99 files changed, 1412 insertions, 1006 deletions
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 798beac7f100..1e308f210928 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -178,27 +178,24 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                        break;
                case 's':{
                                char **sptr = va_arg(ap, char **);
-                                int16_t len;
+                                uint16_t len;
-                                int size;
                                errcode = p9pdu_readf(pdu, proto_version,
                                                                "w", &len);
                                if (errcode)
                                        break;
-                                size = max_t(int16_t, len, 0);
+                                *sptr = kmalloc(len + 1, GFP_KERNEL);
-                                *sptr = kmalloc(size + 1, GFP_KERNEL);
                                if (*sptr == NULL) {
                                        errcode = -EFAULT;
                                        break;
                                }
-                                if (pdu_read(pdu, *sptr, size)) {
+                                if (pdu_read(pdu, *sptr, len)) {
                                        errcode = -EFAULT;
                                        kfree(*sptr);
                                        *sptr = NULL;
                                } else
-                                        (*sptr)[size] = 0;
+                                        (*sptr)[len] = 0;
                        }
                        break;
                case 'Q':{
@@ -234,14 +231,14 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                        }
                        break;
                case 'D':{
-                                int32_t *count = va_arg(ap, int32_t *);
+                                uint32_t *count = va_arg(ap, uint32_t *);
                                void **data = va_arg(ap, void **);
                                errcode =
                                    p9pdu_readf(pdu, proto_version, "d", count);
                                if (!errcode) {
                                        *count =
-                                            min_t(int32_t, *count,
+                                            min_t(uint32_t, *count,
                                                  pdu->size - pdu->offset);
                                        *data = &pdu->sdata[pdu->offset];
                                }
@@ -404,9 +401,10 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                        break;
                case 's':{
                                const char *sptr = va_arg(ap, const char *);
-                                int16_t len = 0;
+                                uint16_t len = 0;
                                if (sptr)
-                                        len = min_t(int16_t, strlen(sptr), USHRT_MAX);
+                                        len = min_t(uint16_t, strlen(sptr),
+                                                                USHRT_MAX);
                                errcode = p9pdu_writef(pdu, proto_version,
                                                                "w", len);
@@ -438,7 +436,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                                 stbuf->n_gid, stbuf->n_muid);
                        } break;
                case 'D':{
-                                int32_t count = va_arg(ap, int32_t);
+                                uint32_t count = va_arg(ap, uint32_t);
                                const void *data = va_arg(ap, const void *);
                                errcode = p9pdu_writef(pdu, proto_version, "d",
diff --git a/net/Kconfig b/net/Kconfig
index ad0aafe903f8..72840626284b 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -253,7 +253,9 @@ config NET_TCPPROBE
        what was just said, you don't need it: say N.
        Documentation on how to use TCP connection probing can be found
-        at http://linux-net.osdl.org/index.php/TcpProbe
+        at:
+        
+          http://www.linuxfoundation.org/collaborate/workgroups/networking/tcpprobe
        To compile this code as a module, choose M here: the
        module will be called tcp_probe.
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index bb86d2932394..6da5daeebab7 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1392,7 +1392,7 @@ static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
        ax25_cb *ax25;
        int err = 0;
-        memset(fsa, 0, sizeof(fsa));
+        memset(fsa, 0, sizeof(*fsa));
        lock_sock(sk);
        ax25 = ax25_sk(sk);
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 1bf0cf503796..8184c031d028 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -740,12 +740,12 @@ static int setsockopt(struct socket *sock,
                if (cf_sk->sk.sk_protocol != CAIFPROTO_UTIL)
                        return -ENOPROTOOPT;
                lock_sock(&(cf_sk->sk));
-                cf_sk->conn_req.param.size = ol;
                if (ol > sizeof(cf_sk->conn_req.param.data) ||
                        copy_from_user(&cf_sk->conn_req.param.data, ov, ol)) {
                        release_sock(&cf_sk->sk);
                        return -EINVAL;
                }
+                cf_sk->conn_req.param.size = ol;
                release_sock(&cf_sk->sk);
                return 0;
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index 84a422c98941..fa9dab372b68 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -76,6 +76,8 @@ static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
        struct chnl_net *priv  = container_of(layr, struct chnl_net, chnl);
        int pktlen;
        int err = 0;
+        const u8 *ip_version;
+        u8 buf;
        priv = container_of(layr, struct chnl_net, chnl);
@@ -90,7 +92,21 @@ static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
         * send the packet to the net stack.
         */
        skb->dev = priv->netdev;
-        skb->protocol = htons(ETH_P_IP);
+        /* check the version of IP */
+        ip_version = skb_header_pointer(skb, 0, 1, &buf);
+        if (!ip_version)
+                return -EINVAL;
+        switch (*ip_version >> 4) {
+        case 4:
+                skb->protocol = htons(ETH_P_IP);
+                break;
+        case 6:
+                skb->protocol = htons(ETH_P_IPV6);
+                break;
+        default:
+                return -EINVAL;
+        }
        /* If we change the header in loop mode, the checksum is corrupted. */
        if (priv->conn_req.protocol == CAIFPROTO_DATAGRAM_LOOP)
diff --git a/net/ceph/ceph_hash.c b/net/ceph/ceph_hash.c
index 815ef8826796..0a1b53bce76d 100644
--- a/net/ceph/ceph_hash.c
+++ b/net/ceph/ceph_hash.c
@@ -1,5 +1,6 @@
 #include <linux/ceph/types.h>
+#include <linux/module.h>
 /*
 * Robert Jenkin's hash function.
@@ -104,6 +105,7 @@ unsigned ceph_str_hash(int type, const char *s, unsigned len)
                return -1;
        }
 }
+EXPORT_SYMBOL(ceph_str_hash);
 const char *ceph_str_hash_name(int type)
 {
@@ -116,3 +118,4 @@ const char *ceph_str_hash_name(int type)
                return "unknown";
        }
 }
+EXPORT_SYMBOL(ceph_str_hash_name);
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index b6ff4a1519ab..dff633d62e5b 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -96,7 +96,7 @@ struct workqueue_struct *ceph_msgr_wq;
 int ceph_msgr_init(void)
 {
-        ceph_msgr_wq = create_workqueue("ceph-msgr");
+        ceph_msgr_wq = alloc_workqueue("ceph-msgr", WQ_NON_REENTRANT, 0);
        if (!ceph_msgr_wq) {
                pr_err("msgr_init failed to create workqueue\n");
                return -ENOMEM;
@@ -1920,20 +1920,6 @@ bad_tag:
 /*
 * Atomically queue work on a connection.  Bump @con reference to
 * avoid races with connection teardown.
- *
- * There is some trickery going on with QUEUED and BUSY because we
- * only want a _single_ thread operating on each connection at any
- * point in time, but we want to use all available CPUs.
- *
- * The worker thread only proceeds if it can atomically set BUSY.  It
- * clears QUEUED and does it's thing.  When it thinks it's done, it
- * clears BUSY, then rechecks QUEUED.. if it's set again, it loops
- * (tries again to set BUSY).
- *
- * To queue work, we first set QUEUED, _then_ if BUSY isn't set, we
- * try to queue work.  If that fails (work is already queued, or BUSY)
- * we give up (work also already being done or is queued) but leave QUEUED
- * set so that the worker thread will loop if necessary.
 */
 static void queue_con(struct ceph_connection *con)
 {
@@ -1948,11 +1934,7 @@ static void queue_con(struct ceph_connection *con)
                return;
        }
-        set_bit(QUEUED, &con->state);
+        if (!queue_delayed_work(ceph_msgr_wq, &con->work, 0)) {
-        if (test_bit(BUSY, &con->state)) {
-                dout("queue_con %p - already BUSY\n", con);
-                con->ops->put(con);
-        } else if (!queue_work(ceph_msgr_wq, &con->work.work)) {
                dout("queue_con %p - already queued\n", con);
                con->ops->put(con);
        } else {
@@ -1967,15 +1949,6 @@ static void con_work(struct work_struct *work)
 {
        struct ceph_connection *con = container_of(work, struct ceph_connection,
                                                   work.work);
-        int backoff = 0;
-more:
-        if (test_and_set_bit(BUSY, &con->state) != 0) {
-                dout("con_work %p BUSY already set\n", con);
-                goto out;
-        }
-        dout("con_work %p start, clearing QUEUED\n", con);
-        clear_bit(QUEUED, &con->state);
        mutex_lock(&con->mutex);
@@ -1994,28 +1967,13 @@ more:
            try_read(con) < 0 ||
            try_write(con) < 0) {
                mutex_unlock(&con->mutex);
-                backoff = 1;
                ceph_fault(con);     /* error/fault path */
                goto done_unlocked;
        }
 done:
        mutex_unlock(&con->mutex);
 done_unlocked:
-        clear_bit(BUSY, &con->state);
-        dout("con->state=%lu\n", con->state);
-        if (test_bit(QUEUED, &con->state)) {
-                if (!backoff || test_bit(OPENING, &con->state)) {
-                        dout("con_work %p QUEUED reset, looping\n", con);
-                        goto more;
-                }
-                dout("con_work %p QUEUED reset, but just faulted\n", con);
-                clear_bit(QUEUED, &con->state);
-        }
-        dout("con_work %p done\n", con);
-out:
        con->ops->put(con);
 }
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index d73f3f6efa36..71603ac3dff5 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -605,8 +605,10 @@ struct ceph_osdmap *osdmap_decode(void **p, void *end)
                        goto bad;
                }
                err = __decode_pool(p, end, pi);
-                if (err < 0)
+                if (err < 0) {
+                        kfree(pi);
                        goto bad;
+                }
                __insert_pg_pool(&map->pg_pools, pi);
        }
diff --git a/net/core/dev.c b/net/core/dev.c
index 3fe443be4b15..54277df0f735 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2297,7 +2297,10 @@ static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q,
                 */
                if (!(dev->priv_flags & IFF_XMIT_DST_RELEASE))
                        skb_dst_force(skb);
-                __qdisc_update_bstats(q, skb->len);
+                qdisc_skb_cb(skb)->pkt_len = skb->len;
+                qdisc_bstats_update(q, skb);
                if (sch_direct_xmit(skb, q, dev, txq, root_lock)) {
                        if (unlikely(contended)) {
                                spin_unlock(&q->busylock);
@@ -5520,34 +5523,6 @@ void netdev_run_todo(void)
        }
 }
-/**
- *      dev_txq_stats_fold - fold tx_queues stats
- *      @dev: device to get statistics from
- *      @stats: struct rtnl_link_stats64 to hold results
- */
-void dev_txq_stats_fold(const struct net_device *dev,
-                        struct rtnl_link_stats64 *stats)
-{
-        u64 tx_bytes = 0, tx_packets = 0, tx_dropped = 0;
-        unsigned int i;
-        struct netdev_queue *txq;
-        for (i = 0; i < dev->num_tx_queues; i++) {
-                txq = netdev_get_tx_queue(dev, i);
-                spin_lock_bh(&txq->_xmit_lock);
-                tx_bytes   += txq->tx_bytes;
-                tx_packets += txq->tx_packets;
-                tx_dropped += txq->tx_dropped;
-                spin_unlock_bh(&txq->_xmit_lock);
-        }
-        if (tx_bytes || tx_packets || tx_dropped) {
-                stats->tx_bytes   = tx_bytes;
-                stats->tx_packets = tx_packets;
-                stats->tx_dropped = tx_dropped;
-        }
-}
-EXPORT_SYMBOL(dev_txq_stats_fold);
 /* Convert net_device_stats to rtnl_link_stats64.  They have the same
 * fields in the same order, with only the type differing.
 */
@@ -5591,7 +5566,6 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
                netdev_stats_to_stats64(storage, ops->ndo_get_stats(dev));
        } else {
                netdev_stats_to_stats64(storage, &dev->stats);
-                dev_txq_stats_fold(dev, storage);
        }
        storage->rx_dropped += atomic_long_read(&dev->rx_dropped);
        return storage;
@@ -5617,18 +5591,20 @@ struct netdev_queue *dev_ingress_queue_create(struct net_device *dev)
 }
 /**
- *      alloc_netdev_mq - allocate network device
+ *      alloc_netdev_mqs - allocate network device
 *      @sizeof_priv:   size of private data to allocate space for
 *      @name:          device name format string
 *      @setup:         callback to initialize device
- *      @queue_count:   the number of subqueues to allocate
+ *      @txqs:          the number of TX subqueues to allocate
+ *      @rxqs:          the number of RX subqueues to allocate
 *
 *      Allocates a struct net_device with private data area for driver use
 *      and performs basic initialization.  Also allocates subquue structs
- *      for each queue on the device at the end of the netdevice.
+ *      for each queue on the device.
 */
-struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
+struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
-                void (*setup)(struct net_device *), unsigned int queue_count)
+                void (*setup)(struct net_device *),
+                unsigned int txqs, unsigned int rxqs)
 {
        struct net_device *dev;
        size_t alloc_size;
@@ -5636,12 +5612,20 @@ struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
        BUG_ON(strlen(name) >= sizeof(dev->name));
-        if (queue_count < 1) {
+        if (txqs < 1) {
                pr_err("alloc_netdev: Unable to allocate device "
                       "with zero queues.\n");
                return NULL;
        }
+#ifdef CONFIG_RPS
+        if (rxqs < 1) {
+                pr_err("alloc_netdev: Unable to allocate device "
+                       "with zero RX queues.\n");
+                return NULL;
+        }
+#endif
        alloc_size = sizeof(struct net_device);
        if (sizeof_priv) {
                /* ensure 32-byte alignment of private area */
@@ -5672,14 +5656,14 @@ struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
        dev_net_set(dev, &init_net);
-        dev->num_tx_queues = queue_count;
+        dev->num_tx_queues = txqs;
-        dev->real_num_tx_queues = queue_count;
+        dev->real_num_tx_queues = txqs;
        if (netif_alloc_netdev_queues(dev))
                goto free_pcpu;
 #ifdef CONFIG_RPS
-        dev->num_rx_queues = queue_count;
+        dev->num_rx_queues = rxqs;
-        dev->real_num_rx_queues = queue_count;
+        dev->real_num_rx_queues = rxqs;
        if (netif_alloc_rx_queues(dev))
                goto free_pcpu;
 #endif
@@ -5707,7 +5691,7 @@ free_p:
        kfree(p);
        return NULL;
 }
-EXPORT_SYMBOL(alloc_netdev_mq);
+EXPORT_SYMBOL(alloc_netdev_mqs);
 /**
 *      free_netdev - free network device
@@ -6205,7 +6189,7 @@ static void __net_exit default_device_exit(struct net *net)
 static void __net_exit default_device_exit_batch(struct list_head *net_list)
 {
        /* At exit all network devices most be removed from a network
-         * namespace.  Do this in the reverse order of registeration.
+         * namespace.  Do this in the reverse order of registration.
         * Do this across as many network namespaces as possible to
         * improve batching efficiency.
         */
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 19d6c21220fd..d31bb36ae0dc 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -380,6 +380,8 @@ static void skb_release_head_state(struct sk_buff *skb)
        }
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
        nf_conntrack_put(skb->nfct);
+#endif
+#ifdef NET_SKBUFF_NF_DEFRAG_NEEDED
        nf_conntrack_put_reasm(skb->nfct_reasm);
 #endif
 #ifdef CONFIG_BRIDGE_NETFILTER
diff --git a/net/core/sock.c b/net/core/sock.c
index a658aeb6d554..7dfed792434d 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -157,7 +157,7 @@ static const char *const af_family_key_strings[AF_MAX+1] = {
  "sk_lock-27"       , "sk_lock-28"          , "sk_lock-AF_CAN"      ,
  "sk_lock-AF_TIPC"  , "sk_lock-AF_BLUETOOTH", "sk_lock-IUCV"        ,
  "sk_lock-AF_RXRPC" , "sk_lock-AF_ISDN"     , "sk_lock-AF_PHONET"   ,
-  "sk_lock-AF_IEEE802154", "sk_lock-AF_CAIF" ,
+  "sk_lock-AF_IEEE802154", "sk_lock-AF_CAIF" , "sk_lock-AF_ALG"      ,
  "sk_lock-AF_MAX"
 };
 static const char *const af_family_slock_key_strings[AF_MAX+1] = {
@@ -173,7 +173,7 @@ static const char *const af_family_slock_key_strings[AF_MAX+1] = {
  "slock-27"       , "slock-28"          , "slock-AF_CAN"      ,
  "slock-AF_TIPC"  , "slock-AF_BLUETOOTH", "slock-AF_IUCV"     ,
  "slock-AF_RXRPC" , "slock-AF_ISDN"     , "slock-AF_PHONET"   ,
-  "slock-AF_IEEE802154", "slock-AF_CAIF" ,
+  "slock-AF_IEEE802154", "slock-AF_CAIF" , "slock-AF_ALG"      ,
  "slock-AF_MAX"
 };
 static const char *const af_family_clock_key_strings[AF_MAX+1] = {
@@ -189,7 +189,7 @@ static const char *const af_family_clock_key_strings[AF_MAX+1] = {
  "clock-27"       , "clock-28"          , "clock-AF_CAN"      ,
  "clock-AF_TIPC"  , "clock-AF_BLUETOOTH", "clock-AF_IUCV"     ,
  "clock-AF_RXRPC" , "clock-AF_ISDN"     , "clock-AF_PHONET"   ,
-  "clock-AF_IEEE802154", "clock-AF_CAIF" ,
+  "clock-AF_IEEE802154", "clock-AF_CAIF" , "clock-AF_ALG"      ,
  "clock-AF_MAX"
 };
diff --git a/net/dccp/Kconfig b/net/dccp/Kconfig
index ad6dffd9070e..b75968a04017 100644
--- a/net/dccp/Kconfig
+++ b/net/dccp/Kconfig
@@ -49,7 +49,9 @@ config NET_DCCPPROBE
        what was just said, you don't need it: say N.
        Documentation on how to use DCCP connection probing can be found
-        at http://linux-net.osdl.org/index.php/DccpProbe
+        at:
+        
+          http://www.linuxfoundation.org/collaborate/workgroups/networking/dccpprobe
        To compile this code as a module, choose M here: the
        module will be called dccp_probe.
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index 0ba15633c418..0dcaa903e00e 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -1130,7 +1130,7 @@ static struct dn_dev *dn_dev_create(struct net_device *dev, int *err)
 /*
 * This processes a device up event. We only start up
 * the loopback device & ethernet devices with correct
- * MAC addreses automatically. Others must be started
+ * MAC addresses automatically. Others must be started
 * specifically.
 *
 * FIXME: How should we configure the loopback address ? If we could dispense
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index f00ef2f1d814..44d2b42fda56 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -347,10 +347,11 @@ void ether_setup(struct net_device *dev)
 EXPORT_SYMBOL(ether_setup);
 /**
- * alloc_etherdev_mq - Allocates and sets up an Ethernet device
+ * alloc_etherdev_mqs - Allocates and sets up an Ethernet device
 * @sizeof_priv: Size of additional driver-private structure to be allocated
 *      for this Ethernet device
- * @queue_count: The number of queues this device has.
+ * @txqs: The number of TX queues this device has.
+ * @rxqs: The number of RX queues this device has.
 *
 * Fill in the fields of the device structure with Ethernet-generic
 * values. Basically does everything except registering the device.
@@ -360,11 +361,12 @@ EXPORT_SYMBOL(ether_setup);
 * this private data area.
 */
-struct net_device *alloc_etherdev_mq(int sizeof_priv, unsigned int queue_count)
+struct net_device *alloc_etherdev_mqs(int sizeof_priv, unsigned int txqs,
+                                      unsigned int rxqs)
 {
-        return alloc_netdev_mq(sizeof_priv, "eth%d", ether_setup, queue_count);
+        return alloc_netdev_mqs(sizeof_priv, "eth%d", ether_setup, txqs, rxqs);
 }
-EXPORT_SYMBOL(alloc_etherdev_mq);
+EXPORT_SYMBOL(alloc_etherdev_mqs);
 static size_t _format_mac_addr(char *buf, int buflen,
                               const unsigned char *addr, int len)
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 9e95d7fb6d5a..a5a1050595d1 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -432,7 +432,9 @@ config INET_DIAG
        ---help---
          Support for INET (TCP, DCCP, etc) socket monitoring interface used by
          native Linux tools such as ss. ss is included in iproute2, currently
-          downloadable at <http://linux-net.osdl.org/index.php/Iproute2>.
+          downloadable at:
+          
+            http://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2
          If unsure, say Y.
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 880a5ec6dce0..86961bec70ab 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -314,14 +314,15 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
        skb->ip_summed = CHECKSUM_NONE;
-        ah = (struct ip_auth_hdr *)skb->data;
-        iph = ip_hdr(skb);
-        ihl = ip_hdrlen(skb);
        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
                goto out;
        nfrags = err;
+        ah = (struct ip_auth_hdr *)skb->data;
+        iph = ip_hdr(skb);
+        ihl = ip_hdrlen(skb);
        work_iph = ah_alloc_tmp(ahash, nfrags, ihl + ahp->icv_trunc_len);
        if (!work_iph)
                goto out;
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index a2fc7b961dbc..04c8b69fd426 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1143,6 +1143,23 @@ static int arp_req_get(struct arpreq *r, struct net_device *dev)
        return err;
 }
+int arp_invalidate(struct net_device *dev, __be32 ip)
+{
+        struct neighbour *neigh = neigh_lookup(&arp_tbl, &ip, dev);
+        int err = -ENXIO;
+        if (neigh) {
+                if (neigh->nud_state & ~NUD_NOARP)
+                        err = neigh_update(neigh, NULL, NUD_FAILED,
+                                           NEIGH_UPDATE_F_OVERRIDE|
+                                           NEIGH_UPDATE_F_ADMIN);
+                neigh_release(neigh);
+        }
+        return err;
+}
+EXPORT_SYMBOL(arp_invalidate);
 static int arp_req_delete_public(struct net *net, struct arpreq *r,
                struct net_device *dev)
 {
@@ -1163,7 +1180,6 @@ static int arp_req_delete(struct net *net, struct arpreq *r,
 {
        int err;
        __be32 ip;
-        struct neighbour *neigh;
        if (r->arp_flags & ATF_PUBL)
                return arp_req_delete_public(net, r, dev);
@@ -1181,16 +1197,7 @@ static int arp_req_delete(struct net *net, struct arpreq *r,
                if (!dev)
                        return -EINVAL;
        }
-        err = -ENXIO;
+        return arp_invalidate(dev, ip);
-        neigh = neigh_lookup(&arp_tbl, &ip, dev);
-        if (neigh) {
-                if (neigh->nud_state & ~NUD_NOARP)
-                        err = neigh_update(neigh, NULL, NUD_FAILED,
-                                           NEIGH_UPDATE_F_OVERRIDE|
-                                           NEIGH_UPDATE_F_ADMIN);
-                neigh_release(neigh);
-        }
-        return err;
 }
 /*
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 25e318153f14..97e5fb765265 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -73,7 +73,7 @@ int inet_csk_bind_conflict(const struct sock *sk,
                     !sk2->sk_bound_dev_if ||
                     sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) {
                        if (!reuse || !sk2->sk_reuse ||
-                            sk2->sk_state == TCP_LISTEN) {
+                            ((1 << sk2->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))) {
                                const __be32 sk2_rcv_saddr = sk_rcv_saddr(sk2);
                                if (!sk2_rcv_saddr || !sk_rcv_saddr(sk) ||
                                    sk2_rcv_saddr == sk_rcv_saddr(sk))
@@ -122,7 +122,8 @@ again:
                                            (tb->num_owners < smallest_size || smallest_size == -1)) {
                                                smallest_size = tb->num_owners;
                                                smallest_rover = rover;
-                                                if (atomic_read(&hashinfo->bsockets) > (high - low) + 1) {
+                                                if (atomic_read(&hashinfo->bsockets) > (high - low) + 1 &&
+                                                    !inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
                                                        spin_unlock(&head->lock);
                                                        snum = smallest_rover;
                                                        goto have_snum;
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 3fac340a28d5..e855fffaed95 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -710,42 +710,25 @@ static void get_counters(const struct xt_table_info *t,
        struct arpt_entry *iter;
        unsigned int cpu;
        unsigned int i;
-        unsigned int curcpu = get_cpu();
-        /* Instead of clearing (by a previous call to memset())
-         * the counters and using adds, we set the counters
-         * with data used by 'current' CPU
-         *
-         * Bottom half has to be disabled to prevent deadlock
-         * if new softirq were to run and call ipt_do_table
-         */
-        local_bh_disable();
-        i = 0;
-        xt_entry_foreach(iter, t->entries[curcpu], t->size) {
-                SET_COUNTER(counters[i], iter->counters.bcnt,
-                            iter->counters.pcnt);
-                ++i;
-        }
-        local_bh_enable();
-        /* Processing counters from other cpus, we can let bottom half enabled,
-         * (preemption is disabled)
-         */
        for_each_possible_cpu(cpu) {
-                if (cpu == curcpu)
+                seqlock_t *lock = &per_cpu(xt_info_locks, cpu).lock;
-                        continue;
                i = 0;
-                local_bh_disable();
-                xt_info_wrlock(cpu);
                xt_entry_foreach(iter, t->entries[cpu], t->size) {
-                        ADD_COUNTER(counters[i], iter->counters.bcnt,
+                        u64 bcnt, pcnt;
-                                    iter->counters.pcnt);
+                        unsigned int start;
+                        do {
+                                start = read_seqbegin(lock);
+                                bcnt = iter->counters.bcnt;
+                                pcnt = iter->counters.pcnt;
+                        } while (read_seqretry(lock, start));
+                        ADD_COUNTER(counters[i], bcnt, pcnt);
                        ++i;
                }
-                xt_info_wrunlock(cpu);
-                local_bh_enable();
        }
-        put_cpu();
 }
 static struct xt_counters *alloc_counters(const struct xt_table *table)
@@ -759,7 +742,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
         * about).
         */
        countersize = sizeof(struct xt_counters) * private->number;
-        counters = vmalloc(countersize);
+        counters = vzalloc(countersize);
        if (counters == NULL)
                return ERR_PTR(-ENOMEM);
@@ -1007,7 +990,7 @@ static int __do_replace(struct net *net, const char *name,
        struct arpt_entry *iter;
        ret = 0;
-        counters = vmalloc(num_counters * sizeof(struct xt_counters));
+        counters = vzalloc(num_counters * sizeof(struct xt_counters));
        if (!counters) {
                ret = -ENOMEM;
                goto out;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index a846d633b3b6..652efea013dc 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -884,42 +884,25 @@ get_counters(const struct xt_table_info *t,
        struct ipt_entry *iter;
        unsigned int cpu;
        unsigned int i;
-        unsigned int curcpu = get_cpu();
-        /* Instead of clearing (by a previous call to memset())
-         * the counters and using adds, we set the counters
-         * with data used by 'current' CPU.
-         *
-         * Bottom half has to be disabled to prevent deadlock
-         * if new softirq were to run and call ipt_do_table
-         */
-        local_bh_disable();
-        i = 0;
-        xt_entry_foreach(iter, t->entries[curcpu], t->size) {
-                SET_COUNTER(counters[i], iter->counters.bcnt,
-                            iter->counters.pcnt);
-                ++i;
-        }
-        local_bh_enable();
-        /* Processing counters from other cpus, we can let bottom half enabled,
-         * (preemption is disabled)
-         */
        for_each_possible_cpu(cpu) {
-                if (cpu == curcpu)
+                seqlock_t *lock = &per_cpu(xt_info_locks, cpu).lock;
-                        continue;
                i = 0;
-                local_bh_disable();
-                xt_info_wrlock(cpu);
                xt_entry_foreach(iter, t->entries[cpu], t->size) {
-                        ADD_COUNTER(counters[i], iter->counters.bcnt,
+                        u64 bcnt, pcnt;
-                                    iter->counters.pcnt);
+                        unsigned int start;
+                        do {
+                                start = read_seqbegin(lock);
+                                bcnt = iter->counters.bcnt;
+                                pcnt = iter->counters.pcnt;
+                        } while (read_seqretry(lock, start));
+                        ADD_COUNTER(counters[i], bcnt, pcnt);
                        ++i; /* macro does multi eval of i */
                }
-                xt_info_wrunlock(cpu);
-                local_bh_enable();
        }
-        put_cpu();
 }
 static struct xt_counters *alloc_counters(const struct xt_table *table)
@@ -932,7 +915,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
           (other than comefrom, which userspace doesn't care
           about). */
        countersize = sizeof(struct xt_counters) * private->number;
-        counters = vmalloc(countersize);
+        counters = vzalloc(countersize);
        if (counters == NULL)
                return ERR_PTR(-ENOMEM);
@@ -1203,7 +1186,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
        struct ipt_entry *iter;
        ret = 0;
-        counters = vmalloc(num_counters * sizeof(struct xt_counters));
+        counters = vzalloc(num_counters * sizeof(struct xt_counters));
        if (!counters) {
                ret = -ENOMEM;
                goto out;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index dc7c096ddfef..406f320336e6 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1350,7 +1350,7 @@ static inline unsigned int tcp_cwnd_test(struct tcp_sock *tp,
        return 0;
 }
-/* Intialize TSO state of a skb.
+/* Initialize TSO state of a skb.
 * This must be invoked the first time we consider transmitting
 * SKB onto the wire.
 */
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 059a3de647db..978e80e2c4a8 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -300,7 +300,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                        goto out;
                }
-                /* Reproduce AF_INET checks to make the bindings consitant */
+                /* Reproduce AF_INET checks to make the bindings consistent */
                v4addr = addr->sin6_addr.s6_addr32[3];
                chk_addr_ret = inet_addr_type(net, v4addr);
                if (!sysctl_ip_nonlocal_bind &&
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index ee82d4ef26ce..1aba54ae53c4 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -538,14 +538,16 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
        if (!pskb_may_pull(skb, ah_hlen))
                goto out;
-        ip6h = ipv6_hdr(skb);
-        skb_push(skb, hdr_len);
        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
                goto out;
        nfrags = err;
+        ah = (struct ip_auth_hdr *)skb->data;
+        ip6h = ipv6_hdr(skb);
+        skb_push(skb, hdr_len);
        work_iph = ah_alloc_tmp(ahash, nfrags, hdr_len + ahp->icv_trunc_len);
        if (!work_iph)
                goto out;
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index e46305d1815a..d144e629d2b4 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -44,7 +44,7 @@ int inet6_csk_bind_conflict(const struct sock *sk,
                     !sk2->sk_bound_dev_if ||
                     sk->sk_bound_dev_if == sk2->sk_bound_dev_if) &&
                    (!sk->sk_reuse || !sk2->sk_reuse ||
-                     sk2->sk_state == TCP_LISTEN) &&
+                     ((1 << sk2->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))) &&
                     ipv6_rcv_saddr_equal(sk, sk2))
                        break;
        }
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 94b5bf132b2e..5f8d242be3f3 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -401,6 +401,9 @@ int ip6_forward(struct sk_buff *skb)
                goto drop;
        }
+        if (skb->pkt_type != PACKET_HOST)
+                goto drop;
        skb_forward_csum(skb);
        /*
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 455582384ece..7d227c644f72 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -897,42 +897,25 @@ get_counters(const struct xt_table_info *t,
        struct ip6t_entry *iter;
        unsigned int cpu;
        unsigned int i;
-        unsigned int curcpu = get_cpu();
-        /* Instead of clearing (by a previous call to memset())
-         * the counters and using adds, we set the counters
-         * with data used by 'current' CPU
-         *
-         * Bottom half has to be disabled to prevent deadlock
-         * if new softirq were to run and call ipt_do_table
-         */
-        local_bh_disable();
-        i = 0;
-        xt_entry_foreach(iter, t->entries[curcpu], t->size) {
-                SET_COUNTER(counters[i], iter->counters.bcnt,
-                            iter->counters.pcnt);
-                ++i;
-        }
-        local_bh_enable();
-        /* Processing counters from other cpus, we can let bottom half enabled,
-         * (preemption is disabled)
-         */
        for_each_possible_cpu(cpu) {
-                if (cpu == curcpu)
+                seqlock_t *lock = &per_cpu(xt_info_locks, cpu).lock;
-                        continue;
                i = 0;
-                local_bh_disable();
-                xt_info_wrlock(cpu);
                xt_entry_foreach(iter, t->entries[cpu], t->size) {
-                        ADD_COUNTER(counters[i], iter->counters.bcnt,
+                        u64 bcnt, pcnt;
-                                    iter->counters.pcnt);
+                        unsigned int start;
+                        do {
+                                start = read_seqbegin(lock);
+                                bcnt = iter->counters.bcnt;
+                                pcnt = iter->counters.pcnt;
+                        } while (read_seqretry(lock, start));
+                        ADD_COUNTER(counters[i], bcnt, pcnt);
                        ++i;
                }
-                xt_info_wrunlock(cpu);
-                local_bh_enable();
        }
-        put_cpu();
 }
 static struct xt_counters *alloc_counters(const struct xt_table *table)
@@ -945,7 +928,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
           (other than comefrom, which userspace doesn't care
           about). */
        countersize = sizeof(struct xt_counters) * private->number;
-        counters = vmalloc(countersize);
+        counters = vzalloc(countersize);
        if (counters == NULL)
                return ERR_PTR(-ENOMEM);
@@ -1216,7 +1199,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
        struct ip6t_entry *iter;
        ret = 0;
-        counters = vmalloc(num_counters * sizeof(struct xt_counters));
+        counters = vzalloc(num_counters * sizeof(struct xt_counters));
        if (!counters) {
                ret = -ENOMEM;
                goto out;
diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
index 99abfb53bab9..97c5b21b9674 100644
--- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
+++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
@@ -19,13 +19,15 @@
 #include <linux/netfilter_ipv6.h>
 #include <linux/netfilter_bridge.h>
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_core.h>
-#include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
+#endif
+#include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
@@ -33,8 +35,10 @@ static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
 {
        u16 zone = NF_CT_DEFAULT_ZONE;
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
        if (skb->nfct)
                zone = nf_ct_zone((struct nf_conn *)skb->nfct);
+#endif
 #ifdef CONFIG_BRIDGE_NETFILTER
        if (skb->nf_bridge &&
@@ -56,9 +60,11 @@ static unsigned int ipv6_defrag(unsigned int hooknum,
 {
        struct sk_buff *reasm;
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
        /* Previously seen (loopback)?  */
        if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct))
                return NF_ACCEPT;
+#endif
        reasm = nf_ct_frag6_gather(skb, nf_ct6_defrag_user(hooknum, skb));
        /* queued */
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 227ca82eef72..0c9d0c07eae6 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -76,7 +76,7 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
 #endif /* CONFIG_MAC80211_HT_DEBUG */
        if (drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_STOP,
-                             &sta->sta, tid, NULL))
+                             &sta->sta, tid, NULL, 0))
                printk(KERN_DEBUG "HW problem - can not stop rx "
                                "aggregation for tid %d\n", tid);
@@ -232,6 +232,9 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
        if (buf_size == 0)
                buf_size = IEEE80211_MAX_AMPDU_BUF;
+        /* make sure the size doesn't exceed the maximum supported by the hw */
+        if (buf_size > local->hw.max_rx_aggregation_subframes)
+                buf_size = local->hw.max_rx_aggregation_subframes;
        /* examine state machine */
        mutex_lock(&sta->ampdu_mlme.mtx);
@@ -287,7 +290,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
        }
        ret = drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_START,
-                               &sta->sta, tid, &start_seq_num);
+                               &sta->sta, tid, &start_seq_num, 0);
 #ifdef CONFIG_MAC80211_HT_DEBUG
        printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 9cc472c6a6a5..63d852cb4ca2 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -190,7 +190,7 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
        ret = drv_ampdu_action(local, sta->sdata,
                               IEEE80211_AMPDU_TX_STOP,
-                               &sta->sta, tid, NULL);
+                               &sta->sta, tid, NULL, 0);
        /* HW shall not deny going back to legacy */
        if (WARN_ON(ret)) {
@@ -311,7 +311,7 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
        start_seq_num = sta->tid_seq[tid] >> 4;
        ret = drv_ampdu_action(local, sdata, IEEE80211_AMPDU_TX_START,
-                               &sta->sta, tid, &start_seq_num);
+                               &sta->sta, tid, &start_seq_num, 0);
        if (ret) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                printk(KERN_DEBUG "BA request denied - HW unavailable for"
@@ -342,7 +342,8 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
        /* send AddBA request */
        ieee80211_send_addba_request(sdata, sta->sta.addr, tid,
                                     tid_tx->dialog_token, start_seq_num,
-                                     0x40, tid_tx->timeout);
+                                     local->hw.max_tx_aggregation_subframes,
+                                     tid_tx->timeout);
 }
 int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
@@ -487,7 +488,8 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
        drv_ampdu_action(local, sta->sdata,
                         IEEE80211_AMPDU_TX_OPERATIONAL,
-                         &sta->sta, tid, NULL);
+                         &sta->sta, tid, NULL,
+                         sta->ampdu_mlme.tid_tx[tid]->buf_size);
        /*
         * synchronize with TX path, while splicing the TX path
@@ -742,9 +744,11 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
 {
        struct tid_ampdu_tx *tid_tx;
        u16 capab, tid;
+        u8 buf_size;
        capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
+        buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
        mutex_lock(&sta->ampdu_mlme.mtx);
@@ -767,12 +771,23 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
        if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
                        == WLAN_STATUS_SUCCESS) {
+                /*
+                 * IEEE 802.11-2007 7.3.1.14:
+                 * In an ADDBA Response frame, when the Status Code field
+                 * is set to 0, the Buffer Size subfield is set to a value
+                 * of at least 1.
+                 */
+                if (!buf_size)
+                        goto out;
                if (test_and_set_bit(HT_AGG_STATE_RESPONSE_RECEIVED,
                                     &tid_tx->state)) {
                        /* ignore duplicate response */
                        goto out;
                }
+                tid_tx->buf_size = buf_size;
                if (test_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state))
                        ieee80211_agg_tx_operational(local, sta, tid);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 4bc8a9250cfd..845c76d58d25 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1215,6 +1215,9 @@ static int ieee80211_set_channel(struct wiphy *wiphy,
 {
        struct ieee80211_local *local = wiphy_priv(wiphy);
        struct ieee80211_sub_if_data *sdata = NULL;
+        struct ieee80211_channel *old_oper;
+        enum nl80211_channel_type old_oper_type;
+        enum nl80211_channel_type old_vif_oper_type= NL80211_CHAN_NO_HT;
        if (netdev)
                sdata = IEEE80211_DEV_TO_SUB_IF(netdev);
@@ -1232,13 +1235,23 @@ static int ieee80211_set_channel(struct wiphy *wiphy,
                break;
        }
-        local->oper_channel = chan;
+        if (sdata)
+                old_vif_oper_type = sdata->vif.bss_conf.channel_type;
+        old_oper_type = local->_oper_channel_type;
        if (!ieee80211_set_channel_type(local, sdata, channel_type))
                return -EBUSY;
-        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+        old_oper = local->oper_channel;
-        if (sdata && sdata->vif.type != NL80211_IFTYPE_MONITOR)
+        local->oper_channel = chan;
+        /* Update driver if changes were actually made. */
+        if ((old_oper != local->oper_channel) ||
+            (old_oper_type != local->_oper_channel_type))
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+        if ((sdata && sdata->vif.type != NL80211_IFTYPE_MONITOR) &&
+            old_vif_oper_type != sdata->vif.bss_conf.channel_type)
                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_HT);
        return 0;
@@ -1274,8 +1287,11 @@ static int ieee80211_scan(struct wiphy *wiphy,
        case NL80211_IFTYPE_P2P_GO:
                if (sdata->local->ops->hw_scan)
                        break;
-                /* FIXME: implement NoA while scanning in software */
+                /*
-                return -EOPNOTSUPP;
+                 * FIXME: implement NoA while scanning in software,
+                 * for now fall through to allow scanning only when
+                 * beaconing hasn't been configured yet
+                 */
        case NL80211_IFTYPE_AP:
                if (sdata->u.ap.beacon)
                        return -EOPNOTSUPP;
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 2dabdf7680d0..dacace6b1393 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -36,7 +36,7 @@ static ssize_t ieee80211_if_read(
                ret = (*format)(sdata, buf, sizeof(buf));
        read_unlock(&dev_base_lock);
-        if (ret != -EINVAL)
+        if (ret >= 0)
                ret = simple_read_from_buffer(userbuf, count, ppos, buf, ret);
        return ret;
@@ -81,6 +81,8 @@ static ssize_t ieee80211_if_fmt_##name(					\
                IEEE80211_IF_FMT(name, field, "%d\n")
 #define IEEE80211_IF_FMT_HEX(name, field)                               \
                IEEE80211_IF_FMT(name, field, "%#x\n")
+#define IEEE80211_IF_FMT_LHEX(name, field)                              \
+                IEEE80211_IF_FMT(name, field, "%#lx\n")
 #define IEEE80211_IF_FMT_SIZE(name, field)                              \
                IEEE80211_IF_FMT(name, field, "%zd\n")
@@ -145,6 +147,9 @@ IEEE80211_IF_FILE(rc_rateidx_mask_2ghz, rc_rateidx_mask[IEEE80211_BAND_2GHZ],
                  HEX);
 IEEE80211_IF_FILE(rc_rateidx_mask_5ghz, rc_rateidx_mask[IEEE80211_BAND_5GHZ],
                  HEX);
+IEEE80211_IF_FILE(flags, flags, HEX);
+IEEE80211_IF_FILE(state, state, LHEX);
+IEEE80211_IF_FILE(channel_type, vif.bss_conf.channel_type, DEC);
 /* STA attributes */
 IEEE80211_IF_FILE(bssid, u.mgd.bssid, MAC);
@@ -216,6 +221,104 @@ static ssize_t ieee80211_if_parse_smps(struct ieee80211_sub_if_data *sdata,
 __IEEE80211_IF_FILE_W(smps);
+static ssize_t ieee80211_if_fmt_tkip_mic_test(
+        const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
+{
+        return -EOPNOTSUPP;
+}
+static int hwaddr_aton(const char *txt, u8 *addr)
+{
+        int i;
+        for (i = 0; i < ETH_ALEN; i++) {
+                int a, b;
+                a = hex_to_bin(*txt++);
+                if (a < 0)
+                        return -1;
+                b = hex_to_bin(*txt++);
+                if (b < 0)
+                        return -1;
+                *addr++ = (a << 4) | b;
+                if (i < 5 && *txt++ != ':')
+                        return -1;
+        }
+        return 0;
+}
+static ssize_t ieee80211_if_parse_tkip_mic_test(
+        struct ieee80211_sub_if_data *sdata, const char *buf, int buflen)
+{
+        struct ieee80211_local *local = sdata->local;
+        u8 addr[ETH_ALEN];
+        struct sk_buff *skb;
+        struct ieee80211_hdr *hdr;
+        __le16 fc;
+        /*
+         * Assume colon-delimited MAC address with possible white space
+         * following.
+         */
+        if (buflen < 3 * ETH_ALEN - 1)
+                return -EINVAL;
+        if (hwaddr_aton(buf, addr) < 0)
+                return -EINVAL;
+        if (!ieee80211_sdata_running(sdata))
+                return -ENOTCONN;
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24 + 100);
+        if (!skb)
+                return -ENOMEM;
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        hdr = (struct ieee80211_hdr *) skb_put(skb, 24);
+        memset(hdr, 0, 24);
+        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP:
+                fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
+                /* DA BSSID SA */
+                memcpy(hdr->addr1, addr, ETH_ALEN);
+                memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
+                memcpy(hdr->addr3, sdata->vif.addr, ETH_ALEN);
+                break;
+        case NL80211_IFTYPE_STATION:
+                fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
+                /* BSSID SA DA */
+                if (sdata->vif.bss_conf.bssid == NULL) {
+                        dev_kfree_skb(skb);
+                        return -ENOTCONN;
+                }
+                memcpy(hdr->addr1, sdata->vif.bss_conf.bssid, ETH_ALEN);
+                memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
+                memcpy(hdr->addr3, addr, ETH_ALEN);
+                break;
+        default:
+                dev_kfree_skb(skb);
+                return -EOPNOTSUPP;
+        }
+        hdr->frame_control = fc;
+        /*
+         * Add some length to the test frame to make it look bit more valid.
+         * The exact contents does not matter since the recipient is required
+         * to drop this because of the Michael MIC failure.
+         */
+        memset(skb_put(skb, 50), 0, 50);
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_TKIP_MIC_FAILURE;
+        ieee80211_tx_skb(sdata, skb);
+        return buflen;
+}
+__IEEE80211_IF_FILE_W(tkip_mic_test);
 /* AP attributes */
 IEEE80211_IF_FILE(num_sta_ps, u.ap.num_sta_ps, ATOMIC);
 IEEE80211_IF_FILE(dtim_count, u.ap.dtim_count, DEC);
@@ -283,6 +386,9 @@ IEEE80211_IF_FILE(dot11MeshHWMPRootMode,
 static void add_sta_files(struct ieee80211_sub_if_data *sdata)
 {
        DEBUGFS_ADD(drop_unencrypted);
+        DEBUGFS_ADD(flags);
+        DEBUGFS_ADD(state);
+        DEBUGFS_ADD(channel_type);
        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
@@ -291,22 +397,30 @@ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
        DEBUGFS_ADD(last_beacon);
        DEBUGFS_ADD(ave_beacon);
        DEBUGFS_ADD_MODE(smps, 0600);
+        DEBUGFS_ADD_MODE(tkip_mic_test, 0200);
 }
 static void add_ap_files(struct ieee80211_sub_if_data *sdata)
 {
        DEBUGFS_ADD(drop_unencrypted);
+        DEBUGFS_ADD(flags);
+        DEBUGFS_ADD(state);
+        DEBUGFS_ADD(channel_type);
        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
        DEBUGFS_ADD(num_sta_ps);
        DEBUGFS_ADD(dtim_count);
        DEBUGFS_ADD(num_buffered_multicast);
+        DEBUGFS_ADD_MODE(tkip_mic_test, 0200);
 }
 static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 {
        DEBUGFS_ADD(drop_unencrypted);
+        DEBUGFS_ADD(flags);
+        DEBUGFS_ADD(state);
+        DEBUGFS_ADD(channel_type);
        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
@@ -316,12 +430,18 @@ static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 static void add_vlan_files(struct ieee80211_sub_if_data *sdata)
 {
        DEBUGFS_ADD(drop_unencrypted);
+        DEBUGFS_ADD(flags);
+        DEBUGFS_ADD(state);
+        DEBUGFS_ADD(channel_type);
        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
 }
 static void add_monitor_files(struct ieee80211_sub_if_data *sdata)
 {
+        DEBUGFS_ADD(flags);
+        DEBUGFS_ADD(state);
+        DEBUGFS_ADD(channel_type);
 }
 #ifdef CONFIG_MAC80211_MESH
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 98d589960a49..78af32d4bc58 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -382,17 +382,17 @@ static inline int drv_ampdu_action(struct ieee80211_local *local,
                                   struct ieee80211_sub_if_data *sdata,
                                   enum ieee80211_ampdu_mlme_action action,
                                   struct ieee80211_sta *sta, u16 tid,
-                                   u16 *ssn)
+                                   u16 *ssn, u8 buf_size)
 {
        int ret = -EOPNOTSUPP;
        might_sleep();
-        trace_drv_ampdu_action(local, sdata, action, sta, tid, ssn);
+        trace_drv_ampdu_action(local, sdata, action, sta, tid, ssn, buf_size);
        if (local->ops->ampdu_action)
                ret = local->ops->ampdu_action(&local->hw, &sdata->vif, action,
-                                               sta, tid, ssn);
+                                               sta, tid, ssn, buf_size);
        trace_drv_return_int(local, ret);
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 49c84218b2f4..e5cce19a7d65 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -9,6 +9,11 @@
 #undef TRACE_EVENT
 #define TRACE_EVENT(name, proto, ...) \
 static inline void trace_ ## name(proto) {}
+#undef DECLARE_EVENT_CLASS
+#define DECLARE_EVENT_CLASS(...)
+#undef DEFINE_EVENT
+#define DEFINE_EVENT(evt_class, name, proto, ...) \
+static inline void trace_ ## name(proto) {}
 #endif
 #undef TRACE_SYSTEM
@@ -38,7 +43,7 @@ static inline void trace_ ## name(proto) {}
 * Tracing for driver callbacks.
 */
-TRACE_EVENT(drv_return_void,
+DECLARE_EVENT_CLASS(local_only_evt,
        TP_PROTO(struct ieee80211_local *local),
        TP_ARGS(local),
        TP_STRUCT__entry(
@@ -50,6 +55,11 @@ TRACE_EVENT(drv_return_void,
        TP_printk(LOCAL_PR_FMT, LOCAL_PR_ARG)
 );
+DEFINE_EVENT(local_only_evt, drv_return_void,
+        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
+);
 TRACE_EVENT(drv_return_int,
        TP_PROTO(struct ieee80211_local *local, int ret),
        TP_ARGS(local, ret),
@@ -78,40 +88,14 @@ TRACE_EVENT(drv_return_u64,
        TP_printk(LOCAL_PR_FMT " - %llu", LOCAL_PR_ARG, __entry->ret)
 );
-TRACE_EVENT(drv_start,
+DEFINE_EVENT(local_only_evt, drv_start,
        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
-        TP_ARGS(local),
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-        ),
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-        ),
-        TP_printk(
-                LOCAL_PR_FMT, LOCAL_PR_ARG
-        )
 );
-TRACE_EVENT(drv_stop,
+DEFINE_EVENT(local_only_evt, drv_stop,
        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
-        TP_ARGS(local),
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-        ),
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-        ),
-        TP_printk(
-                LOCAL_PR_FMT, LOCAL_PR_ARG
-        )
 );
 TRACE_EVENT(drv_add_interface,
@@ -439,40 +423,14 @@ TRACE_EVENT(drv_hw_scan,
        )
 );
-TRACE_EVENT(drv_sw_scan_start,
+DEFINE_EVENT(local_only_evt, drv_sw_scan_start,
        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
-        TP_ARGS(local),
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-        ),
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-        ),
-        TP_printk(
-                LOCAL_PR_FMT, LOCAL_PR_ARG
-        )
 );
-TRACE_EVENT(drv_sw_scan_complete,
+DEFINE_EVENT(local_only_evt, drv_sw_scan_complete,
        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
-        TP_ARGS(local),
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-        ),
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-        ),
-        TP_printk(
-                LOCAL_PR_FMT, LOCAL_PR_ARG
-        )
 );
 TRACE_EVENT(drv_get_stats,
@@ -702,23 +660,9 @@ TRACE_EVENT(drv_conf_tx,
        )
 );
-TRACE_EVENT(drv_get_tsf,
+DEFINE_EVENT(local_only_evt, drv_get_tsf,
        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
-        TP_ARGS(local),
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-        ),
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-        ),
-        TP_printk(
-                LOCAL_PR_FMT,
-                LOCAL_PR_ARG
-        )
 );
 TRACE_EVENT(drv_set_tsf,
@@ -742,41 +686,14 @@ TRACE_EVENT(drv_set_tsf,
        )
 );
-TRACE_EVENT(drv_reset_tsf,
+DEFINE_EVENT(local_only_evt, drv_reset_tsf,
        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
-        TP_ARGS(local),
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-        ),
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-        ),
-        TP_printk(
-                LOCAL_PR_FMT, LOCAL_PR_ARG
-        )
 );
-TRACE_EVENT(drv_tx_last_beacon,
+DEFINE_EVENT(local_only_evt, drv_tx_last_beacon,
        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
-        TP_ARGS(local),
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-        ),
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-        ),
-        TP_printk(
-                LOCAL_PR_FMT,
-                LOCAL_PR_ARG
-        )
 );
 TRACE_EVENT(drv_ampdu_action,
@@ -784,9 +701,9 @@ TRACE_EVENT(drv_ampdu_action,
                 struct ieee80211_sub_if_data *sdata,
                 enum ieee80211_ampdu_mlme_action action,
                 struct ieee80211_sta *sta, u16 tid,
-                 u16 *ssn),
+                 u16 *ssn, u8 buf_size),
-        TP_ARGS(local, sdata, action, sta, tid, ssn),
+        TP_ARGS(local, sdata, action, sta, tid, ssn, buf_size),
        TP_STRUCT__entry(
                LOCAL_ENTRY
@@ -794,6 +711,7 @@ TRACE_EVENT(drv_ampdu_action,
                __field(u32, action)
                __field(u16, tid)
                __field(u16, ssn)
+                __field(u8, buf_size)
                VIF_ENTRY
        ),
@@ -804,11 +722,13 @@ TRACE_EVENT(drv_ampdu_action,
                __entry->action = action;
                __entry->tid = tid;
                __entry->ssn = ssn ? *ssn : 0;
+                __entry->buf_size = buf_size;
        ),
        TP_printk(
-                LOCAL_PR_FMT VIF_PR_FMT STA_PR_FMT " action:%d tid:%d",
+                LOCAL_PR_FMT VIF_PR_FMT STA_PR_FMT " action:%d tid:%d buf:%d",
-                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->action, __entry->tid
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->action,
+                __entry->tid, __entry->buf_size
        )
 );
@@ -959,22 +879,9 @@ TRACE_EVENT(drv_remain_on_channel,
        )
 );
-TRACE_EVENT(drv_cancel_remain_on_channel,
+DEFINE_EVENT(local_only_evt, drv_cancel_remain_on_channel,
        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
-        TP_ARGS(local),
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-        ),
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-        ),
-        TP_printk(
-                LOCAL_PR_FMT, LOCAL_PR_ARG
-        )
 );
 /*
@@ -1069,23 +976,9 @@ TRACE_EVENT(api_stop_tx_ba_cb,
        )
 );
-TRACE_EVENT(api_restart_hw,
+DEFINE_EVENT(local_only_evt, api_restart_hw,
        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
-        TP_ARGS(local),
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-        ),
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-        ),
-        TP_printk(
-                LOCAL_PR_FMT,
-                LOCAL_PR_ARG
-        )
 );
 TRACE_EVENT(api_beacon_loss,
@@ -1214,40 +1107,14 @@ TRACE_EVENT(api_chswitch_done,
        )
 );
-TRACE_EVENT(api_ready_on_channel,
+DEFINE_EVENT(local_only_evt, api_ready_on_channel,
        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
-        TP_ARGS(local),
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-        ),
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-        ),
-        TP_printk(
-                LOCAL_PR_FMT, LOCAL_PR_ARG
-        )
 );
-TRACE_EVENT(api_remain_on_channel_expired,
+DEFINE_EVENT(local_only_evt, api_remain_on_channel_expired,
        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
-        TP_ARGS(local),
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-        ),
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-        ),
-        TP_printk(
-                LOCAL_PR_FMT, LOCAL_PR_ARG
-        )
 );
 /*
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 53c7077ffd4f..775fb63471c4 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -270,7 +270,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
        enum ieee80211_band band = rx_status->band;
        if (elems->ds_params && elems->ds_params_len == 1)
-                freq = ieee80211_channel_to_frequency(elems->ds_params[0]);
+                freq = ieee80211_channel_to_frequency(elems->ds_params[0],
+                                                      band);
        else
                freq = rx_status->freq;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c47d7c0e48a4..44eea1af1553 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -225,6 +225,7 @@ struct ieee80211_if_ap {
        struct sk_buff_head ps_bc_buf;
        atomic_t num_sta_ps; /* number of stations in PS mode */
        int dtim_count;
+        bool dtim_bc_mc;
 };
 struct ieee80211_if_wds {
@@ -654,8 +655,6 @@ struct tpt_led_trigger {
 *      well be on the operating channel
 * @SCAN_HW_SCANNING: The hardware is scanning for us, we have no way to
 *      determine if we are on the operating channel or not
- * @SCAN_OFF_CHANNEL: We're off our operating channel for scanning,
- *      gets only set in conjunction with SCAN_SW_SCANNING
 * @SCAN_COMPLETED: Set for our scan work function when the driver reported
 *      that the scan completed.
 * @SCAN_ABORTED: Set for our scan work function when the driver reported
@@ -664,7 +663,6 @@ struct tpt_led_trigger {
 enum {
        SCAN_SW_SCANNING,
        SCAN_HW_SCANNING,
-        SCAN_OFF_CHANNEL,
        SCAN_COMPLETED,
        SCAN_ABORTED,
 };
@@ -1147,10 +1145,14 @@ void ieee80211_rx_bss_put(struct ieee80211_local *local,
                          struct ieee80211_bss *bss);
 /* off-channel helpers */
-void ieee80211_offchannel_stop_beaconing(struct ieee80211_local *local);
+bool ieee80211_cfg_on_oper_channel(struct ieee80211_local *local);
-void ieee80211_offchannel_stop_station(struct ieee80211_local *local);
+void ieee80211_offchannel_enable_all_ps(struct ieee80211_local *local,
+                                        bool tell_ap);
+void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
+                                    bool offchannel_ps_enable);
 void ieee80211_offchannel_return(struct ieee80211_local *local,
-                                 bool enable_beaconing);
+                                 bool enable_beaconing,
+                                 bool offchannel_ps_disable);
 void ieee80211_hw_roc_setup(struct ieee80211_local *local);
 /* interface handling */
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 8acba456744e..5a4e19b88032 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -382,6 +382,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
        struct sk_buff *skb, *tmp;
        u32 hw_reconf_flags = 0;
        int i;
+        enum nl80211_channel_type orig_ct;
        if (local->scan_sdata == sdata)
                ieee80211_scan_cancel(local);
@@ -542,8 +543,14 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                hw_reconf_flags = 0;
        }
+        /* Re-calculate channel-type, in case there are multiple vifs
+         * on different channel types.
+         */
+        orig_ct = local->_oper_channel_type;
+        ieee80211_set_channel_type(local, NULL, NL80211_CHAN_NO_HT);
        /* do after stop to avoid reconfiguring when we stop anyway */
-        if (hw_reconf_flags)
+        if (hw_reconf_flags || (orig_ct != local->_oper_channel_type))
                ieee80211_hw_config(local, hw_reconf_flags);
        spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index a46ff06d7cb8..c155c0b69426 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -98,6 +98,41 @@ static void ieee80211_reconfig_filter(struct work_struct *work)
        ieee80211_configure_filter(local);
 }
+/*
+ * Returns true if we are logically configured to be on
+ * the operating channel AND the hardware-conf is currently
+ * configured on the operating channel.  Compares channel-type
+ * as well.
+ */
+bool ieee80211_cfg_on_oper_channel(struct ieee80211_local *local)
+{
+        struct ieee80211_channel *chan, *scan_chan;
+        enum nl80211_channel_type channel_type;
+        /* This logic needs to match logic in ieee80211_hw_config */
+        if (local->scan_channel) {
+                chan = local->scan_channel;
+                channel_type = NL80211_CHAN_NO_HT;
+        } else if (local->tmp_channel) {
+                chan = scan_chan = local->tmp_channel;
+                channel_type = local->tmp_channel_type;
+        } else {
+                chan = local->oper_channel;
+                channel_type = local->_oper_channel_type;
+        }
+        if (chan != local->oper_channel ||
+            channel_type != local->_oper_channel_type)
+                return false;
+        /* Check current hardware-config against oper_channel. */
+        if ((local->oper_channel != local->hw.conf.channel) ||
+            (local->_oper_channel_type != local->hw.conf.channel_type))
+                return false;
+        return true;
+}
 int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
 {
        struct ieee80211_channel *chan, *scan_chan;
@@ -110,21 +145,27 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
        scan_chan = local->scan_channel;
+        /* If this off-channel logic ever changes,  ieee80211_on_oper_channel
+         * may need to change as well.
+         */
        offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
        if (scan_chan) {
                chan = scan_chan;
                channel_type = NL80211_CHAN_NO_HT;
-                local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
+        } else if (local->tmp_channel) {
-        } else if (local->tmp_channel &&
-                   local->oper_channel != local->tmp_channel) {
                chan = scan_chan = local->tmp_channel;
                channel_type = local->tmp_channel_type;
-                local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
        } else {
                chan = local->oper_channel;
                channel_type = local->_oper_channel_type;
-                local->hw.conf.flags &= ~IEEE80211_CONF_OFFCHANNEL;
        }
+        if (chan != local->oper_channel ||
+            channel_type != local->_oper_channel_type)
+                local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
+        else
+                local->hw.conf.flags &= ~IEEE80211_CONF_OFFCHANNEL;
        offchannel_flag ^= local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
        if (offchannel_flag || chan != local->hw.conf.channel ||
@@ -231,7 +272,7 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
        if (changed & BSS_CHANGED_BEACON_ENABLED) {
                if (local->quiescing || !ieee80211_sdata_running(sdata) ||
-                    test_bit(SCAN_SW_SCANNING, &local->scanning)) {
+                    test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)) {
                        sdata->vif.bss_conf.enable_beacon = false;
                } else {
                        /*
@@ -554,6 +595,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
        local->hw.queues = 1;
        local->hw.max_rates = 1;
        local->hw.max_report_rates = 0;
+        local->hw.max_rx_aggregation_subframes = IEEE80211_MAX_AMPDU_BUF;
        local->hw.conf.long_frame_max_tx_count = wiphy->retry_long;
        local->hw.conf.short_frame_max_tx_count = wiphy->retry_short;
        local->user_power_level = -1;
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index ca3af4685b0a..2a57cc02c618 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -574,7 +574,7 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
                               &elems);
        if (elems.ds_params && elems.ds_params_len == 1)
-                freq = ieee80211_channel_to_frequency(elems.ds_params[0]);
+                freq = ieee80211_channel_to_frequency(elems.ds_params[0], band);
        else
                freq = rx_status->freq;
@@ -645,7 +645,7 @@ void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata)
        if (test_and_clear_bit(MESH_WORK_GROW_MPATH_TABLE, &ifmsh->wrkq_flags))
                mesh_mpath_table_grow();
-        if (test_and_clear_bit(MESH_WORK_GROW_MPATH_TABLE, &ifmsh->wrkq_flags))
+        if (test_and_clear_bit(MESH_WORK_GROW_MPP_TABLE, &ifmsh->wrkq_flags))
                mesh_mpp_table_grow();
        if (test_and_clear_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags))
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 45fbb9e33746..f77adf1a520e 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -28,8 +28,15 @@
 #include "rate.h"
 #include "led.h"
-#define IEEE80211_MAX_NULLFUNC_TRIES 2
+static int max_nullfunc_tries = 2;
-#define IEEE80211_MAX_PROBE_TRIES 5
+module_param(max_nullfunc_tries, int, 0644);
+MODULE_PARM_DESC(max_nullfunc_tries,
+                 "Maximum nullfunc tx tries before disconnecting (reason 4).");
+static int max_probe_tries = 5;
+module_param(max_probe_tries, int, 0644);
+MODULE_PARM_DESC(max_probe_tries,
+                 "Maximum probe tries before disconnecting (reason 4).");
 /*
 * Beacon loss timeout is calculated as N frames times the
@@ -51,7 +58,11 @@
 * a probe request because of beacon loss or for
 * checking the connection still works.
 */
-#define IEEE80211_PROBE_WAIT            (HZ / 2)
+static int probe_wait_ms = 500;
+module_param(probe_wait_ms, int, 0644);
+MODULE_PARM_DESC(probe_wait_ms,
+                 "Maximum time(ms) to wait for probe response"
+                 " before disconnecting (reason 4).");
 /*
 * Weight given to the latest Beacon frame when calculating average signal
@@ -161,6 +172,7 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
        struct ieee80211_supported_band *sband;
        struct sta_info *sta;
        u32 changed = 0;
+        int hti_cfreq;
        u16 ht_opmode;
        bool enable_ht = true;
        enum nl80211_channel_type prev_chantype;
@@ -174,10 +186,27 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
        if (!sband->ht_cap.ht_supported)
                enable_ht = false;
-        /* check that channel matches the right operating channel */
+        if (enable_ht) {
-        if (local->hw.conf.channel->center_freq !=
+                hti_cfreq = ieee80211_channel_to_frequency(hti->control_chan,
-            ieee80211_channel_to_frequency(hti->control_chan))
+                                                           sband->band);
-                enable_ht = false;
+                /* check that channel matches the right operating channel */
+                if (local->hw.conf.channel->center_freq != hti_cfreq) {
+                        /* Some APs mess this up, evidently.
+                         * Netgear WNDR3700 sometimes reports 4 higher than
+                         * the actual channel, for instance.
+                         */
+                        printk(KERN_DEBUG
+                               "%s: Wrong control channel in association"
+                               " response: configured center-freq: %d"
+                               " hti-cfreq: %d  hti->control_chan: %d"
+                               " band: %d.  Disabling HT.\n",
+                               sdata->name,
+                               local->hw.conf.channel->center_freq,
+                               hti_cfreq, hti->control_chan,
+                               sband->band);
+                        enable_ht = false;
+                }
+        }
        if (enable_ht) {
                channel_type = NL80211_CHAN_HT20;
@@ -429,7 +458,8 @@ void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                container_of((void *)bss, struct cfg80211_bss, priv);
        struct ieee80211_channel *new_ch;
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num);
+        int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num,
+                                                      cbss->channel->band);
        ASSERT_MGD_MTX(ifmgd);
@@ -600,6 +630,14 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
        list_for_each_entry(sdata, &local->interfaces, list) {
                if (!ieee80211_sdata_running(sdata))
                        continue;
+                if (sdata->vif.type == NL80211_IFTYPE_AP) {
+                        /* If an AP vif is found, then disable PS
+                         * by setting the count to zero thereby setting
+                         * ps_sdata to NULL.
+                         */
+                        count = 0;
+                        break;
+                }
                if (sdata->vif.type != NL80211_IFTYPE_STATION)
                        continue;
                found = sdata;
@@ -1089,7 +1127,7 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
        const u8 *ssid;
        u8 *dst = ifmgd->associated->bssid;
-        u8 unicast_limit = max(1, IEEE80211_MAX_PROBE_TRIES - 3);
+        u8 unicast_limit = max(1, max_probe_tries - 3);
        /*
         * Try sending broadcast probe requests for the last three
@@ -1115,7 +1153,7 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
        }
        ifmgd->probe_send_count++;
-        ifmgd->probe_timeout = jiffies + IEEE80211_PROBE_WAIT;
+        ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
        run_again(ifmgd, ifmgd->probe_timeout);
 }
@@ -1216,7 +1254,8 @@ static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
        memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
-        printk(KERN_DEBUG "Connection to AP %pM lost.\n", bssid);
+        printk(KERN_DEBUG "%s: Connection to AP %pM lost.\n",
+               sdata->name, bssid);
        ieee80211_set_disassoc(sdata, true, true);
        mutex_unlock(&ifmgd->mtx);
@@ -1519,7 +1558,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
        }
        if (elems->ds_params && elems->ds_params_len == 1)
-                freq = ieee80211_channel_to_frequency(elems->ds_params[0]);
+                freq = ieee80211_channel_to_frequency(elems->ds_params[0],
+                                                      rx_status->band);
        else
                freq = rx_status->freq;
@@ -1960,9 +2000,9 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
                if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
-                        max_tries = IEEE80211_MAX_NULLFUNC_TRIES;
+                        max_tries = max_nullfunc_tries;
                else
-                        max_tries = IEEE80211_MAX_PROBE_TRIES;
+                        max_tries = max_probe_tries;
                /* ACK received for nullfunc probing frame */
                if (!ifmgd->probe_send_count)
@@ -1972,9 +2012,9 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                                wiphy_debug(local->hw.wiphy,
                                            "%s: No ack for nullfunc frame to"
-                                            " AP %pM, try %d\n",
+                                            " AP %pM, try %d/%i\n",
                                            sdata->name, bssid,
-                                            ifmgd->probe_send_count);
+                                            ifmgd->probe_send_count, max_tries);
 #endif
                                ieee80211_mgd_probe_ap_send(sdata);
                        } else {
@@ -1994,17 +2034,17 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                                    "%s: Failed to send nullfunc to AP %pM"
                                    " after %dms, disconnecting.\n",
                                    sdata->name,
-                                    bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ);
+                                    bssid, probe_wait_ms);
 #endif
                        ieee80211_sta_connection_lost(sdata, bssid);
                } else if (ifmgd->probe_send_count < max_tries) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                        wiphy_debug(local->hw.wiphy,
                                    "%s: No probe response from AP %pM"
-                                    " after %dms, try %d\n",
+                                    " after %dms, try %d/%i\n",
                                    sdata->name,
-                                    bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ,
+                                    bssid, probe_wait_ms,
-                                    ifmgd->probe_send_count);
+                                    ifmgd->probe_send_count, max_tries);
 #endif
                        ieee80211_mgd_probe_ap_send(sdata);
                } else {
@@ -2016,7 +2056,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                                    "%s: No probe response from AP %pM"
                                    " after %dms, disconnecting.\n",
                                    sdata->name,
-                                    bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ);
+                                    bssid, probe_wait_ms);
                        ieee80211_sta_connection_lost(sdata, bssid);
                }
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index b4e52676f3fb..13427b194ced 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -17,10 +17,14 @@
 #include "driver-trace.h"
 /*
- * inform AP that we will go to sleep so that it will buffer the frames
+ * Tell our hardware to disable PS.
- * while we scan
+ * Optionally inform AP that we will go to sleep so that it will buffer
+ * the frames while we are doing off-channel work.  This is optional
+ * because we *may* be doing work on-operating channel, and want our
+ * hardware unconditionally awake, but still let the AP send us normal frames.
 */
-static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata)
+static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata,
+                                           bool tell_ap)
 {
        struct ieee80211_local *local = sdata->local;
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
@@ -41,8 +45,8 @@ static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata)
                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
        }
-        if (!(local->offchannel_ps_enabled) ||
+        if (tell_ap && (!local->offchannel_ps_enabled ||
-            !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK))
+                        !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)))
                /*
                 * If power save was enabled, no need to send a nullfunc
                 * frame because AP knows that we are sleeping. But if the
@@ -77,6 +81,9 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
                 * we are sleeping, let's just enable power save mode in
                 * hardware.
                 */
+                /* TODO:  Only set hardware if CONF_PS changed?
+                 * TODO:  Should we set offchannel_ps_enabled to false?
+                 */
                local->hw.conf.flags |= IEEE80211_CONF_PS;
                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
        } else if (local->hw.conf.dynamic_ps_timeout > 0) {
@@ -95,63 +102,61 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
        ieee80211_sta_reset_conn_monitor(sdata);
 }
-void ieee80211_offchannel_stop_beaconing(struct ieee80211_local *local)
+void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
+                                    bool offchannel_ps_enable)
 {
        struct ieee80211_sub_if_data *sdata;
+        /*
+         * notify the AP about us leaving the channel and stop all
+         * STA interfaces.
+         */
        mutex_lock(&local->iflist_mtx);
        list_for_each_entry(sdata, &local->interfaces, list) {
                if (!ieee80211_sdata_running(sdata))
                        continue;
-                /* disable beaconing */
+                if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                        set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
+                /* Check to see if we should disable beaconing. */
                if (sdata->vif.type == NL80211_IFTYPE_AP ||
                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
                        ieee80211_bss_info_change_notify(
                                sdata, BSS_CHANGED_BEACON_ENABLED);
-                /*
+                if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
-                 * only handle non-STA interfaces here, STA interfaces
-                 * are handled in ieee80211_offchannel_stop_station(),
-                 * e.g., from the background scan state machine.
-                 *
-                 * In addition, do not stop monitor interface to allow it to be
-                 * used from user space controlled off-channel operations.
-                 */
-                if (sdata->vif.type != NL80211_IFTYPE_STATION &&
-                    sdata->vif.type != NL80211_IFTYPE_MONITOR) {
-                        set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
                        netif_tx_stop_all_queues(sdata->dev);
+                        if (offchannel_ps_enable &&
+                            (sdata->vif.type == NL80211_IFTYPE_STATION) &&
+                            sdata->u.mgd.associated)
+                                ieee80211_offchannel_ps_enable(sdata, true);
                }
        }
        mutex_unlock(&local->iflist_mtx);
 }
-void ieee80211_offchannel_stop_station(struct ieee80211_local *local)
+void ieee80211_offchannel_enable_all_ps(struct ieee80211_local *local,
+                                        bool tell_ap)
 {
        struct ieee80211_sub_if_data *sdata;
-        /*
-         * notify the AP about us leaving the channel and stop all STA interfaces
-         */
        mutex_lock(&local->iflist_mtx);
        list_for_each_entry(sdata, &local->interfaces, list) {
                if (!ieee80211_sdata_running(sdata))
                        continue;
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                        set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
+                    sdata->u.mgd.associated)
-                        netif_tx_stop_all_queues(sdata->dev);
+                        ieee80211_offchannel_ps_enable(sdata, tell_ap);
-                        if (sdata->u.mgd.associated)
-                                ieee80211_offchannel_ps_enable(sdata);
-                }
        }
        mutex_unlock(&local->iflist_mtx);
 }
 void ieee80211_offchannel_return(struct ieee80211_local *local,
-                                 bool enable_beaconing)
+                                 bool enable_beaconing,
+                                 bool offchannel_ps_disable)
 {
        struct ieee80211_sub_if_data *sdata;
@@ -161,7 +166,8 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
                        continue;
                /* Tell AP we're back */
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                if (offchannel_ps_disable &&
+                    sdata->vif.type == NL80211_IFTYPE_STATION) {
                        if (sdata->u.mgd.associated)
                                ieee80211_offchannel_ps_disable(sdata);
                }
@@ -181,7 +187,7 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
                        netif_tx_wake_all_queues(sdata->dev);
                }
-                /* re-enable beaconing */
+                /* Check to see if we should re-enable beaconing */
                if (enable_beaconing &&
                    (sdata->vif.type == NL80211_IFTYPE_AP ||
                     sdata->vif.type == NL80211_IFTYPE_ADHOC ||
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index a6701ed87f0d..045b2fe4a414 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -85,6 +85,9 @@ ieee80211_rx_radiotap_len(struct ieee80211_local *local,
        if (len & 1) /* padding for RX_FLAGS if necessary */
                len++;
+        if (status->flag & RX_FLAG_HT) /* HT info */
+                len += 3;
        return len;
 }
@@ -139,11 +142,8 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
        /* IEEE80211_RADIOTAP_RATE */
        if (status->flag & RX_FLAG_HT) {
                /*
-                 * TODO: add following information into radiotap header once
+                 * MCS information is a separate field in radiotap,
-                 * suitable fields are defined for it:
+                 * added below.
-                 * - MCS index (status->rate_idx)
-                 * - HT40 (status->flag & RX_FLAG_40MHZ)
-                 * - short-GI (status->flag & RX_FLAG_SHORT_GI)
                 */
                *pos = 0;
        } else {
@@ -193,6 +193,20 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
        put_unaligned_le16(rx_flags, pos);
        pos += 2;
+        if (status->flag & RX_FLAG_HT) {
+                rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
+                *pos++ = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
+                         IEEE80211_RADIOTAP_MCS_HAVE_GI |
+                         IEEE80211_RADIOTAP_MCS_HAVE_BW;
+                *pos = 0;
+                if (status->flag & RX_FLAG_SHORT_GI)
+                        *pos |= IEEE80211_RADIOTAP_MCS_SGI;
+                if (status->flag & RX_FLAG_40MHZ)
+                        *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
+                pos++;
+                *pos++ = status->rate_idx;
+        }
 }
 /*
@@ -392,16 +406,10 @@ ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
        if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN)))
                return RX_CONTINUE;
-        if (test_bit(SCAN_HW_SCANNING, &local->scanning))
+        if (test_bit(SCAN_HW_SCANNING, &local->scanning) ||
+            test_bit(SCAN_SW_SCANNING, &local->scanning))
                return ieee80211_scan_rx(rx->sdata, skb);
-        if (test_bit(SCAN_SW_SCANNING, &local->scanning)) {
-                /* drop all the other packets during a software scan anyway */
-                if (ieee80211_scan_rx(rx->sdata, skb) != RX_QUEUED)
-                        dev_kfree_skb(skb);
-                return RX_QUEUED;
-        }
        /* scanning finished during invoking of handlers */
        I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
        return RX_DROP_UNUSABLE;
@@ -798,7 +806,7 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
                                rx->local->dot11FrameDuplicateCount++;
                                rx->sta->num_duplicates++;
                        }
-                        return RX_DROP_MONITOR;
+                        return RX_DROP_UNUSABLE;
                } else
                        rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
        }
@@ -1088,7 +1096,8 @@ static void ap_sta_ps_start(struct sta_info *sta)
        atomic_inc(&sdata->bss->num_sta_ps);
        set_sta_flags(sta, WLAN_STA_PS_STA);
-        drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
+        if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
+                drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
        printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
               sdata->name, sta->sta.addr, sta->sta.aid);
@@ -1117,6 +1126,27 @@ static void ap_sta_ps_end(struct sta_info *sta)
        ieee80211_sta_ps_deliver_wakeup(sta);
 }
+int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
+{
+        struct sta_info *sta_inf = container_of(sta, struct sta_info, sta);
+        bool in_ps;
+        WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS));
+        /* Don't let the same PS state be set twice */
+        in_ps = test_sta_flags(sta_inf, WLAN_STA_PS_STA);
+        if ((start && in_ps) || (!start && !in_ps))
+                return -EINVAL;
+        if (start)
+                ap_sta_ps_start(sta_inf);
+        else
+                ap_sta_ps_end(sta_inf);
+        return 0;
+}
+EXPORT_SYMBOL(ieee80211_sta_ps_transition);
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
 {
@@ -1161,7 +1191,8 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         * Change STA power saving mode only at the end of a frame
         * exchange sequence.
         */
-        if (!ieee80211_has_morefrags(hdr->frame_control) &&
+        if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) &&
+            !ieee80211_has_morefrags(hdr->frame_control) &&
            !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
            (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
             rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
@@ -1556,17 +1587,36 @@ __ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
 {
        struct ieee80211_sub_if_data *sdata = rx->sdata;
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+        bool check_port_control = false;
+        struct ethhdr *ehdr;
+        int ret;
        if (ieee80211_has_a4(hdr->frame_control) &&
            sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
                return -1;
+        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+            !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
+                if (!sdata->u.mgd.use_4addr)
+                        return -1;
+                else
+                        check_port_control = true;
+        }
        if (is_multicast_ether_addr(hdr->addr1) &&
-            ((sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta) ||
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
-             (sdata->vif.type == NL80211_IFTYPE_STATION && sdata->u.mgd.use_4addr)))
+                return -1;
+        ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
+        if (ret < 0 || !check_port_control)
+                return ret;
+        ehdr = (struct ethhdr *) rx->skb->data;
+        if (ehdr->h_proto != rx->sdata->control_port_protocol)
                return -1;
-        return ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
+        return 0;
 }
 /*
@@ -1893,7 +1943,10 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
        dev->stats.rx_bytes += rx->skb->len;
        if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
-            !is_multicast_ether_addr(((struct ethhdr *)rx->skb->data)->h_dest)) {
+            !is_multicast_ether_addr(
+                    ((struct ethhdr *)rx->skb->data)->h_dest) &&
+            (!local->scanning &&
+             !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
                        mod_timer(&local->dynamic_ps_timer, jiffies +
                         msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
        }
@@ -2590,7 +2643,8 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                        return 0;
                if (!multicast &&
                    compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
-                        if (!(sdata->dev->flags & IFF_PROMISC))
+                        if (!(sdata->dev->flags & IFF_PROMISC) ||
+                            sdata->u.mgd.use_4addr)
                                return 0;
                        status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
                }
@@ -2639,7 +2693,8 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                                return 0;
                } else if (!ieee80211_bssid_match(bssid,
                                        sdata->vif.addr)) {
-                        if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
+                        if (!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
+                            !ieee80211_is_beacon(hdr->frame_control))
                                return 0;
                        status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
                }
@@ -2692,7 +2747,7 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
                if (!skb) {
                        if (net_ratelimit())
                                wiphy_debug(local->hw.wiphy,
-                                        "failed to copy multicast frame for %s\n",
+                                        "failed to copy skb for %s\n",
                                        sdata->name);
                        return true;
                }
@@ -2730,7 +2785,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                local->dot11ReceivedFragmentCount++;
        if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
-                     test_bit(SCAN_OFF_CHANNEL, &local->scanning)))
+                     test_bit(SCAN_SW_SCANNING, &local->scanning)))
                status->rx_flags |= IEEE80211_RX_IN_SCAN;
        if (ieee80211_is_mgmt(fc))
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index fb274db77e3c..0ea6adae3e06 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -196,7 +196,8 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
        ieee802_11_parse_elems(elements, skb->len - baselen, &elems);
        if (elems.ds_params && elems.ds_params_len == 1)
-                freq = ieee80211_channel_to_frequency(elems.ds_params[0]);
+                freq = ieee80211_channel_to_frequency(elems.ds_params[0],
+                                                      rx_status->band);
        else
                freq = rx_status->freq;
@@ -211,6 +212,14 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
        if (bss)
                ieee80211_rx_bss_put(sdata->local, bss);
+        /* If we are on-operating-channel, and this packet is for the
+         * current channel, pass the pkt on up the stack so that
+         * the rest of the stack can make use of it.
+         */
+        if (ieee80211_cfg_on_oper_channel(sdata->local)
+            && (channel == sdata->local->oper_channel))
+                return RX_CONTINUE;
        dev_kfree_skb(skb);
        return RX_QUEUED;
 }
@@ -292,15 +301,31 @@ static void __ieee80211_scan_completed_finish(struct ieee80211_hw *hw,
                                              bool was_hw_scan)
 {
        struct ieee80211_local *local = hw_to_local(hw);
+        bool on_oper_chan;
+        bool enable_beacons = false;
+        mutex_lock(&local->mtx);
+        on_oper_chan = ieee80211_cfg_on_oper_channel(local);
+        if (was_hw_scan || !on_oper_chan) {
+                if (WARN_ON(local->scan_channel))
+                        local->scan_channel = NULL;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+        }
-        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
        if (!was_hw_scan) {
+                bool on_oper_chan2;
                ieee80211_configure_filter(local);
                drv_sw_scan_complete(local);
-                ieee80211_offchannel_return(local, true);
+                on_oper_chan2 = ieee80211_cfg_on_oper_channel(local);
+                /* We should always be on-channel at this point. */
+                WARN_ON(!on_oper_chan2);
+                if (on_oper_chan2 && (on_oper_chan != on_oper_chan2))
+                        enable_beacons = true;
+                ieee80211_offchannel_return(local, enable_beacons, true);
        }
-        mutex_lock(&local->mtx);
        ieee80211_recalc_idle(local);
        mutex_unlock(&local->mtx);
@@ -340,13 +365,15 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
         */
        drv_sw_scan_start(local);
-        ieee80211_offchannel_stop_beaconing(local);
        local->leave_oper_channel_time = 0;
        local->next_scan_state = SCAN_DECISION;
        local->scan_channel_idx = 0;
-        drv_flush(local, false);
+        /* We always want to use off-channel PS, even if we
+         * are not really leaving oper-channel.  Don't
+         * tell the AP though, as long as we are on-channel.
+         */
+        ieee80211_offchannel_enable_all_ps(local, false);
        ieee80211_configure_filter(local);
@@ -486,7 +513,21 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
        }
        mutex_unlock(&local->iflist_mtx);
-        if (local->scan_channel) {
+        next_chan = local->scan_req->channels[local->scan_channel_idx];
+        if (ieee80211_cfg_on_oper_channel(local)) {
+                /* We're currently on operating channel. */
+                if ((next_chan == local->oper_channel) &&
+                    (local->_oper_channel_type == NL80211_CHAN_NO_HT))
+                        /* We don't need to move off of operating channel. */
+                        local->next_scan_state = SCAN_SET_CHANNEL;
+                else
+                        /*
+                         * We do need to leave operating channel, as next
+                         * scan is somewhere else.
+                         */
+                        local->next_scan_state = SCAN_LEAVE_OPER_CHANNEL;
+        } else {
                /*
                 * we're currently scanning a different channel, let's
                 * see if we can scan another channel without interfering
@@ -502,7 +543,6 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
                 *
                 * Otherwise switch back to the operating channel.
                 */
-                next_chan = local->scan_req->channels[local->scan_channel_idx];
                bad_latency = time_after(jiffies +
                                ieee80211_scan_get_channel_time(next_chan),
@@ -520,12 +560,6 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
                        local->next_scan_state = SCAN_ENTER_OPER_CHANNEL;
                else
                        local->next_scan_state = SCAN_SET_CHANNEL;
-        } else {
-                /*
-                 * we're on the operating channel currently, let's
-                 * leave that channel now to scan another one
-                 */
-                local->next_scan_state = SCAN_LEAVE_OPER_CHANNEL;
        }
        *next_delay = 0;
@@ -534,9 +568,10 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
 static void ieee80211_scan_state_leave_oper_channel(struct ieee80211_local *local,
                                                    unsigned long *next_delay)
 {
-        ieee80211_offchannel_stop_station(local);
+        /* PS will already be in off-channel mode,
+         * we do that once at the beginning of scanning.
-        __set_bit(SCAN_OFF_CHANNEL, &local->scanning);
+         */
+        ieee80211_offchannel_stop_vifs(local, false);
        /*
         * What if the nullfunc frames didn't arrive?
@@ -559,15 +594,15 @@ static void ieee80211_scan_state_enter_oper_channel(struct ieee80211_local *loca
 {
        /* switch back to the operating channel */
        local->scan_channel = NULL;
-        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+        if (!ieee80211_cfg_on_oper_channel(local))
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
        /*
-         * Only re-enable station mode interface now; beaconing will be
+         * Re-enable vifs and beaconing.  Leave PS
-         * re-enabled once the full scan has been completed.
+         * in off-channel state..will put that back
+         * on-channel at the end of scanning.
         */
-        ieee80211_offchannel_return(local, false);
+        ieee80211_offchannel_return(local, true, false);
-        __clear_bit(SCAN_OFF_CHANNEL, &local->scanning);
        *next_delay = HZ / 5;
        local->next_scan_state = SCAN_DECISION;
@@ -583,8 +618,12 @@ static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
        chan = local->scan_req->channels[local->scan_channel_idx];
        local->scan_channel = chan;
-        if (ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL))
-                skip = 1;
+        /* Only call hw-config if we really need to change channels. */
+        if ((chan != local->hw.conf.channel) ||
+            (local->hw.conf.channel_type != NL80211_CHAN_NO_HT))
+                if (ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL))
+                        skip = 1;
        /* advance state machine to next channel/band */
        local->scan_channel_idx++;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index c426504ed1cf..5a11078827ab 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -899,7 +899,8 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
        struct ieee80211_local *local = sdata->local;
        int sent, buffered;
-        drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
+        if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
+                drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
        if (!skb_queue_empty(&sta->ps_tx_buf))
                sta_info_clear_tim_bit(sta);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index bbdd2a86a94b..ca0b69060ef7 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -82,6 +82,7 @@ enum ieee80211_sta_info_flags {
 * @state: session state (see above)
 * @stop_initiator: initiator of a session stop
 * @tx_stop: TX DelBA frame when stopping
+ * @buf_size: reorder buffer size at receiver
 *
 * This structure's lifetime is managed by RCU, assignments to
 * the array holding it must hold the aggregation mutex.
@@ -101,6 +102,7 @@ struct tid_ampdu_tx {
        u8 dialog_token;
        u8 stop_initiator;
        bool tx_stop;
+        u8 buf_size;
 };
 /**
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 38a797217a91..ffb0de9bc2fa 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -98,6 +98,10 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
         *  (b) always process RX events before TX status events if ordering
         *      can be unknown, for example with different interrupt status
         *      bits.
+         *  (c) if PS mode transitions are manual (i.e. the flag
+         *      %IEEE80211_HW_AP_LINK_PS is set), always process PS state
+         *      changes before calling TX status events if ordering can be
+         *      unknown.
         */
        if (test_sta_flags(sta, WLAN_STA_PS_STA) &&
            skb_queue_len(&sta->tx_filtered) < STA_MAX_TX_BUFFER) {
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 5950e3abead9..38e593939727 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -257,7 +257,8 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
        if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
                return TX_CONTINUE;
-        if (unlikely(test_bit(SCAN_OFF_CHANNEL, &tx->local->scanning)) &&
+        if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
+            test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
            !ieee80211_is_probe_req(hdr->frame_control) &&
            !ieee80211_is_nullfunc(hdr->frame_control))
                /*
@@ -1394,7 +1395,8 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
        /* handlers after fragment must be aware of tx info fragmentation! */
        CALL_TXH(ieee80211_tx_h_stats);
        CALL_TXH(ieee80211_tx_h_encrypt);
-        CALL_TXH(ieee80211_tx_h_calculate_duration);
+        if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
+                CALL_TXH(ieee80211_tx_h_calculate_duration);
 #undef CALL_TXH
 txh_done:
@@ -1750,7 +1752,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
        __le16 fc;
        struct ieee80211_hdr hdr;
        struct ieee80211s_hdr mesh_hdr __maybe_unused;
-        struct mesh_path *mppath = NULL;
+        struct mesh_path __maybe_unused *mppath = NULL;
        const u8 *encaps_data;
        int encaps_len, skip_header_bytes;
        int nh_pos, h_pos;
@@ -1815,19 +1817,19 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                        mppath = mpp_path_lookup(skb->data, sdata);
                /*
-                 * Do not use address extension, if it is a packet from
+                 * Use address extension if it is a packet from
-                 * the same interface and the destination is not being
+                 * another interface or if we know the destination
-                 * proxied by any other mest point.
+                 * is being proxied by a portal (i.e. portal address
+                 * differs from proxied address)
                 */
                if (compare_ether_addr(sdata->vif.addr,
                                       skb->data + ETH_ALEN) == 0 &&
-                    (!mppath || !compare_ether_addr(mppath->mpp, skb->data))) {
+                    !(mppath && compare_ether_addr(mppath->mpp, skb->data))) {
                        hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
                                        skb->data, skb->data + ETH_ALEN);
                        meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr,
                                        sdata, NULL, NULL);
                } else {
-                        /* packet from other interface */
                        int is_mesh_mcast = 1;
                        const u8 *mesh_da;
@@ -2178,6 +2180,8 @@ static void ieee80211_beacon_add_tim(struct ieee80211_if_ap *bss,
        if (bss->dtim_count == 0 && !skb_queue_empty(&bss->ps_bc_buf))
                aid0 = 1;
+        bss->dtim_bc_mc = aid0 == 1;
        if (have_bits) {
                /* Find largest even number N1 so that bits numbered 1 through
                 * (N1 x 8) - 1 in the bitmap are 0 and number N2 so that bits
@@ -2230,6 +2234,9 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
        sdata = vif_to_sdata(vif);
+        if (!ieee80211_sdata_running(sdata))
+                goto out;
        if (tim_offset)
                *tim_offset = 0;
        if (tim_length)
@@ -2238,7 +2245,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
        if (sdata->vif.type == NL80211_IFTYPE_AP) {
                ap = &sdata->u.ap;
                beacon = rcu_dereference(ap->beacon);
-                if (ap && beacon) {
+                if (beacon) {
                        /*
                         * headroom, head length,
                         * tail length and maximum TIM length
@@ -2299,6 +2306,11 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                struct ieee80211_mgmt *mgmt;
                u8 *pos;
+#ifdef CONFIG_MAC80211_MESH
+                if (!sdata->u.mesh.mesh_id_len)
+                        goto out;
+#endif
                /* headroom, head length, tail length and maximum TIM length */
                skb = dev_alloc_skb(local->tx_headroom + 400 +
                                sdata->u.mesh.vendor_ie_len);
@@ -2540,7 +2552,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
        if (sdata->vif.type != NL80211_IFTYPE_AP || !beacon || !beacon->head)
                goto out;
-        if (bss->dtim_count != 0)
+        if (bss->dtim_count != 0 || !bss->dtim_bc_mc)
                goto out; /* send buffered bc/mc only after DTIM beacon */
        while (1) {
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index 36305e0d06ef..6bf787a5b38a 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -924,18 +924,44 @@ static void ieee80211_work_work(struct work_struct *work)
                }
                if (!started && !local->tmp_channel) {
-                        /*
+                        bool on_oper_chan;
-                         * TODO: could optimize this by leaving the
+                        bool tmp_chan_changed = false;
-                         *       station vifs in awake mode if they
+                        bool on_oper_chan2;
-                         *       happen to be on the same channel as
+                        on_oper_chan = ieee80211_cfg_on_oper_channel(local);
-                         *       the requested channel
+                        if (local->tmp_channel)
-                         */
+                                if ((local->tmp_channel != wk->chan) ||
-                        ieee80211_offchannel_stop_beaconing(local);
+                                    (local->tmp_channel_type != wk->chan_type))
-                        ieee80211_offchannel_stop_station(local);
+                                        tmp_chan_changed = true;
                        local->tmp_channel = wk->chan;
                        local->tmp_channel_type = wk->chan_type;
-                        ieee80211_hw_config(local, 0);
+                        /*
+                         * Leave the station vifs in awake mode if they
+                         * happen to be on the same channel as
+                         * the requested channel.
+                         */
+                        on_oper_chan2 = ieee80211_cfg_on_oper_channel(local);
+                        if (on_oper_chan != on_oper_chan2) {
+                                if (on_oper_chan2) {
+                                        /* going off oper channel, PS too */
+                                        ieee80211_offchannel_stop_vifs(local,
+                                                                       true);
+                                        ieee80211_hw_config(local, 0);
+                                } else {
+                                        /* going on channel, but leave PS
+                                         * off-channel. */
+                                        ieee80211_hw_config(local, 0);
+                                        ieee80211_offchannel_return(local,
+                                                                    true,
+                                                                    false);
+                                }
+                        } else if (tmp_chan_changed)
+                                /* Still off-channel, but on some other
+                                 * channel, so update hardware.
+                                 * PS should already be off-channel.
+                                 */
+                                ieee80211_hw_config(local, 0);
                        started = true;
                        wk->timeout = jiffies;
                }
@@ -1011,9 +1037,27 @@ static void ieee80211_work_work(struct work_struct *work)
        }
        if (!remain_off_channel && local->tmp_channel) {
+                bool on_oper_chan = ieee80211_cfg_on_oper_channel(local);
                local->tmp_channel = NULL;
-                ieee80211_hw_config(local, 0);
+                /* If tmp_channel wasn't operating channel, then
-                ieee80211_offchannel_return(local, true);
+                 * we need to go back on-channel.
+                 * NOTE:  If we can ever be here while scannning,
+                 * or if the hw_config() channel config logic changes,
+                 * then we may need to do a more thorough check to see if
+                 * we still need to do a hardware config.  Currently,
+                 * we cannot be here while scanning, however.
+                 */
+                if (ieee80211_cfg_on_oper_channel(local) && !on_oper_chan)
+                        ieee80211_hw_config(local, 0);
+                /* At the least, we need to disable offchannel_ps,
+                 * so just go ahead and run the entire offchannel
+                 * return logic here.  We *could* skip enabling
+                 * beaconing if we were already on-oper-channel
+                 * as a future optimization.
+                 */
+                ieee80211_offchannel_return(local, true, true);
                /* give connection some time to breathe */
                run_again(local, jiffies + HZ/2);
        }
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index bee230d8fd11..f1765de2f4bf 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -26,13 +26,12 @@
 ieee80211_tx_result
 ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
 {
-        u8 *data, *key, *mic, key_offset;
+        u8 *data, *key, *mic;
        size_t data_len;
        unsigned int hdrlen;
        struct ieee80211_hdr *hdr;
        struct sk_buff *skb = tx->skb;
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        int authenticator;
        int tail;
        hdr = (struct ieee80211_hdr *)skb->data;
@@ -47,6 +46,11 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
        data = skb->data + hdrlen;
        data_len = skb->len - hdrlen;
+        if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE)) {
+                /* Need to use software crypto for the test */
+                info->control.hw_key = NULL;
+        }
        if (info->control.hw_key &&
            !(tx->flags & IEEE80211_TX_FRAGMENTED) &&
            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC)) {
@@ -62,17 +66,11 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
                    skb_headroom(skb) < TKIP_IV_LEN))
                return TX_DROP;
-#if 0
+        key = &tx->key->conf.key[NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY];
-        authenticator = fc & IEEE80211_FCTL_FROMDS; /* FIX */
-#else
-        authenticator = 1;
-#endif
-        key_offset = authenticator ?
-                NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY :
-                NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY;
-        key = &tx->key->conf.key[key_offset];
        mic = skb_put(skb, MICHAEL_MIC_LEN);
        michael_mic(key, hdr, data, data_len, mic);
+        if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE))
+                mic[0]++;
        return TX_CONTINUE;
 }
@@ -81,14 +79,13 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
 ieee80211_rx_result
 ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
 {
-        u8 *data, *key = NULL, key_offset;
+        u8 *data, *key = NULL;
        size_t data_len;
        unsigned int hdrlen;
        u8 mic[MICHAEL_MIC_LEN];
        struct sk_buff *skb = rx->skb;
        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        int authenticator = 1, wpa_test = 0;
        /* No way to verify the MIC if the hardware stripped it */
        if (status->flag & RX_FLAG_MMIC_STRIPPED)
@@ -106,17 +103,9 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
        data = skb->data + hdrlen;
        data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
-#if 0
+        key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
-        authenticator = fc & IEEE80211_FCTL_TODS; /* FIX */
-#else
-        authenticator = 1;
-#endif
-        key_offset = authenticator ?
-                NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY :
-                NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY;
-        key = &rx->key->conf.key[key_offset];
        michael_mic(key, hdr, data, data_len, mic);
-        if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0 || wpa_test) {
+        if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0) {
                if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
                        return RX_DROP_UNUSABLE;
@@ -208,7 +197,7 @@ ieee80211_rx_result
 ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
 {
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
-        int hdrlen, res, hwaccel = 0, wpa_test = 0;
+        int hdrlen, res, hwaccel = 0;
        struct ieee80211_key *key = rx->key;
        struct sk_buff *skb = rx->skb;
        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
@@ -235,7 +224,7 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
                                          hdr->addr1, hwaccel, rx->queue,
                                          &rx->tkip_iv32,
                                          &rx->tkip_iv16);
-        if (res != TKIP_DECRYPT_OK || wpa_test)
+        if (res != TKIP_DECRYPT_OK)
                return RX_DROP_UNUSABLE;
        /* Trim ICV */
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 746140264b2d..2b7eef37875c 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -645,25 +645,23 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
        struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
        u_int8_t l3proto = nfmsg->nfgen_family;
-        rcu_read_lock();
+        spin_lock_bh(&nf_conntrack_lock);
        last = (struct nf_conn *)cb->args[1];
        for (; cb->args[0] < net->ct.htable_size; cb->args[0]++) {
 restart:
-                hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[cb->args[0]],
+                hlist_nulls_for_each_entry(h, n, &net->ct.hash[cb->args[0]],
                                         hnnode) {
                        if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
                                continue;
                        ct = nf_ct_tuplehash_to_ctrack(h);
-                        if (!atomic_inc_not_zero(&ct->ct_general.use))
-                                continue;
                        /* Dump entries of a given L3 protocol number.
                         * If it is not specified, ie. l3proto == 0,
                         * then dump everything. */
                        if (l3proto && nf_ct_l3num(ct) != l3proto)
-                                goto releasect;
+                                continue;
                        if (cb->args[1]) {
                                if (ct != last)
-                                        goto releasect;
+                                        continue;
                                cb->args[1] = 0;
                        }
                        if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
@@ -681,8 +679,6 @@ restart:
                                if (acct)
                                        memset(acct, 0, sizeof(struct nf_conn_counter[IP_CT_DIR_MAX]));
                        }
-releasect:
-                nf_ct_put(ct);
                }
                if (cb->args[1]) {
                        cb->args[1] = 0;
@@ -690,7 +686,7 @@ releasect:
                }
        }
 out:
-        rcu_read_unlock();
+        spin_unlock_bh(&nf_conntrack_lock);
        if (last)
                nf_ct_put(last);
@@ -976,7 +972,8 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
 free:
        kfree_skb(skb2);
 out:
-        return err;
+        /* this avoids a loop in nfnetlink. */
+        return err == -EAGAIN ? -ENOBUFS : err;
 }
 #ifdef CONFIG_NF_NAT_NEEDED
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 80463507420e..c94237631077 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1325,7 +1325,8 @@ static int __init xt_init(void)
        for_each_possible_cpu(i) {
                struct xt_info_lock *lock = &per_cpu(xt_info_locks, i);
-                spin_lock_init(&lock->lock);
+                seqlock_init(&lock->lock);
                lock->readers = 0;
        }
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index fd95beb72f5d..1072b2c19d31 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -37,7 +37,7 @@
 /* Transport protocol registration */
 static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly;
-static struct phonet_protocol *phonet_proto_get(int protocol)
+static struct phonet_protocol *phonet_proto_get(unsigned int protocol)
 {
        struct phonet_protocol *pp;
@@ -458,7 +458,7 @@ static struct packet_type phonet_packet_type __read_mostly = {
 static DEFINE_MUTEX(proto_tab_lock);
-int __init_or_module phonet_proto_register(int protocol,
+int __init_or_module phonet_proto_register(unsigned int protocol,
                                                struct phonet_protocol *pp)
 {
        int err = 0;
@@ -481,7 +481,7 @@ int __init_or_module phonet_proto_register(int protocol,
 }
 EXPORT_SYMBOL(phonet_proto_register);
-void phonet_proto_unregister(int protocol, struct phonet_protocol *pp)
+void phonet_proto_unregister(unsigned int protocol, struct phonet_protocol *pp)
 {
        mutex_lock(&proto_tab_lock);
        BUG_ON(proto_tab[protocol] != pp);
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 0b9bb2085ce4..74c064c0dfdd 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -808,7 +808,7 @@ static int __init af_rxrpc_init(void)
                goto error_call_jar;
        }
-        rxrpc_workqueue = create_workqueue("krxrpcd");
+        rxrpc_workqueue = alloc_workqueue("krxrpcd", 0, 1);
        if (!rxrpc_workqueue) {
                printk(KERN_NOTICE "RxRPC: Failed to allocate work queue\n");
                goto error_work_queue;
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index a36270a994d7..f04d4a484d53 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -24,7 +24,7 @@ menuconfig NET_SCHED
          To administer these schedulers, you'll need the user-level utilities
          from the package iproute2+tc at <ftp://ftp.tux.org/pub/net/ip-routing/>.
          That package also contains some documentation; for more, check out
-          <http://linux-net.osdl.org/index.php/Iproute2>.
+          <http://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2>.
          This Quality of Service (QoS) support will enable you to use
          Differentiated Services (diffserv) and Resource Reservation Protocol
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 67dc7ce9b63a..83ddfc07e45d 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -508,8 +508,7 @@ static int tcf_csum(struct sk_buff *skb,
        spin_lock(&p->tcf_lock);
        p->tcf_tm.lastuse = jiffies;
-        p->tcf_bstats.bytes += qdisc_pkt_len(skb);
+        bstats_update(&p->tcf_bstats, skb);
-        p->tcf_bstats.packets++;
        action = p->tcf_action;
        update_flags = p->update_flags;
        spin_unlock(&p->tcf_lock);
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 8daef9632255..c2a7c20e81c1 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -209,8 +209,7 @@ static int tcf_ipt(struct sk_buff *skb, struct tc_action *a,
        spin_lock(&ipt->tcf_lock);
        ipt->tcf_tm.lastuse = jiffies;
-        ipt->tcf_bstats.bytes += qdisc_pkt_len(skb);
+        bstats_update(&ipt->tcf_bstats, skb);
-        ipt->tcf_bstats.packets++;
        /* yes, we have to worry about both in and out dev
         worry later - danger - this API seems to have changed
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 0c311be92827..d765067e99db 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -165,8 +165,7 @@ static int tcf_mirred(struct sk_buff *skb, struct tc_action *a,
        spin_lock(&m->tcf_lock);
        m->tcf_tm.lastuse = jiffies;
-        m->tcf_bstats.bytes += qdisc_pkt_len(skb);
+        bstats_update(&m->tcf_bstats, skb);
-        m->tcf_bstats.packets++;
        dev = m->tcfm_dev;
        if (!dev) {
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 186eb837e600..178a4bd7b7cb 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -125,8 +125,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
        egress = p->flags & TCA_NAT_FLAG_EGRESS;
        action = p->tcf_action;
-        p->tcf_bstats.bytes += qdisc_pkt_len(skb);
+        bstats_update(&p->tcf_bstats, skb);
-        p->tcf_bstats.packets++;
        spin_unlock(&p->tcf_lock);
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index a0593c9640db..445bef716f77 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -187,8 +187,7 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
 bad:
        p->tcf_qstats.overlimits++;
 done:
-        p->tcf_bstats.bytes += qdisc_pkt_len(skb);
+        bstats_update(&p->tcf_bstats, skb);
-        p->tcf_bstats.packets++;
        spin_unlock(&p->tcf_lock);
        return p->tcf_action;
 }
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 7ebf7439b478..e2f08b1e2e58 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -298,8 +298,7 @@ static int tcf_act_police(struct sk_buff *skb, struct tc_action *a,
        spin_lock(&police->tcf_lock);
-        police->tcf_bstats.bytes += qdisc_pkt_len(skb);
+        bstats_update(&police->tcf_bstats, skb);
-        police->tcf_bstats.packets++;
        if (police->tcfp_ewma_rate &&
            police->tcf_rate_est.bps >= police->tcfp_ewma_rate) {
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 97e84f3ee775..7287cff7af3e 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -42,8 +42,7 @@ static int tcf_simp(struct sk_buff *skb, struct tc_action *a, struct tcf_result
        spin_lock(&d->tcf_lock);
        d->tcf_tm.lastuse = jiffies;
-        d->tcf_bstats.bytes += qdisc_pkt_len(skb);
+        bstats_update(&d->tcf_bstats, skb);
-        d->tcf_bstats.packets++;
        /* print policy string followed by _ then packet count
         * Example if this was the 3rd packet and the string was "hello"
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index 66cbf4eb8855..836f5fee9e58 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -46,8 +46,7 @@ static int tcf_skbedit(struct sk_buff *skb, struct tc_action *a,
        spin_lock(&d->tcf_lock);
        d->tcf_tm.lastuse = jiffies;
-        d->tcf_bstats.bytes += qdisc_pkt_len(skb);
+        bstats_update(&d->tcf_bstats, skb);
-        d->tcf_bstats.packets++;
        if (d->flags & SKBEDIT_F_PRIORITY)
                skb->priority = d->priority;
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 282540778aa8..943d733409d0 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -422,10 +422,8 @@ drop: __maybe_unused
                }
                return ret;
        }
-        sch->bstats.bytes += qdisc_pkt_len(skb);
+        qdisc_bstats_update(sch, skb);
-        sch->bstats.packets++;
+        bstats_update(&flow->bstats, skb);
-        flow->bstats.bytes += qdisc_pkt_len(skb);
-        flow->bstats.packets++;
        /*
         * Okay, this may seem weird. We pretend we've dropped the packet if
         * it goes via ATM. The reason for this is that the outer qdisc
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index eb7631590865..c80d1c210c5d 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -390,8 +390,7 @@ cbq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        ret = qdisc_enqueue(skb, cl->q);
        if (ret == NET_XMIT_SUCCESS) {
                sch->q.qlen++;
-                sch->bstats.packets++;
+                qdisc_bstats_update(sch, skb);
-                sch->bstats.bytes += qdisc_pkt_len(skb);
                cbq_mark_toplevel(q, cl);
                if (!cl->next_alive)
                        cbq_activate_class(cl);
@@ -650,8 +649,7 @@ static int cbq_reshape_fail(struct sk_buff *skb, struct Qdisc *child)
                ret = qdisc_enqueue(skb, cl->q);
                if (ret == NET_XMIT_SUCCESS) {
                        sch->q.qlen++;
-                        sch->bstats.packets++;
+                        qdisc_bstats_update(sch, skb);
-                        sch->bstats.bytes += qdisc_pkt_len(skb);
                        if (!cl->next_alive)
                                cbq_activate_class(cl);
                        return 0;
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index aa8b5313f8cf..de55e642eafc 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -351,7 +351,6 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
        struct drr_sched *q = qdisc_priv(sch);
        struct drr_class *cl;
-        unsigned int len;
        int err;
        cl = drr_classify(skb, sch, &err);
@@ -362,7 +361,6 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                return err;
        }
-        len = qdisc_pkt_len(skb);
        err = qdisc_enqueue(skb, cl->qdisc);
        if (unlikely(err != NET_XMIT_SUCCESS)) {
                if (net_xmit_drop_count(err)) {
@@ -377,10 +375,8 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                cl->deficit = cl->quantum;
        }
-        cl->bstats.packets++;
+        bstats_update(&cl->bstats, skb);
-        cl->bstats.bytes += len;
+        qdisc_bstats_update(sch, skb);
-        sch->bstats.packets++;
-        sch->bstats.bytes += len;
        sch->q.qlen++;
        return err;
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 1d295d62bb5c..60f4bdd4408e 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -260,8 +260,7 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                return err;
        }
-        sch->bstats.bytes += qdisc_pkt_len(skb);
+        qdisc_bstats_update(sch, skb);
-        sch->bstats.packets++;
        sch->q.qlen++;
        return NET_XMIT_SUCCESS;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 069c62b7bb36..2e45791d4f6c 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1599,10 +1599,8 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        if (cl->qdisc->q.qlen == 1)
                set_active(cl, qdisc_pkt_len(skb));
-        cl->bstats.packets++;
+        bstats_update(&cl->bstats, skb);
-        cl->bstats.bytes += qdisc_pkt_len(skb);
+        qdisc_bstats_update(sch, skb);
-        sch->bstats.packets++;
-        sch->bstats.bytes += qdisc_pkt_len(skb);
        sch->q.qlen++;
        return NET_XMIT_SUCCESS;
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 01b519d6c52d..984c1b0c6836 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -569,15 +569,12 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                }
                return ret;
        } else {
-                cl->bstats.packets +=
+                bstats_update(&cl->bstats, skb);
-                        skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1;
-                cl->bstats.bytes += qdisc_pkt_len(skb);
                htb_activate(q, cl);
        }
        sch->q.qlen++;
-        sch->bstats.packets += skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1;
+        qdisc_bstats_update(sch, skb);
-        sch->bstats.bytes += qdisc_pkt_len(skb);
        return NET_XMIT_SUCCESS;
 }
@@ -648,12 +645,10 @@ static void htb_charge_class(struct htb_sched *q, struct htb_class *cl,
                                htb_add_to_wait_tree(q, cl, diff);
                }
-                /* update byte stats except for leaves which are already updated */
+                /* update basic stats except for leaves which are already updated */
-                if (cl->level) {
+                if (cl->level)
-                        cl->bstats.bytes += bytes;
+                        bstats_update(&cl->bstats, skb);
-                        cl->bstats.packets += skb_is_gso(skb)?
-                                        skb_shinfo(skb)->gso_segs:1;
-                }
                cl = cl->parent;
        }
 }
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index f10e34a68445..bce1665239b8 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -63,8 +63,7 @@ static int ingress_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        result = tc_classify(skb, p->filter_list, &res);
-        sch->bstats.packets++;
+        qdisc_bstats_update(sch, skb);
-        sch->bstats.bytes += qdisc_pkt_len(skb);
        switch (result) {
        case TC_ACT_SHOT:
                result = TC_ACT_SHOT;
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
index 32690deab5d0..21f13da24763 100644
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -83,8 +83,7 @@ multiq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        ret = qdisc_enqueue(skb, qdisc);
        if (ret == NET_XMIT_SUCCESS) {
-                sch->bstats.bytes += qdisc_pkt_len(skb);
+                qdisc_bstats_update(sch, skb);
-                sch->bstats.packets++;
                sch->q.qlen++;
                return NET_XMIT_SUCCESS;
        }
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index e5593c083a78..1c4bce863479 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -240,8 +240,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        if (likely(ret == NET_XMIT_SUCCESS)) {
                sch->q.qlen++;
-                sch->bstats.bytes += qdisc_pkt_len(skb);
+                qdisc_bstats_update(sch, skb);
-                sch->bstats.packets++;
        } else if (net_xmit_drop_count(ret)) {
                sch->qstats.drops++;
        }
@@ -477,8 +476,7 @@ static int tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
                __skb_queue_after(list, skb, nskb);
                sch->qstats.backlog += qdisc_pkt_len(nskb);
-                sch->bstats.bytes += qdisc_pkt_len(nskb);
+                qdisc_bstats_update(sch, nskb);
-                sch->bstats.packets++;
                return NET_XMIT_SUCCESS;
        }
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index b1c95bce33ce..966158d49dd1 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -84,8 +84,7 @@ prio_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        ret = qdisc_enqueue(skb, qdisc);
        if (ret == NET_XMIT_SUCCESS) {
-                sch->bstats.bytes += qdisc_pkt_len(skb);
+                qdisc_bstats_update(sch, skb);
-                sch->bstats.packets++;
                sch->q.qlen++;
                return NET_XMIT_SUCCESS;
        }
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index a67ba3c5a0cc..a6009c5a2c97 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -94,8 +94,7 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc* sch)
        ret = qdisc_enqueue(skb, child);
        if (likely(ret == NET_XMIT_SUCCESS)) {
-                sch->bstats.bytes += qdisc_pkt_len(skb);
+                qdisc_bstats_update(sch, skb);
-                sch->bstats.packets++;
                sch->q.qlen++;
        } else if (net_xmit_drop_count(ret)) {
                q->stats.pdrop++;
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index d54ac94066c2..239ec53a634d 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -403,8 +403,7 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                slot->allot = q->scaled_quantum;
        }
        if (++sch->q.qlen <= q->limit) {
-                sch->bstats.bytes += qdisc_pkt_len(skb);
+                qdisc_bstats_update(sch, skb);
-                sch->bstats.packets++;
                return NET_XMIT_SUCCESS;
        }
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 641a30d64635..77565e721811 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -134,8 +134,7 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
        }
        sch->q.qlen++;
-        sch->bstats.bytes += qdisc_pkt_len(skb);
+        qdisc_bstats_update(sch, skb);
-        sch->bstats.packets++;
        return NET_XMIT_SUCCESS;
 }
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 106479a7c94a..84ce48eadff4 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -59,6 +59,10 @@ struct teql_master
        struct net_device *dev;
        struct Qdisc *slaves;
        struct list_head master_list;
+        unsigned long   tx_bytes;
+        unsigned long   tx_packets;
+        unsigned long   tx_errors;
+        unsigned long   tx_dropped;
 };
 struct teql_sched_data
@@ -83,8 +87,7 @@ teql_enqueue(struct sk_buff *skb, struct Qdisc* sch)
        if (q->q.qlen < dev->tx_queue_len) {
                __skb_queue_tail(&q->q, skb);
-                sch->bstats.bytes += qdisc_pkt_len(skb);
+                qdisc_bstats_update(sch, skb);
-                sch->bstats.packets++;
                return NET_XMIT_SUCCESS;
        }
@@ -275,7 +278,6 @@ static inline int teql_resolve(struct sk_buff *skb,
 static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct teql_master *master = netdev_priv(dev);
-        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
        struct Qdisc *start, *q;
        int busy;
        int nores;
@@ -315,8 +317,8 @@ restart:
                                        __netif_tx_unlock(slave_txq);
                                        master->slaves = NEXT_SLAVE(q);
                                        netif_wake_queue(dev);
-                                        txq->tx_packets++;
+                                        master->tx_packets++;
-                                        txq->tx_bytes += length;
+                                        master->tx_bytes += length;
                                        return NETDEV_TX_OK;
                                }
                                __netif_tx_unlock(slave_txq);
@@ -343,10 +345,10 @@ restart:
                netif_stop_queue(dev);
                return NETDEV_TX_BUSY;
        }
-        dev->stats.tx_errors++;
+        master->tx_errors++;
 drop:
-        txq->tx_dropped++;
+        master->tx_dropped++;
        dev_kfree_skb(skb);
        return NETDEV_TX_OK;
 }
@@ -399,6 +401,18 @@ static int teql_master_close(struct net_device *dev)
        return 0;
 }
+static struct rtnl_link_stats64 *teql_master_stats64(struct net_device *dev,
+                                                     struct rtnl_link_stats64 *stats)
+{
+        struct teql_master *m = netdev_priv(dev);
+        stats->tx_packets       = m->tx_packets;
+        stats->tx_bytes         = m->tx_bytes;
+        stats->tx_errors        = m->tx_errors;
+        stats->tx_dropped       = m->tx_dropped;
+        return stats;
+}
 static int teql_master_mtu(struct net_device *dev, int new_mtu)
 {
        struct teql_master *m = netdev_priv(dev);
@@ -423,6 +437,7 @@ static const struct net_device_ops teql_netdev_ops = {
        .ndo_open       = teql_master_open,
        .ndo_stop       = teql_master_close,
        .ndo_start_xmit = teql_master_xmit,
+        .ndo_get_stats64 = teql_master_stats64,
        .ndo_change_mtu = teql_master_mtu,
 };
diff --git a/net/socket.c b/net/socket.c
index ccc576a6a508..ac2219f90d5d 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -306,20 +306,6 @@ static const struct super_operations sockfs_ops = {
        .statfs         = simple_statfs,
 };
-static struct dentry *sockfs_mount(struct file_system_type *fs_type,
-                         int flags, const char *dev_name, void *data)
-{
-        return mount_pseudo(fs_type, "socket:", &sockfs_ops, SOCKFS_MAGIC);
-}
-static struct vfsmount *sock_mnt __read_mostly;
-static struct file_system_type sock_fs_type = {
-        .name =         "sockfs",
-        .mount =        sockfs_mount,
-        .kill_sb =      kill_anon_super,
-};
 /*
 * sockfs_dname() is called from d_path().
 */
@@ -333,6 +319,21 @@ static const struct dentry_operations sockfs_dentry_operations = {
        .d_dname  = sockfs_dname,
 };
+static struct dentry *sockfs_mount(struct file_system_type *fs_type,
+                         int flags, const char *dev_name, void *data)
+{
+        return mount_pseudo(fs_type, "socket:", &sockfs_ops,
+                &sockfs_dentry_operations, SOCKFS_MAGIC);
+}
+static struct vfsmount *sock_mnt __read_mostly;
+static struct file_system_type sock_fs_type = {
+        .name =         "sockfs",
+        .mount =        sockfs_mount,
+        .kill_sb =      kill_anon_super,
+};
 /*
 *      Obtains the first available file descriptor and sets it up for use.
 *
@@ -368,7 +369,6 @@ static int sock_alloc_file(struct socket *sock, struct file **f, int flags)
        }
        path.mnt = mntget(sock_mnt);
-        d_set_d_op(path.dentry, &sockfs_dentry_operations);
        d_instantiate(path.dentry, SOCK_INODE(sock));
        SOCK_INODE(sock)->i_fop = &socket_file_ops;
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index afe67849269f..67e31276682a 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -563,8 +563,17 @@ rpcauth_checkverf(struct rpc_task *task, __be32 *p)
        return cred->cr_ops->crvalidate(task, p);
 }
+static void rpcauth_wrap_req_encode(kxdreproc_t encode, struct rpc_rqst *rqstp,
+                                   __be32 *data, void *obj)
+{
+        struct xdr_stream xdr;
+        xdr_init_encode(&xdr, &rqstp->rq_snd_buf, data);
+        encode(rqstp, &xdr, obj);
+}
 int
-rpcauth_wrap_req(struct rpc_task *task, kxdrproc_t encode, void *rqstp,
+rpcauth_wrap_req(struct rpc_task *task, kxdreproc_t encode, void *rqstp,
                __be32 *data, void *obj)
 {
        struct rpc_cred *cred = task->tk_rqstp->rq_cred;
@@ -574,11 +583,22 @@ rpcauth_wrap_req(struct rpc_task *task, kxdrproc_t encode, void *rqstp,
        if (cred->cr_ops->crwrap_req)
                return cred->cr_ops->crwrap_req(task, encode, rqstp, data, obj);
        /* By default, we encode the arguments normally. */
-        return encode(rqstp, data, obj);
+        rpcauth_wrap_req_encode(encode, rqstp, data, obj);
+        return 0;
+}
+static int
+rpcauth_unwrap_req_decode(kxdrdproc_t decode, struct rpc_rqst *rqstp,
+                          __be32 *data, void *obj)
+{
+        struct xdr_stream xdr;
+        xdr_init_decode(&xdr, &rqstp->rq_rcv_buf, data);
+        return decode(rqstp, &xdr, obj);
 }
 int
-rpcauth_unwrap_resp(struct rpc_task *task, kxdrproc_t decode, void *rqstp,
+rpcauth_unwrap_resp(struct rpc_task *task, kxdrdproc_t decode, void *rqstp,
                __be32 *data, void *obj)
 {
        struct rpc_cred *cred = task->tk_rqstp->rq_cred;
@@ -589,7 +609,7 @@ rpcauth_unwrap_resp(struct rpc_task *task, kxdrproc_t decode, void *rqstp,
                return cred->cr_ops->crunwrap_resp(task, decode, rqstp,
                                                   data, obj);
        /* By default, we decode the arguments normally. */
-        return decode(rqstp, data, obj);
+        return rpcauth_unwrap_req_decode(decode, rqstp, data, obj);
 }
 int
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 3835ce35e224..45dbf1521b9a 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1231,9 +1231,19 @@ out_bad:
        return NULL;
 }
+static void gss_wrap_req_encode(kxdreproc_t encode, struct rpc_rqst *rqstp,
+                                __be32 *p, void *obj)
+{
+        struct xdr_stream xdr;
+        xdr_init_encode(&xdr, &rqstp->rq_snd_buf, p);
+        encode(rqstp, &xdr, obj);
+}
 static inline int
 gss_wrap_req_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
-                kxdrproc_t encode, struct rpc_rqst *rqstp, __be32 *p, void *obj)
+                   kxdreproc_t encode, struct rpc_rqst *rqstp,
+                   __be32 *p, void *obj)
 {
        struct xdr_buf  *snd_buf = &rqstp->rq_snd_buf;
        struct xdr_buf  integ_buf;
@@ -1249,9 +1259,7 @@ gss_wrap_req_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
        offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
        *p++ = htonl(rqstp->rq_seqno);
-        status = encode(rqstp, p, obj);
+        gss_wrap_req_encode(encode, rqstp, p, obj);
-        if (status)
-                return status;
        if (xdr_buf_subsegment(snd_buf, &integ_buf,
                                offset, snd_buf->len - offset))
@@ -1325,7 +1333,8 @@ out:
 static inline int
 gss_wrap_req_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
-                kxdrproc_t encode, struct rpc_rqst *rqstp, __be32 *p, void *obj)
+                  kxdreproc_t encode, struct rpc_rqst *rqstp,
+                  __be32 *p, void *obj)
 {
        struct xdr_buf  *snd_buf = &rqstp->rq_snd_buf;
        u32             offset;
@@ -1342,9 +1351,7 @@ gss_wrap_req_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
        offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
        *p++ = htonl(rqstp->rq_seqno);
-        status = encode(rqstp, p, obj);
+        gss_wrap_req_encode(encode, rqstp, p, obj);
-        if (status)
-                return status;
        status = alloc_enc_pages(rqstp);
        if (status)
@@ -1394,7 +1401,7 @@ gss_wrap_req_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
 static int
 gss_wrap_req(struct rpc_task *task,
-             kxdrproc_t encode, void *rqstp, __be32 *p, void *obj)
+             kxdreproc_t encode, void *rqstp, __be32 *p, void *obj)
 {
        struct rpc_cred *cred = task->tk_rqstp->rq_cred;
        struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
@@ -1407,12 +1414,14 @@ gss_wrap_req(struct rpc_task *task,
                /* The spec seems a little ambiguous here, but I think that not
                 * wrapping context destruction requests makes the most sense.
                 */
-                status = encode(rqstp, p, obj);
+                gss_wrap_req_encode(encode, rqstp, p, obj);
+                status = 0;
                goto out;
        }
        switch (gss_cred->gc_service) {
                case RPC_GSS_SVC_NONE:
-                        status = encode(rqstp, p, obj);
+                        gss_wrap_req_encode(encode, rqstp, p, obj);
+                        status = 0;
                        break;
                case RPC_GSS_SVC_INTEGRITY:
                        status = gss_wrap_req_integ(cred, ctx, encode,
@@ -1494,10 +1503,19 @@ gss_unwrap_resp_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
        return 0;
 }
+static int
+gss_unwrap_req_decode(kxdrdproc_t decode, struct rpc_rqst *rqstp,
+                      __be32 *p, void *obj)
+{
+        struct xdr_stream xdr;
+        xdr_init_decode(&xdr, &rqstp->rq_rcv_buf, p);
+        return decode(rqstp, &xdr, obj);
+}
 static int
 gss_unwrap_resp(struct rpc_task *task,
-                kxdrproc_t decode, void *rqstp, __be32 *p, void *obj)
+                kxdrdproc_t decode, void *rqstp, __be32 *p, void *obj)
 {
        struct rpc_cred *cred = task->tk_rqstp->rq_cred;
        struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
@@ -1528,7 +1546,7 @@ gss_unwrap_resp(struct rpc_task *task,
        cred->cr_auth->au_rslack = cred->cr_auth->au_verfsize + (p - savedp)
                                                + (savedlen - head->iov_len);
 out_decode:
-        status = decode(rqstp, p, obj);
+        status = gss_unwrap_req_decode(decode, rqstp, p, obj);
 out:
        gss_put_ctx(ctx);
        dprintk("RPC: %5u gss_unwrap_resp returning %d\n", task->tk_pid,
diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index 75ee993ea057..9576f35ab701 100644
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -137,7 +137,7 @@ arcfour_hmac_md5_usage_to_salt(unsigned int usage, u8 salt[4])
                ms_usage = 13;
                break;
        default:
-                return EINVAL;;
+                return -EINVAL;
        }
        salt[0] = (ms_usage >> 0) & 0xff;
        salt[1] = (ms_usage >> 8) & 0xff;
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index dec2a6fc7c12..bcdae78fdfc6 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -67,7 +67,6 @@ static int netobj_equal(struct xdr_netobj *a, struct xdr_netobj *b)
 #define RSI_HASHBITS    6
 #define RSI_HASHMAX     (1<<RSI_HASHBITS)
-#define RSI_HASHMASK    (RSI_HASHMAX-1)
 struct rsi {
        struct cache_head       h;
@@ -319,7 +318,6 @@ static struct rsi *rsi_update(struct rsi *new, struct rsi *old)
 #define RSC_HASHBITS    10
 #define RSC_HASHMAX     (1<<RSC_HASHBITS)
-#define RSC_HASHMASK    (RSC_HASHMAX-1)
 #define GSS_SEQ_WIN     128
diff --git a/net/sunrpc/bc_svc.c b/net/sunrpc/bc_svc.c
index 7dcfe0cc3500..1dd1a6890007 100644
--- a/net/sunrpc/bc_svc.c
+++ b/net/sunrpc/bc_svc.c
@@ -59,8 +59,8 @@ int bc_send(struct rpc_rqst *req)
                ret = task->tk_status;
                rpc_put_task(task);
        }
-        return ret;
        dprintk("RPC:       bc_send ret= %d\n", ret);
+        return ret;
 }
 #endif /* CONFIG_NFS_V4_1 */
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index e433e7580e27..72ad836e4fe0 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -37,7 +37,7 @@
 #define  RPCDBG_FACILITY RPCDBG_CACHE
-static void cache_defer_req(struct cache_req *req, struct cache_head *item);
+static bool cache_defer_req(struct cache_req *req, struct cache_head *item);
 static void cache_revisit_request(struct cache_head *item);
 static void cache_init(struct cache_head *h)
@@ -128,6 +128,7 @@ static void cache_fresh_locked(struct cache_head *head, time_t expiry)
 {
        head->expiry_time = expiry;
        head->last_refresh = seconds_since_boot();
+        smp_wmb(); /* paired with smp_rmb() in cache_is_valid() */
        set_bit(CACHE_VALID, &head->flags);
 }
@@ -208,11 +209,36 @@ static inline int cache_is_valid(struct cache_detail *detail, struct cache_head
                /* entry is valid */
                if (test_bit(CACHE_NEGATIVE, &h->flags))
                        return -ENOENT;
-                else
+                else {
+                        /*
+                         * In combination with write barrier in
+                         * sunrpc_cache_update, ensures that anyone
+                         * using the cache entry after this sees the
+                         * updated contents:
+                         */
+                        smp_rmb();
                        return 0;
+                }
        }
 }
+static int try_to_negate_entry(struct cache_detail *detail, struct cache_head *h)
+{
+        int rv;
+        write_lock(&detail->hash_lock);
+        rv = cache_is_valid(detail, h);
+        if (rv != -EAGAIN) {
+                write_unlock(&detail->hash_lock);
+                return rv;
+        }
+        set_bit(CACHE_NEGATIVE, &h->flags);
+        cache_fresh_locked(h, seconds_since_boot()+CACHE_NEW_EXPIRY);
+        write_unlock(&detail->hash_lock);
+        cache_fresh_unlocked(h, detail);
+        return -ENOENT;
+}
 /*
 * This is the generic cache management routine for all
 * the authentication caches.
@@ -251,14 +277,8 @@ int cache_check(struct cache_detail *detail,
                        case -EINVAL:
                                clear_bit(CACHE_PENDING, &h->flags);
                                cache_revisit_request(h);
-                                if (rv == -EAGAIN) {
+                                rv = try_to_negate_entry(detail, h);
-                                        set_bit(CACHE_NEGATIVE, &h->flags);
-                                        cache_fresh_locked(h, seconds_since_boot()+CACHE_NEW_EXPIRY);
-                                        cache_fresh_unlocked(h, detail);
-                                        rv = -ENOENT;
-                                }
                                break;
                        case -EAGAIN:
                                clear_bit(CACHE_PENDING, &h->flags);
                                cache_revisit_request(h);
@@ -268,9 +288,11 @@ int cache_check(struct cache_detail *detail,
        }
        if (rv == -EAGAIN) {
-                cache_defer_req(rqstp, h);
+                if (!cache_defer_req(rqstp, h)) {
-                if (!test_bit(CACHE_PENDING, &h->flags)) {
+                        /*
-                        /* Request is not deferred */
+                         * Request was not deferred; handle it as best
+                         * we can ourselves:
+                         */
                        rv = cache_is_valid(detail, h);
                        if (rv == -EAGAIN)
                                rv = -ETIMEDOUT;
@@ -618,18 +640,19 @@ static void cache_limit_defers(void)
                discard->revisit(discard, 1);
 }
-static void cache_defer_req(struct cache_req *req, struct cache_head *item)
+/* Return true if and only if a deferred request is queued. */
+static bool cache_defer_req(struct cache_req *req, struct cache_head *item)
 {
        struct cache_deferred_req *dreq;
        if (req->thread_wait) {
                cache_wait_req(req, item);
                if (!test_bit(CACHE_PENDING, &item->flags))
-                        return;
+                        return false;
        }
        dreq = req->defer(req);
        if (dreq == NULL)
-                return;
+                return false;
        setup_deferral(dreq, item, 1);
        if (!test_bit(CACHE_PENDING, &item->flags))
                /* Bit could have been cleared before we managed to
@@ -638,6 +661,7 @@ static void cache_defer_req(struct cache_req *req, struct cache_head *item)
                cache_revisit_request(item);
        cache_limit_defers();
+        return true;
 }
 static void cache_revisit_request(struct cache_head *item)
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 92ce94f5146b..57d344cf2256 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1095,7 +1095,7 @@ static void
 rpc_xdr_encode(struct rpc_task *task)
 {
        struct rpc_rqst *req = task->tk_rqstp;
-        kxdrproc_t      encode;
+        kxdreproc_t     encode;
        __be32          *p;
        dprint_status(task);
@@ -1535,7 +1535,7 @@ call_decode(struct rpc_task *task)
 {
        struct rpc_clnt *clnt = task->tk_client;
        struct rpc_rqst *req = task->tk_rqstp;
-        kxdrproc_t      decode = task->tk_msg.rpc_proc->p_decode;
+        kxdrdproc_t     decode = task->tk_msg.rpc_proc->p_decode;
        __be32          *p;
        dprintk("RPC: %5u call_decode (status %d)\n",
@@ -1776,12 +1776,11 @@ out_overflow:
        goto out_garbage;
 }
-static int rpcproc_encode_null(void *rqstp, __be32 *data, void *obj)
+static void rpcproc_encode_null(void *rqstp, struct xdr_stream *xdr, void *obj)
 {
-        return 0;
 }
-static int rpcproc_decode_null(void *rqstp, __be32 *data, void *obj)
+static int rpcproc_decode_null(void *rqstp, struct xdr_stream *xdr, void *obj)
 {
        return 0;
 }
@@ -1830,23 +1829,15 @@ static void rpc_show_task(const struct rpc_clnt *clnt,
                          const struct rpc_task *task)
 {
        const char *rpc_waitq = "none";
-        char *p, action[KSYM_SYMBOL_LEN];
        if (RPC_IS_QUEUED(task))
                rpc_waitq = rpc_qname(task->tk_waitqueue);
-        /* map tk_action pointer to a function name; then trim off
+        printk(KERN_INFO "%5u %04x %6d %8p %8p %8ld %8p %sv%u %s a:%ps q:%s\n",
-         * the "+0x0 [sunrpc]" */
-        sprint_symbol(action, (unsigned long)task->tk_action);
-        p = strchr(action, '+');
-        if (p)
-                *p = '\0';
-        printk(KERN_INFO "%5u %04x %6d %8p %8p %8ld %8p %sv%u %s a:%s q:%s\n",
                task->tk_pid, task->tk_flags, task->tk_status,
                clnt, task->tk_rqstp, task->tk_timeout, task->tk_ops,
                clnt->cl_protname, clnt->cl_vers, rpc_proc_name(task),
-                action, rpc_waitq);
+                task->tk_action, rpc_waitq);
 }
 void rpc_show_tasks(void)
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 09f01f41e55a..72bc53683965 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -474,7 +474,7 @@ static int __rpc_create_common(struct inode *dir, struct dentry *dentry,
 {
        struct inode *inode;
-        BUG_ON(!d_unhashed(dentry));
+        d_drop(dentry);
        inode = rpc_get_inode(dir->i_sb, mode);
        if (!inode)
                goto out_err;
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index fa6d7ca2c851..c652e4cc9fe9 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -57,10 +57,6 @@ enum {
        RPCBPROC_GETSTAT,
 };
-#define RPCB_HIGHPROC_2         RPCBPROC_CALLIT
-#define RPCB_HIGHPROC_3         RPCBPROC_TADDR2UADDR
-#define RPCB_HIGHPROC_4         RPCBPROC_GETSTAT
 /*
 * r_owner
 *
@@ -693,46 +689,37 @@ static void rpcb_getport_done(struct rpc_task *child, void *data)
 * XDR functions for rpcbind
 */
-static int rpcb_enc_mapping(struct rpc_rqst *req, __be32 *p,
+static void rpcb_enc_mapping(struct rpc_rqst *req, struct xdr_stream *xdr,
-                            const struct rpcbind_args *rpcb)
+                             const struct rpcbind_args *rpcb)
 {
        struct rpc_task *task = req->rq_task;
-        struct xdr_stream xdr;
+        __be32 *p;
        dprintk("RPC: %5u encoding PMAP_%s call (%u, %u, %d, %u)\n",
                        task->tk_pid, task->tk_msg.rpc_proc->p_name,
                        rpcb->r_prog, rpcb->r_vers, rpcb->r_prot, rpcb->r_port);
-        xdr_init_encode(&xdr, &req->rq_snd_buf, p);
+        p = xdr_reserve_space(xdr, RPCB_mappingargs_sz << 2);
+        *p++ = cpu_to_be32(rpcb->r_prog);
-        p = xdr_reserve_space(&xdr, sizeof(__be32) * RPCB_mappingargs_sz);
+        *p++ = cpu_to_be32(rpcb->r_vers);
-        if (unlikely(p == NULL))
+        *p++ = cpu_to_be32(rpcb->r_prot);
-                return -EIO;
+        *p   = cpu_to_be32(rpcb->r_port);
-        *p++ = htonl(rpcb->r_prog);
-        *p++ = htonl(rpcb->r_vers);
-        *p++ = htonl(rpcb->r_prot);
-        *p   = htonl(rpcb->r_port);
-        return 0;
 }
-static int rpcb_dec_getport(struct rpc_rqst *req, __be32 *p,
+static int rpcb_dec_getport(struct rpc_rqst *req, struct xdr_stream *xdr,
                            struct rpcbind_args *rpcb)
 {
        struct rpc_task *task = req->rq_task;
-        struct xdr_stream xdr;
        unsigned long port;
+        __be32 *p;
-        xdr_init_decode(&xdr, &req->rq_rcv_buf, p);
        rpcb->r_port = 0;
-        p = xdr_inline_decode(&xdr, sizeof(__be32));
+        p = xdr_inline_decode(xdr, 4);
        if (unlikely(p == NULL))
                return -EIO;
-        port = ntohl(*p);
+        port = be32_to_cpup(p);
        dprintk("RPC: %5u PMAP_%s result: %lu\n", task->tk_pid,
                        task->tk_msg.rpc_proc->p_name, port);
        if (unlikely(port > USHRT_MAX))
@@ -742,20 +729,18 @@ static int rpcb_dec_getport(struct rpc_rqst *req, __be32 *p,
        return 0;
 }
-static int rpcb_dec_set(struct rpc_rqst *req, __be32 *p,
+static int rpcb_dec_set(struct rpc_rqst *req, struct xdr_stream *xdr,
                        unsigned int *boolp)
 {
        struct rpc_task *task = req->rq_task;
-        struct xdr_stream xdr;
+        __be32 *p;
-        xdr_init_decode(&xdr, &req->rq_rcv_buf, p);
-        p = xdr_inline_decode(&xdr, sizeof(__be32));
+        p = xdr_inline_decode(xdr, 4);
        if (unlikely(p == NULL))
                return -EIO;
        *boolp = 0;
-        if (*p)
+        if (*p != xdr_zero)
                *boolp = 1;
        dprintk("RPC: %5u RPCB_%s call %s\n",
@@ -764,73 +749,53 @@ static int rpcb_dec_set(struct rpc_rqst *req, __be32 *p,
        return 0;
 }
-static int encode_rpcb_string(struct xdr_stream *xdr, const char *string,
+static void encode_rpcb_string(struct xdr_stream *xdr, const char *string,
-                                const u32 maxstrlen)
+                               const u32 maxstrlen)
 {
-        u32 len;
        __be32 *p;
+        u32 len;
-        if (unlikely(string == NULL))
-                return -EIO;
        len = strlen(string);
-        if (unlikely(len > maxstrlen))
+        BUG_ON(len > maxstrlen);
-                return -EIO;
+        p = xdr_reserve_space(xdr, 4 + len);
-        p = xdr_reserve_space(xdr, sizeof(__be32) + len);
-        if (unlikely(p == NULL))
-                return -EIO;
        xdr_encode_opaque(p, string, len);
-        return 0;
 }
-static int rpcb_enc_getaddr(struct rpc_rqst *req, __be32 *p,
+static void rpcb_enc_getaddr(struct rpc_rqst *req, struct xdr_stream *xdr,
-                            const struct rpcbind_args *rpcb)
+                             const struct rpcbind_args *rpcb)
 {
        struct rpc_task *task = req->rq_task;
-        struct xdr_stream xdr;
+        __be32 *p;
        dprintk("RPC: %5u encoding RPCB_%s call (%u, %u, '%s', '%s')\n",
                        task->tk_pid, task->tk_msg.rpc_proc->p_name,
                        rpcb->r_prog, rpcb->r_vers,
                        rpcb->r_netid, rpcb->r_addr);
-        xdr_init_encode(&xdr, &req->rq_snd_buf, p);
+        p = xdr_reserve_space(xdr, (RPCB_program_sz + RPCB_version_sz) << 2);
+        *p++ = cpu_to_be32(rpcb->r_prog);
-        p = xdr_reserve_space(&xdr,
+        *p = cpu_to_be32(rpcb->r_vers);
-                        sizeof(__be32) * (RPCB_program_sz + RPCB_version_sz));
-        if (unlikely(p == NULL))
-                return -EIO;
-        *p++ = htonl(rpcb->r_prog);
-        *p = htonl(rpcb->r_vers);
-        if (encode_rpcb_string(&xdr, rpcb->r_netid, RPCBIND_MAXNETIDLEN))
-                return -EIO;
-        if (encode_rpcb_string(&xdr, rpcb->r_addr, RPCBIND_MAXUADDRLEN))
-                return -EIO;
-        if (encode_rpcb_string(&xdr, rpcb->r_owner, RPCB_MAXOWNERLEN))
-                return -EIO;
-        return 0;
+        encode_rpcb_string(xdr, rpcb->r_netid, RPCBIND_MAXNETIDLEN);
+        encode_rpcb_string(xdr, rpcb->r_addr, RPCBIND_MAXUADDRLEN);
+        encode_rpcb_string(xdr, rpcb->r_owner, RPCB_MAXOWNERLEN);
 }
-static int rpcb_dec_getaddr(struct rpc_rqst *req, __be32 *p,
+static int rpcb_dec_getaddr(struct rpc_rqst *req, struct xdr_stream *xdr,
                            struct rpcbind_args *rpcb)
 {
        struct sockaddr_storage address;
        struct sockaddr *sap = (struct sockaddr *)&address;
        struct rpc_task *task = req->rq_task;
-        struct xdr_stream xdr;
+        __be32 *p;
        u32 len;
        rpcb->r_port = 0;
-        xdr_init_decode(&xdr, &req->rq_rcv_buf, p);
+        p = xdr_inline_decode(xdr, 4);
-        p = xdr_inline_decode(&xdr, sizeof(__be32));
        if (unlikely(p == NULL))
                goto out_fail;
-        len = ntohl(*p);
+        len = be32_to_cpup(p);
        /*
         * If the returned universal address is a null string,
@@ -845,7 +810,7 @@ static int rpcb_dec_getaddr(struct rpc_rqst *req, __be32 *p,
        if (unlikely(len > RPCBIND_MAXUADDRLEN))
                goto out_fail;
-        p = xdr_inline_decode(&xdr, len);
+        p = xdr_inline_decode(xdr, len);
        if (unlikely(p == NULL))
                goto out_fail;
        dprintk("RPC: %5u RPCB_%s reply: %s\n", task->tk_pid,
@@ -871,8 +836,8 @@ out_fail:
 static struct rpc_procinfo rpcb_procedures2[] = {
        [RPCBPROC_SET] = {
                .p_proc         = RPCBPROC_SET,
-                .p_encode       = (kxdrproc_t)rpcb_enc_mapping,
+                .p_encode       = (kxdreproc_t)rpcb_enc_mapping,
-                .p_decode       = (kxdrproc_t)rpcb_dec_set,
+                .p_decode       = (kxdrdproc_t)rpcb_dec_set,
                .p_arglen       = RPCB_mappingargs_sz,
                .p_replen       = RPCB_setres_sz,
                .p_statidx      = RPCBPROC_SET,
@@ -881,8 +846,8 @@ static struct rpc_procinfo rpcb_procedures2[] = {
        },
        [RPCBPROC_UNSET] = {
                .p_proc         = RPCBPROC_UNSET,
-                .p_encode       = (kxdrproc_t)rpcb_enc_mapping,
+                .p_encode       = (kxdreproc_t)rpcb_enc_mapping,
-                .p_decode       = (kxdrproc_t)rpcb_dec_set,
+                .p_decode       = (kxdrdproc_t)rpcb_dec_set,
                .p_arglen       = RPCB_mappingargs_sz,
                .p_replen       = RPCB_setres_sz,
                .p_statidx      = RPCBPROC_UNSET,
@@ -891,8 +856,8 @@ static struct rpc_procinfo rpcb_procedures2[] = {
        },
        [RPCBPROC_GETPORT] = {
                .p_proc         = RPCBPROC_GETPORT,
-                .p_encode       = (kxdrproc_t)rpcb_enc_mapping,
+                .p_encode       = (kxdreproc_t)rpcb_enc_mapping,
-                .p_decode       = (kxdrproc_t)rpcb_dec_getport,
+                .p_decode       = (kxdrdproc_t)rpcb_dec_getport,
                .p_arglen       = RPCB_mappingargs_sz,
                .p_replen       = RPCB_getportres_sz,
                .p_statidx      = RPCBPROC_GETPORT,
@@ -904,8 +869,8 @@ static struct rpc_procinfo rpcb_procedures2[] = {
 static struct rpc_procinfo rpcb_procedures3[] = {
        [RPCBPROC_SET] = {
                .p_proc         = RPCBPROC_SET,
-                .p_encode       = (kxdrproc_t)rpcb_enc_getaddr,
+                .p_encode       = (kxdreproc_t)rpcb_enc_getaddr,
-                .p_decode       = (kxdrproc_t)rpcb_dec_set,
+                .p_decode       = (kxdrdproc_t)rpcb_dec_set,
                .p_arglen       = RPCB_getaddrargs_sz,
                .p_replen       = RPCB_setres_sz,
                .p_statidx      = RPCBPROC_SET,
@@ -914,8 +879,8 @@ static struct rpc_procinfo rpcb_procedures3[] = {
        },
        [RPCBPROC_UNSET] = {
                .p_proc         = RPCBPROC_UNSET,
-                .p_encode       = (kxdrproc_t)rpcb_enc_getaddr,
+                .p_encode       = (kxdreproc_t)rpcb_enc_getaddr,
-                .p_decode       = (kxdrproc_t)rpcb_dec_set,
+                .p_decode       = (kxdrdproc_t)rpcb_dec_set,
                .p_arglen       = RPCB_getaddrargs_sz,
                .p_replen       = RPCB_setres_sz,
                .p_statidx      = RPCBPROC_UNSET,
@@ -924,8 +889,8 @@ static struct rpc_procinfo rpcb_procedures3[] = {
        },
        [RPCBPROC_GETADDR] = {
                .p_proc         = RPCBPROC_GETADDR,
-                .p_encode       = (kxdrproc_t)rpcb_enc_getaddr,
+                .p_encode       = (kxdreproc_t)rpcb_enc_getaddr,
-                .p_decode       = (kxdrproc_t)rpcb_dec_getaddr,
+                .p_decode       = (kxdrdproc_t)rpcb_dec_getaddr,
                .p_arglen       = RPCB_getaddrargs_sz,
                .p_replen       = RPCB_getaddrres_sz,
                .p_statidx      = RPCBPROC_GETADDR,
@@ -937,8 +902,8 @@ static struct rpc_procinfo rpcb_procedures3[] = {
 static struct rpc_procinfo rpcb_procedures4[] = {
        [RPCBPROC_SET] = {
                .p_proc         = RPCBPROC_SET,
-                .p_encode       = (kxdrproc_t)rpcb_enc_getaddr,
+                .p_encode       = (kxdreproc_t)rpcb_enc_getaddr,
-                .p_decode       = (kxdrproc_t)rpcb_dec_set,
+                .p_decode       = (kxdrdproc_t)rpcb_dec_set,
                .p_arglen       = RPCB_getaddrargs_sz,
                .p_replen       = RPCB_setres_sz,
                .p_statidx      = RPCBPROC_SET,
@@ -947,8 +912,8 @@ static struct rpc_procinfo rpcb_procedures4[] = {
        },
        [RPCBPROC_UNSET] = {
                .p_proc         = RPCBPROC_UNSET,
-                .p_encode       = (kxdrproc_t)rpcb_enc_getaddr,
+                .p_encode       = (kxdreproc_t)rpcb_enc_getaddr,
-                .p_decode       = (kxdrproc_t)rpcb_dec_set,
+                .p_decode       = (kxdrdproc_t)rpcb_dec_set,
                .p_arglen       = RPCB_getaddrargs_sz,
                .p_replen       = RPCB_setres_sz,
                .p_statidx      = RPCBPROC_UNSET,
@@ -957,8 +922,8 @@ static struct rpc_procinfo rpcb_procedures4[] = {
        },
        [RPCBPROC_GETADDR] = {
                .p_proc         = RPCBPROC_GETADDR,
-                .p_encode       = (kxdrproc_t)rpcb_enc_getaddr,
+                .p_encode       = (kxdreproc_t)rpcb_enc_getaddr,
-                .p_decode       = (kxdrproc_t)rpcb_dec_getaddr,
+                .p_decode       = (kxdrdproc_t)rpcb_dec_getaddr,
                .p_arglen       = RPCB_getaddrargs_sz,
                .p_replen       = RPCB_getaddrres_sz,
                .p_statidx      = RPCBPROC_GETADDR,
@@ -993,19 +958,19 @@ static struct rpcb_info rpcb_next_version6[] = {
 static struct rpc_version rpcb_version2 = {
        .number         = RPCBVERS_2,
-        .nrprocs        = RPCB_HIGHPROC_2,
+        .nrprocs        = ARRAY_SIZE(rpcb_procedures2),
        .procs          = rpcb_procedures2
 };
 static struct rpc_version rpcb_version3 = {
        .number         = RPCBVERS_3,
-        .nrprocs        = RPCB_HIGHPROC_3,
+        .nrprocs        = ARRAY_SIZE(rpcb_procedures3),
        .procs          = rpcb_procedures3
 };
 static struct rpc_version rpcb_version4 = {
        .number         = RPCBVERS_4,
-        .nrprocs        = RPCB_HIGHPROC_4,
+        .nrprocs        = ARRAY_SIZE(rpcb_procedures4),
        .procs          = rpcb_procedures4
 };
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 6359c42c4941..08e05a8ce025 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -488,10 +488,6 @@ svc_destroy(struct svc_serv *serv)
        if (svc_serv_is_pooled(serv))
                svc_pool_map_put();
-#if defined(CONFIG_NFS_V4_1)
-        svc_sock_destroy(serv->bc_xprt);
-#endif /* CONFIG_NFS_V4_1 */
        svc_unregister(serv);
        kfree(serv->sv_pools);
        kfree(serv);
@@ -1005,6 +1001,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
        rqstp->rq_splice_ok = 1;
        /* Will be turned off only when NFSv4 Sessions are used */
        rqstp->rq_usedeferral = 1;
+        rqstp->rq_dropme = false;
        /* Setup reply header */
        rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp);
@@ -1106,7 +1103,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
                *statp = procp->pc_func(rqstp, rqstp->rq_argp, rqstp->rq_resp);
                /* Encode reply */
-                if (*statp == rpc_drop_reply) {
+                if (rqstp->rq_dropme) {
                        if (procp->pc_release)
                                procp->pc_release(rqstp, NULL, rqstp->rq_resp);
                        goto dropit;
@@ -1147,7 +1144,6 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
 dropit:
        svc_authorise(rqstp);   /* doesn't hurt to call this twice */
        dprintk("svc: svc_process dropit\n");
-        svc_drop(rqstp);
        return 0;
 err_short_len:
@@ -1218,7 +1214,6 @@ svc_process(struct svc_rqst *rqstp)
        struct kvec             *resv = &rqstp->rq_res.head[0];
        struct svc_serv         *serv = rqstp->rq_server;
        u32                     dir;
-        int                     error;
        /*
         * Setup response xdr_buf.
@@ -1246,11 +1241,13 @@ svc_process(struct svc_rqst *rqstp)
                return 0;
        }
-        error = svc_process_common(rqstp, argv, resv);
+        /* Returns 1 for send, 0 for drop */
-        if (error <= 0)
+        if (svc_process_common(rqstp, argv, resv))
-                return error;
+                return svc_send(rqstp);
+        else {
-        return svc_send(rqstp);
+                svc_drop(rqstp);
+                return 0;
+        }
 }
 #if defined(CONFIG_NFS_V4_1)
@@ -1264,10 +1261,9 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
 {
        struct kvec     *argv = &rqstp->rq_arg.head[0];
        struct kvec     *resv = &rqstp->rq_res.head[0];
-        int             error;
        /* Build the svc_rqst used by the common processing routine */
-        rqstp->rq_xprt = serv->bc_xprt;
+        rqstp->rq_xprt = serv->sv_bc_xprt;
        rqstp->rq_xid = req->rq_xid;
        rqstp->rq_prot = req->rq_xprt->prot;
        rqstp->rq_server = serv;
@@ -1292,12 +1288,15 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
        svc_getu32(argv);       /* XID */
        svc_getnl(argv);        /* CALLDIR */
-        error = svc_process_common(rqstp, argv, resv);
+        /* Returns 1 for send, 0 for drop */
-        if (error <= 0)
+        if (svc_process_common(rqstp, argv, resv)) {
-                return error;
+                memcpy(&req->rq_snd_buf, &rqstp->rq_res,
+                                                sizeof(req->rq_snd_buf));
-        memcpy(&req->rq_snd_buf, &rqstp->rq_res, sizeof(req->rq_snd_buf));
+                return bc_send(req);
-        return bc_send(req);
+        } else {
+                /* Nothing to do to drop request */
+                return 0;
+        }
 }
 EXPORT_SYMBOL(bc_svc_process);
 #endif /* CONFIG_NFS_V4_1 */
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 3f2c5559ca1a..ab86b7927f84 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -13,6 +13,7 @@
 #include <linux/sunrpc/stats.h>
 #include <linux/sunrpc/svc_xprt.h>
 #include <linux/sunrpc/svcsock.h>
+#include <linux/sunrpc/xprt.h>
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
@@ -128,6 +129,9 @@ static void svc_xprt_free(struct kref *kref)
        if (test_bit(XPT_CACHE_AUTH, &xprt->xpt_flags))
                svcauth_unix_info_release(xprt);
        put_net(xprt->xpt_net);
+        /* See comment on corresponding get in xs_setup_bc_tcp(): */
+        if (xprt->xpt_bc_xprt)
+                xprt_put(xprt->xpt_bc_xprt);
        xprt->xpt_ops->xpo_free(xprt);
        module_put(owner);
 }
@@ -303,6 +307,15 @@ static void svc_thread_dequeue(struct svc_pool *pool, struct svc_rqst *rqstp)
        list_del(&rqstp->rq_list);
 }
+static bool svc_xprt_has_something_to_do(struct svc_xprt *xprt)
+{
+        if (xprt->xpt_flags & ((1<<XPT_CONN)|(1<<XPT_CLOSE)))
+                return true;
+        if (xprt->xpt_flags & ((1<<XPT_DATA)|(1<<XPT_DEFERRED)))
+                return xprt->xpt_ops->xpo_has_wspace(xprt);
+        return false;
+}
 /*
 * Queue up a transport with data pending. If there are idle nfsd
 * processes, wake 'em up.
@@ -315,8 +328,7 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
        struct svc_rqst *rqstp;
        int cpu;
-        if (!(xprt->xpt_flags &
+        if (!svc_xprt_has_something_to_do(xprt))
-              ((1<<XPT_CONN)|(1<<XPT_DATA)|(1<<XPT_CLOSE)|(1<<XPT_DEFERRED))))
                return;
        cpu = get_cpu();
@@ -343,28 +355,7 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
                dprintk("svc: transport %p busy, not enqueued\n", xprt);
                goto out_unlock;
        }
-        BUG_ON(xprt->xpt_pool != NULL);
-        xprt->xpt_pool = pool;
-        /* Handle pending connection */
-        if (test_bit(XPT_CONN, &xprt->xpt_flags))
-                goto process;
-        /* Handle close in-progress */
-        if (test_bit(XPT_CLOSE, &xprt->xpt_flags))
-                goto process;
-        /* Check if we have space to reply to a request */
-        if (!xprt->xpt_ops->xpo_has_wspace(xprt)) {
-                /* Don't enqueue while not enough space for reply */
-                dprintk("svc: no write space, transport %p  not enqueued\n",
-                        xprt);
-                xprt->xpt_pool = NULL;
-                clear_bit(XPT_BUSY, &xprt->xpt_flags);
-                goto out_unlock;
-        }
- process:
        if (!list_empty(&pool->sp_threads)) {
                rqstp = list_entry(pool->sp_threads.next,
                                   struct svc_rqst,
@@ -381,13 +372,11 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
                rqstp->rq_reserved = serv->sv_max_mesg;
                atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
                pool->sp_stats.threads_woken++;
-                BUG_ON(xprt->xpt_pool != pool);
                wake_up(&rqstp->rq_wait);
        } else {
                dprintk("svc: transport %p put into queue\n", xprt);
                list_add_tail(&xprt->xpt_ready, &pool->sp_sockets);
                pool->sp_stats.sockets_queued++;
-                BUG_ON(xprt->xpt_pool != pool);
        }
 out_unlock:
@@ -426,7 +415,6 @@ static struct svc_xprt *svc_xprt_dequeue(struct svc_pool *pool)
 void svc_xprt_received(struct svc_xprt *xprt)
 {
        BUG_ON(!test_bit(XPT_BUSY, &xprt->xpt_flags));
-        xprt->xpt_pool = NULL;
        /* As soon as we clear busy, the xprt could be closed and
         * 'put', so we need a reference to call svc_xprt_enqueue with:
         */
@@ -722,7 +710,10 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
        if (test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
                dprintk("svc_recv: found XPT_CLOSE\n");
                svc_delete_xprt(xprt);
-        } else if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
+                /* Leave XPT_BUSY set on the dead xprt: */
+                goto out;
+        }
+        if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
                struct svc_xprt *newxpt;
                newxpt = xprt->xpt_ops->xpo_accept(xprt);
                if (newxpt) {
@@ -747,28 +738,23 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                        spin_unlock_bh(&serv->sv_lock);
                        svc_xprt_received(newxpt);
                }
-                svc_xprt_received(xprt);
+        } else if (xprt->xpt_ops->xpo_has_wspace(xprt)) {
-        } else {
                dprintk("svc: server %p, pool %u, transport %p, inuse=%d\n",
                        rqstp, pool->sp_id, xprt,
                        atomic_read(&xprt->xpt_ref.refcount));
                rqstp->rq_deferred = svc_deferred_dequeue(xprt);
-                if (rqstp->rq_deferred) {
+                if (rqstp->rq_deferred)
-                        svc_xprt_received(xprt);
                        len = svc_deferred_recv(rqstp);
-                } else {
+                else
                        len = xprt->xpt_ops->xpo_recvfrom(rqstp);
-                        svc_xprt_received(xprt);
-                }
                dprintk("svc: got len=%d\n", len);
        }
+        svc_xprt_received(xprt);
        /* No data, incomplete (TCP) read, or accept() */
-        if (len == 0 || len == -EAGAIN) {
+        if (len == 0 || len == -EAGAIN)
-                rqstp->rq_res.len = 0;
+                goto out;
-                svc_xprt_release(rqstp);
-                return -EAGAIN;
-        }
        clear_bit(XPT_OLD, &xprt->xpt_flags);
        rqstp->rq_secure = svc_port_is_privileged(svc_addr(rqstp));
@@ -777,6 +763,10 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
        if (serv->sv_stats)
                serv->sv_stats->netcnt++;
        return len;
+out:
+        rqstp->rq_res.len = 0;
+        svc_xprt_release(rqstp);
+        return -EAGAIN;
 }
 EXPORT_SYMBOL_GPL(svc_recv);
@@ -935,7 +925,12 @@ void svc_close_xprt(struct svc_xprt *xprt)
        if (test_and_set_bit(XPT_BUSY, &xprt->xpt_flags))
                /* someone else will have to effect the close */
                return;
+        /*
+         * We expect svc_close_xprt() to work even when no threads are
+         * running (e.g., while configuring the server before starting
+         * any threads), so if the transport isn't busy, we delete
+         * it ourself:
+         */
        svc_delete_xprt(xprt);
 }
 EXPORT_SYMBOL_GPL(svc_close_xprt);
@@ -945,16 +940,16 @@ void svc_close_all(struct list_head *xprt_list)
        struct svc_xprt *xprt;
        struct svc_xprt *tmp;
+        /*
+         * The server is shutting down, and no more threads are running.
+         * svc_xprt_enqueue() might still be running, but at worst it
+         * will re-add the xprt to sp_sockets, which will soon get
+         * freed.  So we don't bother with any more locking, and don't
+         * leave the close to the (nonexistent) server threads:
+         */
        list_for_each_entry_safe(xprt, tmp, xprt_list, xpt_list) {
                set_bit(XPT_CLOSE, &xprt->xpt_flags);
-                if (test_bit(XPT_BUSY, &xprt->xpt_flags)) {
+                svc_delete_xprt(xprt);
-                        /* Waiting to be processed, but no threads left,
-                         * So just remove it from the waiting list
-                         */
-                        list_del_init(&xprt->xpt_ready);
-                        clear_bit(XPT_BUSY, &xprt->xpt_flags);
-                }
-                svc_close_xprt(xprt);
        }
 }
@@ -1028,6 +1023,7 @@ static struct cache_deferred_req *svc_defer(struct cache_req *req)
        }
        svc_xprt_get(rqstp->rq_xprt);
        dr->xprt = rqstp->rq_xprt;
+        rqstp->rq_dropme = true;
        dr->handle.revisit = svc_revisit;
        return &dr->handle;
@@ -1065,14 +1061,13 @@ static struct svc_deferred_req *svc_deferred_dequeue(struct svc_xprt *xprt)
        if (!test_bit(XPT_DEFERRED, &xprt->xpt_flags))
                return NULL;
        spin_lock(&xprt->xpt_lock);
-        clear_bit(XPT_DEFERRED, &xprt->xpt_flags);
        if (!list_empty(&xprt->xpt_deferred)) {
                dr = list_entry(xprt->xpt_deferred.next,
                                struct svc_deferred_req,
                                handle.recent);
                list_del_init(&dr->handle.recent);
-                set_bit(XPT_DEFERRED, &xprt->xpt_flags);
+        } else
-        }
+                clear_bit(XPT_DEFERRED, &xprt->xpt_flags);
        spin_unlock(&xprt->xpt_lock);
        return dr;
 }
diff --git a/net/sunrpc/svcauth.c b/net/sunrpc/svcauth.c
index 4e9393c24687..7963569fc04f 100644
--- a/net/sunrpc/svcauth.c
+++ b/net/sunrpc/svcauth.c
@@ -118,7 +118,6 @@ EXPORT_SYMBOL_GPL(svc_auth_unregister);
 #define DN_HASHBITS     6
 #define DN_HASHMAX      (1<<DN_HASHBITS)
-#define DN_HASHMASK     (DN_HASHMAX-1)
 static struct hlist_head        auth_domain_table[DN_HASHMAX];
 static spinlock_t       auth_domain_lock =
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 560677d187f1..30916b06c12b 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -30,7 +30,9 @@
 struct unix_domain {
        struct auth_domain      h;
+#ifdef CONFIG_NFSD_DEPRECATED
        int     addr_changes;
+#endif /* CONFIG_NFSD_DEPRECATED */
        /* other stuff later */
 };
@@ -64,7 +66,9 @@ struct auth_domain *unix_domain_find(char *name)
                        return NULL;
                }
                new->h.flavour = &svcauth_unix;
+#ifdef CONFIG_NFSD_DEPRECATED
                new->addr_changes = 0;
+#endif /* CONFIG_NFSD_DEPRECATED */
                rv = auth_domain_lookup(name, &new->h);
        }
 }
@@ -85,14 +89,15 @@ static void svcauth_unix_domain_release(struct auth_domain *dom)
 */
 #define IP_HASHBITS     8
 #define IP_HASHMAX      (1<<IP_HASHBITS)
-#define IP_HASHMASK     (IP_HASHMAX-1)
 struct ip_map {
        struct cache_head       h;
        char                    m_class[8]; /* e.g. "nfsd" */
        struct in6_addr         m_addr;
        struct unix_domain      *m_client;
+#ifdef CONFIG_NFSD_DEPRECATED
        int                     m_add_change;
+#endif /* CONFIG_NFSD_DEPRECATED */
 };
 static void ip_map_put(struct kref *kref)
@@ -146,7 +151,9 @@ static void update(struct cache_head *cnew, struct cache_head *citem)
        kref_get(&item->m_client->h.ref);
        new->m_client = item->m_client;
+#ifdef CONFIG_NFSD_DEPRECATED
        new->m_add_change = item->m_add_change;
+#endif /* CONFIG_NFSD_DEPRECATED */
 }
 static struct cache_head *ip_map_alloc(void)
 {
@@ -331,6 +338,7 @@ static int __ip_map_update(struct cache_detail *cd, struct ip_map *ipm,
        ip.h.flags = 0;
        if (!udom)
                set_bit(CACHE_NEGATIVE, &ip.h.flags);
+#ifdef CONFIG_NFSD_DEPRECATED
        else {
                ip.m_add_change = udom->addr_changes;
                /* if this is from the legacy set_client system call,
@@ -339,6 +347,7 @@ static int __ip_map_update(struct cache_detail *cd, struct ip_map *ipm,
                if (expiry == NEVER)
                        ip.m_add_change++;
        }
+#endif /* CONFIG_NFSD_DEPRECATED */
        ip.h.expiry_time = expiry;
        ch = sunrpc_cache_update(cd, &ip.h, &ipm->h,
                                 hash_str(ipm->m_class, IP_HASHBITS) ^
@@ -358,6 +367,7 @@ static inline int ip_map_update(struct net *net, struct ip_map *ipm,
        return __ip_map_update(sn->ip_map_cache, ipm, udom, expiry);
 }
+#ifdef CONFIG_NFSD_DEPRECATED
 int auth_unix_add_addr(struct net *net, struct in6_addr *addr, struct auth_domain *dom)
 {
        struct unix_domain *udom;
@@ -402,8 +412,7 @@ struct auth_domain *auth_unix_lookup(struct net *net, struct in6_addr *addr)
                return NULL;
        if ((ipm->m_client->addr_changes - ipm->m_add_change) >0) {
-                if (test_and_set_bit(CACHE_NEGATIVE, &ipm->h.flags) == 0)
+                sunrpc_invalidate(&ipm->h, sn->ip_map_cache);
-                        auth_domain_put(&ipm->m_client->h);
                rv = NULL;
        } else {
                rv = &ipm->m_client->h;
@@ -413,6 +422,7 @@ struct auth_domain *auth_unix_lookup(struct net *net, struct in6_addr *addr)
        return rv;
 }
 EXPORT_SYMBOL_GPL(auth_unix_lookup);
+#endif /* CONFIG_NFSD_DEPRECATED */
 void svcauth_unix_purge(void)
 {
@@ -497,7 +507,6 @@ svcauth_unix_info_release(struct svc_xprt *xpt)
 */
 #define GID_HASHBITS    8
 #define GID_HASHMAX     (1<<GID_HASHBITS)
-#define GID_HASHMASK    (GID_HASHMAX - 1)
 struct unix_gid {
        struct cache_head       h;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 07919e16be3e..7bd3bbba4710 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -66,6 +66,13 @@ static void		svc_sock_free(struct svc_xprt *);
 static struct svc_xprt *svc_create_socket(struct svc_serv *, int,
                                          struct net *, struct sockaddr *,
                                          int, int);
+#if defined(CONFIG_NFS_V4_1)
+static struct svc_xprt *svc_bc_create_socket(struct svc_serv *, int,
+                                             struct net *, struct sockaddr *,
+                                             int, int);
+static void svc_bc_sock_free(struct svc_xprt *xprt);
+#endif /* CONFIG_NFS_V4_1 */
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 static struct lock_class_key svc_key[2];
 static struct lock_class_key svc_slock_key[2];
@@ -324,19 +331,21 @@ int svc_sock_names(struct svc_serv *serv, char *buf, const size_t buflen,
                        len = onelen;
                        break;
                }
-                if (toclose && strcmp(toclose, buf + len) == 0)
+                if (toclose && strcmp(toclose, buf + len) == 0) {
                        closesk = svsk;
-                else
+                        svc_xprt_get(&closesk->sk_xprt);
+                } else
                        len += onelen;
        }
        spin_unlock_bh(&serv->sv_lock);
-        if (closesk)
+        if (closesk) {
                /* Should unregister with portmap, but you cannot
                 * unregister just one protocol...
                 */
                svc_close_xprt(&closesk->sk_xprt);
-        else if (toclose)
+                svc_xprt_put(&closesk->sk_xprt);
+        } else if (toclose)
                return -ENOENT;
        return len;
 }
@@ -985,15 +994,17 @@ static int svc_process_calldir(struct svc_sock *svsk, struct svc_rqst *rqstp,
                vec[0] = rqstp->rq_arg.head[0];
        } else {
                /* REPLY */
-                if (svsk->sk_bc_xprt)
+                struct rpc_xprt *bc_xprt = svsk->sk_xprt.xpt_bc_xprt;
-                        req = xprt_lookup_rqst(svsk->sk_bc_xprt, xid);
+                if (bc_xprt)
+                        req = xprt_lookup_rqst(bc_xprt, xid);
                if (!req) {
                        printk(KERN_NOTICE
                                "%s: Got unrecognized reply: "
-                                "calldir 0x%x sk_bc_xprt %p xid %08x\n",
+                                "calldir 0x%x xpt_bc_xprt %p xid %08x\n",
                                __func__, ntohl(calldir),
-                                svsk->sk_bc_xprt, xid);
+                                bc_xprt, xid);
                        vec[0] = rqstp->rq_arg.head[0];
                        goto out;
                }
@@ -1184,6 +1195,57 @@ static struct svc_xprt *svc_tcp_create(struct svc_serv *serv,
        return svc_create_socket(serv, IPPROTO_TCP, net, sa, salen, flags);
 }
+#if defined(CONFIG_NFS_V4_1)
+static struct svc_xprt *svc_bc_create_socket(struct svc_serv *, int,
+                                             struct net *, struct sockaddr *,
+                                             int, int);
+static void svc_bc_sock_free(struct svc_xprt *xprt);
+static struct svc_xprt *svc_bc_tcp_create(struct svc_serv *serv,
+                                       struct net *net,
+                                       struct sockaddr *sa, int salen,
+                                       int flags)
+{
+        return svc_bc_create_socket(serv, IPPROTO_TCP, net, sa, salen, flags);
+}
+static void svc_bc_tcp_sock_detach(struct svc_xprt *xprt)
+{
+}
+static struct svc_xprt_ops svc_tcp_bc_ops = {
+        .xpo_create = svc_bc_tcp_create,
+        .xpo_detach = svc_bc_tcp_sock_detach,
+        .xpo_free = svc_bc_sock_free,
+        .xpo_prep_reply_hdr = svc_tcp_prep_reply_hdr,
+};
+static struct svc_xprt_class svc_tcp_bc_class = {
+        .xcl_name = "tcp-bc",
+        .xcl_owner = THIS_MODULE,
+        .xcl_ops = &svc_tcp_bc_ops,
+        .xcl_max_payload = RPCSVC_MAXPAYLOAD_TCP,
+};
+static void svc_init_bc_xprt_sock(void)
+{
+        svc_reg_xprt_class(&svc_tcp_bc_class);
+}
+static void svc_cleanup_bc_xprt_sock(void)
+{
+        svc_unreg_xprt_class(&svc_tcp_bc_class);
+}
+#else /* CONFIG_NFS_V4_1 */
+static void svc_init_bc_xprt_sock(void)
+{
+}
+static void svc_cleanup_bc_xprt_sock(void)
+{
+}
+#endif /* CONFIG_NFS_V4_1 */
 static struct svc_xprt_ops svc_tcp_ops = {
        .xpo_create = svc_tcp_create,
        .xpo_recvfrom = svc_tcp_recvfrom,
@@ -1207,12 +1269,14 @@ void svc_init_xprt_sock(void)
 {
        svc_reg_xprt_class(&svc_tcp_class);
        svc_reg_xprt_class(&svc_udp_class);
+        svc_init_bc_xprt_sock();
 }
 void svc_cleanup_xprt_sock(void)
 {
        svc_unreg_xprt_class(&svc_tcp_class);
        svc_unreg_xprt_class(&svc_udp_class);
+        svc_cleanup_bc_xprt_sock();
 }
 static void svc_tcp_init(struct svc_sock *svsk, struct svc_serv *serv)
@@ -1509,41 +1573,45 @@ static void svc_sock_free(struct svc_xprt *xprt)
        kfree(svsk);
 }
+#if defined(CONFIG_NFS_V4_1)
 /*
- * Create a svc_xprt.
+ * Create a back channel svc_xprt which shares the fore channel socket.
- *
- * For internal use only (e.g. nfsv4.1 backchannel).
- * Callers should typically use the xpo_create() method.
 */
-struct svc_xprt *svc_sock_create(struct svc_serv *serv, int prot)
+static struct svc_xprt *svc_bc_create_socket(struct svc_serv *serv,
+                                             int protocol,
+                                             struct net *net,
+                                             struct sockaddr *sin, int len,
+                                             int flags)
 {
        struct svc_sock *svsk;
-        struct svc_xprt *xprt = NULL;
+        struct svc_xprt *xprt;
+        if (protocol != IPPROTO_TCP) {
+                printk(KERN_WARNING "svc: only TCP sockets"
+                        " supported on shared back channel\n");
+                return ERR_PTR(-EINVAL);
+        }
-        dprintk("svc: %s\n", __func__);
        svsk = kzalloc(sizeof(*svsk), GFP_KERNEL);
        if (!svsk)
-                goto out;
+                return ERR_PTR(-ENOMEM);
        xprt = &svsk->sk_xprt;
-        if (prot == IPPROTO_TCP)
+        svc_xprt_init(&svc_tcp_bc_class, xprt, serv);
-                svc_xprt_init(&svc_tcp_class, xprt, serv);
-        else if (prot == IPPROTO_UDP)
+        serv->sv_bc_xprt = xprt;
-                svc_xprt_init(&svc_udp_class, xprt, serv);
-        else
-                BUG();
-out:
-        dprintk("svc: %s return %p\n", __func__, xprt);
        return xprt;
 }
-EXPORT_SYMBOL_GPL(svc_sock_create);
 /*
- * Destroy a svc_sock.
+ * Free a back channel svc_sock.
 */
-void svc_sock_destroy(struct svc_xprt *xprt)
+static void svc_bc_sock_free(struct svc_xprt *xprt)
 {
-        if (xprt)
+        if (xprt) {
+                kfree(xprt->xpt_bc_sid);
                kfree(container_of(xprt, struct svc_sock, sk_xprt));
+        }
 }
-EXPORT_SYMBOL_GPL(svc_sock_destroy);
+#endif /* CONFIG_NFS_V4_1 */
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index cd9e841e7492..679cd674b81d 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -552,6 +552,74 @@ void xdr_write_pages(struct xdr_stream *xdr, struct page **pages, unsigned int b
 }
 EXPORT_SYMBOL_GPL(xdr_write_pages);
+static void xdr_set_iov(struct xdr_stream *xdr, struct kvec *iov,
+                __be32 *p, unsigned int len)
+{
+        if (len > iov->iov_len)
+                len = iov->iov_len;
+        if (p == NULL)
+                p = (__be32*)iov->iov_base;
+        xdr->p = p;
+        xdr->end = (__be32*)(iov->iov_base + len);
+        xdr->iov = iov;
+        xdr->page_ptr = NULL;
+}
+static int xdr_set_page_base(struct xdr_stream *xdr,
+                unsigned int base, unsigned int len)
+{
+        unsigned int pgnr;
+        unsigned int maxlen;
+        unsigned int pgoff;
+        unsigned int pgend;
+        void *kaddr;
+        maxlen = xdr->buf->page_len;
+        if (base >= maxlen)
+                return -EINVAL;
+        maxlen -= base;
+        if (len > maxlen)
+                len = maxlen;
+        base += xdr->buf->page_base;
+        pgnr = base >> PAGE_SHIFT;
+        xdr->page_ptr = &xdr->buf->pages[pgnr];
+        kaddr = page_address(*xdr->page_ptr);
+        pgoff = base & ~PAGE_MASK;
+        xdr->p = (__be32*)(kaddr + pgoff);
+        pgend = pgoff + len;
+        if (pgend > PAGE_SIZE)
+                pgend = PAGE_SIZE;
+        xdr->end = (__be32*)(kaddr + pgend);
+        xdr->iov = NULL;
+        return 0;
+}
+static void xdr_set_next_page(struct xdr_stream *xdr)
+{
+        unsigned int newbase;
+        newbase = (1 + xdr->page_ptr - xdr->buf->pages) << PAGE_SHIFT;
+        newbase -= xdr->buf->page_base;
+        if (xdr_set_page_base(xdr, newbase, PAGE_SIZE) < 0)
+                xdr_set_iov(xdr, xdr->buf->tail, NULL, xdr->buf->len);
+}
+static bool xdr_set_next_buffer(struct xdr_stream *xdr)
+{
+        if (xdr->page_ptr != NULL)
+                xdr_set_next_page(xdr);
+        else if (xdr->iov == xdr->buf->head) {
+                if (xdr_set_page_base(xdr, 0, PAGE_SIZE) < 0)
+                        xdr_set_iov(xdr, xdr->buf->tail, NULL, xdr->buf->len);
+        }
+        return xdr->p != xdr->end;
+}
 /**
 * xdr_init_decode - Initialize an xdr_stream for decoding data.
 * @xdr: pointer to xdr_stream struct
@@ -560,41 +628,67 @@ EXPORT_SYMBOL_GPL(xdr_write_pages);
 */
 void xdr_init_decode(struct xdr_stream *xdr, struct xdr_buf *buf, __be32 *p)
 {
-        struct kvec *iov = buf->head;
-        unsigned int len = iov->iov_len;
-        if (len > buf->len)
-                len = buf->len;
        xdr->buf = buf;
-        xdr->iov = iov;
+        xdr->scratch.iov_base = NULL;
-        xdr->p = p;
+        xdr->scratch.iov_len = 0;
-        xdr->end = (__be32 *)((char *)iov->iov_base + len);
+        if (buf->head[0].iov_len != 0)
+                xdr_set_iov(xdr, buf->head, p, buf->len);
+        else if (buf->page_len != 0)
+                xdr_set_page_base(xdr, 0, buf->len);
 }
 EXPORT_SYMBOL_GPL(xdr_init_decode);
-/**
+static __be32 * __xdr_inline_decode(struct xdr_stream *xdr, size_t nbytes)
- * xdr_inline_peek - Allow read-ahead in the XDR data stream
- * @xdr: pointer to xdr_stream struct
- * @nbytes: number of bytes of data to decode
- *
- * Check if the input buffer is long enough to enable us to decode
- * 'nbytes' more bytes of data starting at the current position.
- * If so return the current pointer without updating the current
- * pointer position.
- */
-__be32 * xdr_inline_peek(struct xdr_stream *xdr, size_t nbytes)
 {
        __be32 *p = xdr->p;
        __be32 *q = p + XDR_QUADLEN(nbytes);
        if (unlikely(q > xdr->end || q < p))
                return NULL;
+        xdr->p = q;
        return p;
 }
-EXPORT_SYMBOL_GPL(xdr_inline_peek);
 /**
- * xdr_inline_decode - Retrieve non-page XDR data to decode
+ * xdr_set_scratch_buffer - Attach a scratch buffer for decoding data.
+ * @xdr: pointer to xdr_stream struct
+ * @buf: pointer to an empty buffer
+ * @buflen: size of 'buf'
+ *
+ * The scratch buffer is used when decoding from an array of pages.
+ * If an xdr_inline_decode() call spans across page boundaries, then
+ * we copy the data into the scratch buffer in order to allow linear
+ * access.
+ */
+void xdr_set_scratch_buffer(struct xdr_stream *xdr, void *buf, size_t buflen)
+{
+        xdr->scratch.iov_base = buf;
+        xdr->scratch.iov_len = buflen;
+}
+EXPORT_SYMBOL_GPL(xdr_set_scratch_buffer);
+static __be32 *xdr_copy_to_scratch(struct xdr_stream *xdr, size_t nbytes)
+{
+        __be32 *p;
+        void *cpdest = xdr->scratch.iov_base;
+        size_t cplen = (char *)xdr->end - (char *)xdr->p;
+        if (nbytes > xdr->scratch.iov_len)
+                return NULL;
+        memcpy(cpdest, xdr->p, cplen);
+        cpdest += cplen;
+        nbytes -= cplen;
+        if (!xdr_set_next_buffer(xdr))
+                return NULL;
+        p = __xdr_inline_decode(xdr, nbytes);
+        if (p == NULL)
+                return NULL;
+        memcpy(cpdest, p, nbytes);
+        return xdr->scratch.iov_base;
+}
+/**
+ * xdr_inline_decode - Retrieve XDR data to decode
 * @xdr: pointer to xdr_stream struct
 * @nbytes: number of bytes of data to decode
 *
@@ -605,13 +699,16 @@ EXPORT_SYMBOL_GPL(xdr_inline_peek);
 */
 __be32 * xdr_inline_decode(struct xdr_stream *xdr, size_t nbytes)
 {
-        __be32 *p = xdr->p;
+        __be32 *p;
-        __be32 *q = p + XDR_QUADLEN(nbytes);
-        if (unlikely(q > xdr->end || q < p))
+        if (nbytes == 0)
+                return xdr->p;
+        if (xdr->p == xdr->end && !xdr_set_next_buffer(xdr))
                return NULL;
-        xdr->p = q;
+        p = __xdr_inline_decode(xdr, nbytes);
-        return p;
+        if (p != NULL)
+                return p;
+        return xdr_copy_to_scratch(xdr, nbytes);
 }
 EXPORT_SYMBOL_GPL(xdr_inline_decode);
@@ -671,16 +768,12 @@ EXPORT_SYMBOL_GPL(xdr_read_pages);
 */
 void xdr_enter_page(struct xdr_stream *xdr, unsigned int len)
 {
-        char * kaddr = page_address(xdr->buf->pages[0]);
        xdr_read_pages(xdr, len);
        /*
         * Position current pointer at beginning of tail, and
         * set remaining message length.
         */
-        if (len > PAGE_CACHE_SIZE - xdr->buf->page_base)
+        xdr_set_page_base(xdr, 0, len);
-                len = PAGE_CACHE_SIZE - xdr->buf->page_base;
-        xdr->p = (__be32 *)(kaddr + xdr->buf->page_base);
-        xdr->end = (__be32 *)((char *)xdr->p + len);
 }
 EXPORT_SYMBOL_GPL(xdr_enter_page);
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 4c8f18aff7c3..856274d7e85c 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -965,6 +965,7 @@ struct rpc_xprt *xprt_alloc(struct net *net, int size, int max_req)
        xprt = kzalloc(size, GFP_KERNEL);
        if (xprt == NULL)
                goto out;
+        kref_init(&xprt->kref);
        xprt->max_reqs = max_req;
        xprt->slot = kcalloc(max_req, sizeof(struct rpc_rqst), GFP_KERNEL);
@@ -1101,8 +1102,10 @@ found:
                                -PTR_ERR(xprt));
                return xprt;
        }
+        if (test_and_set_bit(XPRT_INITIALIZED, &xprt->state))
+                /* ->setup returned a pre-initialized xprt: */
+                return xprt;
-        kref_init(&xprt->kref);
        spin_lock_init(&xprt->transport_lock);
        spin_lock_init(&xprt->reserve_lock);
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 96549df836ee..c431f5a57960 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2359,6 +2359,15 @@ static struct rpc_xprt *xs_setup_bc_tcp(struct xprt_create *args)
        struct svc_sock *bc_sock;
        struct rpc_xprt *ret;
+        if (args->bc_xprt->xpt_bc_xprt) {
+                /*
+                 * This server connection already has a backchannel
+                 * export; we can't create a new one, as we wouldn't be
+                 * able to match replies based on xid any more.  So,
+                 * reuse the already-existing one:
+                 */
+                 return args->bc_xprt->xpt_bc_xprt;
+        }
        xprt = xs_setup_xprt(args, xprt_tcp_slot_table_entries);
        if (IS_ERR(xprt))
                return xprt;
@@ -2375,16 +2384,6 @@ static struct rpc_xprt *xs_setup_bc_tcp(struct xprt_create *args)
        xprt->reestablish_timeout = 0;
        xprt->idle_timeout = 0;
-        /*
-         * The backchannel uses the same socket connection as the
-         * forechannel
-         */
-        xprt->bc_xprt = args->bc_xprt;
-        bc_sock = container_of(args->bc_xprt, struct svc_sock, sk_xprt);
-        bc_sock->sk_bc_xprt = xprt;
-        transport->sock = bc_sock->sk_sock;
-        transport->inet = bc_sock->sk_sk;
        xprt->ops = &bc_tcp_ops;
        switch (addr->sa_family) {
@@ -2407,6 +2406,20 @@ static struct rpc_xprt *xs_setup_bc_tcp(struct xprt_create *args)
                        xprt->address_strings[RPC_DISPLAY_PROTO]);
        /*
+         * Once we've associated a backchannel xprt with a connection,
+         * we want to keep it around as long as long as the connection
+         * lasts, in case we need to start using it for a backchannel
+         * again; this reference won't be dropped until bc_xprt is
+         * destroyed.
+         */
+        xprt_get(xprt);
+        args->bc_xprt->xpt_bc_xprt = xprt;
+        xprt->bc_xprt = args->bc_xprt;
+        bc_sock = container_of(args->bc_xprt, struct svc_sock, sk_xprt);
+        transport->sock = bc_sock->sk_sock;
+        transport->inet = bc_sock->sk_sk;
+        /*
         * Since we don't want connections for the backchannel, we set
         * the xprt status to connected
         */
@@ -2415,6 +2428,7 @@ static struct rpc_xprt *xs_setup_bc_tcp(struct xprt_create *args)
        if (try_module_get(THIS_MODULE))
                return xprt;
+        xprt_put(xprt);
        ret = ERR_PTR(-EINVAL);
 out_err:
        xprt_free(xprt);
diff --git a/net/wireless/core.c b/net/wireless/core.c
index e9a5f8ca4c27..fe01de29bfe8 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -718,13 +718,6 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                        wdev->ps = false;
                /* allow mac80211 to determine the timeout */
                wdev->ps_timeout = -1;
-                if (rdev->ops->set_power_mgmt)
-                        if (rdev->ops->set_power_mgmt(wdev->wiphy, dev,
-                                                      wdev->ps,
-                                                      wdev->ps_timeout)) {
-                                /* assume this means it's off */
-                                wdev->ps = false;
-                        }
                if (!dev->ethtool_ops)
                        dev->ethtool_ops = &cfg80211_ethtool_ops;
@@ -813,6 +806,19 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                rdev->opencount++;
                mutex_unlock(&rdev->devlist_mtx);
                cfg80211_unlock_rdev(rdev);
+                /*
+                 * Configure power management to the driver here so that its
+                 * correctly set also after interface type changes etc.
+                 */
+                if (wdev->iftype == NL80211_IFTYPE_STATION &&
+                    rdev->ops->set_power_mgmt)
+                        if (rdev->ops->set_power_mgmt(wdev->wiphy, dev,
+                                                      wdev->ps,
+                                                      wdev->ps_timeout)) {
+                                /* assume this means it's off */
+                                wdev->ps = false;
+                        }
                break;
        case NETDEV_UNREGISTER:
                /*
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 9b62710891a2..864ddfbeff2f 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2718,7 +2718,7 @@ static int nl80211_get_mesh_config(struct sk_buff *skb,
        hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
                             NL80211_CMD_GET_MESH_CONFIG);
        if (!hdr)
-                goto nla_put_failure;
+                goto out;
        pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
        if (!pinfoattr)
                goto nla_put_failure;
@@ -2759,6 +2759,7 @@ static int nl80211_get_mesh_config(struct sk_buff *skb,
 nla_put_failure:
        genlmsg_cancel(msg, hdr);
+ out:
        nlmsg_free(msg);
        return -ENOBUFS;
 }
@@ -2954,7 +2955,7 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
        hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
                             NL80211_CMD_GET_REG);
        if (!hdr)
-                goto nla_put_failure;
+                goto put_failure;
        NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
                cfg80211_regdomain->alpha2);
@@ -3001,6 +3002,7 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
 nla_put_failure:
        genlmsg_cancel(msg, hdr);
+put_failure:
        nlmsg_free(msg);
        err = -EMSGSIZE;
 out:
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 37693b6ef23a..c565689f0b9f 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1801,9 +1801,9 @@ void regulatory_hint_disconnect(void)
 static bool freq_is_chan_12_13_14(u16 freq)
 {
-        if (freq == ieee80211_channel_to_frequency(12) ||
+        if (freq == ieee80211_channel_to_frequency(12, IEEE80211_BAND_2GHZ) ||
-            freq == ieee80211_channel_to_frequency(13) ||
+            freq == ieee80211_channel_to_frequency(13, IEEE80211_BAND_2GHZ) ||
-            freq == ieee80211_channel_to_frequency(14))
+            freq == ieee80211_channel_to_frequency(14, IEEE80211_BAND_2GHZ))
                return true;
        return false;
 }
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 7620ae2fcf18..6a750bc6bcfe 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -29,29 +29,37 @@ ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
 }
 EXPORT_SYMBOL(ieee80211_get_response_rate);
-int ieee80211_channel_to_frequency(int chan)
+int ieee80211_channel_to_frequency(int chan, enum ieee80211_band band)
 {
-        if (chan < 14)
+        /* see 802.11 17.3.8.3.2 and Annex J
-                return 2407 + chan * 5;
+         * there are overlapping channel numbers in 5GHz and 2GHz bands */
+        if (band == IEEE80211_BAND_5GHZ) {
-        if (chan == 14)
+                if (chan >= 182 && chan <= 196)
-                return 2484;
+                        return 4000 + chan * 5;
+                else
-        /* FIXME: 802.11j 17.3.8.3.2 */
+                        return 5000 + chan * 5;
-        return (chan + 1000) * 5;
+        } else { /* IEEE80211_BAND_2GHZ */
+                if (chan == 14)
+                        return 2484;
+                else if (chan < 14)
+                        return 2407 + chan * 5;
+                else
+                        return 0; /* not supported */
+        }
 }
 EXPORT_SYMBOL(ieee80211_channel_to_frequency);
 int ieee80211_frequency_to_channel(int freq)
 {
+        /* see 802.11 17.3.8.3.2 and Annex J */
        if (freq == 2484)
                return 14;
+        else if (freq < 2484)
-        if (freq < 2484)
                return (freq - 2407) / 5;
+        else if (freq >= 4910 && freq <= 4980)
-        /* FIXME: 802.11j 17.3.8.3.2 */
+                return (freq - 4000) / 5;
-        return freq/5 - 1000;
+        else
+                return (freq - 5000) / 5;
 }
 EXPORT_SYMBOL(ieee80211_frequency_to_channel);
@@ -159,12 +167,15 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
        /*
         * Disallow pairwise keys with non-zero index unless it's WEP
-         * (because current deployments use pairwise WEP keys with
+         * or a vendor specific cipher (because current deployments use
-         * non-zero indizes but 802.11i clearly specifies to use zero)
+         * pairwise WEP keys with non-zero indices and for vendor specific
+         * ciphers this should be validated in the driver or hardware level
+         * - but 802.11i clearly specifies to use zero)
         */
        if (pairwise && key_idx &&
-            params->cipher != WLAN_CIPHER_SUITE_WEP40 &&
+            ((params->cipher == WLAN_CIPHER_SUITE_TKIP) ||
-            params->cipher != WLAN_CIPHER_SUITE_WEP104)
+             (params->cipher == WLAN_CIPHER_SUITE_CCMP) ||
+             (params->cipher == WLAN_CIPHER_SUITE_AES_CMAC)))
                return -EINVAL;
        switch (params->cipher) {
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 3e5dbd4e4cd5..7f1f4ec49041 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -267,9 +267,12 @@ int cfg80211_wext_freq(struct wiphy *wiphy, struct iw_freq *freq)
         * -EINVAL for impossible things.
         */
        if (freq->e == 0) {
+                enum ieee80211_band band = IEEE80211_BAND_2GHZ;
                if (freq->m < 0)
                        return 0;
-                return ieee80211_channel_to_frequency(freq->m);
+                if (freq->m > 14)
+                        band = IEEE80211_BAND_5GHZ;
+                return ieee80211_channel_to_frequency(freq->m, band);
        } else {
                int i, div = 1000000;
                for (i = 0; i < freq->e; i++)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 6a8da81ff66f..d5e1e0b08890 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -26,6 +26,7 @@
 #include <net/sock.h>
 #include <net/xfrm.h>
 #include <net/netlink.h>
+#include <net/ah.h>
 #include <asm/uaccess.h>
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 #include <linux/in6.h>
@@ -302,7 +303,8 @@ static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
        algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
        if (!algo)
                return -ENOSYS;
-        if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
+        if ((ualg->alg_trunc_len / 8) > MAX_AH_AUTH_LEN ||
+            ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
                return -EINVAL;
        *props = algo->desc.sadb_alg_id;