SUBSCR_TIMEOUT, 0, 0);
 
         /* Now destroy subscription */
-
         k_term_timer(&sub->timer);
         kfree(sub);
         atomic_dec(&topsrv.subscription_count);
@@ -204,7 +189,6 @@ static void subscr_timeout(struct tipc_subscription *sub)
  *
  * Called with subscriber port locked.
  */
-
 static void subscr_del(struct tipc_subscription *sub)
 {
         tipc_nametbl_unsubscribe(sub);
@@ -223,7 +207,6 @@ static void subscr_del(struct tipc_subscription *sub)
  * a new object reference in the interim that uses this lock; this routine will
  * simply wait for it to be released, then claim it.)
  */
-
 static void subscr_terminate(struct tipc_subscriber *subscriber)
 {
         u32 port_ref;
@@ -231,18 +214,15 @@ static void subscr_terminate(struct tipc_subscriber *subscriber)
         struct tipc_subscription *sub_temp;
 
         /* Invalidate subscriber reference */
-
         port_ref = subscriber->port_ref;
         subscriber->port_ref = 0;
         spin_unlock_bh(subscriber->lock);
 
         /* Sever connection to subscriber */
-
         tipc_shutdown(port_ref);
         tipc_deleteport(port_ref);
 
         /* Destroy any existing subscriptions for subscriber */
-
         list_for_each_entry_safe(sub, sub_temp, &subscriber->subscription_list,
                                  subscription_list) {
                 if (sub->timeout != TIPC_WAIT_FOREVER) {
@@ -253,17 +233,14 @@ static void subscr_terminate(struct tipc_subscriber *subscriber)
         }
 
         /* Remove subscriber from topology server's subscriber list */
-
         spin_lock_bh(&topsrv.lock);
         list_del(&subscriber->subscriber_list);
         spin_unlock_bh(&topsrv.lock);
 
         /* Reclaim subscriber lock */
-
         spin_lock_bh(subscriber->lock);
 
         /* Now destroy subscriber */
-
         kfree(subscriber);
 }
 
@@ -276,7 +253,6 @@ static void subscr_terminate(struct tipc_subscriber *subscriber)
  *
  * Note that fields of 's' use subscriber's endianness!
  */
-
 static void subscr_cancel(struct tipc_subscr *s,
                           struct tipc_subscriber *subscriber)
 {
@@ -285,7 +261,6 @@ static void subscr_cancel(struct tipc_subscr *s,
         int found = 0;
 
         /* Find first matching subscription, exit if not found */
-
         list_for_each_entry_safe(sub, sub_temp, &subscriber->subscription_list,
                                  subscription_list) {
                 if (!memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr))) {
@@ -297,7 +272,6 @@ static void subscr_cancel(struct tipc_subscr *s,
                 return;
 
         /* Cancel subscription timer (if used), then delete subscription */
-
         if (sub->timeout != TIPC_WAIT_FOREVER) {
                 sub->timeout = TIPC_WAIT_FOREVER;
                 spin_unlock_bh(subscriber->lock);
@@ -313,7 +287,6 @@ static void subscr_cancel(struct tipc_subscr *s,
  *
  * Called with subscriber port locked.
  */
-
 static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
                                              struct tipc_subscriber *subscriber)
 {
@@ -321,11 +294,9 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
         int swap;
 
         /* Determine subscriber's endianness */
-
         swap = !(s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE));
 
         /* Detect & process a subscription cancellation request */
-
         if (s->filter & htohl(TIPC_SUB_CANCEL, swap)) {
                 s->filter &= ~htohl(TIPC_SUB_CANCEL, swap);
                 subscr_cancel(s, subscriber);
@@ -333,7 +304,6 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
         }
 
         /* Refuse subscription if global limit exceeded */
-
         if (atomic_read(&topsrv.subscription_count) >= tipc_max_subscriptions) {
                 warn("Subscription rejected, subscription limit reached (%u)\n",
                      tipc_max_subscriptions);
@@ -342,7 +312,6 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
         }
 
         /* Allocate subscription object */
-
         sub = kmalloc(sizeof(*sub), GFP_ATOMIC);
         if (!sub) {
                 warn("Subscription rejected, no memory\n");
@@ -351,7 +320,6 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
         }
 
         /* Initialize subscription object */
-
         sub->seq.type = htohl(s->seq.type, swap);
         sub->seq.lower = htohl(s->seq.lower, swap);
         sub->seq.upper = htohl(s->seq.upper, swap);
@@ -385,7 +353,6 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
  *
  * Called with subscriber's server port unlocked.
  */
-
 static void subscr_conn_shutdown_event(void *usr_handle,
                                        u32 port_ref,
                                        struct sk_buff **buf,
@@ -409,7 +376,6 @@ static void subscr_conn_shutdown_event(void *usr_handle,
  *
  * Called with subscriber's server port unlocked.
  */
-
 static void subscr_conn_msg_event(void *usr_handle,
                                   u32 port_ref,
                                   struct sk_buff **buf,
@@ -424,7 +390,6 @@ static void subscr_conn_msg_event(void *usr_handle,
          * Lock subscriber's server port (& make a local copy of lock pointer,
          * in case subscriber is deleted while processing subscription request)
          */
-
         if (tipc_port_lock(port_ref) == NULL)
                 return;
 
@@ -452,7 +417,6 @@ static void subscr_conn_msg_event(void *usr_handle,
                          *    timeout code cannot delete the subscription,
                          * so the subscription object is still protected.
                          */
-
                         tipc_nametbl_subscribe(sub);
                 }
         }
@@ -461,7 +425,6 @@ static void subscr_conn_msg_event(void *usr_handle,
 /**
  * subscr_named_msg_event - handle request to establish a new subscriber
  */
-
 static void subscr_named_msg_event(void *usr_handle,
                                    u32 port_ref,
                                    struct sk_buff **buf,
@@ -475,7 +438,6 @@ static void subscr_named_msg_event(void *usr_handle,
         u32 server_port_ref;
 
         /* Create subscriber object */
-
         subscriber = kzalloc(sizeof(struct tipc_subscriber), GFP_ATOMIC);
         if (subscriber == NULL) {
                 warn("Subscriber rejected, no memory\n");
@@ -485,7 +447,6 @@ static void subscr_named_msg_event(void *usr_handle,
         INIT_LIST_HEAD(&subscriber->subscriber_list);
 
         /* Create server port & establish connection to subscriber */
-
         tipc_createport(subscriber,
                         importance,
                         NULL,
@@ -504,26 +465,21 @@ static void subscr_named_msg_event(void *usr_handle,
         tipc_connect2port(subscriber->port_ref, orig);
 
         /* Lock server port (& save lock address for future use) */
-
         subscriber->lock = tipc_port_lock(subscriber->port_ref)->lock;
 
         /* Add subscriber to topology server's subscriber list */
-
         spin_lock_bh(&topsrv.lock);
         list_add(&subscriber->subscriber_list, &topsrv.subscriber_list);
         spin_unlock_bh(&topsrv.lock);
 
         /* Unlock server port */
-
         server_port_ref = subscriber->port_ref;
         spin_unlock_bh(subscriber->lock);
 
         /* Send an ACK- to complete connection handshaking */
-
         tipc_send(server_port_ref, 0, NULL, 0);
 
         /* Handle optional subscription request */
-
         if (size != 0) {
                 subscr_conn_msg_event(subscriber, server_port_ref,
                                       buf, data, size);
@@ -535,7 +491,6 @@ int tipc_subscr_start(void)
         struct tipc_name_seq seq = {TIPC_TOP_SRV, TIPC_TOP_SRV, TIPC_TOP_SRV};
         int res;
 
-        memset(&topsrv, 0, sizeof(topsrv));
         spin_lock_init(&topsrv.lock);
         INIT_LIST_HEAD(&topsrv.subscriber_list);
 
@@ -552,7 +507,7 @@ int tipc_subscr_start(void)
         if (res)
                 goto failed;
 
-        res = tipc_nametbl_publish_rsv(topsrv.setup_port, TIPC_NODE_SCOPE, &seq);
+        res = tipc_publish(topsrv.setup_port, TIPC_NODE_SCOPE, &seq);
         if (res) {
                 tipc_deleteport(topsrv.setup_port);
                 topsrv.setup_port = 0;
diff --git a/net/tipc/subscr.h b/net/tipc/subscr.h
index ef6529c8456f..218d2e07f0cc 100644
--- a/net/tipc/subscr.h
+++ b/net/tipc/subscr.h
@@ -51,7 +51,6 @@ struct tipc_subscription;
  * @swap: indicates if subscriber uses opposite endianness in its messages
  * @evt: template for events generated by subscription
  */
-
 struct tipc_subscription {
         struct tipc_name_seq seq;
         u32 timeout;
@@ -80,5 +79,4 @@ int tipc_subscr_start(void);
 
 void tipc_subscr_stop(void);
 
-
 #endif
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 85d3bb7490aa..641f2e47f165 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -149,9 +149,10 @@ static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
  *    each socket state is protected by separate spin lock.
  */
 
-static inline unsigned unix_hash_fold(__wsum n)
+static inline unsigned int unix_hash_fold(__wsum n)
 {
-        unsigned hash = (__force unsigned)n;
+        unsigned int hash = (__force unsigned int)n;
+
         hash ^= hash>>16;
         hash ^= hash>>8;
         return hash&(UNIX_HASH_SIZE-1);
@@ -200,7 +201,7 @@ static inline void unix_release_addr(struct unix_address *addr)
  *              - if started by zero, it is abstract name.
  */
 
-static int unix_mkname(struct sockaddr_un *sunaddr, int len, unsigned *hashp)
+static int unix_mkname(struct sockaddr_un *sunaddr, int len, unsigned int *hashp)
 {
         if (len <= sizeof(short) || len > sizeof(*sunaddr))
                 return -EINVAL;
@@ -250,7 +251,7 @@ static inline void unix_insert_socket(struct hlist_head *list, struct sock *sk)
 
 static struct sock *__unix_find_socket_byname(struct net *net,
                                               struct sockaddr_un *sunname,
-                                              int len, int type, unsigned hash)
+                                              int len, int type, unsigned int hash)
 {
         struct sock *s;
         struct hlist_node *node;
@@ -273,7 +274,7 @@ found:
 static inline struct sock *unix_find_socket_byname(struct net *net,
                                                    struct sockaddr_un *sunname,
                                                    int len, int type,
-                                                   unsigned hash)
+                                                   unsigned int hash)
 {
         struct sock *s;
 
@@ -293,7 +294,7 @@ static struct sock *unix_find_socket_byinode(struct inode *i)
         spin_lock(&unix_table_lock);
         sk_for_each(s, node,
                     &unix_socket_table[i->i_ino & (UNIX_HASH_SIZE - 1)]) {
-                struct dentry *dentry = unix_sk(s)->dentry;
+                struct dentry *dentry = unix_sk(s)->path.dentry;
 
                 if (dentry && dentry->d_inode == i) {
                         sock_hold(s);
@@ -377,8 +378,7 @@ static void unix_sock_destructor(struct sock *sk)
 static int unix_release_sock(struct sock *sk, int embrion)
 {
         struct unix_sock *u = unix_sk(sk);
-        struct dentry *dentry;
-        struct vfsmount *mnt;
+        struct path path;
         struct sock *skpair;
         struct sk_buff *skb;
         int state;
@@ -389,10 +389,9 @@ static int unix_release_sock(struct sock *sk, int embrion)
         unix_state_lock(sk);
         sock_orphan(sk);
         sk->sk_shutdown = SHUTDOWN_MASK;
-        dentry       = u->dentry;
-        u->dentry    = NULL;
-        mnt          = u->mnt;
-        u->mnt       = NULL;
+        path         = u->path;
+        u->path.dentry = NULL;
+        u->path.mnt = NULL;
         state = sk->sk_state;
         sk->sk_state = TCP_CLOSE;
         unix_state_unlock(sk);
@@ -425,10 +424,8 @@ static int unix_release_sock(struct sock *sk, int embrion)
                 kfree_skb(skb);
         }
 
-        if (dentry) {
-                dput(dentry);
-                mntput(mnt);
-        }
+        if (path.dentry)
+                path_put(&path);
 
         sock_put(sk);
 
@@ -530,6 +527,16 @@ static int unix_seqpacket_sendmsg(struct kiocb *, struct socket *,
 static int unix_seqpacket_recvmsg(struct kiocb *, struct socket *,
                                   struct msghdr *, size_t, int);
 
+static void unix_set_peek_off(struct sock *sk, int val)
+{
+        struct unix_sock *u = unix_sk(sk);
+
+        mutex_lock(&u->readlock);
+        sk->sk_peek_off = val;
+        mutex_unlock(&u->readlock);
+}
+
+
 static const struct proto_ops unix_stream_ops = {
         .family =       PF_UNIX,
         .owner =        THIS_MODULE,
@@ -549,6 +556,7 @@ static const struct proto_ops unix_stream_ops = {
         .recvmsg =      unix_stream_recvmsg,
         .mmap =         sock_no_mmap,
         .sendpage =     sock_no_sendpage,
+        .set_peek_off = unix_set_peek_off,
 };
 
 static const struct proto_ops unix_dgram_ops = {
@@ -570,6 +578,7 @@ static const struct proto_ops unix_dgram_ops = {
         .recvmsg =      unix_dgram_recvmsg,
         .mmap =         sock_no_mmap,
         .sendpage =     sock_no_sendpage,
+        .set_peek_off = unix_set_peek_off,
 };
 
 static const struct proto_ops unix_seqpacket_ops = {
@@ -591,6 +600,7 @@ static const struct proto_ops unix_seqpacket_ops = {
         .recvmsg =      unix_seqpacket_recvmsg,
         .mmap =         sock_no_mmap,
         .sendpage =     sock_no_sendpage,
+        .set_peek_off = unix_set_peek_off,
 };
 
 static struct proto unix_proto = {
@@ -628,8 +638,8 @@ static struct sock *unix_create1(struct net *net, struct socket *sock)
         sk->sk_max_ack_backlog  = net->unx.sysctl_max_dgram_qlen;
         sk->sk_destruct         = unix_sock_destructor;
         u         = unix_sk(sk);
-        u->dentry = NULL;
-        u->mnt    = NULL;
+        u->path.dentry = NULL;
+        u->path.mnt = NULL;
         spin_lock_init(&u->lock);
         atomic_long_set(&u->inflight, 0);
         INIT_LIST_HEAD(&u->link);
@@ -751,7 +761,7 @@ out:	mutex_unlock(&u->readlock);
 
 static struct sock *unix_find_other(struct net *net,
                                     struct sockaddr_un *sunname, int len,
-                                    int type, unsigned hash, int *error)
+                                    int type, unsigned int hash, int *error)
 {
         struct sock *u;
         struct path path;
@@ -775,7 +785,7 @@ static struct sock *unix_find_other(struct net *net,
                         goto put_fail;
 
                 if (u->sk_type == type)
-                        touch_atime(path.mnt, path.dentry);
+                        touch_atime(&path);
 
                 path_put(&path);
 
@@ -789,9 +799,9 @@ static struct sock *unix_find_other(struct net *net,
                 u = unix_find_socket_byname(net, sunname, len, type, hash);
                 if (u) {
                         struct dentry *dentry;
-                        dentry = unix_sk(u)->dentry;
+                        dentry = unix_sk(u)->path.dentry;
                         if (dentry)
-                                touch_atime(unix_sk(u)->mnt, dentry);
+                                touch_atime(&unix_sk(u)->path);
                 } else
                         goto fail;
         }
@@ -815,7 +825,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct dentry *dentry = NULL;
         struct path path;
         int err;
-        unsigned hash;
+        unsigned int hash;
         struct unix_address *addr;
         struct hlist_head *list;
 
@@ -897,8 +907,7 @@ out_mknod_drop_write:
                 list = &unix_socket_table[addr->hash];
         } else {
                 list = &unix_socket_table[dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1)];
-                u->dentry = path.dentry;
-                u->mnt    = path.mnt;
+                u->path = path;
         }
 
         err = 0;
@@ -956,7 +965,7 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
         struct net *net = sock_net(sk);
         struct sockaddr_un *sunaddr = (struct sockaddr_un *)addr;
         struct sock *other;
-        unsigned hash;
+        unsigned int hash;
         int err;
 
         if (addr->sa_family != AF_UNSPEC) {
@@ -1054,7 +1063,7 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
         struct sock *newsk = NULL;
         struct sock *other = NULL;
         struct sk_buff *skb = NULL;
-        unsigned hash;
+        unsigned int hash;
         int st;
         int err;
         long timeo;
@@ -1180,9 +1189,9 @@ restart:
                 atomic_inc(&otheru->addr->refcnt);
                 newu->addr = otheru->addr;
         }
-        if (otheru->dentry) {
-                newu->dentry    = dget(otheru->dentry);
-                newu->mnt       = mntget(otheru->mnt);
+        if (otheru->path.dentry) {
+                path_get(&otheru->path);
+                newu->path = otheru->path;
         }
 
         /* Set credentials */
@@ -1429,11 +1438,12 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
         struct sock *other = NULL;
         int namelen = 0; /* fake GCC */
         int err;
-        unsigned hash;
+        unsigned int hash;
         struct sk_buff *skb;
         long timeo;
         struct scm_cookie tmp_scm;
         int max_level;
+        int data_len = 0;
 
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
@@ -1467,7 +1477,13 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
         if (len > sk->sk_sndbuf - 32)
                 goto out;
 
-        skb = sock_alloc_send_skb(sk, len, msg->msg_flags&MSG_DONTWAIT, &err);
+        if (len > SKB_MAX_ALLOC)
+                data_len = min_t(size_t,
+                                 len - SKB_MAX_ALLOC,
+                                 MAX_SKB_FRAGS * PAGE_SIZE);
+
+        skb = sock_alloc_send_pskb(sk, len - data_len, data_len,
+                                   msg->msg_flags & MSG_DONTWAIT, &err);
         if (skb == NULL)
                 goto out;
 
@@ -1477,8 +1493,10 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
         max_level = err + 1;
         unix_get_secdata(siocb->scm, skb);
 
-        skb_reset_transport_header(skb);
-        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+        skb_put(skb, len - data_len);
+        skb->data_len = data_len;
+        skb->len = len;
+        err = skb_copy_datagram_from_iovec(skb, 0, msg->msg_iov, 0, len);
         if (err)
                 goto out_free;
 
@@ -1756,6 +1774,7 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
         int noblock = flags & MSG_DONTWAIT;
         struct sk_buff *skb;
         int err;
+        int peeked, skip;
 
         err = -EOPNOTSUPP;
         if (flags&MSG_OOB)
@@ -1769,7 +1788,9 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
                 goto out;
         }
 
-        skb = skb_recv_datagram(sk, flags, noblock, &err);
+        skip = sk_peek_offset(sk, flags);
+
+        skb = __skb_recv_datagram(sk, flags, &peeked, &skip, &err);
         if (!skb) {
                 unix_state_lock(sk);
                 /* Signal EOF on disconnected non-blocking SEQPACKET socket. */
@@ -1786,12 +1807,12 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (msg->msg_name)
                 unix_copy_addr(msg, skb->sk);
 
-        if (size > skb->len)
-                size = skb->len;
-        else if (size < skb->len)
+        if (size > skb->len - skip)
+                size = skb->len - skip;
+        else if (size < skb->len - skip)
                 msg->msg_flags |= MSG_TRUNC;
 
-        err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, size);
+        err = skb_copy_datagram_iovec(skb, skip, msg->msg_iov, size);
         if (err)
                 goto out_free;
 
@@ -1808,6 +1829,8 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (!(flags & MSG_PEEK)) {
                 if (UNIXCB(skb).fp)
                         unix_detach_fds(siocb->scm, skb);
+
+                sk_peek_offset_bwd(sk, skb->len);
         } else {
                 /* It is questionable: on PEEK we could:
                    - do not return fds - good, but too simple 8)
@@ -1821,10 +1844,13 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
                    clearly however!
 
                 */
+
+                sk_peek_offset_fwd(sk, size);
+
                 if (UNIXCB(skb).fp)
                         siocb->scm->fp = scm_fp_dup(UNIXCB(skb).fp);
         }
-        err = size;
+        err = (flags & MSG_TRUNC) ? skb->len - skip : size;
 
         scm_recv(sock, msg, siocb->scm, flags);
 
@@ -1884,6 +1910,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
         int target;
         int err = 0;
         long timeo;
+        int skip;
 
         err = -EINVAL;
         if (sk->sk_state != TCP_ESTABLISHED)
@@ -1913,12 +1940,15 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 goto out;
         }
 
+        skip = sk_peek_offset(sk, flags);
+
         do {
                 int chunk;
                 struct sk_buff *skb;
 
                 unix_state_lock(sk);
                 skb = skb_peek(&sk->sk_receive_queue);
+again:
                 if (skb == NULL) {
                         unix_sk(sk)->recursion_level = 0;
                         if (copied >= target)
@@ -1953,6 +1983,13 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                         unix_state_unlock(sk);
                         break;
                 }
+
+                if (skip >= skb->len) {
+                        skip -= skb->len;
+                        skb = skb_peek_next(skb, &sk->sk_receive_queue);
+                        goto again;
+                }
+
                 unix_state_unlock(sk);
 
                 if (check_creds) {
@@ -1972,8 +2009,8 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                         sunaddr = NULL;
                 }
 
-                chunk = min_t(unsigned int, skb->len, size);
-                if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
+                chunk = min_t(unsigned int, skb->len - skip, size);
+                if (memcpy_toiovec(msg->msg_iov, skb->data + skip, chunk)) {
                         if (copied == 0)
                                 copied = -EFAULT;
                         break;
@@ -1985,6 +2022,8 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 if (!(flags & MSG_PEEK)) {
                         skb_pull(skb, chunk);
 
+                        sk_peek_offset_bwd(sk, chunk);
+
                         if (UNIXCB(skb).fp)
                                 unix_detach_fds(siocb->scm, skb);
 
@@ -2002,6 +2041,8 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                         if (UNIXCB(skb).fp)
                                 siocb->scm->fp = scm_fp_dup(UNIXCB(skb).fp);
 
+                        sk_peek_offset_fwd(sk, chunk);
+
                         break;
                 }
         } while (size);
@@ -2175,7 +2216,7 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
         }
 
         /* No write status requested, avoid expensive OUT tests. */
-        if (wait && !(wait->key & (POLLWRBAND | POLLWRNORM | POLLOUT)))
+        if (!(poll_requested_events(wait) & (POLLWRBAND|POLLWRNORM|POLLOUT)))
                 return mask;
 
         writable = unix_writable(sk);
diff --git a/net/unix/diag.c b/net/unix/diag.c
index 6b7697fd911b..47d3002737f5 100644
--- a/net/unix/diag.c
+++ b/net/unix/diag.c
@@ -29,7 +29,7 @@ rtattr_failure:
 
 static int sk_diag_dump_vfs(struct sock *sk, struct sk_buff *nlskb)
 {
-        struct dentry *dentry = unix_sk(sk)->dentry;
+        struct dentry *dentry = unix_sk(sk)->path.dentry;
         struct unix_diag_vfs *uv;
 
         if (dentry) {
@@ -301,14 +301,16 @@ static int unix_diag_handler_dump(struct sk_buff *skb, struct nlmsghdr *h)
         if (nlmsg_len(h) < hdrlen)
                 return -EINVAL;
 
-        if (h->nlmsg_flags & NLM_F_DUMP)
-                return netlink_dump_start(sock_diag_nlsk, skb, h,
-                                          unix_diag_dump, NULL, 0);
-        else
+        if (h->nlmsg_flags & NLM_F_DUMP) {
+                struct netlink_dump_control c = {
+                        .dump = unix_diag_dump,
+                };
+                return netlink_dump_start(sock_diag_nlsk, skb, h, &c);
+        } else
                 return unix_diag_get_exact(skb, h, (struct unix_diag_req *)NLMSG_DATA(h));
 }
 
-static struct sock_diag_handler unix_diag_handler = {
+static const struct sock_diag_handler unix_diag_handler = {
         .family = AF_UNIX,
         .dump = unix_diag_handler_dump,
 };
diff --git a/net/unix/sysctl_net_unix.c b/net/unix/sysctl_net_unix.c
index 397cffebb3b6..b34b5b9792f0 100644
--- a/net/unix/sysctl_net_unix.c
+++ b/net/unix/sysctl_net_unix.c
@@ -26,12 +26,6 @@ static ctl_table unix_table[] = {
         { }
 };
 
-static struct ctl_path unix_path[] = {
-        { .procname = "net", },
-        { .procname = "unix", },
-        { },
-};
-
 int __net_init unix_sysctl_register(struct net *net)
 {
         struct ctl_table *table;
@@ -41,7 +35,7 @@ int __net_init unix_sysctl_register(struct net *net)
                 goto err_alloc;
 
         table[0].data = &net->unx.sysctl_max_dgram_qlen;
-        net->unx.ctl = register_net_sysctl_table(net, unix_path, table);
+        net->unx.ctl = register_net_sysctl(net, "net/unix", table);
         if (net->unx.ctl == NULL)
                 goto err_reg;
 
@@ -58,6 +52,6 @@ void unix_sysctl_unregister(struct net *net)
         struct ctl_table *table;
 
         table = net->unx.ctl->ctl_table_arg;
-        unregister_sysctl_table(net->unx.ctl);
+        unregister_net_sysctl_table(net->unx.ctl);
         kfree(table);
 }
diff --git a/net/wanrouter/Kconfig b/net/wanrouter/Kconfig
index 61ceae0b9566..a157a2e64e18 100644
--- a/net/wanrouter/Kconfig
+++ b/net/wanrouter/Kconfig
@@ -3,7 +3,7 @@
 #
 
 config WAN_ROUTER
-        tristate "WAN router"
+        tristate "WAN router (DEPRECATED)"
         depends on EXPERIMENTAL
         ---help---
           Wide Area Networks (WANs), such as X.25, frame relay and leased
diff --git a/net/wimax/stack.c b/net/wimax/stack.c
index 3c65eae701c4..a6470ac39498 100644
--- a/net/wimax/stack.c
+++ b/net/wimax/stack.c
@@ -187,7 +187,7 @@ out:
 
 static
 void __check_new_state(enum wimax_st old_state, enum wimax_st new_state,
-                       unsigned allowed_states_bm)
+                       unsigned int allowed_states_bm)
 {
         if (WARN_ON(((1 << new_state) & allowed_states_bm) == 0)) {
                 printk(KERN_ERR "SW BUG! Forbidden state change %u -> %u\n",
@@ -425,7 +425,8 @@ static
 size_t wimax_addr_scnprint(char *addr_str, size_t addr_str_size,
                            unsigned char *addr, size_t addr_len)
 {
-        unsigned cnt, total;
+        unsigned int cnt, total;
+
         for (total = cnt = 0; cnt < addr_len; cnt++)
                 total += scnprintf(addr_str + total, addr_str_size - total,
                                    "%02x%c", addr[cnt],
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 2fcfe0993ca2..884801ac4dd0 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -45,7 +45,7 @@ rdev_freq_to_chan(struct cfg80211_registered_device *rdev,
         return chan;
 }
 
-int cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
+bool cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
                                   struct ieee80211_channel *chan,
                                   enum nl80211_channel_type channel_type)
 {
diff --git a/net/wireless/core.c b/net/wireless/core.c
index ccdfed897651..a87d43552974 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -422,10 +422,6 @@ static int wiphy_verify_combinations(struct wiphy *wiphy)
         const struct ieee80211_iface_combination *c;
         int i, j;
 
-        /* If we have combinations enforce them */
-        if (wiphy->n_iface_combinations)
-                wiphy->flags |= WIPHY_FLAG_ENFORCE_COMBINATIONS;
-
         for (i = 0; i < wiphy->n_iface_combinations; i++) {
                 u32 cnt = 0;
                 u16 all_iftypes = 0;
@@ -668,7 +664,7 @@ void wiphy_unregister(struct wiphy *wiphy)
                 mutex_lock(&rdev->devlist_mtx);
                 __count = rdev->opencount;
                 mutex_unlock(&rdev->devlist_mtx);
-                __count == 0;}));
+                __count == 0; }));
 
         mutex_lock(&rdev->devlist_mtx);
         BUG_ON(!list_empty(&rdev->netdev_list));
@@ -708,6 +704,10 @@ void wiphy_unregister(struct wiphy *wiphy)
         flush_work(&rdev->scan_done_wk);
         cancel_work_sync(&rdev->conn_work);
         flush_work(&rdev->event_work);
+
+        if (rdev->wowlan && rdev->ops->set_wakeup)
+                rdev->ops->set_wakeup(&rdev->wiphy, false);
+        cfg80211_rdev_free_wowlan(rdev);
 }
 EXPORT_SYMBOL(wiphy_unregister);
 
@@ -720,7 +720,6 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev)
         mutex_destroy(&rdev->sched_scan_mtx);
         list_for_each_entry_safe(scan, tmp, &rdev->bss_list, list)
                 cfg80211_put_bss(&scan->pub);
-        cfg80211_rdev_free_wowlan(rdev);
         kfree(rdev);
 }
 
@@ -777,7 +776,7 @@ static struct device_type wiphy_type = {
         .name   = "wlan",
 };
 
-static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
+static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                                          unsigned long state,
                                          void *ndev)
 {
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 43ad9c81efcf..8523f3878677 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -144,11 +144,6 @@ static inline struct cfg80211_internal_bss *bss_from_pub(struct cfg80211_bss *pu
         return container_of(pub, struct cfg80211_internal_bss, pub);
 }
 
-static inline void cfg80211_ref_bss(struct cfg80211_internal_bss *bss)
-{
-        kref_get(&bss->ref);
-}
-
 static inline void cfg80211_hold_bss(struct cfg80211_internal_bss *bss)
 {
         atomic_inc(&bss->hold);
@@ -325,15 +320,13 @@ int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
                          const u8 *bssid,
                          const u8 *ssid, int ssid_len,
                          const u8 *ie, int ie_len,
-                         const u8 *key, int key_len, int key_idx,
-                         bool local_state_change);
+                         const u8 *key, int key_len, int key_idx);
 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
                        struct net_device *dev, struct ieee80211_channel *chan,
                        enum nl80211_auth_type auth_type, const u8 *bssid,
                        const u8 *ssid, int ssid_len,
                        const u8 *ie, int ie_len,
-                       const u8 *key, int key_len, int key_idx,
-                       bool local_state_change);
+                       const u8 *key, int key_len, int key_idx);
 int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
                           struct net_device *dev,
                           struct ieee80211_channel *chan,
@@ -421,7 +414,8 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
                              size_t ie_len, u16 reason, bool from_ap);
 void cfg80211_sme_scan_done(struct net_device *dev);
 void cfg80211_sme_rx_auth(struct net_device *dev, const u8 *buf, size_t len);
-void cfg80211_sme_disassoc(struct net_device *dev, int idx);
+void cfg80211_sme_disassoc(struct net_device *dev,
+                           struct cfg80211_internal_bss *bss);
 void __cfg80211_scan_done(struct work_struct *wk);
 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak);
 void __cfg80211_sched_scan_results(struct work_struct *wk);
@@ -451,8 +445,6 @@ int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
                       struct wireless_dev *wdev, int freq,
                       enum nl80211_channel_type channel_type);
 
-u16 cfg80211_calculate_bitrate(struct rate_info *rate);
-
 int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
                            const u8 *rates, unsigned int n_rates,
                            u32 *mask);
diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
index 39765bcfb472..920cabe0461b 100644
--- a/net/wireless/debugfs.c
+++ b/net/wireless/debugfs.c
@@ -13,12 +13,6 @@
 #include "core.h"
 #include "debugfs.h"
 
-static int cfg80211_open_file_generic(struct inode *inode, struct file *file)
-{
-        file->private_data = inode->i_private;
-        return 0;
-}
-
 #define DEBUGFS_READONLY_FILE(name, buflen, fmt, value...)              \
 static ssize_t name## _read(struct file *file, char __user *userbuf,    \
                             size_t count, loff_t *ppos)                 \
@@ -33,7 +27,7 @@ static ssize_t name## _read(struct file *file, char __user *userbuf,	\
                                                                         \
 static const struct file_operations name## _ops = {                     \
         .read = name## _read,                                           \
-        .open = cfg80211_open_file_generic,                             \
+        .open = simple_open,                                            \
         .llseek = generic_file_llseek,                                  \
 };
 
@@ -102,7 +96,7 @@ static ssize_t ht40allow_map_read(struct file *file,
 
 static const struct file_operations ht40allow_map_ops = {
         .read = ht40allow_map_read,
-        .open = cfg80211_open_file_generic,
+        .open = simple_open,
         .llseek = default_llseek,
 };
 
diff --git a/net/wireless/ethtool.c b/net/wireless/ethtool.c
index 9bde4d1d3e9b..7eecdf40cf80 100644
--- a/net/wireless/ethtool.c
+++ b/net/wireless/ethtool.c
@@ -68,6 +68,32 @@ static int cfg80211_set_ringparam(struct net_device *dev,
         return -ENOTSUPP;
 }
 
+static int cfg80211_get_sset_count(struct net_device *dev, int sset)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        if (rdev->ops->get_et_sset_count)
+                return rdev->ops->get_et_sset_count(wdev->wiphy, dev, sset);
+        return -EOPNOTSUPP;
+}
+
+static void cfg80211_get_stats(struct net_device *dev,
+                               struct ethtool_stats *stats, u64 *data)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        if (rdev->ops->get_et_stats)
+                rdev->ops->get_et_stats(wdev->wiphy, dev, stats, data);
+}
+
+static void cfg80211_get_strings(struct net_device *dev, u32 sset, u8 *data)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        if (rdev->ops->get_et_strings)
+                rdev->ops->get_et_strings(wdev->wiphy, dev, sset, data);
+}
+
 const struct ethtool_ops cfg80211_ethtool_ops = {
         .get_drvinfo = cfg80211_get_drvinfo,
         .get_regs_len = cfg80211_get_regs_len,
@@ -75,4 +101,7 @@ const struct ethtool_ops cfg80211_ethtool_ops = {
         .get_link = ethtool_op_get_link,
         .get_ringparam = cfg80211_get_ringparam,
         .set_ringparam = cfg80211_set_ringparam,
+        .get_strings = cfg80211_get_strings,
+        .get_ethtool_stats = cfg80211_get_stats,
+        .get_sset_count = cfg80211_get_sset_count,
 };
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 30f20fe4a5fe..d2a19b0ff71f 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -473,7 +473,7 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
 
         /* fixed already - and no change */
         if (wdev->wext.ibss.bssid && bssid &&
-            compare_ether_addr(bssid, wdev->wext.ibss.bssid) == 0)
+            ether_addr_equal(bssid, wdev->wext.ibss.bssid))
                 return 0;
 
         wdev_lock(wdev);
diff --git a/net/wireless/lib80211_crypt_ccmp.c b/net/wireless/lib80211_crypt_ccmp.c
index 755738d26bb4..1526c211db66 100644
--- a/net/wireless/lib80211_crypt_ccmp.c
+++ b/net/wireless/lib80211_crypt_ccmp.c
@@ -304,10 +304,8 @@ static int lib80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         pos = skb->data + hdr_len;
         keyidx = pos[3];
         if (!(keyidx & (1 << 5))) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "CCMP: received packet without ExtIV"
-                               " flag from %pM\n", hdr->addr2);
-                }
+                net_dbg_ratelimited("CCMP: received packet without ExtIV flag from %pM\n",
+                                    hdr->addr2);
                 key->dot11RSNAStatsCCMPFormatErrors++;
                 return -2;
         }
@@ -318,11 +316,8 @@ static int lib80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
                 return -6;
         }
         if (!key->key_set) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "CCMP: received packet from %pM"
-                               " with keyid=%d that does not have a configured"
-                               " key\n", hdr->addr2, keyidx);
-                }
+                net_dbg_ratelimited("CCMP: received packet from %pM with keyid=%d that does not have a configured key\n",
+                                    hdr->addr2, keyidx);
                 return -3;
         }
 
@@ -336,15 +331,11 @@ static int lib80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
 
         if (ccmp_replay_check(pn, key->rx_pn)) {
 #ifdef CONFIG_LIB80211_DEBUG
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "CCMP: replay detected: STA=%pM "
-                                 "previous PN %02x%02x%02x%02x%02x%02x "
-                                 "received PN %02x%02x%02x%02x%02x%02x\n",
-                                 hdr->addr2,
-                                 key->rx_pn[0], key->rx_pn[1], key->rx_pn[2],
-                                 key->rx_pn[3], key->rx_pn[4], key->rx_pn[5],
-                                 pn[0], pn[1], pn[2], pn[3], pn[4], pn[5]);
-                }
+                net_dbg_ratelimited("CCMP: replay detected: STA=%pM previous PN %02x%02x%02x%02x%02x%02x received PN %02x%02x%02x%02x%02x%02x\n",
+                                    hdr->addr2,
+                                    key->rx_pn[0], key->rx_pn[1], key->rx_pn[2],
+                                    key->rx_pn[3], key->rx_pn[4], key->rx_pn[5],
+                                    pn[0], pn[1], pn[2], pn[3], pn[4], pn[5]);
 #endif
                 key->dot11RSNAStatsCCMPReplays++;
                 return -4;
@@ -370,10 +361,8 @@ static int lib80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         }
 
         if (memcmp(mic, a, CCMP_MIC_LEN) != 0) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "CCMP: decrypt failed: STA="
-                               "%pM\n", hdr->addr2);
-                }
+                net_dbg_ratelimited("CCMP: decrypt failed: STA=%pM\n",
+                                    hdr->addr2);
                 key->dot11RSNAStatsCCMPDecryptErrors++;
                 return -5;
         }
diff --git a/net/wireless/lib80211_crypt_tkip.c b/net/wireless/lib80211_crypt_tkip.c
index 38734846c19e..d475cfc8568f 100644
--- a/net/wireless/lib80211_crypt_tkip.c
+++ b/net/wireless/lib80211_crypt_tkip.c
@@ -360,12 +360,9 @@ static int lib80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
         struct scatterlist sg;
 
         if (tkey->flags & IEEE80211_CRYPTO_TKIP_COUNTERMEASURES) {
-                if (net_ratelimit()) {
-                        struct ieee80211_hdr *hdr =
-                            (struct ieee80211_hdr *)skb->data;
-                        printk(KERN_DEBUG ": TKIP countermeasures: dropped "
-                               "TX packet to %pM\n", hdr->addr1);
-                }
+                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+                net_dbg_ratelimited("TKIP countermeasures: dropped TX packet to %pM\n",
+                                    hdr->addr1);
                 return -1;
         }
 
@@ -420,10 +417,8 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         hdr = (struct ieee80211_hdr *)skb->data;
 
         if (tkey->flags & IEEE80211_CRYPTO_TKIP_COUNTERMEASURES) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG ": TKIP countermeasures: dropped "
-                               "received packet from %pM\n", hdr->addr2);
-                }
+                net_dbg_ratelimited("TKIP countermeasures: dropped received packet from %pM\n",
+                                    hdr->addr2);
                 return -1;
         }
 
@@ -433,10 +428,8 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         pos = skb->data + hdr_len;
         keyidx = pos[3];
         if (!(keyidx & (1 << 5))) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "TKIP: received packet without ExtIV"
-                               " flag from %pM\n", hdr->addr2);
-                }
+                net_dbg_ratelimited("TKIP: received packet without ExtIV flag from %pM\n",
+                                    hdr->addr2);
                 return -2;
         }
         keyidx >>= 6;
@@ -446,11 +439,8 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
                 return -6;
         }
         if (!tkey->key_set) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "TKIP: received packet from %pM"
-                               " with keyid=%d that does not have a configured"
-                               " key\n", hdr->addr2, keyidx);
-                }
+                net_dbg_ratelimited("TKIP: received packet from %pM with keyid=%d that does not have a configured key\n",
+                                    hdr->addr2, keyidx);
                 return -3;
         }
         iv16 = (pos[0] << 8) | pos[2];
@@ -459,12 +449,9 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
 
         if (tkip_replay_check(iv32, iv16, tkey->rx_iv32, tkey->rx_iv16)) {
 #ifdef CONFIG_LIB80211_DEBUG
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "TKIP: replay detected: STA=%pM"
-                               " previous TSC %08x%04x received TSC "
-                               "%08x%04x\n", hdr->addr2,
-                               tkey->rx_iv32, tkey->rx_iv16, iv32, iv16);
-                }
+                net_dbg_ratelimited("TKIP: replay detected: STA=%pM previous TSC %08x%04x received TSC %08x%04x\n",
+                                    hdr->addr2, tkey->rx_iv32, tkey->rx_iv16,
+                                    iv32, iv16);
 #endif
                 tkey->dot11RSNAStatsTKIPReplays++;
                 return -4;
@@ -481,11 +468,8 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         crypto_blkcipher_setkey(tkey->rx_tfm_arc4, rc4key, 16);
         sg_init_one(&sg, pos, plen + 4);
         if (crypto_blkcipher_decrypt(&desc, &sg, &sg, plen + 4)) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG ": TKIP: failed to decrypt "
-                               "received packet from %pM\n",
-                               hdr->addr2);
-                }
+                net_dbg_ratelimited("TKIP: failed to decrypt received packet from %pM\n",
+                                    hdr->addr2);
                 return -7;
         }
 
@@ -501,10 +485,8 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
                         tkey->rx_phase1_done = 0;
                 }
 #ifdef CONFIG_LIB80211_DEBUG
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "TKIP: ICV error detected: STA="
-                               "%pM\n", hdr->addr2);
-                }
+                net_dbg_ratelimited("TKIP: ICV error detected: STA=%pM\n",
+                                    hdr->addr2);
 #endif
                 tkey->dot11RSNAStatsTKIPICVErrors++;
                 return -5;
diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c
index 8c550df13037..2749cb86b462 100644
--- a/net/wireless/mesh.c
+++ b/net/wireless/mesh.c
@@ -23,6 +23,8 @@
 #define MESH_PERR_MIN_INT       100
 #define MESH_DIAM_TRAVERSAL_TIME 50
 
+#define MESH_RSSI_THRESHOLD     0
+
 /*
  * A path will be refreshed if it is used PATH_REFRESH_TIME milliseconds
  * before timing out.  This way it will remain ACTIVE and no data frames
@@ -36,6 +38,7 @@
 
 #define MESH_MAX_PREQ_RETRIES   4
 
+#define MESH_SYNC_NEIGHBOR_OFFSET_MAX 50
 
 const struct mesh_config default_mesh_config = {
         .dot11MeshRetryTimeout = MESH_RET_T,
@@ -46,6 +49,7 @@ const struct mesh_config default_mesh_config = {
         .element_ttl = MESH_DEFAULT_ELEMENT_TTL,
         .auto_open_plinks = true,
         .dot11MeshMaxPeerLinks = MESH_MAX_ESTAB_PLINKS,
+        .dot11MeshNbrOffsetMaxNeighbor = MESH_SYNC_NEIGHBOR_OFFSET_MAX,
         .dot11MeshHWMPactivePathTimeout = MESH_PATH_TIMEOUT,
         .dot11MeshHWMPpreqMinInterval = MESH_PREQ_MIN_INT,
         .dot11MeshHWMPperrMinInterval = MESH_PERR_MIN_INT,
@@ -55,9 +59,13 @@ const struct mesh_config default_mesh_config = {
         .min_discovery_timeout = MESH_MIN_DISCOVERY_TIMEOUT,
         .dot11MeshHWMPRannInterval = MESH_RANN_INTERVAL,
         .dot11MeshGateAnnouncementProtocol = false,
+        .dot11MeshForwarding = true,
+        .rssi_threshold = MESH_RSSI_THRESHOLD,
+        .ht_opmode = IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED,
 };
 
 const struct mesh_setup default_mesh_setup = {
+        .sync_method = IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET,
         .path_sel_proto = IEEE80211_PATH_PROTOCOL_HWMP,
         .path_metric = IEEE80211_PATH_METRIC_AIRTIME,
         .ie = NULL,
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 438dfc105b4a..eb90988bbd36 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -6,6 +6,7 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/etherdevice.h>
 #include <linux/netdevice.h>
 #include <linux/nl80211.h>
 #include <linux/slab.h>
@@ -20,40 +21,18 @@ void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len)
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
-        u8 *bssid = mgmt->bssid;
-        int i;
-        u16 status = le16_to_cpu(mgmt->u.auth.status_code);
-        bool done = false;
 
         wdev_lock(wdev);
 
-        for (i = 0; i < MAX_AUTH_BSSES; i++) {
-                if (wdev->authtry_bsses[i] &&
-                    memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid,
-                                                        ETH_ALEN) == 0) {
-                        if (status == WLAN_STATUS_SUCCESS) {
-                                wdev->auth_bsses[i] = wdev->authtry_bsses[i];
-                        } else {
-                                cfg80211_unhold_bss(wdev->authtry_bsses[i]);
-                                cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
-                        }
-                        wdev->authtry_bsses[i] = NULL;
-                        done = true;
-                        break;
-                }
-        }
-
-        if (done) {
-                nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
-                cfg80211_sme_rx_auth(dev, buf, len);
-        }
+        nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
+        cfg80211_sme_rx_auth(dev, buf, len);
 
         wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_rx_auth);
 
-void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
+void cfg80211_send_rx_assoc(struct net_device *dev, struct cfg80211_bss *bss,
+                            const u8 *buf, size_t len)
 {
         u16 status_code;
         struct wireless_dev *wdev = dev->ieee80211_ptr;
@@ -61,8 +40,7 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
         u8 *ie = mgmt->u.assoc_resp.variable;
-        int i, ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
-        struct cfg80211_internal_bss *bss = NULL;
+        int ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
 
         wdev_lock(wdev);
 
@@ -75,43 +53,20 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
          * frame instead of reassoc.
          */
         if (status_code != WLAN_STATUS_SUCCESS && wdev->conn &&
-            cfg80211_sme_failed_reassoc(wdev))
+            cfg80211_sme_failed_reassoc(wdev)) {
+                cfg80211_put_bss(bss);
                 goto out;
+        }
 
         nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
 
-        if (status_code == WLAN_STATUS_SUCCESS) {
-                for (i = 0; i < MAX_AUTH_BSSES; i++) {
-                        if (!wdev->auth_bsses[i])
-                                continue;
-                        if (memcmp(wdev->auth_bsses[i]->pub.bssid, mgmt->bssid,
-                                   ETH_ALEN) == 0) {
-                                bss = wdev->auth_bsses[i];
-                                wdev->auth_bsses[i] = NULL;
-                                /* additional reference to drop hold */
-                                cfg80211_ref_bss(bss);
-                                break;
-                        }
-                }
-
-                /*
-                 * We might be coming here because the driver reported
-                 * a successful association at the same time as the
-                 * user requested a deauth. In that case, we will have
-                 * removed the BSS from the auth_bsses list due to the
-                 * deauth request when the assoc response makes it. If
-                 * the two code paths acquire the lock the other way
-                 * around, that's just the standard situation of a
-                 * deauth being requested while connected.
-                 */
-                if (!bss)
-                        goto out;
-        } else if (wdev->conn) {
+        if (status_code != WLAN_STATUS_SUCCESS && wdev->conn) {
                 cfg80211_sme_failed_assoc(wdev);
                 /*
                  * do not call connect_result() now because the
                  * sme will schedule work that does it later.
                  */
+                cfg80211_put_bss(bss);
                 goto out;
         }
 
@@ -124,17 +79,10 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
                 wdev->sme_state = CFG80211_SME_CONNECTING;
         }
 
-        /* this consumes one bss reference (unless bss is NULL) */
+        /* this consumes the bss reference */
         __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
                                   status_code,
-                                  status_code == WLAN_STATUS_SUCCESS,
-                                  bss ? &bss->pub : NULL);
-        /* drop hold now, and also reference acquired above */
-        if (bss) {
-                cfg80211_unhold_bss(bss);
-                cfg80211_put_bss(&bss->pub);
-        }
-
+                                  status_code == WLAN_STATUS_SUCCESS, bss);
  out:
         wdev_unlock(wdev);
 }
@@ -148,42 +96,18 @@ void __cfg80211_send_deauth(struct net_device *dev,
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
         const u8 *bssid = mgmt->bssid;
-        int i;
-        bool found = false, was_current = false;
+        bool was_current = false;
 
         ASSERT_WDEV_LOCK(wdev);
 
         if (wdev->current_bss &&
-            memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
+            ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
                 cfg80211_unhold_bss(wdev->current_bss);
                 cfg80211_put_bss(&wdev->current_bss->pub);
                 wdev->current_bss = NULL;
-                found = true;
                 was_current = true;
-        } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
-                if (wdev->auth_bsses[i] &&
-                    memcmp(wdev->auth_bsses[i]->pub.bssid, bssid, ETH_ALEN) == 0) {
-                        cfg80211_unhold_bss(wdev->auth_bsses[i]);
-                        cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
-                        wdev->auth_bsses[i] = NULL;
-                        found = true;
-                        break;
-                }
-                if (wdev->authtry_bsses[i] &&
-                    memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid,
-                           ETH_ALEN) == 0 &&
-                    memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) == 0) {
-                        cfg80211_unhold_bss(wdev->authtry_bsses[i]);
-                        cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
-                        wdev->authtry_bsses[i] = NULL;
-                        found = true;
-                        break;
-                }
         }
 
-        if (!found)
-                return;
-
         nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
 
         if (wdev->sme_state == CFG80211_SME_CONNECTED && was_current) {
@@ -192,7 +116,7 @@ void __cfg80211_send_deauth(struct net_device *dev,
 
                 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 
-                from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
+                from_ap = !ether_addr_equal(mgmt->sa, dev->dev_addr);
                 __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
         } else if (wdev->sme_state == CFG80211_SME_CONNECTING) {
                 __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
@@ -220,10 +144,8 @@ void __cfg80211_send_disassoc(struct net_device *dev,
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
         const u8 *bssid = mgmt->bssid;
-        int i;
         u16 reason_code;
         bool from_ap;
-        bool done = false;
 
         ASSERT_WDEV_LOCK(wdev);
 
@@ -233,24 +155,18 @@ void __cfg80211_send_disassoc(struct net_device *dev,
                 return;
 
         if (wdev->current_bss &&
-            memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
-                for (i = 0; i < MAX_AUTH_BSSES; i++) {
-                        if (wdev->authtry_bsses[i] || wdev->auth_bsses[i])
-                                continue;
-                        wdev->auth_bsses[i] = wdev->current_bss;
-                        wdev->current_bss = NULL;
-                        done = true;
-                        cfg80211_sme_disassoc(dev, i);
-                        break;
-                }
-                WARN_ON(!done);
+            ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
+                cfg80211_sme_disassoc(dev, wdev->current_bss);
+                cfg80211_unhold_bss(wdev->current_bss);
+                cfg80211_put_bss(&wdev->current_bss->pub);
+                wdev->current_bss = NULL;
         } else
                 WARN_ON(1);
 
 
         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
-        from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
+        from_ap = !ether_addr_equal(mgmt->sa, dev->dev_addr);
         __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 }
 EXPORT_SYMBOL(__cfg80211_send_disassoc);
@@ -287,34 +203,6 @@ void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
 }
 EXPORT_SYMBOL(cfg80211_send_unprot_disassoc);
 
-static void __cfg80211_auth_remove(struct wireless_dev *wdev, const u8 *addr)
-{
-        int i;
-        bool done = false;
-
-        ASSERT_WDEV_LOCK(wdev);
-
-        for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
-                if (wdev->authtry_bsses[i] &&
-                    memcmp(wdev->authtry_bsses[i]->pub.bssid,
-                           addr, ETH_ALEN) == 0) {
-                        cfg80211_unhold_bss(wdev->authtry_bsses[i]);
-                        cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
-                        wdev->authtry_bsses[i] = NULL;
-                        done = true;
-                        break;
-                }
-        }
-
-        WARN_ON(!done);
-}
-
-void __cfg80211_auth_canceled(struct net_device *dev, const u8 *addr)
-{
-        __cfg80211_auth_remove(dev->ieee80211_ptr, addr);
-}
-EXPORT_SYMBOL(__cfg80211_auth_canceled);
-
 void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
@@ -329,8 +217,6 @@ void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
                                           false, NULL);
 
-        __cfg80211_auth_remove(wdev, addr);
-
         wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_auth_timeout);
@@ -340,8 +226,6 @@ void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr)
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        int i;
-        bool done = false;
 
         wdev_lock(wdev);
 
@@ -351,20 +235,6 @@ void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr)
                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
                                           false, NULL);
 
-        for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
-                if (wdev->auth_bsses[i] &&
-                    memcmp(wdev->auth_bsses[i]->pub.bssid,
-                           addr, ETH_ALEN) == 0) {
-                        cfg80211_unhold_bss(wdev->auth_bsses[i]);
-                        cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
-                        wdev->auth_bsses[i] = NULL;
-                        done = true;
-                        break;
-                }
-        }
-
-        WARN_ON(!done);
-
         wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_assoc_timeout);
@@ -403,13 +273,11 @@ int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
                          const u8 *bssid,
                          const u8 *ssid, int ssid_len,
                          const u8 *ie, int ie_len,
-                         const u8 *key, int key_len, int key_idx,
-                         bool local_state_change)
+                         const u8 *key, int key_len, int key_idx)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_auth_request req;
-        struct cfg80211_internal_bss *bss;
-        int i, err, slot = -1, nfree = 0;
+        int err;
 
         ASSERT_WDEV_LOCK(wdev);
 
@@ -418,23 +286,11 @@ int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
                         return -EINVAL;
 
         if (wdev->current_bss &&
-            memcmp(bssid, wdev->current_bss->pub.bssid, ETH_ALEN) == 0)
+            ether_addr_equal(bssid, wdev->current_bss->pub.bssid))
                 return -EALREADY;
 
-        for (i = 0; i < MAX_AUTH_BSSES; i++) {
-                if (wdev->authtry_bsses[i] &&
-                    memcmp(bssid, wdev->authtry_bsses[i]->pub.bssid,
-                                                ETH_ALEN) == 0)
-                        return -EALREADY;
-                if (wdev->auth_bsses[i] &&
-                    memcmp(bssid, wdev->auth_bsses[i]->pub.bssid,
-                                                ETH_ALEN) == 0)
-                        return -EALREADY;
-        }
-
         memset(&req, 0, sizeof(req));
 
-        req.local_state_change = local_state_change;
         req.ie = ie;
         req.ie_len = ie_len;
         req.auth_type = auth_type;
@@ -446,39 +302,9 @@ int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
         if (!req.bss)
                 return -ENOENT;
 
-        bss = bss_from_pub(req.bss);
-
-        for (i = 0; i < MAX_AUTH_BSSES; i++) {
-                if (!wdev->auth_bsses[i] && !wdev->authtry_bsses[i]) {
-                        slot = i;
-                        nfree++;
-                }
-        }
-
-        /* we need one free slot for disassoc and one for this auth */
-        if (nfree < 2) {
-                err = -ENOSPC;
-                goto out;
-        }
-
-        if (local_state_change)
-                wdev->auth_bsses[slot] = bss;
-        else
-                wdev->authtry_bsses[slot] = bss;
-        cfg80211_hold_bss(bss);
-
         err = rdev->ops->auth(&rdev->wiphy, dev, &req);
-        if (err) {
-                if (local_state_change)
-                        wdev->auth_bsses[slot] = NULL;
-                else
-                        wdev->authtry_bsses[slot] = NULL;
-                cfg80211_unhold_bss(bss);
-        }
 
- out:
-        if (err)
-                cfg80211_put_bss(req.bss);
+        cfg80211_put_bss(req.bss);
         return err;
 }
 
@@ -487,15 +313,14 @@ int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
                        enum nl80211_auth_type auth_type, const u8 *bssid,
                        const u8 *ssid, int ssid_len,
                        const u8 *ie, int ie_len,
-                       const u8 *key, int key_len, int key_idx,
-                       bool local_state_change)
+                       const u8 *key, int key_len, int key_idx)
 {
         int err;
 
         wdev_lock(dev->ieee80211_ptr);
         err = __cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
                                    ssid, ssid_len, ie, ie_len,
-                                   key, key_len, key_idx, local_state_change);
+                                   key, key_len, key_idx);
         wdev_unlock(dev->ieee80211_ptr);
 
         return err;
@@ -530,8 +355,7 @@ int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_assoc_request req;
-        struct cfg80211_internal_bss *bss;
-        int i, err, slot = -1;
+        int err;
         bool was_connected = false;
 
         ASSERT_WDEV_LOCK(wdev);
@@ -539,7 +363,7 @@ int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
         memset(&req, 0, sizeof(req));
 
         if (wdev->current_bss && prev_bssid &&
-            memcmp(wdev->current_bss->pub.bssid, prev_bssid, ETH_ALEN) == 0) {
+            ether_addr_equal(wdev->current_bss->pub.bssid, prev_bssid)) {
                 /*
                  * Trying to reassociate: Allow this to proceed and let the old
                  * association to be dropped when the new one is completed.
@@ -573,26 +397,14 @@ int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
                 return -ENOENT;
         }
 
-        bss = bss_from_pub(req.bss);
-
-        for (i = 0; i < MAX_AUTH_BSSES; i++) {
-                if (bss == wdev->auth_bsses[i]) {
-                        slot = i;
-                        break;
-                }
-        }
+        err = rdev->ops->assoc(&rdev->wiphy, dev, &req);
 
-        if (slot < 0) {
-                err = -ENOTCONN;
-                goto out;
+        if (err) {
+                if (was_connected)
+                        wdev->sme_state = CFG80211_SME_CONNECTED;
+                cfg80211_put_bss(req.bss);
         }
 
-        err = rdev->ops->assoc(&rdev->wiphy, dev, &req);
- out:
-        if (err && was_connected)
-                wdev->sme_state = CFG80211_SME_CONNECTED;
-        /* still a reference in wdev->auth_bsses[slot] */
-        cfg80211_put_bss(req.bss);
         return err;
 }
 
@@ -624,36 +436,27 @@ int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
                            bool local_state_change)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_deauth_request req;
-        int i;
+        struct cfg80211_deauth_request req = {
+                .bssid = bssid,
+                .reason_code = reason,
+                .ie = ie,
+                .ie_len = ie_len,
+        };
 
         ASSERT_WDEV_LOCK(wdev);
 
-        memset(&req, 0, sizeof(req));
-        req.reason_code = reason;
-        req.local_state_change = local_state_change;
-        req.ie = ie;
-        req.ie_len = ie_len;
-        if (wdev->current_bss &&
-            memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
-                req.bss = &wdev->current_bss->pub;
-        } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
-                if (wdev->auth_bsses[i] &&
-                    memcmp(bssid, wdev->auth_bsses[i]->pub.bssid, ETH_ALEN) == 0) {
-                        req.bss = &wdev->auth_bsses[i]->pub;
-                        break;
-                }
-                if (wdev->authtry_bsses[i] &&
-                    memcmp(bssid, wdev->authtry_bsses[i]->pub.bssid, ETH_ALEN) == 0) {
-                        req.bss = &wdev->authtry_bsses[i]->pub;
-                        break;
+        if (local_state_change) {
+                if (wdev->current_bss &&
+                    ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
+                        cfg80211_unhold_bss(wdev->current_bss);
+                        cfg80211_put_bss(&wdev->current_bss->pub);
+                        wdev->current_bss = NULL;
                 }
-        }
 
-        if (!req.bss)
-                return -ENOTCONN;
+                return 0;
+        }
 
-        return rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
+        return rdev->ops->deauth(&rdev->wiphy, dev, &req);
 }
 
 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
@@ -693,12 +496,12 @@ static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
         req.local_state_change = local_state_change;
         req.ie = ie;
         req.ie_len = ie_len;
-        if (memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0)
+        if (ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
                 req.bss = &wdev->current_bss->pub;
         else
                 return -ENOTCONN;
 
-        return rdev->ops->disassoc(&rdev->wiphy, dev, &req, wdev);
+        return rdev->ops->disassoc(&rdev->wiphy, dev, &req);
 }
 
 int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
@@ -722,7 +525,7 @@ void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_deauth_request req;
-        int i;
+        u8 bssid[ETH_ALEN];
 
         ASSERT_WDEV_LOCK(wdev);
 
@@ -734,35 +537,17 @@ void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
         req.ie = NULL;
         req.ie_len = 0;
 
-        if (wdev->current_bss) {
-                req.bss = &wdev->current_bss->pub;
-                rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
-                if (wdev->current_bss) {
-                        cfg80211_unhold_bss(wdev->current_bss);
-                        cfg80211_put_bss(&wdev->current_bss->pub);
-                        wdev->current_bss = NULL;
-                }
-        }
+        if (!wdev->current_bss)
+                return;
 
-        for (i = 0; i < MAX_AUTH_BSSES; i++) {
-                if (wdev->auth_bsses[i]) {
-                        req.bss = &wdev->auth_bsses[i]->pub;
-                        rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
-                        if (wdev->auth_bsses[i]) {
-                                cfg80211_unhold_bss(wdev->auth_bsses[i]);
-                                cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
-                                wdev->auth_bsses[i] = NULL;
-                        }
-                }
-                if (wdev->authtry_bsses[i]) {
-                        req.bss = &wdev->authtry_bsses[i]->pub;
-                        rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
-                        if (wdev->authtry_bsses[i]) {
-                                cfg80211_unhold_bss(wdev->authtry_bsses[i]);
-                                cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
-                                wdev->authtry_bsses[i] = NULL;
-                        }
-                }
+        memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN);
+        req.bssid = bssid;
+        rdev->ops->deauth(&rdev->wiphy, dev, &req);
+
+        if (wdev->current_bss) {
+                cfg80211_unhold_bss(wdev->current_bss);
+                cfg80211_put_bss(&wdev->current_bss->pub);
+                wdev->current_bss = NULL;
         }
 }
 
@@ -974,8 +759,8 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
                                 break;
                         }
 
-                        if (memcmp(wdev->current_bss->pub.bssid,
-                                   mgmt->bssid, ETH_ALEN)) {
+                        if (!ether_addr_equal(wdev->current_bss->pub.bssid,
+                                              mgmt->bssid)) {
                                 err = -ENOTCONN;
                                 break;
                         }
@@ -988,8 +773,8 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
                                 break;
 
                         /* for station, check that DA is the AP */
-                        if (memcmp(wdev->current_bss->pub.bssid,
-                                   mgmt->da, ETH_ALEN)) {
+                        if (!ether_addr_equal(wdev->current_bss->pub.bssid,
+                                              mgmt->da)) {
                                 err = -ENOTCONN;
                                 break;
                         }
@@ -997,11 +782,11 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
                 case NL80211_IFTYPE_AP:
                 case NL80211_IFTYPE_P2P_GO:
                 case NL80211_IFTYPE_AP_VLAN:
-                        if (memcmp(mgmt->bssid, dev->dev_addr, ETH_ALEN))
+                        if (!ether_addr_equal(mgmt->bssid, dev->dev_addr))
                                 err = -EINVAL;
                         break;
                 case NL80211_IFTYPE_MESH_POINT:
-                        if (memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN)) {
+                        if (!ether_addr_equal(mgmt->sa, mgmt->bssid)) {
                                 err = -EINVAL;
                                 break;
                         }
@@ -1020,7 +805,7 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
                         return err;
         }
 
-        if (memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0)
+        if (!ether_addr_equal(mgmt->sa, dev->dev_addr))
                 return -EINVAL;
 
         /* Transmit the Action frame as requested by user space */
@@ -1030,8 +815,8 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
                                   cookie);
 }
 
-bool cfg80211_rx_mgmt(struct net_device *dev, int freq, const u8 *buf,
-                      size_t len, gfp_t gfp)
+bool cfg80211_rx_mgmt(struct net_device *dev, int freq, int sig_mbm,
+                      const u8 *buf, size_t len, gfp_t gfp)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
@@ -1070,7 +855,8 @@ bool cfg80211_rx_mgmt(struct net_device *dev, int freq, const u8 *buf,
                 /* found match! */
 
                 /* Indicate the received Action frame to user space */
-                if (nl80211_send_mgmt(rdev, dev, reg->nlpid, freq,
+                if (nl80211_send_mgmt(rdev, dev, reg->nlpid,
+                                      freq, sig_mbm,
                                       buf, len, gfp))
                         continue;
 
@@ -1143,6 +929,33 @@ void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
 }
 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
 
+void cfg80211_ch_switch_notify(struct net_device *dev, int freq,
+                               enum nl80211_channel_type type)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct ieee80211_channel *chan;
+
+        wdev_lock(wdev);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
+                    wdev->iftype != NL80211_IFTYPE_P2P_GO))
+                goto out;
+
+        chan = rdev_freq_to_chan(rdev, freq, type);
+        if (WARN_ON(!chan))
+                goto out;
+
+        wdev->channel = chan;
+
+        nl80211_ch_switch_notify(rdev, dev, freq, type, GFP_KERNEL);
+out:
+        wdev_unlock(wdev);
+        return;
+}
+EXPORT_SYMBOL(cfg80211_ch_switch_notify);
+
 bool cfg80211_rx_spurious_frame(struct net_device *dev,
                                 const u8 *addr, gfp_t gfp)
 {
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index afeea32e04ad..206465dc0cab 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -204,6 +204,8 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
                 .len = NL80211_HT_CAPABILITY_LEN
         },
         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
+        [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
+        [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 };
 
 /* policy for the key attributes */
@@ -354,20 +356,26 @@ static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 static int nl80211_msg_put_channel(struct sk_buff *msg,
                                    struct ieee80211_channel *chan)
 {
-        NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
-                    chan->center_freq);
+        if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
+                        chan->center_freq))
+                goto nla_put_failure;
 
-        if (chan->flags & IEEE80211_CHAN_DISABLED)
-                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
-        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
-        if (chan->flags & IEEE80211_CHAN_NO_IBSS)
-                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
-        if (chan->flags & IEEE80211_CHAN_RADAR)
-                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
+        if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
+            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
+                goto nla_put_failure;
+        if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
+            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
+                goto nla_put_failure;
+        if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
+            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
+                goto nla_put_failure;
+        if ((chan->flags & IEEE80211_CHAN_RADAR) &&
+            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
+                goto nla_put_failure;
 
-        NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
-                    DBM_TO_MBM(chan->max_power));
+        if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
+                        DBM_TO_MBM(chan->max_power)))
+                goto nla_put_failure;
 
         return 0;
 
@@ -427,10 +435,9 @@ static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 
         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
-                int err = nla_parse_nested(kdt,
-                                           NUM_NL80211_KEY_DEFAULT_TYPES - 1,
-                                           tb[NL80211_KEY_DEFAULT_TYPES],
-                                           nl80211_key_default_policy);
+                err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
+                                       tb[NL80211_KEY_DEFAULT_TYPES],
+                                       nl80211_key_default_policy);
                 if (err)
                         return err;
 
@@ -620,8 +627,8 @@ static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 
         i = 0;
         while (ifmodes) {
-                if (ifmodes & 1)
-                        NLA_PUT_FLAG(msg, i);
+                if ((ifmodes & 1) && nla_put_flag(msg, i))
+                        goto nla_put_failure;
                 ifmodes >>= 1;
                 i++;
         }
@@ -664,8 +671,9 @@ static int nl80211_put_iface_combinations(struct wiphy *wiphy,
                         nl_limit = nla_nest_start(msg, j + 1);
                         if (!nl_limit)
                                 goto nla_put_failure;
-                        NLA_PUT_U32(msg, NL80211_IFACE_LIMIT_MAX,
-                                    c->limits[j].max);
+                        if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
+                                        c->limits[j].max))
+                                goto nla_put_failure;
                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
                                                 c->limits[j].types))
                                 goto nla_put_failure;
@@ -674,13 +682,14 @@ static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 
                 nla_nest_end(msg, nl_limits);
 
-                if (c->beacon_int_infra_match)
-                        NLA_PUT_FLAG(msg,
-                                NL80211_IFACE_COMB_STA_AP_BI_MATCH);
-                NLA_PUT_U32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
-                            c->num_different_channels);
-                NLA_PUT_U32(msg, NL80211_IFACE_COMB_MAXNUM,
-                            c->max_interfaces);
+                if (c->beacon_int_infra_match &&
+                    nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
+                        goto nla_put_failure;
+                if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
+                                c->num_different_channels) ||
+                    nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
+                                c->max_interfaces))
+                        goto nla_put_failure;
 
                 nla_nest_end(msg, nl_combi);
         }
@@ -711,64 +720,74 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         if (!hdr)
                 return -1;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
-        NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
-
-        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
-                    cfg80211_rdev_list_generation);
-
-        NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
-                   dev->wiphy.retry_short);
-        NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
-                   dev->wiphy.retry_long);
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
-                    dev->wiphy.frag_threshold);
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
-                    dev->wiphy.rts_threshold);
-        NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
-                    dev->wiphy.coverage_class);
-        NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
-                   dev->wiphy.max_scan_ssids);
-        NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
-                   dev->wiphy.max_sched_scan_ssids);
-        NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
-                    dev->wiphy.max_scan_ie_len);
-        NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
-                    dev->wiphy.max_sched_scan_ie_len);
-        NLA_PUT_U8(msg, NL80211_ATTR_MAX_MATCH_SETS,
-                   dev->wiphy.max_match_sets);
-
-        if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
-                NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
-        if (dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH)
-                NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_MESH_AUTH);
-        if (dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD)
-                NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_AP_UAPSD);
-        if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)
-                NLA_PUT_FLAG(msg, NL80211_ATTR_ROAM_SUPPORT);
-        if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS)
-                NLA_PUT_FLAG(msg, NL80211_ATTR_TDLS_SUPPORT);
-        if (dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)
-                NLA_PUT_FLAG(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP);
-
-        NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
-                sizeof(u32) * dev->wiphy.n_cipher_suites,
-                dev->wiphy.cipher_suites);
-
-        NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
-                   dev->wiphy.max_num_pmkids);
-
-        if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
-                NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
-
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
-                    dev->wiphy.available_antennas_tx);
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
-                    dev->wiphy.available_antennas_rx);
-
-        if (dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD)
-                NLA_PUT_U32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
-                            dev->wiphy.probe_resp_offload);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
+            nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy)) ||
+            nla_put_u32(msg, NL80211_ATTR_GENERATION,
+                        cfg80211_rdev_list_generation) ||
+            nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
+                       dev->wiphy.retry_short) ||
+            nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
+                       dev->wiphy.retry_long) ||
+            nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
+                        dev->wiphy.frag_threshold) ||
+            nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
+                        dev->wiphy.rts_threshold) ||
+            nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
+                       dev->wiphy.coverage_class) ||
+            nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
+                       dev->wiphy.max_scan_ssids) ||
+            nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
+                       dev->wiphy.max_sched_scan_ssids) ||
+            nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
+                        dev->wiphy.max_scan_ie_len) ||
+            nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
+                        dev->wiphy.max_sched_scan_ie_len) ||
+            nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
+                       dev->wiphy.max_match_sets))
+                goto nla_put_failure;
+
+        if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
+            nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
+                goto nla_put_failure;
+        if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
+            nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
+                goto nla_put_failure;
+        if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
+            nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
+                goto nla_put_failure;
+        if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
+            nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
+                goto nla_put_failure;
+        if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
+            nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
+                goto nla_put_failure;
+        if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
+            nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
+                goto nla_put_failure;
+
+        if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
+                    sizeof(u32) * dev->wiphy.n_cipher_suites,
+                    dev->wiphy.cipher_suites))
+                goto nla_put_failure;
+
+        if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
+                       dev->wiphy.max_num_pmkids))
+                goto nla_put_failure;
+
+        if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
+            nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
+                goto nla_put_failure;
+
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
+                        dev->wiphy.available_antennas_tx) ||
+            nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
+                        dev->wiphy.available_antennas_rx))
+                goto nla_put_failure;
+
+        if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
+            nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
+                        dev->wiphy.probe_resp_offload))
+                goto nla_put_failure;
 
         if ((dev->wiphy.available_antennas_tx ||
              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
@@ -776,8 +795,11 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                 int res;
                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
                 if (!res) {
-                        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
-                        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
+                        if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX,
+                                        tx_ant) ||
+                            nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX,
+                                        rx_ant))
+                                goto nla_put_failure;
                 }
         }
 
@@ -798,17 +820,17 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                         goto nla_put_failure;
 
                 /* add HT info */
-                if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
-                        NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
-                                sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
-                                &dev->wiphy.bands[band]->ht_cap.mcs);
-                        NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
-                                dev->wiphy.bands[band]->ht_cap.cap);
-                        NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
-                                dev->wiphy.bands[band]->ht_cap.ampdu_factor);
-                        NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
-                                dev->wiphy.bands[band]->ht_cap.ampdu_density);
-                }
+                if (dev->wiphy.bands[band]->ht_cap.ht_supported &&
+                    (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
+                             sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
+                             &dev->wiphy.bands[band]->ht_cap.mcs) ||
+                     nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
+                                 dev->wiphy.bands[band]->ht_cap.cap) ||
+                     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
+                                dev->wiphy.bands[band]->ht_cap.ampdu_factor) ||
+                     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
+                                dev->wiphy.bands[band]->ht_cap.ampdu_density)))
+                        goto nla_put_failure;
 
                 /* add frequencies */
                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
@@ -841,11 +863,13 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                                 goto nla_put_failure;
 
                         rate = &dev->wiphy.bands[band]->bitrates[i];
-                        NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
-                                    rate->bitrate);
-                        if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
-                                NLA_PUT_FLAG(msg,
-                                        NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
+                        if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
+                                        rate->bitrate))
+                                goto nla_put_failure;
+                        if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
+                            nla_put_flag(msg,
+                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
+                                goto nla_put_failure;
 
                         nla_nest_end(msg, nl_rate);
                 }
@@ -865,14 +889,15 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
          do {                                                   \
                 if (dev->ops->op) {                             \
                         i++;                                    \
-                        NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
+                        if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
+                                goto nla_put_failure;           \
                 }                                               \
         } while (0)
 
         CMD(add_virtual_intf, NEW_INTERFACE);
         CMD(change_virtual_intf, SET_INTERFACE);
         CMD(add_key, NEW_KEY);
-        CMD(add_beacon, NEW_BEACON);
+        CMD(start_ap, START_AP);
         CMD(add_station, NEW_STATION);
         CMD(add_mpath, NEW_MPATH);
         CMD(update_mesh_config, SET_MESH_CONFIG);
@@ -893,7 +918,8 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
                 i++;
-                NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
+                if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
+                        goto nla_put_failure;
         }
         CMD(set_channel, SET_CHANNEL);
         CMD(set_wds_peer, SET_WDS_PEER);
@@ -907,7 +933,8 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         CMD(set_noack_map, SET_NOACK_MAP);
         if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
                 i++;
-                NLA_PUT_U32(msg, i, NL80211_CMD_REGISTER_BEACONS);
+                if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
+                        goto nla_put_failure;
         }
 
 #ifdef CONFIG_NL80211_TESTMODE
@@ -918,23 +945,27 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 
         if (dev->ops->connect || dev->ops->auth) {
                 i++;
-                NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
+                if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
+                        goto nla_put_failure;
         }
 
         if (dev->ops->disconnect || dev->ops->deauth) {
                 i++;
-                NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
+                if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
+                        goto nla_put_failure;
         }
 
         nla_nest_end(msg, nl_cmds);
 
         if (dev->ops->remain_on_channel &&
-            dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
-                NLA_PUT_U32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
-                            dev->wiphy.max_remain_on_channel_duration);
+            (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
+            nla_put_u32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
+                        dev->wiphy.max_remain_on_channel_duration))
+                goto nla_put_failure;
 
-        if (dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)
-                NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
+        if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
+            nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
+                goto nla_put_failure;
 
         if (mgmt_stypes) {
                 u16 stypes;
@@ -952,9 +983,10 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                         i = 0;
                         stypes = mgmt_stypes[ift].tx;
                         while (stypes) {
-                                if (stypes & 1)
-                                        NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
-                                                    (i << 4) | IEEE80211_FTYPE_MGMT);
+                                if ((stypes & 1) &&
+                                    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
+                                                (i << 4) | IEEE80211_FTYPE_MGMT))
+                                        goto nla_put_failure;
                                 stypes >>= 1;
                                 i++;
                         }
@@ -974,9 +1006,10 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                         i = 0;
                         stypes = mgmt_stypes[ift].rx;
                         while (stypes) {
-                                if (stypes & 1)
-                                        NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
-                                                    (i << 4) | IEEE80211_FTYPE_MGMT);
+                                if ((stypes & 1) &&
+                                    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
+                                                (i << 4) | IEEE80211_FTYPE_MGMT))
+                                        goto nla_put_failure;
                                 stypes >>= 1;
                                 i++;
                         }
@@ -993,22 +1026,23 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                 if (!nl_wowlan)
                         goto nla_put_failure;
 
-                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY)
-                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
-                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT)
-                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
-                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT)
-                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
-                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)
-                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED);
-                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)
-                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
-                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)
-                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
-                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)
-                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
-                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE)
-                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
+                if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
+                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
+                    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
+                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
+                    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
+                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
+                    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
+                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
+                    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
+                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
+                    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
+                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
+                    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
+                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
+                    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
+                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
+                    goto nla_put_failure;
                 if (dev->wiphy.wowlan.n_patterns) {
                         struct nl80211_wowlan_pattern_support pat = {
                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
@@ -1017,8 +1051,9 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                                 .max_pattern_len =
                                         dev->wiphy.wowlan.pattern_max_len,
                         };
-                        NLA_PUT(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
-                                sizeof(pat), &pat);
+                        if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
+                                    sizeof(pat), &pat))
+                                goto nla_put_failure;
                 }
 
                 nla_nest_end(msg, nl_wowlan);
@@ -1031,16 +1066,20 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
                 goto nla_put_failure;
 
-        if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME)
-                NLA_PUT_U32(msg, NL80211_ATTR_DEVICE_AP_SME,
-                            dev->wiphy.ap_sme_capa);
+        if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
+            nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
+                        dev->wiphy.ap_sme_capa))
+                goto nla_put_failure;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_FEATURE_FLAGS, dev->wiphy.features);
+        if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS,
+                        dev->wiphy.features))
+                goto nla_put_failure;
 
-        if (dev->wiphy.ht_capa_mod_mask)
-                NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
-                        sizeof(*dev->wiphy.ht_capa_mod_mask),
-                        dev->wiphy.ht_capa_mod_mask);
+        if (dev->wiphy.ht_capa_mod_mask &&
+            nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
+                    sizeof(*dev->wiphy.ht_capa_mod_mask),
+                    dev->wiphy.ht_capa_mod_mask))
+                goto nla_put_failure;
 
         return genlmsg_end(msg, hdr);
 
@@ -1103,17 +1142,20 @@ static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 static int parse_txq_params(struct nlattr *tb[],
                             struct ieee80211_txq_params *txq_params)
 {
-        if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
+        if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
             !tb[NL80211_TXQ_ATTR_AIFS])
                 return -EINVAL;
 
-        txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
+        txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 
+        if (txq_params->ac >= NL80211_NUM_ACS)
+                return -EINVAL;
+
         return 0;
 }
 
@@ -1137,6 +1179,27 @@ static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
 }
 
+static bool nl80211_valid_channel_type(struct genl_info *info,
+                                       enum nl80211_channel_type *channel_type)
+{
+        enum nl80211_channel_type tmp;
+
+        if (!info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
+                return false;
+
+        tmp = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
+        if (tmp != NL80211_CHAN_NO_HT &&
+            tmp != NL80211_CHAN_HT20 &&
+            tmp != NL80211_CHAN_HT40PLUS &&
+            tmp != NL80211_CHAN_HT40MINUS)
+                return false;
+
+        if (channel_type)
+                *channel_type = tmp;
+
+        return true;
+}
+
 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
                                  struct wireless_dev *wdev,
                                  struct genl_info *info)
@@ -1151,15 +1214,9 @@ static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
         if (!nl80211_can_set_dev_channel(wdev))
                 return -EOPNOTSUPP;
 
-        if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
-                channel_type = nla_get_u32(info->attrs[
-                                   NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
-                if (channel_type != NL80211_CHAN_NO_HT &&
-                    channel_type != NL80211_CHAN_HT20 &&
-                    channel_type != NL80211_CHAN_HT40PLUS &&
-                    channel_type != NL80211_CHAN_HT40MINUS)
-                        return -EINVAL;
-        }
+        if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
+            !nl80211_valid_channel_type(info, &channel_type))
+                return -EINVAL;
 
         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 
@@ -1293,6 +1350,11 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                         goto bad_res;
                 }
 
+                if (!netif_running(netdev)) {
+                        result = -ENETDOWN;
+                        goto bad_res;
+                }
+
                 nla_for_each_nested(nl_txq_params,
                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
                                     rem_txq_params) {
@@ -1483,14 +1545,28 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         if (!hdr)
                 return -1;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
+        if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
+            nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name) ||
+            nla_put_u32(msg, NL80211_ATTR_IFTYPE,
+                        dev->ieee80211_ptr->iftype) ||
+            nla_put_u32(msg, NL80211_ATTR_GENERATION,
+                        rdev->devlist_generation ^
+                        (cfg80211_rdev_list_generation << 2)))
+                goto nla_put_failure;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
-                    rdev->devlist_generation ^
-                        (cfg80211_rdev_list_generation << 2));
+        if (rdev->ops->get_channel) {
+                struct ieee80211_channel *chan;
+                enum nl80211_channel_type channel_type;
+
+                chan = rdev->ops->get_channel(&rdev->wiphy, &channel_type);
+                if (chan &&
+                    (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
+                                    chan->center_freq) ||
+                     nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
+                                    channel_type)))
+                        goto nla_put_failure;
+        }
 
         return genlmsg_end(msg, hdr);
 
@@ -1788,35 +1864,34 @@ static void get_key_callback(void *c, struct key_params *params)
         struct nlattr *key;
         struct get_key_cookie *cookie = c;
 
-        if (params->key)
-                NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
-                        params->key_len, params->key);
-
-        if (params->seq)
-                NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
-                        params->seq_len, params->seq);
-
-        if (params->cipher)
-                NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
-                            params->cipher);
+        if ((params->key &&
+             nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
+                     params->key_len, params->key)) ||
+            (params->seq &&
+             nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
+                     params->seq_len, params->seq)) ||
+            (params->cipher &&
+             nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
+                         params->cipher)))
+                goto nla_put_failure;
 
         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
         if (!key)
                 goto nla_put_failure;
 
-        if (params->key)
-                NLA_PUT(cookie->msg, NL80211_KEY_DATA,
-                        params->key_len, params->key);
-
-        if (params->seq)
-                NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
-                        params->seq_len, params->seq);
-
-        if (params->cipher)
-                NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
-                            params->cipher);
+        if ((params->key &&
+             nla_put(cookie->msg, NL80211_KEY_DATA,
+                     params->key_len, params->key)) ||
+            (params->seq &&
+             nla_put(cookie->msg, NL80211_KEY_SEQ,
+                     params->seq_len, params->seq)) ||
+            (params->cipher &&
+             nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
+                         params->cipher)))
+                goto nla_put_failure;
 
-        NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
+        if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
+                goto nla_put_failure;
 
         nla_nest_end(cookie->msg, key);
 
@@ -1874,10 +1949,12 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
         cookie.msg = msg;
         cookie.idx = key_idx;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
-        NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
-        if (mac_addr)
-                NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
+        if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
+            nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
+                goto nla_put_failure;
+        if (mac_addr &&
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
+                goto nla_put_failure;
 
         if (pairwise && mac_addr &&
             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
@@ -2076,15 +2153,10 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
-static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
+static int nl80211_parse_beacon(struct genl_info *info,
+                                struct cfg80211_beacon_data *bcn)
 {
-        int (*call)(struct wiphy *wiphy, struct net_device *dev,
-                    struct beacon_parameters *info);
-        struct cfg80211_registered_device *rdev = info->user_ptr[0];
-        struct net_device *dev = info->user_ptr[1];
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct beacon_parameters params;
-        int haveinfo = 0, err;
+        bool haveinfo = false;
 
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
@@ -2092,149 +2164,190 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
                 return -EINVAL;
 
-        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
-            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
-                return -EOPNOTSUPP;
-
-        memset(&params, 0, sizeof(params));
-
-        switch (info->genlhdr->cmd) {
-        case NL80211_CMD_NEW_BEACON:
-                /* these are required for NEW_BEACON */
-                if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
-                    !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
-                    !info->attrs[NL80211_ATTR_BEACON_HEAD])
-                        return -EINVAL;
-
-                params.interval =
-                        nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
-                params.dtim_period =
-                        nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
-
-                err = cfg80211_validate_beacon_int(rdev, params.interval);
-                if (err)
-                        return err;
-
-                /*
-                 * In theory, some of these attributes could be required for
-                 * NEW_BEACON, but since they were not used when the command was
-                 * originally added, keep them optional for old user space
-                 * programs to work with drivers that do not need the additional
-                 * information.
-                 */
-                if (info->attrs[NL80211_ATTR_SSID]) {
-                        params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
-                        params.ssid_len =
-                                nla_len(info->attrs[NL80211_ATTR_SSID]);
-                        if (params.ssid_len == 0 ||
-                            params.ssid_len > IEEE80211_MAX_SSID_LEN)
-                                return -EINVAL;
-                }
-
-                if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
-                        params.hidden_ssid = nla_get_u32(
-                                info->attrs[NL80211_ATTR_HIDDEN_SSID]);
-                        if (params.hidden_ssid !=
-                            NL80211_HIDDEN_SSID_NOT_IN_USE &&
-                            params.hidden_ssid !=
-                            NL80211_HIDDEN_SSID_ZERO_LEN &&
-                            params.hidden_ssid !=
-                            NL80211_HIDDEN_SSID_ZERO_CONTENTS)
-                                return -EINVAL;
-                }
-
-                params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
-
-                if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
-                        params.auth_type = nla_get_u32(
-                                info->attrs[NL80211_ATTR_AUTH_TYPE]);
-                        if (!nl80211_valid_auth_type(params.auth_type))
-                                return -EINVAL;
-                } else
-                        params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
-
-                err = nl80211_crypto_settings(rdev, info, &params.crypto,
-                                              NL80211_MAX_NR_CIPHER_SUITES);
-                if (err)
-                        return err;
-
-                call = rdev->ops->add_beacon;
-                break;
-        case NL80211_CMD_SET_BEACON:
-                call = rdev->ops->set_beacon;
-                break;
-        default:
-                WARN_ON(1);
-                return -EOPNOTSUPP;
-        }
-
-        if (!call)
-                return -EOPNOTSUPP;
+        memset(bcn, 0, sizeof(*bcn));
 
         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
-                params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
-                params.head_len =
-                    nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
-                haveinfo = 1;
+                bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
+                bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
+                if (!bcn->head_len)
+                        return -EINVAL;
+                haveinfo = true;
         }
 
         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
-                params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
-                params.tail_len =
+                bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
+                bcn->tail_len =
                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
-                haveinfo = 1;
+                haveinfo = true;
         }
 
         if (!haveinfo)
                 return -EINVAL;
 
         if (info->attrs[NL80211_ATTR_IE]) {
-                params.beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
-                params.beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+                bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
+                bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         }
 
         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
-                params.proberesp_ies =
+                bcn->proberesp_ies =
                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
-                params.proberesp_ies_len =
+                bcn->proberesp_ies_len =
                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
         }
 
         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
-                params.assocresp_ies =
+                bcn->assocresp_ies =
                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
-                params.assocresp_ies_len =
+                bcn->assocresp_ies_len =
                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
         }
 
         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
-                params.probe_resp =
+                bcn->probe_resp =
                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
-                params.probe_resp_len =
+                bcn->probe_resp_len =
                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
         }
 
-        err = call(&rdev->wiphy, dev, &params);
-        if (!err && params.interval)
-                wdev->beacon_interval = params.interval;
+        return 0;
+}
+
+static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_ap_settings params;
+        int err;
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
+                return -EOPNOTSUPP;
+
+        if (!rdev->ops->start_ap)
+                return -EOPNOTSUPP;
+
+        if (wdev->beacon_interval)
+                return -EALREADY;
+
+        memset(&params, 0, sizeof(params));
+
+        /* these are required for START_AP */
+        if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
+            !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
+            !info->attrs[NL80211_ATTR_BEACON_HEAD])
+                return -EINVAL;
+
+        err = nl80211_parse_beacon(info, &params.beacon);
+        if (err)
+                return err;
+
+        params.beacon_interval =
+                nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
+        params.dtim_period =
+                nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
+
+        err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
+        if (err)
+                return err;
+
+        /*
+         * In theory, some of these attributes should be required here
+         * but since they were not used when the command was originally
+         * added, keep them optional for old user space programs to let
+         * them continue to work with drivers that do not need the
+         * additional information -- drivers must check!
+         */
+        if (info->attrs[NL80211_ATTR_SSID]) {
+                params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
+                params.ssid_len =
+                        nla_len(info->attrs[NL80211_ATTR_SSID]);
+                if (params.ssid_len == 0 ||
+                    params.ssid_len > IEEE80211_MAX_SSID_LEN)
+                        return -EINVAL;
+        }
+
+        if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
+                params.hidden_ssid = nla_get_u32(
+                        info->attrs[NL80211_ATTR_HIDDEN_SSID]);
+                if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
+                    params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
+                    params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
+                        return -EINVAL;
+        }
+
+        params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
+
+        if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
+                params.auth_type = nla_get_u32(
+                        info->attrs[NL80211_ATTR_AUTH_TYPE]);
+                if (!nl80211_valid_auth_type(params.auth_type))
+                        return -EINVAL;
+        } else
+                params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
+
+        err = nl80211_crypto_settings(rdev, info, &params.crypto,
+                                      NL80211_MAX_NR_CIPHER_SUITES);
+        if (err)
+                return err;
+
+        if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
+                if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
+                        return -EOPNOTSUPP;
+                params.inactivity_timeout = nla_get_u16(
+                        info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
+        }
+
+        err = rdev->ops->start_ap(&rdev->wiphy, dev, &params);
+        if (!err)
+                wdev->beacon_interval = params.beacon_interval;
         return err;
 }
 
-static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
+static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_beacon_data params;
         int err;
 
-        if (!rdev->ops->del_beacon)
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
+                return -EOPNOTSUPP;
+
+        if (!rdev->ops->change_beacon)
+                return -EOPNOTSUPP;
+
+        if (!wdev->beacon_interval)
+                return -EINVAL;
+
+        err = nl80211_parse_beacon(info, &params);
+        if (err)
+                return err;
+
+        return rdev->ops->change_beacon(&rdev->wiphy, dev, &params);
+}
+
+static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        if (!rdev->ops->stop_ap)
                 return -EOPNOTSUPP;
 
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
                 return -EOPNOTSUPP;
 
-        err = rdev->ops->del_beacon(&rdev->wiphy, dev);
+        if (!wdev->beacon_interval)
+                return -ENOENT;
+
+        err = rdev->ops->stop_ap(&rdev->wiphy, dev);
         if (!err)
                 wdev->beacon_interval = 0;
         return err;
@@ -2312,10 +2425,16 @@ static int parse_station_flags(struct genl_info *info,
                 return -EINVAL;
         }
 
-        for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
-                if (flags[flag])
+        for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
+                if (flags[flag]) {
                         params->sta_flags_set |= (1<<flag);
 
+                        /* no longer support new API additions in old API */
+                        if (flag > NL80211_STA_FLAG_MAX_OLD_API)
+                                return -EINVAL;
+                }
+        }
+
         return 0;
 }
 
@@ -2331,15 +2450,15 @@ static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
 
         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
         bitrate = cfg80211_calculate_bitrate(info);
-        if (bitrate > 0)
-                NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
-
-        if (info->flags & RATE_INFO_FLAGS_MCS)
-                NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS, info->mcs);
-        if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
-                NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
-        if (info->flags & RATE_INFO_FLAGS_SHORT_GI)
-                NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
+        if ((bitrate > 0 &&
+             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate)) ||
+            ((info->flags & RATE_INFO_FLAGS_MCS) &&
+             nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) ||
+            ((info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) &&
+             nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH)) ||
+            ((info->flags & RATE_INFO_FLAGS_SHORT_GI) &&
+             nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)))
+                goto nla_put_failure;
 
         nla_nest_end(msg, rate);
         return true;
@@ -2349,7 +2468,9 @@ nla_put_failure:
 }
 
 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
-                                int flags, struct net_device *dev,
+                                int flags,
+                                struct cfg80211_registered_device *rdev,
+                                struct net_device *dev,
                                 const u8 *mac_addr, struct station_info *sinfo)
 {
         void *hdr;
@@ -2359,41 +2480,54 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
         if (!hdr)
                 return -1;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
-        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
-
-        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
+        if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
+            nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
+                goto nla_put_failure;
 
         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
         if (!sinfoattr)
                 goto nla_put_failure;
-        if (sinfo->filled & STATION_INFO_CONNECTED_TIME)
-                NLA_PUT_U32(msg, NL80211_STA_INFO_CONNECTED_TIME,
-                            sinfo->connected_time);
-        if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
-                NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
-                            sinfo->inactive_time);
-        if (sinfo->filled & STATION_INFO_RX_BYTES)
-                NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
-                            sinfo->rx_bytes);
-        if (sinfo->filled & STATION_INFO_TX_BYTES)
-                NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
-                            sinfo->tx_bytes);
-        if (sinfo->filled & STATION_INFO_LLID)
-                NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
-                            sinfo->llid);
-        if (sinfo->filled & STATION_INFO_PLID)
-                NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
-                            sinfo->plid);
-        if (sinfo->filled & STATION_INFO_PLINK_STATE)
-                NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
-                            sinfo->plink_state);
-        if (sinfo->filled & STATION_INFO_SIGNAL)
-                NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
-                           sinfo->signal);
-        if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
-                NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
-                           sinfo->signal_avg);
+        if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
+            nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
+                        sinfo->connected_time))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
+            nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
+                        sinfo->inactive_time))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_RX_BYTES) &&
+            nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
+                        sinfo->rx_bytes))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_TX_BYTES) &&
+            nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
+                        sinfo->tx_bytes))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_LLID) &&
+            nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_PLID) &&
+            nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
+            nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
+                       sinfo->plink_state))
+                goto nla_put_failure;
+        switch (rdev->wiphy.signal_type) {
+        case CFG80211_SIGNAL_TYPE_MBM:
+                if ((sinfo->filled & STATION_INFO_SIGNAL) &&
+                    nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
+                               sinfo->signal))
+                        goto nla_put_failure;
+                if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
+                    nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
+                               sinfo->signal_avg))
+                        goto nla_put_failure;
+                break;
+        default:
+                break;
+        }
         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
                                           NL80211_STA_INFO_TX_BITRATE))
@@ -2404,49 +2538,60 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
                                           NL80211_STA_INFO_RX_BITRATE))
                         goto nla_put_failure;
         }
-        if (sinfo->filled & STATION_INFO_RX_PACKETS)
-                NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
-                            sinfo->rx_packets);
-        if (sinfo->filled & STATION_INFO_TX_PACKETS)
-                NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
-                            sinfo->tx_packets);
-        if (sinfo->filled & STATION_INFO_TX_RETRIES)
-                NLA_PUT_U32(msg, NL80211_STA_INFO_TX_RETRIES,
-                            sinfo->tx_retries);
-        if (sinfo->filled & STATION_INFO_TX_FAILED)
-                NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
-                            sinfo->tx_failed);
-        if (sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT)
-                NLA_PUT_U32(msg, NL80211_STA_INFO_BEACON_LOSS,
-                            sinfo->beacon_loss_count);
+        if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
+            nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
+                        sinfo->rx_packets))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
+            nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
+                        sinfo->tx_packets))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
+            nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
+                        sinfo->tx_retries))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
+            nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
+                        sinfo->tx_failed))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
+            nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
+                        sinfo->beacon_loss_count))
+                goto nla_put_failure;
         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
                 if (!bss_param)
                         goto nla_put_failure;
 
-                if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT)
-                        NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_CTS_PROT);
-                if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE)
-                        NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE);
-                if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME)
-                        NLA_PUT_FLAG(msg,
-                                     NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME);
-                NLA_PUT_U8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
-                           sinfo->bss_param.dtim_period);
-                NLA_PUT_U16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
-                            sinfo->bss_param.beacon_interval);
+                if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
+                     nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
+                    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
+                     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
+                    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
+                     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
+                    nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
+                               sinfo->bss_param.dtim_period) ||
+                    nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
+                                sinfo->bss_param.beacon_interval))
+                        goto nla_put_failure;
 
                 nla_nest_end(msg, bss_param);
         }
-        if (sinfo->filled & STATION_INFO_STA_FLAGS)
-                NLA_PUT(msg, NL80211_STA_INFO_STA_FLAGS,
-                        sizeof(struct nl80211_sta_flag_update),
-                        &sinfo->sta_flags);
+        if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
+            nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
+                    sizeof(struct nl80211_sta_flag_update),
+                    &sinfo->sta_flags))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
+                nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
+                            sinfo->t_offset))
+                goto nla_put_failure;
         nla_nest_end(msg, sinfoattr);
 
-        if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
-                NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
-                        sinfo->assoc_req_ies);
+        if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
+            nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
+                    sinfo->assoc_req_ies))
+                goto nla_put_failure;
 
         return genlmsg_end(msg, hdr);
 
@@ -2486,7 +2631,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
                 if (nl80211_send_station(skb,
                                 NETLINK_CB(cb->skb).pid,
                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                netdev, mac_addr,
+                                dev, netdev, mac_addr,
                                 &sinfo) < 0)
                         goto out;
 
@@ -2531,7 +2676,7 @@ static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
                 return -ENOMEM;
 
         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
-                                 dev, mac_addr, &sinfo) < 0) {
+                                 rdev, dev, mac_addr, &sinfo) < 0) {
                 nlmsg_free(msg);
                 return -ENOBUFS;
         }
@@ -2655,13 +2800,6 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                 break;
         case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_STATION:
-                /* disallow things sta doesn't support */
-                if (params.plink_action)
-                        return -EINVAL;
-                if (params.ht_capa)
-                        return -EINVAL;
-                if (params.listen_interval >= 0)
-                        return -EINVAL;
                 /*
                  * Don't allow userspace to change the TDLS_PEER flag,
                  * but silently ignore attempts to change it since we
@@ -2669,7 +2807,15 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                  * to change the flag.
                  */
                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
-
+                /* fall through */
+        case NL80211_IFTYPE_ADHOC:
+                /* disallow things sta doesn't support */
+                if (params.plink_action)
+                        return -EINVAL;
+                if (params.ht_capa)
+                        return -EINVAL;
+                if (params.listen_interval >= 0)
+                        return -EINVAL;
                 /* reject any changes other than AUTHORIZED */
                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
                         return -EINVAL;
@@ -2867,36 +3013,37 @@ static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
         if (!hdr)
                 return -1;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
-        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
-        NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
-
-        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
+        if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
+            nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
+            nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
+                goto nla_put_failure;
 
         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
         if (!pinfoattr)
                 goto nla_put_failure;
-        if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
-                NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
-                            pinfo->frame_qlen);
-        if (pinfo->filled & MPATH_INFO_SN)
-                NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
-                            pinfo->sn);
-        if (pinfo->filled & MPATH_INFO_METRIC)
-                NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
-                            pinfo->metric);
-        if (pinfo->filled & MPATH_INFO_EXPTIME)
-                NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
-                            pinfo->exptime);
-        if (pinfo->filled & MPATH_INFO_FLAGS)
-                NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
-                            pinfo->flags);
-        if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
-                NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
-                            pinfo->discovery_timeout);
-        if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
-                NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
-                            pinfo->discovery_retries);
+        if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
+            nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
+                        pinfo->frame_qlen))
+                goto nla_put_failure;
+        if (((pinfo->filled & MPATH_INFO_SN) &&
+             nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
+            ((pinfo->filled & MPATH_INFO_METRIC) &&
+             nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
+                         pinfo->metric)) ||
+            ((pinfo->filled & MPATH_INFO_EXPTIME) &&
+             nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
+                         pinfo->exptime)) ||
+            ((pinfo->filled & MPATH_INFO_FLAGS) &&
+             nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
+                        pinfo->flags)) ||
+            ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
+             nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
+                         pinfo->discovery_timeout)) ||
+            ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
+             nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
+                        pinfo->discovery_retries)))
+                goto nla_put_failure;
 
         nla_nest_end(msg, pinfoattr);
 
@@ -3222,43 +3369,52 @@ static int nl80211_get_mesh_config(struct sk_buff *skb,
         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
         if (!pinfoattr)
                 goto nla_put_failure;
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
-        NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
-                        cur_params.dot11MeshRetryTimeout);
-        NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
-                        cur_params.dot11MeshConfirmTimeout);
-        NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
-                        cur_params.dot11MeshHoldingTimeout);
-        NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
-                        cur_params.dot11MeshMaxPeerLinks);
-        NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
-                        cur_params.dot11MeshMaxRetries);
-        NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
-                        cur_params.dot11MeshTTL);
-        NLA_PUT_U8(msg, NL80211_MESHCONF_ELEMENT_TTL,
-                        cur_params.element_ttl);
-        NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
-                        cur_params.auto_open_plinks);
-        NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
-                        cur_params.dot11MeshHWMPmaxPREQretries);
-        NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
-                        cur_params.path_refresh_time);
-        NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
-                        cur_params.min_discovery_timeout);
-        NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
-                        cur_params.dot11MeshHWMPactivePathTimeout);
-        NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
-                        cur_params.dot11MeshHWMPpreqMinInterval);
-        NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
-                        cur_params.dot11MeshHWMPperrMinInterval);
-        NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
-                        cur_params.dot11MeshHWMPnetDiameterTraversalTime);
-        NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
-                        cur_params.dot11MeshHWMPRootMode);
-        NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
-                        cur_params.dot11MeshHWMPRannInterval);
-        NLA_PUT_U8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
-                        cur_params.dot11MeshGateAnnouncementProtocol);
+        if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
+            nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
+                        cur_params.dot11MeshRetryTimeout) ||
+            nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
+                        cur_params.dot11MeshConfirmTimeout) ||
+            nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
+                        cur_params.dot11MeshHoldingTimeout) ||
+            nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
+                        cur_params.dot11MeshMaxPeerLinks) ||
+            nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
+                       cur_params.dot11MeshMaxRetries) ||
+            nla_put_u8(msg, NL80211_MESHCONF_TTL,
+                       cur_params.dot11MeshTTL) ||
+            nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
+                       cur_params.element_ttl) ||
+            nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
+                       cur_params.auto_open_plinks) ||
+            nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
+                        cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
+            nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
+                       cur_params.dot11MeshHWMPmaxPREQretries) ||
+            nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
+                        cur_params.path_refresh_time) ||
+            nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
+                        cur_params.min_discovery_timeout) ||
+            nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
+                        cur_params.dot11MeshHWMPactivePathTimeout) ||
+            nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
+                        cur_params.dot11MeshHWMPpreqMinInterval) ||
+            nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
+                        cur_params.dot11MeshHWMPperrMinInterval) ||
+            nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
+                        cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
+            nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
+                       cur_params.dot11MeshHWMPRootMode) ||
+            nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
+                        cur_params.dot11MeshHWMPRannInterval) ||
+            nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
+                       cur_params.dot11MeshGateAnnouncementProtocol) ||
+            nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
+                       cur_params.dot11MeshForwarding) ||
+            nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
+                        cur_params.rssi_threshold) ||
+            nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
+                        cur_params.ht_opmode))
+                goto nla_put_failure;
         nla_nest_end(msg, pinfoattr);
         genlmsg_end(msg, hdr);
         return genlmsg_reply(msg, info);
@@ -3279,6 +3435,7 @@ static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_A
         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
+        [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
 
         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
@@ -3290,10 +3447,14 @@ static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_A
         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
+        [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
+        [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32},
+        [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16},
 };
 
 static const struct nla_policy
         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
+        [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
@@ -3346,6 +3507,9 @@ do {\
                         mask, NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
+                        mask, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
+                        nla_get_u32);
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
                         nla_get_u8);
@@ -3379,6 +3543,12 @@ do {\
                         dot11MeshGateAnnouncementProtocol, mask,
                         NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
                         nla_get_u8);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding,
+                        mask, NL80211_MESHCONF_FORWARDING, nla_get_u8);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold,
+                        mask, NL80211_MESHCONF_RSSI_THRESHOLD, nla_get_u32);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode,
+                        mask, NL80211_MESHCONF_HT_OPMODE, nla_get_u16);
         if (mask_out)
                 *mask_out = mask;
 
@@ -3399,6 +3569,12 @@ static int nl80211_parse_mesh_setup(struct genl_info *info,
                              nl80211_mesh_setup_params_policy))
                 return -EINVAL;
 
+        if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
+                setup->sync_method =
+                (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
+                 IEEE80211_SYNC_METHOD_VENDOR :
+                 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
+
         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
                 setup->path_sel_proto =
                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
@@ -3483,11 +3659,12 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
         if (!hdr)
                 goto put_failure;
 
-        NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
-                cfg80211_regdomain->alpha2);
-        if (cfg80211_regdomain->dfs_region)
-                NLA_PUT_U8(msg, NL80211_ATTR_DFS_REGION,
-                           cfg80211_regdomain->dfs_region);
+        if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
+                           cfg80211_regdomain->alpha2) ||
+            (cfg80211_regdomain->dfs_region &&
+             nla_put_u8(msg, NL80211_ATTR_DFS_REGION,
+                        cfg80211_regdomain->dfs_region)))
+                goto nla_put_failure;
 
         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
         if (!nl_reg_rules)
@@ -3507,18 +3684,19 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
                 if (!nl_reg_rule)
                         goto nla_put_failure;
 
-                NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
-                        reg_rule->flags);
-                NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
-                        freq_range->start_freq_khz);
-                NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
-                        freq_range->end_freq_khz);
-                NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
-                        freq_range->max_bandwidth_khz);
-                NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
-                        power_rule->max_antenna_gain);
-                NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
-                        power_rule->max_eirp);
+                if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
+                                reg_rule->flags) ||
+                    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
+                                freq_range->start_freq_khz) ||
+                    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
+                                freq_range->end_freq_khz) ||
+                    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
+                                freq_range->max_bandwidth_khz) ||
+                    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
+                                power_rule->max_antenna_gain) ||
+                    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
+                                power_rule->max_eirp))
+                        goto nla_put_failure;
 
                 nla_nest_end(msg, nl_reg_rule);
         }
@@ -4079,7 +4257,6 @@ static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
         struct cfg80211_bss *res = &intbss->pub;
         void *hdr;
         struct nlattr *bss;
-        int i;
 
         ASSERT_WDEV_LOCK(wdev);
 
@@ -4090,37 +4267,44 @@ static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
 
         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
 
-        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
+        if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
+                goto nla_put_failure;
 
         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
         if (!bss)
                 goto nla_put_failure;
-        if (!is_zero_ether_addr(res->bssid))
-                NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
-        if (res->information_elements && res->len_information_elements)
-                NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
-                        res->len_information_elements,
-                        res->information_elements);
-        if (res->beacon_ies && res->len_beacon_ies &&
-            res->beacon_ies != res->information_elements)
-                NLA_PUT(msg, NL80211_BSS_BEACON_IES,
-                        res->len_beacon_ies, res->beacon_ies);
-        if (res->tsf)
-                NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
-        if (res->beacon_interval)
-                NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
-        NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
-        NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
-        NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
-                jiffies_to_msecs(jiffies - intbss->ts));
+        if ((!is_zero_ether_addr(res->bssid) &&
+             nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)) ||
+            (res->information_elements && res->len_information_elements &&
+             nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
+                     res->len_information_elements,
+                     res->information_elements)) ||
+            (res->beacon_ies && res->len_beacon_ies &&
+             res->beacon_ies != res->information_elements &&
+             nla_put(msg, NL80211_BSS_BEACON_IES,
+                     res->len_beacon_ies, res->beacon_ies)))
+                goto nla_put_failure;
+        if (res->tsf &&
+            nla_put_u64(msg, NL80211_BSS_TSF, res->tsf))
+                goto nla_put_failure;
+        if (res->beacon_interval &&
+            nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
+                goto nla_put_failure;
+        if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
+            nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
+            nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
+                        jiffies_to_msecs(jiffies - intbss->ts)))
+                goto nla_put_failure;
 
         switch (rdev->wiphy.signal_type) {
         case CFG80211_SIGNAL_TYPE_MBM:
-                NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
+                if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
+                        goto nla_put_failure;
                 break;
         case CFG80211_SIGNAL_TYPE_UNSPEC:
-                NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
+                if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
+                        goto nla_put_failure;
                 break;
         default:
                 break;
@@ -4129,21 +4313,16 @@ static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
         switch (wdev->iftype) {
         case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_STATION:
-                if (intbss == wdev->current_bss)
-                        NLA_PUT_U32(msg, NL80211_BSS_STATUS,
-                                    NL80211_BSS_STATUS_ASSOCIATED);
-                else for (i = 0; i < MAX_AUTH_BSSES; i++) {
-                        if (intbss != wdev->auth_bsses[i])
-                                continue;
-                        NLA_PUT_U32(msg, NL80211_BSS_STATUS,
-                                    NL80211_BSS_STATUS_AUTHENTICATED);
-                        break;
-                }
+                if (intbss == wdev->current_bss &&
+                    nla_put_u32(msg, NL80211_BSS_STATUS,
+                                NL80211_BSS_STATUS_ASSOCIATED))
+                        goto nla_put_failure;
                 break;
         case NL80211_IFTYPE_ADHOC:
-                if (intbss == wdev->current_bss)
-                        NLA_PUT_U32(msg, NL80211_BSS_STATUS,
-                                    NL80211_BSS_STATUS_IBSS_JOINED);
+                if (intbss == wdev->current_bss &&
+                    nla_put_u32(msg, NL80211_BSS_STATUS,
+                                NL80211_BSS_STATUS_IBSS_JOINED))
+                        goto nla_put_failure;
                 break;
         default:
                 break;
@@ -4212,34 +4391,43 @@ static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
         if (!hdr)
                 return -ENOMEM;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
+        if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
+                goto nla_put_failure;
 
         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
         if (!infoattr)
                 goto nla_put_failure;
 
-        NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
-                    survey->channel->center_freq);
-        if (survey->filled & SURVEY_INFO_NOISE_DBM)
-                NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
-                            survey->noise);
-        if (survey->filled & SURVEY_INFO_IN_USE)
-                NLA_PUT_FLAG(msg, NL80211_SURVEY_INFO_IN_USE);
-        if (survey->filled & SURVEY_INFO_CHANNEL_TIME)
-                NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
-                            survey->channel_time);
-        if (survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
-                NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
-                            survey->channel_time_busy);
-        if (survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
-                NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
-                            survey->channel_time_ext_busy);
-        if (survey->filled & SURVEY_INFO_CHANNEL_TIME_RX)
-                NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
-                            survey->channel_time_rx);
-        if (survey->filled & SURVEY_INFO_CHANNEL_TIME_TX)
-                NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
-                            survey->channel_time_tx);
+        if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
+                        survey->channel->center_freq))
+                goto nla_put_failure;
+
+        if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
+            nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
+                goto nla_put_failure;
+        if ((survey->filled & SURVEY_INFO_IN_USE) &&
+            nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
+                goto nla_put_failure;
+        if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
+            nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
+                        survey->channel_time))
+                goto nla_put_failure;
+        if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
+            nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
+                        survey->channel_time_busy))
+                goto nla_put_failure;
+        if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
+            nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
+                        survey->channel_time_ext_busy))
+                goto nla_put_failure;
+        if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
+            nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
+                        survey->channel_time_rx))
+                goto nla_put_failure;
+        if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
+            nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
+                        survey->channel_time_tx))
+                goto nla_put_failure;
 
         nla_nest_end(msg, infoattr);
 
@@ -4406,10 +4594,16 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
 
         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
 
+        /*
+         * Since we no longer track auth state, ignore
+         * requests to only change local state.
+         */
+        if (local_state_change)
+                return 0;
+
         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
                                   ssid, ssid_len, ie, ie_len,
-                                  key.p.key, key.p.key_len, key.idx,
-                                  local_state_change);
+                                  key.p.key, key.p.key_len, key.idx);
 }
 
 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
@@ -4739,12 +4933,7 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
                 enum nl80211_channel_type channel_type;
 
-                channel_type = nla_get_u32(
-                                info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
-                if (channel_type != NL80211_CHAN_NO_HT &&
-                    channel_type != NL80211_CHAN_HT20 &&
-                    channel_type != NL80211_CHAN_HT40MINUS &&
-                    channel_type != NL80211_CHAN_HT40PLUS)
+                if (!nl80211_valid_channel_type(info, &channel_type))
                         return -EINVAL;
 
                 if (channel_type != NL80211_CHAN_NO_HT &&
@@ -4781,7 +4970,6 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
                 struct ieee80211_supported_band *sband =
                         wiphy->bands[ibss.channel->band];
-                int err;
 
                 err = ieee80211_get_ratemask(sband, rates, n_rates,
                                              &ibss.basic_rates);
@@ -4801,6 +4989,9 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
                         return PTR_ERR(connkeys);
         }
 
+        ibss.control_port =
+                nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
+
         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
         if (err)
                 kfree(connkeys);
@@ -4912,7 +5103,7 @@ static int nl80211_testmode_dump(struct sk_buff *skb,
                                            NL80211_CMD_TESTMODE);
                 struct nlattr *tmdata;
 
-                if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx) < 0) {
+                if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
                         genlmsg_cancel(skb, hdr);
                         break;
                 }
@@ -4963,7 +5154,8 @@ __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
                 return NULL;
         }
 
-        NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
+                goto nla_put_failure;
         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
 
         ((void **)skb->cb)[0] = rdev;
@@ -5069,6 +5261,13 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
 
         wiphy = &rdev->wiphy;
 
+        connect.bg_scan_period = -1;
+        if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
+                (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
+                connect.bg_scan_period =
+                        nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
+        }
+
         if (info->attrs[NL80211_ATTR_MAC])
                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
@@ -5302,15 +5501,9 @@ static int nl80211_remain_on_channel(struct sk_buff *skb,
             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
                 return -EOPNOTSUPP;
 
-        if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
-                channel_type = nla_get_u32(
-                        info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
-                if (channel_type != NL80211_CHAN_NO_HT &&
-                    channel_type != NL80211_CHAN_HT20 &&
-                    channel_type != NL80211_CHAN_HT40PLUS &&
-                    channel_type != NL80211_CHAN_HT40MINUS)
-                        return -EINVAL;
-        }
+        if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
+            !nl80211_valid_channel_type(info, &channel_type))
+                return -EINVAL;
 
         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
         chan = rdev_freq_to_chan(rdev, freq, channel_type);
@@ -5335,7 +5528,8 @@ static int nl80211_remain_on_channel(struct sk_buff *skb,
         if (err)
                 goto free_msg;
 
-        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+        if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -5390,9 +5584,39 @@ static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
         return mask;
 }
 
+static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
+                               u8 *rates, u8 rates_len,
+                               u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
+{
+        u8 i;
+
+        memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
+
+        for (i = 0; i < rates_len; i++) {
+                int ridx, rbit;
+
+                ridx = rates[i] / 8;
+                rbit = BIT(rates[i] % 8);
+
+                /* check validity */
+                if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
+                        return false;
+
+                /* check availability */
+                if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
+                        mcs[ridx] |= rbit;
+                else
+                        return false;
+        }
+
+        return true;
+}
+
 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
                                     .len = NL80211_MAX_SUPP_RATES },
+        [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
+                                 .len = NL80211_MAX_SUPP_HT_RATES },
 };
 
 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
@@ -5418,12 +5642,20 @@ static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
                 sband = rdev->wiphy.bands[i];
                 mask.control[i].legacy =
                         sband ? (1 << sband->n_bitrates) - 1 : 0;
+                if (sband)
+                        memcpy(mask.control[i].mcs,
+                               sband->ht_cap.mcs.rx_mask,
+                               sizeof(mask.control[i].mcs));
+                else
+                        memset(mask.control[i].mcs, 0,
+                               sizeof(mask.control[i].mcs));
         }
 
         /*
          * The nested attribute uses enum nl80211_band as the index. This maps
          * directly to the enum ieee80211_band values used in cfg80211.
          */
+        BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
         {
                 enum ieee80211_band band = nla_type(tx_rates);
@@ -5439,7 +5671,31 @@ static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
                                 sband,
                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
-                        if (mask.control[band].legacy == 0)
+                        if ((mask.control[band].legacy == 0) &&
+                            nla_len(tb[NL80211_TXRATE_LEGACY]))
+                                return -EINVAL;
+                }
+                if (tb[NL80211_TXRATE_MCS]) {
+                        if (!ht_rateset_to_mask(
+                                        sband,
+                                        nla_data(tb[NL80211_TXRATE_MCS]),
+                                        nla_len(tb[NL80211_TXRATE_MCS]),
+                                        mask.control[band].mcs))
+                                return -EINVAL;
+                }
+
+                if (mask.control[band].legacy == 0) {
+                        /* don't allow empty legacy rates if HT
+                         * is not even supported. */
+                        if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
+                                return -EINVAL;
+
+                        for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
+                                if (mask.control[band].mcs[i])
+                                        break;
+
+                        /* legacy and mcs rates may not be both empty */
+                        if (i == IEEE80211_HT_MCS_MASK_LEN)
                                 return -EINVAL;
                 }
         }
@@ -5518,12 +5774,7 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
         }
 
         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
-                channel_type = nla_get_u32(
-                        info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
-                if (channel_type != NL80211_CHAN_NO_HT &&
-                    channel_type != NL80211_CHAN_HT20 &&
-                    channel_type != NL80211_CHAN_HT40PLUS &&
-                    channel_type != NL80211_CHAN_HT40MINUS)
+                if (!nl80211_valid_channel_type(info, &channel_type))
                         return -EINVAL;
                 channel_type_valid = true;
         }
@@ -5563,7 +5814,8 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
                 goto free_msg;
 
         if (msg) {
-                NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+                if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
+                        goto nla_put_failure;
 
                 genlmsg_end(msg, hdr);
                 return genlmsg_reply(msg, info);
@@ -5668,7 +5920,8 @@ static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
         else
                 ps_state = NL80211_PS_DISABLED;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
+        if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
         return genlmsg_reply(msg, info);
@@ -5815,20 +6068,21 @@ static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
                 if (!nl_wowlan)
                         goto nla_put_failure;
 
-                if (rdev->wowlan->any)
-                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
-                if (rdev->wowlan->disconnect)
-                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
-                if (rdev->wowlan->magic_pkt)
-                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
-                if (rdev->wowlan->gtk_rekey_failure)
-                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
-                if (rdev->wowlan->eap_identity_req)
-                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
-                if (rdev->wowlan->four_way_handshake)
-                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
-                if (rdev->wowlan->rfkill_release)
-                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
+                if ((rdev->wowlan->any &&
+                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
+                    (rdev->wowlan->disconnect &&
+                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
+                    (rdev->wowlan->magic_pkt &&
+                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
+                    (rdev->wowlan->gtk_rekey_failure &&
+                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
+                    (rdev->wowlan->eap_identity_req &&
+                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
+                    (rdev->wowlan->four_way_handshake &&
+                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
+                    (rdev->wowlan->rfkill_release &&
+                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
+                        goto nla_put_failure;
                 if (rdev->wowlan->n_patterns) {
                         struct nlattr *nl_pats, *nl_pat;
                         int i, pat_len;
@@ -5843,12 +6097,13 @@ static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
                                 if (!nl_pat)
                                         goto nla_put_failure;
                                 pat_len = rdev->wowlan->patterns[i].pattern_len;
-                                NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_MASK,
-                                        DIV_ROUND_UP(pat_len, 8),
-                                        rdev->wowlan->patterns[i].mask);
-                                NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
-                                        pat_len,
-                                        rdev->wowlan->patterns[i].pattern);
+                                if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
+                                            DIV_ROUND_UP(pat_len, 8),
+                                            rdev->wowlan->patterns[i].mask) ||
+                                    nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
+                                            pat_len,
+                                            rdev->wowlan->patterns[i].pattern))
+                                        goto nla_put_failure;
                                 nla_nest_end(msg, nl_pat);
                         }
                         nla_nest_end(msg, nl_pats);
@@ -5873,6 +6128,7 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_wowlan new_triggers = {};
         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
         int err, i;
+        bool prev_enabled = rdev->wowlan;
 
         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
                 return -EOPNOTSUPP;
@@ -6005,6 +6261,9 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                 rdev->wowlan = NULL;
         }
 
+        if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
+                rdev->ops->set_wakeup(&rdev->wiphy, rdev->wowlan);
+
         return 0;
  error:
         for (i = 0; i < new_triggers.n_patterns; i++)
@@ -6121,7 +6380,8 @@ static int nl80211_probe_client(struct sk_buff *skb,
         if (err)
                 goto free_msg;
 
-        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+        if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -6262,7 +6522,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_get_key,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6293,24 +6553,24 @@ static struct genl_ops nl80211_ops[] = {
                 .cmd = NL80211_CMD_SET_BEACON,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .doit = nl80211_addset_beacon,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .doit = nl80211_set_beacon,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
-                .cmd = NL80211_CMD_NEW_BEACON,
+                .cmd = NL80211_CMD_START_AP,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .doit = nl80211_addset_beacon,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .doit = nl80211_start_ap,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
-                .cmd = NL80211_CMD_DEL_BEACON,
+                .cmd = NL80211_CMD_STOP_AP,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .doit = nl80211_del_beacon,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .doit = nl80211_stop_ap,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6326,7 +6586,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_set_station,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6342,7 +6602,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_del_station,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6375,7 +6635,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_del_mpath,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6383,7 +6643,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_set_bss,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6409,7 +6669,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_get_mesh_config,
                 .policy = nl80211_policy,
                 /* can be retrieved by unprivileged users */
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6542,7 +6802,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_setdel_pmksa,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6550,7 +6810,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_setdel_pmksa,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6558,7 +6818,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_flush_pmksa,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6718,7 +6978,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_probe_client,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6789,19 +7049,24 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
         if (!nest)
                 goto nla_put_failure;
-        for (i = 0; i < req->n_ssids; i++)
-                NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
+        for (i = 0; i < req->n_ssids; i++) {
+                if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
+                        goto nla_put_failure;
+        }
         nla_nest_end(msg, nest);
 
         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
         if (!nest)
                 goto nla_put_failure;
-        for (i = 0; i < req->n_channels; i++)
-                NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
+        for (i = 0; i < req->n_channels; i++) {
+                if (nla_put_u32(msg, i, req->channels[i]->center_freq))
+                        goto nla_put_failure;
+        }
         nla_nest_end(msg, nest);
 
-        if (req->ie)
-                NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
+        if (req->ie &&
+            nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
+                goto nla_put_failure;
 
         return 0;
  nla_put_failure:
@@ -6820,8 +7085,9 @@ static int nl80211_send_scan_msg(struct sk_buff *msg,
         if (!hdr)
                 return -1;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
+                goto nla_put_failure;
 
         /* ignore errors and send incomplete event anyway */
         nl80211_add_scan_req(msg, rdev);
@@ -6845,8 +7111,9 @@ nl80211_send_sched_scan_msg(struct sk_buff *msg,
         if (!hdr)
                 return -1;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
+                goto nla_put_failure;
 
         return genlmsg_end(msg, hdr);
 
@@ -6969,26 +7236,33 @@ void nl80211_send_reg_change_event(struct regulatory_request *request)
         }
 
         /* Userspace can always count this one always being set */
-        NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
-
-        if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
-                NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
-                           NL80211_REGDOM_TYPE_WORLD);
-        else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
-                NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
-                           NL80211_REGDOM_TYPE_CUSTOM_WORLD);
-        else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
-                 request->intersect)
-                NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
-                           NL80211_REGDOM_TYPE_INTERSECTION);
-        else {
-                NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
-                           NL80211_REGDOM_TYPE_COUNTRY);
-                NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
-        }
-
-        if (wiphy_idx_valid(request->wiphy_idx))
-                NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
+        if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
+                goto nla_put_failure;
+
+        if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
+                if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
+                               NL80211_REGDOM_TYPE_WORLD))
+                        goto nla_put_failure;
+        } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
+                if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
+                               NL80211_REGDOM_TYPE_CUSTOM_WORLD))
+                        goto nla_put_failure;
+        } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
+                   request->intersect) {
+                if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
+                               NL80211_REGDOM_TYPE_INTERSECTION))
+                        goto nla_put_failure;
+        } else {
+                if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
+                               NL80211_REGDOM_TYPE_COUNTRY) ||
+                    nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
+                                   request->alpha2))
+                        goto nla_put_failure;
+        }
+
+        if (wiphy_idx_valid(request->wiphy_idx) &&
+            nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -7022,9 +7296,10 @@ static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
-        NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            nla_put(msg, NL80211_ATTR_FRAME, len, buf))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -7102,10 +7377,11 @@ static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
-        NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
-        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -7153,15 +7429,15 @@ void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
-        if (bssid)
-                NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
-        NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
-        if (req_ie)
-                NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
-        if (resp_ie)
-                NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
+            nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
+            (req_ie &&
+             nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
+            (resp_ie &&
+             nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -7193,13 +7469,14 @@ void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
-        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
-        if (req_ie)
-                NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
-        if (resp_ie)
-                NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
+            (req_ie &&
+             nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
+            (resp_ie &&
+             nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -7230,14 +7507,14 @@ void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
-        if (from_ap && reason)
-                NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
-        if (from_ap)
-                NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
-        if (ie)
-                NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            (from_ap && reason &&
+             nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
+            (from_ap &&
+             nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
+            (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -7268,9 +7545,10 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
-        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -7301,11 +7579,12 @@ void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
-        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr);
-        if (ie_len && ie)
-                NLA_PUT(msg, NL80211_ATTR_IE, ie_len , ie);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
+            (ie_len && ie &&
+             nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -7336,15 +7615,14 @@ void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
-        if (addr)
-                NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
-        NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
-        if (key_id != -1)
-                NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
-        if (tsc)
-                NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
+            nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
+            (key_id != -1 &&
+             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
+            (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -7379,7 +7657,8 @@ void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
          * Since we are applying the beacon hint to a wiphy we know its
          * wiphy_idx is valid
          */
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
+                goto nla_put_failure;
 
         /* Before */
         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
@@ -7431,14 +7710,16 @@ static void nl80211_send_remain_on_chan_event(
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
-        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
+            nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type) ||
+            nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
+                goto nla_put_failure;
 
-        if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
-                NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
+        if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
+            nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -7482,7 +7763,8 @@ void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
         if (!msg)
                 return;
 
-        if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
+        if (nl80211_send_station(msg, 0, 0, 0,
+                                 rdev, dev, mac_addr, sinfo) < 0) {
                 nlmsg_free(msg);
                 return;
         }
@@ -7508,8 +7790,9 @@ void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
-        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
+        if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -7545,9 +7828,10 @@ static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
                 return true;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
-        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
+                goto nla_put_failure;
 
         err = genlmsg_end(msg, hdr);
         if (err < 0) {
@@ -7580,7 +7864,8 @@ bool nl80211_unexpected_4addr_frame(struct net_device *dev,
 
 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
                       struct net_device *netdev, u32 nlpid,
-                      int freq, const u8 *buf, size_t len, gfp_t gfp)
+                      int freq, int sig_dbm,
+                      const u8 *buf, size_t len, gfp_t gfp)
 {
         struct sk_buff *msg;
         void *hdr;
@@ -7595,10 +7880,13 @@ int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
                 return -ENOMEM;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
-        NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
+            (sig_dbm &&
+             nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
+            nla_put(msg, NL80211_ATTR_FRAME, len, buf))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -7628,12 +7916,12 @@ void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
-        NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
-        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
-        if (ack)
-                NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
+            nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
+            (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
@@ -7665,15 +7953,17 @@ nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
+                goto nla_put_failure;
 
         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
         if (!pinfoattr)
                 goto nla_put_failure;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
-                    rssi_event);
+        if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
+                        rssi_event))
+                goto nla_put_failure;
 
         nla_nest_end(msg, pinfoattr);
 
@@ -7706,16 +7996,18 @@ void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
-        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
+                goto nla_put_failure;
 
         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
         if (!rekey_attr)
                 goto nla_put_failure;
 
-        NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR,
-                NL80211_REPLAY_CTR_LEN, replay_ctr);
+        if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
+                    NL80211_REPLAY_CTR_LEN, replay_ctr))
+                goto nla_put_failure;
 
         nla_nest_end(msg, rekey_attr);
 
@@ -7748,17 +8040,19 @@ void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
+                goto nla_put_failure;
 
         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
         if (!attr)
                 goto nla_put_failure;
 
-        NLA_PUT_U32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index);
-        NLA_PUT(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid);
-        if (preauth)
-                NLA_PUT_FLAG(msg, NL80211_PMKSA_CANDIDATE_PREAUTH);
+        if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
+            nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
+            (preauth &&
+             nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
+                goto nla_put_failure;
 
         nla_nest_end(msg, attr);
 
@@ -7773,6 +8067,39 @@ void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
         nlmsg_free(msg);
 }
 
+void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
+                              struct net_device *netdev, int freq,
+                              enum nl80211_channel_type type, gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
+            nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, type))
+                goto nla_put_failure;
+
+        genlmsg_end(msg, hdr);
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
 void
 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
                                 struct net_device *netdev, const u8 *peer,
@@ -7792,15 +8119,17 @@ nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
-        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
+                goto nla_put_failure;
 
         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
         if (!pinfoattr)
                 goto nla_put_failure;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets);
+        if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
+                goto nla_put_failure;
 
         nla_nest_end(msg, pinfoattr);
 
@@ -7834,12 +8163,12 @@ void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
-        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
-        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
-        if (acked)
-                NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
+            nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
+            (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
+                goto nla_put_failure;
 
         err = genlmsg_end(msg, hdr);
         if (err < 0) {
@@ -7859,7 +8188,7 @@ EXPORT_SYMBOL(cfg80211_probe_status);
 
 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
                                  const u8 *frame, size_t len,
-                                 int freq, gfp_t gfp)
+                                 int freq, int sig_dbm, gfp_t gfp)
 {
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         struct sk_buff *msg;
@@ -7879,10 +8208,13 @@ void cfg80211_report_obss_beacon(struct wiphy *wiphy,
                 return;
         }
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        if (freq)
-                NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
-        NLA_PUT(msg, NL80211_ATTR_FRAME, len, frame);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            (freq &&
+             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
+            (sig_dbm &&
+             nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
+            nla_put(msg, NL80211_ATTR_FRAME, len, frame))
+                goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
 
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 12bf4d185abe..01a1122c3b33 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -92,7 +92,8 @@ void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
                                 gfp_t gfp);
 
 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
-                      struct net_device *netdev, u32 nlpid, int freq,
+                      struct net_device *netdev, u32 nlpid,
+                      int freq, int sig_dbm,
                       const u8 *buf, size_t len, gfp_t gfp);
 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
                                  struct net_device *netdev, u64 cookie,
@@ -117,6 +118,10 @@ void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
                                     struct net_device *netdev, int index,
                                     const u8 *bssid, bool preauth, gfp_t gfp);
 
+void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
+                              struct net_device *dev, int freq,
+                              enum nl80211_channel_type type, gfp_t gfp);
+
 bool nl80211_unexpected_frame(struct net_device *dev,
                               const u8 *addr, gfp_t gfp);
 bool nl80211_unexpected_4addr_frame(struct net_device *dev,
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index f65feaad155f..15f347477a99 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -388,7 +388,15 @@ static void reg_regdb_query(const char *alpha2)
 
         schedule_work(&reg_regdb_work);
 }
+
+/* Feel free to add any other sanity checks here */
+static void reg_regdb_size_check(void)
+{
+        /* We should ideally BUILD_BUG_ON() but then random builds would fail */
+        WARN_ONCE(!reg_regdb_size, "db.txt is empty, you should update it...");
+}
 #else
+static inline void reg_regdb_size_check(void) {}
 static inline void reg_regdb_query(const char *alpha2) {}
 #endif /* CONFIG_CFG80211_INTERNAL_REGDB */
 
@@ -882,23 +890,8 @@ static void handle_channel(struct wiphy *wiphy,
         chan->flags = flags | bw_flags | map_regdom_flags(reg_rule->flags);
         chan->max_antenna_gain = min(chan->orig_mag,
                 (int) MBI_TO_DBI(power_rule->max_antenna_gain));
-        if (chan->orig_mpwr) {
-                /*
-                 * Devices that have their own custom regulatory domain
-                 * but also use WIPHY_FLAG_STRICT_REGULATORY will follow the
-                 * passed country IE power settings.
-                 */
-                if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
-                    wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY &&
-                    wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY) {
-                        chan->max_power =
-                                MBM_TO_DBM(power_rule->max_eirp);
-                } else {
-                        chan->max_power = min(chan->orig_mpwr,
-                                (int) MBM_TO_DBM(power_rule->max_eirp));
-                }
-        } else
-                chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
+        chan->max_reg_power = (int) MBM_TO_DBM(power_rule->max_eirp);
+        chan->max_power = min(chan->max_power, chan->max_reg_power);
 }
 
 static void handle_band(struct wiphy *wiphy,
@@ -2337,6 +2330,8 @@ int __init regulatory_init(void)
         spin_lock_init(&reg_requests_lock);
         spin_lock_init(&reg_pending_beacons_lock);
 
+        reg_regdb_size_check();
+
         cfg80211_regdomain = cfg80211_world_regdom;
 
         user_alpha2[0] = '9';
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 31119e32e092..af2b1caa37fa 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -18,7 +18,7 @@
 #include "nl80211.h"
 #include "wext-compat.h"
 
-#define IEEE80211_SCAN_RESULT_EXPIRE    (15 * HZ)
+#define IEEE80211_SCAN_RESULT_EXPIRE    (30 * HZ)
 
 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
 {
@@ -281,7 +281,7 @@ static bool is_bss(struct cfg80211_bss *a,
 {
         const u8 *ssidie;
 
-        if (bssid && compare_ether_addr(a->bssid, bssid))
+        if (bssid && !ether_addr_equal(a->bssid, bssid))
                 return false;
 
         if (!ssid)
@@ -378,7 +378,11 @@ static int cmp_bss_core(struct cfg80211_bss *a,
                                b->len_information_elements);
         }
 
-        return memcmp(a->bssid, b->bssid, ETH_ALEN);
+        /*
+         * we can't use compare_ether_addr here since we need a < > operator.
+         * The binary return value of compare_ether_addr isn't enough
+         */
+        return memcmp(a->bssid, b->bssid, sizeof(a->bssid));
 }
 
 static int cmp_bss(struct cfg80211_bss *a,
@@ -734,9 +738,8 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
 struct cfg80211_bss*
 cfg80211_inform_bss(struct wiphy *wiphy,
                     struct ieee80211_channel *channel,
-                    const u8 *bssid,
-                    u64 timestamp, u16 capability, u16 beacon_interval,
-                    const u8 *ie, size_t ielen,
+                    const u8 *bssid, u64 tsf, u16 capability,
+                    u16 beacon_interval, const u8 *ie, size_t ielen,
                     s32 signal, gfp_t gfp)
 {
         struct cfg80211_internal_bss *res;
@@ -758,7 +761,7 @@ cfg80211_inform_bss(struct wiphy *wiphy,
         memcpy(res->pub.bssid, bssid, ETH_ALEN);
         res->pub.channel = channel;
         res->pub.signal = signal;
-        res->pub.tsf = timestamp;
+        res->pub.tsf = tsf;
         res->pub.beacon_interval = beacon_interval;
         res->pub.capability = capability;
         /*
@@ -861,6 +864,18 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(cfg80211_inform_bss_frame);
 
+void cfg80211_ref_bss(struct cfg80211_bss *pub)
+{
+        struct cfg80211_internal_bss *bss;
+
+        if (!pub)
+                return;
+
+        bss = container_of(pub, struct cfg80211_internal_bss, pub);
+        kref_get(&bss->ref);
+}
+EXPORT_SYMBOL(cfg80211_ref_bss);
+
 void cfg80211_put_bss(struct cfg80211_bss *pub)
 {
         struct cfg80211_internal_bss *bss;
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 7b9ecaed96be..f7e937ff8978 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -179,7 +179,7 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                                             params->ssid, params->ssid_len,
                                             NULL, 0,
                                             params->key, params->key_len,
-                                            params->key_idx, false);
+                                            params->key_idx);
         case CFG80211_CONN_ASSOCIATE_NEXT:
                 BUG_ON(!rdev->ops->assoc);
                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
@@ -477,6 +477,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                 kfree(wdev->connect_keys);
                 wdev->connect_keys = NULL;
                 wdev->ssid_len = 0;
+                cfg80211_put_bss(bss);
                 return;
         }
 
@@ -701,31 +702,10 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
         wdev->ssid_len = 0;
 
         if (wdev->conn) {
-                const u8 *bssid;
-                int ret;
-
                 kfree(wdev->conn->ie);
                 wdev->conn->ie = NULL;
                 kfree(wdev->conn);
                 wdev->conn = NULL;
-
-                /*
-                 * If this disconnect was due to a disassoc, we
-                 * we might still have an auth BSS around. For
-                 * the userspace SME that's currently expected,
-                 * but for the kernel SME (nl80211 CONNECT or
-                 * wireless extensions) we want to clear up all
-                 * state.
-                 */
-                for (i = 0; i < MAX_AUTH_BSSES; i++) {
-                        if (!wdev->auth_bsses[i])
-                                continue;
-                        bssid = wdev->auth_bsses[i]->pub.bssid;
-                        ret = __cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
-                                                WLAN_REASON_DEAUTH_LEAVING,
-                                                false);
-                        WARN(ret, "deauth failed: %d\n", ret);
-                }
         }
 
         nl80211_send_disconnected(rdev, dev, reason, ie, ie_len, from_ap);
@@ -1012,7 +992,8 @@ int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
         return err;
 }
 
-void cfg80211_sme_disassoc(struct net_device *dev, int idx)
+void cfg80211_sme_disassoc(struct net_device *dev,
+                           struct cfg80211_internal_bss *bss)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
@@ -1031,16 +1012,8 @@ void cfg80211_sme_disassoc(struct net_device *dev, int idx)
          * want it any more so deauthenticate too.
          */
 
-        if (!wdev->auth_bsses[idx])
-                return;
+        memcpy(bssid, bss->pub.bssid, ETH_ALEN);
 
-        memcpy(bssid, wdev->auth_bsses[idx]->pub.bssid, ETH_ALEN);
-        if (__cfg80211_mlme_deauth(rdev, dev, bssid,
-                                   NULL, 0, WLAN_REASON_DEAUTH_LEAVING,
-                                   false)) {
-                /* whatever -- assume gone anyway */
-                cfg80211_unhold_bss(wdev->auth_bsses[idx]);
-                cfg80211_put_bss(&wdev->auth_bsses[idx]->pub);
-                wdev->auth_bsses[idx] = NULL;
-        }
+        __cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
+                               WLAN_REASON_DEAUTH_LEAVING, false);
 }
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 9aa9db6c8141..55d99466babb 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -370,7 +370,7 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                      iftype != NL80211_IFTYPE_P2P_CLIENT &&
                      iftype != NL80211_IFTYPE_MESH_POINT) ||
                     (is_multicast_ether_addr(dst) &&
-                     !compare_ether_addr(src, addr)))
+                     ether_addr_equal(src, addr)))
                         return -1;
                 if (iftype == NL80211_IFTYPE_MESH_POINT) {
                         struct ieee80211s_hdr *meshdr =
@@ -398,9 +398,9 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
         payload = skb->data + hdrlen;
         ethertype = (payload[6] << 8) | payload[7];
 
-        if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
+        if (likely((ether_addr_equal(payload, rfc1042_header) &&
                     ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
-                   compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
+                   ether_addr_equal(payload, bridge_tunnel_header))) {
                 /* remove RFC1042 or Bridge-Tunnel encapsulation and
                  * replace EtherType */
                 skb_pull(skb, hdrlen + 6);
@@ -609,10 +609,9 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
                 payload = frame->data;
                 ethertype = (payload[6] << 8) | payload[7];
 
-                if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
+                if (likely((ether_addr_equal(payload, rfc1042_header) &&
                             ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
-                           compare_ether_addr(payload,
-                                              bridge_tunnel_header) == 0)) {
+                           ether_addr_equal(payload, bridge_tunnel_header))) {
                         /* remove RFC1042 or Bridge-Tunnel
                          * encapsulation and replace EtherType */
                         skb_pull(frame, 6);
@@ -880,7 +879,7 @@ u16 cfg80211_calculate_bitrate(struct rate_info *rate)
                 return rate->legacy;
 
         /* the formula below does only work for MCS values smaller than 32 */
-        if (rate->mcs >= 32)
+        if (WARN_ON_ONCE(rate->mcs >= 32))
                 return 0;
 
         modulation = rate->mcs & 7;
@@ -904,6 +903,7 @@ u16 cfg80211_calculate_bitrate(struct rate_info *rate)
         /* do NOT round down here */
         return (bitrate + 50000) / 100000;
 }
+EXPORT_SYMBOL(cfg80211_calculate_bitrate);
 
 int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
                                  u32 beacon_int)
@@ -945,13 +945,6 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
         if (rdev->wiphy.software_iftypes & BIT(iftype))
                 return 0;
 
-        /*
-         * Drivers will gradually all set this flag, until all
-         * have it we only enforce for those that set it.
-         */
-        if (!(rdev->wiphy.flags & WIPHY_FLAG_ENFORCE_COMBINATIONS))
-                return 0;
-
         memset(num, 0, sizeof(num));
 
         num[iftype] = 1;
@@ -971,6 +964,9 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
         }
         mutex_unlock(&rdev->devlist_mtx);
 
+        if (total == 1)
+                return 0;
+
         for (i = 0; i < rdev->wiphy.n_iface_combinations; i++) {
                 const struct ieee80211_iface_combination *c;
                 struct ieee80211_iface_limit *limits;
@@ -988,7 +984,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                         if (rdev->wiphy.software_iftypes & BIT(iftype))
                                 continue;
                         for (j = 0; j < c->n_limits; j++) {
-                                if (!(limits[j].types & iftype))
+                                if (!(limits[j].types & BIT(iftype)))
                                         continue;
                                 if (limits[j].max < num[iftype])
                                         goto cont;
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 3c24eb97e9d7..6a6181a673ca 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -821,6 +821,7 @@ static int cfg80211_wext_giwfreq(struct net_device *dev,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         struct ieee80211_channel *chan;
+        enum nl80211_channel_type channel_type;
 
         switch (wdev->iftype) {
         case NL80211_IFTYPE_STATION:
@@ -831,7 +832,7 @@ static int cfg80211_wext_giwfreq(struct net_device *dev,
                 if (!rdev->ops->get_channel)
                         return -EINVAL;
 
-                chan = rdev->ops->get_channel(wdev->wiphy);
+                chan = rdev->ops->get_channel(wdev->wiphy, &channel_type);
                 if (!chan)
                         return -EINVAL;
                 freq->m = chan->center_freq;
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 0af7f54e4f61..b0eb7aa49b60 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -256,7 +256,7 @@ static const struct iw_ioctl_description standard_ioctl[] = {
                 .max_tokens     = sizeof(struct iw_pmksa),
         },
 };
-static const unsigned standard_ioctl_num = ARRAY_SIZE(standard_ioctl);
+static const unsigned int standard_ioctl_num = ARRAY_SIZE(standard_ioctl);
 
 /*
  * Meta-data about all the additional standard Wireless Extension events
@@ -306,7 +306,7 @@ static const struct iw_ioctl_description standard_event[] = {
                 .max_tokens     = sizeof(struct iw_pmkid_cand),
         },
 };
-static const unsigned standard_event_num = ARRAY_SIZE(standard_event);
+static const unsigned int standard_event_num = ARRAY_SIZE(standard_event);
 
 /* Size (in bytes) of various events */
 static const int event_type_size[] = {
@@ -402,7 +402,8 @@ static struct nlmsghdr *rtnetlink_ifinfo_prep(struct net_device *dev,
         r->ifi_flags = dev_get_flags(dev);
         r->ifi_change = 0;      /* Wireless changes don't affect those flags */
 
-        NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
+        if (nla_put_string(skb, IFLA_IFNAME, dev->name))
+                goto nla_put_failure;
 
         return nlh;
  nla_put_failure:
@@ -428,7 +429,7 @@ void wireless_send_event(struct net_device *	dev,
         int hdr_len;                            /* Size of the event header */
         int wrqu_off = 0;                       /* Offset in wrqu */
         /* Don't "optimise" the following variable, it will crash */
-        unsigned        cmd_index;              /* *MUST* be unsigned */
+        unsigned int    cmd_index;              /* *MUST* be unsigned */
         struct sk_buff *skb;
         struct nlmsghdr *nlh;
         struct nlattr *nla;
@@ -780,8 +781,10 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
                 if (cmd == SIOCSIWENCODEEXT) {
                         struct iw_encode_ext *ee = (void *) extra;
 
-                        if (iwp->length < sizeof(*ee) + ee->key_len)
-                                return -EFAULT;
+                        if (iwp->length < sizeof(*ee) + ee->key_len) {
+                                err = -EFAULT;
+                                goto out;
+                        }
                 }
         }
 
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index 326750b99151..7decbd357d51 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -30,6 +30,9 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
         wdev->wext.connect.ie = wdev->wext.ie;
         wdev->wext.connect.ie_len = wdev->wext.ie_len;
 
+        /* Use default background scan period */
+        wdev->wext.connect.bg_scan_period = -1;
+
         if (wdev->wext.keys) {
                 wdev->wext.keys->def = wdev->wext.default_key;
                 wdev->wext.keys->defmgmt = wdev->wext.default_mgmt_key;
@@ -273,7 +276,7 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
 
                 /* fixed already - and no change */
                 if (wdev->wext.connect.bssid && bssid &&
-                    compare_ether_addr(bssid, wdev->wext.connect.bssid) == 0)
+                    ether_addr_equal(bssid, wdev->wext.connect.bssid))
                         goto out;
 
                 err = __cfg80211_disconnect(rdev, dev,
diff --git a/net/wireless/wext-spy.c b/net/wireless/wext-spy.c
index 5d643a548feb..33bef22e44e9 100644
--- a/net/wireless/wext-spy.c
+++ b/net/wireless/wext-spy.c
@@ -203,7 +203,7 @@ void wireless_spy_update(struct net_device *	dev,
 
         /* Update all records that match */
         for (i = 0; i < spydata->spy_number; i++)
-                if (!compare_ether_addr(address, spydata->spy_address[i])) {
+                if (ether_addr_equal(address, spydata->spy_address[i])) {
                         memcpy(&(spydata->spy_stat[i]), wstats,
                                sizeof(struct iw_quality));
                         match = i;
diff --git a/net/x25/sysctl_net_x25.c b/net/x25/sysctl_net_x25.c
index d2efd29f434e..43239527a205 100644
--- a/net/x25/sysctl_net_x25.c
+++ b/net/x25/sysctl_net_x25.c
@@ -73,18 +73,12 @@ static struct ctl_table x25_table[] = {
         { 0, },
 };
 
-static struct ctl_path x25_path[] = {
-        { .procname = "net", },
-        { .procname = "x25", },
-        { }
-};
-
 void __init x25_register_sysctl(void)
 {
-        x25_table_header = register_sysctl_paths(x25_path, x25_table);
+        x25_table_header = register_net_sysctl(&init_net, "net/x25", x25_table);
 }
 
 void x25_unregister_sysctl(void)
 {
-        unregister_sysctl_table(x25_table_header);
+        unregister_net_sysctl_table(x25_table_header);
 }
diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
index f0ce862d1f46..a8a236338e61 100644
--- a/net/x25/x25_dev.c
+++ b/net/x25/x25_dev.c
@@ -58,7 +58,7 @@ static int x25_receive_data(struct sk_buff *skb, struct x25_neigh *nb)
                 if (!sock_owned_by_user(sk)) {
                         queued = x25_process_rx_frame(sk, skb);
                 } else {
-                        queued = !sk_add_backlog(sk, skb);
+                        queued = !sk_add_backlog(sk, skb, sk->sk_rcvbuf);
                 }
                 bh_unlock_sock(sk);
                 sock_put(sk);
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index 36384a1fa9f2..66c638730c7a 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -231,7 +231,7 @@ int x25_create_facilities(unsigned char *buffer,
         }
 
         if (dte_facs->calling_len && (facil_mask & X25_MASK_CALLING_AE)) {
-                unsigned bytecount = (dte_facs->calling_len + 1) >> 1;
+                unsigned int bytecount = (dte_facs->calling_len + 1) >> 1;
                 *p++ = X25_FAC_CALLING_AE;
                 *p++ = 1 + bytecount;
                 *p++ = dte_facs->calling_len;
@@ -240,7 +240,7 @@ int x25_create_facilities(unsigned char *buffer,
         }
 
         if (dte_facs->called_len && (facil_mask & X25_MASK_CALLED_AE)) {
-                unsigned bytecount = (dte_facs->called_len % 2) ?
+                unsigned int bytecount = (dte_facs->called_len % 2) ?
                 dte_facs->called_len / 2 + 1 :
                 dte_facs->called_len / 2;
                 *p++ = X25_FAC_CALLED_AE;
diff --git a/net/xfrm/Kconfig b/net/xfrm/Kconfig
index 6d081674515f..ce90b8d92365 100644
--- a/net/xfrm/Kconfig
+++ b/net/xfrm/Kconfig
@@ -3,12 +3,17 @@
 #
 config XFRM
        bool
-       select CRYPTO
        depends on NET
 
+config XFRM_ALGO
+        tristate
+        select XFRM
+        select CRYPTO
+
 config XFRM_USER
         tristate "Transformation user configuration interface"
-        depends on INET && XFRM
+        depends on INET
+        select XFRM_ALGO
         ---help---
           Support for Transformation(XFRM) user configuration interface
           like IPsec used by native Linux tools.
@@ -48,13 +53,13 @@ config XFRM_STATISTICS
 
 config XFRM_IPCOMP
         tristate
-        select XFRM
+        select XFRM_ALGO
         select CRYPTO
         select CRYPTO_DEFLATE
 
 config NET_KEY
         tristate "PF_KEY sockets"
-        select XFRM
+        select XFRM_ALGO
         ---help---
           PF_KEYv2 socket family, compatible to KAME ones.
           They are required if you are going to use IPsec tools ported
diff --git a/net/xfrm/Makefile b/net/xfrm/Makefile
index aa429eefe919..c0e961983f17 100644
--- a/net/xfrm/Makefile
+++ b/net/xfrm/Makefile
@@ -3,8 +3,9 @@
 #
 
 obj-$(CONFIG_XFRM) := xfrm_policy.o xfrm_state.o xfrm_hash.o \
-                      xfrm_input.o xfrm_output.o xfrm_algo.o \
+                      xfrm_input.o xfrm_output.o \
                       xfrm_sysctl.o xfrm_replay.o
 obj-$(CONFIG_XFRM_STATISTICS) += xfrm_proc.o
+obj-$(CONFIG_XFRM_ALGO) += xfrm_algo.o
 obj-$(CONFIG_XFRM_USER) += xfrm_user.o
 obj-$(CONFIG_XFRM_IPCOMP) += xfrm_ipcomp.o
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index 791ab2e77f3f..4ce2d93162c1 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -15,9 +15,6 @@
 #include <linux/crypto.h>
 #include <linux/scatterlist.h>
 #include <net/xfrm.h>
-#if defined(CONFIG_INET_AH) || defined(CONFIG_INET_AH_MODULE) || defined(CONFIG_INET6_AH) || defined(CONFIG_INET6_AH_MODULE)
-#include <net/ah.h>
-#endif
 #if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
 #include <net/esp.h>
 #endif
@@ -752,3 +749,5 @@ void *pskb_put(struct sk_buff *skb, struct sk_buff *tail, int len)
 }
 EXPORT_SYMBOL_GPL(pskb_put);
 #endif
+
+MODULE_LICENSE("GPL");
diff --git a/net/xfrm/xfrm_hash.h b/net/xfrm/xfrm_hash.h
index 7199d78b2aa1..716502ada53b 100644
--- a/net/xfrm/xfrm_hash.h
+++ b/net/xfrm/xfrm_hash.h
@@ -45,10 +45,10 @@ static inline unsigned int __xfrm_dst_hash(const xfrm_address_t *daddr,
         return (h ^ (h >> 16)) & hmask;
 }
 
-static inline unsigned __xfrm_src_hash(const xfrm_address_t *daddr,
-                                       const xfrm_address_t *saddr,
-                                       unsigned short family,
-                                       unsigned int hmask)
+static inline unsigned int __xfrm_src_hash(const xfrm_address_t *daddr,
+                                           const xfrm_address_t *saddr,
+                                           unsigned short family,
+                                           unsigned int hmask)
 {
         unsigned int h = family;
         switch (family) {
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 47bacd8c0250..95a338c89f99 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -21,7 +21,7 @@
 
 static int xfrm_output2(struct sk_buff *skb);
 
-static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb)
+static int xfrm_skb_check_space(struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
         int nhead = dst->header_len + LL_RESERVED_SPACE(dst->dev)
@@ -48,7 +48,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
                 goto resume;
 
         do {
-                err = xfrm_state_check_space(x, skb);
+                err = xfrm_skb_check_space(skb);
                 if (err) {
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
                         goto error_nolock;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 7661576b6f45..ccfbd328a69d 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -26,6 +26,7 @@
 #include <linux/cache.h>
 #include <linux/audit.h>
 #include <net/dst.h>
+#include <net/flow.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
 #ifdef CONFIG_XFRM_STATISTICS
@@ -56,7 +57,7 @@ static int xfrm_bundle_ok(struct xfrm_dst *xdst);
 static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
                                                 int dir);
 
-static inline int
+static inline bool
 __xfrm4_selector_match(const struct xfrm_selector *sel, const struct flowi *fl)
 {
         const struct flowi4 *fl4 = &fl->u.ip4;
@@ -69,7 +70,7 @@ __xfrm4_selector_match(const struct xfrm_selector *sel, const struct flowi *fl)
                 (fl4->flowi4_oif == sel->ifindex || !sel->ifindex);
 }
 
-static inline int
+static inline bool
 __xfrm6_selector_match(const struct xfrm_selector *sel, const struct flowi *fl)
 {
         const struct flowi6 *fl6 = &fl->u.ip6;
@@ -82,8 +83,8 @@ __xfrm6_selector_match(const struct xfrm_selector *sel, const struct flowi *fl)
                 (fl6->flowi6_oif == sel->ifindex || !sel->ifindex);
 }
 
-int xfrm_selector_match(const struct xfrm_selector *sel, const struct flowi *fl,
-                        unsigned short family)
+bool xfrm_selector_match(const struct xfrm_selector *sel, const struct flowi *fl,
+                         unsigned short family)
 {
         switch (family) {
         case AF_INET:
@@ -91,7 +92,7 @@ int xfrm_selector_match(const struct xfrm_selector *sel, const struct flowi *fl,
         case AF_INET6:
                 return __xfrm6_selector_match(sel, fl);
         }
-        return 0;
+        return false;
 }
 
 static inline struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos,
@@ -877,7 +878,8 @@ static int xfrm_policy_match(const struct xfrm_policy *pol,
                              u8 type, u16 family, int dir)
 {
         const struct xfrm_selector *sel = &pol->selector;
-        int match, ret = -ESRCH;
+        int ret = -ESRCH;
+        bool match;
 
         if (pol->family != family ||
             (fl->flowi_mark & pol->mark.m) != pol->mark.v ||
@@ -1006,8 +1008,8 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir,
 
         read_lock_bh(&xfrm_policy_lock);
         if ((pol = sk->sk_policy[dir]) != NULL) {
-                int match = xfrm_selector_match(&pol->selector, fl,
-                                                sk->sk_family);
+                bool match = xfrm_selector_match(&pol->selector, fl,
+                                                 sk->sk_family);
                 int err = 0;
 
                 if (match) {
@@ -1919,6 +1921,9 @@ no_transform:
         }
 ok:
         xfrm_pols_put(pols, drop_pols);
+        if (dst && dst->xfrm &&
+            dst->xfrm->props.mode == XFRM_MODE_TUNNEL)
+                dst->flags |= DST_XFRM_TUNNEL;
         return dst;
 
 nopol:
@@ -2767,8 +2772,8 @@ EXPORT_SYMBOL_GPL(xfrm_audit_policy_delete);
 #endif
 
 #ifdef CONFIG_XFRM_MIGRATE
-static int xfrm_migrate_selector_match(const struct xfrm_selector *sel_cmp,
-                                       const struct xfrm_selector *sel_tgt)
+static bool xfrm_migrate_selector_match(const struct xfrm_selector *sel_cmp,
+                                        const struct xfrm_selector *sel_tgt)
 {
         if (sel_cmp->proto == IPSEC_ULPROTO_ANY) {
                 if (sel_tgt->family == sel_cmp->family &&
@@ -2778,14 +2783,14 @@ static int xfrm_migrate_selector_match(const struct xfrm_selector *sel_cmp,
                                   sel_cmp->family) == 0 &&
                     sel_tgt->prefixlen_d == sel_cmp->prefixlen_d &&
                     sel_tgt->prefixlen_s == sel_cmp->prefixlen_s) {
-                        return 1;
+                        return true;
                 }
         } else {
                 if (memcmp(sel_tgt, sel_cmp, sizeof(*sel_tgt)) == 0) {
-                        return 1;
+                        return true;
                 }
         }
-        return 0;
+        return false;
 }
 
 static struct xfrm_policy * xfrm_migrate_policy_find(const struct xfrm_selector *sel,
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 39e02c54ed26..2f6d11d04a2b 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -167,7 +167,7 @@ static void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
         }
 
         if (xfrm_aevent_is_on(xs_net(x)))
-                xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
+                x->repl->notify(x, XFRM_REPLAY_UPDATE);
 }
 
 static int xfrm_replay_overflow_bmp(struct xfrm_state *x, struct sk_buff *skb)
@@ -279,7 +279,7 @@ static void xfrm_replay_advance_bmp(struct xfrm_state *x, __be32 net_seq)
         replay_esn->bmp[nr] |= (1U << bitnr);
 
         if (xfrm_aevent_is_on(xs_net(x)))
-                xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
+                x->repl->notify(x, XFRM_REPLAY_UPDATE);
 }
 
 static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
@@ -473,7 +473,7 @@ static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
         replay_esn->bmp[nr] |= (1U << bitnr);
 
         if (xfrm_aevent_is_on(xs_net(x)))
-                xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
+                x->repl->notify(x, XFRM_REPLAY_UPDATE);
 }
 
 static struct xfrm_replay xfrm_replay_legacy = {
diff --git a/net/xfrm/xfrm_sysctl.c b/net/xfrm/xfrm_sysctl.c
index 05640bc9594b..380976f74c4c 100644
--- a/net/xfrm/xfrm_sysctl.c
+++ b/net/xfrm/xfrm_sysctl.c
@@ -54,7 +54,7 @@ int __net_init xfrm_sysctl_init(struct net *net)
         table[2].data = &net->xfrm.sysctl_larval_drop;
         table[3].data = &net->xfrm.sysctl_acq_expires;
 
-        net->xfrm.sysctl_hdr = register_net_sysctl_table(net, net_core_path, table);
+        net->xfrm.sysctl_hdr = register_net_sysctl(net, "net/core", table);
         if (!net->xfrm.sysctl_hdr)
                 goto out_register;
         return 0;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 66b84fbf2746..44293b3fd6a1 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -756,40 +756,50 @@ static int copy_to_user_state_extra(struct xfrm_state *x,
 {
         copy_to_user_state(x, p);
 
-        if (x->coaddr)
-                NLA_PUT(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr);
+        if (x->coaddr &&
+            nla_put(skb, XFRMA_COADDR, sizeof(*x->coaddr), x->coaddr))
+                goto nla_put_failure;
 
-        if (x->lastused)
-                NLA_PUT_U64(skb, XFRMA_LASTUSED, x->lastused);
+        if (x->lastused &&
+            nla_put_u64(skb, XFRMA_LASTUSED, x->lastused))
+                goto nla_put_failure;
 
-        if (x->aead)
-                NLA_PUT(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead);
-        if (x->aalg) {
-                if (copy_to_user_auth(x->aalg, skb))
-                        goto nla_put_failure;
+        if (x->aead &&
+            nla_put(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead))
+                goto nla_put_failure;
 
-                NLA_PUT(skb, XFRMA_ALG_AUTH_TRUNC,
-                        xfrm_alg_auth_len(x->aalg), x->aalg);
-        }
-        if (x->ealg)
-                NLA_PUT(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg);
-        if (x->calg)
-                NLA_PUT(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
+        if (x->aalg &&
+            (copy_to_user_auth(x->aalg, skb) ||
+             nla_put(skb, XFRMA_ALG_AUTH_TRUNC,
+                     xfrm_alg_auth_len(x->aalg), x->aalg)))
+                goto nla_put_failure;
 
-        if (x->encap)
-                NLA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
+        if (x->ealg &&
+            nla_put(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg))
+                goto nla_put_failure;
 
-        if (x->tfcpad)
-                NLA_PUT_U32(skb, XFRMA_TFCPAD, x->tfcpad);
+        if (x->calg &&
+            nla_put(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg))
+                goto nla_put_failure;
+
+        if (x->encap &&
+            nla_put(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap))
+                goto nla_put_failure;
+
+        if (x->tfcpad &&
+            nla_put_u32(skb, XFRMA_TFCPAD, x->tfcpad))
+                goto nla_put_failure;
 
         if (xfrm_mark_put(skb, &x->mark))
                 goto nla_put_failure;
 
-        if (x->replay_esn)
-                NLA_PUT(skb, XFRMA_REPLAY_ESN_VAL,
-                        xfrm_replay_state_esn_len(x->replay_esn), x->replay_esn);
+        if (x->replay_esn &&
+            nla_put(skb, XFRMA_REPLAY_ESN_VAL,
+                    xfrm_replay_state_esn_len(x->replay_esn),
+                    x->replay_esn))
+                goto nla_put_failure;
 
-        if (x->security && copy_sec_ctx(x->security, skb) < 0)
+        if (x->security && copy_sec_ctx(x->security, skb))
                 goto nla_put_failure;
 
         return 0;
@@ -912,8 +922,9 @@ static int build_spdinfo(struct sk_buff *skb, struct net *net,
         sph.spdhcnt = si.spdhcnt;
         sph.spdhmcnt = si.spdhmcnt;
 
-        NLA_PUT(skb, XFRMA_SPD_INFO, sizeof(spc), &spc);
-        NLA_PUT(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph);
+        if (nla_put(skb, XFRMA_SPD_INFO, sizeof(spc), &spc) ||
+            nla_put(skb, XFRMA_SPD_HINFO, sizeof(sph), &sph))
+                goto nla_put_failure;
 
         return nlmsg_end(skb, nlh);
 
@@ -967,8 +978,9 @@ static int build_sadinfo(struct sk_buff *skb, struct net *net,
         sh.sadhmcnt = si.sadhmcnt;
         sh.sadhcnt = si.sadhcnt;
 
-        NLA_PUT_U32(skb, XFRMA_SAD_CNT, si.sadcnt);
-        NLA_PUT(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh);
+        if (nla_put_u32(skb, XFRMA_SAD_CNT, si.sadcnt) ||
+            nla_put(skb, XFRMA_SAD_HINFO, sizeof(sh), &sh))
+                goto nla_put_failure;
 
         return nlmsg_end(skb, nlh);
 
@@ -1690,21 +1702,27 @@ static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct
         id->reqid = x->props.reqid;
         id->flags = c->data.aevent;
 
-        if (x->replay_esn)
-                NLA_PUT(skb, XFRMA_REPLAY_ESN_VAL,
-                        xfrm_replay_state_esn_len(x->replay_esn),
-                        x->replay_esn);
-        else
-                NLA_PUT(skb, XFRMA_REPLAY_VAL, sizeof(x->replay), &x->replay);
-
-        NLA_PUT(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft);
+        if (x->replay_esn) {
+                if (nla_put(skb, XFRMA_REPLAY_ESN_VAL,
+                            xfrm_replay_state_esn_len(x->replay_esn),
+                            x->replay_esn))
+                        goto nla_put_failure;
+        } else {
+                if (nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay),
+                            &x->replay))
+                        goto nla_put_failure;
+        }
+        if (nla_put(skb, XFRMA_LTIME_VAL, sizeof(x->curlft), &x->curlft))
+                goto nla_put_failure;
 
-        if (id->flags & XFRM_AE_RTHR)
-                NLA_PUT_U32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff);
+        if ((id->flags & XFRM_AE_RTHR) &&
+            nla_put_u32(skb, XFRMA_REPLAY_THRESH, x->replay_maxdiff))
+                goto nla_put_failure;
 
-        if (id->flags & XFRM_AE_ETHR)
-                NLA_PUT_U32(skb, XFRMA_ETIMER_THRESH,
-                            x->replay_maxage * 10 / HZ);
+        if ((id->flags & XFRM_AE_ETHR) &&
+            nla_put_u32(skb, XFRMA_ETIMER_THRESH,
+                        x->replay_maxage * 10 / HZ))
+                goto nla_put_failure;
 
         if (xfrm_mark_put(skb, &x->mark))
                 goto nla_put_failure;
@@ -2299,8 +2317,13 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 if (link->dump == NULL)
                         return -EINVAL;
 
-                return netlink_dump_start(net->xfrm.nlsk, skb, nlh,
-                                          link->dump, link->done, 0);
+                {
+                        struct netlink_dump_control c = {
+                                .dump = link->dump,
+                                .done = link->done,
+                        };
+                        return netlink_dump_start(net->xfrm.nlsk, skb, nlh, &c);
+                }
         }
 
         err = nlmsg_parse(nlh, xfrm_msg_min[type], attrs, XFRMA_MAX,
@@ -2830,8 +2853,9 @@ static int build_report(struct sk_buff *skb, u8 proto,
         ur->proto = proto;
         memcpy(&ur->sel, sel, sizeof(ur->sel));
 
-        if (addr)
-                NLA_PUT(skb, XFRMA_COADDR, sizeof(*addr), addr);
+        if (addr &&
+            nla_put(skb, XFRMA_COADDR, sizeof(*addr), addr))
+                goto nla_put_failure;
 
         return nlmsg_end(skb, nlh);