Merge branch 'topic/quirk-cleanup' into topic/hda

39 files changed, 478 insertions, 199 deletions

diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 6c1323940263..e9db889d6222 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -62,13 +62,13 @@ struct net_device *vlan_dev_real_dev(const struct net_device *dev)
 {
         return vlan_dev_info(dev)->real_dev;
 }
-EXPORT_SYMBOL_GPL(vlan_dev_real_dev);
+EXPORT_SYMBOL(vlan_dev_real_dev);
 
 u16 vlan_dev_vlan_id(const struct net_device *dev)
 {
         return vlan_dev_info(dev)->vlan_id;
 }
-EXPORT_SYMBOL_GPL(vlan_dev_vlan_id);
+EXPORT_SYMBOL(vlan_dev_vlan_id);
 
 static int vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
                            unsigned int vlan_tci, struct sk_buff *skb)
diff --git a/net/9p/Kconfig b/net/9p/Kconfig
index 0663f99e977a..7ed75c7bd5d1 100644
--- a/net/9p/Kconfig
+++ b/net/9p/Kconfig
@@ -23,7 +23,7 @@ config NET_9P_VIRTIO
           guest partitions and a host partition.
 
 config NET_9P_RDMA
-        depends on INET && INFINIBAND && EXPERIMENTAL
+        depends on INET && INFINIBAND && INFINIBAND_ADDR_TRANS && EXPERIMENTAL
         tristate "9P RDMA Transport (Experimental)"
         help
           This builds support for an RDMA transport.
diff --git a/net/9p/client.c b/net/9p/client.c
index 821f1ec0b2c3..1eb580c38fbb 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -618,7 +618,7 @@ static struct p9_fid *p9_fid_create(struct p9_client *clnt)
                 return ERR_PTR(-ENOMEM);
 
         ret = p9_idpool_get(clnt->fidpool);
-        if (fid->fid < 0) {
+        if (ret < 0) {
                 ret = -ENOSPC;
                 goto error;
         }
diff --git a/net/Kconfig b/net/Kconfig
index bf2776018f71..cdb8fdef6c4a 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -24,14 +24,6 @@ if NET
 
 menu "Networking options"
 
-config NET_NS
-        bool "Network namespace support"
-        default n
-        depends on EXPERIMENTAL && NAMESPACES
-        help
-          Allow user space to create what appear to be multiple instances
-          of the network stack.
-
 config COMPAT_NET_DEV_OPS
        def_bool y
 
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index a65e43a17fbb..cf754ace0b75 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -58,11 +58,11 @@ static struct ctl_table_header *brnf_sysctl_header;
 static int brnf_call_iptables __read_mostly = 1;
 static int brnf_call_ip6tables __read_mostly = 1;
 static int brnf_call_arptables __read_mostly = 1;
-static int brnf_filter_vlan_tagged __read_mostly = 1;
-static int brnf_filter_pppoe_tagged __read_mostly = 1;
+static int brnf_filter_vlan_tagged __read_mostly = 0;
+static int brnf_filter_pppoe_tagged __read_mostly = 0;
 #else
-#define brnf_filter_vlan_tagged 1
-#define brnf_filter_pppoe_tagged 1
+#define brnf_filter_vlan_tagged 0
+#define brnf_filter_pppoe_tagged 0
 #endif
 
 static inline __be16 vlan_proto(const struct sk_buff *skb)
@@ -686,8 +686,11 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
         if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||
             IS_PPPOE_IP(skb))
                 pf = PF_INET;
-        else
+        else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
+                 IS_PPPOE_IPV6(skb))
                 pf = PF_INET6;
+        else
+                return NF_ACCEPT;
 
         nf_bridge_pull_encap_header(skb);
 
@@ -828,8 +831,11 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
         if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||
             IS_PPPOE_IP(skb))
                 pf = PF_INET;
-        else
+        else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
+                 IS_PPPOE_IPV6(skb))
                 pf = PF_INET6;
+        else
+                return NF_ACCEPT;
 
 #ifdef CONFIG_NETFILTER_DEBUG
         if (skb->dst == NULL) {
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 8a8743d7d6e7..820252aee81f 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -79,7 +79,7 @@ static inline int ebt_do_match (struct ebt_entry_match *m,
 {
         par->match     = m->u.match;
         par->matchinfo = m->data;
-        return m->u.match->match(skb, par);
+        return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
 }
 
 static inline int ebt_dev_check(char *entry, const struct net_device *device)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 1649c8ab2c2f..b7c7d4651136 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -347,51 +347,54 @@ static void bcm_tx_timeout_tsklet(unsigned long data)
         struct bcm_op *op = (struct bcm_op *)data;
         struct bcm_msg_head msg_head;
 
-        /* create notification to user */
-        msg_head.opcode  = TX_EXPIRED;
-        msg_head.flags   = op->flags;
-        msg_head.count   = op->count;
-        msg_head.ival1   = op->ival1;
-        msg_head.ival2   = op->ival2;
-        msg_head.can_id  = op->can_id;
-        msg_head.nframes = 0;
-
-        bcm_send_to_user(op, &msg_head, NULL, 0);
-}
-
-/*
- * bcm_tx_timeout_handler - performes cyclic CAN frame transmissions
- */
-static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)
-{
-        struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
-        enum hrtimer_restart ret = HRTIMER_NORESTART;
-
         if (op->kt_ival1.tv64 && (op->count > 0)) {
 
                 op->count--;
-                if (!op->count && (op->flags & TX_COUNTEVT))
-                        tasklet_schedule(&op->tsklet);
+                if (!op->count && (op->flags & TX_COUNTEVT)) {
+
+                        /* create notification to user */
+                        msg_head.opcode  = TX_EXPIRED;
+                        msg_head.flags   = op->flags;
+                        msg_head.count   = op->count;
+                        msg_head.ival1   = op->ival1;
+                        msg_head.ival2   = op->ival2;
+                        msg_head.can_id  = op->can_id;
+                        msg_head.nframes = 0;
+
+                        bcm_send_to_user(op, &msg_head, NULL, 0);
+                }
         }
 
         if (op->kt_ival1.tv64 && (op->count > 0)) {
 
                 /* send (next) frame */
                 bcm_can_tx(op);
-                hrtimer_forward(hrtimer, ktime_get(), op->kt_ival1);
-                ret = HRTIMER_RESTART;
+                hrtimer_start(&op->timer,
+                              ktime_add(ktime_get(), op->kt_ival1),
+                              HRTIMER_MODE_ABS);
 
         } else {
                 if (op->kt_ival2.tv64) {
 
                         /* send (next) frame */
                         bcm_can_tx(op);
-                        hrtimer_forward(hrtimer, ktime_get(), op->kt_ival2);
-                        ret = HRTIMER_RESTART;
+                        hrtimer_start(&op->timer,
+                                      ktime_add(ktime_get(), op->kt_ival2),
+                                      HRTIMER_MODE_ABS);
                 }
         }
+}
 
-        return ret;
+/*
+ * bcm_tx_timeout_handler - performes cyclic CAN frame transmissions
+ */
+static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)
+{
+        struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
+
+        tasklet_schedule(&op->tsklet);
+
+        return HRTIMER_NORESTART;
 }
 
 /*
diff --git a/net/core/dev.c b/net/core/dev.c
index b715a55cccc4..5379b0c1190a 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1534,7 +1534,19 @@ struct sk_buff *skb_gso_segment(struct sk_buff *skb, int features)
         skb->mac_len = skb->network_header - skb->mac_header;
         __skb_pull(skb, skb->mac_len);
 
-        if (WARN_ON(skb->ip_summed != CHECKSUM_PARTIAL)) {
+        if (unlikely(skb->ip_summed != CHECKSUM_PARTIAL)) {
+                struct net_device *dev = skb->dev;
+                struct ethtool_drvinfo info = {};
+
+                if (dev && dev->ethtool_ops && dev->ethtool_ops->get_drvinfo)
+                        dev->ethtool_ops->get_drvinfo(dev, &info);
+
+                WARN(1, "%s: caps=(0x%lx, 0x%lx) len=%d data_len=%d "
+                        "ip_summed=%d",
+                     info.driver, dev ? dev->features : 0L,
+                     skb->sk ? skb->sk->sk_route_caps : 0L,
+                     skb->len, skb->data_len, skb->ip_summed);
+
                 if (skb_header_cloned(skb) &&
                     (err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
                         return ERR_PTR(err);
@@ -2392,6 +2404,9 @@ int dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
         if (!(skb->dev->features & NETIF_F_GRO))
                 goto normal;
 
+        if (skb_is_gso(skb) || skb_shinfo(skb)->frag_list)
+                goto normal;
+
         rcu_read_lock();
         list_for_each_entry_rcu(ptype, head, list) {
                 struct sk_buff *p;
@@ -2488,12 +2503,6 @@ EXPORT_SYMBOL(napi_gro_receive);
 
 void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
 {
-        skb_shinfo(skb)->nr_frags = 0;
-
-        skb->len -= skb->data_len;
-        skb->truesize -= skb->data_len;
-        skb->data_len = 0;
-
         __skb_pull(skb, skb_headlen(skb));
         skb_reserve(skb, NET_IP_ALIGN - skb_headroom(skb));
 
@@ -2527,6 +2536,7 @@ struct sk_buff *napi_fraginfo_skb(struct napi_struct *napi,
 
         if (!pskb_may_pull(skb, ETH_HLEN)) {
                 napi_reuse_skb(napi, skb);
+                skb = NULL;
                 goto out;
         }
 
@@ -4434,6 +4444,45 @@ err_uninit:
 }
 
 /**
+ *      init_dummy_netdev       - init a dummy network device for NAPI
+ *      @dev: device to init
+ *
+ *      This takes a network device structure and initialize the minimum
+ *      amount of fields so it can be used to schedule NAPI polls without
+ *      registering a full blown interface. This is to be used by drivers
+ *      that need to tie several hardware interfaces to a single NAPI
+ *      poll scheduler due to HW limitations.
+ */
+int init_dummy_netdev(struct net_device *dev)
+{
+        /* Clear everything. Note we don't initialize spinlocks
+         * are they aren't supposed to be taken by any of the
+         * NAPI code and this dummy netdev is supposed to be
+         * only ever used for NAPI polls
+         */
+        memset(dev, 0, sizeof(struct net_device));
+
+        /* make sure we BUG if trying to hit standard
+         * register/unregister code path
+         */
+        dev->reg_state = NETREG_DUMMY;
+
+        /* initialize the ref count */
+        atomic_set(&dev->refcnt, 1);
+
+        /* NAPI wants this */
+        INIT_LIST_HEAD(&dev->napi_list);
+
+        /* a dummy interface is started by default */
+        set_bit(__LINK_STATE_PRESENT, &dev->state);
+        set_bit(__LINK_STATE_START, &dev->state);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(init_dummy_netdev);
+
+
+/**
  *      register_netdev - register a network device
  *      @dev: device to register
  *
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 55cffad2f328..55151faaf90c 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -341,8 +341,8 @@ again:
         rv = register_pernet_operations(first_device, ops);
         if (rv < 0)
                 ida_remove(&net_generic_ids, *id);
-        mutex_unlock(&net_mutex);
 out:
+        mutex_unlock(&net_mutex);
         return rv;
 }
 EXPORT_SYMBOL_GPL(register_pernet_gen_subsys);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 5110b359c758..2e5f2ca3bdcd 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -73,17 +73,13 @@ static struct kmem_cache *skbuff_fclone_cache __read_mostly;
 static void sock_pipe_buf_release(struct pipe_inode_info *pipe,
                                   struct pipe_buffer *buf)
 {
-        struct sk_buff *skb = (struct sk_buff *) buf->private;
-
-        kfree_skb(skb);
+        put_page(buf->page);
 }
 
 static void sock_pipe_buf_get(struct pipe_inode_info *pipe,
                                 struct pipe_buffer *buf)
 {
-        struct sk_buff *skb = (struct sk_buff *) buf->private;
-
-        skb_get(skb);
+        get_page(buf->page);
 }
 
 static int sock_pipe_buf_steal(struct pipe_inode_info *pipe,
@@ -1334,9 +1330,19 @@ fault:
  */
 static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i)
 {
-        struct sk_buff *skb = (struct sk_buff *) spd->partial[i].private;
+        put_page(spd->pages[i]);
+}
 
-        kfree_skb(skb);
+static inline struct page *linear_to_page(struct page *page, unsigned int len,
+                                          unsigned int offset)
+{
+        struct page *p = alloc_pages(GFP_KERNEL, 0);
+
+        if (!p)
+                return NULL;
+        memcpy(page_address(p) + offset, page_address(page) + offset, len);
+
+        return p;
 }
 
 /*
@@ -1344,16 +1350,23 @@ static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i)
  */
 static inline int spd_fill_page(struct splice_pipe_desc *spd, struct page *page,
                                 unsigned int len, unsigned int offset,
-                                struct sk_buff *skb)
+                                struct sk_buff *skb, int linear)
 {
         if (unlikely(spd->nr_pages == PIPE_BUFFERS))
                 return 1;
 
+        if (linear) {
+                page = linear_to_page(page, len, offset);
+                if (!page)
+                        return 1;
+        } else
+                get_page(page);
+
         spd->pages[spd->nr_pages] = page;
         spd->partial[spd->nr_pages].len = len;
         spd->partial[spd->nr_pages].offset = offset;
-        spd->partial[spd->nr_pages].private = (unsigned long) skb_get(skb);
         spd->nr_pages++;
+
         return 0;
 }
 
@@ -1369,7 +1382,7 @@ static inline void __segment_seek(struct page **page, unsigned int *poff,
 static inline int __splice_segment(struct page *page, unsigned int poff,
                                    unsigned int plen, unsigned int *off,
                                    unsigned int *len, struct sk_buff *skb,
-                                   struct splice_pipe_desc *spd)
+                                   struct splice_pipe_desc *spd, int linear)
 {
         if (!*len)
                 return 1;
@@ -1392,7 +1405,7 @@ static inline int __splice_segment(struct page *page, unsigned int poff,
                 /* the linear region may spread across several pages  */
                 flen = min_t(unsigned int, flen, PAGE_SIZE - poff);
 
-                if (spd_fill_page(spd, page, flen, poff, skb))
+                if (spd_fill_page(spd, page, flen, poff, skb, linear))
                         return 1;
 
                 __segment_seek(&page, &poff, &plen, flen);
@@ -1419,7 +1432,7 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
         if (__splice_segment(virt_to_page(skb->data),
                              (unsigned long) skb->data & (PAGE_SIZE - 1),
                              skb_headlen(skb),
-                             offset, len, skb, spd))
+                             offset, len, skb, spd, 1))
                 return 1;
 
         /*
@@ -1429,7 +1442,7 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
                 const skb_frag_t *f = &skb_shinfo(skb)->frags[seg];
 
                 if (__splice_segment(f->page, f->page_offset, f->size,
-                                     offset, len, skb, spd))
+                                     offset, len, skb, spd, 0))
                         return 1;
         }
 
@@ -1442,7 +1455,7 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
  * the frag list, if such a thing exists. We'd probably need to recurse to
  * handle that cleanly.
  */
-int skb_splice_bits(struct sk_buff *__skb, unsigned int offset,
+int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
                     struct pipe_inode_info *pipe, unsigned int tlen,
                     unsigned int flags)
 {
@@ -1455,16 +1468,6 @@ int skb_splice_bits(struct sk_buff *__skb, unsigned int offset,
                 .ops = &sock_pipe_buf_ops,
                 .spd_release = sock_spd_release,
         };
-        struct sk_buff *skb;
-
-        /*
-         * I'd love to avoid the clone here, but tcp_read_sock()
-         * ignores reference counts and unconditonally kills the sk_buff
-         * on return from the actor.
-         */
-        skb = skb_clone(__skb, GFP_KERNEL);
-        if (unlikely(!skb))
-                return -ENOMEM;
 
         /*
          * __skb_splice_bits() only fails if the output has no room left,
@@ -1488,15 +1491,9 @@ int skb_splice_bits(struct sk_buff *__skb, unsigned int offset,
         }
 
 done:
-        /*
-         * drop our reference to the clone, the pipe consumption will
-         * drop the rest.
-         */
-        kfree_skb(skb);
-
         if (spd.nr_pages) {
+                struct sock *sk = skb->sk;
                 int ret;
-                struct sock *sk = __skb->sk;
 
                 /*
                  * Drop the socket lock, otherwise we have reverse
@@ -2588,8 +2585,9 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         struct sk_buff *nskb;
         unsigned int headroom;
         unsigned int hlen = p->data - skb_mac_header(p);
+        unsigned int len = skb->len;
 
-        if (hlen + p->len + skb->len >= 65536)
+        if (hlen + p->len + len >= 65536)
                 return -E2BIG;
 
         if (skb_shinfo(p)->frag_list)
@@ -2602,6 +2600,12 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
                        skb_shinfo(skb)->nr_frags * sizeof(skb_frag_t));
 
                 skb_shinfo(p)->nr_frags += skb_shinfo(skb)->nr_frags;
+                skb_shinfo(skb)->nr_frags = 0;
+
+                skb->truesize -= skb->data_len;
+                skb->len -= skb->data_len;
+                skb->data_len = 0;
+
                 NAPI_GRO_CB(skb)->free = 1;
                 goto done;
         }
@@ -2645,9 +2649,9 @@ merge:
 
 done:
         NAPI_GRO_CB(p)->count++;
-        p->data_len += skb->len;
-        p->truesize += skb->len;
-        p->len += skb->len;
+        p->data_len += len;
+        p->truesize += len;
+        p->len += len;
 
         NAPI_GRO_CB(skb)->same_flow = 1;
         return 0;
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index c9224310ebae..52cb6939d093 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -93,13 +93,8 @@ ipt_local_out_hook(unsigned int hook,
 {
         /* root is playing with raw sockets. */
         if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(skb) < sizeof(struct iphdr)) {
-                if (net_ratelimit())
-                        printk("iptable_filter: ignoring short SOCK_RAW "
-                               "packet.\n");
+            ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
-        }
-
         return ipt_do_table(skb, hook, in, out,
                             dev_net(out)->ipv4.iptable_filter);
 }
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 69f2c4287146..3929d20b9e45 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -132,12 +132,8 @@ ipt_local_hook(unsigned int hook,
 
         /* root is playing with raw sockets. */
         if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
-                if (net_ratelimit())
-                        printk("iptable_mangle: ignoring short SOCK_RAW "
-                               "packet.\n");
+            || ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
-        }
 
         /* Save things which could affect route */
         mark = skb->mark;
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index 8faebfe638f1..7f65d18333e3 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -65,12 +65,8 @@ ipt_local_hook(unsigned int hook,
 {
         /* root is playing with raw sockets. */
         if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(skb) < sizeof(struct iphdr)) {
-                if (net_ratelimit())
-                        printk("iptable_raw: ignoring short SOCK_RAW "
-                               "packet.\n");
+            ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
-        }
         return ipt_do_table(skb, hook, in, out,
                             dev_net(out)->ipv4.iptable_raw);
 }
diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index 36f3be3cc428..a52a35f4a584 100644
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -96,12 +96,8 @@ ipt_local_out_hook(unsigned int hook,
 {
         /* Somebody is playing with raw sockets. */
         if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
-                if (net_ratelimit())
-                        printk(KERN_INFO "iptable_security: ignoring short "
-                               "SOCK_RAW packet.\n");
+            || ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
-        }
         return ipt_do_table(skb, hook, in, out,
                             dev_net(out)->ipv4.iptable_security);
 }
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index b2141e11575e..4beb04fac588 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -145,11 +145,8 @@ static unsigned int ipv4_conntrack_local(unsigned int hooknum,
 {
         /* root is playing with raw sockets. */
         if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(skb) < sizeof(struct iphdr)) {
-                if (net_ratelimit())
-                        printk("ipt_hook: happy cracking.\n");
+            ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
-        }
         return nf_conntrack_in(dev_net(out), PF_INET, hooknum, skb);
 }
 
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index 1fd3ef7718b6..2a8bee26f43d 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -20,7 +20,7 @@
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_log.h>
 
-static unsigned long nf_ct_icmp_timeout __read_mostly = 30*HZ;
+static unsigned int nf_ct_icmp_timeout __read_mostly = 30*HZ;
 
 static bool icmp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
                               struct nf_conntrack_tuple *tuple)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index ce572f9dff02..0cd71b84e483 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -522,8 +522,12 @@ static int tcp_splice_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb,
                                 unsigned int offset, size_t len)
 {
         struct tcp_splice_state *tss = rd_desc->arg.data;
+        int ret;
 
-        return skb_splice_bits(skb, offset, tss->pipe, tss->len, tss->flags);
+        ret = skb_splice_bits(skb, offset, tss->pipe, rd_desc->count, tss->flags);
+        if (ret > 0)
+                rd_desc->count -= ret;
+        return ret;
 }
 
 static int __tcp_splice_read(struct sock *sk, struct tcp_splice_state *tss)
@@ -531,6 +535,7 @@ static int __tcp_splice_read(struct sock *sk, struct tcp_splice_state *tss)
         /* Store TCP splice context information in read_descriptor_t. */
         read_descriptor_t rd_desc = {
                 .arg.data = tss,
+                .count    = tss->len,
         };
 
         return tcp_read_sock(sk, &rd_desc, tcp_splice_data_recv);
@@ -611,11 +616,13 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
                 tss.len -= ret;
                 spliced += ret;
 
+                if (!timeo)
+                        break;
                 release_sock(sk);
                 lock_sock(sk);
 
                 if (sk->sk_err || sk->sk_state == TCP_CLOSE ||
-                    (sk->sk_shutdown & RCV_SHUTDOWN) || !timeo ||
+                    (sk->sk_shutdown & RCV_SHUTDOWN) ||
                     signal_pending(current))
                         break;
         }
@@ -2382,7 +2389,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
         unsigned int seq;
         __be32 delta;
         unsigned int oldlen;
-        unsigned int len;
+        unsigned int mss;
 
         if (!pskb_may_pull(skb, sizeof(*th)))
                 goto out;
@@ -2398,10 +2405,13 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
         oldlen = (u16)~skb->len;
         __skb_pull(skb, thlen);
 
+        mss = skb_shinfo(skb)->gso_size;
+        if (unlikely(skb->len <= mss))
+                goto out;
+
         if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
                 /* Packet is from an untrusted source, reset gso_segs. */
                 int type = skb_shinfo(skb)->gso_type;
-                int mss;
 
                 if (unlikely(type &
                              ~(SKB_GSO_TCPV4 |
@@ -2412,7 +2422,6 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
                              !(type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))))
                         goto out;
 
-                mss = skb_shinfo(skb)->gso_size;
                 skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
 
                 segs = NULL;
@@ -2423,8 +2432,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
         if (IS_ERR(segs))
                 goto out;
 
-        len = skb_shinfo(skb)->gso_size;
-        delta = htonl(oldlen + (thlen + len));
+        delta = htonl(oldlen + (thlen + mss));
 
         skb = segs;
         th = tcp_hdr(skb);
@@ -2440,7 +2448,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
                              csum_fold(csum_partial(skb_transport_header(skb),
                                                     thlen, skb->csum));
 
-                seq += len;
+                seq += mss;
                 skb = skb->next;
                 th = tcp_hdr(skb);
 
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 94f74f5b0cbf..c802bc1658a8 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -797,6 +797,7 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
         unsigned int nlen;
         int flush = 1;
         int proto;
+        __wsum csum;
 
         if (unlikely(!pskb_may_pull(skb, sizeof(*iph))))
                 goto out;
@@ -808,6 +809,7 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
 
         rcu_read_lock();
         proto = ipv6_gso_pull_exthdrs(skb, iph->nexthdr);
+        iph = ipv6_hdr(skb);
         IPV6_GRO_CB(skb)->proto = proto;
         ops = rcu_dereference(inet6_protos[proto]);
         if (!ops || !ops->gro_receive)
@@ -839,8 +841,13 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
 
         NAPI_GRO_CB(skb)->flush |= flush;
 
+        csum = skb->csum;
+        skb_postpull_rcsum(skb, iph, skb_network_header_len(skb));
+
         pp = ops->gro_receive(head, skb);
 
+        skb->csum = csum;
+
 out_unlock:
         rcu_read_unlock();
 
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 29c7c99e69f7..52ee1dced2ff 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -298,6 +298,10 @@ static void fib6_dump_end(struct netlink_callback *cb)
         struct fib6_walker_t *w = (void*)cb->args[2];
 
         if (w) {
+                if (cb->args[4]) {
+                        cb->args[4] = 0;
+                        fib6_walker_unlink(w);
+                }
                 cb->args[2] = 0;
                 kfree(w);
         }
@@ -330,15 +334,12 @@ static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb,
                 read_lock_bh(&table->tb6_lock);
                 res = fib6_walk_continue(w);
                 read_unlock_bh(&table->tb6_lock);
-                if (res != 0) {
-                        if (res < 0)
-                                fib6_walker_unlink(w);
-                        goto end;
+                if (res <= 0) {
+                        fib6_walker_unlink(w);
+                        cb->args[4] = 0;
                 }
-                fib6_walker_unlink(w);
-                cb->args[4] = 0;
         }
-end:
+
         return res;
 }
 
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index bd52151d31e9..c455cf4ee756 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -26,7 +26,7 @@
 #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h>
 #include <net/netfilter/nf_log.h>
 
-static unsigned long nf_ct_icmpv6_timeout __read_mostly = 30*HZ;
+static unsigned int nf_ct_icmpv6_timeout __read_mostly = 30*HZ;
 
 static bool icmpv6_pkt_to_tuple(const struct sk_buff *skb,
                                 unsigned int dataoff,
diff --git a/net/key/af_key.c b/net/key/af_key.c
index f8bd8df5e257..7dcbde3ea7d9 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1285,6 +1285,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                                 ext_hdrs[SADB_X_EXT_NAT_T_DPORT-1];
                         natt->encap_dport = n_port->sadb_x_nat_t_port_port;
                 }
+                memset(&natt->encap_oa, 0, sizeof(natt->encap_oa));
         }
 
         err = xfrm_init_state(x);
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 5f510a13b9f0..c5c0c5271096 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -469,7 +469,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         struct ieee80211_sub_if_data *sdata;
         u16 start_seq_num;
         u8 *state;
-        int ret;
+        int ret = 0;
 
         if ((tid >= STA_TID_NUM) || !(hw->flags & IEEE80211_HW_AMPDU_AGGREGATION))
                 return -EINVAL;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 5abbc3f07dd6..b9074824862a 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -699,7 +699,8 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
                 return 0;
 
         /* Setting ad-hoc mode on non-IBSS channel is not supported. */
-        if (sdata->local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS)
+        if (sdata->local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS &&
+            type == NL80211_IFTYPE_ADHOC)
                 return -EOPNOTSUPP;
 
         /*
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 929ba542fd72..1159bdb4119c 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -107,6 +107,7 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
 
         sta->flags = WLAN_STA_AUTHORIZED;
         sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
+        rate_control_rate_init(sta);
 
         return sta;
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 5ba721b6a399..2b890af01ba4 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -620,8 +620,8 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
         if (use_short_slot != bss_conf->use_short_slot) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: switched to %s slot"
-                               " (BSSID=%s)\n",
+                        printk(KERN_DEBUG "%s: switched to %s slot time"
+                               " (BSSID=%pM)\n",
                                sdata->dev->name,
                                use_short_slot ? "short" : "long",
                                ifsta->bssid);
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 2b3b490a6073..3824990d340b 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -395,13 +395,15 @@ minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
 {
         struct minstrel_sta_info *mi = priv_sta;
         struct minstrel_priv *mp = priv;
-        struct minstrel_rate *mr_ctl;
+        struct ieee80211_local *local = hw_to_local(mp->hw);
+        struct ieee80211_rate *ctl_rate;
         unsigned int i, n = 0;
         unsigned int t_slot = 9; /* FIXME: get real slot time */
 
         mi->lowest_rix = rate_lowest_index(sband, sta);
-        mr_ctl = &mi->r[rix_to_ndx(mi, mi->lowest_rix)];
-        mi->sp_ack_dur = mr_ctl->ack_time;
+        ctl_rate = &sband->bitrates[mi->lowest_rix];
+        mi->sp_ack_dur = ieee80211_frame_duration(local, 10, ctl_rate->bitrate,
+                                !!(ctl_rate->flags & IEEE80211_RATE_ERP_G), 1);
 
         for (i = 0; i < sband->n_bitrates; i++) {
                 struct minstrel_rate *mr = &mi->r[n];
@@ -416,7 +418,7 @@ minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
 
                 mr->rix = i;
                 mr->bitrate = sband->bitrates[i].bitrate / 5;
-                calc_rate_durations(mi, hw_to_local(mp->hw), mr,
+                calc_rate_durations(mi, local, mr,
                                 &sband->bitrates[i]);
 
                 /* calculate maximum number of retransmissions before
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index dc2606d0ae77..e49a5b99cf10 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -195,7 +195,6 @@ struct sta_ampdu_mlme {
  * @tx_packets: number of RX/TX MSDUs
  * @tx_bytes: number of bytes transmitted to this STA
  * @tx_fragments: number of transmitted MPDUs
- * @last_txrate: description of the last used transmit rate
  * @tid_seq: per-TID sequence numbers for sending to this STA
  * @ampdu_mlme: A-MPDU state machine state
  * @timer_to_tid: identity mapping to ID timers
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index a4af3a124cce..4278e545638f 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1307,8 +1307,10 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 if (is_multicast_ether_addr(hdr->addr3))
                         memcpy(hdr->addr1, hdr->addr3, ETH_ALEN);
                 else
-                        if (mesh_nexthop_lookup(skb, osdata))
-                                return  0;
+                        if (mesh_nexthop_lookup(skb, osdata)) {
+                                dev_put(odev);
+                                return 0;
+                        }
                 if (memcmp(odev->dev_addr, hdr->addr4, ETH_ALEN) != 0)
                         IEEE80211_IFSTA_MESH_CTR_INC(&osdata->u.mesh,
                                                             fwded_frames);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 7e83f74cd5de..90ce9ddb9451 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -469,7 +469,7 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
                                    const struct nf_conntrack_tuple *repl,
                                    gfp_t gfp)
 {
-        struct nf_conn *ct = NULL;
+        struct nf_conn *ct;
 
         if (unlikely(!nf_conntrack_hash_rnd_initted)) {
                 get_random_bytes(&nf_conntrack_hash_rnd, 4);
@@ -551,7 +551,7 @@ init_conntrack(struct net *net,
         }
 
         ct = nf_conntrack_alloc(net, tuple, &repl_tuple, GFP_ATOMIC);
-        if (ct == NULL || IS_ERR(ct)) {
+        if (IS_ERR(ct)) {
                 pr_debug("Can't allocate conntrack.\n");
                 return (struct nf_conntrack_tuple_hash *)ct;
         }
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 00e8c27130ff..c32a7e8e3a1b 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -831,13 +831,16 @@ ctnetlink_parse_nat_setup(struct nf_conn *ct,
         if (!parse_nat_setup) {
 #ifdef CONFIG_MODULES
                 rcu_read_unlock();
+                spin_unlock_bh(&nf_conntrack_lock);
                 nfnl_unlock();
                 if (request_module("nf-nat-ipv4") < 0) {
                         nfnl_lock();
+                        spin_lock_bh(&nf_conntrack_lock);
                         rcu_read_lock();
                         return -EOPNOTSUPP;
                 }
                 nfnl_lock();
+                spin_lock_bh(&nf_conntrack_lock);
                 rcu_read_lock();
                 if (nfnetlink_parse_nat_setup_hook)
                         return -EAGAIN;
@@ -1134,7 +1137,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
         struct nf_conntrack_helper *helper;
 
         ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC);
-        if (ct == NULL || IS_ERR(ct))
+        if (IS_ERR(ct))
                 return -ENOMEM;
 
         if (!cda[CTA_TIMEOUT])
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 89837a4eef76..bfbf521f6ea5 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -273,6 +273,10 @@ static int match_revfn(u8 af, const char *name, u8 revision, int *bestp)
                                 have_rev = 1;
                 }
         }
+
+        if (af != NFPROTO_UNSPEC && !have_rev)
+                return match_revfn(NFPROTO_UNSPEC, name, revision, bestp);
+
         return have_rev;
 }
 
@@ -289,6 +293,10 @@ static int target_revfn(u8 af, const char *name, u8 revision, int *bestp)
                                 have_rev = 1;
                 }
         }
+
+        if (af != NFPROTO_UNSPEC && !have_rev)
+                return target_revfn(NFPROTO_UNSPEC, name, revision, bestp);
+
         return have_rev;
 }
 
diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c
index 29375ba8db73..93acaa59d108 100644
--- a/net/netfilter/xt_time.c
+++ b/net/netfilter/xt_time.c
@@ -243,6 +243,17 @@ static struct xt_match xt_time_mt_reg __read_mostly = {
 
 static int __init time_mt_init(void)
 {
+        int minutes = sys_tz.tz_minuteswest;
+
+        if (minutes < 0) /* east of Greenwich */
+                printk(KERN_INFO KBUILD_MODNAME
+                       ": kernel timezone is +%02d%02d\n",
+                       -minutes / 60, -minutes % 60);
+        else /* west of Greenwich */
+                printk(KERN_INFO KBUILD_MODNAME
+                       ": kernel timezone is -%02d%02d\n",
+                       minutes / 60, minutes % 60);
+
         return xt_register_match(&xt_time_mt_reg);
 }
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 5070643ce534..2f0f0b04d3fb 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -661,12 +661,13 @@ static void htb_charge_class(struct htb_sched *q, struct htb_class *cl,
  * next pending event (0 for no event in pq).
  * Note: Applied are events whose have cl->pq_key <= q->now.
  */
-static psched_time_t htb_do_events(struct htb_sched *q, int level)
+static psched_time_t htb_do_events(struct htb_sched *q, int level,
+                                   unsigned long start)
 {
         /* don't run for longer than 2 jiffies; 2 is used instead of
            1 to simplify things when jiffy is going to be incremented
            too soon */
-        unsigned long stop_at = jiffies + 2;
+        unsigned long stop_at = start + 2;
         while (time_before(jiffies, stop_at)) {
                 struct htb_class *cl;
                 long diff;
@@ -685,8 +686,8 @@ static psched_time_t htb_do_events(struct htb_sched *q, int level)
                 if (cl->cmode != HTB_CAN_SEND)
                         htb_add_to_wait_tree(q, cl, diff);
         }
-        /* too much load - let's continue on next jiffie */
-        return q->now + PSCHED_TICKS_PER_SEC / HZ;
+        /* too much load - let's continue on next jiffie (including above) */
+        return q->now + 2 * PSCHED_TICKS_PER_SEC / HZ;
 }
 
 /* Returns class->node+prio from id-tree where classe's id is >= id. NULL
@@ -845,6 +846,7 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
         struct htb_sched *q = qdisc_priv(sch);
         int level;
         psched_time_t next_event;
+        unsigned long start_at;
 
         /* try to dequeue direct packets as high prio (!) to minimize cpu work */
         skb = __skb_dequeue(&q->direct_queue);
@@ -857,6 +859,7 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
         if (!sch->q.qlen)
                 goto fin;
         q->now = psched_get_time();
+        start_at = jiffies;
 
         next_event = q->now + 5 * PSCHED_TICKS_PER_SEC;
 
@@ -866,14 +869,14 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
                 psched_time_t event;
 
                 if (q->now >= q->near_ev_cache[level]) {
-                        event = htb_do_events(q, level);
+                        event = htb_do_events(q, level, start_at);
                         if (!event)
                                 event = q->now + PSCHED_TICKS_PER_SEC;
                         q->near_ev_cache[level] = event;
                 } else
                         event = q->near_ev_cache[level];
 
-                if (event && next_event > event)
+                if (next_event > event)
                         next_event = event;
 
                 m = ~q->row_mask[level];
diff --git a/net/sctp/input.c b/net/sctp/input.c
index bf612d954d41..2e4a8646dbc3 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -249,6 +249,19 @@ int sctp_rcv(struct sk_buff *skb)
          */
         sctp_bh_lock_sock(sk);
 
+        if (sk != rcvr->sk) {
+                /* Our cached sk is different from the rcvr->sk.  This is
+                 * because migrate()/accept() may have moved the association
+                 * to a new socket and released all the sockets.  So now we
+                 * are holding a lock on the old socket while the user may
+                 * be doing something with the new socket.  Switch our veiw
+                 * of the current sk.
+                 */
+                sctp_bh_unlock_sock(sk);
+                sk = rcvr->sk;
+                sctp_bh_lock_sock(sk);
+        }
+
         if (sock_owned_by_user(sk)) {
                 SCTP_INC_STATS_BH(SCTP_MIB_IN_PKT_BACKLOG);
                 sctp_add_backlog(sk, skb);
diff --git a/net/sctp/output.c b/net/sctp/output.c
index c3f417f7ec6e..73639355157e 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -324,14 +324,16 @@ append:
         switch (chunk->chunk_hdr->type) {
             case SCTP_CID_DATA:
                 retval = sctp_packet_append_data(packet, chunk);
+                if (SCTP_XMIT_OK != retval)
+                        goto finish;
                 /* Disallow SACK bundling after DATA. */
                 packet->has_sack = 1;
                 /* Disallow AUTH bundling after DATA */
                 packet->has_auth = 1;
                 /* Let it be knows that packet has DATA in it */
                 packet->has_data = 1;
-                if (SCTP_XMIT_OK != retval)
-                        goto finish;
+                /* timestamp the chunk for rtx purposes */
+                chunk->sent_at = jiffies;
                 break;
             case SCTP_CID_COOKIE_ECHO:
                 packet->has_cookie_echo = 1;
@@ -470,7 +472,6 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                         } else
                                 chunk->resent = 1;
 
-                        chunk->sent_at = jiffies;
                         has_data = 1;
                 }
 
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 247ebc95c1e5..bc411c896216 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -929,7 +929,6 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                 }
 
                 /* Finally, transmit new packets.  */
-                start_timer = 0;
                 while ((chunk = sctp_outq_dequeue_data(q)) != NULL) {
                         /* RFC 2960 6.5 Every DATA chunk MUST carry a valid
                          * stream identifier.
@@ -1028,7 +1027,7 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                         list_add_tail(&chunk->transmitted_list,
                                       &transport->transmitted);
 
-                        sctp_transport_reset_timers(transport, start_timer-1);
+                        sctp_transport_reset_timers(transport, 0);
 
                         q->empty = 0;
 
diff --git a/net/socket.c b/net/socket.c
index 06603d73c411..35dd7371752a 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1214,7 +1214,7 @@ int sock_create_kern(int family, int type, int protocol, struct socket **res)
         return __sock_create(&init_net, family, type, protocol, res, 1);
 }
 
-asmlinkage long sys_socket(int family, int type, int protocol)
+SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
 {
         int retval;
         struct socket *sock;
@@ -1255,8 +1255,8 @@ out_release:
  *      Create a pair of connected sockets.
  */
 
-asmlinkage long sys_socketpair(int family, int type, int protocol,
-                               int __user *usockvec)
+SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
+                int __user *, usockvec)
 {
         struct socket *sock1, *sock2;
         int fd1, fd2, err;
@@ -1356,7 +1356,7 @@ out_fd1:
  *      the protocol layer (having also checked the address is ok).
  */
 
-asmlinkage long sys_bind(int fd, struct sockaddr __user *umyaddr, int addrlen)
+SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
 {
         struct socket *sock;
         struct sockaddr_storage address;
@@ -1385,7 +1385,7 @@ asmlinkage long sys_bind(int fd, struct sockaddr __user *umyaddr, int addrlen)
  *      ready for listening.
  */
 
-asmlinkage long sys_listen(int fd, int backlog)
+SYSCALL_DEFINE2(listen, int, fd, int, backlog)
 {
         struct socket *sock;
         int err, fput_needed;
@@ -1418,8 +1418,8 @@ asmlinkage long sys_listen(int fd, int backlog)
  *      clean when we restucture accept also.
  */
 
-asmlinkage long sys_accept4(int fd, struct sockaddr __user *upeer_sockaddr,
-                            int __user *upeer_addrlen, int flags)
+SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
+                int __user *, upeer_addrlen, int, flags)
 {
         struct socket *sock, *newsock;
         struct file *newfile;
@@ -1502,8 +1502,8 @@ out_fd:
         goto out_put;
 }
 
-asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
-                           int __user *upeer_addrlen)
+SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
+                int __user *, upeer_addrlen)
 {
         return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
 }
@@ -1520,8 +1520,8 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
  *      include the -EINPROGRESS status for such sockets.
  */
 
-asmlinkage long sys_connect(int fd, struct sockaddr __user *uservaddr,
-                            int addrlen)
+SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
+                int, addrlen)
 {
         struct socket *sock;
         struct sockaddr_storage address;
@@ -1552,8 +1552,8 @@ out:
  *      name to user space.
  */
 
-asmlinkage long sys_getsockname(int fd, struct sockaddr __user *usockaddr,
-                                int __user *usockaddr_len)
+SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
+                int __user *, usockaddr_len)
 {
         struct socket *sock;
         struct sockaddr_storage address;
@@ -1583,8 +1583,8 @@ out:
  *      name to user space.
  */
 
-asmlinkage long sys_getpeername(int fd, struct sockaddr __user *usockaddr,
-                                int __user *usockaddr_len)
+SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
+                int __user *, usockaddr_len)
 {
         struct socket *sock;
         struct sockaddr_storage address;
@@ -1615,9 +1615,9 @@ asmlinkage long sys_getpeername(int fd, struct sockaddr __user *usockaddr,
  *      the protocol.
  */
 
-asmlinkage long sys_sendto(int fd, void __user *buff, size_t len,
-                           unsigned flags, struct sockaddr __user *addr,
-                           int addr_len)
+SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
+                unsigned, flags, struct sockaddr __user *, addr,
+                int, addr_len)
 {
         struct socket *sock;
         struct sockaddr_storage address;
@@ -1660,7 +1660,8 @@ out:
  *      Send a datagram down a socket.
  */
 
-asmlinkage long sys_send(int fd, void __user *buff, size_t len, unsigned flags)
+SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
+                unsigned, flags)
 {
         return sys_sendto(fd, buff, len, flags, NULL, 0);
 }
@@ -1671,9 +1672,9 @@ asmlinkage long sys_send(int fd, void __user *buff, size_t len, unsigned flags)
  *      sender address from kernel to user space.
  */
 
-asmlinkage long sys_recvfrom(int fd, void __user *ubuf, size_t size,
-                             unsigned flags, struct sockaddr __user *addr,
-                             int __user *addr_len)
+SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
+                unsigned, flags, struct sockaddr __user *, addr,
+                int __user *, addr_len)
 {
         struct socket *sock;
         struct iovec iov;
@@ -1725,8 +1726,8 @@ asmlinkage long sys_recv(int fd, void __user *ubuf, size_t size,
  *      to pass the user mode parameter for the protocols to sort out.
  */
 
-asmlinkage long sys_setsockopt(int fd, int level, int optname,
-                               char __user *optval, int optlen)
+SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
+                char __user *, optval, int, optlen)
 {
         int err, fput_needed;
         struct socket *sock;
@@ -1759,8 +1760,8 @@ out_put:
  *      to pass a user mode parameter for the protocols to sort out.
  */
 
-asmlinkage long sys_getsockopt(int fd, int level, int optname,
-                               char __user *optval, int __user *optlen)
+SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
+                char __user *, optval, int __user *, optlen)
 {
         int err, fput_needed;
         struct socket *sock;
@@ -1789,7 +1790,7 @@ out_put:
  *      Shutdown a socket.
  */
 
-asmlinkage long sys_shutdown(int fd, int how)
+SYSCALL_DEFINE2(shutdown, int, fd, int, how)
 {
         int err, fput_needed;
         struct socket *sock;
@@ -1815,7 +1816,7 @@ asmlinkage long sys_shutdown(int fd, int how)
  *      BSD sendmsg interface
  */
 
-asmlinkage long sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
+SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
 {
         struct compat_msghdr __user *msg_compat =
             (struct compat_msghdr __user *)msg;
@@ -1921,8 +1922,8 @@ out:
  *      BSD recvmsg interface
  */
 
-asmlinkage long sys_recvmsg(int fd, struct msghdr __user *msg,
-                            unsigned int flags)
+SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
+                unsigned int, flags)
 {
         struct compat_msghdr __user *msg_compat =
             (struct compat_msghdr __user *)msg;
@@ -2045,7 +2046,7 @@ static const unsigned char nargs[19]={
  *  it is set by the callees.
  */
 
-asmlinkage long sys_socketcall(int call, unsigned long __user *args)
+SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
 {
         unsigned long a[6];
         unsigned long a0, a1;
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
new file mode 100644
index 000000000000..dcef600d0bf5
--- /dev/null
+++ b/net/sunrpc/Kconfig
@@ -0,0 +1,78 @@
+config SUNRPC
+        tristate
+
+config SUNRPC_GSS
+        tristate
+
+config SUNRPC_XPRT_RDMA
+        tristate
+        depends on SUNRPC && INFINIBAND && EXPERIMENTAL
+        default SUNRPC && INFINIBAND
+        help
+          This option allows the NFS client and server to support
+          an RDMA-enabled transport.
+
+          To compile RPC client RDMA transport support as a module,
+          choose M here: the module will be called xprtrdma.
+
+          If unsure, say N.
+
+config SUNRPC_REGISTER_V4
+        bool "Register local RPC services via rpcbind v4 (EXPERIMENTAL)"
+        depends on SUNRPC && EXPERIMENTAL
+        default n
+        help
+          Sun added support for registering RPC services at an IPv6
+          address by creating two new versions of the rpcbind protocol
+          (RFC 1833).
+
+          This option enables support in the kernel RPC server for
+          registering kernel RPC services via version 4 of the rpcbind
+          protocol.  If you enable this option, you must run a portmapper
+          daemon that supports rpcbind protocol version 4.
+
+          Serving NFS over IPv6 from knfsd (the kernel's NFS server)
+          requires that you enable this option and use a portmapper that
+          supports rpcbind version 4.
+
+          If unsure, say N to get traditional behavior (register kernel
+          RPC services using only rpcbind version 2).  Distributions
+          using the legacy Linux portmapper daemon must say N here.
+
+config RPCSEC_GSS_KRB5
+        tristate "Secure RPC: Kerberos V mechanism (EXPERIMENTAL)"
+        depends on SUNRPC && EXPERIMENTAL
+        select SUNRPC_GSS
+        select CRYPTO
+        select CRYPTO_MD5
+        select CRYPTO_DES
+        select CRYPTO_CBC
+        help
+          Choose Y here to enable Secure RPC using the Kerberos version 5
+          GSS-API mechanism (RFC 1964).
+
+          Secure RPC calls with Kerberos require an auxiliary user-space
+          daemon which may be found in the Linux nfs-utils package
+          available from http://linux-nfs.org/.  In addition, user-space
+          Kerberos support should be installed.
+
+          If unsure, say N.
+
+config RPCSEC_GSS_SPKM3
+        tristate "Secure RPC: SPKM3 mechanism (EXPERIMENTAL)"
+        depends on SUNRPC && EXPERIMENTAL
+        select SUNRPC_GSS
+        select CRYPTO
+        select CRYPTO_MD5
+        select CRYPTO_DES
+        select CRYPTO_CAST5
+        select CRYPTO_CBC
+        help
+          Choose Y here to enable Secure RPC using the SPKM3 public key
+          GSS-API mechansim (RFC 2025).
+
+          Secure RPC calls with SPKM3 require an auxiliary userspace
+          daemon which may be found in the Linux nfs-utils package
+          available from http://linux-nfs.org/.
+
+          If unsure, say N.
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 4f877535e666..bc494cef2102 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -421,6 +421,31 @@ static u32 freq_max_bandwidth(const struct ieee80211_freq_range *freq_range,
         return 0;
 }
 
+/**
+ * freq_in_rule_band - tells us if a frequency is in a frequency band
+ * @freq_range: frequency rule we want to query
+ * @freq_khz: frequency we are inquiring about
+ *
+ * This lets us know if a specific frequency rule is or is not relevant to
+ * a specific frequency's band. Bands are device specific and artificial
+ * definitions (the "2.4 GHz band" and the "5 GHz band"), however it is
+ * safe for now to assume that a frequency rule should not be part of a
+ * frequency's band if the start freq or end freq are off by more than 2 GHz.
+ * This resolution can be lowered and should be considered as we add
+ * regulatory rule support for other "bands".
+ **/
+static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
+        u32 freq_khz)
+{
+#define ONE_GHZ_IN_KHZ  1000000
+        if (abs(freq_khz - freq_range->start_freq_khz) <= (2 * ONE_GHZ_IN_KHZ))
+                return true;
+        if (abs(freq_khz - freq_range->end_freq_khz) <= (2 * ONE_GHZ_IN_KHZ))
+                return true;
+        return false;
+#undef ONE_GHZ_IN_KHZ
+}
+
 /* Converts a country IE to a regulatory domain. A regulatory domain
  * structure has a lot of information which the IE doesn't yet have,
  * so for the other values we use upper max values as we will intersect
@@ -538,6 +563,7 @@ static struct ieee80211_regdomain *country_ie_2_rd(
 
         /* This time around we fill in the rd */
         while (country_ie_len >= 3) {
+                int end_channel = 0;
                 struct ieee80211_country_ie_triplet *triplet =
                         (struct ieee80211_country_ie_triplet *) country_ie;
                 struct ieee80211_reg_rule *reg_rule = NULL;
@@ -559,6 +585,23 @@ static struct ieee80211_regdomain *country_ie_2_rd(
 
                 reg_rule->flags = flags;
 
+                /* 2 GHz */
+                if (triplet->chans.first_channel <= 14)
+                        end_channel = triplet->chans.first_channel +
+                                triplet->chans.num_channels;
+                else
+                        /*
+                         * 5 GHz -- For example in country IEs if the first
+                         * channel given is 36 and the number of channels is 4
+                         * then the individual channel numbers defined for the
+                         * 5 GHz PHY by these parameters are: 36, 40, 44, and 48
+                         * and not 36, 37, 38, 39.
+                         *
+                         * See: http://tinyurl.com/11d-clarification
+                         */
+                        end_channel =  triplet->chans.first_channel +
+                                (4 * (triplet->chans.num_channels - 1));
+
                 /* The +10 is since the regulatory domain expects
                  * the actual band edge, not the center of freq for
                  * its start and end freqs, assuming 20 MHz bandwidth on
@@ -568,8 +611,7 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                                 triplet->chans.first_channel) - 10);
                 freq_range->end_freq_khz =
                         MHZ_TO_KHZ(ieee80211_channel_to_frequency(
-                                triplet->chans.first_channel +
-                                        triplet->chans.num_channels) + 10);
+                                end_channel) + 10);
 
                 /* Large arbitrary values, we intersect later */
                 /* Increment this if we ever support >= 40 MHz channels
@@ -748,12 +790,23 @@ static u32 map_regdom_flags(u32 rd_flags)
  *      this value to the maximum allowed bandwidth.
  * @reg_rule: the regulatory rule which we have for this frequency
  *
- * Use this function to get the regulatory rule for a specific frequency.
+ * Use this function to get the regulatory rule for a specific frequency on
+ * a given wireless device. If the device has a specific regulatory domain
+ * it wants to follow we respect that unless a country IE has been received
+ * and processed already.
+ *
+ * Returns 0 if it was able to find a valid regulatory rule which does
+ * apply to the given center_freq otherwise it returns non-zero. It will
+ * also return -ERANGE if we determine the given center_freq does not even have
+ * a regulatory rule for a frequency range in the center_freq's band. See
+ * freq_in_rule_band() for our current definition of a band -- this is purely
+ * subjective and right now its 802.11 specific.
  */
 static int freq_reg_info(u32 center_freq, u32 *bandwidth,
                          const struct ieee80211_reg_rule **reg_rule)
 {
         int i;
+        bool band_rule_found = false;
         u32 max_bandwidth = 0;
 
         if (!cfg80211_regdomain)
@@ -767,7 +820,15 @@ static int freq_reg_info(u32 center_freq, u32 *bandwidth,
                 rr = &cfg80211_regdomain->reg_rules[i];
                 fr = &rr->freq_range;
                 pr = &rr->power_rule;
+
+                /* We only need to know if one frequency rule was
+                 * was in center_freq's band, that's enough, so lets
+                 * not overwrite it once found */
+                if (!band_rule_found)
+                        band_rule_found = freq_in_rule_band(fr, center_freq);
+
                 max_bandwidth = freq_max_bandwidth(fr, center_freq);
+
                 if (max_bandwidth && *bandwidth <= max_bandwidth) {
                         *reg_rule = rr;
                         *bandwidth = max_bandwidth;
@@ -775,23 +836,64 @@ static int freq_reg_info(u32 center_freq, u32 *bandwidth,
                 }
         }
 
+        if (!band_rule_found)
+                return -ERANGE;
+
         return !max_bandwidth;
 }
 
-static void handle_channel(struct ieee80211_channel *chan)
+static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
+                           unsigned int chan_idx)
 {
         int r;
-        u32 flags = chan->orig_flags;
+        u32 flags;
         u32 max_bandwidth = 0;
         const struct ieee80211_reg_rule *reg_rule = NULL;
         const struct ieee80211_power_rule *power_rule = NULL;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_channel *chan;
+
+        sband = wiphy->bands[band];
+        BUG_ON(chan_idx >= sband->n_channels);
+        chan = &sband->channels[chan_idx];
+
+        flags = chan->orig_flags;
 
         r = freq_reg_info(MHZ_TO_KHZ(chan->center_freq),
                 &max_bandwidth, &reg_rule);
 
         if (r) {
-                flags |= IEEE80211_CHAN_DISABLED;
-                chan->flags = flags;
+                /* This means no regulatory rule was found in the country IE
+                 * with a frequency range on the center_freq's band, since
+                 * IEEE-802.11 allows for a country IE to have a subset of the
+                 * regulatory information provided in a country we ignore
+                 * disabling the channel unless at least one reg rule was
+                 * found on the center_freq's band. For details see this
+                 * clarification:
+                 *
+                 * http://tinyurl.com/11d-clarification
+                 */
+                if (r == -ERANGE &&
+                    last_request->initiator == REGDOM_SET_BY_COUNTRY_IE) {
+#ifdef CONFIG_CFG80211_REG_DEBUG
+                        printk(KERN_DEBUG "cfg80211: Leaving channel %d MHz "
+                                "intact on %s - no rule found in band on "
+                                "Country IE\n",
+                                chan->center_freq, wiphy_name(wiphy));
+#endif
+                } else {
+                /* In this case we know the country IE has at least one reg rule
+                 * for the band so we respect its band definitions */
+#ifdef CONFIG_CFG80211_REG_DEBUG
+                        if (last_request->initiator == REGDOM_SET_BY_COUNTRY_IE)
+                                printk(KERN_DEBUG "cfg80211: Disabling "
+                                        "channel %d MHz on %s due to "
+                                        "Country IE\n",
+                                        chan->center_freq, wiphy_name(wiphy));
+#endif
+                        flags |= IEEE80211_CHAN_DISABLED;
+                        chan->flags = flags;
+                }
                 return;
         }
 
@@ -808,12 +910,16 @@ static void handle_channel(struct ieee80211_channel *chan)
                 chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
 }
 
-static void handle_band(struct ieee80211_supported_band *sband)
+static void handle_band(struct wiphy *wiphy, enum ieee80211_band band)
 {
-        int i;
+        unsigned int i;
+        struct ieee80211_supported_band *sband;
+
+        BUG_ON(!wiphy->bands[band]);
+        sband = wiphy->bands[band];
 
         for (i = 0; i < sband->n_channels; i++)
-                handle_channel(&sband->channels[i]);
+                handle_channel(wiphy, band, i);
 }
 
 static bool ignore_reg_update(struct wiphy *wiphy, enum reg_set_by setby)
@@ -840,7 +946,7 @@ void wiphy_update_regulatory(struct wiphy *wiphy, enum reg_set_by setby)
         enum ieee80211_band band;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 if (wiphy->bands[band])
-                        handle_band(wiphy->bands[band]);
+                        handle_band(wiphy, band);
                 if (wiphy->reg_notifier)
                         wiphy->reg_notifier(wiphy, setby);
         }