Merge branch 'linus' into sched/clock

author: Ingo Molnar <mingo@elte.hu> 2008-08-11 02:59:21 -0400
committer: Ingo Molnar <mingo@elte.hu> 2008-08-11 02:59:21 -0400
commit: cf206bffbb7542df54043fad9898113172af99d8 (patch)
tree: c7e7ca9a93443b888f98a0c07e74751a1aa3c947 /net
parent: c1955a3d4762e7a9bf84035eb3c4886a900f0d15 (diff)
parent: 796aadeb1b2db9b5d463946766c5bbfd7717158c (diff)
71 files changed, 1066 insertions, 751 deletions
diff --git a/net/Kconfig b/net/Kconfig
index b98668751749..7612cc8c337c 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -2,9 +2,7 @@
 # Network configuration
 #
-menu "Networking"
+menuconfig NET
-config NET
        bool "Networking support"
        ---help---
          Unless you really know what you are doing, you should say Y here.
@@ -22,7 +20,6 @@ config NET
          recommended to read the NET-HOWTO, available from
          <http://www.tldp.org/docs.html#howto>.
-# Make sure that all config symbols are dependent on NET
 if NET
 menu "Networking options"
@@ -252,5 +249,3 @@ source "net/rfkill/Kconfig"
 source "net/9p/Kconfig"
 endif   # if NET
-endmenu # Networking
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 4fccaa1e07be..11b16d16661c 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -62,11 +62,13 @@ static void MPOA_cache_impos_rcvd(struct k_message *msg, struct mpoa_client *mpc
 static void set_mpc_ctrl_addr_rcvd(struct k_message *mesg, struct mpoa_client *mpc);
 static void set_mps_mac_addr_rcvd(struct k_message *mesg, struct mpoa_client *mpc);
-static uint8_t *copy_macs(struct mpoa_client *mpc, uint8_t *router_mac,
+static const uint8_t *copy_macs(struct mpoa_client *mpc,
-                          uint8_t *tlvs, uint8_t mps_macs, uint8_t device_type);
+                                const uint8_t *router_mac,
+                                const uint8_t *tlvs, uint8_t mps_macs,
+                                uint8_t device_type);
 static void purge_egress_shortcut(struct atm_vcc *vcc, eg_cache_entry *entry);
-static void send_set_mps_ctrl_addr(char *addr, struct mpoa_client *mpc);
+static void send_set_mps_ctrl_addr(const char *addr, struct mpoa_client *mpc);
 static void mpoad_close(struct atm_vcc *vcc);
 static int msg_from_mpoad(struct atm_vcc *vcc, struct sk_buff *skb);
@@ -351,12 +353,12 @@ static const char *mpoa_device_type_string(char type)
 * lec sees a TLV it uses the pointer to call this function.
 *
 */
-static void lane2_assoc_ind(struct net_device *dev, uint8_t *mac_addr,
+static void lane2_assoc_ind(struct net_device *dev, const u8 *mac_addr,
-                            uint8_t *tlvs, uint32_t sizeoftlvs)
+                            const u8 *tlvs, u32 sizeoftlvs)
 {
        uint32_t type;
        uint8_t length, mpoa_device_type, number_of_mps_macs;
-        uint8_t *end_of_tlvs;
+        const uint8_t *end_of_tlvs;
        struct mpoa_client *mpc;
        mpoa_device_type = number_of_mps_macs = 0; /* silence gcc */
@@ -430,8 +432,10 @@ static void lane2_assoc_ind(struct net_device *dev, uint8_t *mac_addr,
 * plus the possible MAC address(es) to mpc->mps_macs.
 * For a freshly allocated MPOA client mpc->mps_macs == 0.
 */
-static uint8_t *copy_macs(struct mpoa_client *mpc, uint8_t *router_mac,
+static const uint8_t *copy_macs(struct mpoa_client *mpc,
-                          uint8_t *tlvs, uint8_t mps_macs, uint8_t device_type)
+                                const uint8_t *router_mac,
+                                const uint8_t *tlvs, uint8_t mps_macs,
+                                uint8_t device_type)
 {
        int num_macs;
        num_macs = (mps_macs > 1) ? mps_macs : 1;
@@ -811,7 +815,7 @@ static int atm_mpoa_mpoad_attach (struct atm_vcc *vcc, int arg)
        return arg;
 }
-static void send_set_mps_ctrl_addr(char *addr, struct mpoa_client *mpc)
+static void send_set_mps_ctrl_addr(const char *addr, struct mpoa_client *mpc)
 {
        struct k_message mesg;
diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
index f597987b2424..f288fc4aef9b 100644
--- a/net/ax25/sysctl_net_ax25.c
+++ b/net/ax25/sysctl_net_ax25.c
@@ -36,6 +36,7 @@ static struct ctl_path ax25_path[] = {
        { .procname = "ax25", .ctl_name = NET_AX25, },
        { }
 };
 static const ctl_table ax25_param_table[] = {
        {
                .ctl_name       = NET_AX25_IP_DEFAULT_MODE,
@@ -167,6 +168,7 @@ static const ctl_table ax25_param_table[] = {
                .extra1         = &min_proto,
                .extra2         = &max_proto
        },
+#ifdef CONFIG_AX25_DAMA_SLAVE
        {
                .ctl_name       = NET_AX25_DAMA_SLAVE_TIMEOUT,
                .procname       = "dama_slave_timeout",
@@ -177,6 +179,8 @@ static const ctl_table ax25_param_table[] = {
                .extra1         = &min_ds_timeout,
                .extra2         = &max_ds_timeout
        },
+#endif
        { .ctl_name = 0 }       /* that's all, folks! */
 };
@@ -210,16 +214,6 @@ void ax25_register_sysctl(void)
                ax25_table[n].procname     = ax25_dev->dev->name;
                ax25_table[n].mode         = 0555;
-#ifndef CONFIG_AX25_DAMA_SLAVE
-                /*
-                 * We do not wish to have a representation of this parameter
-                 * in /proc/sys/ when configured *not* to include the
-                 * AX.25 DAMA slave code, do we?
-                 */
-                child[AX25_VALUES_DS_TIMEOUT].procname = NULL;
-#endif
                child[AX25_MAX_VALUES].ctl_name = 0;    /* just in case... */
                for (k = 0; k < AX25_MAX_VALUES; k++)
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index 021172c0e666..12bba6207a8d 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -57,7 +57,10 @@
 #define BT_DBG(D...)
 #endif
-#define VERSION "1.2"
+#define VERSION "1.3"
+static int compress_src = 1;
+static int compress_dst = 1;
 static LIST_HEAD(bnep_session_list);
 static DECLARE_RWSEM(bnep_session_sem);
@@ -418,10 +421,10 @@ static inline int bnep_tx_frame(struct bnep_session *s, struct sk_buff *skb)
        iv[il++] = (struct kvec) { &type, 1 };
        len++;
-        if (!compare_ether_addr(eh->h_dest, s->eh.h_source))
+        if (compress_src && !compare_ether_addr(eh->h_dest, s->eh.h_source))
                type |= 0x01;
-        if (!compare_ether_addr(eh->h_source, s->eh.h_dest))
+        if (compress_dst && !compare_ether_addr(eh->h_source, s->eh.h_dest))
                type |= 0x02;
        if (type)
@@ -727,6 +730,12 @@ static void __exit bnep_exit(void)
 module_init(bnep_init);
 module_exit(bnep_exit);
+module_param(compress_src, bool, 0644);
+MODULE_PARM_DESC(compress_src, "Compress sources headers");
+module_param(compress_dst, bool, 0644);
+MODULE_PARM_DESC(compress_dst, "Compress destination headers");
 MODULE_AUTHOR("David Libault <david.libault@inventel.fr>, Maxim Krasnyansky <maxk@qualcomm.com>");
 MODULE_DESCRIPTION("Bluetooth BNEP ver " VERSION);
 MODULE_VERSION(VERSION);
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index d9449df7cad5..9b58d70b0e7d 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -68,10 +68,17 @@ static int br_dev_stop(struct net_device *dev)
 static int br_change_mtu(struct net_device *dev, int new_mtu)
 {
-        if (new_mtu < 68 || new_mtu > br_min_mtu(netdev_priv(dev)))
+        struct net_bridge *br = netdev_priv(dev);
+        if (new_mtu < 68 || new_mtu > br_min_mtu(br))
                return -EINVAL;
        dev->mtu = new_mtu;
+#ifdef CONFIG_BRIDGE_NETFILTER
+        /* remember the MTU in the rtable for PMTU */
+        br->fake_rtable.u.dst.metrics[RTAX_MTU - 1] = new_mtu;
+#endif
        return 0;
 }
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index a072ea5ca6f5..63c18aacde8c 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -202,6 +202,9 @@ static struct net_device *new_bridge_dev(const char *name)
        br->topology_change = 0;
        br->topology_change_detected = 0;
        br->ageing_time = 300 * HZ;
+        br_netfilter_rtable_init(br);
        INIT_LIST_HEAD(&br->age_list);
        br_stp_timer_init(br);
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index bb90cd7bace3..6a9a6cd74b1e 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -101,33 +101,30 @@ static inline __be16 pppoe_proto(const struct sk_buff *skb)
         pppoe_proto(skb) == htons(PPP_IPV6) && \
         brnf_filter_pppoe_tagged)
-/* We need these fake structures to make netfilter happy --
+/*
- * lots of places assume that skb->dst != NULL, which isn't
+ * Initialize bogus route table used to keep netfilter happy.
- * all that unreasonable.
- *
 * Currently, we fill in the PMTU entry because netfilter
 * refragmentation needs it, and the rt_flags entry because
 * ipt_REJECT needs it.  Future netfilter modules might
- * require us to fill additional fields. */
+ * require us to fill additional fields.
-static struct net_device __fake_net_device = {
+ */
-        .hard_header_len        = ETH_HLEN,
+void br_netfilter_rtable_init(struct net_bridge *br)
-#ifdef CONFIG_NET_NS
+{
-        .nd_net                 = &init_net,
+        struct rtable *rt = &br->fake_rtable;
-#endif
-};
-static struct rtable __fake_rtable = {
+        atomic_set(&rt->u.dst.__refcnt, 1);
-        .u = {
+        rt->u.dst.dev = br->dev;
-                .dst = {
+        rt->u.dst.path = &rt->u.dst;
-                        .__refcnt               = ATOMIC_INIT(1),
+        rt->u.dst.metrics[RTAX_MTU - 1] = 1500;
-                        .dev                    = &__fake_net_device,
+        rt->u.dst.flags = DST_NOXFRM;
-                        .path                   = &__fake_rtable.u.dst,
+}
-                        .metrics                = {[RTAX_MTU - 1] = 1500},
-                        .flags                  = DST_NOXFRM,
+static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
-                }
+{
-        },
+        struct net_bridge_port *port = rcu_dereference(dev->br_port);
-        .rt_flags       = 0,
-};
+        return port ? &port->br->fake_rtable : NULL;
+}
 static inline struct net_device *bridge_parent(const struct net_device *dev)
 {
@@ -226,8 +223,12 @@ static int br_nf_pre_routing_finish_ipv6(struct sk_buff *skb)
        }
        nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
-        skb->rtable = &__fake_rtable;
+        skb->rtable = bridge_parent_rtable(nf_bridge->physindev);
-        dst_hold(&__fake_rtable.u.dst);
+        if (!skb->rtable) {
+                kfree_skb(skb);
+                return 0;
+        }
+        dst_hold(&skb->rtable->u.dst);
        skb->dev = nf_bridge->physindev;
        nf_bridge_push_encap_header(skb);
@@ -391,8 +392,12 @@ bridged_dnat:
                        skb->pkt_type = PACKET_HOST;
                }
        } else {
-                skb->rtable = &__fake_rtable;
+                skb->rtable = bridge_parent_rtable(nf_bridge->physindev);
-                dst_hold(&__fake_rtable.u.dst);
+                if (!skb->rtable) {
+                        kfree_skb(skb);
+                        return 0;
+                }
+                dst_hold(&skb->rtable->u.dst);
        }
        skb->dev = nf_bridge->physindev;
@@ -611,8 +616,8 @@ static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff *skb,
                                   const struct net_device *out,
                                   int (*okfn)(struct sk_buff *))
 {
-        if (skb->rtable == &__fake_rtable) {
+        if (skb->rtable && skb->rtable == bridge_parent_rtable(in)) {
-                dst_release(&__fake_rtable.u.dst);
+                dst_release(&skb->rtable->u.dst);
                skb->rtable = NULL;
        }
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 815ed38925b2..c3dc18ddc043 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -15,6 +15,7 @@
 #include <linux/netdevice.h>
 #include <linux/if_bridge.h>
+#include <net/route.h>
 #define BR_HASH_BITS 8
 #define BR_HASH_SIZE (1 << BR_HASH_BITS)
@@ -92,6 +93,9 @@ struct net_bridge
        struct hlist_head               hash[BR_HASH_SIZE];
        struct list_head                age_list;
        unsigned long                   feature_mask;
+#ifdef CONFIG_BRIDGE_NETFILTER
+        struct rtable                   fake_rtable;
+#endif
        unsigned long                   flags;
 #define BR_SET_MAC_ADDR         0x00000001
@@ -197,9 +201,11 @@ extern int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd, void __us
 #ifdef CONFIG_BRIDGE_NETFILTER
 extern int br_netfilter_init(void);
 extern void br_netfilter_fini(void);
+extern void br_netfilter_rtable_init(struct net_bridge *);
 #else
 #define br_netfilter_init()     (0)
 #define br_netfilter_fini()     do { } while(0)
+#define br_netfilter_rtable_init(x)
 #endif
 /* br_stp.c */
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index 921bbe5cb94a..6e63ec3f1fcf 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -368,14 +368,25 @@ static void br_make_blocking(struct net_bridge_port *p)
 /* called under bridge lock */
 static void br_make_forwarding(struct net_bridge_port *p)
 {
-        if (p->state == BR_STATE_BLOCKING) {
+        struct net_bridge *br = p->br;
-                if (p->br->stp_enabled == BR_KERNEL_STP)
-                        p->state = BR_STATE_LISTENING;
-                else
-                        p->state = BR_STATE_LEARNING;
-                br_log_state(p);
+        if (p->state != BR_STATE_BLOCKING)
-                mod_timer(&p->forward_delay_timer, jiffies + p->br->forward_delay);     }
+                return;
+        if (br->forward_delay == 0) {
+                p->state = BR_STATE_FORWARDING;
+                br_topology_change_detection(br);
+                del_timer(&p->forward_delay_timer);
+        }
+        else if (p->br->stp_enabled == BR_KERNEL_STP)
+                p->state = BR_STATE_LISTENING;
+        else
+                p->state = BR_STATE_LEARNING;
+        br_log_state(p);
+        if (br->forward_delay != 0)
+                mod_timer(&p->forward_delay_timer, jiffies + br->forward_delay);
 }
 /* called under bridge lock */
diff --git a/net/core/dev.c b/net/core/dev.c
index 8d13a9b9f1df..600bb23c4c2e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1796,7 +1796,7 @@ gso:
        skb->tc_verd = SET_TC_AT(skb->tc_verd,AT_EGRESS);
 #endif
        if (q->enqueue) {
-                spinlock_t *root_lock = qdisc_root_lock(q);
+                spinlock_t *root_lock = qdisc_lock(q);
                spin_lock(root_lock);
@@ -1805,7 +1805,6 @@ gso:
                spin_unlock(root_lock);
-                rc = rc == NET_XMIT_BYPASS ? NET_XMIT_SUCCESS : rc;
                goto out;
        }
@@ -1909,7 +1908,6 @@ int netif_rx(struct sk_buff *skb)
        if (queue->input_pkt_queue.qlen <= netdev_max_backlog) {
                if (queue->input_pkt_queue.qlen) {
 enqueue:
-                        dev_hold(skb->dev);
                        __skb_queue_tail(&queue->input_pkt_queue, skb);
                        local_irq_restore(flags);
                        return NET_RX_SUCCESS;
@@ -1941,22 +1939,6 @@ int netif_rx_ni(struct sk_buff *skb)
 EXPORT_SYMBOL(netif_rx_ni);
-static inline struct net_device *skb_bond(struct sk_buff *skb)
-{
-        struct net_device *dev = skb->dev;
-        if (dev->master) {
-                if (skb_bond_should_drop(skb)) {
-                        kfree_skb(skb);
-                        return NULL;
-                }
-                skb->dev = dev->master;
-        }
-        return dev;
-}
 static void net_tx_action(struct softirq_action *h)
 {
        struct softnet_data *sd = &__get_cpu_var(softnet_data);
@@ -1995,7 +1977,7 @@ static void net_tx_action(struct softirq_action *h)
                        smp_mb__before_clear_bit();
                        clear_bit(__QDISC_STATE_SCHED, &q->state);
-                        root_lock = qdisc_root_lock(q);
+                        root_lock = qdisc_lock(q);
                        if (spin_trylock(root_lock)) {
                                qdisc_run(q);
                                spin_unlock(root_lock);
@@ -2100,7 +2082,7 @@ static int ing_filter(struct sk_buff *skb)
        rxq = &dev->rx_queue;
        q = rxq->qdisc;
-        if (q) {
+        if (q != &noop_qdisc) {
                spin_lock(qdisc_lock(q));
                result = qdisc_enqueue_root(skb, q);
                spin_unlock(qdisc_lock(q));
@@ -2113,7 +2095,7 @@ static inline struct sk_buff *handle_ing(struct sk_buff *skb,
                                         struct packet_type **pt_prev,
                                         int *ret, struct net_device *orig_dev)
 {
-        if (!skb->dev->rx_queue.qdisc)
+        if (skb->dev->rx_queue.qdisc == &noop_qdisc)
                goto out;
        if (*pt_prev) {
@@ -2183,6 +2165,7 @@ int netif_receive_skb(struct sk_buff *skb)
 {
        struct packet_type *ptype, *pt_prev;
        struct net_device *orig_dev;
+        struct net_device *null_or_orig;
        int ret = NET_RX_DROP;
        __be16 type;
@@ -2196,10 +2179,14 @@ int netif_receive_skb(struct sk_buff *skb)
        if (!skb->iif)
                skb->iif = skb->dev->ifindex;
-        orig_dev = skb_bond(skb);
+        null_or_orig = NULL;
+        orig_dev = skb->dev;
-        if (!orig_dev)
+        if (orig_dev->master) {
-                return NET_RX_DROP;
+                if (skb_bond_should_drop(skb))
+                        null_or_orig = orig_dev; /* deliver only exact match */
+                else
+                        skb->dev = orig_dev->master;
+        }
        __get_cpu_var(netdev_rx_stat).total++;
@@ -2223,7 +2210,8 @@ int netif_receive_skb(struct sk_buff *skb)
 #endif
        list_for_each_entry_rcu(ptype, &ptype_all, list) {
-                if (!ptype->dev || ptype->dev == skb->dev) {
+                if (ptype->dev == null_or_orig || ptype->dev == skb->dev ||
+                    ptype->dev == orig_dev) {
                        if (pt_prev)
                                ret = deliver_skb(skb, pt_prev, orig_dev);
                        pt_prev = ptype;
@@ -2248,7 +2236,8 @@ ncls:
        list_for_each_entry_rcu(ptype,
                        &ptype_base[ntohs(type) & PTYPE_HASH_MASK], list) {
                if (ptype->type == type &&
-                    (!ptype->dev || ptype->dev == skb->dev)) {
+                    (ptype->dev == null_or_orig || ptype->dev == skb->dev ||
+                     ptype->dev == orig_dev)) {
                        if (pt_prev)
                                ret = deliver_skb(skb, pt_prev, orig_dev);
                        pt_prev = ptype;
@@ -2270,6 +2259,20 @@ out:
        return ret;
 }
+/* Network device is going away, flush any packets still pending  */
+static void flush_backlog(void *arg)
+{
+        struct net_device *dev = arg;
+        struct softnet_data *queue = &__get_cpu_var(softnet_data);
+        struct sk_buff *skb, *tmp;
+        skb_queue_walk_safe(&queue->input_pkt_queue, skb, tmp)
+                if (skb->dev == dev) {
+                        __skb_unlink(skb, &queue->input_pkt_queue);
+                        kfree_skb(skb);
+                }
+}
 static int process_backlog(struct napi_struct *napi, int quota)
 {
        int work = 0;
@@ -2279,7 +2282,6 @@ static int process_backlog(struct napi_struct *napi, int quota)
        napi->weight = weight_p;
        do {
                struct sk_buff *skb;
-                struct net_device *dev;
                local_irq_disable();
                skb = __skb_dequeue(&queue->input_pkt_queue);
@@ -2288,14 +2290,9 @@ static int process_backlog(struct napi_struct *napi, int quota)
                        local_irq_enable();
                        break;
                }
                local_irq_enable();
-                dev = skb->dev;
                netif_receive_skb(skb);
-                dev_put(dev);
        } while (++work < quota && jiffies == start_time);
        return work;
@@ -3988,6 +3985,10 @@ int register_netdevice(struct net_device *dev)
                }
        }
+        /* Enable software GSO if SG is supported. */
+        if (dev->features & NETIF_F_SG)
+                dev->features |= NETIF_F_GSO;
        netdev_initialize_kobject(dev);
        ret = netdev_register_kobject(dev);
        if (ret)
@@ -4165,6 +4166,8 @@ void netdev_run_todo(void)
                dev->reg_state = NETREG_UNREGISTERED;
+                on_each_cpu(flush_backlog, dev, 1);
                netdev_wait_allrefs(dev);
                /* paranoia */
@@ -4200,6 +4203,7 @@ static void netdev_init_queues(struct net_device *dev)
 {
        netdev_init_one_queue(dev, &dev->rx_queue, NULL);
        netdev_for_each_tx_queue(dev, netdev_init_one_queue, NULL);
+        spin_lock_init(&dev->tx_global_lock);
 }
 /**
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index f62c8af85d38..9d92e41826e7 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2281,6 +2281,7 @@ static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
        struct neighbour *n = neigh_get_first(seq);
        if (n) {
+                --(*pos);
                while (*pos) {
                        n = neigh_get_next(seq, n, pos);
                        if (!n)
@@ -2341,6 +2342,7 @@ static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
        struct pneigh_entry *pn = pneigh_get_first(seq);
        if (pn) {
+                --(*pos);
                while (*pos) {
                        pn = pneigh_get_next(seq, pn, pos);
                        if (!pn)
@@ -2354,10 +2356,11 @@ static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
 {
        struct neigh_seq_state *state = seq->private;
        void *rc;
+        loff_t idxpos = *pos;
-        rc = neigh_get_idx(seq, pos);
+        rc = neigh_get_idx(seq, &idxpos);
        if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
-                rc = pneigh_get_idx(seq, pos);
+                rc = pneigh_get_idx(seq, &idxpos);
        return rc;
 }
@@ -2366,7 +2369,6 @@ void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl
        __acquires(tbl->lock)
 {
        struct neigh_seq_state *state = seq->private;
-        loff_t pos_minus_one;
        state->tbl = tbl;
        state->bucket = 0;
@@ -2374,8 +2376,7 @@ void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl
        read_lock_bh(&tbl->lock);
-        pos_minus_one = *pos - 1;
+        return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
-        return *pos ? neigh_get_idx_any(seq, &pos_minus_one) : SEQ_START_TOKEN;
 }
 EXPORT_SYMBOL(neigh_seq_start);
@@ -2385,7 +2386,7 @@ void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
        void *rc;
        if (v == SEQ_START_TOKEN) {
-                rc = neigh_get_idx(seq, pos);
+                rc = neigh_get_first(seq);
                goto out;
        }
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index c12720895ecf..6c7af390be0a 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -70,6 +70,7 @@ static void queue_process(struct work_struct *work)
                local_irq_save(flags);
                __netif_tx_lock(txq, smp_processor_id());
                if (netif_tx_queue_stopped(txq) ||
+                    netif_tx_queue_frozen(txq) ||
                    dev->hard_start_xmit(skb, dev) != NETDEV_TX_OK) {
                        skb_queue_head(&npinfo->txq, skb);
                        __netif_tx_unlock(txq);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index c7d484f7e1c4..526236453908 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -168,7 +168,7 @@
 #include <asm/div64.h>          /* do_div */
 #include <asm/timex.h>
-#define VERSION  "pktgen v2.69: Packet Generator for packet performance testing.\n"
+#define VERSION  "pktgen v2.70: Packet Generator for packet performance testing.\n"
 #define IP_NAME_SZ 32
 #define MAX_MPLS_LABELS 16 /* This is the max label stack depth */
@@ -189,6 +189,7 @@
 #define F_FLOW_SEQ    (1<<11)   /* Sequential flows */
 #define F_IPSEC_ON    (1<<12)   /* ipsec on for flows */
 #define F_QUEUE_MAP_RND (1<<13) /* queue map Random */
+#define F_QUEUE_MAP_CPU (1<<14) /* queue map mirrors smp_processor_id() */
 /* Thread control flag bits */
 #define T_TERMINATE   (1<<0)
@@ -621,6 +622,9 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
        if (pkt_dev->flags & F_QUEUE_MAP_RND)
                seq_printf(seq,  "QUEUE_MAP_RND  ");
+        if (pkt_dev->flags & F_QUEUE_MAP_CPU)
+                seq_printf(seq,  "QUEUE_MAP_CPU  ");
        if (pkt_dev->cflows) {
                if (pkt_dev->flags & F_FLOW_SEQ)
                        seq_printf(seq,  "FLOW_SEQ  "); /*in sequence flows*/
@@ -1134,6 +1138,12 @@ static ssize_t pktgen_if_write(struct file *file,
                else if (strcmp(f, "!QUEUE_MAP_RND") == 0)
                        pkt_dev->flags &= ~F_QUEUE_MAP_RND;
+                else if (strcmp(f, "QUEUE_MAP_CPU") == 0)
+                        pkt_dev->flags |= F_QUEUE_MAP_CPU;
+                else if (strcmp(f, "!QUEUE_MAP_CPU") == 0)
+                        pkt_dev->flags &= ~F_QUEUE_MAP_CPU;
 #ifdef CONFIG_XFRM
                else if (strcmp(f, "IPSEC") == 0)
                        pkt_dev->flags |= F_IPSEC_ON;
@@ -1895,6 +1905,23 @@ static int pktgen_device_event(struct notifier_block *unused,
        return NOTIFY_DONE;
 }
+static struct net_device *pktgen_dev_get_by_name(struct pktgen_dev *pkt_dev, const char *ifname)
+{
+        char b[IFNAMSIZ+5];
+        int i = 0;
+        for(i=0; ifname[i] != '@'; i++) {
+                if(i == IFNAMSIZ)
+                        break;
+                b[i] = ifname[i];
+        }
+        b[i] = 0;
+        return dev_get_by_name(&init_net, b);
+}
 /* Associate pktgen_dev with a device. */
 static int pktgen_setup_dev(struct pktgen_dev *pkt_dev, const char *ifname)
@@ -1908,7 +1935,7 @@ static int pktgen_setup_dev(struct pktgen_dev *pkt_dev, const char *ifname)
                pkt_dev->odev = NULL;
        }
-        odev = dev_get_by_name(&init_net, ifname);
+        odev = pktgen_dev_get_by_name(pkt_dev, ifname);
        if (!odev) {
                printk(KERN_ERR "pktgen: no such netdevice: \"%s\"\n", ifname);
                return -ENODEV;
@@ -2085,15 +2112,19 @@ static inline int f_pick(struct pktgen_dev *pkt_dev)
                if (pkt_dev->flows[flow].count >= pkt_dev->lflow) {
                        /* reset time */
                        pkt_dev->flows[flow].count = 0;
+                        pkt_dev->flows[flow].flags = 0;
                        pkt_dev->curfl += 1;
                        if (pkt_dev->curfl >= pkt_dev->cflows)
                                pkt_dev->curfl = 0; /*reset */
                }
        } else {
                flow = random32() % pkt_dev->cflows;
+                pkt_dev->curfl = flow;
-                if (pkt_dev->flows[flow].count > pkt_dev->lflow)
+                if (pkt_dev->flows[flow].count > pkt_dev->lflow) {
                        pkt_dev->flows[flow].count = 0;
+                        pkt_dev->flows[flow].flags = 0;
+                }
        }
        return pkt_dev->curfl;
@@ -2125,7 +2156,11 @@ static void get_ipsec_sa(struct pktgen_dev *pkt_dev, int flow)
 #endif
 static void set_cur_queue_map(struct pktgen_dev *pkt_dev)
 {
-        if (pkt_dev->queue_map_min < pkt_dev->queue_map_max) {
+        if (pkt_dev->flags & F_QUEUE_MAP_CPU)
+                pkt_dev->cur_queue_map = smp_processor_id();
+        else if (pkt_dev->queue_map_min < pkt_dev->queue_map_max) {
                __u16 t;
                if (pkt_dev->flags & F_QUEUE_MAP_RND) {
                        t = random32() %
@@ -2162,7 +2197,7 @@ static void mod_cur_headers(struct pktgen_dev *pkt_dev)
                        mc = random32() % pkt_dev->src_mac_count;
                else {
                        mc = pkt_dev->cur_src_mac_offset++;
-                        if (pkt_dev->cur_src_mac_offset >
+                        if (pkt_dev->cur_src_mac_offset >=
                            pkt_dev->src_mac_count)
                                pkt_dev->cur_src_mac_offset = 0;
                }
@@ -2189,7 +2224,7 @@ static void mod_cur_headers(struct pktgen_dev *pkt_dev)
                else {
                        mc = pkt_dev->cur_dst_mac_offset++;
-                        if (pkt_dev->cur_dst_mac_offset >
+                        if (pkt_dev->cur_dst_mac_offset >=
                            pkt_dev->dst_mac_count) {
                                pkt_dev->cur_dst_mac_offset = 0;
                        }
@@ -3305,6 +3340,7 @@ static __inline__ void pktgen_xmit(struct pktgen_dev *pkt_dev)
        txq = netdev_get_tx_queue(odev, queue_map);
        if (netif_tx_queue_stopped(txq) ||
+            netif_tx_queue_frozen(txq) ||
            need_resched()) {
                idle_start = getCurUs();
@@ -3320,7 +3356,8 @@ static __inline__ void pktgen_xmit(struct pktgen_dev *pkt_dev)
                pkt_dev->idle_acc += getCurUs() - idle_start;
-                if (netif_tx_queue_stopped(txq)) {
+                if (netif_tx_queue_stopped(txq) ||
+                    netif_tx_queue_frozen(txq)) {
                        pkt_dev->next_tx_us = getCurUs();       /* TODO */
                        pkt_dev->next_tx_ns = 0;
                        goto out;       /* Try the next interface */
@@ -3352,7 +3389,8 @@ static __inline__ void pktgen_xmit(struct pktgen_dev *pkt_dev)
        txq = netdev_get_tx_queue(odev, queue_map);
        __netif_tx_lock_bh(txq);
-        if (!netif_tx_queue_stopped(txq)) {
+        if (!netif_tx_queue_stopped(txq) &&
+            !netif_tx_queue_frozen(txq)) {
                atomic_inc(&(pkt_dev->skb->users));
              retry_now:
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 4e0c92274189..84640172d65d 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -485,6 +485,9 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
        C(head);
        C(data);
        C(truesize);
+#if defined(CONFIG_MAC80211) || defined(CONFIG_MAC80211_MODULE)
+        C(do_not_encrypt);
+#endif
        atomic_set(&n->users, 1);
        atomic_inc(&(skb_shinfo(skb)->dataref));
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index 1c2e3ec2eb57..b4bc6e095a0e 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -229,7 +229,8 @@ extern void dccp_v4_send_check(struct sock *sk, int len, struct sk_buff *skb);
 extern int  dccp_retransmit_skb(struct sock *sk);
 extern void dccp_send_ack(struct sock *sk);
-extern void dccp_reqsk_send_ack(struct sk_buff *sk, struct request_sock *rsk);
+extern void dccp_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
+                                struct request_sock *rsk);
 extern void dccp_send_sync(struct sock *sk, const u64 seq,
                           const enum dccp_pkt_type pkt_type);
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index 66dca5bba858..b2804e2d1b8c 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -296,7 +296,8 @@ int dccp_child_process(struct sock *parent, struct sock *child,
 EXPORT_SYMBOL_GPL(dccp_child_process);
-void dccp_reqsk_send_ack(struct sk_buff *skb, struct request_sock *rsk)
+void dccp_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
+                         struct request_sock *rsk)
 {
        DCCP_BUG("DCCP-ACK packets are never sent in LISTEN/RESPOND state");
 }
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 4e73e5708e70..21515d4c49eb 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -575,7 +575,7 @@ static int esp_init_state(struct xfrm_state *x)
                              crypto_aead_ivsize(aead);
        if (x->props.mode == XFRM_MODE_TUNNEL)
                x->props.header_len += sizeof(struct iphdr);
-        else if (x->props.mode == XFRM_MODE_BEET)
+        else if (x->props.mode == XFRM_MODE_BEET && x->sel.family != AF_INET6)
                x->props.header_len += IPV4_BEET_PHMAXLEN;
        if (x->encap) {
                struct xfrm_encap_tmpl *encap = x->encap;
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 1819ad7ab910..fafe8ebb4c55 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -475,11 +475,10 @@ static void arp_print(struct arp_payload *payload)
 #define HBUFFERLEN 30
        char hbuffer[HBUFFERLEN];
        int j,k;
-        const char hexbuf[]= "0123456789abcdef";
        for (k=0, j=0; k < HBUFFERLEN-3 && j < ETH_ALEN; j++) {
-                hbuffer[k++]=hexbuf[(payload->src_hw[j]>>4)&15];
+                hbuffer[k++] = hex_asc_hi(payload->src_hw[j]);
-                hbuffer[k++]=hexbuf[payload->src_hw[j]&15];
+                hbuffer[k++] = hex_asc_lo(payload->src_hw[j]);
                hbuffer[k++]=':';
        }
        hbuffer[--k]='\0';
diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index 21cb053f5d7d..3974d7cae5c0 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -305,10 +305,10 @@ static void recent_mt_destroy(const struct xt_match *match, void *matchinfo)
                spin_lock_bh(&recent_lock);
                list_del(&t->list);
                spin_unlock_bh(&recent_lock);
-                recent_table_flush(t);
 #ifdef CONFIG_PROC_FS
                remove_proc_entry(t->name, proc_dir);
 #endif
+                recent_table_flush(t);
                kfree(t);
        }
        mutex_unlock(&recent_mutex);
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 834356ea99df..8f5a403f6f6b 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -232,6 +232,8 @@ static const struct snmp_mib snmp4_net_list[] = {
        SNMP_MIB_ITEM("TCPDSACKIgnoredOld", LINUX_MIB_TCPDSACKIGNOREDOLD),
        SNMP_MIB_ITEM("TCPDSACKIgnoredNoUndo", LINUX_MIB_TCPDSACKIGNOREDNOUNDO),
        SNMP_MIB_ITEM("TCPSpuriousRTOs", LINUX_MIB_TCPSPURIOUSRTOS),
+        SNMP_MIB_ITEM("TCPMD5NotFound", LINUX_MIB_TCPMD5NOTFOUND),
+        SNMP_MIB_ITEM("TCPMD5Unexpected", LINUX_MIB_TCPMD5UNEXPECTED),
        SNMP_MIB_SENTINEL
 };
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 380d6474cf66..16fc6f454a31 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1509,14 +1509,14 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
                                        /* BSD 4.2 compatibility hack :-( */
                                        if (mtu == 0 &&
-                                            old_mtu >= dst_metric(&rth->u.dst, RTAX_MTU) &&
+                                            old_mtu >= dst_mtu(&rth->u.dst) &&
                                            old_mtu >= 68 + (iph->ihl << 2))
                                                old_mtu -= iph->ihl << 2;
                                        mtu = guess_mtu(old_mtu);
                                }
-                                if (mtu <= dst_metric(&rth->u.dst, RTAX_MTU)) {
+                                if (mtu <= dst_mtu(&rth->u.dst)) {
-                                        if (mtu < dst_metric(&rth->u.dst, RTAX_MTU)) {
+                                        if (mtu < dst_mtu(&rth->u.dst)) {
                                                dst_confirm(&rth->u.dst);
                                                if (mtu < ip_rt_min_pmtu) {
                                                        mtu = ip_rt_min_pmtu;
@@ -1538,7 +1538,7 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
 static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
-        if (dst_metric(dst, RTAX_MTU) > mtu && mtu >= 68 &&
+        if (dst_mtu(dst) > mtu && mtu >= 68 &&
            !(dst_metric_locked(dst, RTAX_MTU))) {
                if (mtu < ip_rt_min_pmtu) {
                        mtu = ip_rt_min_pmtu;
@@ -1667,7 +1667,7 @@ static void rt_set_nexthop(struct rtable *rt, struct fib_result *res, u32 itag)
        if (dst_metric(&rt->u.dst, RTAX_HOPLIMIT) == 0)
                rt->u.dst.metrics[RTAX_HOPLIMIT-1] = sysctl_ip_default_ttl;
-        if (dst_metric(&rt->u.dst, RTAX_MTU) > IP_MAX_MTU)
+        if (dst_mtu(&rt->u.dst) > IP_MAX_MTU)
                rt->u.dst.metrics[RTAX_MTU-1] = IP_MAX_MTU;
        if (dst_metric(&rt->u.dst, RTAX_ADVMSS) == 0)
                rt->u.dst.metrics[RTAX_ADVMSS-1] = max_t(unsigned int, rt->u.dst.dev->mtu - 40,
@@ -3216,6 +3216,7 @@ int __init ip_rt_init(void)
        return rc;
 }
+#ifdef CONFIG_SYSCTL
 /*
 * We really need to sanitize the damn ipv4 init order, then all
 * this nonsense will go away.
@@ -3224,6 +3225,7 @@ void __init ip_static_sysctl_init(void)
 {
        register_sysctl_paths(ipv4_route_path, ipv4_route_table);
 }
+#endif
 EXPORT_SYMBOL(__ip_select_ident);
 EXPORT_SYMBOL(ip_route_input);
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 770d827f5ab8..e0689fd7b798 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -232,6 +232,7 @@ static struct ctl_table ipv4_table[] = {
                .mode           = 0644,
                .proc_handler   = &ipv4_doint_and_flush,
                .strategy       = &ipv4_doint_and_flush_strategy,
+                .extra2         = &init_net,
        },
        {
                .ctl_name       = NET_IPV4_NO_PMTU_DISC,
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a2b06d0cc26b..44c1e934824b 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -655,8 +655,8 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
                rep.th.doff = arg.iov[0].iov_len/4;
                tcp_v4_md5_hash_hdr((__u8 *) &rep.opt[offset],
-                                    key, ip_hdr(skb)->daddr,
+                                    key, ip_hdr(skb)->saddr,
-                                    ip_hdr(skb)->saddr, &rep.th);
+                                    ip_hdr(skb)->daddr, &rep.th);
        }
 #endif
        arg.csum = csum_tcpudp_nofold(ip_hdr(skb)->daddr,
@@ -687,14 +687,14 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
        inet_twsk_put(tw);
 }
-static void tcp_v4_reqsk_send_ack(struct sk_buff *skb,
+static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
                                  struct request_sock *req)
 {
        tcp_v4_send_ack(skb, tcp_rsk(req)->snt_isn + 1,
                        tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd,
                        req->ts_recent,
                        0,
-                        tcp_v4_md5_do_lookup(skb->sk, ip_hdr(skb)->daddr));
+                        tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->daddr));
 }
 /*
@@ -1116,18 +1116,12 @@ static int tcp_v4_inbound_md5_hash(struct sock *sk, struct sk_buff *skb)
                return 0;
        if (hash_expected && !hash_location) {
-                LIMIT_NETDEBUG(KERN_INFO "MD5 Hash expected but NOT found "
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
-                               "(" NIPQUAD_FMT ", %d)->(" NIPQUAD_FMT ", %d)\n",
-                               NIPQUAD(iph->saddr), ntohs(th->source),
-                               NIPQUAD(iph->daddr), ntohs(th->dest));
                return 1;
        }
        if (!hash_expected && hash_location) {
-                LIMIT_NETDEBUG(KERN_INFO "MD5 Hash NOT expected but found "
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
-                               "(" NIPQUAD_FMT ", %d)->(" NIPQUAD_FMT ", %d)\n",
-                               NIPQUAD(iph->saddr), ntohs(th->source),
-                               NIPQUAD(iph->daddr), ntohs(th->dest));
                return 1;
        }
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 204c42162660..f976fc57892c 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -609,7 +609,7 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
                                          tcp_rsk(req)->rcv_isn + 1, tcp_rsk(req)->rcv_isn + 1 + req->rcv_wnd)) {
                /* Out of window: send ACK and drop. */
                if (!(flg & TCP_FLAG_RST))
-                        req->rsk_ops->send_ack(skb, req);
+                        req->rsk_ops->send_ack(sk, skb, req);
                if (paws_reject)
                        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
                return NULL;
@@ -618,89 +618,87 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
        /* In sequence, PAWS is OK. */
        if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_isn + 1))
-                        req->ts_recent = tmp_opt.rcv_tsval;
+                req->ts_recent = tmp_opt.rcv_tsval;
-                if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
+        if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
-                        /* Truncate SYN, it is out of window starting
+                /* Truncate SYN, it is out of window starting
-                           at tcp_rsk(req)->rcv_isn + 1. */
+                   at tcp_rsk(req)->rcv_isn + 1. */
-                        flg &= ~TCP_FLAG_SYN;
+                flg &= ~TCP_FLAG_SYN;
-                }
+        }
-                /* RFC793: "second check the RST bit" and
+        /* RFC793: "second check the RST bit" and
-                 *         "fourth, check the SYN bit"
+         *         "fourth, check the SYN bit"
-                 */
+         */
-                if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN)) {
+        if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN)) {
-                        TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_ATTEMPTFAILS);
+                TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_ATTEMPTFAILS);
-                        goto embryonic_reset;
+                goto embryonic_reset;
-                }
+        }
-                /* ACK sequence verified above, just make sure ACK is
+        /* ACK sequence verified above, just make sure ACK is
-                 * set.  If ACK not set, just silently drop the packet.
+         * set.  If ACK not set, just silently drop the packet.
-                 */
+         */
-                if (!(flg & TCP_FLAG_ACK))
+        if (!(flg & TCP_FLAG_ACK))
-                        return NULL;
+                return NULL;
-                /* If TCP_DEFER_ACCEPT is set, drop bare ACK. */
-                if (inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
-                    TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
-                        inet_rsk(req)->acked = 1;
-                        return NULL;
-                }
-                /* OK, ACK is valid, create big socket and
+        /* If TCP_DEFER_ACCEPT is set, drop bare ACK. */
-                 * feed this segment to it. It will repeat all
+        if (inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
-                 * the tests. THIS SEGMENT MUST MOVE SOCKET TO
+            TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
-                 * ESTABLISHED STATE. If it will be dropped after
+                inet_rsk(req)->acked = 1;
-                 * socket is created, wait for troubles.
+                return NULL;
-                 */
+        }
-                child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb,
-                                                                 req, NULL);
+        /* OK, ACK is valid, create big socket and
-                if (child == NULL)
+         * feed this segment to it. It will repeat all
-                        goto listen_overflow;
+         * the tests. THIS SEGMENT MUST MOVE SOCKET TO
+         * ESTABLISHED STATE. If it will be dropped after
+         * socket is created, wait for troubles.
+         */
+        child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL);
+        if (child == NULL)
+                goto listen_overflow;
 #ifdef CONFIG_TCP_MD5SIG
-                else {
+        else {
-                        /* Copy over the MD5 key from the original socket */
+                /* Copy over the MD5 key from the original socket */
-                        struct tcp_md5sig_key *key;
+                struct tcp_md5sig_key *key;
-                        struct tcp_sock *tp = tcp_sk(sk);
+                struct tcp_sock *tp = tcp_sk(sk);
-                        key = tp->af_specific->md5_lookup(sk, child);
+                key = tp->af_specific->md5_lookup(sk, child);
-                        if (key != NULL) {
+                if (key != NULL) {
-                                /*
+                        /*
-                                 * We're using one, so create a matching key on the
+                         * We're using one, so create a matching key on the
-                                 * newsk structure. If we fail to get memory then we
+                         * newsk structure. If we fail to get memory then we
-                                 * end up not copying the key across. Shucks.
+                         * end up not copying the key across. Shucks.
-                                 */
+                         */
-                                char *newkey = kmemdup(key->key, key->keylen,
+                        char *newkey = kmemdup(key->key, key->keylen,
-                                                       GFP_ATOMIC);
+                                               GFP_ATOMIC);
-                                if (newkey) {
+                        if (newkey) {
-                                        if (!tcp_alloc_md5sig_pool())
+                                if (!tcp_alloc_md5sig_pool())
-                                                BUG();
+                                        BUG();
-                                        tp->af_specific->md5_add(child, child,
+                                tp->af_specific->md5_add(child, child, newkey,
-                                                                 newkey,
+                                                         key->keylen);
-                                                                 key->keylen);
-                                }
                        }
                }
+        }
 #endif
-                inet_csk_reqsk_queue_unlink(sk, req, prev);
+        inet_csk_reqsk_queue_unlink(sk, req, prev);
-                inet_csk_reqsk_queue_removed(sk, req);
+        inet_csk_reqsk_queue_removed(sk, req);
-                inet_csk_reqsk_queue_add(sk, req, child);
+        inet_csk_reqsk_queue_add(sk, req, child);
-                return child;
+        return child;
-        listen_overflow:
+listen_overflow:
-                if (!sysctl_tcp_abort_on_overflow) {
+        if (!sysctl_tcp_abort_on_overflow) {
-                        inet_rsk(req)->acked = 1;
+                inet_rsk(req)->acked = 1;
-                        return NULL;
+                return NULL;
-                }
+        }
-        embryonic_reset:
+embryonic_reset:
-                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
-                if (!(flg & TCP_FLAG_RST))
+        if (!(flg & TCP_FLAG_RST))
-                        req->rsk_ops->send_reset(sk, skb);
+                req->rsk_ops->send_reset(sk, skb);
-                inet_csk_reqsk_queue_drop(sk, req, prev);
+        inet_csk_reqsk_queue_drop(sk, req, prev);
-                return NULL;
+        return NULL;
 }
 /*
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index 9c798abce736..63418185f524 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -47,8 +47,10 @@ static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb)
        if (unlikely(optlen))
                hdrlen += IPV4_BEET_PHMAXLEN - (optlen & 4);
-        skb_set_network_header(skb, IPV4_BEET_PHMAXLEN - x->props.header_len -
+        skb_set_network_header(skb, -x->props.header_len -
-                                    hdrlen);
+                                    hdrlen + (XFRM_MODE_SKB_CB(skb)->ihl - sizeof(*top_iph)));
+        if (x->sel.family != AF_INET6)
+                skb->network_header += IPV4_BEET_PHMAXLEN;
        skb->mac_header = skb->network_header +
                          offsetof(struct iphdr, protocol);
        skb->transport_header = skb->network_header + sizeof(*top_iph);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index f7b535dec860..410046a8cc91 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -732,7 +732,7 @@ int datagram_send_ctl(struct net *net,
                        LIMIT_NETDEBUG(KERN_DEBUG "invalid cmsg type: %d\n",
                                       cmsg->cmsg_type);
                        err = -EINVAL;
-                        break;
+                        goto exit_f;
                }
        }
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index c6bb4c6d24b3..b181b08fb761 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -521,6 +521,10 @@ static int esp6_init_state(struct xfrm_state *x)
                              crypto_aead_ivsize(aead);
        switch (x->props.mode) {
        case XFRM_MODE_BEET:
+                if (x->sel.family != AF_INET6)
+                        x->props.header_len += IPV4_BEET_PHMAXLEN +
+                                               (sizeof(struct ipv6hdr) - sizeof(struct iphdr));
+                break;
        case XFRM_MODE_TRANSPORT:
                break;
        case XFRM_MODE_TUNNEL:
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 6811901e6b1e..a4402de425d9 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -236,6 +236,10 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
        skb_reset_network_header(skb);
        hdr = ipv6_hdr(skb);
+        /* Allow local fragmentation. */
+        if (ipfragok)
+                skb->local_df = 1;
        /*
         *      Fill in the IPv6 header
         */
@@ -265,7 +269,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
        skb->mark = sk->sk_mark;
        mtu = dst_mtu(dst);
-        if ((skb->len <= mtu) || ipfragok || skb_is_gso(skb)) {
+        if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
                IP6_INC_STATS(ip6_dst_idev(skb->dst),
                              IPSTATS_MIB_OUTREQUESTS);
                return NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index ea33b26512c2..741cfcd96f88 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -346,6 +346,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 */
                if (optlen == 0)
                        optval = NULL;
+                else if (optval == NULL)
+                        goto e_inval;
                else if (optlen < sizeof(struct ipv6_opt_hdr) ||
                         optlen & 0x7 || optlen > 8 * 255)
                        goto e_inval;
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index f82f6074cf85..0179b66864f1 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -286,7 +286,6 @@ proc_net_fail:
 void ipv6_misc_proc_exit(void)
 {
-        proc_net_remove(&init_net, "sockstat6");
        proc_net_remove(&init_net, "dev_snmp6");
        proc_net_remove(&init_net, "snmp6");
        unregister_pernet_subsys(&ipv6_proc_ops);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 86540b24b27c..5a3e87e4b18f 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1249,7 +1249,7 @@ install_route:
        if (dst_metric(&rt->u.dst, RTAX_HOPLIMIT) == 0)
                rt->u.dst.metrics[RTAX_HOPLIMIT-1] = -1;
-        if (!dst_metric(&rt->u.dst, RTAX_MTU))
+        if (!dst_mtu(&rt->u.dst))
                rt->u.dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(dev);
        if (!dst_metric(&rt->u.dst, RTAX_ADVMSS))
                rt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(net, dst_mtu(&rt->u.dst));
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index a46badd1082d..ec394cf5a19b 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -199,10 +199,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
        ireq6 = inet6_rsk(req);
        treq = tcp_rsk(req);
-        if (security_inet_conn_request(sk, skb, req)) {
+        if (security_inet_conn_request(sk, skb, req))
-                reqsk_free(req);
+                goto out_free;
-                goto out;
-        }
        req->mss = mss;
        ireq->rmt_port = th->source;
@@ -255,14 +253,13 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                fl.fl_ip_dport = inet_rsk(req)->rmt_port;
                fl.fl_ip_sport = inet_sk(sk)->sport;
                security_req_classify_flow(req, &fl);
-                if (ip6_dst_lookup(sk, &dst, &fl)) {
+                if (ip6_dst_lookup(sk, &dst, &fl))
-                        reqsk_free(req);
+                        goto out_free;
-                        goto out;
-                }
                if (final_p)
                        ipv6_addr_copy(&fl.fl6_dst, final_p);
                if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
-                        goto out;
+                        goto out_free;
        }
        req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
@@ -273,7 +270,10 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
        ireq->rcv_wscale = rcv_wscale;
        ret = get_cookie_sock(sk, skb, req, dst);
+out:
-out:    return ret;
+        return ret;
+out_free:
+        reqsk_free(req);
+        return NULL;
 }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index cff778b23a7f..5b90b369ccb2 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -69,7 +69,8 @@
 #include <linux/scatterlist.h>
 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
-static void     tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req);
+static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
+                                      struct request_sock *req);
 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
@@ -748,7 +749,7 @@ static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
        ipv6_addr_copy(&bp->saddr, saddr);
        ipv6_addr_copy(&bp->daddr, daddr);
        bp->protocol = cpu_to_be32(IPPROTO_TCP);
-        bp->len = cpu_to_be16(nbytes);
+        bp->len = cpu_to_be32(nbytes);
        sg_init_one(&sg, bp, sizeof(*bp));
        return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
@@ -849,28 +850,17 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
        hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
        hash_location = tcp_parse_md5sig_option(th);
-        /* do we have a hash as expected? */
+        /* We've parsed the options - do we have a hash? */
-        if (!hash_expected) {
+        if (!hash_expected && !hash_location)
-                if (!hash_location)
+                return 0;
-                        return 0;
-                if (net_ratelimit()) {
+        if (hash_expected && !hash_location) {
-                        printk(KERN_INFO "MD5 Hash NOT expected but found "
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
-                               "(" NIP6_FMT ", %u)->"
-                               "(" NIP6_FMT ", %u)\n",
-                               NIP6(ip6h->saddr), ntohs(th->source),
-                               NIP6(ip6h->daddr), ntohs(th->dest));
-                }
                return 1;
        }
-        if (!hash_location) {
+        if (!hash_expected && hash_location) {
-                if (net_ratelimit()) {
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
-                        printk(KERN_INFO "MD5 Hash expected but NOT found "
-                               "(" NIP6_FMT ", %u)->"
-                               "(" NIP6_FMT ", %u)\n",
-                               NIP6(ip6h->saddr), ntohs(th->source),
-                               NIP6(ip6h->daddr), ntohs(th->dest));
-                }
                return 1;
        }
@@ -1105,8 +1095,8 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
                *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
                                (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
                tcp_v6_md5_hash_hdr((__u8 *)topt, key,
-                                    &ipv6_hdr(skb)->daddr,
+                                    &ipv6_hdr(skb)->saddr,
-                                    &ipv6_hdr(skb)->saddr, t1);
+                                    &ipv6_hdr(skb)->daddr, t1);
        }
 #endif
@@ -1149,10 +1139,11 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
        inet_twsk_put(tw);
 }
-static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
+static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
+                                  struct request_sock *req)
 {
        tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
-                        tcp_v6_md5_do_lookup(skb->sk, &ipv6_hdr(skb)->daddr));
+                        tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr));
 }
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
index d6ce400f585f..bbd48b101bae 100644
--- a/net/ipv6/xfrm6_mode_beet.c
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -40,16 +40,39 @@ static void xfrm6_beet_make_header(struct sk_buff *skb)
 static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 {
        struct ipv6hdr *top_iph;
+        struct ip_beet_phdr *ph;
-        skb_set_network_header(skb, -x->props.header_len);
+        struct iphdr *iphv4;
+        int optlen, hdr_len;
+        iphv4 = ip_hdr(skb);
+        hdr_len = 0;
+        optlen = XFRM_MODE_SKB_CB(skb)->optlen;
+        if (unlikely(optlen))
+                hdr_len += IPV4_BEET_PHMAXLEN - (optlen & 4);
+        skb_set_network_header(skb, -x->props.header_len - hdr_len);
+        if (x->sel.family != AF_INET6)
+                skb->network_header += IPV4_BEET_PHMAXLEN;
        skb->mac_header = skb->network_header +
                          offsetof(struct ipv6hdr, nexthdr);
        skb->transport_header = skb->network_header + sizeof(*top_iph);
-        __skb_pull(skb, XFRM_MODE_SKB_CB(skb)->ihl);
+        ph = (struct ip_beet_phdr *)__skb_pull(skb, XFRM_MODE_SKB_CB(skb)->ihl-hdr_len);
        xfrm6_beet_make_header(skb);
        top_iph = ipv6_hdr(skb);
+        if (unlikely(optlen)) {
+                BUG_ON(optlen < 0);
+                ph->padlen = 4 - (optlen & 4);
+                ph->hdrlen = optlen / 8;
+                ph->nexthdr = top_iph->nexthdr;
+                if (ph->padlen)
+                        memset(ph + 1, IPOPT_NOP, ph->padlen);
+                top_iph->nexthdr = IPPROTO_BEETPH;
+        }
        ipv6_addr_copy(&top_iph->saddr, (struct in6_addr *)&x->props.saddr);
        ipv6_addr_copy(&top_iph->daddr, (struct in6_addr *)&x->id.daddr);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 8e7ba0e62cf5..297c257864c7 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -81,6 +81,7 @@ static int ieee80211_change_iface(struct wiphy *wiphy, int ifindex,
                                  enum nl80211_iftype type, u32 *flags,
                                  struct vif_params *params)
 {
+        struct ieee80211_local *local = wiphy_priv(wiphy);
        struct net_device *dev;
        enum ieee80211_if_types itype;
        struct ieee80211_sub_if_data *sdata;
@@ -95,6 +96,9 @@ static int ieee80211_change_iface(struct wiphy *wiphy, int ifindex,
        if (itype == IEEE80211_IF_TYPE_INVALID)
                return -EINVAL;
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        ret = ieee80211_if_change_type(sdata, itype);
@@ -117,12 +121,16 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                             u8 key_idx, u8 *mac_addr,
                             struct key_params *params)
 {
+        struct ieee80211_local *local = wiphy_priv(wiphy);
        struct ieee80211_sub_if_data *sdata;
        struct sta_info *sta = NULL;
        enum ieee80211_key_alg alg;
        struct ieee80211_key *key;
        int err;
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        switch (params->cipher) {
@@ -167,10 +175,14 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
                             u8 key_idx, u8 *mac_addr)
 {
+        struct ieee80211_local *local = wiphy_priv(wiphy);
        struct ieee80211_sub_if_data *sdata;
        struct sta_info *sta;
        int ret;
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        rcu_read_lock();
@@ -211,7 +223,8 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
                             void (*callback)(void *cookie,
                                              struct key_params *params))
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata;
        struct sta_info *sta = NULL;
        u8 seq[6] = {0};
        struct key_params params;
@@ -220,6 +233,11 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
        u16 iv16;
        int err = -ENOENT;
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        rcu_read_lock();
        if (mac_addr) {
@@ -293,8 +311,12 @@ static int ieee80211_config_default_key(struct wiphy *wiphy,
                                        struct net_device *dev,
                                        u8 key_idx)
 {
+        struct ieee80211_local *local = wiphy_priv(wiphy);
        struct ieee80211_sub_if_data *sdata;
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
        rcu_read_lock();
        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -475,9 +497,15 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
 static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
                                struct beacon_parameters *params)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata;
        struct beacon_data *old;
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        if (sdata->vif.type != IEEE80211_IF_TYPE_AP)
                return -EINVAL;
@@ -492,9 +520,15 @@ static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_set_beacon(struct wiphy *wiphy, struct net_device *dev,
                                struct beacon_parameters *params)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata;
        struct beacon_data *old;
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        if (sdata->vif.type != IEEE80211_IF_TYPE_AP)
                return -EINVAL;
@@ -508,9 +542,15 @@ static int ieee80211_set_beacon(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata;
        struct beacon_data *old;
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        if (sdata->vif.type != IEEE80211_IF_TYPE_AP)
                return -EINVAL;
@@ -646,11 +686,14 @@ static void sta_apply_parameters(struct ieee80211_local *local,
 static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
                                 u8 *mac, struct station_parameters *params)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
        struct sta_info *sta;
        struct ieee80211_sub_if_data *sdata;
        int err;
+        if (dev == local->mdev || params->vlan == local->mdev)
+                return -EOPNOTSUPP;
        /* Prevent a race with changing the rate control algorithm */
        if (!netif_running(dev))
                return -ENETDOWN;
@@ -701,10 +744,15 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
                                 u8 *mac)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
-        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_sub_if_data *sdata;
        struct sta_info *sta;
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        if (mac) {
                rcu_read_lock();
@@ -730,10 +778,13 @@ static int ieee80211_change_station(struct wiphy *wiphy,
                                    u8 *mac,
                                    struct station_parameters *params)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
        struct sta_info *sta;
        struct ieee80211_sub_if_data *vlansdata;
+        if (dev == local->mdev || params->vlan == local->mdev)
+                return -EOPNOTSUPP;
        rcu_read_lock();
        /* XXX: get sta belonging to dev */
@@ -752,7 +803,7 @@ static int ieee80211_change_station(struct wiphy *wiphy,
                        return -EINVAL;
                }
-                sta->sdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
+                sta->sdata = vlansdata;
                ieee80211_send_layer2_update(sta);
        }
@@ -767,15 +818,20 @@ static int ieee80211_change_station(struct wiphy *wiphy,
 static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
                                 u8 *dst, u8 *next_hop)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_sub_if_data *sdata;
        struct mesh_path *mpath;
        struct sta_info *sta;
        int err;
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
        if (!netif_running(dev))
                return -ENETDOWN;
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        if (sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)
                return -ENOTSUPP;
@@ -817,14 +873,19 @@ static int ieee80211_change_mpath(struct wiphy *wiphy,
                                    struct net_device *dev,
                                    u8 *dst, u8 *next_hop)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_sub_if_data *sdata;
        struct mesh_path *mpath;
        struct sta_info *sta;
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
        if (!netif_running(dev))
                return -ENETDOWN;
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        if (sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)
                return -ENOTSUPP;
@@ -891,9 +952,15 @@ static int ieee80211_get_mpath(struct wiphy *wiphy, struct net_device *dev,
                               u8 *dst, u8 *next_hop, struct mpath_info *pinfo)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata;
        struct mesh_path *mpath;
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        if (sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)
                return -ENOTSUPP;
@@ -913,9 +980,15 @@ static int ieee80211_dump_mpath(struct wiphy *wiphy, struct net_device *dev,
                                 int idx, u8 *dst, u8 *next_hop,
                                 struct mpath_info *pinfo)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata;
        struct mesh_path *mpath;
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        if (sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)
                return -ENOTSUPP;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index a4f9a832722a..ec59345af65b 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -82,6 +82,7 @@ struct ieee80211_sta_bss {
        u8 bssid[ETH_ALEN];
        u8 ssid[IEEE80211_MAX_SSID_LEN];
+        u8 dtim_period;
        u16 capability; /* host byte order */
        enum ieee80211_band band;
        int freq;
@@ -586,6 +587,7 @@ struct ieee80211_local {
        struct timer_list sta_cleanup;
        unsigned long queues_pending[BITS_TO_LONGS(IEEE80211_MAX_QUEUES)];
+        unsigned long queues_pending_run[BITS_TO_LONGS(IEEE80211_MAX_QUEUES)];
        struct ieee80211_tx_stored_packet pending_packet[IEEE80211_MAX_QUEUES];
        struct tasklet_struct tx_pending_tasklet;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index f1a83d450ea0..aa5a191598c9 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -245,10 +245,13 @@ static int ieee80211_open(struct net_device *dev)
        case IEEE80211_IF_TYPE_AP:
                sdata->bss = &sdata->u.ap;
                break;
+        case IEEE80211_IF_TYPE_MESH_POINT:
+                /* mesh ifaces must set allmulti to forward mcast traffic */
+                atomic_inc(&local->iff_allmultis);
+                break;
        case IEEE80211_IF_TYPE_STA:
        case IEEE80211_IF_TYPE_MNTR:
        case IEEE80211_IF_TYPE_IBSS:
-        case IEEE80211_IF_TYPE_MESH_POINT:
                /* no special treatment */
                break;
        case IEEE80211_IF_TYPE_INVALID:
@@ -495,6 +498,9 @@ static int ieee80211_stop(struct net_device *dev)
                netif_addr_unlock_bh(local->mdev);
                break;
        case IEEE80211_IF_TYPE_MESH_POINT:
+                /* allmulti is always set on mesh ifaces */
+                atomic_dec(&local->iff_allmultis);
+                /* fall through */
        case IEEE80211_IF_TYPE_STA:
        case IEEE80211_IF_TYPE_IBSS:
                sdata->u.sta.state = IEEE80211_DISABLED;
@@ -1233,18 +1239,12 @@ static void ieee80211_tasklet_handler(unsigned long data)
 /* Remove added headers (e.g., QoS control), encryption header/MIC, etc. to
 * make a prepared TX frame (one that has been given to hw) to look like brand
 * new IEEE 802.11 frame that is ready to go through TX processing again.
- * Also, tx_packet_data in cb is restored from tx_control. */
+ */
 static void ieee80211_remove_tx_extra(struct ieee80211_local *local,
                                      struct ieee80211_key *key,
                                      struct sk_buff *skb)
 {
        int hdrlen, iv_len, mic_len;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        info->flags &=  IEEE80211_TX_CTL_REQ_TX_STATUS |
-                        IEEE80211_TX_CTL_DO_NOT_ENCRYPT |
-                        IEEE80211_TX_CTL_REQUEUE |
-                        IEEE80211_TX_CTL_EAPOL_FRAME;
        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
@@ -1695,6 +1695,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        if (local->hw.conf.beacon_int < 10)
                local->hw.conf.beacon_int = 100;
+        if (local->hw.max_listen_interval == 0)
+                local->hw.max_listen_interval = 1;
+        local->hw.conf.listen_interval = local->hw.max_listen_interval;
        local->wstats_flags |= local->hw.flags & (IEEE80211_HW_SIGNAL_UNSPEC |
                                                  IEEE80211_HW_SIGNAL_DB |
                                                  IEEE80211_HW_SIGNAL_DBM) ?
@@ -1731,8 +1736,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        result = ieee80211_wep_init(local);
        if (result < 0) {
-                printk(KERN_DEBUG "%s: Failed to initialize wep\n",
+                printk(KERN_DEBUG "%s: Failed to initialize wep: %d\n",
-                       wiphy_name(local->hw.wiphy));
+                       wiphy_name(local->hw.wiphy), result);
                goto fail_wep;
        }
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 669eafafe497..7495fbb0d211 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -214,8 +214,7 @@ void ieee80211s_stop(void);
 void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata);
 /* Mesh paths */
-int mesh_nexthop_lookup(u8 *next_hop, struct sk_buff *skb,
+int mesh_nexthop_lookup(struct sk_buff *skb, struct net_device *dev);
-                struct net_device *dev);
 void mesh_path_start_discovery(struct net_device *dev);
 struct mesh_path *mesh_path_lookup(u8 *dst, struct net_device *dev);
 struct mesh_path *mesh_path_lookup_by_idx(int idx, struct net_device *dev);
@@ -286,6 +285,4 @@ static inline void mesh_path_activate(struct mesh_path *mpath)
 #define mesh_allocated  0
 #endif
-#define MESH_PREQ(skb)  (skb->cb + 30)
 #endif /* IEEE80211S_H */
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 7fa149e230e6..08aca446ca01 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -758,29 +758,30 @@ enddiscovery:
 /**
 * ieee80211s_lookup_nexthop - put the appropriate next hop on a mesh frame
 *
- * @next_hop: output argument for next hop address
+ * @skb: 802.11 frame to be sent
- * @skb: frame to be sent
 * @dev: network device the frame will be sent through
+ * @fwd_frame: true if this frame was originally from a different host
 *
 * Returns: 0 if the next hop was found. Nonzero otherwise. If no next hop is
 * found, the function will start a path discovery and queue the frame so it is
 * sent when the path is resolved. This means the caller must not free the skb
 * in this case.
 */
-int mesh_nexthop_lookup(u8 *next_hop, struct sk_buff *skb,
+int mesh_nexthop_lookup(struct sk_buff *skb, struct net_device *dev)
-                struct net_device *dev)
 {
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        struct sk_buff *skb_to_free = NULL;
        struct mesh_path *mpath;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        u8 *dst_addr = hdr->addr3;
        int err = 0;
        rcu_read_lock();
-        mpath = mesh_path_lookup(skb->data, dev);
+        mpath = mesh_path_lookup(dst_addr, dev);
        if (!mpath) {
-                mesh_path_add(skb->data, dev);
+                mesh_path_add(dst_addr, dev);
-                mpath = mesh_path_lookup(skb->data, dev);
+                mpath = mesh_path_lookup(dst_addr, dev);
                if (!mpath) {
                        dev_kfree_skb(skb);
                        sdata->u.sta.mshstats.dropped_frames_no_route++;
@@ -792,13 +793,13 @@ int mesh_nexthop_lookup(u8 *next_hop, struct sk_buff *skb,
        if (mpath->flags & MESH_PATH_ACTIVE) {
                if (time_after(jiffies, mpath->exp_time -
                        msecs_to_jiffies(sdata->u.sta.mshcfg.path_refresh_time))
-                                && skb->pkt_type != PACKET_OTHERHOST
+                                && !memcmp(dev->dev_addr, hdr->addr4, ETH_ALEN)
                                && !(mpath->flags & MESH_PATH_RESOLVING)
                                && !(mpath->flags & MESH_PATH_FIXED)) {
                        mesh_queue_preq(mpath,
                                        PREQ_Q_F_START | PREQ_Q_F_REFRESH);
                }
-                memcpy(next_hop, mpath->next_hop->addr,
+                memcpy(hdr->addr1, mpath->next_hop->addr,
                                ETH_ALEN);
        } else {
                if (!(mpath->flags & MESH_PATH_RESOLVING)) {
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 5f88a2e6ee50..838ee60492ad 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -388,18 +388,15 @@ void mesh_path_tx_pending(struct mesh_path *mpath)
 void mesh_path_discard_frame(struct sk_buff *skb, struct net_device *dev)
 {
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
        struct mesh_path *mpath;
        u32 dsn = 0;
-        if (skb->pkt_type == PACKET_OTHERHOST) {
+        if (memcmp(hdr->addr4, dev->dev_addr, ETH_ALEN) != 0) {
-                struct ieee80211s_hdr *prev_meshhdr;
-                int mshhdrlen;
                u8 *ra, *da;
-                prev_meshhdr = ((struct ieee80211s_hdr *)skb->cb);
+                da = hdr->addr3;
-                mshhdrlen = ieee80211_get_mesh_hdrlen(prev_meshhdr);
+                ra = hdr->addr2;
-                da = skb->data;
-                ra = MESH_PREQ(skb);
                mpath = mesh_path_lookup(da, dev);
                if (mpath)
                        dsn = ++mpath->dsn;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index d7c371e36bf0..e1d11c9b6729 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -551,6 +551,7 @@ static void ieee80211_set_associated(struct net_device *dev,
                        /* set timing information */
                        sdata->bss_conf.beacon_int = bss->beacon_int;
                        sdata->bss_conf.timestamp = bss->timestamp;
+                        sdata->bss_conf.dtim_period = bss->dtim_period;
                        changed |= ieee80211_handle_bss_capability(sdata, bss);
@@ -606,7 +607,6 @@ void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
                      int encrypt)
 {
        struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_tx_info *info;
        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        skb->dev = sdata->local->mdev;
@@ -614,11 +614,8 @@ void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
        skb_set_network_header(skb, 0);
        skb_set_transport_header(skb, 0);
-        info = IEEE80211_SKB_CB(skb);
+        skb->iif = sdata->dev->ifindex;
-        memset(info, 0, sizeof(struct ieee80211_tx_info));
+        skb->do_not_encrypt = !encrypt;
-        info->control.ifindex = sdata->dev->ifindex;
-        if (!encrypt)
-                info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
        dev_queue_xmit(skb);
 }
@@ -777,7 +774,8 @@ static void ieee80211_send_assoc(struct net_device *dev,
                mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
                                                   IEEE80211_STYPE_REASSOC_REQ);
                mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
-                mgmt->u.reassoc_req.listen_interval = cpu_to_le16(1);
+                mgmt->u.reassoc_req.listen_interval =
+                                cpu_to_le16(local->hw.conf.listen_interval);
                memcpy(mgmt->u.reassoc_req.current_ap, ifsta->prev_bssid,
                       ETH_ALEN);
        } else {
@@ -785,7 +783,8 @@ static void ieee80211_send_assoc(struct net_device *dev,
                mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
                                                   IEEE80211_STYPE_ASSOC_REQ);
                mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
-                mgmt->u.assoc_req.listen_interval = cpu_to_le16(1);
+                mgmt->u.reassoc_req.listen_interval =
+                                cpu_to_le16(local->hw.conf.listen_interval);
        }
        /* SSID */
@@ -2692,6 +2691,16 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
        bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
        bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
+        if (elems->tim) {
+                struct ieee80211_tim_ie *tim_ie =
+                        (struct ieee80211_tim_ie *)elems->tim;
+                bss->dtim_period = tim_ie->dtim_period;
+        }
+        /* set default value for buggy APs */
+        if (!elems->tim || bss->dtim_period == 0)
+                bss->dtim_period = 1;
        bss->supp_rates_len = 0;
        if (elems->supp_rates) {
                clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
@@ -3303,6 +3312,7 @@ void ieee80211_start_mesh(struct net_device *dev)
        ifsta = &sdata->u.sta;
        ifsta->state = IEEE80211_MESH_UP;
        ieee80211_sta_timer((unsigned long)sdata);
+        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
 }
 #endif
@@ -3653,11 +3663,21 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
                       "%s\n", print_mac(mac, bssid),
                       print_mac(mac2, ifsta->bssid));
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
-        if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
-            (bss = ieee80211_rx_bss_get(dev, bssid,
+        if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
-                                        local->hw.conf.channel->center_freq,
-                                        ifsta->ssid, ifsta->ssid_len))) {
                int ret;
+                int search_freq;
+                if (ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL)
+                        search_freq = bss->freq;
+                else
+                        search_freq = local->hw.conf.channel->center_freq;
+                bss = ieee80211_rx_bss_get(dev, bssid, search_freq,
+                                           ifsta->ssid, ifsta->ssid_len);
+                if (!bss)
+                        goto dont_join;
                printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
                       " based on configured SSID\n",
                       dev->name, print_mac(mac, bssid));
@@ -3665,6 +3685,8 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
                ieee80211_rx_bss_put(local, bss);
                return ret;
        }
+dont_join:
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
        printk(KERN_DEBUG "   did not try to join ibss\n");
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
@@ -3898,7 +3920,7 @@ done:
        if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
                struct ieee80211_if_sta *ifsta = &sdata->u.sta;
                if (!(ifsta->flags & IEEE80211_STA_BSSID_SET) ||
-                    (!ifsta->state == IEEE80211_IBSS_JOINED &&
+                    (!(ifsta->state == IEEE80211_IBSS_JOINED) &&
                    !ieee80211_sta_active_ibss(dev)))
                        ieee80211_sta_find_ibss(dev, ifsta);
        }
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 6d9ae67c27ca..6db854505193 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1109,20 +1109,9 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
        hdrlen = ieee80211_get_hdrlen(fc);
-        if (ieee80211_vif_is_mesh(&sdata->vif)) {
+        if (ieee80211_vif_is_mesh(&sdata->vif))
-                int meshhdrlen = ieee80211_get_mesh_hdrlen(
+                hdrlen += ieee80211_get_mesh_hdrlen(
                                (struct ieee80211s_hdr *) (skb->data + hdrlen));
-                /* Copy on cb:
-                 *  - mesh header: to be used for mesh forwarding
-                 * decision. It will also be used as mesh header template at
-                 * tx.c:ieee80211_subif_start_xmit() if interface
-                 * type is mesh and skb->pkt_type == PACKET_OTHERHOST
-                 *  - ta: to be used if a RERR needs to be sent.
-                 */
-                memcpy(skb->cb, skb->data + hdrlen, meshhdrlen);
-                memcpy(MESH_PREQ(skb), hdr->addr2, ETH_ALEN);
-                hdrlen += meshhdrlen;
-        }
        /* convert IEEE 802.11 header + possible LLC headers into Ethernet
         * header
@@ -1269,38 +1258,6 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
                }
        }
-        /* Mesh forwarding */
-        if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                u8 *mesh_ttl = &((struct ieee80211s_hdr *)skb->cb)->ttl;
-                (*mesh_ttl)--;
-                if (is_multicast_ether_addr(skb->data)) {
-                        if (*mesh_ttl > 0) {
-                                xmit_skb = skb_copy(skb, GFP_ATOMIC);
-                                if (xmit_skb)
-                                        xmit_skb->pkt_type = PACKET_OTHERHOST;
-                                else if (net_ratelimit())
-                                        printk(KERN_DEBUG "%s: failed to clone "
-                                               "multicast frame\n", dev->name);
-                        } else
-                                IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.sta,
-                                                             dropped_frames_ttl);
-                } else if (skb->pkt_type != PACKET_OTHERHOST &&
-                        compare_ether_addr(dev->dev_addr, skb->data) != 0) {
-                        if (*mesh_ttl == 0) {
-                                IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.sta,
-                                                             dropped_frames_ttl);
-                                dev_kfree_skb(skb);
-                                skb = NULL;
-                        } else {
-                                xmit_skb = skb;
-                                xmit_skb->pkt_type = PACKET_OTHERHOST;
-                                if (!(dev->flags & IFF_PROMISC))
-                                        skb  = NULL;
-                        }
-                }
-        }
        if (skb) {
                /* deliver to local stack */
                skb->protocol = eth_type_trans(skb, dev);
@@ -1431,6 +1388,63 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
 }
 static ieee80211_rx_result debug_noinline
+ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+{
+        struct ieee80211_hdr *hdr;
+        struct ieee80211s_hdr *mesh_hdr;
+        unsigned int hdrlen;
+        struct sk_buff *skb = rx->skb, *fwd_skb;
+        hdr = (struct ieee80211_hdr *) skb->data;
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
+        mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+        if (!ieee80211_is_data(hdr->frame_control))
+                return RX_CONTINUE;
+        if (!mesh_hdr->ttl)
+                /* illegal frame */
+                return RX_DROP_MONITOR;
+        if (compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
+                return RX_CONTINUE;
+        mesh_hdr->ttl--;
+        if (rx->flags & IEEE80211_RX_RA_MATCH) {
+                if (!mesh_hdr->ttl)
+                        IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.sta,
+                                                     dropped_frames_ttl);
+                else {
+                        struct ieee80211_hdr *fwd_hdr;
+                        fwd_skb = skb_copy(skb, GFP_ATOMIC);
+                        if (!fwd_skb && net_ratelimit())
+                                printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
+                                                   rx->dev->name);
+                        fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
+                        /*
+                         * Save TA to addr1 to send TA a path error if a
+                         * suitable next hop is not found
+                         */
+                        memcpy(fwd_hdr->addr1, fwd_hdr->addr2, ETH_ALEN);
+                        memcpy(fwd_hdr->addr2, rx->dev->dev_addr, ETH_ALEN);
+                        fwd_skb->dev = rx->local->mdev;
+                        fwd_skb->iif = rx->dev->ifindex;
+                        dev_queue_xmit(fwd_skb);
+                }
+        }
+        if (is_multicast_ether_addr(hdr->addr3) ||
+            rx->dev->flags & IFF_PROMISC)
+                return RX_CONTINUE;
+        else
+                return RX_DROP_MONITOR;
+}
+static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
 {
        struct net_device *dev = rx->dev;
@@ -1663,10 +1677,12 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
        rx->sdata = sdata;
        rx->dev = sdata->dev;
-#define CALL_RXH(rxh)           \
+#define CALL_RXH(rxh)                   \
-        res = rxh(rx);          \
+        do {                            \
-        if (res != RX_CONTINUE) \
+                res = rxh(rx);          \
-                goto rxh_done;
+                if (res != RX_CONTINUE) \
+                        goto rxh_done;  \
+        } while (0);
        CALL_RXH(ieee80211_rx_h_passive_scan)
        CALL_RXH(ieee80211_rx_h_check)
@@ -1678,6 +1694,8 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
        /* must be after MMIC verify so header is counted in MPDU mic */
        CALL_RXH(ieee80211_rx_h_remove_qos_control)
        CALL_RXH(ieee80211_rx_h_amsdu)
+        if (ieee80211_vif_is_mesh(&sdata->vif))
+                CALL_RXH(ieee80211_rx_h_mesh_fwding);
        CALL_RXH(ieee80211_rx_h_data)
        CALL_RXH(ieee80211_rx_h_ctrl)
        CALL_RXH(ieee80211_rx_h_mgmt)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 0fbadd8b983c..4788f7b91f49 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -305,7 +305,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
        rcu_read_unlock();
        local->total_ps_buffered = total;
-#ifdef MAC80211_VERBOSE_PS_DEBUG
+#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
        printk(KERN_DEBUG "%s: PS buffers full - purged %d frames\n",
               wiphy_name(local->hw.wiphy), purged);
 #endif
@@ -342,7 +342,7 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
                        purge_old_ps_buffers(tx->local);
                if (skb_queue_len(&tx->sdata->bss->ps_bc_buf) >=
                    AP_MAX_BC_BUFFER) {
-#ifdef MAC80211_VERBOSE_PS_DEBUG
+#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                        if (net_ratelimit()) {
                                printk(KERN_DEBUG "%s: BC TX buffer full - "
                                       "dropping the oldest frame\n",
@@ -389,7 +389,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                        purge_old_ps_buffers(tx->local);
                if (skb_queue_len(&sta->ps_tx_buf) >= STA_MAX_TX_BUFFER) {
                        struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf);
-#ifdef MAC80211_VERBOSE_PS_DEBUG
+#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                        if (net_ratelimit()) {
                                printk(KERN_DEBUG "%s: STA %s TX "
                                       "buffer full - dropping oldest frame\n",
@@ -439,14 +439,14 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
        u16 fc = tx->fc;
-        if (unlikely(info->flags & IEEE80211_TX_CTL_DO_NOT_ENCRYPT))
+        if (unlikely(tx->skb->do_not_encrypt))
                tx->key = NULL;
        else if (tx->sta && (key = rcu_dereference(tx->sta->key)))
                tx->key = key;
        else if ((key = rcu_dereference(tx->sdata->default_key)))
                tx->key = key;
        else if (tx->sdata->drop_unencrypted &&
-                 !(info->flags & IEEE80211_TX_CTL_EAPOL_FRAME) &&
+                 (tx->skb->protocol != cpu_to_be16(ETH_P_PAE)) &&
                 !(info->flags & IEEE80211_TX_CTL_INJECTED)) {
                I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
                return TX_DROP;
@@ -476,7 +476,7 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
        }
        if (!tx->key || !(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
-                info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
+                tx->skb->do_not_encrypt = 1;
        return TX_CONTINUE;
 }
@@ -732,6 +732,7 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
                memcpy(skb_put(frag, copylen), pos, copylen);
                memcpy(frag->cb, first->cb, sizeof(frag->cb));
                skb_copy_queue_mapping(frag, first);
+                frag->do_not_encrypt = first->do_not_encrypt;
                pos += copylen;
                left -= copylen;
@@ -852,7 +853,7 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
        sband = tx->local->hw.wiphy->bands[tx->channel->band];
-        info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
+        skb->do_not_encrypt = 1;
        info->flags |= IEEE80211_TX_CTL_INJECTED;
        tx->flags &= ~IEEE80211_TX_FRAGMENTED;
@@ -925,8 +926,7 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                                skb_trim(skb, skb->len - FCS_LEN);
                        }
                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
-                                info->flags &=
+                                tx->skb->do_not_encrypt = 0;
-                                        ~IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
                                tx->flags |= IEEE80211_TX_FRAGMENTED;
                        break;
@@ -1042,10 +1042,9 @@ static int ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
                                struct sk_buff *skb,
                                struct net_device *mdev)
 {
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
        struct net_device *dev;
-        dev = dev_get_by_index(&init_net, info->control.ifindex);
+        dev = dev_get_by_index(&init_net, skb->iif);
        if (unlikely(dev && !is_ieee80211_device(dev, mdev))) {
                dev_put(dev);
                dev = NULL;
@@ -1061,13 +1060,14 @@ static int ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
 static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
                          struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_tx_info *info;
        int ret, i;
-        if (netif_subqueue_stopped(local->mdev, skb))
-                return IEEE80211_TX_AGAIN;
        if (skb) {
+                if (netif_subqueue_stopped(local->mdev, skb))
+                        return IEEE80211_TX_AGAIN;
+                info =  IEEE80211_SKB_CB(skb);
                ieee80211_dump_frame(wiphy_name(local->hw.wiphy),
                                     "TX to low-level driver", skb);
                ret = local->ops->tx(local_to_hw(local), skb);
@@ -1216,6 +1216,7 @@ retry:
                if (ret == IEEE80211_TX_FRAG_AGAIN)
                        skb = NULL;
                set_bit(queue, local->queues_pending);
                smp_mb();
                /*
@@ -1300,14 +1301,15 @@ int ieee80211_master_start_xmit(struct sk_buff *skb,
                                struct net_device *dev)
 {
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
        struct net_device *odev = NULL;
        struct ieee80211_sub_if_data *osdata;
        int headroom;
        bool may_encrypt;
        int ret;
-        if (info->control.ifindex)
+        if (skb->iif)
-                odev = dev_get_by_index(&init_net, info->control.ifindex);
+                odev = dev_get_by_index(&init_net, skb->iif);
        if (unlikely(odev && !is_ieee80211_device(odev, dev))) {
                dev_put(odev);
                odev = NULL;
@@ -1321,9 +1323,27 @@ int ieee80211_master_start_xmit(struct sk_buff *skb,
                return 0;
        }
+        memset(info, 0, sizeof(*info));
+        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
        osdata = IEEE80211_DEV_TO_SUB_IF(odev);
-        may_encrypt = !(info->flags & IEEE80211_TX_CTL_DO_NOT_ENCRYPT);
+        if (ieee80211_vif_is_mesh(&osdata->vif) &&
+            ieee80211_is_data(hdr->frame_control)) {
+                if (ieee80211_is_data(hdr->frame_control)) {
+                        if (is_multicast_ether_addr(hdr->addr3))
+                                memcpy(hdr->addr1, hdr->addr3, ETH_ALEN);
+                        else
+                                if (mesh_nexthop_lookup(skb, odev))
+                                        return  0;
+                        if (memcmp(odev->dev_addr, hdr->addr4, ETH_ALEN) != 0)
+                                IEEE80211_IFSTA_MESH_CTR_INC(&osdata->u.sta,
+                                                             fwded_frames);
+                }
+        }
+        may_encrypt = !skb->do_not_encrypt;
        headroom = osdata->local->tx_headroom;
        if (may_encrypt)
@@ -1348,7 +1368,6 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb,
                                 struct net_device *dev)
 {
        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
        struct ieee80211_radiotap_header *prthdr =
                (struct ieee80211_radiotap_header *)skb->data;
        u16 len_rthdr;
@@ -1371,11 +1390,11 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb,
        skb->dev = local->mdev;
        /* needed because we set skb device to master */
-        info->control.ifindex = dev->ifindex;
+        skb->iif = dev->ifindex;
-        info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
+        /* sometimes we do encrypt injected frames, will be fixed
-        /* Interfaces should always request a status report */
+         * up in radiotap parser if not wanted */
-        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
+        skb->do_not_encrypt = 0;
        /*
         * fix up the pointers accounting for the radiotap
@@ -1419,7 +1438,6 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                               struct net_device *dev)
 {
        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_tx_info *info;
        struct ieee80211_sub_if_data *sdata;
        int ret = 1, head_need;
        u16 ethertype, hdrlen,  meshhdrlen = 0;
@@ -1469,30 +1487,17 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
        case IEEE80211_IF_TYPE_MESH_POINT:
                fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                /* RA TA DA SA */
-                if (is_multicast_ether_addr(skb->data))
+                memset(hdr.addr1, 0, ETH_ALEN);
-                        memcpy(hdr.addr1, skb->data, ETH_ALEN);
-                else if (mesh_nexthop_lookup(hdr.addr1, skb, dev))
-                                return 0;
                memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
                memcpy(hdr.addr3, skb->data, ETH_ALEN);
                memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
-                if (skb->pkt_type == PACKET_OTHERHOST) {
+                if (!sdata->u.sta.mshcfg.dot11MeshTTL) {
-                        /* Forwarded frame, keep mesh ttl and seqnum */
+                        /* Do not send frames with mesh_ttl == 0 */
-                        struct ieee80211s_hdr *prev_meshhdr;
+                        sdata->u.sta.mshstats.dropped_frames_ttl++;
-                        prev_meshhdr = ((struct ieee80211s_hdr *)skb->cb);
+                        ret = 0;
-                        meshhdrlen = ieee80211_get_mesh_hdrlen(prev_meshhdr);
+                        goto fail;
-                        memcpy(&mesh_hdr, prev_meshhdr, meshhdrlen);
-                        sdata->u.sta.mshstats.fwded_frames++;
-                } else {
-                        if (!sdata->u.sta.mshcfg.dot11MeshTTL) {
-                                /* Do not send frames with mesh_ttl == 0 */
-                                sdata->u.sta.mshstats.dropped_frames_ttl++;
-                                ret = 0;
-                                goto fail;
-                        }
-                        meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr,
-                                                               sdata);
                }
+                meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr, sdata);
                hdrlen = 30;
                break;
 #endif
@@ -1540,7 +1545,8 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         * Drop unicast frames to unauthorised stations unless they are
         * EAPOL frames from the local station.
         */
-        if (unlikely(!is_multicast_ether_addr(hdr.addr1) &&
+        if (!ieee80211_vif_is_mesh(&sdata->vif) &&
+                unlikely(!is_multicast_ether_addr(hdr.addr1) &&
                      !(sta_flags & WLAN_STA_AUTHORIZED) &&
                      !(ethertype == ETH_P_PAE &&
                       compare_ether_addr(dev->dev_addr,
@@ -1645,14 +1651,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
        nh_pos += hdrlen;
        h_pos += hdrlen;
-        info = IEEE80211_SKB_CB(skb);
+        skb->iif = dev->ifindex;
-        memset(info, 0, sizeof(*info));
-        info->control.ifindex = dev->ifindex;
-        if (ethertype == ETH_P_PAE)
-                info->flags |= IEEE80211_TX_CTL_EAPOL_FRAME;
-        /* Interfaces should always request a status report */
-        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
        skb->dev = local->mdev;
        dev->stats.tx_packets++;
@@ -1714,14 +1713,19 @@ void ieee80211_tx_pending(unsigned long data)
        netif_tx_lock_bh(dev);
        for (i = 0; i < ieee80211_num_regular_queues(&local->hw); i++) {
                /* Check that this queue is ok */
-                if (__netif_subqueue_stopped(local->mdev, i))
+                if (__netif_subqueue_stopped(local->mdev, i) &&
+                    !test_bit(i, local->queues_pending_run))
                        continue;
                if (!test_bit(i, local->queues_pending)) {
+                        clear_bit(i, local->queues_pending_run);
                        ieee80211_wake_queue(&local->hw, i);
                        continue;
                }
+                clear_bit(i, local->queues_pending_run);
+                netif_start_subqueue(local->mdev, i);
                store = &local->pending_packet[i];
                tx.extra_frag = store->extra_frag;
                tx.num_extra_frag = store->num_extra_frag;
@@ -1922,6 +1926,8 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
        info = IEEE80211_SKB_CB(skb);
+        skb->do_not_encrypt = 1;
        info->band = band;
        rate_control_get_rate(local->mdev, sband, skb, &rsel);
@@ -1931,7 +1937,7 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                               "no rate found\n",
                               wiphy_name(local->hw.wiphy));
                }
-                dev_kfree_skb(skb);
+                dev_kfree_skb_any(skb);
                skb = NULL;
                goto out;
        }
@@ -1940,7 +1946,6 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
        info->tx_rate_idx = rsel.rate_idx;
        info->flags |= IEEE80211_TX_CTL_NO_ACK;
-        info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
        info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
        info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
        if (sdata->bss_conf.use_short_preamble &&
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 19f85e1b3695..0d463c80c404 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -361,6 +361,7 @@ void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue)
        struct ieee80211_local *local = hw_to_local(hw);
        if (test_bit(queue, local->queues_pending)) {
+                set_bit(queue, local->queues_pending_run);
                tasklet_schedule(&local->tx_pending_tasklet);
        } else {
                netif_wake_subqueue(local->mdev, queue);
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index 872d2fcd1a5b..5c2bf0a3d4db 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -31,13 +31,13 @@ int ieee80211_wep_init(struct ieee80211_local *local)
        local->wep_tx_tfm = crypto_alloc_blkcipher("ecb(arc4)", 0,
                                                CRYPTO_ALG_ASYNC);
        if (IS_ERR(local->wep_tx_tfm))
-                return -ENOMEM;
+                return PTR_ERR(local->wep_tx_tfm);
        local->wep_rx_tfm = crypto_alloc_blkcipher("ecb(arc4)", 0,
                                                CRYPTO_ALG_ASYNC);
        if (IS_ERR(local->wep_rx_tfm)) {
                crypto_free_blkcipher(local->wep_tx_tfm);
-                return -ENOMEM;
+                return PTR_ERR(local->wep_rx_tfm);
        }
        return 0;
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 07edda0b8a5c..4310e2f65661 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -188,6 +188,9 @@ int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
 {
        int i;
+        /* XXX: currently broken due to cb/requeue use */
+        return -EPERM;
        /* prepare the filter and save it for the SW queue
         * matching the received HW queue */
@@ -238,12 +241,14 @@ void ieee80211_ht_agg_queue_remove(struct ieee80211_local *local,
        } else {
                struct netdev_queue *txq;
                spinlock_t *root_lock;
+                struct Qdisc *q;
                txq = netdev_get_tx_queue(local->mdev, agg_queue);
-                root_lock = qdisc_root_lock(txq->qdisc);
+                q = rcu_dereference(txq->qdisc);
+                root_lock = qdisc_lock(q);
                spin_lock_bh(root_lock);
-                qdisc_reset(txq->qdisc);
+                qdisc_reset(q);
                spin_unlock_bh(root_lock);
        }
 }
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index c519d090bdb9..9d1830da8e84 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1032,10 +1032,10 @@ void nf_conntrack_cleanup(void)
        nf_ct_free_hashtable(nf_conntrack_hash, nf_conntrack_vmalloc,
                             nf_conntrack_htable_size);
-        nf_conntrack_proto_fini();
-        nf_conntrack_helper_fini();
-        nf_conntrack_expect_fini();
        nf_conntrack_acct_fini();
+        nf_conntrack_expect_fini();
+        nf_conntrack_helper_fini();
+        nf_conntrack_proto_fini();
 }
 struct hlist_head *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced)
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 420a10d8eb1e..6f61261888ef 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -67,7 +67,8 @@ static const char *const tcp_conntrack_names[] = {
 /* RFC1122 says the R2 limit should be at least 100 seconds.
   Linux uses 15 packets as limit, which corresponds
   to ~13-30min depending on RTO. */
-static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly =   5 MINS;
+static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly    =   5 MINS;
+static unsigned int nf_ct_tcp_timeout_unacknowledged __read_mostly =   5 MINS;
 static unsigned int tcp_timeouts[TCP_CONNTRACK_MAX] __read_mostly = {
        [TCP_CONNTRACK_SYN_SENT]        = 2 MINS,
@@ -625,8 +626,10 @@ static bool tcp_in_window(const struct nf_conn *ct,
                swin = win + (sack - ack);
                if (sender->td_maxwin < swin)
                        sender->td_maxwin = swin;
-                if (after(end, sender->td_end))
+                if (after(end, sender->td_end)) {
                        sender->td_end = end;
+                        sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
+                }
                /*
                 * Update receiver data.
                 */
@@ -637,6 +640,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
                        if (win == 0)
                                receiver->td_maxend++;
                }
+                if (ack == receiver->td_end)
+                        receiver->flags &= ~IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
                /*
                 * Check retransmissions.
@@ -951,9 +956,16 @@ static int tcp_packet(struct nf_conn *ct,
        if (old_state != new_state
            && new_state == TCP_CONNTRACK_FIN_WAIT)
                ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
-        timeout = ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans
-                  && tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans
+        if (ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans &&
-                  ? nf_ct_tcp_timeout_max_retrans : tcp_timeouts[new_state];
+            tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans)
+                timeout = nf_ct_tcp_timeout_max_retrans;
+        else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
+                 IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
+                 tcp_timeouts[new_state] > nf_ct_tcp_timeout_unacknowledged)
+                timeout = nf_ct_tcp_timeout_unacknowledged;
+        else
+                timeout = tcp_timeouts[new_state];
        write_unlock_bh(&tcp_lock);
        nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
@@ -1236,6 +1248,13 @@ static struct ctl_table tcp_sysctl_table[] = {
                .proc_handler   = &proc_dointvec_jiffies,
        },
        {
+                .procname       = "nf_conntrack_tcp_timeout_unacknowledged",
+                .data           = &nf_ct_tcp_timeout_unacknowledged,
+                .maxlen         = sizeof(unsigned int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_jiffies,
+        },
+        {
                .ctl_name       = NET_NF_CONNTRACK_TCP_LOOSE,
                .procname       = "nf_conntrack_tcp_loose",
                .data           = &nf_ct_tcp_loose,
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 869ef9349d0f..8509db14670b 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -324,6 +324,7 @@ static int log_invalid_proto_min = 0;
 static int log_invalid_proto_max = 255;
 static struct ctl_table_header *nf_ct_sysctl_header;
+static struct ctl_table_header *nf_ct_netfilter_header;
 static ctl_table nf_ct_sysctl_table[] = {
        {
@@ -384,12 +385,6 @@ static ctl_table nf_ct_sysctl_table[] = {
 static ctl_table nf_ct_netfilter_table[] = {
        {
-                .ctl_name       = NET_NETFILTER,
-                .procname       = "netfilter",
-                .mode           = 0555,
-                .child          = nf_ct_sysctl_table,
-        },
-        {
                .ctl_name       = NET_NF_CONNTRACK_MAX,
                .procname       = "nf_conntrack_max",
                .data           = &nf_conntrack_max,
@@ -409,18 +404,29 @@ EXPORT_SYMBOL_GPL(nf_ct_log_invalid);
 static int nf_conntrack_standalone_init_sysctl(void)
 {
-        nf_ct_sysctl_header =
+        nf_ct_netfilter_header =
                register_sysctl_paths(nf_ct_path, nf_ct_netfilter_table);
-        if (nf_ct_sysctl_header == NULL) {
+        if (!nf_ct_netfilter_header)
-                printk("nf_conntrack: can't register to sysctl.\n");
+                goto out;
-                return -ENOMEM;
-        }
+        nf_ct_sysctl_header =
+                 register_sysctl_paths(nf_net_netfilter_sysctl_path,
+                                        nf_ct_sysctl_table);
+        if (!nf_ct_sysctl_header)
+                goto out_unregister_netfilter;
        return 0;
+out_unregister_netfilter:
+        unregister_sysctl_table(nf_ct_netfilter_header);
+out:
+        printk("nf_conntrack: can't register to sysctl.\n");
+        return -ENOMEM;
 }
 static void nf_conntrack_standalone_fini_sysctl(void)
 {
+        unregister_sysctl_table(nf_ct_netfilter_header);
        unregister_sysctl_table(nf_ct_sysctl_header);
 }
 #else
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 6809af542a2c..d9418a267812 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -367,9 +367,7 @@ static void htable_gc(unsigned long htlong)
 static void htable_destroy(struct xt_hashlimit_htable *hinfo)
 {
-        /* remove timer, if it is pending */
+        del_timer_sync(&hinfo->timer);
-        if (timer_pending(&hinfo->timer))
-                del_timer(&hinfo->timer);
        /* remove proc entry */
        remove_proc_entry(hinfo->pde->name,
diff --git a/net/rfkill/rfkill-input.c b/net/rfkill/rfkill-input.c
index 8aa822730145..e5b69556bb5b 100644
--- a/net/rfkill/rfkill-input.c
+++ b/net/rfkill/rfkill-input.c
@@ -109,6 +109,25 @@ static DEFINE_RFKILL_TASK(rfkill_uwb, RFKILL_TYPE_UWB);
 static DEFINE_RFKILL_TASK(rfkill_wimax, RFKILL_TYPE_WIMAX);
 static DEFINE_RFKILL_TASK(rfkill_wwan, RFKILL_TYPE_WWAN);
+static void rfkill_schedule_evsw_rfkillall(int state)
+{
+        /* EVERY radio type. state != 0 means radios ON */
+        /* handle EPO (emergency power off) through shortcut */
+        if (state) {
+                rfkill_schedule_set(&rfkill_wwan,
+                                    RFKILL_STATE_UNBLOCKED);
+                rfkill_schedule_set(&rfkill_wimax,
+                                    RFKILL_STATE_UNBLOCKED);
+                rfkill_schedule_set(&rfkill_uwb,
+                                    RFKILL_STATE_UNBLOCKED);
+                rfkill_schedule_set(&rfkill_bt,
+                                    RFKILL_STATE_UNBLOCKED);
+                rfkill_schedule_set(&rfkill_wlan,
+                                    RFKILL_STATE_UNBLOCKED);
+        } else
+                rfkill_schedule_epo();
+}
 static void rfkill_event(struct input_handle *handle, unsigned int type,
                        unsigned int code, int data)
 {
@@ -132,21 +151,7 @@ static void rfkill_event(struct input_handle *handle, unsigned int type,
        } else if (type == EV_SW) {
                switch (code) {
                case SW_RFKILL_ALL:
-                        /* EVERY radio type. data != 0 means radios ON */
+                        rfkill_schedule_evsw_rfkillall(data);
-                        /* handle EPO (emergency power off) through shortcut */
-                        if (data) {
-                                rfkill_schedule_set(&rfkill_wwan,
-                                                    RFKILL_STATE_UNBLOCKED);
-                                rfkill_schedule_set(&rfkill_wimax,
-                                                    RFKILL_STATE_UNBLOCKED);
-                                rfkill_schedule_set(&rfkill_uwb,
-                                                    RFKILL_STATE_UNBLOCKED);
-                                rfkill_schedule_set(&rfkill_bt,
-                                                    RFKILL_STATE_UNBLOCKED);
-                                rfkill_schedule_set(&rfkill_wlan,
-                                                    RFKILL_STATE_UNBLOCKED);
-                        } else
-                                rfkill_schedule_epo();
                        break;
                default:
                        break;
@@ -168,6 +173,7 @@ static int rfkill_connect(struct input_handler *handler, struct input_dev *dev,
        handle->handler = handler;
        handle->name = "rfkill";
+        /* causes rfkill_start() to be called */
        error = input_register_handle(handle);
        if (error)
                goto err_free_handle;
@@ -185,6 +191,23 @@ static int rfkill_connect(struct input_handler *handler, struct input_dev *dev,
        return error;
 }
+static void rfkill_start(struct input_handle *handle)
+{
+        /* Take event_lock to guard against configuration changes, we
+         * should be able to deal with concurrency with rfkill_event()
+         * just fine (which event_lock will also avoid). */
+        spin_lock_irq(&handle->dev->event_lock);
+        if (test_bit(EV_SW, handle->dev->evbit)) {
+                if (test_bit(SW_RFKILL_ALL, handle->dev->swbit))
+                        rfkill_schedule_evsw_rfkillall(test_bit(SW_RFKILL_ALL,
+                                                        handle->dev->sw));
+                /* add resync for further EV_SW events here */
+        }
+        spin_unlock_irq(&handle->dev->event_lock);
+}
 static void rfkill_disconnect(struct input_handle *handle)
 {
        input_close_device(handle);
@@ -225,6 +248,7 @@ static struct input_handler rfkill_handler = {
        .event =        rfkill_event,
        .connect =      rfkill_connect,
        .disconnect =   rfkill_disconnect,
+        .start =        rfkill_start,
        .name =         "rfkill",
        .id_table =     rfkill_ids,
 };
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index 7a560b785097..d2d45655cd1a 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -105,6 +105,16 @@ static void rfkill_led_trigger(struct rfkill *rfkill,
 #endif /* CONFIG_RFKILL_LEDS */
 }
+#ifdef CONFIG_RFKILL_LEDS
+static void rfkill_led_trigger_activate(struct led_classdev *led)
+{
+        struct rfkill *rfkill = container_of(led->trigger,
+                        struct rfkill, led_trigger);
+        rfkill_led_trigger(rfkill, rfkill->state);
+}
+#endif /* CONFIG_RFKILL_LEDS */
 static void notify_rfkill_state_change(struct rfkill *rfkill)
 {
        blocking_notifier_call_chain(&rfkill_notifier_list,
@@ -130,7 +140,6 @@ static void update_rfkill_state(struct rfkill *rfkill)
 /**
 * rfkill_toggle_radio - wrapper for toggle_radio hook
- *
 * @rfkill: the rfkill struct to use
 * @force: calls toggle_radio even if cache says it is not needed,
 *      and also makes sure notifications of the state will be
@@ -141,8 +150,8 @@ static void update_rfkill_state(struct rfkill *rfkill)
 * calls and handling all the red tape such as issuing notifications
 * if the call is successful.
 *
- * Note that @force cannot override a (possibly cached) state of
+ * Note that the @force parameter cannot override a (possibly cached)
- * RFKILL_STATE_HARD_BLOCKED.  Any device making use of
+ * state of RFKILL_STATE_HARD_BLOCKED.  Any device making use of
 * RFKILL_STATE_HARD_BLOCKED implements either get_state() or
 * rfkill_force_state(), so the cache either is bypassed or valid.
 *
@@ -150,7 +159,7 @@ static void update_rfkill_state(struct rfkill *rfkill)
 * even if the radio is in RFKILL_STATE_HARD_BLOCKED state, so as to
 * give the driver a hint that it should double-BLOCK the transmitter.
 *
- * Caller must have aquired rfkill_mutex.
+ * Caller must have acquired rfkill->mutex.
 */
 static int rfkill_toggle_radio(struct rfkill *rfkill,
                                enum rfkill_state state,
@@ -200,12 +209,12 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
 /**
 * rfkill_switch_all - Toggle state of all switches of given type
- * @type: type of interfaces to be affeceted
+ * @type: type of interfaces to be affected
 * @state: the new state
 *
- * This function toggles state of all switches of given type unless
+ * This function toggles the state of all switches of given type,
- * a specific switch is claimed by userspace in which case it is
+ * unless a specific switch is claimed by userspace (in which case,
- * left alone.
+ * that switch is left alone).
 */
 void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state)
 {
@@ -216,8 +225,11 @@ void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state)
        rfkill_states[type] = state;
        list_for_each_entry(rfkill, &rfkill_list, node) {
-                if ((!rfkill->user_claim) && (rfkill->type == type))
+                if ((!rfkill->user_claim) && (rfkill->type == type)) {
+                        mutex_lock(&rfkill->mutex);
                        rfkill_toggle_radio(rfkill, state, 0);
+                        mutex_unlock(&rfkill->mutex);
+                }
        }
        mutex_unlock(&rfkill_mutex);
@@ -228,7 +240,7 @@ EXPORT_SYMBOL(rfkill_switch_all);
 * rfkill_epo - emergency power off all transmitters
 *
 * This kicks all rfkill devices to RFKILL_STATE_SOFT_BLOCKED, ignoring
- * everything in its path but rfkill_mutex.
+ * everything in its path but rfkill_mutex and rfkill->mutex.
 */
 void rfkill_epo(void)
 {
@@ -236,7 +248,9 @@ void rfkill_epo(void)
        mutex_lock(&rfkill_mutex);
        list_for_each_entry(rfkill, &rfkill_list, node) {
+                mutex_lock(&rfkill->mutex);
                rfkill_toggle_radio(rfkill, RFKILL_STATE_SOFT_BLOCKED, 1);
+                mutex_unlock(&rfkill->mutex);
        }
        mutex_unlock(&rfkill_mutex);
 }
@@ -252,7 +266,12 @@ EXPORT_SYMBOL_GPL(rfkill_epo);
 * a notification by the firmware/hardware of the current *real*
 * state of the radio rfkill switch.
 *
- * It may not be called from an atomic context.
+ * Devices which are subject to external changes on their rfkill
+ * state (such as those caused by a hardware rfkill line) MUST
+ * have their driver arrange to call rfkill_force_state() as soon
+ * as possible after such a change.
+ *
+ * This function may not be called from an atomic context.
 */
 int rfkill_force_state(struct rfkill *rfkill, enum rfkill_state state)
 {
@@ -367,6 +386,9 @@ static ssize_t rfkill_claim_store(struct device *dev,
        if (!capable(CAP_NET_ADMIN))
                return -EPERM;
+        if (rfkill->user_claim_unsupported)
+                return -EOPNOTSUPP;
        /*
         * Take the global lock to make sure the kernel is not in
         * the middle of rfkill_switch_all
@@ -375,19 +397,17 @@ static ssize_t rfkill_claim_store(struct device *dev,
        if (error)
                return error;
-        if (rfkill->user_claim_unsupported) {
-                error = -EOPNOTSUPP;
-                goto out_unlock;
-        }
        if (rfkill->user_claim != claim) {
-                if (!claim)
+                if (!claim) {
+                        mutex_lock(&rfkill->mutex);
                        rfkill_toggle_radio(rfkill,
                                            rfkill_states[rfkill->type],
                                            0);
+                        mutex_unlock(&rfkill->mutex);
+                }
                rfkill->user_claim = claim;
        }
-out_unlock:
        mutex_unlock(&rfkill_mutex);
        return error ? error : count;
@@ -516,8 +536,11 @@ static void rfkill_remove_switch(struct rfkill *rfkill)
 {
        mutex_lock(&rfkill_mutex);
        list_del_init(&rfkill->node);
-        rfkill_toggle_radio(rfkill, RFKILL_STATE_SOFT_BLOCKED, 1);
        mutex_unlock(&rfkill_mutex);
+        mutex_lock(&rfkill->mutex);
+        rfkill_toggle_radio(rfkill, RFKILL_STATE_SOFT_BLOCKED, 1);
+        mutex_unlock(&rfkill->mutex);
 }
 /**
@@ -526,9 +549,10 @@ static void rfkill_remove_switch(struct rfkill *rfkill)
 * @type: type of the switch (RFKILL_TYPE_*)
 *
 * This function should be called by the network driver when it needs
- * rfkill structure. Once the structure is allocated the driver shoud
+ * rfkill structure.  Once the structure is allocated the driver should
- * finish its initialization by setting name, private data, enable_radio
+ * finish its initialization by setting the name, private data, enable_radio
 * and disable_radio methods and then register it with rfkill_register().
+ *
 * NOTE: If registration fails the structure shoudl be freed by calling
 * rfkill_free() otherwise rfkill_unregister() should be used.
 */
@@ -560,7 +584,7 @@ EXPORT_SYMBOL(rfkill_allocate);
 * rfkill_free - Mark rfkill structure for deletion
 * @rfkill: rfkill structure to be destroyed
 *
- * Decrements reference count of rfkill structure so it is destroyed.
+ * Decrements reference count of the rfkill structure so it is destroyed.
 * Note that rfkill_free() should _not_ be called after rfkill_unregister().
 */
 void rfkill_free(struct rfkill *rfkill)
@@ -575,7 +599,10 @@ static void rfkill_led_trigger_register(struct rfkill *rfkill)
 #ifdef CONFIG_RFKILL_LEDS
        int error;
-        rfkill->led_trigger.name = rfkill->dev.bus_id;
+        if (!rfkill->led_trigger.name)
+                rfkill->led_trigger.name = rfkill->dev.bus_id;
+        if (!rfkill->led_trigger.activate)
+                rfkill->led_trigger.activate = rfkill_led_trigger_activate;
        error = led_trigger_register(&rfkill->led_trigger);
        if (error)
                rfkill->led_trigger.name = NULL;
@@ -585,8 +612,10 @@ static void rfkill_led_trigger_register(struct rfkill *rfkill)
 static void rfkill_led_trigger_unregister(struct rfkill *rfkill)
 {
 #ifdef CONFIG_RFKILL_LEDS
-        if (rfkill->led_trigger.name)
+        if (rfkill->led_trigger.name) {
                led_trigger_unregister(&rfkill->led_trigger);
+                rfkill->led_trigger.name = NULL;
+        }
 #endif
 }
@@ -622,8 +651,8 @@ int rfkill_register(struct rfkill *rfkill)
        error = device_add(dev);
        if (error) {
-                rfkill_led_trigger_unregister(rfkill);
                rfkill_remove_switch(rfkill);
+                rfkill_led_trigger_unregister(rfkill);
                return error;
        }
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index d308c19aa3f9..26c7e1f9a350 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -205,10 +205,9 @@ struct tcf_common *tcf_hash_check(u32 index, struct tc_action *a, int bind,
 {
        struct tcf_common *p = NULL;
        if (index && (p = tcf_hash_lookup(index, hinfo)) != NULL) {
-                if (bind) {
+                if (bind)
                        p->tcfc_bindcnt++;
-                        p->tcfc_refcnt++;
+                p->tcfc_refcnt++;
-                }
                a->priv = p;
        }
        return p;
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index b0601642e227..ba1d121f3127 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -189,7 +189,7 @@ struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle)
        for (i = 0; i < dev->num_tx_queues; i++) {
                struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
-                struct Qdisc *q, *txq_root = txq->qdisc;
+                struct Qdisc *q, *txq_root = txq->qdisc_sleeping;
                if (!(txq_root->flags & TCQ_F_BUILTIN) &&
                    txq_root->handle == handle)
@@ -572,44 +572,21 @@ static u32 qdisc_alloc_handle(struct net_device *dev)
 static struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
                                     struct Qdisc *qdisc)
 {
+        struct Qdisc *oqdisc = dev_queue->qdisc_sleeping;
        spinlock_t *root_lock;
-        struct Qdisc *oqdisc;
-        int ingress;
-        ingress = 0;
-        if (qdisc && qdisc->flags&TCQ_F_INGRESS)
-                ingress = 1;
-        if (ingress) {
-                oqdisc = dev_queue->qdisc;
-        } else {
-                oqdisc = dev_queue->qdisc_sleeping;
-        }
        root_lock = qdisc_root_lock(oqdisc);
        spin_lock_bh(root_lock);
-        if (ingress) {
+        /* Prune old scheduler */
-                /* Prune old scheduler */
+        if (oqdisc && atomic_read(&oqdisc->refcnt) <= 1)
-                if (oqdisc && atomic_read(&oqdisc->refcnt) <= 1) {
+                qdisc_reset(oqdisc);
-                        /* delete */
-                        qdisc_reset(oqdisc);
-                        dev_queue->qdisc = NULL;
-                } else {  /* new */
-                        dev_queue->qdisc = qdisc;
-                }
-        } else {
+        /* ... and graft new one */
-                /* Prune old scheduler */
+        if (qdisc == NULL)
-                if (oqdisc && atomic_read(&oqdisc->refcnt) <= 1)
+                qdisc = &noop_qdisc;
-                        qdisc_reset(oqdisc);
+        dev_queue->qdisc_sleeping = qdisc;
+        dev_queue->qdisc = &noop_qdisc;
-                /* ... and graft new one */
-                if (qdisc == NULL)
-                        qdisc = &noop_qdisc;
-                dev_queue->qdisc_sleeping = qdisc;
-                dev_queue->qdisc = &noop_qdisc;
-        }
        spin_unlock_bh(root_lock);
@@ -678,7 +655,8 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
                ingress = 0;
                num_q = dev->num_tx_queues;
-                if (q && q->flags & TCQ_F_INGRESS) {
+                if ((q && q->flags & TCQ_F_INGRESS) ||
+                    (new && new->flags & TCQ_F_INGRESS)) {
                        num_q = 1;
                        ingress = 1;
                }
@@ -692,13 +670,10 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
                        if (!ingress)
                                dev_queue = netdev_get_tx_queue(dev, i);
-                        if (ingress) {
+                        old = dev_graft_qdisc(dev_queue, new);
-                                old = dev_graft_qdisc(dev_queue, q);
+                        if (new && i > 0)
-                        } else {
+                                atomic_inc(&new->refcnt);
-                                old = dev_graft_qdisc(dev_queue, new);
-                                if (new && i > 0)
-                                        atomic_inc(&new->refcnt);
-                        }
                        notify_and_destroy(skb, n, classid, old, new);
                }
@@ -817,8 +792,8 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
                                goto err_out3;
                        }
                }
-                if (parent)
+                if ((parent != TC_H_ROOT) && !(sch->flags & TCQ_F_INGRESS))
-                        list_add_tail(&sch->list, &dev_queue->qdisc->list);
+                        list_add_tail(&sch->list, &dev_queue->qdisc_sleeping->list);
                return sch;
        }
@@ -1261,11 +1236,11 @@ static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
                q_idx = 0;
                dev_queue = netdev_get_tx_queue(dev, 0);
-                if (tc_dump_qdisc_root(dev_queue->qdisc, skb, cb, &q_idx, s_q_idx) < 0)
+                if (tc_dump_qdisc_root(dev_queue->qdisc_sleeping, skb, cb, &q_idx, s_q_idx) < 0)
                        goto done;
                dev_queue = &dev->rx_queue;
-                if (tc_dump_qdisc_root(dev_queue->qdisc, skb, cb, &q_idx, s_q_idx) < 0)
+                if (tc_dump_qdisc_root(dev_queue->qdisc_sleeping, skb, cb, &q_idx, s_q_idx) < 0)
                        goto done;
 cont:
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 6b517b9dac5b..43d37256c15e 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -415,7 +415,7 @@ static int atm_tc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                case TC_ACT_QUEUED:
                case TC_ACT_STOLEN:
                        kfree_skb(skb);
-                        return NET_XMIT_SUCCESS;
+                        return NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                case TC_ACT_SHOT:
                        kfree_skb(skb);
                        goto drop;
@@ -432,9 +432,11 @@ static int atm_tc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        ret = qdisc_enqueue(skb, flow->q);
        if (ret != 0) {
 drop: __maybe_unused
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(ret)) {
-                if (flow)
+                        sch->qstats.drops++;
-                        flow->qstats.drops++;
+                        if (flow)
+                                flow->qstats.drops++;
+                }
                return ret;
        }
        sch->bstats.bytes += qdisc_pkt_len(skb);
@@ -455,7 +457,7 @@ drop: __maybe_unused
                return 0;
        }
        tasklet_schedule(&p->task);
-        return NET_XMIT_BYPASS;
+        return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
 }
 /*
@@ -530,7 +532,7 @@ static int atm_tc_requeue(struct sk_buff *skb, struct Qdisc *sch)
        if (!ret) {
                sch->q.qlen++;
                sch->qstats.requeues++;
-        } else {
+        } else if (net_xmit_drop_count(ret)) {
                sch->qstats.drops++;
                p->link.qstats.drops++;
        }
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 14954bf4a683..4e261ce62f48 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -230,7 +230,7 @@ cbq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
            (cl = cbq_class_lookup(q, prio)) != NULL)
                return cl;
-        *qerr = NET_XMIT_BYPASS;
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
        for (;;) {
                int result = 0;
                defmap = head->defaults;
@@ -256,7 +256,7 @@ cbq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
                switch (result) {
                case TC_ACT_QUEUED:
                case TC_ACT_STOLEN:
-                        *qerr = NET_XMIT_SUCCESS;
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                case TC_ACT_SHOT:
                        return NULL;
                case TC_ACT_RECLASSIFY:
@@ -377,7 +377,7 @@ cbq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        q->rx_class = cl;
 #endif
        if (cl == NULL) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                        sch->qstats.drops++;
                kfree_skb(skb);
                return ret;
@@ -397,9 +397,11 @@ cbq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                return ret;
        }
-        sch->qstats.drops++;
+        if (net_xmit_drop_count(ret)) {
-        cbq_mark_toplevel(q, cl);
+                sch->qstats.drops++;
-        cl->qstats.drops++;
+                cbq_mark_toplevel(q, cl);
+                cl->qstats.drops++;
+        }
        return ret;
 }
@@ -430,8 +432,10 @@ cbq_requeue(struct sk_buff *skb, struct Qdisc *sch)
                        cbq_activate_class(cl);
                return 0;
        }
-        sch->qstats.drops++;
+        if (net_xmit_drop_count(ret)) {
-        cl->qstats.drops++;
+                sch->qstats.drops++;
+                cl->qstats.drops++;
+        }
        return ret;
 }
@@ -664,13 +668,15 @@ static int cbq_reshape_fail(struct sk_buff *skb, struct Qdisc *child)
        q->rx_class = NULL;
        if (cl && (cl = cbq_reclassify(skb, cl)) != NULL) {
+                int ret;
                cbq_mark_toplevel(q, cl);
                q->rx_class = cl;
                cl->q->__parent = sch;
-                if (qdisc_enqueue(skb, cl->q) == 0) {
+                ret = qdisc_enqueue(skb, cl->q);
+                if (ret == NET_XMIT_SUCCESS) {
                        sch->q.qlen++;
                        sch->bstats.packets++;
                        sch->bstats.bytes += qdisc_pkt_len(skb);
@@ -678,7 +684,8 @@ static int cbq_reshape_fail(struct sk_buff *skb, struct Qdisc *child)
                                cbq_activate_class(cl);
                        return 0;
                }
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(ret))
+                        sch->qstats.drops++;
                return 0;
        }
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index a935676987e2..edd1298f85f6 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -236,7 +236,7 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                case TC_ACT_QUEUED:
                case TC_ACT_STOLEN:
                        kfree_skb(skb);
-                        return NET_XMIT_SUCCESS;
+                        return NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                case TC_ACT_SHOT:
                        goto drop;
@@ -254,7 +254,8 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        err = qdisc_enqueue(skb, p->q);
        if (err != NET_XMIT_SUCCESS) {
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(err))
+                        sch->qstats.drops++;
                return err;
        }
@@ -267,7 +268,7 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 drop:
        kfree_skb(skb);
        sch->qstats.drops++;
-        return NET_XMIT_BYPASS;
+        return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
 }
 static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
@@ -321,7 +322,8 @@ static int dsmark_requeue(struct sk_buff *skb, struct Qdisc *sch)
        err = p->q->ops->requeue(skb, p->q);
        if (err != NET_XMIT_SUCCESS) {
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(err))
+                        sch->qstats.drops++;
                return err;
        }
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index fd2a6cadb115..7cf83b37459d 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -29,7 +29,7 @@
 /* Main transmission queue. */
 /* Modifications to data participating in scheduling must be protected with
- * qdisc_root_lock(qdisc) spinlock.
+ * qdisc_lock(qdisc) spinlock.
 *
 * The idea is the following:
 * - enqueue, dequeue are serialized via qdisc root lock
@@ -126,7 +126,7 @@ static inline int qdisc_restart(struct Qdisc *q)
        if (unlikely((skb = dequeue_skb(q)) == NULL))
                return 0;
-        root_lock = qdisc_root_lock(q);
+        root_lock = qdisc_lock(q);
        /* And release qdisc */
        spin_unlock(root_lock);
@@ -135,7 +135,8 @@ static inline int qdisc_restart(struct Qdisc *q)
        txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
        HARD_TX_LOCK(dev, txq, smp_processor_id());
-        if (!netif_subqueue_stopped(dev, skb))
+        if (!netif_tx_queue_stopped(txq) &&
+            !netif_tx_queue_frozen(txq))
                ret = dev_hard_start_xmit(skb, dev, txq);
        HARD_TX_UNLOCK(dev, txq);
@@ -162,7 +163,8 @@ static inline int qdisc_restart(struct Qdisc *q)
                break;
        }
-        if (ret && netif_tx_queue_stopped(txq))
+        if (ret && (netif_tx_queue_stopped(txq) ||
+                    netif_tx_queue_frozen(txq)))
                ret = 0;
        return ret;
@@ -505,7 +507,7 @@ errout:
 }
 EXPORT_SYMBOL(qdisc_create_dflt);
-/* Under qdisc_root_lock(qdisc) and BH! */
+/* Under qdisc_lock(qdisc) and BH! */
 void qdisc_reset(struct Qdisc *qdisc)
 {
@@ -541,7 +543,7 @@ static void __qdisc_destroy(struct rcu_head *head)
        kfree((char *) qdisc - qdisc->padded);
 }
-/* Under qdisc_root_lock(qdisc) and BH! */
+/* Under qdisc_lock(qdisc) and BH! */
 void qdisc_destroy(struct Qdisc *qdisc)
 {
@@ -596,7 +598,7 @@ static void transition_one_qdisc(struct net_device *dev,
        int *need_watchdog_p = _need_watchdog;
        rcu_assign_pointer(dev_queue->qdisc, new_qdisc);
-        if (new_qdisc != &noqueue_qdisc)
+        if (need_watchdog_p && new_qdisc != &noqueue_qdisc)
                *need_watchdog_p = 1;
 }
@@ -619,6 +621,7 @@ void dev_activate(struct net_device *dev)
        need_watchdog = 0;
        netdev_for_each_tx_queue(dev, transition_one_qdisc, &need_watchdog);
+        transition_one_qdisc(dev, &dev->rx_queue, NULL);
        if (need_watchdog) {
                dev->trans_start = jiffies;
@@ -656,7 +659,7 @@ static bool some_qdisc_is_running(struct net_device *dev, int lock)
                dev_queue = netdev_get_tx_queue(dev, i);
                q = dev_queue->qdisc;
-                root_lock = qdisc_root_lock(q);
+                root_lock = qdisc_lock(q);
                if (lock)
                        spin_lock_bh(root_lock);
@@ -677,6 +680,7 @@ void dev_deactivate(struct net_device *dev)
        bool running;
        netdev_for_each_tx_queue(dev, dev_deactivate_queue, &noop_qdisc);
+        dev_deactivate_queue(dev, &dev->rx_queue, &noop_qdisc);
        dev_watchdog_down(dev);
@@ -718,7 +722,7 @@ static void dev_init_scheduler_queue(struct net_device *dev,
 void dev_init_scheduler(struct net_device *dev)
 {
        netdev_for_each_tx_queue(dev, dev_init_scheduler_queue, &noop_qdisc);
-        dev_init_scheduler_queue(dev, &dev->rx_queue, NULL);
+        dev_init_scheduler_queue(dev, &dev->rx_queue, &noop_qdisc);
        setup_timer(&dev->watchdog_timer, dev_watchdog, (unsigned long)dev);
 }
@@ -731,7 +735,7 @@ static void shutdown_scheduler_queue(struct net_device *dev,
        struct Qdisc *qdisc_default = _qdisc_default;
        if (qdisc) {
-                spinlock_t *root_lock = qdisc_root_lock(qdisc);
+                spinlock_t *root_lock = qdisc_lock(qdisc);
                dev_queue->qdisc = qdisc_default;
                dev_queue->qdisc_sleeping = qdisc_default;
@@ -745,6 +749,6 @@ static void shutdown_scheduler_queue(struct net_device *dev,
 void dev_shutdown(struct net_device *dev)
 {
        netdev_for_each_tx_queue(dev, shutdown_scheduler_queue, &noop_qdisc);
-        shutdown_scheduler_queue(dev, &dev->rx_queue, NULL);
+        shutdown_scheduler_queue(dev, &dev->rx_queue, &noop_qdisc);
        WARN_ON(timer_pending(&dev->watchdog_timer));
 }
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 0ae7d19dcba8..c2b8d9cce3d2 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1159,14 +1159,14 @@ hfsc_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
                if (cl->level == 0)
                        return cl;
-        *qerr = NET_XMIT_BYPASS;
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
        tcf = q->root.filter_list;
        while (tcf && (result = tc_classify(skb, tcf, &res)) >= 0) {
 #ifdef CONFIG_NET_CLS_ACT
                switch (result) {
                case TC_ACT_QUEUED:
                case TC_ACT_STOLEN:
-                        *qerr = NET_XMIT_SUCCESS;
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                case TC_ACT_SHOT:
                        return NULL;
                }
@@ -1578,7 +1578,7 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        cl = hfsc_classify(skb, sch, &err);
        if (cl == NULL) {
-                if (err == NET_XMIT_BYPASS)
+                if (err & __NET_XMIT_BYPASS)
                        sch->qstats.drops++;
                kfree_skb(skb);
                return err;
@@ -1586,8 +1586,10 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        err = qdisc_enqueue(skb, cl->qdisc);
        if (unlikely(err != NET_XMIT_SUCCESS)) {
-                cl->qstats.drops++;
+                if (net_xmit_drop_count(err)) {
-                sch->qstats.drops++;
+                        cl->qstats.drops++;
+                        sch->qstats.drops++;
+                }
                return err;
        }
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 75a40951c4f2..be35422711a3 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -214,14 +214,14 @@ static struct htb_class *htb_classify(struct sk_buff *skb, struct Qdisc *sch,
        if ((cl = htb_find(skb->priority, sch)) != NULL && cl->level == 0)
                return cl;
-        *qerr = NET_XMIT_BYPASS;
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
        tcf = q->filter_list;
        while (tcf && (result = tc_classify(skb, tcf, &res)) >= 0) {
 #ifdef CONFIG_NET_CLS_ACT
                switch (result) {
                case TC_ACT_QUEUED:
                case TC_ACT_STOLEN:
-                        *qerr = NET_XMIT_SUCCESS;
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                case TC_ACT_SHOT:
                        return NULL;
                }
@@ -567,14 +567,16 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                }
 #ifdef CONFIG_NET_CLS_ACT
        } else if (!cl) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                        sch->qstats.drops++;
                kfree_skb(skb);
                return ret;
 #endif
-        } else if (qdisc_enqueue(skb, cl->un.leaf.q) != NET_XMIT_SUCCESS) {
+        } else if ((ret = qdisc_enqueue(skb, cl->un.leaf.q)) != NET_XMIT_SUCCESS) {
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(ret)) {
-                cl->qstats.drops++;
+                        sch->qstats.drops++;
+                        cl->qstats.drops++;
+                }
                return NET_XMIT_DROP;
        } else {
                cl->bstats.packets +=
@@ -610,15 +612,17 @@ static int htb_requeue(struct sk_buff *skb, struct Qdisc *sch)
                }
 #ifdef CONFIG_NET_CLS_ACT
        } else if (!cl) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                        sch->qstats.drops++;
                kfree_skb(skb);
                return ret;
 #endif
-        } else if (cl->un.leaf.q->ops->requeue(skb, cl->un.leaf.q) !=
+        } else if ((ret = cl->un.leaf.q->ops->requeue(skb, cl->un.leaf.q)) !=
                   NET_XMIT_SUCCESS) {
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(ret)) {
-                cl->qstats.drops++;
+                        sch->qstats.drops++;
+                        cl->qstats.drops++;
+                }
                return NET_XMIT_DROP;
        } else
                htb_activate(q, cl);
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index a59085700678..fb0294d0b55e 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -176,7 +176,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        if (count == 0) {
                sch->qstats.drops++;
                kfree_skb(skb);
-                return NET_XMIT_BYPASS;
+                return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
        }
        skb_orphan(skb);
@@ -240,8 +240,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                sch->q.qlen++;
                sch->bstats.bytes += qdisc_pkt_len(skb);
                sch->bstats.packets++;
-        } else
+        } else if (net_xmit_drop_count(ret)) {
                sch->qstats.drops++;
+        }
        pr_debug("netem: enqueue ret %d\n", ret);
        return ret;
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index f849243eb095..eac197610edf 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -38,14 +38,14 @@ prio_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
        struct tcf_result res;
        int err;
-        *qerr = NET_XMIT_BYPASS;
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
        if (TC_H_MAJ(skb->priority) != sch->handle) {
                err = tc_classify(skb, q->filter_list, &res);
 #ifdef CONFIG_NET_CLS_ACT
                switch (err) {
                case TC_ACT_STOLEN:
                case TC_ACT_QUEUED:
-                        *qerr = NET_XMIT_SUCCESS;
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                case TC_ACT_SHOT:
                        return NULL;
                }
@@ -74,7 +74,7 @@ prio_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 #ifdef CONFIG_NET_CLS_ACT
        if (qdisc == NULL) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                        sch->qstats.drops++;
                kfree_skb(skb);
                return ret;
@@ -88,7 +88,8 @@ prio_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                sch->q.qlen++;
                return NET_XMIT_SUCCESS;
        }
-        sch->qstats.drops++;
+        if (net_xmit_drop_count(ret))
+                sch->qstats.drops++;
        return ret;
 }
@@ -102,7 +103,7 @@ prio_requeue(struct sk_buff *skb, struct Qdisc* sch)
        qdisc = prio_classify(skb, sch, &ret);
 #ifdef CONFIG_NET_CLS_ACT
        if (qdisc == NULL) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                        sch->qstats.drops++;
                kfree_skb(skb);
                return ret;
@@ -114,7 +115,8 @@ prio_requeue(struct sk_buff *skb, struct Qdisc* sch)
                sch->qstats.requeues++;
                return 0;
        }
-        sch->qstats.drops++;
+        if (net_xmit_drop_count(ret))
+                sch->qstats.drops++;
        return NET_XMIT_DROP;
 }
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 3f2d1d7f3bbd..5da05839e225 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -97,7 +97,7 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc* sch)
                sch->bstats.bytes += qdisc_pkt_len(skb);
                sch->bstats.packets++;
                sch->q.qlen++;
-        } else {
+        } else if (net_xmit_drop_count(ret)) {
                q->stats.pdrop++;
                sch->qstats.drops++;
        }
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 8589da666568..6e041d10dbdb 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -171,14 +171,14 @@ static unsigned int sfq_classify(struct sk_buff *skb, struct Qdisc *sch,
        if (!q->filter_list)
                return sfq_hash(q, skb) + 1;
-        *qerr = NET_XMIT_BYPASS;
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
        result = tc_classify(skb, q->filter_list, &res);
        if (result >= 0) {
 #ifdef CONFIG_NET_CLS_ACT
                switch (result) {
                case TC_ACT_STOLEN:
                case TC_ACT_QUEUED:
-                        *qerr = NET_XMIT_SUCCESS;
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                case TC_ACT_SHOT:
                        return 0;
                }
@@ -285,7 +285,7 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        hash = sfq_classify(skb, sch, &ret);
        if (hash == 0) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                        sch->qstats.drops++;
                kfree_skb(skb);
                return ret;
@@ -339,7 +339,7 @@ sfq_requeue(struct sk_buff *skb, struct Qdisc *sch)
        hash = sfq_classify(skb, sch, &ret);
        if (hash == 0) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                        sch->qstats.drops++;
                kfree_skb(skb);
                return ret;
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index b296672f7632..7d3b7ff3bf07 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -135,7 +135,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
        ret = qdisc_enqueue(skb, q->qdisc);
        if (ret != 0) {
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(ret))
+                        sch->qstats.drops++;
                return ret;
        }
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 537223642b6e..2c35c678563b 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -305,10 +305,11 @@ restart:
                switch (teql_resolve(skb, skb_res, slave)) {
                case 0:
-                        if (netif_tx_trylock(slave)) {
+                        if (__netif_tx_trylock(slave_txq)) {
-                                if (!__netif_subqueue_stopped(slave, subq) &&
+                                if (!netif_tx_queue_stopped(slave_txq) &&
+                                    !netif_tx_queue_frozen(slave_txq) &&
                                    slave->hard_start_xmit(skb, slave) == 0) {
-                                        netif_tx_unlock(slave);
+                                        __netif_tx_unlock(slave_txq);
                                        master->slaves = NEXT_SLAVE(q);
                                        netif_wake_queue(dev);
                                        master->stats.tx_packets++;
@@ -316,7 +317,7 @@ restart:
                                                qdisc_pkt_len(skb);
                                        return 0;
                                }
-                                netif_tx_unlock(slave);
+                                __netif_tx_unlock(slave_txq);
                        }
                        if (netif_queue_stopped(dev))
                                busy = 1;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index a238d6834b33..483a01d0740a 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -195,8 +195,7 @@ out:
 }
 /* Based on tcp_v6_xmit() in tcp_ipv6.c. */
-static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport,
+static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport)
-                        int ipfragok)
 {
        struct sock *sk = skb->sk;
        struct ipv6_pinfo *np = inet6_sk(sk);
@@ -231,7 +230,10 @@ static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport,
        SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
-        return ip6_xmit(sk, skb, &fl, np->opt, ipfragok);
+        if (!(transport->param_flags & SPP_PMTUD_ENABLE))
+                skb->local_df = 1;
+        return ip6_xmit(sk, skb, &fl, np->opt, 0);
 }
 /* Returns the dst cache entry for the given source and destination ip
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 45684646b1db..0dc4a7dfb234 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -586,10 +586,8 @@ int sctp_packet_transmit(struct sctp_packet *packet)
        SCTP_DEBUG_PRINTK("***sctp_transmit_packet*** skb len %d\n",
                          nskb->len);
-        if (tp->param_flags & SPP_PMTUD_ENABLE)
+        nskb->local_df = packet->ipfragok;
-                (*tp->af_specific->sctp_xmit)(nskb, tp, packet->ipfragok);
+        (*tp->af_specific->sctp_xmit)(nskb, tp);
-        else
-                (*tp->af_specific->sctp_xmit)(nskb, tp, 1);
 out:
        packet->size = packet->overhead;
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index a6e0818bcff5..0b65354aaf64 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -862,16 +862,21 @@ static int sctp_inet_supported_addrs(const struct sctp_sock *opt,
 /* Wrapper routine that calls the ip transmit routine. */
 static inline int sctp_v4_xmit(struct sk_buff *skb,
-                               struct sctp_transport *transport, int ipfragok)
+                               struct sctp_transport *transport)
 {
+        struct inet_sock *inet = inet_sk(skb->sk);
        SCTP_DEBUG_PRINTK("%s: skb:%p, len:%d, "
                          "src:%u.%u.%u.%u, dst:%u.%u.%u.%u\n",
                          __func__, skb, skb->len,
                          NIPQUAD(skb->rtable->rt_src),
                          NIPQUAD(skb->rtable->rt_dst));
+        inet->pmtudisc = transport->param_flags & SPP_PMTUD_ENABLE ?
+                         IP_PMTUDISC_DO : IP_PMTUDISC_DONT;
        SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
-        return ip_queue_xmit(skb, ipfragok);
+        return ip_queue_xmit(skb, 0);
 }
 static struct sctp_af sctp_af_inet;
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index b210a88d0960..7f07152bc109 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -57,7 +57,6 @@
 #include <linux/vmalloc.h>      /* vmalloc, vfree */
 #include <asm/uaccess.h>        /* copy_to/from_user */
 #include <linux/init.h>         /* __initfunc et al. */
-#include <net/syncppp.h>
 #define KMEM_SAFETYZONE 8
@@ -567,9 +566,6 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
 {
        wanif_conf_t *cnf;
        struct net_device *dev = NULL;
-#ifdef CONFIG_WANPIPE_MULTPPP
-        struct ppp_device *pppdev=NULL;
-#endif
        int err;
        if ((wandev->state == WAN_UNCONFIGURED) || (wandev->new_if == NULL))
@@ -588,25 +584,10 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
                goto out;
        if (cnf->config_id == WANCONFIG_MPPP) {
-#ifdef CONFIG_WANPIPE_MULTPPP
-                pppdev = kzalloc(sizeof(struct ppp_device), GFP_KERNEL);
-                err = -ENOBUFS;
-                if (pppdev == NULL)
-                        goto out;
-                pppdev->dev = kzalloc(sizeof(struct net_device), GFP_KERNEL);
-                if (pppdev->dev == NULL) {
-                        kfree(pppdev);
-                        err = -ENOBUFS;
-                        goto out;
-                }
-                err = wandev->new_if(wandev, (struct net_device *)pppdev, cnf);
-                dev = pppdev->dev;
-#else
                printk(KERN_INFO "%s: Wanpipe Mulit-Port PPP support has not been compiled in!\n",
                                wandev->name);
                err = -EPROTONOSUPPORT;
                goto out;
-#endif
        } else {
                dev = kzalloc(sizeof(struct net_device), GFP_KERNEL);
                err = -ENOBUFS;
@@ -661,17 +642,9 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
        kfree(dev->priv);
        dev->priv = NULL;
-#ifdef CONFIG_WANPIPE_MULTPPP
-        if (cnf->config_id == WANCONFIG_MPPP)
-                kfree(pppdev);
-        else
-                kfree(dev);
-#else
        /* Sync PPP is disabled */
        if (cnf->config_id != WANCONFIG_MPPP)
                kfree(dev);
-#endif
 out:
        kfree(cnf);
        return err;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index b7fefffd2d0d..59eb2cf42e5f 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -29,16 +29,16 @@ static struct genl_family nl80211_fam = {
 };
 /* internal helper: get drv and dev */
-static int get_drv_dev_by_info_ifindex(struct genl_info *info,
+static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
                                       struct cfg80211_registered_device **drv,
                                       struct net_device **dev)
 {
        int ifindex;
-        if (!info->attrs[NL80211_ATTR_IFINDEX])
+        if (!attrs[NL80211_ATTR_IFINDEX])
                return -EINVAL;
-        ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
+        ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
        *dev = dev_get_by_index(&init_net, ifindex);
        if (!*dev)
                return -ENODEV;
@@ -291,21 +291,31 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
        mutex_lock(&cfg80211_drv_mutex);
        list_for_each_entry(dev, &cfg80211_drv_list, list) {
-                if (++wp_idx < wp_start)
+                if (wp_idx < wp_start) {
+                        wp_idx++;
                        continue;
+                }
                if_idx = 0;
                mutex_lock(&dev->devlist_mtx);
                list_for_each_entry(wdev, &dev->netdev_list, list) {
-                        if (++if_idx < if_start)
+                        if (if_idx < if_start) {
+                                if_idx++;
                                continue;
+                        }
                        if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
                                               cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                               wdev->netdev) < 0)
+                                               wdev->netdev) < 0) {
-                                break;
+                                mutex_unlock(&dev->devlist_mtx);
+                                goto out;
+                        }
+                        if_idx++;
                }
                mutex_unlock(&dev->devlist_mtx);
+                wp_idx++;
        }
+ out:
        mutex_unlock(&cfg80211_drv_mutex);
        cb->args[0] = wp_idx;
@@ -321,7 +331,7 @@ static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
        struct net_device *netdev;
        int err;
-        err = get_drv_dev_by_info_ifindex(info, &dev, &netdev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
        if (err)
                return err;
@@ -392,7 +402,7 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
        } else
                return -EINVAL;
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
        if (err)
                return err;
        ifindex = dev->ifindex;
@@ -477,7 +487,7 @@ static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
        int ifindex, err;
        struct net_device *dev;
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
        if (err)
                return err;
        ifindex = dev->ifindex;
@@ -545,7 +555,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
        if (info->attrs[NL80211_ATTR_MAC])
                mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
        if (err)
                return err;
@@ -618,7 +628,7 @@ static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
        if (!info->attrs[NL80211_ATTR_KEY_DEFAULT])
                return -EINVAL;
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
        if (err)
                return err;
@@ -699,7 +709,7 @@ static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
                return -EINVAL;
        }
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
        if (err)
                return err;
@@ -735,7 +745,7 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
        if (info->attrs[NL80211_ATTR_MAC])
                mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
        if (err)
                return err;
@@ -764,7 +774,7 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
        struct beacon_parameters params;
        int haveinfo = 0;
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
        if (err)
                return err;
@@ -843,7 +853,7 @@ static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
        int err;
        struct net_device *dev;
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
        if (err)
                return err;
@@ -937,67 +947,78 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
 }
 static int nl80211_dump_station(struct sk_buff *skb,
-                struct netlink_callback *cb)
+                                struct netlink_callback *cb)
 {
-        int wp_idx = 0;
-        int if_idx = 0;
-        int sta_idx = cb->args[2];
-        int wp_start = cb->args[0];
-        int if_start = cb->args[1];
        struct station_info sinfo;
        struct cfg80211_registered_device *dev;
-        struct wireless_dev *wdev;
+        struct net_device *netdev;
        u8 mac_addr[ETH_ALEN];
+        int ifidx = cb->args[0];
+        int sta_idx = cb->args[1];
        int err;
-        int exit = 0;
-        /* TODO: filter by device */
+        if (!ifidx) {
-        mutex_lock(&cfg80211_drv_mutex);
+                err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
-        list_for_each_entry(dev, &cfg80211_drv_list, list) {
+                                  nl80211_fam.attrbuf, nl80211_fam.maxattr,
-                if (exit)
+                                  nl80211_policy);
+                if (err)
+                        return err;
+                if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
+                        return -EINVAL;
+                ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
+                if (!ifidx)
+                        return -EINVAL;
+        }
+        netdev = dev_get_by_index(&init_net, ifidx);
+        if (!netdev)
+                return -ENODEV;
+        dev = cfg80211_get_dev_from_ifindex(ifidx);
+        if (IS_ERR(dev)) {
+                err = PTR_ERR(dev);
+                goto out_put_netdev;
+        }
+        if (!dev->ops->dump_station) {
+                err = -ENOSYS;
+                goto out_err;
+        }
+        rtnl_lock();
+        while (1) {
+                err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
+                                             mac_addr, &sinfo);
+                if (err == -ENOENT)
                        break;
-                if (++wp_idx < wp_start)
+                if (err)
-                        continue;
+                        goto out_err_rtnl;
-                if_idx = 0;
-                mutex_lock(&dev->devlist_mtx);
+                if (nl80211_send_station(skb,
-                list_for_each_entry(wdev, &dev->netdev_list, list) {
+                                NETLINK_CB(cb->skb).pid,
-                        if (exit)
+                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                break;
+                                netdev, mac_addr,
-                        if (++if_idx < if_start)
+                                &sinfo) < 0)
-                                continue;
+                        goto out;
-                        if (!dev->ops->dump_station)
-                                continue;
-                        for (;; ++sta_idx) {
+                sta_idx++;
-                                rtnl_lock();
-                                err = dev->ops->dump_station(&dev->wiphy,
-                                                wdev->netdev, sta_idx, mac_addr,
-                                                &sinfo);
-                                rtnl_unlock();
-                                if (err) {
-                                        sta_idx = 0;
-                                        break;
-                                }
-                                if (nl80211_send_station(skb,
-                                                NETLINK_CB(cb->skb).pid,
-                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                                wdev->netdev, mac_addr,
-                                                &sinfo) < 0) {
-                                        exit = 1;
-                                        break;
-                                }
-                        }
-                }
-                mutex_unlock(&dev->devlist_mtx);
        }
-        mutex_unlock(&cfg80211_drv_mutex);
-        cb->args[0] = wp_idx;
-        cb->args[1] = if_idx;
-        cb->args[2] = sta_idx;
-        return skb->len;
+ out:
+        cb->args[1] = sta_idx;
+        err = skb->len;
+ out_err_rtnl:
+        rtnl_unlock();
+ out_err:
+        cfg80211_put_dev(dev);
+ out_put_netdev:
+        dev_put(netdev);
+        return err;
 }
 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
@@ -1016,7 +1037,7 @@ static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
        mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
        if (err)
                return err;
@@ -1112,7 +1133,7 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                params.plink_action =
                    nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
        if (err)
                return err;
@@ -1172,7 +1193,7 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                                &params.station_flags))
                return -EINVAL;
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
        if (err)
                return err;
@@ -1207,7 +1228,7 @@ static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
        if (info->attrs[NL80211_ATTR_MAC])
                mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
        if (err)
                return err;
@@ -1277,68 +1298,78 @@ static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
 }
 static int nl80211_dump_mpath(struct sk_buff *skb,
-                struct netlink_callback *cb)
+                              struct netlink_callback *cb)
 {
-        int wp_idx = 0;
-        int if_idx = 0;
-        int sta_idx = cb->args[2];
-        int wp_start = cb->args[0];
-        int if_start = cb->args[1];
        struct mpath_info pinfo;
        struct cfg80211_registered_device *dev;
-        struct wireless_dev *wdev;
+        struct net_device *netdev;
        u8 dst[ETH_ALEN];
        u8 next_hop[ETH_ALEN];
+        int ifidx = cb->args[0];
+        int path_idx = cb->args[1];
        int err;
-        int exit = 0;
-        /* TODO: filter by device */
+        if (!ifidx) {
-        mutex_lock(&cfg80211_drv_mutex);
+                err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
-        list_for_each_entry(dev, &cfg80211_drv_list, list) {
+                                  nl80211_fam.attrbuf, nl80211_fam.maxattr,
-                if (exit)
+                                  nl80211_policy);
+                if (err)
+                        return err;
+                if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
+                        return -EINVAL;
+                ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
+                if (!ifidx)
+                        return -EINVAL;
+        }
+        netdev = dev_get_by_index(&init_net, ifidx);
+        if (!netdev)
+                return -ENODEV;
+        dev = cfg80211_get_dev_from_ifindex(ifidx);
+        if (IS_ERR(dev)) {
+                err = PTR_ERR(dev);
+                goto out_put_netdev;
+        }
+        if (!dev->ops->dump_mpath) {
+                err = -ENOSYS;
+                goto out_err;
+        }
+        rtnl_lock();
+        while (1) {
+                err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
+                                           dst, next_hop, &pinfo);
+                if (err == -ENOENT)
                        break;
-                if (++wp_idx < wp_start)
+                if (err)
-                        continue;
+                        goto out_err_rtnl;
-                if_idx = 0;
-                mutex_lock(&dev->devlist_mtx);
+                if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
-                list_for_each_entry(wdev, &dev->netdev_list, list) {
+                                       cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                        if (exit)
+                                       netdev, dst, next_hop,
-                                break;
+                                       &pinfo) < 0)
-                        if (++if_idx < if_start)
+                        goto out;
-                                continue;
-                        if (!dev->ops->dump_mpath)
-                                continue;
-                        for (;; ++sta_idx) {
+                path_idx++;
-                                rtnl_lock();
-                                err = dev->ops->dump_mpath(&dev->wiphy,
-                                                wdev->netdev, sta_idx, dst,
-                                                next_hop, &pinfo);
-                                rtnl_unlock();
-                                if (err) {
-                                        sta_idx = 0;
-                                        break;
-                                }
-                                if (nl80211_send_mpath(skb,
-                                                NETLINK_CB(cb->skb).pid,
-                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                                wdev->netdev, dst, next_hop,
-                                                &pinfo) < 0) {
-                                        exit = 1;
-                                        break;
-                                }
-                        }
-                }
-                mutex_unlock(&dev->devlist_mtx);
        }
-        mutex_unlock(&cfg80211_drv_mutex);
-        cb->args[0] = wp_idx;
-        cb->args[1] = if_idx;
-        cb->args[2] = sta_idx;
-        return skb->len;
+ out:
+        cb->args[1] = path_idx;
+        err = skb->len;
+ out_err_rtnl:
+        rtnl_unlock();
+ out_err:
+        cfg80211_put_dev(dev);
+ out_put_netdev:
+        dev_put(netdev);
+        return err;
 }
 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
@@ -1358,7 +1389,7 @@ static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
        dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
        if (err)
                return err;
@@ -1411,7 +1442,7 @@ static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
        dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
        next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
        if (err)
                return err;
@@ -1446,7 +1477,7 @@ static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
        dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
        next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
        if (err)
                return err;
@@ -1475,7 +1506,7 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
        if (info->attrs[NL80211_ATTR_MAC])
                dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
        if (err)
                return err;
author	Ingo Molnar <mingo@elte.hu>	2008-08-11 02:59:21 -0400
committer	Ingo Molnar <mingo@elte.hu>	2008-08-11 02:59:21 -0400
commit	cf206bffbb7542df54043fad9898113172af99d8 (patch)
tree	c7e7ca9a93443b888f98a0c07e74751a1aa3c947 /net
parent	c1955a3d4762e7a9bf84035eb3c4886a900f0d15 (diff)
parent	796aadeb1b2db9b5d463946766c5bbfd7717158c (diff)